@hasna/cloud 0.1.31 → 0.1.32

package/dist/cli/index.js

@@ -6158,7 +6158,7 @@ var require_arrayParser = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/pg-types/node_modules/postgres-date/index.js
+// node_modules/postgres-date/index.js
 var require_postgres_date = __commonJS((exports, module) => {
   var DATE_TIME = /(\d{1,})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})(\.\d{1,})?.*?( BC)?$/;
   var DATE = /^(\d{1,})-(\d{2})-(\d{2})( BC)?$/;
@@ -6260,7 +6260,7 @@ var require_mutable = __commonJS((exports, module) => {
   }
 });
 
-// node_modules/pg-types/node_modules/postgres-interval/index.js
+// node_modules/postgres-interval/index.js
 var require_postgres_interval = __commonJS((exports, module) => {
   var extend = require_mutable();
   module.exports = PostgresInterval;
@@ -6352,7 +6352,7 @@ var require_postgres_interval = __commonJS((exports, module) => {
   }
 });
 
-// node_modules/pg-types/node_modules/postgres-bytea/index.js
+// node_modules/postgres-bytea/index.js
 var require_postgres_bytea = __commonJS((exports, module) => {
   var bufferFrom = Buffer.from || Buffer;
   module.exports = function parseBytea(input) {
@@ -11254,6 +11254,32 @@ function getDbPath(serviceName) {
   const dir = getDataDir(serviceName);
   return join(dir, `${serviceName}.db`);
 }
+function migrateDotfile(serviceName) {
+  const legacyDir = join(homedir(), `.${serviceName}`);
+  const newDir = join(HASNA_DIR, serviceName);
+  if (!existsSync(legacyDir))
+    return [];
+  if (existsSync(newDir))
+    return [];
+  mkdirSync(newDir, { recursive: true });
+  const migrated = [];
+  copyDirRecursive(legacyDir, newDir, legacyDir, migrated);
+  return migrated;
+}
+function copyDirRecursive(src, dest, root, migrated) {
+  const entries = readdirSync(src, { withFileTypes: true });
+  for (const entry of entries) {
+    const srcPath = join(src, entry.name);
+    const destPath = join(dest, entry.name);
+    if (entry.isDirectory()) {
+      mkdirSync(destPath, { recursive: true });
+      copyDirRecursive(srcPath, destPath, root, migrated);
+    } else {
+      copyFileSync(srcPath, destPath);
+      migrated.push(relative(root, srcPath));
+    }
+  }
+}
 function getHasnaDir() {
   mkdirSync(HASNA_DIR, { recursive: true });
   return HASNA_DIR;
@@ -11263,111 +11289,28 @@ var init_dotfile = __esm(() => {
   HASNA_DIR = join(homedir(), ".hasna");
 });
 
-// src/config.ts
-var exports_config = {};
-__export(exports_config, {
-  saveCloudConfig: () => saveCloudConfig2,
-  getConnectionString: () => getConnectionString2,
-  getConfigPath: () => getConfigPath,
-  getConfigDir: () => getConfigDir,
-  getCloudConfig: () => getCloudConfig2,
-  createDatabase: () => createDatabase2,
-  CloudConfigSchema: () => CloudConfigSchema2
-});
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
-function getConfigDir() {
-  return CONFIG_DIR2;
-}
-function getConfigPath() {
-  return CONFIG_PATH2;
-}
-function getCloudConfig2() {
-  if (!existsSync3(CONFIG_PATH2)) {
-    return CloudConfigSchema2.parse({});
-  }
-  try {
-    const raw = readFileSync2(CONFIG_PATH2, "utf-8");
-    return CloudConfigSchema2.parse(JSON.parse(raw));
-  } catch {
-    return CloudConfigSchema2.parse({});
-  }
-}
-function saveCloudConfig2(config) {
-  mkdirSync3(CONFIG_DIR2, { recursive: true });
-  writeFileSync2(CONFIG_PATH2, JSON.stringify(config, null, 2) + `
-`, "utf-8");
-}
-function getConnectionString2(dbName) {
-  const config = getCloudConfig2();
-  const { host, port, username, password_env, ssl } = config.rds;
-  if (!host || !username) {
-    throw new Error("Cloud RDS not configured. Run `cloud setup` to configure.");
-  }
-  const password = process.env[password_env];
-  if (password === undefined || password === "") {
-    throw new Error(`RDS password not set. Export ${password_env} in your shell or add it to ~/.secrets/hasna/rds/live.env`);
-  }
-  const sslParam = ssl ? "?sslmode=require" : "";
-  return `postgres://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbName}${sslParam}`;
-}
-function createDatabase2(options) {
-  const config = getCloudConfig2();
-  const mode = options.mode ?? config.mode;
-  if (mode === "cloud") {
-    const connStr = options.pgConnectionString ?? getConnectionString2(options.service);
-    return new PgAdapter(connStr);
-  }
-  const dbPath = options.sqlitePath ?? getDbPath(options.service);
-  return new SqliteAdapter(dbPath);
-}
-var CloudConfigSchema2, CONFIG_DIR2, CONFIG_PATH2;
-var init_config = __esm(() => {
-  init_zod();
-  init_adapter();
-  init_dotfile();
-  CloudConfigSchema2 = exports_external.object({
-    rds: exports_external.object({
-      host: exports_external.string().default(""),
-      port: exports_external.number().default(5432),
-      username: exports_external.string().default(""),
-      password_env: exports_external.string().default("HASNA_RDS_PASSWORD"),
-      ssl: exports_external.boolean().default(true)
-    }).default({}),
-    mode: exports_external.enum(["local", "cloud", "hybrid"]).default("hybrid"),
-    auto_sync_interval_minutes: exports_external.number().default(0),
-    feedback_endpoint: exports_external.string().default("https://feedback.hasna.com/api/v1/feedback"),
-    sync: exports_external.object({
-      schedule_minutes: exports_external.number().default(0)
-    }).default({})
-  });
-  CONFIG_DIR2 = join3(homedir3(), ".hasna", "cloud");
-  CONFIG_PATH2 = join3(CONFIG_DIR2, "config.json");
-});
-
 // src/discover.ts
 var exports_discover = {};
 __export(exports_discover, {
-  isSyncExcludedTable: () => isSyncExcludedTable2,
+  isSyncExcludedTable: () => isSyncExcludedTable,
   getServiceDbPath: () => getServiceDbPath,
-  discoverSyncableServices: () => discoverSyncableServices2,
-  discoverServices: () => discoverServices2,
-  SYNC_EXCLUDED_TABLE_PATTERNS: () => SYNC_EXCLUDED_TABLE_PATTERNS2,
+  discoverSyncableServices: () => discoverSyncableServices,
+  discoverServices: () => discoverServices,
+  SYNC_EXCLUDED_TABLE_PATTERNS: () => SYNC_EXCLUDED_TABLE_PATTERNS,
   KNOWN_PG_SERVICES: () => KNOWN_PG_SERVICES
 });
-import { readdirSync as readdirSync5, existsSync as existsSync8 } from "fs";
-import { join as join8 } from "path";
-import { homedir as homedir7 } from "os";
-function isSyncExcludedTable2(table) {
-  return SYNC_EXCLUDED_TABLE_PATTERNS2.some((p) => p.test(table));
+import { readdirSync as readdirSync2, existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+import { homedir as homedir2 } from "os";
+function isSyncExcludedTable(table) {
+  return SYNC_EXCLUDED_TABLE_PATTERNS.some((p) => p.test(table));
 }
-function discoverServices2() {
-  const dataDir = join8(homedir7(), ".hasna");
-  if (!existsSync8(dataDir))
+function discoverServices() {
+  const dataDir = join2(homedir2(), ".hasna");
+  if (!existsSync2(dataDir))
     return [];
   try {
-    const entries = readdirSync5(dataDir, { withFileTypes: true });
+    const entries = readdirSync2(dataDir, { withFileTypes: true });
     return entries.filter((e) => {
       if (!e.isDirectory())
         return false;
@@ -11379,35 +11322,35 @@ function discoverServices2() {
     return [];
   }
 }
-function discoverSyncableServices2() {
-  const local = discoverServices2();
+function discoverSyncableServices() {
+  const local = discoverServices();
   const pgSet = new Set(KNOWN_PG_SERVICES);
   return local.filter((s) => pgSet.has(s));
 }
 function getServiceDbPath(service) {
-  const dataDir = join8(homedir7(), ".hasna", service);
-  if (!existsSync8(dataDir))
+  const dataDir = join2(homedir2(), ".hasna", service);
+  if (!existsSync2(dataDir))
     return null;
   const candidates = [
-    join8(dataDir, `${service}.db`),
-    join8(dataDir, "data.db"),
-    join8(dataDir, "database.db")
+    join2(dataDir, `${service}.db`),
+    join2(dataDir, "data.db"),
+    join2(dataDir, "database.db")
   ];
   try {
-    const files = readdirSync5(dataDir);
+    const files = readdirSync2(dataDir);
     for (const f of files) {
       if (f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm")) {
-        candidates.push(join8(dataDir, f));
+        candidates.push(join2(dataDir, f));
       }
     }
   } catch {}
   for (const p of candidates) {
-    if (existsSync8(p))
+    if (existsSync2(p))
       return p;
   }
   return null;
 }
-var KNOWN_PG_SERVICES, SYNC_EXCLUDED_TABLE_PATTERNS2;
+var KNOWN_PG_SERVICES, SYNC_EXCLUDED_TABLE_PATTERNS;
 var init_discover = __esm(() => {
   KNOWN_PG_SERVICES = [
     "assistants",
@@ -11446,7 +11389,7 @@ var init_discover = __esm(() => {
     "todos",
     "wallets"
   ];
-  SYNC_EXCLUDED_TABLE_PATTERNS2 = [
+  SYNC_EXCLUDED_TABLE_PATTERNS = [
     /^sqlite_/,
     /_fts$/,
     /_fts_/,
@@ -11455,48 +11398,433 @@ var init_discover = __esm(() => {
   ];
 });
 
-// node_modules/commander/esm.mjs
-var import__ = __toESM(require_commander(), 1);
-var {
-  program,
-  createCommand,
-  createArgument,
-  createOption,
-  CommanderError,
-  InvalidArgumentError,
-  InvalidOptionArgumentError,
-  Command,
-  Argument,
-  Option,
-  Help
-} = import__.default;
+// src/machines.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync3 } from "fs";
+import { homedir as homedir3, hostname, platform, arch, userInfo } from "os";
+import { dirname, join as join3 } from "path";
+function quoteSqlString(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function normalizePlatform(value) {
+  if (value === "darwin")
+    return "macos";
+  if (value === "win32")
+    return "windows";
+  return value;
+}
+function detectWorkspacePath() {
+  const home = homedir3();
+  const candidates = [join3(home, "workspace"), join3(home, "Workspace")];
+  for (const candidate of candidates) {
+    if (existsSync3(candidate))
+      return candidate;
+  }
+  const cwd = process.cwd();
+  const workspaceIdx = cwd.indexOf("/workspace/");
+  if (workspaceIdx >= 0) {
+    return cwd.slice(0, workspaceIdx + "/workspace".length);
+  }
+  const workspaceUpperIdx = cwd.indexOf("/Workspace/");
+  if (workspaceUpperIdx >= 0) {
+    return cwd.slice(0, workspaceUpperIdx + "/Workspace".length);
+  }
+  return cwd;
+}
+function detectBunPath() {
+  return dirname(process.execPath);
+}
+function toFlag(value, fallback = 0) {
+  if (value === undefined)
+    return fallback;
+  return value ? 1 : 0;
+}
+function getCurrentMachineId() {
+  return hostname();
+}
+function detectCurrentMachine(opts = {}) {
+  const id = opts.id ?? getCurrentMachineId();
+  const username = userInfo().username;
+  return {
+    id,
+    ssh_address: opts.ssh_address ?? `${username}@${id}`,
+    arch: opts.arch ?? `${normalizePlatform(platform())}-${arch()}`,
+    workspace_path: opts.workspace_path ?? detectWorkspacePath(),
+    bun_path: opts.bun_path ?? detectBunPath(),
+    is_primary: opts.is_primary,
+    archived: opts.archived,
+    last_seen_at: opts.last_seen_at,
+    registered_at: opts.registered_at
+  };
+}
+function ensureMachinesTable(db) {
+  db.exec(MACHINES_TABLE_SQL);
+}
+function getMachineRecord(db, id) {
+  ensureMachinesTable(db);
+  return db.get(`SELECT id, ssh_address, arch, workspace_path, bun_path, is_primary, last_seen_at, registered_at, archived
+       FROM machines
+       WHERE id = ?`, id) ?? null;
+}
+function registerMachine(db, opts = {}) {
+  ensureMachinesTable(db);
+  const detected = detectCurrentMachine(opts);
+  const id = detected.id ?? getCurrentMachineId();
+  const now = new Date().toISOString();
+  const existing = getMachineRecord(db, id);
+  const isPrimary = toFlag(detected.is_primary, existing?.is_primary ?? 0);
+  const archived = toFlag(detected.archived, existing?.archived ?? 0);
+  if (isPrimary === 1 && archived === 1) {
+    throw new Error(`Primary machine "${id}" cannot be archived.`);
+  }
+  const record = {
+    id,
+    ssh_address: detected.ssh_address ?? existing?.ssh_address ?? "",
+    arch: detected.arch ?? existing?.arch ?? "",
+    workspace_path: detected.workspace_path ?? existing?.workspace_path ?? "",
+    bun_path: detected.bun_path ?? existing?.bun_path ?? "",
+    is_primary: isPrimary,
+    last_seen_at: detected.last_seen_at ?? now,
+    registered_at: existing?.registered_at ?? detected.registered_at ?? now,
+    archived
+  };
+  db.run(`INSERT INTO machines (
+      id,
+      ssh_address,
+      arch,
+      workspace_path,
+      bun_path,
+      is_primary,
+      last_seen_at,
+      registered_at,
+      archived
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      ssh_address = excluded.ssh_address,
+      arch = excluded.arch,
+      workspace_path = excluded.workspace_path,
+      bun_path = excluded.bun_path,
+      is_primary = excluded.is_primary,
+      last_seen_at = excluded.last_seen_at,
+      registered_at = excluded.registered_at,
+      archived = excluded.archived`, record.id, record.ssh_address, record.arch, record.workspace_path, record.bun_path, record.is_primary, record.last_seen_at, record.registered_at, record.archived);
+  return getMachineRecord(db, record.id) ?? record;
+}
+function listMachines(db, opts = {}) {
+  ensureMachinesTable(db);
+  const includeArchived = opts.includeArchived ?? false;
+  const whereClause = includeArchived ? "" : "WHERE archived = 0";
+  return db.all(`SELECT id, ssh_address, arch, workspace_path, bun_path, is_primary, last_seen_at, registered_at, archived
+     FROM machines
+     ${whereClause}
+     ORDER BY is_primary DESC, id ASC`);
+}
+function pingMachine(machine) {
+  const record = typeof machine === "string" ? {
+    id: machine,
+    ssh_address: machine
+  } : machine;
+  const startedAt = Date.now();
+  const checkedAt = new Date().toISOString();
+  const currentId = getCurrentMachineId();
+  if (record.id === currentId) {
+    return {
+      id: record.id,
+      online: true,
+      checked_at: checkedAt,
+      latency_ms: Date.now() - startedAt
+    };
+  }
+  const target = record.ssh_address || record.id;
+  if (!target) {
+    return {
+      id: record.id,
+      online: false,
+      error: "Machine has no ssh target.",
+      checked_at: checkedAt,
+      latency_ms: Date.now() - startedAt
+    };
+  }
+  const result = spawnSync("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", target, "true"], {
+    encoding: "utf-8",
+    timeout: 6000
+  });
+  return {
+    id: record.id,
+    online: result.status === 0,
+    error: result.status === 0 ? undefined : (result.stderr || result.error?.message || "SSH health check failed").trim(),
+    checked_at: checkedAt,
+    latency_ms: Date.now() - startedAt
+  };
+}
+function getMachineStatus(db, opts = {}) {
+  return listMachines(db, opts).map((machine) => pingMachine(machine));
+}
+function tableExists(db, table) {
+  try {
+    if (typeof db.query === "function") {
+      const rows2 = db.all(`SELECT name FROM sqlite_master WHERE type='table' AND name = ?`, table);
+      return rows2.length > 0;
+    }
+    const rows = db.all(`SELECT table_name
+       FROM information_schema.tables
+       WHERE table_schema = 'public' AND table_name = ?`, table);
+    return rows.length > 0;
+  } catch {
+    return false;
+  }
+}
+function hasMachineIdColumn(db, table) {
+  try {
+    if (typeof db.query === "function") {
+      const rows2 = db.all(`PRAGMA table_info("${table}")`);
+      return rows2.some((row) => row.name === "machine_id");
+    }
+    const rows = db.all(`SELECT column_name
+       FROM information_schema.columns
+       WHERE table_schema = 'public' AND table_name = ? AND column_name = 'machine_id'`, table);
+    return rows.length > 0;
+  } catch {
+    return false;
+  }
+}
+function shouldTrackMachineId(table) {
+  return table !== "machines" && !isSyncExcludedTable(table);
+}
+function ensureMachineIdColumn(db, table) {
+  if (!shouldTrackMachineId(table) || !tableExists(db, table)) {
+    return false;
+  }
+  if (hasMachineIdColumn(db, table)) {
+    return false;
+  }
+  db.exec(`ALTER TABLE "${table}" ADD COLUMN machine_id TEXT DEFAULT ''`);
+  return true;
+}
+function extractTableName(sql, pattern) {
+  const match = sql.match(pattern);
+  if (!match)
+    return null;
+  return match[2] ?? match[3] ?? null;
+}
+function appendLiteralToValueTuples(sql, literal) {
+  let output = "";
+  let depth = 0;
+  let inSingle = false;
+  let inDouble = false;
+  let sawTuple = false;
+  let inValues = true;
+  for (let i = 0;i < sql.length; i++) {
+    const char = sql[i];
+    const prev = sql[i - 1];
+    if (!inDouble && char === "'" && prev !== "\\") {
+      inSingle = !inSingle;
+      output += char;
+      continue;
+    }
+    if (!inSingle && char === `"` && prev !== "\\") {
+      inDouble = !inDouble;
+      output += char;
+      continue;
+    }
+    if (inSingle || inDouble) {
+      output += char;
+      continue;
+    }
+    if (inValues && char === "(") {
+      depth += 1;
+      if (depth === 1)
+        sawTuple = true;
+      output += char;
+      continue;
+    }
+    if (inValues && char === ")" && depth === 1) {
+      output += `, ${literal})`;
+      depth = 0;
+      continue;
+    }
+    if (inValues && char === ")" && depth > 1) {
+      depth -= 1;
+      output += char;
+      continue;
+    }
+    if (inValues && depth === 0 && sawTuple && /[A-Za-z]/.test(char)) {
+      inValues = false;
+    }
+    output += char;
+  }
+  return sawTuple ? output : null;
+}
+function rewriteInsertSql(sql, machineId) {
+  const match = sql.match(/^\s*(insert(?:\s+or\s+\w+)?\s+into\s+((?:"([^"]+)")|([A-Za-z_][\w$]*))\s*)\(([^)]*)\)(\s*values\s*)([\s\S]*)$/i);
+  if (!match)
+    return null;
+  const table = match[3] ?? match[4];
+  if (!table || !shouldTrackMachineId(table))
+    return null;
+  const columns = match[5].split(",").map((column) => column.trim().replace(/^"|"$/g, ""));
+  if (columns.some((column) => column.toLowerCase() === "machine_id")) {
+    return { table, sql };
+  }
+  const rewrittenValues = appendLiteralToValueTuples(match[7], quoteSqlString(machineId));
+  if (!rewrittenValues)
+    return { table, sql };
+  const nextColumns = `${match[5].trim()}, "machine_id"`;
+  return {
+    table,
+    sql: `${match[1]}(${nextColumns})${match[6]}${rewrittenValues}`
+  };
+}
+function rewriteUpdateSql(sql, machineId) {
+  const match = sql.match(/^\s*(update\s+((?:"([^"]+)")|([A-Za-z_][\w$]*))\s+set\s*)([\s\S]*?)(\s+(?:where|returning)\b[\s\S]*|\s*)$/i);
+  if (!match)
+    return null;
+  const table = match[3] ?? match[4];
+  if (!table || !shouldTrackMachineId(table))
+    return null;
+  if (/\bmachine_id\b/i.test(match[5])) {
+    return { table, sql };
+  }
+  return {
+    table,
+    sql: `${match[1]}${match[5].trimEnd()}, "machine_id" = ${quoteSqlString(machineId)}${match[6]}`
+  };
+}
+function maybeRewriteMachineSql(db, sql, machineId) {
+  const trimmed = sql.trimStart();
+  if (/^insert\b/i.test(trimmed)) {
+    const rewritten = rewriteInsertSql(sql, machineId);
+    if (rewritten?.table) {
+      ensureMachineIdColumn(db, rewritten.table);
+      return rewritten.sql;
+    }
+    return sql;
+  }
+  if (/^update\b/i.test(trimmed)) {
+    const rewritten = rewriteUpdateSql(sql, machineId);
+    if (rewritten?.table) {
+      ensureMachineIdColumn(db, rewritten.table);
+      return rewritten.sql;
+    }
+    return sql;
+  }
+  return sql;
+}
+function maybeEnsureCreatedTableHasMachineId(db, sql) {
+  const table = extractTableName(sql, /^\s*(create\s+table(?:\s+if\s+not\s+exists)?\s+((?:"([^"]+)")|([A-Za-z_][\w$]*)))/i);
+  if (table) {
+    ensureMachineIdColumn(db, table);
+  }
+}
+function createMachineRegistry(db, machineId = getCurrentMachineId()) {
+  return {
+    register(opts = {}) {
+      return registerMachine(db, { ...opts, id: opts.id ?? machineId });
+    },
+    list(opts = {}) {
+      return listMachines(db, opts);
+    },
+    ping(machine) {
+      if (!machine) {
+        return pingMachine(registerMachine(db, { id: machineId }));
+      }
+      return pingMachine(typeof machine === "string" ? getMachineRecord(db, machine) ?? machine : machine);
+    },
+    status(opts = {}) {
+      return getMachineStatus(db, opts);
+    },
+    currentMachine() {
+      return registerMachine(db, { id: machineId });
+    }
+  };
+}
+function createMachineAwareAdapter(db) {
+  ensureMachinesTable(db);
+  const machineId = registerMachine(db).id;
+  const machines = createMachineRegistry(db, machineId);
+  const wrapped = {
+    machine_id: machineId,
+    machines,
+    run(sql, ...params) {
+      return db.run(maybeRewriteMachineSql(db, sql, machineId), ...params);
+    },
+    get(sql, ...params) {
+      return db.get(sql, ...params);
+    },
+    all(sql, ...params) {
+      return db.all(sql, ...params);
+    },
+    exec(sql) {
+      db.exec(sql);
+      maybeEnsureCreatedTableHasMachineId(db, sql);
+    },
+    prepare(sql) {
+      const statement = db.prepare(maybeRewriteMachineSql(db, sql, machineId));
+      return {
+        run(...params) {
+          return statement.run(...params);
+        },
+        get(...params) {
+          return statement.get(...params);
+        },
+        all(...params) {
+          return statement.all(...params);
+        },
+        finalize() {
+          statement.finalize();
+        }
+      };
+    },
+    close() {
+      db.close();
+    },
+    transaction(fn) {
+      return db.transaction(fn);
+    },
+    raw: db.raw,
+    query: typeof db.query === "function" ? db.query.bind(db) : undefined
+  };
+  return wrapped;
+}
+var MACHINES_TABLE_SQL = `
+CREATE TABLE IF NOT EXISTS machines (
+  id TEXT PRIMARY KEY,
+  ssh_address TEXT DEFAULT '',
+  arch TEXT DEFAULT '',
+  workspace_path TEXT DEFAULT '',
+  bun_path TEXT DEFAULT '',
+  is_primary INTEGER DEFAULT 0 CHECK (is_primary IN (0, 1)),
+  last_seen_at TEXT,
+  registered_at TEXT,
+  archived INTEGER DEFAULT 0 CHECK (archived IN (0, 1)),
+  CHECK (NOT (is_primary = 1 AND archived = 1))
+)`;
+var init_machines = __esm(() => {
+  init_discover();
+});
 
 // src/config.ts
-init_zod();
-init_adapter();
-init_dotfile();
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
-var CloudConfigSchema = exports_external.object({
-  rds: exports_external.object({
-    host: exports_external.string().default(""),
-    port: exports_external.number().default(5432),
-    username: exports_external.string().default(""),
-    password_env: exports_external.string().default("HASNA_RDS_PASSWORD"),
-    ssl: exports_external.boolean().default(true)
-  }).default({}),
-  mode: exports_external.enum(["local", "cloud", "hybrid"]).default("hybrid"),
-  auto_sync_interval_minutes: exports_external.number().default(0),
-  feedback_endpoint: exports_external.string().default("https://feedback.hasna.com/api/v1/feedback"),
-  sync: exports_external.object({
-    schedule_minutes: exports_external.number().default(0)
-  }).default({})
+var exports_config = {};
+__export(exports_config, {
+  saveCloudConfig: () => saveCloudConfig,
+  getConnectionString: () => getConnectionString,
+  getConfigPath: () => getConfigPath,
+  getConfigDir: () => getConfigDir,
+  getCloudConfig: () => getCloudConfig,
+  createDatabase: () => createDatabase,
+  CloudConfigSchema: () => CloudConfigSchema
 });
-var CONFIG_DIR = join2(homedir2(), ".hasna", "cloud");
-var CONFIG_PATH = join2(CONFIG_DIR, "config.json");
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join4 } from "path";
+function getConfigDir() {
+  return CONFIG_DIR;
+}
+function getConfigPath() {
+  return CONFIG_PATH;
+}
 function getCloudConfig() {
-  if (!existsSync2(CONFIG_PATH)) {
+  if (!existsSync4(CONFIG_PATH)) {
     return CloudConfigSchema.parse({});
   }
   try {
@@ -11529,14 +11857,73 @@ function createDatabase(options) {
   const mode = options.mode ?? config.mode;
   if (mode === "cloud") {
     const connStr = options.pgConnectionString ?? getConnectionString(options.service);
-    return new PgAdapter(connStr);
+    return createMachineAwareAdapter(new PgAdapter(connStr));
   }
   const dbPath = options.sqlitePath ?? getDbPath(options.service);
-  return new SqliteAdapter(dbPath);
+  return createMachineAwareAdapter(new SqliteAdapter(dbPath));
 }
+var DaemonConfigSchema, CloudConfigSchema, CONFIG_DIR, CONFIG_PATH;
+var init_config = __esm(() => {
+  init_zod();
+  init_adapter();
+  init_dotfile();
+  init_machines();
+  DaemonConfigSchema = exports_external.object({
+    enabled: exports_external.boolean().default(false),
+    paused: exports_external.boolean().default(false),
+    watch_interval_seconds: exports_external.number().int().positive().default(5),
+    pull_interval_seconds: exports_external.number().int().positive().default(60),
+    push_debounce_seconds: exports_external.number().int().positive().default(5),
+    conflict_strategy: exports_external.enum(["newest-wins", "local-wins", "remote-wins"]).default("newest-wins"),
+    services: exports_external.array(exports_external.string()).default([]),
+    table_intervals: exports_external.record(exports_external.string(), exports_external.record(exports_external.string(), exports_external.number().int().positive())).default({}),
+    file_rules: exports_external.array(exports_external.object({
+      path: exports_external.string(),
+      interval_seconds: exports_external.number().int().positive().default(30),
+      enabled: exports_external.boolean().default(true)
+    })).default([])
+  }).default({});
+  CloudConfigSchema = exports_external.object({
+    rds: exports_external.object({
+      host: exports_external.string().default(""),
+      port: exports_external.number().default(5432),
+      username: exports_external.string().default(""),
+      password_env: exports_external.string().default("HASNA_RDS_PASSWORD"),
+      ssl: exports_external.boolean().default(true)
+    }).default({}),
+    mode: exports_external.enum(["local", "cloud", "hybrid"]).default("hybrid"),
+    auto_sync_interval_minutes: exports_external.number().default(0),
+    feedback_endpoint: exports_external.string().default("https://feedback.hasna.com/api/v1/feedback"),
+    sync: exports_external.object({
+      schedule_minutes: exports_external.number().default(0)
+    }).default({}),
+    daemon: DaemonConfigSchema
+  });
+  CONFIG_DIR = join4(homedir4(), ".hasna", "cloud");
+  CONFIG_PATH = join4(CONFIG_DIR, "config.json");
+});
 
-// src/sync.ts
-async function syncPush(local, remote, options) {
+// node_modules/commander/esm.mjs
+var import__ = __toESM(require_commander(), 1);
+var {
+  program,
+  createCommand,
+  createArgument,
+  createOption,
+  CommanderError,
+  InvalidArgumentError,
+  InvalidOptionArgumentError,
+  Command,
+  Argument,
+  Option,
+  Help
+} = import__.default;
+
+// src/cli/cmd-setup.ts
+init_config();
+
+// src/sync.ts
+async function syncPush(local, remote, options) {
   const orderedTables = await getTableOrder(remote, options.tables);
   return syncTransfer(local, remote, { ...options, tables: orderedTables }, "push");
 }
@@ -11711,6 +12098,9 @@ async function ensureTablesExist(source, target, tables) {
 }
 async function filterColumnsForTarget(target, table, sourceColumns) {
   try {
+    if (sourceColumns.includes("machine_id") && table !== "machines") {
+      await ensureMachineIdColumnInTarget(target, table);
+    }
     if (!isAsyncAdapter(target)) {
       const colInfo = target.all(`PRAGMA table_info("${table}")`);
       if (Array.isArray(colInfo) && colInfo.length > 0) {
@@ -11733,6 +12123,22 @@ async function filterColumnsForTarget(target, table, sourceColumns) {
   } catch {}
   return sourceColumns;
 }
+async function ensureMachineIdColumnInTarget(target, table) {
+  if (!isAsyncAdapter(target)) {
+    const colInfo2 = target.all(`PRAGMA table_info("${table}")`);
+    const hasMachineId = Array.isArray(colInfo2) ? colInfo2.some((column) => column.name === "machine_id") : false;
+    if (!hasMachineId) {
+      target.exec(`ALTER TABLE "${table}" ADD COLUMN machine_id TEXT DEFAULT ''`);
+    }
+    return;
+  }
+  const colInfo = await target.all(`SELECT column_name
+     FROM information_schema.columns
+     WHERE table_schema = 'public' AND table_name = '${table}' AND column_name = 'machine_id'`);
+  if (colInfo.length === 0) {
+    await target.exec(`ALTER TABLE "${table}" ADD COLUMN machine_id TEXT DEFAULT ''`);
+  }
+}
 async function syncTransfer(source, target, options, _direction) {
   const {
     tables,
@@ -11966,253 +12372,158 @@ async function listPgTables(db) {
   return rows.map((r) => r.tablename);
 }
 
-// src/feedback.ts
+// src/cli/cmd-setup.ts
+init_adapter();
+init_discover();
+init_dotfile();
+
+// src/pg-migrate.ts
+init_adapter();
 init_config();
-import { hostname } from "os";
-var FEEDBACK_TABLE_SQL = `
-CREATE TABLE IF NOT EXISTS feedback (
-  id TEXT PRIMARY KEY,
-  service TEXT NOT NULL,
-  version TEXT DEFAULT '',
-  message TEXT NOT NULL,
-  email TEXT DEFAULT '',
-  machine_id TEXT DEFAULT '',
-  created_at TEXT DEFAULT (datetime('now'))
-)`;
-function ensureFeedbackTable(db) {
-  db.exec(FEEDBACK_TABLE_SQL);
-}
-function saveFeedback(db, feedback) {
-  ensureFeedbackTable(db);
-  const id = feedback.id ?? Math.random().toString(36).slice(2) + Date.now().toString(36);
-  const now = new Date().toISOString();
-  const machineId = feedback.machine_id ?? hostname();
-  db.run(`INSERT INTO feedback (id, service, version, message, email, machine_id, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?)`, id, feedback.service, feedback.version ?? "", feedback.message, feedback.email ?? "", machineId, feedback.created_at ?? now);
-  return id;
-}
-async function sendFeedback(feedback, db) {
-  const config = getCloudConfig2();
-  const id = feedback.id ?? Math.random().toString(36).slice(2) + Date.now().toString(36);
-  const machineId = feedback.machine_id ?? hostname();
-  const now = new Date().toISOString();
-  const payload = {
-    id,
-    service: feedback.service,
-    version: feedback.version ?? "",
-    message: feedback.message,
-    email: feedback.email ?? "",
-    machine_id: machineId,
-    created_at: feedback.created_at ?? now
+async function applyPgMigrations(connectionString, migrations, service = "unknown") {
+  const pg2 = new PgAdapterAsync(connectionString);
+  const result = {
+    service,
+    applied: [],
+    alreadyApplied: [],
+    errors: [],
+    totalMigrations: migrations.length
   };
   try {
-    const res = await fetch(config.feedback_endpoint, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(payload),
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!res.ok) {
-      throw new Error(`HTTP ${res.status}: ${res.statusText}`);
-    }
-    if (db) {
-      try {
-        saveFeedback(db, { ...feedback, id });
-      } catch {}
-    }
-    return { sent: true, id };
-  } catch (err) {
-    const errorMsg = err?.message ?? String(err);
-    if (db) {
+    await pg2.run(`CREATE TABLE IF NOT EXISTS _pg_migrations (
+        id SERIAL PRIMARY KEY,
+        version INT UNIQUE NOT NULL,
+        applied_at TIMESTAMPTZ DEFAULT NOW()
+      )`);
+    const applied = await pg2.all("SELECT version FROM _pg_migrations ORDER BY version");
+    const appliedSet = new Set(applied.map((r) => r.version));
+    for (let i = 0;i < migrations.length; i++) {
+      if (appliedSet.has(i)) {
+        result.alreadyApplied.push(i);
+        continue;
+      }
       try {
-        saveFeedback(db, { ...feedback, id });
-      } catch {}
+        await pg2.exec(migrations[i]);
+        await pg2.run("INSERT INTO _pg_migrations (version) VALUES ($1) ON CONFLICT DO NOTHING", i);
+        result.applied.push(i);
+      } catch (err) {
+        result.errors.push(`Migration ${i}: ${err?.message ?? String(err)}`);
+        break;
+      }
     }
-    return { sent: false, id, error: errorMsg };
+  } finally {
+    await pg2.close();
   }
+  return result;
 }
-
-// src/dotfile.ts
-import {
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync4,
-  readdirSync as readdirSync2,
-  copyFileSync as copyFileSync2
-} from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join4, relative as relative2 } from "path";
-var HASNA_DIR2 = join4(homedir4(), ".hasna");
-function getDataDir2(serviceName) {
-  const dir = join4(HASNA_DIR2, serviceName);
-  mkdirSync4(dir, { recursive: true });
-  return dir;
-}
-function getDbPath2(serviceName) {
-  const dir = getDataDir2(serviceName);
-  return join4(dir, `${serviceName}.db`);
-}
-function migrateDotfile(serviceName) {
-  const legacyDir = join4(homedir4(), `.${serviceName}`);
-  const newDir = join4(HASNA_DIR2, serviceName);
-  if (!existsSync4(legacyDir))
-    return [];
-  if (existsSync4(newDir))
-    return [];
-  mkdirSync4(newDir, { recursive: true });
-  const migrated = [];
-  copyDirRecursive(legacyDir, newDir, legacyDir, migrated);
-  return migrated;
+function getServicePackage(service) {
+  return `@hasna/${service}`;
 }
-function copyDirRecursive(src, dest, root, migrated) {
-  const entries = readdirSync2(src, { withFileTypes: true });
-  for (const entry of entries) {
-    const srcPath = join4(src, entry.name);
-    const destPath = join4(dest, entry.name);
-    if (entry.isDirectory()) {
-      mkdirSync4(destPath, { recursive: true });
-      copyDirRecursive(srcPath, destPath, root, migrated);
-    } else {
-      copyFileSync2(srcPath, destPath);
-      migrated.push(relative2(root, srcPath));
-    }
+async function loadServiceMigrations(service) {
+  const pkg = getServicePackage(service);
+  const paths = [
+    `${pkg}/pg-migrations`,
+    `${pkg}/dist/db/pg-migrations.js`,
+    `${pkg}/dist/db/pg-migrations`
+  ];
+  for (const path of paths) {
+    try {
+      const mod = await import(path);
+      if (Array.isArray(mod.PG_MIGRATIONS)) {
+        return mod.PG_MIGRATIONS;
+      }
+      if (mod.default && Array.isArray(mod.default.PG_MIGRATIONS)) {
+        return mod.default.PG_MIGRATIONS;
+      }
+    } catch {}
   }
+  return null;
 }
-
-// src/adapter.ts
-init_esm();
-import { Database as Database2 } from "bun:sqlite";
-
-class SqliteAdapter2 {
-  db;
-  constructor(path) {
-    this.db = new Database2(path, { create: true });
-    this.db.exec("PRAGMA journal_mode=WAL");
-    this.db.exec("PRAGMA foreign_keys=ON");
-  }
-  run(sql, ...params) {
-    const stmt = this.db.prepare(sql);
-    const result = stmt.run(...params);
+async function migrateService(service, connectionString) {
+  const connStr = connectionString ?? getConnectionString(service);
+  const migrations = await loadServiceMigrations(service);
+  if (!migrations) {
     return {
-      changes: result.changes,
-      lastInsertRowid: result.lastInsertRowid
+      service,
+      applied: [],
+      alreadyApplied: [],
+      errors: [`No PG migrations found for service "${service}"`],
+      totalMigrations: 0
     };
   }
-  get(sql, ...params) {
-    const stmt = this.db.prepare(sql);
-    return stmt.get(...params);
+  return applyPgMigrations(connStr, migrations, service);
+}
+async function migrateAllServices() {
+  const { discoverServices: discoverServices2 } = await Promise.resolve().then(() => (init_discover(), exports_discover));
+  const services = discoverServices2();
+  const results = [];
+  for (const service of services) {
+    try {
+      const result = await migrateService(service);
+      results.push(result);
+    } catch (err) {
+      results.push({
+        service,
+        applied: [],
+        alreadyApplied: [],
+        errors: [err?.message ?? String(err)],
+        totalMigrations: 0
+      });
+    }
   }
-  all(sql, ...params) {
-    const stmt = this.db.prepare(sql);
-    return stmt.all(...params);
+  return results;
+}
+async function ensurePgDatabase(service) {
+  const config = (await Promise.resolve().then(() => (init_config(), exports_config))).getCloudConfig();
+  const { host, port, username, password_env, ssl } = config.rds;
+  if (!host || !username)
+    return false;
+  const password = process.env[password_env] ?? "";
+  const sslParam = ssl ? "?sslmode=require" : "";
+  const adminConnStr = `postgres://${username}:${encodeURIComponent(password)}@${host}:${port}/postgres${sslParam}`;
+  const pg2 = new PgAdapterAsync(adminConnStr);
+  try {
+    const existing = await pg2.all(`SELECT 1 FROM pg_database WHERE datname = $1`, service);
+    if (existing.length === 0) {
+      await pg2.exec(`CREATE DATABASE "${service}"`);
+      return true;
+    }
+    return false;
+  } finally {
+    await pg2.close();
   }
-  exec(sql) {
-    this.db.exec(sql);
+}
+async function ensureAllPgDatabases() {
+  const { discoverServices: discoverServices2 } = await Promise.resolve().then(() => (init_discover(), exports_discover));
+  const services = discoverServices2();
+  const results = [];
+  for (const service of services) {
+    try {
+      const created = await ensurePgDatabase(service);
+      results.push({ service, created });
+    } catch (err) {
+      results.push({ service, created: false, error: err?.message ?? String(err) });
+    }
   }
-  query(sql) {
-    return this.db.query(sql);
-  }
-  prepare(sql) {
-    const stmt = this.db.prepare(sql);
-    return {
-      run(...params) {
-        const r = stmt.run(...params);
-        return { changes: r.changes, lastInsertRowid: r.lastInsertRowid };
-      },
-      get(...params) {
-        return stmt.get(...params);
-      },
-      all(...params) {
-        return stmt.all(...params);
-      },
-      finalize() {
-        stmt.finalize();
-      }
-    };
-  }
-  close() {
-    this.db.close();
-  }
-  transaction(fn) {
-    const wrapped = this.db.transaction(fn);
-    return wrapped();
-  }
-  get raw() {
-    return this.db;
-  }
-}
-class PgAdapterAsync2 {
-  pool;
-  constructor(arg) {
-    if (typeof arg === "string") {
-      const sslConfig = arg.includes("sslmode=require") || arg.includes("ssl=true") ? { rejectUnauthorized: false } : undefined;
-      this.pool = new esm_default.Pool({ connectionString: arg, ssl: sslConfig });
-    } else {
-      this.pool = arg;
-    }
-  }
-  async run(sql, ...params) {
-    const pgSql = translateSql(sql, "pg");
-    const pgParams = translateParams(params);
-    const res = await this.pool.query(pgSql, pgParams);
-    return {
-      changes: res.rowCount ?? 0,
-      lastInsertRowid: res.rows?.[0]?.id ?? 0
-    };
-  }
-  async get(sql, ...params) {
-    const pgSql = translateSql(sql, "pg");
-    const pgParams = translateParams(params);
-    const res = await this.pool.query(pgSql, pgParams);
-    return res.rows[0] ?? null;
-  }
-  async all(sql, ...params) {
-    const pgSql = translateSql(sql, "pg");
-    const pgParams = translateParams(params);
-    const res = await this.pool.query(pgSql, pgParams);
-    return res.rows;
-  }
-  async exec(sql) {
-    const pgSql = translateSql(sql, "pg");
-    await this.pool.query(pgSql);
-  }
-  async close() {
-    await this.pool.end();
-  }
-  async transaction(fn) {
-    const client = await this.pool.connect();
-    try {
-      await client.query("BEGIN");
-      const result = await fn(client);
-      await client.query("COMMIT");
-      return result;
-    } catch (err) {
-      await client.query("ROLLBACK");
-      throw err;
-    } finally {
-      client.release();
-    }
-  }
-  get raw() {
-    return this.pool;
-  }
-}
-
-// src/sync-schedule.ts
-init_config();
-import { join as join5, dirname } from "path";
-import { existsSync as existsSync5, writeFileSync as writeFileSync3, unlinkSync, mkdirSync as mkdirSync5 } from "fs";
-import { homedir as homedir5, platform } from "os";
-var SERVICE_NAME = "hasna-cloud-sync";
-var CONFIG_DIR3 = join5(homedir5(), ".hasna", "cloud");
-function parseInterval(input) {
-  const trimmed = input.trim().toLowerCase();
-  const hourMatch = trimmed.match(/^(\d+)\s*h$/);
-  if (hourMatch) {
-    const hours = parseInt(hourMatch[1], 10);
-    if (hours <= 0) {
-      throw new Error(`Invalid interval "${input}". Value must be greater than 0.`);
-    }
-    return hours * 60;
+  return results;
+}
+
+// src/sync-schedule.ts
+init_config();
+import { join as join5, dirname as dirname2 } from "path";
+import { existsSync as existsSync5, writeFileSync as writeFileSync2, unlinkSync, mkdirSync as mkdirSync3 } from "fs";
+import { homedir as homedir5, platform as platform2 } from "os";
+var SERVICE_NAME = "hasna-cloud-sync";
+var CONFIG_DIR2 = join5(homedir5(), ".hasna", "cloud");
+function parseInterval(input) {
+  const trimmed = input.trim().toLowerCase();
+  const hourMatch = trimmed.match(/^(\d+)\s*h$/);
+  if (hourMatch) {
+    const hours = parseInt(hourMatch[1], 10);
+    if (hours <= 0) {
+      throw new Error(`Invalid interval "${input}". Value must be greater than 0.`);
+    }
+    return hours * 60;
   }
   const minMatch = trimmed.match(/^(\d+)\s*m$/);
   if (minMatch) {
@@ -12243,7 +12554,7 @@ function minutesToCron(minutes) {
   return `*/${minutes} * * * *`;
 }
 function getWorkerPath() {
-  const dir = typeof import.meta.dir === "string" ? import.meta.dir : dirname(import.meta.url.replace("file://", ""));
+  const dir = typeof import.meta.dir === "string" ? import.meta.dir : dirname2(import.meta.url.replace("file://", ""));
   const tsPath = join5(dir, "scheduled-sync.ts");
   const jsPath = join5(dir, "scheduled-sync.js");
   try {
@@ -12270,8 +12581,8 @@ function getLaunchdPlistPath() {
 function createLaunchdPlist(intervalMinutes) {
   const workerPath = getWorkerPath();
   const bunPath = getBunPath();
-  const logPath = join5(CONFIG_DIR3, "sync.log");
-  const errorLogPath = join5(CONFIG_DIR3, "sync-error.log");
+  const logPath = join5(CONFIG_DIR2, "sync.log");
+  const errorLogPath = join5(CONFIG_DIR2, "sync-error.log");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -12304,12 +12615,12 @@ function createLaunchdPlist(intervalMinutes) {
 }
 async function registerLaunchd(intervalMinutes) {
   const plistPath = getLaunchdPlistPath();
-  const plistDir = dirname(plistPath);
-  mkdirSync5(plistDir, { recursive: true });
+  const plistDir = dirname2(plistPath);
+  mkdirSync3(plistDir, { recursive: true });
   try {
     await Bun.spawn(["launchctl", "unload", plistPath]).exited;
   } catch {}
-  writeFileSync3(plistPath, createLaunchdPlist(intervalMinutes));
+  writeFileSync2(plistPath, createLaunchdPlist(intervalMinutes));
   await Bun.spawn(["launchctl", "load", plistPath]).exited;
 }
 async function removeLaunchd() {
@@ -12356,9 +12667,9 @@ WantedBy=timers.target
 }
 async function registerSystemd(intervalMinutes) {
   const dir = getSystemdDir();
-  mkdirSync5(dir, { recursive: true });
-  writeFileSync3(join5(dir, `${SERVICE_NAME}.service`), createSystemdService());
-  writeFileSync3(join5(dir, `${SERVICE_NAME}.timer`), createSystemdTimer(intervalMinutes));
+  mkdirSync3(dir, { recursive: true });
+  writeFileSync2(join5(dir, `${SERVICE_NAME}.service`), createSystemdService());
+  writeFileSync2(join5(dir, `${SERVICE_NAME}.timer`), createSystemdTimer(intervalMinutes));
   await Bun.spawn(["systemctl", "--user", "daemon-reload"]).exited;
   await Bun.spawn(["systemctl", "--user", "enable", "--now", `${SERVICE_NAME}.timer`]).exited;
 }
@@ -12381,33 +12692,33 @@ async function registerSyncSchedule(intervalMinutes) {
   if (intervalMinutes <= 0) {
     throw new Error("Interval must be a positive number of minutes.");
   }
-  mkdirSync5(CONFIG_DIR3, { recursive: true });
-  if (platform() === "darwin") {
+  mkdirSync3(CONFIG_DIR2, { recursive: true });
+  if (platform2() === "darwin") {
     await registerLaunchd(intervalMinutes);
   } else {
     await registerSystemd(intervalMinutes);
   }
-  const config = getCloudConfig2();
+  const config = getCloudConfig();
   config.sync.schedule_minutes = intervalMinutes;
-  saveCloudConfig2(config);
+  saveCloudConfig(config);
 }
 async function removeSyncSchedule() {
-  if (platform() === "darwin") {
+  if (platform2() === "darwin") {
     await removeLaunchd();
   } else {
     await removeSystemd();
   }
-  const config = getCloudConfig2();
+  const config = getCloudConfig();
   config.sync.schedule_minutes = 0;
-  saveCloudConfig2(config);
+  saveCloudConfig(config);
 }
 function getSyncScheduleStatus() {
-  const config = getCloudConfig2();
+  const config = getCloudConfig();
   const minutes = config.sync.schedule_minutes;
   const registered = minutes > 0;
   let mechanism = "none";
   if (registered) {
-    if (platform() === "darwin") {
+    if (platform2() === "darwin") {
       mechanism = existsSync5(getLaunchdPlistPath()) ? "launchd" : "none";
     } else {
       mechanism = existsSync5(join5(getSystemdDir(), `${SERVICE_NAME}.timer`)) ? "systemd" : "none";
@@ -12421,6 +12732,184 @@ function getSyncScheduleStatus() {
   };
 }
 
+// src/cli/cmd-setup.ts
+function registerSetupCommand(program2) {
+  program2.command("setup").description("Configure cloud settings — interactive wizard or flags").option("--host <host>", "RDS hostname").option("--port <port>", "RDS port", "5432").option("--username <user>", "RDS username").option("--password-env <env>", "Env var for RDS password", "HASNA_RDS_PASSWORD").option("--ssl", "Enable SSL", true).option("--no-ssl", "Disable SSL").option("--mode <mode>", "Mode: local, cloud, or hybrid").option("--schedule <interval>", "Sync schedule (e.g. 30m, 1h)").option("--migrate", "Run PG migrations after setup").option("--pull", "Pull data from cloud after setup").action(async (opts) => {
+    const config = getCloudConfig();
+    const isAutoDetect = !opts.host && !opts.username;
+    if (isAutoDetect) {
+      const envHost = process.env.HASNA_RDS_HOST;
+      const envUser = process.env.HASNA_RDS_USERNAME;
+      if (envHost && !config.rds.host) {
+        config.rds.host = envHost;
+        console.log(`Auto-detected RDS host: ${envHost}`);
+      }
+      if (envUser && !config.rds.username) {
+        config.rds.username = envUser;
+        console.log(`Auto-detected RDS username: ${envUser}`);
+      }
+    }
+    if (opts.host)
+      config.rds.host = opts.host;
+    if (opts.port)
+      config.rds.port = parseInt(opts.port, 10);
+    if (opts.username)
+      config.rds.username = opts.username;
+    if (opts.passwordEnv)
+      config.rds.password_env = opts.passwordEnv;
+    config.rds.ssl = opts.ssl;
+    if (opts.mode) {
+      config.mode = opts.mode;
+    } else if (config.mode === "local" && config.rds.host) {
+      config.mode = "hybrid";
+      console.log("Mode set to: hybrid (auto-upgraded from local)");
+    }
+    saveCloudConfig(config);
+    console.log(`
+✓ Configuration saved
+`);
+    const password = process.env[config.rds.password_env];
+    if (!password) {
+      console.error(`✗ ${config.rds.password_env} not set in environment`);
+      console.error(`  Add it to ~/.secrets/hasna/rds/live.env and source it`);
+      return;
+    }
+    if (config.rds.host) {
+      process.stdout.write("Testing PG connection... ");
+      try {
+        const connStr = getConnectionString("postgres");
+        const pg2 = new PgAdapterAsync(connStr);
+        await pg2.all("SELECT 1");
+        await pg2.close();
+        console.log(`✓ Connected
+`);
+      } catch (err) {
+        console.log(`✗ Failed: ${err?.message ?? String(err)}`);
+        return;
+      }
+      if (opts.migrate !== false) {
+        console.log("Creating databases & running migrations...");
+        const dbResults = await ensureAllPgDatabases();
+        const created = dbResults.filter((r) => r.created);
+        if (created.length > 0) {
+          console.log(`  Created ${created.length} database(s): ${created.map((r) => r.service).join(", ")}`);
+        }
+        const migResults = await migrateAllServices();
+        const totalApplied = migResults.reduce((s, r) => s + r.applied.length, 0);
+        const applied = migResults.filter((r) => r.applied.length > 0);
+        if (totalApplied > 0) {
+          console.log(`  Applied ${totalApplied} migration(s) across ${applied.length} service(s)`);
+        } else {
+          console.log("  All migrations up to date");
+        }
+        console.log("");
+      }
+      if (opts.schedule) {
+        try {
+          const minutes = parseInterval(opts.schedule);
+          await registerSyncSchedule(minutes);
+          console.log(`✓ Sync scheduled every ${minutes}m
+`);
+        } catch (err) {
+          console.error(`✗ Schedule failed: ${err?.message}`);
+        }
+      }
+      if (opts.pull) {
+        console.log("Pulling data from cloud...");
+        const services = discoverServices();
+        for (const service of services) {
+          try {
+            const local = new SqliteAdapter(getDbPath(service));
+            const cloud = new PgAdapterAsync(getConnectionString(service));
+            const tables = (await listPgTables(cloud)).filter((t) => !isSyncExcludedTable(t));
+            if (tables.length > 0) {
+              const results = await syncPull(cloud, local, { tables });
+              const written = results.reduce((s, r) => s + r.rowsWritten, 0);
+              if (written > 0)
+                console.log(`  ${service}: ${written} rows`);
+            }
+            local.close();
+            await cloud.close();
+          } catch {}
+        }
+        console.log("");
+      }
+    }
+    console.log("Setup complete. Run `cloud doctor` to verify everything.");
+  });
+}
+
+// node_modules/commander/esm.mjs
+var import__2 = __toESM(require_commander(), 1);
+var {
+  program: program2,
+  createCommand: createCommand2,
+  createArgument: createArgument2,
+  createOption: createOption2,
+  CommanderError: CommanderError2,
+  InvalidArgumentError: InvalidArgumentError2,
+  InvalidOptionArgumentError: InvalidOptionArgumentError2,
+  Command: Command2,
+  Argument: Argument2,
+  Option: Option2,
+  Help: Help2
+} = import__2.default;
+
+// src/cli/cmd-sync.ts
+init_config();
+init_adapter();
+init_discover();
+init_dotfile();
+
+// src/sync-conflicts.ts
+function ensureConflictsTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS _sync_conflicts (
+      id TEXT PRIMARY KEY,
+      table_name TEXT,
+      row_id TEXT,
+      local_data TEXT,
+      remote_data TEXT,
+      local_updated_at TEXT,
+      remote_updated_at TEXT,
+      resolution TEXT,
+      resolved_at TEXT,
+      created_at TEXT DEFAULT (datetime('now'))
+    )
+  `);
+}
+function listConflicts(db, opts) {
+  ensureConflictsTable(db);
+  let sql = `SELECT * FROM _sync_conflicts WHERE 1=1`;
+  const params = [];
+  if (opts?.resolved !== undefined) {
+    if (opts.resolved) {
+      sql += ` AND resolution IS NOT NULL AND resolved_at IS NOT NULL`;
+    } else {
+      sql += ` AND (resolution IS NULL OR resolved_at IS NULL)`;
+    }
+  }
+  if (opts?.table) {
+    sql += ` AND table_name = ?`;
+    params.push(opts.table);
+  }
+  sql += ` ORDER BY created_at DESC`;
+  return db.all(sql, ...params);
+}
+function resolveConflict(db, conflictId, strategy) {
+  ensureConflictsTable(db);
+  const row = db.get(`SELECT * FROM _sync_conflicts WHERE id = ?`, conflictId);
+  if (!row)
+    return null;
+  db.run(`UPDATE _sync_conflicts SET resolution = ?, resolved_at = datetime('now') WHERE id = ?`, strategy, conflictId);
+  return db.get(`SELECT * FROM _sync_conflicts WHERE id = ?`, conflictId);
+}
+function purgeResolvedConflicts(db) {
+  ensureConflictsTable(db);
+  const result = db.run(`DELETE FROM _sync_conflicts WHERE resolution IS NOT NULL AND resolved_at IS NOT NULL`);
+  return result.changes;
+}
+
 // src/scheduled-sync.ts
 init_config();
 init_adapter();
@@ -12428,6 +12917,7 @@ import { existsSync as existsSync6, readdirSync as readdirSync3 } from "fs";
 import { join as join6 } from "path";
 
 // src/sync-incremental.ts
+init_machines();
 var SYNC_META_TABLE_SQL = `
 CREATE TABLE IF NOT EXISTS _sync_meta (
   table_name TEXT PRIMARY KEY,
@@ -12459,6 +12949,11 @@ function transferRows(source, target, table, rows, options) {
   if (rows.length === 0)
     return { written, skipped, errors: errors2 };
   const columns = Object.keys(rows[0]);
+  if (columns.includes("machine_id") && table !== "machines") {
+    try {
+      ensureMachineIdColumn(target, table);
+    } catch {}
+  }
   const hasConflictCol = columns.includes(conflictColumn);
   const hasPrimaryKey = columns.includes(primaryKey);
   if (!hasPrimaryKey) {
@@ -12469,12 +12964,21 @@ function transferRows(source, target, table, rows, options) {
     try {
       const existing = target.get(`SELECT "${primaryKey}"${hasConflictCol ? `, "${conflictColumn}"` : ""} FROM "${table}" WHERE "${primaryKey}" = ?`, row[primaryKey]);
       if (existing) {
-        if (hasConflictCol && existing[conflictColumn] && row[conflictColumn]) {
-          const existingTime = new Date(existing[conflictColumn]).getTime();
-          const incomingTime = new Date(row[conflictColumn]).getTime();
-          if (existingTime >= incomingTime) {
-            skipped++;
-            continue;
+        const conflictStrategy = options.conflictStrategy ?? "newest-wins";
+        const sourceRole = options.sourceRole ?? "local";
+        const sourceWins = conflictStrategy === "local-wins" && sourceRole === "local" || conflictStrategy === "remote-wins" && sourceRole === "remote";
+        if (!sourceWins && conflictStrategy !== "newest-wins") {
+          skipped++;
+          continue;
+        }
+        if (conflictStrategy === "newest-wins") {
+          if (hasConflictCol && existing[conflictColumn] && row[conflictColumn]) {
+            const existingTime = new Date(existing[conflictColumn]).getTime();
+            const incomingTime = new Date(row[conflictColumn]).getTime();
+            if (existingTime >= incomingTime) {
+              skipped++;
+              continue;
+            }
           }
         }
         const setClauses = columns.filter((c) => c !== primaryKey).map((c) => `"${c}" = ?`).join(", ");
@@ -12525,7 +13029,10 @@ function incrementalSyncPush(local, remote, tables, options = {}) {
       }
       for (let offset = 0;offset < rows.length; offset += batchSize) {
         const batch = rows.slice(offset, offset + batchSize);
-        const result = transferRows(local, remote, table, batch, options);
+        const result = transferRows(local, remote, table, batch, {
+          ...options,
+          sourceRole: "local"
+        });
         stat.synced_rows += result.written;
         stat.skipped_rows += result.skipped;
         stat.errors.push(...result.errors);
@@ -12547,18 +13054,66 @@ function incrementalSyncPush(local, remote, tables, options = {}) {
   }
   return results;
 }
-
-// src/scheduled-sync.ts
-init_dotfile();
-
-// src/sync.ts
-function listSqliteTables2(db) {
-  const rows = db.all(`SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' ORDER BY name`);
-  return rows.map((r) => r.name);
+function incrementalSyncPull(remote, local, tables, options = {}) {
+  const { conflictColumn = "updated_at", batchSize = 500 } = options;
+  const results = [];
+  ensureSyncMetaTable(local);
+  for (const table of tables) {
+    const stat = {
+      table,
+      total_rows: 0,
+      synced_rows: 0,
+      skipped_rows: 0,
+      errors: [],
+      first_sync: false
+    };
+    try {
+      const countResult = remote.get(`SELECT COUNT(*) as cnt FROM "${table}"`);
+      stat.total_rows = countResult?.cnt ?? 0;
+      const meta = getSyncMeta(local, table);
+      let rows;
+      if (meta?.last_synced_at) {
+        try {
+          rows = remote.all(`SELECT * FROM "${table}" WHERE "${conflictColumn}" > ?`, meta.last_synced_at);
+        } catch {
+          rows = remote.all(`SELECT * FROM "${table}"`);
+          stat.first_sync = true;
+        }
+      } else {
+        rows = remote.all(`SELECT * FROM "${table}"`);
+        stat.first_sync = true;
+      }
+      for (let offset = 0;offset < rows.length; offset += batchSize) {
+        const batch = rows.slice(offset, offset + batchSize);
+        const result = transferRows(remote, local, table, batch, {
+          ...options,
+          sourceRole: "remote"
+        });
+        stat.synced_rows += result.written;
+        stat.skipped_rows += result.skipped;
+        stat.errors.push(...result.errors);
+      }
+      if (rows.length === 0) {
+        stat.skipped_rows = stat.total_rows;
+      }
+      const now = new Date().toISOString();
+      upsertSyncMeta(local, {
+        table_name: table,
+        last_synced_at: now,
+        last_synced_row_count: stat.synced_rows,
+        direction: "pull"
+      });
+    } catch (err) {
+      stat.errors.push(`Table "${table}": ${err?.message ?? String(err)}`);
+    }
+    results.push(stat);
+  }
+  return results;
 }
 
 // src/scheduled-sync.ts
-function discoverSyncableServices() {
+init_dotfile();
+function discoverSyncableServices2() {
   const hasnaDir = getHasnaDir();
   const services = [];
   try {
@@ -12575,10 +13130,10 @@ function discoverSyncableServices() {
   return services;
 }
 async function runScheduledSync() {
-  const config = getCloudConfig2();
+  const config = getCloudConfig();
   if (config.mode === "local")
     return [];
-  const services = discoverSyncableServices();
+  const services = discoverSyncableServices2();
   const results = [];
   let remote = null;
   for (const service of services) {
@@ -12594,14 +13149,14 @@ async function runScheduledSync() {
         continue;
       }
       const local = new SqliteAdapter(dbPath);
-      const tables = listSqliteTables2(local).filter((t) => !t.startsWith("_") && !t.startsWith("sqlite_"));
+      const tables = listSqliteTables(local).filter((t) => !t.startsWith("_") && !t.startsWith("sqlite_"));
       if (tables.length === 0) {
         local.close();
         continue;
       }
       try {
-        const connStr = getConnectionString2(service);
-        remote = new PgAdapterAsync(connStr);
+        const connStr = getConnectionString(service);
+        remote = new PgAdapter(connStr);
       } catch (err) {
         result.errors.push(`Connection failed: ${err?.message ?? String(err)}`);
         local.close();
@@ -12617,7 +13172,7 @@ async function runScheduledSync() {
         result.errors.push(...s.errors);
       }
       local.close();
-      await remote.close();
+      remote.close();
       remote = null;
     } catch (err) {
       result.errors.push(err?.message ?? String(err));
@@ -12626,785 +13181,1481 @@ async function runScheduledSync() {
   }
   if (remote) {
     try {
-      await remote.close();
+      remote.close();
     } catch {}
   }
   return results;
 }
 
-// src/discover.ts
-import { readdirSync as readdirSync4, existsSync as existsSync7 } from "fs";
-import { join as join7 } from "path";
+// src/cli/cmd-sync.ts
+import { existsSync as existsSync8, statSync as statSync5 } from "fs";
+import { join as join8 } from "path";
+import { homedir as homedir7 } from "os";
+
+// src/daemon-sync.ts
+init_adapter();
+init_config();
+init_discover();
+init_dotfile();
+import { spawn } from "child_process";
+import {
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync3,
+  statSync as statSync4,
+  writeFileSync as writeFileSync3
+} from "fs";
 import { homedir as homedir6 } from "os";
-var SYNC_EXCLUDED_TABLE_PATTERNS = [
-  /^sqlite_/,
-  /_fts$/,
-  /_fts_/,
-  /^_sync_/,
-  /^_pg_migrations$/
-];
-function isSyncExcludedTable(table) {
-  return SYNC_EXCLUDED_TABLE_PATTERNS.some((p) => p.test(table));
+import { join as join7 } from "path";
+var DAEMON_STATE_PATH = join7(homedir6(), ".hasna", "cloud", "daemon-state.json");
+var defaultDaemonAdapterFactory = {
+  getLocalDbPath: (service) => getDbPath(service),
+  openLocal: (service) => new SqliteAdapter(getDbPath(service)),
+  openRemote: (service) => new PgAdapter(getConnectionString(service)),
+  listRemoteTables: (remote) => remote.all(`SELECT tablename FROM pg_tables WHERE schemaname = 'public' ORDER BY tablename`).map((row) => row.tablename)
+};
+function nowIso() {
+  return new Date().toISOString();
 }
-function discoverServices() {
-  const dataDir = join7(homedir6(), ".hasna");
-  if (!existsSync7(dataDir))
-    return [];
+function sleepSync(ms) {
+  if (ms <= 0)
+    return;
+  const sleeper = new Int32Array(new SharedArrayBuffer(4));
+  Atomics.wait(sleeper, 0, 0, ms);
+}
+function cloneState(state) {
+  return JSON.parse(JSON.stringify(state));
+}
+function getDefaultDaemonConfig() {
+  return {
+    enabled: false,
+    paused: false,
+    watch_interval_seconds: 5,
+    pull_interval_seconds: 60,
+    push_debounce_seconds: 5,
+    conflict_strategy: "newest-wins",
+    services: [],
+    table_intervals: {},
+    file_rules: []
+  };
+}
+function getDaemonConfig(config = getCloudConfig()) {
+  const defaults2 = getDefaultDaemonConfig();
+  return {
+    ...defaults2,
+    ...config.daemon,
+    services: [...config.daemon?.services ?? defaults2.services],
+    table_intervals: { ...config.daemon?.table_intervals ?? defaults2.table_intervals },
+    file_rules: [...config.daemon?.file_rules ?? defaults2.file_rules]
+  };
+}
+function saveDaemonConfig(config) {
+  const cloudConfig = getCloudConfig();
+  cloudConfig.daemon = {
+    ...getDefaultDaemonConfig(),
+    ...config,
+    services: [...config.services],
+    table_intervals: { ...config.table_intervals },
+    file_rules: [...config.file_rules]
+  };
+  saveCloudConfig(cloudConfig);
+  return getDaemonConfig(cloudConfig);
+}
+function createDefaultDaemonState() {
+  return {
+    pid: null,
+    status: "stopped",
+    started_at: null,
+    updated_at: null,
+    last_push_at: null,
+    last_pull_at: null,
+    last_error: null,
+    services: {},
+    files: {}
+  };
+}
+function readDaemonState() {
+  if (!existsSync7(DAEMON_STATE_PATH)) {
+    return createDefaultDaemonState();
+  }
   try {
-    const entries = readdirSync4(dataDir, { withFileTypes: true });
-    return entries.filter((e) => {
-      if (!e.isDirectory())
-        return false;
-      if (e.name === "cloud" || e.name.startsWith("."))
-        return false;
-      return true;
-    }).map((e) => e.name).sort();
+    const raw = JSON.parse(readFileSync3(DAEMON_STATE_PATH, "utf-8"));
+    const defaults2 = createDefaultDaemonState();
+    return {
+      ...defaults2,
+      ...raw,
+      services: raw?.services ?? defaults2.services,
+      files: raw?.files ?? defaults2.files
+    };
   } catch {
-    return [];
+    return createDefaultDaemonState();
   }
 }
-
-// src/pg-migrate.ts
-init_adapter();
-init_config();
-async function applyPgMigrations(connectionString, migrations, service = "unknown") {
-  const pg2 = new PgAdapterAsync(connectionString);
-  const result = {
-    service,
-    applied: [],
-    alreadyApplied: [],
-    errors: [],
-    totalMigrations: migrations.length
+function writeDaemonState(state) {
+  mkdirSync4(join7(homedir6(), ".hasna", "cloud"), { recursive: true });
+  writeFileSync3(DAEMON_STATE_PATH, JSON.stringify(state, null, 2) + `
+`, "utf-8");
+}
+function getServiceState(state, service) {
+  return state.services[service] ?? {
+    last_local_db_mtime_ms: 0,
+    last_push_at: null,
+    last_pull_at: null,
+    last_error: null,
+    tables: {}
   };
+}
+function isProcessRunning(pid) {
+  if (!pid || pid <= 0)
+    return false;
   try {
-    await pg2.run(`CREATE TABLE IF NOT EXISTS _pg_migrations (
-        id SERIAL PRIMARY KEY,
-        version INT UNIQUE NOT NULL,
-        applied_at TIMESTAMPTZ DEFAULT NOW()
-      )`);
-    const applied = await pg2.all("SELECT version FROM _pg_migrations ORDER BY version");
-    const appliedSet = new Set(applied.map((r) => r.version));
-    for (let i = 0;i < migrations.length; i++) {
-      if (appliedSet.has(i)) {
-        result.alreadyApplied.push(i);
-        continue;
-      }
-      try {
-        await pg2.exec(migrations[i]);
-        await pg2.run("INSERT INTO _pg_migrations (version) VALUES ($1) ON CONFLICT DO NOTHING", i);
-        result.applied.push(i);
-      } catch (err) {
-        result.errors.push(`Migration ${i}: ${err?.message ?? String(err)}`);
-        break;
-      }
-    }
-  } finally {
-    await pg2.close();
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
   }
-  return result;
 }
-function getServicePackage(service) {
-  return `@hasna/${service}`;
+function resolveDaemonServices(config) {
+  if (config.services.length > 0) {
+    return [...new Set(config.services)].sort();
+  }
+  return discoverSyncableServices();
 }
-async function loadServiceMigrations(service) {
-  const pkg = getServicePackage(service);
-  const paths = [
-    `${pkg}/pg-migrations`,
-    `${pkg}/dist/db/pg-migrations.js`,
-    `${pkg}/dist/db/pg-migrations`
-  ];
-  for (const path of paths) {
+function parseTableIntervalRule(raw) {
+  const match = raw.match(/^([^.:=]+)[.:]([^=]+)=(\d+)$/);
+  if (!match) {
+    throw new Error(`Invalid table interval "${raw}". Use service.table=seconds or service:table=seconds.`);
+  }
+  const intervalSeconds = parseInt(match[3], 10);
+  if (intervalSeconds <= 0) {
+    throw new Error(`Invalid table interval "${raw}". Seconds must be > 0.`);
+  }
+  return {
+    service: match[1],
+    table: match[2],
+    interval_seconds: intervalSeconds
+  };
+}
+function applyTableIntervalRules(existing, rules) {
+  const next = { ...existing };
+  for (const raw of rules) {
+    const parsed = parseTableIntervalRule(raw);
+    next[parsed.service] = {
+      ...next[parsed.service] ?? {},
+      [parsed.table]: parsed.interval_seconds
+    };
+  }
+  return next;
+}
+function parseFileRule(raw) {
+  const [pathPart, intervalPart] = raw.split("=", 2);
+  const path = pathPart?.trim();
+  if (!path) {
+    throw new Error(`Invalid file rule "${raw}". Use /path/to/file=seconds.`);
+  }
+  const intervalSeconds = intervalPart ? parseInt(intervalPart, 10) : 30;
+  if (!Number.isFinite(intervalSeconds) || intervalSeconds <= 0) {
+    throw new Error(`Invalid file rule "${raw}". Seconds must be > 0.`);
+  }
+  return {
+    path,
+    interval_seconds: intervalSeconds,
+    enabled: true
+  };
+}
+function applyFileRules(existing, rules) {
+  const next = [...existing];
+  for (const raw of rules) {
+    next.push(parseFileRule(raw));
+  }
+  return next;
+}
+function isIntervalDue(lastAt, intervalSeconds, nowMs) {
+  if (!intervalSeconds)
+    return true;
+  if (!lastAt)
+    return true;
+  return nowMs - Date.parse(lastAt) >= intervalSeconds * 1000;
+}
+function scanConfiguredFiles(config, state) {
+  for (const rule of config.file_rules) {
+    const key = rule.path;
+    let lastMtime = 0;
+    let exists = false;
     try {
-      const mod = await import(path);
-      if (Array.isArray(mod.PG_MIGRATIONS)) {
-        return mod.PG_MIGRATIONS;
-      }
-      if (mod.default && Array.isArray(mod.default.PG_MIGRATIONS)) {
-        return mod.default.PG_MIGRATIONS;
-      }
-    } catch {}
+      const stats = statSync4(rule.path);
+      lastMtime = stats.mtimeMs;
+      exists = true;
+    } catch {
+      exists = false;
+    }
+    state.files[key] = {
+      path: key,
+      enabled: rule.enabled,
+      interval_seconds: rule.interval_seconds,
+      exists,
+      last_mtime_ms: lastMtime
+    };
   }
-  return null;
 }
-async function migrateService(service, connectionString) {
-  const connStr = connectionString ?? getConnectionString2(service);
-  const migrations = await loadServiceMigrations(service);
-  if (!migrations) {
-    return {
-      service,
-      applied: [],
-      alreadyApplied: [],
-      errors: [`No PG migrations found for service "${service}"`],
-      totalMigrations: 0
+function filterDueTables(service, tables, direction, serviceState, config, nowMs) {
+  const serviceIntervals = config.table_intervals[service] ?? {};
+  return tables.filter((table) => {
+    const tableState = serviceState.tables[table];
+    const lastAt = direction === "push" ? tableState?.last_push_at ?? null : tableState?.last_pull_at ?? null;
+    return isIntervalDue(lastAt, serviceIntervals[table], nowMs);
+  });
+}
+function recordTableRuns(serviceState, tables, direction, at) {
+  for (const table of tables) {
+    const current = serviceState.tables[table] ?? {
+      last_push_at: null,
+      last_pull_at: null
     };
+    if (direction === "push") {
+      current.last_push_at = at;
+    } else {
+      current.last_pull_at = at;
+    }
+    serviceState.tables[table] = current;
   }
-  return applyPgMigrations(connStr, migrations, service);
 }
-async function migrateAllServices() {
-  const { discoverServices: discoverServices3 } = await Promise.resolve().then(() => (init_discover(), exports_discover));
-  const services = discoverServices3();
-  const results = [];
+function summarizeStats(stats) {
+  return {
+    rows: stats.reduce((sum, stat) => sum + stat.synced_rows, 0),
+    errors: stats.flatMap((stat) => stat.errors.map((error) => `${stat.table}: ${error}`))
+  };
+}
+function runDaemonPass(config, state = createDefaultDaemonState(), options = {}) {
+  const nextState = cloneState(state);
+  const adapterFactory = options.adapterFactory ?? defaultDaemonAdapterFactory;
+  const services = options.services ?? resolveDaemonServices(config);
+  const now = nowIso();
+  const nowMs = Date.parse(now);
+  const summary = {
+    services,
+    pushed_services: 0,
+    pulled_services: 0,
+    pushed_rows: 0,
+    pulled_rows: 0,
+    errors: []
+  };
+  nextState.updated_at = now;
+  nextState.status = config.paused ? "paused" : "running";
+  if (config.paused) {
+    scanConfiguredFiles(config, nextState);
+    return { state: nextState, summary };
+  }
   for (const service of services) {
+    const dbPath = adapterFactory.getLocalDbPath(service);
+    if (!existsSync7(dbPath))
+      continue;
+    const serviceState = getServiceState(nextState, service);
+    let local = null;
+    let remote = null;
     try {
-      const result = await migrateService(service);
-      results.push(result);
+      const localStats = statSync4(dbPath);
+      local = adapterFactory.openLocal(service);
+      remote = adapterFactory.openRemote(service);
+      const localTables = listSqliteTables(local).filter((table) => !isSyncExcludedTable(table));
+      const duePushTables = filterDueTables(service, localTables, "push", serviceState, config, nowMs);
+      const pushDebounceDue = !serviceState.last_push_at || nowMs - Date.parse(serviceState.last_push_at) >= config.push_debounce_seconds * 1000;
+      const localChanged = localStats.mtimeMs > serviceState.last_local_db_mtime_ms;
+      const shouldPush = duePushTables.length > 0 && (options.forcePush || localChanged && pushDebounceDue);
+      if (shouldPush) {
+        const pushStats = incrementalSyncPush(local, remote, duePushTables, {
+          conflictStrategy: config.conflict_strategy
+        });
+        const pushSummary = summarizeStats(pushStats);
+        serviceState.last_local_db_mtime_ms = localStats.mtimeMs;
+        serviceState.last_push_at = now;
+        serviceState.last_error = pushSummary.errors[0] ?? null;
+        recordTableRuns(serviceState, duePushTables, "push", now);
+        nextState.last_push_at = now;
+        summary.pushed_services++;
+        summary.pushed_rows += pushSummary.rows;
+        summary.errors.push(...pushSummary.errors.map((error) => `[${service}] ${error}`));
+      } else if (serviceState.last_local_db_mtime_ms === 0) {
+        serviceState.last_local_db_mtime_ms = localStats.mtimeMs;
+      }
+      const remoteTables = adapterFactory.listRemoteTables(remote).filter((table) => !isSyncExcludedTable(table));
+      const duePullTables = filterDueTables(service, remoteTables, "pull", serviceState, config, nowMs);
+      const shouldPull = duePullTables.length > 0 && (options.forcePull || isIntervalDue(serviceState.last_pull_at, config.pull_interval_seconds, nowMs));
+      if (shouldPull) {
+        const pullStats = incrementalSyncPull(remote, local, duePullTables, {
+          conflictStrategy: config.conflict_strategy
+        });
+        const pullSummary = summarizeStats(pullStats);
+        serviceState.last_pull_at = now;
+        serviceState.last_error = pullSummary.errors[0] ?? null;
+        recordTableRuns(serviceState, duePullTables, "pull", now);
+        nextState.last_pull_at = now;
+        summary.pulled_services++;
+        summary.pulled_rows += pullSummary.rows;
+        summary.errors.push(...pullSummary.errors.map((error) => `[${service}] ${error}`));
+      }
     } catch (err) {
-      results.push({
-        service,
-        applied: [],
-        alreadyApplied: [],
-        errors: [err?.message ?? String(err)],
-        totalMigrations: 0
-      });
+      const message = err?.message ?? String(err);
+      serviceState.last_error = message;
+      nextState.last_error = message;
+      summary.errors.push(`[${service}] ${message}`);
+    } finally {
+      nextState.services[service] = serviceState;
+      try {
+        local?.close();
+      } catch {}
+      try {
+        remote?.close();
+      } catch {}
     }
   }
-  return results;
+  if (summary.errors.length > 0) {
+    nextState.last_error = summary.errors[0];
+  }
+  scanConfiguredFiles(config, nextState);
+  return { state: nextState, summary };
 }
-async function ensurePgDatabase(service) {
-  const config = (await Promise.resolve().then(() => (init_config(), exports_config))).getCloudConfig();
-  const { host, port, username, password_env, ssl } = config.rds;
-  if (!host || !username)
-    return false;
-  const password = process.env[password_env] ?? "";
-  const sslParam = ssl ? "?sslmode=require" : "";
-  const adminConnStr = `postgres://${username}:${encodeURIComponent(password)}@${host}:${port}/postgres${sslParam}`;
-  const pg2 = new PgAdapterAsync(adminConnStr);
+function getDaemonStatus() {
+  const config = getDaemonConfig();
+  const state = readDaemonState();
+  const running = isProcessRunning(state.pid);
+  const status = running ? config.paused ? "paused" : state.status : "stopped";
+  return {
+    running,
+    pid: running ? state.pid : null,
+    status,
+    config,
+    state: {
+      ...state,
+      status,
+      pid: running ? state.pid : null
+    },
+    services: resolveDaemonServices(config)
+  };
+}
+function getDaemonArgs() {
+  const script = process.argv[1];
+  if (!script) {
+    throw new Error("Unable to determine the current CLI entrypoint.");
+  }
+  return [script, "sync", "daemon", "--run"];
+}
+function startDaemon(overrides = {}) {
+  const current = getDaemonConfig();
+  const nextConfig = saveDaemonConfig({
+    ...current,
+    ...overrides,
+    enabled: true,
+    paused: false,
+    services: overrides.services ?? current.services,
+    table_intervals: overrides.table_intervals ?? current.table_intervals,
+    file_rules: overrides.file_rules ?? current.file_rules
+  });
+  const currentStatus = getDaemonStatus();
+  if (currentStatus.running) {
+    return currentStatus;
+  }
+  const child = spawn(process.execPath, getDaemonArgs(), {
+    detached: true,
+    stdio: "ignore",
+    env: {
+      ...process.env,
+      HASNA_CLOUD_DAEMON_CHILD: "1"
+    }
+  });
+  child.unref();
+  const state = readDaemonState();
+  const startedAt = nowIso();
+  state.pid = child.pid ?? null;
+  state.status = "running";
+  state.started_at = startedAt;
+  state.updated_at = startedAt;
+  writeDaemonState(state);
+  return {
+    running: true,
+    pid: child.pid ?? null,
+    status: "running",
+    config: nextConfig,
+    state,
+    services: resolveDaemonServices(nextConfig)
+  };
+}
+function stopDaemon() {
+  const current = getDaemonConfig();
+  saveDaemonConfig({ ...current, enabled: false });
+  const status = getDaemonStatus();
+  if (status.pid) {
+    try {
+      process.kill(status.pid, "SIGTERM");
+    } catch {}
+  }
+  const state = readDaemonState();
+  state.pid = null;
+  state.status = "stopped";
+  state.updated_at = nowIso();
+  writeDaemonState(state);
+  return getDaemonStatus();
+}
+function pauseDaemon() {
+  const current = getDaemonConfig();
+  saveDaemonConfig({ ...current, paused: true });
+  const state = readDaemonState();
+  if (state.pid) {
+    state.status = "paused";
+    state.updated_at = nowIso();
+    writeDaemonState(state);
+  }
+  return getDaemonStatus();
+}
+function resumeDaemon() {
+  const current = getDaemonConfig();
+  saveDaemonConfig({ ...current, enabled: true, paused: false });
+  const state = readDaemonState();
+  if (state.pid) {
+    state.status = "running";
+    state.updated_at = nowIso();
+    writeDaemonState(state);
+  }
+  return getDaemonStatus();
+}
+function runDaemonOnce(options = {}) {
+  const config = options.config ?? getDaemonConfig();
+  const state = options.state ?? readDaemonState();
+  const result = runDaemonPass(config, state, {
+    adapterFactory: options.adapterFactory,
+    forcePull: options.forcePull,
+    forcePush: options.forcePush,
+    services: options.services
+  });
+  writeDaemonState(result.state);
+  return result;
+}
+function runDaemonLoop(options = {}) {
+  let stopping = false;
+  const stop = () => {
+    stopping = true;
+  };
+  process.on("SIGTERM", stop);
+  process.on("SIGINT", stop);
+  let passes = 0;
+  const startedAt = nowIso();
   try {
-    const existing = await pg2.all(`SELECT 1 FROM pg_database WHERE datname = $1`, service);
-    if (existing.length === 0) {
-      await pg2.exec(`CREATE DATABASE "${service}"`);
-      return true;
+    while (!stopping) {
+      const config = getDaemonConfig();
+      const state = readDaemonState();
+      if (!config.enabled) {
+        break;
+      }
+      state.pid = process.pid;
+      state.started_at = state.started_at ?? startedAt;
+      state.updated_at = nowIso();
+      writeDaemonState(state);
+      const result = runDaemonPass(config, state, {
+        adapterFactory: options.adapterFactory
+      });
+      result.state.pid = process.pid;
+      result.state.started_at = state.started_at ?? startedAt;
+      result.state.status = config.paused ? "paused" : "running";
+      result.state.updated_at = nowIso();
+      writeDaemonState(result.state);
+      passes++;
+      if (options.max_passes && passes >= options.max_passes) {
+        break;
+      }
+      sleepSync(config.watch_interval_seconds * 1000);
     }
-    return false;
   } finally {
-    await pg2.close();
+    const finalState = readDaemonState();
+    finalState.pid = null;
+    finalState.status = "stopped";
+    finalState.updated_at = nowIso();
+    writeDaemonState(finalState);
   }
 }
-async function ensureAllPgDatabases() {
-  const { discoverServices: discoverServices3 } = await Promise.resolve().then(() => (init_discover(), exports_discover));
-  const services = discoverServices3();
-  const results = [];
-  for (const service of services) {
-    try {
-      const created = await ensurePgDatabase(service);
-      results.push({ service, created });
-    } catch (err) {
-      results.push({ service, created: false, error: err?.message ?? String(err) });
-    }
+function normalizeConflictStrategy(strategy) {
+  if (!strategy)
+    return "newest-wins";
+  if (strategy !== "newest-wins" && strategy !== "local-wins" && strategy !== "remote-wins") {
+    throw new Error(`Invalid conflict strategy "${strategy}". Use newest-wins, local-wins, or remote-wins.`);
   }
-  return results;
+  return strategy;
 }
 
-// src/cli/index.ts
-import { existsSync as existsSync9, statSync as statSync6 } from "fs";
-import { join as join9 } from "path";
-import { homedir as homedir8 } from "os";
-var program2 = new Command;
+// src/cli/cmd-sync.ts
 function logSync(direction, service, rows, errors2) {
   try {
-    const logDir = join9(homedir8(), ".hasna", "cloud");
-    const logPath = join9(logDir, "sync.log");
-    const { mkdirSync: mkdirSync6, appendFileSync } = __require("fs");
-    mkdirSync6(logDir, { recursive: true });
+    const logDir = join8(homedir7(), ".hasna", "cloud");
+    const logPath = join8(logDir, "sync.log");
+    const { mkdirSync: mkdirSync5, appendFileSync } = __require("fs");
+    mkdirSync5(logDir, { recursive: true });
     const ts = new Date().toISOString();
     appendFileSync(logPath, `${ts} ${direction.padEnd(4)} ${service.padEnd(20)} ${rows} rows, ${errors2} errors
 `);
   } catch {}
 }
-program2.name("cloud").description("Shared cloud infrastructure \u2014 database adapter, sync engine, feedback, dotfile migration").version("0.1.8");
-program2.command("setup").description("Configure cloud settings \u2014 interactive wizard or flags").option("--host <host>", "RDS hostname").option("--port <port>", "RDS port", "5432").option("--username <user>", "RDS username").option("--password-env <env>", "Env var for RDS password", "HASNA_RDS_PASSWORD").option("--ssl", "Enable SSL", true).option("--no-ssl", "Disable SSL").option("--mode <mode>", "Mode: local, cloud, or hybrid").option("--schedule <interval>", "Sync schedule (e.g. 30m, 1h)").option("--migrate", "Run PG migrations after setup").option("--pull", "Pull data from cloud after setup").action(async (opts) => {
-  const config = getCloudConfig();
-  const isAutoDetect = !opts.host && !opts.username;
-  if (isAutoDetect) {
-    const envHost = process.env.HASNA_RDS_HOST;
-    const envUser = process.env.HASNA_RDS_USERNAME;
-    if (envHost && !config.rds.host) {
-      config.rds.host = envHost;
-      console.log(`Auto-detected RDS host: ${envHost}`);
-    }
-    if (envUser && !config.rds.username) {
-      config.rds.username = envUser;
-      console.log(`Auto-detected RDS username: ${envUser}`);
-    }
-  }
-  if (opts.host)
-    config.rds.host = opts.host;
-  if (opts.port)
-    config.rds.port = parseInt(opts.port, 10);
-  if (opts.username)
-    config.rds.username = opts.username;
-  if (opts.passwordEnv)
-    config.rds.password_env = opts.passwordEnv;
-  config.rds.ssl = opts.ssl;
-  if (opts.mode) {
-    config.mode = opts.mode;
-  } else if (config.mode === "local" && config.rds.host) {
-    config.mode = "hybrid";
-    console.log("Mode set to: hybrid (auto-upgraded from local)");
+function registerSyncCommands(syncCmd) {
+  registerPushCommand(syncCmd);
+  registerPullCommand(syncCmd);
+  registerStatusCommand(syncCmd);
+  registerConflictsCommand(syncCmd);
+  registerResolveCommand(syncCmd);
+  registerScheduleCommand(syncCmd);
+  registerDaemonCommand(syncCmd);
+}
+function collectValues(value, previous = []) {
+  previous.push(value);
+  return previous;
+}
+function parsePositiveSeconds(raw, label) {
+  const value = parseInt(raw, 10);
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new Error(`${label} must be a positive integer.`);
   }
-  saveCloudConfig(config);
-  console.log(`
-\u2713 Configuration saved
-`);
-  const password = process.env[config.rds.password_env];
-  if (!password) {
-    console.error(`\u2717 ${config.rds.password_env} not set in environment`);
-    console.error(`  Add it to ~/.secrets/hasna/rds/live.env and source it`);
-    return;
+  return value;
+}
+function countTableOverrides(tableIntervals) {
+  return Object.values(tableIntervals).reduce((total, serviceRules) => total + Object.keys(serviceRules).length, 0);
+}
+function printDaemonStatus() {
+  const status = getDaemonStatus();
+  const fileRuleCount = status.config.file_rules.filter((rule) => rule.enabled).length;
+  console.log(`Daemon: ${status.status}`);
+  console.log(`  Running: ${status.running ? "yes" : "no"}`);
+  console.log(`  PID: ${status.pid ?? "—"}`);
+  console.log(`  Services: ${status.services.length > 0 ? status.services.join(", ") : "(auto-discover)"}`);
+  console.log(`  Watch interval: ${status.config.watch_interval_seconds}s`);
+  console.log(`  Pull interval: ${status.config.pull_interval_seconds}s`);
+  console.log(`  Push debounce: ${status.config.push_debounce_seconds}s`);
+  console.log(`  Conflict strategy: ${status.config.conflict_strategy}`);
+  console.log(`  Table overrides: ${countTableOverrides(status.config.table_intervals)}`);
+  console.log(`  File rules: ${fileRuleCount}`);
+  if (status.state.started_at) {
+    console.log(`  Started: ${status.state.started_at}`);
+  }
+  if (status.state.last_push_at) {
+    console.log(`  Last push: ${status.state.last_push_at}`);
+  }
+  if (status.state.last_pull_at) {
+    console.log(`  Last pull: ${status.state.last_pull_at}`);
+  }
+  if (status.state.last_error) {
+    console.log(`  Last error: ${status.state.last_error}`);
   }
-  if (config.rds.host) {
-    process.stdout.write("Testing PG connection... ");
-    try {
-      const connStr = getConnectionString("postgres");
-      const pg2 = new PgAdapterAsync2(connStr);
-      await pg2.all("SELECT 1");
-      await pg2.close();
-      console.log(`\u2713 Connected
-`);
-    } catch (err) {
-      console.log(`\u2717 Failed: ${err?.message ?? String(err)}`);
-      return;
+}
+function registerPushCommand(syncCmd) {
+  syncCmd.command("push").description("Push local data to cloud").option("--service <name>", "Service name").option("--all", "Push all discovered services").option("--tables <tables>", "Comma-separated table names (default: all)").option("--dry-run", "Preview what would be synced without executing").action(async (opts) => {
+    const config = getCloudConfig();
+    if (config.mode === "local") {
+      console.error("Error: mode is 'local'. Run `cloud setup --mode hybrid` or `--mode cloud` first.");
+      process.exit(1);
+    }
+    if (!opts.service && !opts.all) {
+      console.error("Error: specify --service <name> or --all");
+      process.exit(1);
     }
-    if (opts.migrate !== false) {
-      console.log("Creating databases & running migrations...");
-      const dbResults = await ensureAllPgDatabases();
-      const created = dbResults.filter((r) => r.created);
-      if (created.length > 0) {
-        console.log(`  Created ${created.length} database(s): ${created.map((r) => r.service).join(", ")}`);
-      }
-      const migResults = await migrateAllServices();
-      const applied = migResults.filter((r) => r.applied.length > 0);
-      const totalApplied = migResults.reduce((s, r) => s + r.applied.length, 0);
-      if (totalApplied > 0) {
-        console.log(`  Applied ${totalApplied} migration(s) across ${applied.length} service(s)`);
+    const services = opts.all ? discoverServices() : [opts.service];
+    let grandTotalWritten = 0;
+    let grandTotalErrors = 0;
+    for (const service of services) {
+      const dbPath = getDbPath(service);
+      let local;
+      try {
+        local = new SqliteAdapter(dbPath);
+      } catch {
+        if (opts.all)
+          continue;
+        console.error(`No local database found for service "${service}"`);
+        process.exit(1);
+        return;
+      }
+      let tables;
+      if (opts.tables) {
+        tables = opts.tables.split(",").map((t) => t.trim());
       } else {
-        console.log("  All migrations up to date");
+        tables = listSqliteTables(local).filter((t) => !isSyncExcludedTable(t));
       }
-      console.log("");
-    }
-    if (opts.schedule) {
+      if (tables.length === 0) {
+        local.close();
+        continue;
+      }
+      if (opts.dryRun) {
+        const rowCounts = tables.map((t) => {
+          try {
+            const r = local.get(`SELECT COUNT(*) as cnt FROM "${t}"`);
+            return `${t}: ${r?.cnt ?? 0} rows`;
+          } catch {
+            return `${t}: ?`;
+          }
+        });
+        console.log(`[${service}] Would push ${tables.length} table(s): ${rowCounts.join(", ")}`);
+        local.close();
+        continue;
+      }
+      console.log(`[${service}] Pushing ${tables.length} table(s) to cloud...`);
+      let connStr;
       try {
-        const minutes = parseInterval(opts.schedule);
-        await registerSyncSchedule(minutes);
-        console.log(`\u2713 Sync scheduled every ${minutes}m
-`);
+        connStr = getConnectionString(service);
       } catch (err) {
-        console.error(`\u2717 Schedule failed: ${err?.message}`);
+        console.error(`  [${service}] ${err?.message ?? String(err)}`);
+        local.close();
+        grandTotalErrors++;
+        continue;
       }
-    }
-    if (opts.pull) {
-      console.log("Pulling data from cloud...");
-      const services = discoverServices();
-      for (const service of services) {
-        try {
-          const dbPath = getDbPath2(service);
-          const local = new SqliteAdapter2(dbPath);
-          const connStr = getConnectionString(service);
-          const cloud = new PgAdapterAsync2(connStr);
-          const tables = (await listPgTables(cloud)).filter((t) => !isSyncExcludedTable(t));
-          if (tables.length > 0) {
-            const results = await syncPull(cloud, local, { tables });
-            const written = results.reduce((s, r) => s + r.rowsWritten, 0);
-            if (written > 0)
-              console.log(`  ${service}: ${written} rows`);
+      const cloud = new PgAdapterAsync(connStr);
+      const results = await syncPush(local, cloud, {
+        tables,
+        onProgress: (p) => {
+          if (p.phase === "done" && !opts.all) {
+            console.log(`  [${p.currentTableIndex + 1}/${p.totalTables}] ${p.table}: ${p.rowsWritten} rows synced`);
           }
-          local.close();
-          await cloud.close();
-        } catch {}
+        }
+      });
+      local.close();
+      await cloud.close();
+      const totalWritten = results.reduce((s, r) => s + r.rowsWritten, 0);
+      const totalErrors = results.reduce((s, r) => s + r.errors.length, 0);
+      grandTotalWritten += totalWritten;
+      grandTotalErrors += totalErrors;
+      logSync("push", service, totalWritten, totalErrors);
+      if (opts.all) {
+        console.log(`  ${service}: ${totalWritten} rows pushed${totalErrors > 0 ? `, ${totalErrors} errors` : ""}`);
+      } else {
+        console.log(`
+Done. ${totalWritten} rows pushed, ${totalErrors} errors.`);
+        if (totalErrors > 0) {
+          for (const r of results) {
+            for (const e of r.errors) {
+              console.error(`  ${r.table}: ${e}`);
+            }
+          }
+        }
       }
-      console.log("");
     }
-  }
-  console.log("Setup complete. Run `cloud doctor` to verify everything.");
-});
-program2.command("status").description("Show current cloud configuration and connection health").action(async () => {
-  const config = getCloudConfig();
-  console.log("Mode:", config.mode);
-  console.log("RDS Host:", config.rds.host || "(not configured)");
-  console.log("RDS Port:", config.rds.port);
-  console.log("RDS Username:", config.rds.username || "(not configured)");
-  console.log("SSL:", config.rds.ssl);
-  console.log("Auto-sync interval:", config.auto_sync_interval_minutes ? `${config.auto_sync_interval_minutes} minutes` : "disabled");
-  if (config.rds.host && config.rds.username) {
-    console.log(`
-Checking PostgreSQL connection...`);
-    try {
-      const connStr = getConnectionString("postgres");
-      const pg2 = new PgAdapterAsync2(connStr);
-      const row = await pg2.get("SELECT 1 as ok");
-      if (row?.ok === 1) {
-        console.log("PostgreSQL: connected");
-      }
-      await pg2.close();
-    } catch (err) {
-      console.log("PostgreSQL: connection failed \u2014", err?.message);
+    if (opts.all) {
+      console.log(`
+Done. ${services.length} services, ${grandTotalWritten} rows pushed, ${grandTotalErrors} errors.`);
     }
-  }
-});
-var syncCmd = program2.command("sync").description("Sync data between local and cloud");
-syncCmd.command("push").description("Push local data to cloud").option("--service <name>", "Service name").option("--all", "Push all discovered services").option("--tables <tables>", "Comma-separated table names (default: all)").option("--dry-run", "Preview what would be synced without executing").action(async (opts) => {
-  const config = getCloudConfig();
-  if (config.mode === "local") {
-    console.error("Error: mode is 'local'. Run `cloud setup --mode hybrid` or `--mode cloud` first.");
-    process.exit(1);
-  }
-  if (!opts.service && !opts.all) {
-    console.error("Error: specify --service <name> or --all");
-    process.exit(1);
-  }
-  const services = opts.all ? discoverServices() : [opts.service];
-  let grandTotalWritten = 0;
-  let grandTotalErrors = 0;
-  for (const service of services) {
-    const dbPath = getDbPath2(service);
-    let local;
-    try {
-      local = new SqliteAdapter2(dbPath);
-    } catch {
-      if (opts.all)
-        continue;
-      console.error(`No local database found for service "${service}"`);
+  });
+}
+function registerPullCommand(syncCmd) {
+  syncCmd.command("pull").description("Pull cloud data to local").option("--service <name>", "Service name").option("--all", "Pull all discovered services").option("--tables <tables>", "Comma-separated table names (default: all)").option("--dry-run", "Preview what would be synced without executing").action(async (opts) => {
+    const config = getCloudConfig();
+    if (config.mode === "local") {
+      console.error("Error: mode is 'local'. Run `cloud setup --mode hybrid` or `--mode cloud` first.");
       process.exit(1);
-      return;
-    }
-    let tables;
-    if (opts.tables) {
-      tables = opts.tables.split(",").map((t) => t.trim());
-    } else {
-      tables = listSqliteTables(local).filter((t) => !isSyncExcludedTable(t));
     }
-    if (tables.length === 0) {
-      local.close();
-      continue;
+    if (!opts.service && !opts.all) {
+      console.error("Error: specify --service <name> or --all");
+      process.exit(1);
     }
-    if (opts.dryRun) {
-      const rowCounts = tables.map((t) => {
+    const services = opts.all ? discoverServices() : [opts.service];
+    let grandTotalWritten = 0;
+    let grandTotalErrors = 0;
+    for (const service of services) {
+      const dbPath = getDbPath(service);
+      let local;
+      try {
+        local = new SqliteAdapter(dbPath);
+      } catch {
+        if (opts.all)
+          continue;
+        console.error(`No local database found for service "${service}"`);
+        process.exit(1);
+        return;
+      }
+      let connStr;
+      try {
+        connStr = getConnectionString(service);
+      } catch (err) {
+        console.error(`  [${service}] ${err?.message ?? String(err)}`);
+        local.close();
+        grandTotalErrors++;
+        continue;
+      }
+      const cloud = new PgAdapterAsync(connStr);
+      let tables;
+      if (opts.tables) {
+        tables = opts.tables.split(",").map((t) => t.trim());
+      } else {
         try {
-          const r = local.get(`SELECT COUNT(*) as cnt FROM "${t}"`);
-          return `${t}: ${r?.cnt ?? 0} rows`;
+          tables = (await listPgTables(cloud)).filter((t) => !isSyncExcludedTable(t));
         } catch {
-          return `${t}: ?`;
+          if (!opts.all)
+            console.error(`Failed to list tables from cloud for "${service}".`);
+          local.close();
+          await cloud.close();
+          if (!opts.all) {
+            process.exit(1);
+            return;
+          }
+          grandTotalErrors++;
+          continue;
+        }
+      }
+      if (tables.length === 0) {
+        local.close();
+        await cloud.close();
+        continue;
+      }
+      if (opts.dryRun) {
+        console.log(`[${service}] Would pull ${tables.length} table(s): ${tables.join(", ")}`);
+        local.close();
+        await cloud.close();
+        continue;
+      }
+      if (!opts.all)
+        console.log(`Pulling ${tables.length} table(s) from cloud...`);
+      const results = await syncPull(cloud, local, {
+        tables,
+        onProgress: (p) => {
+          if (p.phase === "done" && !opts.all) {
+            console.log(`  [${p.currentTableIndex + 1}/${p.totalTables}] ${p.table}: ${p.rowsWritten} rows synced`);
+          }
         }
       });
-      console.log(`[${service}] Would push ${tables.length} table(s): ${rowCounts.join(", ")}`);
       local.close();
-      continue;
-    }
-    console.log(`[${service}] Pushing ${tables.length} table(s) to cloud...`);
-    let connStr;
-    try {
-      connStr = getConnectionString(service);
-    } catch (err) {
-      console.error(`  [${service}] ${err?.message ?? String(err)}`);
-      local.close();
-      grandTotalErrors++;
-      continue;
-    }
-    const cloud = new PgAdapterAsync2(connStr);
-    const results = await syncPush(local, cloud, {
-      tables,
-      onProgress: (p) => {
-        if (p.phase === "done" && !opts.all) {
-          console.log(`  [${p.currentTableIndex + 1}/${p.totalTables}] ${p.table}: ${p.rowsWritten} rows synced`);
+      await cloud.close();
+      const totalWritten = results.reduce((s, r) => s + r.rowsWritten, 0);
+      const totalErrors = results.reduce((s, r) => s + r.errors.length, 0);
+      grandTotalWritten += totalWritten;
+      grandTotalErrors += totalErrors;
+      logSync("pull", service, totalWritten, totalErrors);
+      if (opts.all) {
+        if (totalWritten > 0 || totalErrors > 0) {
+          console.log(`  ${service}: ${totalWritten} rows pulled${totalErrors > 0 ? `, ${totalErrors} errors` : ""}`);
+        }
+      } else {
+        console.log(`
+Done. ${totalWritten} rows pulled, ${totalErrors} errors.`);
+        if (totalErrors > 0) {
+          for (const r of results) {
+            for (const e of r.errors) {
+              console.error(`  ${r.table}: ${e}`);
+            }
+          }
         }
       }
-    });
-    local.close();
-    await cloud.close();
-    const totalWritten = results.reduce((s, r) => s + r.rowsWritten, 0);
-    const totalErrors = results.reduce((s, r) => s + r.errors.length, 0);
-    grandTotalWritten += totalWritten;
-    grandTotalErrors += totalErrors;
-    logSync("push", service, totalWritten, totalErrors);
+    }
     if (opts.all) {
-      console.log(`  ${service}: ${totalWritten} rows pushed${totalErrors > 0 ? `, ${totalErrors} errors` : ""}`);
-    } else {
       console.log(`
-Done. ${totalWritten} rows pushed, ${totalErrors} errors.`);
-      if (totalErrors > 0) {
-        for (const r of results) {
-          for (const e of r.errors) {
-            console.error(`  ${r.table}: ${e}`);
-          }
-        }
+Done. ${services.length} services, ${grandTotalWritten} rows pulled, ${grandTotalErrors} errors.`);
+    }
+  });
+}
+function registerStatusCommand(syncCmd) {
+  syncCmd.command("status").description("Show sync status for all discovered services").option("--service <name>", "Show status for a single service").option("--json", "Output as JSON").action(async (opts) => {
+    const services = opts.service ? [opts.service] : discoverServices();
+    const statuses = [];
+    for (const service of services) {
+      const dbPath = getDbPath(service);
+      const localExists = existsSync8(dbPath);
+      let localSize = "—";
+      let tableCount = 0;
+      if (localExists) {
+        try {
+          const stat = statSync5(dbPath);
+          localSize = stat.size > 1024 * 1024 ? `${(stat.size / 1024 / 1024).toFixed(1)}MB` : `${(stat.size / 1024).toFixed(0)}KB`;
+        } catch {}
+        try {
+          const local = new SqliteAdapter(dbPath);
+          const tables = listSqliteTables(local);
+          tableCount = tables.length;
+          local.close();
+        } catch {}
       }
+      let pgReachable = false;
+      try {
+        const connStr = getConnectionString(service);
+        const pg2 = new PgAdapterAsync(connStr);
+        await pg2.all("SELECT 1");
+        pgReachable = true;
+        await pg2.close();
+      } catch {}
+      statuses.push({ service, localDb: localExists ? dbPath : null, localSize, tables: tableCount, pgReachable });
     }
-  }
-  if (opts.all) {
-    console.log(`
-Done. ${services.length} services, ${grandTotalWritten} rows pushed, ${grandTotalErrors} errors.`);
-  }
-});
-syncCmd.command("pull").description("Pull cloud data to local").option("--service <name>", "Service name").option("--all", "Pull all discovered services").option("--tables <tables>", "Comma-separated table names (default: all)").option("--dry-run", "Preview what would be synced without executing").action(async (opts) => {
-  const config = getCloudConfig();
-  if (config.mode === "local") {
-    console.error("Error: mode is 'local'. Run `cloud setup --mode hybrid` or `--mode cloud` first.");
-    process.exit(1);
-  }
-  if (!opts.service && !opts.all) {
-    console.error("Error: specify --service <name> or --all");
-    process.exit(1);
-  }
-  const services = opts.all ? discoverServices() : [opts.service];
-  let grandTotalWritten = 0;
-  let grandTotalErrors = 0;
-  for (const service of services) {
-    const dbPath = getDbPath2(service);
-    let local;
-    try {
-      local = new SqliteAdapter2(dbPath);
-    } catch {
-      if (opts.all)
-        continue;
-      console.error(`No local database found for service "${service}"`);
-      process.exit(1);
+    if (opts.json) {
+      console.log(JSON.stringify(statuses, null, 2));
       return;
     }
-    let connStr;
-    try {
-      connStr = getConnectionString(service);
-    } catch (err) {
-      console.error(`  [${service}] ${err?.message ?? String(err)}`);
-      local.close();
-      grandTotalErrors++;
-      continue;
+    const config = getCloudConfig();
+    console.log(`Mode: ${config.mode}`);
+    console.log(`Services: ${statuses.length}
+`);
+    for (const s of statuses) {
+      if (!s.localDb && !s.pgReachable)
+        continue;
+      const pgIcon = s.pgReachable ? "✓" : "✗";
+      console.log(`  ${s.service.padEnd(20)} ${s.localSize.padStart(8)}  ${String(s.tables).padStart(3)} tables  PG: ${pgIcon}`);
     }
-    const cloud = new PgAdapterAsync2(connStr);
-    let tables;
-    if (opts.tables) {
-      tables = opts.tables.split(",").map((t) => t.trim());
-    } else {
+    const withData = statuses.filter((s) => s.localDb);
+    const pgOk = statuses.filter((s) => s.pgReachable);
+    let totalConflicts = 0;
+    for (const s of statuses) {
+      if (!s.localDb)
+        continue;
       try {
-        tables = (await listPgTables(cloud)).filter((t) => !isSyncExcludedTable(t));
-      } catch {
-        if (!opts.all)
-          console.error(`Failed to list tables from cloud for "${service}".`);
+        const local = new SqliteAdapter(getDbPath(s.service));
+        const pending = listConflicts(local, { resolved: false });
         local.close();
-        await cloud.close();
-        if (!opts.all) {
-          process.exit(1);
-          return;
+        if (pending.length > 0) {
+          console.log(`  ⚠ ${s.service}: ${pending.length} unresolved conflict(s) — run \`cloud sync conflicts --service ${s.service}\``);
+          totalConflicts += pending.length;
         }
-        grandTotalErrors++;
+      } catch {}
+    }
+    console.log(`
+${withData.length} with local data, ${pgOk.length} with PG connection${totalConflicts > 0 ? `, ${totalConflicts} unresolved conflict(s)` : ""}`);
+  });
+}
+function registerConflictsCommand(syncCmd) {
+  syncCmd.command("conflicts").description("List stored sync conflicts").option("--service <name>", "Service name (default: all discovered services)").option("--table <name>", "Filter by table name").option("--resolved", "Show resolved conflicts instead of unresolved").option("--json", "Output as JSON").action((opts) => {
+    const services = opts.service ? [opts.service] : discoverServices();
+    const allConflicts = [];
+    for (const service of services) {
+      let local;
+      try {
+        local = new SqliteAdapter(getDbPath(service));
+      } catch {
         continue;
       }
-    }
-    if (tables.length === 0) {
+      const conflicts = listConflicts(local, {
+        resolved: opts.resolved ? true : false,
+        table: opts.table
+      });
       local.close();
-      await cloud.close();
-      continue;
+      for (const c of conflicts) {
+        allConflicts.push({ service, ...c });
+      }
     }
-    if (opts.dryRun) {
-      console.log(`[${service}] Would pull ${tables.length} table(s): ${tables.join(", ")}`);
-      local.close();
-      await cloud.close();
-      continue;
+    if (opts.json) {
+      console.log(JSON.stringify(allConflicts, null, 2));
+      return;
     }
-    if (!opts.all)
-      console.log(`Pulling ${tables.length} table(s) from cloud...`);
-    const results = await syncPull(cloud, local, {
-      tables,
-      onProgress: (p) => {
-        if (p.phase === "done" && !opts.all) {
-          console.log(`  [${p.currentTableIndex + 1}/${p.totalTables}] ${p.table}: ${p.rowsWritten} rows synced`);
-        }
-      }
-    });
-    local.close();
-    await cloud.close();
-    const totalWritten = results.reduce((s, r) => s + r.rowsWritten, 0);
-    const totalErrors = results.reduce((s, r) => s + r.errors.length, 0);
-    grandTotalWritten += totalWritten;
-    grandTotalErrors += totalErrors;
-    logSync("pull", service, totalWritten, totalErrors);
-    if (opts.all) {
-      if (totalWritten > 0 || totalErrors > 0) {
-        console.log(`  ${service}: ${totalWritten} rows pulled${totalErrors > 0 ? `, ${totalErrors} errors` : ""}`);
-      }
-    } else {
+    if (allConflicts.length === 0) {
+      console.log(opts.resolved ? "No resolved conflicts found." : "No unresolved conflicts.");
+      return;
+    }
+    const label = opts.resolved ? "resolved" : "unresolved";
+    console.log(`${allConflicts.length} ${label} conflict(s):
+`);
+    for (const c of allConflicts) {
+      const resolution = c.resolution ? ` [${c.resolution}]` : "";
+      console.log(`  ${c.service}/${c.table_name} row=${c.row_id}${resolution}`);
+      console.log(`    local:  ${c.local_updated_at ?? "—"}`);
+      console.log(`    remote: ${c.remote_updated_at ?? "—"}`);
+      console.log(`    id: ${c.id}`);
+    }
+    if (!opts.resolved) {
       console.log(`
-Done. ${totalWritten} rows pulled, ${totalErrors} errors.`);
-      if (totalErrors > 0) {
-        for (const r of results) {
-          for (const e of r.errors) {
-            console.error(`  ${r.table}: ${e}`);
+Resolve with: cloud sync resolve --service <name> --strategy <local-wins|remote-wins|newest-wins>`);
+    }
+  });
+}
+function registerResolveCommand(syncCmd) {
+  syncCmd.command("resolve").description("Resolve stored sync conflicts using a strategy").option("--service <name>", "Service name (default: all discovered services)").option("--id <id>", "Resolve a specific conflict by ID").option("--table <name>", "Resolve all conflicts for a specific table").option("--all", "Resolve all unresolved conflicts").requiredOption("--strategy <strategy>", "Resolution strategy: local-wins, remote-wins, newest-wins").option("--purge", "Delete resolved conflicts after resolving").option("--dry-run", "Show what would be resolved without applying").action((opts) => {
+    const validStrategies = ["local-wins", "remote-wins", "newest-wins"];
+    if (!validStrategies.includes(opts.strategy)) {
+      console.error(`Invalid strategy "${opts.strategy}". Use: local-wins, remote-wins, newest-wins`);
+      process.exit(1);
+    }
+    if (!opts.id && !opts.table && !opts.all) {
+      console.error("Specify --id <id>, --table <name>, or --all");
+      process.exit(1);
+    }
+    const services = opts.service ? [opts.service] : discoverServices();
+    let totalResolved = 0;
+    for (const service of services) {
+      let local;
+      try {
+        local = new SqliteAdapter(getDbPath(service));
+      } catch {
+        continue;
+      }
+      if (opts.id) {
+        if (opts.dryRun) {
+          console.log(`[dry-run] Would resolve conflict ${opts.id} using ${opts.strategy}`);
+          local.close();
+          continue;
+        }
+        const updated = resolveConflict(local, opts.id, opts.strategy);
+        if (updated) {
+          console.log(`Resolved: ${updated.id} → ${opts.strategy}`);
+          totalResolved++;
+        } else {
+          console.log(`Conflict not found: ${opts.id}`);
+        }
+      } else {
+        const pending = listConflicts(local, { resolved: false, table: opts.table });
+        if (pending.length === 0) {
+          local.close();
+          continue;
+        }
+        if (opts.dryRun) {
+          console.log(`[dry-run] [${service}] Would resolve ${pending.length} conflict(s) using ${opts.strategy}`);
+          for (const c of pending) {
+            console.log(`  ${c.table_name} row=${c.row_id} (id: ${c.id})`);
           }
+          local.close();
+          continue;
+        }
+        let serviceResolved = 0;
+        for (const c of pending) {
+          if (resolveConflict(local, c.id, opts.strategy))
+            serviceResolved++;
         }
+        if (serviceResolved > 0) {
+          console.log(`[${service}] Resolved ${serviceResolved} conflict(s) → ${opts.strategy}`);
+          totalResolved += serviceResolved;
+        }
+      }
+      if (opts.purge && !opts.dryRun) {
+        const purged = purgeResolvedConflicts(local);
+        if (purged > 0)
+          console.log(`[${service}] Purged ${purged} resolved conflict(s)`);
       }
+      local.close();
     }
-  }
-  if (opts.all) {
-    console.log(`
-Done. ${services.length} services, ${grandTotalWritten} rows pulled, ${grandTotalErrors} errors.`);
-  }
-});
-program2.command("migrate-pg").description("Apply PG migrations for services").option("--service <name>", "Service name").option("--all", "Migrate all discovered services").option("--create-db", "Create PG databases if they don't exist (default: true)", true).action(async (opts) => {
-  if (!opts.service && !opts.all) {
-    console.error("Error: specify --service <name> or --all");
-    process.exit(1);
-  }
-  if (opts.all) {
-    if (opts.createDb) {
-      console.log("Ensuring PG databases exist...");
-      const dbResults = await ensureAllPgDatabases();
-      for (const r of dbResults) {
-        if (r.created)
-          console.log(`  Created database: ${r.service}`);
-        if (r.error)
-          console.error(`  ${r.service}: ${r.error}`);
+    if (!opts.dryRun) {
+      console.log(`
+Done. ${totalResolved} conflict(s) resolved.`);
+    }
+  });
+}
+function registerScheduleCommand(syncCmd) {
+  syncCmd.command("schedule").description("Manage scheduled background sync").option("--every <interval>", "Set sync interval (e.g. 5m, 10m, 1h)").option("--off", "Disable scheduled sync").option("--now", "Run a one-off sync immediately").action(async (opts) => {
+    if (opts.off) {
+      try {
+        await removeSyncSchedule();
+        console.log("Scheduled sync disabled.");
+      } catch (err) {
+        console.error("Failed to remove schedule:", err?.message);
+        process.exit(1);
       }
+      return;
     }
-    console.log(`
-Running PG migrations...`);
-    const results = await migrateAllServices();
-    let totalApplied = 0;
-    let totalErrors = 0;
-    for (const r of results) {
-      totalApplied += r.applied.length;
-      totalErrors += r.errors.length;
-      if (r.applied.length > 0 || r.errors.length > 0) {
-        console.log(`  ${r.service}: ${r.applied.length} applied, ${r.alreadyApplied.length} existing${r.errors.length > 0 ? `, ${r.errors.length} errors` : ""}`);
+    if (opts.now) {
+      const config = getCloudConfig();
+      if (config.mode === "local") {
+        console.error("Error: mode is 'local'. Run `cloud setup --mode hybrid` or `--mode cloud` first.");
+        process.exit(1);
+      }
+      console.log("Running sync now...");
+      const services2 = discoverSyncableServices2();
+      console.log(`Discovered ${services2.length} service(s): ${services2.join(", ") || "(none)"}`);
+      const results = await runScheduledSync();
+      for (const r of results) {
+        const status2 = r.errors.length === 0 ? "ok" : "errors";
+        console.log(`  ${r.service}: ${r.tables_synced} table(s), ${r.total_rows_synced} row(s) [${status2}]`);
         for (const e of r.errors) {
           console.error(`    ${e}`);
         }
       }
+      if (results.length === 0) {
+        console.log("No services synced (mode may be local or no databases found).");
+      } else {
+        const totalRows = results.reduce((s, r) => s + r.total_rows_synced, 0);
+        const totalErrors = results.reduce((s, r) => s + r.errors.length, 0);
+        console.log(`
+Done. ${totalRows} rows synced, ${totalErrors} errors.`);
+      }
+      return;
     }
-    console.log(`
-Done. ${results.length} services, ${totalApplied} migrations applied, ${totalErrors} errors.`);
-  } else {
-    if (opts.createDb) {
+    if (opts.every) {
       try {
-        const created = await ensurePgDatabase(opts.service);
-        if (created)
-          console.log(`Created database: ${opts.service}`);
+        const minutes = parseInterval(opts.every);
+        await registerSyncSchedule(minutes);
+        console.log(`Scheduled sync registered: every ${minutes} minute(s).`);
       } catch (err) {
-        console.error(`Failed to create database: ${err?.message ?? String(err)}`);
+        console.error("Failed to register schedule:", err?.message);
+        process.exit(1);
       }
+      return;
     }
-    const result = await migrateService(opts.service);
-    console.log(`${result.service}: ${result.applied.length} applied, ${result.alreadyApplied.length} existing`);
-    for (const e of result.errors) {
-      console.error(`  ${e}`);
+    const status = getSyncScheduleStatus();
+    if (status.registered) {
+      console.log("Scheduled sync: enabled");
+      console.log(`  Interval: ${status.schedule_minutes} minute(s)`);
+      console.log(`  Cron expression: ${status.cron_expression}`);
+    } else {
+      console.log("Scheduled sync: disabled");
+      console.log(`
+To enable, run: cloud sync schedule --every 5m`);
     }
-  }
-});
-syncCmd.command("status").description("Show sync status for all discovered services").option("--service <name>", "Show status for a single service").option("--json", "Output as JSON").action(async (opts) => {
-  const services = opts.service ? [opts.service] : discoverServices();
-  const statuses = [];
-  for (const service of services) {
-    const dbPath = getDbPath2(service);
-    const localExists = existsSync9(dbPath);
-    let localSize = "\u2014";
-    let tableCount = 0;
-    if (localExists) {
+    const services = discoverSyncableServices2();
+    if (services.length > 0) {
+      console.log(`
+Syncable services (${services.length}):`);
+      for (const s of services)
+        console.log(`  - ${s}`);
+    } else {
+      console.log(`
+No syncable services found (no .db files in ~/.hasna/).`);
+    }
+  });
+}
+function registerDaemonCommand(syncCmd) {
+  syncCmd.command("daemon").description("Manage continuous background sync daemon").option("--start", "Start the daemon").option("--stop", "Stop the daemon").option("--pause", "Pause the daemon without stopping it").option("--resume", "Resume a paused daemon").option("--status", "Show daemon status").option("--now", "Run one daemon pass immediately").option("--foreground", "Run the daemon in the foreground").option("--watch <seconds>", "Local database scan interval in seconds").option("--pull <seconds>", "Remote pull interval in seconds").option("--push-debounce <seconds>", "Minimum seconds between auto-pushes").option("--conflict-strategy <strategy>", "newest-wins, local-wins, or remote-wins").option("--service <name>", "Restrict daemon to a service (repeatable)", collectValues, []).option("--table-interval <rule>", "Per-table interval, e.g. todos.tasks=30 or todos:tasks=30", collectValues, []).option("--file <rule>", "Track a file path for daemon status, e.g. ~/.claude/agents=30", collectValues, []).addOption(new Option2("--run", "Internal daemon worker").hideHelp()).action((opts) => {
+    const currentConfig = getDaemonConfig();
+    const selectedServices = opts.service.length > 0 ? Array.from(new Set(opts.service)) : currentConfig.services;
+    const tableIntervalRules = opts.tableInterval;
+    const fileRules = opts.file;
+    const actionCount = [
+      opts.start,
+      opts.stop,
+      opts.pause,
+      opts.resume,
+      opts.status,
+      opts.now,
+      opts.run
+    ].filter(Boolean).length;
+    if (actionCount > 1) {
+      console.error("Choose only one daemon action at a time.");
+      process.exit(1);
+    }
+    if (opts.foreground && !opts.start && !opts.run) {
+      console.error("--foreground only works with --start.");
+      process.exit(1);
+    }
+    const nextConfig = {
+      ...currentConfig,
+      watch_interval_seconds: opts.watch ? parsePositiveSeconds(opts.watch, "Watch interval") : currentConfig.watch_interval_seconds,
+      pull_interval_seconds: opts.pull ? parsePositiveSeconds(opts.pull, "Pull interval") : currentConfig.pull_interval_seconds,
+      push_debounce_seconds: opts.pushDebounce ? parsePositiveSeconds(opts.pushDebounce, "Push debounce") : currentConfig.push_debounce_seconds,
+      conflict_strategy: normalizeConflictStrategy(opts.conflictStrategy ?? currentConfig.conflict_strategy),
+      services: selectedServices,
+      table_intervals: tableIntervalRules.length > 0 ? applyTableIntervalRules(currentConfig.table_intervals, tableIntervalRules) : currentConfig.table_intervals,
+      file_rules: fileRules.length > 0 ? applyFileRules(currentConfig.file_rules, fileRules) : currentConfig.file_rules
+    };
+    if (opts.run) {
+      saveDaemonConfig({ ...nextConfig, enabled: true, paused: false });
+      runDaemonLoop();
+      return;
+    }
+    if (opts.stop) {
+      stopDaemon();
+      printDaemonStatus();
+      return;
+    }
+    if (opts.pause) {
+      saveDaemonConfig(nextConfig);
+      pauseDaemon();
+      printDaemonStatus();
+      return;
+    }
+    if (opts.resume) {
+      saveDaemonConfig(nextConfig);
+      resumeDaemon();
+      printDaemonStatus();
+      return;
+    }
+    if (opts.now) {
+      const savedConfig = saveDaemonConfig(nextConfig);
+      const result = runDaemonOnce({
+        config: { ...savedConfig, enabled: true, paused: false },
+        forcePull: true,
+        forcePush: true
+      });
+      console.log("Daemon pass complete.");
+      console.log(`  Services: ${result.summary.services.length}`);
+      console.log(`  Pushed: ${result.summary.pushed_rows} rows`);
+      console.log(`  Pulled: ${result.summary.pulled_rows} rows`);
+      console.log(`  Errors: ${result.summary.errors.length}`);
+      for (const error of result.summary.errors) {
+        console.error(`  ${error}`);
+      }
+      return;
+    }
+    if (opts.start) {
+      if (opts.foreground) {
+        saveDaemonConfig({ ...nextConfig, enabled: true, paused: false });
+        runDaemonLoop();
+        return;
+      }
+      startDaemon(nextConfig);
+      printDaemonStatus();
+      return;
+    }
+    printDaemonStatus();
+  });
+}
+
+// src/cli/cmd-migrate.ts
+init_dotfile();
+function registerMigrateCommands(program3) {
+  registerMigratePgCommand(program3);
+  registerMigrateCommand(program3);
+}
+function registerMigratePgCommand(program3) {
+  program3.command("migrate-pg").description("Apply PG migrations for services").option("--service <name>", "Service name").option("--all", "Migrate all discovered services").option("--create-db", "Create PG databases if they don't exist (default: true)", true).action(async (opts) => {
+    if (!opts.service && !opts.all) {
+      console.error("Error: specify --service <name> or --all");
+      process.exit(1);
+    }
+    if (opts.all) {
+      if (opts.createDb) {
+        console.log("Ensuring PG databases exist...");
+        const dbResults = await ensureAllPgDatabases();
+        for (const r of dbResults) {
+          if (r.created)
+            console.log(`  Created database: ${r.service}`);
+          if (r.error)
+            console.error(`  ${r.service}: ${r.error}`);
+        }
+      }
+      console.log(`
+Running PG migrations...`);
+      const results = await migrateAllServices();
+      let totalApplied = 0;
+      let totalErrors = 0;
+      for (const r of results) {
+        totalApplied += r.applied.length;
+        totalErrors += r.errors.length;
+        if (r.applied.length > 0 || r.errors.length > 0) {
+          console.log(`  ${r.service}: ${r.applied.length} applied, ${r.alreadyApplied.length} existing${r.errors.length > 0 ? `, ${r.errors.length} errors` : ""}`);
+          for (const e of r.errors)
+            console.error(`    ${e}`);
+        }
+      }
+      console.log(`
+Done. ${results.length} services, ${totalApplied} migrations applied, ${totalErrors} errors.`);
+    } else {
+      if (opts.createDb) {
+        try {
+          const created = await ensurePgDatabase(opts.service);
+          if (created)
+            console.log(`Created database: ${opts.service}`);
+        } catch (err) {
+          console.error(`Failed to create database: ${err?.message ?? String(err)}`);
+        }
+      }
+      const result = await migrateService(opts.service);
+      console.log(`${result.service}: ${result.applied.length} applied, ${result.alreadyApplied.length} existing`);
+      for (const e of result.errors)
+        console.error(`  ${e}`);
+    }
+  });
+}
+function registerMigrateCommand(program3) {
+  program3.command("migrate").description("Migrate legacy dotfiles to ~/.hasna/").argument("<service>", "Service name to migrate").action((service) => {
+    const migrated = migrateDotfile(service);
+    if (migrated.length === 0) {
+      console.log(`No migration needed for "${service}" — either no legacy dir or already migrated.`);
+    } else {
+      console.log(`Migrated ${migrated.length} file(s) from ~/.${service}/ to ~/.hasna/${service}/:`);
+      for (const f of migrated)
+        console.log(`  ${f}`);
+    }
+  });
+}
+
+// src/cli/cmd-feedback.ts
+init_config();
+
+// src/feedback.ts
+init_config();
+import { hostname as hostname2 } from "os";
+var FEEDBACK_TABLE_SQL = `
+CREATE TABLE IF NOT EXISTS feedback (
+  id TEXT PRIMARY KEY,
+  service TEXT NOT NULL,
+  version TEXT DEFAULT '',
+  message TEXT NOT NULL,
+  email TEXT DEFAULT '',
+  machine_id TEXT DEFAULT '',
+  created_at TEXT DEFAULT (datetime('now'))
+)`;
+function ensureFeedbackTable(db) {
+  db.exec(FEEDBACK_TABLE_SQL);
+}
+function saveFeedback(db, feedback) {
+  ensureFeedbackTable(db);
+  const id = feedback.id ?? Math.random().toString(36).slice(2) + Date.now().toString(36);
+  const now = new Date().toISOString();
+  const machineId = feedback.machine_id ?? hostname2();
+  db.run(`INSERT INTO feedback (id, service, version, message, email, machine_id, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`, id, feedback.service, feedback.version ?? "", feedback.message, feedback.email ?? "", machineId, feedback.created_at ?? now);
+  return id;
+}
+async function sendFeedback(feedback, db) {
+  const config = getCloudConfig();
+  const id = feedback.id ?? Math.random().toString(36).slice(2) + Date.now().toString(36);
+  const machineId = feedback.machine_id ?? hostname2();
+  const now = new Date().toISOString();
+  const payload = {
+    id,
+    service: feedback.service,
+    version: feedback.version ?? "",
+    message: feedback.message,
+    email: feedback.email ?? "",
+    machine_id: machineId,
+    created_at: feedback.created_at ?? now
+  };
+  try {
+    const res = await fetch(config.feedback_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) {
+      throw new Error(`HTTP ${res.status}: ${res.statusText}`);
+    }
+    if (db) {
       try {
-        const stat = statSync6(dbPath);
-        localSize = stat.size > 1024 * 1024 ? `${(stat.size / 1024 / 1024).toFixed(1)}MB` : `${(stat.size / 1024).toFixed(0)}KB`;
+        saveFeedback(db, { ...feedback, id });
       } catch {}
+    }
+    return { sent: true, id };
+  } catch (err) {
+    const errorMsg = err?.message ?? String(err);
+    if (db) {
       try {
-        const local = new SqliteAdapter2(dbPath);
-        const tables = listSqliteTables(local);
-        tableCount = tables.length;
-        local.close();
+        saveFeedback(db, { ...feedback, id });
       } catch {}
     }
-    let pgReachable = false;
-    try {
-      const connStr = getConnectionString(service);
-      const pg2 = new PgAdapterAsync2(connStr);
-      await pg2.all("SELECT 1");
-      pgReachable = true;
-      await pg2.close();
-    } catch {}
-    statuses.push({
-      service,
-      localDb: localExists ? dbPath : null,
-      localSize,
-      tables: tableCount,
-      pgReachable
-    });
-  }
-  if (opts.json) {
-    console.log(JSON.stringify(statuses, null, 2));
-  } else {
-    const config = getCloudConfig();
-    console.log(`Mode: ${config.mode}`);
-    console.log(`Services: ${statuses.length}
-`);
-    for (const s of statuses) {
-      if (!s.localDb && !s.pgReachable)
-        continue;
-      const pgIcon = s.pgReachable ? "\u2713" : "\u2717";
-      console.log(`  ${s.service.padEnd(20)} ${s.localSize.padStart(8)}  ${String(s.tables).padStart(3)} tables  PG: ${pgIcon}`);
-    }
-    const withData = statuses.filter((s) => s.localDb);
-    const pgOk = statuses.filter((s) => s.pgReachable);
-    console.log(`
-${withData.length} with local data, ${pgOk.length} with PG connection`);
+    return { sent: false, id, error: errorMsg };
   }
-});
-syncCmd.command("schedule").description("Manage scheduled background sync").option("--every <interval>", "Set sync interval (e.g. 5m, 10m, 1h)").option("--off", "Disable scheduled sync").option("--now", "Run a one-off sync immediately").action(async (opts) => {
-  if (opts.off) {
-    try {
-      await removeSyncSchedule();
-      console.log("Scheduled sync disabled.");
-    } catch (err) {
-      console.error("Failed to remove schedule:", err?.message);
-      process.exit(1);
+}
+
+// src/cli/cmd-feedback.ts
+function registerFeedbackCommand(program3) {
+  program3.command("feedback").description("Send feedback").requiredOption("--service <name>", "Service name").requiredOption("--message <msg>", "Feedback message").option("--email <email>", "Contact email").option("--version <ver>", "Service version").action(async (opts) => {
+    const db = createDatabase({ service: "cloud" });
+    const result = await sendFeedback({
+      service: opts.service,
+      version: opts.version,
+      message: opts.message,
+      email: opts.email
+    }, db);
+    if (result.sent) {
+      console.log(`Feedback sent successfully (id: ${result.id})`);
+    } else {
+      console.log(`Feedback saved locally (id: ${result.id}). Remote send failed: ${result.error}`);
     }
-    return;
-  }
-  if (opts.now) {
+    db.close();
+  });
+}
+
+// src/cli/cmd-doctor.ts
+init_config();
+init_adapter();
+init_discover();
+import { existsSync as existsSync9 } from "fs";
+import { join as join9 } from "path";
+import { homedir as homedir8 } from "os";
+function registerDoctorCommand(program3) {
+  program3.command("doctor").description("Comprehensive health check for cloud sync setup").action(async () => {
+    const checks = [];
+    const configPath = join9(homedir8(), ".hasna", "cloud", "config.json");
+    checks.push(existsSync9(configPath) ? { name: "Config file", status: "pass", detail: configPath } : { name: "Config file", status: "fail", detail: "Missing. Run `cloud setup`." });
     const config = getCloudConfig();
-    if (config.mode === "local") {
-      console.error("Error: mode is 'local'. Run `cloud setup --mode hybrid` or `--mode cloud` first.");
-      process.exit(1);
-    }
-    console.log("Running sync now...");
-    const services2 = discoverSyncableServices();
-    console.log(`Discovered ${services2.length} service(s): ${services2.join(", ") || "(none)"}`);
-    const results = await runScheduledSync();
-    for (const r of results) {
-      const status2 = r.errors.length === 0 ? "ok" : "errors";
-      console.log(`  ${r.service}: ${r.tables_synced} table(s), ${r.total_rows_synced} row(s) [${status2}]`);
-      for (const e of r.errors) {
-        console.error(`    ${e}`);
+    checks.push(config.mode === "hybrid" || config.mode === "cloud" ? { name: "Sync mode", status: "pass", detail: config.mode } : { name: "Sync mode", status: "fail", detail: `"${config.mode}" — sync disabled. Run \`cloud setup --mode hybrid\`.` });
+    checks.push(config.rds.host ? { name: "RDS host", status: "pass", detail: config.rds.host } : { name: "RDS host", status: "fail", detail: "Not configured. Run `cloud setup`." });
+    const password = process.env[config.rds.password_env];
+    checks.push(password ? { name: "RDS password", status: "pass", detail: `${config.rds.password_env} is set` } : { name: "RDS password", status: "fail", detail: `${config.rds.password_env} not in environment. Add to ~/.secrets/hasna/rds/live.env` });
+    if (config.rds.host && password) {
+      try {
+        const pg2 = new PgAdapterAsync(getConnectionString("postgres"));
+        await pg2.all("SELECT 1");
+        await pg2.close();
+        checks.push({ name: "PG connection", status: "pass", detail: "Connected" });
+      } catch (err) {
+        checks.push({ name: "PG connection", status: "fail", detail: err?.message ?? String(err) });
       }
+    } else {
+      checks.push({ name: "PG connection", status: "fail", detail: "Skipped — missing host or password" });
     }
-    if (results.length === 0) {
-      console.log("No services synced (mode may be local or no databases found).");
+    const caPath = process.env.NODE_EXTRA_CA_CERTS;
+    if (caPath && existsSync9(caPath)) {
+      checks.push({ name: "SSL CA cert", status: "pass", detail: caPath });
+    } else if (caPath) {
+      checks.push({ name: "SSL CA cert", status: "warn", detail: `NODE_EXTRA_CA_CERTS set but file missing: ${caPath}` });
     } else {
-      const totalRows = results.reduce((s, r) => s + r.total_rows_synced, 0);
-      const totalErrors = results.reduce((s, r) => s + r.errors.length, 0);
-      console.log(`
-Done. ${totalRows} rows synced, ${totalErrors} errors.`);
+      checks.push({ name: "SSL CA cert", status: "warn", detail: "NODE_EXTRA_CA_CERTS not set. May cause SSL errors on some systems." });
+    }
+    const services = discoverServices();
+    checks.push({ name: "Local services", status: services.length > 0 ? "pass" : "warn", detail: `${services.length} found in ~/.hasna/` });
+    const schedule = getSyncScheduleStatus();
+    checks.push(schedule.registered ? { name: "Sync schedule", status: "pass", detail: `Every ${schedule.schedule_minutes}m (${schedule.mechanism})` } : { name: "Sync schedule", status: "warn", detail: "Not configured. Run `cloud sync schedule --every 30m`." });
+    const daemon = getDaemonStatus();
+    checks.push(daemon.running ? {
+      name: "Sync daemon",
+      status: "pass",
+      detail: `${daemon.status} (watch ${daemon.config.watch_interval_seconds}s, pull ${daemon.config.pull_interval_seconds}s)`
+    } : {
+      name: "Sync daemon",
+      status: daemon.config.enabled ? "warn" : "warn",
+      detail: daemon.config.enabled ? "Enabled in config but not running. Run `cloud sync daemon --start`." : "Not running. Run `cloud sync daemon --start` for continuous sync."
+    });
+    console.log(`Cloud Doctor
+`);
+    for (const c of checks) {
+      const icon = c.status === "pass" ? "✓" : c.status === "fail" ? "✗" : "⚠";
+      console.log(`  ${icon} ${c.name.padEnd(20)} ${c.detail}`);
     }
-    return;
-  }
-  if (opts.every) {
-    try {
-      const minutes = parseInterval(opts.every);
-      await registerSyncSchedule(minutes);
-      console.log(`Scheduled sync registered: every ${minutes} minute(s).`);
-    } catch (err) {
-      console.error("Failed to register schedule:", err?.message);
+    const fails = checks.filter((c) => c.status === "fail").length;
+    const warns = checks.filter((c) => c.status === "warn").length;
+    console.log(`
+${checks.length} checks: ${checks.length - fails - warns} passed, ${warns} warnings, ${fails} failed`);
+    if (fails > 0)
       process.exit(1);
-    }
-    return;
+  });
+}
+
+// src/config.ts
+init_zod();
+init_adapter();
+init_dotfile();
+init_machines();
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join10 } from "path";
+var DaemonConfigSchema2 = exports_external.object({
+  enabled: exports_external.boolean().default(false),
+  paused: exports_external.boolean().default(false),
+  watch_interval_seconds: exports_external.number().int().positive().default(5),
+  pull_interval_seconds: exports_external.number().int().positive().default(60),
+  push_debounce_seconds: exports_external.number().int().positive().default(5),
+  conflict_strategy: exports_external.enum(["newest-wins", "local-wins", "remote-wins"]).default("newest-wins"),
+  services: exports_external.array(exports_external.string()).default([]),
+  table_intervals: exports_external.record(exports_external.string(), exports_external.record(exports_external.string(), exports_external.number().int().positive())).default({}),
+  file_rules: exports_external.array(exports_external.object({
+    path: exports_external.string(),
+    interval_seconds: exports_external.number().int().positive().default(30),
+    enabled: exports_external.boolean().default(true)
+  })).default([])
+}).default({});
+var CloudConfigSchema2 = exports_external.object({
+  rds: exports_external.object({
+    host: exports_external.string().default(""),
+    port: exports_external.number().default(5432),
+    username: exports_external.string().default(""),
+    password_env: exports_external.string().default("HASNA_RDS_PASSWORD"),
+    ssl: exports_external.boolean().default(true)
+  }).default({}),
+  mode: exports_external.enum(["local", "cloud", "hybrid"]).default("hybrid"),
+  auto_sync_interval_minutes: exports_external.number().default(0),
+  feedback_endpoint: exports_external.string().default("https://feedback.hasna.com/api/v1/feedback"),
+  sync: exports_external.object({
+    schedule_minutes: exports_external.number().default(0)
+  }).default({}),
+  daemon: DaemonConfigSchema2
+});
+var CONFIG_DIR3 = join10(homedir9(), ".hasna", "cloud");
+var CONFIG_PATH2 = join10(CONFIG_DIR3, "config.json");
+function getCloudConfig2() {
+  if (!existsSync10(CONFIG_PATH2)) {
+    return CloudConfigSchema2.parse({});
   }
-  const status = getSyncScheduleStatus();
-  if (status.registered) {
-    console.log("Scheduled sync: enabled");
-    console.log(`  Interval: ${status.schedule_minutes} minute(s)`);
-    console.log(`  Cron expression: ${status.cron_expression}`);
-  } else {
-    console.log("Scheduled sync: disabled");
-    console.log(`
-To enable, run: cloud sync schedule --every 5m`);
+  try {
+    const raw = readFileSync4(CONFIG_PATH2, "utf-8");
+    return CloudConfigSchema2.parse(JSON.parse(raw));
+  } catch {
+    return CloudConfigSchema2.parse({});
   }
-  const services = discoverSyncableServices();
-  if (services.length > 0) {
-    console.log(`
-Syncable services (${services.length}):`);
-    for (const s of services) {
-      console.log(`  - ${s}`);
-    }
-  } else {
-    console.log(`
-No syncable services found (no .db files in ~/.hasna/).`);
+}
+function getConnectionString2(dbName) {
+  const config = getCloudConfig2();
+  const { host, port, username, password_env, ssl } = config.rds;
+  if (!host || !username) {
+    throw new Error("Cloud RDS not configured. Run `cloud setup` to configure.");
   }
-});
-program2.command("feedback").description("Send feedback").requiredOption("--service <name>", "Service name").requiredOption("--message <msg>", "Feedback message").option("--email <email>", "Contact email").option("--version <ver>", "Service version").action(async (opts) => {
-  const db = createDatabase({ service: "cloud" });
-  const result = await sendFeedback({
-    service: opts.service,
-    version: opts.version,
-    message: opts.message,
-    email: opts.email
-  }, db);
-  if (result.sent) {
-    console.log(`Feedback sent successfully (id: ${result.id})`);
-  } else {
-    console.log(`Feedback saved locally (id: ${result.id}). Remote send failed: ${result.error}`);
+  const password = process.env[password_env];
+  if (password === undefined || password === "") {
+    throw new Error(`RDS password not set. Export ${password_env} in your shell or add it to ~/.secrets/hasna/rds/live.env`);
   }
-  db.close();
-});
-program2.command("migrate").description("Migrate legacy dotfiles to ~/.hasna/").argument("<service>", "Service name to migrate").action((service) => {
-  const migrated = migrateDotfile(service);
-  if (migrated.length === 0) {
-    console.log(`No migration needed for "${service}" \u2014 either no legacy dir or already migrated.`);
-  } else {
-    console.log(`Migrated ${migrated.length} file(s) from ~/.${service}/ to ~/.hasna/${service}/:`);
-    for (const f of migrated) {
-      console.log(`  ${f}`);
+  const sslParam = ssl ? "?sslmode=require" : "";
+  return `postgres://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbName}${sslParam}`;
+}
+
+// src/adapter.ts
+init_esm();
+class PgAdapterAsync2 {
+  pool;
+  constructor(arg) {
+    if (typeof arg === "string") {
+      const sslConfig = arg.includes("sslmode=require") || arg.includes("ssl=true") ? { rejectUnauthorized: false } : undefined;
+      this.pool = new esm_default.Pool({ connectionString: arg, ssl: sslConfig });
+    } else {
+      this.pool = arg;
     }
   }
-});
-program2.command("doctor").description("Comprehensive health check for cloud sync setup").action(async () => {
-  const checks = [];
-  const configPath = join9(homedir8(), ".hasna", "cloud", "config.json");
-  if (existsSync9(configPath)) {
-    checks.push({ name: "Config file", status: "pass", detail: configPath });
-  } else {
-    checks.push({ name: "Config file", status: "fail", detail: "Missing. Run `cloud setup`." });
+  async run(sql, ...params) {
+    const pgSql = translateSql(sql, "pg");
+    const pgParams = translateParams(params);
+    const res = await this.pool.query(pgSql, pgParams);
+    return {
+      changes: res.rowCount ?? 0,
+      lastInsertRowid: res.rows?.[0]?.id ?? 0
+    };
   }
-  const config = getCloudConfig();
-  if (config.mode === "hybrid" || config.mode === "cloud") {
-    checks.push({ name: "Sync mode", status: "pass", detail: config.mode });
-  } else {
-    checks.push({ name: "Sync mode", status: "fail", detail: `"${config.mode}" \u2014 sync disabled. Run \`cloud setup --mode hybrid\`.` });
+  async get(sql, ...params) {
+    const pgSql = translateSql(sql, "pg");
+    const pgParams = translateParams(params);
+    const res = await this.pool.query(pgSql, pgParams);
+    return res.rows[0] ?? null;
   }
-  if (config.rds.host) {
-    checks.push({ name: "RDS host", status: "pass", detail: config.rds.host });
-  } else {
-    checks.push({ name: "RDS host", status: "fail", detail: "Not configured. Run `cloud setup`." });
+  async all(sql, ...params) {
+    const pgSql = translateSql(sql, "pg");
+    const pgParams = translateParams(params);
+    const res = await this.pool.query(pgSql, pgParams);
+    return res.rows;
   }
-  const password = process.env[config.rds.password_env];
-  if (password) {
-    checks.push({ name: "RDS password", status: "pass", detail: `${config.rds.password_env} is set` });
-  } else {
-    checks.push({ name: "RDS password", status: "fail", detail: `${config.rds.password_env} not in environment. Add to ~/.secrets/hasna/rds/live.env` });
+  async exec(sql) {
+    const pgSql = translateSql(sql, "pg");
+    await this.pool.query(pgSql);
   }
-  if (config.rds.host && password) {
+  async close() {
+    await this.pool.end();
+  }
+  async transaction(fn) {
+    const client = await this.pool.connect();
     try {
-      const connStr = getConnectionString("postgres");
-      const pg2 = new PgAdapterAsync2(connStr);
-      await pg2.all("SELECT 1");
-      await pg2.close();
-      checks.push({ name: "PG connection", status: "pass", detail: "Connected" });
+      await client.query("BEGIN");
+      const result = await fn(client);
+      await client.query("COMMIT");
+      return result;
     } catch (err) {
-      checks.push({ name: "PG connection", status: "fail", detail: err?.message ?? String(err) });
+      await client.query("ROLLBACK");
+      throw err;
+    } finally {
+      client.release();
     }
-  } else {
-    checks.push({ name: "PG connection", status: "fail", detail: "Skipped \u2014 missing host or password" });
   }
-  const caPath = process.env.NODE_EXTRA_CA_CERTS;
-  if (caPath && existsSync9(caPath)) {
-    checks.push({ name: "SSL CA cert", status: "pass", detail: caPath });
-  } else if (caPath) {
-    checks.push({ name: "SSL CA cert", status: "warn", detail: `NODE_EXTRA_CA_CERTS set but file missing: ${caPath}` });
-  } else {
-    checks.push({ name: "SSL CA cert", status: "warn", detail: "NODE_EXTRA_CA_CERTS not set. May cause SSL errors on some systems." });
-  }
-  const services = discoverServices();
-  checks.push({ name: "Local services", status: services.length > 0 ? "pass" : "warn", detail: `${services.length} found in ~/.hasna/` });
-  const schedule = getSyncScheduleStatus();
-  if (schedule.registered) {
-    checks.push({ name: "Sync schedule", status: "pass", detail: `Every ${schedule.schedule_minutes}m (${schedule.mechanism})` });
-  } else {
-    checks.push({ name: "Sync schedule", status: "warn", detail: "Not configured. Run `cloud sync schedule --every 30m`." });
+  get raw() {
+    return this.pool;
   }
-  console.log(`Cloud Doctor
-`);
-  for (const c of checks) {
-    const icon = c.status === "pass" ? "\u2713" : c.status === "fail" ? "\u2717" : "\u26A0";
-    console.log(`  ${icon} ${c.name.padEnd(20)} ${c.detail}`);
+}
+
+// src/cli/index.ts
+var program3 = new Command;
+program3.name("cloud").description("Shared cloud infrastructure \u2014 database adapter, sync engine, feedback, dotfile migration").version("0.1.13");
+registerSetupCommand(program3);
+program3.command("status").description("Show current cloud configuration and connection health").action(async () => {
+  const config = getCloudConfig2();
+  console.log("Mode:", config.mode);
+  console.log("RDS Host:", config.rds.host || "(not configured)");
+  console.log("RDS Port:", config.rds.port);
+  console.log("RDS Username:", config.rds.username || "(not configured)");
+  console.log("SSL:", config.rds.ssl);
+  console.log("Auto-sync interval:", config.auto_sync_interval_minutes ? `${config.auto_sync_interval_minutes} minutes` : "disabled");
+  if (config.rds.host && config.rds.username) {
+    console.log(`
+Checking PostgreSQL connection...`);
+    try {
+      const pg2 = new PgAdapterAsync2(getConnectionString2("postgres"));
+      const row = await pg2.get("SELECT 1 as ok");
+      if (row?.ok === 1)
+        console.log("PostgreSQL: connected");
+      await pg2.close();
+    } catch (err) {
+      console.log("PostgreSQL: connection failed \u2014", err?.message);
+    }
   }
-  const fails = checks.filter((c) => c.status === "fail").length;
-  const warns = checks.filter((c) => c.status === "warn").length;
-  console.log(`
-${checks.length} checks: ${checks.length - fails - warns} passed, ${warns} warnings, ${fails} failed`);
-  if (fails > 0)
-    process.exit(1);
 });
-program2.parse();
+var syncCmd = program3.command("sync").description("Sync data between local and cloud");
+registerSyncCommands(syncCmd);
+registerMigrateCommands(program3);
+registerFeedbackCommand(program3);
+registerDoctorCommand(program3);
+program3.parse();