@hasna/instructions 0.4.3 → 0.4.5

package/dist/index.js

@@ -14,11 +14,11 @@ var CONFIG_CATEGORIES = [
 var CONFIG_AGENTS = [
   "claude",
   "codex",
-  "gemini",
   "opencode",
   "cursor",
   "codewith",
   "aicopilot",
+  "antigravity",
   "zsh",
   "git",
   "npm",
@@ -1067,1497 +1067,1637 @@ function resolveConfigStore(env = process.env) {
   return cloud ? new CloudConfigStore(cloud) : new LocalConfigStore;
 }
 // src/status.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
 
 // src/lib/apply.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync, realpathSync, writeFileSync } from "fs";
-import { basename as basename2, dirname, resolve } from "path";
-import { homedir as homedir2 } from "os";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, realpathSync as realpathSync2, writeFileSync } from "fs";
+import { basename as basename3, dirname as dirname2, resolve as resolve2 } from "path";
+import { homedir as homedir3 } from "os";
 
-// src/lib/transforms.ts
-import { basename, extname } from "path";
+// src/lib/config-agents.ts
+var DEPRECATED_CONFIG_AGENTS = ["gemini"];
+var ACTIVE_CONFIG_AGENT_SET = new Set(CONFIG_AGENTS);
+var DEPRECATED_CONFIG_AGENT_SET = new Set(DEPRECATED_CONFIG_AGENTS);
+function isDeprecatedConfigAgent(agent) {
+  return !!agent && DEPRECATED_CONFIG_AGENT_SET.has(agent);
+}
+function isSupportedConfigAgent(agent) {
+  return !!agent && ACTIVE_CONFIG_AGENT_SET.has(agent) && !isDeprecatedConfigAgent(agent);
+}
+function isRetiredOrUnsupportedConfigAgent(agent) {
+  return !!agent && !isSupportedConfigAgent(agent);
+}
+function retiredOrUnsupportedAgentReason(agent) {
+  if (!agent)
+    return "missing agent";
+  return isDeprecatedConfigAgent(agent) ? `deprecated agent: ${agent}` : `unsupported agent: ${agent}`;
+}
+
+// src/lib/session-render.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync3, readFileSync, realpathSync, statSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { basename, dirname, extname, isAbsolute, join as join3, parse, posix, relative, resolve } from "path";
+var CODEWITH_NATIVE_IMPORTS_ENV = "HASNA_CONFIGS_CODEWITH_NATIVE_IMPORTS";
+var SESSION_RENDER_MANAGED_MARKER = "Managed by @hasna/configs session render";
+var SESSION_RENDER_SCHEMA = "hasna.configs.session-render/v1";
+var RAW_STORE_ROOT_ENV = "HASNA_CONFIGS_HOME";
+var ANTIGRAVITY_RULE_FILE_CHAR_LIMIT = 12000;
+var SESSION_RENDER_TOOLS = [
+  "claude",
+  "codex",
+  "cursor",
+  "opencode",
+  "codewith",
+  "aicopilot",
+  "antigravity"
+];
+var SESSION_INSTRUCTION_LAYERS = [
+  "global",
+  "tool",
+  "account",
+  "machine",
+  "division",
+  "workspace",
+  "repo",
+  "path",
+  "agent",
+  "session",
+  "local"
+];
+var CODEWITH_FLATTENED_ADAPTER = {
+  tool: "codewith",
+  mode: "flattened-markdown",
+  indexFile: "CODEWITH.md",
+  managedDir: ".hasna/instructions",
+  envVar: "CODEWITH_HOME",
+  nativeImports: false,
+  description: "Codewith CODEWITH.md flattened until native @ imports are implemented in Codewith."
+};
+var CODEWITH_NATIVE_ADAPTER = {
+  tool: "codewith",
+  mode: "native-imports",
+  indexFile: "CODEWITH.md",
+  managedDir: ".hasna/instructions",
+  envVar: "CODEWITH_HOME",
+  nativeImports: true,
+  description: "Codewith CODEWITH.md with gated @ imports into managed fragments."
+};
+var SESSION_TOOL_ADAPTERS = {
+  claude: {
+    tool: "claude",
+    mode: "native-imports",
+    indexFile: "CLAUDE.md",
+    managedDir: ".hasna/instructions",
+    envVar: "CLAUDE_CONFIG_DIR",
+    nativeImports: true,
+    description: "Claude Code CLAUDE.md with @ imports into managed fragments."
+  },
+  codex: {
+    tool: "codex",
+    mode: "flattened-markdown",
+    indexFile: "AGENTS.md",
+    managedDir: ".hasna/instructions",
+    envVar: "CODEX_HOME",
+    nativeImports: false,
+    description: "Codex AGENTS.md flattened instruction file."
+  },
+  cursor: {
+    tool: "cursor",
+    mode: "cursor-mdc",
+    managedDir: ".cursor/rules",
+    nativeImports: false,
+    description: "Cursor project rule files in .cursor/rules/*.mdc."
+  },
+  opencode: {
+    tool: "opencode",
+    mode: "opencode-instructions",
+    indexFile: "AGENTS.md",
+    configFile: "opencode.json",
+    managedDir: ".hasna/instructions",
+    envVar: "OPENCODE_CONFIG_DIR",
+    nativeImports: false,
+    description: "OpenCode AGENTS.md plus opencode.json instructions pointing at managed fragments."
+  },
+  aicopilot: {
+    tool: "aicopilot",
+    mode: "flattened-markdown",
+    indexFile: "AICOPILOT.md",
+    managedDir: ".hasna/instructions",
+    envVar: "AICOPILOT_CONFIG_DIR",
+    nativeImports: false,
+    description: "AI Copilot AICOPILOT.md flattened instruction file."
+  },
+  antigravity: {
+    tool: "antigravity",
+    mode: "antigravity-rules",
+    managedDir: ".agents/rules",
+    nativeImports: false,
+    description: "Google Antigravity project rules in .agents/rules/*.md."
+  },
+  codewith: CODEWITH_FLATTENED_ADAPTER
+};
+var SESSION_LAYER_RANK = {
+  global: 10,
+  tool: 20,
+  account: 30,
+  machine: 40,
+  division: 50,
+  workspace: 60,
+  repo: 70,
+  path: 80,
+  agent: 90,
+  session: 100,
+  local: 110
+};
+function normalizeSessionInstructionLayer(value) {
+  if (value === "provider")
+    return "tool";
+  if (value === "identity")
+    return "agent";
+  if (value === "project")
+    return "repo";
+  if (value === "global" || value === "tool" || value === "account" || value === "machine" || value === "division" || value === "workspace" || value === "repo" || value === "path" || value === "agent" || value === "session" || value === "local")
+    return value;
+  throw new Error(`Invalid session instruction layer: ${String(value)}`);
+}
 function ensureTrailingNewline(content) {
   return content.endsWith(`
 `) ? content : `${content}
 `;
 }
+function sha256(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+function fingerprint(value) {
+  return sha256(JSON.stringify(value));
+}
+function slug(value) {
+  const s = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return s || "instruction";
+}
 function yamlQuote(value) {
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
 }
-function headingLevel(line) {
-  const m = line.match(/^(#{1,6})\s+/);
-  return m ? m[1].length : null;
+function getRawStoreRoot() {
+  return resolve(process.env[RAW_STORE_ROOT_ENV] || join3(process.env["HOME"] || homedir2(), ".hasna", "configs"));
 }
-function stripClaudeOnlySections(content) {
-  const withoutMarkedBlocks = content.replace(/<!--\s*claude-only:start\s*-->[\s\S]*?<!--\s*claude-only:end\s*-->/gi, "");
-  const lines = withoutMarkedBlocks.split(`
-`);
-  const kept = [];
-  let droppingUntilLevel = null;
-  for (const line of lines) {
-    const level = headingLevel(line);
-    if (level !== null && droppingUntilLevel !== null && level <= droppingUntilLevel) {
-      droppingUntilLevel = null;
+function defaultTargetHome(tool, profile, sessionId) {
+  return join3(getRawStoreRoot(), "sessions", tool, slug(profile), slug(sessionId || "latest"));
+}
+function joinTarget(targetHome, relativePath) {
+  const safeTargetHome = assertSafeTargetRoot(targetHome);
+  const safeRelativePath = assertSafeRelativePath(relativePath);
+  return join3(safeTargetHome, ...safeRelativePath.split("/"));
+}
+function makeFile(targetHome, relativePath, role, content, sourceIds) {
+  const safeTargetHome = assertSafeTargetRoot(targetHome);
+  const safeRelativePath = assertSafeRelativePath(relativePath);
+  const normalizedContent = ensureTrailingNewline(content);
+  return {
+    path: joinTarget(safeTargetHome, safeRelativePath),
+    relativePath: safeRelativePath,
+    role,
+    content: normalizedContent,
+    sha256: sha256(normalizedContent),
+    sourceIds
+  };
+}
+function normalizeSources(sources, tool, allowEmptySources) {
+  const ordered = sources.map((source, index) => {
+    if (!source.id.trim())
+      throw new Error("Session instruction source id is required.");
+    const content = filterProviderOnlyBlocks(source.content ?? "", tool);
+    const normalized = {
+      ...source,
+      content,
+      normalizedId: slug(source.id),
+      resolvedLabel: source.label ?? source.id,
+      resolvedLayer: source.layer === undefined ? "agent" : normalizeSessionInstructionLayer(source.layer),
+      resolvedMerge: source.merge ?? "append",
+      resolvedOrder: source.order ?? index,
+      resolvedRules: normalizeInstructionRules(source, tool)
+    };
+    const hasPathReferences = (normalized.sourcePaths ?? []).length > 0;
+    if (!allowEmptySources && !normalized.content.trim() && normalized.resolvedRules.length === 0 && !hasPathReferences) {
+      throw new Error(`Session instruction source "${source.id}" is empty. Pass --allow-empty-sources only for explicit empty renders.`);
     }
-    if (droppingUntilLevel !== null)
+    return normalized;
+  }).sort((a, b) => SESSION_LAYER_RANK[a.resolvedLayer] - SESSION_LAYER_RANK[b.resolvedLayer] || a.resolvedOrder - b.resolvedOrder || a.id.localeCompare(b.id));
+  rejectDuplicateSourceSlugs(ordered);
+  rejectDuplicateRulePaths(ordered);
+  return ordered;
+}
+function filterProviderOnlyBlocks(content, tool) {
+  const lines = content.split(/\r?\n/);
+  const output = [];
+  let activeProviders = null;
+  for (const line of lines) {
+    const start = line.match(/^\s*<!--\s*@hasna-provider:\s*([^>]+?)\s*-->\s*$/i);
+    if (start) {
+      if (activeProviders)
+        throw new Error("Nested provider-only instruction blocks are not supported.");
+      activeProviders = start[1].split(",").map((item) => item.trim().toLowerCase()).filter(Boolean);
       continue;
-    if (/^#{1,6}\s+.*claude(?:\s+code)?[-\s]+only\b/i.test(line)) {
-      droppingUntilLevel = level ?? 1;
+    }
+    if (/^\s*<!--\s*@hasna-end-provider\s*-->\s*$/i.test(line)) {
+      if (!activeProviders)
+        throw new Error("Provider-only instruction block end marker without start marker.");
+      activeProviders = null;
       continue;
     }
-    kept.push(line);
+    if (!activeProviders || activeProviders.includes(tool) || activeProviders.includes("all") || activeProviders.includes("generic")) {
+      output.push(line);
+    }
   }
-  return kept.join(`
-`).replace(/\n{3,}/g, `
-
-`).trim();
-}
-function isClaudeRuleConfig(source, candidate) {
-  if (candidate.id === source.id)
-    return false;
-  if (candidate.agent !== "claude" || candidate.category !== "rules")
-    return false;
-  return !!candidate.target_path?.includes("/rules/");
-}
-function ruleLabel(config) {
-  const file = config.target_path ? basename(config.target_path) : config.name;
-  return file.replace(/\.(md|mdc|markdown)$/i, "");
+  if (activeProviders)
+    throw new Error("Provider-only instruction block was not closed.");
+  return output.join(`
+`);
 }
-function claudeRules(source, context) {
-  return (context.configs ?? []).filter((config) => isClaudeRuleConfig(source, config)).sort((a, b) => (a.target_path ?? a.name).localeCompare(b.target_path ?? b.name));
+function composeSources(sources) {
+  let start = -1;
+  for (let i = 0;i < sources.length; i++) {
+    if (sources[i].resolvedMerge === "replace")
+      start = i;
+  }
+  if (start < 0)
+    return sources;
+  const protectedSources = sources.slice(0, start).filter((source) => source.nonOverridable);
+  return [...protectedSources, ...sources.slice(start)];
 }
-function flattenWithRules(source, context) {
-  const parts = [stripClaudeOnlySections(source.content)];
-  const rules = claudeRules(source, context).map((rule) => ({ rule, content: stripClaudeOnlySections(rule.content) })).filter(({ content }) => Boolean(content)).map(({ rule, content }) => `### ${ruleLabel(rule)}
-
-${content}`);
-  if (rules.length > 0) {
-    parts.push(`## Rules
-
-${rules.join(`
-
-`)}`);
+function sectionForSource(source) {
+  const parts = [
+    `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
+    `# ${source.resolvedLabel}`
+  ];
+  if (source.path)
+    parts.push(`Source: ${source.path}`);
+  if (source.sourcePaths && source.sourcePaths.length > 0) {
+    parts.push([
+      "Source paths:",
+      ...source.sourcePaths.map((sourcePath) => {
+        const flags = [
+          sourcePath.editable ? "editable" : null,
+          sourcePath.required ? "required" : null,
+          sourcePath.hash ? sourcePath.hash : null
+        ].filter(Boolean);
+        return `- ${sourcePath.path}${flags.length > 0 ? ` (${flags.join(", ")})` : ""}`;
+      })
+    ].join(`
+`));
   }
-  return ensureTrailingNewline(parts.filter(Boolean).join(`
+  if (source.owner)
+    parts.push(`Owner: ${source.owner.kind}:${source.owner.id}`);
+  const content = source.content.trim();
+  if (content)
+    parts.push(content);
+  return parts.join(`
 
-`));
-}
-function buildCodexAgentsMd(source, context = {}) {
-  return flattenWithRules(source, context);
+`);
 }
-function buildOpenCodeAgentsMd(source, context = {}) {
-  return flattenWithRules(source, context);
+function sectionForRule(source, rule) {
+  const parts = [
+    `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
+    `# ${rule.resolvedLabel}`
+  ];
+  if (source.path)
+    parts.push(`Source: ${source.path}`);
+  if (rule.path)
+    parts.push(`Rule path: ${rule.path}`);
+  const content = rule.content.trim();
+  if (content)
+    parts.push(content);
+  return parts.join(`
+
+`);
 }
-function buildCursorMdc(source) {
-  const stem = source.target_path ? basename(source.target_path, extname(source.target_path)) : source.slug;
-  const description = source.name || stem;
-  return ensureTrailingNewline([
-    "---",
-    `description: ${yamlQuote(description)}`,
-    'globs: ["**/*"]',
-    "alwaysApply: true",
-    "---",
+function fragmentPath(adapter, index, source) {
+  const n = String(index + 1).padStart(2, "0");
+  return posix.join(adapter.managedDir, `${n}-${source.normalizedId}.md`);
+}
+function ruleFragmentPath(adapter, source, rule) {
+  return posix.join(adapter.managedDir, "rules", source.normalizedId, rule.resolvedPath);
+}
+function importPath(indexRelativePath, fragmentRelativePath) {
+  const relative2 = posix.relative(posix.dirname(indexRelativePath), fragmentRelativePath);
+  if (relative2.startsWith("./") || relative2.startsWith("../"))
+    return relative2;
+  return `./${relative2}`;
+}
+function indexHeader(tool, profile) {
+  return [
+    `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
+    `# ${tool} session instructions`,
     "",
-    stripClaudeOnlySections(source.content)
+    `Profile: ${profile}`
   ].join(`
-`));
+`);
 }
-function transformSkillContent(content) {
-  return ensureTrailingNewline(content.split(`
-`).filter((line) => !/^\s*user_invocable\s*:/i.test(line)).join(`
-`).replace(/\bAgent tool\b/g, "delegate through the available MCP or agent orchestration tools").replace(/\bTodoWrite\b/g, "track tasks with the agent's native task mechanism").replace(/\bRead\/Edit\b/g, "read and edit files with the available filesystem tools").replace(/\bRead\b/g, "read files with the available filesystem tools").replace(/\bEdit\b/g, "edit files with the available filesystem tools").replace(/\bBash\b/g, "run shell commands with the available terminal tool").trim());
+function buildNativeImportFiles(targetHome, adapter, profile, sources) {
+  const indexFile = adapter.indexFile;
+  const fragments = sources.flatMap((source, index2) => [
+    makeFile(targetHome, fragmentPath(adapter, index2, source), "fragment", sectionForSource(source), [source.id]),
+    ...source.resolvedRules.map((rule) => makeFile(targetHome, ruleFragmentPath(adapter, source, rule), "rule", sectionForRule(source, rule), [source.id, rule.id]))
+  ]);
+  const imports = fragments.map((file) => `@${importPath(indexFile, file.relativePath)}`);
+  const index = makeFile(targetHome, indexFile, "index", [indexHeader(adapter.tool, profile), ...imports].join(`
+`), sources.map((source) => source.id));
+  return [index, ...fragments];
 }
-function applyTransform(source, output, context = {}) {
-  switch (output.transform) {
-    case "passthrough":
-    case "claude-passthrough":
-      return ensureTrailingNewline(source.content);
-    case "codex-flat":
-      return buildCodexAgentsMd(source, context);
-    case "opencode-flat":
-      return buildOpenCodeAgentsMd(source, context);
+function buildFlattenedMarkdownFiles(targetHome, adapter, profile, sources) {
+  const content = [
+    indexHeader(adapter.tool, profile),
+    ...sources.flatMap((source) => [
+      sectionForSource(source),
+      ...source.resolvedRules.map((rule) => sectionForRule(source, rule))
+    ])
+  ].join(`
+
+`);
+  return [
+    makeFile(targetHome, adapter.indexFile, "index", content, [
+      ...sources.map((source) => source.id),
+      ...sources.flatMap((source) => source.resolvedRules.map((rule) => rule.id))
+    ])
+  ];
+}
+function buildCursorRuleFiles(targetHome, adapter, sources) {
+  return sources.flatMap((source, index) => {
+    const n = String(index + 1).padStart(2, "0");
+    const stem = `${n}-${source.normalizedId}`;
+    const relativePath = posix.join(adapter.managedDir, `${stem}.mdc`);
+    const description = `${source.resolvedLabel} (${source.resolvedLayer})`;
+    const content = [
+      "---",
+      `description: ${yamlQuote(description)}`,
+      'globs: ["**/*"]',
+      "alwaysApply: true",
+      "---",
+      "",
+      `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
+      "",
+      source.content.trim()
+    ].join(`
+`);
+    const sourceFile = makeFile(targetHome, relativePath, "rule", content, [source.id]);
+    const ruleFiles = source.resolvedRules.map((rule) => {
+      const ruleStem = `${n}-${source.normalizedId}-${rule.normalizedId}`;
+      const ruleRelativePath = posix.join(adapter.managedDir, `${ruleStem}.mdc`);
+      const ruleDescription = `${rule.resolvedLabel} (${source.resolvedLayer})`;
+      const ruleContent = [
+        "---",
+        `description: ${yamlQuote(ruleDescription)}`,
+        `globs: ${JSON.stringify(rule.globs && rule.globs.length > 0 ? rule.globs : ["**/*"])}`,
+        "alwaysApply: true",
+        "---",
+        "",
+        `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
+        "",
+        rule.content.trim()
+      ].join(`
+`);
+      return makeFile(targetHome, ruleRelativePath, "rule", ruleContent, [source.id, rule.id]);
+    });
+    return [sourceFile, ...ruleFiles];
+  });
+}
+function buildOpenCodeFiles(targetHome, adapter, profile, sources) {
+  const fragments = sources.flatMap((source, index) => [
+    makeFile(targetHome, fragmentPath(adapter, index, source), "fragment", sectionForSource(source), [source.id]),
+    ...source.resolvedRules.map((rule) => makeFile(targetHome, ruleFragmentPath(adapter, source, rule), "rule", sectionForRule(source, rule), [source.id, rule.id]))
+  ]);
+  const flattenedIndex = makeFile(targetHome, adapter.indexFile, "index", [
+    indexHeader(adapter.tool, profile),
+    ...sources.flatMap((source) => [
+      sectionForSource(source),
+      ...source.resolvedRules.map((rule) => sectionForRule(source, rule))
+    ])
+  ].join(`
+
+`), [
+    ...sources.map((source) => source.id),
+    ...sources.flatMap((source) => source.resolvedRules.map((rule) => rule.id))
+  ]);
+  const config = {
+    $schema: "https://opencode.ai/config.json",
+    instructions: fragments.map((file) => file.relativePath)
+  };
+  return [
+    flattenedIndex,
+    makeFile(targetHome, adapter.configFile, "config", JSON.stringify(config, null, 2), sources.map((source) => source.id)),
+    ...fragments
+  ];
+}
+function buildAntigravityRuleFiles(targetHome, adapter, sources) {
+  return sources.flatMap((source, index) => {
+    const n = String(index + 1).padStart(2, "0");
+    const sourcePath = posix.join(adapter.managedDir, `${n}-${source.normalizedId}.md`);
+    const sourceFile = makeAntigravityRuleFile(targetHome, sourcePath, sectionForSource(source), [source.id]);
+    const ruleFiles = source.resolvedRules.map((rule) => {
+      const rulePath = posix.join(adapter.managedDir, `${n}-${source.normalizedId}-${rule.resolvedPath}`);
+      return makeAntigravityRuleFile(targetHome, rulePath, sectionForRule(source, rule), [source.id, rule.id]);
+    });
+    return [sourceFile, ...ruleFiles];
+  });
+}
+function makeAntigravityRuleFile(targetHome, relativePath, content, sourceIds) {
+  const file = makeFile(targetHome, relativePath, "rule", content, sourceIds);
+  if (file.content.length > ANTIGRAVITY_RULE_FILE_CHAR_LIMIT) {
+    throw new Error(`Antigravity rule file ${file.relativePath} is ${file.content.length} characters; split it before rendering because Antigravity limits rule files to ${ANTIGRAVITY_RULE_FILE_CHAR_LIMIT} characters.`);
+  }
+  return file;
+}
+function buildFiles(targetHome, adapter, profile, sources) {
+  switch (adapter.mode) {
+    case "native-imports":
+      return buildNativeImportFiles(targetHome, adapter, profile, sources);
+    case "flattened-markdown":
+      return buildFlattenedMarkdownFiles(targetHome, adapter, profile, sources);
     case "cursor-mdc":
-      return buildCursorMdc(source);
-    case "skill-neutral":
-      return transformSkillContent(source.content);
+      return buildCursorRuleFiles(targetHome, adapter, sources);
+    case "opencode-instructions":
+      return buildOpenCodeFiles(targetHome, adapter, profile, sources);
+    case "antigravity-rules":
+      return buildAntigravityRuleFiles(targetHome, adapter, sources);
   }
 }
-
-// src/lib/apply.ts
-function getConfigHome() {
+function adapterFor(input) {
+  if (input.tool !== "codewith")
+    return SESSION_TOOL_ADAPTERS[input.tool];
+  const gatedNativeImports = input.codewithNativeImports === true || process.env[CODEWITH_NATIVE_IMPORTS_ENV] === "1" || process.env[CODEWITH_NATIVE_IMPORTS_ENV] === "true";
+  return gatedNativeImports ? CODEWITH_NATIVE_ADAPTER : CODEWITH_FLATTENED_ADAPTER;
+}
+function getHomeDir() {
   return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir2();
 }
-function expandPath(p) {
-  if (p.startsWith("~/")) {
-    return resolve(getConfigHome(), p.slice(2));
+function cleanSessionPathInput(path) {
+  const trimmed = path.trim();
+  if (trimmed.length >= 2 && (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+    return trimmed.slice(1, -1);
   }
-  return resolve(p);
+  return trimmed;
 }
-function normalizeTargetPath(p) {
-  const expanded = expandPath(p);
-  try {
-    return realpathSync(expanded);
-  } catch {
-    let current = expanded;
-    const missingSegments = [];
-    while (true) {
-      if (existsSync3(current)) {
-        try {
-          return resolve(realpathSync(current), ...missingSegments);
-        } catch {
-          return expanded;
-        }
-      }
-      const parent = dirname(current);
-      const name = basename2(current);
-      if (parent === current)
-        return expanded;
-      missingSegments.unshift(name);
-      current = parent;
-    }
+function resolveSessionPath(path) {
+  const cleaned = cleanSessionPathInput(path);
+  if (!cleaned)
+    throw new Error("Session render path cannot be empty.");
+  const home = getHomeDir();
+  if (cleaned === "~")
+    return resolve(home);
+  if (cleaned.startsWith("~/"))
+    return resolve(home, cleaned.slice(2));
+  if (cleaned === "{{HOME}}" || cleaned === "${HOME}")
+    return resolve(home);
+  if (cleaned.startsWith("{{HOME}}/"))
+    return resolve(home, cleaned.slice("{{HOME}}/".length));
+  if (cleaned.startsWith("${HOME}/"))
+    return resolve(home, cleaned.slice("${HOME}/".length));
+  return resolve(cleaned);
+}
+function assertSafeRelativePath(relativePath) {
+  if (!relativePath.trim())
+    throw new Error("Session render relative path cannot be empty.");
+  if (relativePath.includes("\\"))
+    throw new Error(`Session render relative path must use POSIX separators: ${relativePath}`);
+  const normalized = posix.normalize(relativePath);
+  if (normalized === "." || posix.isAbsolute(normalized) || normalized === ".." || normalized.startsWith("../")) {
+    throw new Error(`Session render relative path escapes target root: ${relativePath}`);
   }
+  return normalized;
 }
-async function writeConfigResult(config, targetPath, content, opts, meta = {}) {
-  const renderedTargetPath = opts.vars ? renderMachineAwareContent(targetPath, opts.vars) : targetPath;
-  const renderedContent = opts.vars ? renderMachineAwareContent(content, opts.vars) : content;
-  const path = expandPath(renderedTargetPath);
-  const previousContent = existsSync3(path) ? readFileSync(path, "utf-8") : null;
-  const changed = previousContent !== renderedContent;
-  if (!opts.dryRun) {
-    const dir = dirname(path);
-    if (!existsSync3(dir)) {
-      mkdirSync2(dir, { recursive: true });
-    }
-    if (previousContent !== null && changed) {
-      const store = opts.store ?? resolveConfigStore();
-      await store.createSnapshot(config.id, previousContent, config.version);
+function assertSafeTargetRoot(targetHome) {
+  if (!isAbsolute(targetHome))
+    throw new Error(`Session render target must be an absolute path: ${targetHome}`);
+  const normalized = resolve(targetHome);
+  if (normalized === parse(normalized).root) {
+    throw new Error(`Session render target cannot be the filesystem root: ${targetHome}`);
+  }
+  return normalized;
+}
+function resolveRenderTarget(input) {
+  if (input.tool === "cursor" || input.tool === "antigravity") {
+    if (!input.projectRoot) {
+      const label = input.tool === "cursor" ? "Cursor rules" : "Antigravity rules";
+      const path = input.tool === "cursor" ? ".cursor/rules files" : ".agents/rules files";
+      return {
+        targetHome: defaultTargetHome(input.tool, input.profile, input.sessionId),
+        targetKind: "blocked",
+        blockers: [
+          `${label} are project-scoped; pass --project-root (or projectRoot) before applying ${path}. --target-home is not treated as a repository root for ${input.tool}.`
+        ]
+      };
     }
-    writeFileSync(path, renderedContent, "utf-8");
+    return {
+      targetHome: resolveSessionPath(input.projectRoot),
+      targetKind: "project-root",
+      blockers: []
+    };
   }
   return {
-    config_id: config.id,
-    path,
-    previous_content: previousContent,
-    new_content: renderedContent,
-    dry_run: opts.dryRun ?? false,
-    changed,
-    ...meta
+    targetHome: input.targetHome ? resolveSessionPath(input.targetHome) : defaultTargetHome(input.tool, input.profile, input.sessionId),
+    targetKind: "session-home",
+    blockers: []
   };
 }
-function isGeneratedOutputTarget(config, configs) {
-  if (!config.target_path)
-    return false;
-  const targetPath = normalizeTargetPath(config.target_path);
-  return configs.some((candidate) => candidate.id !== config.id && candidate.outputs.some((output) => normalizeTargetPath(output.target_path) === targetPath));
-}
-async function applyConfig(config, opts = {}) {
-  const selectedOutputs = opts.outputAgent ? config.outputs.filter((output) => output.agent === opts.outputAgent) : config.outputs;
-  const shouldApplyPrimary = !opts.outputAgent || config.agent === opts.outputAgent;
-  if (config.kind === "reference" || (!config.target_path || !shouldApplyPrimary) && selectedOutputs.length === 0) {
-    throw new ConfigApplyError(`Config "${config.name}" is a reference (kind=reference) and has no target_path \u2014 cannot apply to disk.`);
-  }
-  const store = opts.store ?? resolveConfigStore();
-  const contextConfigs = selectedOutputs.length > 0 || config.target_path ? await store.listConfigs() : [config];
-  if (isGeneratedOutputTarget(config, contextConfigs)) {
-    throw new ConfigApplyError(`Config "${config.name}" targets a generated output path. Apply the canonical source config instead.`);
-  }
-  const outputResults = [];
-  for (const output of selectedOutputs) {
-    outputResults.push(await applyOutput(config, output, contextConfigs, opts));
-  }
-  let result;
-  if (config.target_path && shouldApplyPrimary) {
-    result = await writeConfigResult(config, config.target_path, config.content, opts);
-    result.outputs = outputResults;
-    result.changed = result.changed || outputResults.some((output) => output.changed);
-  } else {
-    result = {
-      ...outputResults[0],
-      outputs: outputResults.slice(1),
-      changed: outputResults.some((output) => output.changed)
+function resolveSessionTargetOwnership(input, target) {
+  if (target.targetKind === "blocked") {
+    return {
+      kind: "blocked",
+      tool: input.tool,
+      profile: input.profile,
+      targetHome: target.targetHome,
+      projectRoot: input.projectRoot ? resolveSessionPath(input.projectRoot) : null,
+      ownedBy: "open-configs",
+      reason: "target resolution blocked before provider files can be owned"
     };
   }
-  if (!opts.dryRun) {
-    await store.updateConfig(config.id, { synced_at: new Date().toISOString() });
-  }
-  return result;
-}
-async function applyOutput(config, output, contextConfigs, opts) {
-  const content = applyTransform(config, output, { configs: contextConfigs });
-  return writeConfigResult(config, output.target_path, content, opts, {
-    agent: output.agent,
-    transform: output.transform
-  });
-}
-async function applyConfigs(configs, opts = {}) {
-  const results = [];
-  for (const config of configs) {
-    if (config.kind === "reference")
-      continue;
-    results.push(await applyConfig(config, opts));
-  }
-  return results;
-}
-
-// src/lib/redact.ts
-var SECRET_KEY_PATTERN = /^(.*_?API_?KEY|.*_?TOKEN|.*_?SECRET|.*_?PASSWORD|.*_?PASSWD|.*_?CREDENTIAL|.*_?AUTH(?:_TOKEN|_KEY|ORIZATION)?|.*_?PRIVATE_?KEY|.*_?ACCESS_?KEY|.*_?CLIENT_?SECRET|.*_?SIGNING_?KEY|.*_?ENCRYPTION_?KEY|.*_AUTH_TOKEN)$/i;
-var VALUE_PATTERNS = [
-  { re: /npm_[A-Za-z0-9]{36,}/, reason: "npm token" },
-  { re: /gh[pousr]_[A-Za-z0-9_]{36,}/, reason: "GitHub token" },
-  { re: /sk-ant-[A-Za-z0-9\-_]{40,}/, reason: "Anthropic API key" },
-  { re: /sk-[A-Za-z0-9]{48,}/, reason: "OpenAI API key" },
-  { re: /xoxb-[0-9]+-[A-Za-z0-9\-]+/, reason: "Slack bot token" },
-  { re: /AIza[0-9A-Za-z\-_]{35}/, reason: "Google API key" },
-  { re: /ey[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{20,}\./, reason: "JWT token" },
-  { re: /AKIA[0-9A-Z]{16}/, reason: "AWS access key" }
-];
-var MIN_SECRET_VALUE_LEN = 8;
-function redactShell(content) {
-  const redacted = [];
-  const lines = content.split(`
-`);
-  const out = [];
-  for (let i = 0;i < lines.length; i++) {
-    const line = lines[i];
-    const m = line.match(/^(\s*(?:export\s+)?)([A-Z][A-Z0-9_]*)(\s*=\s*)(['"]?)(.+?)\4\s*$/);
-    if (m) {
-      const [, prefix, key, eq, quote, value] = m;
-      if (shouldRedactKeyValue(key, value)) {
-        const reason = reasonFor(key, value);
-        redacted.push({ varName: key, line: i + 1, reason });
-        out.push(`${prefix}${key}${eq}${quote}{{${key}}}${quote}`);
-        continue;
-      }
-    }
-    out.push(line);
+  if (target.targetKind === "project-root") {
+    return {
+      kind: "project",
+      tool: input.tool,
+      profile: input.profile,
+      targetHome: target.targetHome,
+      projectRoot: target.targetHome,
+      ownedBy: "open-configs",
+      reason: "project-scoped provider files are generated in the explicit repository root"
+    };
   }
-  return { content: out.join(`
-`), redacted, isTemplate: redacted.length > 0 };
+  return {
+    kind: "provider-profile",
+    tool: input.tool,
+    profile: input.profile,
+    targetHome: target.targetHome,
+    projectRoot: null,
+    ownedBy: "open-configs",
+    reason: "profile-scoped provider home is generated by OpenConfigs from identity/config sources"
+  };
 }
-function redactJson(content) {
-  const redacted = [];
-  const lines = content.split(`
-`);
-  const out = [];
-  for (let i = 0;i < lines.length; i++) {
-    const line = lines[i];
-    const m = line.match(/^(\s*"([^"]+)"\s*:\s*)"([^"]+)"(,?)(\s*)$/);
-    if (m) {
-      const [, prefix, key, value, comma, trail] = m;
-      if (shouldRedactKeyValue(key, value)) {
-        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
-        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
-        out.push(`${prefix}"{{${varName}}}"${comma}${trail}`);
-        continue;
-      }
-    }
-    let newLine = line;
-    for (const { re, reason } of VALUE_PATTERNS) {
-      newLine = newLine.replace(re, (match) => {
-        const varName = `REDACTED_${reason.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
-        redacted.push({ varName, line: i + 1, reason });
-        return `{{${varName}}}`;
-      });
-    }
-    out.push(newLine);
+function planSessionRender(input) {
+  if (!SESSION_RENDER_TOOLS.includes(input.tool))
+    throw new Error(`Unsupported session render tool: ${input.tool}`);
+  if (!input.profile.trim())
+    throw new Error("Session render profile is required.");
+  const adapter = adapterFor(input);
+  const { targetHome, targetKind, blockers } = resolveRenderTarget(input);
+  const targetOwner = resolveSessionTargetOwnership(input, { targetHome, targetKind });
+  const blocked = blockers.length > 0;
+  const allowEmptySources = input.allowEmptySources === true;
+  const orderedSources = composeSources(normalizeSources(input.sources, input.tool, allowEmptySources));
+  if (orderedSources.length === 0 && !allowEmptySources) {
+    throw new Error("Session render has no instruction sources. Pass --allow-empty-sources only for explicit empty renders.");
   }
-  return { content: out.join(`
-`), redacted, isTemplate: redacted.length > 0 };
+  const generatedAt = input.generatedAt ?? new Date().toISOString();
+  const env = adapter.envVar && !blocked ? { [adapter.envVar]: targetHome } : {};
+  const warnings = [
+    ...orderedSources.length === 0 ? ["No instruction sources were provided."] : [],
+    ...blockers
+  ];
+  const files = blocked ? [] : buildFiles(targetHome, adapter, input.profile, orderedSources);
+  rejectDuplicateRenderPaths(files);
+  const manifest = {
+    schema: SESSION_RENDER_SCHEMA,
+    tool: input.tool,
+    adapterMode: adapter.mode,
+    profile: input.profile,
+    sessionId: input.sessionId ?? null,
+    targetHome,
+    targetKind,
+    targetOwner,
+    writable: !blocked,
+    blocked,
+    blockers,
+    generatedAt,
+    env,
+    sourceHash: fingerprint(orderedSources.map((source) => ({
+      id: source.id,
+      layer: source.resolvedLayer,
+      order: source.resolvedOrder,
+      merge: source.resolvedMerge,
+      content: source.content,
+      rules: source.resolvedRules.map((rule) => ({ id: rule.id, path: rule.resolvedPath, content: rule.content })),
+      hash: source.hash ?? null
+    }))),
+    sources: orderedSources.map((source) => ({
+      id: source.id,
+      label: source.resolvedLabel,
+      layer: source.resolvedLayer,
+      merge: source.resolvedMerge,
+      order: source.resolvedOrder,
+      path: source.path ?? null,
+      targetProviders: source.targetProviders ?? [],
+      owner: source.owner ?? null,
+      sourcePaths: source.sourcePaths ?? [],
+      hash: source.hash ?? null,
+      nonOverridable: source.nonOverridable === true,
+      replacementScope: source.replacementScope ?? null,
+      rules: source.resolvedRules.map((rule) => ({
+        id: rule.id,
+        label: rule.resolvedLabel,
+        path: rule.resolvedPath,
+        globs: rule.globs ?? [],
+        hash: rule.hash ?? null
+      })),
+      provenance: source.provenance ?? null
+    })),
+    skippedSources: [],
+    files: files.map((file) => ({
+      path: file.path,
+      relativePath: file.relativePath,
+      role: file.role,
+      sha256: file.sha256,
+      sourceIds: file.sourceIds
+    })),
+    warnings
+  };
+  const manifestFile = makeFile(targetHome, posix.join(".hasna", "session-render-manifest.json"), "manifest", JSON.stringify(manifest, null, 2), orderedSources.map((source) => source.id));
+  return {
+    dryRun: true,
+    tool: input.tool,
+    adapter,
+    profile: input.profile,
+    sessionId: input.sessionId ?? null,
+    targetHome,
+    targetKind,
+    targetOwner,
+    writable: !blocked,
+    blocked,
+    blockers,
+    env,
+    files,
+    manifest,
+    manifestFile,
+    allFiles: [...files, manifestFile],
+    warnings
+  };
 }
-function redactToml(content) {
-  const redacted = [];
-  const lines = content.split(`
-`);
-  const out = [];
-  for (let i = 0;i < lines.length; i++) {
-    const line = lines[i];
-    const m = line.match(/^(\s*)([a-zA-Z][a-zA-Z0-9_\-]*)(\s*=\s*)(['"]?)(.+?)\4\s*$/);
-    if (m) {
-      const [, indent, key, eq, quote, value] = m;
-      if (shouldRedactKeyValue(key, value)) {
-        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
-        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
-        out.push(`${indent}${key}${eq}${quote}{{${varName}}}${quote}`);
-        continue;
-      }
-    }
-    out.push(line);
-  }
-  return { content: out.join(`
-`), redacted, isTemplate: redacted.length > 0 };
-}
-function redactIni(content) {
-  const redacted = [];
-  const lines = content.split(`
-`);
-  const out = [];
-  for (let i = 0;i < lines.length; i++) {
-    const line = lines[i];
-    const authM = line.match(/^(\/\/[^:]+:_authToken=)(.+)$/);
-    if (authM && !isReferenceValue(authM[2].trim())) {
-      redacted.push({ varName: "NPM_TOKEN", line: i + 1, reason: "npm auth token" });
-      out.push(`${authM[1]}\${NPM_TOKEN}`);
-      continue;
-    }
-    const m = line.match(/^(\s*)([a-zA-Z][a-zA-Z0-9_\-]*)(\s*=\s*)(.+?)\s*$/);
-    if (m) {
-      const [, indent, key, eq, value] = m;
-      if (shouldRedactKeyValue(key, value)) {
-        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
-        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
-        out.push(`${indent}${key}${eq}{{${varName}}}`);
-        continue;
-      }
-    }
-    out.push(line);
-  }
-  return { content: out.join(`
-`), redacted, isTemplate: redacted.length > 0 };
-}
-function redactGeneric(content) {
-  const redacted = [];
-  const lines = content.split(`
-`);
-  const out = [];
-  for (let i = 0;i < lines.length; i++) {
-    let line = lines[i];
-    for (const { re, reason } of VALUE_PATTERNS) {
-      line = line.replace(re, (match) => {
-        const varName = reason.toUpperCase().replace(/[^A-Z0-9]/g, "_");
-        redacted.push({ varName, line: i + 1, reason });
-        return `{{${varName}}}`;
-      });
-    }
-    out.push(line);
-  }
-  return { content: out.join(`
-`), redacted, isTemplate: redacted.length > 0 };
-}
-function shouldRedactKeyValue(key, value) {
-  if (!value || value.startsWith("{{"))
-    return false;
-  if (isReferenceValue(value.trim()))
-    return false;
-  if (value.length < MIN_SECRET_VALUE_LEN)
-    return false;
-  if (/^(true|false|yes|no|on|off|null|undefined|\d+)$/i.test(value))
-    return false;
-  if (SECRET_KEY_PATTERN.test(key))
-    return true;
-  for (const { re } of VALUE_PATTERNS) {
-    if (re.test(value))
-      return true;
-  }
-  return false;
-}
-function reasonFor(key, value) {
-  if (SECRET_KEY_PATTERN.test(key))
-    return `secret key name: ${key}`;
-  for (const { re, reason } of VALUE_PATTERNS) {
-    if (re.test(value))
-      return reason;
-  }
-  return "secret value pattern";
-}
-function isReferenceValue(value) {
-  return /^\{\{[A-Z][A-Z0-9_]*\}\}$/.test(value) || /^\$\{[A-Z][A-Z0-9_]*\}$/.test(value) || /^\$[A-Z][A-Z0-9_]*$/.test(value) || /^%[A-Z][A-Z0-9_]*%$/.test(value);
-}
-function redactContent(content, format) {
-  switch (format) {
-    case "shell":
-      return redactShell(content);
-    case "json":
-      return redactJson(content);
-    case "toml":
-      return redactToml(content);
-    case "ini":
-      return redactIni(content);
-    default:
-      return redactGeneric(content);
-  }
-}
-function scanSecrets(content, format) {
-  const r = redactContent(content, format);
-  return r.redacted;
-}
-function hasSecrets(content, format) {
-  return scanSecrets(content, format).length > 0;
-}
-
-// src/status.ts
-var PACKAGE_NAME = "@hasna/instructions";
-var PACKAGE_VERSION = "0.3.0";
-function activeDatabaseEnv() {
-  if (process.env["HASNA_INSTRUCTIONS_DB_PATH"])
-    return "HASNA_INSTRUCTIONS_DB_PATH";
-  return null;
-}
-function configuredDatabaseKind() {
-  const value = process.env["HASNA_INSTRUCTIONS_DB_PATH"] ?? "";
-  return value === ":memory:" || value.startsWith("file::memory:") ? "memory" : "file";
-}
-function countBy(items, getValue) {
-  const counts = {};
-  for (const item of items) {
-    const value = getValue(item);
-    if (!value)
-      continue;
-    counts[value] = (counts[value] ?? 0) + 1;
-  }
-  return counts;
-}
-async function getConfigsStatus(store = resolveConfigStore()) {
-  let databaseReachable = true;
-  let configs = [];
-  let categoryStats = { total: 0 };
-  try {
-    configs = await store.listConfigs();
-    categoryStats = await store.getConfigStats();
-  } catch {
-    databaseReachable = false;
-  }
-  const fileConfigs = configs.filter((config) => config.kind === "file");
-  let driftedTargets = 0;
-  let missingTargets = 0;
-  let unredactedSecretFindings = 0;
-  let knownTargets = 0;
-  for (const config of fileConfigs) {
-    unredactedSecretFindings += scanSecrets(config.content, config.format).length;
-    if (!config.target_path)
-      continue;
-    knownTargets += 1;
-    const targetPath = expandPath(config.target_path);
-    if (!existsSync4(targetPath)) {
-      missingTargets += 1;
-      continue;
-    }
-    const disk = readFileSync2(targetPath, "utf-8");
-    const { content: redactedDisk } = redactContent(disk, config.format);
-    if (redactedDisk !== config.content) {
-      driftedTargets += 1;
-    }
-  }
-  let profiles = 0;
-  let machines = 0;
-  let profileLinks = 0;
-  let snapshots = 0;
-  if (databaseReachable) {
-    try {
-      const profileList = await store.listProfiles();
-      profiles = profileList.length;
-      machines = (await store.listMachines()).length;
-      for (const profile of profileList) {
-        profileLinks += (await store.getProfileConfigs(profile.id)).length;
-      }
-      for (const config of configs) {
-        snapshots += (await store.listSnapshots(config.id)).length;
-      }
-    } catch {
-      databaseReachable = false;
-    }
-  }
-  const byCategory = Object.fromEntries(Object.entries(categoryStats).filter(([key]) => key !== "total"));
-  const status = databaseReachable && driftedTargets === 0 && missingTargets === 0 && unredactedSecretFindings === 0 ? "ok" : "warn";
-  return {
-    service: "configs",
-    schemaVersion: "1.0",
-    package: {
-      name: PACKAGE_NAME,
-      version: PACKAGE_VERSION
-    },
-    env: {
-      database: {
-        primary: "HASNA_INSTRUCTIONS_DB_PATH",
-        active: activeDatabaseEnv(),
-        kind: configuredDatabaseKind()
-      }
-    },
-    counts: {
-      configs: {
-        total: configs.length,
-        file: fileConfigs.length,
-        reference: configs.filter((config) => config.kind === "reference").length,
-        templates: configs.filter((config) => config.is_template).length
-      },
-      byCategory,
-      byAgent: countBy(configs, (config) => config.agent),
-      byFormat: countBy(configs, (config) => config.format),
-      profiles,
-      profileLinks,
-      machines,
-      snapshots,
-      knownTargets
-    },
-    health: {
-      status,
-      databaseReachable,
-      driftedTargets,
-      missingTargets,
-      unredactedSecretFindings,
-      hasDrift: driftedTargets > 0,
-      hasMissingTargets: missingTargets > 0,
-      hasUnredactedSecrets: unredactedSecretFindings > 0
-    },
-    safety: {
-      includesConfigValues: false,
-      includesPrivatePaths: false,
-      includesHostnames: false,
-      includesSecretValues: false,
-      statusOutputIsMetadataOnly: true
-    }
-  };
-}
-// src/db/pg-migrations.ts
-var PG_MIGRATIONS = [
-  `CREATE TABLE IF NOT EXISTS configs (
-    id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    slug TEXT NOT NULL UNIQUE,
-    kind TEXT NOT NULL DEFAULT 'file',
-    category TEXT NOT NULL,
-    agent TEXT NOT NULL DEFAULT 'global',
-    target_path TEXT,
-    outputs TEXT NOT NULL DEFAULT '[]',
-    format TEXT NOT NULL DEFAULT 'text',
-    content TEXT NOT NULL DEFAULT '',
-    description TEXT,
-    tags TEXT NOT NULL DEFAULT '[]',
-    is_template BOOLEAN NOT NULL DEFAULT FALSE,
-    version INTEGER NOT NULL DEFAULT 1,
-    created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL,
-    synced_at TEXT
-  )`,
-  `CREATE TABLE IF NOT EXISTS config_snapshots (
-    id TEXT PRIMARY KEY,
-    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
-    content TEXT NOT NULL,
-    version INTEGER NOT NULL,
-    created_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS profiles (
-    id TEXT PRIMARY KEY,
-    name TEXT NOT NULL,
-    slug TEXT NOT NULL UNIQUE,
-    description TEXT,
-    selectors TEXT NOT NULL DEFAULT '{}',
-    variables TEXT NOT NULL DEFAULT '{}',
-    created_at TEXT NOT NULL,
-    updated_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS profile_configs (
-    profile_id TEXT NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
-    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
-    sort_order INTEGER NOT NULL DEFAULT 0,
-    PRIMARY KEY (profile_id, config_id)
-  )`,
-  `CREATE TABLE IF NOT EXISTS machines (
-    id TEXT PRIMARY KEY,
-    hostname TEXT NOT NULL UNIQUE,
-    os TEXT,
-    arch TEXT,
-    last_applied_at TEXT,
-    created_at TEXT NOT NULL
-  )`,
-  `CREATE TABLE IF NOT EXISTS feedback (
-    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
-    message TEXT NOT NULL,
-    email TEXT,
-    category TEXT DEFAULT 'general',
-    version TEXT,
-    machine_id TEXT,
-    created_at TEXT NOT NULL DEFAULT NOW()::text
-  )`,
-  `ALTER TABLE configs ADD COLUMN IF NOT EXISTS outputs TEXT NOT NULL DEFAULT '[]'`
-];
-// src/lib/session-render.ts
-import { createHash } from "crypto";
-import { existsSync as existsSync5, readFileSync as readFileSync3, realpathSync as realpathSync2, statSync } from "fs";
-import { homedir as homedir3 } from "os";
-import { basename as basename3, dirname as dirname2, extname as extname2, isAbsolute, join as join3, parse, posix, relative, resolve as resolve2 } from "path";
-var CODEWITH_NATIVE_IMPORTS_ENV = "HASNA_CONFIGS_CODEWITH_NATIVE_IMPORTS";
-var SESSION_RENDER_MANAGED_MARKER = "Managed by @hasna/configs session render";
-var SESSION_RENDER_SCHEMA = "hasna.configs.session-render/v1";
-var RAW_STORE_ROOT_ENV = "HASNA_CONFIGS_HOME";
-var SESSION_RENDER_TOOLS = [
-  "claude",
-  "codex",
-  "cursor",
-  "opencode",
-  "codewith"
-];
-var CODEWITH_FLATTENED_ADAPTER = {
-  tool: "codewith",
-  mode: "flattened-markdown",
-  indexFile: "CODEWITH.md",
-  managedDir: ".hasna/instructions",
-  envVar: "CODEWITH_HOME",
-  nativeImports: false,
-  description: "Codewith CODEWITH.md flattened until native @ imports are implemented in Codewith."
-};
-var CODEWITH_NATIVE_ADAPTER = {
-  tool: "codewith",
-  mode: "native-imports",
-  indexFile: "CODEWITH.md",
-  managedDir: ".hasna/instructions",
-  envVar: "CODEWITH_HOME",
-  nativeImports: true,
-  description: "Codewith CODEWITH.md with gated @ imports into managed fragments."
-};
-var SESSION_TOOL_ADAPTERS = {
-  claude: {
-    tool: "claude",
-    mode: "native-imports",
-    indexFile: "CLAUDE.md",
-    managedDir: ".hasna/instructions",
-    envVar: "CLAUDE_CONFIG_DIR",
-    nativeImports: true,
-    description: "Claude Code CLAUDE.md with @ imports into managed fragments."
-  },
-  codex: {
-    tool: "codex",
-    mode: "flattened-markdown",
-    indexFile: "AGENTS.md",
-    managedDir: ".hasna/instructions",
-    envVar: "CODEX_HOME",
-    nativeImports: false,
-    description: "Codex AGENTS.md flattened instruction file."
-  },
-  cursor: {
-    tool: "cursor",
-    mode: "cursor-mdc",
-    managedDir: ".cursor/rules",
-    nativeImports: false,
-    description: "Cursor project rule files in .cursor/rules/*.mdc."
-  },
-  opencode: {
-    tool: "opencode",
-    mode: "opencode-instructions",
-    indexFile: "AGENTS.md",
-    configFile: "opencode.json",
-    managedDir: ".hasna/instructions",
-    envVar: "OPENCODE_CONFIG_DIR",
-    nativeImports: false,
-    description: "OpenCode AGENTS.md plus opencode.json instructions pointing at managed fragments."
-  },
-  codewith: CODEWITH_FLATTENED_ADAPTER
-};
-var LAYER_RANK = {
-  global: 10,
-  tool: 20,
-  account: 30,
-  agent: 40,
-  project: 50,
-  local: 60
-};
-function ensureTrailingNewline2(content) {
-  return content.endsWith(`
-`) ? content : `${content}
-`;
-}
-function sha256(content) {
-  return createHash("sha256").update(content).digest("hex");
-}
-function fingerprint(value) {
-  return sha256(JSON.stringify(value));
-}
-function slug(value) {
-  const s = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return s || "instruction";
-}
-function yamlQuote2(value) {
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
-}
-function getRawStoreRoot() {
-  return resolve2(process.env[RAW_STORE_ROOT_ENV] || join3(process.env["HOME"] || homedir3(), ".hasna", "configs"));
-}
-function defaultTargetHome(tool, profile, sessionId) {
-  return join3(getRawStoreRoot(), "sessions", tool, slug(profile), slug(sessionId || "latest"));
-}
-function joinTarget(targetHome, relativePath) {
-  const safeTargetHome = assertSafeTargetRoot(targetHome);
-  const safeRelativePath = assertSafeRelativePath(relativePath);
-  return join3(safeTargetHome, ...safeRelativePath.split("/"));
-}
-function makeFile(targetHome, relativePath, role, content, sourceIds) {
-  const safeTargetHome = assertSafeTargetRoot(targetHome);
-  const safeRelativePath = assertSafeRelativePath(relativePath);
-  const normalizedContent = ensureTrailingNewline2(content);
+function sourceFromFilePath(path, content, order = 0) {
+  const file = basename(path);
   return {
-    path: joinTarget(safeTargetHome, safeRelativePath),
-    relativePath: safeRelativePath,
-    role,
-    content: normalizedContent,
-    sha256: sha256(normalizedContent),
-    sourceIds
-  };
-}
-function normalizeSources(sources, tool, allowEmptySources) {
-  const ordered = sources.map((source, index) => {
-    if (!source.id.trim())
-      throw new Error("Session instruction source id is required.");
-    const content = filterProviderOnlyBlocks(source.content ?? "", tool);
-    const normalized = {
-      ...source,
-      content,
-      normalizedId: slug(source.id),
-      resolvedLabel: source.label ?? source.id,
-      resolvedLayer: source.layer ?? "agent",
-      resolvedMerge: source.merge ?? "append",
-      resolvedOrder: source.order ?? index,
-      resolvedRules: normalizeInstructionRules(source, tool)
-    };
-    const hasPathReferences = (normalized.sourcePaths ?? []).length > 0;
-    if (!allowEmptySources && !normalized.content.trim() && normalized.resolvedRules.length === 0 && !hasPathReferences) {
-      throw new Error(`Session instruction source "${source.id}" is empty. Pass --allow-empty-sources only for explicit empty renders.`);
-    }
-    return normalized;
-  }).sort((a, b) => LAYER_RANK[a.resolvedLayer] - LAYER_RANK[b.resolvedLayer] || a.resolvedOrder - b.resolvedOrder || a.id.localeCompare(b.id));
-  rejectDuplicateSourceSlugs(ordered);
-  rejectDuplicateRulePaths(ordered);
-  return ordered;
-}
-function filterProviderOnlyBlocks(content, tool) {
-  const lines = content.split(/\r?\n/);
-  const output = [];
-  let activeProviders = null;
-  for (const line of lines) {
-    const start = line.match(/^\s*<!--\s*@hasna-provider:\s*([^>]+?)\s*-->\s*$/i);
-    if (start) {
-      if (activeProviders)
-        throw new Error("Nested provider-only instruction blocks are not supported.");
-      activeProviders = start[1].split(",").map((item) => item.trim().toLowerCase()).filter(Boolean);
-      continue;
-    }
-    if (/^\s*<!--\s*@hasna-end-provider\s*-->\s*$/i.test(line)) {
-      if (!activeProviders)
-        throw new Error("Provider-only instruction block end marker without start marker.");
-      activeProviders = null;
-      continue;
-    }
-    if (!activeProviders || activeProviders.includes(tool) || activeProviders.includes("all") || activeProviders.includes("generic")) {
-      output.push(line);
-    }
-  }
-  if (activeProviders)
-    throw new Error("Provider-only instruction block was not closed.");
-  return output.join(`
-`);
-}
-function composeSources(sources) {
-  let start = -1;
-  for (let i = 0;i < sources.length; i++) {
-    if (sources[i].resolvedMerge === "replace")
-      start = i;
-  }
-  if (start < 0)
-    return sources;
-  const protectedSources = sources.slice(0, start).filter((source) => source.nonOverridable);
-  return [...protectedSources, ...sources.slice(start)];
-}
-function sectionForSource(source) {
-  const parts = [
-    `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
-    `# ${source.resolvedLabel}`
-  ];
-  if (source.path)
-    parts.push(`Source: ${source.path}`);
-  if (source.sourcePaths && source.sourcePaths.length > 0) {
-    parts.push([
-      "Source paths:",
-      ...source.sourcePaths.map((sourcePath) => {
-        const flags = [
-          sourcePath.editable ? "editable" : null,
-          sourcePath.required ? "required" : null,
-          sourcePath.hash ? sourcePath.hash : null
-        ].filter(Boolean);
-        return `- ${sourcePath.path}${flags.length > 0 ? ` (${flags.join(", ")})` : ""}`;
-      })
-    ].join(`
-`));
-  }
-  if (source.owner)
-    parts.push(`Owner: ${source.owner.kind}:${source.owner.id}`);
-  const content = source.content.trim();
-  if (content)
-    parts.push(content);
-  return parts.join(`
-
-`);
-}
-function sectionForRule(source, rule) {
-  const parts = [
-    `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
-    `# ${rule.resolvedLabel}`
-  ];
-  if (source.path)
-    parts.push(`Source: ${source.path}`);
-  if (rule.path)
-    parts.push(`Rule path: ${rule.path}`);
-  const content = rule.content.trim();
-  if (content)
-    parts.push(content);
-  return parts.join(`
-
-`);
-}
-function fragmentPath(adapter, index, source) {
-  const n = String(index + 1).padStart(2, "0");
-  return posix.join(adapter.managedDir, `${n}-${source.normalizedId}.md`);
-}
-function ruleFragmentPath(adapter, source, rule) {
-  return posix.join(adapter.managedDir, "rules", source.normalizedId, rule.resolvedPath);
-}
-function importPath(indexRelativePath, fragmentRelativePath) {
-  const relative2 = posix.relative(posix.dirname(indexRelativePath), fragmentRelativePath);
-  if (relative2.startsWith("./") || relative2.startsWith("../"))
-    return relative2;
-  return `./${relative2}`;
-}
-function indexHeader(tool, profile) {
-  return [
-    `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
-    `# ${tool} session instructions`,
-    "",
-    `Profile: ${profile}`
-  ].join(`
-`);
-}
-function buildNativeImportFiles(targetHome, adapter, profile, sources) {
-  const indexFile = adapter.indexFile;
-  const fragments = sources.flatMap((source, index2) => [
-    makeFile(targetHome, fragmentPath(adapter, index2, source), "fragment", sectionForSource(source), [source.id]),
-    ...source.resolvedRules.map((rule) => makeFile(targetHome, ruleFragmentPath(adapter, source, rule), "rule", sectionForRule(source, rule), [source.id, rule.id]))
-  ]);
-  const imports = fragments.map((file) => `@${importPath(indexFile, file.relativePath)}`);
-  const index = makeFile(targetHome, indexFile, "index", [indexHeader(adapter.tool, profile), ...imports].join(`
-`), sources.map((source) => source.id));
-  return [index, ...fragments];
-}
-function buildFlattenedMarkdownFiles(targetHome, adapter, profile, sources) {
-  const content = [
-    indexHeader(adapter.tool, profile),
-    ...sources.flatMap((source) => [
-      sectionForSource(source),
-      ...source.resolvedRules.map((rule) => sectionForRule(source, rule))
-    ])
-  ].join(`
-
-`);
-  return [
-    makeFile(targetHome, adapter.indexFile, "index", content, [
-      ...sources.map((source) => source.id),
-      ...sources.flatMap((source) => source.resolvedRules.map((rule) => rule.id))
-    ])
-  ];
-}
-function buildCursorRuleFiles(targetHome, adapter, sources) {
-  return sources.flatMap((source, index) => {
-    const n = String(index + 1).padStart(2, "0");
-    const stem = `${n}-${source.normalizedId}`;
-    const relativePath = posix.join(adapter.managedDir, `${stem}.mdc`);
-    const description = `${source.resolvedLabel} (${source.resolvedLayer})`;
-    const content = [
-      "---",
-      `description: ${yamlQuote2(description)}`,
-      'globs: ["**/*"]',
-      "alwaysApply: true",
-      "---",
-      "",
-      `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
-      "",
-      source.content.trim()
-    ].join(`
-`);
-    const sourceFile = makeFile(targetHome, relativePath, "rule", content, [source.id]);
-    const ruleFiles = source.resolvedRules.map((rule) => {
-      const ruleStem = `${n}-${source.normalizedId}-${rule.normalizedId}`;
-      const ruleRelativePath = posix.join(adapter.managedDir, `${ruleStem}.mdc`);
-      const ruleDescription = `${rule.resolvedLabel} (${source.resolvedLayer})`;
-      const ruleContent = [
-        "---",
-        `description: ${yamlQuote2(ruleDescription)}`,
-        `globs: ${JSON.stringify(rule.globs && rule.globs.length > 0 ? rule.globs : ["**/*"])}`,
-        "alwaysApply: true",
-        "---",
-        "",
-        `<!-- ${SESSION_RENDER_MANAGED_MARKER}. Do not edit this generated file directly. -->`,
-        "",
-        rule.content.trim()
-      ].join(`
-`);
-      return makeFile(targetHome, ruleRelativePath, "rule", ruleContent, [source.id, rule.id]);
-    });
-    return [sourceFile, ...ruleFiles];
-  });
-}
-function buildOpenCodeFiles(targetHome, adapter, profile, sources) {
-  const fragments = sources.flatMap((source, index) => [
-    makeFile(targetHome, fragmentPath(adapter, index, source), "fragment", sectionForSource(source), [source.id]),
-    ...source.resolvedRules.map((rule) => makeFile(targetHome, ruleFragmentPath(adapter, source, rule), "rule", sectionForRule(source, rule), [source.id, rule.id]))
-  ]);
-  const flattenedIndex = makeFile(targetHome, adapter.indexFile, "index", [
-    indexHeader(adapter.tool, profile),
-    ...sources.flatMap((source) => [
-      sectionForSource(source),
-      ...source.resolvedRules.map((rule) => sectionForRule(source, rule))
-    ])
-  ].join(`
-
-`), [
-    ...sources.map((source) => source.id),
-    ...sources.flatMap((source) => source.resolvedRules.map((rule) => rule.id))
-  ]);
-  const config = {
-    $schema: "https://opencode.ai/config.json",
-    instructions: fragments.map((file) => file.relativePath)
+    id: file.replace(extname(file), ""),
+    label: file,
+    content,
+    layer: "agent",
+    order,
+    path
   };
-  return [
-    flattenedIndex,
-    makeFile(targetHome, adapter.configFile, "config", JSON.stringify(config, null, 2), sources.map((source) => source.id)),
-    ...fragments
-  ];
 }
-function buildFiles(targetHome, adapter, profile, sources) {
-  switch (adapter.mode) {
-    case "native-imports":
-      return buildNativeImportFiles(targetHome, adapter, profile, sources);
-    case "flattened-markdown":
-      return buildFlattenedMarkdownFiles(targetHome, adapter, profile, sources);
-    case "cursor-mdc":
-      return buildCursorRuleFiles(targetHome, adapter, sources);
-    case "opencode-instructions":
-      return buildOpenCodeFiles(targetHome, adapter, profile, sources);
+function sourceFromConfig(config, order = 0, layer) {
+  return {
+    id: config.slug,
+    label: config.name,
+    content: config.content,
+    layer: layer ?? (config.agent === "global" ? "global" : "agent"),
+    order,
+    path: config.target_path ?? undefined,
+    provenance: {
+      source: "open-configs",
+      configSlug: config.slug,
+      configAgent: config.agent
+    }
+  };
+}
+function sourcesFromIdentityExport(value, options = {}) {
+  const record = asRecord(value, "identity instruction export");
+  const shape = requireIdentityExportShape(record);
+  const validation = asOptionalRecord(record["validation"]);
+  if (validation && validation["valid"] === false) {
+    const issues = Array.isArray(validation["issues"]) ? validation["issues"] : [];
+    throw new Error(`Identity instruction export is invalid: ${JSON.stringify(issues)}`);
   }
+  const sources = record["sources"];
+  if (!Array.isArray(sources))
+    throw new Error("Identity instruction export sources must be an array.");
+  const offset = options.orderOffset ?? 0;
+  return sources.map((item, index) => identitySourceToSessionSource(item, {
+    path: options.path,
+    tool: options.tool,
+    orderFallback: offset + index,
+    exportShape: shape
+  })).filter((source) => source !== null);
 }
-function adapterFor(input) {
-  if (input.tool !== "codewith")
-    return SESSION_TOOL_ADAPTERS[input.tool];
-  const gatedNativeImports = input.codewithNativeImports === true || process.env[CODEWITH_NATIVE_IMPORTS_ENV] === "1" || process.env[CODEWITH_NATIVE_IMPORTS_ENV] === "true";
-  return gatedNativeImports ? CODEWITH_NATIVE_ADAPTER : CODEWITH_FLATTENED_ADAPTER;
+function requireIdentityExportShape(record) {
+  if (record["contract"] === "hasna.identities.configs-instructions/v1")
+    return "configs-contract";
+  if (record["version"] === 1 && record["package"] === "@hasna/identities")
+    return "canonical-open-identities";
+  throw new Error("Unsupported identity instruction export contract.");
 }
-function getHomeDir() {
-  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir3();
+function normalizeInstructionRules(source, tool) {
+  const seen = new Set;
+  return (source.rules ?? []).map((rule) => {
+    if (!rule.id.trim())
+      throw new Error(`Instruction rule id is required for source ${source.id}.`);
+    const content = filterProviderOnlyBlocks(rule.content ?? "", tool);
+    if (!content.trim() && !rule.path)
+      throw new Error(`Instruction rule content or path is required for rule ${rule.id}.`);
+    const resolvedPath = normalizeRulePath(rule.path ?? `${slug(rule.id)}.md`);
+    const key = resolvedPath.toLowerCase();
+    if (seen.has(key))
+      throw new Error(`Duplicate rule path for source ${source.id}: ${resolvedPath}`);
+    seen.add(key);
+    return {
+      ...rule,
+      content,
+      normalizedId: slug(rule.id),
+      resolvedLabel: rule.label ?? rule.id,
+      resolvedPath
+    };
+  });
 }
-function cleanSessionPathInput(path) {
-  const trimmed = path.trim();
-  if (trimmed.length >= 2 && (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'"))) {
-    return trimmed.slice(1, -1);
+function rejectDuplicateRenderPaths(files) {
+  const seen = new Set;
+  for (const file of files) {
+    const key = file.relativePath.toLowerCase();
+    if (seen.has(key))
+      throw new Error(`Duplicate session render file path: ${file.relativePath}`);
+    seen.add(key);
   }
-  return trimmed;
 }
-function resolveSessionPath(path) {
-  const cleaned = cleanSessionPathInput(path);
-  if (!cleaned)
-    throw new Error("Session render path cannot be empty.");
-  const home = getHomeDir();
-  if (cleaned === "~")
-    return resolve2(home);
-  if (cleaned.startsWith("~/"))
-    return resolve2(home, cleaned.slice(2));
-  if (cleaned === "{{HOME}}" || cleaned === "${HOME}")
-    return resolve2(home);
-  if (cleaned.startsWith("{{HOME}}/"))
-    return resolve2(home, cleaned.slice("{{HOME}}/".length));
-  if (cleaned.startsWith("${HOME}/"))
-    return resolve2(home, cleaned.slice("${HOME}/".length));
-  return resolve2(cleaned);
+function rejectDuplicateSourceSlugs(sources) {
+  const seen = new Map;
+  for (const source of sources) {
+    const existing = seen.get(source.normalizedId);
+    if (existing)
+      throw new Error(`Duplicate session instruction source slug: ${source.normalizedId} (${existing}, ${source.id})`);
+    seen.set(source.normalizedId, source.id);
+  }
 }
-function assertSafeRelativePath(relativePath) {
-  if (!relativePath.trim())
-    throw new Error("Session render relative path cannot be empty.");
-  if (relativePath.includes("\\"))
-    throw new Error(`Session render relative path must use POSIX separators: ${relativePath}`);
-  const normalized = posix.normalize(relativePath);
+function rejectDuplicateRulePaths(sources) {
+  const seen = new Map;
+  for (const source of sources) {
+    for (const rule of source.resolvedRules) {
+      const key = rule.resolvedPath.toLowerCase();
+      const existing = seen.get(key);
+      if (existing)
+        throw new Error(`Duplicate instruction rule path: ${rule.resolvedPath} (${existing}, ${rule.id})`);
+      seen.set(key, rule.id);
+    }
+  }
+}
+function normalizeRulePath(path) {
+  if (!path.trim())
+    throw new Error("Instruction rule path cannot be empty.");
+  if (path.includes("\\"))
+    throw new Error(`Instruction rule path must use POSIX separators: ${path}`);
+  const normalized = posix.normalize(path);
   if (normalized === "." || posix.isAbsolute(normalized) || normalized === ".." || normalized.startsWith("../")) {
-    throw new Error(`Session render relative path escapes target root: ${relativePath}`);
+    throw new Error(`Instruction rule path escapes managed rule directory: ${path}`);
   }
   return normalized;
 }
-function assertSafeTargetRoot(targetHome) {
-  if (!isAbsolute(targetHome))
-    throw new Error(`Session render target must be an absolute path: ${targetHome}`);
-  const normalized = resolve2(targetHome);
-  if (normalized === parse(normalized).root) {
-    throw new Error(`Session render target cannot be the filesystem root: ${targetHome}`);
+function identitySourceToSessionSource(value, options) {
+  const record = asRecord(value, "identity instruction source");
+  const providers = asStringArray(record["targetProviders"]);
+  if (options.tool && providers.length > 0 && !providerTargetsTool(providers, options.tool))
+    return null;
+  const sourcePaths = normalizeSourcePaths(record["sourcePaths"]);
+  const kind = maybeString(record["kind"]);
+  const layer = record["layer"] === undefined ? layerFromIdentityKind(kind, options.exportShape) : requireLayer(record["layer"]);
+  const merge = requireMerge(record["merge"] ?? record["mergePolicy"] ?? "append");
+  const id = requireString(record["id"], "identity instruction source id");
+  const inlineContent = maybeString(record["content"]);
+  const resolvedContent = inlineContent && inlineContent.trim() ? inlineContent : contentFromIdentitySourcePaths(sourcePaths, options.path, id) ?? inlineContent;
+  return {
+    id,
+    label: maybeString(record["label"]) ?? maybeString(record["title"]) ?? id,
+    layer,
+    merge,
+    order: typeof record["order"] === "number" ? record["order"] : typeof record["precedence"] === "number" ? record["precedence"] : options.orderFallback,
+    content: resolvedContent ?? "",
+    path: options.path,
+    rules: normalizeIdentityRules(record["rules"]),
+    provenance: asOptionalRecord(record["provenance"]) ?? null,
+    targetProviders: providers,
+    owner: normalizeIdentityOwner(record["owner"]),
+    sourcePaths,
+    globs: asStringArray(record["globs"]),
+    hash: maybeString(record["hash"]),
+    nonOverridable: record["nonOverridable"] === true,
+    replacementScope: maybeString(record["replacementScope"]),
+    metadata: asOptionalRecord(record["metadata"]) ?? null
+  };
+}
+function layerFromIdentityKind(kind, exportShape) {
+  if (!kind) {
+    if (exportShape === "configs-contract")
+      throw new Error("Invalid session instruction layer: undefined");
+    return "agent";
+  }
+  switch (kind) {
+    case "global-rules":
+    case "global-system-prompt":
+      return "global";
+    case "provider-rules":
+    case "provider-system-prompt":
+      return "tool";
+    case "identity-doc":
+    case "persona-doc":
+      return "agent";
+    case "account-overlay":
+      return "account";
+    case "project-overlay":
+      return "repo";
+    case "machine-overlay":
+      return "machine";
+    case "session-overlay":
+      return "session";
+    default:
+      throw new Error(`Invalid identity instruction source kind: ${kind}`);
   }
-  return normalized;
 }
-function resolveRenderTarget(input) {
-  if (input.tool === "cursor") {
-    if (!input.projectRoot) {
-      return {
-        targetHome: defaultTargetHome(input.tool, input.profile, input.sessionId),
-        targetKind: "blocked",
-        blockers: [
-          "Cursor rules are project-scoped; pass --project-root (or projectRoot) before applying .cursor/rules files. --target-home is not treated as a repository root for Cursor."
-        ]
-      };
+function contentFromIdentitySourcePaths(sourcePaths, exportPath, sourceId) {
+  if (sourcePaths.length === 0 || !exportPath)
+    return;
+  const baseDir = dirname(resolveSessionPath(exportPath));
+  const contents = [];
+  for (const sourcePath of sourcePaths) {
+    const content = readIdentitySourcePath(sourcePath, baseDir, sourceId);
+    if (content !== undefined)
+      contents.push({ path: sourcePath.path, content });
+  }
+  if (contents.length === 0)
+    return;
+  if (contents.length === 1)
+    return ensureTrailingNewline(contents[0].content);
+  return ensureTrailingNewline(contents.map((item) => `<!-- Source path: ${item.path} -->
+${item.content.trimEnd()}`).join(`
+
+`));
+}
+function readIdentitySourcePath(sourcePath, baseDir, sourceId) {
+  const resolvedPath = resolveIdentitySourcePath(sourcePath.path, baseDir, sourceId);
+  if (!existsSync3(resolvedPath)) {
+    if (sourcePath.required) {
+      throw new Error(`Required identity instruction source path not found for ${sourceId}: ${sourcePath.path}`);
     }
+    return;
+  }
+  const stat = statSync(resolvedPath);
+  if (!stat.isFile()) {
+    throw new Error(`Identity instruction source path is not a file for ${sourceId}: ${sourcePath.path}`);
+  }
+  const realBase = realpathSync(baseDir);
+  const realPath = realpathSync(resolvedPath);
+  if (!pathIsInside(realPath, realBase)) {
+    throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${sourcePath.path}`);
+  }
+  return readFileSync(realPath, "utf-8");
+}
+function resolveIdentitySourcePath(path, baseDir, sourceId) {
+  const cleaned = cleanSessionPathInput(path);
+  if (!cleaned)
+    throw new Error(`Identity instruction source path cannot be empty for ${sourceId}.`);
+  if (cleaned.includes("\\"))
+    throw new Error(`Identity instruction source path must use POSIX separators for ${sourceId}: ${path}`);
+  const resolvedPath = isAbsolute(cleaned) ? resolve(cleaned) : resolve(baseDir, cleaned);
+  if (!pathIsInside(resolvedPath, resolve(baseDir))) {
+    throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${path}`);
+  }
+  return resolvedPath;
+}
+function pathIsInside(path, baseDir) {
+  const rel = relative(baseDir, path);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function providerTargetsTool(targets, tool) {
+  return targets.map((target) => target.toLowerCase()).some((target) => target === tool || target === "all" || target === "generic");
+}
+function normalizeIdentityRules(value) {
+  if (value === undefined || value === null)
+    return [];
+  if (!Array.isArray(value))
+    throw new Error("Identity instruction source rules must be an array.");
+  return value.map((item) => {
+    const record = asRecord(item, "identity instruction rule");
+    const id = requireString(record["id"], "identity instruction rule id");
     return {
-      targetHome: resolveSessionPath(input.projectRoot),
-      targetKind: "project-root",
-      blockers: []
+      id,
+      label: maybeString(record["label"]) ?? id,
+      path: maybeString(record["path"]),
+      content: maybeString(record["content"]) ?? "",
+      globs: asStringArray(record["globs"]),
+      hash: maybeString(record["hash"]),
+      metadata: asOptionalRecord(record["metadata"]) ?? null
     };
-  }
+  });
+}
+function normalizeIdentityOwner(value) {
+  if (value === undefined || value === null)
+    return null;
+  const record = asRecord(value, "identity instruction owner");
   return {
-    targetHome: input.targetHome ? resolveSessionPath(input.targetHome) : defaultTargetHome(input.tool, input.profile, input.sessionId),
-    targetKind: "session-home",
-    blockers: []
+    kind: requireString(record["kind"], "identity instruction owner kind"),
+    id: requireString(record["id"], "identity instruction owner id")
   };
 }
-function resolveSessionTargetOwnership(input, target) {
-  if (target.targetKind === "blocked") {
-    return {
-      kind: "blocked",
-      tool: input.tool,
-      profile: input.profile,
-      targetHome: target.targetHome,
-      projectRoot: input.projectRoot ? resolveSessionPath(input.projectRoot) : null,
-      ownedBy: "open-configs",
-      reason: "target resolution blocked before provider files can be owned"
-    };
-  }
-  if (target.targetKind === "project-root") {
+function normalizeSourcePaths(value) {
+  if (value === undefined || value === null)
+    return [];
+  if (!Array.isArray(value))
+    throw new Error("Identity instruction source paths must be an array.");
+  return value.map((item) => {
+    const record = asRecord(item, "identity instruction source path");
     return {
-      kind: "project",
-      tool: input.tool,
-      profile: input.profile,
-      targetHome: target.targetHome,
-      projectRoot: target.targetHome,
-      ownedBy: "open-configs",
-      reason: "project-scoped provider files are generated in the explicit repository root"
+      path: requireString(record["path"], "identity instruction source path"),
+      editable: record["editable"] === true,
+      required: record["required"] === true,
+      hash: maybeString(record["hash"])
     };
-  }
-  return {
-    kind: "provider-profile",
-    tool: input.tool,
-    profile: input.profile,
-    targetHome: target.targetHome,
-    projectRoot: null,
-    ownedBy: "open-configs",
-    reason: "profile-scoped provider home is generated by OpenConfigs from identity/config sources"
-  };
+  });
 }
-function planSessionRender(input) {
-  if (!SESSION_RENDER_TOOLS.includes(input.tool))
-    throw new Error(`Unsupported session render tool: ${input.tool}`);
-  if (!input.profile.trim())
-    throw new Error("Session render profile is required.");
-  const adapter = adapterFor(input);
-  const { targetHome, targetKind, blockers } = resolveRenderTarget(input);
-  const targetOwner = resolveSessionTargetOwnership(input, { targetHome, targetKind });
-  const blocked = blockers.length > 0;
-  const allowEmptySources = input.allowEmptySources === true;
-  const orderedSources = composeSources(normalizeSources(input.sources, input.tool, allowEmptySources));
-  if (orderedSources.length === 0 && !allowEmptySources) {
-    throw new Error("Session render has no instruction sources. Pass --allow-empty-sources only for explicit empty renders.");
-  }
-  const generatedAt = input.generatedAt ?? new Date().toISOString();
-  const env = adapter.envVar && !blocked ? { [adapter.envVar]: targetHome } : {};
-  const warnings = [
-    ...orderedSources.length === 0 ? ["No instruction sources were provided."] : [],
-    ...blockers
-  ];
-  const files = blocked ? [] : buildFiles(targetHome, adapter, input.profile, orderedSources);
-  rejectDuplicateRenderPaths(files);
-  const manifest = {
-    schema: SESSION_RENDER_SCHEMA,
-    tool: input.tool,
-    adapterMode: adapter.mode,
-    profile: input.profile,
-    sessionId: input.sessionId ?? null,
-    targetHome,
-    targetKind,
-    targetOwner,
-    writable: !blocked,
-    blocked,
-    blockers,
-    generatedAt,
-    env,
-    sourceHash: fingerprint(orderedSources.map((source) => ({
-      id: source.id,
-      layer: source.resolvedLayer,
-      order: source.resolvedOrder,
-      merge: source.resolvedMerge,
-      content: source.content,
-      rules: source.resolvedRules.map((rule) => ({ id: rule.id, path: rule.resolvedPath, content: rule.content })),
-      hash: source.hash ?? null
-    }))),
-    sources: orderedSources.map((source) => ({
-      id: source.id,
-      label: source.resolvedLabel,
-      layer: source.resolvedLayer,
-      merge: source.resolvedMerge,
-      order: source.resolvedOrder,
-      path: source.path ?? null,
-      targetProviders: source.targetProviders ?? [],
-      owner: source.owner ?? null,
-      sourcePaths: source.sourcePaths ?? [],
-      hash: source.hash ?? null,
-      nonOverridable: source.nonOverridable === true,
-      replacementScope: source.replacementScope ?? null,
-      rules: source.resolvedRules.map((rule) => ({
-        id: rule.id,
-        label: rule.resolvedLabel,
-        path: rule.resolvedPath,
-        globs: rule.globs ?? [],
-        hash: rule.hash ?? null
-      })),
-      provenance: source.provenance ?? null
-    })),
-    skippedSources: [],
-    files: files.map((file) => ({
-      path: file.path,
-      relativePath: file.relativePath,
-      role: file.role,
-      sha256: file.sha256,
-      sourceIds: file.sourceIds
-    })),
-    warnings
-  };
-  const manifestFile = makeFile(targetHome, posix.join(".hasna", "session-render-manifest.json"), "manifest", JSON.stringify(manifest, null, 2), orderedSources.map((source) => source.id));
-  return {
-    dryRun: true,
-    tool: input.tool,
-    adapter,
-    profile: input.profile,
-    sessionId: input.sessionId ?? null,
-    targetHome,
-    targetKind,
-    targetOwner,
-    writable: !blocked,
-    blocked,
-    blockers,
-    env,
-    files,
-    manifest,
-    manifestFile,
-    allFiles: [...files, manifestFile],
-    warnings
-  };
+function requireLayer(value) {
+  return normalizeSessionInstructionLayer(value);
 }
-function sourceFromFilePath(path, content, order = 0) {
-  const file = basename3(path);
-  return {
-    id: file.replace(extname2(file), ""),
-    label: file,
-    content,
-    layer: "agent",
-    order,
-    path
-  };
+function requireMerge(value) {
+  if (value === "append" || value === "replace")
+    return value;
+  throw new Error(`Invalid session instruction merge policy: ${String(value)}`);
 }
-function sourceFromConfig(config, order = 0, layer) {
-  return {
-    id: config.slug,
-    label: config.name,
-    content: config.content,
-    layer: layer ?? (config.agent === "global" ? "global" : "agent"),
-    order,
-    path: config.target_path ?? undefined,
-    provenance: {
-      source: "open-configs",
-      configSlug: config.slug,
-      configAgent: config.agent
+function asRecord(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`Invalid ${label}.`);
+  return value;
+}
+function asOptionalRecord(value) {
+  if (value === undefined || value === null)
+    return null;
+  return asRecord(value, "record");
+}
+function maybeString(value) {
+  return typeof value === "string" ? value : undefined;
+}
+function requireString(value, label) {
+  if (typeof value !== "string" || !value.trim())
+    throw new Error(`Invalid ${label}.`);
+  return value;
+}
+function asStringArray(value) {
+  if (value === undefined || value === null)
+    return [];
+  if (!Array.isArray(value))
+    return [];
+  return value.filter((item) => typeof item === "string");
+}
+
+// src/lib/transforms.ts
+import { basename as basename2, extname as extname2 } from "path";
+function ensureTrailingNewline2(content) {
+  return content.endsWith(`
+`) ? content : `${content}
+`;
+}
+function yamlQuote2(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function headingLevel(line) {
+  const m = line.match(/^(#{1,6})\s+/);
+  return m ? m[1].length : null;
+}
+function stripClaudeOnlySections(content) {
+  const withoutMarkedBlocks = content.replace(/<!--\s*claude-only:start\s*-->[\s\S]*?<!--\s*claude-only:end\s*-->/gi, "");
+  const lines = withoutMarkedBlocks.split(`
+`);
+  const kept = [];
+  let droppingUntilLevel = null;
+  for (const line of lines) {
+    const level = headingLevel(line);
+    if (level !== null && droppingUntilLevel !== null && level <= droppingUntilLevel) {
+      droppingUntilLevel = null;
     }
-  };
+    if (droppingUntilLevel !== null)
+      continue;
+    if (/^#{1,6}\s+.*claude(?:\s+code)?[-\s]+only\b/i.test(line)) {
+      droppingUntilLevel = level ?? 1;
+      continue;
+    }
+    kept.push(line);
+  }
+  return kept.join(`
+`).replace(/\n{3,}/g, `
+
+`).trim();
+}
+function isClaudeRuleConfig(source, candidate) {
+  if (candidate.id === source.id)
+    return false;
+  if (candidate.agent !== "claude" || candidate.category !== "rules")
+    return false;
+  return !!candidate.target_path?.includes("/rules/");
 }
-function sourcesFromIdentityExport(value, options = {}) {
-  const record = asRecord(value, "identity instruction export");
-  const shape = requireIdentityExportShape(record);
-  const validation = asOptionalRecord(record["validation"]);
-  if (validation && validation["valid"] === false) {
-    const issues = Array.isArray(validation["issues"]) ? validation["issues"] : [];
-    throw new Error(`Identity instruction export is invalid: ${JSON.stringify(issues)}`);
+function ruleLabel(config) {
+  const file = config.target_path ? basename2(config.target_path) : config.name;
+  return file.replace(/\.(md|mdc|markdown)$/i, "");
+}
+function claudeRules(source, context) {
+  return (context.configs ?? []).filter((config) => isClaudeRuleConfig(source, config)).sort((a, b) => (a.target_path ?? a.name).localeCompare(b.target_path ?? b.name));
+}
+function flattenWithRules(source, context) {
+  const parts = [stripClaudeOnlySections(source.content)];
+  const rules = claudeRules(source, context).map((rule) => ({ rule, content: stripClaudeOnlySections(rule.content) })).filter(({ content }) => Boolean(content)).map(({ rule, content }) => `### ${ruleLabel(rule)}
+
+${content}`);
+  if (rules.length > 0) {
+    parts.push(`## Rules
+
+${rules.join(`
+
+`)}`);
   }
-  const sources = record["sources"];
-  if (!Array.isArray(sources))
-    throw new Error("Identity instruction export sources must be an array.");
-  const offset = options.orderOffset ?? 0;
-  return sources.map((item, index) => identitySourceToSessionSource(item, {
-    path: options.path,
-    tool: options.tool,
-    orderFallback: offset + index,
-    exportShape: shape
-  })).filter((source) => source !== null);
+  return ensureTrailingNewline2(parts.filter(Boolean).join(`
+
+`));
 }
-function requireIdentityExportShape(record) {
-  if (record["contract"] === "hasna.identities.configs-instructions/v1")
-    return "configs-contract";
-  if (record["version"] === 1 && record["package"] === "@hasna/identities")
-    return "canonical-open-identities";
-  throw new Error("Unsupported identity instruction export contract.");
+function buildCodexAgentsMd(source, context = {}) {
+  return flattenWithRules(source, context);
 }
-function normalizeInstructionRules(source, tool) {
-  const seen = new Set;
-  return (source.rules ?? []).map((rule) => {
-    if (!rule.id.trim())
-      throw new Error(`Instruction rule id is required for source ${source.id}.`);
-    const content = filterProviderOnlyBlocks(rule.content ?? "", tool);
-    if (!content.trim() && !rule.path)
-      throw new Error(`Instruction rule content or path is required for rule ${rule.id}.`);
-    const resolvedPath = normalizeRulePath(rule.path ?? `${slug(rule.id)}.md`);
-    const key = resolvedPath.toLowerCase();
-    if (seen.has(key))
-      throw new Error(`Duplicate rule path for source ${source.id}: ${resolvedPath}`);
-    seen.add(key);
-    return {
-      ...rule,
-      content,
-      normalizedId: slug(rule.id),
-      resolvedLabel: rule.label ?? rule.id,
-      resolvedPath
-    };
-  });
+function buildOpenCodeAgentsMd(source, context = {}) {
+  return flattenWithRules(source, context);
 }
-function rejectDuplicateRenderPaths(files) {
-  const seen = new Set;
-  for (const file of files) {
-    const key = file.relativePath.toLowerCase();
-    if (seen.has(key))
-      throw new Error(`Duplicate session render file path: ${file.relativePath}`);
-    seen.add(key);
+function buildCursorMdc(source) {
+  const stem = source.target_path ? basename2(source.target_path, extname2(source.target_path)) : source.slug;
+  const description = source.name || stem;
+  return ensureTrailingNewline2([
+    "---",
+    `description: ${yamlQuote2(description)}`,
+    'globs: ["**/*"]',
+    "alwaysApply: true",
+    "---",
+    "",
+    stripClaudeOnlySections(source.content)
+  ].join(`
+`));
+}
+function transformSkillContent(content) {
+  return ensureTrailingNewline2(content.split(`
+`).filter((line) => !/^\s*user_invocable\s*:/i.test(line)).join(`
+`).replace(/\bAgent tool\b/g, "delegate through the available MCP or agent orchestration tools").replace(/\bTodoWrite\b/g, "track tasks with the agent's native task mechanism").replace(/\bRead\/Edit\b/g, "read and edit files with the available filesystem tools").replace(/\bRead\b/g, "read files with the available filesystem tools").replace(/\bEdit\b/g, "edit files with the available filesystem tools").replace(/\bBash\b/g, "run shell commands with the available terminal tool").trim());
+}
+function applyTransform(source, output, context = {}) {
+  switch (output.transform) {
+    case "passthrough":
+    case "claude-passthrough":
+      return ensureTrailingNewline2(source.content);
+    case "codex-flat":
+      return buildCodexAgentsMd(source, context);
+    case "opencode-flat":
+      return buildOpenCodeAgentsMd(source, context);
+    case "cursor-mdc":
+      return buildCursorMdc(source);
+    case "skill-neutral":
+      return transformSkillContent(source.content);
   }
 }
-function rejectDuplicateSourceSlugs(sources) {
-  const seen = new Map;
-  for (const source of sources) {
-    const existing = seen.get(source.normalizedId);
-    if (existing)
-      throw new Error(`Duplicate session instruction source slug: ${source.normalizedId} (${existing}, ${source.id})`);
-    seen.set(source.normalizedId, source.id);
+
+// src/lib/apply.ts
+function getConfigHome() {
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir3();
+}
+function expandPath(p) {
+  if (p.startsWith("~/")) {
+    return resolve2(getConfigHome(), p.slice(2));
   }
+  return resolve2(p);
 }
-function rejectDuplicateRulePaths(sources) {
-  const seen = new Map;
-  for (const source of sources) {
-    for (const rule of source.resolvedRules) {
-      const key = rule.resolvedPath.toLowerCase();
-      const existing = seen.get(key);
-      if (existing)
-        throw new Error(`Duplicate instruction rule path: ${rule.resolvedPath} (${existing}, ${rule.id})`);
-      seen.set(key, rule.id);
+function normalizeTargetPath(p) {
+  const expanded = expandPath(p);
+  try {
+    return realpathSync2(expanded);
+  } catch {
+    let current = expanded;
+    const missingSegments = [];
+    while (true) {
+      if (existsSync4(current)) {
+        try {
+          return resolve2(realpathSync2(current), ...missingSegments);
+        } catch {
+          return expanded;
+        }
+      }
+      const parent = dirname2(current);
+      const name = basename3(current);
+      if (parent === current)
+        return expanded;
+      missingSegments.unshift(name);
+      current = parent;
     }
   }
 }
-function normalizeRulePath(path) {
-  if (!path.trim())
-    throw new Error("Instruction rule path cannot be empty.");
-  if (path.includes("\\"))
-    throw new Error(`Instruction rule path must use POSIX separators: ${path}`);
-  const normalized = posix.normalize(path);
-  if (normalized === "." || posix.isAbsolute(normalized) || normalized === ".." || normalized.startsWith("../")) {
-    throw new Error(`Instruction rule path escapes managed rule directory: ${path}`);
+async function writeConfigResult(config, targetPath, content, opts, meta = {}) {
+  const renderedTargetPath = opts.vars ? renderMachineAwareContent(targetPath, opts.vars) : targetPath;
+  const renderedContent = opts.vars ? renderMachineAwareContent(content, opts.vars) : content;
+  const targetAgent = meta.agent ?? config.agent;
+  if (isAntigravityRuleTarget(targetAgent, renderedTargetPath) && renderedContent.length > ANTIGRAVITY_RULE_FILE_CHAR_LIMIT) {
+    throw new ConfigApplyError(`Antigravity rule file ${renderedTargetPath} is ${renderedContent.length} characters; split it before applying because Antigravity limits rule files to ${ANTIGRAVITY_RULE_FILE_CHAR_LIMIT} characters.`);
+  }
+  const path = expandPath(renderedTargetPath);
+  const previousContent = existsSync4(path) ? readFileSync2(path, "utf-8") : null;
+  const changed = previousContent !== renderedContent;
+  if (!opts.dryRun) {
+    const dir = dirname2(path);
+    if (!existsSync4(dir)) {
+      mkdirSync2(dir, { recursive: true });
+    }
+    if (previousContent !== null && changed) {
+      const store = opts.store ?? resolveConfigStore();
+      await store.createSnapshot(config.id, previousContent, config.version);
+    }
+    writeFileSync(path, renderedContent, "utf-8");
   }
-  return normalized;
-}
-function identitySourceToSessionSource(value, options) {
-  const record = asRecord(value, "identity instruction source");
-  const providers = asStringArray(record["targetProviders"]);
-  if (options.tool && providers.length > 0 && !providerTargetsTool(providers, options.tool))
-    return null;
-  const sourcePaths = normalizeSourcePaths(record["sourcePaths"]);
-  const kind = maybeString(record["kind"]);
-  const layer = record["layer"] === undefined ? layerFromIdentityKind(kind, options.exportShape) : requireLayer(record["layer"]);
-  const merge = requireMerge(record["merge"] ?? record["mergePolicy"] ?? "append");
-  const id = requireString(record["id"], "identity instruction source id");
-  const inlineContent = maybeString(record["content"]);
-  const resolvedContent = inlineContent && inlineContent.trim() ? inlineContent : contentFromIdentitySourcePaths(sourcePaths, options.path, id) ?? inlineContent;
   return {
-    id,
-    label: maybeString(record["label"]) ?? maybeString(record["title"]) ?? id,
-    layer,
-    merge,
-    order: typeof record["order"] === "number" ? record["order"] : typeof record["precedence"] === "number" ? record["precedence"] : options.orderFallback,
-    content: resolvedContent ?? "",
-    path: options.path,
-    rules: normalizeIdentityRules(record["rules"]),
-    provenance: asOptionalRecord(record["provenance"]) ?? null,
-    targetProviders: providers,
-    owner: normalizeIdentityOwner(record["owner"]),
-    sourcePaths,
-    globs: asStringArray(record["globs"]),
-    hash: maybeString(record["hash"]),
-    nonOverridable: record["nonOverridable"] === true,
-    replacementScope: maybeString(record["replacementScope"]),
-    metadata: asOptionalRecord(record["metadata"]) ?? null
+    config_id: config.id,
+    path,
+    previous_content: previousContent,
+    new_content: renderedContent,
+    dry_run: opts.dryRun ?? false,
+    changed,
+    ...meta
   };
 }
-function layerFromIdentityKind(kind, exportShape) {
-  if (!kind) {
-    if (exportShape === "configs-contract")
-      throw new Error("Invalid session instruction layer: undefined");
-    return "agent";
+function isAntigravityRuleTarget(agent, targetPath) {
+  return agent === "antigravity" && /\.(md|mdc|markdown)$/i.test(targetPath);
+}
+function isGeneratedOutputTarget(config, configs) {
+  if (!config.target_path)
+    return false;
+  const targetPath = normalizeTargetPath(config.target_path);
+  return configs.some((candidate) => candidate.id !== config.id && candidate.outputs.some((output) => normalizeTargetPath(output.target_path) === targetPath));
+}
+async function applyConfig(config, opts = {}) {
+  if (opts.outputAgent && isRetiredOrUnsupportedConfigAgent(opts.outputAgent)) {
+    throw new ConfigApplyError(`Config output agent "${opts.outputAgent}" is retired or unsupported \u2014 cannot apply to disk.`);
   }
-  switch (kind) {
-    case "global-rules":
-    case "global-system-prompt":
-      return "global";
-    case "provider-rules":
-    case "provider-system-prompt":
-      return "tool";
-    case "identity-doc":
-    case "persona-doc":
-      return "agent";
-    case "account-overlay":
-      return "account";
-    case "project-overlay":
-      return "project";
-    case "machine-overlay":
-    case "session-overlay":
-      return "local";
-    default:
-      throw new Error(`Invalid identity instruction source kind: ${kind}`);
+  if (isRetiredOrUnsupportedConfigAgent(config.agent)) {
+    throw new ConfigApplyError(`Config "${config.name}" uses retired or unsupported agent "${config.agent}" \u2014 cannot apply to disk.`);
+  }
+  const selectedOutputs = opts.outputAgent ? config.outputs.filter((output) => output.agent === opts.outputAgent) : config.outputs.filter((output) => !isRetiredOrUnsupportedConfigAgent(output.agent));
+  const shouldApplyPrimary = !opts.outputAgent || config.agent === opts.outputAgent;
+  if (config.kind === "reference" || (!config.target_path || !shouldApplyPrimary) && selectedOutputs.length === 0) {
+    throw new ConfigApplyError(`Config "${config.name}" is a reference (kind=reference) and has no target_path \u2014 cannot apply to disk.`);
+  }
+  const store = opts.store ?? resolveConfigStore();
+  const contextConfigs = selectedOutputs.length > 0 || config.target_path ? await store.listConfigs() : [config];
+  if (isGeneratedOutputTarget(config, contextConfigs)) {
+    throw new ConfigApplyError(`Config "${config.name}" targets a generated output path. Apply the canonical source config instead.`);
+  }
+  const outputResults = [];
+  for (const output of selectedOutputs) {
+    outputResults.push(await applyOutput(config, output, contextConfigs, opts));
+  }
+  let result;
+  if (config.target_path && shouldApplyPrimary) {
+    result = await writeConfigResult(config, config.target_path, config.content, opts);
+    result.outputs = outputResults;
+    result.changed = result.changed || outputResults.some((output) => output.changed);
+  } else {
+    result = {
+      ...outputResults[0],
+      outputs: outputResults.slice(1),
+      changed: outputResults.some((output) => output.changed)
+    };
+  }
+  if (!opts.dryRun) {
+    await store.updateConfig(config.id, { synced_at: new Date().toISOString() });
   }
+  return result;
 }
-function contentFromIdentitySourcePaths(sourcePaths, exportPath, sourceId) {
-  if (sourcePaths.length === 0 || !exportPath)
-    return;
-  const baseDir = dirname2(resolveSessionPath(exportPath));
-  const contents = [];
-  for (const sourcePath of sourcePaths) {
-    const content = readIdentitySourcePath(sourcePath, baseDir, sourceId);
-    if (content !== undefined)
-      contents.push({ path: sourcePath.path, content });
+async function applyOutput(config, output, contextConfigs, opts) {
+  const content = applyTransform(config, output, { configs: contextConfigs });
+  return writeConfigResult(config, output.target_path, content, opts, {
+    agent: output.agent,
+    transform: output.transform
+  });
+}
+async function applyConfigs(configs, opts = {}) {
+  const results = [];
+  for (const config of configs) {
+    if (config.kind === "reference")
+      continue;
+    if (isRetiredOrUnsupportedConfigAgent(config.agent))
+      continue;
+    results.push(await applyConfig(config, opts));
   }
-  if (contents.length === 0)
-    return;
-  if (contents.length === 1)
-    return ensureTrailingNewline2(contents[0].content);
-  return ensureTrailingNewline2(contents.map((item) => `<!-- Source path: ${item.path} -->
-${item.content.trimEnd()}`).join(`
+  return results;
+}
 
-`));
+// src/lib/package-version.ts
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname3, join as join4 } from "path";
+import { fileURLToPath } from "url";
+var cached = null;
+function getPackageVersion() {
+  if (cached)
+    return cached;
+  try {
+    let dir = dirname3(fileURLToPath(import.meta.url));
+    for (let i = 0;i < 8; i++) {
+      const pkgPath = join4(dir, "package.json");
+      if (existsSync5(pkgPath)) {
+        const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+        if (pkg.name === "@hasna/instructions" && pkg.version) {
+          cached = pkg.version;
+          return cached;
+        }
+      }
+      const parent = dirname3(dir);
+      if (parent === dir)
+        break;
+      dir = parent;
+    }
+  } catch {}
+  cached = "0.0.0";
+  return cached;
 }
-function readIdentitySourcePath(sourcePath, baseDir, sourceId) {
-  const resolvedPath = resolveIdentitySourcePath(sourcePath.path, baseDir, sourceId);
-  if (!existsSync5(resolvedPath)) {
-    if (sourcePath.required) {
-      throw new Error(`Required identity instruction source path not found for ${sourceId}: ${sourcePath.path}`);
+
+// src/lib/redact.ts
+var SECRET_KEY_PATTERN = /^(.*_?API_?KEY|.*_?TOKEN|.*_?SECRET|.*_?PASSWORD|.*_?PASSWD|.*_?CREDENTIAL|.*_?AUTH(?:_TOKEN|_KEY|ORIZATION)?|.*_?PRIVATE_?KEY|.*_?ACCESS_?KEY|.*_?CLIENT_?SECRET|.*_?SIGNING_?KEY|.*_?ENCRYPTION_?KEY|.*_AUTH_TOKEN)$/i;
+var VALUE_PATTERNS = [
+  { re: /npm_[A-Za-z0-9]{36,}/, reason: "npm token" },
+  { re: /gh[pousr]_[A-Za-z0-9_]{36,}/, reason: "GitHub token" },
+  { re: /sk-ant-[A-Za-z0-9\-_]{40,}/, reason: "Anthropic API key" },
+  { re: /sk-[A-Za-z0-9]{48,}/, reason: "OpenAI API key" },
+  { re: /xoxb-[0-9]+-[A-Za-z0-9\-]+/, reason: "Slack bot token" },
+  { re: /AIza[0-9A-Za-z\-_]{35}/, reason: "Google API key" },
+  { re: /ey[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{20,}\./, reason: "JWT token" },
+  { re: /AKIA[0-9A-Z]{16}/, reason: "AWS access key" }
+];
+var MIN_SECRET_VALUE_LEN = 8;
+function redactShell(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(/^(\s*(?:export\s+)?)([A-Z][A-Z0-9_]*)(\s*=\s*)(['"]?)(.+?)\4\s*$/);
+    if (m) {
+      const [, prefix, key, eq, quote, value] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const reason = reasonFor(key, value);
+        redacted.push({ varName: key, line: i + 1, reason });
+        out.push(`${prefix}${key}${eq}${quote}{{${key}}}${quote}`);
+        continue;
+      }
     }
-    return;
-  }
-  const stat = statSync(resolvedPath);
-  if (!stat.isFile()) {
-    throw new Error(`Identity instruction source path is not a file for ${sourceId}: ${sourcePath.path}`);
-  }
-  const realBase = realpathSync2(baseDir);
-  const realPath = realpathSync2(resolvedPath);
-  if (!pathIsInside(realPath, realBase)) {
-    throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${sourcePath.path}`);
+    out.push(line);
   }
-  return readFileSync3(realPath, "utf-8");
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
 }
-function resolveIdentitySourcePath(path, baseDir, sourceId) {
-  const cleaned = cleanSessionPathInput(path);
-  if (!cleaned)
-    throw new Error(`Identity instruction source path cannot be empty for ${sourceId}.`);
-  if (cleaned.includes("\\"))
-    throw new Error(`Identity instruction source path must use POSIX separators for ${sourceId}: ${path}`);
-  const resolvedPath = isAbsolute(cleaned) ? resolve2(cleaned) : resolve2(baseDir, cleaned);
-  if (!pathIsInside(resolvedPath, resolve2(baseDir))) {
-    throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${path}`);
+function redactJson(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(/^(\s*"([^"]+)"\s*:\s*)"([^"]+)"(,?)(\s*)$/);
+    if (m) {
+      const [, prefix, key, value, comma, trail] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
+        out.push(`${prefix}"{{${varName}}}"${comma}${trail}`);
+        continue;
+      }
+    }
+    let newLine = line;
+    for (const { re, reason } of VALUE_PATTERNS) {
+      newLine = newLine.replace(re, (match) => {
+        const varName = `REDACTED_${reason.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+        redacted.push({ varName, line: i + 1, reason });
+        return `{{${varName}}}`;
+      });
+    }
+    out.push(newLine);
   }
-  return resolvedPath;
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
 }
-function pathIsInside(path, baseDir) {
-  const rel = relative(baseDir, path);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+function redactToml(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const m = line.match(/^(\s*)([a-zA-Z][a-zA-Z0-9_\-]*)(\s*=\s*)(['"]?)(.+?)\4\s*$/);
+    if (m) {
+      const [, indent, key, eq, quote, value] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
+        out.push(`${indent}${key}${eq}${quote}{{${varName}}}${quote}`);
+        continue;
+      }
+    }
+    out.push(line);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
 }
-function providerTargetsTool(targets, tool) {
-  return targets.map((target) => target.toLowerCase()).some((target) => target === tool || target === "all" || target === "generic");
+function redactIni(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const authM = line.match(/^(\/\/[^:]+:_authToken=)(.+)$/);
+    if (authM && !isReferenceValue(authM[2].trim())) {
+      redacted.push({ varName: "NPM_TOKEN", line: i + 1, reason: "npm auth token" });
+      out.push(`${authM[1]}\${NPM_TOKEN}`);
+      continue;
+    }
+    const m = line.match(/^(\s*)([a-zA-Z][a-zA-Z0-9_\-]*)(\s*=\s*)(.+?)\s*$/);
+    if (m) {
+      const [, indent, key, eq, value] = m;
+      if (shouldRedactKeyValue(key, value)) {
+        const varName = key.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason: reasonFor(key, value) });
+        out.push(`${indent}${key}${eq}{{${varName}}}`);
+        continue;
+      }
+    }
+    out.push(line);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
 }
-function normalizeIdentityRules(value) {
-  if (value === undefined || value === null)
-    return [];
-  if (!Array.isArray(value))
-    throw new Error("Identity instruction source rules must be an array.");
-  return value.map((item) => {
-    const record = asRecord(item, "identity instruction rule");
-    const id = requireString(record["id"], "identity instruction rule id");
-    return {
-      id,
-      label: maybeString(record["label"]) ?? id,
-      path: maybeString(record["path"]),
-      content: maybeString(record["content"]) ?? "",
-      globs: asStringArray(record["globs"]),
-      hash: maybeString(record["hash"]),
-      metadata: asOptionalRecord(record["metadata"]) ?? null
-    };
-  });
+function redactGeneric(content) {
+  const redacted = [];
+  const lines = content.split(`
+`);
+  const out = [];
+  for (let i = 0;i < lines.length; i++) {
+    let line = lines[i];
+    for (const { re, reason } of VALUE_PATTERNS) {
+      line = line.replace(re, (match) => {
+        const varName = reason.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+        redacted.push({ varName, line: i + 1, reason });
+        return `{{${varName}}}`;
+      });
+    }
+    out.push(line);
+  }
+  return { content: out.join(`
+`), redacted, isTemplate: redacted.length > 0 };
 }
-function normalizeIdentityOwner(value) {
-  if (value === undefined || value === null)
-    return null;
-  const record = asRecord(value, "identity instruction owner");
-  return {
-    kind: requireString(record["kind"], "identity instruction owner kind"),
-    id: requireString(record["id"], "identity instruction owner id")
-  };
+function shouldRedactKeyValue(key, value) {
+  if (!value || value.startsWith("{{"))
+    return false;
+  if (isReferenceValue(value.trim()))
+    return false;
+  if (value.length < MIN_SECRET_VALUE_LEN)
+    return false;
+  if (/^(true|false|yes|no|on|off|null|undefined|\d+)$/i.test(value))
+    return false;
+  if (SECRET_KEY_PATTERN.test(key))
+    return true;
+  for (const { re } of VALUE_PATTERNS) {
+    if (re.test(value))
+      return true;
+  }
+  return false;
 }
-function normalizeSourcePaths(value) {
-  if (value === undefined || value === null)
-    return [];
-  if (!Array.isArray(value))
-    throw new Error("Identity instruction source paths must be an array.");
-  return value.map((item) => {
-    const record = asRecord(item, "identity instruction source path");
-    return {
-      path: requireString(record["path"], "identity instruction source path"),
-      editable: record["editable"] === true,
-      required: record["required"] === true,
-      hash: maybeString(record["hash"])
-    };
-  });
+function reasonFor(key, value) {
+  if (SECRET_KEY_PATTERN.test(key))
+    return `secret key name: ${key}`;
+  for (const { re, reason } of VALUE_PATTERNS) {
+    if (re.test(value))
+      return reason;
+  }
+  return "secret value pattern";
 }
-function requireLayer(value) {
-  if (value === "global" || value === "tool" || value === "account" || value === "agent" || value === "project" || value === "local")
-    return value;
-  throw new Error(`Invalid session instruction layer: ${String(value)}`);
+function isReferenceValue(value) {
+  return /^\{\{[A-Z][A-Z0-9_]*\}\}$/.test(value) || /^\$\{[A-Z][A-Z0-9_]*\}$/.test(value) || /^\$[A-Z][A-Z0-9_]*$/.test(value) || /^%[A-Z][A-Z0-9_]*%$/.test(value);
 }
-function requireMerge(value) {
-  if (value === "append" || value === "replace")
-    return value;
-  throw new Error(`Invalid session instruction merge policy: ${String(value)}`);
+function redactContent(content, format) {
+  switch (format) {
+    case "shell":
+      return redactShell(content);
+    case "json":
+      return redactJson(content);
+    case "toml":
+      return redactToml(content);
+    case "ini":
+      return redactIni(content);
+    default:
+      return redactGeneric(content);
+  }
 }
-function asRecord(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    throw new Error(`Invalid ${label}.`);
-  return value;
+function scanSecrets(content, format) {
+  const r = redactContent(content, format);
+  return r.redacted;
 }
-function asOptionalRecord(value) {
-  if (value === undefined || value === null)
-    return null;
-  return asRecord(value, "record");
+function hasSecrets(content, format) {
+  return scanSecrets(content, format).length > 0;
 }
-function maybeString(value) {
-  return typeof value === "string" ? value : undefined;
+
+// src/status.ts
+var PACKAGE_NAME = "@hasna/instructions";
+var PACKAGE_VERSION = getPackageVersion();
+function activeDatabaseEnv() {
+  if (process.env["HASNA_INSTRUCTIONS_DB_PATH"])
+    return "HASNA_INSTRUCTIONS_DB_PATH";
+  return null;
 }
-function requireString(value, label) {
-  if (typeof value !== "string" || !value.trim())
-    throw new Error(`Invalid ${label}.`);
-  return value;
+function configuredDatabaseKind() {
+  const value = process.env["HASNA_INSTRUCTIONS_DB_PATH"] ?? "";
+  return value === ":memory:" || value.startsWith("file::memory:") ? "memory" : "file";
 }
-function asStringArray(value) {
-  if (value === undefined || value === null)
-    return [];
-  if (!Array.isArray(value))
-    return [];
-  return value.filter((item) => typeof item === "string");
+function countBy(items, getValue) {
+  const counts = {};
+  for (const item of items) {
+    const value = getValue(item);
+    if (!value)
+      continue;
+    counts[value] = (counts[value] ?? 0) + 1;
+  }
+  return counts;
+}
+async function getConfigsStatus(store = resolveConfigStore()) {
+  let databaseReachable = true;
+  let configs = [];
+  let categoryStats = { total: 0 };
+  try {
+    configs = await store.listConfigs();
+    categoryStats = await store.getConfigStats();
+  } catch {
+    databaseReachable = false;
+  }
+  const fileConfigs = configs.filter((config) => config.kind === "file");
+  const retiredAgentRows = configs.filter((config) => isRetiredOrUnsupportedConfigAgent(config.agent)).length;
+  let driftedTargets = 0;
+  let missingTargets = 0;
+  let unredactedSecretFindings = 0;
+  let knownTargets = 0;
+  for (const config of fileConfigs) {
+    unredactedSecretFindings += scanSecrets(config.content, config.format).length;
+    if (isRetiredOrUnsupportedConfigAgent(config.agent))
+      continue;
+    if (!config.target_path)
+      continue;
+    knownTargets += 1;
+    const targetPath = expandPath(config.target_path);
+    if (!existsSync6(targetPath)) {
+      missingTargets += 1;
+      continue;
+    }
+    const disk = readFileSync4(targetPath, "utf-8");
+    const { content: redactedDisk } = redactContent(disk, config.format);
+    if (redactedDisk !== config.content) {
+      driftedTargets += 1;
+    }
+  }
+  let profiles = 0;
+  let machines = 0;
+  let profileLinks = 0;
+  let snapshots = 0;
+  if (databaseReachable) {
+    try {
+      const profileList = await store.listProfiles();
+      profiles = profileList.length;
+      machines = (await store.listMachines()).length;
+      for (const profile of profileList) {
+        profileLinks += (await store.getProfileConfigs(profile.id)).length;
+      }
+      for (const config of configs) {
+        snapshots += (await store.listSnapshots(config.id)).length;
+      }
+    } catch {
+      databaseReachable = false;
+    }
+  }
+  const byCategory = Object.fromEntries(Object.entries(categoryStats).filter(([key]) => key !== "total"));
+  const status = databaseReachable && driftedTargets === 0 && missingTargets === 0 && unredactedSecretFindings === 0 && retiredAgentRows === 0 ? "ok" : "warn";
+  return {
+    service: "configs",
+    schemaVersion: "1.0",
+    package: {
+      name: PACKAGE_NAME,
+      version: PACKAGE_VERSION
+    },
+    env: {
+      database: {
+        primary: "HASNA_INSTRUCTIONS_DB_PATH",
+        active: activeDatabaseEnv(),
+        kind: configuredDatabaseKind()
+      }
+    },
+    counts: {
+      configs: {
+        total: configs.length,
+        file: fileConfigs.length,
+        reference: configs.filter((config) => config.kind === "reference").length,
+        templates: configs.filter((config) => config.is_template).length,
+        retiredAgentRows
+      },
+      byCategory,
+      byAgent: countBy(configs, (config) => config.agent),
+      byFormat: countBy(configs, (config) => config.format),
+      profiles,
+      profileLinks,
+      machines,
+      snapshots,
+      knownTargets
+    },
+    health: {
+      status,
+      databaseReachable,
+      driftedTargets,
+      missingTargets,
+      unredactedSecretFindings,
+      retiredAgentRows,
+      hasDrift: driftedTargets > 0,
+      hasMissingTargets: missingTargets > 0,
+      hasUnredactedSecrets: unredactedSecretFindings > 0,
+      hasRetiredAgentRows: retiredAgentRows > 0
+    },
+    safety: {
+      includesConfigValues: false,
+      includesPrivatePaths: false,
+      includesHostnames: false,
+      includesSecretValues: false,
+      statusOutputIsMetadataOnly: true
+    }
+  };
 }
+// src/db/pg-migrations.ts
+var PG_MIGRATIONS = [
+  `CREATE TABLE IF NOT EXISTS configs (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    slug TEXT NOT NULL UNIQUE,
+    kind TEXT NOT NULL DEFAULT 'file',
+    category TEXT NOT NULL,
+    agent TEXT NOT NULL DEFAULT 'global',
+    target_path TEXT,
+    outputs TEXT NOT NULL DEFAULT '[]',
+    format TEXT NOT NULL DEFAULT 'text',
+    content TEXT NOT NULL DEFAULT '',
+    description TEXT,
+    tags TEXT NOT NULL DEFAULT '[]',
+    is_template BOOLEAN NOT NULL DEFAULT FALSE,
+    version INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    synced_at TEXT
+  )`,
+  `CREATE TABLE IF NOT EXISTS config_snapshots (
+    id TEXT PRIMARY KEY,
+    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
+    content TEXT NOT NULL,
+    version INTEGER NOT NULL,
+    created_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS profiles (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    slug TEXT NOT NULL UNIQUE,
+    description TEXT,
+    selectors TEXT NOT NULL DEFAULT '{}',
+    variables TEXT NOT NULL DEFAULT '{}',
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS profile_configs (
+    profile_id TEXT NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
+    config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE,
+    sort_order INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (profile_id, config_id)
+  )`,
+  `CREATE TABLE IF NOT EXISTS machines (
+    id TEXT PRIMARY KEY,
+    hostname TEXT NOT NULL UNIQUE,
+    os TEXT,
+    arch TEXT,
+    last_applied_at TEXT,
+    created_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS feedback (
+    id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+    message TEXT NOT NULL,
+    email TEXT,
+    category TEXT DEFAULT 'general',
+    version TEXT,
+    machine_id TEXT,
+    created_at TEXT NOT NULL DEFAULT NOW()::text
+  )`,
+  `ALTER TABLE configs ADD COLUMN IF NOT EXISTS outputs TEXT NOT NULL DEFAULT '[]'`
+];
 // src/lib/session-apply.ts
 import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 import {
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   lstatSync,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   renameSync,
   rmSync as rmSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join4, parse as parse2, relative as relative2, resolve as resolve3 } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join5, parse as parse2, relative as relative2, resolve as resolve3 } from "path";
 class SessionApplyError extends Error {
   constructor(message) {
     super(message);
@@ -2598,7 +2738,7 @@ function applySessionRender(plan, options = {}) {
     snapshotPath = writeSessionSnapshot(plan, targetHome, manifestPath, results, previousManifest);
     for (const file of files) {
       const target = resolvePlannedFilePath(plan, file, targetHome);
-      const existingContent = existsSync6(target) ? readFileSync4(target, "utf-8") : null;
+      const existingContent = existsSync7(target) ? readFileSync5(target, "utf-8") : null;
       if (existingContent === file.content)
         continue;
       writePlannedFile(target, file.content, targetHome);
@@ -2607,7 +2747,7 @@ function applySessionRender(plan, options = {}) {
       if (result.action !== "delete")
         continue;
       assertNoSymlinkSegments(targetHome, result.path);
-      if (existsSync6(result.path))
+      if (existsSync7(result.path))
         rmSync2(result.path);
     }
   }
@@ -2642,7 +2782,7 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
   const drifted = [];
   for (const file of previousManifest.files) {
     const target = resolveManifestRelativePath(file.relativePath, safeTargetHome);
-    if (!existsSync6(target)) {
+    if (!existsSync7(target)) {
       missing.push({
         path: target,
         relativePath: file.relativePath,
@@ -2652,7 +2792,7 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
       });
       continue;
     }
-    const actualSha256 = sha2562(readFileSync4(target, "utf-8"));
+    const actualSha256 = sha2562(readFileSync5(target, "utf-8"));
     if (actualSha256 !== file.sha256) {
       drifted.push({
         path: target,
@@ -2674,7 +2814,7 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
 }
 function planFileResult(plan, file, targetHome, previousHashes, previousManifest, options) {
   const target = resolvePlannedFilePath(plan, file, targetHome);
-  const previousContent = existsSync6(target) ? readFileSync4(target, "utf-8") : null;
+  const previousContent = existsSync7(target) ? readFileSync5(target, "utf-8") : null;
   const previousSha256 = previousContent === null ? null : sha2562(previousContent);
   const previouslyManaged = isPreviouslyManaged(file, previousSha256, previousHashes, previousManifest);
   const changed = previousContent !== file.content;
@@ -2757,9 +2897,9 @@ function planStaleFileResults(plan, targetHome, previousManifest, currentRelativ
 }
 function planStaleFileResult(file, targetHome, options) {
   const target = resolveManifestRelativePath(file.relativePath, targetHome);
-  if (!existsSync6(target))
+  if (!existsSync7(target))
     return null;
-  const previousContent = readFileSync4(target, "utf-8");
+  const previousContent = readFileSync5(target, "utf-8");
   const previousSha256 = sha2562(previousContent);
   if (!options.force && previousSha256 !== file.sha256) {
     return {
@@ -2825,10 +2965,10 @@ function resolveManifestRelativePath(relativePath, targetHome) {
   return target;
 }
 function readPreviousManifest(path) {
-  if (!existsSync6(path))
+  if (!existsSync7(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync4(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync5(path, "utf-8"));
     if (parsed.schema !== SESSION_RENDER_SCHEMA)
       return null;
     if (!Array.isArray(parsed.files))
@@ -2839,16 +2979,16 @@ function readPreviousManifest(path) {
   }
 }
 function writePlannedFile(path, content, targetHome) {
-  const dir = dirname3(path);
+  const dir = dirname4(path);
   mkdirSync3(dir, { recursive: true });
   assertNoSymlinkSegments(targetHome, path);
-  const tmp = join4(dir, `.session-${randomUUID3()}.tmp`);
+  const tmp = join5(dir, `.session-${randomUUID3()}.tmp`);
   writeFileSync2(tmp, content, "utf-8");
   renameSync(tmp, path);
 }
 function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousManifest) {
-  const existingFiles = results.filter((result) => result.action === "update" || result.action === "delete").filter((result) => existsSync6(result.path)).map((result) => {
-    const content = readFileSync4(result.path, "utf-8");
+  const existingFiles = results.filter((result) => result.action === "update" || result.action === "delete").filter((result) => existsSync7(result.path)).map((result) => {
+    const content = readFileSync5(result.path, "utf-8");
     return {
       path: result.path,
       relativePath: result.relativePath,
@@ -2883,7 +3023,7 @@ function assertSafeTargetHome(targetHome) {
     throw new SessionApplyError(`Session target home cannot be the filesystem root: ${targetHome}`);
   }
   assertNoSymlinkAncestors(normalized);
-  if (existsSync6(normalized) && lstatSync(normalized).isSymbolicLink()) {
+  if (existsSync7(normalized) && lstatSync(normalized).isSymbolicLink()) {
     throw new SessionApplyError(`Session target home cannot be a symlink: ${normalized}`);
   }
   return normalized;
@@ -2893,8 +3033,8 @@ function assertNoSymlinkSegments(root, target) {
   const rel = relative2(root, target);
   let current = root;
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join4(current, segment);
-    if (existsSync6(current) && lstatSync(current).isSymbolicLink()) {
+    current = join5(current, segment);
+    if (existsSync7(current) && lstatSync(current).isSymbolicLink()) {
       throw new SessionApplyError(`Session apply path uses a symlink: ${current}`);
     }
   }
@@ -2905,8 +3045,8 @@ function assertNoSymlinkAncestors(path) {
   let current = parsed.root;
   const rel = relative2(parsed.root, normalized);
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join4(current, segment);
-    if (!existsSync6(current))
+    current = join5(current, segment);
+    if (!existsSync7(current))
       return;
     if (lstatSync(current).isSymbolicLink()) {
       throw new SessionApplyError(`Session apply path uses a symlink ancestor: ${current}`);
@@ -3071,13 +3211,86 @@ async function ensurePlatformProfiles(store = resolveConfigStore()) {
   }
   return ensured;
 }
+// src/lib/global-agent-rules-standard.ts
+var GLOBAL_AGENT_RULES_STANDARD_SLUG = "global-agent-rules-standard";
+var GLOBAL_AGENT_RULES_STANDARD_CONTENT = `# Global Coding Agent Rules Standard
+
+This standard is managed global/system prompt source content for Hasna coding
+agents. Rendered agents must receive these rules unless a newer authorized
+policy source supersedes them.
+
+## Session and Planning Defaults
+
+1. Use automatic session renaming when the agent supports it. Rename the
+   session early to match the active task; if the task materially pivots, rename
+   it again so operators can identify the run.
+2. Never set Codewith goal/token budgets or goal-plan budgets unless the user
+   explicitly asks for a budget. Durable goals and goal plans are unbudgeted by
+   default.
+
+## Repository Mutation and Landing
+
+3. Repo mutation must happen in a task-scoped worktree. First inspect the canonical worktree root
+   \`$HOME/.hasna/repos/worktrees\`; prefer Hasna repo/project worktree
+   mechanisms when available; otherwise use \`git worktree\`. Never mutate shared checkouts.
+4. PR-first landing: normal changes go through a branch/worktree and pull
+   request before landing.
+5. Never push directly to \`main\`, the default branch, or any protected branch
+   unless the user explicitly instructs that exact repo and operation.
+
+## Autonomy and Source-of-Truth Tools
+
+6. Act autonomously. Diagnose, repair, validate, and iterate on the owning
+   CLIs, packages, and workflows before asking the user. Ask only when blocked
+   by destructive decisions, secret-bearing decisions, user-only authority, or
+   external state the agent cannot safely obtain.
+7. Use Hasna CLIs/packages as the source of truth: \`todos\`, \`conversations\`,
+   \`mementos\`, \`knowledge\`, \`projects\`, \`repos\`, \`accounts\`,
+   \`instructions\`, \`machines\`, \`secrets\`, and \`access\`.
+8. Secrets safety is mandatory. Never expose secrets in prompts, tasks,
+   memories, conversations, manifests, reports, logs, PR text, or any other
+   agent-visible output. Reference vault item names, secret identifiers, and
+   access grants only; never print credential values.
+
+## Conversation Surfaces
+
+9. Use default conversation surfaces correctly: \`announcements\` for policy,
+   freeze, breaking, cutover, and release notices; \`incidents\` for outages,
+   crash loops, data risk, or security exposure; \`git-publishing\` before and
+   after package publishes; \`git-prs\`, \`git-commits\`, and \`git-releases\`
+   for repository landing events; \`hq\` for broad coordination;
+   \`agent-policy\` for agent operating-rule discussion; project/product
+   channels for normal work; and \`conversations blockers\` for blocker
+   discovery. Do not invent or refer to a literal blockers channel.
+`;
+async function ensureGlobalAgentRulesStandardConfig(store = resolveConfigStore()) {
+  const input = {
+    name: "Global Agent Rules Standard",
+    category: "rules",
+    agent: "global",
+    format: "markdown",
+    content: GLOBAL_AGENT_RULES_STANDARD_CONTENT,
+    kind: "reference",
+    description: "Managed global/system prompt rules for Hasna coding agents",
+    tags: ["global-agent-rules", "system-prompt", "coding-agent-rules"]
+  };
+  try {
+    const existing = await store.getConfig(GLOBAL_AGENT_RULES_STANDARD_SLUG);
+    if (existing.content !== input.content || existing.description !== input.description || existing.category !== input.category || existing.agent !== input.agent || existing.format !== input.format || existing.kind !== input.kind || JSON.stringify(existing.tags) !== JSON.stringify(input.tags)) {
+      return await store.updateConfig(existing.id, input);
+    }
+    return existing;
+  } catch {
+    return await store.createConfig(input);
+  }
+}
 // src/lib/sync.ts
-import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
-import { basename as basename4, extname as extname3, join as join6 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync7 } from "fs";
+import { basename as basename4, extname as extname3, join as join7 } from "path";
 
 // src/lib/sync-dir.ts
-import { existsSync as existsSync7, readdirSync, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
-import { join as join5, relative as relative3 } from "path";
+import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
+import { join as join6, relative as relative3 } from "path";
 import { homedir as homedir4 } from "os";
 var SKIP = [".db", ".db-shm", ".db-wal", ".log", ".lock", ".DS_Store", "node_modules", ".git"];
 function shouldSkip(p) {
@@ -3086,9 +3299,9 @@ function shouldSkip(p) {
 async function syncFromDir(dir, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const absDir = expandPath(dir);
-  if (!existsSync7(absDir))
+  if (!existsSync8(absDir))
     return { added: 0, updated: 0, unchanged: 0, skipped: [`Not found: ${absDir}`] };
-  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync(absDir).map((f) => join5(absDir, f)).filter((f) => statSync2(f).isFile());
+  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync(absDir).map((f) => join6(absDir, f)).filter((f) => statSync2(f).isFile());
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
   const home = homedir4();
   const allConfigs = await store.listConfigs();
@@ -3098,7 +3311,7 @@ async function syncFromDir(dir, opts = {}) {
       continue;
     }
     try {
-      const content = readFileSync5(file, "utf-8");
+      const content = readFileSync6(file, "utf-8");
       if (content.length > 500000) {
         result.skipped.push(file + " (too large)");
         continue;
@@ -3143,7 +3356,7 @@ async function syncToDir(dir, opts = {}) {
 }
 function walkDir(dir, files = []) {
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const full = join5(dir, entry.name);
+    const full = join6(dir, entry.name);
     if (shouldSkip(full))
       continue;
     if (entry.isDirectory())
@@ -3159,7 +3372,8 @@ var CLAUDE_PROMPT_OUTPUTS = [
   { agent: "codex", target_path: "~/.codex/AGENTS.md", transform: "codex-flat" },
   { agent: "codewith", target_path: "~/.codewith/CODEWITH.md", transform: "codex-flat" },
   { agent: "opencode", target_path: "~/.config/opencode/AGENTS.md", transform: "opencode-flat" },
-  { agent: "aicopilot", target_path: "~/.config/aicopilot/AGENTS.md", transform: "opencode-flat" },
+  { agent: "aicopilot", target_path: "~/.config/aicopilot/AICOPILOT.md", transform: "codex-flat" },
+  { agent: "antigravity", target_path: "~/.gemini/GEMINI.md", transform: "codex-flat" },
   { agent: "cursor", target_path: "~/.cursor/rules/claude.mdc", transform: "cursor-mdc" }
 ];
 function claudeRuleOutputs(fileName) {
@@ -3193,7 +3407,7 @@ function isGeneratedOutputTarget2(config, owners) {
   return !!ownerIds && !ownerIds.has(config.id);
 }
 function hasClaudePromptSource() {
-  return existsSync8(expandPath("~/.claude/CLAUDE.md"));
+  return existsSync9(expandPath("~/.claude/CLAUDE.md"));
 }
 function hasClaudeRuleSourceForCursorTarget(targetPath) {
   const absoluteTargetPath = expandPath(targetPath);
@@ -3201,7 +3415,7 @@ function hasClaudeRuleSourceForCursorTarget(targetPath) {
   if (!absoluteTargetPath.startsWith(`${absolutePrefix}/`) || !absoluteTargetPath.endsWith(".mdc"))
     return false;
   const stem = basename4(absoluteTargetPath, ".mdc");
-  return existsSync8(expandPath(`~/.claude/rules/${stem}.md`)) || existsSync8(expandPath(`~/.claude/rules/${stem}.mdc`));
+  return existsSync9(expandPath(`~/.claude/rules/${stem}.md`)) || existsSync9(expandPath(`~/.claude/rules/${stem}.mdc`));
 }
 function isKnownGeneratedTargetPath(targetPath) {
   const normalizedTargetPath = normalizeTargetPath(targetPath);
@@ -3224,10 +3438,10 @@ var KNOWN_CONFIGS = [
   { path: "~/.cursor/mcp.json", name: "cursor-mcp", category: "mcp", agent: "cursor", format: "json", optional: true, description: "Cursor MCP config (includes Skills MCP server entries)" },
   { path: "~/.codewith/CODEWITH.md", name: "codewith-codewith-md", category: "rules", agent: "codewith", format: "markdown", optional: true },
   { path: "~/.codewith/config.toml", name: "codewith-config", category: "mcp", agent: "codewith", format: "toml", optional: true, description: "codewith config (Codex fork, includes Skills MCP server entries)" },
-  { path: "~/.config/aicopilot/AGENTS.md", name: "aicopilot-agents-md", category: "rules", agent: "aicopilot", format: "markdown", optional: true },
-  { path: "~/.config/aicopilot/opencode.json", name: "aicopilot-config", category: "mcp", agent: "aicopilot", format: "json", optional: true, description: "AI Copilot config (OpenCode fork, includes Skills MCP server entries)" },
-  { path: "~/.gemini/settings.json", name: "gemini-settings", category: "agent", agent: "gemini", format: "json" },
-  { path: "~/.gemini/GEMINI.md", name: "gemini-gemini-md", category: "rules", agent: "gemini", format: "markdown", optional: true },
+  { path: "~/.config/aicopilot/AICOPILOT.md", name: "aicopilot-aicopilot-md", category: "rules", agent: "aicopilot", format: "markdown", optional: true },
+  { path: "~/.config/aicopilot/aicopilot.json", name: "aicopilot-config", category: "mcp", agent: "aicopilot", format: "json", optional: true, description: "AI Copilot config (includes instructions and MCP server entries)" },
+  { path: "~/.gemini/GEMINI.md", name: "antigravity-global-rules", category: "rules", agent: "antigravity", format: "markdown", optional: true, description: "Google Antigravity global rules file" },
+  { path: "~/.gemini/config/mcp_config.json", name: "antigravity-global-mcp", category: "mcp", agent: "antigravity", format: "json", optional: true, description: "Google Antigravity global MCP server entries" },
   { path: "~/.claude.json", name: "claude-json", category: "mcp", agent: "claude", format: "json", description: "Claude Code global config (includes MCP server entries)" },
   { path: "~/.zshrc", name: "zshrc", category: "shell", agent: "zsh" },
   { path: "~/.zprofile", name: "zprofile", category: "shell", agent: "zsh", optional: true },
@@ -3245,10 +3459,12 @@ var PROJECT_CONFIG_FILES = [
   { file: ".mcp.json", category: "mcp", agent: "claude", format: "json" },
   { file: "AGENTS.md", category: "rules", agent: "codex", format: "markdown" },
   { file: ".codex/AGENTS.md", category: "rules", agent: "codex", format: "markdown" },
-  { file: "GEMINI.md", category: "rules", agent: "gemini", format: "markdown" },
   { file: ".opencode/AGENTS.md", category: "rules", agent: "opencode", format: "markdown" },
   { file: ".codewith/CODEWITH.md", category: "rules", agent: "codewith", format: "markdown" },
-  { file: ".cursor/mcp.json", category: "mcp", agent: "cursor", format: "json" }
+  { file: ".aicopilot/AICOPILOT.md", category: "rules", agent: "aicopilot", format: "markdown" },
+  { file: "AICOPILOT.md", category: "rules", agent: "aicopilot", format: "markdown" },
+  { file: ".cursor/mcp.json", category: "mcp", agent: "cursor", format: "json" },
+  { file: ".agents/mcp_config.json", category: "mcp", agent: "antigravity", format: "json" }
 ];
 async function syncProject(opts) {
   const store = opts.store ?? resolveConfigStore();
@@ -3258,11 +3474,11 @@ async function syncProject(opts) {
   const allConfigs = await store.listConfigs();
   const machine = detectMachineContext();
   for (const pf of PROJECT_CONFIG_FILES) {
-    const abs = join6(absDir, pf.file);
-    if (!existsSync8(abs))
+    const abs = join7(absDir, pf.file);
+    if (!existsSync9(abs))
       continue;
     try {
-      const rawContent = readFileSync6(abs, "utf-8");
+      const rawContent = readFileSync7(abs, "utf-8");
       if (rawContent.length > 500000) {
         result.skipped.push(pf.file);
         continue;
@@ -3290,23 +3506,27 @@ async function syncProject(opts) {
       result.skipped.push(pf.file);
     }
   }
-  const rulesDir = join6(absDir, ".claude", "rules");
-  if (existsSync8(rulesDir)) {
-    const mdFiles = readdirSync2(rulesDir).filter((f) => f.endsWith(".md") || f.endsWith(".mdc"));
+  for (const ruleDir of [
+    { dir: join7(absDir, ".claude", "rules"), agent: "claude", namePrefix: "rules" },
+    { dir: join7(absDir, ".agents", "rules"), agent: "antigravity", namePrefix: "antigravity-rules" }
+  ]) {
+    if (!existsSync9(ruleDir.dir))
+      continue;
+    const mdFiles = readdirSync2(ruleDir.dir).filter((f) => f.endsWith(".md") || f.endsWith(".mdc"));
     for (const f of mdFiles) {
-      const abs = join6(rulesDir, f);
-      const raw = readFileSync6(abs, "utf-8");
+      const abs = join7(ruleDir.dir, f);
+      const raw = readFileSync7(abs, "utf-8");
       const redacted = redactContent(raw, "markdown");
       const machineAware = templateizeMachineContent(redacted.content, machine);
       const content = machineAware.content;
       const isTemplate2 = redacted.isTemplate || machineAware.changed;
-      const name = `${projectName}/rules/${f}`;
+      const name = `${projectName}/${ruleDir.namePrefix}/${f}`;
       const targetPath = abs.startsWith(getConfigHome()) ? abs.replace(getConfigHome(), "~") : abs;
       const slug2 = name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
       const existing = allConfigs.find((c) => c.target_path === targetPath || c.slug === slug2);
       if (!existing) {
         if (!opts.dryRun)
-          await store.createConfig({ name, category: "rules", agent: "claude", format: "markdown", content, target_path: targetPath, is_template: isTemplate2 });
+          await store.createConfig({ name, category: "rules", agent: ruleDir.agent, format: "markdown", content, target_path: targetPath, is_template: isTemplate2 });
         result.added++;
       } else if (existing.content !== content) {
         if (!opts.dryRun)
@@ -3334,20 +3554,20 @@ async function syncKnown(opts = {}) {
   for (const known of targets) {
     if (known.rulesDir) {
       const absDir = expandPath(known.rulesDir);
-      if (!existsSync8(absDir)) {
+      if (!existsSync9(absDir)) {
         result.skipped.push(known.rulesDir);
         continue;
       }
       const extensions = known.rulesExtensions ?? [".md", ".mdc"];
       const ruleFiles = readdirSync2(absDir).filter((f) => extensions.some((ext) => f.endsWith(ext)));
       for (const f of ruleFiles) {
-        const abs2 = join6(absDir, f);
+        const abs2 = join7(absDir, f);
         const targetPath = abs2.replace(home, "~");
         if (existingOutputOwners.has(normalizeTargetPath(targetPath)) || isKnownGeneratedTargetPath(targetPath)) {
           result.skipped.push(`${targetPath} (generated output)`);
           continue;
         }
-        const raw = readFileSync6(abs2, "utf-8");
+        const raw = readFileSync7(abs2, "utf-8");
         const redacted = redactContent(raw, "markdown");
         const machineAware = templateizeMachineContent(redacted.content, machine);
         const content = machineAware.content;
@@ -3375,12 +3595,12 @@ async function syncKnown(opts = {}) {
       continue;
     }
     const abs = expandPath(known.path);
-    if (!existsSync8(abs)) {
+    if (!existsSync9(abs)) {
       result.skipped.push(known.path);
       continue;
     }
     try {
-      const rawContent = readFileSync6(abs, "utf-8");
+      const rawContent = readFileSync7(abs, "utf-8");
       if (rawContent.length > 500000) {
         result.skipped.push(known.path + " (too large)");
         continue;
@@ -3444,6 +3664,10 @@ async function syncToDisk(opts = {}) {
   for (const config of configs) {
     if (!config.target_path && config.outputs.length === 0)
       continue;
+    if (isRetiredOrUnsupportedConfigAgent(config.agent)) {
+      result.skipped.push(`${config.slug} (${retiredOrUnsupportedAgentReason(config.agent)})`);
+      continue;
+    }
     try {
       const r = await applyConfig(config, { dryRun: opts.dryRun, store, outputAgent: opts.agent });
       r.changed ? result.updated++ : result.unchanged++;
@@ -3455,9 +3679,9 @@ async function syncToDisk(opts = {}) {
 }
 function buildDiff(expectedContent, targetPath) {
   const path = expandPath(targetPath);
-  if (!existsSync8(path))
+  if (!existsSync9(path))
     return `(file not found on disk: ${path})`;
-  const diskContent = readFileSync6(path, "utf-8");
+  const diskContent = readFileSync7(path, "utf-8");
   if (diskContent === expectedContent)
     return "(no diff \u2014 identical)";
   const stored = expectedContent.split(`
@@ -3510,12 +3734,12 @@ async function diffConfig(config, opts = {}) {
 }
 function detectCategory(filePath) {
   const p = filePath.toLowerCase().replace(getConfigHome(), "~");
-  if (p.includes("/.claude/rules/") || p.includes("/.cursor/rules/") || p.endsWith("claude.md") || p.endsWith("agents.md") || p.endsWith("codewith.md") || p.endsWith("gemini.md") || p.endsWith(".mdc"))
+  if (p.includes("/.claude/rules/") || p.includes("/.cursor/rules/") || p.includes("/.agents/rules/") || p.endsWith("claude.md") || p.endsWith("agents.md") || p.endsWith("codewith.md") || p.endsWith("aicopilot.md") || p.endsWith("/.gemini/gemini.md") || p.endsWith(".mdc"))
     return "rules";
-  if (p.includes("/.claude/") || p.includes("/.codex/") || p.includes("/.gemini/") || p.includes("/.cursor/") || p.includes("/.config/opencode/") || p.includes("/.codewith/") || p.includes("/.config/aicopilot/"))
-    return "agent";
   if (p.includes(".mcp.json") || p.includes("mcp"))
     return "mcp";
+  if (p.includes("/.claude/") || p.includes("/.codex/") || p.includes("/.antigravity/") || p.includes("/.agents/") || p.includes("/.cursor/") || p.includes("/.config/opencode/") || p.includes("/.codewith/") || p.includes("/.config/aicopilot/"))
+    return "agent";
   if (p.includes(".zshrc") || p.includes(".zprofile") || p.includes(".bashrc") || p.includes(".bash_profile"))
     return "shell";
   if (p.includes(".gitconfig") || p.includes(".gitignore"))
@@ -3528,6 +3752,10 @@ function detectCategory(filePath) {
 }
 function detectAgent(filePath) {
   const p = filePath.toLowerCase().replace(getConfigHome(), "~");
+  if (p.endsWith("/.gemini/gemini.md") || p.endsWith("/.gemini/config/mcp_config.json"))
+    return "antigravity";
+  if (p.includes("/.agents/rules/") || p.endsWith("/.agents/mcp_config.json"))
+    return "antigravity";
   if (p.includes("/.claude/") || p.endsWith("claude.md"))
     return "claude";
   if (p.includes("/.config/opencode/"))
@@ -3538,10 +3766,10 @@ function detectAgent(filePath) {
     return "codewith";
   if (p.includes("/.config/aicopilot/"))
     return "aicopilot";
+  if (p.includes("/.antigravity/"))
+    return "antigravity";
   if (p.includes("/.codex/") || p.endsWith("agents.md"))
     return "codex";
-  if (p.includes("/.gemini/") || p.endsWith("gemini.md"))
-    return "gemini";
   if (p.includes(".zshrc") || p.includes(".zprofile") || p.includes(".bashrc"))
     return "zsh";
   if (p.includes(".gitconfig") || p.includes(".gitignore"))
@@ -3565,15 +3793,15 @@ function detectFormat(filePath) {
   return "text";
 }
 // src/lib/export.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join7, resolve as resolve4 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join8, resolve as resolve4 } from "path";
 import { tmpdir } from "os";
 async function exportConfigs(outputPath, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const configs = await store.listConfigs(opts.filter);
   const absOutput = resolve4(outputPath);
-  const tmpDir = join7(tmpdir(), `configs-export-${Date.now()}`);
-  const contentsDir = join7(tmpDir, "contents");
+  const tmpDir = join8(tmpdir(), `configs-export-${Date.now()}`);
+  const contentsDir = join8(tmpDir, "contents");
   try {
     mkdirSync4(contentsDir, { recursive: true });
     const manifest = {
@@ -3581,10 +3809,10 @@ async function exportConfigs(outputPath, opts = {}) {
       exported_at: new Date().toISOString(),
       configs: configs.map(({ content: _content, ...meta }) => meta)
     };
-    writeFileSync3(join7(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
+    writeFileSync3(join8(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
     for (const config of configs) {
       const fileName = `${config.slug}.${config.format === "text" ? "txt" : config.format}`;
-      writeFileSync3(join7(contentsDir, fileName), config.content, "utf-8");
+      writeFileSync3(join8(contentsDir, fileName), config.content, "utf-8");
     }
     const proc = Bun.spawn(["tar", "czf", absOutput, "-C", tmpDir, "."], {
       stdout: "pipe",
@@ -3597,20 +3825,20 @@ async function exportConfigs(outputPath, opts = {}) {
     }
     return { path: absOutput, count: configs.length };
   } finally {
-    if (existsSync9(tmpDir)) {
+    if (existsSync10(tmpDir)) {
       rmSync3(tmpDir, { recursive: true, force: true });
     }
   }
 }
 // src/lib/import.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync7, rmSync as rmSync4 } from "fs";
-import { join as join8, resolve as resolve5 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync8, rmSync as rmSync4 } from "fs";
+import { join as join9, resolve as resolve5 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 async function importConfigs(bundlePath, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const conflict = opts.conflict ?? "skip";
   const absPath = resolve5(bundlePath);
-  const tmpDir = join8(tmpdir2(), `configs-import-${Date.now()}`);
+  const tmpDir = join9(tmpdir2(), `configs-import-${Date.now()}`);
   const result = { created: 0, updated: 0, skipped: 0, errors: [] };
   try {
     mkdirSync5(tmpDir, { recursive: true });
@@ -3623,15 +3851,15 @@ async function importConfigs(bundlePath, opts = {}) {
       const stderr = await new Response(proc.stderr).text();
       throw new Error(`tar extraction failed: ${stderr}`);
     }
-    const manifestPath = join8(tmpDir, "manifest.json");
-    if (!existsSync10(manifestPath))
+    const manifestPath = join9(tmpDir, "manifest.json");
+    if (!existsSync11(manifestPath))
       throw new Error("Invalid bundle: missing manifest.json");
-    const manifest = JSON.parse(readFileSync7(manifestPath, "utf-8"));
+    const manifest = JSON.parse(readFileSync8(manifestPath, "utf-8"));
     for (const meta of manifest.configs) {
       try {
         const ext = meta.format === "text" ? "txt" : meta.format;
-        const contentFile = join8(tmpDir, "contents", `${meta.slug}.${ext}`);
-        const content = existsSync10(contentFile) ? readFileSync7(contentFile, "utf-8") : "";
+        const contentFile = join9(tmpDir, "contents", `${meta.slug}.${ext}`);
+        const content = existsSync11(contentFile) ? readFileSync8(contentFile, "utf-8") : "";
         let existing = null;
         try {
           existing = await store.getConfig(meta.slug);
@@ -3665,16 +3893,16 @@ async function importConfigs(bundlePath, opts = {}) {
     }
     return result;
   } finally {
-    if (existsSync10(tmpDir)) {
+    if (existsSync11(tmpDir)) {
       rmSync4(tmpDir, { recursive: true, force: true });
     }
   }
 }
 // src/lib/package-manager-guard.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync11, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync12, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir5 } from "os";
-import { basename as basename5, dirname as dirname4, isAbsolute as isAbsolute3, join as join9, relative as relative4, resolve as resolve6 } from "path";
+import { basename as basename5, dirname as dirname5, isAbsolute as isAbsolute3, join as join10, relative as relative4, resolve as resolve6 } from "path";
 var SKIP_DIRS = new Set([
   ".git",
   "node_modules",
@@ -3716,7 +3944,7 @@ function scanPackageManagerSecrets(options = {}) {
   const findings = [];
   let scannedFiles = 0;
   for (const root of roots) {
-    if (!existsSync11(root))
+    if (!existsSync12(root))
       continue;
     const stat = lstatSync2(root);
     if (stat.isFile()) {
@@ -3726,7 +3954,7 @@ function scanPackageManagerSecrets(options = {}) {
       if (text === null)
         continue;
       scannedFiles++;
-      findings.push(...scanFile(root, text, classifyRepoFile(root), isTrackedFile(root), dirname4(root)));
+      findings.push(...scanFile(root, text, classifyRepoFile(root), isTrackedFile(root), dirname5(root)));
       continue;
     }
     if (!stat.isDirectory())
@@ -3745,8 +3973,8 @@ function scanPackageManagerSecrets(options = {}) {
   if (options.includeHome) {
     const home = homedir5();
     for (const name of HOME_FILES) {
-      const file = join9(home, name);
-      if (!existsSync11(file))
+      const file = join10(home, name);
+      if (!existsSync12(file))
         continue;
       const text = readTextFile(file);
       if (text === null)
@@ -3770,12 +3998,12 @@ function collectRepoFiles(root) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name))
           continue;
-        visit(join9(dir, entry.name));
+        visit(join10(dir, entry.name));
         continue;
       }
       if (!entry.isFile())
         continue;
-      const file = join9(dir, entry.name);
+      const file = join10(dir, entry.name);
       if (shouldScanRepoFile(file))
         out.push(file);
     }
@@ -3813,7 +4041,7 @@ function readTextFile(file) {
     const stat = lstatSync2(file);
     if (!stat.isFile() || stat.size > 5000000)
       return null;
-    const buf = readFileSync8(file);
+    const buf = readFileSync9(file);
     if (buf.includes(0))
       return null;
     return buf.toString("utf-8");
@@ -4013,7 +4241,7 @@ function trackedFiles(root) {
 }
 function isTrackedFile(file) {
   try {
-    const repoRoot = execFileSync("git", ["-C", dirname4(file), "rev-parse", "--show-toplevel"], {
+    const repoRoot = execFileSync("git", ["-C", dirname5(file), "rev-parse", "--show-toplevel"], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
@@ -4094,6 +4322,7 @@ export {
   expandPath,
   ensureProjectDashboardStandardConfig,
   ensurePlatformProfiles,
+  ensureGlobalAgentRulesStandardConfig,
   diffConfig,
   detectMachineContext,
   detectFormat,
@@ -4117,6 +4346,8 @@ export {
   SESSION_RENDER_TOOLS,
   SESSION_RENDER_SCHEMA,
   SESSION_RENDER_MANAGED_MARKER,
+  SESSION_LAYER_RANK,
+  SESSION_INSTRUCTION_LAYERS,
   RAW_STORE_ROOT_ENV,
   ProfileNotFoundError,
   PROJECT_DASHBOARD_STANDARD_SLUG,
@@ -4127,6 +4358,8 @@ export {
   PG_MIGRATIONS,
   LocalConfigStore,
   KNOWN_CONFIGS,
+  GLOBAL_AGENT_RULES_STANDARD_SLUG,
+  GLOBAL_AGENT_RULES_STANDARD_CONTENT,
   ConfigNotFoundError,
   ConfigApplyError,
   CloudHttpError,