@hasna/skills 0.1.69 → 0.1.71

package/bin/index.js

@@ -36860,7 +36860,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.1.69",
+    version: "0.1.71",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -36912,6 +36912,7 @@ var init_package = __esm(() => {
       "dev:mcp": "bun --watch run ./src/mcp/index.ts",
       "dev:server": "bun --watch run ./src/server/index.ts",
       "dev:worker": "bun --watch run ./src/server/worker.ts",
+      "docker:check": "bash scripts/docker-build-check.sh",
       migrate: "bun run ./src/server/migrate.ts",
       typecheck: "tsc --noEmit",
       "verify:release": "bun run scripts/release-guard.ts",
@@ -36944,7 +36945,8 @@ var init_package = __esm(() => {
       "@types/react": "^18.2.0",
       "bun-types": "1.3.14",
       "react-devtools-core": "^7.0.1",
-      typescript: "^5"
+      typescript: "^5",
+      yaml: "^2.9.0"
     },
     dependencies: {
       "@aws-sdk/client-ecs": "^3.1079.0",
@@ -38320,6 +38322,14 @@ var init_development_tools = __esm(() => {
       category: "Development Tools",
       tags: ["config", "validation", "schema", "linting"]
     },
+    {
+      name: "oss-app-two-backend-storage",
+      displayName: "OSS App Two-Backend Storage",
+      description: "Recipe for the Hasna two-backend storage contract: client transport + HTTP store, server PG/SQLite backend, pg-migrations + apply script, fail-closed URL-without-key, bun bins, contract manifest, Dockerfile",
+      category: "Development Tools",
+      tags: ["storage", "backend", "postgresql", "sqlite", "two-backend", "oss-app"],
+      kind: "instruction"
+    },
     {
       name: "session-inject-monitor",
       displayName: "Session Inject Monitor",
@@ -69906,7 +69916,7 @@ var init_server3 = __esm(() => {
   server = buildServer();
 });
 
-// ../../node_modules/.bun/@hono+node-server@1.19.17+804d2c5c04916069/node_modules/@hono/node-server/dist/index.mjs
+// ../../node_modules/.bun/@hono+node-server@1.19.17+2145b681a064c8e9/node_modules/@hono/node-server/dist/index.mjs
 import { Readable } from "stream";
 import crypto2 from "crypto";
 var GlobalRequest, Request, newHeadersFromIncoming = (incoming) => {
@@ -71385,13 +71395,344 @@ var init_completion = __esm(() => {
   categoryNames = CATEGORIES.map((c) => c);
 });
 
+// src/lib/portable-snapshot-filter.ts
+import { readdirSync as readdirSync15, statSync as statSync15 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join28, sep as sep3 } from "path";
+function isExcludedSkillFileName(fileName) {
+  if (EXCLUDE_FILE_NAMES.has(fileName)) {
+    return true;
+  }
+  return EXCLUDE_FILE_PATTERNS.some((pattern) => pattern.test(fileName));
+}
+function isPortableWithinSkill(relativeParts) {
+  if (relativeParts.length < 2) {
+    return false;
+  }
+  const [, second] = relativeParts;
+  if (PORTABLE_TOP_LEVEL.has(second)) {
+    return relativeParts.length === 2;
+  }
+  if (relativeParts.length < 3) {
+    return false;
+  }
+  return PORTABLE_SUBDIRS.has(second);
+}
+function homePathFor(definition, homesRoot) {
+  const home = homesRoot ?? homedir9();
+  if (definition.subClass === "skills" || definition.subClass === "custom") {
+    return join28(home, ".hasna", "skills", definition.name);
+  }
+  if (definition.agent === "opencode") {
+    return join28(home, ".config", "opencode", "skills");
+  }
+  return join28(home, `.${definition.agent}`, "skills");
+}
+function destinationFor(definition, stationId, relativePath) {
+  const category = definition.subClass === "agent-homes" ? join28("agent-homes", definition.agent ?? "") : definition.name;
+  return join28("resources", stationId, "skills", category, ...relativePath.split(sep3));
+}
+function walkEntries(absoluteRoot) {
+  let entries;
+  try {
+    entries = readdirSync15(absoluteRoot, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const output = [];
+  for (const entry of entries) {
+    const childFull = join28(absoluteRoot, entry.name);
+    if (entry.isSymbolicLink()) {
+      output.push({ kind: "symlink", relativePath: entry.name, fullPath: childFull });
+      continue;
+    }
+    if (entry.isDirectory()) {
+      if (EXCLUDE_DIR_NAMES.has(entry.name) || EXCLUDE_DIR_PATTERNS.some((pattern) => pattern.test(entry.name))) {
+        continue;
+      }
+      const nested = walkEntries(childFull);
+      for (const item of nested) {
+        output.push({ ...item, relativePath: join28(entry.name, item.relativePath) });
+      }
+      continue;
+    }
+    if (entry.isFile()) {
+      output.push({ kind: "file", relativePath: entry.name, fullPath: childFull });
+    }
+  }
+  return output;
+}
+function isRegularFile(filePath) {
+  try {
+    return statSync15(filePath).isFile();
+  } catch {
+    return false;
+  }
+}
+var SYNC_HOMES, EXCLUDE_DIR_NAMES, EXCLUDE_DIR_PATTERNS, EXCLUDE_FILE_NAMES, EXCLUDE_FILE_PATTERNS, PORTABLE_TOP_LEVEL, PORTABLE_SUBDIRS, REFUSED_SCANNER_FLAGGED;
+var init_portable_snapshot_filter = __esm(() => {
+  SYNC_HOMES = [
+    { name: "skills", subClass: "skills", agent: null },
+    { name: "custom", subClass: "custom", agent: null },
+    { name: "claude", subClass: "agent-homes", agent: "claude" },
+    { name: "codewith", subClass: "agent-homes", agent: "codewith" },
+    { name: "codex", subClass: "agent-homes", agent: "codex" },
+    { name: "opencode", subClass: "agent-homes", agent: "opencode" },
+    { name: "cursor", subClass: "agent-homes", agent: "cursor" }
+  ];
+  EXCLUDE_DIR_NAMES = new Set([
+    ".git",
+    "node_modules",
+    "__pycache__",
+    ".cache",
+    ".pytest_cache",
+    ".mypy_cache",
+    ".ruff_cache"
+  ]);
+  EXCLUDE_DIR_PATTERNS = [
+    /^\.merge-pr\.rollback-/
+  ];
+  EXCLUDE_FILE_NAMES = new Set([
+    ".DS_Store",
+    "package-lock.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "Cargo.lock"
+  ]);
+  EXCLUDE_FILE_PATTERNS = [
+    /^\._/,
+    /\.bak$/,
+    /\.orig$/,
+    /\.rej$/,
+    /~$/,
+    /\.pyc$/,
+    /\.pyo$/,
+    /\.log$/,
+    /\.db$/,
+    /\.sqlite(\d)?$/,
+    /^bun\.lock/,
+    /\.env($|\.)/,
+    /\.pem$/,
+    /\.key$/,
+    /\.p12$/,
+    /\.pfx$/,
+    /\.jks$/,
+    /^id_rsa/,
+    /^id_ed25519/,
+    /^credentials/
+  ];
+  PORTABLE_TOP_LEVEL = new Set(["SKILL.md", "skill.json"]);
+  PORTABLE_SUBDIRS = new Set(["scripts", "assets", "references"]);
+  REFUSED_SCANNER_FLAGGED = new Set([
+    "aws-cross-account-app-migration/SKILL.md",
+    "aws-cross-account-app-migration/scripts/selftest.sh",
+    "gateway-serve/SKILL.md",
+    "infinity-drain/SKILL.md",
+    "infinity-run/SKILL.md",
+    "oss-saas-code-cleanup/SKILL.md",
+    "repo-project-familiarization/scripts/repo_shape.py",
+    "repo-project-familiarization/scripts/session_history.py",
+    "scale-check/SKILL.md",
+    "standard-align-repo/SKILL.md",
+    "standard-build-iapp/SKILL.md",
+    "standard-build-oss/SKILL.md",
+    "skill-image/SKILL.md",
+    "skill-scale-check/SKILL.md",
+    "sqlite-to-rds-parity-migrate/scripts/parity-migrate.ts",
+    "pdf-operations/scripts/pdf_ops.py"
+  ]);
+});
+
+// src/lib/station-snapshot.ts
+import { createHash as createHash4 } from "crypto";
+import {
+  copyFileSync as copyFileSync2,
+  mkdirSync as mkdirSync15,
+  readFileSync as readFileSync22,
+  statSync as statSync16,
+  writeFileSync as writeFileSync16
+} from "fs";
+import { dirname as dirname11, isAbsolute as isAbsolute3, relative as relative4, resolve, sep as sep4 } from "path";
+function validateStationId(stationId) {
+  if (!/^[a-z0-9-]+$/.test(stationId)) {
+    throw new StationSnapshotError("INVALID_STATION", `station id must be a slug, got: ${stationId}`);
+  }
+}
+function sha256File(filePath) {
+  return createHash4("sha256").update(readFileSync22(filePath)).digest("hex");
+}
+function scanHome(definition, homesRoot) {
+  const homePath = homePathFor(definition, homesRoot);
+  const entries = walkEntries(homePath);
+  const portable = [];
+  const skipped = [];
+  for (const entry of entries) {
+    const relativeParts = entry.relativePath.split(sep4);
+    const fileName = relativeParts[relativeParts.length - 1];
+    if (entry.kind === "symlink") {
+      skipped.push({ relativePath: entry.relativePath, reason: "symlink" });
+      continue;
+    }
+    if (!isPortableWithinSkill(relativeParts)) {
+      skipped.push({ relativePath: entry.relativePath, reason: "not-portable" });
+      continue;
+    }
+    if (isExcludedSkillFileName(fileName)) {
+      skipped.push({ relativePath: entry.relativePath, reason: "excluded" });
+      continue;
+    }
+    if (REFUSED_SCANNER_FLAGGED.has(entry.relativePath)) {
+      skipped.push({ relativePath: entry.relativePath, reason: "refused-scanner-flagged" });
+      continue;
+    }
+    if (!isRegularFile(entry.fullPath)) {
+      skipped.push({ relativePath: entry.relativePath, reason: "not-regular-file" });
+      continue;
+    }
+    const info = statSync16(entry.fullPath);
+    portable.push({
+      relativePath: entry.relativePath,
+      fullPath: entry.fullPath,
+      size: info.size,
+      mtimeMs: info.mtimeMs,
+      mtimeIso: info.mtime.toISOString()
+    });
+  }
+  return { definition, homePath, portable, skipped };
+}
+function planStationSnapshot(options) {
+  validateStationId(options.stationId);
+  const scanned = SYNC_HOMES.map((definition) => scanHome(definition, options.homesRoot));
+  const symlinks = scanned.reduce((sum2, item) => sum2 + item.skipped.filter((entry) => entry.reason === "symlink").length, 0);
+  if (symlinks > 0) {
+    throw new StationSnapshotError("SYMLINKS_REFUSED", `${symlinks} symlink(s) inside skill homes; symlinks are refused (fail closed)`);
+  }
+  const plans = [];
+  for (const item of scanned) {
+    for (const file of item.portable) {
+      plans.push({
+        definition: item.definition,
+        source: file,
+        destination: destinationFor(item.definition, options.stationId, file.relativePath),
+        digest: sha256File(file.fullPath)
+      });
+    }
+  }
+  const totalBytes = plans.reduce((sum2, plan) => sum2 + plan.source.size, 0);
+  return { scanned, plans, totalBytes };
+}
+function humanHomes(scanned) {
+  return scanned.map((item) => ({
+    name: item.definition.name,
+    homePath: item.homePath,
+    files: item.portable.length,
+    skipped: item.skipped.length
+  }));
+}
+function writeStationSnapshot(options) {
+  const repoRoot = resolve(options.repoRoot ?? process.cwd());
+  const { scanned, plans, totalBytes } = planStationSnapshot(options);
+  const manifestFiles = plans.map((plan) => ({
+    relativePath: plan.source.relativePath,
+    destination: plan.destination,
+    subClass: plan.definition.subClass,
+    agent: plan.definition.agent,
+    sha256: plan.digest,
+    sourceMtimeMs: plan.source.mtimeMs,
+    sourceMtimeIso: plan.source.mtimeIso,
+    size: plan.source.size
+  }));
+  const base2 = {
+    stationId: options.stationId,
+    mode: "dry-run",
+    repoRoot,
+    stats: { files: plans.length, bytes: totalBytes },
+    homes: humanHomes(scanned),
+    files: manifestFiles
+  };
+  if (options.dryRun !== false) {
+    return base2;
+  }
+  const conflicts = [];
+  const untouched = [];
+  for (const plan of plans) {
+    const destination = resolve(repoRoot, plan.destination);
+    const destinationRelative = relative4(repoRoot, destination);
+    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep4) || isAbsolute3(destinationRelative)) {
+      throw new StationSnapshotError("DESTINATION_ESCAPE", `destination escapes repo root: ${plan.destination}`);
+    }
+    let existingDigest = null;
+    try {
+      existingDigest = sha256File(destination);
+    } catch {}
+    if (existingDigest !== null) {
+      if (existingDigest === plan.digest) {
+        continue;
+      }
+      conflicts.push(`existing destination differs from staged source: ${plan.destination}`);
+      continue;
+    }
+    untouched.push(plan);
+  }
+  if (conflicts.length > 0) {
+    throw new StationSnapshotError("CONFLICT", `${conflicts.length} conflict(s); terminal non-acceptance, nothing written`, conflicts);
+  }
+  let written = 0;
+  for (const plan of untouched) {
+    const destination = resolve(repoRoot, plan.destination);
+    mkdirSync15(dirname11(destination), { recursive: true });
+    copyFileSync2(plan.source.fullPath, destination);
+    written += 1;
+  }
+  const unchanged = plans.length - untouched.length;
+  const manifest = {
+    schema: STATION_SYNC_MANIFEST_SCHEMA,
+    stationId: options.stationId,
+    syncedAt: new Date().toISOString(),
+    producer: STATION_SNAPSHOT_PRODUCER,
+    stats: {
+      written,
+      unchanged,
+      files: plans.length,
+      bytes: totalBytes
+    },
+    files: manifestFiles
+  };
+  const manifestPath = resolve(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
+  mkdirSync15(dirname11(manifestPath), { recursive: true });
+  writeFileSync16(manifestPath, `${JSON.stringify(manifest, null, 2)}
+`);
+  return {
+    ...base2,
+    mode: "populate",
+    stats: { files: plans.length, bytes: totalBytes, written, unchanged },
+    manifestPath
+  };
+}
+var STATION_SYNC_MANIFEST_SCHEMA = "hasna.fleet-resources.skills-sync-manifest/v1", STATION_SNAPSHOT_PRODUCER, StationSnapshotError;
+var init_station_snapshot = __esm(() => {
+  init_package();
+  init_portable_snapshot_filter();
+  STATION_SNAPSHOT_PRODUCER = { name: "@hasna/skills", version: package_default.version };
+  StationSnapshotError = class StationSnapshotError extends Error {
+    code;
+    detail;
+    constructor(code, message, detail = []) {
+      super(message);
+      this.name = "StationSnapshotError";
+      this.code = code;
+      this.detail = detail;
+    }
+  };
+});
+
 // src/cli/commands/create-sync-config.ts
 var exports_create_sync_config = {};
 __export(exports_create_sync_config, {
   registerCreateSync: () => registerCreateSync
 });
-import { existsSync as existsSync27, writeFileSync as writeFileSync16, mkdirSync as mkdirSync15 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync27, writeFileSync as writeFileSync17, mkdirSync as mkdirSync16 } from "fs";
+import { join as join29 } from "path";
 function registerCreateSync(parent) {
   const configCmd = parent.command("config").description("Manage skills configuration");
   configCmd.command("show", { isDefault: true }).option("--json", "Output as JSON", false).description("Show current merged configuration").action((options) => {
@@ -71466,13 +71807,13 @@ function registerCreateSync(parent) {
     console.log(`${source_default.cyan("project")}: ${pp}${existsSync27(pp) ? source_default.green(" (exists)") : source_default.dim(" (not found)")}`);
   });
   parent.command("create").argument("<name>", "Skill name (e.g. my-tool)").option("--category <category>", "Skill category", "Development Tools").option("--description <description>", "Short description of what the skill does").option("--tags <tags>", "Comma-separated tags (e.g. api,testing,automation)").option("--global", "Deprecated; custom skills are always global", false).option("--json", "Output result as JSON", false).description("Scaffold a new custom skill directory").action((name, options) => handleCreate(name, options));
-  parent.command("sync").alias("render").argument("[names...]", "Skills to sync (default: every skill in this machine's corpus)").option("--for <agent>", `Target one agent (${SYNC_AGENTS.join(", ")}, or all)`, "all").option("--all", "Sync every corpus skill (the default)", false).option("--source <path>", "Canonical corpus source: a directory of skill folders, or a package root with skills/ (overrides $SKILLS_SOURCE)").option("--dry-run", "Show what would be written without touching any agent folder", false).option("--force", "Adopt an unmanaged skill that already has SKILL.md; other unmarked directories are never overwritten", false).option("--check", "Home drift census (missing-from-home / stray-in-home / diverged); exits non-zero on drift, writes nothing", false).option("--adopt", "Unmarked-home adoption mode: hash unmarked home skills against the corpus; exact matches are marked (dry-run by default)", false).option("--prune", "Prune mode: list (or with --apply, remove) marked home skill dirs that have no canonical corpus entry", false).option("--apply", "Write adoption markers / conflicts ledger, or perform prune removals", false).option("--json", "Output as JSON", false).description("Write corpus skills into each coding agent's global skills folder, per-tool adapted").action((names, options) => handleSync(names, options));
+  parent.command("sync").alias("render").argument("[names...]", "Skills to sync (default: every skill in this machine's corpus)").option("--for <agent>", `Target one agent (${SYNC_AGENTS.join(", ")}, or all)`, "all").option("--all", "Sync every corpus skill (the default)", false).option("--source <path>", "Canonical corpus source: a directory of skill folders, or a package root with skills/ (overrides $SKILLS_SOURCE)").option("--dry-run", "Show what would be written without touching any agent folder", false).option("--force", "Adopt an unmanaged skill that already has SKILL.md; other unmarked directories are never overwritten", false).option("--check", "Home drift census (missing-from-home / stray-in-home / diverged); exits non-zero on drift, writes nothing", false).option("--adopt", "Unmarked-home adoption mode: hash unmarked home skills against the corpus; exact matches are marked (dry-run by default)", false).option("--prune", "Prune mode: list (or with --apply, remove) marked home skill dirs that have no canonical corpus entry", false).option("--apply", "Write adoption markers / conflicts ledger, or perform prune removals", false).option("--json", "Output as JSON", false).option("--station <id>", "Per-station snapshot mode: snapshot the installed skill homes into resources/<station>/skills with a v3 sync-manifest (dry-run by default; --populate writes)").option("--populate", "Write the per-station snapshot (station mode; the default is dry-run)", false).option("--repo-root <path>", "Station snapshot destination repo root (default: cwd)").option("--homes-root <dir>", "Build the station snapshot from a staged mirror of the skill homes instead of this machine's $HOME").description("Write corpus skills into each coding agent's global skills folder, per-tool adapted; with --station, snapshot the homes into a reviewed snapshot repo instead").action((names, options) => handleSync(names, options));
 }
 function handleCreate(name, options) {
   const bare = name.trim();
   const dirName = bare;
   const baseDir = getPortableSkillsRoot();
-  const skillDir = join28(baseDir, dirName);
+  const skillDir = join29(baseDir, dirName);
   if (existsSync27(skillDir)) {
     console.log(options.json ? JSON.stringify({ error: `Skill '${bare}' already exists at ${skillDir}` }) : source_default.red(`Skill '${bare}' already exists at ${skillDir}`));
     process.exitCode = 1;
@@ -71481,8 +71822,8 @@ function handleCreate(name, options) {
   const description = options.description || `${bare} skill`;
   const tags = options.tags ? options.tags.split(",").map((t) => t.trim()).filter(Boolean) : [bare];
   const displayName2 = bare.replace(/-/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
-  mkdirSync15(join28(skillDir, "src"), { recursive: true });
-  writeFileSync16(join28(skillDir, "SKILL.md"), [
+  mkdirSync16(join29(skillDir, "src"), { recursive: true });
+  writeFileSync17(join29(skillDir, "SKILL.md"), [
     "---",
     `name: ${bare}`,
     `description: ${description}`,
@@ -71502,11 +71843,11 @@ function handleCreate(name, options) {
     ""
   ].join(`
 `));
-  writeFileSync16(join28(skillDir, "src", "index.ts"), [`#!/usr/bin/env bun`, `/**`, ` * ${displayName2} \u2014 ${description}`, ` */`, "", `console.log("${displayName2}");`, ""].join(`
+  writeFileSync17(join29(skillDir, "src", "index.ts"), [`#!/usr/bin/env bun`, `/**`, ` * ${displayName2} \u2014 ${description}`, ` */`, "", `console.log("${displayName2}");`, ""].join(`
 `));
-  writeFileSync16(join28(skillDir, "package.json"), JSON.stringify({ name: bare, version: "0.1.0", description, bin: { [bare]: "./src/index.ts" }, scripts: { dev: `bun src/index.ts` }, dependencies: {} }, null, 2) + `
+  writeFileSync17(join29(skillDir, "package.json"), JSON.stringify({ name: bare, version: "0.1.0", description, bin: { [bare]: "./src/index.ts" }, scripts: { dev: `bun src/index.ts` }, dependencies: {} }, null, 2) + `
 `);
-  writeFileSync16(join28(skillDir, "tsconfig.json"), JSON.stringify({ compilerOptions: { target: "ES2022", module: "ESNext", moduleResolution: "bundler", strict: true, outDir: "dist" }, include: ["src/**/*.ts"] }, null, 2) + `
+  writeFileSync17(join29(skillDir, "tsconfig.json"), JSON.stringify({ compilerOptions: { target: "ES2022", module: "ESNext", moduleResolution: "bundler", strict: true, outDir: "dist" }, include: ["src/**/*.ts"] }, null, 2) + `
 `);
   clearRegistryCache();
   if (options.json)
@@ -71515,11 +71856,15 @@ function handleCreate(name, options) {
     console.log(source_default.green(`\u2713 Created custom skill '${bare}' at ${skillDir}`));
     console.log(source_default.dim(`  Category: ${options.category}`));
     console.log(source_default.dim(`  Tags: ${tags.join(", ")}`));
-    console.log(`  ${source_default.cyan("Edit:")} ${join28(skillDir, "src", "index.ts")}`);
-    console.log(`  ${source_default.cyan("Run:")}  bun ${join28(skillDir, "src", "index.ts")}`);
+    console.log(`  ${source_default.cyan("Edit:")} ${join29(skillDir, "src", "index.ts")}`);
+    console.log(`  ${source_default.cyan("Run:")}  bun ${join29(skillDir, "src", "index.ts")}`);
   }
 }
 function handleSync(names, options) {
+  if (options.station) {
+    handleStationSnapshot(names, options);
+    return;
+  }
   const modes = [options.check, options.adopt, options.prune].filter(Boolean).length;
   if (modes > 1) {
     const message = "--check, --adopt, and --prune are mutually exclusive";
@@ -71580,6 +71925,68 @@ function handleSync(names, options) {
     process.exitCode = 1;
   }
 }
+function handleStationSnapshot(names, options) {
+  const station = options.station;
+  if (!station)
+    return;
+  if (options.populate && options.dryRun) {
+    const message = "--populate and --dry-run are mutually exclusive";
+    if (options.json)
+      console.log(JSON.stringify({ error: message }));
+    else
+      console.error(source_default.red(message));
+    process.exitCode = 1;
+    return;
+  }
+  const incompatible = names.length > 0 || options.check || options.adopt || options.prune || options.force || options.all || options.source !== undefined;
+  if (incompatible) {
+    const message = "--station (per-station snapshot mode) cannot be combined with corpus->home sync names, --check, --adopt, --prune, --force, --all, or --source";
+    if (options.json)
+      console.log(JSON.stringify({ error: message }));
+    else
+      console.error(source_default.red(message));
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const result2 = writeStationSnapshot({
+      stationId: station,
+      repoRoot: options.repoRoot,
+      homesRoot: options.homesRoot,
+      dryRun: !options.populate
+    });
+    if (result2.mode === "dry-run") {
+      if (options.json) {
+        console.log(JSON.stringify({
+          stationId: result2.stationId,
+          mode: "dry-run",
+          stats: { files: result2.stats.files, bytes: result2.stats.bytes },
+          homes: Object.fromEntries(result2.homes.map((home) => [
+            home.name,
+            { homePath: home.homePath, files: home.files, skipped: home.skipped }
+          ]))
+        }, null, 2));
+        return;
+      }
+      console.log(`DRY-RUN station=${result2.stationId} files=${result2.stats.files} bytes=${result2.stats.bytes}`);
+      for (const home of result2.homes) {
+        console.log(`  ${home.name}: ${home.files} files, ${home.skipped} skipped`);
+      }
+      return;
+    }
+    console.log(`POPULATE station=${result2.stationId} written=${result2.stats.written} unchanged=${result2.stats.unchanged} total=${result2.stats.files} bytes=${result2.stats.bytes}`);
+  } catch (error2) {
+    if (error2 instanceof StationSnapshotError) {
+      for (const line of error2.detail)
+        console.error(`CONFLICT ${line}`);
+      console.error(`FAIL ${error2.message}`);
+      process.exitCode = 2;
+    } else {
+      console.error(`FAIL ${error2.stack ?? error2.message}`);
+      process.exitCode = 1;
+    }
+  }
+}
 function handleSyncCheck(json) {
   const census = censusHomeDrift();
   if (json) {
@@ -71691,6 +72098,350 @@ var init_create_sync_config = __esm(() => {
   init_agent_sync();
   init_home_adoption();
   init_home_census();
+  init_station_snapshot();
+});
+
+// src/lib/station-hydrate.ts
+import { createHash as createHash5 } from "crypto";
+import {
+  copyFileSync as copyFileSync3,
+  mkdirSync as mkdirSync17,
+  readdirSync as readdirSync16,
+  readFileSync as readFileSync23,
+  statSync as statSync17,
+  writeFileSync as writeFileSync18
+} from "fs";
+import { dirname as dirname12, join as join30, resolve as resolve2, sep as sep5 } from "path";
+function fail2(code, message, detail = []) {
+  throw new StationSnapshotError(code, message, detail);
+}
+function snapshotRootFor(repoRoot, stationId) {
+  return join30(repoRoot, "resources", stationId, "skills");
+}
+function readSnapshotManifest(repoRoot, stationId) {
+  const snapshotRoot = snapshotRootFor(repoRoot, stationId);
+  const manifestPath = join30(snapshotRoot, "sync-manifest.json");
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync23(manifestPath, "utf8"));
+  } catch (error2) {
+    fail2("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error2.message}`);
+  }
+  const sourceSnapshotSha = sha256File(manifestPath);
+  return { manifest, manifestPath, sourceSnapshotSha };
+}
+function planStationHydration(stationId, repoRoot) {
+  validateStationId(stationId);
+  const { manifest, sourceSnapshotSha } = readSnapshotManifest(repoRoot, stationId);
+  const snapshotRoot = snapshotRootFor(repoRoot, stationId);
+  const manifestHashes = new Map;
+  for (const file of manifest.files ?? []) {
+    const relativePath = file.relativePath;
+    const agent = file.agent;
+    if (agent && relativePath) {
+      manifestHashes.set(`${agent}${MANIFEST_HASH_KEY_SEP}${relativePath}`, file.sha256);
+    }
+  }
+  const candidates = [];
+  const symlinks = [];
+  const skippedByRule = [];
+  for (const agent of SYNC_AGENTS) {
+    const agentRoot = join30(snapshotRoot, "agent-homes", agent);
+    let identEntries;
+    try {
+      identEntries = readdirSync16(agentRoot, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const identEntry of identEntries) {
+      if (!identEntry.isDirectory() || identEntry.name.startsWith(".")) {
+        continue;
+      }
+      const identRoot = join30(agentRoot, identEntry.name);
+      const entries = walkEntries(identRoot);
+      for (const entry of entries) {
+        const relativeParts = [identEntry.name, ...entry.relativePath.split(sep5)];
+        if (entry.kind === "symlink") {
+          symlinks.push({ ident: identEntry.name, agent, relativePath: entry.relativePath });
+          continue;
+        }
+        if (!isPortableWithinSkill(relativeParts)) {
+          skippedByRule.push({
+            ident: identEntry.name,
+            agent,
+            relativePath: entry.relativePath,
+            reason: "not-portable"
+          });
+          continue;
+        }
+        const fileName = relativeParts[relativeParts.length - 1];
+        if (isExcludedSkillFileName(fileName)) {
+          skippedByRule.push({
+            ident: identEntry.name,
+            agent,
+            relativePath: entry.relativePath,
+            reason: "excluded"
+          });
+          continue;
+        }
+        const withinIdent = relativeParts.slice(1).join(sep5);
+        const homeRelative = relativeParts.join(sep5);
+        if (REFUSED_SCANNER_FLAGGED.has(homeRelative)) {
+          skippedByRule.push({
+            ident: identEntry.name,
+            agent,
+            relativePath: entry.relativePath,
+            reason: "refused-scanner-flagged"
+          });
+          continue;
+        }
+        if (!isRegularFile(entry.fullPath)) {
+          skippedByRule.push({
+            ident: identEntry.name,
+            agent,
+            relativePath: entry.relativePath,
+            reason: "not-regular-file"
+          });
+          continue;
+        }
+        const info = statSync17(entry.fullPath);
+        candidates.push({
+          ident: identEntry.name,
+          agent,
+          withinIdent,
+          fullPath: entry.fullPath,
+          size: info.size,
+          mtimeMs: info.mtimeMs,
+          manifestHash: manifestHashes.get(`${agent}${MANIFEST_HASH_KEY_SEP}${homeRelative}`) ?? null
+        });
+      }
+    }
+  }
+  if (symlinks.length > 0) {
+    fail2("SYMLINKS_REFUSED", `${symlinks.length} symlink(s) inside the snapshot; symlinks are refused (fail closed)`);
+  }
+  const byIdent = new Map;
+  for (const candidate of candidates) {
+    const group = byIdent.get(candidate.ident) ?? [];
+    group.push(candidate);
+    byIdent.set(candidate.ident, group);
+  }
+  const winners = [];
+  for (const [ident, group] of byIdent) {
+    const byFile = new Map;
+    for (const candidate of group) {
+      const copies = byFile.get(candidate.withinIdent) ?? [];
+      copies.push(candidate);
+      byFile.set(candidate.withinIdent, copies);
+    }
+    const files = [];
+    for (const [withinIdent, copies] of byFile) {
+      let eligible = copies;
+      if (withinIdent === "SKILL.md") {
+        const content = [];
+        for (const copy of copies) {
+          let isStub = false;
+          try {
+            isStub = isPointerSkillMd(readFileSync23(copy.fullPath, "utf8"));
+          } catch {
+            isStub = false;
+          }
+          if (!isStub)
+            content.push(copy);
+        }
+        if (content.length > 0) {
+          eligible = content;
+        }
+      }
+      eligible.sort((left, right) => {
+        const leftHash = left.manifestHash !== null;
+        const rightHash = right.manifestHash !== null;
+        if (leftHash !== rightHash) {
+          return leftHash ? -1 : 1;
+        }
+        if (right.mtimeMs !== left.mtimeMs) {
+          return right.mtimeMs - left.mtimeMs;
+        }
+        return SYNC_AGENTS.indexOf(left.agent) - SYNC_AGENTS.indexOf(right.agent);
+      });
+      const winner = eligible[0];
+      files.push({
+        withinIdent,
+        winner,
+        alternates: copies.filter((copy) => copy !== winner).map((copy) => copy.agent)
+      });
+    }
+    files.sort((left, right) => left.withinIdent.localeCompare(right.withinIdent));
+    winners.push({ ident, files });
+  }
+  winners.sort((left, right) => left.ident.localeCompare(right.ident));
+  const totalFiles = winners.reduce((sum2, skill) => sum2 + skill.files.length, 0);
+  const totalBytes = winners.reduce((sum2, skill) => sum2 + skill.files.reduce((inner, file) => inner + file.winner.size, 0), 0);
+  return { manifest, sourceSnapshotSha, winners, skippedByRule, totalFiles, totalBytes };
+}
+function skillSha256(skill) {
+  const skillMd = skill.files.find((file) => file.withinIdent === "SKILL.md");
+  if (skillMd) {
+    return sha256File(skillMd.winner.fullPath);
+  }
+  if (skill.files.length === 1) {
+    return sha256File(skill.files[0].winner.fullPath);
+  }
+  const joined = skill.files.map((file) => sha256File(file.winner.fullPath));
+  return createHash5("sha256").update(joined.sort().join(`
+`)).digest("hex");
+}
+function writeStationHydration(options) {
+  const repoRoot = resolve2(options.repoRoot ?? process.cwd());
+  const cacheRoot = resolve2(options.cacheRoot ?? resolveCorpusRoot());
+  const plan = planStationHydration(options.stationId, repoRoot);
+  const resultSkills = plan.winners.map((skill) => ({
+    ident: skill.ident,
+    files: skill.files.map((file) => ({
+      relativePath: file.withinIdent,
+      sourceAgent: file.winner.agent,
+      sourceMtimeMs: file.winner.mtimeMs,
+      size: file.winner.size
+    })),
+    sha256: skillSha256(skill)
+  }));
+  const base2 = {
+    stationId: options.stationId,
+    mode: "dry-run",
+    cacheRoot,
+    snapshotRoot: snapshotRootFor(repoRoot, options.stationId),
+    sourceSnapshotSha: plan.sourceSnapshotSha,
+    stats: {
+      idents: plan.winners.length,
+      files: plan.totalFiles,
+      bytes: plan.totalBytes
+    },
+    winners: plan.winners,
+    skills: resultSkills
+  };
+  if (options.dryRun !== false) {
+    return base2;
+  }
+  const conflicts = [];
+  const toWrite = [];
+  for (const skill of plan.winners) {
+    for (const file of skill.files) {
+      const destination = join30(cacheRoot, skill.ident, file.withinIdent);
+      const digest = sha256File(file.winner.fullPath);
+      let existingDigest = null;
+      try {
+        existingDigest = sha256File(destination);
+      } catch {}
+      if (existingDigest !== null) {
+        if (existingDigest === digest) {
+          continue;
+        }
+        conflicts.push(`existing destination differs from snapshot winner: ${destination}`);
+        continue;
+      }
+      toWrite.push({ destination, fullPath: file.winner.fullPath });
+    }
+  }
+  if (conflicts.length > 0) {
+    fail2("CONFLICT", `${conflicts.length} conflict(s); terminal non-acceptance, nothing written`, conflicts);
+  }
+  let written = 0;
+  for (const entry of toWrite) {
+    mkdirSync17(dirname12(entry.destination), { recursive: true });
+    copyFileSync3(entry.fullPath, entry.destination);
+    written += 1;
+  }
+  const unchanged = plan.totalFiles - written;
+  const hydration = {
+    schema: STATION_HYDRATION_MANIFEST_SCHEMA,
+    stationId: options.stationId,
+    hydratedAt: new Date().toISOString(),
+    producer: STATION_HYDRATION_PRODUCER,
+    sourceSnapshotSha: plan.sourceSnapshotSha,
+    cacheRoot,
+    stats: {
+      idents: plan.winners.length,
+      written,
+      unchanged,
+      files: plan.totalFiles,
+      bytes: plan.totalBytes
+    },
+    skills: resultSkills
+  };
+  const hydrationManifestPath = join30(dirname12(cacheRoot), `hydration-${options.stationId}.json`);
+  mkdirSync17(dirname12(hydrationManifestPath), { recursive: true });
+  writeFileSync18(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
+`);
+  return {
+    ...base2,
+    mode: "apply",
+    stats: { ...base2.stats, written, unchanged },
+    manifestPath: hydrationManifestPath
+  };
+}
+var STATION_HYDRATION_MANIFEST_SCHEMA = "hasna.fleet-resources.skills-hydration-manifest/v1", STATION_HYDRATION_PRODUCER, MANIFEST_HASH_KEY_SEP;
+var init_station_hydrate = __esm(() => {
+  init_package();
+  init_agent_sync();
+  init_home_migration();
+  init_portable_snapshot_filter();
+  init_station_snapshot();
+  STATION_HYDRATION_PRODUCER = { name: "@hasna/skills", version: package_default.version };
+  MANIFEST_HASH_KEY_SEP = String.fromCharCode(0);
+});
+
+// src/cli/commands/hydrate.ts
+var exports_hydrate = {};
+__export(exports_hydrate, {
+  registerHydrate: () => registerHydrate
+});
+function registerHydrate(parent) {
+  parent.command("hydrate").description("Hydrate the canonical dedup corpus cache from a reviewed per-station skills snapshot").requiredOption("--station <id>", "Station id (slug) naming the snapshot under resources/<id>/skills").option("--apply", "Write into the corpus cache (the default is dry-run)", false).option("--dry-run", "Report without writing anything (the default)", false).option("--cache-root <dir>", "Override the destination corpus cache (used to stage another station's cache before rsync)").option("--repo-root <path>", "Repo root holding resources/<station>/skills (default: cwd)").action((options) => {
+    handleHydrate(options);
+  });
+}
+function handleHydrate(options) {
+  if (options.apply && options.dryRun) {
+    console.error(source_default.red("--apply and --dry-run are mutually exclusive"));
+    process.exitCode = 2;
+    return;
+  }
+  let result2;
+  try {
+    result2 = writeStationHydration({
+      stationId: options.station,
+      repoRoot: options.repoRoot,
+      cacheRoot: options.cacheRoot,
+      dryRun: !options.apply
+    });
+  } catch (error2) {
+    if (error2 instanceof StationSnapshotError) {
+      for (const line of error2.detail)
+        console.error(`CONFLICT ${line}`);
+      console.error(`FAIL ${error2.message}`);
+      process.exitCode = 2;
+    } else {
+      console.error(`FAIL ${error2.stack ?? error2.message}`);
+      process.exitCode = 1;
+    }
+    return;
+  }
+  if (result2.mode === "dry-run") {
+    console.log(`DRY-RUN station=${result2.stationId} idents=${result2.stats.idents} files=${result2.stats.files} bytes=${result2.stats.bytes}`);
+    console.log(`  cache-root=${result2.cacheRoot} snapshot-sha=${result2.sourceSnapshotSha.slice(0, 12)}`);
+    for (const skill of result2.winners) {
+      const merged = skill.files.length > 1 ? ` (${skill.files.length} files, alternates: ${skill.files.map((file) => file.alternates.length > 0 ? `${file.withinIdent}<-${file.alternates.join(",")}` : null).filter(Boolean).join("; ") || "none"})` : "";
+      console.log(`  ${skill.ident}${merged}`);
+    }
+    return;
+  }
+  console.log(`HYDRATE station=${result2.stationId} idents=${result2.stats.idents} written=${result2.stats.written} unchanged=${result2.stats.unchanged} files=${result2.stats.files} bytes=${result2.stats.bytes}`);
+  console.log(`  manifest=${result2.manifestPath} snapshot-sha=${result2.sourceSnapshotSha}`);
+}
+var init_hydrate = __esm(() => {
+  init_source();
+  init_station_snapshot();
+  init_station_hydrate();
 });
 
 // src/cli/commands/portable-skills.ts
@@ -72021,8 +72772,8 @@ var init_schedule = __esm(() => {
 });
 
 // src/lib/registry-sync.ts
-import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync17 } from "fs";
-import { dirname as dirname11, relative as relative4 } from "path";
+import { mkdirSync as mkdirSync18, writeFileSync as writeFileSync19 } from "fs";
+import { dirname as dirname13, relative as relative5 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
   const includeDocs = options.includeDocs ?? true;
@@ -72034,7 +72785,7 @@ function createRegistrySyncArtifact(options = {}) {
   const registry2 = [...loadRegistryProfile(profile)].sort((a, b) => a.name.localeCompare(b.name));
   const skills = registry2.map((skill) => {
     const skillPath = getSkillPath(skill.name);
-    const directory = relative4(process.cwd(), skillPath) || skillPath;
+    const directory = relative5(process.cwd(), skillPath) || skillPath;
     const validation = includeValidation ? validateSkillDirectory(skill.name, skillPath, skill) : undefined;
     const docs = includeDocs ? buildDocs(skill.name) : undefined;
     return {
@@ -72079,8 +72830,8 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync16(dirname11(path), { recursive: true });
-  writeFileSync17(path, `${JSON.stringify(artifact, null, 2)}
+  mkdirSync18(dirname13(path), { recursive: true });
+  writeFileSync19(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
 function buildDocs(name) {
@@ -72099,7 +72850,7 @@ var init_registry_sync = __esm(() => {
 });
 
 // src/lib/revision.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function revisionIdOf(content) {
   const canonical = JSON.stringify({
     slug: content.slug,
@@ -72114,7 +72865,7 @@ function revisionIdOf(content) {
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
   });
-  return createHash4("sha256").update(canonical).digest("hex");
+  return createHash6("sha256").update(canonical).digest("hex");
 }
 var REVISION_ID_PATTERN;
 var init_revision = __esm(() => {
@@ -72122,9 +72873,9 @@ var init_revision = __esm(() => {
 });
 
 // src/lib/skill-bundle.ts
-import { createHash as createHash5 } from "crypto";
-import { readFileSync as readFileSync22, readdirSync as readdirSync15, statSync as statSync15 } from "fs";
-import { join as join29, relative as relative5 } from "path";
+import { createHash as createHash7 } from "crypto";
+import { readFileSync as readFileSync24, readdirSync as readdirSync17, statSync as statSync18 } from "fs";
+import { join as join31, relative as relative6 } from "path";
 function isDotenvFile(lower) {
   if (lower === ".env" || lower.startsWith(".env."))
     return true;
@@ -72153,7 +72904,7 @@ function ownBytes(view) {
   return out;
 }
 function sha256Hex(bytes) {
-  return createHash5("sha256").update(bytes).digest("hex");
+  return createHash7("sha256").update(bytes).digest("hex");
 }
 function collectSkillBundleEntries(dir) {
   const entries = [];
@@ -72161,9 +72912,9 @@ function collectSkillBundleEntries(dir) {
   return entries.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
 }
 function walk(root, current, out) {
-  for (const entry of readdirSync15(current, { withFileTypes: true })) {
-    const absolute = join29(current, entry.name);
-    const rel = relative5(root, absolute).split("\\").join("/");
+  for (const entry of readdirSync17(current, { withFileTypes: true })) {
+    const absolute = join31(current, entry.name);
+    const rel = relative6(root, absolute).split("\\").join("/");
     const isRootLevel = !rel.includes("/");
     if (ANY_SEGMENT_EXCLUDES.has(entry.name.toLowerCase()))
       continue;
@@ -72183,10 +72934,10 @@ function walk(root, current, out) {
       continue;
     if (isCredentialFile(entry.name))
       continue;
-    const stats = statSync15(absolute);
+    const stats = statSync18(absolute);
     out.push({
       path: rel,
-      bytes: ownBytes(readFileSync22(absolute)),
+      bytes: ownBytes(readFileSync24(absolute)),
       mode: stats.mode & 64 ? 493 : 420
     });
   }
@@ -72472,8 +73223,8 @@ var init_skill_bundles = __esm(() => {
 });
 
 // src/lib/pull.ts
-import { existsSync as existsSync28, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync3, readFileSync as readFileSync23, renameSync as renameSync4, rmSync as rmSync6, writeFileSync as writeFileSync18 } from "fs";
-import { dirname as dirname12, join as join30 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync19, mkdtempSync as mkdtempSync3, readFileSync as readFileSync25, renameSync as renameSync4, rmSync as rmSync6, writeFileSync as writeFileSync20 } from "fs";
+import { dirname as dirname14, join as join32 } from "path";
 async function pullSkills(options = {}) {
   const client = options.client !== undefined ? options.client : createRemoteSkillsClient();
   if (!client) {
@@ -72518,7 +73269,7 @@ async function pullOne(client, rawName, corpusOptions, verify) {
       return reconcileTombstone(slug, corpusOptions);
     }
     if (bundleResponse.status === 404) {
-      const marker = readPullMarker(join30(getPortableSkillsRoot(corpusOptions), slug));
+      const marker = readPullMarker(join32(getPortableSkillsRoot(corpusOptions), slug));
       if (marker && typeof marker.revisionId === "string" && marker.revisionId) {
         return { name: slug, success: true, purged: true, removed: false };
       }
@@ -72549,7 +73300,7 @@ async function pullOne(client, rawName, corpusOptions, verify) {
     return { name: slug, success: false, error: `Skill '${slug}' was not found on the configured Skills instance.` };
   }
   if (!meta?.revisionId) {
-    const marker = readPullMarker(join30(getPortableSkillsRoot(corpusOptions), slug));
+    const marker = readPullMarker(join32(getPortableSkillsRoot(corpusOptions), slug));
     if (marker && typeof marker.revisionId === "string" && marker.revisionId) {
       return { name: slug, success: true, purged: true, removed: false };
     }
@@ -72606,8 +73357,8 @@ function provenRevision(meta, slug, bundle) {
   return declared;
 }
 function reconcileTombstone(slug, corpusOptions) {
-  const target = join30(getPortableSkillsRoot(corpusOptions), slug);
-  if (!existsSync28(join30(target, PULL_MARKER_FILE))) {
+  const target = join32(getPortableSkillsRoot(corpusOptions), slug);
+  if (!existsSync28(join32(target, PULL_MARKER_FILE))) {
     return { name: slug, success: true, tombstoned: true, removed: false, leftInPlace: true };
   }
   rmSync6(target, { recursive: true, force: true });
@@ -72615,7 +73366,7 @@ function reconcileTombstone(slug, corpusOptions) {
 }
 function readPullMarker(dir) {
   try {
-    return JSON.parse(readFileSync23(join30(dir, PULL_MARKER_FILE), "utf-8"));
+    return JSON.parse(readFileSync25(join32(dir, PULL_MARKER_FILE), "utf-8"));
   } catch {
     return null;
   }
@@ -72735,17 +73486,17 @@ function verifyBundleResponseBytes(buffer, response, verify = {}) {
 }
 function installBundleAtomically(name, entries, options = {}, marker = {}) {
   const root = getPortableSkillsRoot(options);
-  mkdirSync17(root, { recursive: true });
-  const target = join30(root, name);
+  mkdirSync19(root, { recursive: true });
+  const target = join32(root, name);
   const created = !existsSync28(target);
-  const staging = mkdtempSync3(join30(root, `.pull-${name}-`));
+  const staging = mkdtempSync3(join32(root, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
     for (const entry of entries) {
-      const destination = join30(staging, entry.path);
-      mkdirSync17(dirname12(destination), { recursive: true });
-      writeFileSync18(destination, entry.bytes, { mode: entry.mode });
+      const destination = join32(staging, entry.path);
+      mkdirSync19(dirname14(destination), { recursive: true });
+      writeFileSync20(destination, entry.bytes, { mode: entry.mode });
     }
     writePullMarker(staging, {
       skill: name,
@@ -72756,8 +73507,8 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       ...marker.revisionId ? { revisionId: marker.revisionId } : {}
     });
     if (existsSync28(target)) {
-      backup = mkdtempSync3(join30(root, `.pull-backup-${name}-`));
-      renameSync4(target, join30(backup, name));
+      backup = mkdtempSync3(join32(root, `.pull-backup-${name}-`));
+      renameSync4(target, join32(backup, name));
       moved = true;
     }
     renameSync4(staging, target);
@@ -72765,9 +73516,9 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       rmSync6(backup, { recursive: true, force: true });
   } catch (error2) {
     rmSync6(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync28(join30(backup, name))) {
+    if (moved && backup && existsSync28(join32(backup, name))) {
       try {
-        renameSync4(join30(backup, name), target);
+        renameSync4(join32(backup, name), target);
       } catch {}
     }
     throw error2;
@@ -72786,7 +73537,7 @@ function writePullMarker(dir, record3) {
     ...record3.revisionId ? { revisionId: record3.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
-  writeFileSync18(join30(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
+  writeFileSync20(join32(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
 `);
 }
 async function safeMeta(client, slug) {
@@ -72860,12 +73611,12 @@ function registerRegistry(parent) {
 async function writeJson2(value, space) {
   const text = `${JSON.stringify(value, null, space)}
 `;
-  await new Promise((resolve, reject2) => {
+  await new Promise((resolve3, reject2) => {
     process.stdout.write(text, (error2) => {
       if (error2)
         reject2(error2);
       else
-        resolve();
+        resolve3();
     });
   });
 }
@@ -72957,8 +73708,8 @@ __export(exports_publish, {
   pushSkill: () => pushSkill,
   PushSkillError: () => PushSkillError
 });
-import { existsSync as existsSync29, readFileSync as readFileSync24 } from "fs";
-import { join as join31 } from "path";
+import { existsSync as existsSync29, readFileSync as readFileSync26 } from "fs";
+import { join as join33 } from "path";
 function registerPublish(parent) {
   parent.command("push").argument("<name>", "Name of a skill in the local corpus (~/.hasna/skills/installed or the migrated ~/.hasna/skills/skills)").option("--version <version>", "Override the version recorded on the instance").option("--dry-run", "Pack and validate without uploading", false).option("--json", "Output result as JSON", false).description("Publish a local skill to the configured skills instance").action(async (name, options) => {
     try {
@@ -72999,8 +73750,8 @@ async function pushSkill(name, options = {}) {
   }
   const manifest = readPortableSkillManifest(skill.path, skill.name);
   const packed = packSkillBundle(skill.path, { maxUnpackedBytes: MAX_UNPACKED_BYTES });
-  const skillMdPath = join31(skill.path, "SKILL.md");
-  const skillMd = existsSync29(skillMdPath) ? readFileSync24(skillMdPath, "utf-8") : undefined;
+  const skillMdPath = join33(skill.path, "SKILL.md");
+  const skillMd = existsSync29(skillMdPath) ? readFileSync26(skillMdPath, "utf-8") : undefined;
   const base2 = {
     slug: skill.name,
     path: skill.path,
@@ -73117,10 +73868,10 @@ __export(exports_auth, {
 import { createInterface as createInterface2 } from "readline";
 function prompt(question) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve(answer.trim());
+      resolve3(answer.trim());
     });
   });
 }
@@ -73270,7 +74021,7 @@ function printWhoami(payload) {
     console.log(source_default.dim("(offline \u2014 showing cached info)"));
 }
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function browserCommand(url) {
   if (process.platform === "darwin")
@@ -73771,11 +74522,11 @@ var init_storage = __esm(() => {
 });
 
 // src/lib/registry-reconcile.ts
-import { existsSync as existsSync30, readFileSync as readFileSync25, statSync as statSync16, writeFileSync as writeFileSync19 } from "fs";
-import { join as join32 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync27, statSync as statSync19, writeFileSync as writeFileSync21 } from "fs";
+import { join as join34 } from "path";
 function isDirectory2(path) {
   try {
-    return statSync16(path).isDirectory();
+    return statSync19(path).isDirectory();
   } catch {
     return false;
   }
@@ -73783,15 +74534,15 @@ function isDirectory2(path) {
 function migrationNeeded(options) {
   if (options.rootDir)
     return false;
-  const appDir = options.homeDir ? join32(options.homeDir, ".hasna", "skills") : getDataDir();
-  return !(isOwnerLayoutMigrated(appDir) && isDirectory2(join32(appDir, SKILLS_CACHE_DIRNAME)));
+  const appDir = options.homeDir ? join34(options.homeDir, ".hasna", "skills") : getDataDir();
+  return !(isOwnerLayoutMigrated(appDir) && isDirectory2(join34(appDir, SKILLS_CACHE_DIRNAME)));
 }
 function readBaseline(skillDir) {
-  const markerPath = join32(skillDir, PULL_MARKER_FILE);
+  const markerPath = join34(skillDir, PULL_MARKER_FILE);
   if (!existsSync30(markerPath))
     return;
   try {
-    const marker = JSON.parse(readFileSync25(markerPath, "utf-8"));
+    const marker = JSON.parse(readFileSync27(markerPath, "utf-8"));
     return {
       ...typeof marker.contentHash === "string" && marker.contentHash ? { contentHash: marker.contentHash } : {},
       ...typeof marker.version === "string" && marker.version ? { version: marker.version } : {}
@@ -73801,11 +74552,11 @@ function readBaseline(skillDir) {
   }
 }
 function readCursor(root) {
-  const path = join32(root, SYNC_CURSOR_FILE);
+  const path = join34(root, SYNC_CURSOR_FILE);
   if (!existsSync30(path))
     return { runCount: 0 };
   try {
-    const cursor = JSON.parse(readFileSync25(path, "utf-8"));
+    const cursor = JSON.parse(readFileSync27(path, "utf-8"));
     return { runCount: typeof cursor.runCount === "number" ? cursor.runCount : 0 };
   } catch {
     return { runCount: 0 };
@@ -73814,12 +74565,12 @@ function readCursor(root) {
 function resolveCorpusRootReadOnly(options) {
   if (options.rootDir)
     return { root: options.rootDir, migrationPending: false };
-  const appDir = options.homeDir ? join32(options.homeDir, ".hasna", "skills") : getDataDirReadOnly();
-  const cache3 = join32(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join34(options.homeDir, ".hasna", "skills") : getDataDirReadOnly();
+  const cache3 = join34(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && isDirectory2(cache3)) {
     return { root: cache3, migrationPending: false };
   }
-  return { root: join32(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
+  return { root: join34(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
 }
 function remoteRowToSkill(record3) {
   const slug = typeof record3.slug === "string" ? record3.slug : typeof record3.name === "string" ? record3.name : undefined;
@@ -73951,7 +74702,7 @@ async function reconcileRegistry(options = {}) {
   for (const slug of allSlugs) {
     const local = locals.get(slug);
     const remote = remotes.get(slug);
-    const baseline = local ? readBaseline(join32(root, slug)) : undefined;
+    const baseline = local ? readBaseline(join34(root, slug)) : undefined;
     const { state, reason } = classifySkill(local, remote, baseline);
     let { action, reason: actionReason } = resolveAction(state, direction, conflict);
     if (state === "remote-only" && isDigestless(remote)) {
@@ -74010,7 +74761,7 @@ async function reconcileRegistry(options = {}) {
       try {
         await pushSkill(slug, { rootDir: root, client });
         const pushed = locals.get(slug);
-        writePullMarker(join32(root, slug), {
+        writePullMarker(join34(root, slug), {
           skill: slug,
           ...pushed?.version ? { version: pushed.version } : {},
           ...pushed?.sha256 ? { contentHash: pushed.sha256 } : {},
@@ -74082,7 +74833,7 @@ async function reconcileRegistry(options = {}) {
         runCount: readCursor(root).runCount + 1,
         summary
       };
-      writeFileSync19(join32(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor, null, 2)}
+      writeFileSync21(join34(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor, null, 2)}
 `);
       return {
         corpusRoot: root,
@@ -81894,6 +82645,8 @@ var { registerCompletion: registerCompletion2 } = await Promise.resolve().then((
 registerCompletion2(program2);
 var { registerCreateSync: registerCreateSync2 } = await Promise.resolve().then(() => (init_create_sync_config(), exports_create_sync_config));
 registerCreateSync2(program2);
+var { registerHydrate: registerHydrate2 } = await Promise.resolve().then(() => (init_hydrate(), exports_hydrate));
+registerHydrate2(program2);
 var { registerPortableSkillCommands: registerPortableSkillCommands2 } = await Promise.resolve().then(() => (init_portable_skills2(), exports_portable_skills));
 registerPortableSkillCommands2(program2);
 var { registerSchedule: registerSchedule2 } = await Promise.resolve().then(() => (init_schedule(), exports_schedule));