@hasna/machines 0.0.1 → 0.0.3

package/dist/mcp/index.js

@@ -16,9 +16,9 @@ var __export = (target, all) => {
 };
 
 // src/mcp/index.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { dirname as dirname4, join as join7 } from "path";
-import { fileURLToPath } from "url";
+import { readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname5, join as join9 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // src/mcp/server.ts
@@ -4197,1240 +4197,769 @@ function detectCurrentMachineManifest() {
   };
 }
 
-// src/commands/apps.ts
-function getPackageName(app) {
-  return app.packageName || app.name;
+// src/remote.ts
+import { spawnSync as spawnSync2 } from "child_process";
+
+// src/db.ts
+import { hostname as hostname2 } from "os";
+
+// node_modules/@hasna/cloud/dist/index.js
+import { createRequire } from "module";
+import { Database } from "bun:sqlite";
+import {
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  readdirSync,
+  copyFileSync
+} from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3, relative } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync22, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir22 } from "os";
+import { join as join22 } from "path";
+import { readdirSync as readdirSync2, existsSync as existsSync32 } from "fs";
+import { join as join32 } from "path";
+import { homedir as homedir32 } from "os";
+import { homedir as homedir4 } from "os";
+import { join as join4 } from "path";
+import { join as join6, dirname as dirname3 } from "path";
+import { homedir as homedir5, platform as platform2 } from "os";
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp2 = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
 }
-function buildAppCommand(machine, app) {
-  const packageName = getPackageName(app);
-  if (app.manager === "custom") {
-    return packageName;
-  }
-  if (machine.platform === "macos") {
-    if (app.manager === "cask") {
-      return `brew install --cask ${packageName}`;
-    }
-    return `brew install ${packageName}`;
-  }
-  if (machine.platform === "windows") {
-    return `winget install ${packageName}`;
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
   }
-  return `sudo apt-get install -y ${packageName}`;
-}
-function buildAppSteps(machine) {
-  return (machine.apps || []).map((app) => ({
-    id: `app-${app.name}`,
-    title: `Install ${app.name} on ${machine.id}`,
-    command: buildAppCommand(machine, app),
-    manager: app.manager === "custom" ? "custom" : machine.platform === "macos" ? "brew" : machine.platform === "windows" ? "custom" : "apt",
-    privileged: machine.platform === "linux"
-  }));
-}
-function resolveMachine(machineId) {
-  return (machineId ? getManifestMachine(machineId) : null) || detectCurrentMachineManifest();
-}
-function listApps(machineId) {
-  const machine = resolveMachine(machineId);
-  return {
-    machineId: machine.id,
-    apps: machine.apps || []
-  };
-}
-function buildAppsPlan(machineId) {
-  const machine = resolveMachine(machineId);
-  return {
-    machineId: machine.id,
-    mode: "plan",
-    steps: buildAppSteps(machine),
-    executed: 0
-  };
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp2(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp2(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue2 = (v) => v;
+function __exportSetter2(name, newValue) {
+  this[name] = __returnValue2.bind(null, newValue);
 }
-function runAppsInstall(machineId, options = {}) {
-  const plan = buildAppsPlan(machineId);
-  if (!options.apply)
-    return plan;
-  if (!options.yes) {
-    throw new Error("App installation requires --yes.");
-  }
-  let executed = 0;
-  for (const step of plan.steps) {
-    const result = Bun.spawnSync(["bash", "-lc", step.command], {
-      stdout: "pipe",
-      stderr: "pipe",
-      env: process.env
+var __export2 = (target, all) => {
+  for (var name in all)
+    __defProp2(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter2.bind(all, name)
     });
-    if (result.exitCode !== 0) {
-      throw new Error(`App install failed (${step.id}): ${result.stderr.toString().trim()}`);
-    }
-    executed += 1;
-  }
-  return {
-    machineId: plan.machineId,
-    mode: "apply",
-    steps: plan.steps,
-    executed
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+var require_postgres_array = __commonJS((exports) => {
+  exports.parse = function(source, transform) {
+    return new ArrayParser(source, transform).parse();
   };
-}
 
-// src/commands/cert.ts
-import { homedir as homedir3, platform as platform2 } from "os";
-import { join as join3 } from "path";
-function quote2(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function certDir() {
-  return join3(homedir3(), ".hasna", "machines", "certs");
-}
-function buildCertPlan(domains) {
-  if (domains.length === 0) {
-    throw new Error("At least one domain is required.");
+  class ArrayParser {
+    constructor(source, transform) {
+      this.source = source;
+      this.transform = transform || identity;
+      this.position = 0;
+      this.entries = [];
+      this.recorded = [];
+      this.dimension = 0;
+    }
+    isEof() {
+      return this.position >= this.source.length;
+    }
+    nextCharacter() {
+      var character = this.source[this.position++];
+      if (character === "\\") {
+        return {
+          value: this.source[this.position++],
+          escaped: true
+        };
+      }
+      return {
+        value: character,
+        escaped: false
+      };
+    }
+    record(character) {
+      this.recorded.push(character);
+    }
+    newEntry(includeEmpty) {
+      var entry;
+      if (this.recorded.length > 0 || includeEmpty) {
+        entry = this.recorded.join("");
+        if (entry === "NULL" && !includeEmpty) {
+          entry = null;
+        }
+        if (entry !== null)
+          entry = this.transform(entry);
+        this.entries.push(entry);
+        this.recorded = [];
+      }
+    }
+    consumeDimensions() {
+      if (this.source[0] === "[") {
+        while (!this.isEof()) {
+          var char = this.nextCharacter();
+          if (char.value === "=")
+            break;
+        }
+      }
+    }
+    parse(nested) {
+      var character, parser, quote2;
+      this.consumeDimensions();
+      while (!this.isEof()) {
+        character = this.nextCharacter();
+        if (character.value === "{" && !quote2) {
+          this.dimension++;
+          if (this.dimension > 1) {
+            parser = new ArrayParser(this.source.substr(this.position - 1), this.transform);
+            this.entries.push(parser.parse(true));
+            this.position += parser.position - 2;
+          }
+        } else if (character.value === "}" && !quote2) {
+          this.dimension--;
+          if (!this.dimension) {
+            this.newEntry();
+            if (nested)
+              return this.entries;
+          }
+        } else if (character.value === '"' && !character.escaped) {
+          if (quote2)
+            this.newEntry(true);
+          quote2 = !quote2;
+        } else if (character.value === "," && !quote2) {
+          this.newEntry();
+        } else {
+          this.record(character.value);
+        }
+      }
+      if (this.dimension !== 0) {
+        throw new Error("array dimension not balanced");
+      }
+      return this.entries;
+    }
   }
-  const primary = domains[0];
-  const certPath = join3(certDir(), `${primary}.pem`);
-  const keyPath = join3(certDir(), `${primary}-key.pem`);
-  const steps = [];
-  if (platform2() === "darwin") {
-    steps.push({
-      id: "mkcert-install-macos",
-      title: "Install mkcert on macOS",
-      command: "brew install mkcert nss",
-      manager: "brew"
-    });
-  } else {
-    steps.push({
-      id: "mkcert-install-linux",
-      title: "Install mkcert on Linux",
-      command: "sudo apt-get update && sudo apt-get install -y mkcert libnss3-tools",
-      manager: "apt",
-      privileged: true
-    });
+  function identity(value) {
+    return value;
   }
-  steps.push({
-    id: "mkcert-local-ca",
-    title: "Install local mkcert CA",
-    command: "mkcert -install",
-    manager: "custom"
-  }, {
-    id: "mkcert-issue",
-    title: `Issue certificate for ${domains.join(", ")}`,
-    command: `mkdir -p ${quote2(certDir())} && mkcert -cert-file ${quote2(certPath)} -key-file ${quote2(keyPath)} ${domains.map((domain) => quote2(domain)).join(" ")}`,
-    manager: "custom"
-  });
-  return {
-    machineId: process.env["HASNA_MACHINES_MACHINE_ID"] || "local",
-    mode: "plan",
-    steps,
-    executed: 0
-  };
-}
-function runCertPlan(domains, options = {}) {
-  const plan = buildCertPlan(domains);
-  if (!options.apply)
-    return plan;
-  if (!options.yes) {
-    throw new Error("Certificate generation requires --yes.");
+});
+var require_arrayParser = __commonJS((exports, module) => {
+  var array = require_postgres_array();
+  module.exports = {
+    create: function(source, transform) {
+      return {
+        parse: function() {
+          return array.parse(source, transform);
+        }
+      };
+    }
+  };
+});
+var require_postgres_date = __commonJS((exports, module) => {
+  var DATE_TIME = /(\d{1,})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})(\.\d{1,})?.*?( BC)?$/;
+  var DATE = /^(\d{1,})-(\d{2})-(\d{2})( BC)?$/;
+  var TIME_ZONE = /([Z+-])(\d{2})?:?(\d{2})?:?(\d{2})?/;
+  var INFINITY = /^-?infinity$/;
+  module.exports = function parseDate(isoDate) {
+    if (INFINITY.test(isoDate)) {
+      return Number(isoDate.replace("i", "I"));
+    }
+    var matches = DATE_TIME.exec(isoDate);
+    if (!matches) {
+      return getDate(isoDate) || null;
+    }
+    var isBC = !!matches[8];
+    var year = parseInt(matches[1], 10);
+    if (isBC) {
+      year = bcYearToNegativeYear(year);
+    }
+    var month = parseInt(matches[2], 10) - 1;
+    var day = matches[3];
+    var hour = parseInt(matches[4], 10);
+    var minute = parseInt(matches[5], 10);
+    var second = parseInt(matches[6], 10);
+    var ms = matches[7];
+    ms = ms ? 1000 * parseFloat(ms) : 0;
+    var date;
+    var offset = timeZoneOffset(isoDate);
+    if (offset != null) {
+      date = new Date(Date.UTC(year, month, day, hour, minute, second, ms));
+      if (is0To99(year)) {
+        date.setUTCFullYear(year);
+      }
+      if (offset !== 0) {
+        date.setTime(date.getTime() - offset);
+      }
+    } else {
+      date = new Date(year, month, day, hour, minute, second, ms);
+      if (is0To99(year)) {
+        date.setFullYear(year);
+      }
+    }
+    return date;
+  };
+  function getDate(isoDate) {
+    var matches = DATE.exec(isoDate);
+    if (!matches) {
+      return;
+    }
+    var year = parseInt(matches[1], 10);
+    var isBC = !!matches[4];
+    if (isBC) {
+      year = bcYearToNegativeYear(year);
+    }
+    var month = parseInt(matches[2], 10) - 1;
+    var day = matches[3];
+    var date = new Date(year, month, day);
+    if (is0To99(year)) {
+      date.setFullYear(year);
+    }
+    return date;
   }
-  let executed = 0;
-  for (const step of plan.steps) {
-    const result = Bun.spawnSync(["bash", "-lc", step.command], {
-      stdout: "pipe",
-      stderr: "pipe",
-      env: process.env
-    });
-    if (result.exitCode !== 0) {
-      throw new Error(`Certificate step failed (${step.id}): ${result.stderr.toString().trim()}`);
+  function timeZoneOffset(isoDate) {
+    if (isoDate.endsWith("+00")) {
+      return 0;
     }
-    executed += 1;
+    var zone = TIME_ZONE.exec(isoDate.split(" ")[1]);
+    if (!zone)
+      return;
+    var type = zone[1];
+    if (type === "Z") {
+      return 0;
+    }
+    var sign = type === "-" ? -1 : 1;
+    var offset = parseInt(zone[2], 10) * 3600 + parseInt(zone[3] || 0, 10) * 60 + parseInt(zone[4] || 0, 10);
+    return offset * sign * 1000;
   }
-  return {
-    machineId: plan.machineId,
-    mode: "apply",
-    steps: plan.steps,
-    executed
-  };
-}
-
-// src/commands/dns.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join4 } from "path";
-function getDnsPath() {
-  return join4(getDataDir(), "dns.json");
-}
-function readMappings() {
-  const path = getDnsPath();
-  if (!existsSync3(path))
-    return [];
-  return JSON.parse(readFileSync2(path, "utf8"));
-}
-function writeMappings(mappings) {
-  const path = getDnsPath();
-  ensureParentDir(path);
-  writeFileSync2(path, `${JSON.stringify(mappings, null, 2)}
-`, "utf8");
-  return path;
-}
-function addDomainMapping(domain, port, targetHost = "127.0.0.1") {
-  const mappings = readMappings().filter((entry) => entry.domain !== domain);
-  mappings.push({ domain, port, targetHost });
-  writeMappings(mappings);
-  return mappings.sort((left, right) => left.domain.localeCompare(right.domain));
-}
-function listDomainMappings() {
-  return readMappings().sort((left, right) => left.domain.localeCompare(right.domain));
-}
-function renderDomainMapping(domain) {
-  const entry = readMappings().find((mapping) => mapping.domain === domain);
-  if (!entry) {
-    throw new Error(`Domain mapping not found: ${domain}`);
+  function bcYearToNegativeYear(year) {
+    return -(year - 1);
   }
-  return {
-    hostsEntry: `${entry.targetHost} ${entry.domain}`,
-    caddySnippet: `${entry.domain} {
-  reverse_proxy 127.0.0.1:${entry.port}
-  tls ${join4(getDataDir(), "certs", `${entry.domain}.pem`)} ${join4(getDataDir(), "certs", `${entry.domain}-key.pem`)}
-}`,
-    certPath: join4(getDataDir(), "certs", `${entry.domain}.pem`),
-    keyPath: join4(getDataDir(), "certs", `${entry.domain}-key.pem`)
-  };
-}
-
-// src/commands/diff.ts
-function packageNames(machine) {
-  return (machine.packages || []).map((pkg) => pkg.name).sort();
-}
-function fileTargets(machine) {
-  return (machine.files || []).map((file) => `${file.source}->${file.target}`).sort();
-}
-function diffMachines(leftMachineId, rightMachineId) {
-  const left = getManifestMachine(leftMachineId);
-  if (!left) {
-    throw new Error(`Machine not found in manifest: ${leftMachineId}`);
+  function is0To99(num) {
+    return num >= 0 && num < 100;
   }
-  const right = rightMachineId ? getManifestMachine(rightMachineId) : detectCurrentMachineManifest();
-  if (!right) {
-    throw new Error(`Machine not found in manifest: ${rightMachineId}`);
+});
+var require_mutable = __commonJS((exports, module) => {
+  module.exports = extend;
+  var hasOwnProperty = Object.prototype.hasOwnProperty;
+  function extend(target) {
+    for (var i = 1;i < arguments.length; i++) {
+      var source = arguments[i];
+      for (var key in source) {
+        if (hasOwnProperty.call(source, key)) {
+          target[key] = source[key];
+        }
+      }
+    }
+    return target;
   }
-  const changedFields = [
-    left.platform !== right.platform ? "platform" : null,
-    left.connection !== right.connection ? "connection" : null,
-    left.workspacePath !== right.workspacePath ? "workspacePath" : null,
-    left.bunPath !== right.bunPath ? "bunPath" : null
-  ].filter(Boolean);
-  const leftPackages = new Set(packageNames(left));
-  const rightPackages = new Set(packageNames(right));
-  const leftFiles = new Set(fileTargets(left));
-  const rightFiles = new Set(fileTargets(right));
-  return {
-    leftMachineId: left.id,
-    rightMachineId: right.id,
-    changedFields,
-    missingPackages: {
-      leftOnly: [...leftPackages].filter((pkg) => !rightPackages.has(pkg)),
-      rightOnly: [...rightPackages].filter((pkg) => !leftPackages.has(pkg))
-    },
-    missingFiles: {
-      leftOnly: [...leftFiles].filter((file) => !rightFiles.has(file)),
-      rightOnly: [...rightFiles].filter((file) => !leftFiles.has(file))
+});
+var require_postgres_interval = __commonJS((exports, module) => {
+  var extend = require_mutable();
+  module.exports = PostgresInterval;
+  function PostgresInterval(raw) {
+    if (!(this instanceof PostgresInterval)) {
+      return new PostgresInterval(raw);
     }
-  };
-}
-
-// src/commands/install-claude.ts
-var AI_CLI_PACKAGES = {
-  claude: "@anthropic-ai/claude-code",
-  codex: "@openai/codex",
-  gemini: "@google/gemini-cli"
-};
-function normalizeTools(tools) {
-  if (!tools || tools.length === 0) {
-    return ["claude", "codex", "gemini"];
+    extend(this, parse(raw));
   }
-  return [...new Set(tools)].map((tool) => {
-    if (!(tool in AI_CLI_PACKAGES)) {
-      throw new Error(`Unsupported AI CLI tool: ${tool}`);
+  var properties = ["seconds", "minutes", "hours", "days", "months", "years"];
+  PostgresInterval.prototype.toPostgres = function() {
+    var filtered = properties.filter(this.hasOwnProperty, this);
+    if (this.milliseconds && filtered.indexOf("seconds") < 0) {
+      filtered.push("seconds");
     }
-    return tool;
-  });
-}
-function buildInstallSteps(machine, tools) {
-  return normalizeTools(tools).map((tool) => ({
-    id: `install-${tool}`,
-    title: `Install or update ${tool} CLI on ${machine.id}`,
-    command: `bun install -g ${AI_CLI_PACKAGES[tool]}`,
-    manager: "bun"
-  }));
-}
-function buildClaudeInstallPlan(machineId, tools) {
-  const machine = (machineId ? getManifestMachine(machineId) : null) || detectCurrentMachineManifest();
-  return {
-    machineId: machine.id,
-    mode: "plan",
-    steps: buildInstallSteps(machine, tools),
-    executed: 0
+    if (filtered.length === 0)
+      return "0";
+    return filtered.map(function(property) {
+      var value = this[property] || 0;
+      if (property === "seconds" && this.milliseconds) {
+        value = (value + this.milliseconds / 1000).toFixed(6).replace(/\.?0+$/, "");
+      }
+      return value + " " + property;
+    }, this).join(" ");
   };
-}
-function runClaudeInstall(machineId, tools, options = {}) {
-  const plan = buildClaudeInstallPlan(machineId, tools);
-  if (!options.apply)
-    return plan;
-  if (!options.yes) {
-    throw new Error("Claude CLI installation requires --yes.");
-  }
-  let executed = 0;
-  for (const step of plan.steps) {
-    const result = Bun.spawnSync(["bash", "-lc", step.command], {
-      stdout: "pipe",
-      stderr: "pipe",
-      env: process.env
-    });
-    if (result.exitCode !== 0) {
-      throw new Error(`AI CLI install failed (${step.id}): ${result.stderr.toString().trim()}`);
-    }
-    executed += 1;
-  }
-  return {
-    machineId: plan.machineId,
-    mode: "apply",
-    steps: plan.steps,
-    executed
+  var propertiesISOEquivalent = {
+    years: "Y",
+    months: "M",
+    days: "D",
+    hours: "H",
+    minutes: "M",
+    seconds: "S"
   };
-}
-
-// src/commands/install-tailscale.ts
-function buildInstallSteps2(machine) {
-  if (machine.platform === "macos") {
-    return [
-      {
-        id: "tailscale-brew",
-        title: "Install Tailscale via Homebrew",
-        command: "brew install --cask tailscale",
-        manager: "brew"
+  var dateProperties = ["years", "months", "days"];
+  var timeProperties = ["hours", "minutes", "seconds"];
+  PostgresInterval.prototype.toISOString = PostgresInterval.prototype.toISO = function() {
+    var datePart = dateProperties.map(buildProperty, this).join("");
+    var timePart = timeProperties.map(buildProperty, this).join("");
+    return "P" + datePart + "T" + timePart;
+    function buildProperty(property) {
+      var value = this[property] || 0;
+      if (property === "seconds" && this.milliseconds) {
+        value = (value + this.milliseconds / 1000).toFixed(6).replace(/0+$/, "");
       }
-    ];
+      return value + propertiesISOEquivalent[property];
+    }
+  };
+  var NUMBER = "([+-]?\\d+)";
+  var YEAR = NUMBER + "\\s+years?";
+  var MONTH = NUMBER + "\\s+mons?";
+  var DAY = NUMBER + "\\s+days?";
+  var TIME = "([+-])?([\\d]*):(\\d\\d):(\\d\\d)\\.?(\\d{1,6})?";
+  var INTERVAL = new RegExp([YEAR, MONTH, DAY, TIME].map(function(regexString) {
+    return "(" + regexString + ")?";
+  }).join("\\s*"));
+  var positions = {
+    years: 2,
+    months: 4,
+    days: 6,
+    hours: 9,
+    minutes: 10,
+    seconds: 11,
+    milliseconds: 12
+  };
+  var negatives = ["hours", "minutes", "seconds", "milliseconds"];
+  function parseMilliseconds(fraction) {
+    var microseconds = fraction + "000000".slice(fraction.length);
+    return parseInt(microseconds, 10) / 1000;
   }
-  if (machine.platform === "windows") {
-    return [
-      {
-        id: "tailscale-winget",
-        title: "Install Tailscale via winget",
-        command: "winget install Tailscale.Tailscale",
-        manager: "custom"
+  function parse(interval) {
+    if (!interval)
+      return {};
+    var matches = INTERVAL.exec(interval);
+    var isNegative = matches[8] === "-";
+    return Object.keys(positions).reduce(function(parsed, property) {
+      var position = positions[property];
+      var value = matches[position];
+      if (!value)
+        return parsed;
+      value = property === "milliseconds" ? parseMilliseconds(value) : parseInt(value, 10);
+      if (!value)
+        return parsed;
+      if (isNegative && ~negatives.indexOf(property)) {
+        value *= -1;
       }
-    ];
+      parsed[property] = value;
+      return parsed;
+    }, {});
   }
-  return [
-    {
-      id: "tailscale-linux",
-      title: "Install Tailscale on Linux",
-      command: "curl -fsSL https://tailscale.com/install.sh | sh",
-      manager: "custom",
-      privileged: true
+});
+var require_postgres_bytea = __commonJS((exports, module) => {
+  var bufferFrom = Buffer.from || Buffer;
+  module.exports = function parseBytea(input) {
+    if (/^\\x/.test(input)) {
+      return bufferFrom(input.substr(2), "hex");
     }
-  ];
-}
-function buildTailscaleInstallPlan(machineId) {
-  const machine = (machineId ? getManifestMachine(machineId) : null) || detectCurrentMachineManifest();
-  return {
-    machineId: machine.id,
-    mode: "plan",
-    steps: buildInstallSteps2(machine),
-    executed: 0
-  };
-}
-function runTailscaleInstall(machineId, options = {}) {
-  const plan = buildTailscaleInstallPlan(machineId);
-  if (!options.apply)
-    return plan;
-  if (!options.yes) {
-    throw new Error("Tailscale install requires --yes.");
-  }
-  let executed = 0;
-  for (const step of plan.steps) {
-    const result = Bun.spawnSync(["bash", "-lc", step.command], {
-      stdout: "pipe",
-      stderr: "pipe",
-      env: process.env
-    });
-    if (result.exitCode !== 0) {
-      throw new Error(`Tailscale install failed (${step.id}): ${result.stderr.toString().trim()}`);
+    var output = "";
+    var i = 0;
+    while (i < input.length) {
+      if (input[i] !== "\\") {
+        output += input[i];
+        ++i;
+      } else {
+        if (/[0-7]{3}/.test(input.substr(i + 1, 3))) {
+          output += String.fromCharCode(parseInt(input.substr(i + 1, 3), 8));
+          i += 4;
+        } else {
+          var backslashes = 1;
+          while (i + backslashes < input.length && input[i + backslashes] === "\\") {
+            backslashes++;
+          }
+          for (var k = 0;k < Math.floor(backslashes / 2); ++k) {
+            output += "\\";
+          }
+          i += Math.floor(backslashes / 2) * 2;
+        }
+      }
     }
-    executed += 1;
-  }
-  return {
-    machineId: plan.machineId,
-    mode: "apply",
-    steps: plan.steps,
-    executed
+    return bufferFrom(output, "binary");
   };
-}
-
-// src/commands/notifications.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-var notificationChannelSchema = exports_external.object({
-  id: exports_external.string(),
-  type: exports_external.enum(["email", "webhook", "command"]),
-  target: exports_external.string(),
-  events: exports_external.array(exports_external.string()),
-  enabled: exports_external.boolean()
-});
-var notificationConfigSchema = exports_external.object({
-  version: exports_external.literal(1),
-  updatedAt: exports_external.string().optional(),
-  channels: exports_external.array(notificationChannelSchema)
 });
-function sortChannels(channels) {
-  return [...channels].sort((left, right) => left.id.localeCompare(right.id));
-}
-function getDefaultNotificationConfig() {
-  return {
-    version: 1,
-    updatedAt: new Date().toISOString(),
-    channels: []
-  };
-}
-function readNotificationConfig(path = getNotificationsPath()) {
-  if (!existsSync4(path)) {
-    return getDefaultNotificationConfig();
+var require_textParsers = __commonJS((exports, module) => {
+  var array = require_postgres_array();
+  var arrayParser = require_arrayParser();
+  var parseDate = require_postgres_date();
+  var parseInterval = require_postgres_interval();
+  var parseByteA = require_postgres_bytea();
+  function allowNull(fn) {
+    return function nullAllowed(value) {
+      if (value === null)
+        return value;
+      return fn(value);
+    };
   }
-  return notificationConfigSchema.parse(JSON.parse(readFileSync3(path, "utf8")));
-}
-function writeNotificationConfig(config, path = getNotificationsPath()) {
-  ensureParentDir(path);
-  const nextConfig = {
-    version: 1,
-    updatedAt: new Date().toISOString(),
-    channels: sortChannels(config.channels)
-  };
-  writeFileSync3(path, `${JSON.stringify(nextConfig, null, 2)}
-`, "utf8");
-  return nextConfig;
-}
-function listNotificationChannels() {
-  return readNotificationConfig();
-}
-function addNotificationChannel(channel) {
-  const config = readNotificationConfig();
-  const channels = config.channels.filter((entry) => entry.id !== channel.id);
-  channels.push({
-    ...channel,
-    events: [...new Set(channel.events)]
-  });
-  return writeNotificationConfig({ ...config, channels });
-}
-function removeNotificationChannel(channelId) {
-  const config = readNotificationConfig();
-  return writeNotificationConfig({
-    ...config,
-    channels: config.channels.filter((channel) => channel.id !== channelId)
-  });
-}
-function buildNotificationPreview(channel, event, message) {
-  if (channel.type === "email") {
-    return `send email to ${channel.target}: [${event}] ${message}`;
+  function parseBool(value) {
+    if (value === null)
+      return value;
+    return value === "TRUE" || value === "t" || value === "true" || value === "y" || value === "yes" || value === "on" || value === "1";
   }
-  if (channel.type === "webhook") {
-    return `POST ${channel.target} with payload {"event":"${event}","message":"${message}"}`;
+  function parseBoolArray(value) {
+    if (!value)
+      return null;
+    return array.parse(value, parseBool);
   }
-  return `${channel.target} --event ${event} --message ${JSON.stringify(message)}`;
-}
-function testNotificationChannel(channelId, event = "manual.test", message = "machines notification test", options = {}) {
-  const channel = readNotificationConfig().channels.find((entry) => entry.id === channelId);
-  if (!channel) {
-    throw new Error(`Notification channel not found: ${channelId}`);
+  function parseBaseTenInt(string) {
+    return parseInt(string, 10);
   }
-  const preview = buildNotificationPreview(channel, event, message);
-  if (!options.apply) {
-    return {
-      channelId,
-      mode: "plan",
-      delivered: false,
-      preview
-    };
+  function parseIntegerArray(value) {
+    if (!value)
+      return null;
+    return array.parse(value, allowNull(parseBaseTenInt));
   }
-  if (!options.yes) {
-    throw new Error("Notification test execution requires --yes.");
+  function parseBigIntegerArray(value) {
+    if (!value)
+      return null;
+    return array.parse(value, allowNull(function(entry) {
+      return parseBigInteger(entry).trim();
+    }));
   }
-  if (channel.type === "command") {
-    const result = Bun.spawnSync(["bash", "-lc", preview], {
-      stdout: "pipe",
-      stderr: "pipe",
-      env: process.env
-    });
-    if (result.exitCode !== 0) {
-      throw new Error(`Notification command failed (${channel.id}): ${result.stderr.toString().trim()}`);
+  var parsePointArray = function(value) {
+    if (!value) {
+      return null;
     }
-  }
-  return {
-    channelId,
-    mode: "apply",
-    delivered: channel.enabled,
-    preview
-  };
-}
-
-// src/commands/ports.ts
-import { spawnSync as spawnSync2 } from "child_process";
-
-// src/db.ts
-import { hostname as hostname2 } from "os";
-
-// node_modules/@hasna/cloud/dist/index.js
-import { createRequire } from "module";
-import { Database } from "bun:sqlite";
-import {
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync2,
-  readdirSync,
-  copyFileSync
-} from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join5, relative } from "path";
-import { existsSync as existsSync22, mkdirSync as mkdirSync22, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir22 } from "os";
-import { join as join22 } from "path";
-import { readdirSync as readdirSync2, existsSync as existsSync32 } from "fs";
-import { join as join32 } from "path";
-import { homedir as homedir32 } from "os";
-import { homedir as homedir42 } from "os";
-import { join as join42 } from "path";
-import { join as join6, dirname as dirname3 } from "path";
-import { homedir as homedir5, platform as platform3 } from "os";
-var __create = Object.create;
-var __getProtoOf = Object.getPrototypeOf;
-var __defProp2 = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-function __accessProp(key) {
-  return this[key];
-}
-var __toESMCache_node;
-var __toESMCache_esm;
-var __toESM = (mod, isNodeMode, target) => {
-  var canCache = mod != null && typeof mod === "object";
-  if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
-    var cached = cache.get(mod);
-    if (cached)
-      return cached;
-  }
-  target = mod != null ? __create(__getProtoOf(mod)) : {};
-  const to = isNodeMode || !mod || !mod.__esModule ? __defProp2(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp2(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
-  if (canCache)
-    cache.set(mod, to);
-  return to;
-};
-var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __returnValue2 = (v) => v;
-function __exportSetter2(name, newValue) {
-  this[name] = __returnValue2.bind(null, newValue);
-}
-var __export2 = (target, all) => {
-  for (var name in all)
-    __defProp2(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter2.bind(all, name)
+    var p = arrayParser.create(value, function(entry) {
+      if (entry !== null) {
+        entry = parsePoint(entry);
+      }
+      return entry;
     });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
-var require_postgres_array = __commonJS((exports) => {
-  exports.parse = function(source, transform) {
-    return new ArrayParser(source, transform).parse();
+    return p.parse();
   };
-
-  class ArrayParser {
-    constructor(source, transform) {
-      this.source = source;
-      this.transform = transform || identity;
-      this.position = 0;
-      this.entries = [];
-      this.recorded = [];
-      this.dimension = 0;
-    }
-    isEof() {
-      return this.position >= this.source.length;
+  var parseFloatArray = function(value) {
+    if (!value) {
+      return null;
     }
-    nextCharacter() {
-      var character = this.source[this.position++];
-      if (character === "\\") {
-        return {
-          value: this.source[this.position++],
-          escaped: true
-        };
+    var p = arrayParser.create(value, function(entry) {
+      if (entry !== null) {
+        entry = parseFloat(entry);
       }
-      return {
-        value: character,
-        escaped: false
-      };
+      return entry;
+    });
+    return p.parse();
+  };
+  var parseStringArray = function(value) {
+    if (!value) {
+      return null;
     }
-    record(character) {
-      this.recorded.push(character);
+    var p = arrayParser.create(value);
+    return p.parse();
+  };
+  var parseDateArray = function(value) {
+    if (!value) {
+      return null;
     }
-    newEntry(includeEmpty) {
-      var entry;
-      if (this.recorded.length > 0 || includeEmpty) {
-        entry = this.recorded.join("");
-        if (entry === "NULL" && !includeEmpty) {
-          entry = null;
-        }
-        if (entry !== null)
-          entry = this.transform(entry);
-        this.entries.push(entry);
-        this.recorded = [];
+    var p = arrayParser.create(value, function(entry) {
+      if (entry !== null) {
+        entry = parseDate(entry);
       }
+      return entry;
+    });
+    return p.parse();
+  };
+  var parseIntervalArray = function(value) {
+    if (!value) {
+      return null;
     }
-    consumeDimensions() {
-      if (this.source[0] === "[") {
-        while (!this.isEof()) {
-          var char = this.nextCharacter();
-          if (char.value === "=")
-            break;
-        }
+    var p = arrayParser.create(value, function(entry) {
+      if (entry !== null) {
+        entry = parseInterval(entry);
       }
+      return entry;
+    });
+    return p.parse();
+  };
+  var parseByteAArray = function(value) {
+    if (!value) {
+      return null;
     }
-    parse(nested) {
-      var character, parser, quote3;
-      this.consumeDimensions();
-      while (!this.isEof()) {
-        character = this.nextCharacter();
-        if (character.value === "{" && !quote3) {
-          this.dimension++;
-          if (this.dimension > 1) {
-            parser = new ArrayParser(this.source.substr(this.position - 1), this.transform);
-            this.entries.push(parser.parse(true));
-            this.position += parser.position - 2;
-          }
-        } else if (character.value === "}" && !quote3) {
-          this.dimension--;
-          if (!this.dimension) {
-            this.newEntry();
-            if (nested)
-              return this.entries;
-          }
-        } else if (character.value === '"' && !character.escaped) {
-          if (quote3)
-            this.newEntry(true);
-          quote3 = !quote3;
-        } else if (character.value === "," && !quote3) {
-          this.newEntry();
-        } else {
-          this.record(character.value);
-        }
-      }
-      if (this.dimension !== 0) {
-        throw new Error("array dimension not balanced");
-      }
-      return this.entries;
+    return array.parse(value, allowNull(parseByteA));
+  };
+  var parseInteger = function(value) {
+    return parseInt(value, 10);
+  };
+  var parseBigInteger = function(value) {
+    var valStr = String(value);
+    if (/^\d+$/.test(valStr)) {
+      return valStr;
     }
-  }
-  function identity(value) {
     return value;
-  }
-});
-var require_arrayParser = __commonJS((exports, module) => {
-  var array = require_postgres_array();
-  module.exports = {
-    create: function(source, transform) {
-      return {
-        parse: function() {
-          return array.parse(source, transform);
-        }
-      };
-    }
   };
-});
-var require_postgres_date = __commonJS((exports, module) => {
-  var DATE_TIME = /(\d{1,})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})(\.\d{1,})?.*?( BC)?$/;
-  var DATE = /^(\d{1,})-(\d{2})-(\d{2})( BC)?$/;
-  var TIME_ZONE = /([Z+-])(\d{2})?:?(\d{2})?:?(\d{2})?/;
-  var INFINITY = /^-?infinity$/;
-  module.exports = function parseDate(isoDate) {
-    if (INFINITY.test(isoDate)) {
-      return Number(isoDate.replace("i", "I"));
+  var parseJsonArray = function(value) {
+    if (!value) {
+      return null;
     }
-    var matches = DATE_TIME.exec(isoDate);
-    if (!matches) {
-      return getDate(isoDate) || null;
+    return array.parse(value, allowNull(JSON.parse));
+  };
+  var parsePoint = function(value) {
+    if (value[0] !== "(") {
+      return null;
     }
-    var isBC = !!matches[8];
-    var year = parseInt(matches[1], 10);
-    if (isBC) {
-      year = bcYearToNegativeYear(year);
+    value = value.substring(1, value.length - 1).split(",");
+    return {
+      x: parseFloat(value[0]),
+      y: parseFloat(value[1])
+    };
+  };
+  var parseCircle = function(value) {
+    if (value[0] !== "<" && value[1] !== "(") {
+      return null;
     }
-    var month = parseInt(matches[2], 10) - 1;
-    var day = matches[3];
-    var hour = parseInt(matches[4], 10);
-    var minute = parseInt(matches[5], 10);
-    var second = parseInt(matches[6], 10);
-    var ms = matches[7];
-    ms = ms ? 1000 * parseFloat(ms) : 0;
-    var date;
-    var offset = timeZoneOffset(isoDate);
-    if (offset != null) {
-      date = new Date(Date.UTC(year, month, day, hour, minute, second, ms));
-      if (is0To99(year)) {
-        date.setUTCFullYear(year);
+    var point = "(";
+    var radius = "";
+    var pointParsed = false;
+    for (var i = 2;i < value.length - 1; i++) {
+      if (!pointParsed) {
+        point += value[i];
       }
-      if (offset !== 0) {
-        date.setTime(date.getTime() - offset);
+      if (value[i] === ")") {
+        pointParsed = true;
+        continue;
+      } else if (!pointParsed) {
+        continue;
       }
-    } else {
-      date = new Date(year, month, day, hour, minute, second, ms);
-      if (is0To99(year)) {
-        date.setFullYear(year);
+      if (value[i] === ",") {
+        continue;
       }
+      radius += value[i];
     }
-    return date;
+    var result = parsePoint(point);
+    result.radius = parseFloat(radius);
+    return result;
   };
-  function getDate(isoDate) {
-    var matches = DATE.exec(isoDate);
-    if (!matches) {
-      return;
+  var init = function(register) {
+    register(20, parseBigInteger);
+    register(21, parseInteger);
+    register(23, parseInteger);
+    register(26, parseInteger);
+    register(700, parseFloat);
+    register(701, parseFloat);
+    register(16, parseBool);
+    register(1082, parseDate);
+    register(1114, parseDate);
+    register(1184, parseDate);
+    register(600, parsePoint);
+    register(651, parseStringArray);
+    register(718, parseCircle);
+    register(1000, parseBoolArray);
+    register(1001, parseByteAArray);
+    register(1005, parseIntegerArray);
+    register(1007, parseIntegerArray);
+    register(1028, parseIntegerArray);
+    register(1016, parseBigIntegerArray);
+    register(1017, parsePointArray);
+    register(1021, parseFloatArray);
+    register(1022, parseFloatArray);
+    register(1231, parseFloatArray);
+    register(1014, parseStringArray);
+    register(1015, parseStringArray);
+    register(1008, parseStringArray);
+    register(1009, parseStringArray);
+    register(1040, parseStringArray);
+    register(1041, parseStringArray);
+    register(1115, parseDateArray);
+    register(1182, parseDateArray);
+    register(1185, parseDateArray);
+    register(1186, parseInterval);
+    register(1187, parseIntervalArray);
+    register(17, parseByteA);
+    register(114, JSON.parse.bind(JSON));
+    register(3802, JSON.parse.bind(JSON));
+    register(199, parseJsonArray);
+    register(3807, parseJsonArray);
+    register(3907, parseStringArray);
+    register(2951, parseStringArray);
+    register(791, parseStringArray);
+    register(1183, parseStringArray);
+    register(1270, parseStringArray);
+  };
+  module.exports = {
+    init
+  };
+});
+var require_pg_int8 = __commonJS((exports, module) => {
+  var BASE = 1e6;
+  function readInt8(buffer) {
+    var high = buffer.readInt32BE(0);
+    var low = buffer.readUInt32BE(4);
+    var sign = "";
+    if (high < 0) {
+      high = ~high + (low === 0);
+      low = ~low + 1 >>> 0;
+      sign = "-";
     }
-    var year = parseInt(matches[1], 10);
-    var isBC = !!matches[4];
-    if (isBC) {
-      year = bcYearToNegativeYear(year);
+    var result = "";
+    var carry;
+    var t;
+    var digits;
+    var pad;
+    var l;
+    var i;
+    {
+      carry = high % BASE;
+      high = high / BASE >>> 0;
+      t = 4294967296 * carry + low;
+      low = t / BASE >>> 0;
+      digits = "" + (t - BASE * low);
+      if (low === 0 && high === 0) {
+        return sign + digits + result;
+      }
+      pad = "";
+      l = 6 - digits.length;
+      for (i = 0;i < l; i++) {
+        pad += "0";
+      }
+      result = pad + digits + result;
     }
-    var month = parseInt(matches[2], 10) - 1;
-    var day = matches[3];
-    var date = new Date(year, month, day);
-    if (is0To99(year)) {
-      date.setFullYear(year);
+    {
+      carry = high % BASE;
+      high = high / BASE >>> 0;
+      t = 4294967296 * carry + low;
+      low = t / BASE >>> 0;
+      digits = "" + (t - BASE * low);
+      if (low === 0 && high === 0) {
+        return sign + digits + result;
+      }
+      pad = "";
+      l = 6 - digits.length;
+      for (i = 0;i < l; i++) {
+        pad += "0";
+      }
+      result = pad + digits + result;
     }
-    return date;
-  }
-  function timeZoneOffset(isoDate) {
-    if (isoDate.endsWith("+00")) {
-      return 0;
+    {
+      carry = high % BASE;
+      high = high / BASE >>> 0;
+      t = 4294967296 * carry + low;
+      low = t / BASE >>> 0;
+      digits = "" + (t - BASE * low);
+      if (low === 0 && high === 0) {
+        return sign + digits + result;
+      }
+      pad = "";
+      l = 6 - digits.length;
+      for (i = 0;i < l; i++) {
+        pad += "0";
+      }
+      result = pad + digits + result;
     }
-    var zone = TIME_ZONE.exec(isoDate.split(" ")[1]);
-    if (!zone)
-      return;
-    var type = zone[1];
-    if (type === "Z") {
-      return 0;
+    {
+      carry = high % BASE;
+      t = 4294967296 * carry + low;
+      digits = "" + t % BASE;
+      return sign + digits + result;
     }
-    var sign = type === "-" ? -1 : 1;
-    var offset = parseInt(zone[2], 10) * 3600 + parseInt(zone[3] || 0, 10) * 60 + parseInt(zone[4] || 0, 10);
-    return offset * sign * 1000;
-  }
-  function bcYearToNegativeYear(year) {
-    return -(year - 1);
-  }
-  function is0To99(num) {
-    return num >= 0 && num < 100;
   }
+  module.exports = readInt8;
 });
-var require_mutable = __commonJS((exports, module) => {
-  module.exports = extend;
-  var hasOwnProperty = Object.prototype.hasOwnProperty;
-  function extend(target) {
-    for (var i = 1;i < arguments.length; i++) {
-      var source = arguments[i];
-      for (var key in source) {
-        if (hasOwnProperty.call(source, key)) {
-          target[key] = source[key];
-        }
+var require_binaryParsers = __commonJS((exports, module) => {
+  var parseInt64 = require_pg_int8();
+  var parseBits = function(data, bits, offset, invert, callback) {
+    offset = offset || 0;
+    invert = invert || false;
+    callback = callback || function(lastValue, newValue, bits2) {
+      return lastValue * Math.pow(2, bits2) + newValue;
+    };
+    var offsetBytes = offset >> 3;
+    var inv = function(value) {
+      if (invert) {
+        return ~value & 255;
       }
+      return value;
+    };
+    var mask = 255;
+    var firstBits = 8 - offset % 8;
+    if (bits < firstBits) {
+      mask = 255 << 8 - bits & 255;
+      firstBits = bits;
     }
-    return target;
-  }
-});
-var require_postgres_interval = __commonJS((exports, module) => {
-  var extend = require_mutable();
-  module.exports = PostgresInterval;
-  function PostgresInterval(raw) {
-    if (!(this instanceof PostgresInterval)) {
-      return new PostgresInterval(raw);
+    if (offset) {
+      mask = mask >> offset % 8;
     }
-    extend(this, parse(raw));
-  }
-  var properties = ["seconds", "minutes", "hours", "days", "months", "years"];
-  PostgresInterval.prototype.toPostgres = function() {
-    var filtered = properties.filter(this.hasOwnProperty, this);
-    if (this.milliseconds && filtered.indexOf("seconds") < 0) {
-      filtered.push("seconds");
+    var result = 0;
+    if (offset % 8 + bits >= 8) {
+      result = callback(0, inv(data[offsetBytes]) & mask, firstBits);
     }
-    if (filtered.length === 0)
-      return "0";
-    return filtered.map(function(property) {
-      var value = this[property] || 0;
-      if (property === "seconds" && this.milliseconds) {
-        value = (value + this.milliseconds / 1000).toFixed(6).replace(/\.?0+$/, "");
-      }
-      return value + " " + property;
-    }, this).join(" ");
-  };
-  var propertiesISOEquivalent = {
-    years: "Y",
-    months: "M",
-    days: "D",
-    hours: "H",
-    minutes: "M",
-    seconds: "S"
-  };
-  var dateProperties = ["years", "months", "days"];
-  var timeProperties = ["hours", "minutes", "seconds"];
-  PostgresInterval.prototype.toISOString = PostgresInterval.prototype.toISO = function() {
-    var datePart = dateProperties.map(buildProperty, this).join("");
-    var timePart = timeProperties.map(buildProperty, this).join("");
-    return "P" + datePart + "T" + timePart;
-    function buildProperty(property) {
-      var value = this[property] || 0;
-      if (property === "seconds" && this.milliseconds) {
-        value = (value + this.milliseconds / 1000).toFixed(6).replace(/0+$/, "");
-      }
-      return value + propertiesISOEquivalent[property];
+    var bytes = bits + offset >> 3;
+    for (var i = offsetBytes + 1;i < bytes; i++) {
+      result = callback(result, inv(data[i]), 8);
     }
+    var lastBits = (bits + offset) % 8;
+    if (lastBits > 0) {
+      result = callback(result, inv(data[bytes]) >> 8 - lastBits, lastBits);
+    }
+    return result;
   };
-  var NUMBER = "([+-]?\\d+)";
-  var YEAR = NUMBER + "\\s+years?";
-  var MONTH = NUMBER + "\\s+mons?";
-  var DAY = NUMBER + "\\s+days?";
-  var TIME = "([+-])?([\\d]*):(\\d\\d):(\\d\\d)\\.?(\\d{1,6})?";
-  var INTERVAL = new RegExp([YEAR, MONTH, DAY, TIME].map(function(regexString) {
-    return "(" + regexString + ")?";
-  }).join("\\s*"));
-  var positions = {
-    years: 2,
-    months: 4,
-    days: 6,
-    hours: 9,
-    minutes: 10,
-    seconds: 11,
-    milliseconds: 12
-  };
-  var negatives = ["hours", "minutes", "seconds", "milliseconds"];
-  function parseMilliseconds(fraction) {
-    var microseconds = fraction + "000000".slice(fraction.length);
-    return parseInt(microseconds, 10) / 1000;
-  }
-  function parse(interval) {
-    if (!interval)
-      return {};
-    var matches = INTERVAL.exec(interval);
-    var isNegative = matches[8] === "-";
-    return Object.keys(positions).reduce(function(parsed, property) {
-      var position = positions[property];
-      var value = matches[position];
-      if (!value)
-        return parsed;
-      value = property === "milliseconds" ? parseMilliseconds(value) : parseInt(value, 10);
-      if (!value)
-        return parsed;
-      if (isNegative && ~negatives.indexOf(property)) {
-        value *= -1;
-      }
-      parsed[property] = value;
-      return parsed;
-    }, {});
-  }
-});
-var require_postgres_bytea = __commonJS((exports, module) => {
-  var bufferFrom = Buffer.from || Buffer;
-  module.exports = function parseBytea(input) {
-    if (/^\\x/.test(input)) {
-      return bufferFrom(input.substr(2), "hex");
+  var parseFloatFromBits = function(data, precisionBits, exponentBits) {
+    var bias = Math.pow(2, exponentBits - 1) - 1;
+    var sign = parseBits(data, 1);
+    var exponent = parseBits(data, exponentBits, 1);
+    if (exponent === 0) {
+      return 0;
     }
-    var output = "";
-    var i = 0;
-    while (i < input.length) {
-      if (input[i] !== "\\") {
-        output += input[i];
-        ++i;
-      } else {
-        if (/[0-7]{3}/.test(input.substr(i + 1, 3))) {
-          output += String.fromCharCode(parseInt(input.substr(i + 1, 3), 8));
-          i += 4;
-        } else {
-          var backslashes = 1;
-          while (i + backslashes < input.length && input[i + backslashes] === "\\") {
-            backslashes++;
-          }
-          for (var k = 0;k < Math.floor(backslashes / 2); ++k) {
-            output += "\\";
-          }
-          i += Math.floor(backslashes / 2) * 2;
+    var precisionBitsCounter = 1;
+    var parsePrecisionBits = function(lastValue, newValue, bits) {
+      if (lastValue === 0) {
+        lastValue = 1;
+      }
+      for (var i = 1;i <= bits; i++) {
+        precisionBitsCounter /= 2;
+        if ((newValue & 1 << bits - i) > 0) {
+          lastValue += precisionBitsCounter;
         }
       }
-    }
-    return bufferFrom(output, "binary");
-  };
-});
-var require_textParsers = __commonJS((exports, module) => {
-  var array = require_postgres_array();
-  var arrayParser = require_arrayParser();
-  var parseDate = require_postgres_date();
-  var parseInterval = require_postgres_interval();
-  var parseByteA = require_postgres_bytea();
-  function allowNull(fn) {
-    return function nullAllowed(value) {
-      if (value === null)
-        return value;
-      return fn(value);
+      return lastValue;
     };
-  }
-  function parseBool(value) {
-    if (value === null)
-      return value;
-    return value === "TRUE" || value === "t" || value === "true" || value === "y" || value === "yes" || value === "on" || value === "1";
-  }
-  function parseBoolArray(value) {
-    if (!value)
-      return null;
-    return array.parse(value, parseBool);
-  }
-  function parseBaseTenInt(string) {
-    return parseInt(string, 10);
-  }
-  function parseIntegerArray(value) {
-    if (!value)
-      return null;
-    return array.parse(value, allowNull(parseBaseTenInt));
-  }
-  function parseBigIntegerArray(value) {
-    if (!value)
-      return null;
-    return array.parse(value, allowNull(function(entry) {
-      return parseBigInteger(entry).trim();
-    }));
-  }
-  var parsePointArray = function(value) {
-    if (!value) {
-      return null;
-    }
-    var p = arrayParser.create(value, function(entry) {
-      if (entry !== null) {
-        entry = parsePoint(entry);
-      }
-      return entry;
-    });
-    return p.parse();
-  };
-  var parseFloatArray = function(value) {
-    if (!value) {
-      return null;
-    }
-    var p = arrayParser.create(value, function(entry) {
-      if (entry !== null) {
-        entry = parseFloat(entry);
+    var mantissa = parseBits(data, precisionBits, exponentBits + 1, false, parsePrecisionBits);
+    if (exponent == Math.pow(2, exponentBits + 1) - 1) {
+      if (mantissa === 0) {
+        return sign === 0 ? Infinity : -Infinity;
       }
-      return entry;
-    });
-    return p.parse();
-  };
-  var parseStringArray = function(value) {
-    if (!value) {
-      return null;
-    }
-    var p = arrayParser.create(value);
-    return p.parse();
-  };
-  var parseDateArray = function(value) {
-    if (!value) {
-      return null;
+      return NaN;
     }
-    var p = arrayParser.create(value, function(entry) {
-      if (entry !== null) {
-        entry = parseDate(entry);
-      }
-      return entry;
-    });
-    return p.parse();
+    return (sign === 0 ? 1 : -1) * Math.pow(2, exponent - bias) * mantissa;
   };
-  var parseIntervalArray = function(value) {
-    if (!value) {
-      return null;
+  var parseInt16 = function(value) {
+    if (parseBits(value, 1) == 1) {
+      return -1 * (parseBits(value, 15, 1, true) + 1);
     }
-    var p = arrayParser.create(value, function(entry) {
-      if (entry !== null) {
-        entry = parseInterval(entry);
-      }
-      return entry;
-    });
-    return p.parse();
+    return parseBits(value, 15, 1);
   };
-  var parseByteAArray = function(value) {
-    if (!value) {
-      return null;
+  var parseInt32 = function(value) {
+    if (parseBits(value, 1) == 1) {
+      return -1 * (parseBits(value, 31, 1, true) + 1);
     }
-    return array.parse(value, allowNull(parseByteA));
+    return parseBits(value, 31, 1);
   };
-  var parseInteger = function(value) {
-    return parseInt(value, 10);
+  var parseFloat32 = function(value) {
+    return parseFloatFromBits(value, 23, 8);
   };
-  var parseBigInteger = function(value) {
-    var valStr = String(value);
-    if (/^\d+$/.test(valStr)) {
-      return valStr;
-    }
-    return value;
+  var parseFloat64 = function(value) {
+    return parseFloatFromBits(value, 52, 11);
   };
-  var parseJsonArray = function(value) {
-    if (!value) {
-      return null;
-    }
-    return array.parse(value, allowNull(JSON.parse));
-  };
-  var parsePoint = function(value) {
-    if (value[0] !== "(") {
-      return null;
-    }
-    value = value.substring(1, value.length - 1).split(",");
-    return {
-      x: parseFloat(value[0]),
-      y: parseFloat(value[1])
-    };
-  };
-  var parseCircle = function(value) {
-    if (value[0] !== "<" && value[1] !== "(") {
-      return null;
-    }
-    var point = "(";
-    var radius = "";
-    var pointParsed = false;
-    for (var i = 2;i < value.length - 1; i++) {
-      if (!pointParsed) {
-        point += value[i];
-      }
-      if (value[i] === ")") {
-        pointParsed = true;
-        continue;
-      } else if (!pointParsed) {
-        continue;
-      }
-      if (value[i] === ",") {
-        continue;
-      }
-      radius += value[i];
-    }
-    var result = parsePoint(point);
-    result.radius = parseFloat(radius);
-    return result;
-  };
-  var init = function(register) {
-    register(20, parseBigInteger);
-    register(21, parseInteger);
-    register(23, parseInteger);
-    register(26, parseInteger);
-    register(700, parseFloat);
-    register(701, parseFloat);
-    register(16, parseBool);
-    register(1082, parseDate);
-    register(1114, parseDate);
-    register(1184, parseDate);
-    register(600, parsePoint);
-    register(651, parseStringArray);
-    register(718, parseCircle);
-    register(1000, parseBoolArray);
-    register(1001, parseByteAArray);
-    register(1005, parseIntegerArray);
-    register(1007, parseIntegerArray);
-    register(1028, parseIntegerArray);
-    register(1016, parseBigIntegerArray);
-    register(1017, parsePointArray);
-    register(1021, parseFloatArray);
-    register(1022, parseFloatArray);
-    register(1231, parseFloatArray);
-    register(1014, parseStringArray);
-    register(1015, parseStringArray);
-    register(1008, parseStringArray);
-    register(1009, parseStringArray);
-    register(1040, parseStringArray);
-    register(1041, parseStringArray);
-    register(1115, parseDateArray);
-    register(1182, parseDateArray);
-    register(1185, parseDateArray);
-    register(1186, parseInterval);
-    register(1187, parseIntervalArray);
-    register(17, parseByteA);
-    register(114, JSON.parse.bind(JSON));
-    register(3802, JSON.parse.bind(JSON));
-    register(199, parseJsonArray);
-    register(3807, parseJsonArray);
-    register(3907, parseStringArray);
-    register(2951, parseStringArray);
-    register(791, parseStringArray);
-    register(1183, parseStringArray);
-    register(1270, parseStringArray);
-  };
-  module.exports = {
-    init
-  };
-});
-var require_pg_int8 = __commonJS((exports, module) => {
-  var BASE = 1e6;
-  function readInt8(buffer) {
-    var high = buffer.readInt32BE(0);
-    var low = buffer.readUInt32BE(4);
-    var sign = "";
-    if (high < 0) {
-      high = ~high + (low === 0);
-      low = ~low + 1 >>> 0;
-      sign = "-";
-    }
-    var result = "";
-    var carry;
-    var t;
-    var digits;
-    var pad;
-    var l;
-    var i;
-    {
-      carry = high % BASE;
-      high = high / BASE >>> 0;
-      t = 4294967296 * carry + low;
-      low = t / BASE >>> 0;
-      digits = "" + (t - BASE * low);
-      if (low === 0 && high === 0) {
-        return sign + digits + result;
-      }
-      pad = "";
-      l = 6 - digits.length;
-      for (i = 0;i < l; i++) {
-        pad += "0";
-      }
-      result = pad + digits + result;
-    }
-    {
-      carry = high % BASE;
-      high = high / BASE >>> 0;
-      t = 4294967296 * carry + low;
-      low = t / BASE >>> 0;
-      digits = "" + (t - BASE * low);
-      if (low === 0 && high === 0) {
-        return sign + digits + result;
-      }
-      pad = "";
-      l = 6 - digits.length;
-      for (i = 0;i < l; i++) {
-        pad += "0";
-      }
-      result = pad + digits + result;
-    }
-    {
-      carry = high % BASE;
-      high = high / BASE >>> 0;
-      t = 4294967296 * carry + low;
-      low = t / BASE >>> 0;
-      digits = "" + (t - BASE * low);
-      if (low === 0 && high === 0) {
-        return sign + digits + result;
-      }
-      pad = "";
-      l = 6 - digits.length;
-      for (i = 0;i < l; i++) {
-        pad += "0";
-      }
-      result = pad + digits + result;
-    }
-    {
-      carry = high % BASE;
-      t = 4294967296 * carry + low;
-      digits = "" + t % BASE;
-      return sign + digits + result;
-    }
-  }
-  module.exports = readInt8;
-});
-var require_binaryParsers = __commonJS((exports, module) => {
-  var parseInt64 = require_pg_int8();
-  var parseBits = function(data, bits, offset, invert, callback) {
-    offset = offset || 0;
-    invert = invert || false;
-    callback = callback || function(lastValue, newValue, bits2) {
-      return lastValue * Math.pow(2, bits2) + newValue;
-    };
-    var offsetBytes = offset >> 3;
-    var inv = function(value) {
-      if (invert) {
-        return ~value & 255;
-      }
-      return value;
-    };
-    var mask = 255;
-    var firstBits = 8 - offset % 8;
-    if (bits < firstBits) {
-      mask = 255 << 8 - bits & 255;
-      firstBits = bits;
-    }
-    if (offset) {
-      mask = mask >> offset % 8;
-    }
-    var result = 0;
-    if (offset % 8 + bits >= 8) {
-      result = callback(0, inv(data[offsetBytes]) & mask, firstBits);
-    }
-    var bytes = bits + offset >> 3;
-    for (var i = offsetBytes + 1;i < bytes; i++) {
-      result = callback(result, inv(data[i]), 8);
-    }
-    var lastBits = (bits + offset) % 8;
-    if (lastBits > 0) {
-      result = callback(result, inv(data[bytes]) >> 8 - lastBits, lastBits);
-    }
-    return result;
-  };
-  var parseFloatFromBits = function(data, precisionBits, exponentBits) {
-    var bias = Math.pow(2, exponentBits - 1) - 1;
-    var sign = parseBits(data, 1);
-    var exponent = parseBits(data, exponentBits, 1);
-    if (exponent === 0) {
-      return 0;
-    }
-    var precisionBitsCounter = 1;
-    var parsePrecisionBits = function(lastValue, newValue, bits) {
-      if (lastValue === 0) {
-        lastValue = 1;
-      }
-      for (var i = 1;i <= bits; i++) {
-        precisionBitsCounter /= 2;
-        if ((newValue & 1 << bits - i) > 0) {
-          lastValue += precisionBitsCounter;
-        }
-      }
-      return lastValue;
-    };
-    var mantissa = parseBits(data, precisionBits, exponentBits + 1, false, parsePrecisionBits);
-    if (exponent == Math.pow(2, exponentBits + 1) - 1) {
-      if (mantissa === 0) {
-        return sign === 0 ? Infinity : -Infinity;
-      }
-      return NaN;
-    }
-    return (sign === 0 ? 1 : -1) * Math.pow(2, exponent - bias) * mantissa;
-  };
-  var parseInt16 = function(value) {
-    if (parseBits(value, 1) == 1) {
-      return -1 * (parseBits(value, 15, 1, true) + 1);
-    }
-    return parseBits(value, 15, 1);
-  };
-  var parseInt32 = function(value) {
-    if (parseBits(value, 1) == 1) {
-      return -1 * (parseBits(value, 31, 1, true) + 1);
-    }
-    return parseBits(value, 31, 1);
-  };
-  var parseFloat32 = function(value) {
-    return parseFloatFromBits(value, 23, 8);
-  };
-  var parseFloat64 = function(value) {
-    return parseFloatFromBits(value, 52, 11);
-  };
-  var parseNumeric = function(value) {
-    var sign = parseBits(value, 16, 32);
-    if (sign == 49152) {
-      return NaN;
+  var parseNumeric = function(value) {
+    var sign = parseBits(value, 16, 32);
+    if (sign == 49152) {
+      return NaN;
     }
     var weight = Math.pow(1e4, parseBits(value, 16, 16));
     var result = 0;
@@ -13858,473 +13387,1267 @@ var init_zod = __esm(() => {
   init_external();
 });
 function getDataDir2(serviceName) {
-  const dir = join5(HASNA_DIR, serviceName);
+  const dir = join3(HASNA_DIR, serviceName);
   mkdirSync2(dir, { recursive: true });
   return dir;
 }
-function getDbPath2(serviceName) {
-  const dir = getDataDir2(serviceName);
-  return join5(dir, `${serviceName}.db`);
+function getDbPath2(serviceName) {
+  const dir = getDataDir2(serviceName);
+  return join3(dir, `${serviceName}.db`);
+}
+var HASNA_DIR;
+var init_dotfile = __esm(() => {
+  HASNA_DIR = join3(homedir3(), ".hasna");
+});
+var exports_config = {};
+__export2(exports_config, {
+  saveCloudConfig: () => saveCloudConfig,
+  getConnectionString: () => getConnectionString,
+  getConfigPath: () => getConfigPath,
+  getConfigDir: () => getConfigDir,
+  getCloudConfig: () => getCloudConfig,
+  createDatabase: () => createDatabase,
+  CloudConfigSchema: () => CloudConfigSchema
+});
+function getConfigDir() {
+  return CONFIG_DIR;
+}
+function getConfigPath() {
+  return CONFIG_PATH;
+}
+function getCloudConfig() {
+  if (!existsSync22(CONFIG_PATH)) {
+    return CloudConfigSchema.parse({});
+  }
+  try {
+    const raw = readFileSync2(CONFIG_PATH, "utf-8");
+    return CloudConfigSchema.parse(JSON.parse(raw));
+  } catch {
+    return CloudConfigSchema.parse({});
+  }
+}
+function saveCloudConfig(config) {
+  mkdirSync22(CONFIG_DIR, { recursive: true });
+  writeFileSync2(CONFIG_PATH, JSON.stringify(config, null, 2) + `
+`, "utf-8");
+}
+function getConnectionString(dbName) {
+  const config = getCloudConfig();
+  const { host, port, username, password_env, ssl } = config.rds;
+  if (!host || !username) {
+    throw new Error("Cloud RDS not configured. Run `cloud setup` to configure.");
+  }
+  const password = process.env[password_env];
+  if (password === undefined || password === "") {
+    throw new Error(`RDS password not set. Export ${password_env} in your shell or add it to ~/.secrets/hasna/rds/live.env`);
+  }
+  const sslParam = ssl ? "?sslmode=require" : "";
+  return `postgres://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbName}${sslParam}`;
+}
+function createDatabase(options) {
+  const config = getCloudConfig();
+  const mode = options.mode ?? config.mode;
+  if (mode === "cloud") {
+    const connStr = options.pgConnectionString ?? getConnectionString(options.service);
+    return new PgAdapter(connStr);
+  }
+  const dbPath = options.sqlitePath ?? getDbPath2(options.service);
+  return new SqliteAdapter(dbPath);
+}
+var CloudConfigSchema;
+var CONFIG_DIR;
+var CONFIG_PATH;
+var init_config = __esm(() => {
+  init_zod();
+  init_adapter();
+  init_dotfile();
+  CloudConfigSchema = exports_external2.object({
+    rds: exports_external2.object({
+      host: exports_external2.string().default(""),
+      port: exports_external2.number().default(5432),
+      username: exports_external2.string().default(""),
+      password_env: exports_external2.string().default("HASNA_RDS_PASSWORD"),
+      ssl: exports_external2.boolean().default(true)
+    }).default({}),
+    mode: exports_external2.enum(["local", "cloud", "hybrid"]).default("hybrid"),
+    auto_sync_interval_minutes: exports_external2.number().default(0),
+    feedback_endpoint: exports_external2.string().default("https://feedback.hasna.com/api/v1/feedback"),
+    sync: exports_external2.object({
+      schedule_minutes: exports_external2.number().default(0)
+    }).default({})
+  });
+  CONFIG_DIR = join22(homedir22(), ".hasna", "cloud");
+  CONFIG_PATH = join22(CONFIG_DIR, "config.json");
+});
+var exports_discover = {};
+__export2(exports_discover, {
+  isSyncExcludedTable: () => isSyncExcludedTable,
+  getServiceDbPath: () => getServiceDbPath,
+  discoverSyncableServices: () => discoverSyncableServices,
+  discoverServices: () => discoverServices,
+  SYNC_EXCLUDED_TABLE_PATTERNS: () => SYNC_EXCLUDED_TABLE_PATTERNS,
+  KNOWN_PG_SERVICES: () => KNOWN_PG_SERVICES
+});
+function isSyncExcludedTable(table) {
+  return SYNC_EXCLUDED_TABLE_PATTERNS.some((p) => p.test(table));
+}
+function discoverServices() {
+  const dataDir = join32(homedir32(), ".hasna");
+  if (!existsSync32(dataDir))
+    return [];
+  try {
+    const entries = readdirSync2(dataDir, { withFileTypes: true });
+    return entries.filter((e) => {
+      if (!e.isDirectory())
+        return false;
+      if (e.name === "cloud" || e.name.startsWith("."))
+        return false;
+      return true;
+    }).map((e) => e.name).sort();
+  } catch {
+    return [];
+  }
+}
+function discoverSyncableServices() {
+  const local = discoverServices();
+  const pgSet = new Set(KNOWN_PG_SERVICES);
+  return local.filter((s) => pgSet.has(s));
+}
+function getServiceDbPath(service) {
+  const dataDir = join32(homedir32(), ".hasna", service);
+  if (!existsSync32(dataDir))
+    return null;
+  const candidates = [
+    join32(dataDir, `${service}.db`),
+    join32(dataDir, "data.db"),
+    join32(dataDir, "database.db")
+  ];
+  try {
+    const files = readdirSync2(dataDir);
+    for (const f of files) {
+      if (f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm")) {
+        candidates.push(join32(dataDir, f));
+      }
+    }
+  } catch {}
+  for (const p of candidates) {
+    if (existsSync32(p))
+      return p;
+  }
+  return null;
+}
+var KNOWN_PG_SERVICES;
+var SYNC_EXCLUDED_TABLE_PATTERNS;
+var init_discover = __esm(() => {
+  KNOWN_PG_SERVICES = [
+    "assistants",
+    "attachments",
+    "brains",
+    "configs",
+    "connectors",
+    "contacts",
+    "context",
+    "conversations",
+    "crawl",
+    "deployment",
+    "economy",
+    "emails",
+    "files",
+    "hooks",
+    "implementations",
+    "logs",
+    "mcps",
+    "mementos",
+    "microservices",
+    "predictor",
+    "prompts",
+    "recordings",
+    "researcher",
+    "sandboxes",
+    "search",
+    "secrets",
+    "sessions",
+    "signatures",
+    "skills",
+    "telephony",
+    "terminal",
+    "testers",
+    "tickets",
+    "todos",
+    "wallets"
+  ];
+  SYNC_EXCLUDED_TABLE_PATTERNS = [
+    /^sqlite_/,
+    /_fts$/,
+    /_fts_/,
+    /^_sync_/,
+    /^_pg_migrations$/
+  ];
+});
+init_adapter();
+init_config();
+init_config();
+init_dotfile();
+
+class SyncProgressTracker {
+  db;
+  progress = new Map;
+  startTimes = new Map;
+  callback;
+  constructor(db, callback) {
+    this.db = db;
+    this.callback = callback;
+    this.ensureResumeTable();
+  }
+  ensureResumeTable() {
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS _sync_resume (
+        table_name TEXT PRIMARY KEY,
+        last_row_id TEXT,
+        direction TEXT,
+        started_at TEXT,
+        status TEXT DEFAULT 'in_progress'
+      )
+    `);
+  }
+  start(table, total, direction) {
+    const resumed = this.canResume(table);
+    const now = Date.now();
+    this.startTimes.set(table, now);
+    const status = resumed ? "resumed" : "in_progress";
+    const info = {
+      table,
+      total,
+      done: 0,
+      percent: 0,
+      elapsed_ms: 0,
+      eta_ms: 0,
+      status
+    };
+    this.progress.set(table, info);
+    this.db.run(`INSERT INTO _sync_resume (table_name, last_row_id, direction, started_at, status)
+       VALUES (?, ?, ?, datetime('now'), ?)
+       ON CONFLICT (table_name) DO UPDATE SET
+         direction = excluded.direction,
+         started_at = datetime('now'),
+         status = excluded.status`, table, "", direction, status);
+    this.notify(table);
+  }
+  update(table, done, lastRowId) {
+    const info = this.progress.get(table);
+    if (!info)
+      return;
+    const startTime = this.startTimes.get(table) ?? Date.now();
+    const elapsed = Date.now() - startTime;
+    const rate = done > 0 ? elapsed / done : 0;
+    const remaining = info.total - done;
+    const eta = remaining > 0 ? Math.round(rate * remaining) : 0;
+    info.done = done;
+    info.percent = info.total > 0 ? Math.round(done / info.total * 100) : 0;
+    info.elapsed_ms = elapsed;
+    info.eta_ms = eta;
+    info.status = "in_progress";
+    this.db.run(`UPDATE _sync_resume SET last_row_id = ?, status = 'in_progress' WHERE table_name = ?`, lastRowId, table);
+    this.notify(table);
+  }
+  markComplete(table) {
+    const info = this.progress.get(table);
+    if (info) {
+      const startTime = this.startTimes.get(table) ?? Date.now();
+      info.elapsed_ms = Date.now() - startTime;
+      info.done = info.total;
+      info.percent = 100;
+      info.eta_ms = 0;
+      info.status = "completed";
+      this.notify(table);
+    }
+    this.db.run(`UPDATE _sync_resume SET status = 'completed' WHERE table_name = ?`, table);
+  }
+  markFailed(table, _error) {
+    const info = this.progress.get(table);
+    if (info) {
+      const startTime = this.startTimes.get(table) ?? Date.now();
+      info.elapsed_ms = Date.now() - startTime;
+      info.status = "failed";
+      this.notify(table);
+    }
+    this.db.run(`UPDATE _sync_resume SET status = 'failed' WHERE table_name = ?`, table);
+  }
+  canResume(table) {
+    const row = this.db.get(`SELECT status FROM _sync_resume WHERE table_name = ?`, table);
+    if (!row)
+      return false;
+    return row.status === "in_progress" || row.status === "resumed";
+  }
+  getResumePoint(table) {
+    const row = this.db.get(`SELECT table_name, last_row_id, direction, started_at, status FROM _sync_resume WHERE table_name = ?`, table);
+    if (!row)
+      return null;
+    if (row.status !== "in_progress" && row.status !== "resumed")
+      return null;
+    return row;
+  }
+  clearResume(table) {
+    this.db.run(`DELETE FROM _sync_resume WHERE table_name = ?`, table);
+    this.progress.delete(table);
+    this.startTimes.delete(table);
+  }
+  getProgress(table) {
+    return this.progress.get(table) ?? null;
+  }
+  getAllProgress() {
+    return Array.from(this.progress.values());
+  }
+  listResumeRecords() {
+    return this.db.all(`SELECT table_name, last_row_id, direction, started_at, status FROM _sync_resume ORDER BY started_at DESC`);
+  }
+  notify(table) {
+    const info = this.progress.get(table);
+    if (info && this.callback) {
+      this.callback({ ...info });
+    }
+  }
+}
+init_adapter();
+init_config();
+init_discover();
+var AUTO_SYNC_CONFIG_PATH = join4(homedir4(), ".hasna", "cloud", "config.json");
+init_config();
+init_adapter();
+init_dotfile();
+init_config();
+var CONFIG_DIR2 = join6(homedir5(), ".hasna", "cloud");
+init_adapter();
+init_config();
+init_discover();
+init_zod();
+init_config();
+init_dotfile();
+init_adapter();
+init_config();
+init_dotfile();
+init_adapter();
+
+// src/db.ts
+var adapter = null;
+function createTables(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS agent_heartbeats (
+      machine_id TEXT NOT NULL,
+      pid INTEGER NOT NULL,
+      status TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY (machine_id, pid)
+    )
+  `);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS setup_runs (
+      id TEXT PRIMARY KEY,
+      machine_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      details_json TEXT NOT NULL DEFAULT '[]',
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    )
+  `);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS sync_runs (
+      id TEXT PRIMARY KEY,
+      machine_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      actions_json TEXT NOT NULL DEFAULT '[]',
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    )
+  `);
+}
+function getAdapter(path = getDbPath()) {
+  if (path === ":memory:") {
+    const memoryAdapter = new SqliteAdapter(path);
+    createTables(memoryAdapter.raw);
+    return memoryAdapter;
+  }
+  if (!adapter) {
+    ensureParentDir(path);
+    adapter = new SqliteAdapter(path);
+    createTables(adapter.raw);
+  }
+  return adapter;
+}
+function getDb(path = getDbPath()) {
+  return getAdapter(path).raw;
+}
+function getLocalMachineId() {
+  return process.env["HASNA_MACHINES_MACHINE_ID"] || hostname2();
+}
+function listHeartbeats(machineId) {
+  const db = getDb();
+  if (machineId) {
+    return db.query(`SELECT machine_id, pid, status, updated_at
+         FROM agent_heartbeats
+         WHERE machine_id = ?
+         ORDER BY updated_at DESC`).all(machineId);
+  }
+  return db.query(`SELECT machine_id, pid, status, updated_at
+       FROM agent_heartbeats
+       ORDER BY updated_at DESC`).all();
+}
+function countRuns(table) {
+  const db = getDb();
+  const row = db.query(`SELECT COUNT(*) as count FROM ${table}`).get();
+  return row.count;
+}
+function recordSetupRun(machineId, status, details) {
+  const db = getDb();
+  const now = new Date().toISOString();
+  db.query(`INSERT INTO setup_runs (id, machine_id, status, details_json, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?)`).run(crypto.randomUUID(), machineId, status, JSON.stringify(details), now, now);
+}
+function recordSyncRun(machineId, status, actions) {
+  const db = getDb();
+  const now = new Date().toISOString();
+  db.query(`INSERT INTO sync_runs (id, machine_id, status, actions_json, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?)`).run(crypto.randomUUID(), machineId, status, JSON.stringify(actions), now, now);
+}
+
+// src/commands/ssh.ts
+import { spawnSync } from "child_process";
+function envReachableHosts() {
+  const raw = process.env["HASNA_MACHINES_REACHABLE_HOSTS"];
+  return new Set((raw || "").split(",").map((value) => value.trim()).filter(Boolean));
+}
+function isReachable(host) {
+  const overrides = envReachableHosts();
+  if (overrides.size > 0) {
+    return overrides.has(host);
+  }
+  const probe = spawnSync("bash", ["-lc", `getent hosts ${host} >/dev/null 2>&1 || ping -c 1 -W 1 ${host} >/dev/null 2>&1`], {
+    stdio: "ignore"
+  });
+  return probe.status === 0;
+}
+function resolveSshTarget(machineId) {
+  const machine = getManifestMachine(machineId);
+  if (!machine) {
+    throw new Error(`Machine not found in manifest: ${machineId}`);
+  }
+  const current = detectCurrentMachineManifest();
+  if (machine.id === current.id) {
+    return {
+      machineId,
+      target: "localhost",
+      route: "local"
+    };
+  }
+  const lanTarget = machine.sshAddress || machine.hostname || machine.id;
+  const tailscaleTarget = machine.tailscaleName || machine.hostname || machine.id;
+  const route = isReachable(lanTarget) ? "lan" : "tailscale";
+  return {
+    machineId,
+    target: route === "lan" ? lanTarget : tailscaleTarget,
+    route
+  };
+}
+function buildSshCommand(machineId, remoteCommand) {
+  const resolved = resolveSshTarget(machineId);
+  return remoteCommand ? `ssh ${resolved.target} ${JSON.stringify(remoteCommand)}` : `ssh ${resolved.target}`;
 }
-var HASNA_DIR;
-var init_dotfile = __esm(() => {
-  HASNA_DIR = join5(homedir4(), ".hasna");
-});
-var exports_config = {};
-__export2(exports_config, {
-  saveCloudConfig: () => saveCloudConfig,
-  getConnectionString: () => getConnectionString,
-  getConfigPath: () => getConfigPath,
-  getConfigDir: () => getConfigDir,
-  getCloudConfig: () => getCloudConfig,
-  createDatabase: () => createDatabase,
-  CloudConfigSchema: () => CloudConfigSchema
-});
-function getConfigDir() {
-  return CONFIG_DIR;
+
+// src/remote.ts
+function runMachineCommand(machineId, command) {
+  const localMachineId = getLocalMachineId();
+  const isLocal = machineId === localMachineId;
+  const route = isLocal ? "local" : resolveSshTarget(machineId).route;
+  const shellCommand = isLocal ? command : buildSshCommand(machineId, command);
+  const result = spawnSync2("bash", ["-lc", shellCommand], {
+    encoding: "utf8",
+    env: process.env
+  });
+  return {
+    machineId,
+    source: route,
+    stdout: result.stdout || "",
+    stderr: result.stderr || "",
+    exitCode: result.status ?? 1
+  };
 }
-function getConfigPath() {
-  return CONFIG_PATH;
+
+// src/commands/apps.ts
+function getPackageName(app) {
+  return app.packageName || app.name;
 }
-function getCloudConfig() {
-  if (!existsSync22(CONFIG_PATH)) {
-    return CloudConfigSchema.parse({});
+function getAppManager(machine, app) {
+  if (app.manager)
+    return app.manager;
+  if (machine.platform === "macos")
+    return "brew";
+  if (machine.platform === "windows")
+    return "winget";
+  return "apt";
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function buildAppCommand(machine, app) {
+  const packageName = getPackageName(app);
+  const manager = getAppManager(machine, app);
+  if (manager === "custom") {
+    return packageName;
   }
-  try {
-    const raw = readFileSync4(CONFIG_PATH, "utf-8");
-    return CloudConfigSchema.parse(JSON.parse(raw));
-  } catch {
-    return CloudConfigSchema.parse({});
+  if (machine.platform === "macos") {
+    if (manager === "cask") {
+      return `brew install --cask ${packageName}`;
+    }
+    return `brew install ${packageName}`;
   }
+  if (machine.platform === "windows") {
+    return `winget install ${packageName}`;
+  }
+  return `sudo apt-get install -y ${packageName}`;
 }
-function saveCloudConfig(config) {
-  mkdirSync22(CONFIG_DIR, { recursive: true });
-  writeFileSync4(CONFIG_PATH, JSON.stringify(config, null, 2) + `
-`, "utf-8");
-}
-function getConnectionString(dbName) {
-  const config = getCloudConfig();
-  const { host, port, username, password_env, ssl } = config.rds;
-  if (!host || !username) {
-    throw new Error("Cloud RDS not configured. Run `cloud setup` to configure.");
+function buildAppProbeCommand(machine, app) {
+  const packageName = shellQuote(getPackageName(app));
+  const manager = getAppManager(machine, app);
+  if (manager === "custom") {
+    return `if command -v ${packageName} >/dev/null 2>&1; then printf 'installed=1\\nversion=custom\\n'; else printf 'installed=0\\n'; fi`;
   }
-  const password = process.env[password_env];
-  if (password === undefined || password === "") {
-    throw new Error(`RDS password not set. Export ${password_env} in your shell or add it to ~/.secrets/hasna/rds/live.env`);
+  if (machine.platform === "macos") {
+    if (manager === "cask") {
+      return `if brew list --cask ${packageName} >/dev/null 2>&1; then printf 'installed=1\\nversion=installed\\n'; else printf 'installed=0\\n'; fi`;
+    }
+    return `if brew list --versions ${packageName} >/dev/null 2>&1; then printf 'installed=1\\nversion='; brew list --versions ${packageName} | awk '{print $2}'; printf '\\n'; else printf 'installed=0\\n'; fi`;
   }
-  const sslParam = ssl ? "?sslmode=require" : "";
-  return `postgres://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbName}${sslParam}`;
+  if (machine.platform === "windows") {
+    return `if winget list --id ${packageName} --exact >/dev/null 2>&1; then printf 'installed=1\\nversion=installed\\n'; else printf 'installed=0\\n'; fi`;
+  }
+  return `if dpkg-query -W -f='${"${Version}"}' ${packageName} >/tmp/machines-app-version 2>/dev/null; then printf 'installed=1\\nversion='; cat /tmp/machines-app-version; printf '\\n'; rm -f /tmp/machines-app-version; else printf 'installed=0\\n'; fi`;
 }
-function createDatabase(options) {
-  const config = getCloudConfig();
-  const mode = options.mode ?? config.mode;
-  if (mode === "cloud") {
-    const connStr = options.pgConnectionString ?? getConnectionString(options.service);
-    return new PgAdapter(connStr);
+function buildAppSteps(machine) {
+  return (machine.apps || []).map((app) => ({
+    id: `app-${app.name}`,
+    title: `Install ${app.name} on ${machine.id}`,
+    command: buildAppCommand(machine, app),
+    manager: getAppManager(machine, app) === "custom" ? "custom" : machine.platform === "macos" ? "brew" : machine.platform === "windows" ? "custom" : "apt",
+    privileged: machine.platform === "linux"
+  }));
+}
+function resolveMachine(machineId) {
+  return (machineId ? getManifestMachine(machineId) : null) || detectCurrentMachineManifest();
+}
+function parseProbeOutput(app, machine, stdout) {
+  const lines = stdout.trim().split(`
+`).filter(Boolean);
+  const installedLine = lines.find((line) => line.startsWith("installed="));
+  const versionLine = lines.find((line) => line.startsWith("version="));
+  return {
+    name: app.name,
+    packageName: getPackageName(app),
+    manager: getAppManager(machine, app),
+    installed: installedLine === "installed=1",
+    version: versionLine?.slice("version=".length) || undefined
+  };
+}
+function listApps(machineId) {
+  const machine = resolveMachine(machineId);
+  return {
+    machineId: machine.id,
+    apps: machine.apps || []
+  };
+}
+function buildAppsPlan(machineId) {
+  const machine = resolveMachine(machineId);
+  return {
+    machineId: machine.id,
+    mode: "plan",
+    steps: buildAppSteps(machine),
+    executed: 0
+  };
+}
+function getAppsStatus(machineId) {
+  const machine = resolveMachine(machineId);
+  const apps = (machine.apps || []).map((app) => {
+    const probe = runMachineCommand(machine.id, buildAppProbeCommand(machine, app));
+    return parseProbeOutput(app, machine, probe.stdout);
+  });
+  return {
+    machineId: machine.id,
+    source: apps.length > 0 ? runMachineCommand(machine.id, "true").source : machine.id === detectCurrentMachineManifest().id ? "local" : runMachineCommand(machine.id, "true").source,
+    apps
+  };
+}
+function diffApps(machineId) {
+  const status = getAppsStatus(machineId);
+  return {
+    ...status,
+    missing: status.apps.filter((app) => !app.installed).map((app) => app.name),
+    installed: status.apps.filter((app) => app.installed).map((app) => app.name)
+  };
+}
+function runAppsInstall(machineId, options = {}) {
+  const plan = buildAppsPlan(machineId);
+  if (!options.apply)
+    return plan;
+  if (!options.yes) {
+    throw new Error("App installation requires --yes.");
   }
-  const dbPath = options.sqlitePath ?? getDbPath2(options.service);
-  return new SqliteAdapter(dbPath);
+  let executed = 0;
+  for (const step of plan.steps) {
+    const result = Bun.spawnSync(["bash", "-lc", step.command], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (result.exitCode !== 0) {
+      throw new Error(`App install failed (${step.id}): ${result.stderr.toString().trim()}`);
+    }
+    executed += 1;
+  }
+  return {
+    machineId: plan.machineId,
+    mode: "apply",
+    steps: plan.steps,
+    executed
+  };
 }
-var CloudConfigSchema;
-var CONFIG_DIR;
-var CONFIG_PATH;
-var init_config = __esm(() => {
-  init_zod();
-  init_adapter();
-  init_dotfile();
-  CloudConfigSchema = exports_external2.object({
-    rds: exports_external2.object({
-      host: exports_external2.string().default(""),
-      port: exports_external2.number().default(5432),
-      username: exports_external2.string().default(""),
-      password_env: exports_external2.string().default("HASNA_RDS_PASSWORD"),
-      ssl: exports_external2.boolean().default(true)
-    }).default({}),
-    mode: exports_external2.enum(["local", "cloud", "hybrid"]).default("hybrid"),
-    auto_sync_interval_minutes: exports_external2.number().default(0),
-    feedback_endpoint: exports_external2.string().default("https://feedback.hasna.com/api/v1/feedback"),
-    sync: exports_external2.object({
-      schedule_minutes: exports_external2.number().default(0)
-    }).default({})
+
+// src/commands/cert.ts
+import { homedir as homedir6, platform as platform3 } from "os";
+import { join as join5 } from "path";
+function quote2(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function certDir() {
+  return join5(homedir6(), ".hasna", "machines", "certs");
+}
+function buildCertPlan(domains) {
+  if (domains.length === 0) {
+    throw new Error("At least one domain is required.");
+  }
+  const primary = domains[0];
+  const certPath = join5(certDir(), `${primary}.pem`);
+  const keyPath = join5(certDir(), `${primary}-key.pem`);
+  const steps = [];
+  if (platform3() === "darwin") {
+    steps.push({
+      id: "mkcert-install-macos",
+      title: "Install mkcert on macOS",
+      command: "brew install mkcert nss",
+      manager: "brew"
+    });
+  } else {
+    steps.push({
+      id: "mkcert-install-linux",
+      title: "Install mkcert on Linux",
+      command: "sudo apt-get update && sudo apt-get install -y mkcert libnss3-tools",
+      manager: "apt",
+      privileged: true
+    });
+  }
+  steps.push({
+    id: "mkcert-local-ca",
+    title: "Install local mkcert CA",
+    command: "mkcert -install",
+    manager: "custom"
+  }, {
+    id: "mkcert-issue",
+    title: `Issue certificate for ${domains.join(", ")}`,
+    command: `mkdir -p ${quote2(certDir())} && mkcert -cert-file ${quote2(certPath)} -key-file ${quote2(keyPath)} ${domains.map((domain) => quote2(domain)).join(" ")}`,
+    manager: "custom"
   });
-  CONFIG_DIR = join22(homedir22(), ".hasna", "cloud");
-  CONFIG_PATH = join22(CONFIG_DIR, "config.json");
-});
-var exports_discover = {};
-__export2(exports_discover, {
-  isSyncExcludedTable: () => isSyncExcludedTable,
-  getServiceDbPath: () => getServiceDbPath,
-  discoverSyncableServices: () => discoverSyncableServices,
-  discoverServices: () => discoverServices,
-  SYNC_EXCLUDED_TABLE_PATTERNS: () => SYNC_EXCLUDED_TABLE_PATTERNS,
-  KNOWN_PG_SERVICES: () => KNOWN_PG_SERVICES
-});
-function isSyncExcludedTable(table) {
-  return SYNC_EXCLUDED_TABLE_PATTERNS.some((p) => p.test(table));
+  return {
+    machineId: process.env["HASNA_MACHINES_MACHINE_ID"] || "local",
+    mode: "plan",
+    steps,
+    executed: 0
+  };
+}
+function runCertPlan(domains, options = {}) {
+  const plan = buildCertPlan(domains);
+  if (!options.apply)
+    return plan;
+  if (!options.yes) {
+    throw new Error("Certificate generation requires --yes.");
+  }
+  let executed = 0;
+  for (const step of plan.steps) {
+    const result = Bun.spawnSync(["bash", "-lc", step.command], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (result.exitCode !== 0) {
+      throw new Error(`Certificate step failed (${step.id}): ${result.stderr.toString().trim()}`);
+    }
+    executed += 1;
+  }
+  return {
+    machineId: plan.machineId,
+    mode: "apply",
+    steps: plan.steps,
+    executed
+  };
+}
+
+// src/commands/dns.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join7 } from "path";
+function getDnsPath() {
+  return join7(getDataDir(), "dns.json");
 }
-function discoverServices() {
-  const dataDir = join32(homedir32(), ".hasna");
-  if (!existsSync32(dataDir))
-    return [];
-  try {
-    const entries = readdirSync2(dataDir, { withFileTypes: true });
-    return entries.filter((e) => {
-      if (!e.isDirectory())
-        return false;
-      if (e.name === "cloud" || e.name.startsWith("."))
-        return false;
-      return true;
-    }).map((e) => e.name).sort();
-  } catch {
+function readMappings() {
+  const path = getDnsPath();
+  if (!existsSync4(path))
     return [];
-  }
+  return JSON.parse(readFileSync3(path, "utf8"));
 }
-function discoverSyncableServices() {
-  const local = discoverServices();
-  const pgSet = new Set(KNOWN_PG_SERVICES);
-  return local.filter((s) => pgSet.has(s));
+function writeMappings(mappings) {
+  const path = getDnsPath();
+  ensureParentDir(path);
+  writeFileSync3(path, `${JSON.stringify(mappings, null, 2)}
+`, "utf8");
+  return path;
 }
-function getServiceDbPath(service) {
-  const dataDir = join32(homedir32(), ".hasna", service);
-  if (!existsSync32(dataDir))
-    return null;
-  const candidates = [
-    join32(dataDir, `${service}.db`),
-    join32(dataDir, "data.db"),
-    join32(dataDir, "database.db")
-  ];
-  try {
-    const files = readdirSync2(dataDir);
-    for (const f of files) {
-      if (f.endsWith(".db") && !f.endsWith("-wal") && !f.endsWith("-shm")) {
-        candidates.push(join32(dataDir, f));
-      }
-    }
-  } catch {}
-  for (const p of candidates) {
-    if (existsSync32(p))
-      return p;
+function addDomainMapping(domain, port, targetHost = "127.0.0.1") {
+  const mappings = readMappings().filter((entry) => entry.domain !== domain);
+  mappings.push({ domain, port, targetHost });
+  writeMappings(mappings);
+  return mappings.sort((left, right) => left.domain.localeCompare(right.domain));
+}
+function listDomainMappings() {
+  return readMappings().sort((left, right) => left.domain.localeCompare(right.domain));
+}
+function renderDomainMapping(domain) {
+  const entry = readMappings().find((mapping) => mapping.domain === domain);
+  if (!entry) {
+    throw new Error(`Domain mapping not found: ${domain}`);
   }
-  return null;
+  return {
+    hostsEntry: `${entry.targetHost} ${entry.domain}`,
+    caddySnippet: `${entry.domain} {
+  reverse_proxy 127.0.0.1:${entry.port}
+  tls ${join7(getDataDir(), "certs", `${entry.domain}.pem`)} ${join7(getDataDir(), "certs", `${entry.domain}-key.pem`)}
+}`,
+    certPath: join7(getDataDir(), "certs", `${entry.domain}.pem`),
+    keyPath: join7(getDataDir(), "certs", `${entry.domain}-key.pem`)
+  };
 }
-var KNOWN_PG_SERVICES;
-var SYNC_EXCLUDED_TABLE_PATTERNS;
-var init_discover = __esm(() => {
-  KNOWN_PG_SERVICES = [
-    "assistants",
-    "attachments",
-    "brains",
-    "configs",
-    "connectors",
-    "contacts",
-    "context",
-    "conversations",
-    "crawl",
-    "deployment",
-    "economy",
-    "emails",
-    "files",
-    "hooks",
-    "implementations",
-    "logs",
-    "mcps",
-    "mementos",
-    "microservices",
-    "predictor",
-    "prompts",
-    "recordings",
-    "researcher",
-    "sandboxes",
-    "search",
-    "secrets",
-    "sessions",
-    "signatures",
-    "skills",
-    "telephony",
-    "terminal",
-    "testers",
-    "tickets",
-    "todos",
-    "wallets"
-  ];
-  SYNC_EXCLUDED_TABLE_PATTERNS = [
-    /^sqlite_/,
-    /_fts$/,
-    /_fts_/,
-    /^_sync_/,
-    /^_pg_migrations$/
-  ];
-});
-init_adapter();
-init_config();
-init_config();
-init_dotfile();
 
-class SyncProgressTracker {
-  db;
-  progress = new Map;
-  startTimes = new Map;
-  callback;
-  constructor(db, callback) {
-    this.db = db;
-    this.callback = callback;
-    this.ensureResumeTable();
+// src/commands/diff.ts
+function packageNames(machine) {
+  return (machine.packages || []).map((pkg) => pkg.name).sort();
+}
+function fileTargets(machine) {
+  return (machine.files || []).map((file) => `${file.source}->${file.target}`).sort();
+}
+function diffMachines(leftMachineId, rightMachineId) {
+  const left = getManifestMachine(leftMachineId);
+  if (!left) {
+    throw new Error(`Machine not found in manifest: ${leftMachineId}`);
   }
-  ensureResumeTable() {
-    this.db.exec(`
-      CREATE TABLE IF NOT EXISTS _sync_resume (
-        table_name TEXT PRIMARY KEY,
-        last_row_id TEXT,
-        direction TEXT,
-        started_at TEXT,
-        status TEXT DEFAULT 'in_progress'
-      )
-    `);
+  const right = rightMachineId ? getManifestMachine(rightMachineId) : detectCurrentMachineManifest();
+  if (!right) {
+    throw new Error(`Machine not found in manifest: ${rightMachineId}`);
   }
-  start(table, total, direction) {
-    const resumed = this.canResume(table);
-    const now = Date.now();
-    this.startTimes.set(table, now);
-    const status = resumed ? "resumed" : "in_progress";
-    const info = {
-      table,
-      total,
-      done: 0,
-      percent: 0,
-      elapsed_ms: 0,
-      eta_ms: 0,
-      status
-    };
-    this.progress.set(table, info);
-    this.db.run(`INSERT INTO _sync_resume (table_name, last_row_id, direction, started_at, status)
-       VALUES (?, ?, ?, datetime('now'), ?)
-       ON CONFLICT (table_name) DO UPDATE SET
-         direction = excluded.direction,
-         started_at = datetime('now'),
-         status = excluded.status`, table, "", direction, status);
-    this.notify(table);
+  const changedFields = [
+    left.platform !== right.platform ? "platform" : null,
+    left.connection !== right.connection ? "connection" : null,
+    left.workspacePath !== right.workspacePath ? "workspacePath" : null,
+    left.bunPath !== right.bunPath ? "bunPath" : null
+  ].filter(Boolean);
+  const leftPackages = new Set(packageNames(left));
+  const rightPackages = new Set(packageNames(right));
+  const leftFiles = new Set(fileTargets(left));
+  const rightFiles = new Set(fileTargets(right));
+  return {
+    leftMachineId: left.id,
+    rightMachineId: right.id,
+    changedFields,
+    missingPackages: {
+      leftOnly: [...leftPackages].filter((pkg) => !rightPackages.has(pkg)),
+      rightOnly: [...rightPackages].filter((pkg) => !leftPackages.has(pkg))
+    },
+    missingFiles: {
+      leftOnly: [...leftFiles].filter((file) => !rightFiles.has(file)),
+      rightOnly: [...rightFiles].filter((file) => !leftFiles.has(file))
+    }
+  };
+}
+
+// src/commands/doctor.ts
+function makeCheck(id, status, summary, detail) {
+  return { id, status, summary, detail };
+}
+function parseKeyValueOutput(stdout) {
+  return Object.fromEntries(stdout.trim().split(`
+`).map((line) => line.split("=")).filter((parts) => parts.length === 2).map(([key, value]) => [key, value]));
+}
+function buildDoctorCommand() {
+  return [
+    'data_dir="${HASNA_MACHINES_DIR:-$HOME/.hasna/machines}"',
+    'manifest_path="${HASNA_MACHINES_MANIFEST_PATH:-$data_dir/machines.json}"',
+    'db_path="${HASNA_MACHINES_DB_PATH:-$data_dir/machines.db}"',
+    'notifications_path="${HASNA_MACHINES_NOTIFICATIONS_PATH:-$data_dir/notifications.json}"',
+    `printf 'manifest_path=%s\\n' "$manifest_path"`,
+    `printf 'db_path=%s\\n' "$db_path"`,
+    `printf 'notifications_path=%s\\n' "$notifications_path"`,
+    `printf 'manifest_exists=%s\\n' "$(test -e "$manifest_path" && printf yes || printf no)"`,
+    `printf 'db_exists=%s\\n' "$(test -e "$db_path" && printf yes || printf no)"`,
+    `printf 'notifications_exists=%s\\n' "$(test -e "$notifications_path" && printf yes || printf no)"`,
+    `printf 'bun=%s\\n' "$(bun --version 2>/dev/null || printf missing)"`,
+    `printf 'ssh=%s\\n' "$(command -v ssh >/dev/null 2>&1 && printf ok || printf missing)"`,
+    `printf 'machines=%s\\n' "$(command -v machines 2>/dev/null || printf missing)"`,
+    `printf 'machines_agent=%s\\n' "$(command -v machines-agent 2>/dev/null || printf missing)"`,
+    `printf 'machines_mcp=%s\\n' "$(command -v machines-mcp 2>/dev/null || printf missing)"`
+  ].join("; ");
+}
+function runDoctor(machineId = getLocalMachineId()) {
+  const manifest = readManifest();
+  const commandChecks = runMachineCommand(machineId, buildDoctorCommand());
+  const details = parseKeyValueOutput(commandChecks.stdout);
+  const machineInManifest = manifest.machines.find((machine) => machine.id === machineId);
+  const checks = [
+    makeCheck("manifest-entry", machineInManifest ? "ok" : "warn", machineInManifest ? "Machine exists in manifest" : "Machine missing from manifest", machineInManifest ? JSON.stringify(machineInManifest) : `No manifest entry for ${machineId}`),
+    makeCheck("manifest-path", details["manifest_exists"] === "yes" ? "ok" : "warn", "Manifest path check", `${details["manifest_path"] || "unknown"} ${details["manifest_exists"] === "yes" ? "exists" : "missing"}`),
+    makeCheck("db-path", details["db_exists"] === "yes" ? "ok" : "warn", "DB path check", `${details["db_path"] || "unknown"} ${details["db_exists"] === "yes" ? "exists" : "missing"}`),
+    makeCheck("notifications-path", details["notifications_exists"] === "yes" ? "ok" : "warn", "Notifications path check", `${details["notifications_path"] || "unknown"} ${details["notifications_exists"] === "yes" ? "exists" : "missing"}`),
+    makeCheck("bun", details["bun"] && details["bun"] !== "missing" ? "ok" : "fail", "Bun availability", details["bun"] || "missing"),
+    makeCheck("machines-cli", details["machines"] && details["machines"] !== "missing" ? "ok" : "warn", "machines CLI availability", details["machines"] || "missing"),
+    makeCheck("machines-agent-cli", details["machines_agent"] && details["machines_agent"] !== "missing" ? "ok" : "warn", "machines-agent availability", details["machines_agent"] || "missing"),
+    makeCheck("machines-mcp-cli", details["machines_mcp"] && details["machines_mcp"] !== "missing" ? "ok" : "warn", "machines-mcp availability", details["machines_mcp"] || "missing"),
+    makeCheck("ssh", details["ssh"] === "ok" ? "ok" : "warn", "SSH availability", details["ssh"] || "missing")
+  ];
+  return {
+    machineId,
+    source: commandChecks.source,
+    manifestPath: details["manifest_path"],
+    dbPath: details["db_path"],
+    notificationsPath: details["notifications_path"],
+    checks
+  };
+}
+
+// src/commands/install-claude.ts
+var AI_CLI_PACKAGES = {
+  claude: "@anthropic-ai/claude-code",
+  codex: "@openai/codex",
+  gemini: "@google/gemini-cli"
+};
+function getToolBinary(tool) {
+  if (tool === "claude")
+    return process.env["HASNA_MACHINES_CLAUDE_BINARY"] || "claude";
+  if (tool === "codex")
+    return process.env["HASNA_MACHINES_CODEX_BINARY"] || "codex";
+  return process.env["HASNA_MACHINES_GEMINI_BINARY"] || "gemini";
+}
+function normalizeTools(tools) {
+  if (!tools || tools.length === 0) {
+    return ["claude", "codex", "gemini"];
   }
-  update(table, done, lastRowId) {
-    const info = this.progress.get(table);
-    if (!info)
-      return;
-    const startTime = this.startTimes.get(table) ?? Date.now();
-    const elapsed = Date.now() - startTime;
-    const rate = done > 0 ? elapsed / done : 0;
-    const remaining = info.total - done;
-    const eta = remaining > 0 ? Math.round(rate * remaining) : 0;
-    info.done = done;
-    info.percent = info.total > 0 ? Math.round(done / info.total * 100) : 0;
-    info.elapsed_ms = elapsed;
-    info.eta_ms = eta;
-    info.status = "in_progress";
-    this.db.run(`UPDATE _sync_resume SET last_row_id = ?, status = 'in_progress' WHERE table_name = ?`, lastRowId, table);
-    this.notify(table);
+  return [...new Set(tools)].map((tool) => {
+    if (!(tool in AI_CLI_PACKAGES)) {
+      throw new Error(`Unsupported AI CLI tool: ${tool}`);
+    }
+    return tool;
+  });
+}
+function buildInstallSteps(machine, tools) {
+  return normalizeTools(tools).map((tool) => ({
+    id: `install-${tool}`,
+    title: `Install or update ${tool} CLI on ${machine.id}`,
+    command: `bun install -g ${AI_CLI_PACKAGES[tool]}`,
+    manager: "bun"
+  }));
+}
+function resolveMachine2(machineId) {
+  return (machineId ? getManifestMachine(machineId) : null) || detectCurrentMachineManifest();
+}
+function buildProbeCommand(tool) {
+  const binary = getToolBinary(tool);
+  return `if command -v ${binary} >/dev/null 2>&1; then printf 'installed=1\\nversion='; ${binary} --version 2>/dev/null | head -n 1; printf '\\n'; else printf 'installed=0\\n'; fi`;
+}
+function parseProbe(tool, stdout) {
+  const lines = stdout.trim().split(`
+`).filter(Boolean);
+  const installedLine = lines.find((line) => line.startsWith("installed="));
+  const versionLine = lines.find((line) => line.startsWith("version="));
+  return {
+    tool,
+    packageName: AI_CLI_PACKAGES[tool],
+    installed: installedLine === "installed=1",
+    version: versionLine?.slice("version=".length) || undefined
+  };
+}
+function buildClaudeInstallPlan(machineId, tools) {
+  const machine = resolveMachine2(machineId);
+  return {
+    machineId: machine.id,
+    mode: "plan",
+    steps: buildInstallSteps(machine, tools),
+    executed: 0
+  };
+}
+function getClaudeCliStatus(machineId, tools) {
+  const machine = resolveMachine2(machineId);
+  const normalizedTools = normalizeTools(tools);
+  const route = runMachineCommand(machine.id, "true").source;
+  return {
+    machineId: machine.id,
+    source: route,
+    tools: normalizedTools.map((tool) => parseProbe(tool, runMachineCommand(machine.id, buildProbeCommand(tool)).stdout))
+  };
+}
+function diffClaudeCli(machineId, tools) {
+  const status = getClaudeCliStatus(machineId, tools);
+  return {
+    ...status,
+    missing: status.tools.filter((tool) => !tool.installed).map((tool) => tool.tool),
+    installed: status.tools.filter((tool) => tool.installed).map((tool) => tool.tool)
+  };
+}
+function runClaudeInstall(machineId, tools, options = {}) {
+  const plan = buildClaudeInstallPlan(machineId, tools);
+  if (!options.apply)
+    return plan;
+  if (!options.yes) {
+    throw new Error("Claude CLI installation requires --yes.");
   }
-  markComplete(table) {
-    const info = this.progress.get(table);
-    if (info) {
-      const startTime = this.startTimes.get(table) ?? Date.now();
-      info.elapsed_ms = Date.now() - startTime;
-      info.done = info.total;
-      info.percent = 100;
-      info.eta_ms = 0;
-      info.status = "completed";
-      this.notify(table);
+  let executed = 0;
+  for (const step of plan.steps) {
+    const result = Bun.spawnSync(["bash", "-lc", step.command], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (result.exitCode !== 0) {
+      throw new Error(`AI CLI install failed (${step.id}): ${result.stderr.toString().trim()}`);
     }
-    this.db.run(`UPDATE _sync_resume SET status = 'completed' WHERE table_name = ?`, table);
+    executed += 1;
   }
-  markFailed(table, _error) {
-    const info = this.progress.get(table);
-    if (info) {
-      const startTime = this.startTimes.get(table) ?? Date.now();
-      info.elapsed_ms = Date.now() - startTime;
-      info.status = "failed";
-      this.notify(table);
-    }
-    this.db.run(`UPDATE _sync_resume SET status = 'failed' WHERE table_name = ?`, table);
+  return {
+    machineId: plan.machineId,
+    mode: "apply",
+    steps: plan.steps,
+    executed
+  };
+}
+
+// src/commands/install-tailscale.ts
+function buildInstallSteps2(machine) {
+  if (machine.platform === "macos") {
+    return [
+      {
+        id: "tailscale-brew",
+        title: "Install Tailscale via Homebrew",
+        command: "brew install --cask tailscale",
+        manager: "brew"
+      }
+    ];
   }
-  canResume(table) {
-    const row = this.db.get(`SELECT status FROM _sync_resume WHERE table_name = ?`, table);
-    if (!row)
-      return false;
-    return row.status === "in_progress" || row.status === "resumed";
+  if (machine.platform === "windows") {
+    return [
+      {
+        id: "tailscale-winget",
+        title: "Install Tailscale via winget",
+        command: "winget install Tailscale.Tailscale",
+        manager: "custom"
+      }
+    ];
   }
-  getResumePoint(table) {
-    const row = this.db.get(`SELECT table_name, last_row_id, direction, started_at, status FROM _sync_resume WHERE table_name = ?`, table);
-    if (!row)
-      return null;
-    if (row.status !== "in_progress" && row.status !== "resumed")
-      return null;
-    return row;
+  return [
+    {
+      id: "tailscale-linux",
+      title: "Install Tailscale on Linux",
+      command: "curl -fsSL https://tailscale.com/install.sh | sh",
+      manager: "custom",
+      privileged: true
+    }
+  ];
+}
+function buildTailscaleInstallPlan(machineId) {
+  const machine = (machineId ? getManifestMachine(machineId) : null) || detectCurrentMachineManifest();
+  return {
+    machineId: machine.id,
+    mode: "plan",
+    steps: buildInstallSteps2(machine),
+    executed: 0
+  };
+}
+function runTailscaleInstall(machineId, options = {}) {
+  const plan = buildTailscaleInstallPlan(machineId);
+  if (!options.apply)
+    return plan;
+  if (!options.yes) {
+    throw new Error("Tailscale install requires --yes.");
   }
-  clearResume(table) {
-    this.db.run(`DELETE FROM _sync_resume WHERE table_name = ?`, table);
-    this.progress.delete(table);
-    this.startTimes.delete(table);
+  let executed = 0;
+  for (const step of plan.steps) {
+    const result = Bun.spawnSync(["bash", "-lc", step.command], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (result.exitCode !== 0) {
+      throw new Error(`Tailscale install failed (${step.id}): ${result.stderr.toString().trim()}`);
+    }
+    executed += 1;
   }
-  getProgress(table) {
-    return this.progress.get(table) ?? null;
+  return {
+    machineId: plan.machineId,
+    mode: "apply",
+    steps: plan.steps,
+    executed
+  };
+}
+
+// src/commands/notifications.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+var notificationChannelSchema = exports_external.object({
+  id: exports_external.string(),
+  type: exports_external.enum(["email", "webhook", "command"]),
+  target: exports_external.string(),
+  events: exports_external.array(exports_external.string()),
+  enabled: exports_external.boolean()
+});
+var notificationConfigSchema = exports_external.object({
+  version: exports_external.literal(1),
+  updatedAt: exports_external.string().optional(),
+  channels: exports_external.array(notificationChannelSchema)
+});
+function sortChannels(channels) {
+  return [...channels].sort((left, right) => left.id.localeCompare(right.id));
+}
+function shellQuote2(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function hasCommand(binary) {
+  const result = Bun.spawnSync(["bash", "-lc", `command -v ${binary} >/dev/null 2>&1`], {
+    stdout: "ignore",
+    stderr: "ignore",
+    env: process.env
+  });
+  return result.exitCode === 0;
+}
+function buildNotificationPreview(channel, event, message) {
+  if (channel.type === "email") {
+    return `send email to ${channel.target}: [${event}] ${message}`;
   }
-  getAllProgress() {
-    return Array.from(this.progress.values());
+  if (channel.type === "webhook") {
+    return `POST ${channel.target} with payload {"event":"${event}","message":"${message}"}`;
   }
-  listResumeRecords() {
-    return this.db.all(`SELECT table_name, last_row_id, direction, started_at, status FROM _sync_resume ORDER BY started_at DESC`);
+  return `${channel.target} --event ${event} --message ${JSON.stringify(message)}`;
+}
+async function dispatchEmail(channel, event, message) {
+  const subject = `[${event}] machines notification`;
+  const body = `To: ${channel.target}
+Subject: ${subject}
+Content-Type: text/plain; charset=utf-8
+
+${message}
+`;
+  if (hasCommand("sendmail")) {
+    const result = Bun.spawnSync(["bash", "-lc", "sendmail -t"], {
+      stdin: new TextEncoder().encode(body),
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (result.exitCode !== 0) {
+      throw new Error(result.stderr.toString().trim() || `sendmail exited with ${result.exitCode}`);
+    }
+    return {
+      channelId: channel.id,
+      event,
+      delivered: true,
+      transport: channel.type,
+      detail: `Delivered via sendmail to ${channel.target}`
+    };
   }
-  notify(table) {
-    const info = this.progress.get(table);
-    if (info && this.callback) {
-      this.callback({ ...info });
+  if (hasCommand("mail")) {
+    const command = `printf %s ${shellQuote2(message)} | mail -s ${shellQuote2(subject)} ${shellQuote2(channel.target)}`;
+    const result = Bun.spawnSync(["bash", "-lc", command], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (result.exitCode !== 0) {
+      throw new Error(result.stderr.toString().trim() || `mail exited with ${result.exitCode}`);
     }
+    return {
+      channelId: channel.id,
+      event,
+      delivered: true,
+      transport: channel.type,
+      detail: `Delivered via mail to ${channel.target}`
+    };
   }
+  throw new Error("No local email transport available. Install sendmail or mail.");
 }
-init_adapter();
-init_config();
-init_discover();
-var AUTO_SYNC_CONFIG_PATH = join42(homedir42(), ".hasna", "cloud", "config.json");
-init_config();
-init_adapter();
-init_dotfile();
-init_config();
-var CONFIG_DIR2 = join6(homedir5(), ".hasna", "cloud");
-init_adapter();
-init_config();
-init_discover();
-init_zod();
-init_config();
-init_dotfile();
-init_adapter();
-init_config();
-init_dotfile();
-init_adapter();
-
-// src/db.ts
-var adapter = null;
-function createTables(db) {
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS agent_heartbeats (
-      machine_id TEXT NOT NULL,
-      pid INTEGER NOT NULL,
-      status TEXT NOT NULL,
-      updated_at TEXT NOT NULL,
-      PRIMARY KEY (machine_id, pid)
-    )
-  `);
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS setup_runs (
-      id TEXT PRIMARY KEY,
-      machine_id TEXT NOT NULL,
-      status TEXT NOT NULL,
-      details_json TEXT NOT NULL DEFAULT '[]',
-      created_at TEXT NOT NULL,
-      updated_at TEXT NOT NULL
-    )
-  `);
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS sync_runs (
-      id TEXT PRIMARY KEY,
-      machine_id TEXT NOT NULL,
-      status TEXT NOT NULL,
-      actions_json TEXT NOT NULL DEFAULT '[]',
-      created_at TEXT NOT NULL,
-      updated_at TEXT NOT NULL
-    )
-  `);
-}
-function getAdapter(path = getDbPath()) {
-  if (path === ":memory:") {
-    const memoryAdapter = new SqliteAdapter(path);
-    createTables(memoryAdapter.raw);
-    return memoryAdapter;
-  }
-  if (!adapter) {
-    ensureParentDir(path);
-    adapter = new SqliteAdapter(path);
-    createTables(adapter.raw);
+async function dispatchWebhook(channel, event, message) {
+  const response = await fetch(channel.target, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      channelId: channel.id,
+      event,
+      message,
+      sentAt: new Date().toISOString()
+    })
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Webhook responded ${response.status}: ${text || response.statusText}`);
   }
-  return adapter;
+  return {
+    channelId: channel.id,
+    event,
+    delivered: true,
+    transport: channel.type,
+    detail: `Webhook accepted with HTTP ${response.status}`
+  };
+}
+async function dispatchCommand(channel, event, message) {
+  const result = Bun.spawnSync(["bash", "-lc", channel.target], {
+    stdout: "pipe",
+    stderr: "pipe",
+    env: {
+      ...process.env,
+      HASNA_MACHINES_NOTIFICATION_CHANNEL: channel.id,
+      HASNA_MACHINES_NOTIFICATION_EVENT: event,
+      HASNA_MACHINES_NOTIFICATION_MESSAGE: message
+    }
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(result.stderr.toString().trim() || `command exited with ${result.exitCode}`);
+  }
+  const stdout = result.stdout.toString().trim();
+  return {
+    channelId: channel.id,
+    event,
+    delivered: true,
+    transport: channel.type,
+    detail: stdout || "Command completed successfully"
+  };
 }
-function getDb(path = getDbPath()) {
-  return getAdapter(path).raw;
+async function dispatchChannel(channel, event, message) {
+  if (!channel.enabled) {
+    return {
+      channelId: channel.id,
+      event,
+      delivered: false,
+      transport: channel.type,
+      detail: "Channel is disabled"
+    };
+  }
+  if (channel.type === "email") {
+    return dispatchEmail(channel, event, message);
+  }
+  if (channel.type === "webhook") {
+    return dispatchWebhook(channel, event, message);
+  }
+  return dispatchCommand(channel, event, message);
 }
-function getLocalMachineId() {
-  return process.env["HASNA_MACHINES_MACHINE_ID"] || hostname2();
+function getDefaultNotificationConfig() {
+  return {
+    version: 1,
+    updatedAt: new Date().toISOString(),
+    channels: []
+  };
 }
-function listHeartbeats(machineId) {
-  const db = getDb();
-  if (machineId) {
-    return db.query(`SELECT machine_id, pid, status, updated_at
-         FROM agent_heartbeats
-         WHERE machine_id = ?
-         ORDER BY updated_at DESC`).all(machineId);
+function readNotificationConfig(path = getNotificationsPath()) {
+  if (!existsSync5(path)) {
+    return getDefaultNotificationConfig();
   }
-  return db.query(`SELECT machine_id, pid, status, updated_at
-       FROM agent_heartbeats
-       ORDER BY updated_at DESC`).all();
+  return notificationConfigSchema.parse(JSON.parse(readFileSync4(path, "utf8")));
 }
-function countRuns(table) {
-  const db = getDb();
-  const row = db.query(`SELECT COUNT(*) as count FROM ${table}`).get();
-  return row.count;
+function writeNotificationConfig(config, path = getNotificationsPath()) {
+  ensureParentDir(path);
+  const nextConfig = {
+    version: 1,
+    updatedAt: new Date().toISOString(),
+    channels: sortChannels(config.channels)
+  };
+  writeFileSync4(path, `${JSON.stringify(nextConfig, null, 2)}
+`, "utf8");
+  return nextConfig;
 }
-function recordSetupRun(machineId, status, details) {
-  const db = getDb();
-  const now = new Date().toISOString();
-  db.query(`INSERT INTO setup_runs (id, machine_id, status, details_json, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?)`).run(crypto.randomUUID(), machineId, status, JSON.stringify(details), now, now);
+function listNotificationChannels() {
+  return readNotificationConfig();
 }
-function recordSyncRun(machineId, status, actions) {
-  const db = getDb();
-  const now = new Date().toISOString();
-  db.query(`INSERT INTO sync_runs (id, machine_id, status, actions_json, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?)`).run(crypto.randomUUID(), machineId, status, JSON.stringify(actions), now, now);
+function addNotificationChannel(channel) {
+  const config = readNotificationConfig();
+  const channels = config.channels.filter((entry) => entry.id !== channel.id);
+  channels.push({
+    ...channel,
+    events: [...new Set(channel.events)]
+  });
+  return writeNotificationConfig({ ...config, channels });
 }
-
-// src/commands/ssh.ts
-import { spawnSync } from "child_process";
-function envReachableHosts() {
-  const raw = process.env["HASNA_MACHINES_REACHABLE_HOSTS"];
-  return new Set((raw || "").split(",").map((value) => value.trim()).filter(Boolean));
+function removeNotificationChannel(channelId) {
+  const config = readNotificationConfig();
+  return writeNotificationConfig({
+    ...config,
+    channels: config.channels.filter((channel) => channel.id !== channelId)
+  });
 }
-function isReachable(host) {
-  const overrides = envReachableHosts();
-  if (overrides.size > 0) {
-    return overrides.has(host);
-  }
-  const probe = spawnSync("bash", ["-lc", `getent hosts ${host} >/dev/null 2>&1 || ping -c 1 -W 1 ${host} >/dev/null 2>&1`], {
-    stdio: "ignore"
+async function dispatchNotificationEvent(event, message, options = {}) {
+  const channels = readNotificationConfig().channels.filter((channel) => {
+    if (options.channelId && channel.id !== options.channelId) {
+      return false;
+    }
+    return channel.events.includes(event) || event === "manual.test";
   });
-  return probe.status === 0;
+  const deliveries = [];
+  for (const channel of channels) {
+    try {
+      deliveries.push(await dispatchChannel(channel, event, message));
+    } catch (error) {
+      deliveries.push({
+        channelId: channel.id,
+        event,
+        delivered: false,
+        transport: channel.type,
+        detail: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return {
+    event,
+    message,
+    deliveries
+  };
 }
-function resolveSshTarget(machineId) {
-  const machine = getManifestMachine(machineId);
-  if (!machine) {
-    throw new Error(`Machine not found in manifest: ${machineId}`);
+async function testNotificationChannel(channelId, event = "manual.test", message = "machines notification test", options = {}) {
+  const channel = readNotificationConfig().channels.find((entry) => entry.id === channelId);
+  if (!channel) {
+    throw new Error(`Notification channel not found: ${channelId}`);
   }
-  const current = detectCurrentMachineManifest();
-  if (machine.id === current.id) {
+  const preview = buildNotificationPreview(channel, event, message);
+  if (!options.apply) {
     return {
-      machineId,
-      target: "localhost",
-      route: "local"
+      channelId,
+      mode: "plan",
+      delivered: false,
+      preview,
+      detail: "Preview only"
     };
   }
-  const lanTarget = machine.sshAddress || machine.hostname || machine.id;
-  const tailscaleTarget = machine.tailscaleName || machine.hostname || machine.id;
-  const route = isReachable(lanTarget) ? "lan" : "tailscale";
+  if (!options.yes) {
+    throw new Error("Notification test execution requires --yes.");
+  }
+  const delivery = await dispatchChannel(channel, event, message);
   return {
-    machineId,
-    target: route === "lan" ? lanTarget : tailscaleTarget,
-    route
+    channelId,
+    mode: "apply",
+    delivered: delivery.delivered,
+    preview,
+    detail: delivery.detail
   };
 }
-function buildSshCommand(machineId, remoteCommand) {
-  const resolved = resolveSshTarget(machineId);
-  return remoteCommand ? `ssh ${resolved.target} ${JSON.stringify(remoteCommand)}` : `ssh ${resolved.target}`;
-}
 
 // src/commands/ports.ts
+import { spawnSync as spawnSync3 } from "child_process";
 function parseSsOutput(output) {
   return output.trim().split(`
 `).map((line) => line.trim()).filter(Boolean).map((line) => {
@@ -14366,7 +14689,7 @@ function listPorts(machineId) {
   const isLocal = targetMachineId === getLocalMachineId();
   const localCommand = "if command -v ss >/dev/null 2>&1; then ss -ltnpH; else lsof -nP -iTCP -sTCP:LISTEN; fi";
   const command = isLocal ? localCommand : buildSshCommand(targetMachineId, localCommand);
-  const result = spawnSync2("bash", ["-lc", command], { encoding: "utf8" });
+  const result = spawnSync3("bash", ["-lc", command], { encoding: "utf8" });
   if (result.status !== 0) {
     throw new Error(result.stderr || `Failed to list ports for ${targetMachineId}`);
   }
@@ -14377,6 +14700,55 @@ function listPorts(machineId) {
   };
 }
 
+// src/commands/manifest.ts
+function manifestList() {
+  return readManifest();
+}
+function manifestAdd(machine) {
+  const manifest = readManifest();
+  const nextMachines = manifest.machines.filter((entry) => entry.id !== machine.id);
+  nextMachines.push(machine);
+  const nextManifest = { ...manifest, machines: nextMachines };
+  writeManifest(nextManifest);
+  return nextManifest;
+}
+function manifestBootstrapCurrentMachine() {
+  return manifestAdd(detectCurrentMachineManifest());
+}
+function manifestGet(machineId) {
+  return getManifestMachine(machineId);
+}
+function manifestRemove(machineId) {
+  const manifest = readManifest();
+  const nextManifest = {
+    ...manifest,
+    machines: manifest.machines.filter((machine) => machine.id !== machineId)
+  };
+  writeManifest(nextManifest);
+  return nextManifest;
+}
+function manifestValidate() {
+  return validateManifest(getManifestPath());
+}
+
+// src/version.ts
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname4, join as join8 } from "path";
+import { fileURLToPath } from "url";
+function getPackageVersion() {
+  try {
+    const here = dirname4(fileURLToPath(import.meta.url));
+    const candidates = [join8(here, "..", "package.json"), join8(here, "..", "..", "package.json")];
+    const pkgPath = candidates.find((candidate) => existsSync6(candidate));
+    if (!pkgPath) {
+      return "0.0.0";
+    }
+    return JSON.parse(readFileSync5(pkgPath, "utf8")).version || "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+
 // src/commands/status.ts
 function getStatus() {
   const manifest = readManifest();
@@ -14409,35 +14781,34 @@ function getStatus() {
   };
 }
 
-// src/commands/manifest.ts
-function manifestList() {
-  return readManifest();
-}
-function manifestAdd(machine) {
-  const manifest = readManifest();
-  const nextMachines = manifest.machines.filter((entry) => entry.id !== machine.id);
-  nextMachines.push(machine);
-  const nextManifest = { ...manifest, machines: nextMachines };
-  writeManifest(nextManifest);
-  return nextManifest;
-}
-function manifestBootstrapCurrentMachine() {
-  return manifestAdd(detectCurrentMachineManifest());
-}
-function manifestGet(machineId) {
-  return getManifestMachine(machineId);
+// src/commands/self-test.ts
+function check(id, status, summary, detail) {
+  return { id, status, summary, detail };
 }
-function manifestRemove(machineId) {
-  const manifest = readManifest();
-  const nextManifest = {
-    ...manifest,
-    machines: manifest.machines.filter((machine) => machine.id !== machineId)
+function runSelfTest() {
+  const version = getPackageVersion();
+  const status = getStatus();
+  const doctor = runDoctor();
+  const serveInfo = getServeInfo();
+  const html = renderDashboardHtml();
+  const notifications = listNotificationChannels();
+  const apps = listApps(status.machineId);
+  const appsDiff = diffApps(status.machineId);
+  const cliPlan = buildClaudeInstallPlan(status.machineId);
+  return {
+    machineId: getLocalMachineId(),
+    checks: [
+      check("package-version", version === "0.0.0" ? "fail" : "ok", "Package version resolves", version),
+      check("status", "ok", "Status loads", JSON.stringify({ machines: status.manifestMachineCount, heartbeats: status.heartbeatCount })),
+      check("doctor", doctor.checks.some((entry) => entry.status === "fail") ? "warn" : "ok", "Doctor completed", `${doctor.checks.length} checks`),
+      check("serve-info", "ok", "Dashboard info renders", `${serveInfo.url} routes=${serveInfo.routes.length}`),
+      check("dashboard-html", html.includes("Machines Dashboard") ? "ok" : "fail", "Dashboard HTML renders", html.slice(0, 80)),
+      check("notifications", "ok", "Notifications config loads", `${notifications.channels.length} channels`),
+      check("apps", "ok", "Apps manifest loads", `${apps.apps.length} apps`),
+      check("apps-diff", appsDiff.missing.length === 0 ? "ok" : "warn", "Apps diff computed", `missing=${appsDiff.missing.length} installed=${appsDiff.installed.length}`),
+      check("install-claude-plan", cliPlan.steps.length > 0 ? "ok" : "warn", "Install plan renders", `${cliPlan.steps.length} steps`)
+    ]
   };
-  writeManifest(nextManifest);
-  return nextManifest;
-}
-function manifestValidate() {
-  return validateManifest(getManifestPath());
 }
 
 // src/commands/serve.ts
@@ -14451,13 +14822,27 @@ function getServeInfo(options = {}) {
     host,
     port,
     url: `http://${host}:${port}`,
-    routes: ["/", "/health", "/api/status", "/api/manifest", "/api/notifications"]
+    routes: [
+      "/",
+      "/health",
+      "/api/status",
+      "/api/manifest",
+      "/api/notifications",
+      "/api/doctor",
+      "/api/self-test",
+      "/api/apps/status",
+      "/api/apps/diff",
+      "/api/install-claude/status",
+      "/api/install-claude/diff",
+      "/api/notifications/test"
+    ]
   };
 }
 function renderDashboardHtml() {
   const status = getStatus();
   const manifest = manifestList();
   const notifications = listNotificationChannels();
+  const doctor = runDoctor();
   return `<!doctype html>
 <html lang="en">
   <head>
@@ -14473,12 +14858,14 @@ function renderDashboardHtml() {
       .card { background: #121933; border: 1px solid #243057; border-radius: 16px; padding: 20px; }
       .stat { font-size: 32px; font-weight: 700; margin-top: 8px; }
       table { width: 100%; border-collapse: collapse; }
-      th, td { text-align: left; padding: 10px 8px; border-bottom: 1px solid #243057; }
+      th, td { text-align: left; padding: 10px 8px; border-bottom: 1px solid #243057; vertical-align: top; }
       code { color: #9ed0ff; }
       .badge { display: inline-block; border-radius: 999px; padding: 4px 10px; font-size: 12px; }
-      .online { background: #12351f; color: #74f0a7; }
-      .offline { background: #3b1a1a; color: #ff8c8c; }
-      .unknown { background: #2f2b16; color: #ffd76a; }
+      .online, .ok { background: #12351f; color: #74f0a7; }
+      .offline, .fail { background: #3b1a1a; color: #ff8c8c; }
+      .unknown, .warn { background: #2f2b16; color: #ffd76a; }
+      ul { margin: 8px 0 0; padding-left: 18px; }
+      .muted { color: #9fb0d9; }
     </style>
   </head>
   <body>
@@ -14488,6 +14875,7 @@ function renderDashboardHtml() {
         <section class="card"><div>Manifest machines</div><div class="stat">${status.manifestMachineCount}</div></section>
         <section class="card"><div>Heartbeats</div><div class="stat">${status.heartbeatCount}</div></section>
         <section class="card"><div>Notification channels</div><div class="stat">${notifications.channels.length}</div></section>
+        <section class="card"><div>Doctor warnings</div><div class="stat">${doctor.checks.filter((entry) => entry.status !== "ok").length}</div></section>
       </div>
 
       <section class="card" style="margin-top:16px">
@@ -14505,6 +14893,25 @@ function renderDashboardHtml() {
         </table>
       </section>
 
+      <section class="card" style="margin-top:16px">
+        <h2>Doctor</h2>
+        <table>
+          <thead><tr><th>Check</th><th>Status</th><th>Detail</th></tr></thead>
+          <tbody>
+            ${doctor.checks.map((entry) => `<tr>
+              <td>${escapeHtml(entry.summary)}</td>
+              <td><span class="badge ${escapeHtml(entry.status)}">${escapeHtml(entry.status)}</span></td>
+              <td class="muted">${escapeHtml(entry.detail)}</td>
+            </tr>`).join("")}
+          </tbody>
+        </table>
+      </section>
+
+      <section class="card" style="margin-top:16px">
+        <h2>Self Test</h2>
+        <p class="muted">Use <code>/api/self-test</code> for the full smoke-check payload.</p>
+      </section>
+
       <section class="card" style="margin-top:16px">
         <h2>Manifest</h2>
         <pre>${escapeHtml(JSON.stringify(manifest, null, 2))}</pre>
@@ -14630,7 +15037,7 @@ function runSetup(machineId, options = {}) {
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync6, lstatSync, readFileSync as readFileSync5, symlinkSync, copyFileSync as copyFileSync2 } from "fs";
+import { existsSync as existsSync7, lstatSync, readFileSync as readFileSync6, symlinkSync, copyFileSync as copyFileSync2 } from "fs";
 function quote4(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -14661,12 +15068,12 @@ function packageInstallCommand(machine, packageName, manager = machine.platform
 function detectPackageActions(machine) {
   return (machine.packages || []).map((pkg, index) => {
     const manager = pkg.manager || (machine.platform === "macos" ? "brew" : "apt");
-    const check = Bun.spawnSync(["bash", "-lc", packageCheckCommand(machine, pkg.name, manager)], {
+    const check2 = Bun.spawnSync(["bash", "-lc", packageCheckCommand(machine, pkg.name, manager)], {
       stdout: "ignore",
       stderr: "ignore",
       env: process.env
     });
-    const installed = check.exitCode === 0;
+    const installed = check2.exitCode === 0;
     return {
       id: `package-${index + 1}`,
       title: `${installed ? "Package present" : "Install package"} ${pkg.name}`,
@@ -14678,15 +15085,15 @@ function detectPackageActions(machine) {
 }
 function detectFileActions(machine) {
   return (machine.files || []).map((file, index) => {
-    const sourceExists = existsSync6(file.source);
-    const targetExists = existsSync6(file.target);
+    const sourceExists = existsSync7(file.source);
+    const targetExists = existsSync7(file.target);
     let status = "missing";
     if (sourceExists && targetExists) {
       if (file.mode === "symlink") {
         status = lstatSync(file.target).isSymbolicLink() ? "ok" : "drifted";
       } else {
-        const source = readFileSync5(file.source, "utf8");
-        const target = readFileSync5(file.target, "utf8");
+        const source = readFileSync6(file.source, "utf8");
+        const target = readFileSync6(file.target, "utf8");
         status = source === target ? "ok" : "drifted";
       }
     }
@@ -14793,25 +15200,19 @@ function getAgentStatus(machineId = getLocalMachineId()) {
 
 // src/mcp/server.ts
 function createMcpServer(version) {
-  const server = new McpServer({
-    name: "machines",
-    version
-  });
+  const server = new McpServer({ name: "machines", version });
   server.tool("machines_status", "Return local machine fleet status paths and machine identity.", {}, async () => ({
     content: [{ type: "text", text: JSON.stringify(getStatus(), null, 2) }]
   }));
-  server.tool("machines_apps_list", "List manifest-managed apps for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({
-    content: [{ type: "text", text: JSON.stringify(listApps(machine_id), null, 2) }]
-  }));
-  server.tool("machines_apps_plan", "Preview app install steps for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({
-    content: [{ type: "text", text: JSON.stringify(buildAppsPlan(machine_id), null, 2) }]
-  }));
-  server.tool("machines_apps_apply", "Install manifest-managed apps for a machine.", {
-    machine_id: exports_external.string().optional().describe("Machine identifier"),
-    yes: exports_external.boolean().describe("Confirmation flag for execution")
-  }, async ({ machine_id, yes }) => ({
-    content: [{ type: "text", text: JSON.stringify(runAppsInstall(machine_id, { apply: true, yes }), null, 2) }]
+  server.tool("machines_doctor", "Run machine preflight checks.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({ content: [{ type: "text", text: JSON.stringify(runDoctor(machine_id), null, 2) }] }));
+  server.tool("machines_self_test", "Run local package smoke checks.", {}, async () => ({
+    content: [{ type: "text", text: JSON.stringify(runSelfTest(), null, 2) }]
   }));
+  server.tool("machines_apps_list", "List manifest-managed apps for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({ content: [{ type: "text", text: JSON.stringify(listApps(machine_id), null, 2) }] }));
+  server.tool("machines_apps_status", "Check installed state for manifest-managed apps.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({ content: [{ type: "text", text: JSON.stringify(getAppsStatus(machine_id), null, 2) }] }));
+  server.tool("machines_apps_diff", "Show missing and installed manifest-managed apps.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({ content: [{ type: "text", text: JSON.stringify(diffApps(machine_id), null, 2) }] }));
+  server.tool("machines_apps_plan", "Preview app install steps for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({ content: [{ type: "text", text: JSON.stringify(buildAppsPlan(machine_id), null, 2) }] }));
+  server.tool("machines_apps_apply", "Install manifest-managed apps for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier"), yes: exports_external.boolean().describe("Confirmation flag for execution") }, async ({ machine_id, yes }) => ({ content: [{ type: "text", text: JSON.stringify(runAppsInstall(machine_id, { apply: true, yes }), null, 2) }] }));
   server.tool("machines_manifest", "Read the current fleet manifest.", {}, async () => ({
     content: [{ type: "text", text: JSON.stringify(manifestList(), null, 2) }]
   }));
@@ -14821,45 +15222,33 @@ function createMcpServer(version) {
   server.tool("machines_manifest_bootstrap", "Detect and upsert the current machine into the fleet manifest.", {}, async () => ({
     content: [{ type: "text", text: JSON.stringify(manifestBootstrapCurrentMachine(), null, 2) }]
   }));
-  server.tool("machines_manifest_get", "Read a single machine from the fleet manifest.", { machine_id: exports_external.string().describe("Machine identifier") }, async ({ machine_id }) => ({
-    content: [{ type: "text", text: JSON.stringify(manifestGet(machine_id), null, 2) }]
-  }));
-  server.tool("machines_manifest_remove", "Remove a single machine from the fleet manifest.", { machine_id: exports_external.string().describe("Machine identifier") }, async ({ machine_id }) => ({
-    content: [{ type: "text", text: JSON.stringify(manifestRemove(machine_id), null, 2) }]
-  }));
+  server.tool("machines_manifest_get", "Read a single machine from the fleet manifest.", { machine_id: exports_external.string().describe("Machine identifier") }, async ({ machine_id }) => ({ content: [{ type: "text", text: JSON.stringify(manifestGet(machine_id), null, 2) }] }));
+  server.tool("machines_manifest_remove", "Remove a single machine from the fleet manifest.", { machine_id: exports_external.string().describe("Machine identifier") }, async ({ machine_id }) => ({ content: [{ type: "text", text: JSON.stringify(manifestRemove(machine_id), null, 2) }] }));
   server.tool("machines_agent_status", "List current machine agent heartbeats.", {}, async () => ({
     content: [{ type: "text", text: JSON.stringify(getAgentStatus(), null, 2) }]
   }));
-  server.tool("machines_setup_preview", "Preview setup actions for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({
-    content: [{ type: "text", text: JSON.stringify(buildSetupPlan(machine_id), null, 2) }]
-  }));
-  server.tool("machines_setup_apply", "Execute setup actions for a machine.", {
-    machine_id: exports_external.string().optional().describe("Machine identifier"),
-    yes: exports_external.boolean().describe("Confirmation flag for execution")
-  }, async ({ machine_id, yes }) => ({
-    content: [{ type: "text", text: JSON.stringify(runSetup(machine_id, { apply: true, yes }), null, 2) }]
-  }));
-  server.tool("machines_sync_preview", "Preview sync actions for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({
-    content: [{ type: "text", text: JSON.stringify(buildSyncPlan(machine_id), null, 2) }]
-  }));
-  server.tool("machines_sync_apply", "Execute sync actions for a machine.", {
-    machine_id: exports_external.string().optional().describe("Machine identifier"),
-    yes: exports_external.boolean().describe("Confirmation flag for execution")
-  }, async ({ machine_id, yes }) => ({
-    content: [{ type: "text", text: JSON.stringify(runSync(machine_id, { apply: true, yes }), null, 2) }]
-  }));
+  server.tool("machines_setup_preview", "Preview setup actions for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({ content: [{ type: "text", text: JSON.stringify(buildSetupPlan(machine_id), null, 2) }] }));
+  server.tool("machines_setup_apply", "Execute setup actions for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier"), yes: exports_external.boolean().describe("Confirmation flag for execution") }, async ({ machine_id, yes }) => ({ content: [{ type: "text", text: JSON.stringify(runSetup(machine_id, { apply: true, yes }), null, 2) }] }));
+  server.tool("machines_sync_preview", "Preview sync actions for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({ content: [{ type: "text", text: JSON.stringify(buildSyncPlan(machine_id), null, 2) }] }));
+  server.tool("machines_sync_apply", "Execute sync actions for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier"), yes: exports_external.boolean().describe("Confirmation flag for execution") }, async ({ machine_id, yes }) => ({ content: [{ type: "text", text: JSON.stringify(runSync(machine_id, { apply: true, yes }), null, 2) }] }));
   server.tool("machines_diff", "Show manifest differences between two machines.", {
     left_machine_id: exports_external.string().describe("Left machine identifier"),
     right_machine_id: exports_external.string().optional().describe("Right machine identifier")
   }, async ({ left_machine_id, right_machine_id }) => ({
     content: [{ type: "text", text: JSON.stringify(diffMachines(left_machine_id, right_machine_id), null, 2) }]
   }));
+  server.tool("machines_install_claude_status", "Check installed state for Claude, Codex, and Gemini CLIs.", {
+    machine_id: exports_external.string().optional().describe("Machine identifier"),
+    tools: exports_external.array(exports_external.enum(["claude", "codex", "gemini"])).optional().describe("AI CLIs to inspect")
+  }, async ({ machine_id, tools }) => ({ content: [{ type: "text", text: JSON.stringify(getClaudeCliStatus(machine_id, tools), null, 2) }] }));
+  server.tool("machines_install_claude_diff", "Show missing and installed Claude, Codex, and Gemini CLIs.", {
+    machine_id: exports_external.string().optional().describe("Machine identifier"),
+    tools: exports_external.array(exports_external.enum(["claude", "codex", "gemini"])).optional().describe("AI CLIs to inspect")
+  }, async ({ machine_id, tools }) => ({ content: [{ type: "text", text: JSON.stringify(diffClaudeCli(machine_id, tools), null, 2) }] }));
   server.tool("machines_install_claude_preview", "Preview Claude, Codex, and Gemini CLI install steps for a machine.", {
     machine_id: exports_external.string().optional().describe("Machine identifier"),
     tools: exports_external.array(exports_external.enum(["claude", "codex", "gemini"])).optional().describe("AI CLIs to install")
-  }, async ({ machine_id, tools }) => ({
-    content: [{ type: "text", text: JSON.stringify(buildClaudeInstallPlan(machine_id, tools), null, 2) }]
-  }));
+  }, async ({ machine_id, tools }) => ({ content: [{ type: "text", text: JSON.stringify(buildClaudeInstallPlan(machine_id, tools), null, 2) }] }));
   server.tool("machines_install_claude_apply", "Execute Claude, Codex, and Gemini CLI install steps for a machine.", {
     machine_id: exports_external.string().optional().describe("Machine identifier"),
     tools: exports_external.array(exports_external.enum(["claude", "codex", "gemini"])).optional().describe("AI CLIs to install"),
@@ -14867,73 +15256,21 @@ function createMcpServer(version) {
   }, async ({ machine_id, tools, yes }) => ({
     content: [{ type: "text", text: JSON.stringify(runClaudeInstall(machine_id, tools, { apply: true, yes }), null, 2) }]
   }));
-  server.tool("machines_install_tailscale_preview", "Preview Tailscale install steps for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({
-    content: [{ type: "text", text: JSON.stringify(buildTailscaleInstallPlan(machine_id), null, 2) }]
-  }));
-  server.tool("machines_install_tailscale_apply", "Execute Tailscale install steps for a machine.", {
-    machine_id: exports_external.string().optional().describe("Machine identifier"),
-    yes: exports_external.boolean().describe("Confirmation flag for execution")
-  }, async ({ machine_id, yes }) => ({
-    content: [{ type: "text", text: JSON.stringify(runTailscaleInstall(machine_id, { apply: true, yes }), null, 2) }]
-  }));
-  server.tool("machines_ssh_resolve", "Resolve the best SSH route for a machine.", {
-    machine_id: exports_external.string().describe("Machine identifier"),
-    remote_command: exports_external.string().optional().describe("Optional remote command")
-  }, async ({ machine_id, remote_command }) => ({
-    content: [
-      {
-        type: "text",
-        text: JSON.stringify({
-          resolved: resolveSshTarget(machine_id),
-          command: buildSshCommand(machine_id, remote_command)
-        }, null, 2)
-      }
-    ]
+  server.tool("machines_install_tailscale_preview", "Preview Tailscale install steps for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({ content: [{ type: "text", text: JSON.stringify(buildTailscaleInstallPlan(machine_id), null, 2) }] }));
+  server.tool("machines_install_tailscale_apply", "Execute Tailscale install steps for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier"), yes: exports_external.boolean().describe("Confirmation flag for execution") }, async ({ machine_id, yes }) => ({ content: [{ type: "text", text: JSON.stringify(runTailscaleInstall(machine_id, { apply: true, yes }), null, 2) }] }));
+  server.tool("machines_ssh_resolve", "Resolve the best SSH route for a machine.", { machine_id: exports_external.string().describe("Machine identifier"), remote_command: exports_external.string().optional().describe("Optional remote command") }, async ({ machine_id, remote_command }) => ({
+    content: [{ type: "text", text: JSON.stringify({ resolved: resolveSshTarget(machine_id), command: buildSshCommand(machine_id, remote_command) }, null, 2) }]
   }));
-  server.tool("machines_ports", "List listening ports on a machine.", {
-    machine_id: exports_external.string().optional().describe("Machine identifier")
-  }, async ({ machine_id }) => ({
+  server.tool("machines_ports", "List listening ports on a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({
     content: [{ type: "text", text: JSON.stringify(listPorts(machine_id), null, 2) }]
   }));
-  server.tool("machines_backup_preview", "Preview backup steps for the current machine.", {
-    bucket: exports_external.string().describe("S3 bucket name"),
-    prefix: exports_external.string().optional().describe("S3 key prefix")
-  }, async ({ bucket, prefix }) => ({
-    content: [{ type: "text", text: JSON.stringify(buildBackupPlan(bucket, prefix), null, 2) }]
-  }));
-  server.tool("machines_backup_apply", "Execute backup steps for the current machine.", {
-    bucket: exports_external.string().describe("S3 bucket name"),
-    prefix: exports_external.string().optional().describe("S3 key prefix"),
-    yes: exports_external.boolean().describe("Confirmation flag for execution")
-  }, async ({ bucket, prefix, yes }) => ({
-    content: [{ type: "text", text: JSON.stringify(runBackup(bucket, prefix, { apply: true, yes }), null, 2) }]
-  }));
-  server.tool("machines_cert_preview", "Preview mkcert steps for one or more domains.", {
-    domains: exports_external.array(exports_external.string()).describe("Domains to issue certificates for")
-  }, async ({ domains }) => ({
-    content: [{ type: "text", text: JSON.stringify(buildCertPlan(domains), null, 2) }]
-  }));
-  server.tool("machines_cert_apply", "Execute mkcert steps for one or more domains.", {
-    domains: exports_external.array(exports_external.string()).describe("Domains to issue certificates for"),
-    yes: exports_external.boolean().describe("Confirmation flag for execution")
-  }, async ({ domains, yes }) => ({
-    content: [{ type: "text", text: JSON.stringify(runCertPlan(domains, { apply: true, yes }), null, 2) }]
-  }));
-  server.tool("machines_dns_add", "Add or replace a local domain mapping.", {
-    domain: exports_external.string().describe("Domain name"),
-    port: exports_external.number().describe("Target port"),
-    target_host: exports_external.string().optional().describe("Target host")
-  }, async ({ domain, port, target_host }) => ({
-    content: [{ type: "text", text: JSON.stringify(addDomainMapping(domain, port, target_host), null, 2) }]
-  }));
-  server.tool("machines_dns_list", "List local domain mappings.", {}, async () => ({
-    content: [{ type: "text", text: JSON.stringify(listDomainMappings(), null, 2) }]
-  }));
-  server.tool("machines_dns_render", "Render hosts/proxy configuration for a domain.", {
-    domain: exports_external.string().describe("Domain name")
-  }, async ({ domain }) => ({
-    content: [{ type: "text", text: JSON.stringify(renderDomainMapping(domain), null, 2) }]
-  }));
+  server.tool("machines_backup_preview", "Preview backup steps for the current machine.", { bucket: exports_external.string().describe("S3 bucket name"), prefix: exports_external.string().optional().describe("S3 key prefix") }, async ({ bucket, prefix }) => ({ content: [{ type: "text", text: JSON.stringify(buildBackupPlan(bucket, prefix), null, 2) }] }));
+  server.tool("machines_backup_apply", "Execute backup steps for the current machine.", { bucket: exports_external.string().describe("S3 bucket name"), prefix: exports_external.string().optional().describe("S3 key prefix"), yes: exports_external.boolean().describe("Confirmation flag for execution") }, async ({ bucket, prefix, yes }) => ({ content: [{ type: "text", text: JSON.stringify(runBackup(bucket, prefix, { apply: true, yes }), null, 2) }] }));
+  server.tool("machines_cert_preview", "Preview mkcert steps for one or more domains.", { domains: exports_external.array(exports_external.string()).describe("Domains to issue certificates for") }, async ({ domains }) => ({ content: [{ type: "text", text: JSON.stringify(buildCertPlan(domains), null, 2) }] }));
+  server.tool("machines_cert_apply", "Execute mkcert steps for one or more domains.", { domains: exports_external.array(exports_external.string()).describe("Domains to issue certificates for"), yes: exports_external.boolean().describe("Confirmation flag for execution") }, async ({ domains, yes }) => ({ content: [{ type: "text", text: JSON.stringify(runCertPlan(domains, { apply: true, yes }), null, 2) }] }));
+  server.tool("machines_dns_add", "Add or replace a local domain mapping.", { domain: exports_external.string().describe("Domain name"), port: exports_external.number().describe("Target port"), target_host: exports_external.string().optional().describe("Target host") }, async ({ domain, port, target_host }) => ({ content: [{ type: "text", text: JSON.stringify(addDomainMapping(domain, port, target_host), null, 2) }] }));
+  server.tool("machines_dns_list", "List local domain mappings.", {}, async () => ({ content: [{ type: "text", text: JSON.stringify(listDomainMappings(), null, 2) }] }));
+  server.tool("machines_dns_render", "Render hosts/proxy configuration for a domain.", { domain: exports_external.string().describe("Domain name") }, async ({ domain }) => ({ content: [{ type: "text", text: JSON.stringify(renderDomainMapping(domain), null, 2) }] }));
   server.tool("machines_notifications_add", "Add or replace a notification channel.", {
     channel_id: exports_external.string().describe("Channel identifier"),
     type: exports_external.enum(["email", "webhook", "command"]).describe("Notification transport"),
@@ -14941,46 +15278,17 @@ function createMcpServer(version) {
     events: exports_external.array(exports_external.string()).describe("Events routed to this channel"),
     enabled: exports_external.boolean().optional().describe("Whether the channel is enabled")
   }, async ({ channel_id, type, target, events, enabled }) => ({
-    content: [
-      {
-        type: "text",
-        text: JSON.stringify(addNotificationChannel({
-          id: channel_id,
-          type,
-          target,
-          events,
-          enabled: enabled ?? true
-        }), null, 2)
-      }
-    ]
+    content: [{ type: "text", text: JSON.stringify(addNotificationChannel({ id: channel_id, type, target, events, enabled: enabled ?? true }), null, 2) }]
   }));
   server.tool("machines_notifications_list", "List notification channels.", {}, async () => ({
     content: [{ type: "text", text: JSON.stringify(listNotificationChannels(), null, 2) }]
   }));
-  server.tool("machines_notifications_test", "Preview or execute a notification test.", {
-    channel_id: exports_external.string().describe("Channel identifier"),
-    event: exports_external.string().optional().describe("Event name"),
-    message: exports_external.string().optional().describe("Message body"),
-    yes: exports_external.boolean().optional().describe("Execute the test when true")
-  }, async ({ channel_id, event, message, yes }) => ({
-    content: [
-      {
-        type: "text",
-        text: JSON.stringify(testNotificationChannel(channel_id, event, message, { apply: Boolean(yes), yes }), null, 2)
-      }
-    ]
-  }));
-  server.tool("machines_notifications_remove", "Remove a notification channel.", {
-    channel_id: exports_external.string().describe("Channel identifier")
-  }, async ({ channel_id }) => ({
-    content: [{ type: "text", text: JSON.stringify(removeNotificationChannel(channel_id), null, 2) }]
-  }));
-  server.tool("machines_serve_info", "Preview the dashboard server bind address and routes.", {
-    host: exports_external.string().optional().describe("Host interface"),
-    port: exports_external.number().optional().describe("Port number")
-  }, async ({ host, port }) => ({
-    content: [{ type: "text", text: JSON.stringify(getServeInfo({ host, port }), null, 2) }]
+  server.tool("machines_notifications_test", "Preview or execute a notification test.", { channel_id: exports_external.string().describe("Channel identifier"), event: exports_external.string().optional().describe("Event name"), message: exports_external.string().optional().describe("Message body"), yes: exports_external.boolean().optional().describe("Execute the test when true") }, async ({ channel_id, event, message, yes }) => ({
+    content: [{ type: "text", text: JSON.stringify(await testNotificationChannel(channel_id, event, message, { apply: Boolean(yes), yes }), null, 2) }]
   }));
+  server.tool("machines_notifications_dispatch", "Dispatch an event to matching notification channels.", { event: exports_external.string().describe("Event name"), message: exports_external.string().describe("Message body"), channel_id: exports_external.string().optional().describe("Limit delivery to one channel") }, async ({ event, message, channel_id }) => ({ content: [{ type: "text", text: JSON.stringify(await dispatchNotificationEvent(event, message, { channelId: channel_id }), null, 2) }] }));
+  server.tool("machines_notifications_remove", "Remove a notification channel.", { channel_id: exports_external.string().describe("Channel identifier") }, async ({ channel_id }) => ({ content: [{ type: "text", text: JSON.stringify(removeNotificationChannel(channel_id), null, 2) }] }));
+  server.tool("machines_serve_info", "Preview the dashboard server bind address and routes.", { host: exports_external.string().optional().describe("Host interface"), port: exports_external.number().optional().describe("Port number") }, async ({ host, port }) => ({ content: [{ type: "text", text: JSON.stringify(getServeInfo({ host, port }), null, 2) }] }));
   server.tool("machines_serve_dashboard", "Render the current dashboard HTML.", {}, async () => ({
     content: [{ type: "text", text: renderDashboardHtml() }]
   }));
@@ -14990,8 +15298,8 @@ function createMcpServer(version) {
 // src/mcp/index.ts
 function getPkgVersion() {
   try {
-    const pkgPath = join7(dirname4(fileURLToPath(import.meta.url)), "..", "..", "package.json");
-    return JSON.parse(readFileSync6(pkgPath, "utf8")).version || "0.0.0";
+    const pkgPath = join9(dirname5(fileURLToPath2(import.meta.url)), "..", "..", "package.json");
+    return JSON.parse(readFileSync7(pkgPath, "utf8")).version || "0.0.0";
   } catch {
     return "0.0.0";
   }