@hasna/instructions 0.4.36 → 0.4.39

package/dist/cli/index.js

@@ -20,12 +20,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -47,8 +49,8 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// node_modules/commander/lib/error.js
-var require_error = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@13.1.0/node_modules/commander/lib/error.js
+var require_error = __commonJS(function(exports) {
   class CommanderError extends Error {
     constructor(exitCode, code, message) {
       super(message);
@@ -71,8 +73,8 @@ var require_error = __commonJS((exports) => {
   exports.InvalidArgumentError = InvalidArgumentError;
 });
 
-// node_modules/commander/lib/argument.js
-var require_argument = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@13.1.0/node_modules/commander/lib/argument.js
+var require_argument = __commonJS(function(exports) {
   var { InvalidArgumentError } = require_error();
 
   class Argument {
@@ -150,8 +152,8 @@ var require_argument = __commonJS((exports) => {
   exports.humanReadableArgName = humanReadableArgName;
 });
 
-// node_modules/commander/lib/help.js
-var require_help = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@13.1.0/node_modules/commander/lib/help.js
+var require_help = __commonJS(function(exports) {
   var { humanReadableArgName } = require_argument();
 
   class Help {
@@ -500,8 +502,8 @@ ${itemIndentStr}`);
   exports.stripColor = stripColor;
 });
 
-// node_modules/commander/lib/option.js
-var require_option = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@13.1.0/node_modules/commander/lib/option.js
+var require_option = __commonJS(function(exports) {
   var { InvalidArgumentError } = require_error();
 
   class Option {
@@ -678,8 +680,8 @@ var require_option = __commonJS((exports) => {
   exports.DualOptions = DualOptions;
 });
 
-// node_modules/commander/lib/suggestSimilar.js
-var require_suggestSimilar = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@13.1.0/node_modules/commander/lib/suggestSimilar.js
+var require_suggestSimilar = __commonJS(function(exports) {
   var maxDistance = 3;
   function editDistance(a, b) {
     if (Math.abs(a.length - b.length) > maxDistance)
@@ -751,8 +753,8 @@ var require_suggestSimilar = __commonJS((exports) => {
   exports.suggestSimilar = suggestSimilar;
 });
 
-// node_modules/commander/lib/command.js
-var require_command = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@13.1.0/node_modules/commander/lib/command.js
+var require_command = __commonJS(function(exports) {
   var EventEmitter = __require("events").EventEmitter;
   var childProcess = __require("child_process");
   var path = __require("path");
@@ -2061,8 +2063,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
   exports.useColor = useColor;
 });
 
-// node_modules/commander/index.js
-var require_commander = __commonJS((exports) => {
+// ../../node_modules/.bun/commander@13.1.0/node_modules/commander/index.js
+var require_commander = __commonJS(function(exports) {
   var { Argument } = require_argument();
   var { Command } = require_command();
   var { CommanderError, InvalidArgumentError } = require_error();
@@ -2136,19 +2138,51 @@ var init_types = __esm(() => {
   };
 });
 
+// src/lib/retired-storage-mode.ts
+function firstDefinedEnvKey(env, keys) {
+  for (const key of keys) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined)
+      return key;
+  }
+  return null;
+}
+function assertNoLegacyStorageMode(env = process.env) {
+  const legacyKey = firstDefinedEnvKey(env, LEGACY_STORAGE_MODE_KEYS);
+  if (!legacyKey)
+    return;
+  throw new Error(`${legacyKey} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `The client uses the local SQLite store, or the HTTP API selected by ` + `HASNA_INSTRUCTIONS_API_URL + HASNA_INSTRUCTIONS_API_KEY. ` + `On the server, set HASNA_INSTRUCTIONS_DATABASE_URL to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+}
+var LEGACY_STORAGE_MODE_KEYS;
+var init_retired_storage_mode = __esm(() => {
+  LEGACY_STORAGE_MODE_KEYS = [
+    "HASNA_INSTRUCTIONS_STORAGE_MODE",
+    "HASNA_INSTRUCTIONS_MODE",
+    "INSTRUCTIONS_STORAGE_MODE",
+    "INSTRUCTIONS_MODE"
+  ];
+});
+
+// src/lib/raw-store-root.ts
+import { homedir as homedir2 } from "os";
+import { join as join2, resolve } from "path";
+function getRawStoreRoot() {
+  return resolve(process.env[RAW_STORE_ROOT_ENV] || join2(process.env["HOME"] || homedir2(), ".hasna", "instructions"));
+}
+var RAW_STORE_ROOT_ENV = "HASNA_CONFIGS_HOME";
+var init_raw_store_root = () => {};
+
 // src/db/database.ts
 import { Database } from "bun:sqlite";
 import { existsSync as existsSync2, mkdirSync, rmSync } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function getDbPath() {
   if (process.env["HASNA_INSTRUCTIONS_DB_PATH"]) {
     return process.env["HASNA_INSTRUCTIONS_DB_PATH"];
   }
-  const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-  const dir = join2(home, ".hasna", "instructions");
+  const dir = getRawStoreRoot();
   mkdirSync(dir, { recursive: true });
-  return join2(dir, "instructions.db");
+  return join3(dir, "instructions.db");
 }
 function uuid() {
   return randomUUID3();
@@ -2162,8 +2196,9 @@ function slugify(name) {
 function getDatabase(path) {
   if (_db)
     return _db;
+  assertNoLegacyStorageMode();
   if (!path && process.env["HASNA_INSTRUCTIONS_API_URL"] && process.env["HASNA_INSTRUCTIONS_API_KEY"]) {
-    throw new Error("instructions is in self_hosted (cloud) mode: this command is not wired to the cloud API yet. " + "Unset HASNA_INSTRUCTIONS_API_URL / HASNA_INSTRUCTIONS_API_KEY to use it against the local store.");
+    throw new Error("instructions is using the HTTP API transport (HASNA_INSTRUCTIONS_API_URL set): this command is not wired to the API yet. " + "Unset HASNA_INSTRUCTIONS_API_URL / HASNA_INSTRUCTIONS_API_KEY to use it against the local store.");
   }
   const dbPath = path || getDbPath();
   const db = new Database(dbPath);
@@ -2244,6 +2279,8 @@ function insertFeedback(input, db) {
 }
 var MIGRATIONS, _db = null;
 var init_database = __esm(() => {
+  init_retired_storage_mode();
+  init_raw_store_root();
   MIGRATIONS = [
     `
   CREATE TABLE IF NOT EXISTS configs (
@@ -2328,6 +2365,37 @@ var init_database = __esm(() => {
   ];
 });
 
+// src/db/snapshots.ts
+function createSnapshot(configId, content, version, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  const ts = now2();
+  d.run("INSERT INTO config_snapshots (id, config_id, content, version, created_at) VALUES (?, ?, ?, ?, ?)", [id, configId, content, version, ts]);
+  return { id, config_id: configId, content, version, created_at: ts };
+}
+function listSnapshots(configId, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? ORDER BY version DESC").all(configId);
+}
+function getSnapshot(id, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE id = ?").get(id);
+}
+function getSnapshotByVersion(configId, version, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? AND version = ?").get(configId, version);
+}
+function pruneSnapshots(configId, keep = 10, db) {
+  const d = db || getDatabase();
+  const result = d.run(`DELETE FROM config_snapshots WHERE config_id = ? AND id NOT IN (
+      SELECT id FROM config_snapshots WHERE config_id = ? ORDER BY version DESC LIMIT ?
+    )`, [configId, configId, keep]);
+  return result.changes;
+}
+var init_snapshots = __esm(() => {
+  init_database();
+});
+
 // src/db/configs.ts
 function rowToConfig(row) {
   let outputs = [];
@@ -2366,25 +2434,28 @@ function createConfig(input, db) {
   const slug = uniqueSlug(input.name, d);
   const tags = JSON.stringify(input.tags || []);
   const outputs = JSON.stringify(input.outputs || []);
-  d.run(`INSERT INTO configs (id, name, slug, kind, category, agent, target_path, outputs, format, content, description, tags, is_template, version, created_at, updated_at, synced_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, NULL)`, [
-    id,
-    input.name,
-    slug,
-    input.kind ?? "file",
-    input.category,
-    input.agent ?? "global",
-    input.target_path ?? null,
-    outputs,
-    input.format ?? "text",
-    input.content,
-    input.description ?? null,
-    tags,
-    input.is_template ? 1 : 0,
-    ts,
-    ts
-  ]);
-  return getConfig(id, d);
+  return d.transaction(() => {
+    d.run(`INSERT INTO configs (id, name, slug, kind, category, agent, target_path, outputs, format, content, description, tags, is_template, version, created_at, updated_at, synced_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, NULL)`, [
+      id,
+      input.name,
+      slug,
+      input.kind ?? "file",
+      input.category,
+      input.agent ?? "global",
+      input.target_path ?? null,
+      outputs,
+      input.format ?? "text",
+      input.content,
+      input.description ?? null,
+      tags,
+      input.is_template ? 1 : 0,
+      ts,
+      ts
+    ]);
+    createSnapshot(id, input.content, 1, d);
+    return getConfig(id, d);
+  })();
 }
 function getConfig(idOrSlug, db) {
   const d = db || getDatabase();
@@ -2489,9 +2560,13 @@ function updateConfig(idOrSlug, input, db) {
     updates.push("synced_at = ?");
     params.push(input.synced_at);
   }
-  params.push(existing.id);
-  d.run(`UPDATE configs SET ${updates.join(", ")} WHERE id = ?`, params);
-  return getConfigById(existing.id, d);
+  return d.transaction(() => {
+    params.push(existing.id);
+    d.run(`UPDATE configs SET ${updates.join(", ")} WHERE id = ?`, params);
+    const updated = getConfigById(existing.id, d);
+    createSnapshot(updated.id, updated.content, updated.version, d);
+    return updated;
+  })();
 }
 function deleteConfig(idOrSlug, db) {
   const d = db || getDatabase();
@@ -2511,16 +2586,17 @@ function getConfigStats(db) {
 var init_configs = __esm(() => {
   init_types();
   init_database();
+  init_snapshots();
 });
 
 // src/lib/template.ts
 var exports_template = {};
 __export(exports_template, {
-  renderTemplatePreview: () => renderTemplatePreview,
-  renderTemplate: () => renderTemplate,
-  parseTemplateVars: () => parseTemplateVars,
+  extractTemplateVars: () => extractTemplateVars,
   isTemplate: () => isTemplate,
-  extractTemplateVars: () => extractTemplateVars
+  parseTemplateVars: () => parseTemplateVars,
+  renderTemplate: () => renderTemplate,
+  renderTemplatePreview: () => renderTemplatePreview
 });
 function parseTemplateVars(content) {
   const names = new Set;
@@ -2584,9 +2660,9 @@ var init_template = __esm(() => {
 });
 
 // src/lib/machine.ts
-import { arch as currentArch, homedir as homedir2, hostname as currentHostname, type as currentOsType } from "os";
+import { arch as currentArch, homedir as homedir3, hostname as currentHostname, type as currentOsType } from "os";
 import { existsSync as existsSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function normalizeOsFamily(os) {
   const value = (os ?? "").trim().toLowerCase();
   if (value === "darwin" || value === "macos" || value === "mac" || value === "osx")
@@ -2598,11 +2674,11 @@ function normalizeOsFamily(os) {
   return value || "unknown";
 }
 function detectMachineContext(overrides = {}) {
-  const homeDir = overrides.home_dir ?? process.env["CONFIGS_HOME"] ?? process.env["HOME"] ?? homedir2();
+  const homeDir = overrides.home_dir ?? process.env["CONFIGS_HOME"] ?? process.env["HOME"] ?? homedir3();
   const os = overrides.os ?? currentOsType();
   const osFamily = normalizeOsFamily(os);
-  const bunBinDir = overrides.bun_bin_dir ?? join3(homeDir, ".bun", "bin");
-  const defaultBunPath = osFamily === "macos" && existsSync3(BREW_BUN_PATH) ? BREW_BUN_PATH : join3(bunBinDir, "bun");
+  const bunBinDir = overrides.bun_bin_dir ?? join4(homeDir, ".bun", "bin");
+  const defaultBunPath = osFamily === "macos" && existsSync3(BREW_BUN_PATH) ? BREW_BUN_PATH : join4(bunBinDir, "bun");
   return {
     id: "current-machine",
     hostname: overrides.hostname ?? currentHostname(),
@@ -2612,10 +2688,10 @@ function detectMachineContext(overrides = {}) {
     created_at: "",
     os_family: osFamily,
     home_dir: homeDir,
-    workspace_root: overrides.workspace_root ?? join3(homeDir, osFamily === "macos" ? "Workspace" : "workspace"),
+    workspace_root: overrides.workspace_root ?? join4(homeDir, osFamily === "macos" ? "Workspace" : "workspace"),
     bun_bin_dir: bunBinDir,
     bun_path: overrides.bun_path ?? defaultBunPath,
-    path_prefix: overrides.path_prefix ?? (osFamily === "macos" ? `${join3("/opt", "homebrew", "bin")}:${bunBinDir}` : bunBinDir)
+    path_prefix: overrides.path_prefix ?? (osFamily === "macos" ? `${join4("/opt", "homebrew", "bin")}:${bunBinDir}` : bunBinDir)
   };
 }
 function machineContextToVariables(machine) {
@@ -3037,7 +3113,7 @@ Policy reference: \`${CODEWITH_SHARED_TODOS_STORAGE_POLICY_REFERENCE}\`
 `;
 });
 
-// node_modules/zod/v3/helpers/util.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType = (data) => {
   const t = typeof data;
   switch (t) {
@@ -3168,7 +3244,7 @@ var init_util = __esm(() => {
   ]);
 });
 
-// node_modules/zod/v3/ZodError.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode, quotelessJson = (obj) => {
   const json = JSON.stringify(obj, null, 2);
   return json.replace(/"([^"]+)":/g, "$1:");
@@ -3289,7 +3365,7 @@ var init_ZodError = __esm(() => {
   };
 });
 
-// node_modules/zod/v3/locales/en.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -3396,7 +3472,7 @@ var init_en = __esm(() => {
   en_default = errorMap;
 });
 
-// node_modules/zod/v3/errors.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
 function setErrorMap(map) {
   overrideErrorMap = map;
 }
@@ -3409,7 +3485,7 @@ var init_errors = __esm(() => {
   overrideErrorMap = en_default;
 });
 
-// node_modules/zod/v3/helpers/parseUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 function addIssueToContext(ctx, issueData) {
   const overrideMap = getErrorMap();
   const issue = makeIssue({
@@ -3514,10 +3590,10 @@ var init_parseUtil = __esm(() => {
   });
 });
 
-// node_modules/zod/v3/helpers/typeAliases.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/typeAliases.js
 var init_typeAliases = () => {};
 
-// node_modules/zod/v3/helpers/errorUtil.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 var init_errorUtil = __esm(() => {
   (function(errorUtil2) {
@@ -3526,7 +3602,7 @@ var init_errorUtil = __esm(() => {
   })(errorUtil || (errorUtil = {}));
 });
 
-// node_modules/zod/v3/types.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -6877,208 +6953,208 @@ var init_types2 = __esm(() => {
   NEVER = INVALID;
 });
 
-// node_modules/zod/v3/external.js
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
-  void: () => voidType,
-  util: () => util,
-  unknown: () => unknownType,
-  union: () => unionType,
-  undefined: () => undefinedType,
-  tuple: () => tupleType,
-  transformer: () => effectsType,
-  symbol: () => symbolType,
-  string: () => stringType,
-  strictObject: () => strictObjectType,
-  setErrorMap: () => setErrorMap,
-  set: () => setType,
-  record: () => recordType,
-  quotelessJson: () => quotelessJson,
-  promise: () => promiseType,
-  preprocess: () => preprocessType,
-  pipeline: () => pipelineType,
-  ostring: () => ostring,
-  optional: () => optionalType,
-  onumber: () => onumber,
-  oboolean: () => oboolean,
-  objectUtil: () => objectUtil,
-  object: () => objectType,
-  number: () => numberType,
-  nullable: () => nullableType,
-  null: () => nullType,
-  never: () => neverType,
-  nativeEnum: () => nativeEnumType,
-  nan: () => nanType,
-  map: () => mapType,
-  makeIssue: () => makeIssue,
-  literal: () => literalType,
-  lazy: () => lazyType,
-  late: () => late,
-  isValid: () => isValid,
-  isDirty: () => isDirty,
-  isAsync: () => isAsync,
-  isAborted: () => isAborted,
-  intersection: () => intersectionType,
-  instanceof: () => instanceOfType,
-  getParsedType: () => getParsedType,
-  getErrorMap: () => getErrorMap,
-  function: () => functionType,
-  enum: () => enumType,
-  effect: () => effectsType,
-  discriminatedUnion: () => discriminatedUnionType,
-  defaultErrorMap: () => en_default,
-  datetimeRegex: () => datetimeRegex,
-  date: () => dateType,
-  custom: () => custom,
-  coerce: () => coerce,
-  boolean: () => booleanType,
-  bigint: () => bigIntType,
-  array: () => arrayType,
-  any: () => anyType,
-  addIssueToContext: () => addIssueToContext,
-  ZodVoid: () => ZodVoid,
-  ZodUnknown: () => ZodUnknown,
-  ZodUnion: () => ZodUnion,
-  ZodUndefined: () => ZodUndefined,
-  ZodType: () => ZodType,
-  ZodTuple: () => ZodTuple,
-  ZodTransformer: () => ZodEffects,
-  ZodSymbol: () => ZodSymbol,
-  ZodString: () => ZodString,
-  ZodSet: () => ZodSet,
-  ZodSchema: () => ZodType,
-  ZodRecord: () => ZodRecord,
-  ZodReadonly: () => ZodReadonly,
-  ZodPromise: () => ZodPromise,
-  ZodPipeline: () => ZodPipeline,
-  ZodParsedType: () => ZodParsedType,
-  ZodOptional: () => ZodOptional,
-  ZodObject: () => ZodObject,
-  ZodNumber: () => ZodNumber,
-  ZodNullable: () => ZodNullable,
-  ZodNull: () => ZodNull,
-  ZodNever: () => ZodNever,
-  ZodNativeEnum: () => ZodNativeEnum,
-  ZodNaN: () => ZodNaN,
-  ZodMap: () => ZodMap,
-  ZodLiteral: () => ZodLiteral,
-  ZodLazy: () => ZodLazy,
-  ZodIssueCode: () => ZodIssueCode,
-  ZodIntersection: () => ZodIntersection,
-  ZodFunction: () => ZodFunction,
-  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
-  ZodError: () => ZodError,
-  ZodEnum: () => ZodEnum,
-  ZodEffects: () => ZodEffects,
-  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
-  ZodDefault: () => ZodDefault,
-  ZodDate: () => ZodDate,
-  ZodCatch: () => ZodCatch,
-  ZodBranded: () => ZodBranded,
-  ZodBoolean: () => ZodBoolean,
-  ZodBigInt: () => ZodBigInt,
-  ZodArray: () => ZodArray,
-  ZodAny: () => ZodAny,
-  Schema: () => ZodType,
-  ParseStatus: () => ParseStatus,
-  OK: () => OK,
-  NEVER: () => NEVER,
-  INVALID: () => INVALID,
-  EMPTY_PATH: () => EMPTY_PATH,
+  BRAND: () => BRAND,
   DIRTY: () => DIRTY,
-  BRAND: () => BRAND
-});
-var init_external = __esm(() => {
-  init_errors();
-  init_parseUtil();
-  init_typeAliases();
-  init_util();
-  init_types2();
-  init_ZodError();
-});
-
-// node_modules/zod/index.js
-var init_zod = __esm(() => {
-  init_external();
-  init_external();
-});
-
-// src/lib/redact.ts
-function redactShell(content) {
-  const redacted = [];
-  const lines = content.split(`
-`);
-  const out = [];
-  for (let i = 0;i < lines.length; i++) {
-    const line = lines[i];
-    const m = line.match(/^(\s*(?:export\s+)?)([A-Z][A-Z0-9_]*)(\s*=\s*)(['"]?)(.+?)\4\s*$/);
-    if (m) {
-      const [, prefix, key, eq, quote, value] = m;
-      if (shouldRedactKeyValue(key, value)) {
-        const reason = reasonFor(key, value);
-        redacted.push({ varName: key, line: i + 1, reason });
-        out.push(`${prefix}${key}${eq}${quote}{{${key}}}${quote}`);
-        continue;
-      }
-    }
-    out.push(line);
-  }
-  return { content: out.join(`
-`), redacted, isTemplate: redacted.length > 0 };
-}
-function redactJson(content) {
-  const redacted = [];
-  const lines = content.split(`
-`);
-  const out = [];
-  for (let i = 0;i < lines.length; i++) {
-    const line = lines[i];
-    const m = line.match(/^(\s*"([^"]+)"\s*:\s*)"([^"]+)"(,?)(\s*)$/);
-    if (m) {
-      const [, prefix, key, value, comma, trail] = m;
-      if (shouldRedactKeyValue(key, value)) {
-        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
-        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
-        out.push(`${prefix}"{{${varName}}}"${comma}${trail}`);
-        continue;
-      }
-    }
-    let newLine = line;
-    for (const { re, reason } of VALUE_PATTERNS) {
-      newLine = newLine.replace(re, (match) => {
-        const varName = `REDACTED_${reason.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
-        redacted.push({ varName, line: i + 1, reason });
-        return `{{${varName}}}`;
-      });
-    }
-    out.push(newLine);
-  }
-  return { content: out.join(`
-`), redacted, isTemplate: redacted.length > 0 };
-}
-function redactToml(content) {
-  const redacted = [];
-  const lines = content.split(`
-`);
-  const out = [];
-  for (let i = 0;i < lines.length; i++) {
-    const line = lines[i];
-    const m = line.match(/^(\s*)([a-zA-Z][a-zA-Z0-9_\-]*)(\s*=\s*)(['"]?)(.+?)\4\s*$/);
-    if (m) {
-      const [, indent, key, eq, quote, value] = m;
-      if (shouldRedactKeyValue(key, value)) {
-        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
-        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
-        out.push(`${indent}${key}${eq}${quote}{{${varName}}}${quote}`);
-        continue;
-      }
-    }
-    out.push(line);
-  }
-  return { content: out.join(`
-`), redacted, isTemplate: redacted.length > 0 };
-}
-function redactIni(content) {
+  EMPTY_PATH: () => EMPTY_PATH,
+  INVALID: () => INVALID,
+  NEVER: () => NEVER,
+  OK: () => OK,
+  ParseStatus: () => ParseStatus,
+  Schema: () => ZodType,
+  ZodAny: () => ZodAny,
+  ZodArray: () => ZodArray,
+  ZodBigInt: () => ZodBigInt,
+  ZodBoolean: () => ZodBoolean,
+  ZodBranded: () => ZodBranded,
+  ZodCatch: () => ZodCatch,
+  ZodDate: () => ZodDate,
+  ZodDefault: () => ZodDefault,
+  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
+  ZodEffects: () => ZodEffects,
+  ZodEnum: () => ZodEnum,
+  ZodError: () => ZodError,
+  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
+  ZodFunction: () => ZodFunction,
+  ZodIntersection: () => ZodIntersection,
+  ZodIssueCode: () => ZodIssueCode,
+  ZodLazy: () => ZodLazy,
+  ZodLiteral: () => ZodLiteral,
+  ZodMap: () => ZodMap,
+  ZodNaN: () => ZodNaN,
+  ZodNativeEnum: () => ZodNativeEnum,
+  ZodNever: () => ZodNever,
+  ZodNull: () => ZodNull,
+  ZodNullable: () => ZodNullable,
+  ZodNumber: () => ZodNumber,
+  ZodObject: () => ZodObject,
+  ZodOptional: () => ZodOptional,
+  ZodParsedType: () => ZodParsedType,
+  ZodPipeline: () => ZodPipeline,
+  ZodPromise: () => ZodPromise,
+  ZodReadonly: () => ZodReadonly,
+  ZodRecord: () => ZodRecord,
+  ZodSchema: () => ZodType,
+  ZodSet: () => ZodSet,
+  ZodString: () => ZodString,
+  ZodSymbol: () => ZodSymbol,
+  ZodTransformer: () => ZodEffects,
+  ZodTuple: () => ZodTuple,
+  ZodType: () => ZodType,
+  ZodUndefined: () => ZodUndefined,
+  ZodUnion: () => ZodUnion,
+  ZodUnknown: () => ZodUnknown,
+  ZodVoid: () => ZodVoid,
+  addIssueToContext: () => addIssueToContext,
+  any: () => anyType,
+  array: () => arrayType,
+  bigint: () => bigIntType,
+  boolean: () => booleanType,
+  coerce: () => coerce,
+  custom: () => custom,
+  date: () => dateType,
+  datetimeRegex: () => datetimeRegex,
+  defaultErrorMap: () => en_default,
+  discriminatedUnion: () => discriminatedUnionType,
+  effect: () => effectsType,
+  enum: () => enumType,
+  function: () => functionType,
+  getErrorMap: () => getErrorMap,
+  getParsedType: () => getParsedType,
+  instanceof: () => instanceOfType,
+  intersection: () => intersectionType,
+  isAborted: () => isAborted,
+  isAsync: () => isAsync,
+  isDirty: () => isDirty,
+  isValid: () => isValid,
+  late: () => late,
+  lazy: () => lazyType,
+  literal: () => literalType,
+  makeIssue: () => makeIssue,
+  map: () => mapType,
+  nan: () => nanType,
+  nativeEnum: () => nativeEnumType,
+  never: () => neverType,
+  null: () => nullType,
+  nullable: () => nullableType,
+  number: () => numberType,
+  object: () => objectType,
+  objectUtil: () => objectUtil,
+  oboolean: () => oboolean,
+  onumber: () => onumber,
+  optional: () => optionalType,
+  ostring: () => ostring,
+  pipeline: () => pipelineType,
+  preprocess: () => preprocessType,
+  promise: () => promiseType,
+  quotelessJson: () => quotelessJson,
+  record: () => recordType,
+  set: () => setType,
+  setErrorMap: () => setErrorMap,
+  strictObject: () => strictObjectType,
+  string: () => stringType,
+  symbol: () => symbolType,
+  transformer: () => effectsType,
+  tuple: () => tupleType,
+  undefined: () => undefinedType,
+  union: () => unionType,
+  unknown: () => unknownType,
+  util: () => util,
+  void: () => voidType
+});
+var init_external = __esm(() => {
+  init_errors();
+  init_parseUtil();
+  init_typeAliases();
+  init_util();
+  init_types2();
+  init_ZodError();
+});
+
+// ../../node_modules/.bun/zod@3.25.76/node_modules/zod/index.js
+var init_zod = __esm(() => {
+  init_external();
+  init_external();
+});
+
+// src/lib/redact.ts
+function redactShell(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(/^(\s*(?:export\s+)?)([A-Z][A-Z0-9_]*)(\s*=\s*)(['"]?)(.+?)\4\s*$/);
+    if (m) {
+      const [, prefix, key, eq, quote, value] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const reason = reasonFor(key, value);
+        redacted.push({ varName: key, line: i + 1, reason });
+        out.push(`${prefix}${key}${eq}${quote}{{${key}}}${quote}`);
+        continue;
+      }
+    }
+    out.push(line);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
+}
+function redactJson(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(/^(\s*"([^"]+)"\s*:\s*)"([^"]+)"(,?)(\s*)$/);
+    if (m) {
+      const [, prefix, key, value, comma, trail] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
+        out.push(`${prefix}"{{${varName}}}"${comma}${trail}`);
+        continue;
+      }
+    }
+    let newLine = line;
+    for (const { re, reason } of VALUE_PATTERNS) {
+      newLine = newLine.replace(re, (match) => {
+        const varName = `REDACTED_${reason.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+        redacted.push({ varName, line: i + 1, reason });
+        return `{{${varName}}}`;
+      });
+    }
+    out.push(newLine);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
+}
+function redactToml(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(/^(\s*)([a-zA-Z][a-zA-Z0-9_\-]*)(\s*=\s*)(['"]?)(.+?)\4\s*$/);
+    if (m) {
+      const [, indent, key, eq, quote, value] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
+        out.push(`${indent}${key}${eq}${quote}{{${varName}}}${quote}`);
+        continue;
+      }
+    }
+    out.push(line);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
+}
+function redactIni(content) {
   const redacted = [];
   const lines = content.split(`
 `);
@@ -7189,7 +7265,7 @@ var init_redact = __esm(() => {
   VALUE_PATTERNS = [
     { re: /npm_[A-Za-z0-9]{36,}/, reason: "npm token" },
     { re: /gh[pousr]_[A-Za-z0-9_]{36,}/, reason: "GitHub token" },
-    { re: /sk-ant-[A-Za-z0-9\-_]{40,}/, reason: "Anthropic API key" },
+    { re: /sk[-]ant-[A-Za-z0-9\-_]{40,}/, reason: "Anthropic API key" },
     { re: /sk-[A-Za-z0-9]{48,}/, reason: "OpenAI API key" },
     { re: /xoxb-[0-9]+-[A-Za-z0-9\-]+/, reason: "Slack bot token" },
     { re: /AIza[0-9A-Za-z\-_]{35}/, reason: "Google API key" },
@@ -7239,7 +7315,7 @@ import {
   statSync,
   writeFileSync
 } from "fs";
-import { basename, dirname, isAbsolute, join as join4, parse, relative, resolve } from "path";
+import { basename, dirname, isAbsolute, join as join5, parse, relative, resolve as resolve2 } from "path";
 function managedObservationMaxBytes(relativePath) {
   return SESSION_MANAGED_OUTPUT_PATHS.includes(relativePath) ? SESSION_MANAGED_OUTPUT_MAX_BYTES : FOREIGN_INPUT_MAX_BYTES;
 }
@@ -7410,7 +7486,7 @@ function composeProjectContextSessionRender(input) {
   if (currentMarkers.block.id !== cache.project_id || currentMarkers.block.revision !== cache.revision || currentMarkers.block.hash !== cache.hash) {
     throw new ProjectContextError("MANAGED_BLOCK_CONFLICT", "project-context provider markers differ from the durable cache");
   }
-  const plannedIndexes = input.files.filter((file) => file.role === "index" && resolve(file.path) === paths.target);
+  const plannedIndexes = input.files.filter((file) => file.role === "index" && resolve2(file.path) === paths.target);
   if (plannedIndexes.length !== 1) {
     throw new ProjectContextError("PROJECT_CONTEXT_MANIFEST_INVALID", "session renderer does not own the selected project-context provider target");
   }
@@ -7468,7 +7544,7 @@ function withProjectContextSessionGuard(guard, action, options = {}) {
     verify();
     return action(null);
   }
-  const lockPath = resolve(validated.workspace_root, ...PROJECT_CONTEXT_LOCK_PATH.split("/"));
+  const lockPath = resolve2(validated.workspace_root, ...PROJECT_CONTEXT_LOCK_PATH.split("/"));
   const lock = acquireWorkspaceLock(validated.workspace_root, lockPath);
   try {
     verify();
@@ -7494,7 +7570,7 @@ function validateProjectContextSessionGuard(guard) {
     if (!isRecord(observed) || typeof observed.path !== "string") {
       throw new ProjectContextError("PROJECT_CONTEXT_SESSION_STALE", "session project-context guard contains malformed hash metadata");
     }
-    const path = resolve(observed.path);
+    const path = resolve2(observed.path);
     if (!allowedPaths.has(path) || observedPaths.has(path)) {
       throw new ProjectContextError("PROJECT_CONTEXT_SESSION_STALE", "session project-context guard contains an unexpected or duplicate path");
     }
@@ -7516,7 +7592,7 @@ function validateProjectContextSessionGuard(guard) {
 function applyProjectContext(options) {
   const workspaceRoot = assertSafeWorkspaceRoot(options.workspace_root);
   const now3 = options.now ?? new Date;
-  const lockPath = resolve(workspaceRoot, ...PROJECT_CONTEXT_LOCK_PATH.split("/"));
+  const lockPath = resolve2(workspaceRoot, ...PROJECT_CONTEXT_LOCK_PATH.split("/"));
   const lock = options.dry_run ? null : acquireWorkspaceLock(workspaceRoot, lockPath, options.test_hooks?.after_lock_open, options.test_hooks?.before_stale_lock_remove, options.test_hooks?.process_start_identity);
   try {
     const resolved = resolveBundleForApply(options, workspaceRoot, now3);
@@ -7663,7 +7739,7 @@ function resolveBundleForApply(options, workspaceRoot, now3) {
   if (!options.expected_project_id) {
     throw new ProjectContextError("PROJECT_CONTEXT_CACHE_ID_REQUIRED", "expected_project_id is required for stale-cache fallback");
   }
-  const cachePath = resolve(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
+  const cachePath = resolve2(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
   const cache = readProjectContextCache(cachePath, workspaceRoot);
   if (!cache)
     throw new ProjectContextError("PROJECT_CONTEXT_CACHE_MISSING", "no last-known-good project context cache exists");
@@ -8019,7 +8095,7 @@ function buildManifest(plan, now3) {
 function buildSessionCompatibilityManifest(plan, now3) {
   const paths = runtimePaths(plan.workspace_root, plan.runtime);
   const tool = manifestTool(plan.runtime);
-  const targetHome = plan.runtime === "codewith" ? resolve(plan.workspace_root, ".codewith") : plan.workspace_root;
+  const targetHome = plan.runtime === "codewith" ? resolve2(plan.workspace_root, ".codewith") : plan.workspace_root;
   const targetRelativePath = sessionTargetRelativePath(plan.runtime);
   const existing = existsSync4(paths.sessionManifest) ? readSessionManifestRecord(paths.sessionManifest, plan.workspace_root) : {
     schema: SESSION_RENDER_SCHEMA,
@@ -8041,7 +8117,7 @@ function buildSessionCompatibilityManifest(plan, now3) {
     throw new ProjectContextError("PROJECT_CONTEXT_MANIFEST_INVALID", "provider session manifest is malformed or incompatible");
   }
   const existingTargetHome = safeLegacyMetadataString(existing["targetHome"], null);
-  if (existingTargetHome !== null && resolve(existingTargetHome) !== targetHome) {
+  if (existingTargetHome !== null && resolve2(existingTargetHome) !== targetHome) {
     throw new ProjectContextError("PROJECT_CONTEXT_MANIFEST_INVALID", "provider session manifest targets a different workspace");
   }
   const sources = sanitizeLegacySources(existing["sources"]).filter((source) => source["id"] !== "project-context-bundle");
@@ -8327,9 +8403,9 @@ function writeMetadataSnapshot(plan, now3) {
   const previous = readProjectContextManifest(plan.manifest_path, plan.workspace_root);
   if (!previous || previous.projectContext.revision === plan.bundle.revision && previous.projectContext.hash === plan.bundle.hash)
     return null;
-  const snapshotDir = resolve(plan.workspace_root, ...PROJECT_CONTEXT_SNAPSHOT_DIR.split("/"));
+  const snapshotDir = resolve2(plan.workspace_root, ...PROJECT_CONTEXT_SNAPSHOT_DIR.split("/"));
   ensureSafeDirectory(snapshotDir, plan.workspace_root, 448);
-  const snapshotPath = resolve(snapshotDir, `${safeFilename(previous.projectContext.revision)}-${previous.projectContext.hash.slice(-12)}.json`);
+  const snapshotPath = resolve2(snapshotDir, `${safeFilename(previous.projectContext.revision)}-${previous.projectContext.hash.slice(-12)}.json`);
   const snapshot = {
     schema: "hasna.configs.session-render-snapshot/v1",
     kind: "project-context-metadata",
@@ -8345,8 +8421,8 @@ function writeMetadataSnapshot(plan, now3) {
   return snapshotPath;
 }
 function metadataSnapshotMatchesManifest(plan, manifest) {
-  const snapshotDir = resolve(plan.workspace_root, ...PROJECT_CONTEXT_SNAPSHOT_DIR.split("/"));
-  const snapshotPath = resolve(snapshotDir, `${safeFilename(manifest.projectContext.revision)}-${manifest.projectContext.hash.slice(-12)}.json`);
+  const snapshotDir = resolve2(plan.workspace_root, ...PROJECT_CONTEXT_SNAPSHOT_DIR.split("/"));
+  const snapshotPath = resolve2(snapshotDir, `${safeFilename(manifest.projectContext.revision)}-${manifest.projectContext.hash.slice(-12)}.json`);
   if (!existsSync4(snapshotPath))
     return false;
   const record = readJsonRecord(snapshotPath, plan.workspace_root);
@@ -8395,10 +8471,10 @@ function writeProjectContextRollbackSnapshot(plan, now3, outputs) {
       sha256: nextHash
     };
   });
-  const snapshotDir = resolve(plan.workspace_root, ...SESSION_RENDER_SNAPSHOT_RELATIVE_DIR.split("/"));
+  const snapshotDir = resolve2(plan.workspace_root, ...SESSION_RENDER_SNAPSHOT_RELATIVE_DIR.split("/"));
   ensureSafeDirectory(snapshotDir, plan.workspace_root, 448);
   const timestamp = now3.toISOString().replace(/[:.]/g, "-");
-  const snapshotPath = resolve(snapshotDir, `${timestamp}-${randomUUID5()}.json`);
+  const snapshotPath = resolve2(snapshotDir, `${timestamp}-${randomUUID5()}.json`);
   const snapshot = {
     schema: "hasna.configs.session-render-snapshot/v2",
     createdAt: now3.toISOString(),
@@ -8463,7 +8539,7 @@ function readSessionManifestRecord(path, workspaceRoot) {
   }
 }
 function atomicWriteFile(path, content, workspaceRoot, defaultMode, expectedHash, afterExchange, atomicExchangeUnavailable = false, beforeInstall, portableCreateOnly = false, maxObservedBytes, allowPortableReplacement = false) {
-  const dir = resolve(path, "..");
+  const dir = resolve2(path, "..");
   ensureSafeDirectory(dir, workspaceRoot, 448);
   assertNoSymlinkSegments(workspaceRoot, path);
   const anchoredOps = portableCreateOnly ? null : resolveAnchoredFsOps();
@@ -8480,7 +8556,7 @@ function atomicWriteFile(path, content, workspaceRoot, defaultMode, expectedHash
   const previous = anchoredFileObservation(directory, targetName);
   const previousMode = previous?.mode ?? defaultMode;
   const tempName = `.project-context-${randomUUID5()}.tmp`;
-  const tempPath = join4(dir, tempName);
+  const tempPath = join5(dir, tempName);
   let fd = null;
   let preserveTemp = false;
   let directoryChanged = false;
@@ -8611,7 +8687,7 @@ function atomicWritePortable(path, content, workspaceRoot, defaultMode, expected
   }
   const dir = dirname(path);
   const directoryIdentity = captureManagedDirectoryIdentity(dir, workspaceRoot);
-  const tempPath = join4(dir, `.project-context-${randomUUID5()}.tmp`);
+  const tempPath = join5(dir, `.project-context-${randomUUID5()}.tmp`);
   let fd = null;
   let tempIdentity = null;
   try {
@@ -8668,7 +8744,7 @@ function atomicWritePortableReplacement(path, content, workspaceRoot, expectedHa
   }
   const dir = dirname(path);
   const directoryIdentity = captureManagedDirectoryIdentity(dir, workspaceRoot);
-  const tempPath = join4(dir, `.project-context-${randomUUID5()}.tmp`);
+  const tempPath = join5(dir, `.project-context-${randomUUID5()}.tmp`);
   const desiredHash = sha2562(content);
   let fd = null;
   let tempIdentity = null;
@@ -8737,11 +8813,11 @@ function portableFileHash(path, workspaceRoot, maxObservedBytes) {
   return createHash2("sha256").update(readFileSync(path)).digest("hex");
 }
 function writeProjectContextCoordinatedFile(input) {
-  atomicWriteFile(resolve(input.path), input.content, assertSafeWorkspaceRoot(input.workspace_root), input.default_mode ?? 420, input.expected_hash, undefined, false, input.test_hooks?.before_install, input.force_portable_file_ops ?? false, input.max_observed_bytes, input.allow_portable_replacement ?? false);
+  atomicWriteFile(resolve2(input.path), input.content, assertSafeWorkspaceRoot(input.workspace_root), input.default_mode ?? 420, input.expected_hash, undefined, false, input.test_hooks?.before_install, input.force_portable_file_ops ?? false, input.max_observed_bytes, input.allow_portable_replacement ?? false);
 }
 function removeProjectContextCoordinatedFile(input) {
   const workspaceRoot = assertSafeWorkspaceRoot(input.workspace_root);
-  const path = resolve(input.path);
+  const path = resolve2(input.path);
   assertNoSymlinkSegments(workspaceRoot, path);
   const dir = dirname(path);
   const anchoredOps = input.force_portable_file_ops ? null : resolveAnchoredFsOps();
@@ -8767,7 +8843,7 @@ function removeProjectContextCoordinatedFile(input) {
       throw new ProjectContextHashRace(`managed path changed during deletion: ${relativePosix(workspaceRoot, path)}`);
     }
     displaced = true;
-    input.test_hooks?.after_displace?.(join4(dir, displacedName));
+    input.test_hooks?.after_displace?.(join5(dir, displacedName));
     const moved = anchoredFileObservation(directory, displacedName);
     if (!moved || moved.dev !== observed.dev || moved.ino !== observed.ino || moved.hash !== input.expected_hash || anchoredFileObservation(directory, targetName) !== null) {
       throw new ProjectContextHashRace(`managed path changed during deletion validation: ${relativePosix(workspaceRoot, path)}`);
@@ -8813,7 +8889,7 @@ function removePortableCoordinatedFile(path, workspaceRoot, expectedHash, maxObs
   }
   const dir = dirname(path);
   const directoryIdentity = captureManagedDirectoryIdentity(dir, workspaceRoot);
-  const displacedPath = join4(dir, `.project-context-delete-${randomUUID5()}.tmp`);
+  const displacedPath = join5(dir, `.project-context-delete-${randomUUID5()}.tmp`);
   let displaced = false;
   try {
     assertManagedDirectoryStable(dir, workspaceRoot, directoryIdentity);
@@ -8884,7 +8960,7 @@ function anchoredOpenExclusive(directory, name, mode) {
   const requestedMode = mode & 4095;
   let fd;
   try {
-    fd = openSync(join4(directory.path, name), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, requestedMode);
+    fd = openSync(join5(directory.path, name), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, requestedMode);
   } catch {
     throw new ProjectContextHashRace(`could not create prepared managed file in ${relativePosix(directory.workspaceRoot, directory.path)}`);
   }
@@ -8927,7 +9003,7 @@ function anchoredFileObservation(directory, name) {
     const stat = fstatSync(fd);
     if (!stat.isFile())
       throw new ProjectContextHashRace("managed output is not a regular file");
-    const relativePath = relativePosix(directory.workspaceRoot, join4(directory.path, name));
+    const relativePath = relativePosix(directory.workspaceRoot, join5(directory.path, name));
     const maxBytes = directory.maxObservedBytes === undefined ? managedObservationMaxBytes(relativePath) : directory.maxObservedBytes;
     if (maxBytes !== null && stat.size > maxBytes) {
       throw new ProjectContextHashRace(`managed output exceeds the safe read limit: ${relativePath}`);
@@ -8953,7 +9029,7 @@ function anchoredPreparedObservation(directory, name, path, stage) {
   return observed;
 }
 function captureManagedDirectoryIdentity(path, workspaceRoot) {
-  assertNoSymlinkSegments(workspaceRoot, join4(path, ".project-context-directory-guard"));
+  assertNoSymlinkSegments(workspaceRoot, join5(path, ".project-context-directory-guard"));
   let stat;
   try {
     stat = lstatSync(path);
@@ -8966,7 +9042,7 @@ function captureManagedDirectoryIdentity(path, workspaceRoot) {
   return { dev: stat.dev, ino: stat.ino };
 }
 function assertManagedDirectoryStable(path, workspaceRoot, expected) {
-  assertNoSymlinkSegments(workspaceRoot, join4(path, ".project-context-directory-guard"));
+  assertNoSymlinkSegments(workspaceRoot, join5(path, ".project-context-directory-guard"));
   let current;
   try {
     current = lstatSync(path);
@@ -9099,10 +9175,10 @@ function resolveAnchoredFsOps() {
   return null;
 }
 function acquireWorkspaceLock(workspaceRoot, lockPath, afterOpen, beforeStaleRemove, processStartIdentityLookup = processStartIdentity) {
-  const lockDirectory = resolve(lockPath, "..");
+  const lockDirectory = resolve2(lockPath, "..");
   ensureSafeDirectory(lockDirectory, workspaceRoot, 448);
   assertNoSymlinkSegments(workspaceRoot, lockPath);
-  const tempPath = join4(lockDirectory, `.project-context-lock-${randomUUID5()}.tmp`);
+  const tempPath = join5(lockDirectory, `.project-context-lock-${randomUUID5()}.tmp`);
   let fd = null;
   let openedIdentity = null;
   let openedContentHash = null;
@@ -9174,7 +9250,7 @@ function removeOwnedLockByInode(lockPath, identity, expectedHash) {
     if (expectedHash !== undefined && sha2562(readFileSync(lockPath, "utf8")) !== expectedHash)
       return;
     rmSync2(lockPath);
-    fsyncDirectory(resolve(lockPath, ".."));
+    fsyncDirectory(resolve2(lockPath, ".."));
   } catch {}
 }
 function observeStaleWorkspaceLock(lockPath, workspaceRoot, processStartIdentityLookup = processStartIdentity) {
@@ -9253,7 +9329,7 @@ function tryTakeoverStaleWorkspaceLock(candidatePath, lockPath, workspaceRoot, c
       throw new ProjectContextError("PROJECT_CONTEXT_LOCK_LOST", "workspace lock changed during stale-lock takeover and could not be restored safely");
     }
     rmSync2(candidatePath);
-    fsyncDirectory(resolve(lockPath, ".."));
+    fsyncDirectory(resolve2(lockPath, ".."));
     exchanged = false;
     return true;
   } catch (error) {
@@ -9332,8 +9408,8 @@ function releaseWorkspaceLock(lockPath, lock, workspaceRoot) {
     }
     return;
   }
-  const lockDirectory = resolve(lockPath, "..");
-  const releasePath = join4(lockDirectory, `.project-context-release-${randomUUID5()}.tmp`);
+  const lockDirectory = resolve2(lockPath, "..");
+  const releasePath = join5(lockDirectory, `.project-context-release-${randomUUID5()}.tmp`);
   let releaseFd = null;
   let releaseIdentity = null;
   let releaseHash = null;
@@ -9413,7 +9489,7 @@ function ensureSafeDirectory(path, workspaceRoot, mode) {
   const segments = rel.split(/[\\/]+/).filter(Boolean);
   let current = workspaceRoot;
   for (const segment of segments) {
-    current = join4(current, segment);
+    current = join5(current, segment);
     if (existsSync4(current)) {
       if (lstatSync(current).isSymbolicLink())
         throw new ProjectContextError("PROJECT_CONTEXT_SYMLINK_REJECTED", `managed path uses a symlink: ${current}`);
@@ -9421,7 +9497,7 @@ function ensureSafeDirectory(path, workspaceRoot, mode) {
         throw new ProjectContextError("PROJECT_CONTEXT_PATH_INVALID", `managed path is not a directory: ${current}`);
     } else {
       mkdirSync2(current, { mode });
-      fsyncDirectory(resolve(current, ".."));
+      fsyncDirectory(resolve2(current, ".."));
     }
   }
 }
@@ -9477,11 +9553,11 @@ function scanGeneratedContent(content) {
 function runtimePaths(workspaceRoot, runtime) {
   const relativeTarget = runtime === "claude" ? "CLAUDE.md" : runtime === "codewith" ? ".codewith/CODEWITH.md" : "AGENTS.md";
   return {
-    target: resolve(workspaceRoot, ...relativeTarget.split("/")),
-    fragment: resolve(workspaceRoot, ...PROJECT_CONTEXT_FRAGMENT_PATH.split("/")),
-    manifest: resolve(workspaceRoot, ...PROJECT_CONTEXT_MANIFEST_PATH.split("/")),
-    cache: resolve(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/")),
-    sessionManifest: runtime === "codewith" ? resolve(workspaceRoot, ".codewith", ".hasna", "session-render-manifest.json") : resolve(workspaceRoot, ".hasna", "session-render-manifest.json")
+    target: resolve2(workspaceRoot, ...relativeTarget.split("/")),
+    fragment: resolve2(workspaceRoot, ...PROJECT_CONTEXT_FRAGMENT_PATH.split("/")),
+    manifest: resolve2(workspaceRoot, ...PROJECT_CONTEXT_MANIFEST_PATH.split("/")),
+    cache: resolve2(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/")),
+    sessionManifest: runtime === "codewith" ? resolve2(workspaceRoot, ".codewith", ".hasna", "session-render-manifest.json") : resolve2(workspaceRoot, ".hasna", "session-render-manifest.json")
   };
 }
 function projectContextSessionGuardPaths(paths, runtime) {
@@ -9491,7 +9567,7 @@ function projectContextSessionGuardPaths(paths, runtime) {
     paths.fragment,
     paths.target,
     paths.sessionManifest,
-    ...runtime === "codewith" ? [resolve(paths.target, "..", "CODEWITH.override.md")] : []
+    ...runtime === "codewith" ? [resolve2(paths.target, "..", "CODEWITH.override.md")] : []
   ];
 }
 function sessionTargetRelativePath(runtime) {
@@ -9511,12 +9587,12 @@ function projectContextRuntimeForSessionTool(tool) {
   return null;
 }
 function projectContextWorkspaceForSession(input, runtime) {
-  const targetHome = resolve(input.target_home);
+  const targetHome = resolve2(input.target_home);
   if (runtime === "codewith") {
     const workspaceRoot = basename(targetHome) === ".codewith" ? dirname(targetHome) : null;
     if (!workspaceRoot)
       return null;
-    if (input.project_root && resolve(input.project_root) !== workspaceRoot) {
+    if (input.project_root && resolve2(input.project_root) !== workspaceRoot) {
       throw new ProjectContextError("PROJECT_CONTEXT_PATH_INVALID", "Codewith project_root must be the parent workspace of target_home");
     }
     if (!existsSync4(workspaceRoot) || !lstatSync(workspaceRoot).isDirectory())
@@ -9530,7 +9606,7 @@ function projectContextWorkspaceForSession(input, runtime) {
 function assertCodewithTargetIsConsumed(workspaceRoot, runtime) {
   if (runtime !== "codewith")
     return;
-  const override = resolve(workspaceRoot, ".codewith", "CODEWITH.override.md");
+  const override = resolve2(workspaceRoot, ".codewith", "CODEWITH.override.md");
   if (!existsSync4(override))
     return;
   assertNoSymlinkSegments(workspaceRoot, override);
@@ -9541,7 +9617,7 @@ function assertCodewithTargetIsConsumed(workspaceRoot, runtime) {
 function assertSafeWorkspaceRoot(path) {
   if (!isAbsolute(path))
     throw new ProjectContextError("PROJECT_CONTEXT_PATH_INVALID", "workspace root must be absolute");
-  const normalized = resolve(path);
+  const normalized = resolve2(path);
   if (normalized === parse(normalized).root)
     throw new ProjectContextError("PROJECT_CONTEXT_PATH_INVALID", "workspace root cannot be the filesystem root");
   if (!existsSync4(normalized) || !lstatSync(normalized).isDirectory())
@@ -9558,17 +9634,17 @@ function assertNoSymlinkSegments(root, target) {
   }
   let current = root;
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join4(current, segment);
+    current = join5(current, segment);
     if (existsSync4(current) && lstatSync(current).isSymbolicLink()) {
       throw new ProjectContextError("PROJECT_CONTEXT_SYMLINK_REJECTED", `managed path uses a symlink: ${current}`);
     }
   }
 }
 function assertNoSymlinkAncestors(path) {
-  const normalized = resolve(path);
+  const normalized = resolve2(path);
   let current = parse(normalized).root;
   for (const segment of relative(current, normalized).split(/[\\/]+/).filter(Boolean)) {
-    current = join4(current, segment);
+    current = join5(current, segment);
     if (!existsSync4(current))
       return;
     if (lstatSync(current).isSymbolicLink())
@@ -9604,10 +9680,10 @@ function fragmentMatchesBundle(path, bundle, workspaceRoot) {
 }
 function durableSourcePath(path, workspaceRoot) {
   if (!path || path.startsWith("/dev/fd/"))
-    return resolve(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
-  const normalized = isAbsolute(path) ? resolve(path) : resolve(workspaceRoot, path);
+    return resolve2(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
+  const normalized = isAbsolute(path) ? resolve2(path) : resolve2(workspaceRoot, path);
   if (normalized.startsWith("/dev/fd/"))
-    return resolve(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
+    return resolve2(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
   return normalized;
 }
 function compareRevisions(incoming, previous) {
@@ -10167,7 +10243,7 @@ function compareProviderVersions(left, right) {
 
 // src/lib/asset-plan.ts
 import { createHash as createHash3 } from "crypto";
-import { isAbsolute as isAbsolute2, posix, resolve as resolve2 } from "path";
+import { isAbsolute as isAbsolute2, posix, resolve as resolve3 } from "path";
 function assetCapability(provider, surface, kind, support, strategies, note, providerVersionRange = "*") {
   return Object.freeze({
     schema: ASSET_CAPABILITY_SCHEMA,
@@ -10374,8 +10450,8 @@ function resolveAssetDestination(item, roots) {
   if (!isAbsolute2(root))
     throw new Error(`Asset ${item.assetKey} destination root must be absolute.`);
   const relativePath = safeRelativePath(item.destination.relativePath);
-  const target = resolve2(root, ...relativePath.split("/"));
-  const normalizedRoot = resolve2(root);
+  const target = resolve3(root, ...relativePath.split("/"));
+  const normalizedRoot = resolve3(root);
   if (target === normalizedRoot)
     throw new Error(`Asset ${item.assetKey} destination cannot replace its root.`);
   if (!target.startsWith(`${normalizedRoot}/`))
@@ -10555,13 +10631,13 @@ var init_asset_plan = __esm(() => {
 // src/lib/cursor-authority.ts
 import { createHash as createHash4 } from "crypto";
 import { lstatSync as lstatSync2, readFileSync as readFileSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join5, resolve as resolve3 } from "path";
+import { homedir as homedir4 } from "os";
+import { join as join6, resolve as resolve4 } from "path";
 function sha2564(content) {
   return createHash4("sha256").update(content).digest("hex");
 }
 function homeDir() {
-  return process.env["HOME"] || homedir3();
+  return process.env["HOME"] || homedir4();
 }
 function markerPayload(content, markerLine, markerIndex) {
   const index = markerIndex ?? content.indexOf(markerLine);
@@ -10577,12 +10653,12 @@ function baseObservation(path) {
   };
 }
 function observeCursorGlobalAuthority(options = {}) {
-  const authorityPath = resolve3(join5(options.home ?? homeDir(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
+  const authorityPath = resolve4(join6(options.home ?? homeDir(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
   const readFile2 = options.readFile ?? ((path) => readFileSync2(path, "utf8"));
   return observeCursorGlobalAuthorityPath(authorityPath, readFile2);
 }
 function observeCursorGlobalAuthorityAtPath(authorityPath) {
-  return observeCursorGlobalAuthorityPath(resolve3(authorityPath), (path) => readFileSync2(path, "utf8"));
+  return observeCursorGlobalAuthorityPath(resolve4(authorityPath), (path) => readFileSync2(path, "utf8"));
 }
 function observeCursorGlobalAuthorityPath(authorityPath, readFile2) {
   const base = baseObservation(authorityPath);
@@ -10727,7 +10803,7 @@ function observeCursorGlobalAuthorityPath(authorityPath, readFile2) {
   };
 }
 function isCursorGlobalAuthorityPath(path) {
-  return resolve3(path) === resolve3(join5(homeDir(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
+  return resolve4(path) === resolve4(join6(homeDir(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
 }
 function stampCursorGlobalAuthorityMarker(content) {
   if (CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN.test(content))
@@ -10770,11 +10846,88 @@ var init_cursor_authority = __esm(() => {
   CURSOR_GLOBAL_AUTHORITY_FRONTMATTER_PATTERN = /^---\n[\s\S]*?\n---(?:\n|$)/;
 });
 
-// src/lib/session-render.ts
+// src/lib/session-authority.ts
 import { createHash as createHash5 } from "crypto";
-import { existsSync as existsSync5, readFileSync as readFileSync3, realpathSync, statSync as statSync2 } from "fs";
-import { homedir as homedir4 } from "os";
-import { basename as basename3, dirname as dirname2, extname as extname2, isAbsolute as isAbsolute3, join as join6, parse as parse2, posix as posix2, relative as relative2, resolve as resolve4 } from "path";
+import { lstatSync as lstatSync3, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { join as join7, resolve as resolve5 } from "path";
+function sha2565(content) {
+  return createHash5("sha256").update(content).digest("hex");
+}
+function detectClaudeAuthorityConflicts(targetHome) {
+  const authorityPath = resolve5(join7(targetHome, CLAUDE_LEGACY_AUTHORITY_RELATIVE_PATH));
+  let stat;
+  try {
+    stat = lstatSync3(authorityPath);
+  } catch {
+    return [];
+  }
+  const provenanceBase = {
+    tool: "claude",
+    relativePath: CLAUDE_LEGACY_AUTHORITY_RELATIVE_PATH,
+    path: authorityPath
+  };
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    return [{
+      ...provenanceBase,
+      kind: "invalid-unmanaged-authority",
+      sha256: null,
+      markers: [],
+      provenance: {
+        source: "filesystem",
+        authority: "unmanaged",
+        observedPath: authorityPath,
+        detection: "non-regular-file"
+      },
+      reason: "Claude target contains unmanaged AGENTS.md that is not a regular file; authority cannot be verified safely."
+    }];
+  }
+  if (statSync2(authorityPath).size > CLAUDE_LEGACY_AUTHORITY_MAX_BYTES) {
+    return [{
+      ...provenanceBase,
+      kind: "invalid-unmanaged-authority",
+      sha256: null,
+      markers: [],
+      provenance: {
+        source: "filesystem",
+        authority: "unmanaged",
+        observedPath: authorityPath,
+        detection: "oversized-file"
+      },
+      reason: `Claude target contains unmanaged AGENTS.md larger than ${CLAUDE_LEGACY_AUTHORITY_MAX_BYTES} bytes; authority cannot be classified safely.`
+    }];
+  }
+  const content = readFileSync3(authorityPath, "utf8");
+  const markers = CLAUDE_LEGACY_MARKERS.filter((marker) => marker.pattern.test(content)).map((marker) => marker.id);
+  const knownLegacy = markers.includes("no-worktrees-heading") && markers.includes("no-worktrees-directive");
+  return [{
+    ...provenanceBase,
+    kind: knownLegacy ? "known-legacy-no-worktree" : "unknown-unmanaged-authority",
+    sha256: sha2565(content),
+    markers,
+    provenance: {
+      source: "filesystem",
+      authority: "unmanaged",
+      observedPath: authorityPath,
+      detection: knownLegacy ? "known-legacy-markers" : "unknown-content"
+    },
+    reason: knownLegacy ? "Claude target contains unmanaged legacy AGENTS.md with no-worktree directives; migrate or remove it through an owned authority path before applying." : "Claude target contains unmanaged AGENTS.md with unknown authority content; refusing to guess whether it conflicts with the managed Claude render."
+  }];
+}
+var CLAUDE_LEGACY_AUTHORITY_RELATIVE_PATH = "AGENTS.md", CLAUDE_LEGACY_AUTHORITY_MAX_BYTES, CLAUDE_LEGACY_MARKERS;
+var init_session_authority = __esm(() => {
+  CLAUDE_LEGACY_AUTHORITY_MAX_BYTES = 256 * 1024;
+  CLAUDE_LEGACY_MARKERS = [
+    { id: "claude-agent-rules-heading", pattern: /^# Agent Rules \(Claude\)/m },
+    { id: "no-worktrees-heading", pattern: /^## No Worktrees/m },
+    { id: "no-worktrees-directive", pattern: /\bNever use git worktrees\b/m }
+  ];
+});
+
+// src/lib/session-render.ts
+import { createHash as createHash6 } from "crypto";
+import { existsSync as existsSync5, readFileSync as readFileSync4, realpathSync, statSync as statSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { basename as basename3, dirname as dirname2, extname as extname2, isAbsolute as isAbsolute3, join as join8, parse as parse2, posix as posix2, relative as relative2, resolve as resolve6 } from "path";
 function normalizeSessionInstructionLayer(value) {
   if (value === "provider")
     return "tool";
@@ -10791,11 +10944,11 @@ function ensureTrailingNewline3(content) {
 `) ? content : `${content}
 `;
 }
-function sha2565(content) {
-  return createHash5("sha256").update(content).digest("hex");
+function sha2566(content) {
+  return createHash6("sha256").update(content).digest("hex");
 }
 function fingerprint(value) {
-  return sha2565(JSON.stringify(value));
+  return sha2566(JSON.stringify(value));
 }
 function canonicalFingerprintValue(value) {
   if (Array.isArray(value))
@@ -10813,7 +10966,7 @@ function ruleAttestation(rule) {
   };
   const applied = metadata["payloadFloorApplied"];
   return {
-    contentSha256: sha2565(rule.content ?? ""),
+    contentSha256: sha2566(rule.content ?? ""),
     payloadFloorApplied: typeof applied === "boolean" ? applied : null,
     flooredFromRulesVersion: read("flooredFromRulesVersion"),
     flooredFromPayloadSha256: read("flooredFromPayloadSha256"),
@@ -10859,16 +11012,14 @@ function slug(value) {
 function yamlQuote2(value) {
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
 }
-function getRawStoreRoot() {
-  return resolve4(process.env[RAW_STORE_ROOT_ENV] || join6(process.env["HOME"] || homedir4(), ".hasna", "configs"));
-}
 function defaultTargetHome(tool, profile, sessionId) {
-  return join6(getRawStoreRoot(), "sessions", tool, slug(profile), slug(sessionId || "latest"));
+  const home = process.env["HOME"] || homedir5();
+  return join8(home, ".hasna", "accounts", "profiles", tool, slug(profile));
 }
 function joinTarget(targetHome, relativePath) {
   const safeTargetHome = assertSafeTargetRoot(targetHome);
   const safeRelativePath2 = assertSafeRelativePath(relativePath);
-  return join6(safeTargetHome, ...safeRelativePath2.split("/"));
+  return join8(safeTargetHome, ...safeRelativePath2.split("/"));
 }
 function makeFile(targetHome, relativePath, role, content, sourceIds) {
   const safeTargetHome = assertSafeTargetRoot(targetHome);
@@ -10879,7 +11030,7 @@ function makeFile(targetHome, relativePath, role, content, sourceIds) {
     relativePath: safeRelativePath2,
     role,
     content: normalizedContent,
-    sha256: sha2565(normalizedContent),
+    sha256: sha2566(normalizedContent),
     sourceIds
   };
 }
@@ -10913,7 +11064,7 @@ function applyAgentOperatingRulesFloor(source, content) {
   const floored = {
     payloadFloorApplied: true,
     flooredFromRulesVersion: parseAgentOperatingRulesVersion(content),
-    flooredFromPayloadSha256: sha2565(content)
+    flooredFromPayloadSha256: sha2566(content)
   };
   return {
     content: payload.content,
@@ -10935,7 +11086,7 @@ function applyAgentOperatingRulesFloorToRule(source, rule, content) {
   const floored = {
     payloadFloorApplied: true,
     flooredFromRulesVersion: parseAgentOperatingRulesVersion(content),
-    flooredFromPayloadSha256: sha2565(content)
+    flooredFromPayloadSha256: sha2566(content)
   };
   return {
     content: payload.content,
@@ -10954,7 +11105,7 @@ function skippedSource(source, reason) {
       order: source.resolvedOrder,
       path: source.path ?? null,
       hash: source.hash ?? null,
-      renderedPayloadSha256: sha2565(source.content),
+      renderedPayloadSha256: sha2566(source.content),
       nonOverridable: source.nonOverridable === true,
       provenance: source.provenance ?? null
     }
@@ -10996,7 +11147,7 @@ function compareSessionInstructionSources(a, b) {
   return SESSION_LAYER_RANK[a.resolvedLayer] - SESSION_LAYER_RANK[b.resolvedLayer] || a.resolvedOrder - b.resolvedOrder || a.id.localeCompare(b.id);
 }
 function semanticPolicyIntegrity(body) {
-  return sha2565(body) === AGENT_OPERATING_RULES_PAYLOAD_SHA256 ? "pinned-digest" : "unverified-self-declared";
+  return sha2566(body) === AGENT_OPERATING_RULES_PAYLOAD_SHA256 ? "pinned-digest" : "unverified-self-declared";
 }
 function semanticPolicyDeclaration(source) {
   const normalize = (value) => value.replace(/\r\n/g, `
@@ -11221,7 +11372,7 @@ function composeSources(sources, tool) {
             targetSourceId: target.id,
             targetNormalizedSourceId: target.normalizedId,
             targetHash: target.hash ?? null,
-            targetRenderedPayloadSha256: sha2565(target.content),
+            targetRenderedPayloadSha256: sha2566(target.content),
             targetNonOverridable: protectedReplacement,
             authority: protectedReplacement ? "canonical-identity-export/codewith-provider/v1" : "overridable-source/v1"
           }
@@ -11403,7 +11554,7 @@ function buildOpenCodeFiles(targetHome, adapter, profile, sources, providerConfi
     ...sources.flatMap((source) => source.resolvedRules.map((rule) => rule.id))
   ]);
   const existingConfigPath = joinTarget(targetHome, adapter.configFile);
-  const selectedConfig = existsSync5(existingConfigPath) ? readOpenCodeConfig(readFileSync3(existingConfigPath, "utf8"), existingConfigPath) : providerConfig ? readOpenCodeConfig(providerConfig.content, providerConfig.sourceId) : {};
+  const selectedConfig = existsSync5(existingConfigPath) ? readOpenCodeConfig(readFileSync4(existingConfigPath, "utf8"), existingConfigPath) : providerConfig ? readOpenCodeConfig(providerConfig.content, providerConfig.sourceId) : {};
   const preservedInstructions = normalizeOpenCodeInstructions(selectedConfig["instructions"]).filter((path) => !pathIsManagedOpenCodeInstruction(path, adapter.managedDir));
   const config = {
     ...selectedConfig,
@@ -11552,7 +11703,7 @@ function buildAssetFiles(input, targetHome, blocked) {
       relativePath: assertSafeRelativePath(relativePath),
       role: "asset",
       content,
-      sha256: sha2565(content),
+      sha256: sha2566(content),
       sourceIds: [item.sourceConfigId, item.assetId]
     };
   });
@@ -11592,7 +11743,7 @@ function adapterFor(input) {
   return gatedNativeImports ? CODEWITH_NATIVE_ADAPTER : CODEWITH_FLATTENED_ADAPTER;
 }
 function getHomeDir() {
-  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir4();
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir5();
 }
 function cleanSessionPathInput(path) {
   const trimmed = path.trim();
@@ -11607,16 +11758,16 @@ function resolveSessionPath(path) {
     throw new Error("Session render path cannot be empty.");
   const home = getHomeDir();
   if (cleaned === "~")
-    return resolve4(home);
+    return resolve6(home);
   if (cleaned.startsWith("~/"))
-    return resolve4(home, cleaned.slice(2));
+    return resolve6(home, cleaned.slice(2));
   if (cleaned === "{{HOME}}" || cleaned === "${HOME}")
-    return resolve4(home);
+    return resolve6(home);
   if (cleaned.startsWith("{{HOME}}/"))
-    return resolve4(home, cleaned.slice("{{HOME}}/".length));
+    return resolve6(home, cleaned.slice("{{HOME}}/".length));
   if (cleaned.startsWith("${HOME}/"))
-    return resolve4(home, cleaned.slice("${HOME}/".length));
-  return resolve4(cleaned);
+    return resolve6(home, cleaned.slice("${HOME}/".length));
+  return resolve6(cleaned);
 }
 function assertSafeRelativePath(relativePath) {
   if (!relativePath.trim())
@@ -11632,7 +11783,7 @@ function assertSafeRelativePath(relativePath) {
 function assertSafeTargetRoot(targetHome) {
   if (!isAbsolute3(targetHome))
     throw new Error(`Session render target must be an absolute path: ${targetHome}`);
-  const normalized = resolve4(targetHome);
+  const normalized = resolve6(targetHome);
   if (normalized === parse2(normalized).root) {
     throw new Error(`Session render target cannot be the filesystem root: ${targetHome}`);
   }
@@ -11730,7 +11881,7 @@ function planSessionRender(input) {
     blockers: targetBlockers
   } = resolveRenderTarget(input);
   const authorityObservations = input.tool === "cursor" && targetKind !== "blocked" ? [observeCursorGlobalAuthority({ home: input.cursorAuthorityHome })] : [];
-  const authorityConflicts = input.tool === "cursor" && targetKind !== "blocked" ? detectCursorAuthorityConflicts(authorityObservations[0]) : [];
+  const authorityConflicts = input.tool === "cursor" && targetKind !== "blocked" ? detectCursorAuthorityConflicts(authorityObservations[0]) : input.tool === "claude" && targetKind !== "blocked" ? detectClaudeAuthorityConflicts(targetHome) : [];
   const blockers = [
     ...targetBlockers,
     ...authorityConflicts.map((conflict) => `${conflict.relativePath}: ${conflict.reason}`)
@@ -11828,7 +11979,7 @@ function planSessionRender(input) {
           hash: rule.hash ?? null,
           ...ruleAttestation(rule)
         })),
-        renderedPayloadSha256: sha2565(source.content),
+        renderedPayloadSha256: sha2566(source.content),
         provenance: source.provenance ?? null,
         metadata: source.metadata ?? null
       })),
@@ -11866,8 +12017,8 @@ function planSessionRender(input) {
     ...input.providerConfig ? {
       providerConfig: {
         sourceId: input.providerConfig.sourceId,
-        selectedPayloadSha256: sha2565(input.providerConfig.content),
-        renderedPayloadSha256: files.find((file) => file.relativePath === adapter.configFile)?.sha256 ?? sha2565(input.providerConfig.content),
+        selectedPayloadSha256: sha2566(input.providerConfig.content),
+        renderedPayloadSha256: files.find((file) => file.relativePath === adapter.configFile)?.sha256 ?? sha2566(input.providerConfig.content),
         selected: !existsSync5(joinTarget(targetHome, adapter.configFile))
       }
     } : {},
@@ -12153,7 +12304,7 @@ function readIdentitySourcePath(sourcePath, baseDir, sourceId) {
     }
     return;
   }
-  const stat = statSync2(resolvedPath);
+  const stat = statSync3(resolvedPath);
   if (!stat.isFile()) {
     throw new Error(`Identity instruction source path is not a file for ${sourceId}: ${sourcePath.path}`);
   }
@@ -12162,7 +12313,7 @@ function readIdentitySourcePath(sourcePath, baseDir, sourceId) {
   if (!pathIsInside(realPath, realBase)) {
     throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${sourcePath.path}`);
   }
-  return readFileSync3(realPath, "utf-8");
+  return readFileSync4(realPath, "utf-8");
 }
 function resolveIdentitySourcePath(path, baseDir, sourceId) {
   const cleaned = cleanSessionPathInput(path);
@@ -12170,8 +12321,8 @@ function resolveIdentitySourcePath(path, baseDir, sourceId) {
     throw new Error(`Identity instruction source path cannot be empty for ${sourceId}.`);
   if (cleaned.includes("\\"))
     throw new Error(`Identity instruction source path must use POSIX separators for ${sourceId}: ${path}`);
-  const resolvedPath = isAbsolute3(cleaned) ? resolve4(cleaned) : resolve4(baseDir, cleaned);
-  if (!pathIsInside(resolvedPath, resolve4(baseDir))) {
+  const resolvedPath = isAbsolute3(cleaned) ? resolve6(cleaned) : resolve6(baseDir, cleaned);
+  if (!pathIsInside(resolvedPath, resolve6(baseDir))) {
     throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${path}`);
   }
   return resolvedPath;
@@ -12259,7 +12410,7 @@ function asStringArray(value) {
     return [];
   return value.filter((item) => typeof item === "string");
 }
-var RAW_STORE_ROOT_ENV = "HASNA_CONFIGS_HOME", ANTIGRAVITY_RULE_FILE_CHAR_LIMIT = 12000, SESSION_RENDERER_OWNER_ID = "instructions-session-renderer", SESSION_RENDER_TOOLS, SESSION_RENDER_PROFILE_ENTRYPOINTS, SESSION_RENDER_OWNED_CONFIG_TARGETS, IDENTITY_EXPORT_AUTHORITY, CODEWITH_PROTECTED_REPLACEMENT_TARGETS, CODEWITH_FLATTENED_ADAPTER, CODEWITH_NATIVE_ADAPTER, SESSION_TOOL_ADAPTERS, SESSION_RENDER_MANAGED_DIRS, SESSION_RENDER_SHARED_MANAGED_DIRS, SESSION_RENDER_EXCLUSIVE_MANAGED_PATHS, SESSION_LAYER_RANK, CANONICAL_IDENTITY_EXPORT_PACKAGES;
+var ANTIGRAVITY_RULE_FILE_CHAR_LIMIT = 12000, SESSION_RENDERER_OWNER_ID = "instructions-session-renderer", SESSION_RENDER_TOOLS, SESSION_RENDER_PROFILE_ENTRYPOINTS, SESSION_RENDER_OWNED_CONFIG_TARGETS, IDENTITY_EXPORT_AUTHORITY, CODEWITH_PROTECTED_REPLACEMENT_TARGETS, CODEWITH_FLATTENED_ADAPTER, CODEWITH_NATIVE_ADAPTER, SESSION_TOOL_ADAPTERS, SESSION_RENDER_MANAGED_DIRS, SESSION_RENDER_SHARED_MANAGED_DIRS, SESSION_RENDER_EXCLUSIVE_MANAGED_PATHS, SESSION_LAYER_RANK, CANONICAL_IDENTITY_EXPORT_PACKAGES;
 var init_session_render = __esm(() => {
   init_global_agent_rules_standard();
   init_codewith_shared_todos_storage_standard();
@@ -12268,8 +12419,11 @@ var init_session_render = __esm(() => {
   init_transforms();
   init_asset_plan();
   init_cursor_authority();
+  init_session_authority();
   init_session_render_contract();
   init_session_render_contract();
+  init_raw_store_root();
+  init_raw_store_root();
   SESSION_RENDER_TOOLS = [
     "claude",
     "codex",
@@ -12470,7 +12624,7 @@ var init_session_render = __esm(() => {
 });
 
 // src/lib/instruction-graph.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 function capability(provider, providerVersionRange, selectedRepresentation, loadingPath, options = {}) {
   return Object.freeze({
     schema: PROVIDER_CAPABILITY_SCHEMA,
@@ -12717,7 +12871,7 @@ function compileInstructionGraph(input) {
       effective_activation: effective.get(configId),
       fallback: row.binding.fallback,
       required: row.binding.required,
-      content_sha256: sha2566(config.content),
+      content_sha256: sha2567(config.content),
       dependencies: dependencies.get(configId) ?? []
     };
   });
@@ -12754,7 +12908,7 @@ function compileInstructionGraph(input) {
     diagnostics
   };
   return {
-    plan: deepFreeze2({ ...planWithoutHash, source_hash: sha2566(stableJson2(planWithoutHash)) }),
+    plan: deepFreeze2({ ...planWithoutHash, source_hash: sha2567(stableJson2(planWithoutHash)) }),
     sources,
     capability: capability2
   };
@@ -12928,8 +13082,8 @@ function assertExactOnce(units, artifacts) {
 function errorDiagnostic(configId, code, message) {
   return { severity: "error", code, config_id: configId, message };
 }
-function sha2566(value) {
-  return createHash6("sha256").update(value).digest("hex");
+function sha2567(value) {
+  return createHash7("sha256").update(value).digest("hex");
 }
 function stableJson2(value) {
   const canonical = (entry) => Array.isArray(entry) ? entry.map(canonical) : entry && typeof entry === "object" ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)).map(([key, child]) => [key, canonical(child)])) : entry;
@@ -13228,37 +13382,6 @@ var init_profiles = __esm(() => {
   init_asset_plan();
 });
 
-// src/db/snapshots.ts
-function createSnapshot(configId, content, version, db) {
-  const d = db || getDatabase();
-  const id = uuid();
-  const ts = now2();
-  d.run("INSERT INTO config_snapshots (id, config_id, content, version, created_at) VALUES (?, ?, ?, ?, ?)", [id, configId, content, version, ts]);
-  return { id, config_id: configId, content, version, created_at: ts };
-}
-function listSnapshots(configId, db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? ORDER BY version DESC").all(configId);
-}
-function getSnapshot(id, db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM config_snapshots WHERE id = ?").get(id);
-}
-function getSnapshotByVersion(configId, version, db) {
-  const d = db || getDatabase();
-  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? AND version = ?").get(configId, version);
-}
-function pruneSnapshots(configId, keep = 10, db) {
-  const d = db || getDatabase();
-  const result = d.run(`DELETE FROM config_snapshots WHERE config_id = ? AND id NOT IN (
-      SELECT id FROM config_snapshots WHERE config_id = ? ORDER BY version DESC LIMIT ?
-    )`, [configId, configId, keep]);
-  return result.changes;
-}
-var init_snapshots = __esm(() => {
-  init_database();
-});
-
 // src/db/machines.ts
 import { arch, hostname, type } from "os";
 function currentHostname2() {
@@ -13350,16 +13473,17 @@ function formatCliError(err, env = process.env) {
   return err instanceof Error ? err.message : String(err);
 }
 function resolveCloudConfig(env = process.env) {
+  assertNoLegacyStorageMode(env);
   const apiUrl = env[API_URL_ENV]?.trim();
   const apiKey = env[API_KEY_ENV]?.trim();
   if (!apiUrl && !apiKey)
     return null;
   if (!apiUrl || !apiKey) {
-    throw new Error(`API mode requires BOTH ${API_URL_ENV} and ${API_KEY_ENV}; only ` + `${apiUrl ? API_URL_ENV : API_KEY_ENV} is set. Set both to use the cloud API, ` + `or unset both to use the local store.`);
+    throw new Error(`API mode requires BOTH ${API_URL_ENV} and ${API_KEY_ENV}; only ` + `${apiUrl ? API_URL_ENV : API_KEY_ENV} is set. Set both to use the HTTP API, ` + `or unset both to use the local store.`);
   }
   return { apiUrl, apiKey };
 }
-function isCloudMode(env = process.env) {
+function isApiTransport(env = process.env) {
   return resolveCloudConfig(env) !== null;
 }
 
@@ -13845,6 +13969,7 @@ var init_config_store = __esm(() => {
   init_types();
   init_bounded_read();
   init_instruction_graph();
+  init_retired_storage_mode();
   CloudHttpError = class CloudHttpError extends Error {
     status;
     body;
@@ -13858,8 +13983,8 @@ var init_config_store = __esm(() => {
 });
 
 // src/lib/session-render-ownership.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4, statSync as statSync3 } from "fs";
-import { dirname as dirname3, join as join7, parse as parse3, relative as relative3, sep } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
+import { dirname as dirname3, join as join9, parse as parse3, relative as relative3, sep } from "path";
 function toSegments(absolutePath2) {
   return absolutePath2.replaceAll("\\", "/").split("/").filter(Boolean);
 }
@@ -13880,7 +14005,7 @@ function readManifestRelativePaths(manifestPath) {
   try {
     if (!existsSync6(manifestPath))
       return null;
-    stats = statSync3(manifestPath);
+    stats = statSync4(manifestPath);
   } catch {
     return null;
   }
@@ -13890,7 +14015,7 @@ function readManifestRelativePaths(manifestPath) {
   }
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync4(manifestPath, "utf-8"));
+    manifest = JSON.parse(readFileSync5(manifestPath, "utf-8"));
   } catch {
     return null;
   }
@@ -13907,7 +14032,7 @@ function sessionRenderManifestClaimsPath(absolutePath2) {
   const root = parse3(absolutePath2).root;
   let home = dirname3(absolutePath2);
   for (let depth = 0;depth < MANIFEST_ANCESTOR_LIMIT; depth += 1) {
-    const manifestPath = join7(home, ...SESSION_RENDER_MANIFEST_RELATIVE_PATH.split("/"));
+    const manifestPath = join9(home, ...SESSION_RENDER_MANIFEST_RELATIVE_PATH.split("/"));
     const relativePaths = readManifestRelativePaths(manifestPath);
     if (relativePaths) {
       const claimed = relative3(home, absolutePath2).split(sep).join("/");
@@ -13934,25 +14059,25 @@ var init_session_render_ownership = __esm(() => {
 // src/lib/apply.ts
 var exports_apply = {};
 __export(exports_apply, {
-  previewConfigs: () => previewConfigs,
-  normalizeTargetPath: () => normalizeTargetPath,
-  getConfigHome: () => getConfigHome,
-  expandPath: () => expandPath,
-  applyConfigsWithReport: () => applyConfigsWithReport,
+  applyConfig: () => applyConfig,
   applyConfigs: () => applyConfigs,
-  applyConfig: () => applyConfig
+  applyConfigsWithReport: () => applyConfigsWithReport,
+  expandPath: () => expandPath,
+  getConfigHome: () => getConfigHome,
+  normalizeTargetPath: () => normalizeTargetPath,
+  previewConfigs: () => previewConfigs
 });
-import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync5, realpathSync as realpathSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename as basename4, dirname as dirname4, join as join8, resolve as resolve5 } from "path";
-import { homedir as homedir5 } from "os";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6, realpathSync as realpathSync2, writeFileSync as writeFileSync2 } from "fs";
+import { basename as basename4, dirname as dirname4, join as join10, resolve as resolve7 } from "path";
+import { homedir as homedir6 } from "os";
 function getConfigHome() {
-  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir5();
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir6();
 }
 function expandPath(p) {
   if (p.startsWith("~/")) {
-    return resolve5(getConfigHome(), p.slice(2));
+    return resolve7(getConfigHome(), p.slice(2));
   }
-  return resolve5(p);
+  return resolve7(p);
 }
 function normalizeTargetPath(p) {
   const expanded = expandPath(p);
@@ -13964,7 +14089,7 @@ function normalizeTargetPath(p) {
     while (true) {
       if (existsSync7(current)) {
         try {
-          return resolve5(realpathSync2(current), ...missingSegments);
+          return resolve7(realpathSync2(current), ...missingSegments);
         } catch {
           return expanded;
         }
@@ -13993,7 +14118,7 @@ async function writeConfigResult(config, targetPath, content, opts, meta = {}) {
   }
   const path = expandPath(renderedTargetPath);
   const renderedForTarget = isCursorGlobalAuthorityPath(path) ? stampCursorGlobalAuthorityMarker(renderedContent) : renderedContent;
-  const previousContent = existsSync7(path) ? readFileSync5(path, "utf-8") : null;
+  const previousContent = existsSync7(path) ? readFileSync6(path, "utf-8") : null;
   const changed = previousContent !== renderedForTarget;
   if (!opts.dryRun) {
     const dir = dirname4(path);
@@ -14033,7 +14158,7 @@ function wouldDestroyACredential(targetPath, renderedContent, format) {
     const path = expandPath(targetPath);
     if (!existsSync7(path))
       return [];
-    current = readFileSync5(path, "utf-8");
+    current = readFileSync6(path, "utf-8");
   } catch {
     return secretTokens;
   }
@@ -14357,7 +14482,7 @@ function sessionRendererOwnsCanonicalTarget(normalized, opts) {
     getConfigHome(),
     opts.vars?.["HOME_DIR"]
   ].filter((home) => typeof home === "string" && home.length > 0));
-  if ([...homes].some((home) => SESSION_RENDER_OWNED_CONFIG_TARGETS.some((relativePath) => normalized === normalizeTargetPath(join8(home, ...relativePath.split("/"))))))
+  if ([...homes].some((home) => SESSION_RENDER_OWNED_CONFIG_TARGETS.some((relativePath) => normalized === normalizeTargetPath(join10(home, ...relativePath.split("/"))))))
     return true;
   return sessionRenderOwnsPath(normalized);
 }
@@ -14375,9 +14500,9 @@ var init_apply = __esm(() => {
 });
 
 // src/lib/sync-dir.ts
-import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
-import { join as join9, relative as relative4 } from "path";
-import { homedir as homedir6 } from "os";
+import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync7, statSync as statSync5 } from "fs";
+import { join as join11, relative as relative4 } from "path";
+import { homedir as homedir7 } from "os";
 function shouldSkip(p) {
   return SKIP.some((s) => p.includes(s));
 }
@@ -14386,9 +14511,9 @@ async function syncFromDir(dir, opts = {}) {
   const absDir = expandPath(dir);
   if (!existsSync8(absDir))
     return { added: 0, updated: 0, unchanged: 0, skipped: [`Not found: ${absDir}`] };
-  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync(absDir).map((f) => join9(absDir, f)).filter((f) => statSync4(f).isFile());
+  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync(absDir).map((f) => join11(absDir, f)).filter((f) => statSync5(f).isFile());
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
-  const home = homedir6();
+  const home = homedir7();
   const allConfigs = await store.listConfigs();
   for (const file of files) {
     if (shouldSkip(file)) {
@@ -14396,7 +14521,7 @@ async function syncFromDir(dir, opts = {}) {
       continue;
     }
     try {
-      const content = readFileSync6(file, "utf-8");
+      const content = readFileSync7(file, "utf-8");
       if (content.length > 500000) {
         result.skipped.push(file + " (too large)");
         continue;
@@ -14422,7 +14547,7 @@ async function syncFromDir(dir, opts = {}) {
 }
 async function syncToDir(dir, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
-  const home = homedir6();
+  const home = homedir7();
   const absDir = expandPath(dir);
   const normalized = dir.startsWith("~/") ? dir : absDir.replace(home, "~");
   const configs = (await store.listConfigs()).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
@@ -14446,7 +14571,7 @@ async function syncToDir(dir, opts = {}) {
 }
 function walkDir(dir, files = []) {
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const full = join9(dir, entry.name);
+    const full = join11(dir, entry.name);
     if (shouldSkip(full))
       continue;
     if (entry.isDirectory())
@@ -14467,21 +14592,21 @@ var init_sync_dir = __esm(() => {
 // src/lib/sync.ts
 var exports_sync = {};
 __export(exports_sync, {
-  syncToDisk: () => syncToDisk,
-  syncToDir: () => syncToDir,
-  syncProject: () => syncProject,
-  syncKnown: () => syncKnown,
-  syncFromDir: () => syncFromDir,
-  diffConfig: () => diffConfig,
-  detectFormat: () => detectFormat,
-  detectCategory: () => detectCategory,
-  detectAgent: () => detectAgent,
-  PROJECT_CONFIG_FILES: () => PROJECT_CONFIG_FILES,
+  CLAUDE_PROMPT_OUTPUTS: () => CLAUDE_PROMPT_OUTPUTS,
   KNOWN_CONFIGS: () => KNOWN_CONFIGS,
-  CLAUDE_PROMPT_OUTPUTS: () => CLAUDE_PROMPT_OUTPUTS
+  PROJECT_CONFIG_FILES: () => PROJECT_CONFIG_FILES,
+  detectAgent: () => detectAgent,
+  detectCategory: () => detectCategory,
+  detectFormat: () => detectFormat,
+  diffConfig: () => diffConfig,
+  syncFromDir: () => syncFromDir,
+  syncKnown: () => syncKnown,
+  syncProject: () => syncProject,
+  syncToDir: () => syncToDir,
+  syncToDisk: () => syncToDisk
 });
-import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync7 } from "fs";
-import { basename as basename5, extname as extname3, join as join10 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync8 } from "fs";
+import { basename as basename5, extname as extname3, join as join12 } from "path";
 function claudeRuleOutputs(fileName) {
   const stem = basename5(fileName, extname3(fileName));
   return [
@@ -14545,11 +14670,11 @@ async function syncProject(opts) {
   const allConfigs = await store.listConfigs();
   const machine = detectMachineContext();
   for (const pf of PROJECT_CONFIG_FILES) {
-    const abs = join10(absDir, pf.file);
+    const abs = join12(absDir, pf.file);
     if (!existsSync9(abs))
       continue;
     try {
-      const rawContent = readFileSync7(abs, "utf-8");
+      const rawContent = readFileSync8(abs, "utf-8");
       if (rawContent.length > 500000) {
         result.skipped.push(pf.file);
         continue;
@@ -14578,20 +14703,20 @@ async function syncProject(opts) {
     }
   }
   for (const ruleDir of [
-    { dir: join10(absDir, ".claude", "rules"), agent: "claude", namePrefix: "rules" },
-    { dir: join10(absDir, ".agents", "rules"), agent: "antigravity", namePrefix: "antigravity-rules" },
-    { dir: join10(absDir, ".cursor", "rules"), agent: "cursor", namePrefix: "cursor-rules" },
-    { dir: join10(absDir, ".github", "instructions"), agent: "copilot", namePrefix: "copilot-instructions" },
-    { dir: join10(absDir, ".devin", "rules"), agent: "devin", namePrefix: "devin-rules" },
-    { dir: join10(absDir, ".windsurf", "rules"), agent: "windsurf-legacy", namePrefix: "windsurf-rules" },
-    { dir: join10(absDir, ".clinerules"), agent: "cline", namePrefix: "cline-rules" }
+    { dir: join12(absDir, ".claude", "rules"), agent: "claude", namePrefix: "rules" },
+    { dir: join12(absDir, ".agents", "rules"), agent: "antigravity", namePrefix: "antigravity-rules" },
+    { dir: join12(absDir, ".cursor", "rules"), agent: "cursor", namePrefix: "cursor-rules" },
+    { dir: join12(absDir, ".github", "instructions"), agent: "copilot", namePrefix: "copilot-instructions" },
+    { dir: join12(absDir, ".devin", "rules"), agent: "devin", namePrefix: "devin-rules" },
+    { dir: join12(absDir, ".windsurf", "rules"), agent: "windsurf-legacy", namePrefix: "windsurf-rules" },
+    { dir: join12(absDir, ".clinerules"), agent: "cline", namePrefix: "cline-rules" }
   ]) {
     if (!existsSync9(ruleDir.dir))
       continue;
     const mdFiles = readdirSync2(ruleDir.dir).filter((f) => f.endsWith(".md") || f.endsWith(".mdc"));
     for (const f of mdFiles) {
-      const abs = join10(ruleDir.dir, f);
-      const raw = readFileSync7(abs, "utf-8");
+      const abs = join12(ruleDir.dir, f);
+      const raw = readFileSync8(abs, "utf-8");
       const redacted = redactContent(raw, "markdown");
       const machineAware = templateizeMachineContent(redacted.content, machine);
       const content = machineAware.content;
@@ -14637,13 +14762,13 @@ async function syncKnown(opts = {}) {
       const extensions = known.rulesExtensions ?? [".md", ".mdc"];
       const ruleFiles = readdirSync2(absDir).filter((f) => extensions.some((ext) => f.endsWith(ext)));
       for (const f of ruleFiles) {
-        const abs2 = join10(absDir, f);
+        const abs2 = join12(absDir, f);
         const targetPath = abs2.replace(home, "~");
         if (existingOutputOwners.has(normalizeTargetPath(targetPath)) || isKnownGeneratedTargetPath(targetPath)) {
           result.skipped.push(`${targetPath} (generated output)`);
           continue;
         }
-        const raw = readFileSync7(abs2, "utf-8");
+        const raw = readFileSync8(abs2, "utf-8");
         const redacted = redactContent(raw, "markdown");
         const machineAware = templateizeMachineContent(redacted.content, machine);
         const content = machineAware.content;
@@ -14676,7 +14801,7 @@ async function syncKnown(opts = {}) {
       continue;
     }
     try {
-      const rawContent = normalizeKnownConfigSource(known, readFileSync7(abs, "utf-8"));
+      const rawContent = normalizeKnownConfigSource(known, readFileSync8(abs, "utf-8"));
       if (rawContent.length > 500000) {
         result.skipped.push(known.path + " (too large)");
         continue;
@@ -14779,7 +14904,7 @@ function buildDiff(expectedContent, targetPath, storedFormat, showSecrets) {
   const path = expandPath(targetPath);
   if (!existsSync9(path))
     return `(file not found on disk: ${path})`;
-  const diskContent = readFileSync7(path, "utf-8");
+  const diskContent = readFileSync8(path, "utf-8");
   if (diskContent === expectedContent)
     return "(no diff \u2014 identical)";
   const format = redactFormatForTarget(targetPath, storedFormat);
@@ -15012,18 +15137,18 @@ __export(exports_package_manager_guard, {
   scanPackageManagerSecrets: () => scanPackageManagerSecrets
 });
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync15, lstatSync as lstatSync4, readdirSync as readdirSync4, readFileSync as readFileSync12 } from "fs";
-import { homedir as homedir7 } from "os";
-import { basename as basename6, dirname as dirname7, isAbsolute as isAbsolute5, join as join15, relative as relative6, resolve as resolve9 } from "path";
+import { existsSync as existsSync16, lstatSync as lstatSync6, readdirSync as readdirSync4, readFileSync as readFileSync14 } from "fs";
+import { homedir as homedir9 } from "os";
+import { basename as basename6, dirname as dirname8, isAbsolute as isAbsolute5, join as join18, relative as relative7, resolve as resolve12 } from "path";
 function scanPackageManagerSecrets(options = {}) {
-  const cwd = options.cwd ? resolve9(options.cwd) : process.cwd();
-  const roots = (options.roots && options.roots.length > 0 ? options.roots : [cwd]).map((root) => resolve9(cwd, root));
+  const cwd = options.cwd ? resolve12(options.cwd) : process.cwd();
+  const roots = (options.roots && options.roots.length > 0 ? options.roots : [cwd]).map((root) => resolve12(cwd, root));
   const findings = [];
   let scannedFiles = 0;
   for (const root of roots) {
-    if (!existsSync15(root))
+    if (!existsSync16(root))
       continue;
-    const stat = lstatSync4(root);
+    const stat = lstatSync6(root);
     if (stat.isFile()) {
       if (!shouldScanRepoFile(root))
         continue;
@@ -15031,14 +15156,14 @@ function scanPackageManagerSecrets(options = {}) {
       if (text === null)
         continue;
       scannedFiles++;
-      findings.push(...scanFile(root, text, classifyRepoFile(root), isTrackedFile(root), dirname7(root)));
+      findings.push(...scanFile(root, text, classifyRepoFile(root), isTrackedFile(root), dirname8(root)));
       continue;
     }
     if (!stat.isDirectory())
       continue;
     const tracked = trackedFiles(root);
     for (const file of collectRepoFiles(root)) {
-      const rel = toPosix(relative6(root, file));
+      const rel = toPosix(relative7(root, file));
       const isTracked = tracked.has(rel);
       const text = readTextFile(file);
       if (text === null)
@@ -15048,10 +15173,10 @@ function scanPackageManagerSecrets(options = {}) {
     }
   }
   if (options.includeHome) {
-    const home = homedir7();
+    const home = homedir9();
     for (const name of HOME_FILES) {
-      const file = join15(home, name);
-      if (!existsSync15(file))
+      const file = join18(home, name);
+      if (!existsSync16(file))
         continue;
       const text = readTextFile(file);
       if (text === null)
@@ -15075,12 +15200,12 @@ function collectRepoFiles(root) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name))
           continue;
-        visit(join15(dir, entry.name));
+        visit(join18(dir, entry.name));
         continue;
       }
       if (!entry.isFile())
         continue;
-      const file = join15(dir, entry.name);
+      const file = join18(dir, entry.name);
       if (shouldScanRepoFile(file))
         out.push(file);
     }
@@ -15115,10 +15240,10 @@ function isNpmrcName(name) {
 }
 function readTextFile(file) {
   try {
-    const stat = lstatSync4(file);
+    const stat = lstatSync6(file);
     if (!stat.isFile() || stat.size > 5000000)
       return null;
-    const buf = readFileSync12(file);
+    const buf = readFileSync14(file);
     if (buf.includes(0))
       return null;
     return buf.toString("utf-8");
@@ -15318,11 +15443,11 @@ function trackedFiles(root) {
 }
 function isTrackedFile(file) {
   try {
-    const repoRoot = execFileSync2("git", ["-C", dirname7(file), "rev-parse", "--show-toplevel"], {
+    const repoRoot = execFileSync2("git", ["-C", dirname8(file), "rev-parse", "--show-toplevel"], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
-    const rel = toPosix(relative6(repoRoot, file));
+    const rel = toPosix(relative7(repoRoot, file));
     execFileSync2("git", ["-C", repoRoot, "ls-files", "--error-unmatch", "--", rel], {
       stdio: ["ignore", "ignore", "ignore"]
     });
@@ -15348,13 +15473,13 @@ function stripInlineComment(value) {
   return value.replace(/\s[#;].*$/, "").trim();
 }
 function displayPath(file, root) {
-  const home = homedir7();
+  const home = homedir9();
   if (root === home && (file === home || file.startsWith(home + "/")))
-    return "~/" + toPosix(relative6(home, file));
+    return "~/" + toPosix(relative7(home, file));
   if (isAbsolute5(root) && file.startsWith(root + "/"))
-    return toPosix(relative6(root, file));
+    return toPosix(relative7(root, file));
   if (file === home || file.startsWith(home + "/"))
-    return "~/" + toPosix(relative6(home, file));
+    return "~/" + toPosix(relative7(home, file));
   return file;
 }
 function toPosix(path) {
@@ -15392,15 +15517,16 @@ var init_package_manager_guard = __esm(() => {
   TOKEN_VALUE_PATTERNS = [
     { re: /npm_[A-Za-z0-9]{36,}/, rule: "literal-npm-token", detail: "literal npm token-like value" },
     { re: /gh[pousr]_[A-Za-z0-9_]{36,}/, rule: "literal-github-token", detail: "literal GitHub token-like value" },
-    { re: /sk-ant-[A-Za-z0-9\-_]{40,}/, rule: "literal-anthropic-key", detail: "literal Anthropic key-like value" },
+    { re: /sk[-]ant-[A-Za-z0-9\-_]{40,}/, rule: "literal-anthropic-key", detail: "literal Anthropic key-like value" },
     { re: /sk-[A-Za-z0-9]{48,}/, rule: "literal-openai-key", detail: "literal OpenAI key-like value" },
     { re: /AKIA[0-9A-Z]{16}/, rule: "literal-aws-access-key", detail: "literal AWS access-key-like value" },
     { re: /xoxb-[0-9]+-[A-Za-z0-9-]+/, rule: "literal-slack-token", detail: "literal Slack token-like value" }
   ];
 });
 
-// node_modules/@hasna/events/dist/commander.js
+// ../events/dist/commander.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { Buffer as Buffer2 } from "buffer";
 import { existsSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
@@ -15416,29 +15542,83 @@ function getPathValue(input, path) {
     return;
   }, input);
 }
-function wildcardToRegExp(pattern) {
-  const escaped = pattern.replace(/[|\\{}()[\]^$+?.]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`);
+function getFieldValues(input, path) {
+  const values = [];
+  const push = (value) => {
+    if (!values.some((item) => Object.is(item, value)))
+      values.push(value);
+  };
+  if (path.includes(".") && path in input)
+    push(input[path]);
+  const nestedValue = getPathValue(input, path);
+  if (nestedValue !== undefined || !path.includes("."))
+    push(nestedValue);
+  return values;
+}
+function wildcardToRegExp(pattern, options = {}) {
+  let body = "";
+  for (let index = 0;index < pattern.length; index += 1) {
+    const char = pattern[index];
+    if (char === "*") {
+      if (pattern[index + 1] === "*") {
+        body += ".*";
+        index += 1;
+      } else {
+        body += options.segmentSafe ? "[^/]*" : ".*";
+      }
+    } else {
+      body += char.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${body}$`);
 }
-function matchString(value, matcher) {
+function matchString(value, matcher, options = {}) {
   if (matcher === undefined)
     return true;
   if (value === undefined)
     return false;
   const matchers = Array.isArray(matcher) ? matcher : [matcher];
-  return matchers.some((item) => wildcardToRegExp(item).test(value));
+  return matchers.some((item) => wildcardToRegExp(item, options).test(value));
 }
 function matchRecord(input, matcher) {
   if (!matcher)
     return true;
   return Object.entries(matcher).every(([path, expected]) => {
-    const actual = getPathValue(input, path);
-    if (typeof expected === "string" || Array.isArray(expected)) {
-      return matchString(actual === undefined ? undefined : String(actual), expected);
-    }
-    return actual === expected;
+    const actualValues = getFieldValues(input, path);
+    return matchField(actualValues, expected, path);
   });
 }
+function matchField(actualValues, expected, path) {
+  if (isNegativeMatcher(expected)) {
+    return !actualValues.some((actual) => matchPositiveField(actual, expected.not, path));
+  }
+  return actualValues.some((actual) => matchPositiveField(actual, expected, path));
+}
+function matchPositiveField(actual, expected, path) {
+  if (typeof expected === "string" || Array.isArray(expected)) {
+    return stringCandidates(actual).some((candidate) => matchString(candidate, expected, {
+      segmentSafe: path.endsWith("_path") || path.endsWith(".path")
+    }));
+  }
+  if (Array.isArray(actual)) {
+    return actual.some((item) => item === expected);
+  }
+  return actual === expected;
+}
+function stringCandidates(actual) {
+  if (actual === undefined)
+    return [];
+  if (Array.isArray(actual)) {
+    return actual.flatMap((item) => isPrimitiveFieldValue(item) ? [String(item)] : []);
+  }
+  return [String(actual)];
+}
+function isPrimitiveFieldValue(value) {
+  return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function isNegativeMatcher(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value) && "not" in value);
+}
 function eventMatchesFilter(event, filter) {
   return matchString(event.source, filter.source) && matchString(event.type, filter.type) && matchString(event.subject, filter.subject) && matchString(event.severity, filter.severity) && matchRecord(event.data, filter.data) && matchRecord(event.metadata, filter.metadata);
 }
@@ -15451,16 +15631,29 @@ function channelMatchesEvent(channel, event) {
 }
 var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR";
 var HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME";
+var LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:";
+var DEFAULT_EVENT_PAGE_LIMIT = 100;
+var MAX_EVENT_PAGE_LIMIT = 1000;
 function getEventsDataDir(override) {
   return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join(homedir(), ".hasna", "events");
 }
+function getActiveEventsDirEnv() {
+  if (process.env[HASNA_EVENTS_DIR_ENV])
+    return HASNA_EVENTS_DIR_ENV;
+  if (process.env[HASNA_EVENTS_HOME_ENV])
+    return HASNA_EVENTS_HOME_ENV;
+  return null;
+}
+
 class JsonEventsStore {
   dataDir;
+  runtime;
   channelsPath;
   eventsPath;
   deliveriesPath;
   constructor(dataDir = getEventsDataDir()) {
     this.dataDir = dataDir;
+    this.runtime = localJsonRuntime(dataDir);
     this.channelsPath = join(dataDir, "channels.json");
     this.eventsPath = join(dataDir, "events.json");
     this.deliveriesPath = join(dataDir, "deliveries.json");
@@ -15508,13 +15701,58 @@ class JsonEventsStore {
     await this.writeJson(this.eventsPath, events);
     return event;
   }
-  async listEvents() {
+  async appendEventOnce(event, options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    const dedupe = options.dedupe !== false;
+    if (dedupe) {
+      const existing = findEventByIdentity(events, { id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    events.push(event);
+    await this.writeJson(this.eventsPath, events);
+    return {
+      event,
+      stored: true,
+      deduped: false,
+      identity: { id: event.id, dedupeKey: event.dedupeKey }
+    };
+  }
+  async listEvents(options = {}) {
     await this.init();
-    return this.readJson(this.eventsPath, []);
+    const events = await this.readJson(this.eventsPath, []);
+    return queryEvents(events, options);
+  }
+  async listEventsPage(options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    const queried = queryEvents(events, {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = queried.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < queried.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async findEventByIdentity(identity) {
     const events = await this.listEvents();
-    return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+    return findEventByIdentity(events, identity);
   }
   async appendDelivery(result) {
     await this.init();
@@ -15565,6 +15803,130 @@ class JsonEventsStore {
     });
   }
 }
+function localJsonRuntime(dataDir = getEventsDataDir()) {
+  return {
+    mode: "local-files",
+    name: "json-events-store",
+    remote: false,
+    localFiles: true,
+    localSqlite: false,
+    postgres: false,
+    s3: false,
+    aws: false,
+    durable: true,
+    idempotency: "best-effort-local",
+    replayCursors: true,
+    description: `Local JSON files in ${dataDir}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+  };
+}
+function encodeLocalJsonEventCursor(offset, options = {}) {
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid event cursor offset: ${offset}`);
+  const payload = {
+    offset,
+    eventId: options.eventId,
+    source: options.source,
+    type: options.type
+  };
+  return `${LOCAL_JSON_EVENT_CURSOR_PREFIX}${Buffer2.from(JSON.stringify(payload), "utf-8").toString("base64url")}`;
+}
+function decodeLocalJsonEventCursor(cursor, options = {}) {
+  if (!cursor)
+    return 0;
+  if (!cursor.startsWith(LOCAL_JSON_EVENT_CURSOR_PREFIX))
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  const rawPayload = cursor.slice(LOCAL_JSON_EVENT_CURSOR_PREFIX.length);
+  let payload;
+  try {
+    payload = JSON.parse(Buffer2.from(rawPayload, "base64url").toString("utf-8"));
+  } catch {
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  }
+  const offset = payload.offset;
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  assertCursorFilter("eventId", payload.eventId, options.eventId);
+  assertCursorFilter("source", payload.source, options.source);
+  assertCursorFilter("type", payload.type, options.type);
+  return offset;
+}
+function normalizeEventPageLimit(limit) {
+  if (limit === undefined)
+    return DEFAULT_EVENT_PAGE_LIMIT;
+  if (!Number.isInteger(limit) || limit < 1)
+    throw new Error(`Event page limit must be a positive integer, got ${limit}`);
+  return Math.min(limit, MAX_EVENT_PAGE_LIMIT);
+}
+function queryEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor) {
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    rows = rows.slice(offset);
+  }
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
+}
+function assertCursorFilter(name, cursorValue, optionValue) {
+  if (cursorValue !== optionValue)
+    throw new Error(`Local JSON event cursor ${name} filter mismatch`);
+}
+function findEventByIdentity(events, identity) {
+  return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+}
+async function getEventsStatus(dataDir) {
+  const store = new JsonEventsStore(dataDir);
+  await store.init();
+  const [channels, events, deliveries] = await Promise.all([
+    store.listChannels(),
+    store.listEvents(),
+    store.listDeliveries()
+  ]);
+  const transports = channels.reduce((counts, channel) => {
+    counts[channel.transport] = (counts[channel.transport] ?? 0) + 1;
+    return counts;
+  }, {});
+  return {
+    service: "events",
+    schemaVersion: "1.0",
+    dataDir: store.dataDir,
+    storage: store.runtime,
+    env: {
+      primary: HASNA_EVENTS_DIR_ENV,
+      fallback: HASNA_EVENTS_HOME_ENV,
+      active: getActiveEventsDirEnv()
+    },
+    files: {
+      channels: statusFile(store.dataDir, "channels.json", channels.length),
+      events: statusFile(store.dataDir, "events.json", events.length),
+      deliveries: statusFile(store.dataDir, "deliveries.json", deliveries.length)
+    },
+    counts: {
+      channels: channels.length,
+      enabledChannels: channels.filter((channel) => channel.enabled).length,
+      disabledChannels: channels.filter((channel) => !channel.enabled).length,
+      events: events.length,
+      deliveries: deliveries.length
+    },
+    transports,
+    safety: {
+      includesEventPayloads: false,
+      includesWebhookSecrets: false,
+      listOutputsRedactSecrets: true,
+      statusOutputIsMetadataOnly: true
+    }
+  };
+}
+function statusFile(dataDir, fileName, records) {
+  const path = join(dataDir, fileName);
+  return { path, exists: existsSync(path), records };
+}
 var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
 function buildSignatureBase(timestamp, body) {
   return `${timestamp}.${body}`;
@@ -15579,21 +15941,27 @@ function now() {
 function truncate(value, max = 4096) {
   return value.length > max ? `${value.slice(0, max)}...` : value;
 }
-function buildWebhookRequest(event, channel) {
+function buildWebhookRequest(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  for (const name of Object.keys(channel.webhook.headers ?? {})) {
+    if (/^x-hasna-/i.test(name)) {
+      throw new Error(`Webhook header ${name} is reserved for signed delivery metadata`);
+    }
+  }
   const body = JSON.stringify(event);
-  const timestamp = event.time;
+  const timestamp = options.timestamp ?? new Date().toISOString();
   const headers = {
     "Content-Type": "application/json",
     "User-Agent": "@hasna/events",
     "X-Hasna-Event-Id": event.id,
     "X-Hasna-Event-Type": event.type,
-    "X-Hasna-Timestamp": timestamp,
-    ...channel.webhook.headers
+    ...channel.webhook.headers,
+    "X-Hasna-Timestamp": timestamp
   };
-  if (channel.webhook.secret) {
-    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp, body);
+  const secret = options.secret ?? channel.webhook.secret;
+  if (secret) {
+    headers["X-Hasna-Signature"] = signPayload(secret, timestamp, body);
   }
   return { body, headers };
 }
@@ -15601,7 +15969,21 @@ async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
   const startedAt = now();
-  const { body, headers } = buildWebhookRequest(event, channel);
+  let secret = channel.webhook.secret;
+  if (channel.webhook.secretRef) {
+    if (!options.secretResolver) {
+      return failedAttempt(startedAt, "Webhook secret reference has no runtime resolver");
+    }
+    try {
+      secret = await options.secretResolver(channel.webhook.secretRef);
+    } catch {
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+    }
+    if (!secret)
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+  }
+  const timestamp = (options.now?.() ?? new Date).toISOString();
+  const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp });
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
@@ -15633,6 +16015,15 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function failedAttempt(startedAt, error) {
+  return {
+    attempt: 1,
+    status: "failed",
+    startedAt,
+    completedAt: now(),
+    error
+  };
+}
 async function dispatchCommand(event, channel) {
   if (!channel.command)
     throw new Error(`Channel ${channel.id} has no command config`);
@@ -15721,6 +16112,90 @@ function createDeliveryResult(event, channel, attempts) {
     completedAt: attempts.at(-1)?.completedAt ?? now()
   };
 }
+
+class EventValidationError extends Error {
+  eventType;
+  issues;
+  constructor(eventType, issues) {
+    const detail = issues.map((issue) => `${issue.path || "<root>"}: ${issue.message}`).join("; ");
+    super(`Event validation failed for type "${eventType}": ${detail}`);
+    this.name = "EventValidationError";
+    this.eventType = eventType;
+    this.issues = issues;
+  }
+}
+
+class EventTypeCatalog {
+  definitions = new Map;
+  register(definition) {
+    this.definitions.set(definition.type, definition);
+    return this;
+  }
+  unregister(type) {
+    return this.definitions.delete(type);
+  }
+  has(type) {
+    return this.definitions.has(type);
+  }
+  get(type) {
+    return this.definitions.get(type);
+  }
+  list() {
+    return [...this.definitions.values()];
+  }
+  validateEvent(event) {
+    const definition = this.definitions.get(event.type);
+    if (!definition)
+      return { ok: true };
+    return definition.validate(event.data, event);
+  }
+  assertEventValid(event) {
+    const result = this.validateEvent(event);
+    if (!result.ok) {
+      throw new EventValidationError(event.type, result.issues);
+    }
+  }
+}
+var defaultEventTypeCatalog = new EventTypeCatalog;
+var APP_EVENT_V1_MAX_DATA_BYTES = 32 * 1024;
+function redactPaths(event, paths, replacement = "[REDACTED]") {
+  if (paths.length === 0)
+    return event;
+  const copy = structuredClone(event);
+  for (const path of paths) {
+    setPath(copy, path, replacement);
+  }
+  return copy;
+}
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue(event, replacement);
+}
+function shouldRedactKey(key) {
+  return /secret|token|password|api[_-]?key|authorization/i.test(key);
+}
+function redactValue(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue(item, replacement)
+  ]));
+}
+function setPath(input, path, replacement) {
+  const parts = path.split(".");
+  let cursor = input;
+  for (const part of parts.slice(0, -1)) {
+    const next = cursor[part];
+    if (!next || typeof next !== "object")
+      return;
+    cursor = next;
+  }
+  const last = parts.at(-1);
+  if (last && last in cursor)
+    cursor[last] = replacement;
+}
 function createEvent(input) {
   return {
     id: input.id ?? randomUUID2(),
@@ -15741,10 +16216,18 @@ class EventsClient {
   store;
   redactors;
   transportOptions;
+  catalog;
+  validateCatalogTypes;
   constructor(options = {}) {
     this.store = options.store ?? new JsonEventsStore(options.dataDir);
     this.redactors = options.redactors ?? [];
-    this.transportOptions = { fetchImpl: options.fetchImpl };
+    this.transportOptions = {
+      fetchImpl: options.fetchImpl,
+      secretResolver: options.secretResolver,
+      now: options.now
+    };
+    this.catalog = options.catalog ?? defaultEventTypeCatalog;
+    this.validateCatalogTypes = options.validateCatalogTypes ?? false;
   }
   async addChannel(input) {
     const timestamp = new Date().toISOString();
@@ -15762,18 +16245,40 @@ class EventsClient {
   }
   async emit(input, options = {}) {
     const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
-    if (options.dedupe !== false) {
-      const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
-      if (existing) {
-        return { event: existing, deliveries: [], deduped: true };
-      }
-    }
-    await this.store.appendEvent(event);
-    const deliveries = options.deliver === false ? [] : await this.deliver(event);
-    return { event, deliveries, deduped: false };
-  }
-  async listEvents() {
-    return this.store.listEvents();
+    if (options.validate ?? this.validateCatalogTypes) {
+      this.catalog.assertEventValid(event);
+    }
+    const append = await this.appendEvent(event, { dedupe: options.dedupe !== false });
+    if (append.deduped) {
+      return { event: append.event, deliveries: [], deduped: true };
+    }
+    const deliveries = options.deliver === false ? [] : await this.deliver(append.event);
+    return { event: append.event, deliveries, deduped: false };
+  }
+  async listEvents(options = {}) {
+    if (Object.keys(options).length === 0)
+      return this.store.listEvents();
+    return queryClientEvents(await this.store.listEvents(), options);
+  }
+  async listEventsPage(options = {}) {
+    if (this.store.listEventsPage)
+      return this.store.listEventsPage(options);
+    const events = queryClientEvents(await this.store.listEvents(), {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = events.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < events.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async listDeliveries() {
     return this.store.listDeliveries();
@@ -15790,7 +16295,7 @@ class EventsClient {
     }
     return deliveries;
   }
-  async testChannel(id, input = {}) {
+  async matchChannel(id, input = {}) {
     const channel = await this.store.getChannel(id);
     if (!channel)
       throw new Error(`Channel not found: ${id}`);
@@ -15807,28 +16312,71 @@ class EventsClient {
       time: input.time,
       id: input.id
     });
+    const matched = channelMatchesEvent(channel, event);
+    return {
+      channelId: channel.id,
+      matched,
+      event,
+      filters: channel.filters,
+      reason: matched ? undefined : channel.enabled ? "event did not match channel filters" : "channel is disabled"
+    };
+  }
+  async testChannel(id, input = {}, options = {}) {
+    const channel = await this.store.getChannel(id);
+    if (!channel)
+      throw new Error(`Channel not found: ${id}`);
+    const match = await this.matchChannel(id, input);
+    const event = match.event;
+    if (options.honorFilters && !match.matched) {
+      const timestamp = new Date().toISOString();
+      const result2 = createDeliveryResult(event, channel, [{
+        attempt: 1,
+        status: "skipped",
+        startedAt: timestamp,
+        completedAt: timestamp,
+        error: match.reason
+      }]);
+      result2.metadata = { reason: "filter_mismatch" };
+      await this.store.appendDelivery(result2);
+      return result2;
+    }
     const eventForChannel = await this.applyRedaction(event, channel);
     const result = await this.deliverWithRetry(eventForChannel, channel);
     await this.store.appendDelivery(result);
     return result;
   }
   async replay(options = {}) {
-    const events = (await this.store.listEvents()).filter((event) => {
-      if (options.eventId && event.id !== options.eventId)
-        return false;
-      if (options.source && event.source !== options.source)
-        return false;
-      if (options.type && event.type !== options.type)
-        return false;
-      return true;
-    });
+    const page = options.cursor || options.limit !== undefined ? await this.listEventsPage(options) : { events: await this.listEvents(options), hasMore: false };
     if (options.dryRun)
-      return { events, deliveries: [] };
+      return { events: page.events, deliveries: [], cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
     const deliveries = [];
-    for (const event of events) {
+    for (const event of page.events) {
       deliveries.push(...await this.deliver(event));
     }
-    return { events, deliveries };
+    return { events: page.events, deliveries, cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
+  }
+  async appendEvent(event, options) {
+    if (this.store.appendEventOnce) {
+      return this.store.appendEventOnce(event, { dedupe: options.dedupe });
+    }
+    if (options.dedupe) {
+      const existing = await this.store.findEventByIdentity({ id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    const stored = await this.store.appendEvent(event);
+    return {
+      event: stored,
+      stored: true,
+      deduped: false,
+      identity: { id: stored.id, dedupeKey: stored.dedupeKey }
+    };
   }
   async applyRedaction(event, channel) {
     let next = redactPaths(event, channel.redact?.paths ?? [], channel.redact?.replacement ?? "[REDACTED]");
@@ -15855,15 +16403,6 @@ class EventsClient {
     return createDeliveryResult(event, channel, attempts);
   }
 }
-function redactPaths(event, paths, replacement = "[REDACTED]") {
-  if (paths.length === 0)
-    return event;
-  const copy = structuredClone(event);
-  for (const path of paths) {
-    setPath(copy, path, replacement);
-  }
-  return copy;
-}
 function sanitizeChannelForOutput(channel) {
   const copy = structuredClone(channel);
   if (copy.webhook?.secret)
@@ -15876,34 +16415,19 @@ function sanitizeChannelForOutput(channel) {
 function sanitizeChannelsForOutput(channels) {
   return channels.map(sanitizeChannelForOutput);
 }
-function redactSensitiveKeys(event, replacement = "[REDACTED]") {
-  return redactValue(event, replacement);
-}
-function shouldRedactKey(key) {
-  return /secret|token|password|api[_-]?key|authorization/i.test(key);
-}
-function redactValue(value, replacement) {
-  if (Array.isArray(value))
-    return value.map((item) => redactValue(item, replacement));
-  if (!value || typeof value !== "object")
-    return value;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-    key,
-    shouldRedactKey(key) ? replacement : redactValue(item, replacement)
-  ]));
-}
-function setPath(input, path, replacement) {
-  const parts = path.split(".");
-  let cursor = input;
-  for (const part of parts.slice(0, -1)) {
-    const next = cursor[part];
-    if (!next || typeof next !== "object")
-      return;
-    cursor = next;
-  }
-  const last = parts.at(-1);
-  if (last && last in cursor)
-    cursor[last] = replacement;
+function queryClientEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor)
+    rows = rows.slice(decodeLocalJsonEventCursor(options.cursor, options));
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
 }
 function normalizeTime(value) {
   if (!value)
@@ -15917,6 +16441,77 @@ function normalizeRetryPolicy(policy) {
     multiplier: Math.max(1, policy?.multiplier ?? 2)
   };
 }
+function parseFieldMatchers(values, label, typed = false) {
+  if (!values?.length)
+    return;
+  const result = {};
+  for (const value of values) {
+    const parsed = parseMatcherExpression(value, label);
+    const path = parsed.path;
+    if (path in result)
+      throw new Error(`Duplicate ${label} filter path: ${path}`);
+    const matcherValue = typed ? parseTypedMatcherValue(parsed.rawValue, label) : parsed.rawValue;
+    result[path] = parsed.negated ? { not: matcherValue } : matcherValue;
+  }
+  return result;
+}
+function parseFilterOptions(options) {
+  const filter2 = {};
+  if (options.source)
+    filter2.source = options.source;
+  if (options.type)
+    filter2.type = options.type;
+  if (options.subject)
+    filter2.subject = options.subject;
+  if (options.severity)
+    filter2.severity = options.severity;
+  const data = mergeMatchers(parseFieldMatchers(options.data, "data"), parseFieldMatchers(options.dataJson, "data-json", true));
+  const metadata = mergeMatchers(parseFieldMatchers(options.metadata, "metadata"), parseFieldMatchers(options.metadataJson, "metadata-json", true));
+  if (Object.keys(data).length > 0)
+    filter2.data = data;
+  if (Object.keys(metadata).length > 0)
+    filter2.metadata = metadata;
+  return Object.keys(filter2).length > 0 ? [filter2] : undefined;
+}
+function mergeMatchers(...records) {
+  const result = {};
+  for (const record of records) {
+    if (!record)
+      continue;
+    for (const [path, value] of Object.entries(record)) {
+      if (path in result)
+        throw new Error(`Duplicate filter path: ${path}`);
+      result[path] = value;
+    }
+  }
+  return result;
+}
+function parseTypedMatcherValue(value, label) {
+  const parsed = JSON.parse(value);
+  if (parsed === null || typeof parsed === "string" || typeof parsed === "number" || typeof parsed === "boolean" || Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) {
+    return parsed;
+  }
+  throw new Error(`${label} filter JSON values must be string, string[], number, boolean, or null`);
+}
+function parseMatcherExpression(value, label) {
+  const negativeSeparator = value.indexOf("!=");
+  if (negativeSeparator > 0) {
+    return {
+      path: value.slice(0, negativeSeparator),
+      rawValue: value.slice(negativeSeparator + 2),
+      negated: true
+    };
+  }
+  const separator = value.indexOf("=");
+  if (separator <= 0)
+    throw new Error(`Invalid ${label} filter, expected path=value or path!=value: ${value}`);
+  return {
+    path: value.slice(0, separator),
+    rawValue: value.slice(separator + 1),
+    negated: false
+  };
+}
+var DEFAULT_EVENT_LIST_LIMIT = 100;
 function parseJsonObject(value, fallback) {
   if (!value)
     return fallback;
@@ -15938,18 +16533,6 @@ function parseHeaders(values) {
   }
   return headers;
 }
-function parseFilter(options) {
-  const filter2 = {};
-  if (options.source)
-    filter2.source = options.source;
-  if (options.type)
-    filter2.type = options.type;
-  if (options.subject)
-    filter2.subject = options.subject;
-  if (options.severity)
-    filter2.severity = options.severity;
-  return Object.keys(filter2).length > 0 ? [filter2] : undefined;
-}
 function createClient(options) {
   if (options.createClient)
     return options.createClient();
@@ -15961,22 +16544,30 @@ function print(value, json, text) {
   else
     console.log(text);
 }
+function fail(error, json) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (json)
+    console.log(JSON.stringify({ error: message }, null, 2));
+  else
+    console.error(message);
+  process.exitCode = 1;
+}
 function hasJsonOption(options) {
   return Boolean(options?.json || options?.opts?.().json || options?.optsWithGlobals?.().json || options?.parent?.opts?.().json || options?.parent?.optsWithGlobals?.().json);
 }
 function wantsJson(actionOptions, command) {
   return hasJsonOption(actionOptions) || hasJsonOption(command);
 }
-function registerWebhookCommands(program, options) {
-  const webhooks = program.command(options.webhooksCommandName ?? "webhooks").description("Manage Hasna event webhook subscriptions");
-  webhooks.command("add").description("Add or replace a webhook or command subscription").argument("<target>", "Webhook URL or command binary").requiredOption("--id <id>", "Subscription/channel identifier").option("--transport <kind>", "Transport kind: webhook or command", "webhook").option("--name <name>", "Display name").option("--type <pattern>", "Event type filter, e.g. todos.task.*").option("--source <pattern>", "Event source filter").option("--subject <pattern>", "Event subject filter").option("--severity <pattern>", "Event severity filter").option("--secret <secret>", "Webhook HMAC secret").option("--header <name=value...>", "Webhook header", collectValues, []).option("--arg <arg...>", "Command argument", collectValues, []).option("--timeout-ms <ms>", "Transport timeout in milliseconds", parseNumber).option("--retry-attempts <n>", "Maximum delivery attempts", parseNumber).option("--retry-backoff-ms <ms>", "Initial retry backoff in milliseconds", parseNumber).option("--redact <path...>", "Event field path to redact before delivery", collectValues, []).option("--disabled", "Create channel disabled", false).option("-j, --json", "Print JSON output", false).action(async (target, actionOptions, command) => {
+function registerChannelCommands(program, options) {
+  const channels = program.command(options.channelsCommandName ?? "channels").description("Manage Hasna event channels");
+  channels.command("add").description("Add or replace a channel").argument("<target>", "Webhook URL or command binary").requiredOption("--id <id>", "Channel identifier").option("--transport <kind>", "Transport kind: webhook or command", "webhook").option("--name <name>", "Display name").option("--type <pattern>", "Event type filter, e.g. todos.task.*").option("--source <pattern>", "Event source filter").option("--subject <pattern>", "Event subject filter").option("--severity <pattern>", "Event severity filter").option("--data <path=value...>", "Event data field filter; string values, path!=value negatives, array-member matching, dot paths, * segment wildcard, ** recursive wildcard", collectValues, []).option("--metadata <path=value...>", "Event metadata field filter; string values, path!=value negatives, array-member matching, dot paths, * segment wildcard, ** recursive wildcard", collectValues, []).option("--data-json <path=json...>", "Event data field filter with typed JSON value; path!=json negatives supported", collectValues, []).option("--metadata-json <path=json...>", "Event metadata field filter with typed JSON value; path!=json negatives supported", collectValues, []).option("--secret <secret>", "Webhook HMAC secret").option("--header <name=value...>", "Webhook header", collectValues, []).option("--arg <arg...>", "Command argument", collectValues, []).option("--timeout-ms <ms>", "Transport timeout in milliseconds", parseNumber).option("--retry-attempts <n>", "Maximum delivery attempts", parseNumber).option("--retry-backoff-ms <ms>", "Initial retry backoff in milliseconds", parseNumber).option("--redact <path...>", "Event field path to redact before delivery", collectValues, []).option("--disabled", "Create channel disabled", false).option("-j, --json", "Print JSON output", false).action(async (target, actionOptions, command) => {
     const timestamp = new Date().toISOString();
     const channel = {
       id: actionOptions.id,
       name: actionOptions.name,
       enabled: !actionOptions.disabled,
       transport: actionOptions.transport,
-      filters: parseFilter(actionOptions),
+      filters: parseFilterOptions(actionOptions),
       retry: actionOptions.retryAttempts || actionOptions.retryBackoffMs ? { maxAttempts: actionOptions.retryAttempts, backoffMs: actionOptions.retryBackoffMs } : undefined,
       redact: actionOptions.redact?.length ? { paths: actionOptions.redact } : undefined,
       createdAt: timestamp,
@@ -15992,35 +16583,61 @@ function registerWebhookCommands(program, options) {
     const saved = await createClient(options).addChannel(channel);
     print(sanitizeChannelForOutput(saved), wantsJson(actionOptions, command), `Added ${saved.transport} channel ${saved.id}`);
   });
-  webhooks.command("list").description("List configured subscriptions").option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
-    const channels = await createClient(options).listChannels();
+  channels.command("list").description("List configured channels").option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+    const channels2 = await createClient(options).listChannels();
     if (wantsJson(actionOptions, command)) {
-      console.log(JSON.stringify(sanitizeChannelsForOutput(channels), null, 2));
+      console.log(JSON.stringify(sanitizeChannelsForOutput(channels2), null, 2));
       return;
     }
-    if (!channels.length) {
+    if (!channels2.length) {
       console.log("No channels configured.");
       return;
     }
-    for (const channel of channels) {
+    for (const channel of channels2) {
       console.log(`${channel.id}	${channel.enabled ? "enabled" : "disabled"}	${channel.transport}	${channel.webhook?.url ?? channel.command?.command ?? channel.transport}`);
     }
   });
-  webhooks.command("remove").description("Remove a subscription").argument("<id>", "Subscription/channel identifier").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
+  channels.command("status").description("Show events channel storage status").option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+    const status = await getEventsStatus(options.dataDir);
+    print(status, wantsJson(actionOptions, command), `events dataDir: ${status.dataDir}`);
+  });
+  channels.command("remove").description("Remove a channel").argument("<id>", "Channel identifier").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
     const removed = await createClient(options).removeChannel(id);
     print({ removed }, wantsJson(actionOptions, command), removed ? `Removed ${id}` : `Channel not found: ${id}`);
   });
-  webhooks.command("test").description("Send a test event to one subscription").argument("<id>", "Subscription/channel identifier").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events test delivery").option("--data <json>", "Event data JSON object").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
-    const result = await createClient(options).testChannel(id, {
-      source: options.source,
-      type: actionOptions.type,
-      subject: actionOptions.subject ?? id,
-      message: actionOptions.message,
-      data: parseJsonObject(actionOptions.data, { test: true })
-    });
-    print(result, wantsJson(actionOptions, command), `${result.status}: ${result.channelId}`);
+  channels.command("test").description("Send a test event to one channel").argument("<id>", "Channel identifier").option("--source <source>", "Event source override").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events test delivery").option("--data <json>", "Event data JSON object").option("--metadata <json>", "Event metadata JSON object").option("--honor-filters", "Skip delivery when the sample event does not match channel filters", false).option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
+    const json = wantsJson(actionOptions, command);
+    try {
+      const result = await createClient(options).testChannel(id, {
+        source: actionOptions.source ?? options.source,
+        type: actionOptions.type,
+        subject: actionOptions.subject ?? id,
+        message: actionOptions.message,
+        data: parseJsonObject(actionOptions.data, { test: true }),
+        metadata: parseJsonObject(actionOptions.metadata, {})
+      }, { honorFilters: actionOptions.honorFilters });
+      print(result, json, `${result.status}: ${result.channelId}`);
+    } catch (error) {
+      fail(error, json);
+    }
+  });
+  channels.command("match").description("Check whether a sample event matches one channel without delivering").argument("<id>", "Channel identifier").option("--source <source>", "Event source override").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events match preview").option("--data <json>", "Event data JSON object").option("--metadata <json>", "Event metadata JSON object").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
+    const json = wantsJson(actionOptions, command);
+    try {
+      const result = await createClient(options).matchChannel(id, {
+        source: actionOptions.source ?? options.source,
+        type: actionOptions.type,
+        subject: actionOptions.subject ?? id,
+        message: actionOptions.message,
+        data: parseJsonObject(actionOptions.data, { test: true }),
+        metadata: parseJsonObject(actionOptions.metadata, {})
+      });
+      print(result, json, `${result.matched ? "matched" : "skipped"}: ${result.channelId}`);
+    } catch (error) {
+      fail(error, json);
+    }
   });
-  return webhooks;
+  return channels;
 }
 function registerEventCommands(program, options) {
   const events = program.command(options.eventsCommandName ?? "events").description("Emit, list, and replay Hasna events");
@@ -16037,7 +16654,8 @@ function registerEventCommands(program, options) {
     }, { deliver: actionOptions.deliver, dedupe: actionOptions.dedupe });
     print(result, wantsJson(actionOptions, command), `${result.deduped ? "Deduped" : "Emitted"} ${result.event.id} to ${result.deliveries.length} channel(s)`);
   });
-  events.command("list").description("List recorded events").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--limit <n>", "Limit results", parseNumber).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+  const defaultListLimit = options.defaultEventListLimit ?? DEFAULT_EVENT_LIST_LIMIT;
+  events.command("list").description("List recorded events").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--limit <n>", `Limit to the most recent <n> events (default ${defaultListLimit}; use 0 for all)`, parseNumber, defaultListLimit).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
     let rows = await createClient(options).listEvents();
     if (actionOptions.source)
       rows = rows.filter((event) => event.source === actionOptions.source);
@@ -16056,19 +16674,21 @@ function registerEventCommands(program, options) {
     for (const event of rows)
       console.log(`${event.time}	${event.id}	${event.source}	${event.type}	${event.severity}`);
   });
-  events.command("replay").description("Replay recorded events").option("--id <id>", "Replay one event id").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--dry-run", "Preview without delivery", false).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+  events.command("replay").description("Replay recorded events").option("--id <id>", "Replay one event id").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--cursor <cursor>", "Opaque replay cursor from a previous page").option("--limit <n>", "Maximum events to replay", parseNumber).option("--dry-run", "Preview without delivery", false).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
     const result = await createClient(options).replay({
       eventId: actionOptions.id,
       source: actionOptions.source,
       type: actionOptions.type,
+      cursor: actionOptions.cursor,
+      limit: actionOptions.limit,
       dryRun: actionOptions.dryRun
     });
-    print(result, wantsJson(actionOptions, command), `Replayed ${result.events.length} event(s), ${result.deliveries.length} delivery result(s)`);
+    print(result, wantsJson(actionOptions, command), replaySummary(result.events.length, result.deliveries.length, result.nextCursor));
   });
   return events;
 }
 function registerEventsCommands(program, options) {
-  registerWebhookCommands(program, options);
+  registerChannelCommands(program, options);
   registerEventCommands(program, options);
 }
 function parseNumber(value) {
@@ -16081,8 +16701,12 @@ function collectValues(value, previous) {
   previous.push(value);
   return previous;
 }
+function replaySummary(events, deliveries, nextCursor) {
+  const suffix = nextCursor ? `, next cursor: ${nextCursor}` : "";
+  return `Replayed ${events} event(s), ${deliveries} delivery result(s)${suffix}`;
+}
 
-// node_modules/commander/esm.mjs
+// ../../node_modules/.bun/commander@13.1.0/node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
   program,
@@ -16101,9 +16725,9 @@ var {
 // src/cli/index.tsx
 init_apply();
 import chalk from "chalk";
-import { existsSync as existsSync16, lstatSync as lstatSync5, readFileSync as readFileSync13, readSync, writeSync } from "fs";
-import { homedir as homedir8 } from "os";
-import { basename as basename7, join as join16, resolve as resolve10 } from "path";
+import { existsSync as existsSync17, lstatSync as lstatSync7, readFileSync as readFileSync15, readSync, writeSync } from "fs";
+import { homedir as homedir10 } from "os";
+import { basename as basename7, join as join19, resolve as resolve13 } from "path";
 
 // src/lib/config-target-identity.ts
 init_apply();
@@ -16150,14 +16774,14 @@ init_redact();
 // src/lib/export.ts
 init_config_store();
 import { existsSync as existsSync10, mkdirSync as mkdirSync4, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join11, resolve as resolve6 } from "path";
+import { join as join13, resolve as resolve8 } from "path";
 import { tmpdir } from "os";
 async function exportConfigs(outputPath, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const configs = await store.listConfigs(opts.filter);
-  const absOutput = resolve6(outputPath);
-  const tmpDir = join11(tmpdir(), `configs-export-${Date.now()}`);
-  const contentsDir = join11(tmpDir, "contents");
+  const absOutput = resolve8(outputPath);
+  const tmpDir = join13(tmpdir(), `configs-export-${Date.now()}`);
+  const contentsDir = join13(tmpDir, "contents");
   try {
     mkdirSync4(contentsDir, { recursive: true });
     const manifest = {
@@ -16165,10 +16789,10 @@ async function exportConfigs(outputPath, opts = {}) {
       exported_at: new Date().toISOString(),
       configs: configs.map(({ content: _content, ...meta }) => meta)
     };
-    writeFileSync3(join11(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
+    writeFileSync3(join13(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
     for (const config of configs) {
       const fileName = `${config.slug}.${config.format === "text" ? "txt" : config.format}`;
-      writeFileSync3(join11(contentsDir, fileName), config.content, "utf-8");
+      writeFileSync3(join13(contentsDir, fileName), config.content, "utf-8");
     }
     const proc = Bun.spawn(["tar", "czf", absOutput, "-C", tmpDir, "."], {
       stdout: "pipe",
@@ -16189,14 +16813,14 @@ async function exportConfigs(outputPath, opts = {}) {
 
 // src/lib/import.ts
 init_config_store();
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync8, rmSync as rmSync4 } from "fs";
-import { join as join12, resolve as resolve7 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync9, rmSync as rmSync4 } from "fs";
+import { join as join14, resolve as resolve9 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 async function importConfigs(bundlePath, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const conflict = opts.conflict ?? "skip";
-  const absPath = resolve7(bundlePath);
-  const tmpDir = join12(tmpdir2(), `configs-import-${Date.now()}`);
+  const absPath = resolve9(bundlePath);
+  const tmpDir = join14(tmpdir2(), `configs-import-${Date.now()}`);
   const result = { created: 0, updated: 0, skipped: 0, errors: [] };
   try {
     mkdirSync5(tmpDir, { recursive: true });
@@ -16209,15 +16833,15 @@ async function importConfigs(bundlePath, opts = {}) {
       const stderr = await new Response(proc.stderr).text();
       throw new Error(`tar extraction failed: ${stderr}`);
     }
-    const manifestPath = join12(tmpDir, "manifest.json");
+    const manifestPath = join14(tmpDir, "manifest.json");
     if (!existsSync11(manifestPath))
       throw new Error("Invalid bundle: missing manifest.json");
-    const manifest = JSON.parse(readFileSync8(manifestPath, "utf-8"));
+    const manifest = JSON.parse(readFileSync9(manifestPath, "utf-8"));
     for (const meta of manifest.configs) {
       try {
         const ext = meta.format === "text" ? "txt" : meta.format;
-        const contentFile = join12(tmpDir, "contents", `${meta.slug}.${ext}`);
-        const content = existsSync11(contentFile) ? readFileSync8(contentFile, "utf-8") : "";
+        const contentFile = join14(tmpDir, "contents", `${meta.slug}.${ext}`);
+        const content = existsSync11(contentFile) ? readFileSync9(contentFile, "utf-8") : "";
         let existing = null;
         try {
           existing = await store.getConfig(meta.slug);
@@ -16265,16 +16889,17 @@ init_machine();
 init_project_context();
 init_session_render();
 init_cursor_authority();
-import { createHash as createHash7, randomUUID as randomUUID7 } from "crypto";
+init_session_authority();
+import { createHash as createHash8, randomUUID as randomUUID7 } from "crypto";
 import {
   existsSync as existsSync12,
-  lstatSync as lstatSync3,
+  lstatSync as lstatSync4,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync10,
   readdirSync as readdirSync3,
-  statSync as statSync5
+  statSync as statSync6
 } from "fs";
-import { dirname as dirname5, isAbsolute as isAbsolute4, join as join13, parse as parse4, relative as relative5, resolve as resolve8 } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute4, join as join15, parse as parse4, relative as relative5, resolve as resolve10 } from "path";
 
 class SessionApplyError extends Error {
   constructor(message) {
@@ -16295,6 +16920,7 @@ function applySessionRenderUnlocked(plan, options, coordination) {
   }
   assertCursorAuthorityUnchanged(plan);
   const targetHome = assertSafeTargetHome(plan.targetHome);
+  assertClaudeAuthorityStillClear(plan, targetHome);
   const payloadFiles = [...plan.files, ...plan.assetFiles ?? []];
   const files = [...payloadFiles, plan.manifestFile];
   const manifestPath = resolvePlannedFilePath(plan, plan.manifestFile, targetHome);
@@ -16395,6 +17021,15 @@ function assertCursorAuthorityUnchanged(plan) {
     throw new SessionApplyError("Cursor fixed global authority changed after planning; refusing to apply a stale render plan.");
   }
 }
+function assertClaudeAuthorityStillClear(plan, targetHome) {
+  if (plan.tool !== "claude" || plan.targetKind === "blocked")
+    return;
+  const conflicts = detectClaudeAuthorityConflicts(targetHome);
+  if (conflicts.length === 0)
+    return;
+  const summary = conflicts.map((conflict) => `${conflict.relativePath}: ${conflict.reason}`).join("; ");
+  throw new SessionApplyError(`Claude authority changed after planning; refusing to apply: ${summary}`);
+}
 function ensureSessionTargetHome(targetHome) {
   if (!existsSync12(targetHome))
     mkdirSync6(targetHome, { recursive: true, mode: 448 });
@@ -16402,7 +17037,7 @@ function ensureSessionTargetHome(targetHome) {
 }
 function checkSessionRenderDrift(targetHome, manifestPath) {
   const safeTargetHome = assertSafeTargetHome(targetHome);
-  const resolvedManifestPath = manifestPath ? resolveManifestRelativePath(relative5(safeTargetHome, resolve8(manifestPath)), safeTargetHome) : resolve8(safeTargetHome, ".hasna", "session-render-manifest.json");
+  const resolvedManifestPath = manifestPath ? resolveManifestRelativePath(relative5(safeTargetHome, resolve10(manifestPath)), safeTargetHome) : resolve10(safeTargetHome, ".hasna", "session-render-manifest.json");
   const checkedAt = new Date().toISOString();
   const previousManifest = readPreviousManifest(resolvedManifestPath);
   if (!previousManifest) {
@@ -16429,7 +17064,7 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
       });
       continue;
     }
-    const actualSha256 = sha2567(readFileSync9(target, "utf-8"));
+    const actualSha256 = sha2568(readFileSync10(target, "utf-8"));
     if (actualSha256 !== file.sha256) {
       drifted.push({
         path: target,
@@ -16452,7 +17087,7 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
 function restoreSessionRenderSnapshot(snapshotPath, options = {}) {
   const snapshot = readSessionRenderSnapshot(snapshotPath);
   const targetHome = assertSafeTargetHome(snapshot.targetHome);
-  const resolvedSnapshotPath = resolve8(snapshotPath);
+  const resolvedSnapshotPath = resolve10(snapshotPath);
   const snapshotRelativePath = relative5(targetHome, resolvedSnapshotPath);
   if (snapshotRelativePath === "" || snapshotRelativePath === ".." || snapshotRelativePath.startsWith("../") || isAbsolute4(snapshotRelativePath)) {
     throw new SessionApplyError("Session snapshot must be stored inside its target home.");
@@ -16570,19 +17205,19 @@ function requiredRestoreHash(file) {
   return file.previousSha256;
 }
 function readSessionRenderSnapshot(snapshotPath) {
-  const resolved = resolve8(snapshotPath);
+  const resolved = resolve10(snapshotPath);
   if (!existsSync12(resolved))
     throw new SessionApplyError(`Session snapshot not found: ${snapshotPath}`);
-  const stat = lstatSync3(resolved);
+  const stat = lstatSync4(resolved);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw new SessionApplyError(`Session snapshot is not a regular file: ${snapshotPath}`);
   }
-  if (statSync5(resolved).size > 32 * 1024 * 1024) {
+  if (statSync6(resolved).size > 32 * 1024 * 1024) {
     throw new SessionApplyError(`Session snapshot exceeds the 32 MiB restore limit: ${snapshotPath}`);
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync9(resolved, "utf8"));
+    parsed = JSON.parse(readFileSync10(resolved, "utf8"));
   } catch {
     throw new SessionApplyError(`Session snapshot is not valid JSON: ${snapshotPath}`);
   }
@@ -16604,7 +17239,7 @@ function readSessionRenderSnapshot(snapshotPath) {
   const previousManifest = snapshot.previousManifest;
   const previousFiles = new Map;
   for (const file of snapshot.files) {
-    if (!file || typeof file.relativePath !== "string" || typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.content !== "string" || sha2567(file.content) !== file.sha256) {
+    if (!file || typeof file.relativePath !== "string" || typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.content !== "string" || sha2568(file.content) !== file.sha256) {
       throw new SessionApplyError(`Session snapshot previous file metadata is invalid: ${snapshotPath}`);
     }
     resolveSnapshotFilePath(file.relativePath, file.path, targetHome);
@@ -16651,7 +17286,7 @@ function readSessionRenderSnapshot(snapshotPath) {
 }
 function reconstructPreRollbackLegacyV1Snapshot(snapshot, previousFiles, previousManifestFiles, targetHome, snapshotPath) {
   assertNoNewerSessionSnapshot(snapshotPath, snapshot.createdAt, targetHome);
-  const manifestPath = resolve8(snapshot.manifestPath);
+  const manifestPath = resolve10(snapshot.manifestPath);
   const manifestRelativePath = relative5(targetHome, manifestPath).replaceAll("\\", "/");
   resolveSnapshotFilePath(manifestRelativePath, snapshot.manifestPath, targetHome);
   const manifestSha256 = currentSessionFileHash(manifestPath, targetHome);
@@ -16660,7 +17295,7 @@ function reconstructPreRollbackLegacyV1Snapshot(snapshot, previousFiles, previou
   }
   let parsedManifest;
   try {
-    parsedManifest = JSON.parse(readFileSync9(manifestPath, "utf8"));
+    parsedManifest = JSON.parse(readFileSync10(manifestPath, "utf8"));
   } catch {
     throw new SessionApplyError(`Pre-rollback legacy v1 applied manifest is not valid JSON: ${snapshotPath}`);
   }
@@ -16668,7 +17303,7 @@ function reconstructPreRollbackLegacyV1Snapshot(snapshot, previousFiles, previou
     throw new SessionApplyError(`Pre-rollback legacy v1 applied manifest is invalid: ${snapshotPath}`);
   }
   const appliedManifest = parsedManifest;
-  if (appliedManifest.schema !== SESSION_RENDER_SCHEMA || appliedManifest.tool !== snapshot.tool || appliedManifest.profile !== snapshot.profile || typeof appliedManifest.targetHome !== "string" || resolve8(appliedManifest.targetHome) !== targetHome || appliedManifest.targetKind !== "session-home" && appliedManifest.targetKind !== "project-root" || !Array.isArray(appliedManifest.files)) {
+  if (appliedManifest.schema !== SESSION_RENDER_SCHEMA || appliedManifest.tool !== snapshot.tool || appliedManifest.profile !== snapshot.profile || typeof appliedManifest.targetHome !== "string" || resolve10(appliedManifest.targetHome) !== targetHome || appliedManifest.targetKind !== "session-home" && appliedManifest.targetKind !== "project-root" || !Array.isArray(appliedManifest.files)) {
     throw new SessionApplyError(`Pre-rollback legacy v1 applied manifest does not match its snapshot: ${snapshotPath}`);
   }
   const afterFiles = [];
@@ -16753,16 +17388,16 @@ function assertNoNewerSessionSnapshot(snapshotPath, createdAt, targetHome) {
     throw new SessionApplyError(`Pre-rollback legacy v1 snapshot has an invalid creation time: ${snapshotPath}`);
   }
   for (const entry of readdirSync3(dirname5(snapshotPath))) {
-    const candidatePath = resolve8(dirname5(snapshotPath), entry);
-    if (candidatePath === resolve8(snapshotPath) || !entry.endsWith(".json"))
+    const candidatePath = resolve10(dirname5(snapshotPath), entry);
+    if (candidatePath === resolve10(snapshotPath) || !entry.endsWith(".json"))
       continue;
-    const candidateStat = lstatSync3(candidatePath);
+    const candidateStat = lstatSync4(candidatePath);
     if (candidateStat.isSymbolicLink() || !candidateStat.isFile() || candidateStat.size > 32 * 1024 * 1024)
       continue;
     try {
-      const candidate = JSON.parse(readFileSync9(candidatePath, "utf8"));
+      const candidate = JSON.parse(readFileSync10(candidatePath, "utf8"));
       const candidateCreatedAtMs = typeof candidate.createdAt === "string" ? Date.parse(candidate.createdAt) : Number.NaN;
-      if ((candidate.schema === "hasna.configs.session-render-snapshot/v1" || candidate.schema === "hasna.configs.session-render-snapshot/v2") && typeof candidate.targetHome === "string" && resolve8(candidate.targetHome) === targetHome && Number.isFinite(candidateCreatedAtMs) && candidateCreatedAtMs >= createdAtMs) {
+      if ((candidate.schema === "hasna.configs.session-render-snapshot/v1" || candidate.schema === "hasna.configs.session-render-snapshot/v2") && typeof candidate.targetHome === "string" && resolve10(candidate.targetHome) === targetHome && Number.isFinite(candidateCreatedAtMs) && candidateCreatedAtMs >= createdAtMs) {
         throw new SessionApplyError(`Cannot restore pre-rollback legacy v1 snapshot after a newer session snapshot exists: ${candidatePath}`);
       }
     } catch (error) {
@@ -16820,7 +17455,7 @@ function inferLegacySnapshotAction(file, previousFiles, previousManifestFiles, p
     return "create";
   }
   if (file.role === "manifest" && previousManifest) {
-    const previousManifestSha256 = sha2567(`${JSON.stringify(previousManifest, null, 2)}
+    const previousManifestSha256 = sha2568(`${JSON.stringify(previousManifest, null, 2)}
 `);
     if (previousManifestSha256 !== file.sha256) {
       throw new SessionApplyError(`Cannot infer legacy v1 manifest action without a before-image: ${file.relativePath}`);
@@ -16831,15 +17466,15 @@ function inferLegacySnapshotAction(file, previousFiles, previousManifestFiles, p
 }
 function resolveSnapshotFilePath(relativePath, recordedPath, targetHome) {
   const path = resolveManifestRelativePath(relativePath, targetHome);
-  if (resolve8(recordedPath) !== path) {
+  if (resolve10(recordedPath) !== path) {
     throw new SessionApplyError(`Session snapshot file path mismatch for ${relativePath}`);
   }
   return path;
 }
 function planFileResult(plan, file, targetHome, previousHashes, previousManifest, options) {
   const target = resolvePlannedFilePath(plan, file, targetHome);
-  const previousContent = existsSync12(target) ? readFileSync9(target, "utf-8") : null;
-  const previousSha256 = previousContent === null ? null : sha2567(previousContent);
+  const previousContent = existsSync12(target) ? readFileSync10(target, "utf-8") : null;
+  const previousSha256 = previousContent === null ? null : sha2568(previousContent);
   const previouslyManaged = isPreviouslyManaged(file, previousSha256, previousHashes, previousManifest);
   const changed = previousContent !== file.content;
   if (previousContent !== null && !options.force && !previouslyManaged) {
@@ -16936,8 +17571,8 @@ function planStaleFileResult(file, targetHome, options) {
   const target = resolveManifestRelativePath(file.relativePath, targetHome);
   if (!existsSync12(target))
     return null;
-  const previousContent = readFileSync9(target, "utf-8");
-  const previousSha256 = sha2567(previousContent);
+  const previousContent = readFileSync10(target, "utf-8");
+  const previousSha256 = sha2568(previousContent);
   if (!options.force && previousSha256 !== file.sha256) {
     return {
       path: target,
@@ -16981,19 +17616,19 @@ function isPreviouslyManaged(file, previousSha256, previousHashes, previousManif
   return previousHashes.get(file.relativePath) === previousSha256;
 }
 function resolvePlannedFilePath(plan, file, targetHome) {
-  const target = resolve8(targetHome, ...file.relativePath.split("/"));
+  const target = resolve10(targetHome, ...file.relativePath.split("/"));
   const rel = relative5(targetHome, target);
   if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute4(rel)) {
     throw new SessionApplyError(`Session file escapes target home: ${file.relativePath}`);
   }
-  if (resolve8(file.path) !== target) {
+  if (resolve10(file.path) !== target) {
     throw new SessionApplyError(`Session file path mismatch for ${file.relativePath}: ${file.path}`);
   }
   assertNoSymlinkSegments2(targetHome, target);
   return target;
 }
 function resolveManifestRelativePath(relativePath, targetHome) {
-  const target = resolve8(targetHome, ...relativePath.split(/[\\/]+/));
+  const target = resolve10(targetHome, ...relativePath.split(/[\\/]+/));
   const rel = relative5(targetHome, target);
   if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute4(rel)) {
     throw new SessionApplyError(`Session manifest file escapes target home: ${relativePath}`);
@@ -17005,7 +17640,7 @@ function readPreviousManifest(path) {
   if (!existsSync12(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync9(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync10(path, "utf-8"));
     if (parsed.schema !== SESSION_RENDER_SCHEMA)
       return null;
     if (!Array.isArray(parsed.files))
@@ -17046,11 +17681,11 @@ function currentSessionFileHash(path, targetHome) {
   assertNoSymlinkSegments2(targetHome, path);
   if (!existsSync12(path))
     return null;
-  const stat = lstatSync3(path);
+  const stat = lstatSync4(path);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw new SessionApplyError(`Session apply path is not a regular file: ${path}`);
   }
-  return sha2567(readFileSync9(path, "utf-8"));
+  return sha2568(readFileSync10(path, "utf-8"));
 }
 function requiredPreviousHash(result) {
   if (result.previousSha256 === null) {
@@ -17060,12 +17695,12 @@ function requiredPreviousHash(result) {
 }
 function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousManifest, coordination, allowPortableFallback, forcePortableFileOps) {
   const existingFiles = results.filter((result) => result.action === "update" || result.action === "delete").filter((result) => existsSync12(result.path)).map((result) => {
-    const content = readFileSync9(result.path, "utf-8");
+    const content = readFileSync10(result.path, "utf-8");
     return {
       path: result.path,
       relativePath: result.relativePath,
       role: result.role,
-      sha256: sha2567(content),
+      sha256: sha2568(content),
       content
     };
   });
@@ -17078,7 +17713,7 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
     };
   }
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
-  const snapshotPath = resolve8(targetHome, ".hasna", "session-render-snapshots", `${timestamp}-${randomUUID7()}.json`);
+  const snapshotPath = resolve10(targetHome, ".hasna", "session-render-snapshots", `${timestamp}-${randomUUID7()}.json`);
   const afterFiles = results.map((result) => {
     if (result.action === "conflict") {
       throw new SessionApplyError(`Cannot snapshot unresolved conflict: ${result.relativePath}`);
@@ -17126,12 +17761,12 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
 function assertSafeTargetHome(targetHome) {
   if (!isAbsolute4(targetHome))
     throw new SessionApplyError(`Session target home must be absolute: ${targetHome}`);
-  const normalized = resolve8(targetHome);
+  const normalized = resolve10(targetHome);
   if (normalized === parse4(normalized).root) {
     throw new SessionApplyError(`Session target home cannot be the filesystem root: ${targetHome}`);
   }
   assertNoSymlinkAncestors2(normalized);
-  if (existsSync12(normalized) && lstatSync3(normalized).isSymbolicLink()) {
+  if (existsSync12(normalized) && lstatSync4(normalized).isSymbolicLink()) {
     throw new SessionApplyError(`Session target home cannot be a symlink: ${normalized}`);
   }
   return normalized;
@@ -17141,32 +17776,33 @@ function assertNoSymlinkSegments2(root, target) {
   const rel = relative5(root, target);
   let current = root;
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join13(current, segment);
-    if (existsSync12(current) && lstatSync3(current).isSymbolicLink()) {
+    current = join15(current, segment);
+    if (existsSync12(current) && lstatSync4(current).isSymbolicLink()) {
       throw new SessionApplyError(`Session apply path uses a symlink: ${current}`);
     }
   }
 }
 function assertNoSymlinkAncestors2(path) {
-  const normalized = resolve8(path);
+  const normalized = resolve10(path);
   const parsed = parse4(normalized);
   let current = parsed.root;
   const rel = relative5(parsed.root, normalized);
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join13(current, segment);
+    current = join15(current, segment);
     if (!existsSync12(current))
       return;
-    if (lstatSync3(current).isSymbolicLink()) {
+    if (lstatSync4(current).isSymbolicLink()) {
       throw new SessionApplyError(`Session apply path uses a symlink ancestor: ${current}`);
     }
   }
 }
-function sha2567(content) {
-  return createHash7("sha256").update(content).digest("hex");
+function sha2568(content) {
+  return createHash8("sha256").update(content).digest("hex");
 }
 
 // src/cli/index.tsx
 init_session_render();
+init_raw_store_root();
 init_asset_plan();
 init_instruction_graph();
 
@@ -17513,34 +18149,433 @@ async function ensureDangerousOperationGuardStandardConfig(store = resolveConfig
 
 // src/cli/index.tsx
 init_codewith_shared_todos_storage_standard();
+
+// src/lib/managed-skill-runtimes.ts
+import { createHash as createHash9 } from "crypto";
+import { spawnSync } from "child_process";
+import {
+  existsSync as existsSync13,
+  lstatSync as lstatSync5,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync11,
+  renameSync as renameSync2,
+  rmSync as rmSync5,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname6, join as join16, parse as parse5, relative as relative6, resolve as resolve11 } from "path";
+var INBOX_CONVERSATIONS_MINIMUM_VERSION = "0.5.28";
+var INBOX_SKILL_MARKERS = [
+  [".claude", "skills", "inbox", "SKILL.md"],
+  [".codex", "skills", "inbox", "SKILL.md"],
+  [".codewith", "skills", "inbox", "SKILL.md"],
+  [".config", "opencode", "skills", "inbox", "SKILL.md"],
+  [".cursor", "skills", "inbox", "SKILL.md"]
+];
+var REQUIRED_WATCH_FLAGS = ["--from <agent>", "--all", "--full-content"];
+function sha2569(content) {
+  return createHash9("sha256").update(content).digest("hex");
+}
+function lstatOrNull(path) {
+  try {
+    return lstatSync5(path);
+  } catch {
+    return null;
+  }
+}
+function findSymlinkedAncestor(path) {
+  const normalized = resolve11(path);
+  const parsed = parse5(normalized);
+  let current = parsed.root;
+  const rel = relative6(parsed.root, normalized);
+  for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
+    current = join16(current, segment);
+    if (!existsSync13(current))
+      return null;
+    if (lstatSync5(current).isSymbolicLink())
+      return current;
+  }
+  return null;
+}
+function assertNoSymlinkAncestors3(path) {
+  const found = findSymlinkedAncestor(path);
+  if (found !== null) {
+    throw new Error(`managed skill path uses a symlink ancestor: ${found}`);
+  }
+}
+function packagedInboxSkillPath(explicitPath) {
+  if (explicitPath)
+    return explicitPath;
+  const candidates = [
+    join16(import.meta.dir, "..", "..", "assets", "skills", "inbox", "SKILL.md"),
+    join16(import.meta.dir, "..", "assets", "skills", "inbox", "SKILL.md"),
+    join16(process.cwd(), "assets", "skills", "inbox", "SKILL.md")
+  ];
+  const found = candidates.find((candidate) => existsSync13(candidate));
+  if (!found) {
+    throw new Error(`packaged inbox skill contract is missing (checked ${candidates.length} package-relative locations)`);
+  }
+  return found;
+}
+function readCanonicalSkill(explicitPath) {
+  const assetPath = packagedInboxSkillPath(explicitPath);
+  const stat = lstatOrNull(assetPath);
+  if (!stat?.isFile()) {
+    throw new Error("packaged inbox skill contract is not a regular file");
+  }
+  const content = readFileSync11(assetPath, "utf8");
+  if (!content.includes("conversations watch --from <agent> --all")) {
+    throw new Error("packaged inbox skill contract does not declare the canonical conversations watcher");
+  }
+  if (!content.includes("There is no separate")) {
+    throw new Error("packaged inbox skill contract does not retire the legacy executable");
+  }
+  return { content, sha256: sha2569(content) };
+}
+function runProbe(command, args) {
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    timeout: 5000,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.error || result.status !== 0) {
+    return { ok: false, output: "" };
+  }
+  return {
+    ok: true,
+    output: `${result.stdout ?? ""}
+${result.stderr ?? ""}`.trim()
+  };
+}
+function parseVersion(output) {
+  return output.match(/\b(\d+\.\d+\.\d+)\b/)?.[1] ?? null;
+}
+function compareVersions(left, right) {
+  const a = left.split(".").map(Number);
+  const b = right.split(".").map(Number);
+  for (let i = 0;i < Math.max(a.length, b.length); i++) {
+    const delta = (a[i] ?? 0) - (b[i] ?? 0);
+    if (delta !== 0)
+      return delta;
+  }
+  return 0;
+}
+function inspectSkillMarkers(homeDir2) {
+  return INBOX_SKILL_MARKERS.map((parts) => join16(homeDir2, ...parts)).map((path) => {
+    const stat = lstatOrNull(path);
+    if (!stat)
+      return null;
+    if (!stat.isFile()) {
+      return { path, content: null, mode: null, regular: false };
+    }
+    return {
+      path,
+      content: readFileSync11(path, "utf8"),
+      mode: stat.mode & 511,
+      regular: true
+    };
+  }).filter((snapshot) => snapshot !== null);
+}
+function inspectInbox(options) {
+  const homeDir2 = options.homeDir ?? homedir8();
+  const runtimeCommand = options.conversationsCommand ?? "conversations";
+  const snapshots = inspectSkillMarkers(homeDir2);
+  const skillPresent = snapshots.length > 0;
+  let canonicalContent = null;
+  let canonicalSha256 = null;
+  let assetError = null;
+  try {
+    const canonical = readCanonicalSkill(options.assetPath);
+    canonicalContent = canonical.content;
+    canonicalSha256 = canonical.sha256;
+  } catch (error) {
+    assetError = error instanceof Error ? error.message : String(error);
+  }
+  const versionProbe = skillPresent ? runProbe(runtimeCommand, ["--version"]) : { ok: false, output: "" };
+  const helpProbe = versionProbe.ok ? runProbe(runtimeCommand, ["watch", "--help"]) : { ok: false, output: "" };
+  const runtimeVersion = versionProbe.ok ? parseVersion(versionProbe.output) : null;
+  const supportsFrom = helpProbe.ok && helpProbe.output.includes(REQUIRED_WATCH_FLAGS[0]);
+  const supportsAll = helpProbe.ok && helpProbe.output.includes(REQUIRED_WATCH_FLAGS[1]);
+  const supportsFullContent = helpProbe.ok && helpProbe.output.includes(REQUIRED_WATCH_FLAGS[2]);
+  const packageReady = versionProbe.ok && runtimeVersion !== null && compareVersions(runtimeVersion, INBOX_CONVERSATIONS_MINIMUM_VERSION) >= 0 && helpProbe.ok && supportsFrom && supportsAll && supportsFullContent;
+  const heartbeatProbe = skillPresent && packageReady && options.agent ? runProbe(runtimeCommand, ["agents", "heartbeat", "--from", options.agent, "--json"]) : null;
+  const hostedHeartbeat = heartbeatProbe === null ? "unverified" : heartbeatProbe.ok ? "passed" : "failed";
+  const deliveryVerified = hostedHeartbeat === "passed" && options.deliveryVerified === true;
+  const staleMarkers = canonicalContent === null ? snapshots.map((snapshot) => snapshot.path) : snapshots.filter((snapshot) => !snapshot.regular || snapshot.content !== canonicalContent).map((snapshot) => snapshot.path);
+  let reason = "skill not installed";
+  if (skillPresent) {
+    const nonRegular = snapshots.some((snapshot) => !snapshot.regular);
+    const symlinkAncestor = snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname6(path))).find((found) => found !== null);
+    if (nonRegular)
+      reason = "managed skill target is not a regular file";
+    else if (symlinkAncestor)
+      reason = `managed skill path uses a symlink ancestor: ${symlinkAncestor}`;
+    else if (assetError)
+      reason = assetError;
+    else if (!versionProbe.ok)
+      reason = "conversations command unavailable";
+    else if (!runtimeVersion)
+      reason = "conversations version is unreadable";
+    else if (compareVersions(runtimeVersion, INBOX_CONVERSATIONS_MINIMUM_VERSION) < 0) {
+      reason = `conversations ${runtimeVersion} is older than ${INBOX_CONVERSATIONS_MINIMUM_VERSION}`;
+    } else if (!helpProbe.ok)
+      reason = "conversations watch help is unavailable";
+    else if (!supportsFrom || !supportsAll || !supportsFullContent) {
+      const missing = [
+        !supportsFrom ? "--from" : null,
+        !supportsAll ? "--all" : null,
+        !supportsFullContent ? "--full-content" : null
+      ].filter((flag) => flag !== null);
+      reason = `conversations watch is missing required flags: ${missing.join(", ")}`;
+    } else if (staleMarkers.length > 0)
+      reason = "skill contract stale";
+    else if (hostedHeartbeat === "failed")
+      reason = "hosted heartbeat failed; manual fallback required";
+    else if (hostedHeartbeat === "unverified")
+      reason = "hosted heartbeat unverified; manual fallback required";
+    else if (!deliveryVerified)
+      reason = "hosted heartbeat passed; channel and DM delivery verification required";
+    else
+      reason = "ready";
+  }
+  return {
+    status: {
+      skill: "inbox",
+      runtime: "conversations watch",
+      minimum_version: INBOX_CONVERSATIONS_MINIMUM_VERSION,
+      skill_present: skillPresent,
+      skill_markers: snapshots.map((snapshot) => snapshot.path),
+      skill_contracts_current: snapshots.length - staleMarkers.length,
+      stale_skill_markers: staleMarkers,
+      expected_skill_sha256: canonicalSha256,
+      runtime_command: runtimeCommand,
+      runtime_present: versionProbe.ok,
+      runtime_version: runtimeVersion,
+      watch_supports_from: supportsFrom,
+      watch_supports_all: supportsAll,
+      watch_supports_full_content: supportsFullContent,
+      hosted_heartbeat: hostedHeartbeat,
+      delivery_verified: deliveryVerified,
+      manual_fallback_ready: skillPresent && staleMarkers.length === 0 && packageReady,
+      healthy: !skillPresent || reason === "ready",
+      reason
+    },
+    canonicalContent,
+    snapshots
+  };
+}
+function inspectManagedSkillRuntimes(options = {}) {
+  const runtime = inspectInbox(options).status;
+  const installed = runtime.skill_present ? [runtime] : [];
+  return {
+    runtimes: [runtime],
+    skills_present: installed.length,
+    healthy: installed.filter((item) => item.healthy).length,
+    missing: installed.filter((item) => !item.healthy).length
+  };
+}
+function runtimeReadyForWrite(status) {
+  return status.runtime_present && status.runtime_version !== null && compareVersions(status.runtime_version, INBOX_CONVERSATIONS_MINIMUM_VERSION) >= 0 && status.watch_supports_from && status.watch_supports_all && status.watch_supports_full_content;
+}
+function projectUpdatedStatus(status, contractCount) {
+  const healthy = status.hosted_heartbeat === "passed" && status.delivery_verified;
+  return {
+    ...status,
+    skill_contracts_current: contractCount,
+    stale_skill_markers: [],
+    manual_fallback_ready: true,
+    healthy,
+    reason: healthy ? "ready" : status.hosted_heartbeat === "failed" ? "hosted heartbeat failed; manual fallback required" : status.hosted_heartbeat === "unverified" ? "hosted heartbeat unverified; manual fallback required" : "hosted heartbeat passed; channel and DM delivery verification required"
+  };
+}
+function cleanup(path) {
+  rmSync5(path, { force: true });
+}
+function writeAtomic(path, content, mode) {
+  assertNoSymlinkAncestors3(dirname6(path));
+  const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  try {
+    mkdirSync7(dirname6(path), { recursive: true, mode: 493 });
+    writeFileSync4(tempPath, content, { mode, flag: "wx" });
+    renameSync2(tempPath, path);
+  } finally {
+    cleanup(tempPath);
+  }
+}
+var DEFAULT_SKILL_WRITE_FILE_OPERATIONS = {
+  lstat: lstatOrNull,
+  read: (path) => readFileSync11(path, "utf8"),
+  write: writeAtomic
+};
+function writeSkillContractsTransactional(snapshots, canonicalContent, fileOperations = DEFAULT_SKILL_WRITE_FILE_OPERATIONS) {
+  const written = [];
+  try {
+    for (const snapshot of snapshots) {
+      const currentStat = fileOperations.lstat(snapshot.path);
+      if (!currentStat?.isFile() || fileOperations.read(snapshot.path) !== snapshot.content) {
+        throw new Error("managed skill changed after inspection; refusing a stale write");
+      }
+      fileOperations.write(snapshot.path, canonicalContent, snapshot.mode);
+      written.push(snapshot);
+    }
+    return { ok: true, error: null, rollback_conflicts: [] };
+  } catch (error) {
+    const rollbackConflicts = [];
+    for (const snapshot of written.reverse()) {
+      const currentStat = fileOperations.lstat(snapshot.path);
+      if (!currentStat?.isFile()) {
+        rollbackConflicts.push(`${snapshot.path}: no longer a regular file`);
+        continue;
+      }
+      let currentContent;
+      try {
+        currentContent = fileOperations.read(snapshot.path);
+      } catch {
+        rollbackConflicts.push(`${snapshot.path}: could not read the current file`);
+        continue;
+      }
+      if (currentContent !== canonicalContent) {
+        rollbackConflicts.push(`${snapshot.path}: changed after this reconciliation wrote it`);
+        continue;
+      }
+      try {
+        fileOperations.write(snapshot.path, snapshot.content, snapshot.mode);
+      } catch {
+        rollbackConflicts.push(`${snapshot.path}: still owned but could not be restored`);
+      }
+    }
+    return {
+      ok: false,
+      error: error instanceof Error ? error.message : String(error),
+      rollback_conflicts: rollbackConflicts
+    };
+  }
+}
+async function reconcileManagedSkillRuntimes(options = {}) {
+  const dryRun = options.dryRun ?? false;
+  const before = inspectInbox(options);
+  const status = before.status;
+  if (!status.skill_present) {
+    return {
+      runtimes: [{ ...status, action: "skipped", dry_run: dryRun, skill_contracts_changed: 0 }],
+      changed: 0,
+      failed: 0,
+      dry_run: dryRun
+    };
+  }
+  if (before.snapshots.some((snapshot) => !snapshot.regular)) {
+    return {
+      runtimes: [{ ...status, action: "failed", dry_run: dryRun, skill_contracts_changed: 0 }],
+      changed: 0,
+      failed: 1,
+      dry_run: dryRun
+    };
+  }
+  const symlinkedAncestor = before.snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname6(path))).find((found) => found !== null);
+  if (symlinkedAncestor) {
+    return {
+      runtimes: [{ ...status, action: "failed", dry_run: dryRun, skill_contracts_changed: 0 }],
+      changed: 0,
+      failed: 1,
+      dry_run: dryRun
+    };
+  }
+  if (!before.canonicalContent || !runtimeReadyForWrite(status)) {
+    return {
+      runtimes: [{ ...status, action: "failed", dry_run: dryRun, skill_contracts_changed: 0 }],
+      changed: 0,
+      failed: 1,
+      dry_run: dryRun
+    };
+  }
+  const staleSnapshots = before.snapshots.filter((snapshot) => snapshot.content !== before.canonicalContent);
+  if (staleSnapshots.length === 0) {
+    return {
+      runtimes: [{ ...status, action: "unchanged", dry_run: dryRun, skill_contracts_changed: 0 }],
+      changed: 0,
+      failed: 0,
+      dry_run: dryRun
+    };
+  }
+  if (dryRun) {
+    const projected = projectUpdatedStatus(status, before.snapshots.length);
+    return {
+      runtimes: [{
+        ...projected,
+        action: "update",
+        dry_run: true,
+        skill_contracts_changed: staleSnapshots.length
+      }],
+      changed: 1,
+      failed: 0,
+      dry_run: true
+    };
+  }
+  const transaction = writeSkillContractsTransactional(staleSnapshots.map((snapshot) => ({
+    path: snapshot.path,
+    content: snapshot.content,
+    mode: snapshot.mode ?? 420
+  })), before.canonicalContent);
+  if (!transaction.ok) {
+    const rollbackConflictReason = transaction.rollback_conflicts.length > 0 ? `; rollback conflicts: ${transaction.rollback_conflicts.join("; ")}` : "";
+    const reason = `${transaction.error ?? "managed skill reconciliation failed"}${rollbackConflictReason}`;
+    return {
+      runtimes: [{
+        ...status,
+        action: "failed",
+        dry_run: false,
+        skill_contracts_changed: 0,
+        reason
+      }],
+      changed: 0,
+      failed: 1,
+      dry_run: false
+    };
+  }
+  const after = inspectInbox(options).status;
+  const accepted = after.healthy || after.manual_fallback_ready;
+  return {
+    runtimes: [{
+      ...after,
+      action: accepted ? "update" : "failed",
+      dry_run: false,
+      skill_contracts_changed: accepted ? staleSnapshots.length : 0
+    }],
+    changed: accepted ? 1 : 0,
+    failed: accepted ? 0 : 1,
+    dry_run: false
+  };
+}
+
+// src/cli/index.tsx
 init_project_context();
 
 // src/status.ts
 init_config_store();
 init_apply();
 init_config_agents();
-import { existsSync as existsSync14, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
 
 // src/lib/package-version.ts
-import { existsSync as existsSync13, readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname6, join as join14 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync12 } from "fs";
+import { dirname as dirname7, join as join17 } from "path";
 import { fileURLToPath } from "url";
 var cached = null;
 function getPackageVersion() {
   if (cached)
     return cached;
   try {
-    let dir = dirname6(fileURLToPath(import.meta.url));
+    let dir = dirname7(fileURLToPath(import.meta.url));
     for (let i = 0;i < 8; i++) {
-      const pkgPath = join14(dir, "package.json");
-      if (existsSync13(pkgPath)) {
-        const pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
+      const pkgPath = join17(dir, "package.json");
+      if (existsSync14(pkgPath)) {
+        const pkg = JSON.parse(readFileSync12(pkgPath, "utf8"));
         if (pkg.name === "@hasna/instructions" && pkg.version) {
           cached = pkg.version;
           return cached;
         }
       }
-      const parent = dirname6(dir);
+      const parent = dirname7(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -17573,7 +18608,7 @@ function countBy(items, getValue) {
   }
   return counts;
 }
-async function getConfigsStatus(store = resolveConfigStore()) {
+async function getConfigsStatus(store = resolveConfigStore(), options = {}) {
   let databaseReachable = true;
   let configs = [];
   let categoryStats = { total: 0 };
@@ -17597,11 +18632,11 @@ async function getConfigsStatus(store = resolveConfigStore()) {
       continue;
     knownTargets += 1;
     const targetPath = expandPath(config.target_path);
-    if (!existsSync14(targetPath)) {
+    if (!existsSync15(targetPath)) {
       missingTargets += 1;
       continue;
     }
-    const disk = readFileSync11(targetPath, "utf-8");
+    const disk = readFileSync13(targetPath, "utf-8");
     const { content: redactedDisk } = redactContent(disk, config.format);
     if (redactedDisk !== config.content) {
       driftedTargets += 1;
@@ -17627,7 +18662,11 @@ async function getConfigsStatus(store = resolveConfigStore()) {
     }
   }
   const byCategory = Object.fromEntries(Object.entries(categoryStats).filter(([key]) => key !== "total"));
-  const status = databaseReachable && driftedTargets === 0 && missingTargets === 0 && unredactedSecretFindings === 0 && retiredAgentRows === 0 ? "ok" : "warn";
+  const managedSkillRuntimes = inspectManagedSkillRuntimes({
+    homeDir: options.homeDir,
+    conversationsCommand: options.conversationsCommand
+  });
+  const status = databaseReachable && driftedTargets === 0 && missingTargets === 0 && unredactedSecretFindings === 0 && retiredAgentRows === 0 && managedSkillRuntimes.missing === 0 ? "ok" : "warn";
   return {
     service: "configs",
     schemaVersion: "1.0",
@@ -17657,7 +18696,12 @@ async function getConfigsStatus(store = resolveConfigStore()) {
       profileLinks,
       machines,
       snapshots,
-      knownTargets
+      knownTargets,
+      managedSkillRuntimes: {
+        skillsPresent: managedSkillRuntimes.skills_present,
+        healthy: managedSkillRuntimes.healthy,
+        missing: managedSkillRuntimes.missing
+      }
     },
     health: {
       status,
@@ -17666,10 +18710,12 @@ async function getConfigsStatus(store = resolveConfigStore()) {
       missingTargets,
       unredactedSecretFindings,
       retiredAgentRows,
+      missingManagedSkillRuntimes: managedSkillRuntimes.missing,
       hasDrift: driftedTargets > 0,
       hasMissingTargets: missingTargets > 0,
       hasUnredactedSecrets: unredactedSecretFindings > 0,
-      hasRetiredAgentRows: retiredAgentRows > 0
+      hasRetiredAgentRows: retiredAgentRows > 0,
+      hasMissingManagedSkillRuntimes: managedSkillRuntimes.missing > 0
     },
     safety: {
       includesConfigValues: false,
@@ -17711,6 +18757,17 @@ function printLine(text = "") {
 function printJson(value) {
   printLine(JSON.stringify(value, null, 2));
 }
+function printManagedSkillRuntimeReport(report) {
+  for (const runtime of report.runtimes) {
+    if (!runtime.skill_present)
+      continue;
+    const prefix = runtime.action === "failed" ? chalk.red("[failed]") : runtime.dry_run ? chalk.yellow("[dry-run]") : runtime.manual_fallback_ready && !runtime.healthy ? chalk.yellow("[degraded]") : runtime.action === "unchanged" ? chalk.dim("=") : chalk.green("\u2713");
+    console.log(`${prefix} ${runtime.skill} via ${runtime.runtime} \u2014 ${runtime.reason}`);
+    if (runtime.action === "update") {
+      console.log(chalk.dim(`  skill contracts: ${runtime.skill_contracts_changed}`));
+    }
+  }
+}
 function fmtConfig(c, format) {
   if (format === "json")
     return JSON.stringify(c, null, 2);
@@ -17777,7 +18834,7 @@ function parseSessionSource(value, order) {
   if (!path)
     throw new Error(`Invalid --source "${value}" (expected path or id=path)`);
   const absPath = resolveSessionPath(path);
-  if (!existsSync16(absPath))
+  if (!existsSync17(absPath))
     throw new Error(`Instruction source file not found: ${absPath}`);
   const content = readSessionInstructionSourceFile(absPath);
   const source = sourceFromFilePath(absPath, content, order);
@@ -17821,7 +18878,7 @@ function sessionSourceReplacements(values) {
   return replacements;
 }
 function readSessionInstructionSourceFile(path) {
-  const stat = lstatSync5(path);
+  const stat = lstatSync7(path);
   if (stat.isSymbolicLink()) {
     throw new Error("SESSION_SOURCE_SYMLINK_REJECTED: instruction source file must be a regular non-symlink file");
   }
@@ -17831,7 +18888,7 @@ function readSessionInstructionSourceFile(path) {
   if (stat.size > SESSION_MANAGED_INPUT_MAX_BYTES) {
     throw new Error(`SESSION_SOURCE_INPUT_TOO_LARGE: instruction source file exceeds ${SESSION_MANAGED_INPUT_MAX_BYTES} bytes`);
   }
-  return readFileSync13(path, "utf-8");
+  return readFileSync15(path, "utf-8");
 }
 function parseLayeredReference(value) {
   const trimmed = value.trim();
@@ -17858,9 +18915,9 @@ async function collectSessionSources(opts, tool, store) {
   }
   for (const value of opts.identityExport ?? []) {
     const path = resolveSessionPath(value);
-    if (!existsSync16(path))
+    if (!existsSync17(path))
       throw new Error(`Identity instruction export not found: ${path}`);
-    const parsed = JSON.parse(readFileSync13(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync15(path, "utf-8"));
     sources.push(...sourcesFromIdentityExport(parsed, { path, tool, orderOffset: sources.length }));
   }
   return sources.map((source) => {
@@ -17981,19 +19038,19 @@ function readProjectContextBundleOption(value, allowMissing = false) {
   if (value === "-")
     return { json: readBoundedProjectContextStdin() };
   const path = resolveSessionPath(value);
-  if (!existsSync16(path)) {
+  if (!existsSync17(path)) {
     if (allowMissing)
       return {};
     throw new ProjectContextError("PROJECT_CONTEXT_INPUT_MISSING", `bundle file not found: ${path}`);
   }
-  const stat = lstatSync5(path);
+  const stat = lstatSync7(path);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw new ProjectContextError("PROJECT_CONTEXT_SYMLINK_REJECTED", "bundle input must be a regular non-symlink file");
   }
   if (stat.size > PROJECT_CONTEXT_MAX_INPUT_BYTES) {
     throw new ProjectContextError("PROJECT_CONTEXT_INPUT_TOO_LARGE", `bundle exceeds ${PROJECT_CONTEXT_MAX_INPUT_BYTES} bytes`);
   }
-  return { json: readFileSync13(path, "utf8"), sourcePath: path };
+  return { json: readFileSync15(path, "utf8"), sourcePath: path };
 }
 function readBoundedProjectContextStdin() {
   const chunks = [];
@@ -18152,15 +19209,15 @@ program.command("tag <id>").description("Add or remove tags on a stored config (
   console.log(chalk.green("\u2713") + ` Tags on ${chalk.bold(updated.name)} ${chalk.dim(`(${updated.slug})`)}: ${nextTags.join(", ") || chalk.dim("(none)")}`);
 });
 program.command("add <path>").description("Ingest a file into the config DB").option("-n, --name <name>", "config name (defaults to filename)").option("-c, --category <cat>", "category override").option("-a, --agent <agent>", "agent override").option("-k, --kind <kind>", "kind: file|reference", "file").option("--template", "mark as template (has {{VAR}} placeholders)").option("--update", "if a config already owns this path, update that row in place instead of refusing").action(async (filePath, opts) => {
-  const abs = resolve10(filePath);
-  if (!existsSync16(abs)) {
+  const abs = resolve13(filePath);
+  if (!existsSync17(abs)) {
     console.error(chalk.red(`File not found: ${abs}`));
     process.exit(1);
   }
-  const rawContent = readFileSync13(abs, "utf-8");
+  const rawContent = readFileSync15(abs, "utf-8");
   const fmt = detectFormat(abs);
   const { content, redacted, isTemplate: isTemplate2 } = redactContent(rawContent, fmt);
-  const targetPath = abs.startsWith(homedir8()) ? abs.replace(homedir8(), "~") : abs;
+  const targetPath = abs.startsWith(homedir10()) ? abs.replace(homedir10(), "~") : abs;
   const name = opts.name || filePath.split("/").pop();
   const store = resolveConfigStore();
   const allConfigs = await store.listConfigs();
@@ -18335,7 +19392,7 @@ program.command("sync").description("Sync known AI coding configs from disk into
       for (const entry of entries) {
         if (!entry.isDirectory())
           continue;
-        const projDir = join16(absDir, entry.name);
+        const projDir = join19(absDir, entry.name);
         const hasAgentConfig = [
           "CLAUDE.md",
           ".mcp.json",
@@ -18348,7 +19405,7 @@ program.command("sync").description("Sync known AI coding configs from disk into
           ".aicopilot",
           ".cursor",
           ".agents"
-        ].some((marker) => existsSync16(join16(projDir, marker)));
+        ].some((marker) => existsSync17(join19(projDir, marker)));
         if (!hasAgentConfig)
           continue;
         const result2 = await syncProject({ projectDir: projDir, dryRun: opts.dryRun, store });
@@ -18399,10 +19456,10 @@ program.command("import <file>").description("Import configs from a tar.gz bundl
 });
 program.command("whoami").description("Show setup summary").action(async () => {
   const store = resolveConfigStore();
-  const dbPath = isCloudMode() ? `${process.env["HASNA_INSTRUCTIONS_API_URL"]}/v1 (self_hosted)` : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join16(homedir8(), ".hasna", "instructions", "instructions.db");
+  const dbPath = isApiTransport() ? `${process.env["HASNA_INSTRUCTIONS_API_URL"]}/v1` : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join19(getRawStoreRoot(), "instructions.db");
   const stats = await store.getConfigStats();
   console.log(chalk.bold("@hasna/instructions") + chalk.dim(" v" + pkg.version));
-  console.log(chalk.cyan(isCloudMode() ? "API:" : "DB:") + " " + dbPath);
+  console.log(chalk.cyan(isApiTransport() ? "API:" : "DB:") + " " + dbPath);
   console.log(chalk.cyan("Total configs:") + " " + (stats["total"] || 0));
   console.log();
   console.log(chalk.bold("By category:"));
@@ -18622,7 +19679,7 @@ profileCmd.command("binding <profile> <config>").description("Set a config's sch
     process.exit(1);
   }
 });
-profileCmd.command("apply [id]").description("Apply all configs in a profile to disk").option("--dry-run", "preview without writing").option("--auto", "resolve the matching profile for the current machine").option("--hostname <hostname>", "override detected hostname for auto resolution").option("--os <os>", "override detected OS for auto resolution").option("--arch <arch>", "override detected arch for auto resolution").action(async (id, opts) => {
+profileCmd.command("apply [id]").description("Apply all configs in a profile to disk").option("--dry-run", "preview without writing").option("--from <agent>", "verify the hosted Conversations heartbeat for this agent").option("--delivery-verified", "assert channel and direct-message canaries were observed in this acceptance pass").option("--auto", "resolve the matching profile for the current machine").option("--hostname <hostname>", "override detected hostname for auto resolution").option("--os <os>", "override detected OS for auto resolution").option("--arch <arch>", "override detected arch for auto resolution").action(async (id, opts) => {
   try {
     const store = resolveConfigStore();
     const { machine, profile } = await getMachineProfileContext(opts, store);
@@ -18659,6 +19716,14 @@ profileCmd.command("apply [id]").description("Apply all configs in a profile to
     }
     if (report.failures.length > 0)
       process.exitCode = 1;
+    const runtimeReport = await reconcileManagedSkillRuntimes({
+      dryRun: opts.dryRun,
+      agent: opts.from,
+      deliveryVerified: opts.deliveryVerified
+    });
+    printManagedSkillRuntimeReport(runtimeReport);
+    if (runtimeReport.failed > 0)
+      process.exitCode = 1;
     console.log(chalk.dim(`
 ${changed}/${results.length} changed (${selected.slug} on ${machine.hostname} ${machine.os_family}/${machine.arch})`));
   } catch (e) {
@@ -19146,14 +20211,14 @@ mcpCmd.command("install").alias("add").description("Install configs MCP server i
       } else if (target === "codex") {
         const { appendFileSync, existsSync: ex } = await import("fs");
         const { join: j } = await import("path");
-        const configPath = j(homedir8(), ".codex", "config.toml");
+        const configPath = j(homedir10(), ".codex", "config.toml");
         const block = `
 [mcp_servers.configs]
 command = "${mcpBinary}"
 args = []
 `;
         if (ex(configPath)) {
-          const content = readFileSync13(configPath, "utf-8");
+          const content = readFileSync15(configPath, "utf-8");
           if (content.includes("[mcp_servers.configs]")) {
             console.log(chalk.dim("= Already installed in Codex"));
             continue;
@@ -19164,7 +20229,7 @@ args = []
       } else if (target === "antigravity") {
         const { mkdirSync: md, readFileSync: rf, writeFileSync: wf, existsSync: ex } = await import("fs");
         const { dirname: dn, join: j } = await import("path");
-        const configPath = j(homedir8(), ".gemini", "config", "mcp_config.json");
+        const configPath = j(homedir10(), ".gemini", "config", "mcp_config.json");
         let settings = {};
         if (ex(configPath)) {
           try {
@@ -19248,9 +20313,9 @@ DB stats:`));
     if (count > 0)
       console.log(`  ${key.padEnd(18)} ${count}`);
   }
-  const location = isCloudMode() ? `${process.env["HASNA_INSTRUCTIONS_API_URL"]}/v1 (self_hosted)` : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join16(homedir8(), ".hasna", "instructions", "instructions.db");
+  const location = isApiTransport() ? `${process.env["HASNA_INSTRUCTIONS_API_URL"]}/v1` : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join19(getRawStoreRoot(), "instructions.db");
   console.log(chalk.dim(`
-${isCloudMode() ? "API" : "DB"}: ${location}`));
+${isApiTransport() ? "API" : "DB"}: ${location}`));
 });
 program.command("status").description("Health check: total configs, drift from disk, unredacted secrets").option("--json", "output metadata-only JSON").action(async (opts) => {
   const status = await getConfigsStatus(resolveConfigStore());
@@ -19266,14 +20331,53 @@ program.command("status").description("Health check: total configs, drift from d
   console.log(chalk.cyan("Missing:") + ` ${status.health.missingTargets === 0 ? chalk.green("0") : chalk.yellow(String(status.health.missingTargets))} (file not on disk)`);
   console.log(chalk.cyan("Secrets:") + ` ${status.health.unredactedSecretFindings === 0 ? chalk.green("0 \u2713") : chalk.red(String(status.health.unredactedSecretFindings) + " \u26A0")} unredacted`);
   console.log(chalk.cyan("Retired agents:") + ` ${status.health.retiredAgentRows === 0 ? chalk.green("0") : chalk.yellow(String(status.health.retiredAgentRows))} row(s)`);
+  console.log(chalk.cyan("Skill runtimes:") + ` ${status.health.missingManagedSkillRuntimes === 0 ? chalk.green(`${status.counts.managedSkillRuntimes.healthy} ready`) : chalk.yellow(`${status.health.missingManagedSkillRuntimes} missing`)} (${status.counts.managedSkillRuntimes.skillsPresent} managed skill(s) present)`);
   console.log(chalk.cyan("Templates:") + ` ${status.counts.configs.templates} (with {{VAR}} placeholders)`);
 });
+var managedSkillsCmd = program.command("managed-skills").description("Inspect or reconcile package-owned runtime contracts for installed managed skills");
+managedSkillsCmd.command("status").option("--from <agent>", "verify the hosted Conversations heartbeat for this agent").option("--delivery-verified", "assert channel and direct-message canaries were observed in this acceptance pass").option("--json", "output the full local runtime status as JSON").action((opts) => {
+  const report = inspectManagedSkillRuntimes({
+    agent: opts.from,
+    deliveryVerified: opts.deliveryVerified
+  });
+  if (opts.json) {
+    printJson(report);
+    if (report.missing > 0)
+      process.exitCode = 1;
+    return;
+  }
+  if (report.skills_present === 0) {
+    console.log(chalk.dim("No managed skills with package-owned runtime contracts are installed."));
+    return;
+  }
+  for (const runtime of report.runtimes) {
+    if (!runtime.skill_present)
+      continue;
+    const prefix = runtime.healthy ? chalk.green("\u2713") : chalk.yellow("!");
+    console.log(`${prefix} ${runtime.skill} via ${runtime.runtime} \u2014 ${runtime.reason}`);
+  }
+  if (report.missing > 0)
+    process.exitCode = 1;
+});
+managedSkillsCmd.command("apply").option("--dry-run", "preview without writing").option("--from <agent>", "verify the hosted Conversations heartbeat for this agent").option("--delivery-verified", "assert channel and direct-message canaries were observed in this acceptance pass").option("--json", "output the reconcile report as JSON").action(async (opts) => {
+  const report = await reconcileManagedSkillRuntimes({
+    dryRun: opts.dryRun,
+    agent: opts.from,
+    deliveryVerified: opts.deliveryVerified
+  });
+  if (opts.json)
+    printJson(report);
+  else
+    printManagedSkillRuntimeReport(report);
+  if (report.failed > 0)
+    process.exitCode = 1;
+});
 program.command("backup").description("Export configs to a timestamped backup file").action(async () => {
   const { mkdirSync: mk } = await import("fs");
-  const backupDir = join16(homedir8(), ".hasna", "instructions", "backups");
+  const backupDir = join19(getRawStoreRoot(), "backups");
   mk(backupDir, { recursive: true });
   const ts = new Date().toISOString().replace(/[:.]/g, "-").replace("T", "-").slice(0, 19);
-  const outPath = join16(backupDir, `configs-${ts}.tar.gz`);
+  const outPath = join19(backupDir, `configs-${ts}.tar.gz`);
   const result = await exportConfigs(outPath, { store: resolveConfigStore() });
   const { statSync: st } = await import("fs");
   const size = st(outPath).size;
@@ -19291,7 +20395,7 @@ program.command("doctor").description("Validate configs: syntax, permissions, mi
   const store = resolveConfigStore();
   let issues = 0;
   const pass = (msg) => console.log(chalk.green("  \u2713 ") + msg);
-  const fail = (msg) => {
+  const fail2 = (msg) => {
     issues++;
     console.log(chalk.red("  \u2717 ") + msg);
   };
@@ -19301,9 +20405,9 @@ program.command("doctor").description("Validate configs: syntax, permissions, mi
   console.log(chalk.cyan("Known files on disk:"));
   for (const k of KNOWN_CONFIGS) {
     if (k.rulesDir) {
-      existsSync16(expandPath(k.rulesDir)) ? pass(`${k.rulesDir}/ exists`) : k.optional ? skip(`${k.rulesDir}/ (optional)`) : fail(`${k.rulesDir}/ not found`);
+      existsSync17(expandPath(k.rulesDir)) ? pass(`${k.rulesDir}/ exists`) : k.optional ? skip(`${k.rulesDir}/ (optional)`) : fail2(`${k.rulesDir}/ not found`);
     } else {
-      existsSync16(expandPath(k.path)) ? pass(k.path) : k.optional ? skip(`${k.path} (optional)`) : fail(`${k.path} not found`);
+      existsSync17(expandPath(k.path)) ? pass(k.path) : k.optional ? skip(`${k.path} (optional)`) : fail2(`${k.path} not found`);
     }
   }
   const allConfigs = await store.listConfigs();
@@ -19316,7 +20420,7 @@ Stored configs (${allConfigs.length}):`));
         JSON.parse(c.content);
         validCount++;
       } catch {
-        fail(`${c.slug}: invalid JSON`);
+        fail2(`${c.slug}: invalid JSON`);
       }
     } else {
       validCount++;
@@ -19328,13 +20432,13 @@ Stored configs (${allConfigs.length}):`));
     const found = scanSecrets(c.content, c.format);
     secretCount += found.length;
   }
-  secretCount === 0 ? pass("No unredacted secrets") : fail(`${secretCount} unredacted secret(s) \u2014 run \`configs scan --fix\``);
+  secretCount === 0 ? pass("No unredacted secrets") : fail2(`${secretCount} unredacted secret(s) \u2014 run \`configs scan --fix\``);
   const duplicateTargets = findDuplicateTargetPathGroups(allConfigs);
   if (duplicateTargets.length === 0) {
     pass("No target path is claimed by more than one config");
   } else {
     const rowCount = duplicateTargets.reduce((total, group) => total + group.configs.length, 0);
-    fail(`${duplicateTargets.length} target path(s) claimed by more than one config (${rowCount} rows) \u2014 apply order between them is undefined`);
+    fail2(`${duplicateTargets.length} target path(s) claimed by more than one config (${rowCount} rows) \u2014 apply order between them is undefined`);
     for (const group of duplicateTargets) {
       console.log(chalk.yellow(`      ${group.target_path}`));
       for (const c of group.configs) {
@@ -19348,7 +20452,7 @@ Stored configs (${allConfigs.length}):`));
     pass("No reference config name is claimed by more than one row");
   } else {
     const rowCount = duplicateReferenceNames.reduce((total, group) => total + group.configs.length, 0);
-    fail(`${duplicateReferenceNames.length} reference name(s) claimed by more than one row (${rowCount} rows) \u2014 only one is live in the next render`);
+    fail2(`${duplicateReferenceNames.length} reference name(s) claimed by more than one row (${rowCount} rows) \u2014 only one is live in the next render`);
     for (const group of duplicateReferenceNames) {
       console.log(chalk.yellow(`      ${group.name}`));
       for (const c of group.configs) {
@@ -19456,16 +20560,16 @@ program.command("watch").description("Watch known config files for changes and a
   for (const k of KNOWN_CONFIGS) {
     if (k.rulesDir) {
       const absDir = expandPath2(k.rulesDir);
-      if (!existsSync16(absDir))
+      if (!existsSync17(absDir))
         continue;
       const { readdirSync: readdirSync5 } = await import("fs");
       for (const f of readdirSync5(absDir).filter((f2) => f2.endsWith(".md"))) {
-        const abs = join16(absDir, f);
+        const abs = join19(absDir, f);
         mtimes.set(abs, st(abs).mtimeMs);
       }
     } else {
       const abs = expandPath2(k.path);
-      if (existsSync16(abs))
+      if (existsSync17(abs))
         mtimes.set(abs, st(abs).mtimeMs);
     }
   }
@@ -19473,7 +20577,7 @@ program.command("watch").description("Watch known config files for changes and a
   const tick = async () => {
     let changed = 0;
     for (const [abs, oldMtime] of mtimes) {
-      if (!existsSync16(abs))
+      if (!existsSync17(abs))
         continue;
       const newMtime = st(abs).mtimeMs;
       if (newMtime !== oldMtime) {
@@ -19485,10 +20589,10 @@ program.command("watch").description("Watch known config files for changes and a
     for (const k of KNOWN_CONFIGS) {
       if (k.rulesDir) {
         const absDir = expandPath2(k.rulesDir);
-        if (!existsSync16(absDir))
+        if (!existsSync17(absDir))
           continue;
         for (const f of rd(absDir).filter((f2) => f2.endsWith(".md"))) {
-          const abs = join16(absDir, f);
+          const abs = join19(absDir, f);
           if (!mtimes.has(abs)) {
             mtimes.set(abs, st(abs).mtimeMs);
             changed++;
@@ -19496,7 +20600,7 @@ program.command("watch").description("Watch known config files for changes and a
         }
       } else {
         const abs = expandPath2(k.path);
-        if (existsSync16(abs) && !mtimes.has(abs)) {
+        if (existsSync17(abs) && !mtimes.has(abs)) {
           mtimes.set(abs, st(abs).mtimeMs);
           changed++;
         }
@@ -19524,11 +20628,11 @@ program.command("report").description("Summary of stored configs, drift, and eco
     if (!c.target_path)
       continue;
     const abs = expandPath(c.target_path);
-    if (!existsSync16(abs)) {
+    if (!existsSync17(abs)) {
       missing++;
       continue;
     }
-    const disk = readFileSync13(abs, "utf-8");
+    const disk = readFileSync15(abs, "utf-8");
     const { content: redactedDisk } = redactContent(disk, c.format);
     if (redactedDisk !== c.content)
       drifted++;
@@ -19595,7 +20699,7 @@ program.command("clean").description("Remove configs from DB whose target files
     if (!c.target_path)
       continue;
     const abs = expandPath(c.target_path);
-    if (!existsSync16(abs)) {
+    if (!existsSync17(abs)) {
       if (printed < maxPrinted) {
         if (opts.dryRun) {
           console.log(chalk.yellow("  would remove:") + ` ${c.slug} ${chalk.dim(`(${truncateMiddle(c.target_path, 88)})`)}`);
@@ -19619,7 +20723,7 @@ ${removed} orphaned config(s) ${opts.dryRun ? "found" : "removed"}${omitted > 0
       console.log(chalk.dim(`Use --limit ${removed} to print every orphan row.`));
   }
 });
-program.command("bootstrap").description("Install the full @hasna ecosystem: CLI tools + MCP servers + configs").option("--dry-run", "show what would be installed without doing it").option("--skip-mcp", "skip MCP server registration").action(async (opts) => {
+program.command("bootstrap").description("Install the full @hasna ecosystem: CLI tools + MCP servers + configs").option("--dry-run", "show what would be installed without doing it").option("--from <agent>", "verify the hosted Conversations heartbeat for this agent").option("--delivery-verified", "assert channel and direct-message canaries were observed in this acceptance pass").option("--skip-mcp", "skip MCP server registration").action(async (opts) => {
   const store = resolveConfigStore();
   const packages = [
     { name: "@hasna/todos", bin: "todos", mcp: "todos-mcp" },
@@ -19682,8 +20786,22 @@ Initializing configs:`));
   } else {
     console.log(chalk.dim("  would run: configs init"));
   }
+  console.log(chalk.cyan(`
+Reconciling managed skill runtimes:`));
+  const runtimeReport = await reconcileManagedSkillRuntimes({
+    dryRun: opts.dryRun,
+    agent: opts.from,
+    deliveryVerified: opts.deliveryVerified
+  });
+  printManagedSkillRuntimeReport(runtimeReport);
+  if (runtimeReport.failed > 0) {
+    console.error(chalk.red(`
+Bootstrap incomplete: a managed skill runtime could not be reconciled.`));
+    process.exitCode = 1;
+    return;
+  }
   console.log(chalk.bold(`
-\u2713 Bootstrap complete.`) + chalk.dim(" Restart Claude Code for MCP servers to activate."));
+\u2713 Bootstrap complete.`) + chalk.dim(" Restart agent sessions to load updated integrations."));
 });
 program.command("pull").description("Alias for sync (read from disk into DB)").option("-a, --agent <agent>", "only sync this agent").option("--dry-run", "preview without writing").action(async (opts) => {
   const result = await syncKnown({ dryRun: opts.dryRun, agent: opts.agent, store: resolveConfigStore() });