@hasna/instructions 0.3.0

package/dist/index.js

@@ -0,0 +1,3749 @@
+// @bun
+// src/types/index.ts
+var CONFIG_KINDS = ["file", "reference"];
+var CONFIG_CATEGORIES = [
+  "agent",
+  "rules",
+  "mcp",
+  "shell",
+  "secrets_schema",
+  "workspace",
+  "git",
+  "tools"
+];
+var CONFIG_AGENTS = [
+  "claude",
+  "codex",
+  "gemini",
+  "opencode",
+  "cursor",
+  "codewith",
+  "aicopilot",
+  "zsh",
+  "git",
+  "npm",
+  "global"
+];
+var CONFIG_TRANSFORMS = [
+  "passthrough",
+  "claude-passthrough",
+  "codex-flat",
+  "opencode-flat",
+  "cursor-mdc",
+  "skill-neutral"
+];
+var CONFIG_FORMATS = [
+  "text",
+  "json",
+  "toml",
+  "yaml",
+  "markdown",
+  "ini"
+];
+
+class ConfigNotFoundError extends Error {
+  constructor(id) {
+    super(`Config not found: ${id}`);
+    this.name = "ConfigNotFoundError";
+  }
+}
+
+class ProfileNotFoundError extends Error {
+  constructor(id) {
+    super(`Profile not found: ${id}`);
+    this.name = "ProfileNotFoundError";
+  }
+}
+
+class ConfigApplyError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigApplyError";
+  }
+}
+
+class TemplateRenderError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TemplateRenderError";
+  }
+}
+// src/db/database.ts
+import { Database } from "bun:sqlite";
+import { cpSync, existsSync, mkdirSync, statSync } from "fs";
+import { join } from "path";
+import { randomUUID } from "crypto";
+function getDbPath() {
+  if (process.env["HASNA_CONFIGS_DB_PATH"]) {
+    return process.env["HASNA_CONFIGS_DB_PATH"];
+  }
+  if (process.env["CONFIGS_DB_PATH"]) {
+    return process.env["CONFIGS_DB_PATH"];
+  }
+  migrateDotfile();
+  const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
+  const dir = join(home, ".hasna", "configs");
+  mkdirSync(dir, { recursive: true });
+  return join(dir, "configs.db");
+}
+function uuid() {
+  return randomUUID();
+}
+function now() {
+  return new Date().toISOString();
+}
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+var MIGRATIONS = [
+  `
+  CREATE TABLE IF NOT EXISTS configs (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    slug TEXT NOT NULL UNIQUE,
+    kind TEXT NOT NULL DEFAULT 'file',
+    category TEXT NOT NULL,
+    agent TEXT NOT NULL DEFAULT 'global',
+    target_path TEXT,
+    format TEXT NOT NULL DEFAULT 'text',
+    content TEXT NOT NULL DEFAULT '',
+    description TEXT,
+    tags TEXT NOT NULL DEFAULT '[]',
+    is_template INTEGER NOT NULL DEFAULT 0,
+    version INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    synced_at TEXT
+  );
+
+  CREATE TABLE IF NOT EXISTS config_snapshots (
+    id TEXT PRIMARY KEY,
+    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
+    content TEXT NOT NULL,
+    version INTEGER NOT NULL,
+    created_at TEXT NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS profiles (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    slug TEXT NOT NULL UNIQUE,
+    description TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS profile_configs (
+    profile_id TEXT NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
+    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
+    sort_order INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (profile_id, config_id)
+  );
+
+  CREATE TABLE IF NOT EXISTS machines (
+    id TEXT PRIMARY KEY,
+    hostname TEXT NOT NULL UNIQUE,
+    os TEXT,
+    last_applied_at TEXT,
+    created_at TEXT NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS schema_version (
+    version INTEGER PRIMARY KEY
+  );
+
+  INSERT OR IGNORE INTO schema_version (version) VALUES (1);
+  `,
+  `
+  ALTER TABLE profiles ADD COLUMN selectors TEXT NOT NULL DEFAULT '{}';
+  ALTER TABLE profiles ADD COLUMN variables TEXT NOT NULL DEFAULT '{}';
+  ALTER TABLE machines ADD COLUMN arch TEXT;
+  `,
+  `
+  ALTER TABLE configs ADD COLUMN outputs TEXT NOT NULL DEFAULT '[]';
+  `
+];
+var _db = null;
+function getDatabase(path) {
+  if (_db)
+    return _db;
+  const dbPath = path || getDbPath();
+  const db = new Database(dbPath);
+  db.run("PRAGMA journal_mode = WAL");
+  db.run("PRAGMA foreign_keys = ON");
+  applyMigrations(db);
+  ensureFeedbackTable(db);
+  _db = db;
+  return db;
+}
+function resetDatabase() {
+  if (_db) {
+    try {
+      _db.close();
+    } catch {}
+  }
+  _db = null;
+}
+function applyMigrations(db) {
+  let currentVersion = 0;
+  try {
+    const row = db.query("SELECT version FROM schema_version ORDER BY version DESC LIMIT 1").get();
+    currentVersion = row?.version ?? 0;
+  } catch {
+    currentVersion = 0;
+  }
+  for (let i = currentVersion;i < MIGRATIONS.length; i++) {
+    db.exec(MIGRATIONS[i]);
+    db.run(`INSERT OR REPLACE INTO schema_version (version) VALUES (${i + 1})`);
+  }
+}
+function ensureFeedbackTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS feedback (
+      id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+      message TEXT NOT NULL,
+      email TEXT,
+      category TEXT DEFAULT 'general',
+      version TEXT,
+      machine_id TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    )
+  `);
+}
+function migrateDotfile() {
+  const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
+  const oldDirs = [join(home, ".open-configs"), join(home, ".configs")];
+  const newDir = join(home, ".hasna", "configs");
+  if (existsSync(newDir))
+    return;
+  for (const oldDir of oldDirs) {
+    if (!existsSync(oldDir))
+      continue;
+    try {
+      if (!statSync(oldDir).isDirectory())
+        continue;
+      mkdirSync(join(home, ".hasna"), { recursive: true });
+      cpSync(oldDir, newDir, { recursive: true, force: false });
+      return;
+    } catch {}
+  }
+}
+
+// src/db/configs.ts
+function rowToConfig(row) {
+  let outputs = [];
+  try {
+    const parsed = JSON.parse(row.outputs || "[]");
+    outputs = Array.isArray(parsed) ? parsed : [];
+  } catch {
+    outputs = [];
+  }
+  return {
+    ...row,
+    tags: JSON.parse(row.tags || "[]"),
+    outputs,
+    is_template: !!row.is_template,
+    kind: row.kind,
+    category: row.category,
+    agent: row.agent,
+    format: row.format
+  };
+}
+function uniqueSlug(name, db, excludeId) {
+  const base = slugify(name);
+  let slug = base;
+  let i = 1;
+  while (true) {
+    const existing = db.query("SELECT id FROM configs WHERE slug = ?").get(slug);
+    if (!existing || existing.id === excludeId)
+      return slug;
+    slug = `${base}-${i++}`;
+  }
+}
+function createConfig(input, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  const ts = now();
+  const slug = uniqueSlug(input.name, d);
+  const tags = JSON.stringify(input.tags || []);
+  const outputs = JSON.stringify(input.outputs || []);
+  d.run(`INSERT INTO configs (id, name, slug, kind, category, agent, target_path, outputs, format, content, description, tags, is_template, version, created_at, updated_at, synced_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?, ?, NULL)`, [
+    id,
+    input.name,
+    slug,
+    input.kind ?? "file",
+    input.category,
+    input.agent ?? "global",
+    input.target_path ?? null,
+    outputs,
+    input.format ?? "text",
+    input.content,
+    input.description ?? null,
+    tags,
+    input.is_template ? 1 : 0,
+    ts,
+    ts
+  ]);
+  return getConfig(id, d);
+}
+function getConfig(idOrSlug, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT * FROM configs WHERE id = ? OR slug = ?").get(idOrSlug, idOrSlug);
+  if (!row)
+    throw new ConfigNotFoundError(idOrSlug);
+  return rowToConfig(row);
+}
+function getConfigById(id, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT * FROM configs WHERE id = ?").get(id);
+  if (!row)
+    throw new ConfigNotFoundError(id);
+  return rowToConfig(row);
+}
+function listConfigs(filter, db) {
+  const d = db || getDatabase();
+  const conditions = [];
+  const params = [];
+  if (filter?.category) {
+    conditions.push("category = ?");
+    params.push(filter.category);
+  }
+  if (filter?.agent) {
+    conditions.push("agent = ?");
+    params.push(filter.agent);
+  }
+  if (filter?.kind) {
+    conditions.push("kind = ?");
+    params.push(filter.kind);
+  }
+  if (filter?.is_template !== undefined) {
+    conditions.push("is_template = ?");
+    params.push(filter.is_template ? 1 : 0);
+  }
+  if (filter?.search) {
+    conditions.push("(name LIKE ? OR description LIKE ? OR content LIKE ?)");
+    const q = `%${filter.search}%`;
+    params.push(q, q, q);
+  }
+  if (filter?.tags && filter.tags.length > 0) {
+    const tagConditions = filter.tags.map(() => "tags LIKE ?").join(" OR ");
+    conditions.push(`(${tagConditions})`);
+    for (const tag of filter.tags)
+      params.push(`%"${tag}"%`);
+  }
+  const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+  const rows = d.query(`SELECT * FROM configs ${where} ORDER BY category, name`).all(...params);
+  return rows.map(rowToConfig);
+}
+function updateConfig(idOrSlug, input, db) {
+  const d = db || getDatabase();
+  const existing = getConfig(idOrSlug, d);
+  const ts = now();
+  const updates = ["updated_at = ?", "version = version + 1"];
+  const params = [ts];
+  if (input.name !== undefined) {
+    updates.push("name = ?", "slug = ?");
+    params.push(input.name, uniqueSlug(input.name, d, existing.id));
+  }
+  if (input.kind !== undefined) {
+    updates.push("kind = ?");
+    params.push(input.kind);
+  }
+  if (input.category !== undefined) {
+    updates.push("category = ?");
+    params.push(input.category);
+  }
+  if (input.agent !== undefined) {
+    updates.push("agent = ?");
+    params.push(input.agent);
+  }
+  if (input.target_path !== undefined) {
+    updates.push("target_path = ?");
+    params.push(input.target_path);
+  }
+  if (input.outputs !== undefined) {
+    updates.push("outputs = ?");
+    params.push(JSON.stringify(input.outputs));
+  }
+  if (input.format !== undefined) {
+    updates.push("format = ?");
+    params.push(input.format);
+  }
+  if (input.content !== undefined) {
+    updates.push("content = ?");
+    params.push(input.content);
+  }
+  if (input.description !== undefined) {
+    updates.push("description = ?");
+    params.push(input.description);
+  }
+  if (input.tags !== undefined) {
+    updates.push("tags = ?");
+    params.push(JSON.stringify(input.tags));
+  }
+  if (input.is_template !== undefined) {
+    updates.push("is_template = ?");
+    params.push(input.is_template ? 1 : 0);
+  }
+  if (input.synced_at !== undefined) {
+    updates.push("synced_at = ?");
+    params.push(input.synced_at);
+  }
+  params.push(existing.id);
+  d.run(`UPDATE configs SET ${updates.join(", ")} WHERE id = ?`, params);
+  return getConfigById(existing.id, d);
+}
+function deleteConfig(idOrSlug, db) {
+  const d = db || getDatabase();
+  const existing = getConfig(idOrSlug, d);
+  d.run("DELETE FROM configs WHERE id = ?", [existing.id]);
+}
+function getConfigStats(db) {
+  const d = db || getDatabase();
+  const rows = d.query("SELECT category, COUNT(*) as count FROM configs GROUP BY category").all();
+  const stats = { total: 0 };
+  for (const row of rows) {
+    stats[row.category] = row.count;
+    stats["total"] = (stats["total"] || 0) + row.count;
+  }
+  return stats;
+}
+// src/db/snapshots.ts
+function createSnapshot(configId, content, version, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  const ts = now();
+  d.run("INSERT INTO config_snapshots (id, config_id, content, version, created_at) VALUES (?, ?, ?, ?, ?)", [id, configId, content, version, ts]);
+  return { id, config_id: configId, content, version, created_at: ts };
+}
+function listSnapshots(configId, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? ORDER BY version DESC").all(configId);
+}
+function getSnapshot(id, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE id = ?").get(id);
+}
+function getSnapshotByVersion(configId, version, db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM config_snapshots WHERE config_id = ? AND version = ?").get(configId, version);
+}
+function pruneSnapshots(configId, keep = 10, db) {
+  const d = db || getDatabase();
+  const result = d.run(`DELETE FROM config_snapshots WHERE config_id = ? AND id NOT IN (
+      SELECT id FROM config_snapshots WHERE config_id = ? ORDER BY version DESC LIMIT ?
+    )`, [configId, configId, keep]);
+  return result.changes;
+}
+// src/lib/machine.ts
+import { arch as currentArch, homedir, hostname as currentHostname, type as currentOsType } from "os";
+import { existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+
+// src/lib/template.ts
+var VAR_PATTERN = /\{\{([A-Z0-9_]+)(?::([^}]*))?\}\}/g;
+function parseTemplateVars(content) {
+  const names = new Set;
+  let match;
+  VAR_PATTERN.lastIndex = 0;
+  while ((match = VAR_PATTERN.exec(content)) !== null) {
+    names.add(match[1]);
+  }
+  return Array.from(names);
+}
+function extractTemplateVars(content) {
+  const vars = new Map;
+  let match;
+  VAR_PATTERN.lastIndex = 0;
+  while ((match = VAR_PATTERN.exec(content)) !== null) {
+    const name = match[1];
+    const description = match[2] ?? null;
+    if (!vars.has(name)) {
+      vars.set(name, { name, description, required: true });
+    }
+  }
+  return Array.from(vars.values());
+}
+function renderTemplate(content, vars) {
+  const missing = [];
+  VAR_PATTERN.lastIndex = 0;
+  let match;
+  while ((match = VAR_PATTERN.exec(content)) !== null) {
+    const name = match[1];
+    if (!(name in vars))
+      missing.push(name);
+  }
+  if (missing.length > 0) {
+    throw new TemplateRenderError(`Missing required template variables: ${missing.join(", ")}`);
+  }
+  VAR_PATTERN.lastIndex = 0;
+  return content.replace(VAR_PATTERN, (_match, name) => vars[name] ?? "");
+}
+function isTemplate(content) {
+  VAR_PATTERN.lastIndex = 0;
+  return VAR_PATTERN.test(content);
+}
+
+// src/lib/machine.ts
+var BREW_BUN_PATH = "/opt/homebrew/bin/bun";
+function normalizeOsFamily(os) {
+  const value = (os ?? "").trim().toLowerCase();
+  if (value === "darwin" || value === "macos" || value === "mac" || value === "osx")
+    return "macos";
+  if (value === "linux")
+    return "linux";
+  if (value === "windows_nt" || value === "windows" || value === "win32")
+    return "windows";
+  return value || "unknown";
+}
+function detectMachineContext(overrides = {}) {
+  const homeDir = overrides.home_dir ?? process.env["CONFIGS_HOME"] ?? process.env["HOME"] ?? homedir();
+  const os = overrides.os ?? currentOsType();
+  const osFamily = normalizeOsFamily(os);
+  const bunBinDir = overrides.bun_bin_dir ?? join2(homeDir, ".bun", "bin");
+  const defaultBunPath = osFamily === "macos" && existsSync2(BREW_BUN_PATH) ? BREW_BUN_PATH : join2(bunBinDir, "bun");
+  return {
+    id: "current-machine",
+    hostname: overrides.hostname ?? currentHostname(),
+    os,
+    arch: overrides.arch ?? currentArch(),
+    last_applied_at: null,
+    created_at: "",
+    os_family: osFamily,
+    home_dir: homeDir,
+    workspace_root: overrides.workspace_root ?? join2(homeDir, osFamily === "macos" ? "Workspace" : "workspace"),
+    bun_bin_dir: bunBinDir,
+    bun_path: overrides.bun_path ?? defaultBunPath,
+    path_prefix: overrides.path_prefix ?? (osFamily === "macos" ? `${join2("/opt", "homebrew", "bin")}:${bunBinDir}` : bunBinDir)
+  };
+}
+function machineContextToVariables(machine) {
+  return {
+    HOSTNAME: machine.hostname,
+    OS: machine.os ?? "",
+    OS_FAMILY: machine.os_family,
+    ARCH: machine.arch ?? "",
+    HOME_DIR: machine.home_dir,
+    WORKSPACE_ROOT: machine.workspace_root,
+    BUN_BIN_DIR: machine.bun_bin_dir,
+    BUN_PATH: machine.bun_path,
+    PATH_PREFIX: machine.path_prefix
+  };
+}
+function resolveProfileVariables(profile, machine) {
+  const base = machineContextToVariables(machine);
+  const raw = profile?.variables ?? {};
+  const resolved = { ...base };
+  const pending = new Map(Object.entries(raw));
+  const maxPasses = Math.max(4, pending.size * 2);
+  for (let pass = 0;pass < maxPasses && pending.size > 0; pass++) {
+    let progress = false;
+    for (const [key, value] of [...pending.entries()]) {
+      try {
+        resolved[key] = isTemplate(value) ? renderTemplate(value, resolved) : value;
+        pending.delete(key);
+        progress = true;
+      } catch {}
+    }
+    if (!progress)
+      break;
+  }
+  for (const [key, value] of pending.entries()) {
+    resolved[key] = value;
+  }
+  return resolved;
+}
+function replaceKnownPath(content, actual, placeholder) {
+  if (!actual || actual === placeholder)
+    return content;
+  return content.split(actual).join(placeholder);
+}
+function templateizeMachineContent(content, machine) {
+  const vars = machineContextToVariables(machine);
+  let next = content;
+  const replacements = [
+    [vars["WORKSPACE_ROOT"], "{{WORKSPACE_ROOT}}"],
+    [vars["BUN_PATH"], "{{BUN_PATH}}"],
+    [vars["BUN_BIN_DIR"], "{{BUN_BIN_DIR}}"],
+    [vars["PATH_PREFIX"], "{{PATH_PREFIX}}"],
+    [vars["HOME_DIR"], "{{HOME_DIR}}"]
+  ];
+  for (const [actual, placeholder] of replacements) {
+    next = replaceKnownPath(next, actual, placeholder);
+  }
+  next = next.replace(/~\/workspace/g, "{{WORKSPACE_ROOT}}").replace(/~\/Workspace/g, "{{WORKSPACE_ROOT}}").replace(/\/opt\/homebrew\/bin\/bun/g, "{{BUN_PATH}}");
+  return { content: next, changed: next !== content };
+}
+function renderMachineAwareContent(content, variables) {
+  return isTemplate(content) ? renderTemplate(content, variables) : content;
+}
+
+// src/db/profiles.ts
+function rowToProfile(row) {
+  return {
+    ...row,
+    selectors: JSON.parse(row.selectors || "{}"),
+    variables: JSON.parse(row.variables || "{}")
+  };
+}
+function uniqueProfileSlug(name, db, excludeId) {
+  const base = slugify(name);
+  let slug = base;
+  let i = 1;
+  while (true) {
+    const existing = db.query("SELECT id FROM profiles WHERE slug = ?").get(slug);
+    if (!existing || existing.id === excludeId)
+      return slug;
+    slug = `${base}-${i++}`;
+  }
+}
+function createProfile(input, db) {
+  const d = db || getDatabase();
+  const id = uuid();
+  const ts = now();
+  const slug = uniqueProfileSlug(input.name, d);
+  d.run("INSERT INTO profiles (id, name, slug, description, selectors, variables, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)", [
+    id,
+    input.name,
+    slug,
+    input.description ?? null,
+    JSON.stringify(input.selectors ?? {}),
+    JSON.stringify(input.variables ?? {}),
+    ts,
+    ts
+  ]);
+  return getProfile(id, d);
+}
+function getProfile(idOrSlug, db) {
+  const d = db || getDatabase();
+  const row = d.query("SELECT * FROM profiles WHERE id = ? OR slug = ?").get(idOrSlug, idOrSlug);
+  if (!row)
+    throw new ProfileNotFoundError(idOrSlug);
+  return rowToProfile(row);
+}
+function listProfiles(db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM profiles ORDER BY name").all().map(rowToProfile);
+}
+function updateProfile(idOrSlug, input, db) {
+  const d = db || getDatabase();
+  const existing = getProfile(idOrSlug, d);
+  const ts = now();
+  const updates = ["updated_at = ?"];
+  const params = [ts];
+  if (input.name !== undefined) {
+    updates.push("name = ?", "slug = ?");
+    params.push(input.name, uniqueProfileSlug(input.name, d, existing.id));
+  }
+  if (input.description !== undefined) {
+    updates.push("description = ?");
+    params.push(input.description);
+  }
+  if (input.selectors !== undefined) {
+    updates.push("selectors = ?");
+    params.push(JSON.stringify(input.selectors));
+  }
+  if (input.variables !== undefined) {
+    updates.push("variables = ?");
+    params.push(JSON.stringify(input.variables));
+  }
+  params.push(existing.id);
+  d.run(`UPDATE profiles SET ${updates.join(", ")} WHERE id = ?`, params);
+  return getProfile(existing.id, d);
+}
+function deleteProfile(idOrSlug, db) {
+  const d = db || getDatabase();
+  const existing = getProfile(idOrSlug, d);
+  d.run("DELETE FROM profiles WHERE id = ?", [existing.id]);
+}
+function addConfigToProfile(profileIdOrSlug, configId, db) {
+  const d = db || getDatabase();
+  const profile = getProfile(profileIdOrSlug, d);
+  const maxRow = d.query("SELECT MAX(sort_order) as max_order FROM profile_configs WHERE profile_id = ?").get(profile.id);
+  const order = (maxRow?.max_order ?? -1) + 1;
+  d.run("INSERT OR IGNORE INTO profile_configs (profile_id, config_id, sort_order) VALUES (?, ?, ?)", [profile.id, configId, order]);
+}
+function removeConfigFromProfile(profileIdOrSlug, configId, db) {
+  const d = db || getDatabase();
+  const profile = getProfile(profileIdOrSlug, d);
+  d.run("DELETE FROM profile_configs WHERE profile_id = ? AND config_id = ?", [profile.id, configId]);
+}
+function getProfileConfigs(profileIdOrSlug, db) {
+  const d = db || getDatabase();
+  const profile = getProfile(profileIdOrSlug, d);
+  const rows = d.query("SELECT config_id FROM profile_configs WHERE profile_id = ? ORDER BY sort_order").all(profile.id);
+  if (rows.length === 0)
+    return [];
+  const ids = rows.map((r) => r.config_id);
+  return listConfigs(undefined, d).filter((c) => ids.includes(c.id));
+}
+function profileHasSelectors(profile) {
+  const selectors = profile.selectors ?? {};
+  return (selectors.os?.length ?? 0) > 0 || (selectors.arch?.length ?? 0) > 0 || (selectors.hostnames?.length ?? 0) > 0;
+}
+function profileMatchesMachine(profile, machine) {
+  const selectors = profile.selectors ?? {};
+  const osMatches = !selectors.os?.length || selectors.os.some((candidate) => {
+    const value = candidate.trim().toLowerCase();
+    return value === machine.os_family || value === (machine.os ?? "").trim().toLowerCase() || normalizeOsFamily(candidate) === machine.os_family;
+  });
+  const archMatches = !selectors.arch?.length || selectors.arch.some((candidate) => candidate.trim().toLowerCase() === (machine.arch ?? "").trim().toLowerCase());
+  const hostnameMatches = !selectors.hostnames?.length || selectors.hostnames.some((candidate) => candidate.trim().toLowerCase() === machine.hostname.trim().toLowerCase());
+  return osMatches && archMatches && hostnameMatches;
+}
+function resolveProfileForMachine(machine = detectMachineContext(), db) {
+  const profiles = listProfiles(db).filter(profileHasSelectors);
+  const matches = profiles.filter((profile) => profileMatchesMachine(profile, machine)).map((profile) => {
+    const selectors = profile.selectors;
+    const score = (selectors.hostnames?.length ? 100 : 0) + (selectors.os?.length ? 10 : 0) + (selectors.arch?.length ? 10 : 0);
+    return { profile, score };
+  }).sort((a, b) => b.score - a.score || a.profile.name.localeCompare(b.profile.name));
+  return matches[0]?.profile ?? null;
+}
+// src/db/machines.ts
+import { arch, hostname, type } from "os";
+function currentHostname2() {
+  return hostname();
+}
+function currentOs() {
+  return type();
+}
+function currentArch2() {
+  return arch();
+}
+function registerMachine(hostnameStr, os, archStr, db) {
+  const d = db || getDatabase();
+  const h = hostnameStr ?? currentHostname2();
+  const o = os ?? currentOs();
+  const a = archStr ?? currentArch2();
+  const existing = d.query("SELECT * FROM machines WHERE hostname = ?").get(h);
+  if (existing) {
+    if (existing.os !== o || existing.arch !== a) {
+      d.run("UPDATE machines SET os = ?, arch = ? WHERE hostname = ?", [o, a, h]);
+      return d.query("SELECT * FROM machines WHERE hostname = ?").get(h);
+    }
+    return existing;
+  }
+  const id = uuid();
+  const ts = now();
+  d.run("INSERT INTO machines (id, hostname, os, arch, last_applied_at, created_at) VALUES (?, ?, ?, ?, NULL, ?)", [id, h, o, a, ts]);
+  return d.query("SELECT * FROM machines WHERE id = ?").get(id);
+}
+function updateMachineApplied(hostnameStr, db) {
+  const d = db || getDatabase();
+  const h = hostnameStr ?? currentHostname2();
+  d.run("UPDATE machines SET last_applied_at = ? WHERE hostname = ?", [now(), h]);
+}
+function listMachines(db) {
+  const d = db || getDatabase();
+  return d.query("SELECT * FROM machines ORDER BY last_applied_at DESC NULLS LAST").all();
+}
+// src/db/pg-migrations.ts
+var PG_MIGRATIONS = [
+  `CREATE TABLE IF NOT EXISTS configs (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    slug TEXT NOT NULL UNIQUE,
+    kind TEXT NOT NULL DEFAULT 'file',
+    category TEXT NOT NULL,
+    agent TEXT NOT NULL DEFAULT 'global',
+    target_path TEXT,
+    outputs TEXT NOT NULL DEFAULT '[]',
+    format TEXT NOT NULL DEFAULT 'text',
+    content TEXT NOT NULL DEFAULT '',
+    description TEXT,
+    tags TEXT NOT NULL DEFAULT '[]',
+    is_template BOOLEAN NOT NULL DEFAULT FALSE,
+    version INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    synced_at TEXT
+  )`,
+  `CREATE TABLE IF NOT EXISTS config_snapshots (
+    id TEXT PRIMARY KEY,
+    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
+    content TEXT NOT NULL,
+    version INTEGER NOT NULL,
+    created_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS profiles (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    slug TEXT NOT NULL UNIQUE,
+    description TEXT,
+    selectors TEXT NOT NULL DEFAULT '{}',
+    variables TEXT NOT NULL DEFAULT '{}',
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS profile_configs (
+    profile_id TEXT NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
+    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
+    sort_order INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (profile_id, config_id)
+  )`,
+  `CREATE TABLE IF NOT EXISTS machines (
+    id TEXT PRIMARY KEY,
+    hostname TEXT NOT NULL UNIQUE,
+    os TEXT,
+    arch TEXT,
+    last_applied_at TEXT,
+    created_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS feedback (
+    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+    message TEXT NOT NULL,
+    email TEXT,
+    category TEXT DEFAULT 'general',
+    version TEXT,
+    machine_id TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `ALTER TABLE configs ADD COLUMN IF NOT EXISTS outputs TEXT NOT NULL DEFAULT '[]'`
+];
+
+// src/db/remote-storage.ts
+import pg from "pg";
+var DISABLED_SSL_MODE = "disable";
+function translatePlaceholders(sql) {
+  let index = 0;
+  return sql.replace(/\?/g, () => `$${++index}`);
+}
+function normalizeParams(params) {
+  const flat = params.length === 1 && Array.isArray(params[0]) ? params[0] : params;
+  return flat.map((value) => value === undefined ? null : value);
+}
+function normalizeHost(hostname2) {
+  const stripped = hostname2.replace(/^\[/, "").replace(/\]$/, "");
+  try {
+    return decodeURIComponent(stripped).toLowerCase();
+  } catch {
+    return stripped.toLowerCase();
+  }
+}
+function isLocalPostgresHost(hostname2) {
+  const host = normalizeHost(hostname2);
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "" || host.startsWith("/");
+}
+function effectivePgHost(url) {
+  const hosts = url.searchParams.getAll("host");
+  const finalHost = hosts.length > 0 ? hosts[hosts.length - 1] : null;
+  return finalHost?.trim() ? finalHost : url.hostname;
+}
+function buildPgPoolConfig(connectionString) {
+  let url;
+  try {
+    url = new URL(connectionString);
+  } catch {
+    throw new Error("Invalid PostgreSQL connection string");
+  }
+  const sslMode = url.searchParams.get("sslmode")?.trim().toLowerCase();
+  const sslValue = url.searchParams.get("ssl")?.trim().toLowerCase();
+  const isLocal = isLocalPostgresHost(effectivePgHost(url));
+  const hasDisabledSsl = sslMode === DISABLED_SSL_MODE || sslValue === "false";
+  if (!isLocal && hasDisabledSsl) {
+    throw new Error("Refusing remote PostgreSQL connection with TLS disabled");
+  }
+  const shouldUseSsl = !isLocal || sslMode === "require" || sslMode === "verify-ca" || sslMode === "verify-full" || sslValue === "true";
+  url.searchParams.delete("sslmode");
+  url.searchParams.delete("ssl");
+  return {
+    connectionString: url.toString(),
+    ssl: shouldUseSsl ? { rejectUnauthorized: true } : undefined
+  };
+}
+
+class PgAdapterAsync {
+  pool;
+  constructor(connectionString) {
+    this.pool = new pg.Pool(buildPgPoolConfig(connectionString));
+  }
+  async run(sql, ...params) {
+    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
+    return { changes: result.rowCount ?? 0 };
+  }
+  async all(sql, ...params) {
+    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
+    return result.rows;
+  }
+  async close() {
+    await this.pool.end();
+  }
+}
+
+// src/db/storage-sync.ts
+var STORAGE_TABLES = ["configs", "config_snapshots", "profiles", "profile_configs", "machines", "feedback"];
+var CONFIGS_STORAGE_TABLES = STORAGE_TABLES;
+var PRIMARY_KEYS = {
+  configs: ["id"],
+  config_snapshots: ["id"],
+  profiles: ["id"],
+  profile_configs: ["profile_id", "config_id"],
+  machines: ["id"],
+  feedback: ["id"]
+};
+var CONFIGS_STORAGE_ENV = "HASNA_CONFIGS_DATABASE_URL";
+var CONFIGS_STORAGE_FALLBACK_ENV = "CONFIGS_DATABASE_URL";
+var CONFIGS_STORAGE_MODE_ENV = "HASNA_CONFIGS_STORAGE_MODE";
+var CONFIGS_STORAGE_MODE_FALLBACK_ENV = "CONFIGS_STORAGE_MODE";
+var STORAGE_DATABASE_ENV = [CONFIGS_STORAGE_ENV, CONFIGS_STORAGE_FALLBACK_ENV];
+var STORAGE_MODE_ENV = [CONFIGS_STORAGE_MODE_ENV, CONFIGS_STORAGE_MODE_FALLBACK_ENV];
+function firstEnv(names) {
+  for (const name of names) {
+    const value = process.env[name];
+    if (value)
+      return value;
+  }
+  return null;
+}
+function normalizeStorageMode(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (normalized === "local" || normalized === "hybrid" || normalized === "remote")
+    return normalized;
+  return;
+}
+function getStorageDatabaseUrl() {
+  return firstEnv(STORAGE_DATABASE_ENV);
+}
+function getStorageDatabaseEnvName() {
+  for (const name of STORAGE_DATABASE_ENV) {
+    if (process.env[name])
+      return name;
+  }
+  return null;
+}
+function getStorageMode() {
+  const mode = normalizeStorageMode(firstEnv(STORAGE_MODE_ENV));
+  if (mode)
+    return mode;
+  return getStorageDatabaseUrl() ? "hybrid" : "local";
+}
+async function getStoragePg() {
+  const url = getStorageDatabaseUrl();
+  if (!url)
+    throw new Error("Missing HASNA_CONFIGS_DATABASE_URL or CONFIGS_DATABASE_URL");
+  return new PgAdapterAsync(url);
+}
+async function runStorageMigrations(remote) {
+  await remote.run("CREATE EXTENSION IF NOT EXISTS pgcrypto");
+  for (const sql of PG_MIGRATIONS)
+    await remote.run(sql);
+}
+async function storagePush(options) {
+  const remote = await getStoragePg();
+  const db = getDatabase();
+  try {
+    await runStorageMigrations(remote);
+    const results = [];
+    for (const table of resolveTables(options?.tables))
+      results.push(await pushTable(db, remote, table));
+    recordSyncMeta(db, "push", results);
+    return results;
+  } finally {
+    await remote.close();
+  }
+}
+async function storagePull(options) {
+  const remote = await getStoragePg();
+  const db = getDatabase();
+  try {
+    await runStorageMigrations(remote);
+    const results = [];
+    for (const table of resolveTables(options?.tables))
+      results.push(await pullTable(remote, db, table));
+    recordSyncMeta(db, "pull", results);
+    return results;
+  } finally {
+    await remote.close();
+  }
+}
+async function storageSync(options) {
+  const pull = await storagePull(options);
+  const push = await storagePush(options);
+  return { pull, push };
+}
+function getStorageSyncMetaAll() {
+  const db = getDatabase();
+  ensureSyncMetaTable(db);
+  return db.query("SELECT table_name, last_synced_at, direction FROM _configs_sync_meta ORDER BY table_name, direction").all();
+}
+function getSyncMetaAll() {
+  return getStorageSyncMetaAll();
+}
+function getStorageStatus() {
+  return {
+    configured: Boolean(getStorageDatabaseUrl()),
+    mode: getStorageMode(),
+    env: STORAGE_DATABASE_ENV,
+    service: "configs",
+    tables: STORAGE_TABLES,
+    sync: getStorageSyncMetaAll()
+  };
+}
+function resolveTables(tables) {
+  if (!tables || tables.length === 0)
+    return [...STORAGE_TABLES];
+  const allowed = new Set(STORAGE_TABLES);
+  const requested = tables.map((table) => table.trim()).filter(Boolean);
+  const invalid = requested.filter((table) => !allowed.has(table));
+  if (invalid.length > 0)
+    throw new Error(`Unknown configs sync table(s): ${invalid.join(", ")}`);
+  return requested;
+}
+async function pushTable(db, remote, table) {
+  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
+  try {
+    const rows = db.query(`SELECT * FROM ${quoteIdent(table)}`).all();
+    result.rowsRead = rows.length;
+    if (rows.length === 0)
+      return result;
+    const columns = await filterRemoteColumns(remote, table, Object.keys(rows[0]));
+    result.rowsWritten = await upsertPg(remote, table, columns, rows);
+  } catch (error) {
+    result.errors.push(error instanceof Error ? error.message : String(error));
+  }
+  return result;
+}
+async function pullTable(remote, db, table) {
+  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
+  try {
+    const rows = await remote.all(`SELECT * FROM ${quoteIdent(table)}`);
+    result.rowsRead = rows.length;
+    if (rows.length === 0)
+      return result;
+    const columns = filterLocalColumns(db, table, Object.keys(rows[0]));
+    result.rowsWritten = upsertSqlite(db, table, columns, rows);
+  } catch (error) {
+    result.errors.push(error instanceof Error ? error.message : String(error));
+  }
+  return result;
+}
+async function filterRemoteColumns(remote, table, columns) {
+  const rows = await remote.all("SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = ?", table);
+  if (rows.length === 0)
+    return columns;
+  const allowed = new Set(rows.map((row) => row.column_name));
+  return columns.filter((column) => allowed.has(column));
+}
+function filterLocalColumns(db, table, columns) {
+  const rows = db.query(`PRAGMA table_info(${quoteIdent(table)})`).all();
+  const allowed = new Set(rows.map((row) => row.name));
+  return columns.filter((column) => allowed.has(column));
+}
+async function upsertPg(remote, table, columns, rows) {
+  if (columns.length === 0)
+    return 0;
+  const primaryKeys = PRIMARY_KEYS[table];
+  const columnList = columns.map(quoteIdent).join(", ");
+  const placeholders = columns.map(() => "?").join(", ");
+  const keyList = primaryKeys.map(quoteIdent).join(", ");
+  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
+  const fallbackKey = primaryKeys[0];
+  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = EXCLUDED.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = EXCLUDED.${quoteIdent(fallbackKey)}`;
+  for (const row of rows) {
+    await remote.run(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders}) ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`, ...columns.map((column) => row[column] ?? null));
+  }
+  return rows.length;
+}
+function upsertSqlite(db, table, columns, rows) {
+  if (columns.length === 0)
+    return 0;
+  const primaryKeys = PRIMARY_KEYS[table];
+  const columnList = columns.map(quoteIdent).join(", ");
+  const placeholders = columns.map(() => "?").join(", ");
+  const keyList = primaryKeys.map(quoteIdent).join(", ");
+  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
+  const fallbackKey = primaryKeys[0];
+  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = excluded.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = excluded.${quoteIdent(fallbackKey)}`;
+  const statement = db.prepare(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders}) ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`);
+  db.transaction((batch) => {
+    for (const row of batch)
+      statement.run(...columns.map((column) => coerceForSqlite(row[column])));
+  })(rows);
+  return rows.length;
+}
+function recordSyncMeta(db, direction, results) {
+  ensureSyncMetaTable(db);
+  const now2 = new Date().toISOString();
+  const statement = db.prepare("INSERT INTO _configs_sync_meta (table_name, last_synced_at, direction) VALUES (?, ?, ?) ON CONFLICT(table_name, direction) DO UPDATE SET last_synced_at = excluded.last_synced_at");
+  for (const result of results) {
+    if (result.errors.length > 0)
+      continue;
+    statement.run(result.table, now2, direction);
+  }
+}
+function ensureSyncMetaTable(db) {
+  db.exec("CREATE TABLE IF NOT EXISTS _configs_sync_meta (table_name TEXT NOT NULL, last_synced_at TEXT, direction TEXT NOT NULL CHECK(direction IN ('push', 'pull')), PRIMARY KEY (table_name, direction))");
+}
+function quoteIdent(identifier) {
+  return `"${identifier.replace(/"/g, '""')}"`;
+}
+function coerceForSqlite(value) {
+  if (value === undefined || value === null)
+    return null;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean")
+    return value;
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array)
+    return value;
+  if (typeof value === "object")
+    return JSON.stringify(value);
+  return String(value);
+}
+// src/status.ts
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+
+// src/lib/apply.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync, realpathSync, writeFileSync } from "fs";
+import { basename as basename2, dirname, resolve } from "path";
+import { homedir as homedir2 } from "os";
+
+// src/lib/transforms.ts
+import { basename, extname } from "path";
+function ensureTrailingNewline(content) {
+  return content.endsWith(`
+`) ? content : `${content}
+`;
+}
+function yamlQuote(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function headingLevel(line) {
+  const m = line.match(/^(#{1,6})\s+/);
+  return m ? m[1].length : null;
+}
+function stripClaudeOnlySections(content) {
+  const withoutMarkedBlocks = content.replace(/<!--\s*claude-only:start\s*-->[\s\S]*?<!--\s*claude-only:end\s*-->/gi, "");
+  const lines = withoutMarkedBlocks.split(`
+`);
+  const kept = [];
+  let droppingUntilLevel = null;
+  for (const line of lines) {
+    const level = headingLevel(line);
+    if (level !== null && droppingUntilLevel !== null && level <= droppingUntilLevel) {
+      droppingUntilLevel = null;
+    }
+    if (droppingUntilLevel !== null)
+      continue;
+    if (/^#{1,6}\s+.*claude(?:\s+code)?[-\s]+only\b/i.test(line)) {
+      droppingUntilLevel = level ?? 1;
+      continue;
+    }
+    kept.push(line);
+  }
+  return kept.join(`
+`).replace(/\n{3,}/g, `
+
+`).trim();
+}
+function isClaudeRuleConfig(source, candidate) {
+  if (candidate.id === source.id)
+    return false;
+  if (candidate.agent !== "claude" || candidate.category !== "rules")
+    return false;
+  return !!candidate.target_path?.includes("/rules/");
+}
+function ruleLabel(config) {
+  const file = config.target_path ? basename(config.target_path) : config.name;
+  return file.replace(/\.(md|mdc|markdown)$/i, "");
+}
+function claudeRules(source, context) {
+  return (context.configs ?? []).filter((config) => isClaudeRuleConfig(source, config)).sort((a, b) => (a.target_path ?? a.name).localeCompare(b.target_path ?? b.name));
+}
+function flattenWithRules(source, context) {
+  const parts = [stripClaudeOnlySections(source.content)];
+  const rules = claudeRules(source, context).map((rule) => ({ rule, content: stripClaudeOnlySections(rule.content) })).filter(({ content }) => Boolean(content)).map(({ rule, content }) => `### ${ruleLabel(rule)}
+
+${content}`);
+  if (rules.length > 0) {
+    parts.push(`## Rules
+
+${rules.join(`
+
+`)}`);
+  }
+  return ensureTrailingNewline(parts.filter(Boolean).join(`
+
+`));
+}
+function buildCodexAgentsMd(source, context = {}) {
+  return flattenWithRules(source, context);
+}
+function buildOpenCodeAgentsMd(source, context = {}) {
+  return flattenWithRules(source, context);
+}
+function buildCursorMdc(source) {
+  const stem = source.target_path ? basename(source.target_path, extname(source.target_path)) : source.slug;
+  const description = source.name || stem;
+  return ensureTrailingNewline([
+    "---",
+    `description: ${yamlQuote(description)}`,
+    'globs: ["**/*"]',
+    "alwaysApply: true",
+    "---",
+    "",
+    stripClaudeOnlySections(source.content)
+  ].join(`
+`));
+}
+function transformSkillContent(content) {
+  return ensureTrailingNewline(content.split(`
+`).filter((line) => !/^\s*user_invocable\s*:/i.test(line)).join(`
+`).replace(/\bAgent tool\b/g, "delegate through the available MCP or agent orchestration tools").replace(/\bTodoWrite\b/g, "track tasks with the agent's native task mechanism").replace(/\bRead\/Edit\b/g, "read and edit files with the available filesystem tools").replace(/\bRead\b/g, "read files with the available filesystem tools").replace(/\bEdit\b/g, "edit files with the available filesystem tools").replace(/\bBash\b/g, "run shell commands with the available terminal tool").trim());
+}
+function applyTransform(source, output, context = {}) {
+  switch (output.transform) {
+    case "passthrough":
+    case "claude-passthrough":
+      return ensureTrailingNewline(source.content);
+    case "codex-flat":
+      return buildCodexAgentsMd(source, context);
+    case "opencode-flat":
+      return buildOpenCodeAgentsMd(source, context);
+    case "cursor-mdc":
+      return buildCursorMdc(source);
+    case "skill-neutral":
+      return transformSkillContent(source.content);
+  }
+}
+
+// src/lib/apply.ts
+function getConfigHome() {
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir2();
+}
+function expandPath(p) {
+  if (p.startsWith("~/")) {
+    return resolve(getConfigHome(), p.slice(2));
+  }
+  return resolve(p);
+}
+function normalizeTargetPath(p) {
+  const expanded = expandPath(p);
+  try {
+    return realpathSync(expanded);
+  } catch {
+    let current = expanded;
+    const missingSegments = [];
+    while (true) {
+      if (existsSync3(current)) {
+        try {
+          return resolve(realpathSync(current), ...missingSegments);
+        } catch {
+          return expanded;
+        }
+      }
+      const parent = dirname(current);
+      const name = basename2(current);
+      if (parent === current)
+        return expanded;
+      missingSegments.unshift(name);
+      current = parent;
+    }
+  }
+}
+async function writeConfigResult(config, targetPath, content, opts, meta = {}) {
+  const renderedTargetPath = opts.vars ? renderMachineAwareContent(targetPath, opts.vars) : targetPath;
+  const renderedContent = opts.vars ? renderMachineAwareContent(content, opts.vars) : content;
+  const path = expandPath(renderedTargetPath);
+  const previousContent = existsSync3(path) ? readFileSync(path, "utf-8") : null;
+  const changed = previousContent !== renderedContent;
+  if (!opts.dryRun) {
+    const dir = dirname(path);
+    if (!existsSync3(dir)) {
+      mkdirSync2(dir, { recursive: true });
+    }
+    if (previousContent !== null && changed) {
+      const db = opts.db || getDatabase();
+      createSnapshot(config.id, previousContent, config.version, db);
+    }
+    writeFileSync(path, renderedContent, "utf-8");
+  }
+  return {
+    config_id: config.id,
+    path,
+    previous_content: previousContent,
+    new_content: renderedContent,
+    dry_run: opts.dryRun ?? false,
+    changed,
+    ...meta
+  };
+}
+function isGeneratedOutputTarget(config, configs) {
+  if (!config.target_path)
+    return false;
+  const targetPath = normalizeTargetPath(config.target_path);
+  return configs.some((candidate) => candidate.id !== config.id && candidate.outputs.some((output) => normalizeTargetPath(output.target_path) === targetPath));
+}
+async function applyConfig(config, opts = {}) {
+  const selectedOutputs = opts.outputAgent ? config.outputs.filter((output) => output.agent === opts.outputAgent) : config.outputs;
+  const shouldApplyPrimary = !opts.outputAgent || config.agent === opts.outputAgent;
+  if (config.kind === "reference" || (!config.target_path || !shouldApplyPrimary) && selectedOutputs.length === 0) {
+    throw new ConfigApplyError(`Config "${config.name}" is a reference (kind=reference) and has no target_path \u2014 cannot apply to disk.`);
+  }
+  const db = opts.db || getDatabase();
+  const contextConfigs = selectedOutputs.length > 0 || config.target_path ? listConfigs(undefined, db) : [config];
+  if (isGeneratedOutputTarget(config, contextConfigs)) {
+    throw new ConfigApplyError(`Config "${config.name}" targets a generated output path. Apply the canonical source config instead.`);
+  }
+  const outputResults = [];
+  for (const output of selectedOutputs) {
+    outputResults.push(await applyOutput(config, output, contextConfigs, opts));
+  }
+  let result;
+  if (config.target_path && shouldApplyPrimary) {
+    result = await writeConfigResult(config, config.target_path, config.content, opts);
+    result.outputs = outputResults;
+    result.changed = result.changed || outputResults.some((output) => output.changed);
+  } else {
+    result = {
+      ...outputResults[0],
+      outputs: outputResults.slice(1),
+      changed: outputResults.some((output) => output.changed)
+    };
+  }
+  if (!opts.dryRun) {
+    updateConfig(config.id, { synced_at: now() }, db);
+  }
+  return result;
+}
+async function applyOutput(config, output, contextConfigs, opts) {
+  const content = applyTransform(config, output, { configs: contextConfigs });
+  return writeConfigResult(config, output.target_path, content, opts, {
+    agent: output.agent,
+    transform: output.transform
+  });
+}
+async function applyConfigs(configs, opts = {}) {
+  const results = [];
+  for (const config of configs) {
+    if (config.kind === "reference")
+      continue;
+    results.push(await applyConfig(config, opts));
+  }
+  return results;
+}
+
+// src/lib/redact.ts
+var SECRET_KEY_PATTERN = /^(.*_?API_?KEY|.*_?TOKEN|.*_?SECRET|.*_?PASSWORD|.*_?PASSWD|.*_?CREDENTIAL|.*_?AUTH(?:_TOKEN|_KEY|ORIZATION)?|.*_?PRIVATE_?KEY|.*_?ACCESS_?KEY|.*_?CLIENT_?SECRET|.*_?SIGNING_?KEY|.*_?ENCRYPTION_?KEY|.*_AUTH_TOKEN)$/i;
+var VALUE_PATTERNS = [
+  { re: /npm_[A-Za-z0-9]{36,}/, reason: "npm token" },
+  { re: /gh[pousr]_[A-Za-z0-9_]{36,}/, reason: "GitHub token" },
+  { re: /sk-ant-[A-Za-z0-9\-_]{40,}/, reason: "Anthropic API key" },
+  { re: /sk-[A-Za-z0-9]{48,}/, reason: "OpenAI API key" },
+  { re: /xoxb-[0-9]+-[A-Za-z0-9\-]+/, reason: "Slack bot token" },
+  { re: /AIza[0-9A-Za-z\-_]{35}/, reason: "Google API key" },
+  { re: /ey[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{20,}\./, reason: "JWT token" },
+  { re: /AKIA[0-9A-Z]{16}/, reason: "AWS access key" }
+];
+var MIN_SECRET_VALUE_LEN = 8;
+function redactShell(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(/^(\s*(?:export\s+)?)([A-Z][A-Z0-9_]*)(\s*=\s*)(['"]?)(.+?)\4\s*$/);
+    if (m) {
+      const [, prefix, key, eq, quote, value] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const reason = reasonFor(key, value);
+        redacted.push({ varName: key, line: i + 1, reason });
+        out.push(`${prefix}${key}${eq}${quote}{{${key}}}${quote}`);
+        continue;
+      }
+    }
+    out.push(line);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
+}
+function redactJson(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(/^(\s*"([^"]+)"\s*:\s*)"([^"]+)"(,?)(\s*)$/);
+    if (m) {
+      const [, prefix, key, value, comma, trail] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
+        out.push(`${prefix}"{{${varName}}}"${comma}${trail}`);
+        continue;
+      }
+    }
+    let newLine = line;
+    for (const { re, reason } of VALUE_PATTERNS) {
+      newLine = newLine.replace(re, (match) => {
+        const varName = `REDACTED_${reason.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+        redacted.push({ varName, line: i + 1, reason });
+        return `{{${varName}}}`;
+      });
+    }
+    out.push(newLine);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
+}
+function redactToml(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(/^(\s*)([a-zA-Z][a-zA-Z0-9_\-]*)(\s*=\s*)(['"]?)(.+?)\4\s*$/);
+    if (m) {
+      const [, indent, key, eq, quote, value] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
+        out.push(`${indent}${key}${eq}${quote}{{${varName}}}${quote}`);
+        continue;
+      }
+    }
+    out.push(line);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
+}
+function redactIni(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const authM = line.match(/^(\/\/[^:]+:_authToken=)(.+)$/);
+    if (authM && !authM[2].startsWith("{{")) {
+      redacted.push({ varName: "NPM_AUTH_TOKEN", line: i + 1, reason: "npm auth token" });
+      out.push(`${authM[1]}{{NPM_AUTH_TOKEN}}`);
+      continue;
+    }
+    const m = line.match(/^(\s*)([a-zA-Z][a-zA-Z0-9_\-]*)(\s*=\s*)(.+?)\s*$/);
+    if (m) {
+      const [, indent, key, eq, value] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
+        out.push(`${indent}${key}${eq}{{${varName}}}`);
+        continue;
+      }
+    }
+    out.push(line);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
+}
+function redactGeneric(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    let line = lines[i];
+    for (const { re, reason } of VALUE_PATTERNS) {
+      line = line.replace(re, (match) => {
+        const varName = reason.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason });
+        return `{{${varName}}}`;
+      });
+    }
+    out.push(line);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
+}
+function shouldRedactKeyValue(key, value) {
+  if (!value || value.startsWith("{{"))
+    return false;
+  if (value.length < MIN_SECRET_VALUE_LEN)
+    return false;
+  if (/^(true|false|yes|no|on|off|null|undefined|\d+)$/i.test(value))
+    return false;
+  if (SECRET_KEY_PATTERN.test(key))
+    return true;
+  for (const { re } of VALUE_PATTERNS) {
+    if (re.test(value))
+      return true;
+  }
+  return false;
+}
+function reasonFor(key, value) {
+  if (SECRET_KEY_PATTERN.test(key))
+    return `secret key name: ${key}`;
+  for (const { re, reason } of VALUE_PATTERNS) {
+    if (re.test(value))
+      return reason;
+  }
+  return "secret value pattern";
+}
+function redactContent(content, format) {
+  switch (format) {
+    case "shell":
+      return redactShell(content);
+    case "json":
+      return redactJson(content);
+    case "toml":
+      return redactToml(content);
+    case "ini":
+      return redactIni(content);
+    default:
+      return redactGeneric(content);
+  }
+}
+function scanSecrets(content, format) {
+  const r = redactContent(content, format);
+  return r.redacted;
+}
+function hasSecrets(content, format) {
+  return scanSecrets(content, format).length > 0;
+}
+
+// src/status.ts
+var PACKAGE_NAME = "@hasna/instructions";
+var PACKAGE_VERSION = "0.3.0";
+function activeDatabaseEnv() {
+  if (process.env["HASNA_CONFIGS_DB_PATH"])
+    return "HASNA_CONFIGS_DB_PATH";
+  if (process.env["CONFIGS_DB_PATH"])
+    return "CONFIGS_DB_PATH";
+  return null;
+}
+function configuredDatabaseKind() {
+  const value = process.env["HASNA_CONFIGS_DB_PATH"] ?? process.env["CONFIGS_DB_PATH"] ?? "";
+  return value === ":memory:" || value.startsWith("file::memory:") ? "memory" : "file";
+}
+function countBy(items, getValue) {
+  const counts = {};
+  for (const item of items) {
+    const value = getValue(item);
+    if (!value)
+      continue;
+    counts[value] = (counts[value] ?? 0) + 1;
+  }
+  return counts;
+}
+function tableCount(db, table) {
+  try {
+    const row = db.query(`SELECT COUNT(*) AS count FROM ${table}`).get();
+    return Number(row?.count ?? 0);
+  } catch {
+    return 0;
+  }
+}
+function getConfigsStatus(db = getDatabase()) {
+  let databaseReachable = true;
+  let configs = [];
+  let categoryStats = { total: 0 };
+  try {
+    configs = listConfigs(undefined, db);
+    categoryStats = getConfigStats(db);
+  } catch {
+    databaseReachable = false;
+  }
+  const fileConfigs = configs.filter((config) => config.kind === "file");
+  let driftedTargets = 0;
+  let missingTargets = 0;
+  let unredactedSecretFindings = 0;
+  let knownTargets = 0;
+  for (const config of fileConfigs) {
+    unredactedSecretFindings += scanSecrets(config.content, config.format).length;
+    if (!config.target_path)
+      continue;
+    knownTargets += 1;
+    const targetPath = expandPath(config.target_path);
+    if (!existsSync4(targetPath)) {
+      missingTargets += 1;
+      continue;
+    }
+    const disk = readFileSync2(targetPath, "utf-8");
+    const { content: redactedDisk } = redactContent(disk, config.format);
+    if (redactedDisk !== config.content) {
+      driftedTargets += 1;
+    }
+  }
+  const profiles = databaseReachable ? listProfiles(db).length : 0;
+  const machines = databaseReachable ? listMachines(db).length : 0;
+  const profileLinks = databaseReachable ? tableCount(db, "profile_configs") : 0;
+  const snapshots = databaseReachable ? tableCount(db, "config_snapshots") : 0;
+  const byCategory = Object.fromEntries(Object.entries(categoryStats).filter(([key]) => key !== "total"));
+  const status = databaseReachable && driftedTargets === 0 && missingTargets === 0 && unredactedSecretFindings === 0 ? "ok" : "warn";
+  return {
+    service: "configs",
+    schemaVersion: "1.0",
+    package: {
+      name: PACKAGE_NAME,
+      version: PACKAGE_VERSION
+    },
+    env: {
+      database: {
+        primary: "HASNA_CONFIGS_DB_PATH",
+        fallback: "CONFIGS_DB_PATH",
+        active: activeDatabaseEnv(),
+        kind: configuredDatabaseKind()
+      }
+    },
+    counts: {
+      configs: {
+        total: configs.length,
+        file: fileConfigs.length,
+        reference: configs.filter((config) => config.kind === "reference").length,
+        templates: configs.filter((config) => config.is_template).length
+      },
+      byCategory,
+      byAgent: countBy(configs, (config) => config.agent),
+      byFormat: countBy(configs, (config) => config.format),
+      profiles,
+      profileLinks,
+      machines,
+      snapshots,
+      knownTargets
+    },
+    health: {
+      status,
+      databaseReachable,
+      driftedTargets,
+      missingTargets,
+      unredactedSecretFindings,
+      hasDrift: driftedTargets > 0,
+      hasMissingTargets: missingTargets > 0,
+      hasUnredactedSecrets: unredactedSecretFindings > 0
+    },
+    safety: {
+      includesConfigValues: false,
+      includesPrivatePaths: false,
+      includesHostnames: false,
+      includesSecretValues: false,
+      statusOutputIsMetadataOnly: true
+    }
+  };
+}
+// src/lib/session-render.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync5, readFileSync as readFileSync3, realpathSync as realpathSync2, statSync as statSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { basename as basename3, dirname as dirname2, extname as extname2, isAbsolute, join as join3, parse, posix, relative, resolve as resolve2 } from "path";
+var CODEWITH_NATIVE_IMPORTS_ENV = "HASNA_CONFIGS_CODEWITH_NATIVE_IMPORTS";
+var SESSION_RENDER_MANAGED_MARKER = "Managed by @hasna/configs session render";
+var SESSION_RENDER_SCHEMA = "hasna.configs.session-render/v1";
+var RAW_STORE_ROOT_ENV = "HASNA_CONFIGS_HOME";
+var SESSION_RENDER_TOOLS = [
+  "claude",
+  "codex",
+  "cursor",
+  "opencode",
+  "codewith"
+];
+var CODEWITH_FLATTENED_ADAPTER = {
+  tool: "codewith",
+  mode: "flattened-markdown",
+  indexFile: "CODEWITH.md",
+  managedDir: ".hasna/instructions",
+  envVar: "CODEWITH_HOME",
+  nativeImports: false,
+  description: "Codewith CODEWITH.md flattened until native @ imports are implemented in Codewith."
+};
+var CODEWITH_NATIVE_ADAPTER = {
+  tool: "codewith",
+  mode: "native-imports",
+  indexFile: "CODEWITH.md",
+  managedDir: ".hasna/instructions",
+  envVar: "CODEWITH_HOME",
+  nativeImports: true,
+  description: "Codewith CODEWITH.md with gated @ imports into managed fragments."
+};
+var SESSION_TOOL_ADAPTERS = {
+  claude: {
+    tool: "claude",
+    mode: "native-imports",
+    indexFile: "CLAUDE.md",
+    managedDir: ".hasna/instructions",
+    envVar: "CLAUDE_CONFIG_DIR",
+    nativeImports: true,
+    description: "Claude Code CLAUDE.md with @ imports into managed fragments."
+  },
+  codex: {
+    tool: "codex",
+    mode: "flattened-markdown",
+    indexFile: "AGENTS.md",
+    managedDir: ".hasna/instructions",
+    envVar: "CODEX_HOME",
+    nativeImports: false,
+    description: "Codex AGENTS.md flattened instruction file."
+  },
+  cursor: {
+    tool: "cursor",
+    mode: "cursor-mdc",
+    managedDir: ".cursor/rules",
+    nativeImports: false,
+    description: "Cursor project rule files in .cursor/rules/*.mdc."
+  },
+  opencode: {
+    tool: "opencode",
+    mode: "opencode-instructions",
+    indexFile: "AGENTS.md",
+    configFile: "opencode.json",
+    managedDir: ".hasna/instructions",
+    envVar: "OPENCODE_CONFIG_DIR",
+    nativeImports: false,
+    description: "OpenCode AGENTS.md plus opencode.json instructions pointing at managed fragments."
+  },
+  codewith: CODEWITH_FLATTENED_ADAPTER
+};
+var LAYER_RANK = {
+  global: 10,
+  tool: 20,
+  account: 30,
+  agent: 40,
+  project: 50,
+  local: 60
+};
+function ensureTrailingNewline2(content) {
+  return content.endsWith(`
+`) ? content : `${content}
+`;
+}
+function sha256(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+function fingerprint(value) {
+  return sha256(JSON.stringify(value));
+}
+function slug(value) {
+  const s = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return s || "instruction";
+}
+function yamlQuote2(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function getRawStoreRoot() {
+  return resolve2(process.env[RAW_STORE_ROOT_ENV] || join3(process.env["HOME"] || homedir3(), ".hasna", "configs"));
+}
+function defaultTargetHome(tool, profile, sessionId) {
+  return join3(getRawStoreRoot(), "sessions", tool, slug(profile), slug(sessionId || "latest"));
+}
+function joinTarget(targetHome, relativePath) {
+  const safeTargetHome = assertSafeTargetRoot(targetHome);
+  const safeRelativePath = assertSafeRelativePath(relativePath);
+  return join3(safeTargetHome, ...safeRelativePath.split("/"));
+}
+function makeFile(targetHome, relativePath, role, content, sourceIds) {
+  const safeTargetHome = assertSafeTargetRoot(targetHome);
+  const safeRelativePath = assertSafeRelativePath(relativePath);
+  const normalizedContent = ensureTrailingNewline2(content);
+  return {
+    path: joinTarget(safeTargetHome, safeRelativePath),
+    relativePath: safeRelativePath,
+    role,
+    content: normalizedContent,
+    sha256: sha256(normalizedContent),
+    sourceIds
+  };
+}
+function normalizeSources(sources, tool, allowEmptySources) {
+  const ordered = sources.map((source, index) => {
+    if (!source.id.trim())
+      throw new Error("Session instruction source id is required.");
+    const content = filterProviderOnlyBlocks(source.content ?? "", tool);
+    const normalized = {
+      ...source,
+      content,
+      normalizedId: slug(source.id),
+      resolvedLabel: source.label ?? source.id,
+      resolvedLayer: source.layer ?? "agent",
+      resolvedMerge: source.merge ?? "append",
+      resolvedOrder: source.order ?? index,
+      resolvedRules: normalizeInstructionRules(source, tool)
+    };
+    const hasPathReferences = (normalized.sourcePaths ?? []).length > 0;
+    if (!allowEmptySources && !normalized.content.trim() && normalized.resolvedRules.length === 0 && !hasPathReferences) {
+      throw new Error(`Session instruction source "${source.id}" is empty. Pass --allow-empty-sources only for explicit empty renders.`);
+    }
+    return normalized;
+  }).sort((a, b) => LAYER_RANK[a.resolvedLayer] - LAYER_RANK[b.resolvedLayer] || a.resolvedOrder - b.resolvedOrder || a.id.localeCompare(b.id));
+  rejectDuplicateSourceSlugs(ordered);
+  rejectDuplicateRulePaths(ordered);
+  return ordered;
+}
+function filterProviderOnlyBlocks(content, tool) {
+  const lines = content.split(/\r?\n/);
+  const output = [];
+  let activeProviders = null;
+  for (const line of lines) {
+    const start = line.match(/^\s*<!--\s*@hasna-provider:\s*([^>]+?)\s*-->\s*$/i);
+    if (start) {
+      if (activeProviders)
+        throw new Error("Nested provider-only instruction blocks are not supported.");
+      activeProviders = start[1].split(",").map((item) => item.trim().toLowerCase()).filter(Boolean);
+      continue;
+    }
+    if (/^\s*<!--\s*@hasna-end-provider\s*-->\s*$/i.test(line)) {
+      if (!activeProviders)
+        throw new Error("Provider-only instruction block end marker without start marker.");
+      activeProviders = null;
+      continue;
+    }
+    if (!activeProviders || activeProviders.includes(tool) || activeProviders.includes("all") || activeProviders.includes("generic")) {
+      output.push(line);
+    }
+  }
+  if (activeProviders)
+    throw new Error("Provider-only instruction block was not closed.");
+  return output.join(`
+`);
+}
+function composeSources(sources) {
+  let start = -1;
+  for (let i = 0;i < sources.length; i++) {
+    if (sources[i].resolvedMerge === "replace")
+      start = i;
+  }
+  if (start < 0)
+    return sources;
+  const protectedSources = sources.slice(0, start).filter((source) => source.nonOverridable);
+  return [...protectedSources, ...sources.slice(start)];
+}
+function sectionForSource(source) {
+  const parts = [
+    `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
+    `# ${source.resolvedLabel}`
+  ];
+  if (source.path)
+    parts.push(`Source: ${source.path}`);
+  if (source.sourcePaths && source.sourcePaths.length > 0) {
+    parts.push([
+      "Source paths:",
+      ...source.sourcePaths.map((sourcePath) => {
+        const flags = [
+          sourcePath.editable ? "editable" : null,
+          sourcePath.required ? "required" : null,
+          sourcePath.hash ? sourcePath.hash : null
+        ].filter(Boolean);
+        return `- ${sourcePath.path}${flags.length > 0 ? ` (${flags.join(", ")})` : ""}`;
+      })
+    ].join(`
+`));
+  }
+  if (source.owner)
+    parts.push(`Owner: ${source.owner.kind}:${source.owner.id}`);
+  const content = source.content.trim();
+  if (content)
+    parts.push(content);
+  return parts.join(`
+
+`);
+}
+function sectionForRule(source, rule) {
+  const parts = [
+    `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
+    `# ${rule.resolvedLabel}`
+  ];
+  if (source.path)
+    parts.push(`Source: ${source.path}`);
+  if (rule.path)
+    parts.push(`Rule path: ${rule.path}`);
+  const content = rule.content.trim();
+  if (content)
+    parts.push(content);
+  return parts.join(`
+
+`);
+}
+function fragmentPath(adapter, index, source) {
+  const n = String(index + 1).padStart(2, "0");
+  return posix.join(adapter.managedDir, `${n}-${source.normalizedId}.md`);
+}
+function ruleFragmentPath(adapter, source, rule) {
+  return posix.join(adapter.managedDir, "rules", source.normalizedId, rule.resolvedPath);
+}
+function importPath(indexRelativePath, fragmentRelativePath) {
+  const relative2 = posix.relative(posix.dirname(indexRelativePath), fragmentRelativePath);
+  if (relative2.startsWith("./") || relative2.startsWith("../"))
+    return relative2;
+  return `./${relative2}`;
+}
+function indexHeader(tool, profile) {
+  return [
+    `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
+    `# ${tool} session instructions`,
+    "",
+    `Profile: ${profile}`
+  ].join(`
+`);
+}
+function buildNativeImportFiles(targetHome, adapter, profile, sources) {
+  const indexFile = adapter.indexFile;
+  const fragments = sources.flatMap((source, index2) => [
+    makeFile(targetHome, fragmentPath(adapter, index2, source), "fragment", sectionForSource(source), [source.id]),
+    ...source.resolvedRules.map((rule) => makeFile(targetHome, ruleFragmentPath(adapter, source, rule), "rule", sectionForRule(source, rule), [source.id, rule.id]))
+  ]);
+  const imports = fragments.map((file) => `@${importPath(indexFile, file.relativePath)}`);
+  const index = makeFile(targetHome, indexFile, "index", [indexHeader(adapter.tool, profile), ...imports].join(`
+`), sources.map((source) => source.id));
+  return [index, ...fragments];
+}
+function buildFlattenedMarkdownFiles(targetHome, adapter, profile, sources) {
+  const content = [
+    indexHeader(adapter.tool, profile),
+    ...sources.flatMap((source) => [
+      sectionForSource(source),
+      ...source.resolvedRules.map((rule) => sectionForRule(source, rule))
+    ])
+  ].join(`
+
+`);
+  return [
+    makeFile(targetHome, adapter.indexFile, "index", content, [
+      ...sources.map((source) => source.id),
+      ...sources.flatMap((source) => source.resolvedRules.map((rule) => rule.id))
+    ])
+  ];
+}
+function buildCursorRuleFiles(targetHome, adapter, sources) {
+  return sources.flatMap((source, index) => {
+    const n = String(index + 1).padStart(2, "0");
+    const stem = `${n}-${source.normalizedId}`;
+    const relativePath = posix.join(adapter.managedDir, `${stem}.mdc`);
+    const description = `${source.resolvedLabel} (${source.resolvedLayer})`;
+    const content = [
+      "---",
+      `description: ${yamlQuote2(description)}`,
+      'globs: ["**/*"]',
+      "alwaysApply: true",
+      "---",
+      "",
+      `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
+      "",
+      source.content.trim()
+    ].join(`
+`);
+    const sourceFile = makeFile(targetHome, relativePath, "rule", content, [source.id]);
+    const ruleFiles = source.resolvedRules.map((rule) => {
+      const ruleStem = `${n}-${source.normalizedId}-${rule.normalizedId}`;
+      const ruleRelativePath = posix.join(adapter.managedDir, `${ruleStem}.mdc`);
+      const ruleDescription = `${rule.resolvedLabel} (${source.resolvedLayer})`;
+      const ruleContent = [
+        "---",
+        `description: ${yamlQuote2(ruleDescription)}`,
+        `globs: ${JSON.stringify(rule.globs && rule.globs.length > 0 ? rule.globs : ["**/*"])}`,
+        "alwaysApply: true",
+        "---",
+        "",
+        `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
+        "",
+        rule.content.trim()
+      ].join(`
+`);
+      return makeFile(targetHome, ruleRelativePath, "rule", ruleContent, [source.id, rule.id]);
+    });
+    return [sourceFile, ...ruleFiles];
+  });
+}
+function buildOpenCodeFiles(targetHome, adapter, profile, sources) {
+  const fragments = sources.flatMap((source, index) => [
+    makeFile(targetHome, fragmentPath(adapter, index, source), "fragment", sectionForSource(source), [source.id]),
+    ...source.resolvedRules.map((rule) => makeFile(targetHome, ruleFragmentPath(adapter, source, rule), "rule", sectionForRule(source, rule), [source.id, rule.id]))
+  ]);
+  const flattenedIndex = makeFile(targetHome, adapter.indexFile, "index", [
+    indexHeader(adapter.tool, profile),
+    ...sources.flatMap((source) => [
+      sectionForSource(source),
+      ...source.resolvedRules.map((rule) => sectionForRule(source, rule))
+    ])
+  ].join(`
+
+`), [
+    ...sources.map((source) => source.id),
+    ...sources.flatMap((source) => source.resolvedRules.map((rule) => rule.id))
+  ]);
+  const config = {
+    $schema: "https://opencode.ai/config.json",
+    instructions: fragments.map((file) => file.relativePath)
+  };
+  return [
+    flattenedIndex,
+    makeFile(targetHome, adapter.configFile, "config", JSON.stringify(config, null, 2), sources.map((source) => source.id)),
+    ...fragments
+  ];
+}
+function buildFiles(targetHome, adapter, profile, sources) {
+  switch (adapter.mode) {
+    case "native-imports":
+      return buildNativeImportFiles(targetHome, adapter, profile, sources);
+    case "flattened-markdown":
+      return buildFlattenedMarkdownFiles(targetHome, adapter, profile, sources);
+    case "cursor-mdc":
+      return buildCursorRuleFiles(targetHome, adapter, sources);
+    case "opencode-instructions":
+      return buildOpenCodeFiles(targetHome, adapter, profile, sources);
+  }
+}
+function adapterFor(input) {
+  if (input.tool !== "codewith")
+    return SESSION_TOOL_ADAPTERS[input.tool];
+  const gatedNativeImports = input.codewithNativeImports === true || process.env[CODEWITH_NATIVE_IMPORTS_ENV] === "1" || process.env[CODEWITH_NATIVE_IMPORTS_ENV] === "true";
+  return gatedNativeImports ? CODEWITH_NATIVE_ADAPTER : CODEWITH_FLATTENED_ADAPTER;
+}
+function getHomeDir() {
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir3();
+}
+function cleanSessionPathInput(path) {
+  const trimmed = path.trim();
+  if (trimmed.length >= 2 && (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function resolveSessionPath(path) {
+  const cleaned = cleanSessionPathInput(path);
+  if (!cleaned)
+    throw new Error("Session render path cannot be empty.");
+  const home = getHomeDir();
+  if (cleaned === "~")
+    return resolve2(home);
+  if (cleaned.startsWith("~/"))
+    return resolve2(home, cleaned.slice(2));
+  if (cleaned === "{{HOME}}" || cleaned === "${HOME}")
+    return resolve2(home);
+  if (cleaned.startsWith("{{HOME}}/"))
+    return resolve2(home, cleaned.slice("{{HOME}}/".length));
+  if (cleaned.startsWith("${HOME}/"))
+    return resolve2(home, cleaned.slice("${HOME}/".length));
+  return resolve2(cleaned);
+}
+function assertSafeRelativePath(relativePath) {
+  if (!relativePath.trim())
+    throw new Error("Session render relative path cannot be empty.");
+  if (relativePath.includes("\\"))
+    throw new Error(`Session render relative path must use POSIX separators: ${relativePath}`);
+  const normalized = posix.normalize(relativePath);
+  if (normalized === "." || posix.isAbsolute(normalized) || normalized === ".." || normalized.startsWith("../")) {
+    throw new Error(`Session render relative path escapes target root: ${relativePath}`);
+  }
+  return normalized;
+}
+function assertSafeTargetRoot(targetHome) {
+  if (!isAbsolute(targetHome))
+    throw new Error(`Session render target must be an absolute path: ${targetHome}`);
+  const normalized = resolve2(targetHome);
+  if (normalized === parse(normalized).root) {
+    throw new Error(`Session render target cannot be the filesystem root: ${targetHome}`);
+  }
+  return normalized;
+}
+function resolveRenderTarget(input) {
+  if (input.tool === "cursor") {
+    if (!input.projectRoot) {
+      return {
+        targetHome: defaultTargetHome(input.tool, input.profile, input.sessionId),
+        targetKind: "blocked",
+        blockers: [
+          "Cursor rules are project-scoped; pass --project-root (or projectRoot) before applying .cursor/rules files. --target-home is not treated as a repository root for Cursor."
+        ]
+      };
+    }
+    return {
+      targetHome: resolveSessionPath(input.projectRoot),
+      targetKind: "project-root",
+      blockers: []
+    };
+  }
+  return {
+    targetHome: input.targetHome ? resolveSessionPath(input.targetHome) : defaultTargetHome(input.tool, input.profile, input.sessionId),
+    targetKind: "session-home",
+    blockers: []
+  };
+}
+function resolveSessionTargetOwnership(input, target) {
+  if (target.targetKind === "blocked") {
+    return {
+      kind: "blocked",
+      tool: input.tool,
+      profile: input.profile,
+      targetHome: target.targetHome,
+      projectRoot: input.projectRoot ? resolveSessionPath(input.projectRoot) : null,
+      ownedBy: "open-configs",
+      reason: "target resolution blocked before provider files can be owned"
+    };
+  }
+  if (target.targetKind === "project-root") {
+    return {
+      kind: "project",
+      tool: input.tool,
+      profile: input.profile,
+      targetHome: target.targetHome,
+      projectRoot: target.targetHome,
+      ownedBy: "open-configs",
+      reason: "project-scoped provider files are generated in the explicit repository root"
+    };
+  }
+  return {
+    kind: "provider-profile",
+    tool: input.tool,
+    profile: input.profile,
+    targetHome: target.targetHome,
+    projectRoot: null,
+    ownedBy: "open-configs",
+    reason: "profile-scoped provider home is generated by OpenConfigs from identity/config sources"
+  };
+}
+function planSessionRender(input) {
+  if (!SESSION_RENDER_TOOLS.includes(input.tool))
+    throw new Error(`Unsupported session render tool: ${input.tool}`);
+  if (!input.profile.trim())
+    throw new Error("Session render profile is required.");
+  const adapter = adapterFor(input);
+  const { targetHome, targetKind, blockers } = resolveRenderTarget(input);
+  const targetOwner = resolveSessionTargetOwnership(input, { targetHome, targetKind });
+  const blocked = blockers.length > 0;
+  const allowEmptySources = input.allowEmptySources === true;
+  const orderedSources = composeSources(normalizeSources(input.sources, input.tool, allowEmptySources));
+  if (orderedSources.length === 0 && !allowEmptySources) {
+    throw new Error("Session render has no instruction sources. Pass --allow-empty-sources only for explicit empty renders.");
+  }
+  const generatedAt = input.generatedAt ?? new Date().toISOString();
+  const env = adapter.envVar && !blocked ? { [adapter.envVar]: targetHome } : {};
+  const warnings = [
+    ...orderedSources.length === 0 ? ["No instruction sources were provided."] : [],
+    ...blockers
+  ];
+  const files = blocked ? [] : buildFiles(targetHome, adapter, input.profile, orderedSources);
+  rejectDuplicateRenderPaths(files);
+  const manifest = {
+    schema: SESSION_RENDER_SCHEMA,
+    tool: input.tool,
+    adapterMode: adapter.mode,
+    profile: input.profile,
+    sessionId: input.sessionId ?? null,
+    targetHome,
+    targetKind,
+    targetOwner,
+    writable: !blocked,
+    blocked,
+    blockers,
+    generatedAt,
+    env,
+    sourceHash: fingerprint(orderedSources.map((source) => ({
+      id: source.id,
+      layer: source.resolvedLayer,
+      order: source.resolvedOrder,
+      merge: source.resolvedMerge,
+      content: source.content,
+      rules: source.resolvedRules.map((rule) => ({ id: rule.id, path: rule.resolvedPath, content: rule.content })),
+      hash: source.hash ?? null
+    }))),
+    sources: orderedSources.map((source) => ({
+      id: source.id,
+      label: source.resolvedLabel,
+      layer: source.resolvedLayer,
+      merge: source.resolvedMerge,
+      order: source.resolvedOrder,
+      path: source.path ?? null,
+      targetProviders: source.targetProviders ?? [],
+      owner: source.owner ?? null,
+      sourcePaths: source.sourcePaths ?? [],
+      hash: source.hash ?? null,
+      nonOverridable: source.nonOverridable === true,
+      replacementScope: source.replacementScope ?? null,
+      rules: source.resolvedRules.map((rule) => ({
+        id: rule.id,
+        label: rule.resolvedLabel,
+        path: rule.resolvedPath,
+        globs: rule.globs ?? [],
+        hash: rule.hash ?? null
+      })),
+      provenance: source.provenance ?? null
+    })),
+    skippedSources: [],
+    files: files.map((file) => ({
+      path: file.path,
+      relativePath: file.relativePath,
+      role: file.role,
+      sha256: file.sha256,
+      sourceIds: file.sourceIds
+    })),
+    warnings
+  };
+  const manifestFile = makeFile(targetHome, posix.join(".hasna", "session-render-manifest.json"), "manifest", JSON.stringify(manifest, null, 2), orderedSources.map((source) => source.id));
+  return {
+    dryRun: true,
+    tool: input.tool,
+    adapter,
+    profile: input.profile,
+    sessionId: input.sessionId ?? null,
+    targetHome,
+    targetKind,
+    targetOwner,
+    writable: !blocked,
+    blocked,
+    blockers,
+    env,
+    files,
+    manifest,
+    manifestFile,
+    allFiles: [...files, manifestFile],
+    warnings
+  };
+}
+function sourceFromFilePath(path, content, order = 0) {
+  const file = basename3(path);
+  return {
+    id: file.replace(extname2(file), ""),
+    label: file,
+    content,
+    layer: "agent",
+    order,
+    path
+  };
+}
+function sourceFromConfig(config, order = 0, layer) {
+  return {
+    id: config.slug,
+    label: config.name,
+    content: config.content,
+    layer: layer ?? (config.agent === "global" ? "global" : "agent"),
+    order,
+    path: config.target_path ?? undefined,
+    provenance: {
+      source: "open-configs",
+      configSlug: config.slug,
+      configAgent: config.agent
+    }
+  };
+}
+function sourcesFromIdentityExport(value, options = {}) {
+  const record = asRecord(value, "identity instruction export");
+  const shape = requireIdentityExportShape(record);
+  const validation = asOptionalRecord(record["validation"]);
+  if (validation && validation["valid"] === false) {
+    const issues = Array.isArray(validation["issues"]) ? validation["issues"] : [];
+    throw new Error(`Identity instruction export is invalid: ${JSON.stringify(issues)}`);
+  }
+  const sources = record["sources"];
+  if (!Array.isArray(sources))
+    throw new Error("Identity instruction export sources must be an array.");
+  const offset = options.orderOffset ?? 0;
+  return sources.map((item, index) => identitySourceToSessionSource(item, {
+    path: options.path,
+    tool: options.tool,
+    orderFallback: offset + index,
+    exportShape: shape
+  })).filter((source) => source !== null);
+}
+function requireIdentityExportShape(record) {
+  if (record["contract"] === "hasna.identities.configs-instructions/v1")
+    return "configs-contract";
+  if (record["version"] === 1 && record["package"] === "@hasna/identities")
+    return "canonical-open-identities";
+  throw new Error("Unsupported identity instruction export contract.");
+}
+function normalizeInstructionRules(source, tool) {
+  const seen = new Set;
+  return (source.rules ?? []).map((rule) => {
+    if (!rule.id.trim())
+      throw new Error(`Instruction rule id is required for source ${source.id}.`);
+    const content = filterProviderOnlyBlocks(rule.content ?? "", tool);
+    if (!content.trim() && !rule.path)
+      throw new Error(`Instruction rule content or path is required for rule ${rule.id}.`);
+    const resolvedPath = normalizeRulePath(rule.path ?? `${slug(rule.id)}.md`);
+    const key = resolvedPath.toLowerCase();
+    if (seen.has(key))
+      throw new Error(`Duplicate rule path for source ${source.id}: ${resolvedPath}`);
+    seen.add(key);
+    return {
+      ...rule,
+      content,
+      normalizedId: slug(rule.id),
+      resolvedLabel: rule.label ?? rule.id,
+      resolvedPath
+    };
+  });
+}
+function rejectDuplicateRenderPaths(files) {
+  const seen = new Set;
+  for (const file of files) {
+    const key = file.relativePath.toLowerCase();
+    if (seen.has(key))
+      throw new Error(`Duplicate session render file path: ${file.relativePath}`);
+    seen.add(key);
+  }
+}
+function rejectDuplicateSourceSlugs(sources) {
+  const seen = new Map;
+  for (const source of sources) {
+    const existing = seen.get(source.normalizedId);
+    if (existing)
+      throw new Error(`Duplicate session instruction source slug: ${source.normalizedId} (${existing}, ${source.id})`);
+    seen.set(source.normalizedId, source.id);
+  }
+}
+function rejectDuplicateRulePaths(sources) {
+  const seen = new Map;
+  for (const source of sources) {
+    for (const rule of source.resolvedRules) {
+      const key = rule.resolvedPath.toLowerCase();
+      const existing = seen.get(key);
+      if (existing)
+        throw new Error(`Duplicate instruction rule path: ${rule.resolvedPath} (${existing}, ${rule.id})`);
+      seen.set(key, rule.id);
+    }
+  }
+}
+function normalizeRulePath(path) {
+  if (!path.trim())
+    throw new Error("Instruction rule path cannot be empty.");
+  if (path.includes("\\"))
+    throw new Error(`Instruction rule path must use POSIX separators: ${path}`);
+  const normalized = posix.normalize(path);
+  if (normalized === "." || posix.isAbsolute(normalized) || normalized === ".." || normalized.startsWith("../")) {
+    throw new Error(`Instruction rule path escapes managed rule directory: ${path}`);
+  }
+  return normalized;
+}
+function identitySourceToSessionSource(value, options) {
+  const record = asRecord(value, "identity instruction source");
+  const providers = asStringArray(record["targetProviders"]);
+  if (options.tool && providers.length > 0 && !providerTargetsTool(providers, options.tool))
+    return null;
+  const sourcePaths = normalizeSourcePaths(record["sourcePaths"]);
+  const kind = maybeString(record["kind"]);
+  const layer = record["layer"] === undefined ? layerFromIdentityKind(kind, options.exportShape) : requireLayer(record["layer"]);
+  const merge = requireMerge(record["merge"] ?? record["mergePolicy"] ?? "append");
+  const id = requireString(record["id"], "identity instruction source id");
+  const inlineContent = maybeString(record["content"]);
+  const resolvedContent = inlineContent && inlineContent.trim() ? inlineContent : contentFromIdentitySourcePaths(sourcePaths, options.path, id) ?? inlineContent;
+  return {
+    id,
+    label: maybeString(record["label"]) ?? maybeString(record["title"]) ?? id,
+    layer,
+    merge,
+    order: typeof record["order"] === "number" ? record["order"] : typeof record["precedence"] === "number" ? record["precedence"] : options.orderFallback,
+    content: resolvedContent ?? "",
+    path: options.path,
+    rules: normalizeIdentityRules(record["rules"]),
+    provenance: asOptionalRecord(record["provenance"]) ?? null,
+    targetProviders: providers,
+    owner: normalizeIdentityOwner(record["owner"]),
+    sourcePaths,
+    globs: asStringArray(record["globs"]),
+    hash: maybeString(record["hash"]),
+    nonOverridable: record["nonOverridable"] === true,
+    replacementScope: maybeString(record["replacementScope"]),
+    metadata: asOptionalRecord(record["metadata"]) ?? null
+  };
+}
+function layerFromIdentityKind(kind, exportShape) {
+  if (!kind) {
+    if (exportShape === "configs-contract")
+      throw new Error("Invalid session instruction layer: undefined");
+    return "agent";
+  }
+  switch (kind) {
+    case "global-rules":
+    case "global-system-prompt":
+      return "global";
+    case "provider-rules":
+    case "provider-system-prompt":
+      return "tool";
+    case "identity-doc":
+    case "persona-doc":
+      return "agent";
+    case "account-overlay":
+      return "account";
+    case "project-overlay":
+      return "project";
+    case "machine-overlay":
+    case "session-overlay":
+      return "local";
+    default:
+      throw new Error(`Invalid identity instruction source kind: ${kind}`);
+  }
+}
+function contentFromIdentitySourcePaths(sourcePaths, exportPath, sourceId) {
+  if (sourcePaths.length === 0 || !exportPath)
+    return;
+  const baseDir = dirname2(resolveSessionPath(exportPath));
+  const contents = [];
+  for (const sourcePath of sourcePaths) {
+    const content = readIdentitySourcePath(sourcePath, baseDir, sourceId);
+    if (content !== undefined)
+      contents.push({ path: sourcePath.path, content });
+  }
+  if (contents.length === 0)
+    return;
+  if (contents.length === 1)
+    return ensureTrailingNewline2(contents[0].content);
+  return ensureTrailingNewline2(contents.map((item) => `<!-- Source path: ${item.path} -->
+${item.content.trimEnd()}`).join(`
+
+`));
+}
+function readIdentitySourcePath(sourcePath, baseDir, sourceId) {
+  const resolvedPath = resolveIdentitySourcePath(sourcePath.path, baseDir, sourceId);
+  if (!existsSync5(resolvedPath)) {
+    if (sourcePath.required) {
+      throw new Error(`Required identity instruction source path not found for ${sourceId}: ${sourcePath.path}`);
+    }
+    return;
+  }
+  const stat = statSync2(resolvedPath);
+  if (!stat.isFile()) {
+    throw new Error(`Identity instruction source path is not a file for ${sourceId}: ${sourcePath.path}`);
+  }
+  const realBase = realpathSync2(baseDir);
+  const realPath = realpathSync2(resolvedPath);
+  if (!pathIsInside(realPath, realBase)) {
+    throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${sourcePath.path}`);
+  }
+  return readFileSync3(realPath, "utf-8");
+}
+function resolveIdentitySourcePath(path, baseDir, sourceId) {
+  const cleaned = cleanSessionPathInput(path);
+  if (!cleaned)
+    throw new Error(`Identity instruction source path cannot be empty for ${sourceId}.`);
+  if (cleaned.includes("\\"))
+    throw new Error(`Identity instruction source path must use POSIX separators for ${sourceId}: ${path}`);
+  const resolvedPath = isAbsolute(cleaned) ? resolve2(cleaned) : resolve2(baseDir, cleaned);
+  if (!pathIsInside(resolvedPath, resolve2(baseDir))) {
+    throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${path}`);
+  }
+  return resolvedPath;
+}
+function pathIsInside(path, baseDir) {
+  const rel = relative(baseDir, path);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function providerTargetsTool(targets, tool) {
+  return targets.map((target) => target.toLowerCase()).some((target) => target === tool || target === "all" || target === "generic");
+}
+function normalizeIdentityRules(value) {
+  if (value === undefined || value === null)
+    return [];
+  if (!Array.isArray(value))
+    throw new Error("Identity instruction source rules must be an array.");
+  return value.map((item) => {
+    const record = asRecord(item, "identity instruction rule");
+    const id = requireString(record["id"], "identity instruction rule id");
+    return {
+      id,
+      label: maybeString(record["label"]) ?? id,
+      path: maybeString(record["path"]),
+      content: maybeString(record["content"]) ?? "",
+      globs: asStringArray(record["globs"]),
+      hash: maybeString(record["hash"]),
+      metadata: asOptionalRecord(record["metadata"]) ?? null
+    };
+  });
+}
+function normalizeIdentityOwner(value) {
+  if (value === undefined || value === null)
+    return null;
+  const record = asRecord(value, "identity instruction owner");
+  return {
+    kind: requireString(record["kind"], "identity instruction owner kind"),
+    id: requireString(record["id"], "identity instruction owner id")
+  };
+}
+function normalizeSourcePaths(value) {
+  if (value === undefined || value === null)
+    return [];
+  if (!Array.isArray(value))
+    throw new Error("Identity instruction source paths must be an array.");
+  return value.map((item) => {
+    const record = asRecord(item, "identity instruction source path");
+    return {
+      path: requireString(record["path"], "identity instruction source path"),
+      editable: record["editable"] === true,
+      required: record["required"] === true,
+      hash: maybeString(record["hash"])
+    };
+  });
+}
+function requireLayer(value) {
+  if (value === "global" || value === "tool" || value === "account" || value === "agent" || value === "project" || value === "local")
+    return value;
+  throw new Error(`Invalid session instruction layer: ${String(value)}`);
+}
+function requireMerge(value) {
+  if (value === "append" || value === "replace")
+    return value;
+  throw new Error(`Invalid session instruction merge policy: ${String(value)}`);
+}
+function asRecord(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`Invalid ${label}.`);
+  return value;
+}
+function asOptionalRecord(value) {
+  if (value === undefined || value === null)
+    return null;
+  return asRecord(value, "record");
+}
+function maybeString(value) {
+  return typeof value === "string" ? value : undefined;
+}
+function requireString(value, label) {
+  if (typeof value !== "string" || !value.trim())
+    throw new Error(`Invalid ${label}.`);
+  return value;
+}
+function asStringArray(value) {
+  if (value === undefined || value === null)
+    return [];
+  if (!Array.isArray(value))
+    return [];
+  return value.filter((item) => typeof item === "string");
+}
+// src/lib/session-apply.ts
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import {
+  existsSync as existsSync6,
+  lstatSync,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync4,
+  renameSync,
+  rmSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join4, parse as parse2, relative as relative2, resolve as resolve3 } from "path";
+class SessionApplyError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SessionApplyError";
+  }
+}
+function applySessionRender(plan, options = {}) {
+  if (plan.blocked || !plan.writable) {
+    throw new SessionApplyError(`Session render plan is blocked: ${plan.blockers.join("; ")}`);
+  }
+  const targetHome = assertSafeTargetHome(plan.targetHome);
+  const files = [...plan.files, plan.manifestFile];
+  const manifestPath = resolvePlannedFilePath(plan, plan.manifestFile, targetHome);
+  const previousManifest = readPreviousManifest(manifestPath);
+  const previousHashes = previousManifest ? new Map(previousManifest.files.map((file) => [file.relativePath, file.sha256])) : new Map;
+  const currentRelativePaths = new Set(files.map((file) => file.relativePath));
+  const drift = checkSessionRenderDrift(targetHome, manifestPath);
+  const results = [
+    ...files.map((file) => planFileResult(plan, file, targetHome, previousHashes, previousManifest, options)),
+    ...planStaleFileResults(plan, targetHome, previousManifest, currentRelativePaths, options)
+  ];
+  const conflicts = results.filter((result) => result.action === "conflict");
+  if (conflicts.length > 0) {
+    return {
+      dryRun: options.dryRun ?? false,
+      applied: false,
+      targetHome,
+      manifestPath,
+      snapshotPath: null,
+      env: plan.env,
+      files: results,
+      conflicts,
+      drift
+    };
+  }
+  let snapshotPath = null;
+  if (!options.dryRun) {
+    snapshotPath = writeSessionSnapshot(plan, targetHome, manifestPath, results, previousManifest);
+    for (const file of files) {
+      const target = resolvePlannedFilePath(plan, file, targetHome);
+      const existingContent = existsSync6(target) ? readFileSync4(target, "utf-8") : null;
+      if (existingContent === file.content)
+        continue;
+      writePlannedFile(target, file.content, targetHome);
+    }
+    for (const result of results) {
+      if (result.action !== "delete")
+        continue;
+      assertNoSymlinkSegments(targetHome, result.path);
+      if (existsSync6(result.path))
+        rmSync(result.path);
+    }
+  }
+  return {
+    dryRun: options.dryRun ?? false,
+    applied: !(options.dryRun ?? false),
+    targetHome,
+    manifestPath,
+    snapshotPath,
+    env: plan.env,
+    files: results,
+    conflicts,
+    drift
+  };
+}
+function checkSessionRenderDrift(targetHome, manifestPath) {
+  const safeTargetHome = assertSafeTargetHome(targetHome);
+  const resolvedManifestPath = manifestPath ? resolveManifestRelativePath(relative2(safeTargetHome, resolve3(manifestPath)), safeTargetHome) : resolve3(safeTargetHome, ".hasna", "session-render-manifest.json");
+  const checkedAt = new Date().toISOString();
+  const previousManifest = readPreviousManifest(resolvedManifestPath);
+  if (!previousManifest) {
+    return {
+      checked: false,
+      clean: true,
+      manifestPath: resolvedManifestPath,
+      checkedAt,
+      missing: [],
+      drifted: []
+    };
+  }
+  const missing = [];
+  const drifted = [];
+  for (const file of previousManifest.files) {
+    const target = resolveManifestRelativePath(file.relativePath, safeTargetHome);
+    if (!existsSync6(target)) {
+      missing.push({
+        path: target,
+        relativePath: file.relativePath,
+        expectedSha256: file.sha256,
+        actualSha256: null,
+        reason: "missing"
+      });
+      continue;
+    }
+    const actualSha256 = sha2562(readFileSync4(target, "utf-8"));
+    if (actualSha256 !== file.sha256) {
+      drifted.push({
+        path: target,
+        relativePath: file.relativePath,
+        expectedSha256: file.sha256,
+        actualSha256,
+        reason: "hash_mismatch"
+      });
+    }
+  }
+  return {
+    checked: true,
+    clean: missing.length === 0 && drifted.length === 0,
+    manifestPath: resolvedManifestPath,
+    checkedAt,
+    missing,
+    drifted
+  };
+}
+function planFileResult(plan, file, targetHome, previousHashes, previousManifest, options) {
+  const target = resolvePlannedFilePath(plan, file, targetHome);
+  const previousContent = existsSync6(target) ? readFileSync4(target, "utf-8") : null;
+  const previousSha256 = previousContent === null ? null : sha2562(previousContent);
+  const previouslyManaged = isPreviouslyManaged(file, previousSha256, previousHashes, previousManifest);
+  const changed = previousContent !== file.content;
+  if (previousContent !== null && !options.force && !previouslyManaged) {
+    return {
+      path: target,
+      relativePath: file.relativePath,
+      role: file.role,
+      action: "conflict",
+      changed,
+      previousSha256,
+      newSha256: file.sha256,
+      reason: "existing unmanaged file; pass force to overwrite or adopt"
+    };
+  }
+  if (!changed && options.force && !previouslyManaged) {
+    return {
+      path: target,
+      relativePath: file.relativePath,
+      role: file.role,
+      action: "update",
+      changed: false,
+      previousSha256,
+      newSha256: file.sha256,
+      reason: "force"
+    };
+  }
+  if (!changed) {
+    return {
+      path: target,
+      relativePath: file.relativePath,
+      role: file.role,
+      action: "unchanged",
+      changed: false,
+      previousSha256,
+      newSha256: file.sha256,
+      reason: null
+    };
+  }
+  if (previousContent === null) {
+    return {
+      path: target,
+      relativePath: file.relativePath,
+      role: file.role,
+      action: "create",
+      changed: true,
+      previousSha256,
+      newSha256: file.sha256,
+      reason: null
+    };
+  }
+  if (options.force || previouslyManaged) {
+    return {
+      path: target,
+      relativePath: file.relativePath,
+      role: file.role,
+      action: "update",
+      changed: true,
+      previousSha256,
+      newSha256: file.sha256,
+      reason: options.force ? "force" : "previous manifest hash matched"
+    };
+  }
+  return {
+    path: target,
+    relativePath: file.relativePath,
+    role: file.role,
+    action: "conflict",
+    changed: true,
+    previousSha256,
+    newSha256: file.sha256,
+    reason: "existing unmanaged file differs; pass force to overwrite"
+  };
+}
+function planStaleFileResults(plan, targetHome, previousManifest, currentRelativePaths, options) {
+  if (!previousManifest)
+    return [];
+  const managedPrefix = `${plan.adapter.managedDir}/`;
+  return previousManifest.files.filter((file) => !currentRelativePaths.has(file.relativePath)).filter((file) => file.relativePath === plan.adapter.managedDir || file.relativePath.startsWith(managedPrefix)).map((file) => planStaleFileResult(file, targetHome, options)).filter((result) => result !== null);
+}
+function planStaleFileResult(file, targetHome, options) {
+  const target = resolveManifestRelativePath(file.relativePath, targetHome);
+  if (!existsSync6(target))
+    return null;
+  const previousContent = readFileSync4(target, "utf-8");
+  const previousSha256 = sha2562(previousContent);
+  if (!options.force && previousSha256 !== file.sha256) {
+    return {
+      path: target,
+      relativePath: file.relativePath,
+      role: file.role,
+      action: "conflict",
+      changed: true,
+      previousSha256,
+      newSha256: "",
+      reason: "stale managed file changed since previous manifest; pass force to remove"
+    };
+  }
+  if (!options.force && !previousContent.includes(SESSION_RENDER_MANAGED_MARKER)) {
+    return {
+      path: target,
+      relativePath: file.relativePath,
+      role: file.role,
+      action: "conflict",
+      changed: true,
+      previousSha256,
+      newSha256: "",
+      reason: "stale file lacks managed marker; pass force to remove"
+    };
+  }
+  return {
+    path: target,
+    relativePath: file.relativePath,
+    role: file.role,
+    action: "delete",
+    changed: true,
+    previousSha256,
+    newSha256: "",
+    reason: "stale managed file removed"
+  };
+}
+function isPreviouslyManaged(file, previousSha256, previousHashes, previousManifest) {
+  if (file.role === "manifest")
+    return previousManifest !== null;
+  if (!previousSha256)
+    return false;
+  return previousHashes.get(file.relativePath) === previousSha256;
+}
+function resolvePlannedFilePath(plan, file, targetHome) {
+  const target = resolve3(targetHome, ...file.relativePath.split("/"));
+  const rel = relative2(targetHome, target);
+  if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute2(rel)) {
+    throw new SessionApplyError(`Session file escapes target home: ${file.relativePath}`);
+  }
+  if (resolve3(file.path) !== target) {
+    throw new SessionApplyError(`Session file path mismatch for ${file.relativePath}: ${file.path}`);
+  }
+  assertNoSymlinkSegments(targetHome, target);
+  return target;
+}
+function resolveManifestRelativePath(relativePath, targetHome) {
+  const target = resolve3(targetHome, ...relativePath.split(/[\\/]+/));
+  const rel = relative2(targetHome, target);
+  if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute2(rel)) {
+    throw new SessionApplyError(`Session manifest file escapes target home: ${relativePath}`);
+  }
+  assertNoSymlinkSegments(targetHome, target);
+  return target;
+}
+function readPreviousManifest(path) {
+  if (!existsSync6(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync4(path, "utf-8"));
+    if (parsed.schema !== SESSION_RENDER_SCHEMA)
+      return null;
+    if (!Array.isArray(parsed.files))
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function writePlannedFile(path, content, targetHome) {
+  const dir = dirname3(path);
+  mkdirSync3(dir, { recursive: true });
+  assertNoSymlinkSegments(targetHome, path);
+  const tmp = join4(dir, `.session-${randomUUID2()}.tmp`);
+  writeFileSync2(tmp, content, "utf-8");
+  renameSync(tmp, path);
+}
+function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousManifest) {
+  const existingFiles = results.filter((result) => result.action === "update" || result.action === "delete").filter((result) => existsSync6(result.path)).map((result) => {
+    const content = readFileSync4(result.path, "utf-8");
+    return {
+      path: result.path,
+      relativePath: result.relativePath,
+      role: result.role,
+      sha256: sha2562(content),
+      content
+    };
+  });
+  if (!previousManifest && existingFiles.length === 0)
+    return null;
+  const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const snapshotPath = resolve3(targetHome, ".hasna", "session-render-snapshots", `${timestamp}-${randomUUID2()}.json`);
+  const snapshot = {
+    schema: "hasna.configs.session-render-snapshot/v1",
+    createdAt: new Date().toISOString(),
+    tool: plan.tool,
+    profile: plan.profile,
+    targetHome,
+    manifestPath,
+    previousManifest,
+    files: existingFiles
+  };
+  writePlannedFile(snapshotPath, `${JSON.stringify(snapshot, null, 2)}
+`, targetHome);
+  return snapshotPath;
+}
+function assertSafeTargetHome(targetHome) {
+  if (!isAbsolute2(targetHome))
+    throw new SessionApplyError(`Session target home must be absolute: ${targetHome}`);
+  const normalized = resolve3(targetHome);
+  if (normalized === parse2(normalized).root) {
+    throw new SessionApplyError(`Session target home cannot be the filesystem root: ${targetHome}`);
+  }
+  assertNoSymlinkAncestors(normalized);
+  if (existsSync6(normalized) && lstatSync(normalized).isSymbolicLink()) {
+    throw new SessionApplyError(`Session target home cannot be a symlink: ${normalized}`);
+  }
+  return normalized;
+}
+function assertNoSymlinkSegments(root, target) {
+  assertNoSymlinkAncestors(root);
+  const rel = relative2(root, target);
+  let current = root;
+  for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
+    current = join4(current, segment);
+    if (existsSync6(current) && lstatSync(current).isSymbolicLink()) {
+      throw new SessionApplyError(`Session apply path uses a symlink: ${current}`);
+    }
+  }
+}
+function assertNoSymlinkAncestors(path) {
+  const normalized = resolve3(path);
+  const parsed = parse2(normalized);
+  let current = parsed.root;
+  const rel = relative2(parsed.root, normalized);
+  for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
+    current = join4(current, segment);
+    if (!existsSync6(current))
+      return;
+    if (lstatSync(current).isSymbolicLink()) {
+      throw new SessionApplyError(`Session apply path uses a symlink ancestor: ${current}`);
+    }
+  }
+}
+function sha2562(content) {
+  return createHash2("sha256").update(content).digest("hex");
+}
+// src/lib/project-dashboard-standard.ts
+var PROJECT_DASHBOARD_STANDARD_SLUG = "agent-managed-project-dashboard-standard";
+var PROJECT_DASHBOARD_PROFILE_VARIABLES = {
+  PROJECT_DASHBOARD_DIR: ".hasna/project",
+  PROJECT_DASHBOARD_RENDER_MANIFEST: ".hasna/project/dashboard/render.json",
+  PROJECT_DASHBOARD_SNAPSHOTS_DIR: ".hasna/project/dashboard/snapshots",
+  PROJECT_CHANNEL_PREFIX: "iproj-"
+};
+var PROJECT_DASHBOARD_STANDARD_CONTENT = `# Agent-Managed Project Dashboard Standard
+
+This standard applies to Hasna work projects under \`Workspace/<division>/project/<slug>\`.
+Humans do not work directly inside these folders; agents keep structure,
+evidence, tasks, knowledge, and dashboard output consistent.
+
+## Canonical Files
+
+- Project manifest root: \`.hasna/project/\`
+- Dashboard render manifest: \`.hasna/project/dashboard/render.json\`
+- Latest snapshot: \`.hasna/project/dashboard/snapshots/latest.snapshot.json\`
+- Dashboard schema ids come from \`@hasna/contracts\`.
+- Project folders may contain private documents, but render JSON must contain
+  only ids, counts, statuses, resource refs, evidence refs, and redacted
+  summaries.
+
+## Viewer Commands
+
+Use the Projects-owned viewer. Do not invent a separate per-project app unless
+\`open-projects\` cannot express the surface.
+
+\`\`\`bash
+projects dashboard snapshot <project> --write --json
+projects dashboard render <project> --json
+projects dashboard validate <project> --json
+PROJECTS_DASHBOARD_TOKEN=<token> projects dashboard serve <project> --host 0.0.0.0 --port <port>
+\`\`\`
+
+Non-loopback serving must use \`--token\`, \`PROJECTS_DASHBOARD_TOKEN\`, or an
+explicit \`--trust-network\` choice. Never put the token in a URL, task
+evidence, render spec, or report.
+
+## Provider Panels
+
+Provider CLIs emit bounded \`hasna.project_panel.v1\` summaries:
+
+\`\`\`bash
+todos project-panel --project <project> --json --contract
+files project-panel --project <project> --json --contract
+mailery project-panel --project <project> --limit 20 --json --contract
+conversations project-panel --project <project> --limit 30 --json --contract
+knowledge project-panel --project <project> --scope project --limit 30 --json --contract
+mementos --json project-panel --project <project> --contract
+reports project-panel --project <project> --json --contract
+\`\`\`
+
+Providers must degrade to unavailable/error panels instead of dumping raw
+content. Mailery is workspace-scoped until explicit project-email mapping is
+configured; Knowledge must run from the project cwd or with the correct store
+context.
+
+## Coordination
+
+- Project conversation channels use \`iproj-<project-slug>\` in the CLI and are
+  displayed to humans as \`#iproj-<project-slug>\`.
+- Todos tasks are the source of truth for work; messages are only coordination.
+- Durable Codewith goal plans should own long-running implementation.
+- New implementation/verification work should route through task-triggered fresh
+  agent runs, not by opening or pasting into existing tmux panes.
+- Agent handoff should reference task ids, project ids, commit ids, evidence
+  paths, and dashboard URLs without exposing secrets or raw private documents.
+
+## Report Rules
+
+Reports and dashboards should use JSON Render/React Flow through
+\`projects dashboard render\`. Include decisions, open questions, bank/document
+ids, tasks, and evidence refs. Exclude raw email bodies, account numbers, tax
+ids, passport numbers, credentials, and contract clauses unless an explicit
+approved storage policy exists.
+`;
+function ensureProjectDashboardStandardConfig(db) {
+  const input = {
+    name: "Agent Managed Project Dashboard Standard",
+    category: "workspace",
+    agent: "global",
+    format: "markdown",
+    content: PROJECT_DASHBOARD_STANDARD_CONTENT,
+    kind: "reference",
+    description: "Standard structure, provider commands, channel naming, and safety rules for agent-managed project dashboards",
+    tags: ["projects-dashboard", "agent-projects", "json-render"]
+  };
+  try {
+    const existing = getConfig(PROJECT_DASHBOARD_STANDARD_SLUG, db);
+    if (existing.content !== input.content || existing.description !== input.description || existing.category !== input.category || existing.agent !== input.agent || existing.format !== input.format || existing.kind !== input.kind) {
+      return updateConfig(existing.id, input, db);
+    }
+    return existing;
+  } catch {
+    return createConfig(input, db);
+  }
+}
+
+// src/lib/platform-profiles.ts
+var PLATFORM_PROFILE_PRESETS = [
+  {
+    name: "linux-arm64",
+    description: "Default Linux arm64 profile for linux-node-a/linux-node-b-style machines",
+    selectors: { os: ["linux"], arch: ["arm64"], hostnames: ["linux-node-a", "linux-node-b"] },
+    variables: {
+      WORKSPACE_ROOT: "{{HOME_DIR}}/workspace",
+      BUN_BIN_DIR: "{{HOME_DIR}}/.bun/bin",
+      BUN_PATH: "{{BUN_BIN_DIR}}/bun",
+      PATH_PREFIX: "{{BUN_BIN_DIR}}",
+      ...PROJECT_DASHBOARD_PROFILE_VARIABLES
+    }
+  },
+  {
+    name: "macos-arm64",
+    description: "Default macOS arm64 profile for macos-node-a/macos-node-b-style machines",
+    selectors: { os: ["macos"], arch: ["arm64"], hostnames: ["macos-node-a", "macos-node-b"] },
+    variables: {
+      WORKSPACE_ROOT: "{{HOME_DIR}}/Workspace",
+      BUN_BIN_DIR: "{{HOME_DIR}}/.bun/bin",
+      BUN_PATH: "/opt/homebrew/bin/bun",
+      PATH_PREFIX: "/opt/homebrew/bin:{{BUN_BIN_DIR}}",
+      ...PROJECT_DASHBOARD_PROFILE_VARIABLES
+    }
+  }
+];
+function ensurePlatformProfiles(db) {
+  const configs = listConfigs(undefined, db);
+  const ensured = [];
+  for (const preset of PLATFORM_PROFILE_PRESETS) {
+    let profile;
+    try {
+      profile = getProfile(preset.name, db);
+      if (!profileHasSelectors(profile) || Object.keys(profile.variables).length === 0) {
+        profile = updateProfile(profile.id, {
+          description: profile.description ?? preset.description,
+          selectors: profileHasSelectors(profile) ? profile.selectors : preset.selectors,
+          variables: Object.keys(profile.variables).length > 0 ? profile.variables : preset.variables
+        }, db);
+      }
+    } catch {
+      profile = createProfile(preset, db);
+    }
+    for (const config of configs) {
+      addConfigToProfile(profile.id, config.id, db);
+    }
+    ensured.push(profile);
+  }
+  return ensured;
+}
+// src/lib/sync.ts
+import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
+import { basename as basename4, extname as extname3, join as join6 } from "path";
+
+// src/lib/sync-dir.ts
+import { existsSync as existsSync7, readdirSync, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
+import { join as join5, relative as relative3 } from "path";
+import { homedir as homedir4 } from "os";
+var SKIP = [".db", ".db-shm", ".db-wal", ".log", ".lock", ".DS_Store", "node_modules", ".git"];
+function shouldSkip(p) {
+  return SKIP.some((s) => p.includes(s));
+}
+async function syncFromDir(dir, opts = {}) {
+  const d = opts.db || getDatabase();
+  const absDir = expandPath(dir);
+  if (!existsSync7(absDir))
+    return { added: 0, updated: 0, unchanged: 0, skipped: [`Not found: ${absDir}`] };
+  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync(absDir).map((f) => join5(absDir, f)).filter((f) => statSync3(f).isFile());
+  const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
+  const home = homedir4();
+  const allConfigs = listConfigs(undefined, d);
+  for (const file of files) {
+    if (shouldSkip(file)) {
+      result.skipped.push(file);
+      continue;
+    }
+    try {
+      const content = readFileSync5(file, "utf-8");
+      if (content.length > 500000) {
+        result.skipped.push(file + " (too large)");
+        continue;
+      }
+      const targetPath = file.replace(home, "~");
+      const existing = allConfigs.find((c) => c.target_path === targetPath);
+      if (!existing) {
+        if (!opts.dryRun)
+          createConfig({ name: relative3(absDir, file), category: detectCategory(file), agent: detectAgent(file), target_path: targetPath, format: detectFormat(file), content }, d);
+        result.added++;
+      } else if (existing.content !== content) {
+        if (!opts.dryRun)
+          updateConfig(existing.id, { content }, d);
+        result.updated++;
+      } else {
+        result.unchanged++;
+      }
+    } catch {
+      result.skipped.push(file);
+    }
+  }
+  return result;
+}
+async function syncToDir(dir, opts = {}) {
+  const d = opts.db || getDatabase();
+  const home = homedir4();
+  const absDir = expandPath(dir);
+  const normalized = dir.startsWith("~/") ? dir : absDir.replace(home, "~");
+  const configs = listConfigs(undefined, d).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
+  const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
+  for (const config of configs) {
+    if (config.kind === "reference")
+      continue;
+    try {
+      const r = await applyConfig(config, { dryRun: opts.dryRun, db: d });
+      r.changed ? result.updated++ : result.unchanged++;
+    } catch {
+      result.skipped.push(config.target_path || config.id);
+    }
+  }
+  return result;
+}
+function walkDir(dir, files = []) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join5(dir, entry.name);
+    if (shouldSkip(full))
+      continue;
+    if (entry.isDirectory())
+      walkDir(full, files);
+    else if (entry.isFile())
+      files.push(full);
+  }
+  return files;
+}
+
+// src/lib/sync.ts
+var CLAUDE_PROMPT_OUTPUTS = [
+  { agent: "codex", target_path: "~/.codex/AGENTS.md", transform: "codex-flat" },
+  { agent: "codewith", target_path: "~/.codewith/CODEWITH.md", transform: "codex-flat" },
+  { agent: "opencode", target_path: "~/.config/opencode/AGENTS.md", transform: "opencode-flat" },
+  { agent: "aicopilot", target_path: "~/.config/aicopilot/AGENTS.md", transform: "opencode-flat" },
+  { agent: "cursor", target_path: "~/.cursor/rules/claude.mdc", transform: "cursor-mdc" }
+];
+function claudeRuleOutputs(fileName) {
+  const stem = basename4(fileName, extname3(fileName));
+  return [
+    { agent: "cursor", target_path: `~/.cursor/rules/${stem}.mdc`, transform: "cursor-mdc" }
+  ];
+}
+function normalizeOutputs(outputs) {
+  return outputs ?? [];
+}
+function outputsEqual(a, b) {
+  return JSON.stringify(normalizeOutputs(a)) === JSON.stringify(normalizeOutputs(b));
+}
+function outputOwnerIdsByTarget(configs) {
+  const owners = new Map;
+  for (const config of configs) {
+    for (const output of config.outputs) {
+      const targetPath = normalizeTargetPath(output.target_path);
+      const existing = owners.get(targetPath) ?? new Set;
+      existing.add(config.id);
+      owners.set(targetPath, existing);
+    }
+  }
+  return owners;
+}
+function isGeneratedOutputTarget2(config, owners) {
+  if (!config.target_path)
+    return false;
+  const ownerIds = owners.get(normalizeTargetPath(config.target_path));
+  return !!ownerIds && !ownerIds.has(config.id);
+}
+function hasClaudePromptSource() {
+  return existsSync8(expandPath("~/.claude/CLAUDE.md"));
+}
+function hasClaudeRuleSourceForCursorTarget(targetPath) {
+  const absoluteTargetPath = expandPath(targetPath);
+  const absolutePrefix = expandPath("~/.cursor/rules");
+  if (!absoluteTargetPath.startsWith(`${absolutePrefix}/`) || !absoluteTargetPath.endsWith(".mdc"))
+    return false;
+  const stem = basename4(absoluteTargetPath, ".mdc");
+  return existsSync8(expandPath(`~/.claude/rules/${stem}.md`)) || existsSync8(expandPath(`~/.claude/rules/${stem}.mdc`));
+}
+function isKnownGeneratedTargetPath(targetPath) {
+  const normalizedTargetPath = normalizeTargetPath(targetPath);
+  const promptTargets = new Set(CLAUDE_PROMPT_OUTPUTS.map((output) => normalizeTargetPath(output.target_path)));
+  if (promptTargets.has(normalizedTargetPath))
+    return hasClaudePromptSource();
+  return hasClaudeRuleSourceForCursorTarget(targetPath);
+}
+var KNOWN_CONFIGS = [
+  { path: "~/.claude/CLAUDE.md", name: "claude-claude-md", category: "rules", agent: "claude", format: "markdown", outputs: CLAUDE_PROMPT_OUTPUTS },
+  { path: "~/.claude/settings.json", name: "claude-settings", category: "agent", agent: "claude", format: "json" },
+  { path: "~/.claude/settings.local.json", name: "claude-settings-local", category: "agent", agent: "claude", format: "json" },
+  { path: "~/.claude/keybindings.json", name: "claude-keybindings", category: "agent", agent: "claude", format: "json", optional: true },
+  { path: "~/.claude/rules", name: "claude-rules", category: "rules", agent: "claude", rulesDir: "~/.claude/rules", rulesExtensions: [".md", ".mdc"] },
+  { path: "~/.codex/config.toml", name: "codex-config", category: "agent", agent: "codex", format: "toml" },
+  { path: "~/.codex/AGENTS.md", name: "codex-agents-md", category: "rules", agent: "codex", format: "markdown" },
+  { path: "~/.config/opencode/AGENTS.md", name: "opencode-agents-md", category: "rules", agent: "opencode", format: "markdown", optional: true },
+  { path: "~/.config/opencode/opencode.json", name: "opencode-config", category: "mcp", agent: "opencode", format: "json", optional: true, description: "OpenCode config (includes Skills MCP server entries)" },
+  { path: "~/.cursor/rules", name: "cursor-rules", category: "rules", agent: "cursor", rulesDir: "~/.cursor/rules", rulesExtensions: [".md", ".mdc"] },
+  { path: "~/.cursor/mcp.json", name: "cursor-mcp", category: "mcp", agent: "cursor", format: "json", optional: true, description: "Cursor MCP config (includes Skills MCP server entries)" },
+  { path: "~/.codewith/CODEWITH.md", name: "codewith-codewith-md", category: "rules", agent: "codewith", format: "markdown", optional: true },
+  { path: "~/.codewith/config.toml", name: "codewith-config", category: "mcp", agent: "codewith", format: "toml", optional: true, description: "codewith config (Codex fork, includes Skills MCP server entries)" },
+  { path: "~/.config/aicopilot/AGENTS.md", name: "aicopilot-agents-md", category: "rules", agent: "aicopilot", format: "markdown", optional: true },
+  { path: "~/.config/aicopilot/opencode.json", name: "aicopilot-config", category: "mcp", agent: "aicopilot", format: "json", optional: true, description: "AI Copilot config (OpenCode fork, includes Skills MCP server entries)" },
+  { path: "~/.gemini/settings.json", name: "gemini-settings", category: "agent", agent: "gemini", format: "json" },
+  { path: "~/.gemini/GEMINI.md", name: "gemini-gemini-md", category: "rules", agent: "gemini", format: "markdown", optional: true },
+  { path: "~/.claude.json", name: "claude-json", category: "mcp", agent: "claude", format: "json", description: "Claude Code global config (includes MCP server entries)" },
+  { path: "~/.zshrc", name: "zshrc", category: "shell", agent: "zsh" },
+  { path: "~/.zprofile", name: "zprofile", category: "shell", agent: "zsh", optional: true },
+  { path: "~/.bashrc", name: "bashrc", category: "shell", agent: "zsh", optional: true },
+  { path: "~/.bash_profile", name: "bash-profile", category: "shell", agent: "zsh", optional: true },
+  { path: "~/.gitconfig", name: "gitconfig", category: "git", agent: "git", format: "ini" },
+  { path: "~/.gitignore_global", name: "gitignore-global", category: "git", agent: "git", optional: true },
+  { path: "~/.npmrc", name: "npmrc", category: "tools", agent: "npm", format: "ini" },
+  { path: "~/.bunfig.toml", name: "bunfig", category: "tools", agent: "global", format: "toml", optional: true }
+];
+var PROJECT_CONFIG_FILES = [
+  { file: "CLAUDE.md", category: "rules", agent: "claude", format: "markdown" },
+  { file: ".claude/settings.json", category: "agent", agent: "claude", format: "json" },
+  { file: ".claude/settings.local.json", category: "agent", agent: "claude", format: "json" },
+  { file: ".mcp.json", category: "mcp", agent: "claude", format: "json" },
+  { file: "AGENTS.md", category: "rules", agent: "codex", format: "markdown" },
+  { file: ".codex/AGENTS.md", category: "rules", agent: "codex", format: "markdown" },
+  { file: "GEMINI.md", category: "rules", agent: "gemini", format: "markdown" },
+  { file: ".opencode/AGENTS.md", category: "rules", agent: "opencode", format: "markdown" },
+  { file: ".codewith/CODEWITH.md", category: "rules", agent: "codewith", format: "markdown" },
+  { file: ".cursor/mcp.json", category: "mcp", agent: "cursor", format: "json" }
+];
+async function syncProject(opts) {
+  const d = opts.db || getDatabase();
+  const absDir = expandPath(opts.projectDir);
+  const projectName = absDir.split("/").pop() || "project";
+  const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
+  const allConfigs = listConfigs(undefined, d);
+  const machine = detectMachineContext();
+  for (const pf of PROJECT_CONFIG_FILES) {
+    const abs = join6(absDir, pf.file);
+    if (!existsSync8(abs))
+      continue;
+    try {
+      const rawContent = readFileSync6(abs, "utf-8");
+      if (rawContent.length > 500000) {
+        result.skipped.push(pf.file);
+        continue;
+      }
+      const redacted = redactContent(rawContent, pf.format);
+      const machineAware = templateizeMachineContent(redacted.content, machine);
+      const content = machineAware.content;
+      const isTemplate2 = redacted.isTemplate || machineAware.changed;
+      const name = `${projectName}/${pf.file}`;
+      const targetPath = abs.startsWith(getConfigHome()) ? abs.replace(getConfigHome(), "~") : abs;
+      const slug2 = name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+      const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === slug2);
+      if (!existing) {
+        if (!opts.dryRun)
+          createConfig({ name, category: pf.category, agent: pf.agent, format: pf.format, content, target_path: targetPath, is_template: isTemplate2 }, d);
+        result.added++;
+      } else if (existing.content !== content) {
+        if (!opts.dryRun)
+          updateConfig(existing.id, { content, is_template: isTemplate2 }, d);
+        result.updated++;
+      } else {
+        result.unchanged++;
+      }
+    } catch {
+      result.skipped.push(pf.file);
+    }
+  }
+  const rulesDir = join6(absDir, ".claude", "rules");
+  if (existsSync8(rulesDir)) {
+    const mdFiles = readdirSync2(rulesDir).filter((f) => f.endsWith(".md") || f.endsWith(".mdc"));
+    for (const f of mdFiles) {
+      const abs = join6(rulesDir, f);
+      const raw = readFileSync6(abs, "utf-8");
+      const redacted = redactContent(raw, "markdown");
+      const machineAware = templateizeMachineContent(redacted.content, machine);
+      const content = machineAware.content;
+      const isTemplate2 = redacted.isTemplate || machineAware.changed;
+      const name = `${projectName}/rules/${f}`;
+      const targetPath = abs.startsWith(getConfigHome()) ? abs.replace(getConfigHome(), "~") : abs;
+      const slug2 = name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+      const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === slug2);
+      if (!existing) {
+        if (!opts.dryRun)
+          createConfig({ name, category: "rules", agent: "claude", format: "markdown", content, target_path: targetPath, is_template: isTemplate2 }, d);
+        result.added++;
+      } else if (existing.content !== content) {
+        if (!opts.dryRun)
+          updateConfig(existing.id, { content, is_template: isTemplate2 }, d);
+        result.updated++;
+      } else {
+        result.unchanged++;
+      }
+    }
+  }
+  return result;
+}
+async function syncKnown(opts = {}) {
+  const d = opts.db || getDatabase();
+  const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
+  const home = getConfigHome();
+  const machine = detectMachineContext();
+  let targets = KNOWN_CONFIGS;
+  if (opts.agent)
+    targets = targets.filter((k) => k.agent === opts.agent);
+  if (opts.category)
+    targets = targets.filter((k) => k.category === opts.category);
+  const allConfigs = listConfigs(undefined, d);
+  const existingOutputOwners = outputOwnerIdsByTarget(allConfigs);
+  for (const known of targets) {
+    if (known.rulesDir) {
+      const absDir = expandPath(known.rulesDir);
+      if (!existsSync8(absDir)) {
+        result.skipped.push(known.rulesDir);
+        continue;
+      }
+      const extensions = known.rulesExtensions ?? [".md", ".mdc"];
+      const ruleFiles = readdirSync2(absDir).filter((f) => extensions.some((ext) => f.endsWith(ext)));
+      for (const f of ruleFiles) {
+        const abs2 = join6(absDir, f);
+        const targetPath = abs2.replace(home, "~");
+        if (existingOutputOwners.has(normalizeTargetPath(targetPath)) || isKnownGeneratedTargetPath(targetPath)) {
+          result.skipped.push(`${targetPath} (generated output)`);
+          continue;
+        }
+        const raw = readFileSync6(abs2, "utf-8");
+        const redacted = redactContent(raw, "markdown");
+        const machineAware = templateizeMachineContent(redacted.content, machine);
+        const content = machineAware.content;
+        const isTemplate2 = redacted.isTemplate || machineAware.changed;
+        const name = `${known.name}-${f}`;
+        const slug2 = name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+        const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === slug2);
+        const outputs = known.agent === "claude" ? claudeRuleOutputs(f) : known.outputs;
+        if (!existing) {
+          if (!opts.dryRun)
+            createConfig({ name, category: known.category, agent: known.agent, format: "markdown", content, target_path: targetPath, is_template: isTemplate2, outputs }, d);
+          result.added++;
+        } else if (existing.content !== content) {
+          if (!opts.dryRun)
+            updateConfig(existing.id, { content, is_template: isTemplate2, outputs }, d);
+          result.updated++;
+        } else if (!outputsEqual(existing.outputs, outputs)) {
+          if (!opts.dryRun)
+            updateConfig(existing.id, { outputs }, d);
+          result.updated++;
+        } else {
+          result.unchanged++;
+        }
+      }
+      continue;
+    }
+    const abs = expandPath(known.path);
+    if (!existsSync8(abs)) {
+      result.skipped.push(known.path);
+      continue;
+    }
+    try {
+      const rawContent = readFileSync6(abs, "utf-8");
+      if (rawContent.length > 500000) {
+        result.skipped.push(known.path + " (too large)");
+        continue;
+      }
+      const fmt = known.format ?? detectFormat(abs);
+      const redacted = redactContent(rawContent, fmt);
+      const machineAware = templateizeMachineContent(redacted.content, machine);
+      const content = machineAware.content;
+      const isTemplate2 = redacted.isTemplate || machineAware.changed;
+      const targetPath = abs.replace(home, "~");
+      if (existingOutputOwners.has(normalizeTargetPath(targetPath)) || isKnownGeneratedTargetPath(targetPath)) {
+        result.skipped.push(`${targetPath} (generated output)`);
+        continue;
+      }
+      const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === known.name);
+      if (!existing) {
+        if (!opts.dryRun) {
+          createConfig({
+            name: known.name,
+            category: known.category,
+            agent: known.agent,
+            format: fmt,
+            content,
+            target_path: known.kind === "reference" ? null : targetPath,
+            kind: known.kind ?? "file",
+            description: known.description,
+            is_template: isTemplate2,
+            outputs: known.outputs
+          }, d);
+        }
+        result.added++;
+      } else if (existing.content !== content) {
+        if (!opts.dryRun)
+          updateConfig(existing.id, { content, is_template: isTemplate2, outputs: known.outputs }, d);
+        result.updated++;
+      } else if (!outputsEqual(existing.outputs, known.outputs)) {
+        if (!opts.dryRun)
+          updateConfig(existing.id, { outputs: known.outputs }, d);
+        result.updated++;
+      } else {
+        result.unchanged++;
+      }
+    } catch {
+      result.skipped.push(known.path);
+    }
+  }
+  return result;
+}
+async function syncToDisk(opts = {}) {
+  const d = opts.db || getDatabase();
+  const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
+  const allFileConfigs = listConfigs({ kind: "file", ...opts.category ? { category: opts.category } : {} }, d);
+  const outputOwners = outputOwnerIdsByTarget(allFileConfigs);
+  let configs = allFileConfigs.filter((config) => {
+    return !isGeneratedOutputTarget2(config, outputOwners);
+  }).filter((config) => {
+    if (!opts.agent)
+      return true;
+    return config.agent === opts.agent || config.outputs.some((output) => output.agent === opts.agent);
+  });
+  for (const config of configs) {
+    if (!config.target_path && config.outputs.length === 0)
+      continue;
+    try {
+      const r = await applyConfig(config, { dryRun: opts.dryRun, db: d, outputAgent: opts.agent });
+      r.changed ? result.updated++ : result.unchanged++;
+    } catch {
+      result.skipped.push(config.target_path ?? config.id);
+    }
+  }
+  return result;
+}
+function buildDiff(expectedContent, targetPath) {
+  const path = expandPath(targetPath);
+  if (!existsSync8(path))
+    return `(file not found on disk: ${path})`;
+  const diskContent = readFileSync6(path, "utf-8");
+  if (diskContent === expectedContent)
+    return "(no diff \u2014 identical)";
+  const stored = expectedContent.split(`
+`);
+  const disk = diskContent.split(`
+`);
+  const lines = [`--- stored (DB)`, `+++ disk (${path})`];
+  const maxLen = Math.max(stored.length, disk.length);
+  for (let i = 0;i < maxLen; i++) {
+    const s = stored[i];
+    const dk = disk[i];
+    if (s === dk) {
+      if (s !== undefined)
+        lines.push(` ${s}`);
+    } else {
+      if (s !== undefined)
+        lines.push(`-${s}`);
+      if (dk !== undefined)
+        lines.push(`+${dk}`);
+    }
+  }
+  return lines.join(`
+`);
+}
+function diffConfig(config, opts = {}) {
+  if (!config.target_path && config.outputs.length === 0)
+    return "(reference \u2014 no target path)";
+  const diffs = [];
+  const db = opts.db || getDatabase();
+  const contextConfigs = config.outputs.length > 0 || config.target_path ? listConfigs(undefined, db) : [config];
+  if (isGeneratedOutputTarget2(config, outputOwnerIdsByTarget(contextConfigs))) {
+    return "(generated output \u2014 managed by fan-out)";
+  }
+  if (config.target_path) {
+    const diff = buildDiff(config.content, config.target_path);
+    if (!diff.includes("no diff"))
+      diffs.push(diff);
+  }
+  if (config.outputs.length > 0) {
+    for (const output of config.outputs) {
+      const expected = applyTransform(config, output, { configs: contextConfigs });
+      const diff = buildDiff(expected, output.target_path);
+      if (!diff.includes("no diff"))
+        diffs.push(diff);
+    }
+  }
+  return diffs.length > 0 ? diffs.join(`
+
+`) : "(no diff \u2014 identical)";
+}
+function detectCategory(filePath) {
+  const p = filePath.toLowerCase().replace(getConfigHome(), "~");
+  if (p.includes("/.claude/rules/") || p.includes("/.cursor/rules/") || p.endsWith("claude.md") || p.endsWith("agents.md") || p.endsWith("codewith.md") || p.endsWith("gemini.md") || p.endsWith(".mdc"))
+    return "rules";
+  if (p.includes("/.claude/") || p.includes("/.codex/") || p.includes("/.gemini/") || p.includes("/.cursor/") || p.includes("/.config/opencode/") || p.includes("/.codewith/") || p.includes("/.config/aicopilot/"))
+    return "agent";
+  if (p.includes(".mcp.json") || p.includes("mcp"))
+    return "mcp";
+  if (p.includes(".zshrc") || p.includes(".zprofile") || p.includes(".bashrc") || p.includes(".bash_profile"))
+    return "shell";
+  if (p.includes(".gitconfig") || p.includes(".gitignore"))
+    return "git";
+  if (p.includes(".npmrc") || p.includes("tsconfig") || p.includes("bunfig"))
+    return "tools";
+  if (p.includes(".secrets"))
+    return "secrets_schema";
+  return "tools";
+}
+function detectAgent(filePath) {
+  const p = filePath.toLowerCase().replace(getConfigHome(), "~");
+  if (p.includes("/.claude/") || p.endsWith("claude.md"))
+    return "claude";
+  if (p.includes("/.config/opencode/"))
+    return "opencode";
+  if (p.includes("/.cursor/") || p.endsWith(".mdc"))
+    return "cursor";
+  if (p.includes("/.codewith/") || p.endsWith("codewith.md"))
+    return "codewith";
+  if (p.includes("/.config/aicopilot/"))
+    return "aicopilot";
+  if (p.includes("/.codex/") || p.endsWith("agents.md"))
+    return "codex";
+  if (p.includes("/.gemini/") || p.endsWith("gemini.md"))
+    return "gemini";
+  if (p.includes(".zshrc") || p.includes(".zprofile") || p.includes(".bashrc"))
+    return "zsh";
+  if (p.includes(".gitconfig") || p.includes(".gitignore"))
+    return "git";
+  if (p.includes(".npmrc"))
+    return "npm";
+  return "global";
+}
+function detectFormat(filePath) {
+  const ext = extname3(filePath).toLowerCase();
+  if (ext === ".json")
+    return "json";
+  if (ext === ".toml")
+    return "toml";
+  if (ext === ".yaml" || ext === ".yml")
+    return "yaml";
+  if (ext === ".md" || ext === ".mdc" || ext === ".markdown")
+    return "markdown";
+  if (ext === ".ini" || ext === ".cfg")
+    return "ini";
+  return "text";
+}
+// src/lib/export.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join7, resolve as resolve4 } from "path";
+import { tmpdir } from "os";
+async function exportConfigs(outputPath, opts = {}) {
+  const d = opts.db || getDatabase();
+  const configs = listConfigs(opts.filter, d);
+  const absOutput = resolve4(outputPath);
+  const tmpDir = join7(tmpdir(), `configs-export-${Date.now()}`);
+  const contentsDir = join7(tmpDir, "contents");
+  try {
+    mkdirSync4(contentsDir, { recursive: true });
+    const manifest = {
+      version: "1.0.0",
+      exported_at: now(),
+      configs: configs.map(({ content: _content, ...meta }) => meta)
+    };
+    writeFileSync3(join7(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
+    for (const config of configs) {
+      const fileName = `${config.slug}.${config.format === "text" ? "txt" : config.format}`;
+      writeFileSync3(join7(contentsDir, fileName), config.content, "utf-8");
+    }
+    const proc = Bun.spawn(["tar", "czf", absOutput, "-C", tmpDir, "."], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exitCode = await proc.exited;
+    if (exitCode !== 0) {
+      const stderr = await new Response(proc.stderr).text();
+      throw new Error(`tar failed: ${stderr}`);
+    }
+    return { path: absOutput, count: configs.length };
+  } finally {
+    if (existsSync9(tmpDir)) {
+      rmSync2(tmpDir, { recursive: true, force: true });
+    }
+  }
+}
+// src/lib/import.ts
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
+import { join as join8, resolve as resolve5 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+async function importConfigs(bundlePath, opts = {}) {
+  const d = opts.db || getDatabase();
+  const conflict = opts.conflict ?? "skip";
+  const absPath = resolve5(bundlePath);
+  const tmpDir = join8(tmpdir2(), `configs-import-${Date.now()}`);
+  const result = { created: 0, updated: 0, skipped: 0, errors: [] };
+  try {
+    mkdirSync5(tmpDir, { recursive: true });
+    const proc = Bun.spawn(["tar", "xzf", absPath, "-C", tmpDir], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exitCode = await proc.exited;
+    if (exitCode !== 0) {
+      const stderr = await new Response(proc.stderr).text();
+      throw new Error(`tar extraction failed: ${stderr}`);
+    }
+    const manifestPath = join8(tmpDir, "manifest.json");
+    if (!existsSync10(manifestPath))
+      throw new Error("Invalid bundle: missing manifest.json");
+    const manifest = JSON.parse(readFileSync7(manifestPath, "utf-8"));
+    for (const meta of manifest.configs) {
+      try {
+        const ext = meta.format === "text" ? "txt" : meta.format;
+        const contentFile = join8(tmpDir, "contents", `${meta.slug}.${ext}`);
+        const content = existsSync10(contentFile) ? readFileSync7(contentFile, "utf-8") : "";
+        let existing = null;
+        try {
+          existing = getConfig(meta.slug, d);
+        } catch {}
+        if (existing) {
+          if (conflict === "skip") {
+            result.skipped++;
+          } else if (conflict === "overwrite" || conflict === "version") {
+            updateConfig(existing.id, { content, description: meta.description ?? undefined, tags: meta.tags, outputs: meta.outputs }, d);
+            result.updated++;
+          }
+        } else {
+          createConfig({
+            name: meta.name,
+            kind: meta.kind,
+            category: meta.category,
+            agent: meta.agent,
+            target_path: meta.target_path ?? undefined,
+            outputs: meta.outputs,
+            format: meta.format,
+            content,
+            description: meta.description ?? undefined,
+            tags: meta.tags,
+            is_template: meta.is_template
+          }, d);
+          result.created++;
+        }
+      } catch (err) {
+        result.errors.push(`${meta.slug}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    return result;
+  } finally {
+    if (existsSync10(tmpDir)) {
+      rmSync3(tmpDir, { recursive: true, force: true });
+    }
+  }
+}
+export {
+  uuid,
+  updateProfile,
+  updateMachineApplied,
+  updateConfig,
+  transformSkillContent,
+  templateizeMachineContent,
+  syncToDisk,
+  syncToDir,
+  syncProject,
+  syncKnown,
+  syncFromDir,
+  stripClaudeOnlySections,
+  storageSync,
+  storagePush,
+  storagePull,
+  sourcesFromIdentityExport,
+  sourceFromFilePath,
+  sourceFromConfig,
+  slugify,
+  scanSecrets,
+  runStorageMigrations,
+  resolveTables,
+  resolveSessionTargetOwnership,
+  resolveSessionPath,
+  resolveProfileVariables,
+  resolveProfileForMachine,
+  resetDatabase,
+  renderTemplate,
+  renderMachineAwareContent,
+  removeConfigFromProfile,
+  registerMachine,
+  redactContent,
+  pruneSnapshots,
+  profileMatchesMachine,
+  profileHasSelectors,
+  planSessionRender,
+  parseTemplateVars,
+  now,
+  normalizeOsFamily,
+  machineContextToVariables,
+  listSnapshots,
+  listProfiles,
+  listMachines,
+  listConfigs,
+  isTemplate,
+  isLocalPostgresHost,
+  importConfigs,
+  hasSecrets,
+  getSyncMetaAll,
+  getStorageSyncMetaAll,
+  getStorageStatus,
+  getStoragePg,
+  getStorageMode,
+  getStorageDatabaseUrl,
+  getStorageDatabaseEnvName,
+  getSnapshotByVersion,
+  getSnapshot,
+  getProfileConfigs,
+  getProfile,
+  getDatabase,
+  getConfigsStatus,
+  getConfigStats,
+  getConfigById,
+  getConfig,
+  extractTemplateVars,
+  exportConfigs,
+  expandPath,
+  ensureProjectDashboardStandardConfig,
+  ensurePlatformProfiles,
+  diffConfig,
+  detectMachineContext,
+  detectFormat,
+  detectCategory,
+  detectAgent,
+  deleteProfile,
+  deleteConfig,
+  currentOs,
+  currentHostname2 as currentHostname,
+  currentArch2 as currentArch,
+  createSnapshot,
+  createProfile,
+  createConfig,
+  cleanSessionPathInput,
+  checkSessionRenderDrift,
+  buildPgPoolConfig,
+  buildOpenCodeAgentsMd,
+  buildCursorMdc,
+  buildCodexAgentsMd,
+  applyTransform,
+  applySessionRender,
+  applyConfigs,
+  applyConfig,
+  addConfigToProfile,
+  TemplateRenderError,
+  SessionApplyError,
+  STORAGE_TABLES,
+  STORAGE_MODE_ENV,
+  STORAGE_DATABASE_ENV,
+  SESSION_TOOL_ADAPTERS,
+  SESSION_RENDER_TOOLS,
+  SESSION_RENDER_SCHEMA,
+  SESSION_RENDER_MANAGED_MARKER,
+  RAW_STORE_ROOT_ENV,
+  ProfileNotFoundError,
+  PgAdapterAsync,
+  PROJECT_DASHBOARD_STANDARD_SLUG,
+  PROJECT_DASHBOARD_STANDARD_CONTENT,
+  PROJECT_DASHBOARD_PROFILE_VARIABLES,
+  PROJECT_CONFIG_FILES,
+  PLATFORM_PROFILE_PRESETS,
+  PG_MIGRATIONS,
+  KNOWN_CONFIGS,
+  ConfigNotFoundError,
+  ConfigApplyError,
+  CONFIG_TRANSFORMS,
+  CONFIG_KINDS,
+  CONFIG_FORMATS,
+  CONFIG_CATEGORIES,
+  CONFIG_AGENTS,
+  CONFIGS_STORAGE_TABLES,
+  CONFIGS_STORAGE_MODE_FALLBACK_ENV,
+  CONFIGS_STORAGE_MODE_ENV,
+  CONFIGS_STORAGE_FALLBACK_ENV,
+  CONFIGS_STORAGE_ENV,
+  CODEWITH_NATIVE_IMPORTS_ENV
+};