@hasna/cloud 0.1.34 → 0.1.36

package/dist/cli/index.js

@@ -994,7 +994,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          } else {}
+          }
         };
       }
       return this;
@@ -6158,7 +6158,7 @@ var require_arrayParser = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/pg-types/node_modules/postgres-date/index.js
+// node_modules/postgres-date/index.js
 var require_postgres_date = __commonJS((exports, module) => {
   var DATE_TIME = /(\d{1,})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})(\.\d{1,})?.*?( BC)?$/;
   var DATE = /^(\d{1,})-(\d{2})-(\d{2})( BC)?$/;
@@ -6260,7 +6260,7 @@ var require_mutable = __commonJS((exports, module) => {
   }
 });
 
-// node_modules/pg-types/node_modules/postgres-interval/index.js
+// node_modules/postgres-interval/index.js
 var require_postgres_interval = __commonJS((exports, module) => {
   var extend = require_mutable();
   module.exports = PostgresInterval;
@@ -6352,7 +6352,7 @@ var require_postgres_interval = __commonJS((exports, module) => {
   }
 });
 
-// node_modules/pg-types/node_modules/postgres-bytea/index.js
+// node_modules/postgres-bytea/index.js
 var require_postgres_bytea = __commonJS((exports, module) => {
   var bufferFrom = Buffer.from || Buffer;
   module.exports = function parseBytea(input) {
@@ -11238,28 +11238,28 @@ var init_adapter = __esm(() => {
 
 // src/dotfile.ts
 import {
-  existsSync,
+  existsSync as existsSync2,
   mkdirSync,
   readdirSync,
   copyFileSync
 } from "fs";
-import { homedir } from "os";
-import { join, relative } from "path";
+import { homedir as homedir2 } from "os";
+import { join as join2, relative } from "path";
 function getDataDir(serviceName) {
-  const dir = join(HASNA_DIR, serviceName);
+  const dir = join2(HASNA_DIR, serviceName);
   mkdirSync(dir, { recursive: true });
   return dir;
 }
 function getDbPath(serviceName) {
   const dir = getDataDir(serviceName);
-  return join(dir, `${serviceName}.db`);
+  return join2(dir, `${serviceName}.db`);
 }
 function migrateDotfile(serviceName) {
-  const legacyDir = join(homedir(), `.${serviceName}`);
-  const newDir = join(HASNA_DIR, serviceName);
-  if (!existsSync(legacyDir))
+  const legacyDir = join2(homedir2(), `.${serviceName}`);
+  const newDir = join2(HASNA_DIR, serviceName);
+  if (!existsSync2(legacyDir))
     return [];
-  if (existsSync(newDir))
+  if (existsSync2(newDir))
     return [];
   mkdirSync(newDir, { recursive: true });
   const migrated = [];
@@ -11269,8 +11269,8 @@ function migrateDotfile(serviceName) {
 function copyDirRecursive(src, dest, root, migrated) {
   const entries = readdirSync(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = join(src, entry.name);
-    const destPath = join(dest, entry.name);
+    const srcPath = join2(src, entry.name);
+    const destPath = join2(dest, entry.name);
     if (entry.isDirectory()) {
       mkdirSync(destPath, { recursive: true });
       copyDirRecursive(srcPath, destPath, root, migrated);
@@ -11286,7 +11286,7 @@ function getHasnaDir() {
 }
 var HASNA_DIR;
 var init_dotfile = __esm(() => {
-  HASNA_DIR = join(homedir(), ".hasna");
+  HASNA_DIR = join2(homedir2(), ".hasna");
 });
 
 // src/discover.ts
@@ -11299,15 +11299,15 @@ __export(exports_discover, {
   SYNC_EXCLUDED_TABLE_PATTERNS: () => SYNC_EXCLUDED_TABLE_PATTERNS,
   KNOWN_PG_SERVICES: () => KNOWN_PG_SERVICES
 });
-import { readdirSync as readdirSync2, existsSync as existsSync2 } from "fs";
-import { join as join2 } from "path";
-import { homedir as homedir2 } from "os";
+import { readdirSync as readdirSync2, existsSync as existsSync3 } from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir3 } from "os";
 function isSyncExcludedTable(table) {
   return SYNC_EXCLUDED_TABLE_PATTERNS.some((p) => p.test(table));
 }
 function discoverServices() {
-  const dataDir = join2(homedir2(), ".hasna");
-  if (!existsSync2(dataDir))
+  const dataDir = join3(homedir3(), ".hasna");
+  if (!existsSync3(dataDir))
     return [];
   try {
     const entries = readdirSync2(dataDir, { withFileTypes: true });
@@ -11328,24 +11328,24 @@ function discoverSyncableServices() {
   return local.filter((s) => pgSet.has(s));
 }
 function getServiceDbPath(service) {
-  const dataDir = join2(homedir2(), ".hasna", service);
-  if (!existsSync2(dataDir))
+  const dataDir = join3(homedir3(), ".hasna", service);
+  if (!existsSync3(dataDir))
     return null;
   const candidates = [
-    join2(dataDir, `${service}.db`),
-    join2(dataDir, "data.db"),
-    join2(dataDir, "database.db")
+    join3(dataDir, `${service}.db`),
+    join3(dataDir, "data.db"),
+    join3(dataDir, "database.db")
   ];
   try {
     const files = readdirSync2(dataDir);
     for (const f of files) {
       if (f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm")) {
-        candidates.push(join2(dataDir, f));
+        candidates.push(join3(dataDir, f));
       }
     }
   } catch {}
   for (const p of candidates) {
-    if (existsSync2(p))
+    if (existsSync3(p))
       return p;
   }
   return null;
@@ -11400,9 +11400,9 @@ var init_discover = __esm(() => {
 
 // src/machines.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync3 } from "fs";
-import { homedir as homedir3, hostname, platform, arch, userInfo } from "os";
-import { dirname, join as join3 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { homedir as homedir4, hostname, platform, arch, userInfo } from "os";
+import { dirname, join as join4 } from "path";
 function quoteSqlString(value) {
   return `'${value.replace(/'/g, "''")}'`;
 }
@@ -11414,10 +11414,10 @@ function normalizePlatform(value) {
   return value;
 }
 function detectWorkspacePath() {
-  const home = homedir3();
-  const candidates = [join3(home, "workspace"), join3(home, "Workspace")];
+  const home = homedir4();
+  const candidates = [join4(home, "workspace"), join4(home, "Workspace")];
   for (const candidate of candidates) {
-    if (existsSync3(candidate))
+    if (existsSync4(candidate))
       return candidate;
   }
   const cwd = process.cwd();
@@ -11470,7 +11470,7 @@ function registerMachine(db, opts = {}) {
   ensureMachinesTable(db);
   const detected = detectCurrentMachine(opts);
   const id = detected.id ?? getCurrentMachineId();
-  const now = new Date().toISOString();
+  const now2 = new Date().toISOString();
   const existing = getMachineRecord(db, id);
   const isPrimary = toFlag(detected.is_primary, existing?.is_primary ?? 0);
   const archived = toFlag(detected.archived, existing?.archived ?? 0);
@@ -11484,8 +11484,8 @@ function registerMachine(db, opts = {}) {
     workspace_path: detected.workspace_path ?? existing?.workspace_path ?? "",
     bun_path: detected.bun_path ?? existing?.bun_path ?? "",
     is_primary: isPrimary,
-    last_seen_at: detected.last_seen_at ?? now,
-    registered_at: existing?.registered_at ?? detected.registered_at ?? now,
+    last_seen_at: detected.last_seen_at ?? now2,
+    registered_at: existing?.registered_at ?? detected.registered_at ?? now2,
     archived
   };
   db.run(`INSERT INTO machines (
@@ -11814,9 +11814,9 @@ __export(exports_config, {
   createDatabase: () => createDatabase,
   CloudConfigSchema: () => CloudConfigSchema
 });
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
 function getConfigDir() {
   return CONFIG_DIR;
 }
@@ -11824,7 +11824,7 @@ function getConfigPath() {
   return CONFIG_PATH;
 }
 function getCloudConfig() {
-  if (!existsSync4(CONFIG_PATH)) {
+  if (!existsSync5(CONFIG_PATH)) {
     return CloudConfigSchema.parse({});
   }
   try {
@@ -11899,8 +11899,8 @@ var init_config = __esm(() => {
     }).default({}),
     daemon: DaemonConfigSchema
   });
-  CONFIG_DIR = join4(homedir4(), ".hasna", "cloud");
-  CONFIG_PATH = join4(CONFIG_DIR, "config.json");
+  CONFIG_DIR = join5(homedir5(), ".hasna", "cloud");
+  CONFIG_PATH = join5(CONFIG_DIR, "config.json");
 });
 
 // node_modules/commander/esm.mjs
@@ -11919,6 +11919,690 @@ var {
   Help
 } = import__.default;
 
+// node_modules/@hasna/events/dist/commander.js
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { createHmac, timingSafeEqual } from "crypto";
+import { randomUUID } from "crypto";
+import { spawn } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+function getPathValue(input, path) {
+  return path.split(".").reduce((value, part) => {
+    if (value && typeof value === "object" && part in value) {
+      return value[part];
+    }
+    return;
+  }, input);
+}
+function wildcardToRegExp(pattern) {
+  const escaped = pattern.replace(/[|\\{}()[\]^$+?.]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+function matchString(value, matcher) {
+  if (matcher === undefined)
+    return true;
+  if (value === undefined)
+    return false;
+  const matchers = Array.isArray(matcher) ? matcher : [matcher];
+  return matchers.some((item) => wildcardToRegExp(item).test(value));
+}
+function matchRecord(input, matcher) {
+  if (!matcher)
+    return true;
+  return Object.entries(matcher).every(([path, expected]) => {
+    const actual = getPathValue(input, path);
+    if (typeof expected === "string" || Array.isArray(expected)) {
+      return matchString(actual === undefined ? undefined : String(actual), expected);
+    }
+    return actual === expected;
+  });
+}
+function eventMatchesFilter(event, filter) {
+  return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
+}
+function channelMatchesEvent(channel, event) {
+  if (!channel.enabled)
+    return false;
+  if (!channel.filters || channel.filters.length === 0)
+    return true;
+  return channel.filters.some((filter) => eventMatchesFilter(event, filter));
+}
+var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR";
+var HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME";
+function getEventsDataDir(override) {
+  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join(homedir(), ".hasna", "events");
+}
+
+class JsonEventsStore {
+  dataDir;
+  channelsPath;
+  eventsPath;
+  deliveriesPath;
+  constructor(dataDir = getEventsDataDir()) {
+    this.dataDir = dataDir;
+    this.channelsPath = join(dataDir, "channels.json");
+    this.eventsPath = join(dataDir, "events.json");
+    this.deliveriesPath = join(dataDir, "deliveries.json");
+  }
+  async init() {
+    await mkdir(this.dataDir, { recursive: true, mode: 448 });
+    await chmod(this.dataDir, 448).catch(() => {
+      return;
+    });
+    await this.ensureArrayFile(this.channelsPath);
+    await this.ensureArrayFile(this.eventsPath);
+    await this.ensureArrayFile(this.deliveriesPath);
+  }
+  async addChannel(channel) {
+    await this.init();
+    const channels = await this.readJson(this.channelsPath, []);
+    const index = channels.findIndex((item) => item.id === channel.id);
+    if (index >= 0) {
+      channels[index] = { ...channel, createdAt: channels[index].createdAt, updatedAt: new Date().toISOString() };
+    } else {
+      channels.push(channel);
+    }
+    await this.writeJson(this.channelsPath, channels);
+    return index >= 0 ? channels[index] : channel;
+  }
+  async listChannels() {
+    await this.init();
+    return this.readJson(this.channelsPath, []);
+  }
+  async getChannel(id) {
+    const channels = await this.listChannels();
+    return channels.find((channel) => channel.id === id);
+  }
+  async removeChannel(id) {
+    await this.init();
+    const channels = await this.readJson(this.channelsPath, []);
+    const next = channels.filter((channel) => channel.id !== id);
+    await this.writeJson(this.channelsPath, next);
+    return next.length !== channels.length;
+  }
+  async appendEvent(event) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    events.push(event);
+    await this.writeJson(this.eventsPath, events);
+    return event;
+  }
+  async listEvents() {
+    await this.init();
+    return this.readJson(this.eventsPath, []);
+  }
+  async findEventByIdentity(identity) {
+    const events = await this.listEvents();
+    return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+  }
+  async appendDelivery(result) {
+    await this.init();
+    const deliveries = await this.readJson(this.deliveriesPath, []);
+    deliveries.push(result);
+    await this.writeJson(this.deliveriesPath, deliveries);
+    return result;
+  }
+  async listDeliveries() {
+    await this.init();
+    return this.readJson(this.deliveriesPath, []);
+  }
+  async exportData() {
+    return {
+      channels: await this.listChannels(),
+      events: await this.listEvents(),
+      deliveries: await this.listDeliveries()
+    };
+  }
+  async ensureArrayFile(path) {
+    if (!existsSync(path)) {
+      await writeFile(path, `[]
+`, { encoding: "utf-8", mode: 384 });
+    }
+    await chmod(path, 384).catch(() => {
+      return;
+    });
+  }
+  async readJson(path, fallback) {
+    try {
+      const raw = await readFile(path, "utf-8");
+      if (!raw.trim())
+        return fallback;
+      return JSON.parse(raw);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return fallback;
+      throw error;
+    }
+  }
+  async writeJson(path, value) {
+    const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(tempPath, `${JSON.stringify(value, null, 2)}
+`, { encoding: "utf-8", mode: 384 });
+    await rename(tempPath, path);
+    await chmod(path, 384).catch(() => {
+      return;
+    });
+  }
+}
+var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
+function buildSignatureBase(timestamp, body) {
+  return `${timestamp}.${body}`;
+}
+function signPayload(secret, timestamp, body) {
+  const digest = createHmac("sha256", secret).update(buildSignatureBase(timestamp, body)).digest("hex");
+  return `sha256=${digest}`;
+}
+function now() {
+  return new Date().toISOString();
+}
+function truncate(value, max = 4096) {
+  return value.length > max ? `${value.slice(0, max)}...` : value;
+}
+function buildWebhookRequest(event, channel) {
+  if (!channel.webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const body = JSON.stringify(event);
+  const timestamp = event.time;
+  const headers = {
+    "Content-Type": "application/json",
+    "User-Agent": "@hasna/events",
+    "X-Hasna-Event-Id": event.id,
+    "X-Hasna-Event-Type": event.type,
+    "X-Hasna-Timestamp": timestamp,
+    ...channel.webhook.headers
+  };
+  if (channel.webhook.secret) {
+    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp, body);
+  }
+  return { body, headers };
+}
+async function dispatchWebhook(event, channel, options = {}) {
+  if (!channel.webhook)
+    throw new Error(`Channel ${channel.id} has no webhook config`);
+  const startedAt = now();
+  const { body, headers } = buildWebhookRequest(event, channel);
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
+  try {
+    const response = await (options.fetchImpl ?? fetch)(channel.webhook.url, {
+      method: "POST",
+      headers,
+      body,
+      signal: controller.signal
+    });
+    const responseBody = truncate(await response.text());
+    return {
+      attempt: 1,
+      status: response.ok ? "success" : "failed",
+      startedAt,
+      completedAt: now(),
+      responseStatus: response.status,
+      responseBody,
+      error: response.ok ? undefined : `Webhook returned HTTP ${response.status}`
+    };
+  } catch (error) {
+    return {
+      attempt: 1,
+      status: "failed",
+      startedAt,
+      completedAt: now(),
+      error: error instanceof Error ? error.message : String(error)
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function dispatchCommand(event, channel) {
+  if (!channel.command)
+    throw new Error(`Channel ${channel.id} has no command config`);
+  const startedAt = now();
+  const eventJson = JSON.stringify(event);
+  const env = {
+    ...process.env,
+    ...channel.command.env,
+    HASNA_CHANNEL_ID: channel.id,
+    HASNA_EVENT_ID: event.id,
+    HASNA_EVENT_TYPE: event.type,
+    HASNA_EVENT_SOURCE: event.source,
+    HASNA_EVENT_SUBJECT: event.subject ?? "",
+    HASNA_EVENT_SEVERITY: event.severity,
+    HASNA_EVENT_TIME: event.time,
+    HASNA_EVENT_DEDUPE_KEY: event.dedupeKey ?? "",
+    HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
+    HASNA_EVENT_JSON: eventJson
+  };
+  return new Promise((resolve) => {
+    const child = spawn(channel.command.command, channel.command.args ?? [], {
+      cwd: channel.command.cwd,
+      env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    const timeout = setTimeout(() => child.kill("SIGTERM"), channel.command.timeoutMs ?? 15000);
+    child.stdin.end(eventJson);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", (error) => {
+      clearTimeout(timeout);
+      resolve({
+        attempt: 1,
+        status: "failed",
+        startedAt,
+        completedAt: now(),
+        stdout: truncate(stdout),
+        stderr: truncate(stderr),
+        error: error.message
+      });
+    });
+    child.on("close", (code, signal) => {
+      clearTimeout(timeout);
+      const success = code === 0;
+      resolve({
+        attempt: 1,
+        status: success ? "success" : "failed",
+        startedAt,
+        completedAt: now(),
+        stdout: truncate(stdout),
+        stderr: truncate(stderr),
+        error: success ? undefined : `Command exited with ${signal ? `signal ${signal}` : `code ${code}`}`
+      });
+    });
+  });
+}
+async function dispatchChannel(event, channel, options = {}) {
+  if (channel.transport === "webhook")
+    return dispatchWebhook(event, channel, options);
+  if (channel.transport === "command")
+    return dispatchCommand(event, channel);
+  return {
+    attempt: 1,
+    status: "skipped",
+    startedAt: now(),
+    completedAt: now(),
+    error: `Unsupported transport: ${channel.transport}`
+  };
+}
+function createDeliveryResult(event, channel, attempts) {
+  const status = attempts.some((attempt) => attempt.status === "success") ? "success" : attempts.every((attempt) => attempt.status === "skipped") ? "skipped" : "failed";
+  return {
+    id: randomUUID(),
+    eventId: event.id,
+    channelId: channel.id,
+    transport: channel.transport,
+    status,
+    attempts,
+    createdAt: attempts[0]?.startedAt ?? now(),
+    completedAt: attempts.at(-1)?.completedAt ?? now()
+  };
+}
+function createEvent(input) {
+  return {
+    id: input.id ?? randomUUID2(),
+    source: input.source,
+    type: input.type,
+    time: normalizeTime(input.time),
+    subject: input.subject,
+    severity: input.severity ?? "info",
+    data: input.data ?? {},
+    message: input.message,
+    dedupeKey: input.dedupeKey,
+    schemaVersion: input.schemaVersion ?? "1.0",
+    metadata: input.metadata ?? {}
+  };
+}
+
+class EventsClient {
+  store;
+  redactors;
+  transportOptions;
+  constructor(options = {}) {
+    this.store = options.store ?? new JsonEventsStore(options.dataDir);
+    this.redactors = options.redactors ?? [];
+    this.transportOptions = { fetchImpl: options.fetchImpl };
+  }
+  async addChannel(input) {
+    const timestamp = new Date().toISOString();
+    return this.store.addChannel({
+      ...input,
+      createdAt: input.createdAt ?? timestamp,
+      updatedAt: input.updatedAt ?? timestamp
+    });
+  }
+  async listChannels() {
+    return this.store.listChannels();
+  }
+  async removeChannel(id) {
+    return this.store.removeChannel(id);
+  }
+  async emit(input, options = {}) {
+    const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
+    if (options.dedupe !== false) {
+      const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return { event: existing, deliveries: [], deduped: true };
+      }
+    }
+    await this.store.appendEvent(event);
+    const deliveries = options.deliver === false ? [] : await this.deliver(event);
+    return { event, deliveries, deduped: false };
+  }
+  async listEvents() {
+    return this.store.listEvents();
+  }
+  async listDeliveries() {
+    return this.store.listDeliveries();
+  }
+  async deliver(event) {
+    const channels = await this.store.listChannels();
+    const selected = channels.filter((channel) => channelMatchesEvent(channel, event));
+    const deliveries = [];
+    for (const channel of selected) {
+      const eventForChannel = await this.applyRedaction(event, channel);
+      const result = await this.deliverWithRetry(eventForChannel, channel);
+      await this.store.appendDelivery(result);
+      deliveries.push(result);
+    }
+    return deliveries;
+  }
+  async testChannel(id, input = {}) {
+    const channel = await this.store.getChannel(id);
+    if (!channel)
+      throw new Error(`Channel not found: ${id}`);
+    const event = createEvent({
+      source: input.source ?? "hasna.events",
+      type: input.type ?? "events.test",
+      subject: input.subject ?? id,
+      severity: input.severity ?? "info",
+      data: input.data ?? { test: true },
+      message: input.message ?? "Hasna events test delivery",
+      dedupeKey: input.dedupeKey,
+      schemaVersion: input.schemaVersion,
+      metadata: input.metadata,
+      time: input.time,
+      id: input.id
+    });
+    const eventForChannel = await this.applyRedaction(event, channel);
+    const result = await this.deliverWithRetry(eventForChannel, channel);
+    await this.store.appendDelivery(result);
+    return result;
+  }
+  async replay(options = {}) {
+    const events = (await this.store.listEvents()).filter((event) => {
+      if (options.eventId && event.id !== options.eventId)
+        return false;
+      if (options.source && event.source !== options.source)
+        return false;
+      if (options.type && event.type !== options.type)
+        return false;
+      return true;
+    });
+    if (options.dryRun)
+      return { events, deliveries: [] };
+    const deliveries = [];
+    for (const event of events) {
+      deliveries.push(...await this.deliver(event));
+    }
+    return { events, deliveries };
+  }
+  async applyRedaction(event, channel) {
+    let next = redactPaths(event, channel.redact?.paths ?? [], channel.redact?.replacement ?? "[REDACTED]");
+    for (const redactor of this.redactors) {
+      next = await redactor(next, channel);
+    }
+    return next;
+  }
+  async deliverWithRetry(event, channel) {
+    const policy = normalizeRetryPolicy(channel.retry);
+    const attempts = [];
+    for (let index = 0;index < policy.maxAttempts; index += 1) {
+      const attempt = await dispatchChannel(event, channel, this.transportOptions);
+      attempt.attempt = index + 1;
+      if (attempt.status === "failed" && index + 1 < policy.maxAttempts) {
+        attempt.nextBackoffMs = Math.round(policy.backoffMs * policy.multiplier ** index);
+      }
+      attempts.push(attempt);
+      if (attempt.status !== "failed")
+        break;
+      if (attempt.nextBackoffMs)
+        await Bun.sleep(attempt.nextBackoffMs);
+    }
+    return createDeliveryResult(event, channel, attempts);
+  }
+}
+function redactPaths(event, paths, replacement = "[REDACTED]") {
+  if (paths.length === 0)
+    return event;
+  const copy = structuredClone(event);
+  for (const path of paths) {
+    setPath(copy, path, replacement);
+  }
+  return copy;
+}
+function sanitizeChannelForOutput(channel) {
+  const copy = structuredClone(channel);
+  if (copy.webhook?.secret)
+    copy.webhook.secret = "[REDACTED]";
+  if (copy.command?.env) {
+    copy.command.env = Object.fromEntries(Object.entries(copy.command.env).map(([key, value]) => [key, shouldRedactKey(key) ? "[REDACTED]" : value]));
+  }
+  return copy;
+}
+function sanitizeChannelsForOutput(channels) {
+  return channels.map(sanitizeChannelForOutput);
+}
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue(event, replacement);
+}
+function shouldRedactKey(key) {
+  return /secret|token|password|api[_-]?key|authorization/i.test(key);
+}
+function redactValue(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue(item, replacement)
+  ]));
+}
+function setPath(input, path, replacement) {
+  const parts = path.split(".");
+  let cursor = input;
+  for (const part of parts.slice(0, -1)) {
+    const next = cursor[part];
+    if (!next || typeof next !== "object")
+      return;
+    cursor = next;
+  }
+  const last = parts.at(-1);
+  if (last && last in cursor)
+    cursor[last] = replacement;
+}
+function normalizeTime(value) {
+  if (!value)
+    return new Date().toISOString();
+  return value instanceof Date ? value.toISOString() : value;
+}
+function normalizeRetryPolicy(policy) {
+  return {
+    maxAttempts: Math.max(1, policy?.maxAttempts ?? 1),
+    backoffMs: Math.max(0, policy?.backoffMs ?? 250),
+    multiplier: Math.max(1, policy?.multiplier ?? 2)
+  };
+}
+function parseJsonObject(value, fallback) {
+  if (!value)
+    return fallback;
+  const parsed = JSON.parse(value);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("Expected a JSON object");
+  }
+  return parsed;
+}
+function parseHeaders(values) {
+  if (!values?.length)
+    return;
+  const headers = {};
+  for (const value of values) {
+    const separator = value.indexOf("=");
+    if (separator === -1)
+      throw new Error(`Invalid header, expected name=value: ${value}`);
+    headers[value.slice(0, separator)] = value.slice(separator + 1);
+  }
+  return headers;
+}
+function parseFilter(options) {
+  const filter2 = {};
+  if (options.source)
+    filter2.source = options.source;
+  if (options.type)
+    filter2.type = options.type;
+  if (options.subject)
+    filter2.subject = options.subject;
+  if (options.severity)
+    filter2.severity = options.severity;
+  return Object.keys(filter2).length > 0 ? [filter2] : undefined;
+}
+function createClient(options) {
+  if (options.createClient)
+    return options.createClient();
+  return new EventsClient({ store: new JsonEventsStore(options.dataDir) });
+}
+function print(value, json, text) {
+  if (json)
+    console.log(JSON.stringify(value, null, 2));
+  else
+    console.log(text);
+}
+function hasJsonOption(options) {
+  return Boolean(options?.json || options?.opts?.().json || options?.optsWithGlobals?.().json || options?.parent?.opts?.().json || options?.parent?.optsWithGlobals?.().json);
+}
+function wantsJson(actionOptions, command) {
+  return hasJsonOption(actionOptions) || hasJsonOption(command);
+}
+function registerWebhookCommands(program2, options) {
+  const webhooks = program2.command(options.webhooksCommandName ?? "webhooks").description("Manage Hasna event webhook subscriptions");
+  webhooks.command("add").description("Add or replace a webhook or command subscription").argument("<target>", "Webhook URL or command binary").requiredOption("--id <id>", "Subscription/channel identifier").option("--transport <kind>", "Transport kind: webhook or command", "webhook").option("--name <name>", "Display name").option("--type <pattern>", "Event type filter, e.g. todos.task.*").option("--source <pattern>", "Event source filter").option("--subject <pattern>", "Event subject filter").option("--severity <pattern>", "Event severity filter").option("--secret <secret>", "Webhook HMAC secret").option("--header <name=value...>", "Webhook header", collectValues, []).option("--arg <arg...>", "Command argument", collectValues, []).option("--timeout-ms <ms>", "Transport timeout in milliseconds", parseNumber).option("--retry-attempts <n>", "Maximum delivery attempts", parseNumber).option("--retry-backoff-ms <ms>", "Initial retry backoff in milliseconds", parseNumber).option("--redact <path...>", "Event field path to redact before delivery", collectValues, []).option("--disabled", "Create channel disabled", false).option("-j, --json", "Print JSON output", false).action(async (target, actionOptions, command) => {
+    const timestamp = new Date().toISOString();
+    const channel = {
+      id: actionOptions.id,
+      name: actionOptions.name,
+      enabled: !actionOptions.disabled,
+      transport: actionOptions.transport,
+      filters: parseFilter(actionOptions),
+      retry: actionOptions.retryAttempts || actionOptions.retryBackoffMs ? { maxAttempts: actionOptions.retryAttempts, backoffMs: actionOptions.retryBackoffMs } : undefined,
+      redact: actionOptions.redact?.length ? { paths: actionOptions.redact } : undefined,
+      createdAt: timestamp,
+      updatedAt: timestamp
+    };
+    if (actionOptions.transport === "webhook") {
+      channel.webhook = { url: target, secret: actionOptions.secret, headers: parseHeaders(actionOptions.header), timeoutMs: actionOptions.timeoutMs };
+    } else if (actionOptions.transport === "command") {
+      channel.command = { command: target, args: actionOptions.arg ?? [], timeoutMs: actionOptions.timeoutMs };
+    } else {
+      throw new Error(`Transport ${actionOptions.transport} is reserved for future use and cannot be added yet`);
+    }
+    const saved = await createClient(options).addChannel(channel);
+    print(sanitizeChannelForOutput(saved), wantsJson(actionOptions, command), `Added ${saved.transport} channel ${saved.id}`);
+  });
+  webhooks.command("list").description("List configured subscriptions").option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+    const channels = await createClient(options).listChannels();
+    if (wantsJson(actionOptions, command)) {
+      console.log(JSON.stringify(sanitizeChannelsForOutput(channels), null, 2));
+      return;
+    }
+    if (!channels.length) {
+      console.log("No channels configured.");
+      return;
+    }
+    for (const channel of channels) {
+      console.log(`${channel.id}	${channel.enabled ? "enabled" : "disabled"}	${channel.transport}	${channel.webhook?.url ?? channel.command?.command ?? channel.transport}`);
+    }
+  });
+  webhooks.command("remove").description("Remove a subscription").argument("<id>", "Subscription/channel identifier").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
+    const removed = await createClient(options).removeChannel(id);
+    print({ removed }, wantsJson(actionOptions, command), removed ? `Removed ${id}` : `Channel not found: ${id}`);
+  });
+  webhooks.command("test").description("Send a test event to one subscription").argument("<id>", "Subscription/channel identifier").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events test delivery").option("--data <json>", "Event data JSON object").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
+    const result = await createClient(options).testChannel(id, {
+      source: options.source,
+      type: actionOptions.type,
+      subject: actionOptions.subject ?? id,
+      message: actionOptions.message,
+      data: parseJsonObject(actionOptions.data, { test: true })
+    });
+    print(result, wantsJson(actionOptions, command), `${result.status}: ${result.channelId}`);
+  });
+  return webhooks;
+}
+function registerEventCommands(program2, options) {
+  const events = program2.command(options.eventsCommandName ?? "events").description("Emit, list, and replay Hasna events");
+  events.command("emit").description("Emit an event from this app").argument("<type>", "Event type").option("--source <source>", "Event source override").option("--subject <subject>", "Event subject").option("--severity <severity>", "Event severity", "info").option("--message <message>", "Event message").option("--dedupe-key <key>", "Dedupe key").option("--data <json>", "Event data JSON object").option("--metadata <json>", "Event metadata JSON object").option("--no-deliver", "Record without delivering").option("--no-dedupe", "Allow duplicate id/dedupeKey events").option("-j, --json", "Print JSON output", false).action(async (type, actionOptions, command) => {
+    const result = await createClient(options).emit({
+      source: actionOptions.source ?? options.source,
+      type,
+      subject: actionOptions.subject,
+      severity: actionOptions.severity,
+      message: actionOptions.message,
+      dedupeKey: actionOptions.dedupeKey,
+      data: parseJsonObject(actionOptions.data, {}),
+      metadata: parseJsonObject(actionOptions.metadata, {})
+    }, { deliver: actionOptions.deliver, dedupe: actionOptions.dedupe });
+    print(result, wantsJson(actionOptions, command), `${result.deduped ? "Deduped" : "Emitted"} ${result.event.id} to ${result.deliveries.length} channel(s)`);
+  });
+  events.command("list").description("List recorded events").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--limit <n>", "Limit results", parseNumber).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+    let rows = await createClient(options).listEvents();
+    if (actionOptions.source)
+      rows = rows.filter((event) => event.source === actionOptions.source);
+    if (actionOptions.type)
+      rows = rows.filter((event) => event.type === actionOptions.type);
+    if (actionOptions.limit)
+      rows = rows.slice(-actionOptions.limit);
+    if (wantsJson(actionOptions, command)) {
+      console.log(JSON.stringify(rows, null, 2));
+      return;
+    }
+    if (!rows.length) {
+      console.log("No events recorded.");
+      return;
+    }
+    for (const event of rows)
+      console.log(`${event.time}	${event.id}	${event.source}	${event.type}	${event.severity}`);
+  });
+  events.command("replay").description("Replay recorded events").option("--id <id>", "Replay one event id").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--dry-run", "Preview without delivery", false).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+    const result = await createClient(options).replay({
+      eventId: actionOptions.id,
+      source: actionOptions.source,
+      type: actionOptions.type,
+      dryRun: actionOptions.dryRun
+    });
+    print(result, wantsJson(actionOptions, command), `Replayed ${result.events.length} event(s), ${result.deliveries.length} delivery result(s)`);
+  });
+  return events;
+}
+function registerEventsCommands(program2, options) {
+  registerWebhookCommands(program2, options);
+  registerEventCommands(program2, options);
+}
+function parseNumber(value) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed))
+    throw new Error(`Expected a number, got ${value}`);
+  return parsed;
+}
+function collectValues(value, previous) {
+  previous.push(value);
+  return previous;
+}
+
 // src/cli/cmd-setup.ts
 init_config();
 
@@ -12510,11 +13194,11 @@ async function ensureAllPgDatabases() {
 
 // src/sync-schedule.ts
 init_config();
-import { join as join5, dirname as dirname2 } from "path";
-import { existsSync as existsSync5, writeFileSync as writeFileSync2, unlinkSync, mkdirSync as mkdirSync3 } from "fs";
-import { homedir as homedir5, platform as platform2 } from "os";
+import { join as join6, dirname as dirname2 } from "path";
+import { existsSync as existsSync6, writeFileSync as writeFileSync2, unlinkSync, mkdirSync as mkdirSync3 } from "fs";
+import { homedir as homedir6, platform as platform2 } from "os";
 var SERVICE_NAME = "hasna-cloud-sync";
-var CONFIG_DIR2 = join5(homedir5(), ".hasna", "cloud");
+var CONFIG_DIR2 = join6(homedir6(), ".hasna", "cloud");
 function parseInterval(input) {
   const trimmed = input.trim().toLowerCase();
   const hourMatch = trimmed.match(/^(\d+)\s*h$/);
@@ -12555,34 +13239,34 @@ function minutesToCron(minutes) {
 }
 function getWorkerPath() {
   const dir = typeof import.meta.dir === "string" ? import.meta.dir : dirname2(import.meta.url.replace("file://", ""));
-  const tsPath = join5(dir, "scheduled-sync.ts");
-  const jsPath = join5(dir, "scheduled-sync.js");
+  const tsPath = join6(dir, "scheduled-sync.ts");
+  const jsPath = join6(dir, "scheduled-sync.js");
   try {
-    if (existsSync5(tsPath))
+    if (existsSync6(tsPath))
       return tsPath;
   } catch {}
   return jsPath;
 }
 function getBunPath() {
   const candidates = [
-    join5(homedir5(), ".bun", "bin", "bun"),
+    join6(homedir6(), ".bun", "bin", "bun"),
     "/usr/local/bin/bun",
     "/usr/bin/bun"
   ];
   for (const p of candidates) {
-    if (existsSync5(p))
+    if (existsSync6(p))
       return p;
   }
   return "bun";
 }
 function getLaunchdPlistPath() {
-  return join5(homedir5(), "Library", "LaunchAgents", `com.hasna.cloud-sync.plist`);
+  return join6(homedir6(), "Library", "LaunchAgents", `com.hasna.cloud-sync.plist`);
 }
 function createLaunchdPlist(intervalMinutes) {
   const workerPath = getWorkerPath();
   const bunPath = getBunPath();
-  const logPath = join5(CONFIG_DIR2, "sync.log");
-  const errorLogPath = join5(CONFIG_DIR2, "sync-error.log");
+  const logPath = join6(CONFIG_DIR2, "sync.log");
+  const errorLogPath = join6(CONFIG_DIR2, "sync-error.log");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -12608,7 +13292,7 @@ function createLaunchdPlist(intervalMinutes) {
     <key>PATH</key>
     <string>${process.env.PATH || "/usr/local/bin:/usr/bin:/bin"}</string>
     <key>HOME</key>
-    <string>${homedir5()}</string>
+    <string>${homedir6()}</string>
   </dict>
 </dict>
 </plist>`;
@@ -12633,7 +13317,7 @@ async function removeLaunchd() {
   } catch {}
 }
 function getSystemdDir() {
-  return join5(homedir5(), ".config", "systemd", "user");
+  return join6(homedir6(), ".config", "systemd", "user");
 }
 function createSystemdService() {
   const workerPath = getWorkerPath();
@@ -12645,7 +13329,7 @@ After=network.target
 [Service]
 Type=oneshot
 ExecStart=${bunPath} run ${workerPath}
-Environment=HOME=${homedir5()}
+Environment=HOME=${homedir6()}
 Environment=PATH=${process.env.PATH || "/usr/local/bin:/usr/bin:/bin"}
 
 [Install]
@@ -12668,8 +13352,8 @@ WantedBy=timers.target
 async function registerSystemd(intervalMinutes) {
   const dir = getSystemdDir();
   mkdirSync3(dir, { recursive: true });
-  writeFileSync2(join5(dir, `${SERVICE_NAME}.service`), createSystemdService());
-  writeFileSync2(join5(dir, `${SERVICE_NAME}.timer`), createSystemdTimer(intervalMinutes));
+  writeFileSync2(join6(dir, `${SERVICE_NAME}.service`), createSystemdService());
+  writeFileSync2(join6(dir, `${SERVICE_NAME}.timer`), createSystemdTimer(intervalMinutes));
   await Bun.spawn(["systemctl", "--user", "daemon-reload"]).exited;
   await Bun.spawn(["systemctl", "--user", "enable", "--now", `${SERVICE_NAME}.timer`]).exited;
 }
@@ -12679,10 +13363,10 @@ async function removeSystemd() {
   } catch {}
   const dir = getSystemdDir();
   try {
-    unlinkSync(join5(dir, `${SERVICE_NAME}.service`));
+    unlinkSync(join6(dir, `${SERVICE_NAME}.service`));
   } catch {}
   try {
-    unlinkSync(join5(dir, `${SERVICE_NAME}.timer`));
+    unlinkSync(join6(dir, `${SERVICE_NAME}.timer`));
   } catch {}
   try {
     await Bun.spawn(["systemctl", "--user", "daemon-reload"]).exited;
@@ -12719,9 +13403,9 @@ function getSyncScheduleStatus() {
   let mechanism = "none";
   if (registered) {
     if (platform2() === "darwin") {
-      mechanism = existsSync5(getLaunchdPlistPath()) ? "launchd" : "none";
+      mechanism = existsSync6(getLaunchdPlistPath()) ? "launchd" : "none";
     } else {
-      mechanism = existsSync5(join5(getSystemdDir(), `${SERVICE_NAME}.timer`)) ? "systemd" : "none";
+      mechanism = existsSync6(join6(getSystemdDir(), `${SERVICE_NAME}.timer`)) ? "systemd" : "none";
     }
   }
   return {
@@ -12913,8 +13597,8 @@ function purgeResolvedConflicts(db) {
 // src/scheduled-sync.ts
 init_config();
 init_adapter();
-import { existsSync as existsSync6, readdirSync as readdirSync3 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync7, readdirSync as readdirSync3 } from "fs";
+import { join as join7 } from "path";
 
 // src/sync-incremental.ts
 init_machines();
@@ -13040,10 +13724,10 @@ function incrementalSyncPush(local, remote, tables, options = {}) {
       if (rows.length === 0) {
         stat.skipped_rows = stat.total_rows;
       }
-      const now = new Date().toISOString();
+      const now2 = new Date().toISOString();
       upsertSyncMeta(local, {
         table_name: table,
-        last_synced_at: now,
+        last_synced_at: now2,
         last_synced_row_count: stat.synced_rows,
         direction: "push"
       });
@@ -13096,10 +13780,10 @@ function incrementalSyncPull(remote, local, tables, options = {}) {
       if (rows.length === 0) {
         stat.skipped_rows = stat.total_rows;
       }
-      const now = new Date().toISOString();
+      const now2 = new Date().toISOString();
       upsertSyncMeta(local, {
         table_name: table,
-        last_synced_at: now,
+        last_synced_at: now2,
         last_synced_row_count: stat.synced_rows,
         direction: "pull"
       });
@@ -13121,8 +13805,8 @@ function discoverSyncableServices2() {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const dbPath = join6(hasnaDir, entry.name, `${entry.name}.db`);
-      if (existsSync6(dbPath)) {
+      const dbPath = join7(hasnaDir, entry.name, `${entry.name}.db`);
+      if (existsSync7(dbPath)) {
         services.push(entry.name);
       }
     }
@@ -13144,8 +13828,8 @@ async function runScheduledSync() {
       errors: []
     };
     try {
-      const dbPath = join6(getDataDir(service), `${service}.db`);
-      if (!existsSync6(dbPath)) {
+      const dbPath = join7(getDataDir(service), `${service}.db`);
+      if (!existsSync7(dbPath)) {
         continue;
       }
       const local = new SqliteAdapter(dbPath);
@@ -13188,26 +13872,26 @@ async function runScheduledSync() {
 }
 
 // src/cli/cmd-sync.ts
-import { existsSync as existsSync8, statSync as statSync5 } from "fs";
-import { join as join8 } from "path";
-import { homedir as homedir7 } from "os";
+import { existsSync as existsSync9, statSync as statSync5 } from "fs";
+import { join as join9 } from "path";
+import { homedir as homedir8 } from "os";
 
 // src/daemon-sync.ts
 init_adapter();
 init_config();
 init_discover();
 init_dotfile();
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import {
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync3,
   statSync as statSync4,
   writeFileSync as writeFileSync3
 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
-var DAEMON_STATE_PATH = join7(homedir6(), ".hasna", "cloud", "daemon-state.json");
+import { homedir as homedir7 } from "os";
+import { join as join8 } from "path";
+var DAEMON_STATE_PATH = join8(homedir7(), ".hasna", "cloud", "daemon-state.json");
 var defaultDaemonAdapterFactory = {
   getLocalDbPath: (service) => getDbPath(service),
   openLocal: (service) => new SqliteAdapter(getDbPath(service)),
@@ -13275,7 +13959,7 @@ function createDefaultDaemonState() {
   };
 }
 function readDaemonState() {
-  if (!existsSync7(DAEMON_STATE_PATH)) {
+  if (!existsSync8(DAEMON_STATE_PATH)) {
     return createDefaultDaemonState();
   }
   try {
@@ -13292,7 +13976,7 @@ function readDaemonState() {
   }
 }
 function writeDaemonState(state) {
-  mkdirSync4(join7(homedir6(), ".hasna", "cloud"), { recursive: true });
+  mkdirSync4(join8(homedir7(), ".hasna", "cloud"), { recursive: true });
   writeFileSync3(DAEMON_STATE_PATH, JSON.stringify(state, null, 2) + `
 `, "utf-8");
 }
@@ -13430,8 +14114,8 @@ function runDaemonPass(config, state = createDefaultDaemonState(), options = {})
   const nextState = cloneState(state);
   const adapterFactory = options.adapterFactory ?? defaultDaemonAdapterFactory;
   const services = options.services ?? resolveDaemonServices(config);
-  const now = nowIso();
-  const nowMs = Date.parse(now);
+  const now2 = nowIso();
+  const nowMs = Date.parse(now2);
   const summary = {
     services,
     pushed_services: 0,
@@ -13440,7 +14124,7 @@ function runDaemonPass(config, state = createDefaultDaemonState(), options = {})
     pulled_rows: 0,
     errors: []
   };
-  nextState.updated_at = now;
+  nextState.updated_at = now2;
   nextState.status = config.paused ? "paused" : "running";
   if (config.paused) {
     scanConfiguredFiles(config, nextState);
@@ -13448,7 +14132,7 @@ function runDaemonPass(config, state = createDefaultDaemonState(), options = {})
   }
   for (const service of services) {
     const dbPath = adapterFactory.getLocalDbPath(service);
-    if (!existsSync7(dbPath))
+    if (!existsSync8(dbPath))
       continue;
     const serviceState = getServiceState(nextState, service);
     let local = null;
@@ -13468,10 +14152,10 @@ function runDaemonPass(config, state = createDefaultDaemonState(), options = {})
         });
         const pushSummary = summarizeStats(pushStats);
         serviceState.last_local_db_mtime_ms = localStats.mtimeMs;
-        serviceState.last_push_at = now;
+        serviceState.last_push_at = now2;
         serviceState.last_error = pushSummary.errors[0] ?? null;
-        recordTableRuns(serviceState, duePushTables, "push", now);
-        nextState.last_push_at = now;
+        recordTableRuns(serviceState, duePushTables, "push", now2);
+        nextState.last_push_at = now2;
         summary.pushed_services++;
         summary.pushed_rows += pushSummary.rows;
         summary.errors.push(...pushSummary.errors.map((error) => `[${service}] ${error}`));
@@ -13486,10 +14170,10 @@ function runDaemonPass(config, state = createDefaultDaemonState(), options = {})
           conflictStrategy: config.conflict_strategy
         });
         const pullSummary = summarizeStats(pullStats);
-        serviceState.last_pull_at = now;
+        serviceState.last_pull_at = now2;
         serviceState.last_error = pullSummary.errors[0] ?? null;
-        recordTableRuns(serviceState, duePullTables, "pull", now);
-        nextState.last_pull_at = now;
+        recordTableRuns(serviceState, duePullTables, "pull", now2);
+        nextState.last_pull_at = now2;
         summary.pulled_services++;
         summary.pulled_rows += pullSummary.rows;
         summary.errors.push(...pullSummary.errors.map((error) => `[${service}] ${error}`));
@@ -13555,7 +14239,7 @@ function startDaemon(overrides = {}) {
   if (currentStatus.running) {
     return currentStatus;
   }
-  const child = spawn(process.execPath, getDaemonArgs(), {
+  const child = spawn2(process.execPath, getDaemonArgs(), {
     detached: true,
     stdio: "ignore",
     env: {
@@ -13684,8 +14368,8 @@ function normalizeConflictStrategy(strategy) {
 // src/cli/cmd-sync.ts
 function logSync(direction, service, rows, errors2) {
   try {
-    const logDir = join8(homedir7(), ".hasna", "cloud");
-    const logPath = join8(logDir, "sync.log");
+    const logDir = join9(homedir8(), ".hasna", "cloud");
+    const logPath = join9(logDir, "sync.log");
     const { mkdirSync: mkdirSync5, appendFileSync } = __require("fs");
     mkdirSync5(logDir, { recursive: true });
     const ts = new Date().toISOString();
@@ -13702,7 +14386,7 @@ function registerSyncCommands(syncCmd) {
   registerScheduleCommand(syncCmd);
   registerDaemonCommand(syncCmd);
 }
-function collectValues(value, previous = []) {
+function collectValues2(value, previous = []) {
   previous.push(value);
   return previous;
 }
@@ -13948,7 +14632,7 @@ function registerStatusCommand(syncCmd) {
     const statuses = [];
     for (const service of services) {
       const dbPath = getDbPath(service);
-      const localExists = existsSync8(dbPath);
+      const localExists = existsSync9(dbPath);
       let localSize = "—";
       let tableCount = 0;
       if (localExists) {
@@ -14194,7 +14878,7 @@ No syncable services found (no .db files in ~/.hasna/).`);
   });
 }
 function registerDaemonCommand(syncCmd) {
-  syncCmd.command("daemon").description("Manage continuous background sync daemon").option("--start", "Start the daemon").option("--stop", "Stop the daemon").option("--pause", "Pause the daemon without stopping it").option("--resume", "Resume a paused daemon").option("--status", "Show daemon status").option("--now", "Run one daemon pass immediately").option("--foreground", "Run the daemon in the foreground").option("--watch <seconds>", "Local database scan interval in seconds").option("--pull <seconds>", "Remote pull interval in seconds").option("--push-debounce <seconds>", "Minimum seconds between auto-pushes").option("--conflict-strategy <strategy>", "newest-wins, local-wins, or remote-wins").option("--service <name>", "Restrict daemon to a service (repeatable)", collectValues, []).option("--table-interval <rule>", "Per-table interval, e.g. todos.tasks=30 or todos:tasks=30", collectValues, []).option("--file <rule>", "Track a file path for daemon status, e.g. ~/.claude/agents=30", collectValues, []).addOption(new Option2("--run", "Internal daemon worker").hideHelp()).action((opts) => {
+  syncCmd.command("daemon").description("Manage continuous background sync daemon").option("--start", "Start the daemon").option("--stop", "Stop the daemon").option("--pause", "Pause the daemon without stopping it").option("--resume", "Resume a paused daemon").option("--status", "Show daemon status").option("--now", "Run one daemon pass immediately").option("--foreground", "Run the daemon in the foreground").option("--watch <seconds>", "Local database scan interval in seconds").option("--pull <seconds>", "Remote pull interval in seconds").option("--push-debounce <seconds>", "Minimum seconds between auto-pushes").option("--conflict-strategy <strategy>", "newest-wins, local-wins, or remote-wins").option("--service <name>", "Restrict daemon to a service (repeatable)", collectValues2, []).option("--table-interval <rule>", "Per-table interval, e.g. todos.tasks=30 or todos:tasks=30", collectValues2, []).option("--file <rule>", "Track a file path for daemon status, e.g. ~/.claude/agents=30", collectValues2, []).addOption(new Option2("--run", "Internal daemon worker").hideHelp()).action((opts) => {
     const currentConfig = getDaemonConfig();
     const selectedServices = opts.service.length > 0 ? Array.from(new Set(opts.service)) : currentConfig.services;
     const tableIntervalRules = opts.tableInterval;
@@ -14370,17 +15054,17 @@ function ensureFeedbackTable(db) {
 function saveFeedback(db, feedback) {
   ensureFeedbackTable(db);
   const id = feedback.id ?? Math.random().toString(36).slice(2) + Date.now().toString(36);
-  const now = new Date().toISOString();
+  const now2 = new Date().toISOString();
   const machineId = feedback.machine_id ?? hostname2();
   db.run(`INSERT INTO feedback (id, service, version, message, email, machine_id, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?)`, id, feedback.service, feedback.version ?? "", feedback.message, feedback.email ?? "", machineId, feedback.created_at ?? now);
+     VALUES (?, ?, ?, ?, ?, ?, ?)`, id, feedback.service, feedback.version ?? "", feedback.message, feedback.email ?? "", machineId, feedback.created_at ?? now2);
   return id;
 }
 async function sendFeedback(feedback, db) {
   const config = getCloudConfig();
   const id = feedback.id ?? Math.random().toString(36).slice(2) + Date.now().toString(36);
   const machineId = feedback.machine_id ?? hostname2();
-  const now = new Date().toISOString();
+  const now2 = new Date().toISOString();
   const payload = {
     id,
     service: feedback.service,
@@ -14388,7 +15072,7 @@ async function sendFeedback(feedback, db) {
     message: feedback.message,
     email: feedback.email ?? "",
     machine_id: machineId,
-    created_at: feedback.created_at ?? now
+    created_at: feedback.created_at ?? now2
   };
   try {
     const res = await fetch(config.feedback_endpoint, {
@@ -14440,14 +15124,14 @@ function registerFeedbackCommand(program3) {
 init_config();
 init_adapter();
 init_discover();
-import { existsSync as existsSync9 } from "fs";
-import { join as join9 } from "path";
-import { homedir as homedir8 } from "os";
+import { existsSync as existsSync10 } from "fs";
+import { join as join10 } from "path";
+import { homedir as homedir9 } from "os";
 function registerDoctorCommand(program3) {
   program3.command("doctor").description("Comprehensive health check for cloud sync setup").action(async () => {
     const checks = [];
-    const configPath = join9(homedir8(), ".hasna", "cloud", "config.json");
-    checks.push(existsSync9(configPath) ? { name: "Config file", status: "pass", detail: configPath } : { name: "Config file", status: "fail", detail: "Missing. Run `cloud setup`." });
+    const configPath = join10(homedir9(), ".hasna", "cloud", "config.json");
+    checks.push(existsSync10(configPath) ? { name: "Config file", status: "pass", detail: configPath } : { name: "Config file", status: "fail", detail: "Missing. Run `cloud setup`." });
     const config = getCloudConfig();
     checks.push(config.mode === "hybrid" || config.mode === "cloud" ? { name: "Sync mode", status: "pass", detail: config.mode } : { name: "Sync mode", status: "fail", detail: `"${config.mode}" — sync disabled. Run \`cloud setup --mode hybrid\`.` });
     checks.push(config.rds.host ? { name: "RDS host", status: "pass", detail: config.rds.host } : { name: "RDS host", status: "fail", detail: "Not configured. Run `cloud setup`." });
@@ -14466,7 +15150,7 @@ function registerDoctorCommand(program3) {
       checks.push({ name: "PG connection", status: "fail", detail: "Skipped — missing host or password" });
     }
     const caPath = process.env.NODE_EXTRA_CA_CERTS;
-    if (caPath && existsSync9(caPath)) {
+    if (caPath && existsSync10(caPath)) {
       checks.push({ name: "SSL CA cert", status: "pass", detail: caPath });
     } else if (caPath) {
       checks.push({ name: "SSL CA cert", status: "warn", detail: `NODE_EXTRA_CA_CERTS set but file missing: ${caPath}` });
@@ -14507,9 +15191,9 @@ init_zod();
 init_adapter();
 init_dotfile();
 init_machines();
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join10 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join11 } from "path";
 var DaemonConfigSchema2 = exports_external.object({
   enabled: exports_external.boolean().default(false),
   paused: exports_external.boolean().default(false),
@@ -14541,10 +15225,10 @@ var CloudConfigSchema2 = exports_external.object({
   }).default({}),
   daemon: DaemonConfigSchema2
 });
-var CONFIG_DIR3 = join10(homedir9(), ".hasna", "cloud");
-var CONFIG_PATH2 = join10(CONFIG_DIR3, "config.json");
+var CONFIG_DIR3 = join11(homedir10(), ".hasna", "cloud");
+var CONFIG_PATH2 = join11(CONFIG_DIR3, "config.json");
 function getCloudConfig2() {
-  if (!existsSync10(CONFIG_PATH2)) {
+  if (!existsSync11(CONFIG_PATH2)) {
     return CloudConfigSchema2.parse({});
   }
   try {
@@ -14630,6 +15314,7 @@ class PgAdapterAsync2 {
 // src/cli/index.ts
 var program3 = new Command;
 program3.name("cloud").description("Shared cloud infrastructure \u2014 database adapter, sync engine, feedback, dotfile migration").version("0.1.13");
+registerEventsCommands(program3, { source: "cloud" });
 registerSetupCommand(program3);
 program3.command("status").description("Show current cloud configuration and connection health").action(async () => {
   const config = getCloudConfig2();