@hasna/instructions 0.3.1 → 0.4.1

package/dist/index.js

@@ -68,9 +68,12 @@ class TemplateRenderError extends Error {
     this.name = "TemplateRenderError";
   }
 }
+// src/data/config-store.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
 // src/db/database.ts
 import { Database } from "bun:sqlite";
-import { cpSync, existsSync, mkdirSync, statSync } from "fs";
+import { cpSync, existsSync, mkdirSync, rmSync, statSync } from "fs";
 import { join } from "path";
 import { randomUUID } from "crypto";
 function getDbPath() {
@@ -167,6 +170,9 @@ var _db = null;
 function getDatabase(path) {
   if (_db)
     return _db;
+  if (!path && process.env["HASNA_INSTRUCTIONS_API_URL"] && process.env["HASNA_INSTRUCTIONS_API_KEY"]) {
+    throw new Error("instructions is in self_hosted (cloud) mode: this command is not wired to the cloud API yet. " + "Unset HASNA_INSTRUCTIONS_API_URL / HASNA_INSTRUCTIONS_API_KEY to use it against the local store.");
+  }
   const dbPath = path || getDbPath();
   const db = new Database(dbPath);
   db.run("PRAGMA journal_mode = WAL");
@@ -184,6 +190,16 @@ function resetDatabase() {
   }
   _db = null;
 }
+function resetLocalDatabase() {
+  resetDatabase();
+  const dbPath = getDbPath();
+  if (dbPath === ":memory:")
+    return;
+  for (const p of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
+    if (existsSync(p))
+      rmSync(p);
+  }
+}
 function applyMigrations(db) {
   let currentVersion = 0;
   try {
@@ -209,6 +225,22 @@ function ensureFeedbackTable(db) {
       created_at TEXT NOT NULL DEFAULT (datetime('now'))
     )
   `);
+  const existing = new Set(db.query("PRAGMA table_info(feedback)").all().map((r) => r.name));
+  const required = [
+    ["email", "TEXT"],
+    ["category", "TEXT DEFAULT 'general'"],
+    ["version", "TEXT"],
+    ["machine_id", "TEXT"],
+    ["created_at", "TEXT"]
+  ];
+  for (const [name, def] of required) {
+    if (!existing.has(name))
+      db.exec(`ALTER TABLE feedback ADD COLUMN ${name} ${def}`);
+  }
+}
+function insertFeedback(input, db) {
+  const d = db || getDatabase();
+  d.run("INSERT INTO feedback (message, email, category, version) VALUES (?, ?, ?, ?)", [input.message, input.email ?? null, input.category ?? "general", input.version ?? null]);
 }
 function migrateDotfile() {
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
@@ -409,33 +441,7 @@ function getConfigStats(db) {
   }
   return stats;
 }
-// src/db/snapshots.ts
-function createSnapshot(configId, content, version, db) {
-  const d = db || getDatabase();
-  const id = uuid();
-  const ts = now();
-  d.run("INSERT INTO config_snapshots (id, config_id, content, version, created_at) VALUES (?, ?, ?, ?, ?)", [id, configId, content, version, ts]);
-  return { id, config_id: configId, content, version, created_at: ts };
-}
-function listSnapshots(configId, db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? ORDER BY version DESC").all(configId);
-}
-function getSnapshot(id, db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM config_snapshots WHERE id = ?").get(id);
-}
-function getSnapshotByVersion(configId, version, db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? AND version = ?").get(configId, version);
-}
-function pruneSnapshots(configId, keep = 10, db) {
-  const d = db || getDatabase();
-  const result = d.run(`DELETE FROM config_snapshots WHERE config_id = ? AND id NOT IN (
-      SELECT id FROM config_snapshots WHERE config_id = ? ORDER BY version DESC LIMIT ?
-    )`, [configId, configId, keep]);
-  return result.changes;
-}
+
 // src/lib/machine.ts
 import { arch as currentArch, homedir, hostname as currentHostname, type as currentOsType } from "os";
 import { existsSync as existsSync2 } from "fs";
@@ -701,6 +707,35 @@ function resolveProfileForMachine(machine = detectMachineContext(), db) {
   }).sort((a, b) => b.score - a.score || a.profile.name.localeCompare(b.profile.name));
   return matches[0]?.profile ?? null;
 }
+
+// src/db/snapshots.ts
+function createSnapshot(configId, content, version, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  const ts = now();
+  d.run("INSERT INTO config_snapshots (id, config_id, content, version, created_at) VALUES (?, ?, ?, ?, ?)", [id, configId, content, version, ts]);
+  return { id, config_id: configId, content, version, created_at: ts };
+}
+function listSnapshots(configId, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? ORDER BY version DESC").all(configId);
+}
+function getSnapshot(id, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE id = ?").get(id);
+}
+function getSnapshotByVersion(configId, version, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? AND version = ?").get(configId, version);
+}
+function pruneSnapshots(configId, keep = 10, db) {
+  const d = db || getDatabase();
+  const result = d.run(`DELETE FROM config_snapshots WHERE config_id = ? AND id NOT IN (
+      SELECT id FROM config_snapshots WHERE config_id = ? ORDER BY version DESC LIMIT ?
+    )`, [configId, configId, keep]);
+  return result.changes;
+}
+
 // src/db/machines.ts
 import { arch, hostname, type } from "os";
 function currentHostname2() {
@@ -739,358 +774,319 @@ function listMachines(db) {
   const d = db || getDatabase();
   return d.query("SELECT * FROM machines ORDER BY last_applied_at DESC NULLS LAST").all();
 }
-// src/db/pg-migrations.ts
-var PG_MIGRATIONS = [
-  `CREATE TABLE IF NOT EXISTS configs (
-    id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    slug TEXT NOT NULL UNIQUE,
-    kind TEXT NOT NULL DEFAULT 'file',
-    category TEXT NOT NULL,
-    agent TEXT NOT NULL DEFAULT 'global',
-    target_path TEXT,
-    outputs TEXT NOT NULL DEFAULT '[]',
-    format TEXT NOT NULL DEFAULT 'text',
-    content TEXT NOT NULL DEFAULT '',
-    description TEXT,
-    tags TEXT NOT NULL DEFAULT '[]',
-    is_template BOOLEAN NOT NULL DEFAULT FALSE,
-    version INTEGER NOT NULL DEFAULT 1,
-    created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL,
-    synced_at TEXT
-  )`,
-  `CREATE TABLE IF NOT EXISTS config_snapshots (
-    id TEXT PRIMARY KEY,
-    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
-    content TEXT NOT NULL,
-    version INTEGER NOT NULL,
-    created_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS profiles (
-    id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    slug TEXT NOT NULL UNIQUE,
-    description TEXT,
-    selectors TEXT NOT NULL DEFAULT '{}',
-    variables TEXT NOT NULL DEFAULT '{}',
-    created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS profile_configs (
-    profile_id TEXT NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
-    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
-    sort_order INTEGER NOT NULL DEFAULT 0,
-    PRIMARY KEY (profile_id, config_id)
-  )`,
-  `CREATE TABLE IF NOT EXISTS machines (
-    id TEXT PRIMARY KEY,
-    hostname TEXT NOT NULL UNIQUE,
-    os TEXT,
-    arch TEXT,
-    last_applied_at TEXT,
-    created_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS feedback (
-    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-    message TEXT NOT NULL,
-    email TEXT,
-    category TEXT DEFAULT 'general',
-    version TEXT,
-    machine_id TEXT,
-    created_at TEXT NOT NULL DEFAULT NOW()::text
-  )`,
-  `ALTER TABLE configs ADD COLUMN IF NOT EXISTS outputs TEXT NOT NULL DEFAULT '[]'`
-];
 
-// src/db/remote-storage.ts
-import pg from "pg";
-var DISABLED_SSL_MODE = "disable";
-function translatePlaceholders(sql) {
-  let index = 0;
-  return sql.replace(/\?/g, () => `$${++index}`);
-}
-function normalizeParams(params) {
-  const flat = params.length === 1 && Array.isArray(params[0]) ? params[0] : params;
-  return flat.map((value) => value === undefined ? null : value);
-}
-function normalizeHost(hostname2) {
-  const stripped = hostname2.replace(/^\[/, "").replace(/\]$/, "");
-  try {
-    return decodeURIComponent(stripped).toLowerCase();
-  } catch {
-    return stripped.toLowerCase();
+// src/data/config-store.ts
+class CloudHttpError extends Error {
+  status;
+  body;
+  constructor(status, message, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "CloudHttpError";
   }
 }
-function isLocalPostgresHost(hostname2) {
-  const host = normalizeHost(hostname2);
-  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "" || host.startsWith("/");
-}
-function effectivePgHost(url) {
-  const hosts = url.searchParams.getAll("host");
-  const finalHost = hosts.length > 0 ? hosts[hosts.length - 1] : null;
-  return finalHost?.trim() ? finalHost : url.hostname;
+var API_URL_ENV = "HASNA_INSTRUCTIONS_API_URL";
+var API_KEY_ENV = "HASNA_INSTRUCTIONS_API_KEY";
+function resolveCloudConfig(env = process.env) {
+  const apiUrl = env[API_URL_ENV]?.trim();
+  const apiKey = env[API_KEY_ENV]?.trim();
+  if (!apiUrl && !apiKey)
+    return null;
+  if (!apiUrl || !apiKey) {
+    throw new Error(`API mode requires BOTH ${API_URL_ENV} and ${API_KEY_ENV}; only ` + `${apiUrl ? API_URL_ENV : API_KEY_ENV} is set. Set both to use the cloud API, ` + `or unset both to use the local store.`);
+  }
+  return { apiUrl, apiKey };
 }
-function buildPgPoolConfig(connectionString) {
-  let url;
-  try {
-    url = new URL(connectionString);
-  } catch {
-    throw new Error("Invalid PostgreSQL connection string");
-  }
-  const sslMode = url.searchParams.get("sslmode")?.trim().toLowerCase();
-  const sslValue = url.searchParams.get("ssl")?.trim().toLowerCase();
-  const isLocal = isLocalPostgresHost(effectivePgHost(url));
-  const hasDisabledSsl = sslMode === DISABLED_SSL_MODE || sslValue === "false";
-  if (!isLocal && hasDisabledSsl) {
-    throw new Error("Refusing remote PostgreSQL connection with TLS disabled");
-  }
-  const shouldUseSsl = !isLocal || sslMode === "require" || sslMode === "verify-ca" || sslMode === "verify-full" || sslValue === "true";
-  url.searchParams.delete("sslmode");
-  url.searchParams.delete("ssl");
-  return {
-    connectionString: url.toString(),
-    ssl: shouldUseSsl ? { rejectUnauthorized: true } : undefined
-  };
+function isCloudMode(env = process.env) {
+  return resolveCloudConfig(env) !== null;
 }
 
-class PgAdapterAsync {
-  pool;
-  constructor(connectionString) {
-    this.pool = new pg.Pool(buildPgPoolConfig(connectionString));
+class LocalConfigStore {
+  db;
+  mode = "local";
+  constructor(db) {
+    this.db = db;
+  }
+  async listConfigs(filter) {
+    return listConfigs(filter, this.db);
+  }
+  async getConfig(idOrSlug) {
+    return getConfig(idOrSlug, this.db);
+  }
+  async getConfigById(id) {
+    return getConfigById(id, this.db);
+  }
+  async createConfig(input) {
+    return createConfig(input, this.db);
+  }
+  async updateConfig(idOrSlug, input) {
+    return updateConfig(idOrSlug, input, this.db);
+  }
+  async deleteConfig(idOrSlug) {
+    deleteConfig(idOrSlug, this.db);
   }
-  async run(sql, ...params) {
-    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
-    return { changes: result.rowCount ?? 0 };
+  async getConfigStats() {
+    return getConfigStats(this.db);
   }
-  async all(sql, ...params) {
-    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
-    return result.rows;
+  async listSnapshots(configId) {
+    return listSnapshots(configId, this.db);
   }
-  async close() {
-    await this.pool.end();
+  async getSnapshot(id) {
+    return getSnapshot(id, this.db);
+  }
+  async getSnapshotByVersion(configId, version) {
+    return getSnapshotByVersion(configId, version, this.db);
+  }
+  async createSnapshot(configId, content, version) {
+    return createSnapshot(configId, content, version, this.db);
+  }
+  async pruneSnapshots(configId, keep = 10) {
+    return pruneSnapshots(configId, keep, this.db);
+  }
+  async listProfiles() {
+    return listProfiles(this.db);
+  }
+  async getProfile(idOrSlug) {
+    return getProfile(idOrSlug, this.db);
+  }
+  async getProfileConfigs(idOrSlug) {
+    return getProfileConfigs(idOrSlug, this.db);
+  }
+  async createProfile(input) {
+    return createProfile(input, this.db);
+  }
+  async updateProfile(idOrSlug, input) {
+    return updateProfile(idOrSlug, input, this.db);
+  }
+  async deleteProfile(idOrSlug) {
+    deleteProfile(idOrSlug, this.db);
+  }
+  async addConfigToProfile(profileIdOrSlug, configId) {
+    addConfigToProfile(profileIdOrSlug, configId, this.db);
+  }
+  async removeConfigFromProfile(profileIdOrSlug, configId) {
+    removeConfigFromProfile(profileIdOrSlug, configId, this.db);
+  }
+  async resolveProfileForMachine(machine) {
+    return machine ? resolveProfileForMachine(machine, this.db) : resolveProfileForMachine(undefined, this.db);
+  }
+  async registerMachine(hostname2, os, arch2) {
+    return registerMachine(hostname2, os, arch2, this.db);
+  }
+  async updateMachineApplied(hostname2) {
+    updateMachineApplied(hostname2, this.db);
+  }
+  async listMachines() {
+    return listMachines(this.db);
+  }
+  async sendFeedback(input) {
+    insertFeedback(input, this.db);
+  }
+  async reset() {
+    resetLocalDatabase();
   }
 }
 
-// src/db/storage-sync.ts
-var STORAGE_TABLES = ["configs", "config_snapshots", "profiles", "profile_configs", "machines", "feedback"];
-var CONFIGS_STORAGE_TABLES = STORAGE_TABLES;
-var PRIMARY_KEYS = {
-  configs: ["id"],
-  config_snapshots: ["id"],
-  profiles: ["id"],
-  profile_configs: ["profile_id", "config_id"],
-  machines: ["id"],
-  feedback: ["id"]
-};
-var CONFIGS_STORAGE_ENV = "HASNA_CONFIGS_DATABASE_URL";
-var CONFIGS_STORAGE_FALLBACK_ENV = "CONFIGS_DATABASE_URL";
-var CONFIGS_STORAGE_MODE_ENV = "HASNA_CONFIGS_STORAGE_MODE";
-var CONFIGS_STORAGE_MODE_FALLBACK_ENV = "CONFIGS_STORAGE_MODE";
-var STORAGE_DATABASE_ENV = [CONFIGS_STORAGE_ENV, CONFIGS_STORAGE_FALLBACK_ENV];
-var STORAGE_MODE_ENV = [CONFIGS_STORAGE_MODE_ENV, CONFIGS_STORAGE_MODE_FALLBACK_ENV];
-function firstEnv(names) {
-  for (const name of names) {
-    const value = process.env[name];
-    if (value)
-      return value;
+class CloudConfigStore {
+  mode = "api";
+  base;
+  apiKey;
+  timeoutMs;
+  constructor(config) {
+    this.base = `${config.apiUrl.replace(/\/+$/, "")}/v1`;
+    this.apiKey = config.apiKey;
+    this.timeoutMs = config.timeoutMs ?? 30000;
+  }
+  async request(method, path, body, opts = {}) {
+    const controller = new AbortController;
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    const headers = {
+      Authorization: `Bearer ${this.apiKey}`,
+      Accept: "application/json"
+    };
+    if (body !== undefined)
+      headers["Content-Type"] = "application/json";
+    if (opts.idempotent)
+      headers["Idempotency-Key"] = randomUUID2();
+    try {
+      const res = await fetch(`${this.base}${path}`, {
+        method,
+        headers,
+        body: body === undefined ? undefined : JSON.stringify(body),
+        signal: controller.signal
+      });
+      if (res.status === 404 && opts.allow404)
+        return { status: 404, data: null };
+      const text = await res.text();
+      let parsed = null;
+      if (text) {
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          parsed = text;
+        }
+      }
+      if (!res.ok) {
+        const message = (parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : undefined) ?? `HTTP ${res.status} on ${method} ${path}`;
+        throw new CloudHttpError(res.status, message, parsed);
+      }
+      return { status: res.status, data: parsed };
+    } finally {
+      clearTimeout(timer);
+    }
   }
-  return null;
-}
-function normalizeStorageMode(value) {
-  const normalized = value?.trim().toLowerCase();
-  if (normalized === "local" || normalized === "hybrid" || normalized === "remote")
-    return normalized;
-  return;
-}
-function getStorageDatabaseUrl() {
-  return firstEnv(STORAGE_DATABASE_ENV);
-}
-function getStorageDatabaseEnvName() {
-  for (const name of STORAGE_DATABASE_ENV) {
-    if (process.env[name])
-      return name;
+  async listConfigs(filter = {}) {
+    const params = new URLSearchParams;
+    if (filter.category)
+      params.set("category", filter.category);
+    if (filter.agent)
+      params.set("agent", filter.agent);
+    if (filter.kind)
+      params.set("kind", filter.kind);
+    if (filter.search)
+      params.set("search", filter.search);
+    const qs = params.toString();
+    const { data } = await this.request("GET", `/configs${qs ? `?${qs}` : ""}`);
+    let configs = data?.configs ?? [];
+    if (filter.tags && filter.tags.length > 0) {
+      configs = configs.filter((c) => filter.tags.every((t) => c.tags.includes(t)));
+    }
+    if (filter.is_template !== undefined) {
+      configs = configs.filter((c) => c.is_template === filter.is_template);
+    }
+    return configs;
   }
-  return null;
-}
-function getStorageMode() {
-  const mode = normalizeStorageMode(firstEnv(STORAGE_MODE_ENV));
-  if (mode)
-    return mode;
-  return getStorageDatabaseUrl() ? "hybrid" : "local";
-}
-async function getStoragePg() {
-  const url = getStorageDatabaseUrl();
-  if (!url)
-    throw new Error("Missing HASNA_CONFIGS_DATABASE_URL or CONFIGS_DATABASE_URL");
-  return new PgAdapterAsync(url);
-}
-async function runStorageMigrations(remote) {
-  await remote.run("CREATE EXTENSION IF NOT EXISTS pgcrypto");
-  for (const sql of PG_MIGRATIONS)
-    await remote.run(sql);
-}
-async function storagePush(options) {
-  const remote = await getStoragePg();
-  const db = getDatabase();
-  try {
-    await runStorageMigrations(remote);
-    const results = [];
-    for (const table of resolveTables(options?.tables))
-      results.push(await pushTable(db, remote, table));
-    recordSyncMeta(db, "push", results);
-    return results;
-  } finally {
-    await remote.close();
+  async getConfig(idOrSlug) {
+    const { status, data } = await this.request("GET", `/configs/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404 || !data?.config)
+      throw new ConfigNotFoundError(idOrSlug);
+    return data.config;
   }
-}
-async function storagePull(options) {
-  const remote = await getStoragePg();
-  const db = getDatabase();
-  try {
-    await runStorageMigrations(remote);
-    const results = [];
-    for (const table of resolveTables(options?.tables))
-      results.push(await pullTable(remote, db, table));
-    recordSyncMeta(db, "pull", results);
-    return results;
-  } finally {
-    await remote.close();
+  async getConfigById(id) {
+    return this.getConfig(id);
   }
-}
-async function storageSync(options) {
-  const pull = await storagePull(options);
-  const push = await storagePush(options);
-  return { pull, push };
-}
-function getStorageSyncMetaAll() {
-  const db = getDatabase();
-  ensureSyncMetaTable(db);
-  return db.query("SELECT table_name, last_synced_at, direction FROM _configs_sync_meta ORDER BY table_name, direction").all();
-}
-function getSyncMetaAll() {
-  return getStorageSyncMetaAll();
-}
-function getStorageStatus() {
-  return {
-    configured: Boolean(getStorageDatabaseUrl()),
-    mode: getStorageMode(),
-    env: STORAGE_DATABASE_ENV,
-    service: "configs",
-    tables: STORAGE_TABLES,
-    sync: getStorageSyncMetaAll()
-  };
-}
-function resolveTables(tables) {
-  if (!tables || tables.length === 0)
-    return [...STORAGE_TABLES];
-  const allowed = new Set(STORAGE_TABLES);
-  const requested = tables.map((table) => table.trim()).filter(Boolean);
-  const invalid = requested.filter((table) => !allowed.has(table));
-  if (invalid.length > 0)
-    throw new Error(`Unknown configs sync table(s): ${invalid.join(", ")}`);
-  return requested;
-}
-async function pushTable(db, remote, table) {
-  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
-  try {
-    const rows = db.query(`SELECT * FROM ${quoteIdent(table)}`).all();
-    result.rowsRead = rows.length;
-    if (rows.length === 0)
-      return result;
-    const columns = await filterRemoteColumns(remote, table, Object.keys(rows[0]));
-    result.rowsWritten = await upsertPg(remote, table, columns, rows);
-  } catch (error) {
-    result.errors.push(error instanceof Error ? error.message : String(error));
+  async createConfig(input) {
+    const { data } = await this.request("POST", "/configs", input, {
+      idempotent: true
+    });
+    return data.config;
   }
-  return result;
-}
-async function pullTable(remote, db, table) {
-  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
-  try {
-    const rows = await remote.all(`SELECT * FROM ${quoteIdent(table)}`);
-    result.rowsRead = rows.length;
-    if (rows.length === 0)
-      return result;
-    const columns = filterLocalColumns(db, table, Object.keys(rows[0]));
-    result.rowsWritten = upsertSqlite(db, table, columns, rows);
-  } catch (error) {
-    result.errors.push(error instanceof Error ? error.message : String(error));
+  async updateConfig(idOrSlug, input) {
+    const { data } = await this.request("PATCH", `/configs/${encodeURIComponent(idOrSlug)}`, input);
+    return data.config;
   }
-  return result;
-}
-async function filterRemoteColumns(remote, table, columns) {
-  const rows = await remote.all("SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = ?", table);
-  if (rows.length === 0)
-    return columns;
-  const allowed = new Set(rows.map((row) => row.column_name));
-  return columns.filter((column) => allowed.has(column));
-}
-function filterLocalColumns(db, table, columns) {
-  const rows = db.query(`PRAGMA table_info(${quoteIdent(table)})`).all();
-  const allowed = new Set(rows.map((row) => row.name));
-  return columns.filter((column) => allowed.has(column));
-}
-async function upsertPg(remote, table, columns, rows) {
-  if (columns.length === 0)
-    return 0;
-  const primaryKeys = PRIMARY_KEYS[table];
-  const columnList = columns.map(quoteIdent).join(", ");
-  const placeholders = columns.map(() => "?").join(", ");
-  const keyList = primaryKeys.map(quoteIdent).join(", ");
-  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
-  const fallbackKey = primaryKeys[0];
-  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = EXCLUDED.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = EXCLUDED.${quoteIdent(fallbackKey)}`;
-  for (const row of rows) {
-    await remote.run(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders}) ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`, ...columns.map((column) => row[column] ?? null));
-  }
-  return rows.length;
-}
-function upsertSqlite(db, table, columns, rows) {
-  if (columns.length === 0)
-    return 0;
-  const primaryKeys = PRIMARY_KEYS[table];
-  const columnList = columns.map(quoteIdent).join(", ");
-  const placeholders = columns.map(() => "?").join(", ");
-  const keyList = primaryKeys.map(quoteIdent).join(", ");
-  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
-  const fallbackKey = primaryKeys[0];
-  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = excluded.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = excluded.${quoteIdent(fallbackKey)}`;
-  const statement = db.prepare(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders}) ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`);
-  db.transaction((batch) => {
-    for (const row of batch)
-      statement.run(...columns.map((column) => coerceForSqlite(row[column])));
-  })(rows);
-  return rows.length;
-}
-function recordSyncMeta(db, direction, results) {
-  ensureSyncMetaTable(db);
-  const now2 = new Date().toISOString();
-  const statement = db.prepare("INSERT INTO _configs_sync_meta (table_name, last_synced_at, direction) VALUES (?, ?, ?) ON CONFLICT(table_name, direction) DO UPDATE SET last_synced_at = excluded.last_synced_at");
-  for (const result of results) {
-    if (result.errors.length > 0)
-      continue;
-    statement.run(result.table, now2, direction);
+  async deleteConfig(idOrSlug) {
+    const { status } = await this.request("DELETE", `/configs/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404)
+      throw new ConfigNotFoundError(idOrSlug);
+  }
+  async getConfigStats() {
+    const { data } = await this.request("GET", "/stats");
+    return data ?? { total: 0 };
+  }
+  async listSnapshots(configId) {
+    const { data } = await this.request("GET", `/configs/${encodeURIComponent(configId)}/snapshots`);
+    return data?.snapshots ?? [];
+  }
+  async getSnapshot(id) {
+    const { status, data } = await this.request("GET", `/snapshots/${encodeURIComponent(id)}`, undefined, { allow404: true });
+    if (status === 404 || !data?.snapshot)
+      return null;
+    return data.snapshot;
+  }
+  async getSnapshotByVersion(configId, version) {
+    const { status, data } = await this.request("GET", `/configs/${encodeURIComponent(configId)}/snapshots/${version}`, undefined, { allow404: true });
+    if (status === 404 || !data?.snapshot)
+      return null;
+    return data.snapshot;
+  }
+  async createSnapshot(configId, content, version) {
+    const { data } = await this.request("POST", `/configs/${encodeURIComponent(configId)}/snapshots`, { content, version }, { idempotent: true });
+    return data.snapshot;
+  }
+  async pruneSnapshots(configId, keep = 10) {
+    const { data } = await this.request("POST", `/configs/${encodeURIComponent(configId)}/snapshots/prune`, { keep });
+    return data?.pruned ?? 0;
+  }
+  async listProfiles() {
+    const { data } = await this.request("GET", "/profiles");
+    return data?.profiles ?? [];
+  }
+  async getProfile(idOrSlug) {
+    const { status, data } = await this.request("GET", `/profiles/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404 || !data?.profile)
+      throw new ProfileNotFoundError(idOrSlug);
+    const { configs: _configs, ...profile } = data.profile;
+    return profile;
+  }
+  async getProfileConfigs(idOrSlug) {
+    const { status, data } = await this.request("GET", `/profiles/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404 || !data?.profile)
+      throw new ProfileNotFoundError(idOrSlug);
+    return data.profile.configs ?? [];
+  }
+  async createProfile(input) {
+    const { data } = await this.request("POST", "/profiles", input, {
+      idempotent: true
+    });
+    return data.profile;
+  }
+  async updateProfile(idOrSlug, input) {
+    const { data } = await this.request("PATCH", `/profiles/${encodeURIComponent(idOrSlug)}`, input);
+    return data.profile;
+  }
+  async deleteProfile(idOrSlug) {
+    const { status } = await this.request("DELETE", `/profiles/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404)
+      throw new ProfileNotFoundError(idOrSlug);
+  }
+  async addConfigToProfile(profileIdOrSlug, configId) {
+    await this.request("POST", `/profiles/${encodeURIComponent(profileIdOrSlug)}/configs`, { config_id: configId }, { idempotent: true });
+  }
+  async removeConfigFromProfile(profileIdOrSlug, configId) {
+    await this.request("DELETE", `/profiles/${encodeURIComponent(profileIdOrSlug)}/configs/${encodeURIComponent(configId)}`, undefined, { allow404: true });
+  }
+  async resolveProfileForMachine(machine) {
+    const params = new URLSearchParams;
+    if (machine?.hostname)
+      params.set("hostname", machine.hostname);
+    if (machine?.os)
+      params.set("os", machine.os);
+    if (machine?.arch)
+      params.set("arch", machine.arch);
+    const qs = params.toString();
+    const { status, data } = await this.request("GET", `/profiles/resolve${qs ? `?${qs}` : ""}`, undefined, { allow404: true });
+    if (status === 404 || !data?.profile)
+      return null;
+    return data.profile;
+  }
+  async registerMachine(hostname2, os, arch2) {
+    const { data } = await this.request("POST", "/machines", { hostname: hostname2, os, arch: arch2 }, { idempotent: true });
+    return data.machine;
+  }
+  async updateMachineApplied(hostname2) {
+    await this.request("POST", "/machines/applied", { hostname: hostname2 });
+  }
+  async listMachines() {
+    const { data } = await this.request("GET", "/machines");
+    return data?.machines ?? [];
+  }
+  async sendFeedback(input) {
+    await this.request("POST", "/feedback", {
+      message: input.message,
+      email: input.email ?? undefined,
+      category: input.category ?? undefined,
+      version: input.version ?? undefined
+    });
+  }
+  async reset() {
+    throw new Error("`init --force` cannot wipe the shared cloud store from a client. " + "Unset HASNA_INSTRUCTIONS_API_URL / HASNA_INSTRUCTIONS_API_KEY to reset the local store instead.");
   }
 }
-function ensureSyncMetaTable(db) {
-  db.exec("CREATE TABLE IF NOT EXISTS _configs_sync_meta (table_name TEXT NOT NULL, last_synced_at TEXT, direction TEXT NOT NULL CHECK(direction IN ('push', 'pull')), PRIMARY KEY (table_name, direction))");
-}
-function quoteIdent(identifier) {
-  return `"${identifier.replace(/"/g, '""')}"`;
-}
-function coerceForSqlite(value) {
-  if (value === undefined || value === null)
-    return null;
-  if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean")
-    return value;
-  if (value instanceof Date)
-    return value.toISOString();
-  if (Buffer.isBuffer(value) || value instanceof Uint8Array)
-    return value;
-  if (typeof value === "object")
-    return JSON.stringify(value);
-  return String(value);
+function resolveConfigStore(env = process.env) {
+  const cloud = resolveCloudConfig(env);
+  return cloud ? new CloudConfigStore(cloud) : new LocalConfigStore;
 }
 // src/status.ts
 import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
@@ -1255,8 +1251,8 @@ async function writeConfigResult(config, targetPath, content, opts, meta = {}) {
       mkdirSync2(dir, { recursive: true });
     }
     if (previousContent !== null && changed) {
-      const db = opts.db || getDatabase();
-      createSnapshot(config.id, previousContent, config.version, db);
+      const store = opts.store ?? resolveConfigStore();
+      await store.createSnapshot(config.id, previousContent, config.version);
     }
     writeFileSync(path, renderedContent, "utf-8");
   }
@@ -1282,8 +1278,8 @@ async function applyConfig(config, opts = {}) {
   if (config.kind === "reference" || (!config.target_path || !shouldApplyPrimary) && selectedOutputs.length === 0) {
     throw new ConfigApplyError(`Config "${config.name}" is a reference (kind=reference) and has no target_path \u2014 cannot apply to disk.`);
   }
-  const db = opts.db || getDatabase();
-  const contextConfigs = selectedOutputs.length > 0 || config.target_path ? listConfigs(undefined, db) : [config];
+  const store = opts.store ?? resolveConfigStore();
+  const contextConfigs = selectedOutputs.length > 0 || config.target_path ? await store.listConfigs() : [config];
   if (isGeneratedOutputTarget(config, contextConfigs)) {
     throw new ConfigApplyError(`Config "${config.name}" targets a generated output path. Apply the canonical source config instead.`);
   }
@@ -1304,7 +1300,7 @@ async function applyConfig(config, opts = {}) {
     };
   }
   if (!opts.dryRun) {
-    updateConfig(config.id, { synced_at: now() }, db);
+    await store.updateConfig(config.id, { synced_at: new Date().toISOString() });
   }
   return result;
 }
@@ -1420,9 +1416,9 @@ function redactIni(content) {
   for (let i = 0;i < lines.length; i++) {
     const line = lines[i];
     const authM = line.match(/^(\/\/[^:]+:_authToken=)(.+)$/);
-    if (authM && !authM[2].startsWith("{{")) {
-      redacted.push({ varName: "NPM_AUTH_TOKEN", line: i + 1, reason: "npm auth token" });
-      out.push(`${authM[1]}{{NPM_AUTH_TOKEN}}`);
+    if (authM && !isReferenceValue(authM[2].trim())) {
+      redacted.push({ varName: "NPM_TOKEN", line: i + 1, reason: "npm auth token" });
+      out.push(`${authM[1]}\${NPM_TOKEN}`);
       continue;
     }
     const m = line.match(/^(\s*)([a-zA-Z][a-zA-Z0-9_\-]*)(\s*=\s*)(.+?)\s*$/);
@@ -1462,6 +1458,8 @@ function redactGeneric(content) {
 function shouldRedactKeyValue(key, value) {
   if (!value || value.startsWith("{{"))
     return false;
+  if (isReferenceValue(value.trim()))
+    return false;
   if (value.length < MIN_SECRET_VALUE_LEN)
     return false;
   if (/^(true|false|yes|no|on|off|null|undefined|\d+)$/i.test(value))
@@ -1483,6 +1481,9 @@ function reasonFor(key, value) {
   }
   return "secret value pattern";
 }
+function isReferenceValue(value) {
+  return /^\{\{[A-Z][A-Z0-9_]*\}\}$/.test(value) || /^\$\{[A-Z][A-Z0-9_]*\}$/.test(value) || /^\$[A-Z][A-Z0-9_]*$/.test(value) || /^%[A-Z][A-Z0-9_]*%$/.test(value);
+}
 function redactContent(content, format) {
   switch (format) {
     case "shell":
@@ -1529,21 +1530,13 @@ function countBy(items, getValue) {
   }
   return counts;
 }
-function tableCount(db, table) {
-  try {
-    const row = db.query(`SELECT COUNT(*) AS count FROM ${table}`).get();
-    return Number(row?.count ?? 0);
-  } catch {
-    return 0;
-  }
-}
-function getConfigsStatus(db = getDatabase()) {
+async function getConfigsStatus(store = resolveConfigStore()) {
   let databaseReachable = true;
   let configs = [];
   let categoryStats = { total: 0 };
   try {
-    configs = listConfigs(undefined, db);
-    categoryStats = getConfigStats(db);
+    configs = await store.listConfigs();
+    categoryStats = await store.getConfigStats();
   } catch {
     databaseReachable = false;
   }
@@ -1568,10 +1561,25 @@ function getConfigsStatus(db = getDatabase()) {
       driftedTargets += 1;
     }
   }
-  const profiles = databaseReachable ? listProfiles(db).length : 0;
-  const machines = databaseReachable ? listMachines(db).length : 0;
-  const profileLinks = databaseReachable ? tableCount(db, "profile_configs") : 0;
-  const snapshots = databaseReachable ? tableCount(db, "config_snapshots") : 0;
+  let profiles = 0;
+  let machines = 0;
+  let profileLinks = 0;
+  let snapshots = 0;
+  if (databaseReachable) {
+    try {
+      const profileList = await store.listProfiles();
+      profiles = profileList.length;
+      machines = (await store.listMachines()).length;
+      for (const profile of profileList) {
+        profileLinks += (await store.getProfileConfigs(profile.id)).length;
+      }
+      for (const config of configs) {
+        snapshots += (await store.listSnapshots(config.id)).length;
+      }
+    } catch {
+      databaseReachable = false;
+    }
+  }
   const byCategory = Object.fromEntries(Object.entries(categoryStats).filter(([key]) => key !== "total"));
   const status = databaseReachable && driftedTargets === 0 && missingTargets === 0 && unredactedSecretFindings === 0 ? "ok" : "warn";
   return {
@@ -1624,6 +1632,69 @@ function getConfigsStatus(db = getDatabase()) {
     }
   };
 }
+// src/db/pg-migrations.ts
+var PG_MIGRATIONS = [
+  `CREATE TABLE IF NOT EXISTS configs (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    slug TEXT NOT NULL UNIQUE,
+    kind TEXT NOT NULL DEFAULT 'file',
+    category TEXT NOT NULL,
+    agent TEXT NOT NULL DEFAULT 'global',
+    target_path TEXT,
+    outputs TEXT NOT NULL DEFAULT '[]',
+    format TEXT NOT NULL DEFAULT 'text',
+    content TEXT NOT NULL DEFAULT '',
+    description TEXT,
+    tags TEXT NOT NULL DEFAULT '[]',
+    is_template BOOLEAN NOT NULL DEFAULT FALSE,
+    version INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    synced_at TEXT
+  )`,
+  `CREATE TABLE IF NOT EXISTS config_snapshots (
+    id TEXT PRIMARY KEY,
+    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
+    content TEXT NOT NULL,
+    version INTEGER NOT NULL,
+    created_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS profiles (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    slug TEXT NOT NULL UNIQUE,
+    description TEXT,
+    selectors TEXT NOT NULL DEFAULT '{}',
+    variables TEXT NOT NULL DEFAULT '{}',
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS profile_configs (
+    profile_id TEXT NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
+    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
+    sort_order INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (profile_id, config_id)
+  )`,
+  `CREATE TABLE IF NOT EXISTS machines (
+    id TEXT PRIMARY KEY,
+    hostname TEXT NOT NULL UNIQUE,
+    os TEXT,
+    arch TEXT,
+    last_applied_at TEXT,
+    created_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS feedback (
+    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+    message TEXT NOT NULL,
+    email TEXT,
+    category TEXT DEFAULT 'general',
+    version TEXT,
+    machine_id TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `ALTER TABLE configs ADD COLUMN IF NOT EXISTS outputs TEXT NOT NULL DEFAULT '[]'`
+];
 // src/lib/session-render.ts
 import { createHash } from "crypto";
 import { existsSync as existsSync5, readFileSync as readFileSync3, realpathSync as realpathSync2, statSync as statSync2 } from "fs";
@@ -2501,14 +2572,14 @@ function asStringArray(value) {
   return value.filter((item) => typeof item === "string");
 }
 // src/lib/session-apply.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 import {
   existsSync as existsSync6,
   lstatSync,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync4,
   renameSync,
-  rmSync,
+  rmSync as rmSync2,
   writeFileSync as writeFileSync2
 } from "fs";
 import { dirname as dirname3, isAbsolute as isAbsolute2, join as join4, parse as parse2, relative as relative2, resolve as resolve3 } from "path";
@@ -2562,7 +2633,7 @@ function applySessionRender(plan, options = {}) {
         continue;
       assertNoSymlinkSegments(targetHome, result.path);
       if (existsSync6(result.path))
-        rmSync(result.path);
+        rmSync2(result.path);
     }
   }
   return {
@@ -2796,7 +2867,7 @@ function writePlannedFile(path, content, targetHome) {
   const dir = dirname3(path);
   mkdirSync3(dir, { recursive: true });
   assertNoSymlinkSegments(targetHome, path);
-  const tmp = join4(dir, `.session-${randomUUID2()}.tmp`);
+  const tmp = join4(dir, `.session-${randomUUID3()}.tmp`);
   writeFileSync2(tmp, content, "utf-8");
   renameSync(tmp, path);
 }
@@ -2814,7 +2885,7 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
   if (!previousManifest && existingFiles.length === 0)
     return null;
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
-  const snapshotPath = resolve3(targetHome, ".hasna", "session-render-snapshots", `${timestamp}-${randomUUID2()}.json`);
+  const snapshotPath = resolve3(targetHome, ".hasna", "session-render-snapshots", `${timestamp}-${randomUUID3()}.json`);
   const snapshot = {
     schema: "hasna.configs.session-render-snapshot/v1",
     createdAt: new Date().toISOString(),
@@ -2948,7 +3019,7 @@ ids, tasks, and evidence refs. Exclude raw email bodies, account numbers, tax
 ids, passport numbers, credentials, and contract clauses unless an explicit
 approved storage policy exists.
 `;
-function ensureProjectDashboardStandardConfig(db) {
+async function ensureProjectDashboardStandardConfig(store = resolveConfigStore()) {
   const input = {
     name: "Agent Managed Project Dashboard Standard",
     category: "workspace",
@@ -2960,17 +3031,21 @@ function ensureProjectDashboardStandardConfig(db) {
     tags: ["projects-dashboard", "agent-projects", "json-render"]
   };
   try {
-    const existing = getConfig(PROJECT_DASHBOARD_STANDARD_SLUG, db);
+    const existing = await store.getConfig(PROJECT_DASHBOARD_STANDARD_SLUG);
     if (existing.content !== input.content || existing.description !== input.description || existing.category !== input.category || existing.agent !== input.agent || existing.format !== input.format || existing.kind !== input.kind) {
-      return updateConfig(existing.id, input, db);
+      return await store.updateConfig(existing.id, input);
     }
     return existing;
   } catch {
-    return createConfig(input, db);
+    return await store.createConfig(input);
   }
 }
 
 // src/lib/platform-profiles.ts
+function profileHasSelectors2(profile) {
+  const selectors = profile.selectors ?? {};
+  return (selectors.os?.length ?? 0) > 0 || (selectors.arch?.length ?? 0) > 0 || (selectors.hostnames?.length ?? 0) > 0;
+}
 var PLATFORM_PROFILE_PRESETS = [
   {
     name: "linux-arm64",
@@ -2997,25 +3072,25 @@ var PLATFORM_PROFILE_PRESETS = [
     }
   }
 ];
-function ensurePlatformProfiles(db) {
-  const configs = listConfigs(undefined, db);
+async function ensurePlatformProfiles(store = resolveConfigStore()) {
+  const configs = await store.listConfigs();
   const ensured = [];
   for (const preset of PLATFORM_PROFILE_PRESETS) {
     let profile;
     try {
-      profile = getProfile(preset.name, db);
-      if (!profileHasSelectors(profile) || Object.keys(profile.variables).length === 0) {
-        profile = updateProfile(profile.id, {
+      profile = await store.getProfile(preset.name);
+      if (!profileHasSelectors2(profile) || Object.keys(profile.variables).length === 0) {
+        profile = await store.updateProfile(profile.id, {
           description: profile.description ?? preset.description,
-          selectors: profileHasSelectors(profile) ? profile.selectors : preset.selectors,
+          selectors: profileHasSelectors2(profile) ? profile.selectors : preset.selectors,
           variables: Object.keys(profile.variables).length > 0 ? profile.variables : preset.variables
-        }, db);
+        });
       }
     } catch {
-      profile = createProfile(preset, db);
+      profile = await store.createProfile(preset);
     }
     for (const config of configs) {
-      addConfigToProfile(profile.id, config.id, db);
+      await store.addConfigToProfile(profile.id, config.id);
     }
     ensured.push(profile);
   }
@@ -3034,14 +3109,14 @@ function shouldSkip(p) {
   return SKIP.some((s) => p.includes(s));
 }
 async function syncFromDir(dir, opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const absDir = expandPath(dir);
   if (!existsSync7(absDir))
     return { added: 0, updated: 0, unchanged: 0, skipped: [`Not found: ${absDir}`] };
   const files = opts.recursive !== false ? walkDir(absDir) : readdirSync(absDir).map((f) => join5(absDir, f)).filter((f) => statSync3(f).isFile());
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
   const home = homedir4();
-  const allConfigs = listConfigs(undefined, d);
+  const allConfigs = await store.listConfigs();
   for (const file of files) {
     if (shouldSkip(file)) {
       result.skipped.push(file);
@@ -3057,11 +3132,11 @@ async function syncFromDir(dir, opts = {}) {
       const existing = allConfigs.find((c) => c.target_path === targetPath);
       if (!existing) {
         if (!opts.dryRun)
-          createConfig({ name: relative3(absDir, file), category: detectCategory(file), agent: detectAgent(file), target_path: targetPath, format: detectFormat(file), content }, d);
+          await store.createConfig({ name: relative3(absDir, file), category: detectCategory(file), agent: detectAgent(file), target_path: targetPath, format: detectFormat(file), content });
         result.added++;
       } else if (existing.content !== content) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { content }, d);
+          await store.updateConfig(existing.id, { content });
         result.updated++;
       } else {
         result.unchanged++;
@@ -3073,17 +3148,17 @@ async function syncFromDir(dir, opts = {}) {
   return result;
 }
 async function syncToDir(dir, opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const home = homedir4();
   const absDir = expandPath(dir);
   const normalized = dir.startsWith("~/") ? dir : absDir.replace(home, "~");
-  const configs = listConfigs(undefined, d).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
+  const configs = (await store.listConfigs()).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
   for (const config of configs) {
     if (config.kind === "reference")
       continue;
     try {
-      const r = await applyConfig(config, { dryRun: opts.dryRun, db: d });
+      const r = await applyConfig(config, { dryRun: opts.dryRun, store });
       r.changed ? result.updated++ : result.unchanged++;
     } catch {
       result.skipped.push(config.target_path || config.id);
@@ -3201,11 +3276,11 @@ var PROJECT_CONFIG_FILES = [
   { file: ".cursor/mcp.json", category: "mcp", agent: "cursor", format: "json" }
 ];
 async function syncProject(opts) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const absDir = expandPath(opts.projectDir);
   const projectName = absDir.split("/").pop() || "project";
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
-  const allConfigs = listConfigs(undefined, d);
+  const allConfigs = await store.listConfigs();
   const machine = detectMachineContext();
   for (const pf of PROJECT_CONFIG_FILES) {
     const abs = join6(absDir, pf.file);
@@ -3227,11 +3302,11 @@ async function syncProject(opts) {
       const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === slug2);
       if (!existing) {
         if (!opts.dryRun)
-          createConfig({ name, category: pf.category, agent: pf.agent, format: pf.format, content, target_path: targetPath, is_template: isTemplate2 }, d);
+          await store.createConfig({ name, category: pf.category, agent: pf.agent, format: pf.format, content, target_path: targetPath, is_template: isTemplate2 });
         result.added++;
       } else if (existing.content !== content) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { content, is_template: isTemplate2 }, d);
+          await store.updateConfig(existing.id, { content, is_template: isTemplate2 });
         result.updated++;
       } else {
         result.unchanged++;
@@ -3256,11 +3331,11 @@ async function syncProject(opts) {
       const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === slug2);
       if (!existing) {
         if (!opts.dryRun)
-          createConfig({ name, category: "rules", agent: "claude", format: "markdown", content, target_path: targetPath, is_template: isTemplate2 }, d);
+          await store.createConfig({ name, category: "rules", agent: "claude", format: "markdown", content, target_path: targetPath, is_template: isTemplate2 });
         result.added++;
       } else if (existing.content !== content) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { content, is_template: isTemplate2 }, d);
+          await store.updateConfig(existing.id, { content, is_template: isTemplate2 });
         result.updated++;
       } else {
         result.unchanged++;
@@ -3270,7 +3345,7 @@ async function syncProject(opts) {
   return result;
 }
 async function syncKnown(opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
   const home = getConfigHome();
   const machine = detectMachineContext();
@@ -3279,7 +3354,7 @@ async function syncKnown(opts = {}) {
     targets = targets.filter((k) => k.agent === opts.agent);
   if (opts.category)
     targets = targets.filter((k) => k.category === opts.category);
-  const allConfigs = listConfigs(undefined, d);
+  const allConfigs = await store.listConfigs();
   const existingOutputOwners = outputOwnerIdsByTarget(allConfigs);
   for (const known of targets) {
     if (known.rulesDir) {
@@ -3308,15 +3383,15 @@ async function syncKnown(opts = {}) {
         const outputs = known.agent === "claude" ? claudeRuleOutputs(f) : known.outputs;
         if (!existing) {
           if (!opts.dryRun)
-            createConfig({ name, category: known.category, agent: known.agent, format: "markdown", content, target_path: targetPath, is_template: isTemplate2, outputs }, d);
+            await store.createConfig({ name, category: known.category, agent: known.agent, format: "markdown", content, target_path: targetPath, is_template: isTemplate2, outputs });
           result.added++;
         } else if (existing.content !== content) {
           if (!opts.dryRun)
-            updateConfig(existing.id, { content, is_template: isTemplate2, outputs }, d);
+            await store.updateConfig(existing.id, { content, is_template: isTemplate2, outputs });
           result.updated++;
         } else if (!outputsEqual(existing.outputs, outputs)) {
           if (!opts.dryRun)
-            updateConfig(existing.id, { outputs }, d);
+            await store.updateConfig(existing.id, { outputs });
           result.updated++;
         } else {
           result.unchanged++;
@@ -3348,7 +3423,7 @@ async function syncKnown(opts = {}) {
       const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === known.name);
       if (!existing) {
         if (!opts.dryRun) {
-          createConfig({
+          await store.createConfig({
             name: known.name,
             category: known.category,
             agent: known.agent,
@@ -3359,16 +3434,16 @@ async function syncKnown(opts = {}) {
             description: known.description,
             is_template: isTemplate2,
             outputs: known.outputs
-          }, d);
+          });
         }
         result.added++;
       } else if (existing.content !== content) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { content, is_template: isTemplate2, outputs: known.outputs }, d);
+          await store.updateConfig(existing.id, { content, is_template: isTemplate2, outputs: known.outputs });
         result.updated++;
       } else if (!outputsEqual(existing.outputs, known.outputs)) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { outputs: known.outputs }, d);
+          await store.updateConfig(existing.id, { outputs: known.outputs });
         result.updated++;
       } else {
         result.unchanged++;
@@ -3380,9 +3455,9 @@ async function syncKnown(opts = {}) {
   return result;
 }
 async function syncToDisk(opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
-  const allFileConfigs = listConfigs({ kind: "file", ...opts.category ? { category: opts.category } : {} }, d);
+  const allFileConfigs = await store.listConfigs({ kind: "file", ...opts.category ? { category: opts.category } : {} });
   const outputOwners = outputOwnerIdsByTarget(allFileConfigs);
   let configs = allFileConfigs.filter((config) => {
     return !isGeneratedOutputTarget2(config, outputOwners);
@@ -3395,7 +3470,7 @@ async function syncToDisk(opts = {}) {
     if (!config.target_path && config.outputs.length === 0)
       continue;
     try {
-      const r = await applyConfig(config, { dryRun: opts.dryRun, db: d, outputAgent: opts.agent });
+      const r = await applyConfig(config, { dryRun: opts.dryRun, store, outputAgent: opts.agent });
       r.changed ? result.updated++ : result.unchanged++;
     } catch {
       result.skipped.push(config.target_path ?? config.id);
@@ -3432,12 +3507,12 @@ function buildDiff(expectedContent, targetPath) {
   return lines.join(`
 `);
 }
-function diffConfig(config, opts = {}) {
+async function diffConfig(config, opts = {}) {
   if (!config.target_path && config.outputs.length === 0)
     return "(reference \u2014 no target path)";
   const diffs = [];
-  const db = opts.db || getDatabase();
-  const contextConfigs = config.outputs.length > 0 || config.target_path ? listConfigs(undefined, db) : [config];
+  const store = opts.store ?? resolveConfigStore();
+  const contextConfigs = config.outputs.length > 0 || config.target_path ? await store.listConfigs() : [config];
   if (isGeneratedOutputTarget2(config, outputOwnerIdsByTarget(contextConfigs))) {
     return "(generated output \u2014 managed by fan-out)";
   }
@@ -3515,12 +3590,12 @@ function detectFormat(filePath) {
   return "text";
 }
 // src/lib/export.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join7, resolve as resolve4 } from "path";
 import { tmpdir } from "os";
 async function exportConfigs(outputPath, opts = {}) {
-  const d = opts.db || getDatabase();
-  const configs = listConfigs(opts.filter, d);
+  const store = opts.store ?? resolveConfigStore();
+  const configs = await store.listConfigs(opts.filter);
   const absOutput = resolve4(outputPath);
   const tmpDir = join7(tmpdir(), `configs-export-${Date.now()}`);
   const contentsDir = join7(tmpDir, "contents");
@@ -3528,7 +3603,7 @@ async function exportConfigs(outputPath, opts = {}) {
     mkdirSync4(contentsDir, { recursive: true });
     const manifest = {
       version: "1.0.0",
-      exported_at: now(),
+      exported_at: new Date().toISOString(),
       configs: configs.map(({ content: _content, ...meta }) => meta)
     };
     writeFileSync3(join7(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
@@ -3548,16 +3623,16 @@ async function exportConfigs(outputPath, opts = {}) {
     return { path: absOutput, count: configs.length };
   } finally {
     if (existsSync9(tmpDir)) {
-      rmSync2(tmpDir, { recursive: true, force: true });
+      rmSync3(tmpDir, { recursive: true, force: true });
     }
   }
 }
 // src/lib/import.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync7, rmSync as rmSync4 } from "fs";
 import { join as join8, resolve as resolve5 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 async function importConfigs(bundlePath, opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const conflict = opts.conflict ?? "skip";
   const absPath = resolve5(bundlePath);
   const tmpDir = join8(tmpdir2(), `configs-import-${Date.now()}`);
@@ -3584,17 +3659,17 @@ async function importConfigs(bundlePath, opts = {}) {
         const content = existsSync10(contentFile) ? readFileSync7(contentFile, "utf-8") : "";
         let existing = null;
         try {
-          existing = getConfig(meta.slug, d);
+          existing = await store.getConfig(meta.slug);
         } catch {}
         if (existing) {
           if (conflict === "skip") {
             result.skipped++;
           } else if (conflict === "overwrite" || conflict === "version") {
-            updateConfig(existing.id, { content, description: meta.description ?? undefined, tags: meta.tags, outputs: meta.outputs }, d);
+            await store.updateConfig(existing.id, { content, description: meta.description ?? undefined, tags: meta.tags, outputs: meta.outputs });
             result.updated++;
           }
         } else {
-          createConfig({
+          await store.createConfig({
             name: meta.name,
             kind: meta.kind,
             category: meta.category,
@@ -3606,7 +3681,7 @@ async function importConfigs(bundlePath, opts = {}) {
             description: meta.description ?? undefined,
             tags: meta.tags,
             is_template: meta.is_template
-          }, d);
+          });
           result.created++;
         }
       } catch (err) {
@@ -3616,15 +3691,397 @@ async function importConfigs(bundlePath, opts = {}) {
     return result;
   } finally {
     if (existsSync10(tmpDir)) {
-      rmSync3(tmpDir, { recursive: true, force: true });
+      rmSync4(tmpDir, { recursive: true, force: true });
+    }
+  }
+}
+// src/lib/package-manager-guard.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync11, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "fs";
+import { homedir as homedir5 } from "os";
+import { basename as basename5, dirname as dirname4, isAbsolute as isAbsolute3, join as join9, relative as relative4, resolve as resolve6 } from "path";
+var SKIP_DIRS = new Set([
+  ".git",
+  "node_modules",
+  "dist",
+  "build",
+  "coverage",
+  ".next",
+  ".turbo",
+  ".cache"
+]);
+var LOCKFILE_NAMES = new Set([
+  "bun.lock",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "pnpm-lock.yaml",
+  "yarn.lock"
+]);
+var HOME_FILES = [
+  ".npmrc",
+  ".bunfig.toml",
+  "bunfig.toml",
+  ".bashrc",
+  ".bash_profile",
+  ".zshrc",
+  ".zprofile",
+  ".profile"
+];
+var TOKEN_VALUE_PATTERNS = [
+  { re: /npm_[A-Za-z0-9]{36,}/, rule: "literal-npm-token", detail: "literal npm token-like value" },
+  { re: /gh[pousr]_[A-Za-z0-9_]{36,}/, rule: "literal-github-token", detail: "literal GitHub token-like value" },
+  { re: /sk-ant-[A-Za-z0-9\-_]{40,}/, rule: "literal-anthropic-key", detail: "literal Anthropic key-like value" },
+  { re: /sk-[A-Za-z0-9]{48,}/, rule: "literal-openai-key", detail: "literal OpenAI key-like value" },
+  { re: /AKIA[0-9A-Z]{16}/, rule: "literal-aws-access-key", detail: "literal AWS access-key-like value" },
+  { re: /xoxb-[0-9]+-[A-Za-z0-9-]+/, rule: "literal-slack-token", detail: "literal Slack token-like value" }
+];
+function scanPackageManagerSecrets(options = {}) {
+  const cwd = options.cwd ? resolve6(options.cwd) : process.cwd();
+  const roots = (options.roots && options.roots.length > 0 ? options.roots : [cwd]).map((root) => resolve6(cwd, root));
+  const findings = [];
+  let scannedFiles = 0;
+  for (const root of roots) {
+    if (!existsSync11(root))
+      continue;
+    const stat = lstatSync2(root);
+    if (stat.isFile()) {
+      if (!shouldScanRepoFile(root))
+        continue;
+      const text = readTextFile(root);
+      if (text === null)
+        continue;
+      scannedFiles++;
+      findings.push(...scanFile(root, text, classifyRepoFile(root), isTrackedFile(root), dirname4(root)));
+      continue;
+    }
+    if (!stat.isDirectory())
+      continue;
+    const tracked = trackedFiles(root);
+    for (const file of collectRepoFiles(root)) {
+      const rel = toPosix(relative4(root, file));
+      const isTracked = tracked.has(rel);
+      const text = readTextFile(file);
+      if (text === null)
+        continue;
+      scannedFiles++;
+      findings.push(...scanFile(file, text, classifyRepoFile(file), isTracked, root));
+    }
+  }
+  if (options.includeHome) {
+    const home = homedir5();
+    for (const name of HOME_FILES) {
+      const file = join9(home, name);
+      if (!existsSync11(file))
+        continue;
+      const text = readTextFile(file);
+      if (text === null)
+        continue;
+      scannedFiles++;
+      findings.push(...scanFile(file, text, classifyHomeFile(name), false, home));
+    }
+  }
+  findings.sort((a, b) => a.path.localeCompare(b.path) || a.line - b.line || a.rule.localeCompare(b.rule));
+  return {
+    clean: findings.length === 0,
+    scannedFiles,
+    scannedRoots: roots,
+    findings
+  };
+}
+function collectRepoFiles(root) {
+  const out = [];
+  const visit = (dir) => {
+    for (const entry of readdirSync3(dir, { withFileTypes: true })) {
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS.has(entry.name))
+          continue;
+        visit(join9(dir, entry.name));
+        continue;
+      }
+      if (!entry.isFile())
+        continue;
+      const file = join9(dir, entry.name);
+      if (shouldScanRepoFile(file))
+        out.push(file);
+    }
+  };
+  visit(root);
+  return out;
+}
+function shouldScanRepoFile(file) {
+  const name = basename5(file);
+  return isNpmrcName(name) || isBunConfigName(name) || LOCKFILE_NAMES.has(name);
+}
+function classifyRepoFile(file) {
+  const name = basename5(file);
+  if (isNpmrcName(name))
+    return "repo-npmrc";
+  if (isBunConfigName(name))
+    return "bun-config";
+  return "lockfile";
+}
+function classifyHomeFile(name) {
+  if (name === ".npmrc")
+    return "home-npmrc";
+  if (isBunConfigName(name))
+    return "bun-config";
+  return "shell-profile";
+}
+function isBunConfigName(name) {
+  return name === "bunfig.toml" || name === ".bunfig.toml";
+}
+function isNpmrcName(name) {
+  return name === ".npmrc" || name.startsWith(".npmrc.") || name.endsWith(".npmrc");
+}
+function readTextFile(file) {
+  try {
+    const stat = lstatSync2(file);
+    if (!stat.isFile() || stat.size > 5000000)
+      return null;
+    const buf = readFileSync8(file);
+    if (buf.includes(0))
+      return null;
+    return buf.toString("utf-8");
+  } catch {
+    return null;
+  }
+}
+function scanFile(file, text, surface, tracked, root) {
+  const findings = [];
+  const path = displayPath(file, root);
+  if (surface === "bun-config")
+    return scanBunConfigFile(text, path, tracked);
+  const lines = text.split(/\r?\n/);
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const lineNo = i + 1;
+    if (surface === "repo-npmrc" || surface === "home-npmrc") {
+      findings.push(...scanNpmrcLine(line, path, lineNo, surface, tracked));
+    } else if (surface === "shell-profile") {
+      findings.push(...scanShellProfileLine(line, path, lineNo, tracked));
+    } else {
+      findings.push(...scanLockfileLine(line, path, lineNo, tracked));
+    }
+  }
+  return findings;
+}
+function scanNpmrcLine(lineText, path, line, surface, tracked) {
+  const findings = [];
+  const stripped = lineText.trim();
+  if (stripped === "" || stripped.startsWith("#") || stripped.startsWith(";"))
+    return findings;
+  const auth = stripped.match(/(?:^|:)(_[A-Za-z]*(?:auth|password)[A-Za-z]*|password)\s*=\s*(.+)$/i);
+  if (auth) {
+    const value = stripQuotes(stripInlineComment(auth[2].trim()));
+    if (value && !isSafeReference(value)) {
+      findings.push({
+        path,
+        line,
+        rule: "npmrc-literal-auth",
+        surface,
+        severity: "error",
+        tracked,
+        detail: tracked ? "tracked npm auth entry uses a literal value" : "npm auth entry uses a literal value"
+      });
+    }
+  }
+  findings.push(...scanCredentialedUrl(stripped, path, line, surface, tracked));
+  findings.push(...scanKnownTokenPatterns(stripped, path, line, surface, tracked));
+  return findings;
+}
+function scanBunConfigFile(text, path, tracked) {
+  const findings = [];
+  const lines = text.split(/\r?\n/);
+  let inReleaseAgeExcludes = false;
+  let hasMinimumReleaseAge = false;
+  for (let i = 0;i < lines.length; i++) {
+    const lineText = lines[i];
+    const line = i + 1;
+    const stripped = lineText.trim();
+    if (stripped === "" || stripped.startsWith("#"))
+      continue;
+    const releaseAge = stripped.match(/^minimumReleaseAge\s*=\s*(?:"([^"]+)"|'([^']+)'|([0-9]+))\s*(?:#.*)?$/i);
+    if (releaseAge) {
+      hasMinimumReleaseAge = true;
+      const rawValue = releaseAge[1] ?? releaseAge[2] ?? releaseAge[3] ?? "";
+      const value = Number(rawValue);
+      if (!Number.isFinite(value) || value <= 0) {
+        findings.push({
+          path,
+          line,
+          rule: "bun-release-age-disabled",
+          surface: "bun-config",
+          severity: "error",
+          tracked,
+          detail: "Bun release-age quarantine is disabled"
+        });
+      }
+    }
+    const startsReleaseAgeExcludes = /minimumReleaseAgeExcludes/i.test(stripped);
+    const scanExcludes = startsReleaseAgeExcludes || inReleaseAgeExcludes;
+    if (scanExcludes) {
+      const quoted = [...stripped.matchAll(/["']([^"']+)["']/g)].map((m) => m[1]);
+      for (const item of quoted) {
+        if (!isExactHasnaPackageName(item)) {
+          findings.push({
+            path,
+            line,
+            rule: "bun-release-age-broad-exclude",
+            surface: "bun-config",
+            severity: "error",
+            tracked,
+            detail: "Bun release-age exclude must be an exact @hasna package name"
+          });
+        }
+      }
+    }
+    inReleaseAgeExcludes = startsReleaseAgeExcludes ? stripped.includes("[") && !stripped.includes("]") : inReleaseAgeExcludes && !stripped.includes("]");
+    findings.push(...scanKnownTokenPatterns(stripped, path, line, "bun-config", tracked));
+  }
+  if (!hasMinimumReleaseAge) {
+    findings.push({
+      path,
+      line: 1,
+      rule: "bun-release-age-missing",
+      surface: "bun-config",
+      severity: "error",
+      tracked,
+      detail: "Bun release-age quarantine must be configured with a positive minimumReleaseAge"
+    });
+  }
+  return findings;
+}
+function scanShellProfileLine(lineText, path, line, tracked) {
+  const findings = [];
+  const stripped = lineText.trim();
+  if (stripped === "" || stripped.startsWith("#"))
+    return findings;
+  const assignment = stripped.match(/^(?:export\s+)?(NPM(?:_CONFIG)?_[A-Z0-9_]*TOKEN|NODE_AUTH_TOKEN|NPM_TOKEN)\s*=\s*(.+)$/);
+  if (assignment) {
+    const value = stripQuotes(stripInlineComment(assignment[2].trim()));
+    if (value && !isSafeReference(value)) {
+      findings.push({
+        path,
+        line,
+        rule: "shell-literal-package-token",
+        surface: "shell-profile",
+        severity: "error",
+        tracked,
+        detail: "shell profile package-manager token uses a literal value"
+      });
+    }
+  }
+  findings.push(...scanKnownTokenPatterns(stripped, path, line, "shell-profile", tracked));
+  return findings;
+}
+function scanLockfileLine(lineText, path, line, tracked) {
+  const findings = scanKnownTokenPatterns(lineText, path, line, "lockfile", tracked);
+  if (/(?:^|:)_authToken\s*=\s*/i.test(lineText) && !/\$\{[A-Z0-9_]+\}|\{\{[A-Z0-9_]+\}\}/.test(lineText)) {
+    findings.push({
+      path,
+      line,
+      rule: "lockfile-auth-token",
+      surface: "lockfile",
+      severity: "error",
+      tracked,
+      detail: "lockfile contains package-manager auth token material"
+    });
+  }
+  return findings;
+}
+function scanKnownTokenPatterns(lineText, path, line, surface, tracked) {
+  const findings = [];
+  for (const pattern of TOKEN_VALUE_PATTERNS) {
+    if (pattern.re.test(lineText)) {
+      findings.push({
+        path,
+        line,
+        rule: pattern.rule,
+        surface,
+        severity: "error",
+        tracked,
+        detail: pattern.detail
+      });
+    }
+  }
+  return findings;
+}
+function scanCredentialedUrl(lineText, path, line, surface, tracked) {
+  const findings = [];
+  for (const match of lineText.matchAll(/\bhttps?:\/\/([^/\s#;]+)@/gi)) {
+    const userInfo = match[1];
+    const credentialPart = userInfo.includes(":") ? userInfo.split(":").slice(1).join(":") : userInfo;
+    if (credentialPart && !isSafeReference(credentialPart)) {
+      findings.push({
+        path,
+        line,
+        rule: "package-manager-url-credentials",
+        surface,
+        severity: "error",
+        tracked,
+        detail: "package-manager URL embeds literal credentials"
+      });
     }
   }
+  return findings;
+}
+function trackedFiles(root) {
+  try {
+    const output = execFileSync("git", ["-C", root, "ls-files", "-z"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return new Set(output.split("\x00").filter(Boolean).map(toPosix));
+  } catch {
+    return new Set;
+  }
+}
+function isTrackedFile(file) {
+  try {
+    const repoRoot = execFileSync("git", ["-C", dirname4(file), "rev-parse", "--show-toplevel"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const rel = toPosix(relative4(repoRoot, file));
+    execFileSync("git", ["-C", repoRoot, "ls-files", "--error-unmatch", "--", rel], {
+      stdio: ["ignore", "ignore", "ignore"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isExactHasnaPackageName(item) {
+  return /^@hasna\/[a-z0-9][a-z0-9._-]*$/.test(item);
+}
+function isSafeReference(value) {
+  const trimmed = stripQuotes(value.trim());
+  return /^\$\{[A-Z][A-Z0-9_]*\}$/.test(trimmed) || /^\$[A-Z][A-Z0-9_]*$/.test(trimmed) || /^\{\{[A-Z][A-Z0-9_]*\}\}$/.test(trimmed) || /^%[A-Z][A-Z0-9_]*%$/.test(trimmed);
+}
+function stripQuotes(value) {
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+function stripInlineComment(value) {
+  return value.replace(/\s[#;].*$/, "").trim();
+}
+function displayPath(file, root) {
+  const home = homedir5();
+  if (root === home && (file === home || file.startsWith(home + "/")))
+    return "~/" + toPosix(relative4(home, file));
+  if (isAbsolute3(root) && file.startsWith(root + "/"))
+    return toPosix(relative4(root, file));
+  if (file === home || file.startsWith(home + "/"))
+    return "~/" + toPosix(relative4(home, file));
+  return file;
+}
+function toPosix(path) {
+  return path.split("\\").join("/");
 }
 export {
   uuid,
-  updateProfile,
-  updateMachineApplied,
-  updateConfig,
   transformSkillContent,
   templateizeMachineContent,
   syncToDisk,
@@ -3633,58 +4090,30 @@ export {
   syncKnown,
   syncFromDir,
   stripClaudeOnlySections,
-  storageSync,
-  storagePush,
-  storagePull,
   sourcesFromIdentityExport,
   sourceFromFilePath,
   sourceFromConfig,
   slugify,
   scanSecrets,
-  runStorageMigrations,
-  resolveTables,
+  scanPackageManagerSecrets,
   resolveSessionTargetOwnership,
   resolveSessionPath,
   resolveProfileVariables,
-  resolveProfileForMachine,
-  resetDatabase,
+  resolveConfigStore,
+  resolveCloudConfig,
   renderTemplate,
   renderMachineAwareContent,
-  removeConfigFromProfile,
-  registerMachine,
   redactContent,
-  pruneSnapshots,
-  profileMatchesMachine,
-  profileHasSelectors,
   planSessionRender,
   parseTemplateVars,
   now,
   normalizeOsFamily,
   machineContextToVariables,
-  listSnapshots,
-  listProfiles,
-  listMachines,
-  listConfigs,
   isTemplate,
-  isLocalPostgresHost,
+  isCloudMode,
   importConfigs,
   hasSecrets,
-  getSyncMetaAll,
-  getStorageSyncMetaAll,
-  getStorageStatus,
-  getStoragePg,
-  getStorageMode,
-  getStorageDatabaseUrl,
-  getStorageDatabaseEnvName,
-  getSnapshotByVersion,
-  getSnapshot,
-  getProfileConfigs,
-  getProfile,
-  getDatabase,
   getConfigsStatus,
-  getConfigStats,
-  getConfigById,
-  getConfig,
   extractTemplateVars,
   exportConfigs,
   expandPath,
@@ -3695,17 +4124,11 @@ export {
   detectFormat,
   detectCategory,
   detectAgent,
-  deleteProfile,
-  deleteConfig,
   currentOs,
   currentHostname2 as currentHostname,
   currentArch2 as currentArch,
-  createSnapshot,
-  createProfile,
-  createConfig,
   cleanSessionPathInput,
   checkSessionRenderDrift,
-  buildPgPoolConfig,
   buildOpenCodeAgentsMd,
   buildCursorMdc,
   buildCodexAgentsMd,
@@ -3713,37 +4136,30 @@ export {
   applySessionRender,
   applyConfigs,
   applyConfig,
-  addConfigToProfile,
   TemplateRenderError,
   SessionApplyError,
-  STORAGE_TABLES,
-  STORAGE_MODE_ENV,
-  STORAGE_DATABASE_ENV,
   SESSION_TOOL_ADAPTERS,
   SESSION_RENDER_TOOLS,
   SESSION_RENDER_SCHEMA,
   SESSION_RENDER_MANAGED_MARKER,
   RAW_STORE_ROOT_ENV,
   ProfileNotFoundError,
-  PgAdapterAsync,
   PROJECT_DASHBOARD_STANDARD_SLUG,
   PROJECT_DASHBOARD_STANDARD_CONTENT,
   PROJECT_DASHBOARD_PROFILE_VARIABLES,
   PROJECT_CONFIG_FILES,
   PLATFORM_PROFILE_PRESETS,
   PG_MIGRATIONS,
+  LocalConfigStore,
   KNOWN_CONFIGS,
   ConfigNotFoundError,
   ConfigApplyError,
+  CloudHttpError,
+  CloudConfigStore,
   CONFIG_TRANSFORMS,
   CONFIG_KINDS,
   CONFIG_FORMATS,
   CONFIG_CATEGORIES,
   CONFIG_AGENTS,
-  CONFIGS_STORAGE_TABLES,
-  CONFIGS_STORAGE_MODE_FALLBACK_ENV,
-  CONFIGS_STORAGE_MODE_ENV,
-  CONFIGS_STORAGE_FALLBACK_ENV,
-  CONFIGS_STORAGE_ENV,
   CODEWITH_NATIVE_IMPORTS_ENV
 };