@hasna/skills 0.1.63 → 0.1.64

package/bin/index.js

@@ -36860,7 +36860,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.1.63",
+    version: "0.1.64",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -36934,6 +36934,7 @@ var init_package = __esm(() => {
     license: "Apache-2.0",
     devDependencies: {
       "@types/bun": "latest",
+      "@types/node": "25.2.3",
       "@types/react": "^18.2.0",
       "bun-types": "1.3.14",
       "react-devtools-core": "^7.0.1",
@@ -36942,7 +36943,7 @@ var init_package = __esm(() => {
     dependencies: {
       "@aws-sdk/client-ecs": "^3.1079.0",
       "@aws-sdk/client-s3": "^3.1079.0",
-      "@hasna/events": "0.1.7",
+      "@hasna/events": "0.1.16",
       "@modelcontextprotocol/sdk": "^1.26.0",
       chalk: "^5.3.0",
       commander: "^12.1.0",
@@ -37956,6 +37957,9 @@ function normalizeConfigValue(key, value) {
     return value.trim() ? value : undefined;
   return;
 }
+function isOwnerLayoutMigrated(appDir) {
+  return existsSync3(join3(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD));
+}
 function getDataDir() {
   const override = process.env[DATA_DIR_ENV];
   if (override) {
@@ -37979,6 +37983,33 @@ function getDataDir() {
   }
   return newDir;
 }
+function getDataDirReadOnly() {
+  const override = process.env[DATA_DIR_ENV];
+  if (override)
+    return override;
+  return join3(process.env["HOME"] || process.env["USERPROFILE"] || homedir2(), ".hasna", "skills");
+}
+function getConfigPathReadOnly(scope) {
+  if (scope === "global")
+    return join3(getDataDirReadOnly(), "config.json");
+  return join3(process.cwd(), "skills.config.json");
+}
+function loadConfigReadOnly() {
+  const canonicalConfigPath = getConfigPathReadOnly("global");
+  let globalConfig;
+  if (existsSync3(canonicalConfigPath)) {
+    globalConfig = readConfigFile(canonicalConfigPath);
+  } else if (process.env[DATA_DIR_ENV] !== undefined) {
+    globalConfig = {};
+  } else {
+    globalConfig = readConfigFile(legacyConfigFilePath());
+  }
+  const projectConfig = readConfigFile(getConfigPathReadOnly("project"));
+  return { ...globalConfig, ...projectConfig };
+}
+function legacyConfigFilePath() {
+  return join3(process.env["HOME"] || process.env["USERPROFILE"] || homedir2(), ".skillsrc");
+}
 function getConfigPath(scope) {
   if (scope === "global") {
     return join3(getDataDir(), "config.json");
@@ -38065,7 +38096,7 @@ function unsetConfig(key, scope = "project") {
 `);
   return true;
 }
-var ENUM_KEYS, STRING_KEYS, DATA_DIR_ENV = "HASNA_SKILLS_DIR", INSTALLED_SKILLS_DIRNAME = "installed";
+var ENUM_KEYS, STRING_KEYS, DATA_DIR_ENV = "HASNA_SKILLS_DIR", INSTALLED_SKILLS_DIRNAME = "installed", SKILLS_CACHE_DIRNAME = "skills", LAYOUT_MIGRATION_RECORD = ".layout-migration.json";
 var init_config = __esm(() => {
   init_retired_settings();
   ENUM_KEYS = {
@@ -38236,7 +38267,7 @@ var init_development_tools = __esm(() => {
     {
       name: "monitor",
       displayName: "Monitor",
-      description: "Operate the open-monitor MCP for machine health, processes, cron jobs, and cleanup workflows",
+      description: "Operate the monitor MCP for machine health, processes, cron jobs, and cleanup workflows",
       category: "Development Tools",
       tags: ["monitoring", "mcp", "processes", "operations"]
     },
@@ -38282,6 +38313,14 @@ var init_development_tools = __esm(() => {
       description: "Validate configuration files for syntax and schema compliance",
       category: "Development Tools",
       tags: ["config", "validation", "schema", "linting"]
+    },
+    {
+      name: "session-inject-monitor",
+      displayName: "Session Inject Monitor",
+      description: "Set up a declarative monitor that injects a prompt into a live coding-agent session when a watched source (conversations, email, todos, knowledge, command output) has new content",
+      category: "Development Tools",
+      tags: ["monitor", "session", "injection", "automation", "wake"],
+      kind: "instruction"
     }
   ];
 });
@@ -38693,7 +38732,7 @@ var init_design_branding = __esm(() => {
       displayName: "Site Analyze",
       description: "Analyze any website's design system \u2014 detects shadcn/ui, Tailwind, extracts colors, typography, and components via Playwright + Claude Vision.",
       category: "Design & Branding",
-      tags: ["design", "shadcn", "tailwind", "colors", "typography", "playwright", "analysis", "open-styles"]
+      tags: ["design", "shadcn", "tailwind", "colors", "typography", "playwright", "analysis", "styles"]
     }
   ];
 });
@@ -40114,6 +40153,9 @@ function getPortableSkillsRoot(options = {}) {
   if (options.rootDir)
     return options.rootDir;
   const appDir = options.homeDir ? join7(options.homeDir, ".hasna", "skills") : getDataDir();
+  const cache3 = join7(appDir, SKILLS_CACHE_DIRNAME);
+  if (isOwnerLayoutMigrated(appDir) && safeIsDirectory(cache3))
+    return cache3;
   const installed = join7(appDir, INSTALLED_SKILLS_DIRNAME);
   migrateLegacySkillLayout(appDir, installed);
   return installed;
@@ -40333,10 +40375,7 @@ function writeCorpusSkill(input, options = {}) {
   const skillPath = join7(root, name);
   const created = !existsSync7(skillPath);
   mkdirSync3(skillPath, { recursive: true });
-  const skillMd = input.skillMd.endsWith(`
-`) ? input.skillMd : `${input.skillMd}
-`;
-  writeFileSync3(join7(skillPath, "SKILL.md"), skillMd);
+  writeFileSync3(join7(skillPath, "SKILL.md"), input.skillMd);
   const frontmatter = parseSkillFrontmatter(input.skillMd) ?? undefined;
   const kind = input.meta?.kind ?? parseSkillKind(frontmatter?.kind) ?? "instruction";
   const manifest = {
@@ -42516,16 +42555,7 @@ import { join as join9 } from "path";
 function layoutMigrationRecordPath(appDir) {
   return join9(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD);
 }
-function isOwnerLayoutMigrated(appDir) {
-  return existsSync9(layoutMigrationRecordPath(appDir));
-}
 function resolveCorpusRoot(options = {}) {
-  if (options.rootDir)
-    return options.rootDir;
-  const appDir = options.homeDir ? join9(options.homeDir, ".hasna", "skills") : getDataDir();
-  const cache3 = join9(appDir, SKILLS_CACHE_DIRNAME);
-  if (isOwnerLayoutMigrated(appDir) && existsSync9(cache3))
-    return cache3;
   return getPortableSkillsRoot(options);
 }
 function migrationAppDir(homeDir) {
@@ -42647,10 +42677,11 @@ function migrateOwnerLayout(options = {}) {
 `);
   return { status: "migrated", moved, created, record };
 }
-var SKILLS_CACHE_DIRNAME = "skills", LOGS_DIRNAME = "logs", OUTPUTS_DIRNAME = "outputs", LAYOUT_MIGRATION_RECORD = ".layout-migration.json", LEGACY_CUSTOM_DIRNAME2 = "custom";
+var LOGS_DIRNAME = "logs", OUTPUTS_DIRNAME = "outputs", LEGACY_CUSTOM_DIRNAME2 = "custom";
 var init_home_migration = __esm(() => {
   init_config();
   init_portable_skills();
+  init_config();
 });
 
 // src/lib/agent-sync.ts
@@ -42705,6 +42736,9 @@ ${lines.join(`
 ---
 ${body}`;
 }
+function isPointerSkillMd(markdown) {
+  return markdown.includes(POINTER_MARKER_PHRASE) && /^kind:\s*executable\b/m.test(markdown);
+}
 function pointerSkillMd(name, description) {
   const display = name.replace(/[-_]+/g, " ").replace(/\b\w/g, (char) => char.toUpperCase());
   return [
@@ -42730,7 +42764,7 @@ function resolveSyncCorpus(options = {}) {
   if (explicit) {
     const roots = packageSourceRoots(explicit);
     if (roots.length === 0) {
-      throw new Error(`SKILLS_SOURCE '${explicit}' contains no skills: expected a corpus directory or a package root with skills/ and/or agent-skills/`);
+      throw new Error(`SKILLS_SOURCE '${explicit}' contains no skills: expected a corpus directory or a package root with skills/`);
     }
     return { roots, source: "source" };
   }
@@ -42738,7 +42772,7 @@ function resolveSyncCorpus(options = {}) {
 }
 function packageSourceRoots(source) {
   const roots = [];
-  for (const sub of ["skills", "agent-skills"]) {
+  for (const sub of ["skills"]) {
     const candidate = join10(source, sub);
     if (existsSync10(candidate) && isDirectory(candidate))
       roots.push(candidate);
@@ -42863,6 +42897,21 @@ function writeManagedSkillDir(dir, skillMd, options) {
       reason: "an unmanaged SKILL.md already exists here (hand-authored); pass --force to overwrite"
     };
   }
+  if (dirExists && managed && hasSkillMd && !options.force && isPointerSkillMd(skillMd)) {
+    let existingIsStub = false;
+    try {
+      existingIsStub = isPointerSkillMd(readFileSync7(skillMdPath, "utf-8"));
+    } catch {
+      existingIsStub = false;
+    }
+    if (!existingIsStub) {
+      return {
+        action: "skip",
+        path: skillMdPath,
+        reason: "refusing to replace a content-bearing managed home with an executable pointer stub (the corpus entry lacks kind: instruction); pass --force to overwrite"
+      };
+    }
+  }
   const action = dirExists ? "update" : "create";
   if (options.dryRun)
     return { action, path: skillMdPath };
@@ -42947,7 +42996,7 @@ function normalizeRequested(names) {
   const normalized = names.map((name) => name.trim()).filter(Boolean).map((name) => normalizePortableSkillName(name));
   return [...new Set(normalized)];
 }
-var SYNC_AGENTS, SKILLS_SOURCE_ENV = "SKILLS_SOURCE", SYNC_MARKER_FILE = ".hasna-skills.json", SYNC_MARKER_MANAGED_BY = "@hasna/skills";
+var SYNC_AGENTS, SKILLS_SOURCE_ENV = "SKILLS_SOURCE", SYNC_MARKER_FILE = ".hasna-skills.json", SYNC_MARKER_MANAGED_BY = "@hasna/skills", POINTER_MARKER_PHRASE = "This is an executable skill from the @hasna/skills catalog";
 var init_agent_sync = __esm(() => {
   init_portable_skills();
   init_home_migration();
@@ -47539,19 +47588,33 @@ var exports_auth_store = {};
 __export(exports_auth_store, {
   saveAuthConfig: () => saveAuthConfig,
   normalizeSkillsApiOrigin: () => normalizeSkillsApiOrigin,
+  getAuthFilePathReadOnly: () => getAuthFilePathReadOnly,
+  getAuthFilePath: () => getAuthFilePath,
+  getAuthConfigReadOnly: () => getAuthConfigReadOnly,
   getAuthConfig: () => getAuthConfig,
   getApiUrl: () => getApiUrl,
+  getApiKeyReadOnly: () => getApiKeyReadOnly,
   getApiKey: () => getApiKey,
   clearAuthConfig: () => clearAuthConfig
 });
 import { existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync7, unlinkSync } from "fs";
-import { join as join13 } from "path";
+import { dirname as dirname6, join as join13 } from "path";
 import { homedir as homedir5 } from "os";
+function getAuthFilePath() {
+  return join13(getDataDir(), "auth.json");
+}
+function getAuthFilePathReadOnly() {
+  return join13(getDataDirReadOnly(), "auth.json");
+}
+function legacyAuthFilePath() {
+  return join13(process.env["HOME"] || process.env["USERPROFILE"] || homedir5(), ".skills", "auth.json");
+}
 function getAuthConfig() {
   if (cachedConfig !== undefined)
     return cachedConfig;
   try {
-    const raw = readFileSync10(existsSync13(AUTH_FILE) ? AUTH_FILE : LEGACY_AUTH_FILE, "utf-8");
+    const file = existsSync13(getAuthFilePath()) ? getAuthFilePath() : legacyAuthFilePath();
+    const raw = readFileSync10(file, "utf-8");
     const config = JSON.parse(raw);
     if (!config.apiKey) {
       cachedConfig = null;
@@ -47565,19 +47628,20 @@ function getAuthConfig() {
   }
 }
 function saveAuthConfig(config) {
-  mkdirSync7(AUTH_DIR, { recursive: true, mode: 448 });
-  writeFileSync7(AUTH_FILE, JSON.stringify(config, null, 2) + `
+  const file = getAuthFilePath();
+  mkdirSync7(dirname6(file), { recursive: true, mode: 448 });
+  writeFileSync7(file, JSON.stringify(config, null, 2) + `
 `, { mode: 384 });
   cachedConfig = config;
 }
 function clearAuthConfig() {
   try {
-    unlinkSync(AUTH_FILE);
+    unlinkSync(getAuthFilePath());
   } catch {}
   try {
-    unlinkSync(LEGACY_AUTH_FILE);
+    unlinkSync(legacyAuthFilePath());
   } catch {}
-  cachedConfig = null;
+  cachedConfig = undefined;
 }
 function getApiKey() {
   if (process.env.SKILLS_API_KEY)
@@ -47586,6 +47650,25 @@ function getApiKey() {
     return process.env.SKILL_API_KEY;
   return getAuthConfig()?.apiKey || null;
 }
+function getAuthConfigReadOnly() {
+  try {
+    const file = existsSync13(getAuthFilePathReadOnly()) ? getAuthFilePathReadOnly() : legacyAuthFilePath();
+    const raw = readFileSync10(file, "utf-8");
+    const config = JSON.parse(raw);
+    if (!config.apiKey)
+      return null;
+    return config;
+  } catch {
+    return null;
+  }
+}
+function getApiKeyReadOnly() {
+  if (process.env.SKILLS_API_KEY)
+    return process.env.SKILLS_API_KEY;
+  if (process.env.SKILL_API_KEY)
+    return process.env.SKILL_API_KEY;
+  return getAuthConfigReadOnly()?.apiKey || null;
+}
 function normalizeSkillsApiOrigin(apiUrl) {
   const url = new URL(apiUrl);
   const pathname = url.pathname.replace(/\/+$/, "");
@@ -47601,12 +47684,10 @@ function normalizeSkillsApiOrigin(apiUrl) {
 function getApiUrl(action) {
   return normalizeSkillsApiOrigin(requireApiUrl(action));
 }
-var AUTH_DIR, AUTH_FILE, LEGACY_AUTH_FILE, cachedConfig;
+var cachedConfig;
 var init_auth_store = __esm(() => {
   init_api_url();
-  AUTH_DIR = join13(homedir5(), ".hasna", "skills");
-  AUTH_FILE = join13(AUTH_DIR, "auth.json");
-  LEGACY_AUTH_FILE = join13(homedir5(), ".skills", "auth.json");
+  init_config();
 });
 
 // src/lib/remote-registry.ts
@@ -47723,6 +47804,16 @@ async function loadRemoteRegistry(options = {}) {
   const url = buildSkillsApiUrl(apiUrl, options.endpoint);
   return parseRemoteRegistryPayload(await fetchRemoteJson(url, options));
 }
+async function mergeRemoteRegistry(local, options = {}) {
+  const apiUrl = options.apiUrl || getConfiguredApiUrl();
+  if (!apiUrl)
+    return local;
+  const token = options.authToken !== undefined ? options.authToken : getApiKey();
+  if (!token?.trim())
+    return local;
+  const remote = await loadRemoteRegistry({ ...options, apiUrl, authToken: token });
+  return mergeSkillRegistryLists(local, remote);
+}
 async function loadRemoteSkill(name, options = {}) {
   const apiUrl = options.apiUrl || getConfiguredApiUrl();
   if (!apiUrl) {
@@ -47739,6 +47830,7 @@ var init_remote_registry = __esm(() => {
   init_auth_store();
   init_config();
   init_discovery();
+  init_registry_merge();
   remoteAvailabilitySchema = exports_external.object({
     status: exports_external.enum(["available", "unavailable"]),
     code: exports_external.string().optional(),
@@ -48077,7 +48169,7 @@ __export(exports_list, {
   registerBrowse: () => registerBrowse
 });
 function registerBrowse(parent) {
-  parent.command("list").alias("ls").option("-c, --category <category>", "Filter by category").option("-p, --pinned", "Show only pinned skills", false).option("-t, --tags <tags>", "Filter by comma-separated tags (OR logic, case-insensitive)").option("--all", "Show the full skill registry instead of the default basic set", false).option("--remote", "Use remote registry from SKILLS_API_URL or config apiUrl", false).option("--json", "Output as JSON", false).option("--brief", "One line per skill: name \u2014 description [category]", false).option("--format <format>", "Output format: compact (names only) or csv (name,category,price,description)").option("--limit <n>", "Maximum rows to print for human output (default: 30, use 0 or all for every row)").option("--cursor <n>", "Numeric offset for human-output pagination", "0").option("--verbose", "Show longer descriptions and tags in human output", false).action((options) => {
+  parent.command("list").alias("ls").option("-c, --category <category>", "Filter by category").option("-p, --pinned", "Show only pinned skills", false).option("-t, --tags <tags>", "Filter by comma-separated tags (OR logic, case-insensitive)").option("--tag <tags>", "Filter by comma-separated tags (alias for --tags)").option("--all", "Show the full skill registry instead of the default basic set", false).option("--remote", "Use remote registry from SKILLS_API_URL or config apiUrl", false).option("--json", "Output as JSON", false).option("--brief", "One line per skill: name \u2014 description [category]", false).option("--format <format>", "Output format: compact (names only) or csv (name,category,price,description)").option("--limit <n>", "Maximum rows to print for human output (default: 30, use 0 or all for every row)").option("--cursor <n>", "Numeric offset for human-output pagination", "0").option("--verbose", "Show longer descriptions and tags in human output", false).action((options) => {
     return handleList(options).catch(handleBrowseError);
   });
   parent.command("search").alias("s").argument("<query>", "Search term").option("--json", "Output as JSON", false).option("--brief", "One line per skill: name \u2014 description [category]", false).option("--format <format>", "Output format: compact (names only) or csv (name,category,price,description)").option("-c, --category <category>", "Filter results by category").option("-t, --tags <tags>", "Filter results by comma-separated tags (OR logic, case-insensitive)").option("--all", "Search the full skill registry instead of the default basic set", false).option("--remote", "Use remote registry from SKILLS_API_URL or config apiUrl", false).option("--limit <n>", "Maximum rows to print for human output (default: 20, use 0 or all for every row)").option("--cursor <n>", "Numeric offset for human-output pagination", "0").option("--verbose", "Show longer descriptions and tags in human output", false).description("Search for skills").action((query, options) => {
@@ -48129,10 +48221,11 @@ async function writeJson(value, space) {
 async function getBrowseRegistry(options) {
   const profile = options.all ? "all" : "basic";
   const local = loadRegistryProfile(profile);
-  if (!options.remote)
-    return local;
-  const remote = await loadRemoteRegistry();
-  return mergeSkillRegistryLists(local, remote);
+  if (options.remote) {
+    const remote = await loadRemoteRegistry();
+    return mergeSkillRegistryLists(local, remote);
+  }
+  return mergeRemoteRegistry(local);
 }
 function registryCategories(registry) {
   const known = CATEGORIES.filter((category) => registry.some((skill) => skill.category === category));
@@ -48140,7 +48233,13 @@ function registryCategories(registry) {
   return [...known, ...extra];
 }
 function availableCategories(options, registry) {
-  return options.remote ? registryCategories(registry) : [...CATEGORIES];
+  if (options.remote)
+    return registryCategories(registry);
+  const hasRemoteRows = registry.some((skill) => skill.source === "remote");
+  if (!hasRemoteRows)
+    return [...CATEGORIES];
+  const extras = Array.from(new Set(registry.map((skill) => skill.category))).filter((category) => !CATEGORIES.includes(category)).sort();
+  return [...CATEGORIES, ...extras];
 }
 async function handleList(options) {
   const brief = options.brief && !options.json;
@@ -48185,7 +48284,8 @@ Pinned skills (${showingLabel(installed.length, page2.items.length, page2.offset
     printPageHint(page2, "skills list --pinned");
     return;
   }
-  const tagFilter = options.tags ? options.tags.split(",").map((t) => t.trim().toLowerCase()).filter(Boolean) : null;
+  const tagsOption = options.tags ?? options.tag;
+  const tagFilter = tagsOption ? tagsOption.split(",").map((t) => t.trim().toLowerCase()).filter(Boolean) : null;
   if (options.category) {
     const categories = availableCategories(options, registry);
     const category = categories.find((c) => c.toLowerCase() === options.category.toLowerCase());
@@ -48396,6 +48496,8 @@ function listCommand(options) {
     parts.push("--category", quoteArg(options.category));
   if (options.tags)
     parts.push("--tags", quoteArg(options.tags));
+  else if (options.tag)
+    parts.push("--tag", quoteArg(options.tag));
   if (options.pinned)
     parts.push("--pinned");
   return parts.join(" ");
@@ -49100,7 +49202,8 @@ function handleDiff(name, options) {
   const canonical = {
     present: existsSync15(canonicalSkillMd),
     path: canonicalDir,
-    ...existsSync15(canonicalSkillMd) ? { hash: hashSkillMarkdownFile(canonicalSkillMd) } : {}
+    ...existsSync15(canonicalSkillMd) ? { hash: hashSkillMarkdownFile(canonicalSkillMd) } : {},
+    ...existsSync15(canonicalSkillMd) ? { stub: isPointerSkillMd(readFileSync12(canonicalSkillMd, "utf-8")) } : {}
   };
   const pinned = getInstalledSkills().includes(bare);
   const installMeta = getInstallMeta();
@@ -49120,6 +49223,14 @@ function handleDiff(name, options) {
     const managed = existsSync15(join15(dir, SYNC_MARKER_FILE));
     const skillMdPath = join15(dir, "SKILL.md");
     const hash = present && existsSync15(skillMdPath) ? hashSkillMarkdownFile(skillMdPath) : undefined;
+    let stub;
+    if (present && existsSync15(skillMdPath)) {
+      try {
+        stub = isPointerSkillMd(readFileSync12(skillMdPath, "utf-8"));
+      } catch {
+        stub = undefined;
+      }
+    }
     const diverged = present && canonical.present && managed && hash !== canonical.hash;
     homes.push({
       agent,
@@ -49127,6 +49238,7 @@ function handleDiff(name, options) {
       present,
       managed,
       ...hash ? { hash } : {},
+      ...stub !== undefined ? { stub } : {},
       ...diverged !== undefined ? { diverged } : {}
     });
   }
@@ -49156,7 +49268,8 @@ function handleDiff(name, options) {
       } else if (!home.managed) {
         console.log(`${source_default.dim("\u2022")} ${home.agent}: ${source_default.yellow("unmarked (adoption candidate)")}`);
       } else if (home.diverged) {
-        console.log(`${source_default.red("\u2717")} ${home.agent}: ${source_default.red("diverged")} ${source_default.dim(home.hash?.slice(0, 12))} \u2260 ${source_default.dim(canonical.hash?.slice(0, 12))}`);
+        const stubNote = home.stub === true ? " (home is a pointer stub; canonical holds content)" : canonical.stub === true ? " (home holds content; canonical renders a pointer stub \u2014 sync refuses to replace it)" : "";
+        console.log(`${source_default.red("\u2717")} ${home.agent}: ${source_default.red("diverged")} ${source_default.dim(home.hash?.slice(0, 12))} \u2260 ${source_default.dim(canonical.hash?.slice(0, 12))}${stubNote}`);
       } else {
         console.log(`${source_default.green("\u2713")} ${home.agent}: ${source_default.green("matches canonical")}`);
       }
@@ -50085,7 +50198,7 @@ var init_home_adoption = __esm(() => {
 });
 
 // src/lib/home-census.ts
-import { existsSync as existsSync18, readdirSync as readdirSync9, statSync as statSync9 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync15, readdirSync as readdirSync9, statSync as statSync9 } from "fs";
 import { homedir as homedir7 } from "os";
 import { join as join18 } from "path";
 function sortEntries(entries) {
@@ -50145,7 +50258,20 @@ function censusHomeDrift(options = {}) {
       }
       const homeHash = hashSkillMarkdownFile(skillMdPath);
       if (homeHash !== canonicalHash) {
-        entries.push({ agent, skill, kind: "diverged", path: dir, homeHash, canonicalHash });
+        let homeStub;
+        try {
+          homeStub = isPointerSkillMd(readFileSync15(skillMdPath, "utf-8"));
+        } catch {
+          homeStub = undefined;
+        }
+        let canonicalStub;
+        const canonicalSkillMd = join18(corpusRoot, skill, "SKILL.md");
+        try {
+          canonicalStub = isPointerSkillMd(readFileSync15(canonicalSkillMd, "utf-8"));
+        } catch {
+          canonicalStub = undefined;
+        }
+        entries.push({ agent, skill, kind: "diverged", path: dir, homeHash, canonicalHash, homeStub, canonicalStub });
       }
     }
     for (const [name, canonicalHash] of index) {
@@ -50180,7 +50306,7 @@ var exports_diagnostic = {};
 __export(exports_diagnostic, {
   registerDiagnostic: () => registerDiagnostic
 });
-import { existsSync as existsSync19, readFileSync as readFileSync15, readdirSync as readdirSync10, statSync as statSync10, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync16, readdirSync as readdirSync10, statSync as statSync10, writeFileSync as writeFileSync10 } from "fs";
 import { join as join19 } from "path";
 import { execSync as execSync2 } from "child_process";
 function registerDiagnostic(parent) {
@@ -50319,7 +50445,7 @@ function handleAuth(name, options) {
       process.exitCode = 1;
       return;
     }
-    let existing = existsSync19(envFilePath) ? readFileSync15(envFilePath, "utf-8") : "";
+    let existing = existsSync19(envFilePath) ? readFileSync16(envFilePath, "utf-8") : "";
     const keyPattern = new RegExp(`^${key}=.*$`, "m");
     const updated = keyPattern.test(existing) ? existing.replace(keyPattern, `${key}=${value}`) : existing.endsWith(`
 `) || existing === "" ? existing + `${key}=${value}
@@ -50427,7 +50553,7 @@ function handleOutdated(options) {
     let registryVersion = "unknown";
     if (existsSync19(registryPkgPath))
       try {
-        registryVersion = JSON.parse(readFileSync15(registryPkgPath, "utf-8")).version || "unknown";
+        registryVersion = JSON.parse(readFileSync16(registryPkgPath, "utf-8")).version || "unknown";
       } catch {}
     if (installedVersion !== registryVersion)
       pins.push({ skill: name, installedVersion, registryVersion });
@@ -50691,7 +50817,7 @@ var init_runs = __esm(() => {
 
 // src/lib/run-state.ts
 import { createHash as createHash2, randomBytes } from "crypto";
-import { existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync16, readdirSync as readdirSync11, statSync as statSync11, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync17, readdirSync as readdirSync11, statSync as statSync11, writeFileSync as writeFileSync11 } from "fs";
 import { extname, join as join20, relative as relative2 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now3 = new Date;
@@ -50762,7 +50888,7 @@ function appendRunEvent(context, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
   const path = join20(context.runDir, "events.ndjson");
-  const previous = existsSync20(path) ? readFileSync16(path, "utf-8") : "";
+  const previous = existsSync20(path) ? readFileSync17(path, "utf-8") : "";
   writeFileSync11(path, previous + line);
 }
 function listSkillRuns(targetDir = process.cwd(), limit = 50) {
@@ -50822,7 +50948,7 @@ function collectRunArtifacts(context) {
   const artifacts = [];
   for (const path of walkFiles(context.exportDir)) {
     const stat = statSync11(path);
-    const bytes = readFileSync16(path);
+    const bytes = readFileSync17(path);
     artifacts.push({
       path: toProjectRelative(context.targetDir, path),
       mime: mimeForPath(path),
@@ -50837,7 +50963,7 @@ function readRunRecord(runDir) {
   if (!existsSync20(path))
     return null;
   try {
-    return JSON.parse(readFileSync16(path, "utf-8"));
+    return JSON.parse(readFileSync17(path, "utf-8"));
   } catch {
     return null;
   }
@@ -68063,8 +68189,11 @@ var init_discovery_tools = __esm(() => {
 // src/lib/remote-client.ts
 var exports_remote_client = {};
 __export(exports_remote_client, {
+  createRemoteSkillsClientReadOnly: () => createRemoteSkillsClientReadOnly,
   createRemoteSkillsClient: () => createRemoteSkillsClient,
-  RemoteSkillsClient: () => RemoteSkillsClient
+  RemoteSkillsClient: () => RemoteSkillsClient,
+  RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
+  RemoteRequestError: () => RemoteRequestError
 });
 
 class RemoteSkillsClient {
@@ -68084,6 +68213,20 @@ class RemoteSkillsClient {
       }
     });
   }
+  async requestNewRoute(path, options, opts = {}) {
+    const response = await this.request(path, options);
+    const routePath = path.split("?")[0];
+    if (response.status === 404 || response.status === 405) {
+      if (response.status === 404 && opts.domainNotFoundCodes?.length && await responseBodyCarriesCode(response, opts.domainNotFoundCodes)) {
+        return response;
+      }
+      throw new RemoteRouteUnsupportedError(routePath, response.status, this.apiUrl);
+    }
+    if (!response.ok) {
+      throw new RemoteRequestError(routePath, response.status, response.statusText);
+    }
+    return response;
+  }
   async listSkills() {
     const res = await this.request("/api/v1/skills");
     return res.json();
@@ -68100,6 +68243,14 @@ class RemoteSkillsClient {
       return null;
     return res.json();
   }
+  async getSkillStatus(slug) {
+    const res = await this.request(`/api/v1/skills/${encodeURIComponent(slug)}`, { method: "GET" });
+    let body = null;
+    try {
+      body = await res.json();
+    } catch {}
+    return { status: res.status, body };
+  }
   async submitRun(slug, input, args) {
     const res = await this.request(`/api/v1/runs/${slug}`, {
       method: "POST",
@@ -68133,15 +68284,18 @@ class RemoteSkillsClient {
       method: "GET"
     });
   }
-  async publishSkill(manifest, bundle) {
+  async publishSkill(manifest, bundle, ifMatch) {
     const form = new FormData;
     form.set("manifest", JSON.stringify(manifest));
     if (bundle) {
       form.set("bundle", new Blob([bundle], { type: "application/gzip" }), `${String(manifest.slug ?? "skill")}.tar.gz`);
     }
+    const headers = { Authorization: `Bearer ${this.apiKey}` };
+    if (ifMatch)
+      headers["If-Match"] = ifMatch;
     return fetch(`${this.apiUrl}/api/v1/skills`, {
       method: "POST",
-      headers: { Authorization: `Bearer ${this.apiKey}` },
+      headers,
       body: form
     });
   }
@@ -68157,6 +68311,135 @@ class RemoteSkillsClient {
       return null;
     return response;
   }
+  async listPins() {
+    const response = await this.requestNewRoute("/api/v1/pins");
+    return normalizePinList(await response.json());
+  }
+  async pin(slug, metadata) {
+    const path = `/api/v1/pins/${encodeURIComponent(slug)}`;
+    const response = await this.requestNewRoute(path, {
+      method: "PUT",
+      body: JSON.stringify({ ...metadata ? { metadata } : {} })
+    });
+    return normalizePin(await response.json());
+  }
+  async unpin(slug) {
+    const path = `/api/v1/pins/${encodeURIComponent(slug)}`;
+    const response = await this.requestNewRoute(path, { method: "DELETE" }, { domainNotFoundCodes: ["PIN_NOT_FOUND"] });
+    return response.status !== 404;
+  }
+  async listTags() {
+    const response = await this.requestNewRoute("/api/v1/tags");
+    const payload = await response.json();
+    if (!Array.isArray(payload)) {
+      throw new Error("Remote tags payload did not match the expected contract (expected an array of tag names)");
+    }
+    for (const tag of payload) {
+      if (typeof tag !== "string" || tag.trim().length === 0) {
+        throw new Error("Remote tags payload did not match the expected contract (every element must be a non-empty tag name)");
+      }
+    }
+    return payload;
+  }
+  async skillsByTag(tag) {
+    const path = `/api/v1/tags/${encodeURIComponent(tag)}/skills`;
+    const response = await this.requestNewRoute(path);
+    return normalizeSkillSummaryList(await response.json());
+  }
+  async listUpdatedSince(since, options = {}) {
+    const params = new URLSearchParams({ since });
+    if (options.cursor)
+      params.set("cursor", options.cursor);
+    if (options.limit !== undefined)
+      params.set("limit", String(options.limit));
+    const response = await this.requestNewRoute(`/api/v1/skills/updated?${params.toString()}`);
+    return normalizeUpdatedSincePage(await response.json());
+  }
+}
+function requireOptionalString(record3, field) {
+  if (record3[field] === undefined)
+    return;
+  if (typeof record3[field] !== "string") {
+    throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
+  }
+  return record3[field];
+}
+function normalizePin(entry) {
+  if (!entry || typeof entry !== "object") {
+    throw new Error("Remote pin payload did not match the expected contract (expected an object)");
+  }
+  const record3 = entry;
+  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  if (!slug) {
+    throw new Error("Remote pin payload did not match the expected contract (missing slug)");
+  }
+  let metadata;
+  if (record3.metadata !== undefined) {
+    if (!record3.metadata || typeof record3.metadata !== "object" || Array.isArray(record3.metadata)) {
+      throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
+    }
+    metadata = record3.metadata;
+  }
+  const pinnedAt = requireOptionalString(record3, "pinnedAt");
+  return {
+    slug,
+    ...pinnedAt !== undefined ? { pinnedAt } : {},
+    ...metadata ? { metadata } : {}
+  };
+}
+function normalizePinList(payload) {
+  if (!Array.isArray(payload)) {
+    throw new Error("Remote pins payload did not match the expected contract (expected an array of pins)");
+  }
+  return payload.map(normalizePin);
+}
+function normalizeSkillSummary(entry) {
+  if (!entry || typeof entry !== "object") {
+    throw new Error("Remote skill payload did not match the expected contract (expected an object)");
+  }
+  const record3 = entry;
+  const slug = typeof record3.slug === "string" && record3.slug.trim() ? record3.slug.trim() : undefined;
+  if (!slug) {
+    throw new Error("Remote skill payload did not match the expected contract (missing slug)");
+  }
+  return {
+    slug,
+    ...requireOptionalString(record3, "name") !== undefined ? { name: requireOptionalString(record3, "name") } : {},
+    ...requireOptionalString(record3, "version") !== undefined ? { version: requireOptionalString(record3, "version") } : {},
+    ...requireOptionalString(record3, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record3, "updatedAt") } : {}
+  };
+}
+function normalizeSkillSummaryList(payload) {
+  if (!Array.isArray(payload)) {
+    throw new Error("Remote skills payload did not match the expected contract (expected an array of skills)");
+  }
+  return payload.map(normalizeSkillSummary);
+}
+async function responseBodyCarriesCode(response, codes) {
+  try {
+    const payload = await response.clone().json();
+    if (!payload || typeof payload !== "object")
+      return false;
+    const code = payload.code;
+    return typeof code === "string" && codes.includes(code);
+  } catch {
+    return false;
+  }
+}
+function normalizeUpdatedSincePage(payload) {
+  if (!payload || typeof payload !== "object") {
+    throw new Error("Updated-since payload did not match the expected contract (expected an object)");
+  }
+  const record3 = payload;
+  if (!Array.isArray(record3.skills)) {
+    throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
+  }
+  const skills = record3.skills.map(normalizeSkillSummary);
+  const nextCursor = record3.nextCursor === undefined || record3.nextCursor === null ? null : record3.nextCursor;
+  if (nextCursor !== null && typeof nextCursor !== "string") {
+    throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
+  }
+  return { skills, nextCursor };
 }
 function createRemoteSkillsClient() {
   const apiKey = getApiKey();
@@ -68164,8 +68447,42 @@ function createRemoteSkillsClient() {
     return null;
   return new RemoteSkillsClient(apiKey);
 }
+function createRemoteSkillsClientReadOnly() {
+  const apiKey = getApiKeyReadOnly();
+  if (!apiKey)
+    return null;
+  const apiUrl = resolveApiUrl(loadConfigReadOnly(), process.env);
+  if (!apiUrl)
+    throw new MissingApiUrlError("the cloud group's sync verb (--dry-run)");
+  return new RemoteSkillsClient(apiKey, apiUrl);
+}
+var RemoteRouteUnsupportedError, RemoteRequestError;
 var init_remote_client = __esm(() => {
   init_auth_store();
+  init_api_url();
+  init_config();
+  RemoteRouteUnsupportedError = class RemoteRouteUnsupportedError extends Error {
+    path;
+    status;
+    instance;
+    constructor(path, status, instance) {
+      super(`The configured Skills instance does not support ${path} (HTTP ${status}). ` + `The instance at ${instance} predates this client feature \u2014 upgrade the server, or ` + `use a client version that matches it.`);
+      this.path = path;
+      this.status = status;
+      this.instance = instance;
+      this.name = "RemoteRouteUnsupportedError";
+    }
+  };
+  RemoteRequestError = class RemoteRequestError extends Error {
+    path;
+    status;
+    constructor(path, status, statusText) {
+      super(`Remote request to ${path} failed: HTTP ${status}${statusText ? ` ${statusText}` : ""}`);
+      this.path = path;
+      this.status = status;
+      this.name = "RemoteRequestError";
+    }
+  };
 });
 
 // src/mcp/operation-tools.ts
@@ -68630,14 +68947,14 @@ var init_operation_tools = __esm(() => {
 
 // src/lib/feedback.ts
 import { existsSync as existsSync22, mkdirSync as mkdirSync10 } from "fs";
-import { dirname as dirname6, join as join22 } from "path";
+import { dirname as dirname7, join as join22 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
   return join22(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
-  const dir = dirname6(dbPath);
+  const dir = dirname7(dbPath);
   if (!existsSync22(dir))
     mkdirSync10(dir, { recursive: true });
   const db = new Database(dbPath);
@@ -68812,7 +69129,7 @@ var init_resource_meta_tools = __esm(() => {
 });
 
 // src/lib/scheduler.ts
-import { existsSync as existsSync23, readFileSync as readFileSync17, writeFileSync as writeFileSync12, mkdirSync as mkdirSync11 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync18, writeFileSync as writeFileSync12, mkdirSync as mkdirSync11 } from "fs";
 import { join as join23 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
   return join23(targetDir, ".skills", "schedules.json");
@@ -68821,7 +69138,7 @@ function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
   if (existsSync23(path)) {
     try {
-      return JSON.parse(readFileSync17(path, "utf-8"));
+      return JSON.parse(readFileSync18(path, "utf-8"));
     } catch {}
   }
   return { version: 1, schedules: [] };
@@ -69131,12 +69448,12 @@ import { createHash as createHash3, createHmac as createHmac2 } from "crypto";
 import {
   existsSync as existsSync24,
   mkdirSync as mkdirSync12,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   readdirSync as readdirSync13,
   statSync as statSync13,
   writeFileSync as writeFileSync13
 } from "fs";
-import { dirname as dirname7, join as join24, normalize as normalize3, relative as relative3, sep as sep2 } from "path";
+import { dirname as dirname8, join as join24, normalize as normalize3, relative as relative3, sep as sep2 } from "path";
 function resolveSkillsNativeStorageConfig(env3 = process.env) {
   assertNoRetiredModeEnvVars(env3, {
     app: SKILLS_ENV_NAMESPACE,
@@ -69168,7 +69485,7 @@ function getSkillsNativeStorageStatus(options = {}) {
   const s3BucketEnv = readStorageEnv(env3, "s3Bucket");
   const targetDir = options.targetDir ?? process.cwd();
   return {
-    package: "open-skills",
+    package: "skills",
     tables: [...SKILLS_STORAGE_TABLES],
     env: {
       databaseUrl: SKILLS_NATIVE_STORAGE_ENV.databaseUrl,
@@ -69199,7 +69516,7 @@ function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
   const files = [];
   if (existsSync24(projectStateDir)) {
     for (const filePath of walkFiles2(projectStateDir)) {
-      const bytes = readFileSync18(filePath);
+      const bytes = readFileSync19(filePath);
       const relativePath = toPosix(relative3(targetDir, filePath));
       files.push({
         path: relativePath,
@@ -69361,7 +69678,7 @@ function registerStorageTools(server) {
     const snapshot = exportSkillsLocalSnapshot(targetDir, { includeFileContents: false });
     const s3Plan = config2.s3Bucket ? planSkillsS3SnapshotUpload(snapshot, { prefix: config2.s3Prefix }) : [];
     return mcpJson({
-      package: "open-skills",
+      package: "skills",
       noNetwork: true,
       databaseConfigured: Boolean(config2.databaseUrl),
       s3Configured: Boolean(config2.s3Bucket),
@@ -69802,9 +70119,9 @@ var init_mcp2 = __esm(() => {
 });
 
 // src/cli/commands/runtime-mcp.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync13, readFileSync as readFileSync20, writeFileSync as writeFileSync14 } from "fs";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname8, join as join25 } from "path";
+import { dirname as dirname9, join as join25 } from "path";
 async function handleMcp(options) {
   if (options.register) {
     let agents;
@@ -69912,7 +70229,7 @@ function registerCodexMcp(command) {
   const config2 = `[mcp_servers.${MCP_SERVER_NAME}]
 command = ${JSON.stringify(command)}`;
   try {
-    const current = existsSync25(path) ? readFileSync19(path, "utf-8") : "";
+    const current = existsSync25(path) ? readFileSync20(path, "utf-8") : "";
     writeTextFile(path, upsertTomlSection(current, `[mcp_servers.${MCP_SERVER_NAME}]`, `command = ${JSON.stringify(command)}`));
     return { agent: "codex", success: true, path, config: config2 };
   } catch (err) {
@@ -69964,7 +70281,7 @@ function registerJsonMcpServer(agent, path, containerKey, server2) {
 function readJsonObject2(path) {
   if (!existsSync25(path))
     return {};
-  const raw = readFileSync19(path, "utf-8").trim();
+  const raw = readFileSync20(path, "utf-8").trim();
   if (!raw)
     return {};
   const parsed = JSON.parse(raw);
@@ -69977,7 +70294,7 @@ function writeJsonObject(path, data) {
 `);
 }
 function writeTextFile(path, content) {
-  mkdirSync13(dirname8(path), { recursive: true });
+  mkdirSync13(dirname9(path), { recursive: true });
   writeFileSync14(path, content.endsWith(`
 `) ? content : `${content}
 `);
@@ -70029,7 +70346,7 @@ __export(exports_runtime, {
   registerRuntime: () => registerRuntime
 });
 import { mkdirSync as mkdirSync14, writeFileSync as writeFileSync15 } from "fs";
-import { dirname as dirname9, join as join26 } from "path";
+import { dirname as dirname10, join as join26 } from "path";
 import { createInterface } from "readline";
 function registerRuntime(parent) {
   parent.command("run").argument("<skill>", "Skill name").argument("[args...]", "Arguments to pass to the skill").allowUnknownOption(true).passThroughOptions(true).option("--json", "Output result as JSON", false).option("--wait", "Poll remote runs until a terminal status", false).option("--poll-interval-ms <ms>", "Remote polling interval in milliseconds", "1000").option("--poll-timeout-ms <ms>", "Maximum time to wait for a remote run", "300000").description("Run a skill directly").action(async (name, args2, options) => handleRun(name, args2, options));
@@ -70514,7 +70831,7 @@ async function handleExportsDownload(runId, options) {
         throw new Error(`download failed for artifact ${artifactId}: ${response.status}`);
       const relativePath = safeArtifactRelativePath(typeof artifact.relativePath === "string" ? artifact.relativePath : artifact.fileName, String(artifact.fileName || artifactId));
       const outputPath = join26(exportDir, relativePath);
-      mkdirSync14(dirname9(outputPath), { recursive: true });
+      mkdirSync14(dirname10(outputPath), { recursive: true });
       const bytes = new Uint8Array(await response.arrayBuffer());
       writeFileSync15(outputPath, bytes);
       downloaded.push({ id: artifactId, path: outputPath, byteSize: bytes.byteLength });
@@ -70954,7 +71271,7 @@ function registerCreateSync(parent) {
     console.log(`${source_default.cyan("project")}: ${pp}${existsSync26(pp) ? source_default.green(" (exists)") : source_default.dim(" (not found)")}`);
   });
   parent.command("create").argument("<name>", "Skill name (e.g. my-tool)").option("--category <category>", "Skill category", "Development Tools").option("--description <description>", "Short description of what the skill does").option("--tags <tags>", "Comma-separated tags (e.g. api,testing,automation)").option("--global", "Deprecated; custom skills are always global", false).option("--json", "Output result as JSON", false).description("Scaffold a new custom skill directory").action((name, options) => handleCreate(name, options));
-  parent.command("sync").alias("render").argument("[names...]", "Skills to sync (default: every skill in this machine's corpus)").option("--for <agent>", `Target one agent (${SYNC_AGENTS.join(", ")}, or all)`, "all").option("--all", "Sync every corpus skill (the default)", false).option("--source <path>", "Canonical corpus source: a directory of skill folders, or a package root with skills/ and agent-skills/ (overrides $SKILLS_SOURCE)").option("--dry-run", "Show what would be written without touching any agent folder", false).option("--force", "Adopt an unmanaged skill that already has SKILL.md; other unmarked directories are never overwritten", false).option("--check", "Home drift census (missing-from-home / stray-in-home / diverged); exits non-zero on drift, writes nothing", false).option("--adopt", "Unmarked-home adoption mode: hash unmarked home skills against the corpus; exact matches are marked (dry-run by default)", false).option("--prune", "Prune mode: list (or with --apply, remove) marked home skill dirs that have no canonical corpus entry", false).option("--apply", "Write adoption markers / conflicts ledger, or perform prune removals", false).option("--json", "Output as JSON", false).description("Write corpus skills into each coding agent's global skills folder, per-tool adapted").action((names, options) => handleSync(names, options));
+  parent.command("sync").alias("render").argument("[names...]", "Skills to sync (default: every skill in this machine's corpus)").option("--for <agent>", `Target one agent (${SYNC_AGENTS.join(", ")}, or all)`, "all").option("--all", "Sync every corpus skill (the default)", false).option("--source <path>", "Canonical corpus source: a directory of skill folders, or a package root with skills/ (overrides $SKILLS_SOURCE)").option("--dry-run", "Show what would be written without touching any agent folder", false).option("--force", "Adopt an unmanaged skill that already has SKILL.md; other unmarked directories are never overwritten", false).option("--check", "Home drift census (missing-from-home / stray-in-home / diverged); exits non-zero on drift, writes nothing", false).option("--adopt", "Unmarked-home adoption mode: hash unmarked home skills against the corpus; exact matches are marked (dry-run by default)", false).option("--prune", "Prune mode: list (or with --apply, remove) marked home skill dirs that have no canonical corpus entry", false).option("--apply", "Write adoption markers / conflicts ledger, or perform prune removals", false).option("--json", "Output as JSON", false).description("Write corpus skills into each coding agent's global skills folder, per-tool adapted").action((names, options) => handleSync(names, options));
 }
 function handleCreate(name, options) {
   const bare = name.trim();
@@ -71139,7 +71456,12 @@ Home drift census: ${census.entries.length} drift entr${census.entries.length ==
 `));
   for (const entry of census.entries) {
     const kind = entry.kind === "missing-from-home" ? source_default.red("missing-from-home") : entry.kind === "stray-in-home" ? source_default.yellow("stray-in-home") : source_default.yellow("diverged");
-    console.log(`  ${kind}  ${source_default.bold(entry.skill)} \u2192 ${entry.agent}  ${source_default.dim(entry.path)}`);
+    let note = "";
+    if (entry.homeStub === true)
+      note = " (home is a pointer stub; canonical holds content)";
+    else if (entry.canonicalStub === true)
+      note = " (home holds content; canonical renders a pointer stub \u2014 sync refuses to replace it)";
+    console.log(`  ${kind}  ${source_default.bold(entry.skill)} \u2192 ${entry.agent}  ${source_default.dim(entry.path)}${note}`);
   }
   console.log(source_default.dim(`
 ${census.managed} managed, ${census.unmarked} unmarked (adoption candidates). Exit code is non-zero while drift exists.`));
@@ -71497,7 +71819,7 @@ var init_schedule = __esm(() => {
 
 // src/lib/registry-sync.ts
 import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync17 } from "fs";
-import { dirname as dirname10, relative as relative4 } from "path";
+import { dirname as dirname11, relative as relative4 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
   const includeDocs = options.includeDocs ?? true;
@@ -71554,7 +71876,7 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync16(dirname10(path), { recursive: true });
+  mkdirSync16(dirname11(path), { recursive: true });
   writeFileSync17(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
@@ -71573,9 +71895,32 @@ var init_registry_sync = __esm(() => {
   init_skill_validation();
 });
 
-// src/lib/skill-bundle.ts
+// src/lib/revision.ts
 import { createHash as createHash4 } from "crypto";
-import { readFileSync as readFileSync20, readdirSync as readdirSync14, statSync as statSync14 } from "fs";
+function revisionIdOf(content) {
+  const canonical = JSON.stringify({
+    slug: content.slug,
+    displayName: content.displayName,
+    description: content.description,
+    category: content.category,
+    tags: content.tags,
+    source: content.source,
+    kind: content.kind,
+    version: content.version ?? null,
+    skillMd: content.skillMd ?? null,
+    bundleSha256: content.bundleSha256 ?? null,
+    bundleByteSize: content.bundleByteSize ?? null
+  });
+  return createHash4("sha256").update(canonical).digest("hex");
+}
+var REVISION_ID_PATTERN;
+var init_revision = __esm(() => {
+  REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
+});
+
+// src/lib/skill-bundle.ts
+import { createHash as createHash5 } from "crypto";
+import { readFileSync as readFileSync21, readdirSync as readdirSync14, statSync as statSync14 } from "fs";
 import { join as join28, relative as relative5 } from "path";
 function isDotenvFile(lower) {
   if (lower === ".env" || lower.startsWith(".env."))
@@ -71605,7 +71950,7 @@ function ownBytes(view) {
   return out;
 }
 function sha256Hex(bytes) {
-  return createHash4("sha256").update(bytes).digest("hex");
+  return createHash5("sha256").update(bytes).digest("hex");
 }
 function collectSkillBundleEntries(dir) {
   const entries = [];
@@ -71621,6 +71966,8 @@ function walk(root, current, out) {
       continue;
     if (isRootLevel && ROOT_EXCLUDES.has(entry.name.toLowerCase()))
       continue;
+    if (isRootLevel && TOOL_SIDECAR_FILENAMES.has(entry.name.toLowerCase()))
+      continue;
     if (entry.name.startsWith("._"))
       continue;
     if (entry.isSymbolicLink())
@@ -71636,7 +71983,7 @@ function walk(root, current, out) {
     const stats = statSync14(absolute);
     out.push({
       path: rel,
-      bytes: ownBytes(readFileSync20(absolute)),
+      bytes: ownBytes(readFileSync21(absolute)),
       mode: stats.mode & 64 ? 493 : 420
     });
   }
@@ -71774,7 +72121,7 @@ function concat2(chunks) {
   }
   return merged;
 }
-var BLOCK = 512, ANY_SEGMENT_EXCLUDES, ROOT_EXCLUDES, CREDENTIAL_FILENAMES, CREDENTIAL_EXTENSIONS, ENV_TEMPLATE_NAMES, NON_DOTENV_EXTENSIONS;
+var BLOCK = 512, ANY_SEGMENT_EXCLUDES, ROOT_EXCLUDES, TOOL_SIDECAR_FILENAMES, CREDENTIAL_FILENAMES, CREDENTIAL_EXTENSIONS, ENV_TEMPLATE_NAMES, NON_DOTENV_EXTENSIONS;
 var init_skill_bundle = __esm(() => {
   ANY_SEGMENT_EXCLUDES = new Set([
     ".git",
@@ -71787,6 +72134,7 @@ var init_skill_bundle = __esm(() => {
     ".docker"
   ]);
   ROOT_EXCLUDES = new Set(["dist", "build", ".turbo"]);
+  TOOL_SIDECAR_FILENAMES = new Set([".hasna-skills.json"]);
   CREDENTIAL_FILENAMES = new Set([
     ".npmrc",
     ".pypirc",
@@ -71921,8 +72269,8 @@ var init_skill_bundles = __esm(() => {
 });
 
 // src/lib/pull.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync2, renameSync as renameSync4, rmSync as rmSync6, writeFileSync as writeFileSync18 } from "fs";
-import { dirname as dirname11, join as join29 } from "path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync2, readFileSync as readFileSync22, renameSync as renameSync4, rmSync as rmSync6, writeFileSync as writeFileSync18 } from "fs";
+import { dirname as dirname12, join as join29 } from "path";
 async function pullSkills(options = {}) {
   const client = options.client !== undefined ? options.client : createRemoteSkillsClient();
   if (!client) {
@@ -71963,6 +72311,15 @@ async function pullOne(client, rawName, corpusOptions, verify) {
     return { name: slug, success: false, error: `Failed to fetch '${slug}': ${error2.message}` };
   }
   if (bundleResponse && !bundleResponse.ok) {
+    if (bundleResponse.status === 410) {
+      return reconcileTombstone(slug, corpusOptions);
+    }
+    if (bundleResponse.status === 404) {
+      const marker = readPullMarker(join29(getPortableSkillsRoot(corpusOptions), slug));
+      if (marker && typeof marker.revisionId === "string" && marker.revisionId) {
+        return { name: slug, success: true, purged: true, removed: false };
+      }
+    }
     return {
       name: slug,
       success: false,
@@ -71988,17 +72345,78 @@ async function pullOne(client, rawName, corpusOptions, verify) {
   if (skillMd === null) {
     return { name: slug, success: false, error: `Skill '${slug}' was not found on the configured Skills instance.` };
   }
+  if (!meta?.revisionId) {
+    const marker = readPullMarker(join29(getPortableSkillsRoot(corpusOptions), slug));
+    if (marker && typeof marker.revisionId === "string" && marker.revisionId) {
+      return { name: slug, success: true, purged: true, removed: false };
+    }
+  }
+  let provenRevisionId;
+  try {
+    provenRevisionId = meta?.revisionId ? provenRevision({ ...meta, skillMd }, slug, {}) : undefined;
+  } catch (error2) {
+    if (error2 instanceof PullSkillError) {
+      return { name: slug, success: false, error: error2.message };
+    }
+    throw error2;
+  }
   const written = writeCorpusSkill({ name: slug, skillMd, meta }, corpusOptions);
-  writePullMarker(written.path, { skill: slug, version: written.manifest.version });
+  writePullMarker(written.path, {
+    skill: slug,
+    version: written.manifest.version,
+    ...provenRevisionId ? { revisionId: provenRevisionId } : {}
+  });
   return {
     name: slug,
     success: true,
     path: written.path,
     kind: written.manifest.kind,
     version: written.manifest.version,
-    created: written.created
+    created: written.created,
+    ...provenRevisionId ? { revisionId: provenRevisionId } : {}
   };
 }
+function provenRevision(meta, slug, bundle) {
+  const declared = meta.revisionId;
+  if (!declared)
+    return "";
+  const source = meta.publishedSource;
+  if (typeof source !== "string" || source.length === 0) {
+    throw new PullSkillError(`Revision proof failed for '${slug}': the instance declared revision '${declared.slice(0, 12)}\u2026' but did not serve the content fields needed to recompute it (publishedSource). Nothing was installed.`);
+  }
+  const recomputed = revisionIdOf({
+    slug,
+    displayName: meta.displayName ?? "",
+    description: meta.description ?? "",
+    category: meta.category ?? "",
+    tags: meta.tags ?? [],
+    source,
+    kind: meta.kind ?? "instruction",
+    ...meta.version ? { version: meta.version } : {},
+    ...typeof meta.skillMd === "string" && meta.skillMd.length > 0 ? { skillMd: meta.skillMd } : {},
+    ...bundle.sha256 ? { bundleSha256: bundle.sha256 } : {},
+    ...bundle.byteSize !== undefined && bundle.byteSize !== null ? { bundleByteSize: bundle.byteSize } : {}
+  });
+  if (recomputed !== declared) {
+    throw new PullSkillError(`Revision proof failed for '${slug}': the instance declared revision '${declared.slice(0, 12)}\u2026' but the served content recomputes to '${recomputed.slice(0, 12)}\u2026'. The declared revision does not identify the content that was received. Nothing was installed.`);
+  }
+  return declared;
+}
+function reconcileTombstone(slug, corpusOptions) {
+  const target = join29(getPortableSkillsRoot(corpusOptions), slug);
+  if (!existsSync27(join29(target, PULL_MARKER_FILE))) {
+    return { name: slug, success: true, tombstoned: true, removed: false, leftInPlace: true };
+  }
+  rmSync6(target, { recursive: true, force: true });
+  return { name: slug, success: true, tombstoned: true, removed: true };
+}
+function readPullMarker(dir) {
+  try {
+    return JSON.parse(readFileSync22(join29(dir, PULL_MARKER_FILE), "utf-8"));
+  } catch {
+    return null;
+  }
+}
 function installVerifiedBundle(slug, response, meta, corpusOptions, verify) {
   return response.arrayBuffer().then((buffer) => {
     const verified = verifyBundleResponseBytes(buffer, response, verify);
@@ -72010,11 +72428,17 @@ function installVerifiedBundle(slug, response, meta, corpusOptions, verify) {
     }
     const version2 = str(meta?.version) ?? versionFromEntries(entries) ?? "unknown";
     const sourceCommit = sourceCommitFromEntries(entries);
+    const declaredRevision = verified.revisionId ?? meta?.revisionId;
+    if (declaredRevision && meta?.revisionId && verified.revisionId && declaredRevision !== meta.revisionId) {
+      throw new PullSkillError(`Revision proof failed for '${slug}': the bundle header declares '${verified.revisionId.slice(0, 12)}\u2026' but the metadata declares '${meta.revisionId.slice(0, 12)}\u2026'. The instance is inconsistent. Nothing was installed.`);
+    }
+    const provenRevisionId = declaredRevision ? provenRevision(meta ?? {}, slug, { sha256: verified.contentHash, byteSize: verified.bytes.byteLength }) : undefined;
     const installed = installBundleAtomically(slug, entries, corpusOptions, {
       version: version2,
       contentHash: verified.contentHash,
       ...sourceCommit ? { sourceCommit } : {},
-      ...verified.signature ? { signature: verified.signature } : {}
+      ...verified.signature ? { signature: verified.signature } : {},
+      ...provenRevisionId ? { revisionId: provenRevisionId } : {}
     });
     return {
       name: slug,
@@ -72024,6 +72448,7 @@ function installVerifiedBundle(slug, response, meta, corpusOptions, verify) {
       version: version2,
       contentHash: verified.contentHash,
       ...sourceCommit ? { sourceCommit } : {},
+      ...provenRevisionId ? { revisionId: provenRevisionId } : {},
       created: installed.created
     };
   });
@@ -72074,11 +72499,20 @@ function sourceCommitFromEntries(entries) {
 function verifyBundleResponseBytes(buffer, response, verify = {}) {
   const serverHash = response.headers.get(BUNDLE_DIGEST_HEADER);
   const signature = response.headers.get(BUNDLE_SIGNATURE_HEADER);
+  const revisionId = response.headers.get(BUNDLE_REVISION_ID_HEADER);
+  const revisionNumberRaw = response.headers.get(BUNDLE_REVISION_NUMBER_HEADER);
   const bytes = new Uint8Array(buffer.slice(0));
   const contentHash = sha256Hex(bytes);
   if (serverHash && serverHash.toLowerCase() !== contentHash) {
     throw new PullSkillError(`Bundle digest mismatch: the instance declared ${serverHash} but the received bundle hashes to ${contentHash}.`, ["The bundle was tampered with or truncated in transit. Nothing was installed."]);
   }
+  if (revisionId && !REVISION_ID_PATTERN.test(revisionId)) {
+    throw new PullSkillError(`Malformed revision id: the instance declared '${revisionId}', which is not a 64-character lowercase hex sha-256.`, ["The revision headers were tampered with or the instance is broken. Nothing was installed."]);
+  }
+  const revisionNumber = revisionNumberRaw === null ? undefined : Number(revisionNumberRaw);
+  if (revisionNumberRaw !== null && (!Number.isInteger(revisionNumber) || revisionNumber < 0)) {
+    throw new PullSkillError(`Malformed revision number: the instance declared '${revisionNumberRaw}', which is not a non-negative integer.`, ["The revision headers were tampered with or the instance is broken. Nothing was installed."]);
+  }
   if (signature) {
     const key = verify.signingKey;
     if (!key) {
@@ -72091,7 +72525,9 @@ function verifyBundleResponseBytes(buffer, response, verify = {}) {
     bytes,
     contentHash,
     ...serverHash ? { serverHash } : {},
-    ...signature ? { signature } : {}
+    ...signature ? { signature } : {},
+    ...revisionId ? { revisionId } : {},
+    ...revisionNumberRaw === null || revisionNumber === undefined ? {} : { revisionNumber }
   };
 }
 function installBundleAtomically(name, entries, options = {}, marker = {}) {
@@ -72105,7 +72541,7 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
   try {
     for (const entry of entries) {
       const destination = join29(staging, entry.path);
-      mkdirSync17(dirname11(destination), { recursive: true });
+      mkdirSync17(dirname12(destination), { recursive: true });
       writeFileSync18(destination, entry.bytes, { mode: entry.mode });
     }
     writePullMarker(staging, {
@@ -72113,7 +72549,8 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       ...marker.version ? { version: marker.version } : {},
       ...marker.contentHash ? { contentHash: marker.contentHash } : {},
       ...marker.sourceCommit ? { sourceCommit: marker.sourceCommit } : {},
-      ...marker.signature ? { signature: marker.signature } : {}
+      ...marker.signature ? { signature: marker.signature } : {},
+      ...marker.revisionId ? { revisionId: marker.revisionId } : {}
     });
     if (existsSync27(target)) {
       backup = mkdtempSync2(join29(root, `.pull-backup-${name}-`));
@@ -72138,11 +72575,12 @@ function writePullMarker(dir, record3) {
   const marker = {
     managedBy: "@hasna/skills",
     skill: record3.skill,
-    source: "pull",
+    source: record3.source ?? "pull",
     ...record3.version ? { version: record3.version } : {},
     ...record3.contentHash ? { contentHash: record3.contentHash } : {},
     ...record3.sourceCommit ? { sourceCommit: record3.sourceCommit } : {},
     ...record3.signature ? { signature: record3.signature } : {},
+    ...record3.revisionId ? { revisionId: record3.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
   writeFileSync18(join29(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
@@ -72166,20 +72604,14 @@ async function safeMeta(client, slug) {
     ...str(record3.category) ? { category: str(record3.category) } : {},
     ...tags && tags.length ? { tags } : {},
     ...str(record3.version) ? { version: str(record3.version) } : {},
-    ...kind ? { kind } : {}
+    ...kind ? { kind } : {},
+    ...REVISION_ID_PATTERN.test(str(record3.revisionId) ?? "") ? { revisionId: str(record3.revisionId) } : {},
+    ...typeof record3.skillMd === "string" && record3.skillMd.length > 0 ? { skillMd: record3.skillMd } : {},
+    ...str(record3.publishedSource) ? { publishedSource: str(record3.publishedSource) } : {}
   };
 }
 function pickCorpusOptions(options) {
-  return { rootDir: resolvePullCorpusRoot(options) };
-}
-function resolvePullCorpusRoot(options) {
-  if (options.rootDir)
-    return options.rootDir;
-  const appDir = options.homeDir ? join29(options.homeDir, ".hasna", "skills") : getDataDir();
-  const cache3 = join29(appDir, SKILLS_CACHE_DIRNAME2);
-  if (existsSync27(join29(cache3, LAYOUT_MIGRATION_RECORD2)) && existsSync27(cache3))
-    return cache3;
-  return getPortableSkillsRoot(options);
+  return { rootDir: resolveCorpusRoot(options) };
 }
 function extractSlug(entry) {
   if (!entry || typeof entry !== "object")
@@ -72193,13 +72625,15 @@ function dedupe(values2) {
 function str(value) {
   return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
-var BUNDLE_DIGEST_HEADER = "X-Skill-Bundle-Sha256", BUNDLE_SIGNATURE_HEADER = "X-Skill-Bundle-Signature", PULL_MARKER_FILE = ".hasna-skills.json", SKILLS_CACHE_DIRNAME2 = "skills", LAYOUT_MIGRATION_RECORD2 = ".layout-migration.json", PullSkillError;
+var BUNDLE_DIGEST_HEADER = "X-Skill-Bundle-Sha256", BUNDLE_SIGNATURE_HEADER = "X-Skill-Bundle-Signature", BUNDLE_REVISION_ID_HEADER = "X-Skill-Revision-Id", BUNDLE_REVISION_NUMBER_HEADER = "X-Skill-Revision-Number", PULL_MARKER_FILE = ".hasna-skills.json", PullSkillError;
 var init_pull = __esm(() => {
   init_remote_client();
   init_portable_skills();
-  init_config();
+  init_home_migration();
+  init_revision();
   init_skill_bundle();
   init_skill_bundles();
+  init_revision();
   PullSkillError = class PullSkillError extends Error {
     detail;
     constructor(message, detail) {
@@ -72320,10 +72754,10 @@ __export(exports_publish, {
   pushSkill: () => pushSkill,
   PushSkillError: () => PushSkillError
 });
-import { existsSync as existsSync28, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync23 } from "fs";
 import { join as join30 } from "path";
 function registerPublish(parent) {
-  parent.command("push").argument("<name>", "Name of a skill in ~/.hasna/skills/installed").option("--version <version>", "Override the version recorded on the instance").option("--dry-run", "Pack and validate without uploading", false).option("--json", "Output result as JSON", false).description("Publish a local skill to the configured skills instance").action(async (name, options) => {
+  parent.command("push").argument("<name>", "Name of a skill in the local corpus (~/.hasna/skills/installed or the migrated ~/.hasna/skills/skills)").option("--version <version>", "Override the version recorded on the instance").option("--dry-run", "Pack and validate without uploading", false).option("--json", "Output result as JSON", false).description("Publish a local skill to the configured skills instance").action(async (name, options) => {
     try {
       const result2 = await pushSkill(name, {
         dryRun: options.dryRun,
@@ -72363,7 +72797,7 @@ async function pushSkill(name, options = {}) {
   const manifest = readPortableSkillManifest(skill.path, skill.name);
   const packed = packSkillBundle(skill.path, { maxUnpackedBytes: MAX_UNPACKED_BYTES });
   const skillMdPath = join30(skill.path, "SKILL.md");
-  const skillMd = existsSync28(skillMdPath) ? readFileSync21(skillMdPath, "utf-8") : undefined;
+  const skillMd = existsSync28(skillMdPath) ? readFileSync23(skillMdPath, "utf-8") : undefined;
   const base2 = {
     slug: skill.name,
     path: skill.path,
@@ -72381,6 +72815,8 @@ async function pushSkill(name, options = {}) {
   if (!client) {
     throw new PushSkillError("No API key configured, so there is nowhere to publish to.", ["Run `skills login`, or set SKILLS_API_KEY and SKILLS_API_URL for this instance."]);
   }
+  const current = await client.getSkill(skill.name);
+  const ifMatch = current && typeof current.revisionId === "string" && current.revisionId ? current.revisionId : undefined;
   const response = await client.publishSkill({
     slug: skill.name,
     displayName: manifest.displayName ?? skill.displayName,
@@ -72393,10 +72829,17 @@ async function pushSkill(name, options = {}) {
     bundleSha256: packed.sha256,
     contentHash: packed.sha256,
     ...skillMd ? { skillMd } : {}
-  }, packed.bytes);
+  }, packed.bytes, ifMatch);
   const payload = await readBody(response);
   if (!response.ok) {
-    throw new PushSkillError(`Publishing '${skill.name}' failed: ${response.status} ${describeError(payload)}`, typeof payload === "object" && payload && "code" in payload ? [`code: ${String(payload.code)}`] : undefined);
+    const code = typeof payload === "object" && payload && "code" in payload ? String(payload.code) : undefined;
+    if (response.status === 409 || code === "REVISION_CONFLICT") {
+      throw new PushSkillError(`Publishing '${skill.name}' failed: the instance serves a NEWER revision of this skill. ` + "Your push would silently overwrite it, so it was refused.", [
+        `code: REVISION_CONFLICT`,
+        "Reconcile first: pull the current revision (skills pull <name>), merge your changes, then push again."
+      ]);
+    }
+    throw new PushSkillError(`Publishing '${skill.name}' failed: ${response.status} ${describeError(payload)}`, code ? [`code: ${code}`] : undefined);
   }
   return { ...base2, published: true, status: response.status, response: payload };
 }
@@ -72680,7 +73123,7 @@ function printLoginSuccess(loginResult, json) {
 \u2713 Signed in as ${loginResult.user.email}`));
   console.log(source_default.dim(`  Organization: ${loginResult.organization.name}`));
   if (loginResult.firstLogin) {
-    console.log(source_default.dim(`  API key saved to ~/.hasna/skills/auth.json`));
+    console.log(source_default.dim(`  API key saved to ${getAuthFilePath()}`));
   }
 }
 async function doLogin(email2, code, json) {
@@ -73055,7 +73498,7 @@ function registerStorage(parent) {
     const snapshot = exportSkillsLocalSnapshot(process.cwd(), { includeFileContents: false });
     const s3Plan = config2.s3Bucket ? planSkillsS3SnapshotUpload(snapshot, { prefix: config2.s3Prefix }) : [];
     const plan = {
-      package: "open-skills",
+      package: "skills",
       noNetwork: true,
       databaseConfigured: Boolean(config2.databaseUrl),
       s3Configured: Boolean(config2.s3Bucket),
@@ -73124,6 +73567,428 @@ var init_storage = __esm(() => {
   init_home_migration();
 });
 
+// src/lib/registry-reconcile.ts
+import { existsSync as existsSync29, readFileSync as readFileSync24, statSync as statSync15, writeFileSync as writeFileSync19 } from "fs";
+import { join as join31 } from "path";
+function isDirectory2(path) {
+  try {
+    return statSync15(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function migrationNeeded(options) {
+  if (options.rootDir)
+    return false;
+  const appDir = options.homeDir ? join31(options.homeDir, ".hasna", "skills") : getDataDir();
+  return !(isOwnerLayoutMigrated(appDir) && isDirectory2(join31(appDir, SKILLS_CACHE_DIRNAME)));
+}
+function readBaseline(skillDir) {
+  const markerPath = join31(skillDir, PULL_MARKER_FILE);
+  if (!existsSync29(markerPath))
+    return;
+  try {
+    const marker = JSON.parse(readFileSync24(markerPath, "utf-8"));
+    return {
+      ...typeof marker.contentHash === "string" && marker.contentHash ? { contentHash: marker.contentHash } : {},
+      ...typeof marker.version === "string" && marker.version ? { version: marker.version } : {}
+    };
+  } catch {
+    return;
+  }
+}
+function readCursor(root) {
+  const path = join31(root, SYNC_CURSOR_FILE);
+  if (!existsSync29(path))
+    return { runCount: 0 };
+  try {
+    const cursor = JSON.parse(readFileSync24(path, "utf-8"));
+    return { runCount: typeof cursor.runCount === "number" ? cursor.runCount : 0 };
+  } catch {
+    return { runCount: 0 };
+  }
+}
+function resolveCorpusRootReadOnly(options) {
+  if (options.rootDir)
+    return { root: options.rootDir, migrationPending: false };
+  const appDir = options.homeDir ? join31(options.homeDir, ".hasna", "skills") : getDataDirReadOnly();
+  const cache3 = join31(appDir, SKILLS_CACHE_DIRNAME);
+  if (isOwnerLayoutMigrated(appDir) && isDirectory2(cache3)) {
+    return { root: cache3, migrationPending: false };
+  }
+  return { root: join31(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
+}
+function remoteRowToSkill(record3) {
+  const slug = typeof record3.slug === "string" ? record3.slug : typeof record3.name === "string" ? record3.name : undefined;
+  if (!slug)
+    return;
+  return {
+    slug,
+    version: typeof record3.version === "string" ? record3.version : undefined,
+    sha256: typeof record3.bundleSha256 === "string" && record3.bundleSha256 ? record3.bundleSha256 : undefined
+  };
+}
+function recheckLocalSide(plannedLocal, localDir, ops = {
+  pack: (dir) => packSkillBundle(dir).sha256,
+  exists: existsSync29
+}) {
+  let localNow;
+  try {
+    localNow = ops.pack(localDir);
+  } catch {
+    localNow = undefined;
+  }
+  const dirExists = ops.exists(localDir);
+  return plannedLocal !== undefined ? localNow !== plannedLocal : localNow !== undefined || dirExists;
+}
+function classifySkill(local, remote, baseline) {
+  if (!remote)
+    return { state: "local-only" };
+  if (!local)
+    return { state: "remote-only" };
+  const baselineHash = baseline?.contentHash;
+  const baselineVersion = baseline?.version;
+  if (remote.sha256) {
+    if (remote.sha256 === local.sha256) {
+      const effectiveLocalVersion = baselineVersion ?? local.version ?? undefined;
+      const remoteVersion = remote.version ?? undefined;
+      if (effectiveLocalVersion !== undefined && remoteVersion !== undefined && effectiveLocalVersion !== remoteVersion) {
+        return { state: "conflict", reason: "version divergence with identical digest" };
+      }
+      return { state: "in-sync" };
+    }
+    if (!baselineHash) {
+      return { state: "conflict", reason: "no baseline marker: cannot prove which side changed" };
+    }
+    if (baselineHash === local.sha256)
+      return { state: "changed-remotely" };
+    if (baselineHash === remote.sha256)
+      return { state: "changed-locally" };
+    return { state: "conflict", reason: "both sides changed since the baseline marker" };
+  }
+  if (baselineHash && baselineHash !== local.sha256) {
+    return { state: "changed-locally", reason: "local digest moved since the baseline marker" };
+  }
+  if (local.version !== undefined && remote.version !== undefined && local.version !== remote.version) {
+    return { state: "changed-locally", reason: "version diverged from the bundled row" };
+  }
+  return { state: "in-sync", reason: "no remote digest; no version or baseline evidence of local divergence" };
+}
+function isDigestless(remote) {
+  return remote !== undefined && !remote.sha256;
+}
+function resolveAction(state, direction, conflict) {
+  switch (state) {
+    case "local-only":
+    case "changed-locally":
+      return direction === "push" || direction === "all" ? { action: "push" } : { action: "skip", reason: "push not requested" };
+    case "remote-only":
+    case "changed-remotely":
+      return direction === "pull" || direction === "all" ? { action: "pull" } : { action: "skip", reason: "pull not requested" };
+    case "conflict":
+      if (conflict === "local" && (direction === "push" || direction === "all"))
+        return { action: "push" };
+      if (conflict === "remote" && (direction === "pull" || direction === "all"))
+        return { action: "pull" };
+      return { action: "skip", reason: `conflict policy '${conflict}' does not resolve in this direction` };
+    case "in-sync":
+      return { action: "none" };
+  }
+}
+async function currentRemoteDigest(client, slug) {
+  const { status, body } = await client.getSkillStatus(slug);
+  if (status === 404)
+    return;
+  if (status !== 200) {
+    throw new ReconcileRegistryError(`Registry re-check for '${slug}' failed: HTTP ${status}.`);
+  }
+  if (!body || typeof body !== "object")
+    return;
+  const digest = body.bundleSha256;
+  return typeof digest === "string" && digest ? digest : undefined;
+}
+async function reconcileRegistry(options = {}) {
+  const conflict = options.conflict ?? "skip";
+  if (!CONFLICT_POLICIES.includes(conflict)) {
+    throw new ReconcileRegistryError(`Unknown conflict policy '${String(conflict)}'. Use one of: ${CONFLICT_POLICIES.join(", ")}.`);
+  }
+  const direction = options.pull && !options.push && !options.all ? "pull" : options.push && !options.pull && !options.all ? "push" : "all";
+  const dryRun = options.dryRun ?? false;
+  const client = options.client !== undefined ? options.client : dryRun ? createRemoteSkillsClientReadOnly() : createRemoteSkillsClient();
+  if (!client) {
+    throw new ReconcileRegistryError("No API key configured, so there is nowhere to sync to.", ["Run `skills login`, or set SKILLS_API_KEY and SKILLS_API_URL for this instance."]);
+  }
+  const { root, migrationPending } = dryRun ? resolveCorpusRootReadOnly(options) : { root: resolveCorpusRoot(options), migrationPending: migrationNeeded(options) };
+  const localSkills = listPortableSkillMetas({ rootDir: root });
+  const locals = new Map;
+  for (const meta of localSkills) {
+    try {
+      const path = getPortableSkillPath(meta.name, { rootDir: root });
+      const packed = packSkillBundle(path);
+      locals.set(meta.name, { slug: meta.name, version: meta.version, sha256: packed.sha256 });
+    } catch {
+      locals.set(meta.name, { slug: meta.name, version: meta.version, sha256: "" });
+    }
+  }
+  const remoteRowsPayload = await client.listSkills();
+  if (!Array.isArray(remoteRowsPayload)) {
+    const shape = remoteRowsPayload && typeof remoteRowsPayload === "object" ? `object with keys [${Object.keys(remoteRowsPayload).join(", ")}]` : typeof remoteRowsPayload;
+    throw new ReconcileRegistryError(`Registry listing failed: expected an array of skills, got ${shape}.`, ["Check SKILLS_API_URL and the stored credential; a failed listing must not be read as an empty registry."]);
+  }
+  const remotes = new Map;
+  for (const row of remoteRowsPayload) {
+    if (!row || typeof row !== "object")
+      continue;
+    const skill = remoteRowToSkill(row);
+    if (skill)
+      remotes.set(skill.slug, skill);
+  }
+  const allSlugs = [...new Set([...locals.keys(), ...remotes.keys()])].sort();
+  const skills = [];
+  for (const slug of allSlugs) {
+    const local = locals.get(slug);
+    const remote = remotes.get(slug);
+    const baseline = local ? readBaseline(join31(root, slug)) : undefined;
+    const { state, reason } = classifySkill(local, remote, baseline);
+    let { action, reason: actionReason } = resolveAction(state, direction, conflict);
+    if (state === "remote-only" && isDigestless(remote)) {
+      action = "skip";
+      actionReason = "no bundle digest; verified pulls only (use `skills pull --all` for metadata-only)";
+    }
+    skills.push({
+      slug,
+      state,
+      action,
+      ...local?.version ? { localVersion: local.version } : {},
+      ...remote?.version ? { remoteVersion: remote.version } : {},
+      ...local?.sha256 ? { localSha256: local.sha256 } : {},
+      ...remote?.sha256 ? { remoteSha256: remote.sha256 } : {},
+      ...reason ?? actionReason ? { reason: reason ?? actionReason } : {}
+    });
+  }
+  const summary = {
+    local: locals.size,
+    remote: remotes.size,
+    inSync: 0,
+    pushed: 0,
+    pulled: 0,
+    conflicts: 0,
+    skipped: 0,
+    errors: 0
+  };
+  for (const entry of skills) {
+    if (entry.state === "in-sync")
+      summary.inSync += 1;
+    if (entry.state === "conflict")
+      summary.conflicts += 1;
+    if (entry.action === "skip")
+      summary.skipped += 1;
+  }
+  const pushSlugs = skills.filter((entry) => entry.action === "push").map((entry) => entry.slug);
+  const pullSlugs = skills.filter((entry) => entry.action === "pull").map((entry) => entry.slug);
+  if (!dryRun) {
+    for (const slug of pushSlugs) {
+      const entry = skills.find((item) => item.slug === slug);
+      const plannedRemote = remotes.get(slug)?.sha256;
+      let currentRemote;
+      try {
+        currentRemote = await currentRemoteDigest(client, slug);
+      } catch (error2) {
+        entry.result = { ok: false, detail: error2.message };
+        summary.errors += 1;
+        continue;
+      }
+      if (plannedRemote === undefined ? currentRemote !== undefined : currentRemote !== plannedRemote) {
+        entry.result = { ok: false, detail: "remote changed during sync; push skipped" };
+        entry.reason = (entry.reason ? `${entry.reason}; ` : "") + "remote changed during sync";
+        summary.skipped += 1;
+        continue;
+      }
+      try {
+        await pushSkill(slug, { rootDir: root, client });
+        const pushed = locals.get(slug);
+        writePullMarker(join31(root, slug), {
+          skill: slug,
+          ...pushed?.version ? { version: pushed.version } : {},
+          ...pushed?.sha256 ? { contentHash: pushed.sha256 } : {},
+          source: "sync"
+        });
+        entry.result = { ok: true };
+        summary.pushed += 1;
+      } catch (error2) {
+        entry.result = { ok: false, detail: error2.message };
+        summary.errors += 1;
+      }
+    }
+    const verifiedPullSlugs = [];
+    for (const slug of pullSlugs) {
+      const entry = skills.find((item) => item.slug === slug);
+      const plannedRemote = remotes.get(slug)?.sha256;
+      let currentRemote;
+      try {
+        currentRemote = await currentRemoteDigest(client, slug);
+      } catch (error2) {
+        entry.result = { ok: false, detail: error2.message };
+        summary.errors += 1;
+        continue;
+      }
+      if (plannedRemote === undefined ? currentRemote !== undefined : currentRemote !== plannedRemote) {
+        entry.result = { ok: false, detail: "remote changed during sync; pull skipped" };
+        entry.reason = (entry.reason ? `${entry.reason}; ` : "") + "remote changed during sync";
+        summary.skipped += 1;
+        continue;
+      }
+      const plannedLocal = locals.get(slug)?.sha256;
+      const localDir = getPortableSkillPath(slug, { rootDir: root });
+      const localMoved = recheckLocalSide(plannedLocal, localDir);
+      if (localMoved) {
+        entry.result = { ok: false, detail: "local changed during sync; pull skipped" };
+        entry.reason = (entry.reason ? `${entry.reason}; ` : "") + "local changed during sync";
+        summary.skipped += 1;
+        continue;
+      }
+      verifiedPullSlugs.push(slug);
+    }
+    if (verifiedPullSlugs.length > 0) {
+      try {
+        const pulled = await pullSkills({ names: verifiedPullSlugs, rootDir: root, client, signingKey: options.signingKey });
+        for (const result2 of pulled.results) {
+          const entry = skills.find((item) => item.slug === result2.name);
+          if (entry) {
+            entry.result = { ok: result2.success, ...result2.error ? { detail: result2.error } : {} };
+            if (result2.success)
+              summary.pulled += 1;
+            else
+              summary.errors += 1;
+          }
+        }
+      } catch (error2) {
+        for (const slug of verifiedPullSlugs) {
+          const entry = skills.find((item) => item.slug === slug);
+          if (entry)
+            entry.result = { ok: false, detail: error2.message };
+        }
+        summary.errors += verifiedPullSlugs.length;
+      }
+    }
+    if (summary.errors === 0) {
+      const cursor = {
+        schemaVersion: SYNC_CURSOR_SCHEMA_VERSION,
+        managedBy: "@hasna/skills",
+        lastSyncedAt: new Date().toISOString(),
+        runCount: readCursor(root).runCount + 1,
+        summary
+      };
+      writeFileSync19(join31(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor, null, 2)}
+`);
+      return {
+        corpusRoot: root,
+        migrationPending,
+        direction,
+        dryRun: false,
+        conflictPolicy: conflict,
+        conflictPolicyDescription: conflict === "skip" ? DEFAULT_CONFLICT_POLICY : conflict,
+        summary,
+        skills,
+        cursor: { lastSyncedAt: cursor.lastSyncedAt, runCount: cursor.runCount }
+      };
+    }
+  }
+  if (dryRun) {
+    summary.pushed = pushSlugs.length;
+    summary.pulled = pullSlugs.length;
+  }
+  return {
+    corpusRoot: root,
+    migrationPending,
+    direction,
+    dryRun,
+    conflictPolicy: conflict,
+    conflictPolicyDescription: conflict === "skip" ? DEFAULT_CONFLICT_POLICY : conflict,
+    summary,
+    skills
+  };
+}
+var DEFAULT_CONFLICT_POLICY = "local-wins-on-identical-digest-else-skip-and-report", CONFLICT_POLICIES, SYNC_CURSOR_FILE = ".sync-cursor.json", SYNC_CURSOR_SCHEMA_VERSION = 1, ReconcileRegistryError;
+var init_registry_reconcile = __esm(() => {
+  init_publish();
+  init_config();
+  init_home_migration();
+  init_portable_skills();
+  init_pull();
+  init_remote_client();
+  init_skill_bundle();
+  CONFLICT_POLICIES = ["local", "remote", "skip"];
+  ReconcileRegistryError = class ReconcileRegistryError extends Error {
+    detail;
+    constructor(message, detail) {
+      super(message);
+      this.detail = detail;
+      this.name = "ReconcileRegistryError";
+    }
+  };
+});
+
+// src/cli/commands/registry-reconcile.ts
+var exports_registry_reconcile = {};
+__export(exports_registry_reconcile, {
+  registerRegistryReconcile: () => registerRegistryReconcile
+});
+function registerRegistryReconcile(parent) {
+  const group = parent.command("cloud").description("Synchronize this machine's skill corpus with the hosted registry");
+  group.command("sync").option("--push", "Push local changes to the registry (local-only, changed-locally, and conflicts won by local)", false).option("--pull", "Pull registry changes into the local corpus (remote-only, changed-remotely, and conflicts won by remote)", false).option("--all", "Both directions (the default when neither --push nor --pull is given)", false).option("--dry-run", "Plan and report without writing anything", false).option("--json", "Output the full result as JSON", false).option("--conflict <policy>", `Conflict policy: ${CONFLICT_POLICIES.join(" | ")}. Default: ${DEFAULT_CONFLICT_POLICY}.`, "skip").description("Two-way reconcile between the local corpus and the hosted registry").action(async (options) => {
+    try {
+      const result2 = await reconcileRegistry({
+        push: options.push,
+        pull: options.pull,
+        all: options.all,
+        dryRun: options.dryRun,
+        conflict: options.conflict
+      });
+      if (options.json) {
+        console.log(JSON.stringify(result2, null, 2));
+        if (result2.summary.errors > 0)
+          process.exitCode = 1;
+        return;
+      }
+      printHuman2(result2);
+      if (result2.summary.errors > 0)
+        process.exitCode = 1;
+    } catch (error2) {
+      if (options.json) {
+        console.log(JSON.stringify({ error: error2.message }, null, 2));
+      } else {
+        console.error(source_default.red(error2.message));
+        if (error2 instanceof ReconcileRegistryError)
+          for (const line of error2.detail ?? [])
+            console.error(source_default.dim(`  - ${line}`));
+      }
+      process.exitCode = 1;
+    }
+  });
+}
+function printHuman2(result2) {
+  const { summary } = result2;
+  const heading = result2.dryRun ? "Dry run: what a sync would do" : summary.errors > 0 ? "Sync completed with errors" : "Sync complete";
+  console.log(source_default.bold(`${heading} (${result2.direction === "all" ? "all" : result2.direction}${result2.dryRun ? ", dry-run" : ""})`));
+  console.log(`  ${source_default.dim("corpus")}    ${result2.corpusRoot}`);
+  console.log(`  ${source_default.dim("conflict")}  ${result2.conflictPolicy}`);
+  console.log(`  ${source_default.dim("summary")}  ${summary.pushed} pushed \xB7 ${summary.pulled} pulled \xB7 ${summary.inSync} in-sync \xB7 ${summary.conflicts} conflict(s) \xB7 ${summary.skipped} skipped \xB7 ${summary.errors} error(s)`);
+  const interesting = result2.skills.filter((entry) => entry.action !== "none" || entry.state === "conflict");
+  for (const entry of interesting) {
+    const verb = entry.action === "push" ? source_default.green("push") : entry.action === "pull" ? source_default.cyan("pull") : source_default.yellow(entry.action);
+    console.log(`  ${verb.padEnd(7)} ${entry.slug}${entry.reason ? source_default.dim(` \u2014 ${entry.reason}`) : ""}`);
+    if (entry.result && !entry.result.ok) {
+      console.log(source_default.dim(`         failed: ${entry.result.detail ?? "unknown error"}`));
+    }
+  }
+  console.log("");
+}
+var init_registry_reconcile2 = __esm(() => {
+  init_source();
+  init_registry_reconcile();
+});
+
 // ../../node_modules/.bun/ink@5.2.1+6e93904c7bfe2418/node_modules/ink/build/render.js
 import { Stream } from "stream";
 import process12 from "process";
@@ -78144,8 +79009,9 @@ var import_react21 = __toESM(require_react(), 1);
 // src/cli/index.tsx
 init_esm();
 
-// ../../node_modules/.bun/@hasna+events@0.1.7/node_modules/@hasna/events/dist/commander.js
+// ../events/dist/commander.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { Buffer as Buffer22 } from "buffer";
 import { existsSync as existsSync2 } from "fs";
 import { homedir } from "os";
 import { join as join2 } from "path";
@@ -78161,29 +79027,83 @@ function getPathValue(input, path) {
     return;
   }, input);
 }
-function wildcardToRegExp(pattern) {
-  const escaped = pattern.replace(/[|\\{}()[\]^$+?.]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`);
+function getFieldValues(input, path) {
+  const values2 = [];
+  const push = (value) => {
+    if (!values2.some((item) => Object.is(item, value)))
+      values2.push(value);
+  };
+  if (path.includes(".") && path in input)
+    push(input[path]);
+  const nestedValue = getPathValue(input, path);
+  if (nestedValue !== undefined || !path.includes("."))
+    push(nestedValue);
+  return values2;
 }
-function matchString(value, matcher) {
+function wildcardToRegExp(pattern, options = {}) {
+  let body = "";
+  for (let index = 0;index < pattern.length; index += 1) {
+    const char = pattern[index];
+    if (char === "*") {
+      if (pattern[index + 1] === "*") {
+        body += ".*";
+        index += 1;
+      } else {
+        body += options.segmentSafe ? "[^/]*" : ".*";
+      }
+    } else {
+      body += char.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${body}$`);
+}
+function matchString(value, matcher, options = {}) {
   if (matcher === undefined)
     return true;
   if (value === undefined)
     return false;
   const matchers = Array.isArray(matcher) ? matcher : [matcher];
-  return matchers.some((item) => wildcardToRegExp(item).test(value));
+  return matchers.some((item) => wildcardToRegExp(item, options).test(value));
 }
 function matchRecord(input, matcher) {
   if (!matcher)
     return true;
   return Object.entries(matcher).every(([path, expected]) => {
-    const actual = getPathValue(input, path);
-    if (typeof expected === "string" || Array.isArray(expected)) {
-      return matchString(actual === undefined ? undefined : String(actual), expected);
-    }
-    return actual === expected;
+    const actualValues = getFieldValues(input, path);
+    return matchField(actualValues, expected, path);
   });
 }
+function matchField(actualValues, expected, path) {
+  if (isNegativeMatcher(expected)) {
+    return !actualValues.some((actual) => matchPositiveField(actual, expected.not, path));
+  }
+  return actualValues.some((actual) => matchPositiveField(actual, expected, path));
+}
+function matchPositiveField(actual, expected, path) {
+  if (typeof expected === "string" || Array.isArray(expected)) {
+    return stringCandidates(actual).some((candidate) => matchString(candidate, expected, {
+      segmentSafe: path.endsWith("_path") || path.endsWith(".path")
+    }));
+  }
+  if (Array.isArray(actual)) {
+    return actual.some((item) => item === expected);
+  }
+  return actual === expected;
+}
+function stringCandidates(actual) {
+  if (actual === undefined)
+    return [];
+  if (Array.isArray(actual)) {
+    return actual.flatMap((item) => isPrimitiveFieldValue(item) ? [String(item)] : []);
+  }
+  return [String(actual)];
+}
+function isPrimitiveFieldValue(value) {
+  return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function isNegativeMatcher(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value) && "not" in value);
+}
 function eventMatchesFilter(event, filter2) {
   return matchString(event.source, filter2.source) && matchString(event.type, filter2.type) && matchString(event.subject, filter2.subject) && matchString(event.severity, filter2.severity) && matchRecord(event.data, filter2.data) && matchRecord(event.metadata, filter2.metadata);
 }
@@ -78196,17 +79116,29 @@ function channelMatchesEvent(channel, event) {
 }
 var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR";
 var HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME";
+var LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:";
+var DEFAULT_EVENT_PAGE_LIMIT = 100;
+var MAX_EVENT_PAGE_LIMIT = 1000;
 function getEventsDataDir(override) {
   return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join2(homedir(), ".hasna", "events");
 }
+function getActiveEventsDirEnv() {
+  if (process.env[HASNA_EVENTS_DIR_ENV])
+    return HASNA_EVENTS_DIR_ENV;
+  if (process.env[HASNA_EVENTS_HOME_ENV])
+    return HASNA_EVENTS_HOME_ENV;
+  return null;
+}
 
 class JsonEventsStore {
   dataDir;
+  runtime;
   channelsPath;
   eventsPath;
   deliveriesPath;
   constructor(dataDir = getEventsDataDir()) {
     this.dataDir = dataDir;
+    this.runtime = localJsonRuntime(dataDir);
     this.channelsPath = join2(dataDir, "channels.json");
     this.eventsPath = join2(dataDir, "events.json");
     this.deliveriesPath = join2(dataDir, "deliveries.json");
@@ -78254,13 +79186,58 @@ class JsonEventsStore {
     await this.writeJson(this.eventsPath, events);
     return event;
   }
-  async listEvents() {
+  async appendEventOnce(event, options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    const dedupe = options.dedupe !== false;
+    if (dedupe) {
+      const existing = findEventByIdentity(events, { id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    events.push(event);
+    await this.writeJson(this.eventsPath, events);
+    return {
+      event,
+      stored: true,
+      deduped: false,
+      identity: { id: event.id, dedupeKey: event.dedupeKey }
+    };
+  }
+  async listEvents(options = {}) {
     await this.init();
-    return this.readJson(this.eventsPath, []);
+    const events = await this.readJson(this.eventsPath, []);
+    return queryEvents(events, options);
+  }
+  async listEventsPage(options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    const queried = queryEvents(events, {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = queried.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < queried.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async findEventByIdentity(identity2) {
     const events = await this.listEvents();
-    return events.find((event) => identity2.id !== undefined && event.id === identity2.id || identity2.dedupeKey !== undefined && event.dedupeKey === identity2.dedupeKey);
+    return findEventByIdentity(events, identity2);
   }
   async appendDelivery(result2) {
     await this.init();
@@ -78311,6 +79288,130 @@ class JsonEventsStore {
     });
   }
 }
+function localJsonRuntime(dataDir = getEventsDataDir()) {
+  return {
+    mode: "local-files",
+    name: "json-events-store",
+    remote: false,
+    localFiles: true,
+    localSqlite: false,
+    postgres: false,
+    s3: false,
+    aws: false,
+    durable: true,
+    idempotency: "best-effort-local",
+    replayCursors: true,
+    description: `Local JSON files in ${dataDir}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+  };
+}
+function encodeLocalJsonEventCursor(offset, options = {}) {
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid event cursor offset: ${offset}`);
+  const payload = {
+    offset,
+    eventId: options.eventId,
+    source: options.source,
+    type: options.type
+  };
+  return `${LOCAL_JSON_EVENT_CURSOR_PREFIX}${Buffer22.from(JSON.stringify(payload), "utf-8").toString("base64url")}`;
+}
+function decodeLocalJsonEventCursor(cursor, options = {}) {
+  if (!cursor)
+    return 0;
+  if (!cursor.startsWith(LOCAL_JSON_EVENT_CURSOR_PREFIX))
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  const rawPayload = cursor.slice(LOCAL_JSON_EVENT_CURSOR_PREFIX.length);
+  let payload;
+  try {
+    payload = JSON.parse(Buffer22.from(rawPayload, "base64url").toString("utf-8"));
+  } catch {
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  }
+  const offset = payload.offset;
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  assertCursorFilter("eventId", payload.eventId, options.eventId);
+  assertCursorFilter("source", payload.source, options.source);
+  assertCursorFilter("type", payload.type, options.type);
+  return offset;
+}
+function normalizeEventPageLimit(limit) {
+  if (limit === undefined)
+    return DEFAULT_EVENT_PAGE_LIMIT;
+  if (!Number.isInteger(limit) || limit < 1)
+    throw new Error(`Event page limit must be a positive integer, got ${limit}`);
+  return Math.min(limit, MAX_EVENT_PAGE_LIMIT);
+}
+function queryEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor) {
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    rows = rows.slice(offset);
+  }
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
+}
+function assertCursorFilter(name, cursorValue, optionValue) {
+  if (cursorValue !== optionValue)
+    throw new Error(`Local JSON event cursor ${name} filter mismatch`);
+}
+function findEventByIdentity(events, identity2) {
+  return events.find((event) => identity2.id !== undefined && event.id === identity2.id || identity2.dedupeKey !== undefined && event.dedupeKey === identity2.dedupeKey);
+}
+async function getEventsStatus(dataDir) {
+  const store = new JsonEventsStore(dataDir);
+  await store.init();
+  const [channels, events, deliveries] = await Promise.all([
+    store.listChannels(),
+    store.listEvents(),
+    store.listDeliveries()
+  ]);
+  const transports = channels.reduce((counts, channel) => {
+    counts[channel.transport] = (counts[channel.transport] ?? 0) + 1;
+    return counts;
+  }, {});
+  return {
+    service: "events",
+    schemaVersion: "1.0",
+    dataDir: store.dataDir,
+    storage: store.runtime,
+    env: {
+      primary: HASNA_EVENTS_DIR_ENV,
+      fallback: HASNA_EVENTS_HOME_ENV,
+      active: getActiveEventsDirEnv()
+    },
+    files: {
+      channels: statusFile(store.dataDir, "channels.json", channels.length),
+      events: statusFile(store.dataDir, "events.json", events.length),
+      deliveries: statusFile(store.dataDir, "deliveries.json", deliveries.length)
+    },
+    counts: {
+      channels: channels.length,
+      enabledChannels: channels.filter((channel) => channel.enabled).length,
+      disabledChannels: channels.filter((channel) => !channel.enabled).length,
+      events: events.length,
+      deliveries: deliveries.length
+    },
+    transports,
+    safety: {
+      includesEventPayloads: false,
+      includesWebhookSecrets: false,
+      listOutputsRedactSecrets: true,
+      statusOutputIsMetadataOnly: true
+    }
+  };
+}
+function statusFile(dataDir, fileName, records) {
+  const path = join2(dataDir, fileName);
+  return { path, exists: existsSync2(path), records };
+}
 var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
 function buildSignatureBase(timestamp, body) {
   return `${timestamp}.${body}`;
@@ -78325,21 +79426,27 @@ function now2() {
 function truncate2(value, max2 = 4096) {
   return value.length > max2 ? `${value.slice(0, max2)}...` : value;
 }
-function buildWebhookRequest(event, channel) {
+function buildWebhookRequest(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  for (const name of Object.keys(channel.webhook.headers ?? {})) {
+    if (/^x-hasna-/i.test(name)) {
+      throw new Error(`Webhook header ${name} is reserved for signed delivery metadata`);
+    }
+  }
   const body = JSON.stringify(event);
-  const timestamp = event.time;
+  const timestamp = options.timestamp ?? new Date().toISOString();
   const headers = {
     "Content-Type": "application/json",
     "User-Agent": "@hasna/events",
     "X-Hasna-Event-Id": event.id,
     "X-Hasna-Event-Type": event.type,
-    "X-Hasna-Timestamp": timestamp,
-    ...channel.webhook.headers
+    ...channel.webhook.headers,
+    "X-Hasna-Timestamp": timestamp
   };
-  if (channel.webhook.secret) {
-    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp, body);
+  const secret = options.secret ?? channel.webhook.secret;
+  if (secret) {
+    headers["X-Hasna-Signature"] = signPayload(secret, timestamp, body);
   }
   return { body, headers };
 }
@@ -78347,7 +79454,21 @@ async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
   const startedAt = now2();
-  const { body, headers } = buildWebhookRequest(event, channel);
+  let secret = channel.webhook.secret;
+  if (channel.webhook.secretRef) {
+    if (!options.secretResolver) {
+      return failedAttempt(startedAt, "Webhook secret reference has no runtime resolver");
+    }
+    try {
+      secret = await options.secretResolver(channel.webhook.secretRef);
+    } catch {
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+    }
+    if (!secret)
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+  }
+  const timestamp = (options.now?.() ?? new Date).toISOString();
+  const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp });
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
@@ -78379,6 +79500,15 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function failedAttempt(startedAt, error) {
+  return {
+    attempt: 1,
+    status: "failed",
+    startedAt,
+    completedAt: now2(),
+    error
+  };
+}
 async function dispatchCommand(event, channel) {
   if (!channel.command)
     throw new Error(`Channel ${channel.id} has no command config`);
@@ -78467,6 +79597,90 @@ function createDeliveryResult(event, channel, attempts) {
     completedAt: attempts.at(-1)?.completedAt ?? now2()
   };
 }
+
+class EventValidationError extends Error {
+  eventType;
+  issues;
+  constructor(eventType, issues) {
+    const detail = issues.map((issue) => `${issue.path || "<root>"}: ${issue.message}`).join("; ");
+    super(`Event validation failed for type "${eventType}": ${detail}`);
+    this.name = "EventValidationError";
+    this.eventType = eventType;
+    this.issues = issues;
+  }
+}
+
+class EventTypeCatalog {
+  definitions = new Map;
+  register(definition) {
+    this.definitions.set(definition.type, definition);
+    return this;
+  }
+  unregister(type) {
+    return this.definitions.delete(type);
+  }
+  has(type) {
+    return this.definitions.has(type);
+  }
+  get(type) {
+    return this.definitions.get(type);
+  }
+  list() {
+    return [...this.definitions.values()];
+  }
+  validateEvent(event) {
+    const definition = this.definitions.get(event.type);
+    if (!definition)
+      return { ok: true };
+    return definition.validate(event.data, event);
+  }
+  assertEventValid(event) {
+    const result2 = this.validateEvent(event);
+    if (!result2.ok) {
+      throw new EventValidationError(event.type, result2.issues);
+    }
+  }
+}
+var defaultEventTypeCatalog = new EventTypeCatalog;
+var APP_EVENT_V1_MAX_DATA_BYTES = 32 * 1024;
+function redactPaths(event, paths, replacement = "[REDACTED]") {
+  if (paths.length === 0)
+    return event;
+  const copy = structuredClone(event);
+  for (const path of paths) {
+    setPath(copy, path, replacement);
+  }
+  return copy;
+}
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue(event, replacement);
+}
+function shouldRedactKey(key) {
+  return /secret|token|password|api[_-]?key|authorization/i.test(key);
+}
+function redactValue(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue(item, replacement)
+  ]));
+}
+function setPath(input, path, replacement) {
+  const parts = path.split(".");
+  let cursor = input;
+  for (const part of parts.slice(0, -1)) {
+    const next = cursor[part];
+    if (!next || typeof next !== "object")
+      return;
+    cursor = next;
+  }
+  const last2 = parts.at(-1);
+  if (last2 && last2 in cursor)
+    cursor[last2] = replacement;
+}
 function createEvent(input) {
   return {
     id: input.id ?? randomUUID2(),
@@ -78487,10 +79701,18 @@ class EventsClient {
   store;
   redactors;
   transportOptions;
+  catalog;
+  validateCatalogTypes;
   constructor(options = {}) {
     this.store = options.store ?? new JsonEventsStore(options.dataDir);
     this.redactors = options.redactors ?? [];
-    this.transportOptions = { fetchImpl: options.fetchImpl };
+    this.transportOptions = {
+      fetchImpl: options.fetchImpl,
+      secretResolver: options.secretResolver,
+      now: options.now
+    };
+    this.catalog = options.catalog ?? defaultEventTypeCatalog;
+    this.validateCatalogTypes = options.validateCatalogTypes ?? false;
   }
   async addChannel(input) {
     const timestamp = new Date().toISOString();
@@ -78508,18 +79730,40 @@ class EventsClient {
   }
   async emit(input, options = {}) {
     const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
-    if (options.dedupe !== false) {
-      const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
-      if (existing) {
-        return { event: existing, deliveries: [], deduped: true };
-      }
-    }
-    await this.store.appendEvent(event);
-    const deliveries = options.deliver === false ? [] : await this.deliver(event);
-    return { event, deliveries, deduped: false };
-  }
-  async listEvents() {
-    return this.store.listEvents();
+    if (options.validate ?? this.validateCatalogTypes) {
+      this.catalog.assertEventValid(event);
+    }
+    const append = await this.appendEvent(event, { dedupe: options.dedupe !== false });
+    if (append.deduped) {
+      return { event: append.event, deliveries: [], deduped: true };
+    }
+    const deliveries = options.deliver === false ? [] : await this.deliver(append.event);
+    return { event: append.event, deliveries, deduped: false };
+  }
+  async listEvents(options = {}) {
+    if (Object.keys(options).length === 0)
+      return this.store.listEvents();
+    return queryClientEvents(await this.store.listEvents(), options);
+  }
+  async listEventsPage(options = {}) {
+    if (this.store.listEventsPage)
+      return this.store.listEventsPage(options);
+    const events = queryClientEvents(await this.store.listEvents(), {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = events.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < events.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async listDeliveries() {
     return this.store.listDeliveries();
@@ -78536,7 +79780,7 @@ class EventsClient {
     }
     return deliveries;
   }
-  async testChannel(id, input = {}) {
+  async matchChannel(id, input = {}) {
     const channel = await this.store.getChannel(id);
     if (!channel)
       throw new Error(`Channel not found: ${id}`);
@@ -78553,28 +79797,71 @@ class EventsClient {
       time: input.time,
       id: input.id
     });
+    const matched = channelMatchesEvent(channel, event);
+    return {
+      channelId: channel.id,
+      matched,
+      event,
+      filters: channel.filters,
+      reason: matched ? undefined : channel.enabled ? "event did not match channel filters" : "channel is disabled"
+    };
+  }
+  async testChannel(id, input = {}, options = {}) {
+    const channel = await this.store.getChannel(id);
+    if (!channel)
+      throw new Error(`Channel not found: ${id}`);
+    const match = await this.matchChannel(id, input);
+    const event = match.event;
+    if (options.honorFilters && !match.matched) {
+      const timestamp = new Date().toISOString();
+      const result22 = createDeliveryResult(event, channel, [{
+        attempt: 1,
+        status: "skipped",
+        startedAt: timestamp,
+        completedAt: timestamp,
+        error: match.reason
+      }]);
+      result22.metadata = { reason: "filter_mismatch" };
+      await this.store.appendDelivery(result22);
+      return result22;
+    }
     const eventForChannel = await this.applyRedaction(event, channel);
     const result2 = await this.deliverWithRetry(eventForChannel, channel);
     await this.store.appendDelivery(result2);
     return result2;
   }
   async replay(options = {}) {
-    const events = (await this.store.listEvents()).filter((event) => {
-      if (options.eventId && event.id !== options.eventId)
-        return false;
-      if (options.source && event.source !== options.source)
-        return false;
-      if (options.type && event.type !== options.type)
-        return false;
-      return true;
-    });
+    const page = options.cursor || options.limit !== undefined ? await this.listEventsPage(options) : { events: await this.listEvents(options), hasMore: false };
     if (options.dryRun)
-      return { events, deliveries: [] };
+      return { events: page.events, deliveries: [], cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
     const deliveries = [];
-    for (const event of events) {
+    for (const event of page.events) {
       deliveries.push(...await this.deliver(event));
     }
-    return { events, deliveries };
+    return { events: page.events, deliveries, cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
+  }
+  async appendEvent(event, options) {
+    if (this.store.appendEventOnce) {
+      return this.store.appendEventOnce(event, { dedupe: options.dedupe });
+    }
+    if (options.dedupe) {
+      const existing = await this.store.findEventByIdentity({ id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    const stored = await this.store.appendEvent(event);
+    return {
+      event: stored,
+      stored: true,
+      deduped: false,
+      identity: { id: stored.id, dedupeKey: stored.dedupeKey }
+    };
   }
   async applyRedaction(event, channel) {
     let next = redactPaths(event, channel.redact?.paths ?? [], channel.redact?.replacement ?? "[REDACTED]");
@@ -78601,15 +79888,6 @@ class EventsClient {
     return createDeliveryResult(event, channel, attempts);
   }
 }
-function redactPaths(event, paths, replacement = "[REDACTED]") {
-  if (paths.length === 0)
-    return event;
-  const copy = structuredClone(event);
-  for (const path of paths) {
-    setPath(copy, path, replacement);
-  }
-  return copy;
-}
 function sanitizeChannelForOutput(channel) {
   const copy = structuredClone(channel);
   if (copy.webhook?.secret)
@@ -78622,34 +79900,19 @@ function sanitizeChannelForOutput(channel) {
 function sanitizeChannelsForOutput(channels) {
   return channels.map(sanitizeChannelForOutput);
 }
-function redactSensitiveKeys(event, replacement = "[REDACTED]") {
-  return redactValue(event, replacement);
-}
-function shouldRedactKey(key) {
-  return /secret|token|password|api[_-]?key|authorization/i.test(key);
-}
-function redactValue(value, replacement) {
-  if (Array.isArray(value))
-    return value.map((item) => redactValue(item, replacement));
-  if (!value || typeof value !== "object")
-    return value;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-    key,
-    shouldRedactKey(key) ? replacement : redactValue(item, replacement)
-  ]));
-}
-function setPath(input, path, replacement) {
-  const parts = path.split(".");
-  let cursor = input;
-  for (const part of parts.slice(0, -1)) {
-    const next = cursor[part];
-    if (!next || typeof next !== "object")
-      return;
-    cursor = next;
-  }
-  const last2 = parts.at(-1);
-  if (last2 && last2 in cursor)
-    cursor[last2] = replacement;
+function queryClientEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor)
+    rows = rows.slice(decodeLocalJsonEventCursor(options.cursor, options));
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
 }
 function normalizeTime(value) {
   if (!value)
@@ -78663,6 +79926,77 @@ function normalizeRetryPolicy(policy) {
     multiplier: Math.max(1, policy?.multiplier ?? 2)
   };
 }
+function parseFieldMatchers(values2, label, typed = false) {
+  if (!values2?.length)
+    return;
+  const result2 = {};
+  for (const value of values2) {
+    const parsed = parseMatcherExpression(value, label);
+    const path = parsed.path;
+    if (path in result2)
+      throw new Error(`Duplicate ${label} filter path: ${path}`);
+    const matcherValue = typed ? parseTypedMatcherValue(parsed.rawValue, label) : parsed.rawValue;
+    result2[path] = parsed.negated ? { not: matcherValue } : matcherValue;
+  }
+  return result2;
+}
+function parseFilterOptions(options) {
+  const filter2 = {};
+  if (options.source)
+    filter2.source = options.source;
+  if (options.type)
+    filter2.type = options.type;
+  if (options.subject)
+    filter2.subject = options.subject;
+  if (options.severity)
+    filter2.severity = options.severity;
+  const data = mergeMatchers(parseFieldMatchers(options.data, "data"), parseFieldMatchers(options.dataJson, "data-json", true));
+  const metadata = mergeMatchers(parseFieldMatchers(options.metadata, "metadata"), parseFieldMatchers(options.metadataJson, "metadata-json", true));
+  if (Object.keys(data).length > 0)
+    filter2.data = data;
+  if (Object.keys(metadata).length > 0)
+    filter2.metadata = metadata;
+  return Object.keys(filter2).length > 0 ? [filter2] : undefined;
+}
+function mergeMatchers(...records) {
+  const result2 = {};
+  for (const record of records) {
+    if (!record)
+      continue;
+    for (const [path, value] of Object.entries(record)) {
+      if (path in result2)
+        throw new Error(`Duplicate filter path: ${path}`);
+      result2[path] = value;
+    }
+  }
+  return result2;
+}
+function parseTypedMatcherValue(value, label) {
+  const parsed = JSON.parse(value);
+  if (parsed === null || typeof parsed === "string" || typeof parsed === "number" || typeof parsed === "boolean" || Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) {
+    return parsed;
+  }
+  throw new Error(`${label} filter JSON values must be string, string[], number, boolean, or null`);
+}
+function parseMatcherExpression(value, label) {
+  const negativeSeparator = value.indexOf("!=");
+  if (negativeSeparator > 0) {
+    return {
+      path: value.slice(0, negativeSeparator),
+      rawValue: value.slice(negativeSeparator + 2),
+      negated: true
+    };
+  }
+  const separator = value.indexOf("=");
+  if (separator <= 0)
+    throw new Error(`Invalid ${label} filter, expected path=value or path!=value: ${value}`);
+  return {
+    path: value.slice(0, separator),
+    rawValue: value.slice(separator + 1),
+    negated: false
+  };
+}
+var DEFAULT_EVENT_LIST_LIMIT = 100;
 function parseJsonObject(value, fallback) {
   if (!value)
     return fallback;
@@ -78684,18 +80018,6 @@ function parseHeaders(values2) {
   }
   return headers;
 }
-function parseFilter(options) {
-  const filter2 = {};
-  if (options.source)
-    filter2.source = options.source;
-  if (options.type)
-    filter2.type = options.type;
-  if (options.subject)
-    filter2.subject = options.subject;
-  if (options.severity)
-    filter2.severity = options.severity;
-  return Object.keys(filter2).length > 0 ? [filter2] : undefined;
-}
 function createClient(options) {
   if (options.createClient)
     return options.createClient();
@@ -78707,22 +80029,30 @@ function print(value, json, text) {
   else
     console.log(text);
 }
+function fail(error, json) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (json)
+    console.log(JSON.stringify({ error: message }, null, 2));
+  else
+    console.error(message);
+  process.exitCode = 1;
+}
 function hasJsonOption(options) {
   return Boolean(options?.json || options?.opts?.().json || options?.optsWithGlobals?.().json || options?.parent?.opts?.().json || options?.parent?.optsWithGlobals?.().json);
 }
 function wantsJson(actionOptions, command) {
   return hasJsonOption(actionOptions) || hasJsonOption(command);
 }
-function registerWebhookCommands(program2, options) {
-  const webhooks = program2.command(options.webhooksCommandName ?? "webhooks").description("Manage Hasna event webhook subscriptions");
-  webhooks.command("add").description("Add or replace a webhook or command subscription").argument("<target>", "Webhook URL or command binary").requiredOption("--id <id>", "Subscription/channel identifier").option("--transport <kind>", "Transport kind: webhook or command", "webhook").option("--name <name>", "Display name").option("--type <pattern>", "Event type filter, e.g. todos.task.*").option("--source <pattern>", "Event source filter").option("--subject <pattern>", "Event subject filter").option("--severity <pattern>", "Event severity filter").option("--secret <secret>", "Webhook HMAC secret").option("--header <name=value...>", "Webhook header", collectValues, []).option("--arg <arg...>", "Command argument", collectValues, []).option("--timeout-ms <ms>", "Transport timeout in milliseconds", parseNumber).option("--retry-attempts <n>", "Maximum delivery attempts", parseNumber).option("--retry-backoff-ms <ms>", "Initial retry backoff in milliseconds", parseNumber).option("--redact <path...>", "Event field path to redact before delivery", collectValues, []).option("--disabled", "Create channel disabled", false).option("-j, --json", "Print JSON output", false).action(async (target, actionOptions, command) => {
+function registerChannelCommands(program2, options) {
+  const channels = program2.command(options.channelsCommandName ?? "channels").description("Manage Hasna event channels");
+  channels.command("add").description("Add or replace a channel").argument("<target>", "Webhook URL or command binary").requiredOption("--id <id>", "Channel identifier").option("--transport <kind>", "Transport kind: webhook or command", "webhook").option("--name <name>", "Display name").option("--type <pattern>", "Event type filter, e.g. todos.task.*").option("--source <pattern>", "Event source filter").option("--subject <pattern>", "Event subject filter").option("--severity <pattern>", "Event severity filter").option("--data <path=value...>", "Event data field filter; string values, path!=value negatives, array-member matching, dot paths, * segment wildcard, ** recursive wildcard", collectValues, []).option("--metadata <path=value...>", "Event metadata field filter; string values, path!=value negatives, array-member matching, dot paths, * segment wildcard, ** recursive wildcard", collectValues, []).option("--data-json <path=json...>", "Event data field filter with typed JSON value; path!=json negatives supported", collectValues, []).option("--metadata-json <path=json...>", "Event metadata field filter with typed JSON value; path!=json negatives supported", collectValues, []).option("--secret <secret>", "Webhook HMAC secret").option("--header <name=value...>", "Webhook header", collectValues, []).option("--arg <arg...>", "Command argument", collectValues, []).option("--timeout-ms <ms>", "Transport timeout in milliseconds", parseNumber).option("--retry-attempts <n>", "Maximum delivery attempts", parseNumber).option("--retry-backoff-ms <ms>", "Initial retry backoff in milliseconds", parseNumber).option("--redact <path...>", "Event field path to redact before delivery", collectValues, []).option("--disabled", "Create channel disabled", false).option("-j, --json", "Print JSON output", false).action(async (target, actionOptions, command) => {
     const timestamp = new Date().toISOString();
     const channel = {
       id: actionOptions.id,
       name: actionOptions.name,
       enabled: !actionOptions.disabled,
       transport: actionOptions.transport,
-      filters: parseFilter(actionOptions),
+      filters: parseFilterOptions(actionOptions),
       retry: actionOptions.retryAttempts || actionOptions.retryBackoffMs ? { maxAttempts: actionOptions.retryAttempts, backoffMs: actionOptions.retryBackoffMs } : undefined,
       redact: actionOptions.redact?.length ? { paths: actionOptions.redact } : undefined,
       createdAt: timestamp,
@@ -78738,35 +80068,61 @@ function registerWebhookCommands(program2, options) {
     const saved = await createClient(options).addChannel(channel);
     print(sanitizeChannelForOutput(saved), wantsJson(actionOptions, command), `Added ${saved.transport} channel ${saved.id}`);
   });
-  webhooks.command("list").description("List configured subscriptions").option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
-    const channels = await createClient(options).listChannels();
+  channels.command("list").description("List configured channels").option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+    const channels2 = await createClient(options).listChannels();
     if (wantsJson(actionOptions, command)) {
-      console.log(JSON.stringify(sanitizeChannelsForOutput(channels), null, 2));
+      console.log(JSON.stringify(sanitizeChannelsForOutput(channels2), null, 2));
       return;
     }
-    if (!channels.length) {
+    if (!channels2.length) {
       console.log("No channels configured.");
       return;
     }
-    for (const channel of channels) {
+    for (const channel of channels2) {
       console.log(`${channel.id}	${channel.enabled ? "enabled" : "disabled"}	${channel.transport}	${channel.webhook?.url ?? channel.command?.command ?? channel.transport}`);
     }
   });
-  webhooks.command("remove").description("Remove a subscription").argument("<id>", "Subscription/channel identifier").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
+  channels.command("status").description("Show events channel storage status").option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+    const status = await getEventsStatus(options.dataDir);
+    print(status, wantsJson(actionOptions, command), `events dataDir: ${status.dataDir}`);
+  });
+  channels.command("remove").description("Remove a channel").argument("<id>", "Channel identifier").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
     const removed = await createClient(options).removeChannel(id);
     print({ removed }, wantsJson(actionOptions, command), removed ? `Removed ${id}` : `Channel not found: ${id}`);
   });
-  webhooks.command("test").description("Send a test event to one subscription").argument("<id>", "Subscription/channel identifier").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events test delivery").option("--data <json>", "Event data JSON object").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
-    const result2 = await createClient(options).testChannel(id, {
-      source: options.source,
-      type: actionOptions.type,
-      subject: actionOptions.subject ?? id,
-      message: actionOptions.message,
-      data: parseJsonObject(actionOptions.data, { test: true })
-    });
-    print(result2, wantsJson(actionOptions, command), `${result2.status}: ${result2.channelId}`);
+  channels.command("test").description("Send a test event to one channel").argument("<id>", "Channel identifier").option("--source <source>", "Event source override").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events test delivery").option("--data <json>", "Event data JSON object").option("--metadata <json>", "Event metadata JSON object").option("--honor-filters", "Skip delivery when the sample event does not match channel filters", false).option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
+    const json = wantsJson(actionOptions, command);
+    try {
+      const result2 = await createClient(options).testChannel(id, {
+        source: actionOptions.source ?? options.source,
+        type: actionOptions.type,
+        subject: actionOptions.subject ?? id,
+        message: actionOptions.message,
+        data: parseJsonObject(actionOptions.data, { test: true }),
+        metadata: parseJsonObject(actionOptions.metadata, {})
+      }, { honorFilters: actionOptions.honorFilters });
+      print(result2, json, `${result2.status}: ${result2.channelId}`);
+    } catch (error) {
+      fail(error, json);
+    }
+  });
+  channels.command("match").description("Check whether a sample event matches one channel without delivering").argument("<id>", "Channel identifier").option("--source <source>", "Event source override").option("--type <type>", "Event type", "events.test").option("--subject <subject>", "Event subject").option("--message <message>", "Event message", "Hasna events match preview").option("--data <json>", "Event data JSON object").option("--metadata <json>", "Event metadata JSON object").option("-j, --json", "Print JSON output", false).action(async (id, actionOptions, command) => {
+    const json = wantsJson(actionOptions, command);
+    try {
+      const result2 = await createClient(options).matchChannel(id, {
+        source: actionOptions.source ?? options.source,
+        type: actionOptions.type,
+        subject: actionOptions.subject ?? id,
+        message: actionOptions.message,
+        data: parseJsonObject(actionOptions.data, { test: true }),
+        metadata: parseJsonObject(actionOptions.metadata, {})
+      });
+      print(result2, json, `${result2.matched ? "matched" : "skipped"}: ${result2.channelId}`);
+    } catch (error) {
+      fail(error, json);
+    }
   });
-  return webhooks;
+  return channels;
 }
 function registerEventCommands(program2, options) {
   const events = program2.command(options.eventsCommandName ?? "events").description("Emit, list, and replay Hasna events");
@@ -78783,7 +80139,8 @@ function registerEventCommands(program2, options) {
     }, { deliver: actionOptions.deliver, dedupe: actionOptions.dedupe });
     print(result2, wantsJson(actionOptions, command), `${result2.deduped ? "Deduped" : "Emitted"} ${result2.event.id} to ${result2.deliveries.length} channel(s)`);
   });
-  events.command("list").description("List recorded events").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--limit <n>", "Limit results", parseNumber).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+  const defaultListLimit = options.defaultEventListLimit ?? DEFAULT_EVENT_LIST_LIMIT;
+  events.command("list").description("List recorded events").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--limit <n>", `Limit to the most recent <n> events (default ${defaultListLimit}; use 0 for all)`, parseNumber, defaultListLimit).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
     let rows = await createClient(options).listEvents();
     if (actionOptions.source)
       rows = rows.filter((event) => event.source === actionOptions.source);
@@ -78802,19 +80159,21 @@ function registerEventCommands(program2, options) {
     for (const event of rows)
       console.log(`${event.time}	${event.id}	${event.source}	${event.type}	${event.severity}`);
   });
-  events.command("replay").description("Replay recorded events").option("--id <id>", "Replay one event id").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--dry-run", "Preview without delivery", false).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
+  events.command("replay").description("Replay recorded events").option("--id <id>", "Replay one event id").option("--source <source>", "Filter by source").option("--type <type>", "Filter by type").option("--cursor <cursor>", "Opaque replay cursor from a previous page").option("--limit <n>", "Maximum events to replay", parseNumber).option("--dry-run", "Preview without delivery", false).option("-j, --json", "Print JSON output", false).action(async (actionOptions, command) => {
     const result2 = await createClient(options).replay({
       eventId: actionOptions.id,
       source: actionOptions.source,
       type: actionOptions.type,
+      cursor: actionOptions.cursor,
+      limit: actionOptions.limit,
       dryRun: actionOptions.dryRun
     });
-    print(result2, wantsJson(actionOptions, command), `Replayed ${result2.events.length} event(s), ${result2.deliveries.length} delivery result(s)`);
+    print(result2, wantsJson(actionOptions, command), replaySummary(result2.events.length, result2.deliveries.length, result2.nextCursor));
   });
   return events;
 }
 function registerEventsCommands(program2, options) {
-  registerWebhookCommands(program2, options);
+  registerChannelCommands(program2, options);
   registerEventCommands(program2, options);
 }
 function parseNumber(value) {
@@ -78827,6 +80186,10 @@ function collectValues(value, previous) {
   previous.push(value);
   return previous;
 }
+function replaySummary(events, deliveries, nextCursor) {
+  const suffix = nextCursor ? `, next cursor: ${nextCursor}` : "";
+  return `Replayed ${events} event(s), ${deliveries} delivery result(s)${suffix}`;
+}
 
 // src/cli/index.tsx
 init_source();
@@ -79986,6 +81349,8 @@ var { registerFeedback: registerFeedback2 } = await Promise.resolve().then(() =>
 registerFeedback2(program2);
 var { registerStorage: registerStorage2 } = await Promise.resolve().then(() => (init_storage(), exports_storage));
 registerStorage2(program2);
+var { registerRegistryReconcile: registerRegistryReconcile2 } = await Promise.resolve().then(() => (init_registry_reconcile2(), exports_registry_reconcile));
+registerRegistryReconcile2(program2);
 registerEventsCommands(program2, { source: "skills" });
 try {
   await program2.parseAsync();