@hasna/skills 0.1.69 → 0.1.71

package/dist/index.js

@@ -488,6 +488,14 @@ var DEVELOPMENT_TOOLS_SKILLS = [
     category: "Development Tools",
     tags: ["config", "validation", "schema", "linting"]
   },
+  {
+    name: "oss-app-two-backend-storage",
+    displayName: "OSS App Two-Backend Storage",
+    description: "Recipe for the Hasna two-backend storage contract: client transport + HTTP store, server PG/SQLite backend, pg-migrations + apply script, fail-closed URL-without-key, bun bins, contract manifest, Dockerfile",
+    category: "Development Tools",
+    tags: ["storage", "backend", "postgresql", "sqlite", "two-backend", "oss-app"],
+    kind: "instruction"
+  },
   {
     name: "session-inject-monitor",
     displayName: "Session Inject Monitor",
@@ -10342,7 +10350,7 @@ import { dirname as dirname8, relative as relative3 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.1.69",
+  version: "0.1.71",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -10394,6 +10402,7 @@ var package_default = {
     "dev:mcp": "bun --watch run ./src/mcp/index.ts",
     "dev:server": "bun --watch run ./src/server/index.ts",
     "dev:worker": "bun --watch run ./src/server/worker.ts",
+    "docker:check": "bash scripts/docker-build-check.sh",
     migrate: "bun run ./src/server/migrate.ts",
     typecheck: "tsc --noEmit",
     "verify:release": "bun run scripts/release-guard.ts",
@@ -10426,7 +10435,8 @@ var package_default = {
     "@types/react": "^18.2.0",
     "bun-types": "1.3.14",
     "react-devtools-core": "^7.0.1",
-    typescript: "^5"
+    typescript: "^5",
+    yaml: "^2.9.0"
   },
   dependencies: {
     "@aws-sdk/client-ecs": "^3.1079.0",
@@ -11980,14 +11990,625 @@ function toArrayBuffer(bytes) {
   new Uint8Array(buffer).set(bytes);
   return buffer;
 }
+// src/lib/station-snapshot.ts
+import { createHash as createHash6 } from "crypto";
+import {
+  copyFileSync as copyFileSync2,
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync16,
+  statSync as statSync11,
+  writeFileSync as writeFileSync12
+} from "fs";
+import { dirname as dirname11, isAbsolute as isAbsolute3, relative as relative5, resolve, sep as sep4 } from "path";
+
+// src/lib/portable-snapshot-filter.ts
+import { readdirSync as readdirSync10, statSync as statSync10 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join18, sep as sep3 } from "path";
+var SYNC_HOMES = [
+  { name: "skills", subClass: "skills", agent: null },
+  { name: "custom", subClass: "custom", agent: null },
+  { name: "claude", subClass: "agent-homes", agent: "claude" },
+  { name: "codewith", subClass: "agent-homes", agent: "codewith" },
+  { name: "codex", subClass: "agent-homes", agent: "codex" },
+  { name: "opencode", subClass: "agent-homes", agent: "opencode" },
+  { name: "cursor", subClass: "agent-homes", agent: "cursor" }
+];
+var EXCLUDE_DIR_NAMES = new Set([
+  ".git",
+  "node_modules",
+  "__pycache__",
+  ".cache",
+  ".pytest_cache",
+  ".mypy_cache",
+  ".ruff_cache"
+]);
+var EXCLUDE_DIR_PATTERNS = [
+  /^\.merge-pr\.rollback-/
+];
+var EXCLUDE_FILE_NAMES = new Set([
+  ".DS_Store",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  "Cargo.lock"
+]);
+var EXCLUDE_FILE_PATTERNS = [
+  /^\._/,
+  /\.bak$/,
+  /\.orig$/,
+  /\.rej$/,
+  /~$/,
+  /\.pyc$/,
+  /\.pyo$/,
+  /\.log$/,
+  /\.db$/,
+  /\.sqlite(\d)?$/,
+  /^bun\.lock/,
+  /\.env($|\.)/,
+  /\.pem$/,
+  /\.key$/,
+  /\.p12$/,
+  /\.pfx$/,
+  /\.jks$/,
+  /^id_rsa/,
+  /^id_ed25519/,
+  /^credentials/
+];
+var PORTABLE_TOP_LEVEL = new Set(["SKILL.md", "skill.json"]);
+var PORTABLE_SUBDIRS = new Set(["scripts", "assets", "references"]);
+var REFUSED_SCANNER_FLAGGED = new Set([
+  "aws-cross-account-app-migration/SKILL.md",
+  "aws-cross-account-app-migration/scripts/selftest.sh",
+  "gateway-serve/SKILL.md",
+  "infinity-drain/SKILL.md",
+  "infinity-run/SKILL.md",
+  "oss-saas-code-cleanup/SKILL.md",
+  "repo-project-familiarization/scripts/repo_shape.py",
+  "repo-project-familiarization/scripts/session_history.py",
+  "scale-check/SKILL.md",
+  "standard-align-repo/SKILL.md",
+  "standard-build-iapp/SKILL.md",
+  "standard-build-oss/SKILL.md",
+  "skill-image/SKILL.md",
+  "skill-scale-check/SKILL.md",
+  "sqlite-to-rds-parity-migrate/scripts/parity-migrate.ts",
+  "pdf-operations/scripts/pdf_ops.py"
+]);
+function isExcludedSkillFileName(fileName) {
+  if (EXCLUDE_FILE_NAMES.has(fileName)) {
+    return true;
+  }
+  return EXCLUDE_FILE_PATTERNS.some((pattern) => pattern.test(fileName));
+}
+function isPortableWithinSkill(relativeParts) {
+  if (relativeParts.length < 2) {
+    return false;
+  }
+  const [, second] = relativeParts;
+  if (PORTABLE_TOP_LEVEL.has(second)) {
+    return relativeParts.length === 2;
+  }
+  if (relativeParts.length < 3) {
+    return false;
+  }
+  return PORTABLE_SUBDIRS.has(second);
+}
+function homePathFor(definition, homesRoot) {
+  const home = homesRoot ?? homedir5();
+  if (definition.subClass === "skills" || definition.subClass === "custom") {
+    return join18(home, ".hasna", "skills", definition.name);
+  }
+  if (definition.agent === "opencode") {
+    return join18(home, ".config", "opencode", "skills");
+  }
+  return join18(home, `.${definition.agent}`, "skills");
+}
+function destinationFor(definition, stationId, relativePath) {
+  const category = definition.subClass === "agent-homes" ? join18("agent-homes", definition.agent ?? "") : definition.name;
+  return join18("resources", stationId, "skills", category, ...relativePath.split(sep3));
+}
+function walkEntries(absoluteRoot) {
+  let entries;
+  try {
+    entries = readdirSync10(absoluteRoot, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const output = [];
+  for (const entry of entries) {
+    const childFull = join18(absoluteRoot, entry.name);
+    if (entry.isSymbolicLink()) {
+      output.push({ kind: "symlink", relativePath: entry.name, fullPath: childFull });
+      continue;
+    }
+    if (entry.isDirectory()) {
+      if (EXCLUDE_DIR_NAMES.has(entry.name) || EXCLUDE_DIR_PATTERNS.some((pattern) => pattern.test(entry.name))) {
+        continue;
+      }
+      const nested = walkEntries(childFull);
+      for (const item of nested) {
+        output.push({ ...item, relativePath: join18(entry.name, item.relativePath) });
+      }
+      continue;
+    }
+    if (entry.isFile()) {
+      output.push({ kind: "file", relativePath: entry.name, fullPath: childFull });
+    }
+  }
+  return output;
+}
+function isRegularFile(filePath) {
+  try {
+    return statSync10(filePath).isFile();
+  } catch {
+    return false;
+  }
+}
+
+// src/lib/station-snapshot.ts
+var STATION_SYNC_MANIFEST_SCHEMA = "hasna.fleet-resources.skills-sync-manifest/v1";
+var STATION_SNAPSHOT_PRODUCER = { name: "@hasna/skills", version: package_default.version };
+
+class StationSnapshotError extends Error {
+  code;
+  detail;
+  constructor(code, message, detail = []) {
+    super(message);
+    this.name = "StationSnapshotError";
+    this.code = code;
+    this.detail = detail;
+  }
+}
+function validateStationId(stationId) {
+  if (!/^[a-z0-9-]+$/.test(stationId)) {
+    throw new StationSnapshotError("INVALID_STATION", `station id must be a slug, got: ${stationId}`);
+  }
+}
+function sha256File(filePath) {
+  return createHash6("sha256").update(readFileSync16(filePath)).digest("hex");
+}
+function scanHome(definition, homesRoot) {
+  const homePath = homePathFor(definition, homesRoot);
+  const entries = walkEntries(homePath);
+  const portable = [];
+  const skipped = [];
+  for (const entry of entries) {
+    const relativeParts = entry.relativePath.split(sep4);
+    const fileName = relativeParts[relativeParts.length - 1];
+    if (entry.kind === "symlink") {
+      skipped.push({ relativePath: entry.relativePath, reason: "symlink" });
+      continue;
+    }
+    if (!isPortableWithinSkill(relativeParts)) {
+      skipped.push({ relativePath: entry.relativePath, reason: "not-portable" });
+      continue;
+    }
+    if (isExcludedSkillFileName(fileName)) {
+      skipped.push({ relativePath: entry.relativePath, reason: "excluded" });
+      continue;
+    }
+    if (REFUSED_SCANNER_FLAGGED.has(entry.relativePath)) {
+      skipped.push({ relativePath: entry.relativePath, reason: "refused-scanner-flagged" });
+      continue;
+    }
+    if (!isRegularFile(entry.fullPath)) {
+      skipped.push({ relativePath: entry.relativePath, reason: "not-regular-file" });
+      continue;
+    }
+    const info = statSync11(entry.fullPath);
+    portable.push({
+      relativePath: entry.relativePath,
+      fullPath: entry.fullPath,
+      size: info.size,
+      mtimeMs: info.mtimeMs,
+      mtimeIso: info.mtime.toISOString()
+    });
+  }
+  return { definition, homePath, portable, skipped };
+}
+function planStationSnapshot(options) {
+  validateStationId(options.stationId);
+  const scanned = SYNC_HOMES.map((definition) => scanHome(definition, options.homesRoot));
+  const symlinks = scanned.reduce((sum, item) => sum + item.skipped.filter((entry) => entry.reason === "symlink").length, 0);
+  if (symlinks > 0) {
+    throw new StationSnapshotError("SYMLINKS_REFUSED", `${symlinks} symlink(s) inside skill homes; symlinks are refused (fail closed)`);
+  }
+  const plans = [];
+  for (const item of scanned) {
+    for (const file of item.portable) {
+      plans.push({
+        definition: item.definition,
+        source: file,
+        destination: destinationFor(item.definition, options.stationId, file.relativePath),
+        digest: sha256File(file.fullPath)
+      });
+    }
+  }
+  const totalBytes = plans.reduce((sum, plan) => sum + plan.source.size, 0);
+  return { scanned, plans, totalBytes };
+}
+function humanHomes(scanned) {
+  return scanned.map((item) => ({
+    name: item.definition.name,
+    homePath: item.homePath,
+    files: item.portable.length,
+    skipped: item.skipped.length
+  }));
+}
+function writeStationSnapshot(options) {
+  const repoRoot = resolve(options.repoRoot ?? process.cwd());
+  const { scanned, plans, totalBytes } = planStationSnapshot(options);
+  const manifestFiles = plans.map((plan) => ({
+    relativePath: plan.source.relativePath,
+    destination: plan.destination,
+    subClass: plan.definition.subClass,
+    agent: plan.definition.agent,
+    sha256: plan.digest,
+    sourceMtimeMs: plan.source.mtimeMs,
+    sourceMtimeIso: plan.source.mtimeIso,
+    size: plan.source.size
+  }));
+  const base = {
+    stationId: options.stationId,
+    mode: "dry-run",
+    repoRoot,
+    stats: { files: plans.length, bytes: totalBytes },
+    homes: humanHomes(scanned),
+    files: manifestFiles
+  };
+  if (options.dryRun !== false) {
+    return base;
+  }
+  const conflicts = [];
+  const untouched = [];
+  for (const plan of plans) {
+    const destination = resolve(repoRoot, plan.destination);
+    const destinationRelative = relative5(repoRoot, destination);
+    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep4) || isAbsolute3(destinationRelative)) {
+      throw new StationSnapshotError("DESTINATION_ESCAPE", `destination escapes repo root: ${plan.destination}`);
+    }
+    let existingDigest = null;
+    try {
+      existingDigest = sha256File(destination);
+    } catch {}
+    if (existingDigest !== null) {
+      if (existingDigest === plan.digest) {
+        continue;
+      }
+      conflicts.push(`existing destination differs from staged source: ${plan.destination}`);
+      continue;
+    }
+    untouched.push(plan);
+  }
+  if (conflicts.length > 0) {
+    throw new StationSnapshotError("CONFLICT", `${conflicts.length} conflict(s); terminal non-acceptance, nothing written`, conflicts);
+  }
+  let written = 0;
+  for (const plan of untouched) {
+    const destination = resolve(repoRoot, plan.destination);
+    mkdirSync13(dirname11(destination), { recursive: true });
+    copyFileSync2(plan.source.fullPath, destination);
+    written += 1;
+  }
+  const unchanged = plans.length - untouched.length;
+  const manifest = {
+    schema: STATION_SYNC_MANIFEST_SCHEMA,
+    stationId: options.stationId,
+    syncedAt: new Date().toISOString(),
+    producer: STATION_SNAPSHOT_PRODUCER,
+    stats: {
+      written,
+      unchanged,
+      files: plans.length,
+      bytes: totalBytes
+    },
+    files: manifestFiles
+  };
+  const manifestPath = resolve(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
+  mkdirSync13(dirname11(manifestPath), { recursive: true });
+  writeFileSync12(manifestPath, `${JSON.stringify(manifest, null, 2)}
+`);
+  return {
+    ...base,
+    mode: "populate",
+    stats: { files: plans.length, bytes: totalBytes, written, unchanged },
+    manifestPath
+  };
+}
+// src/lib/station-hydrate.ts
+import { createHash as createHash7 } from "crypto";
+import {
+  copyFileSync as copyFileSync3,
+  mkdirSync as mkdirSync14,
+  readdirSync as readdirSync11,
+  readFileSync as readFileSync17,
+  statSync as statSync12,
+  writeFileSync as writeFileSync13
+} from "fs";
+import { dirname as dirname12, join as join19, resolve as resolve2, sep as sep5 } from "path";
+var STATION_HYDRATION_MANIFEST_SCHEMA = "hasna.fleet-resources.skills-hydration-manifest/v1";
+var STATION_HYDRATION_PRODUCER = { name: "@hasna/skills", version: package_default.version };
+var MANIFEST_HASH_KEY_SEP = String.fromCharCode(0);
+function fail(code, message, detail = []) {
+  throw new StationSnapshotError(code, message, detail);
+}
+function snapshotRootFor(repoRoot, stationId) {
+  return join19(repoRoot, "resources", stationId, "skills");
+}
+function readSnapshotManifest(repoRoot, stationId) {
+  const snapshotRoot = snapshotRootFor(repoRoot, stationId);
+  const manifestPath = join19(snapshotRoot, "sync-manifest.json");
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync17(manifestPath, "utf8"));
+  } catch (error) {
+    fail("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error.message}`);
+  }
+  const sourceSnapshotSha = sha256File(manifestPath);
+  return { manifest, manifestPath, sourceSnapshotSha };
+}
+function planStationHydration(stationId, repoRoot) {
+  validateStationId(stationId);
+  const { manifest, sourceSnapshotSha } = readSnapshotManifest(repoRoot, stationId);
+  const snapshotRoot = snapshotRootFor(repoRoot, stationId);
+  const manifestHashes = new Map;
+  for (const file of manifest.files ?? []) {
+    const relativePath = file.relativePath;
+    const agent = file.agent;
+    if (agent && relativePath) {
+      manifestHashes.set(`${agent}${MANIFEST_HASH_KEY_SEP}${relativePath}`, file.sha256);
+    }
+  }
+  const candidates = [];
+  const symlinks = [];
+  const skippedByRule = [];
+  for (const agent of SYNC_AGENTS) {
+    const agentRoot = join19(snapshotRoot, "agent-homes", agent);
+    let identEntries;
+    try {
+      identEntries = readdirSync11(agentRoot, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const identEntry of identEntries) {
+      if (!identEntry.isDirectory() || identEntry.name.startsWith(".")) {
+        continue;
+      }
+      const identRoot = join19(agentRoot, identEntry.name);
+      const entries = walkEntries(identRoot);
+      for (const entry of entries) {
+        const relativeParts = [identEntry.name, ...entry.relativePath.split(sep5)];
+        if (entry.kind === "symlink") {
+          symlinks.push({ ident: identEntry.name, agent, relativePath: entry.relativePath });
+          continue;
+        }
+        if (!isPortableWithinSkill(relativeParts)) {
+          skippedByRule.push({
+            ident: identEntry.name,
+            agent,
+            relativePath: entry.relativePath,
+            reason: "not-portable"
+          });
+          continue;
+        }
+        const fileName = relativeParts[relativeParts.length - 1];
+        if (isExcludedSkillFileName(fileName)) {
+          skippedByRule.push({
+            ident: identEntry.name,
+            agent,
+            relativePath: entry.relativePath,
+            reason: "excluded"
+          });
+          continue;
+        }
+        const withinIdent = relativeParts.slice(1).join(sep5);
+        const homeRelative = relativeParts.join(sep5);
+        if (REFUSED_SCANNER_FLAGGED.has(homeRelative)) {
+          skippedByRule.push({
+            ident: identEntry.name,
+            agent,
+            relativePath: entry.relativePath,
+            reason: "refused-scanner-flagged"
+          });
+          continue;
+        }
+        if (!isRegularFile(entry.fullPath)) {
+          skippedByRule.push({
+            ident: identEntry.name,
+            agent,
+            relativePath: entry.relativePath,
+            reason: "not-regular-file"
+          });
+          continue;
+        }
+        const info = statSync12(entry.fullPath);
+        candidates.push({
+          ident: identEntry.name,
+          agent,
+          withinIdent,
+          fullPath: entry.fullPath,
+          size: info.size,
+          mtimeMs: info.mtimeMs,
+          manifestHash: manifestHashes.get(`${agent}${MANIFEST_HASH_KEY_SEP}${homeRelative}`) ?? null
+        });
+      }
+    }
+  }
+  if (symlinks.length > 0) {
+    fail("SYMLINKS_REFUSED", `${symlinks.length} symlink(s) inside the snapshot; symlinks are refused (fail closed)`);
+  }
+  const byIdent = new Map;
+  for (const candidate of candidates) {
+    const group = byIdent.get(candidate.ident) ?? [];
+    group.push(candidate);
+    byIdent.set(candidate.ident, group);
+  }
+  const winners = [];
+  for (const [ident, group] of byIdent) {
+    const byFile = new Map;
+    for (const candidate of group) {
+      const copies = byFile.get(candidate.withinIdent) ?? [];
+      copies.push(candidate);
+      byFile.set(candidate.withinIdent, copies);
+    }
+    const files = [];
+    for (const [withinIdent, copies] of byFile) {
+      let eligible = copies;
+      if (withinIdent === "SKILL.md") {
+        const content = [];
+        for (const copy of copies) {
+          let isStub = false;
+          try {
+            isStub = isPointerSkillMd(readFileSync17(copy.fullPath, "utf8"));
+          } catch {
+            isStub = false;
+          }
+          if (!isStub)
+            content.push(copy);
+        }
+        if (content.length > 0) {
+          eligible = content;
+        }
+      }
+      eligible.sort((left, right) => {
+        const leftHash = left.manifestHash !== null;
+        const rightHash = right.manifestHash !== null;
+        if (leftHash !== rightHash) {
+          return leftHash ? -1 : 1;
+        }
+        if (right.mtimeMs !== left.mtimeMs) {
+          return right.mtimeMs - left.mtimeMs;
+        }
+        return SYNC_AGENTS.indexOf(left.agent) - SYNC_AGENTS.indexOf(right.agent);
+      });
+      const winner = eligible[0];
+      files.push({
+        withinIdent,
+        winner,
+        alternates: copies.filter((copy) => copy !== winner).map((copy) => copy.agent)
+      });
+    }
+    files.sort((left, right) => left.withinIdent.localeCompare(right.withinIdent));
+    winners.push({ ident, files });
+  }
+  winners.sort((left, right) => left.ident.localeCompare(right.ident));
+  const totalFiles = winners.reduce((sum, skill) => sum + skill.files.length, 0);
+  const totalBytes = winners.reduce((sum, skill) => sum + skill.files.reduce((inner, file) => inner + file.winner.size, 0), 0);
+  return { manifest, sourceSnapshotSha, winners, skippedByRule, totalFiles, totalBytes };
+}
+function skillSha256(skill) {
+  const skillMd = skill.files.find((file) => file.withinIdent === "SKILL.md");
+  if (skillMd) {
+    return sha256File(skillMd.winner.fullPath);
+  }
+  if (skill.files.length === 1) {
+    return sha256File(skill.files[0].winner.fullPath);
+  }
+  const joined = skill.files.map((file) => sha256File(file.winner.fullPath));
+  return createHash7("sha256").update(joined.sort().join(`
+`)).digest("hex");
+}
+function writeStationHydration(options) {
+  const repoRoot = resolve2(options.repoRoot ?? process.cwd());
+  const cacheRoot = resolve2(options.cacheRoot ?? resolveCorpusRoot());
+  const plan = planStationHydration(options.stationId, repoRoot);
+  const resultSkills = plan.winners.map((skill) => ({
+    ident: skill.ident,
+    files: skill.files.map((file) => ({
+      relativePath: file.withinIdent,
+      sourceAgent: file.winner.agent,
+      sourceMtimeMs: file.winner.mtimeMs,
+      size: file.winner.size
+    })),
+    sha256: skillSha256(skill)
+  }));
+  const base = {
+    stationId: options.stationId,
+    mode: "dry-run",
+    cacheRoot,
+    snapshotRoot: snapshotRootFor(repoRoot, options.stationId),
+    sourceSnapshotSha: plan.sourceSnapshotSha,
+    stats: {
+      idents: plan.winners.length,
+      files: plan.totalFiles,
+      bytes: plan.totalBytes
+    },
+    winners: plan.winners,
+    skills: resultSkills
+  };
+  if (options.dryRun !== false) {
+    return base;
+  }
+  const conflicts = [];
+  const toWrite = [];
+  for (const skill of plan.winners) {
+    for (const file of skill.files) {
+      const destination = join19(cacheRoot, skill.ident, file.withinIdent);
+      const digest = sha256File(file.winner.fullPath);
+      let existingDigest = null;
+      try {
+        existingDigest = sha256File(destination);
+      } catch {}
+      if (existingDigest !== null) {
+        if (existingDigest === digest) {
+          continue;
+        }
+        conflicts.push(`existing destination differs from snapshot winner: ${destination}`);
+        continue;
+      }
+      toWrite.push({ destination, fullPath: file.winner.fullPath });
+    }
+  }
+  if (conflicts.length > 0) {
+    fail("CONFLICT", `${conflicts.length} conflict(s); terminal non-acceptance, nothing written`, conflicts);
+  }
+  let written = 0;
+  for (const entry of toWrite) {
+    mkdirSync14(dirname12(entry.destination), { recursive: true });
+    copyFileSync3(entry.fullPath, entry.destination);
+    written += 1;
+  }
+  const unchanged = plan.totalFiles - written;
+  const hydration = {
+    schema: STATION_HYDRATION_MANIFEST_SCHEMA,
+    stationId: options.stationId,
+    hydratedAt: new Date().toISOString(),
+    producer: STATION_HYDRATION_PRODUCER,
+    sourceSnapshotSha: plan.sourceSnapshotSha,
+    cacheRoot,
+    stats: {
+      idents: plan.winners.length,
+      written,
+      unchanged,
+      files: plan.totalFiles,
+      bytes: plan.totalBytes
+    },
+    skills: resultSkills
+  };
+  const hydrationManifestPath = join19(dirname12(cacheRoot), `hydration-${options.stationId}.json`);
+  mkdirSync14(dirname12(hydrationManifestPath), { recursive: true });
+  writeFileSync13(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
+`);
+  return {
+    ...base,
+    mode: "apply",
+    stats: { ...base.stats, written, unchanged },
+    manifestPath: hydrationManifestPath
+  };
+}
 export {
+  writeStationSnapshot,
+  writeStationHydration,
   writeRunLogs,
   writeRegistrySyncArtifact,
   writeManagedSkillDir,
   writeManagedAgentSkill,
   writeCorpusSkill,
+  walkEntries,
   verifyContentHash,
   validateToolPrimitiveCoverage,
+  validateStationId,
   validateSkillsCliMcpParity,
   validateSkillDirectory,
   validateRegistryConsistency,
@@ -12006,6 +12627,7 @@ export {
   skillsPostgresSyncSchemaSql,
   skillExists,
   signSkillsAwsV4Request,
+  sha256File,
   setSkillDisabled,
   setScheduleEnabled,
   searchSkills,
@@ -12033,6 +12655,8 @@ export {
   portPortableSkillDirectory,
   portPortableSkill,
   pointerSkillMd,
+  planStationSnapshot,
+  planStationHydration,
   planSkillsS3SnapshotUpload,
   pinSkill,
   pinProjectSkill,
@@ -12058,7 +12682,10 @@ export {
   listPinnedSkills,
   listMcpToolContracts,
   isSyncAgent,
+  isRegularFile,
+  isPortableWithinSkill,
   isGatewayBackedSkill,
+  isExcludedSkillFileName,
   isBasicSkillName,
   installSkills,
   installSkillSource,
@@ -12066,6 +12693,7 @@ export {
   installSkillForAgent,
   installSkill,
   importSkillsLocalSnapshot,
+  homePathFor,
   getToolPrimitive,
   getStorageStatus,
   getStorageDatabaseUrl,
@@ -12115,6 +12743,7 @@ export {
   ensureProjectConfig,
   enableSkill,
   disableSkill,
+  destinationFor,
   describeMcpToolContracts,
   createSkillsSnapshotSyncRecord,
   createSkillsS3ObjectStore,
@@ -12138,12 +12767,16 @@ export {
   adaptSkillMdForAgent,
   TOOL_PRIMITIVE_SCHEMA_VERSION,
   TOOL_PRIMITIVES,
+  StationSnapshotError,
   SkillsS3ObjectStore,
   SkillsPostgresSyncStore,
   SYNC_MARKER_MANAGED_BY,
   SYNC_MARKER_FILE,
+  SYNC_HOMES,
   SYNC_AGENTS,
   STORAGE_TABLES,
+  STATION_SYNC_MANIFEST_SCHEMA,
+  STATION_HYDRATION_MANIFEST_SCHEMA,
   SKILL_SYSTEM_DEPS_ALLOWLIST,
   SKILL_SANDBOX_MODES,
   SKILL_RUNTIMES,
@@ -12160,6 +12793,7 @@ export {
   RemoteRouteUnsupportedError,
   RemoteRequestError,
   REMOTE_SKILL_RUN_CONTRACT_VERSION,
+  REFUSED_SCANNER_FLAGGED,
   PullSkillError,
   PROJECT_CONFIG_FILE,
   PORTABLE_SKILL_STANDARD,