@hasna/instructions 0.3.1 → 0.4.1

package/dist/mcp/index.js

@@ -18,17 +18,38 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// src/db/database.ts
-var exports_database = {};
-__export(exports_database, {
-  uuid: () => uuid,
-  slugify: () => slugify,
-  resetDatabase: () => resetDatabase,
-  now: () => now,
-  getDatabase: () => getDatabase
+// src/types/index.ts
+var ConfigNotFoundError, ProfileNotFoundError, ConfigApplyError, TemplateRenderError;
+var init_types = __esm(() => {
+  ConfigNotFoundError = class ConfigNotFoundError extends Error {
+    constructor(id) {
+      super(`Config not found: ${id}`);
+      this.name = "ConfigNotFoundError";
+    }
+  };
+  ProfileNotFoundError = class ProfileNotFoundError extends Error {
+    constructor(id) {
+      super(`Profile not found: ${id}`);
+      this.name = "ProfileNotFoundError";
+    }
+  };
+  ConfigApplyError = class ConfigApplyError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ConfigApplyError";
+    }
+  };
+  TemplateRenderError = class TemplateRenderError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "TemplateRenderError";
+    }
+  };
 });
+
+// src/db/database.ts
 import { Database } from "bun:sqlite";
-import { cpSync, existsSync, mkdirSync, statSync } from "fs";
+import { cpSync, existsSync, mkdirSync, rmSync, statSync } from "fs";
 import { join } from "path";
 import { randomUUID } from "crypto";
 function getDbPath() {
@@ -56,6 +77,9 @@ function slugify(name) {
 function getDatabase(path) {
   if (_db)
     return _db;
+  if (!path && process.env["HASNA_INSTRUCTIONS_API_URL"] && process.env["HASNA_INSTRUCTIONS_API_KEY"]) {
+    throw new Error("instructions is in self_hosted (cloud) mode: this command is not wired to the cloud API yet. " + "Unset HASNA_INSTRUCTIONS_API_URL / HASNA_INSTRUCTIONS_API_KEY to use it against the local store.");
+  }
   const dbPath = path || getDbPath();
   const db = new Database(dbPath);
   db.run("PRAGMA journal_mode = WAL");
@@ -73,6 +97,16 @@ function resetDatabase() {
   }
   _db = null;
 }
+function resetLocalDatabase() {
+  resetDatabase();
+  const dbPath = getDbPath();
+  if (dbPath === ":memory:")
+    return;
+  for (const p of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
+    if (existsSync(p))
+      rmSync(p);
+  }
+}
 function applyMigrations(db) {
   let currentVersion = 0;
   try {
@@ -98,6 +132,22 @@ function ensureFeedbackTable(db) {
       created_at TEXT NOT NULL DEFAULT (datetime('now'))
     )
   `);
+  const existing = new Set(db.query("PRAGMA table_info(feedback)").all().map((r) => r.name));
+  const required = [
+    ["email", "TEXT"],
+    ["category", "TEXT DEFAULT 'general'"],
+    ["version", "TEXT"],
+    ["machine_id", "TEXT"],
+    ["created_at", "TEXT"]
+  ];
+  for (const [name, def] of required) {
+    if (!existing.has(name))
+      db.exec(`ALTER TABLE feedback ADD COLUMN ${name} ${def}`);
+  }
+}
+function insertFeedback(input, db) {
+  const d = db || getDatabase();
+  d.run("INSERT INTO feedback (message, email, category, version) VALUES (?, ?, ?, ?)", [input.message, input.email ?? null, input.category ?? "general", input.version ?? null]);
 }
 function migrateDotfile() {
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
@@ -189,46 +239,7 @@ var init_database = __esm(() => {
   ];
 });
 
-// src/types/index.ts
-var ConfigNotFoundError, ProfileNotFoundError, ConfigApplyError, TemplateRenderError;
-var init_types = __esm(() => {
-  ConfigNotFoundError = class ConfigNotFoundError extends Error {
-    constructor(id) {
-      super(`Config not found: ${id}`);
-      this.name = "ConfigNotFoundError";
-    }
-  };
-  ProfileNotFoundError = class ProfileNotFoundError extends Error {
-    constructor(id) {
-      super(`Profile not found: ${id}`);
-      this.name = "ProfileNotFoundError";
-    }
-  };
-  ConfigApplyError = class ConfigApplyError extends Error {
-    constructor(message) {
-      super(message);
-      this.name = "ConfigApplyError";
-    }
-  };
-  TemplateRenderError = class TemplateRenderError extends Error {
-    constructor(message) {
-      super(message);
-      this.name = "TemplateRenderError";
-    }
-  };
-});
-
 // src/db/configs.ts
-var exports_configs = {};
-__export(exports_configs, {
-  updateConfig: () => updateConfig,
-  listConfigs: () => listConfigs,
-  getConfigStats: () => getConfigStats,
-  getConfigById: () => getConfigById,
-  getConfig: () => getConfig,
-  deleteConfig: () => deleteConfig,
-  createConfig: () => createConfig
-});
 function rowToConfig(row) {
   let outputs = [];
   try {
@@ -413,26 +424,6 @@ var init_configs = __esm(() => {
   init_database();
 });
 
-// src/db/snapshots.ts
-function createSnapshot(configId, content, version, db) {
-  const d = db || getDatabase();
-  const id = uuid();
-  const ts = now();
-  d.run("INSERT INTO config_snapshots (id, config_id, content, version, created_at) VALUES (?, ?, ?, ?, ?)", [id, configId, content, version, ts]);
-  return { id, config_id: configId, content, version, created_at: ts };
-}
-function listSnapshots(configId, db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? ORDER BY version DESC").all(configId);
-}
-function getSnapshotByVersion(configId, version, db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? AND version = ?").get(configId, version);
-}
-var init_snapshots = __esm(() => {
-  init_database();
-});
-
 // src/lib/template.ts
 var exports_template = {};
 __export(exports_template, {
@@ -588,6 +579,527 @@ var init_machine = __esm(() => {
   init_template();
 });
 
+// src/db/profiles.ts
+function rowToProfile(row) {
+  return {
+    ...row,
+    selectors: JSON.parse(row.selectors || "{}"),
+    variables: JSON.parse(row.variables || "{}")
+  };
+}
+function uniqueProfileSlug(name, db, excludeId) {
+  const base = slugify(name);
+  let slug = base;
+  let i = 1;
+  while (true) {
+    const existing = db.query("SELECT id FROM profiles WHERE slug = ?").get(slug);
+    if (!existing || existing.id === excludeId)
+      return slug;
+    slug = `${base}-${i++}`;
+  }
+}
+function createProfile(input, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  const ts = now();
+  const slug = uniqueProfileSlug(input.name, d);
+  d.run("INSERT INTO profiles (id, name, slug, description, selectors, variables, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)", [
+    id,
+    input.name,
+    slug,
+    input.description ?? null,
+    JSON.stringify(input.selectors ?? {}),
+    JSON.stringify(input.variables ?? {}),
+    ts,
+    ts
+  ]);
+  return getProfile(id, d);
+}
+function getProfile(idOrSlug, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT * FROM profiles WHERE id = ? OR slug = ?").get(idOrSlug, idOrSlug);
+  if (!row)
+    throw new ProfileNotFoundError(idOrSlug);
+  return rowToProfile(row);
+}
+function listProfiles(db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM profiles ORDER BY name").all().map(rowToProfile);
+}
+function updateProfile(idOrSlug, input, db) {
+  const d = db || getDatabase();
+  const existing = getProfile(idOrSlug, d);
+  const ts = now();
+  const updates = ["updated_at = ?"];
+  const params = [ts];
+  if (input.name !== undefined) {
+    updates.push("name = ?", "slug = ?");
+    params.push(input.name, uniqueProfileSlug(input.name, d, existing.id));
+  }
+  if (input.description !== undefined) {
+    updates.push("description = ?");
+    params.push(input.description);
+  }
+  if (input.selectors !== undefined) {
+    updates.push("selectors = ?");
+    params.push(JSON.stringify(input.selectors));
+  }
+  if (input.variables !== undefined) {
+    updates.push("variables = ?");
+    params.push(JSON.stringify(input.variables));
+  }
+  params.push(existing.id);
+  d.run(`UPDATE profiles SET ${updates.join(", ")} WHERE id = ?`, params);
+  return getProfile(existing.id, d);
+}
+function deleteProfile(idOrSlug, db) {
+  const d = db || getDatabase();
+  const existing = getProfile(idOrSlug, d);
+  d.run("DELETE FROM profiles WHERE id = ?", [existing.id]);
+}
+function addConfigToProfile(profileIdOrSlug, configId, db) {
+  const d = db || getDatabase();
+  const profile = getProfile(profileIdOrSlug, d);
+  const maxRow = d.query("SELECT MAX(sort_order) as max_order FROM profile_configs WHERE profile_id = ?").get(profile.id);
+  const order = (maxRow?.max_order ?? -1) + 1;
+  d.run("INSERT OR IGNORE INTO profile_configs (profile_id, config_id, sort_order) VALUES (?, ?, ?)", [profile.id, configId, order]);
+}
+function removeConfigFromProfile(profileIdOrSlug, configId, db) {
+  const d = db || getDatabase();
+  const profile = getProfile(profileIdOrSlug, d);
+  d.run("DELETE FROM profile_configs WHERE profile_id = ? AND config_id = ?", [profile.id, configId]);
+}
+function getProfileConfigs(profileIdOrSlug, db) {
+  const d = db || getDatabase();
+  const profile = getProfile(profileIdOrSlug, d);
+  const rows = d.query("SELECT config_id FROM profile_configs WHERE profile_id = ? ORDER BY sort_order").all(profile.id);
+  if (rows.length === 0)
+    return [];
+  const ids = rows.map((r) => r.config_id);
+  return listConfigs(undefined, d).filter((c) => ids.includes(c.id));
+}
+function profileHasSelectors(profile) {
+  const selectors = profile.selectors ?? {};
+  return (selectors.os?.length ?? 0) > 0 || (selectors.arch?.length ?? 0) > 0 || (selectors.hostnames?.length ?? 0) > 0;
+}
+function profileMatchesMachine(profile, machine) {
+  const selectors = profile.selectors ?? {};
+  const osMatches = !selectors.os?.length || selectors.os.some((candidate) => {
+    const value = candidate.trim().toLowerCase();
+    return value === machine.os_family || value === (machine.os ?? "").trim().toLowerCase() || normalizeOsFamily(candidate) === machine.os_family;
+  });
+  const archMatches = !selectors.arch?.length || selectors.arch.some((candidate) => candidate.trim().toLowerCase() === (machine.arch ?? "").trim().toLowerCase());
+  const hostnameMatches = !selectors.hostnames?.length || selectors.hostnames.some((candidate) => candidate.trim().toLowerCase() === machine.hostname.trim().toLowerCase());
+  return osMatches && archMatches && hostnameMatches;
+}
+function resolveProfileForMachine(machine = detectMachineContext(), db) {
+  const profiles = listProfiles(db).filter(profileHasSelectors);
+  const matches = profiles.filter((profile) => profileMatchesMachine(profile, machine)).map((profile) => {
+    const selectors = profile.selectors;
+    const score = (selectors.hostnames?.length ? 100 : 0) + (selectors.os?.length ? 10 : 0) + (selectors.arch?.length ? 10 : 0);
+    return { profile, score };
+  }).sort((a, b) => b.score - a.score || a.profile.name.localeCompare(b.profile.name));
+  return matches[0]?.profile ?? null;
+}
+var init_profiles = __esm(() => {
+  init_types();
+  init_database();
+  init_configs();
+  init_machine();
+});
+
+// src/db/snapshots.ts
+function createSnapshot(configId, content, version, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  const ts = now();
+  d.run("INSERT INTO config_snapshots (id, config_id, content, version, created_at) VALUES (?, ?, ?, ?, ?)", [id, configId, content, version, ts]);
+  return { id, config_id: configId, content, version, created_at: ts };
+}
+function listSnapshots(configId, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? ORDER BY version DESC").all(configId);
+}
+function getSnapshot(id, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE id = ?").get(id);
+}
+function getSnapshotByVersion(configId, version, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? AND version = ?").get(configId, version);
+}
+function pruneSnapshots(configId, keep = 10, db) {
+  const d = db || getDatabase();
+  const result = d.run(`DELETE FROM config_snapshots WHERE config_id = ? AND id NOT IN (
+      SELECT id FROM config_snapshots WHERE config_id = ? ORDER BY version DESC LIMIT ?
+    )`, [configId, configId, keep]);
+  return result.changes;
+}
+var init_snapshots = __esm(() => {
+  init_database();
+});
+
+// src/db/machines.ts
+import { arch, hostname, type } from "os";
+function currentHostname2() {
+  return hostname();
+}
+function currentOs() {
+  return type();
+}
+function currentArch2() {
+  return arch();
+}
+function registerMachine(hostnameStr, os, archStr, db) {
+  const d = db || getDatabase();
+  const h = hostnameStr ?? currentHostname2();
+  const o = os ?? currentOs();
+  const a = archStr ?? currentArch2();
+  const existing = d.query("SELECT * FROM machines WHERE hostname = ?").get(h);
+  if (existing) {
+    if (existing.os !== o || existing.arch !== a) {
+      d.run("UPDATE machines SET os = ?, arch = ? WHERE hostname = ?", [o, a, h]);
+      return d.query("SELECT * FROM machines WHERE hostname = ?").get(h);
+    }
+    return existing;
+  }
+  const id = uuid();
+  const ts = now();
+  d.run("INSERT INTO machines (id, hostname, os, arch, last_applied_at, created_at) VALUES (?, ?, ?, ?, NULL, ?)", [id, h, o, a, ts]);
+  return d.query("SELECT * FROM machines WHERE id = ?").get(id);
+}
+function updateMachineApplied(hostnameStr, db) {
+  const d = db || getDatabase();
+  const h = hostnameStr ?? currentHostname2();
+  d.run("UPDATE machines SET last_applied_at = ? WHERE hostname = ?", [now(), h]);
+}
+function listMachines(db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM machines ORDER BY last_applied_at DESC NULLS LAST").all();
+}
+var init_machines = __esm(() => {
+  init_database();
+});
+
+// src/data/config-store.ts
+import { randomUUID as randomUUID2 } from "crypto";
+function resolveCloudConfig(env = process.env) {
+  const apiUrl = env[API_URL_ENV]?.trim();
+  const apiKey = env[API_KEY_ENV]?.trim();
+  if (!apiUrl && !apiKey)
+    return null;
+  if (!apiUrl || !apiKey) {
+    throw new Error(`API mode requires BOTH ${API_URL_ENV} and ${API_KEY_ENV}; only ` + `${apiUrl ? API_URL_ENV : API_KEY_ENV} is set. Set both to use the cloud API, ` + `or unset both to use the local store.`);
+  }
+  return { apiUrl, apiKey };
+}
+
+class LocalConfigStore {
+  db;
+  mode = "local";
+  constructor(db) {
+    this.db = db;
+  }
+  async listConfigs(filter) {
+    return listConfigs(filter, this.db);
+  }
+  async getConfig(idOrSlug) {
+    return getConfig(idOrSlug, this.db);
+  }
+  async getConfigById(id) {
+    return getConfigById(id, this.db);
+  }
+  async createConfig(input) {
+    return createConfig(input, this.db);
+  }
+  async updateConfig(idOrSlug, input) {
+    return updateConfig(idOrSlug, input, this.db);
+  }
+  async deleteConfig(idOrSlug) {
+    deleteConfig(idOrSlug, this.db);
+  }
+  async getConfigStats() {
+    return getConfigStats(this.db);
+  }
+  async listSnapshots(configId) {
+    return listSnapshots(configId, this.db);
+  }
+  async getSnapshot(id) {
+    return getSnapshot(id, this.db);
+  }
+  async getSnapshotByVersion(configId, version) {
+    return getSnapshotByVersion(configId, version, this.db);
+  }
+  async createSnapshot(configId, content, version) {
+    return createSnapshot(configId, content, version, this.db);
+  }
+  async pruneSnapshots(configId, keep = 10) {
+    return pruneSnapshots(configId, keep, this.db);
+  }
+  async listProfiles() {
+    return listProfiles(this.db);
+  }
+  async getProfile(idOrSlug) {
+    return getProfile(idOrSlug, this.db);
+  }
+  async getProfileConfigs(idOrSlug) {
+    return getProfileConfigs(idOrSlug, this.db);
+  }
+  async createProfile(input) {
+    return createProfile(input, this.db);
+  }
+  async updateProfile(idOrSlug, input) {
+    return updateProfile(idOrSlug, input, this.db);
+  }
+  async deleteProfile(idOrSlug) {
+    deleteProfile(idOrSlug, this.db);
+  }
+  async addConfigToProfile(profileIdOrSlug, configId) {
+    addConfigToProfile(profileIdOrSlug, configId, this.db);
+  }
+  async removeConfigFromProfile(profileIdOrSlug, configId) {
+    removeConfigFromProfile(profileIdOrSlug, configId, this.db);
+  }
+  async resolveProfileForMachine(machine) {
+    return machine ? resolveProfileForMachine(machine, this.db) : resolveProfileForMachine(undefined, this.db);
+  }
+  async registerMachine(hostname2, os, arch2) {
+    return registerMachine(hostname2, os, arch2, this.db);
+  }
+  async updateMachineApplied(hostname2) {
+    updateMachineApplied(hostname2, this.db);
+  }
+  async listMachines() {
+    return listMachines(this.db);
+  }
+  async sendFeedback(input) {
+    insertFeedback(input, this.db);
+  }
+  async reset() {
+    resetLocalDatabase();
+  }
+}
+
+class CloudConfigStore {
+  mode = "api";
+  base;
+  apiKey;
+  timeoutMs;
+  constructor(config) {
+    this.base = `${config.apiUrl.replace(/\/+$/, "")}/v1`;
+    this.apiKey = config.apiKey;
+    this.timeoutMs = config.timeoutMs ?? 30000;
+  }
+  async request(method, path, body, opts = {}) {
+    const controller = new AbortController;
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    const headers = {
+      Authorization: `Bearer ${this.apiKey}`,
+      Accept: "application/json"
+    };
+    if (body !== undefined)
+      headers["Content-Type"] = "application/json";
+    if (opts.idempotent)
+      headers["Idempotency-Key"] = randomUUID2();
+    try {
+      const res = await fetch(`${this.base}${path}`, {
+        method,
+        headers,
+        body: body === undefined ? undefined : JSON.stringify(body),
+        signal: controller.signal
+      });
+      if (res.status === 404 && opts.allow404)
+        return { status: 404, data: null };
+      const text = await res.text();
+      let parsed = null;
+      if (text) {
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          parsed = text;
+        }
+      }
+      if (!res.ok) {
+        const message = (parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : undefined) ?? `HTTP ${res.status} on ${method} ${path}`;
+        throw new CloudHttpError(res.status, message, parsed);
+      }
+      return { status: res.status, data: parsed };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async listConfigs(filter = {}) {
+    const params = new URLSearchParams;
+    if (filter.category)
+      params.set("category", filter.category);
+    if (filter.agent)
+      params.set("agent", filter.agent);
+    if (filter.kind)
+      params.set("kind", filter.kind);
+    if (filter.search)
+      params.set("search", filter.search);
+    const qs = params.toString();
+    const { data } = await this.request("GET", `/configs${qs ? `?${qs}` : ""}`);
+    let configs = data?.configs ?? [];
+    if (filter.tags && filter.tags.length > 0) {
+      configs = configs.filter((c) => filter.tags.every((t) => c.tags.includes(t)));
+    }
+    if (filter.is_template !== undefined) {
+      configs = configs.filter((c) => c.is_template === filter.is_template);
+    }
+    return configs;
+  }
+  async getConfig(idOrSlug) {
+    const { status, data } = await this.request("GET", `/configs/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404 || !data?.config)
+      throw new ConfigNotFoundError(idOrSlug);
+    return data.config;
+  }
+  async getConfigById(id) {
+    return this.getConfig(id);
+  }
+  async createConfig(input) {
+    const { data } = await this.request("POST", "/configs", input, {
+      idempotent: true
+    });
+    return data.config;
+  }
+  async updateConfig(idOrSlug, input) {
+    const { data } = await this.request("PATCH", `/configs/${encodeURIComponent(idOrSlug)}`, input);
+    return data.config;
+  }
+  async deleteConfig(idOrSlug) {
+    const { status } = await this.request("DELETE", `/configs/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404)
+      throw new ConfigNotFoundError(idOrSlug);
+  }
+  async getConfigStats() {
+    const { data } = await this.request("GET", "/stats");
+    return data ?? { total: 0 };
+  }
+  async listSnapshots(configId) {
+    const { data } = await this.request("GET", `/configs/${encodeURIComponent(configId)}/snapshots`);
+    return data?.snapshots ?? [];
+  }
+  async getSnapshot(id) {
+    const { status, data } = await this.request("GET", `/snapshots/${encodeURIComponent(id)}`, undefined, { allow404: true });
+    if (status === 404 || !data?.snapshot)
+      return null;
+    return data.snapshot;
+  }
+  async getSnapshotByVersion(configId, version) {
+    const { status, data } = await this.request("GET", `/configs/${encodeURIComponent(configId)}/snapshots/${version}`, undefined, { allow404: true });
+    if (status === 404 || !data?.snapshot)
+      return null;
+    return data.snapshot;
+  }
+  async createSnapshot(configId, content, version) {
+    const { data } = await this.request("POST", `/configs/${encodeURIComponent(configId)}/snapshots`, { content, version }, { idempotent: true });
+    return data.snapshot;
+  }
+  async pruneSnapshots(configId, keep = 10) {
+    const { data } = await this.request("POST", `/configs/${encodeURIComponent(configId)}/snapshots/prune`, { keep });
+    return data?.pruned ?? 0;
+  }
+  async listProfiles() {
+    const { data } = await this.request("GET", "/profiles");
+    return data?.profiles ?? [];
+  }
+  async getProfile(idOrSlug) {
+    const { status, data } = await this.request("GET", `/profiles/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404 || !data?.profile)
+      throw new ProfileNotFoundError(idOrSlug);
+    const { configs: _configs, ...profile } = data.profile;
+    return profile;
+  }
+  async getProfileConfigs(idOrSlug) {
+    const { status, data } = await this.request("GET", `/profiles/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404 || !data?.profile)
+      throw new ProfileNotFoundError(idOrSlug);
+    return data.profile.configs ?? [];
+  }
+  async createProfile(input) {
+    const { data } = await this.request("POST", "/profiles", input, {
+      idempotent: true
+    });
+    return data.profile;
+  }
+  async updateProfile(idOrSlug, input) {
+    const { data } = await this.request("PATCH", `/profiles/${encodeURIComponent(idOrSlug)}`, input);
+    return data.profile;
+  }
+  async deleteProfile(idOrSlug) {
+    const { status } = await this.request("DELETE", `/profiles/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
+    if (status === 404)
+      throw new ProfileNotFoundError(idOrSlug);
+  }
+  async addConfigToProfile(profileIdOrSlug, configId) {
+    await this.request("POST", `/profiles/${encodeURIComponent(profileIdOrSlug)}/configs`, { config_id: configId }, { idempotent: true });
+  }
+  async removeConfigFromProfile(profileIdOrSlug, configId) {
+    await this.request("DELETE", `/profiles/${encodeURIComponent(profileIdOrSlug)}/configs/${encodeURIComponent(configId)}`, undefined, { allow404: true });
+  }
+  async resolveProfileForMachine(machine) {
+    const params = new URLSearchParams;
+    if (machine?.hostname)
+      params.set("hostname", machine.hostname);
+    if (machine?.os)
+      params.set("os", machine.os);
+    if (machine?.arch)
+      params.set("arch", machine.arch);
+    const qs = params.toString();
+    const { status, data } = await this.request("GET", `/profiles/resolve${qs ? `?${qs}` : ""}`, undefined, { allow404: true });
+    if (status === 404 || !data?.profile)
+      return null;
+    return data.profile;
+  }
+  async registerMachine(hostname2, os, arch2) {
+    const { data } = await this.request("POST", "/machines", { hostname: hostname2, os, arch: arch2 }, { idempotent: true });
+    return data.machine;
+  }
+  async updateMachineApplied(hostname2) {
+    await this.request("POST", "/machines/applied", { hostname: hostname2 });
+  }
+  async listMachines() {
+    const { data } = await this.request("GET", "/machines");
+    return data?.machines ?? [];
+  }
+  async sendFeedback(input) {
+    await this.request("POST", "/feedback", {
+      message: input.message,
+      email: input.email ?? undefined,
+      category: input.category ?? undefined,
+      version: input.version ?? undefined
+    });
+  }
+  async reset() {
+    throw new Error("`init --force` cannot wipe the shared cloud store from a client. " + "Unset HASNA_INSTRUCTIONS_API_URL / HASNA_INSTRUCTIONS_API_KEY to reset the local store instead.");
+  }
+}
+function resolveConfigStore(env = process.env) {
+  const cloud = resolveCloudConfig(env);
+  return cloud ? new CloudConfigStore(cloud) : new LocalConfigStore;
+}
+var CloudHttpError, API_URL_ENV = "HASNA_INSTRUCTIONS_API_URL", API_KEY_ENV = "HASNA_INSTRUCTIONS_API_KEY";
+var init_config_store = __esm(() => {
+  init_configs();
+  init_profiles();
+  init_snapshots();
+  init_machines();
+  init_database();
+  init_types();
+  CloudHttpError = class CloudHttpError extends Error {
+    status;
+    body;
+    constructor(status, message, body) {
+      super(message);
+      this.status = status;
+      this.body = body;
+      this.name = "CloudHttpError";
+    }
+  };
+});
+
 // src/lib/transforms.ts
 import { basename, extname } from "path";
 function ensureTrailingNewline(content) {
@@ -755,8 +1267,8 @@ async function writeConfigResult(config, targetPath, content, opts, meta = {}) {
       mkdirSync2(dir, { recursive: true });
     }
     if (previousContent !== null && changed) {
-      const db = opts.db || getDatabase();
-      createSnapshot(config.id, previousContent, config.version, db);
+      const store = opts.store ?? resolveConfigStore();
+      await store.createSnapshot(config.id, previousContent, config.version);
     }
     writeFileSync(path, renderedContent, "utf-8");
   }
@@ -782,8 +1294,8 @@ async function applyConfig(config, opts = {}) {
   if (config.kind === "reference" || (!config.target_path || !shouldApplyPrimary) && selectedOutputs.length === 0) {
     throw new ConfigApplyError(`Config "${config.name}" is a reference (kind=reference) and has no target_path \u2014 cannot apply to disk.`);
   }
-  const db = opts.db || getDatabase();
-  const contextConfigs = selectedOutputs.length > 0 || config.target_path ? listConfigs(undefined, db) : [config];
+  const store = opts.store ?? resolveConfigStore();
+  const contextConfigs = selectedOutputs.length > 0 || config.target_path ? await store.listConfigs() : [config];
   if (isGeneratedOutputTarget(config, contextConfigs)) {
     throw new ConfigApplyError(`Config "${config.name}" targets a generated output path. Apply the canonical source config instead.`);
   }
@@ -804,7 +1316,7 @@ async function applyConfig(config, opts = {}) {
     };
   }
   if (!opts.dryRun) {
-    updateConfig(config.id, { synced_at: now() }, db);
+    await store.updateConfig(config.id, { synced_at: new Date().toISOString() });
   }
   return result;
 }
@@ -826,9 +1338,7 @@ async function applyConfigs(configs, opts = {}) {
 }
 var init_apply = __esm(() => {
   init_types();
-  init_database();
-  init_configs();
-  init_snapshots();
+  init_config_store();
   init_machine();
   init_transforms();
 });
@@ -922,9 +1432,9 @@ function redactIni(content) {
   for (let i = 0;i < lines.length; i++) {
     const line = lines[i];
     const authM = line.match(/^(\/\/[^:]+:_authToken=)(.+)$/);
-    if (authM && !authM[2].startsWith("{{")) {
-      redacted.push({ varName: "NPM_AUTH_TOKEN", line: i + 1, reason: "npm auth token" });
-      out.push(`${authM[1]}{{NPM_AUTH_TOKEN}}`);
+    if (authM && !isReferenceValue(authM[2].trim())) {
+      redacted.push({ varName: "NPM_TOKEN", line: i + 1, reason: "npm auth token" });
+      out.push(`${authM[1]}\${NPM_TOKEN}`);
       continue;
     }
     const m = line.match(/^(\s*)([a-zA-Z][a-zA-Z0-9_\-]*)(\s*=\s*)(.+?)\s*$/);
@@ -964,6 +1474,8 @@ function redactGeneric(content) {
 function shouldRedactKeyValue(key, value) {
   if (!value || value.startsWith("{{"))
     return false;
+  if (isReferenceValue(value.trim()))
+    return false;
   if (value.length < MIN_SECRET_VALUE_LEN)
     return false;
   if (/^(true|false|yes|no|on|off|null|undefined|\d+)$/i.test(value))
@@ -985,6 +1497,9 @@ function reasonFor(key, value) {
   }
   return "secret value pattern";
 }
+function isReferenceValue(value) {
+  return /^\{\{[A-Z][A-Z0-9_]*\}\}$/.test(value) || /^\$\{[A-Z][A-Z0-9_]*\}$/.test(value) || /^\$[A-Z][A-Z0-9_]*$/.test(value) || /^%[A-Z][A-Z0-9_]*%$/.test(value);
+}
 function redactContent(content, format) {
   switch (format) {
     case "shell":
@@ -1088,11 +1603,11 @@ function isKnownGeneratedTargetPath(targetPath) {
   return hasClaudeRuleSourceForCursorTarget(targetPath);
 }
 async function syncProject(opts) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const absDir = expandPath(opts.projectDir);
   const projectName = absDir.split("/").pop() || "project";
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
-  const allConfigs = listConfigs(undefined, d);
+  const allConfigs = await store.listConfigs();
   const machine = detectMachineContext();
   for (const pf of PROJECT_CONFIG_FILES) {
     const abs = join3(absDir, pf.file);
@@ -1114,11 +1629,11 @@ async function syncProject(opts) {
       const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === slug);
       if (!existing) {
         if (!opts.dryRun)
-          createConfig({ name, category: pf.category, agent: pf.agent, format: pf.format, content, target_path: targetPath, is_template: isTemplate2 }, d);
+          await store.createConfig({ name, category: pf.category, agent: pf.agent, format: pf.format, content, target_path: targetPath, is_template: isTemplate2 });
         result.added++;
       } else if (existing.content !== content) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { content, is_template: isTemplate2 }, d);
+          await store.updateConfig(existing.id, { content, is_template: isTemplate2 });
         result.updated++;
       } else {
         result.unchanged++;
@@ -1143,11 +1658,11 @@ async function syncProject(opts) {
       const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === slug);
       if (!existing) {
         if (!opts.dryRun)
-          createConfig({ name, category: "rules", agent: "claude", format: "markdown", content, target_path: targetPath, is_template: isTemplate2 }, d);
+          await store.createConfig({ name, category: "rules", agent: "claude", format: "markdown", content, target_path: targetPath, is_template: isTemplate2 });
         result.added++;
       } else if (existing.content !== content) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { content, is_template: isTemplate2 }, d);
+          await store.updateConfig(existing.id, { content, is_template: isTemplate2 });
         result.updated++;
       } else {
         result.unchanged++;
@@ -1157,7 +1672,7 @@ async function syncProject(opts) {
   return result;
 }
 async function syncKnown(opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
   const home = getConfigHome();
   const machine = detectMachineContext();
@@ -1166,7 +1681,7 @@ async function syncKnown(opts = {}) {
     targets = targets.filter((k) => k.agent === opts.agent);
   if (opts.category)
     targets = targets.filter((k) => k.category === opts.category);
-  const allConfigs = listConfigs(undefined, d);
+  const allConfigs = await store.listConfigs();
   const existingOutputOwners = outputOwnerIdsByTarget(allConfigs);
   for (const known of targets) {
     if (known.rulesDir) {
@@ -1195,15 +1710,15 @@ async function syncKnown(opts = {}) {
         const outputs = known.agent === "claude" ? claudeRuleOutputs(f) : known.outputs;
         if (!existing) {
           if (!opts.dryRun)
-            createConfig({ name, category: known.category, agent: known.agent, format: "markdown", content, target_path: targetPath, is_template: isTemplate2, outputs }, d);
+            await store.createConfig({ name, category: known.category, agent: known.agent, format: "markdown", content, target_path: targetPath, is_template: isTemplate2, outputs });
           result.added++;
         } else if (existing.content !== content) {
           if (!opts.dryRun)
-            updateConfig(existing.id, { content, is_template: isTemplate2, outputs }, d);
+            await store.updateConfig(existing.id, { content, is_template: isTemplate2, outputs });
           result.updated++;
         } else if (!outputsEqual(existing.outputs, outputs)) {
           if (!opts.dryRun)
-            updateConfig(existing.id, { outputs }, d);
+            await store.updateConfig(existing.id, { outputs });
           result.updated++;
         } else {
           result.unchanged++;
@@ -1235,7 +1750,7 @@ async function syncKnown(opts = {}) {
       const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === known.name);
       if (!existing) {
         if (!opts.dryRun) {
-          createConfig({
+          await store.createConfig({
             name: known.name,
             category: known.category,
             agent: known.agent,
@@ -1246,16 +1761,16 @@ async function syncKnown(opts = {}) {
             description: known.description,
             is_template: isTemplate2,
             outputs: known.outputs
-          }, d);
+          });
         }
         result.added++;
       } else if (existing.content !== content) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { content, is_template: isTemplate2, outputs: known.outputs }, d);
+          await store.updateConfig(existing.id, { content, is_template: isTemplate2, outputs: known.outputs });
         result.updated++;
       } else if (!outputsEqual(existing.outputs, known.outputs)) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { outputs: known.outputs }, d);
+          await store.updateConfig(existing.id, { outputs: known.outputs });
         result.updated++;
       } else {
         result.unchanged++;
@@ -1267,9 +1782,9 @@ async function syncKnown(opts = {}) {
   return result;
 }
 async function syncToDisk(opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
-  const allFileConfigs = listConfigs({ kind: "file", ...opts.category ? { category: opts.category } : {} }, d);
+  const allFileConfigs = await store.listConfigs({ kind: "file", ...opts.category ? { category: opts.category } : {} });
   const outputOwners = outputOwnerIdsByTarget(allFileConfigs);
   let configs = allFileConfigs.filter((config) => {
     return !isGeneratedOutputTarget2(config, outputOwners);
@@ -1282,7 +1797,7 @@ async function syncToDisk(opts = {}) {
     if (!config.target_path && config.outputs.length === 0)
       continue;
     try {
-      const r = await applyConfig(config, { dryRun: opts.dryRun, db: d, outputAgent: opts.agent });
+      const r = await applyConfig(config, { dryRun: opts.dryRun, store, outputAgent: opts.agent });
       r.changed ? result.updated++ : result.unchanged++;
     } catch {
       result.skipped.push(config.target_path ?? config.id);
@@ -1319,12 +1834,12 @@ function buildDiff(expectedContent, targetPath) {
   return lines.join(`
 `);
 }
-function diffConfig(config, opts = {}) {
+async function diffConfig(config, opts = {}) {
   if (!config.target_path && config.outputs.length === 0)
     return "(reference \u2014 no target path)";
   const diffs = [];
-  const db = opts.db || getDatabase();
-  const contextConfigs = config.outputs.length > 0 || config.target_path ? listConfigs(undefined, db) : [config];
+  const store = opts.store ?? resolveConfigStore();
+  const contextConfigs = config.outputs.length > 0 || config.target_path ? await store.listConfigs() : [config];
   if (isGeneratedOutputTarget2(config, outputOwnerIdsByTarget(contextConfigs))) {
     return "(generated output \u2014 managed by fan-out)";
   }
@@ -1403,8 +1918,7 @@ function detectFormat(filePath) {
 }
 var CLAUDE_PROMPT_OUTPUTS, KNOWN_CONFIGS, PROJECT_CONFIG_FILES;
 var init_sync = __esm(() => {
-  init_database();
-  init_configs();
+  init_config_store();
   init_apply();
   init_redact();
   init_machine();
@@ -1467,14 +1981,14 @@ function shouldSkip(p) {
   return SKIP.some((s) => p.includes(s));
 }
 async function syncFromDir(dir, opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const absDir = expandPath(dir);
   if (!existsSync5(absDir))
     return { added: 0, updated: 0, unchanged: 0, skipped: [`Not found: ${absDir}`] };
   const files = opts.recursive !== false ? walkDir(absDir) : readdirSync2(absDir).map((f) => join4(absDir, f)).filter((f) => statSync2(f).isFile());
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
   const home = homedir3();
-  const allConfigs = listConfigs(undefined, d);
+  const allConfigs = await store.listConfigs();
   for (const file of files) {
     if (shouldSkip(file)) {
       result.skipped.push(file);
@@ -1490,11 +2004,11 @@ async function syncFromDir(dir, opts = {}) {
       const existing = allConfigs.find((c) => c.target_path === targetPath);
       if (!existing) {
         if (!opts.dryRun)
-          createConfig({ name: relative(absDir, file), category: detectCategory(file), agent: detectAgent(file), target_path: targetPath, format: detectFormat(file), content }, d);
+          await store.createConfig({ name: relative(absDir, file), category: detectCategory(file), agent: detectAgent(file), target_path: targetPath, format: detectFormat(file), content });
         result.added++;
       } else if (existing.content !== content) {
         if (!opts.dryRun)
-          updateConfig(existing.id, { content }, d);
+          await store.updateConfig(existing.id, { content });
         result.updated++;
       } else {
         result.unchanged++;
@@ -1506,17 +2020,17 @@ async function syncFromDir(dir, opts = {}) {
   return result;
 }
 async function syncToDir(dir, opts = {}) {
-  const d = opts.db || getDatabase();
+  const store = opts.store ?? resolveConfigStore();
   const home = homedir3();
   const absDir = expandPath(dir);
   const normalized = dir.startsWith("~/") ? dir : absDir.replace(home, "~");
-  const configs = listConfigs(undefined, d).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
+  const configs = (await store.listConfigs()).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
   for (const config of configs) {
     if (config.kind === "reference")
       continue;
     try {
-      const r = await applyConfig(config, { dryRun: opts.dryRun, db: d });
+      const r = await applyConfig(config, { dryRun: opts.dryRun, store });
       r.changed ? result.updated++ : result.unchanged++;
     } catch {
       result.skipped.push(config.target_path || config.id);
@@ -1538,8 +2052,7 @@ function walkDir(dir, files = []) {
 }
 var SKIP;
 var init_sync_dir = __esm(() => {
-  init_database();
-  init_configs();
+  init_config_store();
   init_apply();
   init_sync();
   SKIP = [".db", ".db-shm", ".db-wal", ".log", ".lock", ".DS_Store", "node_modules", ".git"];
@@ -1549,7 +2062,7 @@ var init_sync_dir = __esm(() => {
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@hasna/instructions",
-    version: "0.3.1",
+    version: "0.4.1",
     description: "AI coding agent instruction & configuration manager \u2014 store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.",
     type: "module",
     main: "dist/index.js",
@@ -1564,10 +2077,6 @@ var require_package = __commonJS((exports, module) => {
       ".": {
         types: "./dist/index.d.ts",
         import: "./dist/index.js"
-      },
-      "./storage": {
-        types: "./dist/storage.d.ts",
-        import: "./dist/storage.js"
       }
     },
     files: [
@@ -1578,14 +2087,15 @@ var require_package = __commonJS((exports, module) => {
     ],
     scripts: {
       clean: "rm -rf dist",
-      build: "bun run clean && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external pg --external @modelcontextprotocol/sdk && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external pg --external @modelcontextprotocol/sdk && bun build src/server/index.ts --outdir dist/server --target bun --external pg && bun build src/index.ts src/storage.ts --outdir dist --target bun --external pg && tsc --emitDeclarationOnly --outDir dist",
-      "build:server": "bun run clean && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external pg --external @modelcontextprotocol/sdk && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external pg --external @modelcontextprotocol/sdk && bun build src/server/index.ts --outdir dist/server --target bun --external pg && bun build src/index.ts src/storage.ts --outdir dist --target bun --external pg",
+      build: "bun run clean && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external pg --external @modelcontextprotocol/sdk && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external pg --external @modelcontextprotocol/sdk && bun build src/server/index.ts --outdir dist/server --target bun --external pg && bun build src/index.ts --outdir dist --target bun --external pg && tsc --emitDeclarationOnly --outDir dist",
+      "build:server": "bun run clean && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external pg --external @modelcontextprotocol/sdk && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external pg --external @modelcontextprotocol/sdk && bun build src/server/index.ts --outdir dist/server --target bun --external pg && bun build src/index.ts --outdir dist --target bun --external pg",
       "build:dashboard": "cd dashboard && bun run build",
       migrate: "bun run src/server/index.ts migrate",
       "generate:sdk": "bun run scripts/generate-sdk.ts",
       "kit:check": "bunx @hasna/contracts vendor-kit --check",
       typecheck: "tsc --noEmit",
       test: "bun test",
+      "check:package-secrets": "bun run src/cli/index.tsx package-manager-scan --fail-on-findings --home .",
       "dev:cli": "bun run src/cli/index.tsx",
       "dev:mcp": "bun run src/mcp/index.ts",
       "dev:serve": "bun run src/server/index.ts",
@@ -1649,420 +2159,12 @@ var require_package = __commonJS((exports, module) => {
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // src/mcp/server.ts
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-
-// src/db/storage-sync.ts
-init_database();
-
-// src/db/pg-migrations.ts
-var PG_MIGRATIONS = [
-  `CREATE TABLE IF NOT EXISTS configs (
-    id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    slug TEXT NOT NULL UNIQUE,
-    kind TEXT NOT NULL DEFAULT 'file',
-    category TEXT NOT NULL,
-    agent TEXT NOT NULL DEFAULT 'global',
-    target_path TEXT,
-    outputs TEXT NOT NULL DEFAULT '[]',
-    format TEXT NOT NULL DEFAULT 'text',
-    content TEXT NOT NULL DEFAULT '',
-    description TEXT,
-    tags TEXT NOT NULL DEFAULT '[]',
-    is_template BOOLEAN NOT NULL DEFAULT FALSE,
-    version INTEGER NOT NULL DEFAULT 1,
-    created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL,
-    synced_at TEXT
-  )`,
-  `CREATE TABLE IF NOT EXISTS config_snapshots (
-    id TEXT PRIMARY KEY,
-    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
-    content TEXT NOT NULL,
-    version INTEGER NOT NULL,
-    created_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS profiles (
-    id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    slug TEXT NOT NULL UNIQUE,
-    description TEXT,
-    selectors TEXT NOT NULL DEFAULT '{}',
-    variables TEXT NOT NULL DEFAULT '{}',
-    created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS profile_configs (
-    profile_id TEXT NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
-    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
-    sort_order INTEGER NOT NULL DEFAULT 0,
-    PRIMARY KEY (profile_id, config_id)
-  )`,
-  `CREATE TABLE IF NOT EXISTS machines (
-    id TEXT PRIMARY KEY,
-    hostname TEXT NOT NULL UNIQUE,
-    os TEXT,
-    arch TEXT,
-    last_applied_at TEXT,
-    created_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS feedback (
-    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-    message TEXT NOT NULL,
-    email TEXT,
-    category TEXT DEFAULT 'general',
-    version TEXT,
-    machine_id TEXT,
-    created_at TEXT NOT NULL DEFAULT NOW()::text
-  )`,
-  `ALTER TABLE configs ADD COLUMN IF NOT EXISTS outputs TEXT NOT NULL DEFAULT '[]'`
-];
-
-// src/db/remote-storage.ts
-import pg from "pg";
-var DISABLED_SSL_MODE = "disable";
-function translatePlaceholders(sql) {
-  let index = 0;
-  return sql.replace(/\?/g, () => `$${++index}`);
-}
-function normalizeParams(params) {
-  const flat = params.length === 1 && Array.isArray(params[0]) ? params[0] : params;
-  return flat.map((value) => value === undefined ? null : value);
-}
-function normalizeHost(hostname) {
-  const stripped = hostname.replace(/^\[/, "").replace(/\]$/, "");
-  try {
-    return decodeURIComponent(stripped).toLowerCase();
-  } catch {
-    return stripped.toLowerCase();
-  }
-}
-function isLocalPostgresHost(hostname) {
-  const host = normalizeHost(hostname);
-  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "" || host.startsWith("/");
-}
-function effectivePgHost(url) {
-  const hosts = url.searchParams.getAll("host");
-  const finalHost = hosts.length > 0 ? hosts[hosts.length - 1] : null;
-  return finalHost?.trim() ? finalHost : url.hostname;
-}
-function buildPgPoolConfig(connectionString) {
-  let url;
-  try {
-    url = new URL(connectionString);
-  } catch {
-    throw new Error("Invalid PostgreSQL connection string");
-  }
-  const sslMode = url.searchParams.get("sslmode")?.trim().toLowerCase();
-  const sslValue = url.searchParams.get("ssl")?.trim().toLowerCase();
-  const isLocal = isLocalPostgresHost(effectivePgHost(url));
-  const hasDisabledSsl = sslMode === DISABLED_SSL_MODE || sslValue === "false";
-  if (!isLocal && hasDisabledSsl) {
-    throw new Error("Refusing remote PostgreSQL connection with TLS disabled");
-  }
-  const shouldUseSsl = !isLocal || sslMode === "require" || sslMode === "verify-ca" || sslMode === "verify-full" || sslValue === "true";
-  url.searchParams.delete("sslmode");
-  url.searchParams.delete("ssl");
-  return {
-    connectionString: url.toString(),
-    ssl: shouldUseSsl ? { rejectUnauthorized: true } : undefined
-  };
-}
-
-class PgAdapterAsync {
-  pool;
-  constructor(connectionString) {
-    this.pool = new pg.Pool(buildPgPoolConfig(connectionString));
-  }
-  async run(sql, ...params) {
-    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
-    return { changes: result.rowCount ?? 0 };
-  }
-  async all(sql, ...params) {
-    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
-    return result.rows;
-  }
-  async close() {
-    await this.pool.end();
-  }
-}
-
-// src/db/storage-sync.ts
-var STORAGE_TABLES = ["configs", "config_snapshots", "profiles", "profile_configs", "machines", "feedback"];
-var PRIMARY_KEYS = {
-  configs: ["id"],
-  config_snapshots: ["id"],
-  profiles: ["id"],
-  profile_configs: ["profile_id", "config_id"],
-  machines: ["id"],
-  feedback: ["id"]
-};
-var CONFIGS_STORAGE_ENV = "HASNA_CONFIGS_DATABASE_URL";
-var CONFIGS_STORAGE_FALLBACK_ENV = "CONFIGS_DATABASE_URL";
-var CONFIGS_STORAGE_MODE_ENV = "HASNA_CONFIGS_STORAGE_MODE";
-var CONFIGS_STORAGE_MODE_FALLBACK_ENV = "CONFIGS_STORAGE_MODE";
-var STORAGE_DATABASE_ENV = [CONFIGS_STORAGE_ENV, CONFIGS_STORAGE_FALLBACK_ENV];
-var STORAGE_MODE_ENV = [CONFIGS_STORAGE_MODE_ENV, CONFIGS_STORAGE_MODE_FALLBACK_ENV];
-function firstEnv(names) {
-  for (const name of names) {
-    const value = process.env[name];
-    if (value)
-      return value;
-  }
-  return null;
-}
-function normalizeStorageMode(value) {
-  const normalized = value?.trim().toLowerCase();
-  if (normalized === "local" || normalized === "hybrid" || normalized === "remote")
-    return normalized;
-  return;
-}
-function getStorageDatabaseUrl() {
-  return firstEnv(STORAGE_DATABASE_ENV);
-}
-function getStorageMode() {
-  const mode = normalizeStorageMode(firstEnv(STORAGE_MODE_ENV));
-  if (mode)
-    return mode;
-  return getStorageDatabaseUrl() ? "hybrid" : "local";
-}
-async function getStoragePg() {
-  const url = getStorageDatabaseUrl();
-  if (!url)
-    throw new Error("Missing HASNA_CONFIGS_DATABASE_URL or CONFIGS_DATABASE_URL");
-  return new PgAdapterAsync(url);
-}
-async function runStorageMigrations(remote) {
-  await remote.run("CREATE EXTENSION IF NOT EXISTS pgcrypto");
-  for (const sql of PG_MIGRATIONS)
-    await remote.run(sql);
-}
-async function storagePush(options) {
-  const remote = await getStoragePg();
-  const db = getDatabase();
-  try {
-    await runStorageMigrations(remote);
-    const results = [];
-    for (const table of resolveTables(options?.tables))
-      results.push(await pushTable(db, remote, table));
-    recordSyncMeta(db, "push", results);
-    return results;
-  } finally {
-    await remote.close();
-  }
-}
-async function storagePull(options) {
-  const remote = await getStoragePg();
-  const db = getDatabase();
-  try {
-    await runStorageMigrations(remote);
-    const results = [];
-    for (const table of resolveTables(options?.tables))
-      results.push(await pullTable(remote, db, table));
-    recordSyncMeta(db, "pull", results);
-    return results;
-  } finally {
-    await remote.close();
-  }
-}
-async function storageSync(options) {
-  const pull = await storagePull(options);
-  const push = await storagePush(options);
-  return { pull, push };
-}
-function getStorageSyncMetaAll() {
-  const db = getDatabase();
-  ensureSyncMetaTable(db);
-  return db.query("SELECT table_name, last_synced_at, direction FROM _configs_sync_meta ORDER BY table_name, direction").all();
-}
-function getStorageStatus() {
-  return {
-    configured: Boolean(getStorageDatabaseUrl()),
-    mode: getStorageMode(),
-    env: STORAGE_DATABASE_ENV,
-    service: "configs",
-    tables: STORAGE_TABLES,
-    sync: getStorageSyncMetaAll()
-  };
-}
-function resolveTables(tables) {
-  if (!tables || tables.length === 0)
-    return [...STORAGE_TABLES];
-  const allowed = new Set(STORAGE_TABLES);
-  const requested = tables.map((table) => table.trim()).filter(Boolean);
-  const invalid = requested.filter((table) => !allowed.has(table));
-  if (invalid.length > 0)
-    throw new Error(`Unknown configs sync table(s): ${invalid.join(", ")}`);
-  return requested;
-}
-async function pushTable(db, remote, table) {
-  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
-  try {
-    const rows = db.query(`SELECT * FROM ${quoteIdent(table)}`).all();
-    result.rowsRead = rows.length;
-    if (rows.length === 0)
-      return result;
-    const columns = await filterRemoteColumns(remote, table, Object.keys(rows[0]));
-    result.rowsWritten = await upsertPg(remote, table, columns, rows);
-  } catch (error) {
-    result.errors.push(error instanceof Error ? error.message : String(error));
-  }
-  return result;
-}
-async function pullTable(remote, db, table) {
-  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
-  try {
-    const rows = await remote.all(`SELECT * FROM ${quoteIdent(table)}`);
-    result.rowsRead = rows.length;
-    if (rows.length === 0)
-      return result;
-    const columns = filterLocalColumns(db, table, Object.keys(rows[0]));
-    result.rowsWritten = upsertSqlite(db, table, columns, rows);
-  } catch (error) {
-    result.errors.push(error instanceof Error ? error.message : String(error));
-  }
-  return result;
-}
-async function filterRemoteColumns(remote, table, columns) {
-  const rows = await remote.all("SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = ?", table);
-  if (rows.length === 0)
-    return columns;
-  const allowed = new Set(rows.map((row) => row.column_name));
-  return columns.filter((column) => allowed.has(column));
-}
-function filterLocalColumns(db, table, columns) {
-  const rows = db.query(`PRAGMA table_info(${quoteIdent(table)})`).all();
-  const allowed = new Set(rows.map((row) => row.name));
-  return columns.filter((column) => allowed.has(column));
-}
-async function upsertPg(remote, table, columns, rows) {
-  if (columns.length === 0)
-    return 0;
-  const primaryKeys = PRIMARY_KEYS[table];
-  const columnList = columns.map(quoteIdent).join(", ");
-  const placeholders = columns.map(() => "?").join(", ");
-  const keyList = primaryKeys.map(quoteIdent).join(", ");
-  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
-  const fallbackKey = primaryKeys[0];
-  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = EXCLUDED.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = EXCLUDED.${quoteIdent(fallbackKey)}`;
-  for (const row of rows) {
-    await remote.run(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders}) ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`, ...columns.map((column) => row[column] ?? null));
-  }
-  return rows.length;
-}
-function upsertSqlite(db, table, columns, rows) {
-  if (columns.length === 0)
-    return 0;
-  const primaryKeys = PRIMARY_KEYS[table];
-  const columnList = columns.map(quoteIdent).join(", ");
-  const placeholders = columns.map(() => "?").join(", ");
-  const keyList = primaryKeys.map(quoteIdent).join(", ");
-  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
-  const fallbackKey = primaryKeys[0];
-  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = excluded.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = excluded.${quoteIdent(fallbackKey)}`;
-  const statement = db.prepare(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders}) ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`);
-  db.transaction((batch) => {
-    for (const row of batch)
-      statement.run(...columns.map((column) => coerceForSqlite(row[column])));
-  })(rows);
-  return rows.length;
-}
-function recordSyncMeta(db, direction, results) {
-  ensureSyncMetaTable(db);
-  const now2 = new Date().toISOString();
-  const statement = db.prepare("INSERT INTO _configs_sync_meta (table_name, last_synced_at, direction) VALUES (?, ?, ?) ON CONFLICT(table_name, direction) DO UPDATE SET last_synced_at = excluded.last_synced_at");
-  for (const result of results) {
-    if (result.errors.length > 0)
-      continue;
-    statement.run(result.table, now2, direction);
-  }
-}
-function ensureSyncMetaTable(db) {
-  db.exec("CREATE TABLE IF NOT EXISTS _configs_sync_meta (table_name TEXT NOT NULL, last_synced_at TEXT, direction TEXT NOT NULL CHECK(direction IN ('push', 'pull')), PRIMARY KEY (table_name, direction))");
-}
-function quoteIdent(identifier) {
-  return `"${identifier.replace(/"/g, '""')}"`;
-}
-function coerceForSqlite(value) {
-  if (value === undefined || value === null)
-    return null;
-  if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean")
-    return value;
-  if (value instanceof Date)
-    return value.toISOString();
-  if (Buffer.isBuffer(value) || value instanceof Uint8Array)
-    return value;
-  if (typeof value === "object")
-    return JSON.stringify(value);
-  return String(value);
-}
-
-// src/mcp/server.ts
-init_configs();
+init_config_store();
 init_apply();
 init_sync_dir();
-
-// src/db/profiles.ts
-init_types();
-init_database();
-init_configs();
-init_machine();
-function rowToProfile(row) {
-  return {
-    ...row,
-    selectors: JSON.parse(row.selectors || "{}"),
-    variables: JSON.parse(row.variables || "{}")
-  };
-}
-function getProfile(idOrSlug, db) {
-  const d = db || getDatabase();
-  const row = d.query("SELECT * FROM profiles WHERE id = ? OR slug = ?").get(idOrSlug, idOrSlug);
-  if (!row)
-    throw new ProfileNotFoundError(idOrSlug);
-  return rowToProfile(row);
-}
-function listProfiles(db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM profiles ORDER BY name").all().map(rowToProfile);
-}
-function getProfileConfigs(profileIdOrSlug, db) {
-  const d = db || getDatabase();
-  const profile = getProfile(profileIdOrSlug, d);
-  const rows = d.query("SELECT config_id FROM profile_configs WHERE profile_id = ? ORDER BY sort_order").all(profile.id);
-  if (rows.length === 0)
-    return [];
-  const ids = rows.map((r) => r.config_id);
-  return listConfigs(undefined, d).filter((c) => ids.includes(c.id));
-}
-function profileHasSelectors(profile) {
-  const selectors = profile.selectors ?? {};
-  return (selectors.os?.length ?? 0) > 0 || (selectors.arch?.length ?? 0) > 0 || (selectors.hostnames?.length ?? 0) > 0;
-}
-function profileMatchesMachine(profile, machine) {
-  const selectors = profile.selectors ?? {};
-  const osMatches = !selectors.os?.length || selectors.os.some((candidate) => {
-    const value = candidate.trim().toLowerCase();
-    return value === machine.os_family || value === (machine.os ?? "").trim().toLowerCase() || normalizeOsFamily(candidate) === machine.os_family;
-  });
-  const archMatches = !selectors.arch?.length || selectors.arch.some((candidate) => candidate.trim().toLowerCase() === (machine.arch ?? "").trim().toLowerCase());
-  const hostnameMatches = !selectors.hostnames?.length || selectors.hostnames.some((candidate) => candidate.trim().toLowerCase() === machine.hostname.trim().toLowerCase());
-  return osMatches && archMatches && hostnameMatches;
-}
-function resolveProfileForMachine(machine = detectMachineContext(), db) {
-  const profiles = listProfiles(db).filter(profileHasSelectors);
-  const matches = profiles.filter((profile) => profileMatchesMachine(profile, machine)).map((profile) => {
-    const selectors = profile.selectors;
-    const score = (selectors.hostnames?.length ? 100 : 0) + (selectors.os?.length ? 10 : 0) + (selectors.arch?.length ? 10 : 0);
-    return { profile, score };
-  }).sort((a, b) => b.score - a.score || a.profile.name.localeCompare(b.profile.name));
-  return matches[0]?.profile ?? null;
-}
-
-// src/mcp/server.ts
-init_apply();
-init_snapshots();
 init_machine();
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 
 // src/lib/compact-output.ts
 var DEFAULT_LIST_LIMIT = 20;
@@ -2208,11 +2310,7 @@ var ALL_LEAN_TOOLS = [
   { name: "heartbeat", description: "Update last_seen_at.", inputSchema: { type: "object", properties: { agent_id: { type: "string" } }, required: ["agent_id"] } },
   { name: "set_focus", description: "Set active project context.", inputSchema: { type: "object", properties: { agent_id: { type: "string" }, project_id: { type: "string" } }, required: ["agent_id"] } },
   { name: "list_agents", description: "List all registered agents.", inputSchema: { type: "object", properties: {} } },
-  { name: "send_feedback", description: "Send feedback about this service", inputSchema: { type: "object", properties: { message: { type: "string" }, email: { type: "string" }, category: { type: "string", enum: ["bug", "feature", "general"] } }, required: ["message"] } },
-  { name: "storage_status", description: "Show storage sync configuration and local sync history.", inputSchema: { type: "object", properties: {} } },
-  { name: "storage_push", description: "Push local configs data to storage PostgreSQL.", inputSchema: { type: "object", properties: { tables: { type: "array", items: { type: "string" } } } } },
-  { name: "storage_pull", description: "Pull configs data from storage PostgreSQL to local SQLite.", inputSchema: { type: "object", properties: { tables: { type: "array", items: { type: "string" } } } } },
-  { name: "storage_sync", description: "Bidirectional configs sync: pull then push.", inputSchema: { type: "object", properties: { tables: { type: "array", items: { type: "string" } } } } }
+  { name: "send_feedback", description: "Send feedback about this service", inputSchema: { type: "object", properties: { message: { type: "string" }, email: { type: "string" }, category: { type: "string", enum: ["bug", "feature", "general"] } }, required: ["message"] } }
 ];
 function ok(data) {
   return { content: [{ type: "text", text: JSON.stringify(data) }] };
@@ -2227,10 +2325,11 @@ function buildServer() {
   server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: LEAN_TOOLS }));
   server.setRequestHandler(CallToolRequestSchema, async (req) => {
     const { name, arguments: args = {} } = req.params;
+    const store = resolveConfigStore();
     try {
       switch (name) {
         case "list_configs": {
-          const configs = listConfigs({
+          const configs = await store.listConfigs({
             category: args["category"] || undefined,
             agent: args["agent"] || undefined,
             kind: args["kind"] || undefined,
@@ -2244,11 +2343,11 @@ function buildServer() {
           }));
         }
         case "get_config": {
-          const c = getConfig(args["id_or_slug"]);
+          const c = await store.getConfig(args["id_or_slug"]);
           return ok(c);
         }
         case "create_config": {
-          const c = createConfig({
+          const c = await store.createConfig({
             name: args["name"],
             content: args["content"],
             category: args["category"],
@@ -2264,7 +2363,7 @@ function buildServer() {
           return ok({ id: c.id, slug: c.slug, name: c.name });
         }
         case "update_config": {
-          const c = updateConfig(args["id_or_slug"], {
+          const c = await store.updateConfig(args["id_or_slug"], {
             content: args["content"],
             name: args["name"],
             tags: args["tags"],
@@ -2277,23 +2376,22 @@ function buildServer() {
           return ok({ id: c.id, slug: c.slug, version: c.version });
         }
         case "delete_config": {
-          const { deleteConfig: deleteConfig2 } = await Promise.resolve().then(() => (init_configs(), exports_configs));
-          deleteConfig2(args["id_or_slug"]);
+          await store.deleteConfig(args["id_or_slug"]);
           return ok({ deleted: true });
         }
         case "apply_config": {
-          const config = getConfig(args["id_or_slug"]);
-          const result = await applyConfig(config, { dryRun: args["dry_run"] });
+          const config = await store.getConfig(args["id_or_slug"]);
+          const result = await applyConfig(config, { dryRun: args["dry_run"], store });
           return ok(args["verbose"] ? result : summarizeApplyResult(result));
         }
         case "sync_directory": {
           const dir = args["dir"];
           const direction = args["direction"] || "from_disk";
-          const result = direction === "to_disk" ? await syncToDir(dir) : await syncFromDir(dir);
+          const result = direction === "to_disk" ? await syncToDir(dir, { store }) : await syncFromDir(dir, { store });
           return ok(result);
         }
         case "list_profiles": {
-          const profiles = listProfiles().map((profile) => summarizeProfile(profile, { verbose: Boolean(args["verbose"]) }));
+          const profiles = (await store.listProfiles()).map((profile) => summarizeProfile(profile, { verbose: Boolean(args["verbose"]) }));
           return ok(pagedPayload(profiles, {
             limit: args["limit"],
             cursor: args["cursor"],
@@ -2308,12 +2406,12 @@ function buildServer() {
           });
           if (!args["auto"] && !args["id_or_slug"])
             return err("id_or_slug is required unless auto=true");
-          const profile = args["auto"] ? resolveProfileForMachine(machine) : getProfile(args["id_or_slug"]);
+          const profile = args["auto"] ? await store.resolveProfileForMachine(machine) : await store.getProfile(args["id_or_slug"]);
           if (!profile)
             return err("No matching machine-aware profile found");
-          const configs = getProfileConfigs(profile.id);
+          const configs = await store.getProfileConfigs(profile.id);
           const vars = resolveProfileVariables(profile, machine);
-          const results = await applyConfigs(configs, { dryRun: args["dry_run"], vars });
+          const results = await applyConfigs(configs, { dryRun: args["dry_run"], vars, store });
           return ok({
             profile: summarizeProfile(profile, { verbose: Boolean(args["verbose"]) }),
             machine: {
@@ -2328,17 +2426,17 @@ function buildServer() {
           });
         }
         case "get_snapshot": {
-          const config = getConfig(args["config_id_or_slug"]);
+          const config = await store.getConfig(args["config_id_or_slug"]);
           if (args["version"]) {
-            const snap = getSnapshotByVersion(config.id, args["version"]);
+            const snap = await store.getSnapshotByVersion(config.id, args["version"]);
             return snap ? ok(snap) : err("Snapshot not found");
           }
-          const snaps = listSnapshots(config.id);
+          const snaps = await store.listSnapshots(config.id);
           return ok(snaps[0] ?? null);
         }
         case "get_status": {
-          const stats = getConfigStats();
-          const allConfigs = listConfigs({ kind: "file" });
+          const stats = await store.getConfigStats();
+          const allConfigs = await store.listConfigs({ kind: "file" });
           const { existsSync: ex, readFileSync: rf } = await import("fs");
           const { expandPath: expandPath2 } = await Promise.resolve().then(() => (init_apply(), exports_apply));
           const { redactContent: redactContent2 } = await Promise.resolve().then(() => (init_redact(), exports_redact));
@@ -2374,6 +2472,7 @@ function buildServer() {
         case "sync_known": {
           const { syncKnown: syncKnown2 } = await Promise.resolve().then(() => (init_sync(), exports_sync));
           const result = await syncKnown2({
+            store,
             agent: args["agent"] || undefined,
             category: args["category"] || undefined
           });
@@ -2382,12 +2481,12 @@ function buildServer() {
         case "sync_project": {
           const { syncProject: syncProject2 } = await Promise.resolve().then(() => (init_sync(), exports_sync));
           const dir = args["project_dir"] || process.cwd();
-          const result = await syncProject2({ projectDir: dir });
+          const result = await syncProject2({ store, projectDir: dir });
           return ok(result);
         }
         case "render_template": {
           const { renderTemplate: renderTemplate2 } = await Promise.resolve().then(() => (init_template(), exports_template));
-          const config = getConfig(args["id_or_slug"]);
+          const config = await store.getConfig(args["id_or_slug"]);
           const vars = args["vars"] || {};
           if (args["use_env"]) {
             const { extractTemplateVars: extractTemplateVars2 } = await Promise.resolve().then(() => (init_template(), exports_template));
@@ -2402,7 +2501,7 @@ function buildServer() {
         }
         case "scan_secrets": {
           const { scanSecrets: scanSecrets2, redactContent: redactContent2 } = await Promise.resolve().then(() => (init_redact(), exports_redact));
-          const configs = args["id_or_slug"] ? [getConfig(args["id_or_slug"])] : listConfigs({ kind: "file" });
+          const configs = args["id_or_slug"] ? [await store.getConfig(args["id_or_slug"])] : await store.listConfigs({ kind: "file" });
           const findings = [];
           for (const c of configs) {
             const fmt = c.format;
@@ -2411,7 +2510,7 @@ function buildServer() {
               findings.push({ slug: c.slug, secrets: secrets.length, vars: secrets.map((s) => s.varName) });
               if (args["fix"]) {
                 const { content, isTemplate: isTemplate2 } = redactContent2(c.content, fmt);
-                updateConfig(c.id, { content, is_template: isTemplate2 });
+                await store.updateConfig(c.id, { content, is_template: isTemplate2 });
               }
             }
           }
@@ -2467,27 +2566,15 @@ function buildServer() {
           return ok([..._cfgAgents.values()]);
         }
         case "send_feedback": {
-          const { getDatabase: getDatabase2 } = await Promise.resolve().then(() => (init_database(), exports_database));
-          const db = getDatabase2();
           const pkg = require_package();
-          db.run("INSERT INTO feedback (message, email, category, version) VALUES (?, ?, ?, ?)", [args["message"], args["email"] || null, args["category"] || "general", pkg.version]);
+          await store.sendFeedback({
+            message: args["message"],
+            email: args["email"] || null,
+            category: args["category"] || "general",
+            version: pkg.version
+          });
           return ok({ message: "Feedback saved. Thank you!" });
         }
-        case "storage_status": {
-          return ok(getStorageStatus());
-        }
-        case "storage_push": {
-          const tables = Array.isArray(args["tables"]) ? args["tables"] : undefined;
-          return ok(await storagePush(tables ? { tables } : undefined));
-        }
-        case "storage_pull": {
-          const tables = Array.isArray(args["tables"]) ? args["tables"] : undefined;
-          return ok(await storagePull(tables ? { tables } : undefined));
-        }
-        case "storage_sync": {
-          const tables = Array.isArray(args["tables"]) ? args["tables"] : undefined;
-          return ok(await storageSync(tables ? { tables } : undefined));
-        }
         default:
           return err(`Unknown tool: ${name}`);
       }