@hasna/instructions 0.4.18 → 0.4.20

package/README.md

@@ -331,14 +331,22 @@ workflows:
 - `{{PROJECT_DASHBOARD_DIR}}` -> `.hasna/project`
 - `{{PROJECT_DASHBOARD_RENDER_MANIFEST}}` -> `.hasna/project/dashboard/render.json`
 - `{{PROJECT_DASHBOARD_SNAPSHOTS_DIR}}` -> `.hasna/project/dashboard/snapshots`
-- `{{PROJECT_CHANNEL_PREFIX}}` -> `iproj-`
+- `{{PROJECT_CHANNEL_PREFIX}}` -> `""` (no prefix; the channel is the normalized project slug)
+
+Existing profiles can be migrated in place without deleting or recreating them:
+
+```bash
+instructions profile update linux-arm64 \
+  --var PROJECT_CHANNEL_PREFIX= \
+  --unset-var LEGACY_VARIABLE
+```
 
 `instructions init` and `bun run seed` seed the
 `agent-managed-project-dashboard-standard` reference. It documents the standard
 `.hasna/project` layout, `projects dashboard *` commands, provider panel
-commands, `#iproj-*` channel naming, durable todos/goal workflow, and the rule
-that dashboards must show ids/statuses/evidence refs instead of raw private
-documents or secrets.
+commands, normalized project-slug channel naming, durable todos/goal workflow,
+and the rule that dashboards must show ids/statuses/evidence refs instead of raw
+private documents or secrets.
 
 ## License
 

package/dist/cli/add-reference-update.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=add-reference-update.test.d.ts.map

package/dist/cli/add-reference-update.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-reference-update.test.d.ts","sourceRoot":"","sources":["../../src/cli/add-reference-update.test.ts"],"names":[],"mappings":""}

package/dist/cli/doctor-reference-duplicates.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=doctor-reference-duplicates.test.d.ts.map

package/dist/cli/doctor-reference-duplicates.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-reference-duplicates.test.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-reference-duplicates.test.ts"],"names":[],"mappings":""}

package/dist/cli/index.js

@@ -10371,6 +10371,21 @@ function canonicalFingerprintValue(value) {
   }
   return value;
 }
+function ruleAttestation(rule) {
+  const metadata = rule.metadata ?? {};
+  const read = (key) => {
+    const value = metadata[key];
+    return typeof value === "string" ? value : null;
+  };
+  const applied = metadata["payloadFloorApplied"];
+  return {
+    contentSha256: sha2563(rule.content ?? ""),
+    payloadFloorApplied: typeof applied === "boolean" ? applied : null,
+    flooredFromRulesVersion: read("flooredFromRulesVersion"),
+    flooredFromPayloadSha256: read("flooredFromPayloadSha256"),
+    payloadIntegrity: read("payloadIntegrity")
+  };
+}
 function sourceFingerprint(source) {
   return {
     id: source.id,
@@ -10469,6 +10484,27 @@ function applyAgentOperatingRulesFloor(source, content) {
     metadata: { ...source.metadata ?? {}, ...payload.metadata, ...floored }
   };
 }
+function applyAgentOperatingRulesFloorToRule(source, rule, content) {
+  const unchanged = { content, metadata: rule.metadata ?? null };
+  if (!claimsAgentOperatingRulesPolicy(source, content))
+    return unchanged;
+  const payload = resolveAgentOperatingRulesPayload(content);
+  if (payload.content === content) {
+    return {
+      content,
+      metadata: { ...rule.metadata ?? {}, payloadIntegrity: payload.integrity }
+    };
+  }
+  const floored = {
+    payloadFloorApplied: true,
+    flooredFromRulesVersion: parseAgentOperatingRulesVersion(content),
+    flooredFromPayloadSha256: sha2563(content)
+  };
+  return {
+    content: payload.content,
+    metadata: { ...rule.metadata ?? {}, ...payload.metadata, ...floored }
+  };
+}
 function skippedSource(source, reason) {
   return {
     id: source.id,
@@ -10507,24 +10543,67 @@ function normalizeSources(sources, tool, allowEmptySources) {
   rejectDuplicateRulePaths(ordered);
   return { sources: ordered, skipped: deduplicated.skipped };
 }
+function semanticPolicyIntegrity(body) {
+  return sha2563(body) === AGENT_OPERATING_RULES_PAYLOAD_SHA256 ? "pinned-digest" : "unverified-self-declared";
+}
+function semanticPolicyDeclaration(source) {
+  const normalize = (value) => value.replace(/\r\n/g, `
+`).trim();
+  const sentinel = source.content.match(AGENT_OPERATING_RULES_SENTINEL_PATTERN);
+  if (sentinel) {
+    return {
+      version: sentinel[1],
+      normalizedContent: normalize(source.content),
+      integrity: semanticPolicyIntegrity(source.content)
+    };
+  }
+  for (const rule of source.resolvedRules) {
+    const body = rule.content ?? "";
+    if (!claimsAgentOperatingRulesPolicy(source, body))
+      continue;
+    const ruleSentinel = body.match(AGENT_OPERATING_RULES_SENTINEL_PATTERN);
+    if (!ruleSentinel)
+      continue;
+    return {
+      version: ruleSentinel[1],
+      normalizedContent: normalize(body),
+      integrity: semanticPolicyIntegrity(body)
+    };
+  }
+  return null;
+}
+function withoutSemanticPolicyPayloads(source) {
+  const content = AGENT_OPERATING_RULES_SENTINEL_PATTERN.test(source.content) ? "" : source.content;
+  const resolvedRules = source.resolvedRules.filter((rule) => {
+    const body = rule.content ?? "";
+    return !(AGENT_OPERATING_RULES_SENTINEL_PATTERN.test(body) && claimsAgentOperatingRulesPolicy(source, body));
+  });
+  const hasPathReferences = (source.sourcePaths ?? []).length > 0;
+  if (!content.trim() && resolvedRules.length === 0 && !hasPathReferences)
+    return null;
+  return { ...source, content, resolvedRules };
+}
 function deduplicateSemanticPolicySources(sources) {
   const selected = [];
   const skipped = [];
   const policySources = new Map;
-  const collapseReason = (winner, key) => `superseded by "${winner.id}": sources declaring the semantic policy ${key} collapse to one so a single instruction home cannot carry two rule-set versions`;
+  const collapseReason = (winner, key, partial, displacesVerified) => `superseded by "${winner.id}": sources declaring the semantic policy ${key} collapse to one so a single instruction home cannot carry two rule-set versions` + (partial ? "; only the policy payload was removed and this source's other instructions still render" : "") + (displacesVerified ? "; WARNING the surviving payload is unverified-self-declared and displaced a digest-verified one on its own version claim" : "");
+  const discard = (loser, winner, key, displacesVerified) => {
+    const remainder = withoutSemanticPolicyPayloads(loser);
+    skipped.push(skippedSource(loser, collapseReason(winner, key, remainder !== null, displacesVerified)));
+    return remainder;
+  };
   for (const source of sources) {
-    const sentinel = source.content.match(AGENT_OPERATING_RULES_SENTINEL_PATTERN);
-    if (!sentinel) {
+    const declaration = semanticPolicyDeclaration(source);
+    if (!declaration) {
       selected.push(source);
       continue;
     }
-    const version = sentinel[1];
+    const { version, normalizedContent, integrity } = declaration;
     const key = AGENT_OPERATING_RULES_SEMANTIC_POLICY_KEY;
-    const normalizedContent = source.content.replace(/\r\n/g, `
-`).trim();
     const existing = policySources.get(key);
     if (!existing) {
-      policySources.set(key, { index: selected.length, version, normalizedContent });
+      policySources.set(key, { index: selected.length, version, normalizedContent, integrity });
       selected.push(source);
       continue;
     }
@@ -10534,16 +10613,22 @@ function deduplicateSemanticPolicySources(sources) {
     }
     const current = selected[existing.index];
     const priorityOrder = semanticPolicySourcePriority(source) - semanticPolicySourcePriority(current);
-    if (priorityOrder < 0 || priorityOrder === 0 && versionOrder <= 0) {
-      skipped.push(skippedSource(source, collapseReason(current, key)));
+    const displacesVerified = existing.integrity === "pinned-digest" && integrity === "unverified-self-declared";
+    const arrivingWins = priorityOrder > 0 || priorityOrder === 0 && versionOrder > 0;
+    if (!arrivingWins) {
+      const remainder2 = discard(source, current, key, false);
+      if (remainder2)
+        selected.push(remainder2);
       continue;
     }
-    skipped.push(skippedSource(current, collapseReason(source, key)));
+    const remainder = discard(current, source, key, displacesVerified);
     selected[existing.index] = {
       ...source,
       resolvedOrder: current.resolvedOrder
     };
-    policySources.set(key, { index: existing.index, version, normalizedContent });
+    if (remainder)
+      selected.push(remainder);
+    policySources.set(key, { index: existing.index, version, normalizedContent, integrity });
   }
   return { selected, skipped };
 }
@@ -10551,7 +10636,7 @@ function semanticPolicySourcePriority(source) {
   let priority = 0;
   if (source.nonOverridable)
     priority += 4;
-  if (source.id === GLOBAL_AGENT_RULES_STANDARD_SLUG)
+  if (source.id === GLOBAL_AGENT_RULES_STANDARD_SLUG || source.id === AGENT_OPERATING_RULES_SOURCE_ID)
     priority += 2;
   if (source.metadata?.["role"] === AGENT_OPERATING_RULES_ROLE)
     priority += 1;
@@ -11051,7 +11136,8 @@ function planSessionRender(input) {
           label: rule.resolvedLabel,
           path: rule.resolvedPath,
           globs: rule.globs ?? [],
-          hash: rule.hash ?? null
+          hash: rule.hash ?? null,
+          ...ruleAttestation(rule)
         })),
         renderedPayloadSha256: sha2563(source.content),
         provenance: source.provenance ?? null,
@@ -11172,7 +11258,8 @@ function normalizeInstructionRules(source, tool) {
   return (source.rules ?? []).map((rule) => {
     if (!rule.id.trim())
       throw new Error(`Instruction rule id is required for source ${source.id}.`);
-    const content = filterProviderOnlyBlocks(rule.content ?? "", tool);
+    const floored = applyAgentOperatingRulesFloorToRule(source, rule, rule.content ?? "");
+    const content = filterProviderOnlyBlocks(floored.content, tool);
     if (!content.trim() && !rule.path)
       throw new Error(`Instruction rule content or path is required for rule ${rule.id}.`);
     const resolvedPath = normalizeRulePath(rule.path ?? `${slug(rule.id)}.md`);
@@ -11183,6 +11270,7 @@ function normalizeInstructionRules(source, tool) {
     return {
       ...rule,
       content,
+      metadata: floored.metadata,
       normalizedId: slug(rule.id),
       resolvedLabel: rule.label ?? rule.id,
       resolvedPath
@@ -13794,6 +13882,7 @@ import { basename as basename7, join as join15, resolve as resolve8 } from "path
 
 // src/lib/config-target-identity.ts
 init_apply();
+init_database();
 function findConfigsByTargetPath(configs, targetPath) {
   const wanted = normalizeTargetPath(targetPath);
   return configs.filter((config) => {
@@ -13804,6 +13893,20 @@ function findConfigsByTargetPath(configs, targetPath) {
     return normalizeTargetPath(config.target_path) === wanted;
   });
 }
+function findReferenceConfigsByName(configs, name) {
+  const wantedSlug = slugify(name);
+  return configs.filter((config) => config.kind === "reference" && (config.name === name || slugify(config.name) === wantedSlug));
+}
+function findDuplicateReferenceNameGroups(configs) {
+  const groups = new Map;
+  for (const config of configs) {
+    if (config.kind !== "reference")
+      continue;
+    const key = slugify(config.name);
+    groups.set(key, [...groups.get(key) ?? [], config]);
+  }
+  return [...groups.entries()].filter(([, rows]) => rows.length > 1).map(([, rows]) => ({ name: rows[0].name, configs: rows }));
+}
 function findDuplicateTargetPathGroups(configs) {
   const groups = new Map;
   for (const config of configs) {
@@ -14833,7 +14936,7 @@ var PROJECT_DASHBOARD_PROFILE_VARIABLES = {
   PROJECT_DASHBOARD_DIR: ".hasna/project",
   PROJECT_DASHBOARD_RENDER_MANIFEST: ".hasna/project/dashboard/render.json",
   PROJECT_DASHBOARD_SNAPSHOTS_DIR: ".hasna/project/dashboard/snapshots",
-  PROJECT_CHANNEL_PREFIX: "iproj-"
+  PROJECT_CHANNEL_PREFIX: ""
 };
 var PROJECT_DASHBOARD_STANDARD_CONTENT = `# Agent-Managed Project Dashboard Standard
 
@@ -14888,8 +14991,8 @@ context.
 
 ## Coordination
 
-- Project conversation channels use \`iproj-<project-slug>\` in the CLI and are
-  displayed to humans as \`#iproj-<project-slug>\`.
+- Project conversation channels use the normalized project slug in the CLI and
+  are displayed to humans as \`#<project-slug>\`.
 - Todos tasks are the source of truth for work; messages are only coordination.
 - Durable Codewith goal plans should own long-running implementation.
 - New implementation/verification work should route through task-triggered fresh
@@ -14994,10 +15097,15 @@ function mergeProfileSelectors(preset, existing) {
   };
 }
 function mergeProfileVariables(preset, existing) {
-  return {
+  const variables = {
     ...preset ?? {},
     ...existing
   };
+  for (const [key, value] of Object.entries(preset ?? {})) {
+    if (value === "")
+      variables[key] = value;
+  }
+  return variables;
 }
 function mergeUnique(preset, existing) {
   const values = [...new Set([...preset ?? [], ...existing ?? []])];
@@ -15577,6 +15685,15 @@ function parseVarArgs(values) {
   }
   return Object.keys(vars).length > 0 ? vars : undefined;
 }
+function parseUnsetVarArgs(values) {
+  if (!values || values.length === 0)
+    return [];
+  const keys = [...new Set(values.map((value) => value.trim()))];
+  if (keys.some((key) => key.length === 0 || key.includes("="))) {
+    throw new Error('Invalid --unset-var (expected variable names without "=")');
+  }
+  return keys;
+}
 function parseProfileSelectors(opts) {
   const selectors = {};
   const os = splitCsv(opts.os);
@@ -15691,20 +15808,33 @@ program.command("add <path>").description("Ingest a file into the config DB").op
   const targetPath = abs.startsWith(homedir7()) ? abs.replace(homedir7(), "~") : abs;
   const name = opts.name || filePath.split("/").pop();
   const store = resolveConfigStore();
-  const existingOwners = opts.kind === "reference" ? [] : findConfigsByTargetPath(await store.listConfigs(), targetPath);
+  const allConfigs = await store.listConfigs();
+  const existingOwners = opts.kind === "reference" ? findReferenceConfigsByName(allConfigs, name) : findConfigsByTargetPath(allConfigs, targetPath);
+  const isReference = opts.kind === "reference";
+  const identityLabel = isReference ? `Reference config "${name}"` : targetPath;
+  const identityNoun = isReference ? "name" : "path";
   if (existingOwners.length > 0 && !opts.update) {
     const owners = existingOwners.map((owner) => `${owner.slug} (${owner.id})`).join(", ");
-    console.error(chalk.red(`${targetPath} is already tracked by: ${owners}`));
+    console.error(chalk.red(`${identityLabel} is already tracked by: ${owners}`));
     if (existingOwners.length > 1) {
-      console.error(chalk.red(`  ${existingOwners.length} rows already collide on this path \u2014 apply order between them is undefined.`));
+      console.error(chalk.red(`  ${existingOwners.length} rows already collide on this ${identityNoun} \u2014 apply order between them is undefined.`));
     }
     console.error(chalk.dim("  Use `instructions add <path> --update` to refresh that row in place,"));
-    console.error(chalk.dim("  `instructions sync` to pull disk changes in, or `instructions delete <id>` first."));
+    if (isReference) {
+      console.error(chalk.dim("  or `instructions delete <id>` first."));
+    } else {
+      console.error(chalk.dim("  `instructions sync` to pull disk changes in, or `instructions delete <id>` first."));
+    }
     process.exit(1);
   }
   let config;
   if (existingOwners.length > 0) {
-    const [target, ...rest] = existingOwners;
+    const exactIndex = isReference ? existingOwners.findIndex((owner) => owner.name === name) : -1;
+    const target = exactIndex >= 0 ? existingOwners[exactIndex] : existingOwners[0];
+    const rest = existingOwners.filter((owner) => owner.id !== target.id);
+    if (content !== target.content) {
+      await store.createSnapshot(target.id, target.content, target.version);
+    }
     config = await store.updateConfig(target.id, {
       content,
       format: fmt,
@@ -15714,7 +15844,7 @@ program.command("add <path>").description("Ingest a file into the config DB").op
     });
     console.log(chalk.green("\u2713") + ` Updated: ${chalk.bold(config.name)} ${chalk.dim(`(${config.slug})`)}`);
     if (rest.length > 0) {
-      console.log(chalk.yellow(`  \u26A0 ${rest.length} other row(s) still target ${targetPath}: ${rest.map((r) => r.slug).join(", ")}`));
+      console.log(chalk.yellow(`  \u26A0 ${rest.length} other row(s) still share this ${identityNoun}: ${rest.map((r) => r.slug).join(", ")}`));
       console.log(chalk.yellow("    Apply order between them is undefined. Delete the extras."));
     }
     if (redacted.length > 0) {
@@ -15979,6 +16109,31 @@ profileCmd.command("create <name>").description("Create a new profile").option("
   });
   console.log(chalk.green("\u2713") + ` Created profile: ${chalk.bold(p.name)} ${chalk.dim(`(${p.slug})`)}`);
 });
+profileCmd.command("update <id>").description("Update an existing profile's variables in one store operation").option("--var <vars...>", "set profile variable(s) as KEY=VALUE").option("--unset-var <keys...>", "remove profile variable(s) by key").action(async (id, opts) => {
+  try {
+    const setVariables = parseVarArgs(opts.var) ?? {};
+    const unsetVariables = parseUnsetVarArgs(opts.unsetVar);
+    const setKeys = new Set(Object.keys(setVariables));
+    const conflicts = unsetVariables.filter((key) => setKeys.has(key));
+    if (conflicts.length > 0) {
+      throw new Error(`Variables cannot be both set and unset: ${conflicts.join(", ")}`);
+    }
+    if (Object.keys(setVariables).length === 0 && unsetVariables.length === 0) {
+      throw new Error("Provide --var KEY=VALUE and/or --unset-var KEY");
+    }
+    const store = resolveConfigStore();
+    const profile = await store.getProfile(id);
+    const variables = { ...profile.variables };
+    for (const key of unsetVariables)
+      delete variables[key];
+    Object.assign(variables, setVariables);
+    const updated = await store.updateProfile(profile.id, { variables });
+    console.log(chalk.green("\u2713") + ` Updated profile: ${chalk.bold(updated.name)} ${chalk.dim(`(${updated.slug})`)}`);
+  } catch (e) {
+    console.error(chalk.red(formatCliError(e)));
+    process.exit(1);
+  }
+});
 profileCmd.command("show <id>").description("Show profile and its configs").option("--limit <n>", `max config rows (default ${DEFAULT_LIST_LIMIT})`).option("--cursor <n>", "zero-based pagination cursor").action(async (id, opts) => {
   try {
     const store = resolveConfigStore();
@@ -16755,6 +16910,20 @@ Stored configs (${allConfigs.length}):`));
     }
     console.log(chalk.dim("      Keep one row per path: `instructions delete <id>` for the extras."));
   }
+  const duplicateReferenceNames = findDuplicateReferenceNameGroups(allConfigs);
+  if (duplicateReferenceNames.length === 0) {
+    pass("No reference config name is claimed by more than one row");
+  } else {
+    const rowCount = duplicateReferenceNames.reduce((total, group) => total + group.configs.length, 0);
+    fail(`${duplicateReferenceNames.length} reference name(s) claimed by more than one row (${rowCount} rows) \u2014 only one is live in the next render`);
+    for (const group of duplicateReferenceNames) {
+      console.log(chalk.yellow(`      ${group.name}`));
+      for (const c of group.configs) {
+        console.log(chalk.dim(`        ${c.slug}  (${c.id})  updated ${c.updated_at}`));
+      }
+    }
+    console.log(chalk.dim("      Keep one row per name: `instructions delete <id>` for the extras."));
+  }
   console.log(`
 ${issues === 0 ? chalk.green("\u2713 All checks passed") : chalk.yellow(`${issues} issue(s) found`)}`);
 });

package/dist/cli/profile-update.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=profile-update.test.d.ts.map

package/dist/cli/profile-update.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-update.test.d.ts","sourceRoot":"","sources":["../../src/cli/profile-update.test.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -8442,6 +8442,21 @@ function canonicalFingerprintValue(value) {
   }
   return value;
 }
+function ruleAttestation(rule) {
+  const metadata = rule.metadata ?? {};
+  const read = (key) => {
+    const value = metadata[key];
+    return typeof value === "string" ? value : null;
+  };
+  const applied = metadata["payloadFloorApplied"];
+  return {
+    contentSha256: sha2563(rule.content ?? ""),
+    payloadFloorApplied: typeof applied === "boolean" ? applied : null,
+    flooredFromRulesVersion: read("flooredFromRulesVersion"),
+    flooredFromPayloadSha256: read("flooredFromPayloadSha256"),
+    payloadIntegrity: read("payloadIntegrity")
+  };
+}
 function sourceFingerprint(source) {
   return {
     id: source.id,
@@ -8540,6 +8555,27 @@ function applyAgentOperatingRulesFloor(source, content) {
     metadata: { ...source.metadata ?? {}, ...payload.metadata, ...floored }
   };
 }
+function applyAgentOperatingRulesFloorToRule(source, rule, content) {
+  const unchanged = { content, metadata: rule.metadata ?? null };
+  if (!claimsAgentOperatingRulesPolicy(source, content))
+    return unchanged;
+  const payload = resolveAgentOperatingRulesPayload(content);
+  if (payload.content === content) {
+    return {
+      content,
+      metadata: { ...rule.metadata ?? {}, payloadIntegrity: payload.integrity }
+    };
+  }
+  const floored = {
+    payloadFloorApplied: true,
+    flooredFromRulesVersion: parseAgentOperatingRulesVersion(content),
+    flooredFromPayloadSha256: sha2563(content)
+  };
+  return {
+    content: payload.content,
+    metadata: { ...rule.metadata ?? {}, ...payload.metadata, ...floored }
+  };
+}
 function skippedSource(source, reason) {
   return {
     id: source.id,
@@ -8578,24 +8614,67 @@ function normalizeSources(sources, tool, allowEmptySources) {
   rejectDuplicateRulePaths(ordered);
   return { sources: ordered, skipped: deduplicated.skipped };
 }
+function semanticPolicyIntegrity(body) {
+  return sha2563(body) === AGENT_OPERATING_RULES_PAYLOAD_SHA256 ? "pinned-digest" : "unverified-self-declared";
+}
+function semanticPolicyDeclaration(source) {
+  const normalize = (value) => value.replace(/\r\n/g, `
+`).trim();
+  const sentinel = source.content.match(AGENT_OPERATING_RULES_SENTINEL_PATTERN);
+  if (sentinel) {
+    return {
+      version: sentinel[1],
+      normalizedContent: normalize(source.content),
+      integrity: semanticPolicyIntegrity(source.content)
+    };
+  }
+  for (const rule of source.resolvedRules) {
+    const body = rule.content ?? "";
+    if (!claimsAgentOperatingRulesPolicy(source, body))
+      continue;
+    const ruleSentinel = body.match(AGENT_OPERATING_RULES_SENTINEL_PATTERN);
+    if (!ruleSentinel)
+      continue;
+    return {
+      version: ruleSentinel[1],
+      normalizedContent: normalize(body),
+      integrity: semanticPolicyIntegrity(body)
+    };
+  }
+  return null;
+}
+function withoutSemanticPolicyPayloads(source) {
+  const content = AGENT_OPERATING_RULES_SENTINEL_PATTERN.test(source.content) ? "" : source.content;
+  const resolvedRules = source.resolvedRules.filter((rule) => {
+    const body = rule.content ?? "";
+    return !(AGENT_OPERATING_RULES_SENTINEL_PATTERN.test(body) && claimsAgentOperatingRulesPolicy(source, body));
+  });
+  const hasPathReferences = (source.sourcePaths ?? []).length > 0;
+  if (!content.trim() && resolvedRules.length === 0 && !hasPathReferences)
+    return null;
+  return { ...source, content, resolvedRules };
+}
 function deduplicateSemanticPolicySources(sources) {
   const selected = [];
   const skipped = [];
   const policySources = new Map;
-  const collapseReason = (winner, key) => `superseded by "${winner.id}": sources declaring the semantic policy ${key} collapse to one so a single instruction home cannot carry two rule-set versions`;
+  const collapseReason = (winner, key, partial, displacesVerified) => `superseded by "${winner.id}": sources declaring the semantic policy ${key} collapse to one so a single instruction home cannot carry two rule-set versions` + (partial ? "; only the policy payload was removed and this source's other instructions still render" : "") + (displacesVerified ? "; WARNING the surviving payload is unverified-self-declared and displaced a digest-verified one on its own version claim" : "");
+  const discard = (loser, winner, key, displacesVerified) => {
+    const remainder = withoutSemanticPolicyPayloads(loser);
+    skipped.push(skippedSource(loser, collapseReason(winner, key, remainder !== null, displacesVerified)));
+    return remainder;
+  };
   for (const source of sources) {
-    const sentinel = source.content.match(AGENT_OPERATING_RULES_SENTINEL_PATTERN);
-    if (!sentinel) {
+    const declaration = semanticPolicyDeclaration(source);
+    if (!declaration) {
       selected.push(source);
       continue;
     }
-    const version = sentinel[1];
+    const { version, normalizedContent, integrity } = declaration;
     const key = AGENT_OPERATING_RULES_SEMANTIC_POLICY_KEY;
-    const normalizedContent = source.content.replace(/\r\n/g, `
-`).trim();
     const existing = policySources.get(key);
     if (!existing) {
-      policySources.set(key, { index: selected.length, version, normalizedContent });
+      policySources.set(key, { index: selected.length, version, normalizedContent, integrity });
       selected.push(source);
       continue;
     }
@@ -8605,16 +8684,22 @@ function deduplicateSemanticPolicySources(sources) {
     }
     const current = selected[existing.index];
     const priorityOrder = semanticPolicySourcePriority(source) - semanticPolicySourcePriority(current);
-    if (priorityOrder < 0 || priorityOrder === 0 && versionOrder <= 0) {
-      skipped.push(skippedSource(source, collapseReason(current, key)));
+    const displacesVerified = existing.integrity === "pinned-digest" && integrity === "unverified-self-declared";
+    const arrivingWins = priorityOrder > 0 || priorityOrder === 0 && versionOrder > 0;
+    if (!arrivingWins) {
+      const remainder2 = discard(source, current, key, false);
+      if (remainder2)
+        selected.push(remainder2);
       continue;
     }
-    skipped.push(skippedSource(current, collapseReason(source, key)));
+    const remainder = discard(current, source, key, displacesVerified);
     selected[existing.index] = {
       ...source,
       resolvedOrder: current.resolvedOrder
     };
-    policySources.set(key, { index: existing.index, version, normalizedContent });
+    if (remainder)
+      selected.push(remainder);
+    policySources.set(key, { index: existing.index, version, normalizedContent, integrity });
   }
   return { selected, skipped };
 }
@@ -8622,7 +8707,7 @@ function semanticPolicySourcePriority(source) {
   let priority = 0;
   if (source.nonOverridable)
     priority += 4;
-  if (source.id === GLOBAL_AGENT_RULES_STANDARD_SLUG)
+  if (source.id === GLOBAL_AGENT_RULES_STANDARD_SLUG || source.id === AGENT_OPERATING_RULES_SOURCE_ID)
     priority += 2;
   if (source.metadata?.["role"] === AGENT_OPERATING_RULES_ROLE)
     priority += 1;
@@ -9122,7 +9207,8 @@ function planSessionRender(input) {
           label: rule.resolvedLabel,
           path: rule.resolvedPath,
           globs: rule.globs ?? [],
-          hash: rule.hash ?? null
+          hash: rule.hash ?? null,
+          ...ruleAttestation(rule)
         })),
         renderedPayloadSha256: sha2563(source.content),
         provenance: source.provenance ?? null,
@@ -9344,7 +9430,8 @@ function normalizeInstructionRules(source, tool) {
   return (source.rules ?? []).map((rule) => {
     if (!rule.id.trim())
       throw new Error(`Instruction rule id is required for source ${source.id}.`);
-    const content = filterProviderOnlyBlocks(rule.content ?? "", tool);
+    const floored = applyAgentOperatingRulesFloorToRule(source, rule, rule.content ?? "");
+    const content = filterProviderOnlyBlocks(floored.content, tool);
     if (!content.trim() && !rule.path)
       throw new Error(`Instruction rule content or path is required for rule ${rule.id}.`);
     const resolvedPath = normalizeRulePath(rule.path ?? `${slug(rule.id)}.md`);
@@ -9355,6 +9442,7 @@ function normalizeInstructionRules(source, tool) {
     return {
       ...rule,
       content,
+      metadata: floored.metadata,
       normalizedId: slug(rule.id),
       resolvedLabel: rule.label ?? rule.id,
       resolvedPath
@@ -11163,7 +11251,7 @@ var PROJECT_DASHBOARD_PROFILE_VARIABLES = {
   PROJECT_DASHBOARD_DIR: ".hasna/project",
   PROJECT_DASHBOARD_RENDER_MANIFEST: ".hasna/project/dashboard/render.json",
   PROJECT_DASHBOARD_SNAPSHOTS_DIR: ".hasna/project/dashboard/snapshots",
-  PROJECT_CHANNEL_PREFIX: "iproj-"
+  PROJECT_CHANNEL_PREFIX: ""
 };
 var PROJECT_DASHBOARD_STANDARD_CONTENT = `# Agent-Managed Project Dashboard Standard
 
@@ -11218,8 +11306,8 @@ context.
 
 ## Coordination
 
-- Project conversation channels use \`iproj-<project-slug>\` in the CLI and are
-  displayed to humans as \`#iproj-<project-slug>\`.
+- Project conversation channels use the normalized project slug in the CLI and
+  are displayed to humans as \`#<project-slug>\`.
 - Todos tasks are the source of truth for work; messages are only coordination.
 - Durable Codewith goal plans should own long-running implementation.
 - New implementation/verification work should route through task-triggered fresh
@@ -11324,10 +11412,15 @@ function mergeProfileSelectors(preset, existing) {
   };
 }
 function mergeProfileVariables(preset, existing) {
-  return {
+  const variables = {
     ...preset ?? {},
     ...existing
   };
+  for (const [key, value] of Object.entries(preset ?? {})) {
+    if (value === "")
+      variables[key] = value;
+  }
+  return variables;
 }
 function mergeUnique(preset, existing) {
   const values = [...new Set([...preset ?? [], ...existing ?? []])];

package/dist/lib/config-target-identity.d.ts

@@ -15,6 +15,82 @@ import type { Config } from "../types/index.js";
  * Reference configs (`kind: "reference"`) own no target path and never match.
  */
 export declare function findConfigsByTargetPath(configs: Config[], targetPath: string): Config[];
+/**
+ * Every reference-kind row already ingested under `name`.
+ *
+ * A reference config (`kind: "reference"`) owns no target_path — it is not
+ * mirrored 1:1 onto one file on disk, so `findConfigsByTargetPath` can never
+ * find it, by design (see that function's own doc comment). That left
+ * `add <path> --kind reference --update` with no identity signal at all: every
+ * re-ingest of a reference config's content minted a fresh row instead of
+ * updating the one that already existed, at every `--update` setting, because
+ * there was nothing to match on. Measured live 2026-08-04, todos 757cefdb: 20
+ * of 20 reference-kind rows in the fleet store had target_path=null.
+ *
+ * For a reference config, `name` IS the identity, in exactly the same sense a
+ * file-kind config's target_path is its identity: re-ingest with the same
+ * name, get the same row; re-ingest with a different name, get a different
+ * (or new) row. Two comparisons, both needed:
+ *
+ *  - EXACT name match. `uniqueSlug` (db/database.ts) only de-duplicates the
+ *    SLUG column, which carries a DB-level UNIQUE constraint — it never
+ *    touches `name`, which carries no such constraint. So every prior
+ *    duplicate this bug already produced still has the identical `name` and a
+ *    `-1`, `-2`, ... suffixed slug. Measured live 2026-08-04 in the fleet
+ *    store: 8 reference rows all named "Global Agent Rules Standard"
+ *    (`global-agent-rules-standard-1` through `-8`), one identical SHA-256
+ *    content hash across all 8, ingested on 6 different days — the exact
+ *    shape this function exists to stop.
+ *  - Slugified match, for a re-ingest whose `--name` differs only in case or
+ *    punctuation from an existing row's name.
+ *
+ *    CORRECTED 2026-08-04 (todos 195272ae, Finding 1): this used to compare
+ *    the query's slug against each candidate's STORED `.slug` COLUMN
+ *    (`config.slug === wantedSlug`). That is sound only for a candidate whose
+ *    own slug was never disambiguated — the moment two rows already collide
+ *    and `uniqueSlug` has suffixed one of them (`sample-rule-1`), its stored
+ *    slug no longer equals what re-slugifying its OWN name produces, so the
+ *    old comparison went blind to it. Reproduced live: row A "Sample Rule"
+ *    (slug "sample-rule"), row B "sample rule" (slug disambiguated to
+ *    "sample-rule-1" because A already held the base slug) — querying "Sample
+ *    Rule" found only A. `add --update` then updated A, reported
+ *    `rest.length === 0` (no "N other rows share this name" warning), and
+ *    left B — the exact row a human would call a duplicate of A — untouched
+ *    and unmentioned. This is the one population the slug clause exists to
+ *    catch: it is impossible for a fresh, non-colliding row to need it, since
+ *    an un-disambiguated slug already matches via `slugify(name)` trivially.
+ *    Comparing against `slugify(config.name)` instead — recomputed from the
+ *    candidate's own name rather than trusted from its (possibly
+ *    disambiguated) stored column — fixes this without weakening the EXACT
+ *    name clause above, which still independently catches the byte-identical
+ *    case regardless: it can only ADD matches the old comparison missed, not
+ *    remove any a query's name literally shares.
+ */
+export declare function findReferenceConfigsByName(configs: Config[], name: string): Config[];
+/**
+ * Groups of reference-kind rows that collide on identity, the mirror image of
+ * `findDuplicateTargetPathGroups` for the identity axis reference configs
+ * actually use. Only groups with more than one member are returned, so an
+ * empty result means the store is clean.
+ *
+ * CORRECTED 2026-08-04 (todos 195272ae, Finding 1): grouping used to key on
+ * the raw, exact `config.name` string. `doctor` (which calls this) therefore
+ * reported a store CLEAN for two rows whose names differ only in case or
+ * punctuation — precisely the pair `findReferenceConfigsByName` above treats
+ * as one identity (see its doc comment for the reproduction). The two
+ * functions disagreeing about what "the same reference config" means was the
+ * same defect class PR #57 fixed one level up, one file down: `doctor` a
+ * store clean, `add --update` half-fixing it. Keying on `slugify(config.name)`
+ * instead makes this agree with `findReferenceConfigsByName`'s identity
+ * notion — a case/punctuation variant is now reported as a duplicate group
+ * too, not only a byte-identical one. The reported `name` is the first
+ * colliding row's own (human-authored) name, for display — the grouping key
+ * itself is never surfaced.
+ */
+export declare function findDuplicateReferenceNameGroups(configs: Config[]): Array<{
+    name: string;
+    configs: Config[];
+}>;
 /**
  * Groups of rows that collide on one normalized target path. Only groups with
  * more than one member are returned, so an empty result means the store is

package/dist/lib/config-target-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-target-identity.d.ts","sourceRoot":"","sources":["../../src/lib/config-target-identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAGhD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAOvF;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAUlH"}
+{"version":3,"file":"config-target-identity.d.ts","sourceRoot":"","sources":["../../src/lib/config-target-identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAIhD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAOvF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAKpF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAU9G;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAUlH"}

package/dist/lib/global-agent-rules-standard.d.ts

@@ -127,7 +127,17 @@ export declare function compareAgentOperatingRulesVersions(left: string, right:
  *    ties on priority in `deduplicateSemanticPolicySources` and then WINS on version,
  *    EVICTING the genuine baseline from the same render; the collapse happens before
  *    `rejectDuplicateSourceSlugs` runs, so the duplicate-slug guard never sees the
- *    collision. Nothing in these bytes distinguishes a genuine future rules version from
+ *    collision. That eviction was REACHABLE and is now narrowed, not closed: the managed
+ *    source id `hasna-agent-operating-rules` earns precedence in
+ *    `semanticPolicySourcePriority` alongside the managed slug, so the canonical source no
+ *    longer merely ties with any export that sets `nonOverridable`, and an eviction by an
+ *    unverified payload is reported in `skippedSources` and in `warnings` instead of
+ *    passing as a routine collapse. An export that also mimics a canonical id still ties
+ *    and still wins on version. Ordering by `payloadIntegrity` instead was tried and
+ *    rejected: the pinned digest describes the EMBEDDED snapshot, so preferring it would
+ *    freeze a home carrying that snapshot beside a newly published rules document — the
+ *    same downgrade this floor exists to prevent, arriving by the selection path.
+ *    Nothing in these bytes distinguishes a genuine future rules version from
  *    an inflated one. Rejecting
  *    above-baseline versions was considered and deliberately NOT done: the canonical
  *    rules document ships from `@hasna/identities`, which legitimately runs ahead of the
@@ -138,15 +148,24 @@ export declare function compareAgentOperatingRulesVersions(left: string, right:
  *    channel), not a comparison. Until then the choice is recorded rather than hidden:
  *    every payload carries `payloadIntegrity`, which is `unverified-self-declared`
  *    whenever bytes were accepted on their version claim alone.
- * 2. This function guards only the payloads routed through it, and the render pipeline
- *    routes exactly one field: `source.content`. `normalizeSources` floors that, so a
- *    claiming source is covered whether it came from the config store, an identity export,
- *    or a file. `source.rules[].content` is NOT floored — `normalizeInstructionRules` only
- *    filters provider blocks, `normalizeIdentityRules` copies rule bodies straight out of
- *    export JSON, and `deduplicateSemanticPolicySources` inspects only `source.content`.
- *    So a sentinel carried inside a RULE is neither floored nor deduped nor attested, on
- *    the same untrusted export transport this floor otherwise defends. That predates this
- *    guard and is tracked as a follow-up; do not read the choke point as covering it.
+ * 2. This function guards only the payloads routed through it. The render pipeline routes
+ *    BOTH `source.content` and `source.rules[].content`: `normalizeSources` floors the
+ *    first and `normalizeInstructionRules` floors the second through
+ *    `applyAgentOperatingRulesFloorToRule`, both before provider filtering, and
+ *    `deduplicateSemanticPolicySources` reads a declaration from either field. A claiming
+ *    source or rule is therefore covered whether it came from the config store, an
+ *    identity export, or a file.
+ *
+ *    The rule half was NOT covered until hasna/instructions#54, and this note used to say
+ *    so in present tense. Until then a sentinel carried inside a RULE was neither floored
+ *    nor deduped nor attested on the same untrusted export transport this floor otherwise
+ *    defends, so an export installed a below-baseline NON-OVERRIDABLE rules document by
+ *    putting it in `rules[]` instead of `content`.
+ *
+ *    What remains uncovered is narrower and is stated so the choke point is not read as
+ *    total: an unprivileged rule that merely QUOTES the rules mid-body is deliberately not
+ *    floored (the F2 false positive), and a rule under a privileged parent IS floored even
+ *    when it only quotes them.
  *
  *    The attestation is also PER-RENDER, not durable: a repair is recorded in the manifest
  *    of the render that performed it, so fleet-wide auditing needs those manifests

package/dist/lib/global-agent-rules-standard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-agent-rules-standard.d.ts","sourceRoot":"","sources":["../../src/lib/global-agent-rules-standard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE/E,eAAO,MAAM,gCAAgC,gCAAgC,CAAC;AAE9E,eAAO,MAAM,mCAAmC,EAAG,mCAA4C,CAAC;AAChG,eAAO,MAAM,+BAA+B,EAAG,6BAAsC,CAAC;AACtF,yFAAyF;AACzF,eAAO,MAAM,0BAA0B,EAAG,uBAAgC,CAAC;AAC3E,eAAO,MAAM,6BAA6B,EAAG,OAAgB,CAAC;AAC9D,eAAO,MAAM,wCAAwC,EAAG,YAAqB,CAAC;AAC9E,eAAO,MAAM,8BAA8B,EAAG,8CAAuD,CAAC;AACtG;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,EAAG,6BAAsC,CAAC;AAChG,6FAA6F;AAC7F,eAAO,MAAM,sCAAsC,QAA2E,CAAC;AAC/H;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC,QAAsG,CAAC;AACzJ,eAAO,MAAM,oCAAoC,EAAG,kEAA2E,CAAC;AAChI,eAAO,MAAM,oCAAoC,oEAAuC,CAAC;AACzF,eAAO,MAAM,0CAA0C,EAAG,kEAA2E,CAAC;AACtI,eAAO,MAAM,2CAA2C,EAAG,2DAAoE,CAAC;AAEhI,eAAO,MAAM,8BAA8B;;;;CAIjC,CAAC;AAEX,eAAO,MAAM,iCAAiC;;;;;;;CAOpC,CAAC;AAEX,eAAO,MAAM,gCAAgC;;;;;;;;;;;;CAYnC,CAAC;AAEX,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;CAejC,CAAC;AAEX,eAAO,MAAM,0BAA0B,8ZAA8Z,CAAC;AAEtc,eAAO,MAAM,mCAAmC,QA+B7B,CAAC;AAEpB,iFAAiF;AACjF,MAAM,MAAM,gCAAgC,GAAG,eAAe,GAAG,mBAAmB,CAAC;AAErF;;;;;;;;GAQG;AACH,MAAM,MAAM,mCAAmC,GAAG,eAAe,GAAG,0BAA0B,CAAC;AAE/F,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,gCAAgC,CAAC;IACzC,iFAAiF;IACjF,uBAAuB,EAAE,OAAO,CAAC;IACjC,gFAAgF;IAChF,SAAS,EAAE,mCAAmC,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,2EAA2E;AAC3E,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAEjG;AAED,qDAAqD;AACrD,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQtF;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAgB,iCAAiC,CAC/C,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,0BAA0B,CA0E5B;AAwBD;;;;;;GAMG;AACH,wBAAsB,oCAAoC,CAAC,KAAK,GAAE,WAAkC,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBrH"}
+{"version":3,"file":"global-agent-rules-standard.d.ts","sourceRoot":"","sources":["../../src/lib/global-agent-rules-standard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE/E,eAAO,MAAM,gCAAgC,gCAAgC,CAAC;AAE9E,eAAO,MAAM,mCAAmC,EAAG,mCAA4C,CAAC;AAChG,eAAO,MAAM,+BAA+B,EAAG,6BAAsC,CAAC;AACtF,yFAAyF;AACzF,eAAO,MAAM,0BAA0B,EAAG,uBAAgC,CAAC;AAC3E,eAAO,MAAM,6BAA6B,EAAG,OAAgB,CAAC;AAC9D,eAAO,MAAM,wCAAwC,EAAG,YAAqB,CAAC;AAC9E,eAAO,MAAM,8BAA8B,EAAG,8CAAuD,CAAC;AACtG;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,EAAG,6BAAsC,CAAC;AAChG,6FAA6F;AAC7F,eAAO,MAAM,sCAAsC,QAA2E,CAAC;AAC/H;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC,QAAsG,CAAC;AACzJ,eAAO,MAAM,oCAAoC,EAAG,kEAA2E,CAAC;AAChI,eAAO,MAAM,oCAAoC,oEAAuC,CAAC;AACzF,eAAO,MAAM,0CAA0C,EAAG,kEAA2E,CAAC;AACtI,eAAO,MAAM,2CAA2C,EAAG,2DAAoE,CAAC;AAEhI,eAAO,MAAM,8BAA8B;;;;CAIjC,CAAC;AAEX,eAAO,MAAM,iCAAiC;;;;;;;CAOpC,CAAC;AAEX,eAAO,MAAM,gCAAgC;;;;;;;;;;;;CAYnC,CAAC;AAEX,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;CAejC,CAAC;AAEX,eAAO,MAAM,0BAA0B,8ZAA8Z,CAAC;AAEtc,eAAO,MAAM,mCAAmC,QA+B7B,CAAC;AAEpB,iFAAiF;AACjF,MAAM,MAAM,gCAAgC,GAAG,eAAe,GAAG,mBAAmB,CAAC;AAErF;;;;;;;;GAQG;AACH,MAAM,MAAM,mCAAmC,GAAG,eAAe,GAAG,0BAA0B,CAAC;AAE/F,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,gCAAgC,CAAC;IACzC,iFAAiF;IACjF,uBAAuB,EAAE,OAAO,CAAC;IACjC,gFAAgF;IAChF,SAAS,EAAE,mCAAmC,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,2EAA2E;AAC3E,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAEjG;AAED,qDAAqD;AACrD,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQtF;AAmBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,wBAAgB,iCAAiC,CAC/C,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,0BAA0B,CA0E5B;AAwBD;;;;;;GAMG;AACH,wBAAsB,oCAAoC,CAAC,KAAK,GAAE,WAAkC,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBrH"}

package/dist/lib/project-dashboard-standard.d.ts

@@ -2,6 +2,6 @@ import type { Config, ProfileVariables } from "../types/index.js";
 import { type ConfigStore } from "../data/config-store.js";
 export declare const PROJECT_DASHBOARD_STANDARD_SLUG = "agent-managed-project-dashboard-standard";
 export declare const PROJECT_DASHBOARD_PROFILE_VARIABLES: ProfileVariables;
-export declare const PROJECT_DASHBOARD_STANDARD_CONTENT = "# Agent-Managed Project Dashboard Standard\n\nThis standard applies to Hasna work projects under `Workspace/<division>/project/<slug>`.\nHumans do not work directly inside these folders; agents keep structure,\nevidence, tasks, knowledge, and dashboard output consistent.\n\n## Canonical Files\n\n- Project manifest root: `.hasna/project/`\n- Dashboard render manifest: `.hasna/project/dashboard/render.json`\n- Latest snapshot: `.hasna/project/dashboard/snapshots/latest.snapshot.json`\n- Dashboard schema ids come from `@hasna/contracts`.\n- Project folders may contain private documents, but render JSON must contain\n  only ids, counts, statuses, resource refs, evidence refs, and redacted\n  summaries.\n\n## Viewer Commands\n\nUse the Projects-owned viewer. Do not invent a separate per-project app unless\n`open-projects` cannot express the surface.\n\n```bash\nprojects dashboard snapshot <project> --write --json\nprojects dashboard render <project> --json\nprojects dashboard validate <project> --json\nPROJECTS_DASHBOARD_TOKEN=<token> projects dashboard serve <project> --host 0.0.0.0 --port <port>\n```\n\nNon-loopback serving must use `--token`, `PROJECTS_DASHBOARD_TOKEN`, or an\nexplicit `--trust-network` choice. Never put the token in a URL, task\nevidence, render spec, or report.\n\n## Provider Panels\n\nProvider CLIs emit bounded `hasna.project_panel.v1` summaries:\n\n```bash\ntodos project-panel --project <project> --json --contract\nfiles project-panel --project <project> --json --contract\nmailery project-panel --project <project> --limit 20 --json --contract\nconversations project-panel --project <project> --limit 30 --json --contract\nknowledge project-panel --project <project> --scope project --limit 30 --json --contract\nmementos --json project-panel --project <project> --contract\nreports project-panel --project <project> --json --contract\n```\n\nProviders must degrade to unavailable/error panels instead of dumping raw\ncontent. Mailery is workspace-scoped until explicit project-email mapping is\nconfigured; Knowledge must run from the project cwd or with the correct store\ncontext.\n\n## Coordination\n\n- Project conversation channels use `iproj-<project-slug>` in the CLI and are\n  displayed to humans as `#iproj-<project-slug>`.\n- Todos tasks are the source of truth for work; messages are only coordination.\n- Durable Codewith goal plans should own long-running implementation.\n- New implementation/verification work should route through task-triggered fresh\n  agent runs, not by opening or pasting into existing tmux panes.\n- Agent handoff should reference task ids, project ids, commit ids, evidence\n  paths, and dashboard URLs without exposing secrets or raw private documents.\n\n## Report Rules\n\nReports and dashboards should use JSON Render/React Flow through\n`projects dashboard render`. Include decisions, open questions, bank/document\nids, tasks, and evidence refs. Exclude raw email bodies, account numbers, tax\nids, passport numbers, credentials, and contract clauses unless an explicit\napproved storage policy exists.\n";
+export declare const PROJECT_DASHBOARD_STANDARD_CONTENT = "# Agent-Managed Project Dashboard Standard\n\nThis standard applies to Hasna work projects under `Workspace/<division>/project/<slug>`.\nHumans do not work directly inside these folders; agents keep structure,\nevidence, tasks, knowledge, and dashboard output consistent.\n\n## Canonical Files\n\n- Project manifest root: `.hasna/project/`\n- Dashboard render manifest: `.hasna/project/dashboard/render.json`\n- Latest snapshot: `.hasna/project/dashboard/snapshots/latest.snapshot.json`\n- Dashboard schema ids come from `@hasna/contracts`.\n- Project folders may contain private documents, but render JSON must contain\n  only ids, counts, statuses, resource refs, evidence refs, and redacted\n  summaries.\n\n## Viewer Commands\n\nUse the Projects-owned viewer. Do not invent a separate per-project app unless\n`open-projects` cannot express the surface.\n\n```bash\nprojects dashboard snapshot <project> --write --json\nprojects dashboard render <project> --json\nprojects dashboard validate <project> --json\nPROJECTS_DASHBOARD_TOKEN=<token> projects dashboard serve <project> --host 0.0.0.0 --port <port>\n```\n\nNon-loopback serving must use `--token`, `PROJECTS_DASHBOARD_TOKEN`, or an\nexplicit `--trust-network` choice. Never put the token in a URL, task\nevidence, render spec, or report.\n\n## Provider Panels\n\nProvider CLIs emit bounded `hasna.project_panel.v1` summaries:\n\n```bash\ntodos project-panel --project <project> --json --contract\nfiles project-panel --project <project> --json --contract\nmailery project-panel --project <project> --limit 20 --json --contract\nconversations project-panel --project <project> --limit 30 --json --contract\nknowledge project-panel --project <project> --scope project --limit 30 --json --contract\nmementos --json project-panel --project <project> --contract\nreports project-panel --project <project> --json --contract\n```\n\nProviders must degrade to unavailable/error panels instead of dumping raw\ncontent. Mailery is workspace-scoped until explicit project-email mapping is\nconfigured; Knowledge must run from the project cwd or with the correct store\ncontext.\n\n## Coordination\n\n- Project conversation channels use the normalized project slug in the CLI and\n  are displayed to humans as `#<project-slug>`.\n- Todos tasks are the source of truth for work; messages are only coordination.\n- Durable Codewith goal plans should own long-running implementation.\n- New implementation/verification work should route through task-triggered fresh\n  agent runs, not by opening or pasting into existing tmux panes.\n- Agent handoff should reference task ids, project ids, commit ids, evidence\n  paths, and dashboard URLs without exposing secrets or raw private documents.\n\n## Report Rules\n\nReports and dashboards should use JSON Render/React Flow through\n`projects dashboard render`. Include decisions, open questions, bank/document\nids, tasks, and evidence refs. Exclude raw email bodies, account numbers, tax\nids, passport numbers, credentials, and contract clauses unless an explicit\napproved storage policy exists.\n";
 export declare function ensureProjectDashboardStandardConfig(store?: ConfigStore): Promise<Config>;
 //# sourceMappingURL=project-dashboard-standard.d.ts.map

package/dist/lib/project-dashboard-standard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-dashboard-standard.d.ts","sourceRoot":"","sources":["../../src/lib/project-dashboard-standard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE/E,eAAO,MAAM,+BAA+B,6CAA6C,CAAC;AAE1F,eAAO,MAAM,mCAAmC,EAAE,gBAKjD,CAAC;AAEF,eAAO,MAAM,kCAAkC,2hGAqE9C,CAAC;AAEF,wBAAsB,oCAAoC,CAAC,KAAK,GAAE,WAAkC,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BrH"}
+{"version":3,"file":"project-dashboard-standard.d.ts","sourceRoot":"","sources":["../../src/lib/project-dashboard-standard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE/E,eAAO,MAAM,+BAA+B,6CAA6C,CAAC;AAE1F,eAAO,MAAM,mCAAmC,EAAE,gBAKjD,CAAC;AAEF,eAAO,MAAM,kCAAkC,0hGAqE9C,CAAC;AAEF,wBAAsB,oCAAoC,CAAC,KAAK,GAAE,WAAkC,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BrH"}

package/dist/lib/session-render-rule-currency-floor.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-render-rule-currency-floor.test.d.ts.map

package/dist/lib/session-render-rule-currency-floor.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-render-rule-currency-floor.test.d.ts","sourceRoot":"","sources":["../../src/lib/session-render-rule-currency-floor.test.ts"],"names":[],"mappings":""}

package/dist/lib/session-render.d.ts

@@ -150,6 +150,11 @@ export interface SessionRenderManifest {
             path: string;
             globs: string[];
             hash: string | null;
+            contentSha256: string;
+            payloadFloorApplied: boolean | null;
+            flooredFromRulesVersion: string | null;
+            flooredFromPayloadSha256: string | null;
+            payloadIntegrity: string | null;
         }>;
         renderedPayloadSha256: string;
         provenance: Record<string, unknown> | null;

package/dist/lib/session-render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-render.d.ts","sourceRoot":"","sources":["../../src/lib/session-render.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAahD,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAEL,0BAA0B,EAI1B,qBAAqB,EAEtB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,uCAAuC,EACvC,6BAA6B,EAC7B,gCAAgC,EAChC,qCAAqC,EACrC,qBAAqB,EACrB,oCAAoC,GACrC,MAAM,8BAA8B,CAAC;AACtC,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,gCAAgC,QAAS,CAAC;AACvD,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAEzE,eAAO,MAAM,oBAAoB,oGASvB,CAAC;AAEX,eAAO,MAAM,kCAAkC,2GAKrC,CAAC;AACX,eAAO,MAAM,mCAAmC,0JAItC,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,YAAY,GAAG,uBAAuB,GAAG,mBAAmB,CAAC;AACvI,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAClF,MAAM,MAAM,4BAA4B,GAAG,uBAAuB,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AACzG,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC3D,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC;AAC1F,MAAM,MAAM,uBAAuB,GAAG,cAAc,GAAG,cAAc,GAAG,SAAS,CAAC;AAClF,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhF,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,4BAA4B,CAAC;IACrC,KAAK,CAAC,EAAE,uBAAuB,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACvC,WAAW,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C;AAmBD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,cAAc,EAAE,cAAc,CAAC;IAC/B,MAAM,EAAE;QACN,EAAE,EAAE,OAAO,yBAAyB,CAAC;QACrC,SAAS,EAAE,IAAI,CAAC;QAChB,aAAa,EAAE,CAAC,cAAc,CAAC,CAAC;QAChC,KAAK,EAAE,wBAAwB,GAAG,4BAA4B,CAAC;KAChE,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,cAAc,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,qBAAqB,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,OAAO,qBAAqB,CAAC;IACrC,IAAI,EAAE,iBAAiB,CAAC;IACxB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,uBAAuB,CAAC;IACpC,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,uBAAuB,CAAC;QAC/B,KAAK,EAAE,uBAAuB,CAAC;QAC/B,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAC;QACtC,WAAW,EAAE,4BAA4B,EAAE,CAAC;QAC5C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,cAAc,EAAE,OAAO,CAAC;QACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,KAAK,EAAE,KAAK,CAAC;YACX,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,EAAE,CAAC;YAChB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;SACrB,CAAC,CAAC;QACH,qBAAqB,EAAE,MAAM,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC3C,CAAC,CAAC;IACH,cAAc,EAAE,KAAK,CAAC;QACpB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,qBAAqB,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC,CAAC;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,qBAAqB,EAAE,MAAM,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,cAAc,CAAC,EAAE;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,IAAI,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,uBAAuB,CAAC;IACpC,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;;OASG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,YAAY,EAAE,iBAAiB,CAAC;IAChC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;CAClD;AAsBD,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CA8D/E,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAQxD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC,EAAE,SAAS,MAAM,EAAsB,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,EAAE,SAAS,MAAM,EAInE,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAYtE,CAAC;AAEF,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAkBxF;AAkpBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU1D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUvD;AAsDD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE;IACzH,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,uBAAuB,CAAC;CACrC,GAAG,kBAAkB,CAqDrB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAG,iBAAiB,CAyK9E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,wBAAwB,CAUrG;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,aAAa,CAAC,EAC3E,KAAK,SAAI,EACT,KAAK,CAAC,EAAE,uBAAuB,GAC9B,wBAAwB,CA4B1B;AAED,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,EAAE,iBAAiB,GACtB,6BAA6B,CAoF/B;AA2CD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9E,wBAAwB,EAAE,CAmB5B"}
+{"version":3,"file":"session-render.d.ts","sourceRoot":"","sources":["../../src/lib/session-render.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAehD,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAEL,0BAA0B,EAI1B,qBAAqB,EAEtB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,uCAAuC,EACvC,6BAA6B,EAC7B,gCAAgC,EAChC,qCAAqC,EACrC,qBAAqB,EACrB,oCAAoC,GACrC,MAAM,8BAA8B,CAAC;AACtC,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,gCAAgC,QAAS,CAAC;AACvD,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAEzE,eAAO,MAAM,oBAAoB,oGASvB,CAAC;AAEX,eAAO,MAAM,kCAAkC,2GAKrC,CAAC;AACX,eAAO,MAAM,mCAAmC,0JAItC,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,YAAY,GAAG,uBAAuB,GAAG,mBAAmB,CAAC;AACvI,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAClF,MAAM,MAAM,4BAA4B,GAAG,uBAAuB,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AACzG,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC3D,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC;AAC1F,MAAM,MAAM,uBAAuB,GAAG,cAAc,GAAG,cAAc,GAAG,SAAS,CAAC;AAClF,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhF,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,4BAA4B,CAAC;IACrC,KAAK,CAAC,EAAE,uBAAuB,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACvC,WAAW,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C;AAmBD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,cAAc,EAAE,cAAc,CAAC;IAC/B,MAAM,EAAE;QACN,EAAE,EAAE,OAAO,yBAAyB,CAAC;QACrC,SAAS,EAAE,IAAI,CAAC;QAChB,aAAa,EAAE,CAAC,cAAc,CAAC,CAAC;QAChC,KAAK,EAAE,wBAAwB,GAAG,4BAA4B,CAAC;KAChE,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,cAAc,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,qBAAqB,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,OAAO,qBAAqB,CAAC;IACrC,IAAI,EAAE,iBAAiB,CAAC;IACxB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,uBAAuB,CAAC;IACpC,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,KAAK,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,uBAAuB,CAAC;QAC/B,KAAK,EAAE,uBAAuB,CAAC;QAC/B,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAC;QACtC,WAAW,EAAE,4BAA4B,EAAE,CAAC;QAC5C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,cAAc,EAAE,OAAO,CAAC;QACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,KAAK,EAAE,KAAK,CAAC;YACX,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,EAAE,CAAC;YAChB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YAQpB,aAAa,EAAE,MAAM,CAAC;YACtB,mBAAmB,EAAE,OAAO,GAAG,IAAI,CAAC;YACpC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;YACvC,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;YACxC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,qBAAqB,EAAE,MAAM,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC3C,CAAC,CAAC;IACH,cAAc,EAAE,KAAK,CAAC;QACpB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,qBAAqB,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC,CAAC;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,qBAAqB,EAAE,MAAM,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,cAAc,CAAC,EAAE;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,IAAI,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,uBAAuB,CAAC;IACpC,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;;OASG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,YAAY,EAAE,iBAAiB,CAAC;IAChC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;CAClD;AAsBD,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CA8D/E,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAQxD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC,EAAE,SAAS,MAAM,EAAsB,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,EAAE,SAAS,MAAM,EAInE,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAYtE,CAAC;AAEF,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAkBxF;AAw5BD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU1D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUvD;AAsDD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE;IACzH,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,uBAAuB,CAAC;CACrC,GAAG,kBAAkB,CAqDrB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAG,iBAAiB,CA0K9E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,wBAAwB,CAUrG;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,aAAa,CAAC,EAC3E,KAAK,SAAI,EACT,KAAK,CAAC,EAAE,uBAAuB,GAC9B,wBAAwB,CA4B1B;AAED,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,EAAE,iBAAiB,GACtB,6BAA6B,CAoF/B;AA2CD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9E,wBAAwB,EAAE,CAmB5B"}

package/dist/mcp/index.js

@@ -6957,7 +6957,7 @@ var init_sync_dir = __esm(() => {
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@hasna/instructions",
-    version: "0.4.18",
+    version: "0.4.20",
     description: "AI coding agent instruction & configuration manager \u2014 store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.",
     type: "module",
     main: "dist/index.js",
@@ -7062,6 +7062,7 @@ import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprot
 
 // src/lib/config-target-identity.ts
 init_apply();
+init_database();
 function findConfigsByTargetPath(configs, targetPath) {
   const wanted = normalizeTargetPath(targetPath);
   return configs.filter((config) => {
@@ -7072,6 +7073,10 @@ function findConfigsByTargetPath(configs, targetPath) {
     return normalizeTargetPath(config.target_path) === wanted;
   });
 }
+function findReferenceConfigsByName(configs, name) {
+  const wantedSlug = slugify(name);
+  return configs.filter((config) => config.kind === "reference" && (config.name === name || slugify(config.name) === wantedSlug));
+}
 
 // src/mcp/server.ts
 init_sync_dir();
@@ -7178,7 +7183,7 @@ function summarizeApplyResult(result) {
 var TOOL_DOCS = {
   list_configs: "List configs. Params: category?, agent?, kind?, search?, limit?, cursor?, verbose?. Defaults to a paged compact envelope without content; use get_config for full content.",
   get_config: "Get a config by id or slug. Returns full config including content.",
-  create_config: "Create a new config. Required: name, content, category. Optional: agent, target_path, outputs, kind, format, tags, description, is_template. Refuses when target_path is already tracked by another config (one target path, one row) \u2014 use update_config on the owning row, or delete_config first. kind:'reference' owns no target path and is exempt.",
+  create_config: "Create a new config. Required: name, content, category. Optional: agent, target_path, outputs, kind, format, tags, description, is_template. Refuses when target_path is already tracked by another config (one target path, one row) \u2014 use update_config on the owning row, or delete_config first. kind:'reference' owns no target path and is exempt from that check, but is instead refused when its name (or a case/punctuation variant of it) already tracks another reference config.",
   update_config: "Update a config by id or slug. Optional: content, name, tags, description, category, agent, target_path, outputs.",
   apply_config: "Apply a config through the shared ownership gate. Params: id_or_slug, dry_run?, verbose?. Returns results plus session-renderer-owned targets that were skipped.",
   sync_directory: "Sync a directory with the DB. Params: dir, direction ('from_disk'|'to_disk'). Returns sync result.",
@@ -7269,6 +7274,15 @@ function buildServer() {
               return err(`${targetPath} is already tracked by: ${named}.${collision}` + ` Use update_config on that row to refresh it in place, or delete_config first.`);
             }
           }
+          if (kind === "reference") {
+            const name2 = args["name"];
+            const owners = findReferenceConfigsByName(await store.listConfigs(), name2);
+            if (owners.length > 0) {
+              const named = owners.map((owner) => `${owner.slug} (${owner.id})`).join(", ");
+              const collision = owners.length > 1 ? ` ${owners.length} rows already collide on this name \u2014 apply order between them is undefined.` : "";
+              return err(`Reference config "${name2}" is already tracked by: ${named}.${collision}` + ` Use update_config on that row to refresh it in place, or delete_config first.`);
+            }
+          }
           const c = await store.createConfig({
             name: args["name"],
             content: args["content"],

package/dist/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AA4EnE,wBAAgB,WAAW,IAAI,MAAM,CAyTpC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AA4EnE,wBAAgB,WAAW,IAAI,MAAM,CAyVpC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/instructions",
-  "version": "0.4.18",
+  "version": "0.4.20",
   "description": "AI coding agent instruction & configuration manager \u2014 store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.",
   "type": "module",
   "main": "dist/index.js",