@hasna/instructions 0.4.26 → 0.4.28

package/README.md

@@ -52,6 +52,12 @@ small. Human output is capped at 20 rows unless you pass `--limit`; use
 - `--json` preserves full machine-readable records for automation.
 - `show`/`inspect` and `snapshot show` print full config or snapshot content.
 
+`instructions report --json` emits the stable `schema_version: 1` report
+envelope. Its top-level fields are `configs`, `profiles`, `drift`, `secrets`,
+`by_agent`, and `by_category`. The nested count fields are numeric, and
+`secrets.policy` is `redacted_on_ingest`. Run `instructions report` without
+`--json` for the human-readable report.
+
 ## Package-Manager Secret Guard
 
 `instructions package-manager-scan` blocks package-manager credential ingress without
@@ -243,7 +249,8 @@ never silently become "overwrite renderer-owned instruction files".
 ### Managed project context
 
 `instructions project-context plan|apply` is the sole writer for the strict
-`hasna.projects.project_context_bundle.v1` contract emitted by Projects. It
+`hasna.projects.project_context_bundle.v1` and schema-compatible
+`hasna.projects.project_context_bundle.v2` contracts emitted by Projects. It
 accepts bounded structured JSON from a regular file or stdin and never invokes
 Projects, Todos, Conversations, or Mementos while rendering:
 
@@ -286,6 +293,12 @@ compatible last-known-good cache can be selected explicitly with
 `--allow-stale-cache --expected-project-id <id>`; its bounded age/status is
 visible in the rendered context.
 
+Projects v2 bundles may carry the strict optional
+`hasna.projects.finance_project_metadata.v1` object. Instructions validates
+that object and preserves every accepted finance field through the bundle
+cache and session-manifest provenance path; malformed finance metadata and
+finance attached to a legacy v1 bundle fail closed.
+
 Compatibility remains additive: project-context manifests keep
 `hasna.configs.session-render/v1`, `Managed by @hasna/configs`, and
 `ownedBy: open-configs`, while recording `canonicalOwner: instructions`. The

package/dist/cli/index.js

@@ -7952,14 +7952,14 @@ function parseProjectContextBundleInternal(input, allowLegacyHash, normalizeLega
     throw new ProjectContextError("PROJECT_CONTEXT_INVALID", "bundle is not valid JSON");
   }
   const candidateSchema = isRecord(value) ? value["schema"] : undefined;
-  if (typeof candidateSchema === "string" && candidateSchema !== PROJECT_CONTEXT_SCHEMA) {
+  if (typeof candidateSchema === "string" && !PROJECT_CONTEXT_SUPPORTED_SCHEMAS.includes(candidateSchema)) {
     if (/^hasna\.projects\.project_context_bundle\.v[0-9]+$/.test(candidateSchema)) {
       throw new ProjectContextError("PROJECT_CONTEXT_UNSUPPORTED_VERSION", `unsupported bundle schema ${candidateSchema}`);
     }
   }
   const result = projectContextBundleSchema.safeParse(value);
   if (!result.success) {
-    throw new ProjectContextError("PROJECT_CONTEXT_INVALID", "bundle does not match the strict v1 schema", {
+    throw new ProjectContextError("PROJECT_CONTEXT_INVALID", "bundle does not match a strict supported schema", {
       issues: result.error.issues.map((issue) => ({ path: issue.path.join("."), code: issue.code, message: issue.message }))
     });
   }
@@ -7969,7 +7969,7 @@ function parseProjectContextBundleInternal(input, allowLegacyHash, normalizeLega
   validateIdentityConsistency(bundle);
   rejectCredentialLikeBundle(bundle);
   const expected = computeProjectContextSourceHash(bundle);
-  const matchesLegacyHash = bundle.hash !== expected && allowLegacyHash && bundle.hash === computeLegacyProjectContextSourceHash(bundle);
+  const matchesLegacyHash = bundle.hash !== expected && allowLegacyHash && bundle.schema === PROJECT_CONTEXT_SCHEMA && bundle.hash === computeLegacyProjectContextSourceHash(bundle);
   if (bundle.hash !== expected && !matchesLegacyHash) {
     throw new ProjectContextError("PROJECT_CONTEXT_HASH_MISMATCH", "bundle hash does not match its canonical allowlisted payload");
   }
@@ -8956,7 +8956,7 @@ function projectContextManifestSource(cachePath, runtime, bundle) {
     rules: [],
     renderedPayloadSha256: sha2562(JSON.stringify(bundle)),
     provenance: {
-      schema: PROJECT_CONTEXT_SCHEMA,
+      schema: bundle.schema,
       projectId: bundle.project.id,
       revision: bundle.revision,
       hash: bundle.hash
@@ -8965,7 +8965,7 @@ function projectContextManifestSource(cachePath, runtime, bundle) {
 }
 function manifestProjectContext(plan) {
   return {
-    schema: PROJECT_CONTEXT_SCHEMA,
+    schema: plan.bundle.schema,
     projectId: plan.bundle.project.id,
     revision: plan.bundle.revision,
     hash: plan.bundle.hash,
@@ -10437,11 +10437,13 @@ function sha2562(content) {
 function isRecord(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
-var PROJECT_CONTEXT_SCHEMA = "hasna.projects.project_context_bundle.v1", PROJECT_CONTEXT_MAX_INPUT_BYTES, PROJECT_CONTEXT_MAX_RENDERED_BYTES, PROJECT_CONTEXT_MAX_APPROX_TOKENS = 1000, PROJECT_CONTEXT_MAX_COMMANDS = 6, PROJECT_CONTEXT_MAX_WARNINGS = 3, PROJECT_CONTEXT_FRAGMENT_PATH = ".hasna/instructions/project-context.md", PROJECT_CONTEXT_MANIFEST_PATH = ".hasna/project-context-manifest.json", PROJECT_CONTEXT_CACHE_PATH = ".hasna/project-context-cache.json", PROJECT_CONTEXT_LOCK_PATH = ".hasna/project-context.lock", PROJECT_CONTEXT_SNAPSHOT_DIR = ".hasna/project-context-snapshots", PROJECT_CONTEXT_CACHE_SCHEMA = "hasna.instructions.project-context-cache/v1", PROJECT_CONTEXT_MANAGED_COMMENT = "Managed by @hasna/configs project context", SESSION_COMPATIBILITY_MANIFEST_MAX_BYTES, FOREIGN_INPUT_MAX_BYTES, SESSION_MANAGED_OUTPUT_MAX_BYTES, SESSION_MANAGED_INPUT_MAX_BYTES, SESSION_MANAGED_OUTPUT_PATHS, SESSION_MANAGED_OUTPUT_WARN_BYTES, PROJECT_CONTEXT_LOCK_STALE_MS, LEGACY_CONFIGS_PACKAGE = "@hasna/configs", LEGACY_CONFIGS_COMPAT_VERSION = "0.2.45", LEGACY_CONFIGS_EXECUTABLE = "configs", PROJECT_KINDS, PROJECT_STATUSES, LINK_STATES, RESOLUTION_SOURCES, safeId, nullableId, producerSlug, producerName, safeOptionalDisplay, isoTimestamp, revisionSchema, hashSchema, absolutePath, commandArg, commandSchema, projectContextBundleSchema, storedManifestProjectContextSchema, storedManifestFileSchema, storedManifestObservationSchema, projectContextMetadataSnapshotSchema, projectContextCacheSchema, ProjectContextError, ProjectContextHashRace, anchoredFsOps, atomicExchange, atomicExchangeLibraries;
+var PROJECT_CONTEXT_SCHEMA = "hasna.projects.project_context_bundle.v1", PROJECT_CONTEXT_SCHEMA_V2 = "hasna.projects.project_context_bundle.v2", PROJECT_CONTEXT_SUPPORTED_SCHEMAS, projectContextSchema, PROJECT_CONTEXT_MAX_INPUT_BYTES, PROJECT_CONTEXT_MAX_RENDERED_BYTES, PROJECT_CONTEXT_MAX_APPROX_TOKENS = 1000, PROJECT_CONTEXT_MAX_COMMANDS = 6, PROJECT_CONTEXT_MAX_WARNINGS = 3, PROJECT_CONTEXT_FRAGMENT_PATH = ".hasna/instructions/project-context.md", PROJECT_CONTEXT_MANIFEST_PATH = ".hasna/project-context-manifest.json", PROJECT_CONTEXT_CACHE_PATH = ".hasna/project-context-cache.json", PROJECT_CONTEXT_LOCK_PATH = ".hasna/project-context.lock", PROJECT_CONTEXT_SNAPSHOT_DIR = ".hasna/project-context-snapshots", PROJECT_CONTEXT_CACHE_SCHEMA = "hasna.instructions.project-context-cache/v1", PROJECT_CONTEXT_MANAGED_COMMENT = "Managed by @hasna/configs project context", SESSION_COMPATIBILITY_MANIFEST_MAX_BYTES, FOREIGN_INPUT_MAX_BYTES, SESSION_MANAGED_OUTPUT_MAX_BYTES, SESSION_MANAGED_INPUT_MAX_BYTES, SESSION_MANAGED_OUTPUT_PATHS, SESSION_MANAGED_OUTPUT_WARN_BYTES, PROJECT_CONTEXT_LOCK_STALE_MS, LEGACY_CONFIGS_PACKAGE = "@hasna/configs", LEGACY_CONFIGS_COMPAT_VERSION = "0.2.45", LEGACY_CONFIGS_EXECUTABLE = "configs", PROJECT_KINDS, PROJECT_STATUSES, LINK_STATES, RESOLUTION_SOURCES, safeId, nullableId, producerSlug, producerName, safeOptionalDisplay, isoTimestamp, revisionSchema, hashSchema, absolutePath, commandArg, financeText, financeLegalEntity, financeProjectMetadataSchema, commandSchema, projectContextBundleSchema, storedManifestProjectContextSchema, storedManifestFileSchema, storedManifestObservationSchema, projectContextMetadataSnapshotSchema, projectContextCacheSchema, ProjectContextError, ProjectContextHashRace, anchoredFsOps, atomicExchange, atomicExchangeLibraries;
 var init_project_context = __esm(() => {
   init_zod();
   init_redact();
   init_session_render_contract();
+  PROJECT_CONTEXT_SUPPORTED_SCHEMAS = [PROJECT_CONTEXT_SCHEMA, PROJECT_CONTEXT_SCHEMA_V2];
+  projectContextSchema = exports_external.enum(PROJECT_CONTEXT_SUPPORTED_SCHEMAS);
   PROJECT_CONTEXT_MAX_INPUT_BYTES = 8 * 1024;
   PROJECT_CONTEXT_MAX_RENDERED_BYTES = 4 * 1024;
   SESSION_COMPATIBILITY_MANIFEST_MAX_BYTES = 8 * 1024 * 1024;
@@ -10484,12 +10486,34 @@ var init_project_context = __esm(() => {
   hashSchema = exports_external.string().regex(/^sha256:[a-f0-9]{64}$/);
   absolutePath = exports_external.string().min(1).max(4096).refine((value) => isAbsolute(value), "must be absolute").refine(isSafeSingleLine, "must be safe").nullable();
   commandArg = exports_external.string().min(1).max(1024).refine((value) => isSafeCommandArgument(value), "unsafe argv item");
+  financeText = exports_external.string().min(1).max(512).refine((value) => value === value.trim(), "must be normalized");
+  financeLegalEntity = exports_external.string().min(1).max(256).refine((value) => value === value.trim(), "must be normalized");
+  financeProjectMetadataSchema = exports_external.object({
+    schema: exports_external.literal("hasna.projects.finance_project_metadata.v1"),
+    business_area: exports_external.literal("finance"),
+    jurisdiction: exports_external.string().min(2).max(64).regex(/^[A-Z0-9][A-Z0-9._:-]{1,63}$/),
+    legal_entities: exports_external.array(financeLegalEntity).min(1).max(100).refine((values) => new Set(values).size === values.length, "must not contain duplicate legal entities"),
+    fiscal_cycle: exports_external.enum(["monthly", "quarterly", "annual", "event-driven"]),
+    data_classification: exports_external.enum(["public", "internal", "confidential", "restricted"]),
+    retention_policy: financeText,
+    ledger_authority: financeText,
+    evidence_store: financeText,
+    approver: financeText,
+    external_recipient_policy: financeText
+  }).strict().superRefine((value, context) => {
+    if (Buffer.byteLength(JSON.stringify(value), "utf8") > 4 * 1024) {
+      context.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        message: "finance project metadata exceeds the 4 KiB producer context budget"
+      });
+    }
+  });
   commandSchema = exports_external.object({
     name: exports_external.enum(["show", "context", "why", "context-bundle"]),
     argv: exports_external.array(commandArg).min(1).max(8)
   }).strict();
   projectContextBundleSchema = exports_external.object({
-    schema: exports_external.literal(PROJECT_CONTEXT_SCHEMA),
+    schema: projectContextSchema,
     generated_at: isoTimestamp,
     hash: hashSchema,
     revision: revisionSchema,
@@ -10512,7 +10536,8 @@ var init_project_context = __esm(() => {
       kind: exports_external.enum(PROJECT_KINDS),
       status: exports_external.enum(PROJECT_STATUSES),
       path: absolutePath,
-      updated_at: isoTimestamp
+      updated_at: isoTimestamp,
+      finance: financeProjectMetadataSchema.optional()
     }).strict(),
     links: exports_external.object({
       todos: exports_external.object({
@@ -10535,9 +10560,17 @@ var init_project_context = __esm(() => {
       machine_id: nullableId
     }).strict().nullable(),
     commands: exports_external.array(commandSchema).max(PROJECT_CONTEXT_MAX_COMMANDS)
-  }).strict();
+  }).strict().superRefine((bundle, context) => {
+    if (bundle.schema === PROJECT_CONTEXT_SCHEMA && bundle.project.finance !== undefined) {
+      context.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        path: ["project", "finance"],
+        message: "finance project metadata requires project-context bundle v2"
+      });
+    }
+  });
   storedManifestProjectContextSchema = exports_external.object({
-    schema: exports_external.literal(PROJECT_CONTEXT_SCHEMA),
+    schema: projectContextSchema,
     projectId: safeId,
     revision: revisionSchema,
     hash: hashSchema,
@@ -10808,10 +10841,13 @@ function sourceFingerprint(source) {
     metadata: canonicalFingerprintValue(source.metadata ?? null)
   };
 }
-function slug(value) {
+function normalizeSessionInstructionSourceId(value) {
   const s = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   return s || "instruction";
 }
+function slug(value) {
+  return normalizeSessionInstructionSourceId(value);
+}
 function yamlQuote2(value) {
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
 }
@@ -10930,12 +10966,17 @@ function normalizeSources(sources, tool, allowEmptySources) {
     }
     return normalized2;
   });
+  const originalOrder = [...normalized].sort(compareSessionInstructionSources);
   const deduplicated = deduplicateSemanticPolicySources(normalized);
-  const ordered = deduplicated.selected.sort((a, b) => SESSION_LAYER_RANK[a.resolvedLayer] - SESSION_LAYER_RANK[b.resolvedLayer] || a.resolvedOrder - b.resolvedOrder || a.id.localeCompare(b.id));
+  const ordered = deduplicated.selected.sort(compareSessionInstructionSources);
+  validateTargetedReplacementSources(originalOrder, ordered, deduplicated.skipped);
   rejectDuplicateSourceSlugs(ordered);
   rejectDuplicateRulePaths(ordered);
   return { sources: ordered, skipped: deduplicated.skipped };
 }
+function compareSessionInstructionSources(a, b) {
+  return SESSION_LAYER_RANK[a.resolvedLayer] - SESSION_LAYER_RANK[b.resolvedLayer] || a.resolvedOrder - b.resolvedOrder || a.id.localeCompare(b.id);
+}
 function semanticPolicyIntegrity(body) {
   return sha2563(body) === AGENT_OPERATING_RULES_PAYLOAD_SHA256 ? "pinned-digest" : "unverified-self-declared";
 }
@@ -11062,7 +11103,52 @@ function filterProviderOnlyBlocks(content, tool) {
   return output.join(`
 `);
 }
-function composeSources(sources) {
+function targetedReplacementTarget(source) {
+  if (source.replacementScope == null)
+    return null;
+  if (source.resolvedMerge !== "replace") {
+    throw new Error(`Session instruction source "${source.id}" uses replacement scope "${source.replacementScope}" ` + `with merge=${source.resolvedMerge}; replacement scopes require merge=replace, not append.`);
+  }
+  const scope = source.replacementScope.trim();
+  if (!scope.startsWith("source:")) {
+    throw new Error(`Invalid replacement scope "${source.replacementScope}" for source "${source.id}"; ` + 'expected "source:<normalized-source-id>".');
+  }
+  const target = scope.slice("source:".length);
+  if (!target || target !== slug(target)) {
+    throw new Error(`Invalid replacement scope "${source.replacementScope}" for source "${source.id}"; ` + "the target must be a non-empty normalized source id.");
+  }
+  return target;
+}
+function validateTargetedReplacementSources(originalSources, selectedSources, deduplicatedSources) {
+  for (let replacerIndex = 0;replacerIndex < originalSources.length; replacerIndex++) {
+    const replacer = originalSources[replacerIndex];
+    const targetNormalizedId = targetedReplacementTarget(replacer);
+    if (targetNormalizedId === null)
+      continue;
+    const matches = originalSources.filter((source) => source.normalizedId === targetNormalizedId);
+    if (matches.length === 0) {
+      throw new Error(`Targeted replacement source "${replacer.id}" names missing source "${targetNormalizedId}".`);
+    }
+    if (matches.length > 1) {
+      throw new Error(`Targeted replacement source "${replacer.id}" is ambiguous after normalization: ` + `"${targetNormalizedId}" matches ${matches.map((source) => `"${source.id}"`).join(", ")}.`);
+    }
+    const target = matches[0];
+    const targetIndex = originalSources.indexOf(target);
+    if (targetIndex >= replacerIndex) {
+      throw new Error(`Targeted replacement source "${replacer.id}" must name an earlier source; ` + `"${target.id}" is later than or identical to the replacer.`);
+    }
+    if (target.nonOverridable) {
+      throw new Error(`Targeted replacement source "${replacer.id}" cannot replace non-overridable source "${target.id}".`);
+    }
+    if (!selectedSources.some((source) => source.id === replacer.id)) {
+      throw new Error(`Targeted replacement source "${replacer.id}" was removed by semantic-policy deduplication before composition.`);
+    }
+    if (deduplicatedSources.some((source) => source.id === target.id)) {
+      throw new Error(`Targeted replacement source "${replacer.id}" cannot claim success because target "${target.id}" ` + "was removed by semantic-policy deduplication before composition.");
+    }
+  }
+}
+function composeBroadReplaceSources(sources) {
   let start = -1;
   for (let i = 0;i < sources.length; i++) {
     if (sources[i].resolvedMerge === "replace")
@@ -11076,6 +11162,53 @@ function composeSources(sources) {
   const skipped = earlier.filter((source) => !source.nonOverridable).map((source) => skippedSource(source, `superseded by "${replacer.id}": a replace-merge source discards earlier overridable instruction layers`));
   return { sources: [...protectedSources, ...sources.slice(start)], skipped };
 }
+function composeSources(sources) {
+  const hasTargetedReplacement = sources.some((source) => source.replacementScope !== undefined);
+  if (!hasTargetedReplacement)
+    return composeBroadReplaceSources(sources);
+  const selected = [];
+  const skipped = [];
+  for (const source of sources) {
+    const targetNormalizedId = targetedReplacementTarget(source);
+    if (targetNormalizedId !== null) {
+      const targetIndex = selected.findIndex((candidate) => candidate.normalizedId === targetNormalizedId);
+      if (targetIndex < 0) {
+        throw new Error(`Targeted replacement source "${source.id}" cannot replace "${targetNormalizedId}": ` + "the earlier target was already removed.");
+      }
+      const target = selected[targetIndex];
+      if (target.nonOverridable) {
+        throw new Error(`Targeted replacement source "${source.id}" cannot replace non-overridable source "${target.id}".`);
+      }
+      selected.splice(targetIndex, 1);
+      skipped.push(skippedSource(target, `superseded by "${source.id}": targeted replacement ${source.replacementScope} ` + `removed exactly source "${target.id}"`));
+      selected.push({
+        ...source,
+        provenance: {
+          ...source.provenance ?? {},
+          targetedReplacement: {
+            scope: source.replacementScope,
+            targetSourceId: target.id,
+            targetNormalizedSourceId: target.normalizedId
+          }
+        }
+      });
+      continue;
+    }
+    if (source.resolvedMerge === "replace") {
+      const retained = selected.filter((candidate) => candidate.nonOverridable);
+      for (const candidate of selected) {
+        if (candidate.nonOverridable)
+          continue;
+        skipped.push(skippedSource(candidate, `superseded by "${source.id}": a replace-merge source discards earlier overridable instruction layers`));
+      }
+      selected.length = 0;
+      selected.push(...retained, source);
+      continue;
+    }
+    selected.push(source);
+  }
+  return { sources: selected, skipped };
+}
 function sectionForSource(source) {
   const parts = [
     `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
@@ -15916,7 +16049,7 @@ function parseSessionLayer(value) {
     return value;
   throw new Error(`Invalid source layer "${value}"`);
 }
-function parseSessionSource(value, order, replaceIds) {
+function parseSessionSource(value, order) {
   const idx = value.indexOf("=");
   let id = idx > 0 ? value.slice(0, idx).trim() : "";
   const path = idx > 0 ? value.slice(idx + 1).trim() : value.trim();
@@ -15939,9 +16072,39 @@ function parseSessionSource(value, order, replaceIds) {
     id: resolvedId,
     label: id ? resolvedId : source.label ?? resolvedId,
     layer,
-    merge: replaceIds.has(resolvedId) ? "replace" : "append"
+    merge: "append"
   };
 }
+function parseSessionSourceReplacement(value) {
+  const trimmed = value.trim();
+  const separator = trimmed.indexOf("=");
+  const replacerId = (separator >= 0 ? trimmed.slice(0, separator) : trimmed).trim();
+  if (!replacerId) {
+    throw new Error(`Invalid --replace-source "${value}" (expected replacer-id or replacer-id=target-source-id)`);
+  }
+  if (separator < 0)
+    return { replacerId };
+  const targetId = trimmed.slice(separator + 1).trim();
+  if (!targetId) {
+    throw new Error(`Invalid --replace-source "${value}" (target source id is required after "=")`);
+  }
+  return {
+    replacerId,
+    replacementScope: `source:${normalizeSessionInstructionSourceId(targetId)}`
+  };
+}
+function sessionSourceReplacements(values) {
+  const replacements = new Map;
+  for (const value of values) {
+    const replacement = parseSessionSourceReplacement(value);
+    const existing = replacements.get(replacement.replacerId);
+    if (existing && existing.replacementScope !== replacement.replacementScope) {
+      throw new Error(`Conflicting --replace-source values for "${replacement.replacerId}": ` + `${existing.replacementScope ?? "broad"} and ${replacement.replacementScope ?? "broad"}.`);
+    }
+    replacements.set(replacement.replacerId, replacement);
+  }
+  return replacements;
+}
 function readSessionInstructionSourceFile(path) {
   const stat = lstatSync4(path);
   if (stat.isSymbolicLink()) {
@@ -15972,8 +16135,8 @@ function parseLayeredReference(value) {
   return { id: trimmed };
 }
 async function collectSessionSources(opts, tool, store) {
-  const replaceIds = new Set(opts.replaceSource ?? []);
-  const sources = (opts.source ?? []).map((value, index) => parseSessionSource(value, index, replaceIds));
+  const replacements = sessionSourceReplacements(opts.replaceSource ?? []);
+  const sources = (opts.source ?? []).map((value, index) => parseSessionSource(value, index));
   for (const value of opts.config ?? []) {
     const { layer, id } = parseLayeredReference(value);
     sources.push(sourceFromConfig(await store.getConfig(id), sources.length, layer));
@@ -15985,7 +16148,16 @@ async function collectSessionSources(opts, tool, store) {
     const parsed = JSON.parse(readFileSync12(path, "utf-8"));
     sources.push(...sourcesFromIdentityExport(parsed, { path, tool, orderOffset: sources.length }));
   }
-  return sources.map((source) => replaceIds.has(source.id) ? { ...source, merge: "replace" } : source);
+  return sources.map((source) => {
+    const replacement = replacements.get(source.id);
+    if (!replacement)
+      return source;
+    return {
+      ...source,
+      merge: "replace",
+      replacementScope: replacement.replacementScope
+    };
+  });
 }
 async function checkGlobalSourceCoverage(plan, store) {
   const registryConfigs = await store.listConfigs({});
@@ -16728,7 +16900,7 @@ projectContextCmd.command("apply").description("Atomically write project context
   }
 });
 var sessionCmd = program.command("session").description("Plan and apply session-scoped agent instruction files");
-sessionCmd.command("plan").description("Produce a dry-run render plan for profile-scoped instruction injection").requiredOption("--tool <tool>", `target tool (${SESSION_RENDER_TOOLS.join("|")})`).requiredOption("--profile <profile>", "account/profile name that owns the rendered instruction home").option("--target-home <path>", "override generated profile-scoped target home").option("--project-root <path>", "repository root for project-scoped adapters such as Cursor").option("--session-id <id>", "session id to include in the manifest").option("--source <layer:id=path>", `instruction source file; layers: ${SESSION_SOURCE_LAYER_HELP}`, collectOption, []).option("--config <layer:id-or-slug>", "stored config source by id/slug; repeatable; layer aliases match --source", collectOption, []).option("--identity-export <path>", "OpenIdentities configs instruction export JSON; repeatable", collectOption, []).option("--replace-source <id>", "source id that replaces earlier layers instead of appending", collectOption, []).option("--codewith-native-imports", "select the gated Codewith native @ import adapter").option("--allow-empty-sources", "allow an explicit empty render plan").option("--check-global-coverage", "warn (non-fatal) when a registered, non-retired global-* source is absent from this render's --config list; expected is read fresh from the registry, independent of this plan (todos 102d6d0a)").option("--json", "output dry-run JSON").action(async (opts) => {
+sessionCmd.command("plan").description("Produce a dry-run render plan for profile-scoped instruction injection").requiredOption("--tool <tool>", `target tool (${SESSION_RENDER_TOOLS.join("|")})`).requiredOption("--profile <profile>", "account/profile name that owns the rendered instruction home").option("--target-home <path>", "override generated profile-scoped target home").option("--project-root <path>", "repository root for project-scoped adapters such as Cursor").option("--session-id <id>", "session id to include in the manifest").option("--source <layer:id=path>", `instruction source file; layers: ${SESSION_SOURCE_LAYER_HELP}`, collectOption, []).option("--config <layer:id-or-slug>", "stored config source by id/slug; repeatable; layer aliases match --source", collectOption, []).option("--identity-export <path>", "OpenIdentities configs instruction export JSON; repeatable", collectOption, []).option("--replace-source <replacer-id>[=<target-source-id>]", "source id that broadly replaces earlier layers, or targets one earlier source", collectOption, []).option("--codewith-native-imports", "select the gated Codewith native @ import adapter").option("--allow-empty-sources", "allow an explicit empty render plan").option("--check-global-coverage", "warn (non-fatal) when a registered, non-retired global-* source is absent from this render's --config list; expected is read fresh from the registry, independent of this plan (todos 102d6d0a)").option("--json", "output dry-run JSON").action(async (opts) => {
   try {
     const tool = opts.tool;
     if (!SESSION_RENDER_TOOLS.includes(tool)) {
@@ -16784,7 +16956,7 @@ sessionCmd.command("plan").description("Produce a dry-run render plan for profil
     process.exit(1);
   }
 });
-sessionCmd.command("apply").description("Write a session render plan to its managed target home or explicit project root").requiredOption("--tool <tool>", `target tool (${SESSION_RENDER_TOOLS.join("|")})`).requiredOption("--profile <profile>", "account/profile name that owns the rendered instruction home").option("--target-home <path>", "override generated profile-scoped target home").option("--project-root <path>", "repository root for project-scoped adapters such as Cursor").option("--session-id <id>", "session id to include in the manifest").option("--source <layer:id=path>", `instruction source file; layers: ${SESSION_SOURCE_LAYER_HELP}`, collectOption, []).option("--config <layer:id-or-slug>", "stored config source by id/slug; repeatable; layer aliases match --source", collectOption, []).option("--identity-export <path>", "OpenIdentities configs instruction export JSON; repeatable", collectOption, []).option("--replace-source <id>", "source id that replaces earlier layers instead of appending", collectOption, []).option("--codewith-native-imports", "select the gated Codewith native @ import adapter").option("--allow-empty-sources", "allow an explicit empty render").option("--check-global-coverage", "warn (non-fatal) when a registered, non-retired global-* source is absent from this render's --config list; expected is read fresh from the registry, independent of this plan (todos 102d6d0a)").option("--dry-run", "preview writes and conflicts without writing").option("--force", "overwrite existing unmanaged files").option("--json", "output apply JSON").action(async (opts) => {
+sessionCmd.command("apply").description("Write a session render plan to its managed target home or explicit project root").requiredOption("--tool <tool>", `target tool (${SESSION_RENDER_TOOLS.join("|")})`).requiredOption("--profile <profile>", "account/profile name that owns the rendered instruction home").option("--target-home <path>", "override generated profile-scoped target home").option("--project-root <path>", "repository root for project-scoped adapters such as Cursor").option("--session-id <id>", "session id to include in the manifest").option("--source <layer:id=path>", `instruction source file; layers: ${SESSION_SOURCE_LAYER_HELP}`, collectOption, []).option("--config <layer:id-or-slug>", "stored config source by id/slug; repeatable; layer aliases match --source", collectOption, []).option("--identity-export <path>", "OpenIdentities configs instruction export JSON; repeatable", collectOption, []).option("--replace-source <replacer-id>[=<target-source-id>]", "source id that broadly replaces earlier layers, or targets one earlier source", collectOption, []).option("--codewith-native-imports", "select the gated Codewith native @ import adapter").option("--allow-empty-sources", "allow an explicit empty render").option("--check-global-coverage", "warn (non-fatal) when a registered, non-retired global-* source is absent from this render's --config list; expected is read fresh from the registry, independent of this plan (todos 102d6d0a)").option("--dry-run", "preview writes and conflicts without writing").option("--force", "overwrite existing unmanaged files").option("--json", "output apply JSON").action(async (opts) => {
   try {
     const tool = opts.tool;
     if (!SESSION_RENDER_TOOLS.includes(tool)) {
@@ -17477,7 +17649,7 @@ program.command("watch").description("Watch known config files for changes and a
   setInterval(tick, interval);
   await new Promise(() => {});
 });
-program.command("report").description("Summary of stored configs, drift, and ecosystem health").option("--json", "output as JSON").option("--markdown", "output as markdown").action(async () => {
+program.command("report").description("Summary of stored configs, drift, and ecosystem health").option("--json", "output as JSON").option("--markdown", "output as markdown").action(async (opts) => {
   const store = resolveConfigStore();
   const stats = await store.getConfigStats();
   const allConfigs = await store.listConfigs();
@@ -17503,6 +17675,32 @@ program.command("report").description("Summary of stored configs, drift, and eco
   for (const c of allConfigs)
     byAgent[c.agent] = (byAgent[c.agent] || 0) + 1;
   const projectConfigs = allConfigs.filter((c) => c.target_path && !c.target_path.startsWith("~/."));
+  if (opts.json) {
+    printJson({
+      schema_version: 1,
+      configs: {
+        total: allConfigs.length,
+        files: fileConfigs.length,
+        references: refConfigs.length,
+        templates: templates.length,
+        project: projectConfigs.length
+      },
+      profiles: {
+        total: profiles.length
+      },
+      drift: {
+        drifted,
+        missing
+      },
+      secrets: {
+        findings: 0,
+        policy: "redacted_on_ingest"
+      },
+      by_agent: byAgent,
+      by_category: Object.fromEntries(Object.entries(stats).filter(([key]) => key !== "total").map(([key, value]) => [key, Number(value)]))
+    });
+    return;
+  }
   console.log(chalk.bold(`configs report
 `));
   console.log(`  Total:       ${allConfigs.length} configs (${fileConfigs.length} files, ${refConfigs.length} references)`);