@hasna/instructions 0.3.0 → 0.4.0

package/dist/cli/index.js

@@ -2112,7 +2112,7 @@ var init_types = __esm(() => {
 
 // src/db/database.ts
 import { Database } from "bun:sqlite";
-import { cpSync, existsSync as existsSync2, mkdirSync, statSync } from "fs";
+import { cpSync, existsSync as existsSync2, mkdirSync, rmSync, statSync } from "fs";
 import { join as join2 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function getDbPath() {
@@ -2140,6 +2140,9 @@ function slugify(name) {
 function getDatabase(path) {
   if (_db)
     return _db;
+  if (!path && process.env["HASNA_INSTRUCTIONS_API_URL"] && process.env["HASNA_INSTRUCTIONS_API_KEY"]) {
+    throw new Error("instructions is in self_hosted (cloud) mode: this command is not wired to the cloud API yet. " + "Unset HASNA_INSTRUCTIONS_API_URL / HASNA_INSTRUCTIONS_API_KEY to use it against the local store.");
+  }
   const dbPath = path || getDbPath();
   const db = new Database(dbPath);
   db.run("PRAGMA journal_mode = WAL");
@@ -2157,6 +2160,16 @@ function resetDatabase() {
   }
   _db = null;
 }
+function resetLocalDatabase() {
+  resetDatabase();
+  const dbPath = getDbPath();
+  if (dbPath === ":memory:")
+    return;
+  for (const p of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
+    if (existsSync2(p))
+      rmSync(p);
+  }
+}
 function applyMigrations(db) {
   let currentVersion = 0;
   try {
@@ -2183,6 +2196,10 @@ function ensureFeedbackTable(db) {
     )
   `);
 }
+function insertFeedback(input, db) {
+  const d = db || getDatabase();
+  d.run("INSERT INTO feedback (message, email, category, version) VALUES (?, ?, ?, ?)", [input.message, input.email ?? null, input.category ?? "general", input.version ?? null]);
+}
 function migrateDotfile() {
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
   const oldDirs = [join2(home, ".open-configs"), join2(home, ".configs")];
@@ -2613,6 +2630,135 @@ var init_machine = __esm(() => {
   init_template();
 });
 
+// src/db/profiles.ts
+function rowToProfile(row) {
+  return {
+    ...row,
+    selectors: JSON.parse(row.selectors || "{}"),
+    variables: JSON.parse(row.variables || "{}")
+  };
+}
+function uniqueProfileSlug(name, db, excludeId) {
+  const base = slugify(name);
+  let slug = base;
+  let i = 1;
+  while (true) {
+    const existing = db.query("SELECT id FROM profiles WHERE slug = ?").get(slug);
+    if (!existing || existing.id === excludeId)
+      return slug;
+    slug = `${base}-${i++}`;
+  }
+}
+function createProfile(input, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  const ts = now2();
+  const slug = uniqueProfileSlug(input.name, d);
+  d.run("INSERT INTO profiles (id, name, slug, description, selectors, variables, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)", [
+    id,
+    input.name,
+    slug,
+    input.description ?? null,
+    JSON.stringify(input.selectors ?? {}),
+    JSON.stringify(input.variables ?? {}),
+    ts,
+    ts
+  ]);
+  return getProfile(id, d);
+}
+function getProfile(idOrSlug, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT * FROM profiles WHERE id = ? OR slug = ?").get(idOrSlug, idOrSlug);
+  if (!row)
+    throw new ProfileNotFoundError(idOrSlug);
+  return rowToProfile(row);
+}
+function listProfiles(db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM profiles ORDER BY name").all().map(rowToProfile);
+}
+function updateProfile(idOrSlug, input, db) {
+  const d = db || getDatabase();
+  const existing = getProfile(idOrSlug, d);
+  const ts = now2();
+  const updates = ["updated_at = ?"];
+  const params = [ts];
+  if (input.name !== undefined) {
+    updates.push("name = ?", "slug = ?");
+    params.push(input.name, uniqueProfileSlug(input.name, d, existing.id));
+  }
+  if (input.description !== undefined) {
+    updates.push("description = ?");
+    params.push(input.description);
+  }
+  if (input.selectors !== undefined) {
+    updates.push("selectors = ?");
+    params.push(JSON.stringify(input.selectors));
+  }
+  if (input.variables !== undefined) {
+    updates.push("variables = ?");
+    params.push(JSON.stringify(input.variables));
+  }
+  params.push(existing.id);
+  d.run(`UPDATE profiles SET ${updates.join(", ")} WHERE id = ?`, params);
+  return getProfile(existing.id, d);
+}
+function deleteProfile(idOrSlug, db) {
+  const d = db || getDatabase();
+  const existing = getProfile(idOrSlug, d);
+  d.run("DELETE FROM profiles WHERE id = ?", [existing.id]);
+}
+function addConfigToProfile(profileIdOrSlug, configId, db) {
+  const d = db || getDatabase();
+  const profile = getProfile(profileIdOrSlug, d);
+  const maxRow = d.query("SELECT MAX(sort_order) as max_order FROM profile_configs WHERE profile_id = ?").get(profile.id);
+  const order = (maxRow?.max_order ?? -1) + 1;
+  d.run("INSERT OR IGNORE INTO profile_configs (profile_id, config_id, sort_order) VALUES (?, ?, ?)", [profile.id, configId, order]);
+}
+function removeConfigFromProfile(profileIdOrSlug, configId, db) {
+  const d = db || getDatabase();
+  const profile = getProfile(profileIdOrSlug, d);
+  d.run("DELETE FROM profile_configs WHERE profile_id = ? AND config_id = ?", [profile.id, configId]);
+}
+function getProfileConfigs(profileIdOrSlug, db) {
+  const d = db || getDatabase();
+  const profile = getProfile(profileIdOrSlug, d);
+  const rows = d.query("SELECT config_id FROM profile_configs WHERE profile_id = ? ORDER BY sort_order").all(profile.id);
+  if (rows.length === 0)
+    return [];
+  const ids = rows.map((r) => r.config_id);
+  return listConfigs(undefined, d).filter((c) => ids.includes(c.id));
+}
+function profileHasSelectors(profile) {
+  const selectors = profile.selectors ?? {};
+  return (selectors.os?.length ?? 0) > 0 || (selectors.arch?.length ?? 0) > 0 || (selectors.hostnames?.length ?? 0) > 0;
+}
+function profileMatchesMachine(profile, machine) {
+  const selectors = profile.selectors ?? {};
+  const osMatches = !selectors.os?.length || selectors.os.some((candidate) => {
+    const value = candidate.trim().toLowerCase();
+    return value === machine.os_family || value === (machine.os ?? "").trim().toLowerCase() || normalizeOsFamily(candidate) === machine.os_family;
+  });
+  const archMatches = !selectors.arch?.length || selectors.arch.some((candidate) => candidate.trim().toLowerCase() === (machine.arch ?? "").trim().toLowerCase());
+  const hostnameMatches = !selectors.hostnames?.length || selectors.hostnames.some((candidate) => candidate.trim().toLowerCase() === machine.hostname.trim().toLowerCase());
+  return osMatches && archMatches && hostnameMatches;
+}
+function resolveProfileForMachine(machine = detectMachineContext(), db) {
+  const profiles = listProfiles(db).filter(profileHasSelectors);
+  const matches = profiles.filter((profile) => profileMatchesMachine(profile, machine)).map((profile) => {
+    const selectors = profile.selectors;
+    const score = (selectors.hostnames?.length ? 100 : 0) + (selectors.os?.length ? 10 : 0) + (selectors.arch?.length ? 10 : 0);
+    return { profile, score };
+  }).sort((a, b) => b.score - a.score || a.profile.name.localeCompare(b.profile.name));
+  return matches[0]?.profile ?? null;
+}
+var init_profiles = __esm(() => {
+  init_types();
+  init_database();
+  init_configs();
+  init_machine();
+});
+
 // src/db/snapshots.ts
 function createSnapshot(configId, content, version, db) {
   const d = db || getDatabase();
@@ -2629,10 +2775,385 @@ function getSnapshot(id, db) {
   const d = db || getDatabase();
   return d.query("SELECT * FROM config_snapshots WHERE id = ?").get(id);
 }
+function getSnapshotByVersion(configId, version, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? AND version = ?").get(configId, version);
+}
+function pruneSnapshots(configId, keep = 10, db) {
+  const d = db || getDatabase();
+  const result = d.run(`DELETE FROM config_snapshots WHERE config_id = ? AND id NOT IN (
+      SELECT id FROM config_snapshots WHERE config_id = ? ORDER BY version DESC LIMIT ?
+    )`, [configId, configId, keep]);
+  return result.changes;
+}
 var init_snapshots = __esm(() => {
   init_database();
 });
 
+// src/db/machines.ts
+import { arch, hostname, type } from "os";
+function currentHostname2() {
+  return hostname();
+}
+function currentOs() {
+  return type();
+}
+function currentArch2() {
+  return arch();
+}
+function registerMachine(hostnameStr, os, archStr, db) {
+  const d = db || getDatabase();
+  const h = hostnameStr ?? currentHostname2();
+  const o = os ?? currentOs();
+  const a = archStr ?? currentArch2();
+  const existing = d.query("SELECT * FROM machines WHERE hostname = ?").get(h);
+  if (existing) {
+    if (existing.os !== o || existing.arch !== a) {
+      d.run("UPDATE machines SET os = ?, arch = ? WHERE hostname = ?", [o, a, h]);
+      return d.query("SELECT * FROM machines WHERE hostname = ?").get(h);
+    }
+    return existing;
+  }
+  const id = uuid();
+  const ts = now2();
+  d.run("INSERT INTO machines (id, hostname, os, arch, last_applied_at, created_at) VALUES (?, ?, ?, ?, NULL, ?)", [id, h, o, a, ts]);
+  return d.query("SELECT * FROM machines WHERE id = ?").get(id);
+}
+function updateMachineApplied(hostnameStr, db) {
+  const d = db || getDatabase();
+  const h = hostnameStr ?? currentHostname2();
+  d.run("UPDATE machines SET last_applied_at = ? WHERE hostname = ?", [now2(), h]);
+}
+function listMachines(db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM machines ORDER BY last_applied_at DESC NULLS LAST").all();
+}
+var init_machines = __esm(() => {
+  init_database();
+});
+
+// src/data/config-store.ts
+import { randomUUID as randomUUID5 } from "crypto";
+function resolveCloudConfig(env = process.env) {
+  const apiUrl = env[API_URL_ENV]?.trim();
+  const apiKey = env[API_KEY_ENV]?.trim();
+  if (!apiUrl && !apiKey)
+    return null;
+  if (!apiUrl || !apiKey) {
+    throw new Error(`API mode requires BOTH ${API_URL_ENV} and ${API_KEY_ENV}; only ` + `${apiUrl ? API_URL_ENV : API_KEY_ENV} is set. Set both to use the cloud API, ` + `or unset both to use the local store.`);
+  }
+  return { apiUrl, apiKey };
+}
+function isCloudMode(env = process.env) {
+  return resolveCloudConfig(env) !== null;
+}
+
+class LocalConfigStore {
+  db;
+  mode = "local";
+  constructor(db) {
+    this.db = db;
+  }
+  async listConfigs(filter) {
+    return listConfigs(filter, this.db);
+  }
+  async getConfig(idOrSlug) {
+    return getConfig(idOrSlug, this.db);
+  }
+  async getConfigById(id) {
+    return getConfigById(id, this.db);
+  }
+  async createConfig(input) {
+    return createConfig(input, this.db);
+  }
+  async updateConfig(idOrSlug, input) {
+    return updateConfig(idOrSlug, input, this.db);
+  }
+  async deleteConfig(idOrSlug) {
+    deleteConfig(idOrSlug, this.db);
+  }
+  async getConfigStats() {
+    return getConfigStats(this.db);
+  }
+  async listSnapshots(configId) {
+    return listSnapshots(configId, this.db);
+  }
+  async getSnapshot(id) {
+    return getSnapshot(id, this.db);
+  }
+  async getSnapshotByVersion(configId, version) {
+    return getSnapshotByVersion(configId, version, this.db);
+  }
+  async createSnapshot(configId, content, version) {
+    return createSnapshot(configId, content, version, this.db);
+  }
+  async pruneSnapshots(configId, keep = 10) {
+    return pruneSnapshots(configId, keep, this.db);
+  }
+  async listProfiles() {
+    return listProfiles(this.db);
+  }
+  async getProfile(idOrSlug) {
+    return getProfile(idOrSlug, this.db);
+  }
+  async getProfileConfigs(idOrSlug) {
+    return getProfileConfigs(idOrSlug, this.db);
+  }
+  async createProfile(input) {
+    return createProfile(input, this.db);
+  }
+  async updateProfile(idOrSlug, input) {
+    return updateProfile(idOrSlug, input, this.db);
+  }
+  async deleteProfile(idOrSlug) {
+    deleteProfile(idOrSlug, this.db);
+  }
+  async addConfigToProfile(profileIdOrSlug, configId) {
+    addConfigToProfile(profileIdOrSlug, configId, this.db);
+  }
+  async removeConfigFromProfile(profileIdOrSlug, configId) {
+    removeConfigFromProfile(profileIdOrSlug, configId, this.db);
+  }
+  async resolveProfileForMachine(machine) {
+    return machine ? resolveProfileForMachine(machine, this.db) : resolveProfileForMachine(undefined, this.db);
+  }
+  async registerMachine(hostname2, os, arch2) {
+    return registerMachine(hostname2, os, arch2, this.db);
+  }
+  async updateMachineApplied(hostname2) {
+    updateMachineApplied(hostname2, this.db);
+  }
+  async listMachines() {
+    return listMachines(this.db);
+  }
+  async sendFeedback(input) {
+    insertFeedback(input, this.db);
+  }
+  async reset() {
+    resetLocalDatabase();
+  }
+}
+
+class CloudConfigStore {
+  mode = "api";
+  base;
+  apiKey;
+  timeoutMs;
+  constructor(config) {
+    this.base = `${config.apiUrl.replace(/\/+$/, "")}/v1`;
+    this.apiKey = config.apiKey;
+    this.timeoutMs = config.timeoutMs ?? 30000;
+  }
+  async request(method, path, body, opts = {}) {
+    const controller = new AbortController;
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    const headers = {
+      Authorization: `Bearer ${this.apiKey}`,
+      Accept: "application/json"
+    };
+    if (body !== undefined)
+      headers["Content-Type"] = "application/json";
+    if (opts.idempotent)
+      headers["Idempotency-Key"] = randomUUID5();
+    try {
+      const res = await fetch(`${this.base}${path}`, {
+        method,
+        headers,
+        body: body === undefined ? undefined : JSON.stringify(body),
+        signal: controller.signal
+      });
+      if (res.status === 404 && opts.allow404)
+        return { status: 404, data: null };
+      const text = await res.text();
+      let parsed = null;
+      if (text) {
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          parsed = text;
+        }
+      }
+      if (!res.ok) {
+        const message = (parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : undefined) ?? `HTTP ${res.status} on ${method} ${path}`;
+        throw new CloudHttpError(res.status, message, parsed);
+      }
+      return { status: res.status, data: parsed };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async listConfigs(filter = {}) {
+    const params = new URLSearchParams;
+    if (filter.category)
+      params.set("category", filter.category);
+    if (filter.agent)
+      params.set("agent", filter.agent);
+    if (filter.kind)
+      params.set("kind", filter.kind);
+    if (filter.search)
+      params.set("search", filter.search);
+    const qs = params.toString();
+    const { data } = await this.request("GET", `/configs${qs ? `?${qs}` : ""}`);
+    let configs = data?.configs ?? [];
+    if (filter.tags && filter.tags.length > 0) {
+      configs = configs.filter((c) => filter.tags.every((t) => c.tags.includes(t)));
+    }
+    if (filter.is_template !== undefined) {
+      configs = configs.filter((c) => c.is_template === filter.is_template);
+    }
+    return configs;
+  }
+  async getConfig(idOrSlug) {
+    const { status, data } = await this.request("GET", `/configs/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404 || !data?.config)
+      throw new ConfigNotFoundError(idOrSlug);
+    return data.config;
+  }
+  async getConfigById(id) {
+    return this.getConfig(id);
+  }
+  async createConfig(input) {
+    const { data } = await this.request("POST", "/configs", input, {
+      idempotent: true
+    });
+    return data.config;
+  }
+  async updateConfig(idOrSlug, input) {
+    const { data } = await this.request("PATCH", `/configs/${encodeURIComponent(idOrSlug)}`, input);
+    return data.config;
+  }
+  async deleteConfig(idOrSlug) {
+    const { status } = await this.request("DELETE", `/configs/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404)
+      throw new ConfigNotFoundError(idOrSlug);
+  }
+  async getConfigStats() {
+    const { data } = await this.request("GET", "/stats");
+    return data ?? { total: 0 };
+  }
+  async listSnapshots(configId) {
+    const { data } = await this.request("GET", `/configs/${encodeURIComponent(configId)}/snapshots`);
+    return data?.snapshots ?? [];
+  }
+  async getSnapshot(id) {
+    const { status, data } = await this.request("GET", `/snapshots/${encodeURIComponent(id)}`, undefined, { allow404: true });
+    if (status === 404 || !data?.snapshot)
+      return null;
+    return data.snapshot;
+  }
+  async getSnapshotByVersion(configId, version) {
+    const { status, data } = await this.request("GET", `/configs/${encodeURIComponent(configId)}/snapshots/${version}`, undefined, { allow404: true });
+    if (status === 404 || !data?.snapshot)
+      return null;
+    return data.snapshot;
+  }
+  async createSnapshot(configId, content, version) {
+    const { data } = await this.request("POST", `/configs/${encodeURIComponent(configId)}/snapshots`, { content, version }, { idempotent: true });
+    return data.snapshot;
+  }
+  async pruneSnapshots(configId, keep = 10) {
+    const { data } = await this.request("POST", `/configs/${encodeURIComponent(configId)}/snapshots/prune`, { keep });
+    return data?.pruned ?? 0;
+  }
+  async listProfiles() {
+    const { data } = await this.request("GET", "/profiles");
+    return data?.profiles ?? [];
+  }
+  async getProfile(idOrSlug) {
+    const { status, data } = await this.request("GET", `/profiles/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404 || !data?.profile)
+      throw new ProfileNotFoundError(idOrSlug);
+    const { configs: _configs, ...profile } = data.profile;
+    return profile;
+  }
+  async getProfileConfigs(idOrSlug) {
+    const { status, data } = await this.request("GET", `/profiles/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404 || !data?.profile)
+      throw new ProfileNotFoundError(idOrSlug);
+    return data.profile.configs ?? [];
+  }
+  async createProfile(input) {
+    const { data } = await this.request("POST", "/profiles", input, {
+      idempotent: true
+    });
+    return data.profile;
+  }
+  async updateProfile(idOrSlug, input) {
+    const { data } = await this.request("PATCH", `/profiles/${encodeURIComponent(idOrSlug)}`, input);
+    return data.profile;
+  }
+  async deleteProfile(idOrSlug) {
+    const { status } = await this.request("DELETE", `/profiles/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404)
+      throw new ProfileNotFoundError(idOrSlug);
+  }
+  async addConfigToProfile(profileIdOrSlug, configId) {
+    await this.request("POST", `/profiles/${encodeURIComponent(profileIdOrSlug)}/configs`, { config_id: configId }, { idempotent: true });
+  }
+  async removeConfigFromProfile(profileIdOrSlug, configId) {
+    await this.request("DELETE", `/profiles/${encodeURIComponent(profileIdOrSlug)}/configs/${encodeURIComponent(configId)}`, undefined, { allow404: true });
+  }
+  async resolveProfileForMachine(machine) {
+    const params = new URLSearchParams;
+    if (machine?.hostname)
+      params.set("hostname", machine.hostname);
+    if (machine?.os)
+      params.set("os", machine.os);
+    if (machine?.arch)
+      params.set("arch", machine.arch);
+    const qs = params.toString();
+    const { status, data } = await this.request("GET", `/profiles/resolve${qs ? `?${qs}` : ""}`, undefined, { allow404: true });
+    if (status === 404 || !data?.profile)
+      return null;
+    return data.profile;
+  }
+  async registerMachine(hostname2, os, arch2) {
+    const { data } = await this.request("POST", "/machines", { hostname: hostname2, os, arch: arch2 }, { idempotent: true });
+    return data.machine;
+  }
+  async updateMachineApplied(hostname2) {
+    await this.request("POST", "/machines/applied", { hostname: hostname2 });
+  }
+  async listMachines() {
+    const { data } = await this.request("GET", "/machines");
+    return data?.machines ?? [];
+  }
+  async sendFeedback(input) {
+    await this.request("POST", "/feedback", {
+      message: input.message,
+      email: input.email ?? undefined,
+      category: input.category ?? undefined,
+      version: input.version ?? undefined
+    });
+  }
+  async reset() {
+    throw new Error("`init --force` cannot wipe the shared cloud store from a client. " + "Unset HASNA_INSTRUCTIONS_API_URL / HASNA_INSTRUCTIONS_API_KEY to reset the local store instead.");
+  }
+}
+function resolveConfigStore(env = process.env) {
+  const cloud = resolveCloudConfig(env);
+  return cloud ? new CloudConfigStore(cloud) : new LocalConfigStore;
+}
+var CloudHttpError, API_URL_ENV = "HASNA_INSTRUCTIONS_API_URL", API_KEY_ENV = "HASNA_INSTRUCTIONS_API_KEY";
+var init_config_store = __esm(() => {
+  init_configs();
+  init_profiles();
+  init_snapshots();
+  init_machines();
+  init_database();
+  init_types();
+  CloudHttpError = class CloudHttpError extends Error {
+    status;
+    body;
+    constructor(status, message, body) {
+      super(message);
+      this.status = status;
+      this.body = body;
+      this.name = "CloudHttpError";
+    }
+  };
+});
+
 // src/lib/transforms.ts
 import { basename, extname } from "path";
 function ensureTrailingNewline(content) {
@@ -2800,8 +3321,8 @@ async function writeConfigResult(config, targetPath, content, opts, meta = {}) {
       mkdirSync2(dir, { recursive: true });
     }
     if (previousContent !== null && changed) {
-      const db = opts.db || getDatabase();
-      createSnapshot(config.id, previousContent, config.version, db);
+      const store = opts.store ?? resolveConfigStore();
+      await store.createSnapshot(config.id, previousContent, config.version);
     }
     writeFileSync(path, renderedContent, "utf-8");
   }
@@ -2827,8 +3348,8 @@ async function applyConfig(config, opts = {}) {
   if (config.kind === "reference" || (!config.target_path || !shouldApplyPrimary) && selectedOutputs.length === 0) {
     throw new ConfigApplyError(`Config "${config.name}" is a reference (kind=reference) and has no target_path \u2014 cannot apply to disk.`);
   }
-  const db = opts.db || getDatabase();
-  const contextConfigs = selectedOutputs.length > 0 || config.target_path ? listConfigs(undefined, db) : [config];
+  const store = opts.store ?? resolveConfigStore();
+  const contextConfigs = selectedOutputs.length > 0 || config.target_path ? await store.listConfigs() : [config];
   if (isGeneratedOutputTarget(config, contextConfigs)) {
     throw new ConfigApplyError(`Config "${config.name}" targets a generated output path. Apply the canonical source config instead.`);
   }
@@ -2849,7 +3370,7 @@ async function applyConfig(config, opts = {}) {
     };
   }
   if (!opts.dryRun) {
-    updateConfig(config.id, { synced_at: now2() }, db);
+    await store.updateConfig(config.id, { synced_at: new Date().toISOString() });
   }
   return result;
 }
@@ -2871,9 +3392,7 @@ async function applyConfigs(configs, opts = {}) {
 }
 var init_apply = __esm(() => {
   init_types();
-  init_database();
-  init_configs();
-  init_snapshots();
+  init_config_store();
   init_machine();
   init_transforms();
 });
@@ -2961,9 +3480,9 @@ function redactIni(content) {
   for (let i = 0;i < lines.length; i++) {
     const line = lines[i];
     const authM = line.match(/^(\/\/[^:]+:_authToken=)(.+)$/);
-    if (authM && !authM[2].startsWith("{{")) {
-      redacted.push({ varName: "NPM_AUTH_TOKEN", line: i + 1, reason: "npm auth token" });
-      out.push(`${authM[1]}{{NPM_AUTH_TOKEN}}`);
+    if (authM && !isReferenceValue(authM[2].trim())) {
+      redacted.push({ varName: "NPM_TOKEN", line: i + 1, reason: "npm auth token" });
+      out.push(`${authM[1]}\${NPM_TOKEN}`);
       continue;
     }
     const m = line.match(/^(\s*)([a-zA-Z][a-zA-Z0-9_\-]*)(\s*=\s*)(.+?)\s*$/);
@@ -3003,6 +3522,8 @@ function redactGeneric(content) {
 function shouldRedactKeyValue(key, value) {
   if (!value || value.startsWith("{{"))
     return false;
+  if (isReferenceValue(value.trim()))
+    return false;
   if (value.length < MIN_SECRET_VALUE_LEN)
     return false;
   if (/^(true|false|yes|no|on|off|null|undefined|\d+)$/i.test(value))
@@ -3024,6 +3545,9 @@ function reasonFor(key, value) {
   }
   return "secret value pattern";
 }
+function isReferenceValue(value) {
+  return /^\{\{[A-Z][A-Z0-9_]*\}\}$/.test(value) || /^\$\{[A-Z][A-Z0-9_]*\}$/.test(value) || /^\$[A-Z][A-Z0-9_]*$/.test(value) || /^%[A-Z][A-Z0-9_]*%$/.test(value);
+}
 function redactContent(content, format) {
   switch (format) {
     case "shell":
@@ -3065,14 +3589,14 @@ function shouldSkip(p) {
   return SKIP.some((s) => p.includes(s));
 }
 async function syncFromDir(dir, opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const absDir = expandPath(dir);
   if (!existsSync5(absDir))
     return { added: 0, updated: 0, unchanged: 0, skipped: [`Not found: ${absDir}`] };
   const files = opts.recursive !== false ? walkDir(absDir) : readdirSync(absDir).map((f) => join4(absDir, f)).filter((f) => statSync2(f).isFile());
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
   const home = homedir4();
-  const allConfigs = listConfigs(undefined, d);
+  const allConfigs = await store.listConfigs();
   for (const file of files) {
     if (shouldSkip(file)) {
       result.skipped.push(file);
@@ -3088,11 +3612,11 @@ async function syncFromDir(dir, opts = {}) {
       const existing = allConfigs.find((c) => c.target_path === targetPath);
       if (!existing) {
         if (!opts.dryRun)
-          createConfig({ name: relative(absDir, file), category: detectCategory(file), agent: detectAgent(file), target_path: targetPath, format: detectFormat(file), content }, d);
+          await store.createConfig({ name: relative(absDir, file), category: detectCategory(file), agent: detectAgent(file), target_path: targetPath, format: detectFormat(file), content });
         result.added++;
       } else if (existing.content !== content) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { content }, d);
+          await store.updateConfig(existing.id, { content });
         result.updated++;
       } else {
         result.unchanged++;
@@ -3104,17 +3628,17 @@ async function syncFromDir(dir, opts = {}) {
   return result;
 }
 async function syncToDir(dir, opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const home = homedir4();
   const absDir = expandPath(dir);
   const normalized = dir.startsWith("~/") ? dir : absDir.replace(home, "~");
-  const configs = listConfigs(undefined, d).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
+  const configs = (await store.listConfigs()).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
   for (const config of configs) {
     if (config.kind === "reference")
       continue;
     try {
-      const r = await applyConfig(config, { dryRun: opts.dryRun, db: d });
+      const r = await applyConfig(config, { dryRun: opts.dryRun, store });
       r.changed ? result.updated++ : result.unchanged++;
     } catch {
       result.skipped.push(config.target_path || config.id);
@@ -3136,8 +3660,7 @@ function walkDir(dir, files = []) {
 }
 var SKIP;
 var init_sync_dir = __esm(() => {
-  init_database();
-  init_configs();
+  init_config_store();
   init_apply();
   init_sync();
   SKIP = [".db", ".db-shm", ".db-wal", ".log", ".lock", ".DS_Store", "node_modules", ".git"];
@@ -3210,11 +3733,11 @@ function isKnownGeneratedTargetPath(targetPath) {
   return hasClaudeRuleSourceForCursorTarget(targetPath);
 }
 async function syncProject(opts) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const absDir = expandPath(opts.projectDir);
   const projectName = absDir.split("/").pop() || "project";
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
-  const allConfigs = listConfigs(undefined, d);
+  const allConfigs = await store.listConfigs();
   const machine = detectMachineContext();
   for (const pf of PROJECT_CONFIG_FILES) {
     const abs = join5(absDir, pf.file);
@@ -3236,11 +3759,11 @@ async function syncProject(opts) {
       const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === slug);
       if (!existing) {
         if (!opts.dryRun)
-          createConfig({ name, category: pf.category, agent: pf.agent, format: pf.format, content, target_path: targetPath, is_template: isTemplate2 }, d);
+          await store.createConfig({ name, category: pf.category, agent: pf.agent, format: pf.format, content, target_path: targetPath, is_template: isTemplate2 });
         result.added++;
       } else if (existing.content !== content) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { content, is_template: isTemplate2 }, d);
+          await store.updateConfig(existing.id, { content, is_template: isTemplate2 });
         result.updated++;
       } else {
         result.unchanged++;
@@ -3265,11 +3788,11 @@ async function syncProject(opts) {
       const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === slug);
       if (!existing) {
         if (!opts.dryRun)
-          createConfig({ name, category: "rules", agent: "claude", format: "markdown", content, target_path: targetPath, is_template: isTemplate2 }, d);
+          await store.createConfig({ name, category: "rules", agent: "claude", format: "markdown", content, target_path: targetPath, is_template: isTemplate2 });
         result.added++;
       } else if (existing.content !== content) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { content, is_template: isTemplate2 }, d);
+          await store.updateConfig(existing.id, { content, is_template: isTemplate2 });
         result.updated++;
       } else {
         result.unchanged++;
@@ -3279,7 +3802,7 @@ async function syncProject(opts) {
   return result;
 }
 async function syncKnown(opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
   const home = getConfigHome();
   const machine = detectMachineContext();
@@ -3288,7 +3811,7 @@ async function syncKnown(opts = {}) {
     targets = targets.filter((k) => k.agent === opts.agent);
   if (opts.category)
     targets = targets.filter((k) => k.category === opts.category);
-  const allConfigs = listConfigs(undefined, d);
+  const allConfigs = await store.listConfigs();
   const existingOutputOwners = outputOwnerIdsByTarget(allConfigs);
   for (const known of targets) {
     if (known.rulesDir) {
@@ -3317,15 +3840,15 @@ async function syncKnown(opts = {}) {
         const outputs = known.agent === "claude" ? claudeRuleOutputs(f) : known.outputs;
         if (!existing) {
           if (!opts.dryRun)
-            createConfig({ name, category: known.category, agent: known.agent, format: "markdown", content, target_path: targetPath, is_template: isTemplate2, outputs }, d);
+            await store.createConfig({ name, category: known.category, agent: known.agent, format: "markdown", content, target_path: targetPath, is_template: isTemplate2, outputs });
           result.added++;
         } else if (existing.content !== content) {
           if (!opts.dryRun)
-            updateConfig(existing.id, { content, is_template: isTemplate2, outputs }, d);
+            await store.updateConfig(existing.id, { content, is_template: isTemplate2, outputs });
           result.updated++;
         } else if (!outputsEqual(existing.outputs, outputs)) {
           if (!opts.dryRun)
-            updateConfig(existing.id, { outputs }, d);
+            await store.updateConfig(existing.id, { outputs });
           result.updated++;
         } else {
           result.unchanged++;
@@ -3357,7 +3880,7 @@ async function syncKnown(opts = {}) {
       const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === known.name);
       if (!existing) {
         if (!opts.dryRun) {
-          createConfig({
+          await store.createConfig({
             name: known.name,
             category: known.category,
             agent: known.agent,
@@ -3368,16 +3891,16 @@ async function syncKnown(opts = {}) {
             description: known.description,
             is_template: isTemplate2,
             outputs: known.outputs
-          }, d);
+          });
         }
         result.added++;
       } else if (existing.content !== content) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { content, is_template: isTemplate2, outputs: known.outputs }, d);
+          await store.updateConfig(existing.id, { content, is_template: isTemplate2, outputs: known.outputs });
         result.updated++;
       } else if (!outputsEqual(existing.outputs, known.outputs)) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { outputs: known.outputs }, d);
+          await store.updateConfig(existing.id, { outputs: known.outputs });
         result.updated++;
       } else {
         result.unchanged++;
@@ -3389,9 +3912,9 @@ async function syncKnown(opts = {}) {
   return result;
 }
 async function syncToDisk(opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
-  const allFileConfigs = listConfigs({ kind: "file", ...opts.category ? { category: opts.category } : {} }, d);
+  const allFileConfigs = await store.listConfigs({ kind: "file", ...opts.category ? { category: opts.category } : {} });
   const outputOwners = outputOwnerIdsByTarget(allFileConfigs);
   let configs = allFileConfigs.filter((config) => {
     return !isGeneratedOutputTarget2(config, outputOwners);
@@ -3404,7 +3927,7 @@ async function syncToDisk(opts = {}) {
     if (!config.target_path && config.outputs.length === 0)
       continue;
     try {
-      const r = await applyConfig(config, { dryRun: opts.dryRun, db: d, outputAgent: opts.agent });
+      const r = await applyConfig(config, { dryRun: opts.dryRun, store, outputAgent: opts.agent });
       r.changed ? result.updated++ : result.unchanged++;
     } catch {
       result.skipped.push(config.target_path ?? config.id);
@@ -3441,12 +3964,12 @@ function buildDiff(expectedContent, targetPath) {
   return lines.join(`
 `);
 }
-function diffConfig(config, opts = {}) {
+async function diffConfig(config, opts = {}) {
   if (!config.target_path && config.outputs.length === 0)
     return "(reference \u2014 no target path)";
   const diffs = [];
-  const db = opts.db || getDatabase();
-  const contextConfigs = config.outputs.length > 0 || config.target_path ? listConfigs(undefined, db) : [config];
+  const store = opts.store ?? resolveConfigStore();
+  const contextConfigs = config.outputs.length > 0 || config.target_path ? await store.listConfigs() : [config];
   if (isGeneratedOutputTarget2(config, outputOwnerIdsByTarget(contextConfigs))) {
     return "(generated output \u2014 managed by fan-out)";
   }
@@ -3525,8 +4048,7 @@ function detectFormat(filePath) {
 }
 var CLAUDE_PROMPT_OUTPUTS, KNOWN_CONFIGS, PROJECT_CONFIG_FILES;
 var init_sync = __esm(() => {
-  init_database();
-  init_configs();
+  init_config_store();
   init_apply();
   init_redact();
   init_machine();
@@ -3581,100 +4103,439 @@ var init_sync = __esm(() => {
   ];
 });
 
-// node_modules/.pnpm/@hasna+events@0.1.13/node_modules/@hasna/events/dist/commander.js
-import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
-import { existsSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-import { createHmac, timingSafeEqual } from "crypto";
-import { randomUUID } from "crypto";
-import { spawn } from "child_process";
-import { randomUUID as randomUUID2 } from "crypto";
-function getPathValue(input, path) {
-  return path.split(".").reduce((value, part) => {
-    if (value && typeof value === "object" && part in value) {
-      return value[part];
+// src/lib/package-manager-guard.ts
+var exports_package_manager_guard = {};
+__export(exports_package_manager_guard, {
+  scanPackageManagerSecrets: () => scanPackageManagerSecrets
+});
+import { execFileSync } from "child_process";
+import { existsSync as existsSync12, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "fs";
+import { homedir as homedir6 } from "os";
+import { basename as basename5, dirname as dirname4, isAbsolute as isAbsolute3, join as join10, relative as relative4, resolve as resolve6 } from "path";
+function scanPackageManagerSecrets(options = {}) {
+  const cwd = options.cwd ? resolve6(options.cwd) : process.cwd();
+  const roots = (options.roots && options.roots.length > 0 ? options.roots : [cwd]).map((root) => resolve6(cwd, root));
+  const findings = [];
+  let scannedFiles = 0;
+  for (const root of roots) {
+    if (!existsSync12(root))
+      continue;
+    const stat = lstatSync2(root);
+    if (stat.isFile()) {
+      if (!shouldScanRepoFile(root))
+        continue;
+      const text = readTextFile(root);
+      if (text === null)
+        continue;
+      scannedFiles++;
+      findings.push(...scanFile(root, text, classifyRepoFile(root), isTrackedFile(root), dirname4(root)));
+      continue;
     }
-    return;
-  }, input);
-}
-function getFieldValues(input, path) {
-  const values = [];
-  const push = (value) => {
-    if (!values.some((item) => Object.is(item, value)))
-      values.push(value);
+    if (!stat.isDirectory())
+      continue;
+    const tracked = trackedFiles(root);
+    for (const file of collectRepoFiles(root)) {
+      const rel = toPosix(relative4(root, file));
+      const isTracked = tracked.has(rel);
+      const text = readTextFile(file);
+      if (text === null)
+        continue;
+      scannedFiles++;
+      findings.push(...scanFile(file, text, classifyRepoFile(file), isTracked, root));
+    }
+  }
+  if (options.includeHome) {
+    const home = homedir6();
+    for (const name of HOME_FILES) {
+      const file = join10(home, name);
+      if (!existsSync12(file))
+        continue;
+      const text = readTextFile(file);
+      if (text === null)
+        continue;
+      scannedFiles++;
+      findings.push(...scanFile(file, text, classifyHomeFile(name), false, home));
+    }
+  }
+  findings.sort((a, b) => a.path.localeCompare(b.path) || a.line - b.line || a.rule.localeCompare(b.rule));
+  return {
+    clean: findings.length === 0,
+    scannedFiles,
+    scannedRoots: roots,
+    findings
   };
-  if (path.includes(".") && path in input)
-    push(input[path]);
-  const nestedValue = getPathValue(input, path);
-  if (nestedValue !== undefined || !path.includes("."))
-    push(nestedValue);
-  return values;
-}
-function wildcardToRegExp(pattern, options = {}) {
-  let body = "";
-  for (let index = 0;index < pattern.length; index += 1) {
-    const char = pattern[index];
-    if (char === "*") {
-      if (pattern[index + 1] === "*") {
-        body += ".*";
-        index += 1;
-      } else {
-        body += options.segmentSafe ? "[^/]*" : ".*";
+}
+function collectRepoFiles(root) {
+  const out = [];
+  const visit = (dir) => {
+    for (const entry of readdirSync3(dir, { withFileTypes: true })) {
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS.has(entry.name))
+          continue;
+        visit(join10(dir, entry.name));
+        continue;
       }
+      if (!entry.isFile())
+        continue;
+      const file = join10(dir, entry.name);
+      if (shouldScanRepoFile(file))
+        out.push(file);
+    }
+  };
+  visit(root);
+  return out;
+}
+function shouldScanRepoFile(file) {
+  const name = basename5(file);
+  return isNpmrcName(name) || isBunConfigName(name) || LOCKFILE_NAMES.has(name);
+}
+function classifyRepoFile(file) {
+  const name = basename5(file);
+  if (isNpmrcName(name))
+    return "repo-npmrc";
+  if (isBunConfigName(name))
+    return "bun-config";
+  return "lockfile";
+}
+function classifyHomeFile(name) {
+  if (name === ".npmrc")
+    return "home-npmrc";
+  if (isBunConfigName(name))
+    return "bun-config";
+  return "shell-profile";
+}
+function isBunConfigName(name) {
+  return name === "bunfig.toml" || name === ".bunfig.toml";
+}
+function isNpmrcName(name) {
+  return name === ".npmrc" || name.startsWith(".npmrc.") || name.endsWith(".npmrc");
+}
+function readTextFile(file) {
+  try {
+    const stat = lstatSync2(file);
+    if (!stat.isFile() || stat.size > 5000000)
+      return null;
+    const buf = readFileSync8(file);
+    if (buf.includes(0))
+      return null;
+    return buf.toString("utf-8");
+  } catch {
+    return null;
+  }
+}
+function scanFile(file, text, surface, tracked, root) {
+  const findings = [];
+  const path = displayPath(file, root);
+  if (surface === "bun-config")
+    return scanBunConfigFile(text, path, tracked);
+  const lines = text.split(/\r?\n/);
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const lineNo = i + 1;
+    if (surface === "repo-npmrc" || surface === "home-npmrc") {
+      findings.push(...scanNpmrcLine(line, path, lineNo, surface, tracked));
+    } else if (surface === "shell-profile") {
+      findings.push(...scanShellProfileLine(line, path, lineNo, tracked));
     } else {
-      body += char.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+      findings.push(...scanLockfileLine(line, path, lineNo, tracked));
+    }
+  }
+  return findings;
+}
+function scanNpmrcLine(lineText, path, line, surface, tracked) {
+  const findings = [];
+  const stripped = lineText.trim();
+  if (stripped === "" || stripped.startsWith("#") || stripped.startsWith(";"))
+    return findings;
+  const auth = stripped.match(/(?:^|:)(_[A-Za-z]*(?:auth|password)[A-Za-z]*|password)\s*=\s*(.+)$/i);
+  if (auth) {
+    const value = stripQuotes(stripInlineComment(auth[2].trim()));
+    if (value && !isSafeReference(value)) {
+      findings.push({
+        path,
+        line,
+        rule: "npmrc-literal-auth",
+        surface,
+        severity: "error",
+        tracked,
+        detail: tracked ? "tracked npm auth entry uses a literal value" : "npm auth entry uses a literal value"
+      });
+    }
+  }
+  findings.push(...scanCredentialedUrl(stripped, path, line, surface, tracked));
+  findings.push(...scanKnownTokenPatterns(stripped, path, line, surface, tracked));
+  return findings;
+}
+function scanBunConfigFile(text, path, tracked) {
+  const findings = [];
+  const lines = text.split(/\r?\n/);
+  let inReleaseAgeExcludes = false;
+  let hasMinimumReleaseAge = false;
+  for (let i = 0;i < lines.length; i++) {
+    const lineText = lines[i];
+    const line = i + 1;
+    const stripped = lineText.trim();
+    if (stripped === "" || stripped.startsWith("#"))
+      continue;
+    const releaseAge = stripped.match(/^minimumReleaseAge\s*=\s*(?:"([^"]+)"|'([^']+)'|([0-9]+))\s*(?:#.*)?$/i);
+    if (releaseAge) {
+      hasMinimumReleaseAge = true;
+      const rawValue = releaseAge[1] ?? releaseAge[2] ?? releaseAge[3] ?? "";
+      const value = Number(rawValue);
+      if (!Number.isFinite(value) || value <= 0) {
+        findings.push({
+          path,
+          line,
+          rule: "bun-release-age-disabled",
+          surface: "bun-config",
+          severity: "error",
+          tracked,
+          detail: "Bun release-age quarantine is disabled"
+        });
+      }
+    }
+    const startsReleaseAgeExcludes = /minimumReleaseAgeExcludes/i.test(stripped);
+    const scanExcludes = startsReleaseAgeExcludes || inReleaseAgeExcludes;
+    if (scanExcludes) {
+      const quoted = [...stripped.matchAll(/["']([^"']+)["']/g)].map((m) => m[1]);
+      for (const item of quoted) {
+        if (!isExactHasnaPackageName(item)) {
+          findings.push({
+            path,
+            line,
+            rule: "bun-release-age-broad-exclude",
+            surface: "bun-config",
+            severity: "error",
+            tracked,
+            detail: "Bun release-age exclude must be an exact @hasna package name"
+          });
+        }
+      }
+    }
+    inReleaseAgeExcludes = startsReleaseAgeExcludes ? stripped.includes("[") && !stripped.includes("]") : inReleaseAgeExcludes && !stripped.includes("]");
+    findings.push(...scanKnownTokenPatterns(stripped, path, line, "bun-config", tracked));
+  }
+  if (!hasMinimumReleaseAge) {
+    findings.push({
+      path,
+      line: 1,
+      rule: "bun-release-age-missing",
+      surface: "bun-config",
+      severity: "error",
+      tracked,
+      detail: "Bun release-age quarantine must be configured with a positive minimumReleaseAge"
+    });
+  }
+  return findings;
+}
+function scanShellProfileLine(lineText, path, line, tracked) {
+  const findings = [];
+  const stripped = lineText.trim();
+  if (stripped === "" || stripped.startsWith("#"))
+    return findings;
+  const assignment = stripped.match(/^(?:export\s+)?(NPM(?:_CONFIG)?_[A-Z0-9_]*TOKEN|NODE_AUTH_TOKEN|NPM_TOKEN)\s*=\s*(.+)$/);
+  if (assignment) {
+    const value = stripQuotes(stripInlineComment(assignment[2].trim()));
+    if (value && !isSafeReference(value)) {
+      findings.push({
+        path,
+        line,
+        rule: "shell-literal-package-token",
+        surface: "shell-profile",
+        severity: "error",
+        tracked,
+        detail: "shell profile package-manager token uses a literal value"
+      });
+    }
+  }
+  findings.push(...scanKnownTokenPatterns(stripped, path, line, "shell-profile", tracked));
+  return findings;
+}
+function scanLockfileLine(lineText, path, line, tracked) {
+  const findings = scanKnownTokenPatterns(lineText, path, line, "lockfile", tracked);
+  if (/(?:^|:)_authToken\s*=\s*/i.test(lineText) && !/\$\{[A-Z0-9_]+\}|\{\{[A-Z0-9_]+\}\}/.test(lineText)) {
+    findings.push({
+      path,
+      line,
+      rule: "lockfile-auth-token",
+      surface: "lockfile",
+      severity: "error",
+      tracked,
+      detail: "lockfile contains package-manager auth token material"
+    });
+  }
+  return findings;
+}
+function scanKnownTokenPatterns(lineText, path, line, surface, tracked) {
+  const findings = [];
+  for (const pattern of TOKEN_VALUE_PATTERNS) {
+    if (pattern.re.test(lineText)) {
+      findings.push({
+        path,
+        line,
+        rule: pattern.rule,
+        surface,
+        severity: "error",
+        tracked,
+        detail: pattern.detail
+      });
+    }
+  }
+  return findings;
+}
+function scanCredentialedUrl(lineText, path, line, surface, tracked) {
+  const findings = [];
+  for (const match of lineText.matchAll(/\bhttps?:\/\/([^/\s#;]+)@/gi)) {
+    const userInfo = match[1];
+    const credentialPart = userInfo.includes(":") ? userInfo.split(":").slice(1).join(":") : userInfo;
+    if (credentialPart && !isSafeReference(credentialPart)) {
+      findings.push({
+        path,
+        line,
+        rule: "package-manager-url-credentials",
+        surface,
+        severity: "error",
+        tracked,
+        detail: "package-manager URL embeds literal credentials"
+      });
     }
   }
-  return new RegExp(`^${body}$`);
+  return findings;
 }
-function matchString(value, matcher, options = {}) {
+function trackedFiles(root) {
+  try {
+    const output = execFileSync("git", ["-C", root, "ls-files", "-z"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return new Set(output.split("\x00").filter(Boolean).map(toPosix));
+  } catch {
+    return new Set;
+  }
+}
+function isTrackedFile(file) {
+  try {
+    const repoRoot = execFileSync("git", ["-C", dirname4(file), "rev-parse", "--show-toplevel"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const rel = toPosix(relative4(repoRoot, file));
+    execFileSync("git", ["-C", repoRoot, "ls-files", "--error-unmatch", "--", rel], {
+      stdio: ["ignore", "ignore", "ignore"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isExactHasnaPackageName(item) {
+  return /^@hasna\/[a-z0-9][a-z0-9._-]*$/.test(item);
+}
+function isSafeReference(value) {
+  const trimmed = stripQuotes(value.trim());
+  return /^\$\{[A-Z][A-Z0-9_]*\}$/.test(trimmed) || /^\$[A-Z][A-Z0-9_]*$/.test(trimmed) || /^\{\{[A-Z][A-Z0-9_]*\}\}$/.test(trimmed) || /^%[A-Z][A-Z0-9_]*%$/.test(trimmed);
+}
+function stripQuotes(value) {
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+function stripInlineComment(value) {
+  return value.replace(/\s[#;].*$/, "").trim();
+}
+function displayPath(file, root) {
+  const home = homedir6();
+  if (root === home && (file === home || file.startsWith(home + "/")))
+    return "~/" + toPosix(relative4(home, file));
+  if (isAbsolute3(root) && file.startsWith(root + "/"))
+    return toPosix(relative4(root, file));
+  if (file === home || file.startsWith(home + "/"))
+    return "~/" + toPosix(relative4(home, file));
+  return file;
+}
+function toPosix(path) {
+  return path.split("\\").join("/");
+}
+var SKIP_DIRS, LOCKFILE_NAMES, HOME_FILES, TOKEN_VALUE_PATTERNS;
+var init_package_manager_guard = __esm(() => {
+  SKIP_DIRS = new Set([
+    ".git",
+    "node_modules",
+    "dist",
+    "build",
+    "coverage",
+    ".next",
+    ".turbo",
+    ".cache"
+  ]);
+  LOCKFILE_NAMES = new Set([
+    "bun.lock",
+    "package-lock.json",
+    "npm-shrinkwrap.json",
+    "pnpm-lock.yaml",
+    "yarn.lock"
+  ]);
+  HOME_FILES = [
+    ".npmrc",
+    ".bunfig.toml",
+    "bunfig.toml",
+    ".bashrc",
+    ".bash_profile",
+    ".zshrc",
+    ".zprofile",
+    ".profile"
+  ];
+  TOKEN_VALUE_PATTERNS = [
+    { re: /npm_[A-Za-z0-9]{36,}/, rule: "literal-npm-token", detail: "literal npm token-like value" },
+    { re: /gh[pousr]_[A-Za-z0-9_]{36,}/, rule: "literal-github-token", detail: "literal GitHub token-like value" },
+    { re: /sk-ant-[A-Za-z0-9\-_]{40,}/, rule: "literal-anthropic-key", detail: "literal Anthropic key-like value" },
+    { re: /sk-[A-Za-z0-9]{48,}/, rule: "literal-openai-key", detail: "literal OpenAI key-like value" },
+    { re: /AKIA[0-9A-Z]{16}/, rule: "literal-aws-access-key", detail: "literal AWS access-key-like value" },
+    { re: /xoxb-[0-9]+-[A-Za-z0-9-]+/, rule: "literal-slack-token", detail: "literal Slack token-like value" }
+  ];
+});
+
+// node_modules/@hasna/events/dist/commander.js
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { createHmac, timingSafeEqual } from "crypto";
+import { randomUUID } from "crypto";
+import { spawn } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+function getPathValue(input, path) {
+  return path.split(".").reduce((value, part) => {
+    if (value && typeof value === "object" && part in value) {
+      return value[part];
+    }
+    return;
+  }, input);
+}
+function wildcardToRegExp(pattern) {
+  const escaped = pattern.replace(/[|\\{}()[\]^$+?.]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+function matchString(value, matcher) {
   if (matcher === undefined)
     return true;
   if (value === undefined)
     return false;
   const matchers = Array.isArray(matcher) ? matcher : [matcher];
-  return matchers.some((item) => wildcardToRegExp(item, options).test(value));
+  return matchers.some((item) => wildcardToRegExp(item).test(value));
 }
 function matchRecord(input, matcher) {
   if (!matcher)
     return true;
   return Object.entries(matcher).every(([path, expected]) => {
-    const actualValues = getFieldValues(input, path);
-    return matchField(actualValues, expected, path);
+    const actual = getPathValue(input, path);
+    if (typeof expected === "string" || Array.isArray(expected)) {
+      return matchString(actual === undefined ? undefined : String(actual), expected);
+    }
+    return actual === expected;
   });
 }
-function matchField(actualValues, expected, path) {
-  if (isNegativeMatcher(expected)) {
-    return !actualValues.some((actual) => matchPositiveField(actual, expected.not, path));
-  }
-  return actualValues.some((actual) => matchPositiveField(actual, expected, path));
-}
-function matchPositiveField(actual, expected, path) {
-  if (typeof expected === "string" || Array.isArray(expected)) {
-    return stringCandidates(actual).some((candidate) => matchString(candidate, expected, {
-      segmentSafe: path.endsWith("_path") || path.endsWith(".path")
-    }));
-  }
-  if (Array.isArray(actual)) {
-    return actual.some((item) => item === expected);
-  }
-  return actual === expected;
-}
-function stringCandidates(actual) {
-  if (actual === undefined)
-    return [];
-  if (Array.isArray(actual)) {
-    return actual.flatMap((item) => isPrimitiveFieldValue(item) ? [String(item)] : []);
-  }
-  return [String(actual)];
-}
-function isPrimitiveFieldValue(value) {
-  return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
-}
-function isNegativeMatcher(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value) && "not" in value);
-}
 function eventMatchesFilter(event, filter) {
   return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
 }
@@ -3690,14 +4551,6 @@ var HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME";
 function getEventsDataDir(override) {
   return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join(homedir(), ".hasna", "events");
 }
-function getActiveEventsDirEnv() {
-  if (process.env[HASNA_EVENTS_DIR_ENV])
-    return HASNA_EVENTS_DIR_ENV;
-  if (process.env[HASNA_EVENTS_HOME_ENV])
-    return HASNA_EVENTS_HOME_ENV;
-  return null;
-}
-
 class JsonEventsStore {
   dataDir;
   channelsPath;
@@ -3809,52 +4662,6 @@ class JsonEventsStore {
     });
   }
 }
-async function getEventsStatus(dataDir) {
-  const store = new JsonEventsStore(dataDir);
-  await store.init();
-  const [channels, events, deliveries] = await Promise.all([
-    store.listChannels(),
-    store.listEvents(),
-    store.listDeliveries()
-  ]);
-  const transports = channels.reduce((counts, channel) => {
-    counts[channel.transport] = (counts[channel.transport] ?? 0) + 1;
-    return counts;
-  }, {});
-  return {
-    service: "events",
-    schemaVersion: "1.0",
-    dataDir: store.dataDir,
-    env: {
-      primary: HASNA_EVENTS_DIR_ENV,
-      fallback: HASNA_EVENTS_HOME_ENV,
-      active: getActiveEventsDirEnv()
-    },
-    files: {
-      channels: statusFile(store.dataDir, "channels.json", channels.length),
-      events: statusFile(store.dataDir, "events.json", events.length),
-      deliveries: statusFile(store.dataDir, "deliveries.json", deliveries.length)
-    },
-    counts: {
-      channels: channels.length,
-      enabledChannels: channels.filter((channel) => channel.enabled).length,
-      disabledChannels: channels.filter((channel) => !channel.enabled).length,
-      events: events.length,
-      deliveries: deliveries.length
-    },
-    transports,
-    safety: {
-      includesEventPayloads: false,
-      includesWebhookSecrets: false,
-      listOutputsRedactSecrets: true,
-      statusOutputIsMetadataOnly: true
-    }
-  };
-}
-function statusFile(dataDir, fileName, records) {
-  const path = join(dataDir, fileName);
-  return { path, exists: existsSync(path), records };
-}
 var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
 function buildSignatureBase(timestamp, body) {
   return `${timestamp}.${body}`;
@@ -4080,7 +4887,7 @@ class EventsClient {
     }
     return deliveries;
   }
-  async matchChannel(id, input = {}) {
+  async testChannel(id, input = {}) {
     const channel = await this.store.getChannel(id);
     if (!channel)
       throw new Error(`Channel not found: ${id}`);
@@ -4097,34 +4904,6 @@ class EventsClient {
       time: input.time,
       id: input.id
     });
-    const matched = channelMatchesEvent(channel, event);
-    return {
-      channelId: channel.id,
-      matched,
-      event,
-      filters: channel.filters,
-      reason: matched ? undefined : channel.enabled ? "event did not match channel filters" : "channel is disabled"
-    };
-  }
-  async testChannel(id, input = {}, options = {}) {
-    const channel = await this.store.getChannel(id);
-    if (!channel)
-      throw new Error(`Channel not found: ${id}`);
-    const match = await this.matchChannel(id, input);
-    const event = match.event;
-    if (options.honorFilters && !match.matched) {
-      const timestamp = new Date().toISOString();
-      const result2 = createDeliveryResult(event, channel, [{
-        attempt: 1,
-        status: "skipped",
-        startedAt: timestamp,
-        completedAt: timestamp,
-        error: match.reason
-      }]);
-      result2.metadata = { reason: "filter_mismatch" };
-      await this.store.appendDelivery(result2);
-      return result2;
-    }
     const eventForChannel = await this.applyRedaction(event, channel);
     const result = await this.deliverWithRetry(eventForChannel, channel);
     await this.store.appendDelivery(result);
@@ -4235,76 +5014,6 @@ function normalizeRetryPolicy(policy) {
     multiplier: Math.max(1, policy?.multiplier ?? 2)
   };
 }
-function parseFieldMatchers(values, label, typed = false) {
-  if (!values?.length)
-    return;
-  const result = {};
-  for (const value of values) {
-    const parsed = parseMatcherExpression(value, label);
-    const path = parsed.path;
-    if (path in result)
-      throw new Error(`Duplicate ${label} filter path: ${path}`);
-    const matcherValue = typed ? parseTypedMatcherValue(parsed.rawValue, label) : parsed.rawValue;
-    result[path] = parsed.negated ? { not: matcherValue } : matcherValue;
-  }
-  return result;
-}
-function parseFilterOptions(options) {
-  const filter2 = {};
-  if (options.source)
-    filter2.source = options.source;
-  if (options.type)
-    filter2.type = options.type;
-  if (options.subject)
-    filter2.subject = options.subject;
-  if (options.severity)
-    filter2.severity = options.severity;
-  const data = mergeMatchers(parseFieldMatchers(options.data, "data"), parseFieldMatchers(options.dataJson, "data-json", true));
-  const metadata = mergeMatchers(parseFieldMatchers(options.metadata, "metadata"), parseFieldMatchers(options.metadataJson, "metadata-json", true));
-  if (Object.keys(data).length > 0)
-    filter2.data = data;
-  if (Object.keys(metadata).length > 0)
-    filter2.metadata = metadata;
-  return Object.keys(filter2).length > 0 ? [filter2] : undefined;
-}
-function mergeMatchers(...records) {
-  const result = {};
-  for (const record of records) {
-    if (!record)
-      continue;
-    for (const [path, value] of Object.entries(record)) {
-      if (path in result)
-        throw new Error(`Duplicate filter path: ${path}`);
-      result[path] = value;
-    }
-  }
-  return result;
-}
-function parseTypedMatcherValue(value, label) {
-  const parsed = JSON.parse(value);
-  if (parsed === null || typeof parsed === "string" || typeof parsed === "number" || typeof parsed === "boolean" || Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) {
-    return parsed;
-  }
-  throw new Error(`${label} filter JSON values must be string, string[], number, boolean, or null`);
-}
-function parseMatcherExpression(value, label) {
-  const negativeSeparator = value.indexOf("!=");
-  if (negativeSeparator > 0) {
-    return {
-      path: value.slice(0, negativeSeparator),
-      rawValue: value.slice(negativeSeparator + 2),
-      negated: true
-    };
-  }
-  const separator = value.indexOf("=");
-  if (separator <= 0)
-    throw new Error(`Invalid ${label} filter, expected path=value or path!=value: ${value}`);
-  return {
-    path: value.slice(0, separator),
-    rawValue: value.slice(separator + 1),
-    negated: false
-  };
-}
 function parseJsonObject(value, fallback) {
   if (!value)
     return fallback;
@@ -4326,6 +5035,18 @@ function parseHeaders(values) {
   }
   return headers;
 }
+function parseFilter(options) {
+  const filter2 = {};
+  if (options.source)
+    filter2.source = options.source;
+  if (options.type)
+    filter2.type = options.type;
+  if (options.subject)
+    filter2.subject = options.subject;
+  if (options.severity)
+    filter2.severity = options.severity;
+  return Object.keys(filter2).length > 0 ? [filter2] : undefined;
+}
 function createClient(options) {
   if (options.createClient)
     return options.createClient();
@@ -4343,16 +5064,16 @@ function hasJsonOption(options) {
 function wantsJson(actionOptions, command) {
   return hasJsonOption(actionOptions) || hasJsonOption(command);
 }
-function registerChannelCommands(program, options) {
-  const channels = program.command(options.channelsCommandName ?? "channels").description("Manage Hasna event channels");
-  channels.command("add").description("Add or replace a channel").argument("<target>", "Webhook URL or command binary").requiredOption("--id <id>", "Channel identifier").option("--transport <kind>", "Transport kind: webhook or command", "webhook").option("--name <name>", "Display name").option("--type <pattern>", "Event type filter, e.g. todos.task.*").option("--source <pattern>", "Event source filter").option("--subject <pattern>", "Event subject filter").option("--severity <pattern>", "Event severity filter").option("--data <path=value...>", "Event data field filter; string values, path!=value negatives, array-member matching, dot paths, * segment wildcard, ** recursive wildcard", collectValues, []).option("--metadata <path=value...>", "Event metadata field filter; string values, path!=value negatives, array-member matching, dot paths, * segment wildcard, ** recursive wildcard", collectValues, []).option("--data-json <path=json...>", "Event data field filter with typed JSON value; path!=json negatives supported", collectValues, []).option("--metadata-json <path=json...>", "Event metadata field filter with typed JSON value; path!=json negatives supported", collectValues, []).option("--secret <secret>", "Webhook HMAC secret").option("--header <name=value...>", "Webhook header", collectValues, []).option("--arg <arg...>", "Command argument", collectValues, []).option("--timeout-ms <ms>", "Transport timeout in milliseconds", parseNumber).option("--retry-attempts <n>", "Maximum delivery attempts", parseNumber).option("--retry-backoff-ms <ms>", "Initial retry backoff in milliseconds", parseNumber).option("--redact <path...>", "Event field path to redact before delivery", collectValues, []).option("--disabled", "Create channel disabled", false).option("-j, --json", "Print JSON output", false).action(async (target, actionOptions, command) => {
+function registerWebhookCommands(program, options) {
+  const webhooks = program.command(options.webhooksCommandName ?? "webhooks").description("Manage Hasna event webhook subscriptions");
+  webhooks.command("add").description("Add or replace a webhook or command subscription").argument("<target>", "Webhook URL or command binary").requiredOption("--id <id>", "Subscription/channel identifier").option("--transport <kind>", "Transport kind: webhook or command", "webhook").option("--name <name>", "Display name").option("--type <pattern>", "Event type filter, e.g. todos.task.*").option("--source <pattern>", "Event source filter").option("--subject <pattern>", "Event subject filter").option("--severity <pattern>", "Event severity filter").option("--secret <secret>", "Webhook HMAC secret").option("--header <name=value...>", "Webhook header", collectValues, []).option("--arg <arg...>", "Command argument", collectValues, []).option("--timeout-ms <ms>", "Transport timeout in milliseconds", parseNumber).option("--retry-attempts <n>", "Maximum delivery attempts", parseNumber).option("--retry-backoff-ms <ms>", "Initial retry backoff in milliseconds", parseNumber).option("--redact <path...>", "Event field path to redact before delivery", collectValues, []).option("--disabled", "Create channel disabled", false).option("-j, --json", "Print JSON output", false).action(async (target, actionOptions, command) => {
     const timestamp = new Date().toISOString();
     const channel = {
       id: actionOptions.id,
       name: actionOptions.name,
       enabled: !actionOptions.disabled,
       transport: actionOptions.transport,
-      filters: parseFilterOptions(actionOptions),
+      filters: parseFilter(actionOptions),
       retry: actionOptions.retryAttempts || actionOptions.retryBackoffMs ? { maxAttempts: actionOptions.retryAttempts, backoffMs: actionOptions.retryBackoffMs } : undefined,
       redact: actionOptions.redact?.length ? { paths: actionOptions.redact } : undefined,
       createdAt: timestamp,
@@ -4368,51 +5089,35 @@ function registerChannelCommands(program, options) {
     const saved = await createClient(options).addChannel(channel);
     print(sanitizeChannelForOutput(saved), wantsJson(actionOptions, command), `Added ${saved.transport} channel ${saved.id}`);
   });
-  channels.command("list").description("List configured channels").option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
-    const channels2 = await createClient(options).listChannels();
+  webhooks.command("list").description("List configured subscriptions").option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+    const channels = await createClient(options).listChannels();
     if (wantsJson(actionOptions, command)) {
-      console.log(JSON.stringify(sanitizeChannelsForOutput(channels2), null, 2));
+      console.log(JSON.stringify(sanitizeChannelsForOutput(channels), null, 2));
       return;
     }
-    if (!channels2.length) {
+    if (!channels.length) {
       console.log("No channels configured.");
       return;
     }
-    for (const channel of channels2) {
+    for (const channel of channels) {
       console.log(`${channel.id}	${channel.enabled ? "enabled" : "disabled"}	${channel.transport}	${channel.webhook?.url ?? channel.command?.command ?? channel.transport}`);
     }
   });
-  channels.command("status").description("Show events channel storage status").option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
-    const status = await getEventsStatus(options.dataDir);
-    print(status, wantsJson(actionOptions, command), `events dataDir: ${status.dataDir}`);
-  });
-  channels.command("remove").description("Remove a channel").argument("<id>", "Channel identifier").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
+  webhooks.command("remove").description("Remove a subscription").argument("<id>", "Subscription/channel identifier").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
     const removed = await createClient(options).removeChannel(id);
     print({ removed }, wantsJson(actionOptions, command), removed ? `Removed ${id}` : `Channel not found: ${id}`);
   });
-  channels.command("test").description("Send a test event to one channel").argument("<id>", "Channel identifier").option("--source <source>", "Event source override").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events test delivery").option("--data <json>", "Event data JSON object").option("--metadata <json>", "Event metadata JSON object").option("--honor-filters", "Skip delivery when the sample event does not match channel filters", false).option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
+  webhooks.command("test").description("Send a test event to one subscription").argument("<id>", "Subscription/channel identifier").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events test delivery").option("--data <json>", "Event data JSON object").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
     const result = await createClient(options).testChannel(id, {
-      source: actionOptions.source ?? options.source,
-      type: actionOptions.type,
-      subject: actionOptions.subject ?? id,
-      message: actionOptions.message,
-      data: parseJsonObject(actionOptions.data, { test: true }),
-      metadata: parseJsonObject(actionOptions.metadata, {})
-    }, { honorFilters: actionOptions.honorFilters });
-    print(result, wantsJson(actionOptions, command), `${result.status}: ${result.channelId}`);
-  });
-  channels.command("match").description("Check whether a sample event matches one channel without delivering").argument("<id>", "Channel identifier").option("--source <source>", "Event source override").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events match preview").option("--data <json>", "Event data JSON object").option("--metadata <json>", "Event metadata JSON object").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
-    const result = await createClient(options).matchChannel(id, {
-      source: actionOptions.source ?? options.source,
+      source: options.source,
       type: actionOptions.type,
       subject: actionOptions.subject ?? id,
       message: actionOptions.message,
-      data: parseJsonObject(actionOptions.data, { test: true }),
-      metadata: parseJsonObject(actionOptions.metadata, {})
+      data: parseJsonObject(actionOptions.data, { test: true })
     });
-    print(result, wantsJson(actionOptions, command), `${result.matched ? "matched" : "skipped"}: ${result.channelId}`);
+    print(result, wantsJson(actionOptions, command), `${result.status}: ${result.channelId}`);
   });
-  return channels;
+  return webhooks;
 }
 function registerEventCommands(program, options) {
   const events = program.command(options.eventsCommandName ?? "events").description("Emit, list, and replay Hasna events");
@@ -4434,212 +5139,79 @@ function registerEventCommands(program, options) {
     if (actionOptions.source)
       rows = rows.filter((event) => event.source === actionOptions.source);
     if (actionOptions.type)
-      rows = rows.filter((event) => event.type === actionOptions.type);
-    if (actionOptions.limit)
-      rows = rows.slice(-actionOptions.limit);
-    if (wantsJson(actionOptions, command)) {
-      console.log(JSON.stringify(rows, null, 2));
-      return;
-    }
-    if (!rows.length) {
-      console.log("No events recorded.");
-      return;
-    }
-    for (const event of rows)
-      console.log(`${event.time}	${event.id}	${event.source}	${event.type}	${event.severity}`);
-  });
-  events.command("replay").description("Replay recorded events").option("--id <id>", "Replay one event id").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--dry-run", "Preview without delivery", false).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
-    const result = await createClient(options).replay({
-      eventId: actionOptions.id,
-      source: actionOptions.source,
-      type: actionOptions.type,
-      dryRun: actionOptions.dryRun
-    });
-    print(result, wantsJson(actionOptions, command), `Replayed ${result.events.length} event(s), ${result.deliveries.length} delivery result(s)`);
-  });
-  return events;
-}
-function registerEventsCommands(program, options) {
-  registerChannelCommands(program, options);
-  registerEventCommands(program, options);
-}
-function parseNumber(value) {
-  const parsed = Number(value);
-  if (!Number.isFinite(parsed))
-    throw new Error(`Expected a number, got ${value}`);
-  return parsed;
-}
-function collectValues(value, previous) {
-  previous.push(value);
-  return previous;
-}
-
-// node_modules/.pnpm/commander@13.1.0/node_modules/commander/esm.mjs
-var import__ = __toESM(require_commander(), 1);
-var {
-  program,
-  createCommand,
-  createArgument,
-  createOption,
-  CommanderError,
-  InvalidArgumentError,
-  InvalidOptionArgumentError,
-  Command,
-  Argument,
-  Option,
-  Help
-} = import__.default;
-
-// src/cli/index.tsx
-init_configs();
-import chalk from "chalk";
-import { existsSync as existsSync12, readFileSync as readFileSync8 } from "fs";
-import { homedir as homedir6 } from "os";
-import { basename as basename5, join as join10, resolve as resolve6 } from "path";
-
-// src/db/profiles.ts
-init_types();
-init_database();
-init_configs();
-init_machine();
-function rowToProfile(row) {
-  return {
-    ...row,
-    selectors: JSON.parse(row.selectors || "{}"),
-    variables: JSON.parse(row.variables || "{}")
-  };
-}
-function uniqueProfileSlug(name, db, excludeId) {
-  const base = slugify(name);
-  let slug = base;
-  let i = 1;
-  while (true) {
-    const existing = db.query("SELECT id FROM profiles WHERE slug = ?").get(slug);
-    if (!existing || existing.id === excludeId)
-      return slug;
-    slug = `${base}-${i++}`;
-  }
-}
-function createProfile(input, db) {
-  const d = db || getDatabase();
-  const id = uuid();
-  const ts = now2();
-  const slug = uniqueProfileSlug(input.name, d);
-  d.run("INSERT INTO profiles (id, name, slug, description, selectors, variables, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)", [
-    id,
-    input.name,
-    slug,
-    input.description ?? null,
-    JSON.stringify(input.selectors ?? {}),
-    JSON.stringify(input.variables ?? {}),
-    ts,
-    ts
-  ]);
-  return getProfile(id, d);
-}
-function getProfile(idOrSlug, db) {
-  const d = db || getDatabase();
-  const row = d.query("SELECT * FROM profiles WHERE id = ? OR slug = ?").get(idOrSlug, idOrSlug);
-  if (!row)
-    throw new ProfileNotFoundError(idOrSlug);
-  return rowToProfile(row);
-}
-function listProfiles(db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM profiles ORDER BY name").all().map(rowToProfile);
-}
-function updateProfile(idOrSlug, input, db) {
-  const d = db || getDatabase();
-  const existing = getProfile(idOrSlug, d);
-  const ts = now2();
-  const updates = ["updated_at = ?"];
-  const params = [ts];
-  if (input.name !== undefined) {
-    updates.push("name = ?", "slug = ?");
-    params.push(input.name, uniqueProfileSlug(input.name, d, existing.id));
-  }
-  if (input.description !== undefined) {
-    updates.push("description = ?");
-    params.push(input.description);
-  }
-  if (input.selectors !== undefined) {
-    updates.push("selectors = ?");
-    params.push(JSON.stringify(input.selectors));
-  }
-  if (input.variables !== undefined) {
-    updates.push("variables = ?");
-    params.push(JSON.stringify(input.variables));
-  }
-  params.push(existing.id);
-  d.run(`UPDATE profiles SET ${updates.join(", ")} WHERE id = ?`, params);
-  return getProfile(existing.id, d);
-}
-function deleteProfile(idOrSlug, db) {
-  const d = db || getDatabase();
-  const existing = getProfile(idOrSlug, d);
-  d.run("DELETE FROM profiles WHERE id = ?", [existing.id]);
-}
-function addConfigToProfile(profileIdOrSlug, configId, db) {
-  const d = db || getDatabase();
-  const profile = getProfile(profileIdOrSlug, d);
-  const maxRow = d.query("SELECT MAX(sort_order) as max_order FROM profile_configs WHERE profile_id = ?").get(profile.id);
-  const order = (maxRow?.max_order ?? -1) + 1;
-  d.run("INSERT OR IGNORE INTO profile_configs (profile_id, config_id, sort_order) VALUES (?, ?, ?)", [profile.id, configId, order]);
-}
-function removeConfigFromProfile(profileIdOrSlug, configId, db) {
-  const d = db || getDatabase();
-  const profile = getProfile(profileIdOrSlug, d);
-  d.run("DELETE FROM profile_configs WHERE profile_id = ? AND config_id = ?", [profile.id, configId]);
-}
-function getProfileConfigs(profileIdOrSlug, db) {
-  const d = db || getDatabase();
-  const profile = getProfile(profileIdOrSlug, d);
-  const rows = d.query("SELECT config_id FROM profile_configs WHERE profile_id = ? ORDER BY sort_order").all(profile.id);
-  if (rows.length === 0)
-    return [];
-  const ids = rows.map((r) => r.config_id);
-  return listConfigs(undefined, d).filter((c) => ids.includes(c.id));
+      rows = rows.filter((event) => event.type === actionOptions.type);
+    if (actionOptions.limit)
+      rows = rows.slice(-actionOptions.limit);
+    if (wantsJson(actionOptions, command)) {
+      console.log(JSON.stringify(rows, null, 2));
+      return;
+    }
+    if (!rows.length) {
+      console.log("No events recorded.");
+      return;
+    }
+    for (const event of rows)
+      console.log(`${event.time}	${event.id}	${event.source}	${event.type}	${event.severity}`);
+  });
+  events.command("replay").description("Replay recorded events").option("--id <id>", "Replay one event id").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--dry-run", "Preview without delivery", false).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+    const result = await createClient(options).replay({
+      eventId: actionOptions.id,
+      source: actionOptions.source,
+      type: actionOptions.type,
+      dryRun: actionOptions.dryRun
+    });
+    print(result, wantsJson(actionOptions, command), `Replayed ${result.events.length} event(s), ${result.deliveries.length} delivery result(s)`);
+  });
+  return events;
 }
-function profileHasSelectors(profile) {
-  const selectors = profile.selectors ?? {};
-  return (selectors.os?.length ?? 0) > 0 || (selectors.arch?.length ?? 0) > 0 || (selectors.hostnames?.length ?? 0) > 0;
+function registerEventsCommands(program, options) {
+  registerWebhookCommands(program, options);
+  registerEventCommands(program, options);
 }
-function profileMatchesMachine(profile, machine) {
-  const selectors = profile.selectors ?? {};
-  const osMatches = !selectors.os?.length || selectors.os.some((candidate) => {
-    const value = candidate.trim().toLowerCase();
-    return value === machine.os_family || value === (machine.os ?? "").trim().toLowerCase() || normalizeOsFamily(candidate) === machine.os_family;
-  });
-  const archMatches = !selectors.arch?.length || selectors.arch.some((candidate) => candidate.trim().toLowerCase() === (machine.arch ?? "").trim().toLowerCase());
-  const hostnameMatches = !selectors.hostnames?.length || selectors.hostnames.some((candidate) => candidate.trim().toLowerCase() === machine.hostname.trim().toLowerCase());
-  return osMatches && archMatches && hostnameMatches;
+function parseNumber(value) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed))
+    throw new Error(`Expected a number, got ${value}`);
+  return parsed;
 }
-function resolveProfileForMachine(machine = detectMachineContext(), db) {
-  const profiles = listProfiles(db).filter(profileHasSelectors);
-  const matches = profiles.filter((profile) => profileMatchesMachine(profile, machine)).map((profile) => {
-    const selectors = profile.selectors;
-    const score = (selectors.hostnames?.length ? 100 : 0) + (selectors.os?.length ? 10 : 0) + (selectors.arch?.length ? 10 : 0);
-    return { profile, score };
-  }).sort((a, b) => b.score - a.score || a.profile.name.localeCompare(b.profile.name));
-  return matches[0]?.profile ?? null;
+function collectValues(value, previous) {
+  previous.push(value);
+  return previous;
 }
 
+// node_modules/.pnpm/commander@13.1.0/node_modules/commander/esm.mjs
+var import__ = __toESM(require_commander(), 1);
+var {
+  program,
+  createCommand,
+  createArgument,
+  createOption,
+  CommanderError,
+  InvalidArgumentError,
+  InvalidOptionArgumentError,
+  Command,
+  Argument,
+  Option,
+  Help
+} = import__.default;
+
 // src/cli/index.tsx
-init_snapshots();
-init_database();
 init_apply();
 init_sync();
 init_redact();
+import chalk from "chalk";
+import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
+import { homedir as homedir7 } from "os";
+import { basename as basename6, join as join11, resolve as resolve7 } from "path";
 
 // src/lib/export.ts
-init_database();
-init_configs();
-import { existsSync as existsSync7, mkdirSync as mkdirSync3, rmSync, writeFileSync as writeFileSync2 } from "fs";
+init_config_store();
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join6, resolve as resolve2 } from "path";
 import { tmpdir } from "os";
 async function exportConfigs(outputPath, opts = {}) {
-  const d = opts.db || getDatabase();
-  const configs = listConfigs(opts.filter, d);
+  const store = opts.store ?? resolveConfigStore();
+  const configs = await store.listConfigs(opts.filter);
   const absOutput = resolve2(outputPath);
   const tmpDir = join6(tmpdir(), `configs-export-${Date.now()}`);
   const contentsDir = join6(tmpDir, "contents");
@@ -4647,7 +5219,7 @@ async function exportConfigs(outputPath, opts = {}) {
     mkdirSync3(contentsDir, { recursive: true });
     const manifest = {
       version: "1.0.0",
-      exported_at: now2(),
+      exported_at: new Date().toISOString(),
       configs: configs.map(({ content: _content, ...meta }) => meta)
     };
     writeFileSync2(join6(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
@@ -4667,19 +5239,18 @@ async function exportConfigs(outputPath, opts = {}) {
     return { path: absOutput, count: configs.length };
   } finally {
     if (existsSync7(tmpDir)) {
-      rmSync(tmpDir, { recursive: true, force: true });
+      rmSync2(tmpDir, { recursive: true, force: true });
     }
   }
 }
 
 // src/lib/import.ts
-init_database();
-init_configs();
-import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync4, rmSync as rmSync2 } from "fs";
+init_config_store();
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync4, rmSync as rmSync3 } from "fs";
 import { join as join7, resolve as resolve3 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 async function importConfigs(bundlePath, opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const conflict = opts.conflict ?? "skip";
   const absPath = resolve3(bundlePath);
   const tmpDir = join7(tmpdir2(), `configs-import-${Date.now()}`);
@@ -4706,17 +5277,17 @@ async function importConfigs(bundlePath, opts = {}) {
         const content = existsSync8(contentFile) ? readFileSync4(contentFile, "utf-8") : "";
         let existing = null;
         try {
-          existing = getConfig(meta.slug, d);
+          existing = await store.getConfig(meta.slug);
         } catch {}
         if (existing) {
           if (conflict === "skip") {
             result.skipped++;
           } else if (conflict === "overwrite" || conflict === "version") {
-            updateConfig(existing.id, { content, description: meta.description ?? undefined, tags: meta.tags, outputs: meta.outputs }, d);
+            await store.updateConfig(existing.id, { content, description: meta.description ?? undefined, tags: meta.tags, outputs: meta.outputs });
             result.updated++;
           }
         } else {
-          createConfig({
+          await store.createConfig({
             name: meta.name,
             kind: meta.kind,
             category: meta.category,
@@ -4728,7 +5299,7 @@ async function importConfigs(bundlePath, opts = {}) {
             description: meta.description ?? undefined,
             tags: meta.tags,
             is_template: meta.is_template
-          }, d);
+          });
           result.created++;
         }
       } catch (err) {
@@ -4738,7 +5309,7 @@ async function importConfigs(bundlePath, opts = {}) {
     return result;
   } finally {
     if (existsSync8(tmpDir)) {
-      rmSync2(tmpDir, { recursive: true, force: true });
+      rmSync3(tmpDir, { recursive: true, force: true });
     }
   }
 }
@@ -4748,14 +5319,14 @@ init_template();
 init_machine();
 
 // src/lib/session-apply.ts
-import { createHash as createHash2, randomUUID as randomUUID5 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID6 } from "crypto";
 import {
   existsSync as existsSync10,
   lstatSync,
   mkdirSync as mkdirSync5,
   readFileSync as readFileSync6,
   renameSync,
-  rmSync as rmSync3,
+  rmSync as rmSync4,
   writeFileSync as writeFileSync3
 } from "fs";
 import { dirname as dirname3, isAbsolute as isAbsolute2, join as join9, parse as parse2, relative as relative3, resolve as resolve5 } from "path";
@@ -5688,7 +6259,7 @@ function applySessionRender(plan, options = {}) {
         continue;
       assertNoSymlinkSegments(targetHome, result.path);
       if (existsSync10(result.path))
-        rmSync3(result.path);
+        rmSync4(result.path);
     }
   }
   return {
@@ -5922,7 +6493,7 @@ function writePlannedFile(path, content, targetHome) {
   const dir = dirname3(path);
   mkdirSync5(dir, { recursive: true });
   assertNoSymlinkSegments(targetHome, path);
-  const tmp = join9(dir, `.session-${randomUUID5()}.tmp`);
+  const tmp = join9(dir, `.session-${randomUUID6()}.tmp`);
   writeFileSync3(tmp, content, "utf-8");
   renameSync(tmp, path);
 }
@@ -5940,7 +6511,7 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
   if (!previousManifest && existingFiles.length === 0)
     return null;
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
-  const snapshotPath = resolve5(targetHome, ".hasna", "session-render-snapshots", `${timestamp}-${randomUUID5()}.json`);
+  const snapshotPath = resolve5(targetHome, ".hasna", "session-render-snapshots", `${timestamp}-${randomUUID6()}.json`);
   const snapshot = {
     schema: "hasna.configs.session-render-snapshot/v1",
     createdAt: new Date().toISOString(),
@@ -5998,10 +6569,10 @@ function sha2562(content) {
 }
 
 // src/lib/platform-profiles.ts
-init_configs();
+init_config_store();
 
 // src/lib/project-dashboard-standard.ts
-init_configs();
+init_config_store();
 var PROJECT_DASHBOARD_STANDARD_SLUG = "agent-managed-project-dashboard-standard";
 var PROJECT_DASHBOARD_PROFILE_VARIABLES = {
   PROJECT_DASHBOARD_DIR: ".hasna/project",
@@ -6079,7 +6650,7 @@ ids, tasks, and evidence refs. Exclude raw email bodies, account numbers, tax
 ids, passport numbers, credentials, and contract clauses unless an explicit
 approved storage policy exists.
 `;
-function ensureProjectDashboardStandardConfig(db) {
+async function ensureProjectDashboardStandardConfig(store = resolveConfigStore()) {
   const input = {
     name: "Agent Managed Project Dashboard Standard",
     category: "workspace",
@@ -6091,17 +6662,21 @@ function ensureProjectDashboardStandardConfig(db) {
     tags: ["projects-dashboard", "agent-projects", "json-render"]
   };
   try {
-    const existing = getConfig(PROJECT_DASHBOARD_STANDARD_SLUG, db);
+    const existing = await store.getConfig(PROJECT_DASHBOARD_STANDARD_SLUG);
     if (existing.content !== input.content || existing.description !== input.description || existing.category !== input.category || existing.agent !== input.agent || existing.format !== input.format || existing.kind !== input.kind) {
-      return updateConfig(existing.id, input, db);
+      return await store.updateConfig(existing.id, input);
     }
     return existing;
   } catch {
-    return createConfig(input, db);
+    return await store.createConfig(input);
   }
 }
 
 // src/lib/platform-profiles.ts
+function profileHasSelectors2(profile) {
+  const selectors = profile.selectors ?? {};
+  return (selectors.os?.length ?? 0) > 0 || (selectors.arch?.length ?? 0) > 0 || (selectors.hostnames?.length ?? 0) > 0;
+}
 var PLATFORM_PROFILE_PRESETS = [
   {
     name: "linux-arm64",
@@ -6128,25 +6703,25 @@ var PLATFORM_PROFILE_PRESETS = [
     }
   }
 ];
-function ensurePlatformProfiles(db) {
-  const configs = listConfigs(undefined, db);
+async function ensurePlatformProfiles(store = resolveConfigStore()) {
+  const configs = await store.listConfigs();
   const ensured = [];
   for (const preset of PLATFORM_PROFILE_PRESETS) {
     let profile;
     try {
-      profile = getProfile(preset.name, db);
-      if (!profileHasSelectors(profile) || Object.keys(profile.variables).length === 0) {
-        profile = updateProfile(profile.id, {
+      profile = await store.getProfile(preset.name);
+      if (!profileHasSelectors2(profile) || Object.keys(profile.variables).length === 0) {
+        profile = await store.updateProfile(profile.id, {
           description: profile.description ?? preset.description,
-          selectors: profileHasSelectors(profile) ? profile.selectors : preset.selectors,
+          selectors: profileHasSelectors2(profile) ? profile.selectors : preset.selectors,
           variables: Object.keys(profile.variables).length > 0 ? profile.variables : preset.variables
-        }, db);
+        });
       }
     } catch {
-      profile = createProfile(preset, db);
+      profile = await store.createProfile(preset);
     }
     for (const config of configs) {
-      addConfigToProfile(profile.id, config.id, db);
+      await store.addConfigToProfile(profile.id, config.id);
     }
     ensured.push(profile);
   }
@@ -6154,20 +6729,10 @@ function ensurePlatformProfiles(db) {
 }
 
 // src/status.ts
-init_database();
-init_configs();
-import { existsSync as existsSync11, readFileSync as readFileSync7 } from "fs";
-
-// src/db/machines.ts
-init_database();
-function listMachines(db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM machines ORDER BY last_applied_at DESC NULLS LAST").all();
-}
-
-// src/status.ts
+init_config_store();
 init_apply();
 init_redact();
+import { existsSync as existsSync11, readFileSync as readFileSync7 } from "fs";
 var PACKAGE_NAME = "@hasna/instructions";
 var PACKAGE_VERSION = "0.3.0";
 function activeDatabaseEnv() {
@@ -6191,21 +6756,13 @@ function countBy(items, getValue) {
   }
   return counts;
 }
-function tableCount(db, table) {
-  try {
-    const row = db.query(`SELECT COUNT(*) AS count FROM ${table}`).get();
-    return Number(row?.count ?? 0);
-  } catch {
-    return 0;
-  }
-}
-function getConfigsStatus(db = getDatabase()) {
+async function getConfigsStatus(store = resolveConfigStore()) {
   let databaseReachable = true;
   let configs = [];
   let categoryStats = { total: 0 };
   try {
-    configs = listConfigs(undefined, db);
-    categoryStats = getConfigStats(db);
+    configs = await store.listConfigs();
+    categoryStats = await store.getConfigStats();
   } catch {
     databaseReachable = false;
   }
@@ -6230,10 +6787,25 @@ function getConfigsStatus(db = getDatabase()) {
       driftedTargets += 1;
     }
   }
-  const profiles = databaseReachable ? listProfiles(db).length : 0;
-  const machines = databaseReachable ? listMachines(db).length : 0;
-  const profileLinks = databaseReachable ? tableCount(db, "profile_configs") : 0;
-  const snapshots = databaseReachable ? tableCount(db, "config_snapshots") : 0;
+  let profiles = 0;
+  let machines = 0;
+  let profileLinks = 0;
+  let snapshots = 0;
+  if (databaseReachable) {
+    try {
+      const profileList = await store.listProfiles();
+      profiles = profileList.length;
+      machines = (await store.listMachines()).length;
+      for (const profile of profileList) {
+        profileLinks += (await store.getProfileConfigs(profile.id)).length;
+      }
+      for (const config of configs) {
+        snapshots += (await store.listSnapshots(config.id)).length;
+      }
+    } catch {
+      databaseReachable = false;
+    }
+  }
   const byCategory = Object.fromEntries(Object.entries(categoryStats).filter(([key]) => key !== "total"));
   const status = databaseReachable && driftedTargets === 0 && missingTargets === 0 && unredactedSecretFindings === 0 ? "ok" : "warn";
   return {
@@ -6287,425 +6859,8 @@ function getConfigsStatus(db = getDatabase()) {
   };
 }
 
-// src/db/storage-sync.ts
-init_database();
-
-// src/db/pg-migrations.ts
-var PG_MIGRATIONS = [
-  `CREATE TABLE IF NOT EXISTS configs (
-    id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    slug TEXT NOT NULL UNIQUE,
-    kind TEXT NOT NULL DEFAULT 'file',
-    category TEXT NOT NULL,
-    agent TEXT NOT NULL DEFAULT 'global',
-    target_path TEXT,
-    outputs TEXT NOT NULL DEFAULT '[]',
-    format TEXT NOT NULL DEFAULT 'text',
-    content TEXT NOT NULL DEFAULT '',
-    description TEXT,
-    tags TEXT NOT NULL DEFAULT '[]',
-    is_template BOOLEAN NOT NULL DEFAULT FALSE,
-    version INTEGER NOT NULL DEFAULT 1,
-    created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL,
-    synced_at TEXT
-  )`,
-  `CREATE TABLE IF NOT EXISTS config_snapshots (
-    id TEXT PRIMARY KEY,
-    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
-    content TEXT NOT NULL,
-    version INTEGER NOT NULL,
-    created_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS profiles (
-    id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    slug TEXT NOT NULL UNIQUE,
-    description TEXT,
-    selectors TEXT NOT NULL DEFAULT '{}',
-    variables TEXT NOT NULL DEFAULT '{}',
-    created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS profile_configs (
-    profile_id TEXT NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
-    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
-    sort_order INTEGER NOT NULL DEFAULT 0,
-    PRIMARY KEY (profile_id, config_id)
-  )`,
-  `CREATE TABLE IF NOT EXISTS machines (
-    id TEXT PRIMARY KEY,
-    hostname TEXT NOT NULL UNIQUE,
-    os TEXT,
-    arch TEXT,
-    last_applied_at TEXT,
-    created_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS feedback (
-    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-    message TEXT NOT NULL,
-    email TEXT,
-    category TEXT DEFAULT 'general',
-    version TEXT,
-    machine_id TEXT,
-    created_at TEXT NOT NULL DEFAULT NOW()::text
-  )`,
-  `ALTER TABLE configs ADD COLUMN IF NOT EXISTS outputs TEXT NOT NULL DEFAULT '[]'`
-];
-
-// src/db/remote-storage.ts
-import pg from "pg";
-var DISABLED_SSL_MODE = "disable";
-function translatePlaceholders(sql) {
-  let index = 0;
-  return sql.replace(/\?/g, () => `$${++index}`);
-}
-function normalizeParams(params) {
-  const flat = params.length === 1 && Array.isArray(params[0]) ? params[0] : params;
-  return flat.map((value) => value === undefined ? null : value);
-}
-function normalizeHost(hostname) {
-  const stripped = hostname.replace(/^\[/, "").replace(/\]$/, "");
-  try {
-    return decodeURIComponent(stripped).toLowerCase();
-  } catch {
-    return stripped.toLowerCase();
-  }
-}
-function isLocalPostgresHost(hostname) {
-  const host = normalizeHost(hostname);
-  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "" || host.startsWith("/");
-}
-function effectivePgHost(url) {
-  const hosts = url.searchParams.getAll("host");
-  const finalHost = hosts.length > 0 ? hosts[hosts.length - 1] : null;
-  return finalHost?.trim() ? finalHost : url.hostname;
-}
-function buildPgPoolConfig(connectionString) {
-  let url;
-  try {
-    url = new URL(connectionString);
-  } catch {
-    throw new Error("Invalid PostgreSQL connection string");
-  }
-  const sslMode = url.searchParams.get("sslmode")?.trim().toLowerCase();
-  const sslValue = url.searchParams.get("ssl")?.trim().toLowerCase();
-  const isLocal = isLocalPostgresHost(effectivePgHost(url));
-  const hasDisabledSsl = sslMode === DISABLED_SSL_MODE || sslValue === "false";
-  if (!isLocal && hasDisabledSsl) {
-    throw new Error("Refusing remote PostgreSQL connection with TLS disabled");
-  }
-  const shouldUseSsl = !isLocal || sslMode === "require" || sslMode === "verify-ca" || sslMode === "verify-full" || sslValue === "true";
-  url.searchParams.delete("sslmode");
-  url.searchParams.delete("ssl");
-  return {
-    connectionString: url.toString(),
-    ssl: shouldUseSsl ? { rejectUnauthorized: true } : undefined
-  };
-}
-
-class PgAdapterAsync {
-  pool;
-  constructor(connectionString) {
-    this.pool = new pg.Pool(buildPgPoolConfig(connectionString));
-  }
-  async run(sql, ...params) {
-    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
-    return { changes: result.rowCount ?? 0 };
-  }
-  async all(sql, ...params) {
-    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
-    return result.rows;
-  }
-  async close() {
-    await this.pool.end();
-  }
-}
-
-// src/db/storage-sync.ts
-var STORAGE_TABLES = ["configs", "config_snapshots", "profiles", "profile_configs", "machines", "feedback"];
-var PRIMARY_KEYS = {
-  configs: ["id"],
-  config_snapshots: ["id"],
-  profiles: ["id"],
-  profile_configs: ["profile_id", "config_id"],
-  machines: ["id"],
-  feedback: ["id"]
-};
-var CONFIGS_STORAGE_ENV = "HASNA_CONFIGS_DATABASE_URL";
-var CONFIGS_STORAGE_FALLBACK_ENV = "CONFIGS_DATABASE_URL";
-var CONFIGS_STORAGE_MODE_ENV = "HASNA_CONFIGS_STORAGE_MODE";
-var CONFIGS_STORAGE_MODE_FALLBACK_ENV = "CONFIGS_STORAGE_MODE";
-var STORAGE_DATABASE_ENV = [CONFIGS_STORAGE_ENV, CONFIGS_STORAGE_FALLBACK_ENV];
-var STORAGE_MODE_ENV = [CONFIGS_STORAGE_MODE_ENV, CONFIGS_STORAGE_MODE_FALLBACK_ENV];
-function firstEnv(names) {
-  for (const name of names) {
-    const value = process.env[name];
-    if (value)
-      return value;
-  }
-  return null;
-}
-function normalizeStorageMode(value) {
-  const normalized = value?.trim().toLowerCase();
-  if (normalized === "local" || normalized === "hybrid" || normalized === "remote")
-    return normalized;
-  return;
-}
-function getStorageDatabaseUrl() {
-  return firstEnv(STORAGE_DATABASE_ENV);
-}
-function getStorageMode() {
-  const mode = normalizeStorageMode(firstEnv(STORAGE_MODE_ENV));
-  if (mode)
-    return mode;
-  return getStorageDatabaseUrl() ? "hybrid" : "local";
-}
-async function getStoragePg() {
-  const url = getStorageDatabaseUrl();
-  if (!url)
-    throw new Error("Missing HASNA_CONFIGS_DATABASE_URL or CONFIGS_DATABASE_URL");
-  return new PgAdapterAsync(url);
-}
-async function runStorageMigrations(remote) {
-  await remote.run("CREATE EXTENSION IF NOT EXISTS pgcrypto");
-  for (const sql of PG_MIGRATIONS)
-    await remote.run(sql);
-}
-async function storagePush(options) {
-  const remote = await getStoragePg();
-  const db = getDatabase();
-  try {
-    await runStorageMigrations(remote);
-    const results = [];
-    for (const table of resolveTables(options?.tables))
-      results.push(await pushTable(db, remote, table));
-    recordSyncMeta(db, "push", results);
-    return results;
-  } finally {
-    await remote.close();
-  }
-}
-async function storagePull(options) {
-  const remote = await getStoragePg();
-  const db = getDatabase();
-  try {
-    await runStorageMigrations(remote);
-    const results = [];
-    for (const table of resolveTables(options?.tables))
-      results.push(await pullTable(remote, db, table));
-    recordSyncMeta(db, "pull", results);
-    return results;
-  } finally {
-    await remote.close();
-  }
-}
-async function storageSync(options) {
-  const pull = await storagePull(options);
-  const push = await storagePush(options);
-  return { pull, push };
-}
-function getStorageSyncMetaAll() {
-  const db = getDatabase();
-  ensureSyncMetaTable(db);
-  return db.query("SELECT table_name, last_synced_at, direction FROM _configs_sync_meta ORDER BY table_name, direction").all();
-}
-function getStorageStatus() {
-  return {
-    configured: Boolean(getStorageDatabaseUrl()),
-    mode: getStorageMode(),
-    env: STORAGE_DATABASE_ENV,
-    service: "configs",
-    tables: STORAGE_TABLES,
-    sync: getStorageSyncMetaAll()
-  };
-}
-function resolveTables(tables) {
-  if (!tables || tables.length === 0)
-    return [...STORAGE_TABLES];
-  const allowed = new Set(STORAGE_TABLES);
-  const requested = tables.map((table) => table.trim()).filter(Boolean);
-  const invalid = requested.filter((table) => !allowed.has(table));
-  if (invalid.length > 0)
-    throw new Error(`Unknown configs sync table(s): ${invalid.join(", ")}`);
-  return requested;
-}
-async function pushTable(db, remote, table) {
-  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
-  try {
-    const rows = db.query(`SELECT * FROM ${quoteIdent(table)}`).all();
-    result.rowsRead = rows.length;
-    if (rows.length === 0)
-      return result;
-    const columns = await filterRemoteColumns(remote, table, Object.keys(rows[0]));
-    result.rowsWritten = await upsertPg(remote, table, columns, rows);
-  } catch (error) {
-    result.errors.push(error instanceof Error ? error.message : String(error));
-  }
-  return result;
-}
-async function pullTable(remote, db, table) {
-  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
-  try {
-    const rows = await remote.all(`SELECT * FROM ${quoteIdent(table)}`);
-    result.rowsRead = rows.length;
-    if (rows.length === 0)
-      return result;
-    const columns = filterLocalColumns(db, table, Object.keys(rows[0]));
-    result.rowsWritten = upsertSqlite(db, table, columns, rows);
-  } catch (error) {
-    result.errors.push(error instanceof Error ? error.message : String(error));
-  }
-  return result;
-}
-async function filterRemoteColumns(remote, table, columns) {
-  const rows = await remote.all("SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = ?", table);
-  if (rows.length === 0)
-    return columns;
-  const allowed = new Set(rows.map((row) => row.column_name));
-  return columns.filter((column) => allowed.has(column));
-}
-function filterLocalColumns(db, table, columns) {
-  const rows = db.query(`PRAGMA table_info(${quoteIdent(table)})`).all();
-  const allowed = new Set(rows.map((row) => row.name));
-  return columns.filter((column) => allowed.has(column));
-}
-async function upsertPg(remote, table, columns, rows) {
-  if (columns.length === 0)
-    return 0;
-  const primaryKeys = PRIMARY_KEYS[table];
-  const columnList = columns.map(quoteIdent).join(", ");
-  const placeholders = columns.map(() => "?").join(", ");
-  const keyList = primaryKeys.map(quoteIdent).join(", ");
-  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
-  const fallbackKey = primaryKeys[0];
-  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = EXCLUDED.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = EXCLUDED.${quoteIdent(fallbackKey)}`;
-  for (const row of rows) {
-    await remote.run(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders}) ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`, ...columns.map((column) => row[column] ?? null));
-  }
-  return rows.length;
-}
-function upsertSqlite(db, table, columns, rows) {
-  if (columns.length === 0)
-    return 0;
-  const primaryKeys = PRIMARY_KEYS[table];
-  const columnList = columns.map(quoteIdent).join(", ");
-  const placeholders = columns.map(() => "?").join(", ");
-  const keyList = primaryKeys.map(quoteIdent).join(", ");
-  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
-  const fallbackKey = primaryKeys[0];
-  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = excluded.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = excluded.${quoteIdent(fallbackKey)}`;
-  const statement = db.prepare(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders}) ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`);
-  db.transaction((batch) => {
-    for (const row of batch)
-      statement.run(...columns.map((column) => coerceForSqlite(row[column])));
-  })(rows);
-  return rows.length;
-}
-function recordSyncMeta(db, direction, results) {
-  ensureSyncMetaTable(db);
-  const now3 = new Date().toISOString();
-  const statement = db.prepare("INSERT INTO _configs_sync_meta (table_name, last_synced_at, direction) VALUES (?, ?, ?) ON CONFLICT(table_name, direction) DO UPDATE SET last_synced_at = excluded.last_synced_at");
-  for (const result of results) {
-    if (result.errors.length > 0)
-      continue;
-    statement.run(result.table, now3, direction);
-  }
-}
-function ensureSyncMetaTable(db) {
-  db.exec("CREATE TABLE IF NOT EXISTS _configs_sync_meta (table_name TEXT NOT NULL, last_synced_at TEXT, direction TEXT NOT NULL CHECK(direction IN ('push', 'pull')), PRIMARY KEY (table_name, direction))");
-}
-function quoteIdent(identifier) {
-  return `"${identifier.replace(/"/g, '""')}"`;
-}
-function coerceForSqlite(value) {
-  if (value === undefined || value === null)
-    return null;
-  if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean")
-    return value;
-  if (value instanceof Date)
-    return value.toISOString();
-  if (Buffer.isBuffer(value) || value instanceof Uint8Array)
-    return value;
-  if (typeof value === "object")
-    return JSON.stringify(value);
-  return String(value);
-}
-
-// src/cli/storage.ts
-function parseTables(value) {
-  if (!value)
-    return;
-  return value.split(",").map((table) => table.trim()).filter(Boolean);
-}
-function printJson(value) {
-  console.log(JSON.stringify(value, null, 2));
-}
-function printResults(results, label) {
-  const total = results.reduce((sum, result) => sum + result.rowsWritten, 0);
-  for (const result of results) {
-    const errors = result.errors.length > 0 ? ` (${result.errors.join("; ")})` : "";
-    console.log(`  ${result.table}: ${result.rowsWritten}/${result.rowsRead} rows ${label}${errors}`);
-  }
-  console.log(`Done. ${total} rows ${label}.`);
-}
-function registerStorageCommands(program2) {
-  const storageCmd = program2.command("storage").description("Storage sync commands");
-  storageCmd.command("status").description("Show storage config and local sync state").option("--json", "Output as JSON").action((opts) => {
-    const info = getStorageStatus();
-    if (opts.json) {
-      printJson(info);
-      return;
-    }
-    console.log(`Storage configured: ${info.configured ? "yes" : "no"}`);
-    console.log(`Tables: ${info.tables.join(", ")}`);
-    if (info.sync.length === 0)
-      console.log("Sync: no local sync history");
-    for (const entry of info.sync)
-      console.log(`  ${entry.table_name} ${entry.direction}: ${entry.last_synced_at ?? "never"}`);
-  });
-  storageCmd.command("push").description("Push local configs data to storage PostgreSQL").option("--tables <tables>", "Comma-separated table names").option("--json", "Output as JSON").action(async (opts) => {
-    try {
-      const results = await storagePush({ tables: parseTables(opts.tables) });
-      if (opts.json) {
-        printJson(results);
-        return;
-      }
-      printResults(results, "pushed");
-    } catch (error) {
-      console.error(error instanceof Error ? error.message : String(error));
-      process.exit(1);
-    }
-  });
-  storageCmd.command("pull").description("Pull configs data from storage PostgreSQL to local SQLite").option("--tables <tables>", "Comma-separated table names").option("--json", "Output as JSON").action(async (opts) => {
-    try {
-      const results = await storagePull({ tables: parseTables(opts.tables) });
-      if (opts.json) {
-        printJson(results);
-        return;
-      }
-      printResults(results, "pulled");
-    } catch (error) {
-      console.error(error instanceof Error ? error.message : String(error));
-      process.exit(1);
-    }
-  });
-  storageCmd.command("sync").description("Bidirectional sync: pull then push").option("--tables <tables>", "Comma-separated table names").option("--json", "Output as JSON").action(async (opts) => {
-    try {
-      const result = await storageSync({ tables: parseTables(opts.tables) });
-      if (opts.json) {
-        printJson(result);
-        return;
-      }
-      printResults(result.pull, "pulled");
-      printResults(result.push, "pushed");
-    } catch (error) {
-      console.error(error instanceof Error ? error.message : String(error));
-      process.exit(1);
-    }
-  });
-}
+// src/cli/index.tsx
+init_config_store();
 
 // src/lib/compact-output.ts
 var DEFAULT_LIST_LIMIT = 20;
@@ -6784,9 +6939,9 @@ function pageFooter(command, page, detailsHint) {
 function printConfigRows(configs) {
   console.log(`${pad("slug", 32)} ${pad("type", 15)} ${pad("fmt", 8)} ${pad("path", 44)} out v`);
   for (const c of configs) {
-    const type = `${c.category}/${c.agent}`;
+    const type2 = `${c.category}/${c.agent}`;
     const path = c.kind === "reference" ? "(ref)" : c.target_path ?? "(no path)";
-    console.log(`${pad(c.slug, 32)} ${pad(type, 15)} ${pad(c.format, 8)} ${pad(truncateMiddle(path, 44), 44)} ${String(c.outputs.length).padStart(3)} ${c.version}`);
+    console.log(`${pad(c.slug, 32)} ${pad(type2, 15)} ${pad(c.format, 8)} ${pad(truncateMiddle(path, 44), 44)} ${String(c.outputs.length).padStart(3)} ${c.version}`);
   }
 }
 function splitCsv(value) {
@@ -6821,11 +6976,11 @@ function parseSessionSource(value, order, replaceIds) {
   if (!path)
     throw new Error(`Invalid --source "${value}" (expected path or id=path)`);
   const absPath = resolveSessionPath(path);
-  if (!existsSync12(absPath))
+  if (!existsSync13(absPath))
     throw new Error(`Instruction source file not found: ${absPath}`);
-  const content = readFileSync8(absPath, "utf-8");
+  const content = readFileSync9(absPath, "utf-8");
   const source = sourceFromFilePath(absPath, content, order);
-  const resolvedId = id || source.id || basename5(absPath);
+  const resolvedId = id || source.id || basename6(absPath);
   return {
     ...source,
     id: resolvedId,
@@ -6850,18 +7005,18 @@ function parseLayeredReference(value) {
     throw new Error("Instruction reference cannot be empty.");
   return { id: trimmed };
 }
-function collectSessionSources(opts, tool) {
+async function collectSessionSources(opts, tool, store) {
   const replaceIds = new Set(opts.replaceSource ?? []);
   const sources = (opts.source ?? []).map((value, index) => parseSessionSource(value, index, replaceIds));
   for (const value of opts.config ?? []) {
     const { layer, id } = parseLayeredReference(value);
-    sources.push(sourceFromConfig(getConfig(id), sources.length, layer));
+    sources.push(sourceFromConfig(await store.getConfig(id), sources.length, layer));
   }
   for (const value of opts.identityExport ?? []) {
     const path = resolveSessionPath(value);
-    if (!existsSync12(path))
+    if (!existsSync13(path))
       throw new Error(`Identity instruction export not found: ${path}`);
-    const parsed = JSON.parse(readFileSync8(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync9(path, "utf-8"));
     sources.push(...sourcesFromIdentityExport(parsed, { path, tool, orderOffset: sources.length }));
   }
   return sources.map((source) => replaceIds.has(source.id) ? { ...source, merge: "replace" } : source);
@@ -6893,12 +7048,12 @@ function parseVarArgs(values) {
 function parseProfileSelectors(opts) {
   const selectors = {};
   const os = splitCsv(opts.os);
-  const arch = splitCsv(opts.arch);
+  const arch2 = splitCsv(opts.arch);
   const hostnames = splitCsv(opts.hostname);
   if (os)
     selectors.os = os;
-  if (arch)
-    selectors.arch = arch;
+  if (arch2)
+    selectors.arch = arch2;
   if (hostnames)
     selectors.hostnames = hostnames;
   return Object.keys(selectors).length > 0 ? selectors : undefined;
@@ -6916,14 +7071,14 @@ function formatProfileSelectorSummary(profile) {
 function formatProfileVariables(profile) {
   return Object.entries(profile.variables).map(([key, value]) => `${key}=${value}`).join(", ");
 }
-function getMachineProfileContext(opts) {
+async function getMachineProfileContext(opts, store) {
   const machine = detectMachineContext({ hostname: opts.hostname, os: opts.os, arch: opts.arch });
-  const profile = resolveProfileForMachine(machine);
+  const profile = await store.resolveProfileForMachine(machine);
   return { machine, profile, vars: resolveProfileVariables(profile, machine) };
 }
 program.command("list").alias("ls").description("List stored configs").option("-c, --category <cat>", "filter by category").option("-a, --agent <agent>", "filter by agent").option("-k, --kind <kind>", "filter by kind (file|reference)").option("-t, --tag <tag>", "filter by tag").option("-s, --search <query>", "search name/description/content").option("-f, --format <fmt>", "output format: compact|table|json", "compact").option("--brief", "shorthand for --format compact").option("--verbose", "show expanded metadata for each listed config").option("--json", "output full matching records as JSON").option("--limit <n>", `max rows for human output (default ${DEFAULT_LIST_LIMIT})`).option("--cursor <n>", "zero-based pagination cursor for human output").action(async (opts) => {
   const fmt = opts.json ? "json" : opts.verbose ? "table" : opts.brief ? "compact" : opts.format;
-  const configs = listConfigs({
+  const configs = await resolveConfigStore().listConfigs({
     category: opts.category,
     agent: opts.agent,
     kind: opts.kind,
@@ -6951,7 +7106,7 @@ program.command("list").alias("ls").description("List stored configs").option("-
 });
 program.command("show <id>").alias("inspect").description("Show a config's content and metadata").option("-f, --format <fmt>", "output format: table|json|content", "table").action(async (id, opts) => {
   try {
-    const c = getConfig(id);
+    const c = await resolveConfigStore().getConfig(id);
     if (opts.format === "json") {
       console.log(JSON.stringify(c, null, 2));
       return;
@@ -6971,17 +7126,17 @@ program.command("show <id>").alias("inspect").description("Show a config's conte
   }
 });
 program.command("add <path>").description("Ingest a file into the config DB").option("-n, --name <name>", "config name (defaults to filename)").option("-c, --category <cat>", "category override").option("-a, --agent <agent>", "agent override").option("-k, --kind <kind>", "kind: file|reference", "file").option("--template", "mark as template (has {{VAR}} placeholders)").action(async (filePath, opts) => {
-  const abs = resolve6(filePath);
-  if (!existsSync12(abs)) {
+  const abs = resolve7(filePath);
+  if (!existsSync13(abs)) {
     console.error(chalk.red(`File not found: ${abs}`));
     process.exit(1);
   }
-  const rawContent = readFileSync8(abs, "utf-8");
+  const rawContent = readFileSync9(abs, "utf-8");
   const fmt = detectFormat(abs);
   const { content, redacted, isTemplate: isTemplate2 } = redactContent(rawContent, fmt);
-  const targetPath = abs.startsWith(homedir6()) ? abs.replace(homedir6(), "~") : abs;
+  const targetPath = abs.startsWith(homedir7()) ? abs.replace(homedir7(), "~") : abs;
   const name = opts.name || filePath.split("/").pop();
-  const config = createConfig({
+  const config = await resolveConfigStore().createConfig({
     name,
     kind: opts.kind ?? "file",
     category: opts.category ?? detectCategory(abs),
@@ -6999,10 +7154,26 @@ program.command("add <path>").description("Ingest a file into the config DB").op
     console.log(chalk.dim("  Config stored as a template. Use `configs template vars` to see placeholders."));
   }
 });
+program.command("delete <id>").alias("rm").description("Delete a config record (by id or slug)").option("--json", "output result as JSON").action(async (id, opts) => {
+  try {
+    const store = resolveConfigStore();
+    const config = await store.getConfig(id);
+    await store.deleteConfig(config.id);
+    if (opts.json) {
+      console.log(JSON.stringify({ deleted: true, id: config.id, slug: config.slug }, null, 2));
+      return;
+    }
+    console.log(chalk.green("\u2713") + ` Deleted: ${chalk.bold(config.name)} ${chalk.dim(`(${config.slug})`)}`);
+  } catch (e) {
+    console.error(chalk.red(e instanceof Error ? e.message : String(e)));
+    process.exit(1);
+  }
+});
 program.command("apply <id>").description("Apply a config to its target_path and output targets on disk").option("--dry-run", "preview without writing").option("--force", "overwrite even if unchanged").action(async (id, opts) => {
   try {
-    const config = getConfig(id);
-    const result = await applyConfig(config, { dryRun: opts.dryRun });
+    const store = resolveConfigStore();
+    const config = await store.getConfig(id);
+    const result = await applyConfig(config, { dryRun: opts.dryRun, store });
     const status = opts.dryRun ? chalk.yellow("[dry-run]") : result.changed ? chalk.green("\u2713") : chalk.dim("=");
     const change = result.changed ? "changed" : "unchanged";
     console.log(`${status} ${result.path} ${chalk.dim(`(${change})`)}`);
@@ -7018,17 +7189,18 @@ program.command("apply <id>").description("Apply a config to its target_path and
 });
 program.command("diff [id]").description("Show diff between stored config and disk (omit id for --all)").option("--all", "diff every known config against disk").action(async (id, opts) => {
   try {
+    const store = resolveConfigStore();
     if (id) {
-      const config = getConfig(id);
-      console.log(diffConfig(config));
+      const config = await store.getConfig(id);
+      console.log(await diffConfig(config, { store }));
       return;
     }
-    const configs = listConfigs({ kind: "file" });
+    const configs = await store.listConfigs({ kind: "file" });
     let drifted = 0;
     for (const c of configs) {
       if (!c.target_path)
         continue;
-      const diff = diffConfig(c);
+      const diff = await diffConfig(c, { store });
       if (diff.includes("no diff") || diff.includes("not found"))
         continue;
       drifted++;
@@ -7043,6 +7215,7 @@ program.command("diff [id]").description("Show diff between stored config and di
   }
 });
 program.command("sync").description("Sync known AI coding configs from disk into DB (claude, codex, opencode, cursor, codewith, aicopilot, gemini, zsh, git, npm)").option("-a, --agent <agent>", "only sync configs for this agent (claude|codex|opencode|cursor|codewith|aicopilot|gemini|zsh|git|npm)").option("-c, --category <cat>", "only sync configs in this category").option("-p, --project [dir]", "sync project-scoped configs (CLAUDE.md, .mcp.json, etc.) from a project dir").option("--all", "with --project: scan all subdirs for projects to sync").option("--to-disk", "apply DB configs back to disk instead").option("--dry-run", "preview without writing").option("--list", "show which files would be synced without doing anything").option("--limit <n>", `with --list, max rows (default ${DEFAULT_LIST_LIMIT})`).option("--cursor <n>", "with --list, zero-based pagination cursor").action(async (opts) => {
+  const store = resolveConfigStore();
   if (opts.list) {
     const targets = KNOWN_CONFIGS.filter((k) => {
       if (opts.agent && k.agent !== opts.agent)
@@ -7063,18 +7236,18 @@ program.command("sync").description("Sync known AI coding configs from disk into
   if (opts.project) {
     const dir = typeof opts.project === "string" ? opts.project : process.cwd();
     if (opts.all) {
-      const { readdirSync: readdirSync3, statSync: st } = await import("fs");
+      const { readdirSync: readdirSync4, statSync: st } = await import("fs");
       const absDir = expandPath(dir);
-      const entries = readdirSync3(absDir, { withFileTypes: true });
+      const entries = readdirSync4(absDir, { withFileTypes: true });
       let totalAdded = 0, totalUpdated = 0, totalUnchanged = 0, projects = 0;
       for (const entry of entries) {
         if (!entry.isDirectory())
           continue;
-        const projDir = join10(absDir, entry.name);
-        const hasClaude = existsSync12(join10(projDir, "CLAUDE.md")) || existsSync12(join10(projDir, ".mcp.json")) || existsSync12(join10(projDir, ".claude"));
+        const projDir = join11(absDir, entry.name);
+        const hasClaude = existsSync13(join11(projDir, "CLAUDE.md")) || existsSync13(join11(projDir, ".mcp.json")) || existsSync13(join11(projDir, ".claude"));
         if (!hasClaude)
           continue;
-        const result2 = await syncProject({ projectDir: projDir, dryRun: opts.dryRun });
+        const result2 = await syncProject({ projectDir: projDir, dryRun: opts.dryRun, store });
         if (result2.added + result2.updated > 0) {
           console.log(`  ${chalk.green("\u2713")} ${entry.name}: +${result2.added} updated:${result2.updated}`);
         }
@@ -7086,15 +7259,15 @@ program.command("sync").description("Sync known AI coding configs from disk into
       console.log(chalk.green("\u2713") + ` Synced ${projects} projects: +${totalAdded} updated:${totalUpdated} unchanged:${totalUnchanged}`);
       return;
     }
-    const result = await syncProject({ projectDir: dir, dryRun: opts.dryRun });
+    const result = await syncProject({ projectDir: dir, dryRun: opts.dryRun, store });
     console.log(chalk.green("\u2713") + ` Project sync: +${result.added} updated:${result.updated} unchanged:${result.unchanged} skipped:${result.skipped.length}`);
     return;
   }
   if (opts.toDisk) {
-    const result = await syncToDisk({ dryRun: opts.dryRun, agent: opts.agent, category: opts.category });
+    const result = await syncToDisk({ dryRun: opts.dryRun, agent: opts.agent, category: opts.category, store });
     console.log(chalk.green("\u2713") + ` Written to disk: updated:${result.updated} unchanged:${result.unchanged} skipped:${result.skipped.length}`);
   } else {
-    const result = await syncKnown({ dryRun: opts.dryRun, agent: opts.agent, category: opts.category });
+    const result = await syncKnown({ dryRun: opts.dryRun, agent: opts.agent, category: opts.category, store });
     console.log(chalk.green("\u2713") + ` Synced: +${result.added} updated:${result.updated} unchanged:${result.unchanged} skipped:${result.skipped.length}`);
     if (result.skipped.length > 0) {
       console.log(chalk.dim("  skipped (not found): " + result.skipped.join(", ")));
@@ -7103,13 +7276,15 @@ program.command("sync").description("Sync known AI coding configs from disk into
 });
 program.command("export").description("Export configs as a tar.gz bundle").option("-o, --output <path>", "output file", "./configs-export.tar.gz").option("-c, --category <cat>", "filter by category").action(async (opts) => {
   const result = await exportConfigs(opts.output, {
-    filter: opts.category ? { category: opts.category } : undefined
+    filter: opts.category ? { category: opts.category } : undefined,
+    store: resolveConfigStore()
   });
   console.log(chalk.green("\u2713") + ` Exported ${result.count} configs to ${result.path}`);
 });
 program.command("import <file>").description("Import configs from a tar.gz bundle").option("--overwrite", "overwrite existing configs").action(async (file, opts) => {
   const result = await importConfigs(file, {
-    conflict: opts.overwrite ? "overwrite" : "skip"
+    conflict: opts.overwrite ? "overwrite" : "skip",
+    store: resolveConfigStore()
   });
   console.log(chalk.green("\u2713") + ` Import complete: +${result.created} updated:${result.updated} skipped:${result.skipped}`);
   if (result.errors.length > 0) {
@@ -7119,10 +7294,11 @@ program.command("import <file>").description("Import configs from a tar.gz bundl
   }
 });
 program.command("whoami").description("Show setup summary").action(async () => {
-  const dbPath = process.env["CONFIGS_DB_PATH"] || join10(homedir6(), ".hasna", "configs", "configs.db");
-  const stats = getConfigStats();
+  const store = resolveConfigStore();
+  const dbPath = isCloudMode() ? `${process.env["HASNA_INSTRUCTIONS_API_URL"]}/v1 (self_hosted)` : process.env["CONFIGS_DB_PATH"] || join11(homedir7(), ".hasna", "configs", "configs.db");
+  const stats = await store.getConfigStats();
   console.log(chalk.bold("@hasna/configs") + chalk.dim(" v" + pkg.version));
-  console.log(chalk.cyan("DB:") + " " + dbPath);
+  console.log(chalk.cyan(isCloudMode() ? "API:" : "DB:") + " " + dbPath);
   console.log(chalk.cyan("Total configs:") + " " + (stats["total"] || 0));
   console.log();
   console.log(chalk.bold("By category:"));
@@ -7132,7 +7308,7 @@ program.command("whoami").description("Show setup summary").action(async () => {
     if (count > 0)
       console.log(`  ${chalk.cyan(cat.padEnd(16))} ${count}`);
   }
-  const profiles = listProfiles();
+  const profiles = await store.listProfiles();
   if (profiles.length > 0) {
     console.log();
     console.log(chalk.bold("Profiles:") + chalk.dim(` (${profiles.length})`));
@@ -7143,7 +7319,8 @@ program.command("whoami").description("Show setup summary").action(async () => {
 var profileCmd = program.command("profile").description("Manage config profiles (named bundles)");
 profileCmd.command("list").description("List all profiles").option("--brief", "compact one-line output").option("-f, --format <fmt>", "compact|table|json", "compact").option("--verbose", "show expanded profile metadata").option("--json", "output full profiles as JSON").option("--limit <n>", `max rows for human output (default ${DEFAULT_LIST_LIMIT})`).option("--cursor <n>", "zero-based pagination cursor for human output").action(async (opts) => {
   const fmt = opts.json ? "json" : opts.verbose ? "table" : opts.brief ? "compact" : opts.format;
-  const profiles = listProfiles();
+  const store = resolveConfigStore();
+  const profiles = await store.listProfiles();
   if (profiles.length === 0) {
     console.log(chalk.dim("No profiles."));
     return;
@@ -7158,10 +7335,10 @@ profileCmd.command("list").description("List all profiles").option("--brief", "c
   for (const p of page.items) {
     if (fmt === "compact") {
       const selectorSummary2 = formatProfileSelectorSummary(p);
-      console.log(`${pad(p.slug, 28)} ${pad(String(getProfileConfigs(p.id).length), 8)} ${pad(selectorSummary2 || "-", 36)} ${Object.keys(p.variables).length}`);
+      console.log(`${pad(p.slug, 28)} ${pad(String((await store.getProfileConfigs(p.id)).length), 8)} ${pad(selectorSummary2 || "-", 36)} ${Object.keys(p.variables).length}`);
       continue;
     }
-    const configs = getProfileConfigs(p.id);
+    const configs = await store.getProfileConfigs(p.id);
     console.log(`${chalk.bold(p.name)} ${chalk.dim(`(${p.slug})`)} \u2014 ${configs.length} config(s)`);
     if (p.description)
       console.log(`  ${chalk.dim(p.description)}`);
@@ -7175,7 +7352,7 @@ profileCmd.command("list").description("List all profiles").option("--brief", "c
   pageFooter("configs profile list", page, "Use --verbose for expanded rows, --json for full records, or `configs profile show <slug>` for details.");
 });
 profileCmd.command("create <name>").description("Create a new profile").option("-d, --description <desc>", "profile description").option("--os <os>", "comma-separated OS matchers (linux, macos, darwin, etc.)").option("--arch <arch>", "comma-separated CPU arch matchers (arm64, x64, etc.)").option("--hostname <hosts>", "comma-separated hostname matchers").option("--var <vars...>", "set profile variable(s) as KEY=VALUE").action(async (name, opts) => {
-  const p = createProfile({
+  const p = await resolveConfigStore().createProfile({
     name,
     description: opts.description,
     selectors: parseProfileSelectors(opts),
@@ -7185,8 +7362,9 @@ profileCmd.command("create <name>").description("Create a new profile").option("
 });
 profileCmd.command("show <id>").description("Show profile and its configs").option("--limit <n>", `max config rows (default ${DEFAULT_LIST_LIMIT})`).option("--cursor <n>", "zero-based pagination cursor").action(async (id, opts) => {
   try {
-    const p = getProfile(id);
-    const configs = getProfileConfigs(id);
+    const store = resolveConfigStore();
+    const p = await store.getProfile(id);
+    const configs = await store.getProfileConfigs(id);
     console.log(chalk.bold(p.name) + chalk.dim(` (${p.slug})`));
     if (p.description)
       console.log(chalk.dim(p.description));
@@ -7210,8 +7388,9 @@ profileCmd.command("show <id>").description("Show profile and its configs").opti
 });
 profileCmd.command("add <profile> <config>").description("Add a config to a profile").action(async (profile, config) => {
   try {
-    const c = getConfig(config);
-    addConfigToProfile(profile, c.id);
+    const store = resolveConfigStore();
+    const c = await store.getConfig(config);
+    await store.addConfigToProfile(profile, c.id);
     console.log(chalk.green("\u2713") + ` Added ${c.slug} to profile ${profile}`);
   } catch (e) {
     console.error(chalk.red(e instanceof Error ? e.message : String(e)));
@@ -7220,8 +7399,9 @@ profileCmd.command("add <profile> <config>").description("Add a config to a prof
 });
 profileCmd.command("remove <profile> <config>").description("Remove a config from a profile").action(async (profile, config) => {
   try {
-    const c = getConfig(config);
-    removeConfigFromProfile(profile, c.id);
+    const store = resolveConfigStore();
+    const c = await store.getConfig(config);
+    await store.removeConfigFromProfile(profile, c.id);
     console.log(chalk.green("\u2713") + ` Removed ${c.slug} from profile ${profile}`);
   } catch (e) {
     console.error(chalk.red(e instanceof Error ? e.message : String(e)));
@@ -7230,15 +7410,16 @@ profileCmd.command("remove <profile> <config>").description("Remove a config fro
 });
 profileCmd.command("apply [id]").description("Apply all configs in a profile to disk").option("--dry-run", "preview without writing").option("--auto", "resolve the matching profile for the current machine").option("--hostname <hostname>", "override detected hostname for auto resolution").option("--os <os>", "override detected OS for auto resolution").option("--arch <arch>", "override detected arch for auto resolution").action(async (id, opts) => {
   try {
-    const { machine, profile } = getMachineProfileContext(opts);
-    const selected = opts.auto ? profile : id ? getProfile(id) : null;
+    const store = resolveConfigStore();
+    const { machine, profile } = await getMachineProfileContext(opts, store);
+    const selected = opts.auto ? profile : id ? await store.getProfile(id) : null;
     if (!selected) {
       console.error(chalk.red(opts.auto ? "No matching machine-aware profile found." : "Provide a profile id or use --auto."));
       process.exit(1);
     }
-    const configs = getProfileConfigs(selected.id);
+    const configs = await store.getProfileConfigs(selected.id);
     const vars = resolveProfileVariables(selected, machine);
-    const results = await applyConfigs(configs, { dryRun: opts.dryRun, vars });
+    const results = await applyConfigs(configs, { dryRun: opts.dryRun, vars, store });
     let changed = 0;
     for (const r of results) {
       const status = opts.dryRun ? chalk.yellow("[dry-run]") : r.changed ? chalk.green("\u2713") : chalk.dim("=");
@@ -7254,7 +7435,8 @@ ${changed}/${results.length} changed (${selected.slug} on ${machine.hostname} ${
   }
 });
 profileCmd.command("resolve").description("Resolve the matching machine-aware profile").option("--hostname <hostname>", "override detected hostname").option("--os <os>", "override detected OS").option("--arch <arch>", "override detected arch").action(async (opts) => {
-  const { machine, profile, vars } = getMachineProfileContext(opts);
+  const store = resolveConfigStore();
+  const { machine, profile, vars } = await getMachineProfileContext(opts, store);
   if (!profile) {
     console.log(chalk.yellow(`No matching profile for ${machine.hostname} ${machine.os_family}/${machine.arch}`));
     process.exit(1);
@@ -7271,8 +7453,9 @@ profileCmd.command("resolve").description("Resolve the matching machine-aware pr
 });
 profileCmd.command("delete <id>").description("Delete a profile").action(async (id) => {
   try {
-    const p = getProfile(id);
-    deleteProfile(id);
+    const store = resolveConfigStore();
+    const p = await store.getProfile(id);
+    await store.deleteProfile(p.id);
     console.log(chalk.green("\u2713") + ` Deleted profile: ${p.name}`);
   } catch (e) {
     console.error(chalk.red(e instanceof Error ? e.message : String(e)));
@@ -7287,7 +7470,7 @@ sessionCmd.command("plan").description("Produce a dry-run render plan for profil
       console.error(chalk.red(`Unsupported tool: ${opts.tool}`));
       process.exit(1);
     }
-    const sources = collectSessionSources(opts, tool);
+    const sources = await collectSessionSources(opts, tool, resolveConfigStore());
     const plan = planSessionRender({
       tool,
       profile: opts.profile,
@@ -7331,7 +7514,7 @@ sessionCmd.command("apply").description("Write a session render plan to its mana
       console.error(chalk.red(`Unsupported tool: ${opts.tool}`));
       process.exit(1);
     }
-    const sources = collectSessionSources(opts, tool);
+    const sources = await collectSessionSources(opts, tool, resolveConfigStore());
     const plan = planSessionRender({
       tool,
       profile: opts.profile,
@@ -7378,8 +7561,9 @@ sessionCmd.command("apply").description("Write a session render plan to its mana
 var snapshotCmd = program.command("snapshot").description("Manage config version history");
 snapshotCmd.command("list <config>").description("List snapshots for a config").option("--limit <n>", `max rows (default ${DEFAULT_LIST_LIMIT})`).option("--cursor <n>", "zero-based pagination cursor").action(async (configId, opts) => {
   try {
-    const c = getConfig(configId);
-    const snaps = listSnapshots(c.id);
+    const store = resolveConfigStore();
+    const c = await store.getConfig(configId);
+    const snaps = await store.listSnapshots(c.id);
     if (snaps.length === 0) {
       console.log(chalk.dim("No snapshots."));
       return;
@@ -7395,7 +7579,7 @@ snapshotCmd.command("list <config>").description("List snapshots for a config").
   }
 });
 snapshotCmd.command("show <id>").description("Show a snapshot's content").action(async (id) => {
-  const snap = getSnapshot(id);
+  const snap = await resolveConfigStore().getSnapshot(id);
   if (!snap) {
     console.error(chalk.red("Snapshot not found: " + id));
     process.exit(1);
@@ -7404,12 +7588,13 @@ snapshotCmd.command("show <id>").description("Show a snapshot's content").action
 });
 snapshotCmd.command("restore <config> <snapshot-id>").description("Restore a config to a snapshot version").action(async (configId, snapId) => {
   try {
-    const snap = getSnapshot(snapId);
+    const store = resolveConfigStore();
+    const snap = await store.getSnapshot(snapId);
     if (!snap) {
       console.error(chalk.red("Snapshot not found: " + snapId));
       process.exit(1);
     }
-    updateConfig(configId, { content: snap.content });
+    await store.updateConfig(configId, { content: snap.content });
     console.log(chalk.green("\u2713") + ` Restored ${configId} to snapshot v${snap.version}`);
   } catch (e) {
     console.error(chalk.red(e instanceof Error ? e.message : String(e)));
@@ -7419,7 +7604,7 @@ snapshotCmd.command("restore <config> <snapshot-id>").description("Restore a con
 var templateCmd = program.command("template").description("Work with template configs");
 templateCmd.command("vars <id>").description("Show template variables").action(async (id) => {
   try {
-    const c = getConfig(id);
+    const c = await resolveConfigStore().getConfig(id);
     const vars = extractTemplateVars(c.content);
     if (vars.length === 0) {
       console.log(chalk.dim("No template variables found."));
@@ -7436,7 +7621,7 @@ templateCmd.command("vars <id>").description("Show template variables").action(a
 templateCmd.command("render <id>").description("Render a template config with variables and optionally apply to disk").option("--var <vars...>", "set variables as KEY=VALUE pairs").option("--env", "use environment variables to fill template vars").option("--apply", "write rendered output to target_path").option("--dry-run", "preview rendered output without writing").action(async (id, opts) => {
   try {
     const { renderTemplate: renderTemplate2 } = await Promise.resolve().then(() => (init_template(), exports_template));
-    const c = getConfig(id);
+    const c = await resolveConfigStore().getConfig(id);
     const vars = {};
     if (opts.var) {
       for (const kv of opts.var) {
@@ -7467,9 +7652,9 @@ templateCmd.command("render <id>").description("Render a template config with va
         console.log(rendered);
       } else {
         const { writeFileSync: writeFileSync4, mkdirSync: mkdirSync6 } = await import("fs");
-        const { dirname: dirname4 } = await import("path");
+        const { dirname: dirname5 } = await import("path");
         const path = expandPath(c.target_path);
-        mkdirSync6(dirname4(path), { recursive: true });
+        mkdirSync6(dirname5(path), { recursive: true });
         writeFileSync4(path, rendered, "utf-8");
         console.log(chalk.green("\u2713") + ` Rendered and applied to ${path}`);
       }
@@ -7482,11 +7667,12 @@ templateCmd.command("render <id>").description("Render a template config with va
   }
 });
 program.command("scan [id]").description("Scan configs for secrets. Defaults to known configs only.").option("--fix", "redact found secrets in-place").option("--all", "scan every config in the DB (slow on large DBs)").option("-c, --category <cat>", "scan only a specific category").option("--limit <n>", `max findings to print (default ${DEFAULT_LIST_LIMIT})`).action(async (id, opts) => {
+  const store = resolveConfigStore();
   let configs;
   if (id) {
-    configs = [getConfig(id)];
+    configs = [await store.getConfig(id)];
   } else if (opts.all) {
-    configs = listConfigs(opts.category ? { kind: "file", category: opts.category } : { kind: "file" });
+    configs = await store.listConfigs(opts.category ? { kind: "file", category: opts.category } : { kind: "file" });
   } else {
     const { KNOWN_CONFIGS: KNOWN_CONFIGS2 } = await Promise.resolve().then(() => (init_sync(), exports_sync));
     const slugs = [
@@ -7495,10 +7681,10 @@ program.command("scan [id]").description("Scan configs for secrets. Defaults to
     const fetched = [];
     for (const slug2 of slugs) {
       try {
-        fetched.push(getConfig(slug2));
+        fetched.push(await store.getConfig(slug2));
       } catch {}
     }
-    const rules = listConfigs({ category: "rules", agent: "claude" });
+    const rules = await store.listConfigs({ category: "rules", agent: "claude" });
     for (const r of rules)
       if (!fetched.find((c) => c.id === r.id))
         fetched.push(r);
@@ -7528,7 +7714,7 @@ program.command("scan [id]").description("Scan configs for secrets. Defaults to
       }
       if (opts.fix) {
         const { content, isTemplate: isTemplate2 } = redactContent(c.content, fmt);
-        updateConfig(c.id, { content, is_template: isTemplate2 });
+        await store.updateConfig(c.id, { content, is_template: isTemplate2 });
         if (visible.length > 0)
           console.log(chalk.green("  \u2713 Redacted."));
       }
@@ -7547,6 +7733,32 @@ Run with --fix to redact in-place.`));
 Redacted all ${total} finding(s); printed ${printed}. Re-run without --fix and a higher --limit for full details.`));
   }
 });
+program.command("package-manager-scan [paths...]").description("Scan package-manager config for literal token ingress without printing values").option("--home", "also scan home .npmrc, Bun config, and shell profiles").option("--fail-on-findings", "exit nonzero when any finding is detected").option("--json", "output machine-readable JSON").option("--limit <n>", `max findings to print (default ${DEFAULT_LIST_LIMIT})`).action(async (paths, opts) => {
+  const { scanPackageManagerSecrets: scanPackageManagerSecrets2 } = await Promise.resolve().then(() => (init_package_manager_guard(), exports_package_manager_guard));
+  const roots = paths && paths.length > 0 ? paths : [process.cwd()];
+  const result = scanPackageManagerSecrets2({ roots, includeHome: !!opts.home });
+  const maxPrinted = parseLimit(opts.limit, DEFAULT_LIST_LIMIT);
+  const visible = result.findings.slice(0, maxPrinted);
+  const omitted = Math.max(0, result.findings.length - visible.length);
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else if (result.findings.length === 0) {
+    console.log(chalk.green("\u2713") + ` Package-manager scan clean (${result.scannedFiles} file(s)).`);
+  } else {
+    console.log(chalk.red(`\u2717 ${result.findings.length} package-manager finding(s) detected.`));
+    for (const finding of visible) {
+      const tracked = finding.tracked ? "tracked" : "untracked";
+      const color = finding.severity === "error" ? chalk.red : chalk.yellow;
+      console.log(color(`  ${finding.path}:${finding.line} ${finding.rule}`) + chalk.dim(` [${finding.surface}, ${tracked}] ${finding.detail}`));
+    }
+    if (omitted > 0)
+      console.log(chalk.dim(`  Omitted ${omitted} finding(s). Re-run with --limit ${result.findings.length} or --json.`));
+    console.log(chalk.dim("  Secret values are never printed by this command."));
+  }
+  if (opts.failOnFindings && result.findings.length > 0) {
+    process.exitCode = 1;
+  }
+});
 var mcpCmd = program.command("mcp").description("Install/remove MCP server for AI agents");
 mcpCmd.command("install").alias("add").description("Install configs MCP server into an agent").option("--claude", "install into Claude Code").option("--codex", "install into Codex").option("--gemini", "install into Gemini").option("--all", "install into all agents").option("--profile <level>", "set CONFIGS_PROFILE (minimal|standard|full)", "standard").action(async (opts) => {
   const targets = opts.all ? ["claude", "codex", "gemini"] : [
@@ -7560,7 +7772,7 @@ mcpCmd.command("install").alias("add").description("Install configs MCP server i
   }
   for (const target of targets) {
     try {
-      const { vars } = getMachineProfileContext({});
+      const { vars } = await getMachineProfileContext({}, resolveConfigStore());
       const mcpBinary = `${vars["BUN_BIN_DIR"]}/configs-mcp`;
       if (target === "claude") {
         const cmd = opts.profile && opts.profile !== "full" ? ["claude", "mcp", "add", "--transport", "stdio", "--scope", "user", "configs", "--", "env", `CONFIGS_PROFILE=${opts.profile}`, mcpBinary] : ["claude", "mcp", "add", "--transport", "stdio", "--scope", "user", "configs", "--", mcpBinary];
@@ -7570,14 +7782,14 @@ mcpCmd.command("install").alias("add").description("Install configs MCP server i
       } else if (target === "codex") {
         const { appendFileSync, existsSync: ex } = await import("fs");
         const { join: j } = await import("path");
-        const configPath = j(homedir6(), ".codex", "config.toml");
+        const configPath = j(homedir7(), ".codex", "config.toml");
         const block = `
 [mcp_servers.configs]
 command = "${mcpBinary}"
 args = []
 `;
         if (ex(configPath)) {
-          const content = readFileSync8(configPath, "utf-8");
+          const content = readFileSync9(configPath, "utf-8");
           if (content.includes("[mcp_servers.configs]")) {
             console.log(chalk.dim("= Already installed in Codex"));
             continue;
@@ -7588,7 +7800,7 @@ args = []
       } else if (target === "gemini") {
         const { readFileSync: rf, writeFileSync: wf, existsSync: ex } = await import("fs");
         const { join: j } = await import("path");
-        const configPath = j(homedir6(), ".gemini", "settings.json");
+        const configPath = j(homedir7(), ".gemini", "settings.json");
         let settings = {};
         if (ex(configPath)) {
           try {
@@ -7615,16 +7827,14 @@ mcpCmd.command("uninstall").alias("remove").description("Remove configs MCP serv
   }
 });
 program.command("init").description("First-time setup: sync all known configs, create default profile").option("--force", "delete existing DB and start fresh").action(async (opts) => {
-  const dbPath = join10(homedir6(), ".hasna", "configs", "configs.db");
-  if (opts.force && existsSync12(dbPath)) {
-    const { rmSync: rmSync4 } = await import("fs");
-    rmSync4(dbPath);
-    console.log(chalk.dim("Deleted existing DB."));
-    resetDatabase();
+  const store = resolveConfigStore();
+  if (opts.force) {
+    await store.reset();
+    console.log(chalk.dim("Reset local store."));
   }
   console.log(chalk.bold(`@hasna/configs \u2014 initializing
 `));
-  const result = await syncKnown({});
+  const result = await syncKnown({ store });
   console.log(chalk.green("\u2713") + ` Synced: +${result.added} updated:${result.updated} unchanged:${result.unchanged}`);
   if (result.skipped.length > 0) {
     console.log(chalk.dim("  skipped: " + result.skipped.join(", ")));
@@ -7642,35 +7852,36 @@ Keys: ANTHROPIC_API_KEY, OPENAI_API_KEY, EXA_API_KEY, NPM_TOKEN, GITHUB_TOKEN`,
   ];
   for (const ref of refs) {
     try {
-      getConfig(ref.slug);
+      await store.getConfig(ref.slug);
     } catch {
-      createConfig({ name: ref.name, category: ref.category, agent: "global", format: "markdown", content: ref.content, kind: "reference", description: ref.desc });
+      await store.createConfig({ name: ref.name, category: ref.category, agent: "global", format: "markdown", content: ref.content, kind: "reference", description: ref.desc });
     }
   }
-  ensureProjectDashboardStandardConfig();
+  await ensureProjectDashboardStandardConfig(store);
   try {
-    getProfile("my-setup");
+    await store.getProfile("my-setup");
   } catch {
-    const p = createProfile({ name: "my-setup", description: "Default profile with all known configs" });
-    const allConfigs = listConfigs();
+    const p = await store.createProfile({ name: "my-setup", description: "Default profile with all known configs" });
+    const allConfigs = await store.listConfigs();
     for (const c of allConfigs)
-      addConfigToProfile(p.id, c.id);
+      await store.addConfigToProfile(p.id, c.id);
     console.log(chalk.green("\u2713") + ` Created profile "my-setup" with ${allConfigs.length} configs`);
   }
-  const machineProfiles = ensurePlatformProfiles();
+  const machineProfiles = await ensurePlatformProfiles(store);
   console.log(chalk.green("\u2713") + ` Ensured ${machineProfiles.length} machine-aware profile(s)`);
-  const stats = getConfigStats();
+  const stats = await store.getConfigStats();
   console.log(chalk.bold(`
 DB stats:`));
   for (const [key, count] of Object.entries(stats)) {
     if (count > 0)
       console.log(`  ${key.padEnd(18)} ${count}`);
   }
+  const location = isCloudMode() ? `${process.env["HASNA_INSTRUCTIONS_API_URL"]}/v1 (self_hosted)` : process.env["CONFIGS_DB_PATH"] || join11(homedir7(), ".hasna", "configs", "configs.db");
   console.log(chalk.dim(`
-DB: ${dbPath}`));
+${isCloudMode() ? "API" : "DB"}: ${location}`));
 });
 program.command("status").description("Health check: total configs, drift from disk, unredacted secrets").option("--json", "output metadata-only JSON").action(async (opts) => {
-  const status = getConfigsStatus();
+  const status = await getConfigsStatus(resolveConfigStore());
   if (opts.json) {
     console.log(JSON.stringify(status, null, 2));
     return;
@@ -7686,17 +7897,17 @@ program.command("status").description("Health check: total configs, drift from d
 });
 program.command("backup").description("Export configs to a timestamped backup file").action(async () => {
   const { mkdirSync: mk } = await import("fs");
-  const backupDir = join10(homedir6(), ".hasna", "configs", "backups");
+  const backupDir = join11(homedir7(), ".hasna", "configs", "backups");
   mk(backupDir, { recursive: true });
   const ts = new Date().toISOString().replace(/[:.]/g, "-").replace("T", "-").slice(0, 19);
-  const outPath = join10(backupDir, `configs-${ts}.tar.gz`);
-  const result = await exportConfigs(outPath);
+  const outPath = join11(backupDir, `configs-${ts}.tar.gz`);
+  const result = await exportConfigs(outPath, { store: resolveConfigStore() });
   const { statSync: st } = await import("fs");
   const size = st(outPath).size;
   console.log(chalk.green("\u2713") + ` Backup: ${result.count} configs \u2192 ${outPath} (${(size / 1024).toFixed(1)}KB)`);
 });
 program.command("restore <file>").description("Restore configs from a backup file").option("--overwrite", "overwrite existing configs (default: skip)").action(async (file, opts) => {
-  const result = await importConfigs(file, { conflict: opts.overwrite ? "overwrite" : "skip" });
+  const result = await importConfigs(file, { conflict: opts.overwrite ? "overwrite" : "skip", store: resolveConfigStore() });
   console.log(chalk.green("\u2713") + ` Restored: +${result.created} updated:${result.updated} skipped:${result.skipped}`);
   if (result.errors.length > 0) {
     for (const e of result.errors)
@@ -7704,6 +7915,7 @@ program.command("restore <file>").description("Restore configs from a backup fil
   }
 });
 program.command("doctor").description("Validate configs: syntax, permissions, missing files, secrets").action(async () => {
+  const store = resolveConfigStore();
   let issues = 0;
   const pass = (msg) => console.log(chalk.green("  \u2713 ") + msg);
   const fail = (msg) => {
@@ -7716,12 +7928,12 @@ program.command("doctor").description("Validate configs: syntax, permissions, mi
   console.log(chalk.cyan("Known files on disk:"));
   for (const k of KNOWN_CONFIGS) {
     if (k.rulesDir) {
-      existsSync12(expandPath(k.rulesDir)) ? pass(`${k.rulesDir}/ exists`) : k.optional ? skip(`${k.rulesDir}/ (optional)`) : fail(`${k.rulesDir}/ not found`);
+      existsSync13(expandPath(k.rulesDir)) ? pass(`${k.rulesDir}/ exists`) : k.optional ? skip(`${k.rulesDir}/ (optional)`) : fail(`${k.rulesDir}/ not found`);
     } else {
-      existsSync12(expandPath(k.path)) ? pass(k.path) : k.optional ? skip(`${k.path} (optional)`) : fail(`${k.path} not found`);
+      existsSync13(expandPath(k.path)) ? pass(k.path) : k.optional ? skip(`${k.path} (optional)`) : fail(`${k.path} not found`);
     }
   }
-  const allConfigs = listConfigs();
+  const allConfigs = await store.listConfigs();
   console.log(chalk.cyan(`
 Stored configs (${allConfigs.length}):`));
   let validCount = 0;
@@ -7791,8 +8003,9 @@ complete -F _configs_completions configs`);
 });
 program.command("compare <a> <b>").description("Diff two stored configs against each other").action(async (a, b) => {
   try {
-    const configA = getConfig(a);
-    const configB = getConfig(b);
+    const store = resolveConfigStore();
+    const configA = await store.getConfig(a);
+    const configB = await store.getConfig(b);
     console.log(chalk.bold(`${configA.slug}`) + chalk.dim(` (${configA.category}/${configA.agent})`));
     console.log(chalk.bold(`${configB.slug}`) + chalk.dim(` (${configB.category}/${configB.agent})`));
     console.log();
@@ -7831,6 +8044,7 @@ ${diffs} difference(s)`));
   }
 });
 program.command("watch").description("Watch known config files for changes and auto-sync to DB").option("-i, --interval <ms>", "poll interval in milliseconds", "3000").action(async (opts) => {
+  const store = resolveConfigStore();
   const interval = Number(opts.interval);
   const { statSync: st } = await import("fs");
   const { expandPath: expandPath2 } = await Promise.resolve().then(() => (init_apply(), exports_apply));
@@ -7841,16 +8055,16 @@ program.command("watch").description("Watch known config files for changes and a
   for (const k of KNOWN_CONFIGS) {
     if (k.rulesDir) {
       const absDir = expandPath2(k.rulesDir);
-      if (!existsSync12(absDir))
+      if (!existsSync13(absDir))
         continue;
-      const { readdirSync: readdirSync3 } = await import("fs");
-      for (const f of readdirSync3(absDir).filter((f2) => f2.endsWith(".md"))) {
-        const abs = join10(absDir, f);
+      const { readdirSync: readdirSync4 } = await import("fs");
+      for (const f of readdirSync4(absDir).filter((f2) => f2.endsWith(".md"))) {
+        const abs = join11(absDir, f);
         mtimes.set(abs, st(abs).mtimeMs);
       }
     } else {
       const abs = expandPath2(k.path);
-      if (existsSync12(abs))
+      if (existsSync13(abs))
         mtimes.set(abs, st(abs).mtimeMs);
     }
   }
@@ -7858,7 +8072,7 @@ program.command("watch").description("Watch known config files for changes and a
   const tick = async () => {
     let changed = 0;
     for (const [abs, oldMtime] of mtimes) {
-      if (!existsSync12(abs))
+      if (!existsSync13(abs))
         continue;
       const newMtime = st(abs).mtimeMs;
       if (newMtime !== oldMtime) {
@@ -7870,10 +8084,10 @@ program.command("watch").description("Watch known config files for changes and a
     for (const k of KNOWN_CONFIGS) {
       if (k.rulesDir) {
         const absDir = expandPath2(k.rulesDir);
-        if (!existsSync12(absDir))
+        if (!existsSync13(absDir))
           continue;
         for (const f of rd(absDir).filter((f2) => f2.endsWith(".md"))) {
-          const abs = join10(absDir, f);
+          const abs = join11(absDir, f);
           if (!mtimes.has(abs)) {
             mtimes.set(abs, st(abs).mtimeMs);
             changed++;
@@ -7881,14 +8095,14 @@ program.command("watch").description("Watch known config files for changes and a
         }
       } else {
         const abs = expandPath2(k.path);
-        if (existsSync12(abs) && !mtimes.has(abs)) {
+        if (existsSync13(abs) && !mtimes.has(abs)) {
           mtimes.set(abs, st(abs).mtimeMs);
           changed++;
         }
       }
     }
     if (changed > 0) {
-      const result = await syncKnown({});
+      const result = await syncKnown({ store });
       const ts = new Date().toLocaleTimeString();
       console.log(`${chalk.dim(ts)} ${chalk.green("\u2713")} ${changed} file(s) changed/new \u2192 synced +${result.added} updated:${result.updated}`);
     }
@@ -7897,22 +8111,23 @@ program.command("watch").description("Watch known config files for changes and a
   await new Promise(() => {});
 });
 program.command("report").description("Summary of stored configs, drift, and ecosystem health").option("--json", "output as JSON").option("--markdown", "output as markdown").action(async () => {
-  const stats = getConfigStats();
-  const allConfigs = listConfigs();
+  const store = resolveConfigStore();
+  const stats = await store.getConfigStats();
+  const allConfigs = await store.listConfigs();
   const fileConfigs = allConfigs.filter((c) => c.kind === "file");
   const refConfigs = allConfigs.filter((c) => c.kind === "reference");
   const templates = allConfigs.filter((c) => c.is_template);
-  const profiles = listProfiles();
+  const profiles = await store.listProfiles();
   let drifted = 0, missing = 0;
   for (const c of fileConfigs) {
     if (!c.target_path)
       continue;
     const abs = expandPath(c.target_path);
-    if (!existsSync12(abs)) {
+    if (!existsSync13(abs)) {
       missing++;
       continue;
     }
-    const disk = readFileSync8(abs, "utf-8");
+    const disk = readFileSync9(abs, "utf-8");
     const { content: redactedDisk } = redactContent(disk, c.format);
     if (redactedDisk !== c.content)
       drifted++;
@@ -7944,7 +8159,8 @@ program.command("report").description("Summary of stored configs, drift, and eco
   }
 });
 program.command("clean").description("Remove configs from DB whose target files no longer exist on disk").option("--dry-run", "show what would be removed").option("--limit <n>", `max orphan rows to print (default ${DEFAULT_LIST_LIMIT})`).action(async (opts) => {
-  const configs = listConfigs({ kind: "file" });
+  const store = resolveConfigStore();
+  const configs = await store.listConfigs({ kind: "file" });
   let removed = 0;
   let printed = 0;
   const maxPrinted = parseLimit(opts.limit, DEFAULT_LIST_LIMIT);
@@ -7952,7 +8168,7 @@ program.command("clean").description("Remove configs from DB whose target files
     if (!c.target_path)
       continue;
     const abs = expandPath(c.target_path);
-    if (!existsSync12(abs)) {
+    if (!existsSync13(abs)) {
       if (printed < maxPrinted) {
         if (opts.dryRun) {
           console.log(chalk.yellow("  would remove:") + ` ${c.slug} ${chalk.dim(`(${truncateMiddle(c.target_path, 88)})`)}`);
@@ -7962,7 +8178,7 @@ program.command("clean").description("Remove configs from DB whose target files
         printed++;
       }
       if (!opts.dryRun)
-        deleteConfig(c.id);
+        await store.deleteConfig(c.id);
       removed++;
     }
   }
@@ -7977,6 +8193,7 @@ ${removed} orphaned config(s) ${opts.dryRun ? "found" : "removed"}${omitted > 0
   }
 });
 program.command("bootstrap").description("Install the full @hasna ecosystem: CLI tools + MCP servers + configs").option("--dry-run", "show what would be installed without doing it").option("--skip-mcp", "skip MCP server registration").action(async (opts) => {
+  const store = resolveConfigStore();
   const packages = [
     { name: "@hasna/todos", bin: "todos", mcp: "todos-mcp" },
     { name: "@hasna/mementos", bin: "mementos", mcp: "mementos-mcp" },
@@ -8033,7 +8250,7 @@ Registering MCP servers in Claude Code:`));
   console.log(chalk.cyan(`
 Initializing configs:`));
   if (!opts.dryRun) {
-    const result = await syncKnown({});
+    const result = await syncKnown({ store });
     console.log(chalk.green("  \u2713 ") + `Synced ${result.added + result.updated + result.unchanged} known configs`);
   } else {
     console.log(chalk.dim("  would run: configs init"));
@@ -8042,11 +8259,11 @@ Initializing configs:`));
 \u2713 Bootstrap complete.`) + chalk.dim(" Restart Claude Code for MCP servers to activate."));
 });
 program.command("pull").description("Alias for sync (read from disk into DB)").option("-a, --agent <agent>", "only sync this agent").option("--dry-run", "preview without writing").action(async (opts) => {
-  const result = await syncKnown({ dryRun: opts.dryRun, agent: opts.agent });
+  const result = await syncKnown({ dryRun: opts.dryRun, agent: opts.agent, store: resolveConfigStore() });
   console.log(chalk.green("\u2713") + ` Pulled: +${result.added} updated:${result.updated} unchanged:${result.unchanged}`);
 });
 program.command("push").description("Alias for sync --to-disk (write DB configs to disk)").option("-a, --agent <agent>", "only push this agent").option("--dry-run", "preview without writing").action(async (opts) => {
-  const result = await syncToDisk({ dryRun: opts.dryRun, agent: opts.agent });
+  const result = await syncToDisk({ dryRun: opts.dryRun, agent: opts.agent, store: resolveConfigStore() });
   console.log(chalk.green("\u2713") + ` Pushed: updated:${result.updated} unchanged:${result.unchanged} skipped:${result.skipped.length}`);
 });
 program.command("update").description("Check for updates and install latest version").option("--check", "only check, don't install").action(async (opts) => {
@@ -8070,11 +8287,14 @@ program.command("update").description("Check for updates and install latest vers
   }
 });
 program.command("feedback <message>").description("Send feedback about this service").option("-e, --email <email>", "Contact email").option("-c, --category <cat>", "Category: bug, feature, general", "general").action(async (message, opts) => {
-  const db = getDatabase();
-  db.run("INSERT INTO feedback (message, email, category, version) VALUES (?, ?, ?, ?)", [message, opts.email || null, opts.category || "general", pkg.version]);
+  await resolveConfigStore().sendFeedback({
+    message,
+    email: opts.email || null,
+    category: opts.category || "general",
+    version: pkg.version
+  });
   console.log(chalk.green("\u2713") + " Feedback saved. Thank you!");
 });
 program.version(pkg.version).name("instructions");
-registerStorageCommands(program);
 registerEventsCommands(program, { source: "configs" });
 program.parse(process.argv);