@hasna/instructions 0.5.1 → 0.5.3

package/dist/cli/index.js

@@ -10828,8 +10828,18 @@ function isCursorGlobalAuthorityPath(path) {
   return resolve4(path) === resolve4(join6(homeDir(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
 }
 function stampCursorGlobalAuthorityMarker(content) {
-  if (CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN.test(content))
-    return content;
+  const existing = content.match(CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN);
+  if (existing) {
+    const markerLine2 = existing[0];
+    const index = existing.index ?? content.indexOf(markerLine2);
+    const payload = markerPayload(content, markerLine2, index);
+    if (sha2564(payload) === existing[1].slice("sha256:".length)) {
+      return content;
+    }
+    const digest2 = sha2564(payload);
+    const freshMarkerLine = `<!-- ${CURSOR_GLOBAL_AUTHORITY_MANAGED_MARKER} hash=sha256:${digest2} -->`;
+    return content.slice(0, index) + freshMarkerLine + content.slice(index + markerLine2.length);
+  }
   const digest = sha2564(content);
   const markerLine = `<!-- ${CURSOR_GLOBAL_AUTHORITY_MANAGED_MARKER} hash=sha256:${digest} -->`;
   const frontmatter = content.match(CURSOR_GLOBAL_AUTHORITY_FRONTMATTER_PATTERN)?.[0];
@@ -20739,7 +20749,7 @@ projectContextCmd.command("apply").description("Atomically write project context
   }
 });
 var sessionCmd = program.command("session").description("Plan and apply session-scoped agent instruction files");
-sessionCmd.command("plan").description("Produce a dry-run render plan for profile-scoped instruction injection").requiredOption("--tool <tool>", `target tool (${SESSION_RENDER_TOOLS.join("|")})`).requiredOption("--profile <profile>", "account/profile name that owns the rendered instruction home").option("--target-home <path>", "override generated profile-scoped target home").option("--project-root <path>", "repository root for project-scoped adapters such as Cursor").option("--session-id <id>", "session id to include in the manifest").option("--source <layer:id=path>", `instruction source file; layers: ${SESSION_SOURCE_LAYER_HELP}`, collectOption, []).option("--config <layer:id-or-slug>", "stored config source by id/slug; repeatable; layer aliases match --source", collectOption, []).option("--identity-export <path>", "OpenIdentities configs instruction export JSON; repeatable", collectOption, []).option("--replace-source <replacer-id>[=<target-source-id>]", "source id that broadly replaces earlier layers, or targets one earlier source", collectOption, []).option("--compile-profile <id-or-slug>", "compile persisted config bindings from this Instructions profile").option("--provider-version <semver>", "installed provider version used for capability matching").option("--provider-variant <variant>", "explicit provider capability variant (for example OpenCode v2-agents)").option("--model <model>", "active model used for model activation").option("--path <path>", "active path recorded in the graph context").option("--manual <config-id-or-slug>", "manually activate a binding; repeatable", collectOption, []).option("--asset-surface <surface>", "explicit provider asset surface (for example cline cli or ide)").option("--asset-scope <scope>", "asset scope (global|project|session)").option("--allow-asset-installers", "opt in to planned provider installers; planning never invokes them").option("--codewith-native-imports", "select the gated Codewith native @ import adapter").option("--allow-empty-sources", "allow an explicit empty render plan").option("--check-global-coverage", "warn (non-fatal) when a registered, non-retired global-* source is absent from this render's --config list; expected is read fresh from the registry, independent of this plan (todos 102d6d0a)").option("--no-station-profile", "do not inject the cached station-profile source").option("--json", "output dry-run JSON").action(async (opts) => {
+sessionCmd.command("plan").description("Produce a dry-run render plan for profile-scoped instruction injection").requiredOption("--tool <tool>", `target tool (${SESSION_RENDER_TOOLS.join("|")})`).requiredOption("--profile <profile>", "account/profile name that owns the rendered instruction home").option("--target-home <path>", "override generated profile-scoped target home").option("--project-root <path>", "repository root for project-scoped adapters such as Cursor").option("--session-id <id>", "session id to include in the manifest").option("--source <layer:id=path>", `instruction source file; layers: ${SESSION_SOURCE_LAYER_HELP}`, collectOption, []).option("--config <layer:id-or-slug>", "stored config source by id/slug; repeatable; layer aliases match --source", collectOption, []).option("--identity-export <path>", "OpenIdentities configs instruction export JSON; repeatable", collectOption, []).option("--replace-source <replacer-id>[=<target-source-id>]", "source id that broadly replaces earlier layers, or targets one earlier source", collectOption, []).option("--compile-profile <id-or-slug>", "compile persisted config bindings from this Instructions profile").option("--provider-version <semver>", "installed provider version used for capability matching").option("--provider-variant <variant>", "explicit provider capability variant (for example OpenCode v2-agents)").option("--model <model>", "active model used for model activation").option("--path <path>", "active path recorded in the graph context").option("--manual <config-id-or-slug>", "manually activate a binding; repeatable", collectOption, []).option("--asset-surface <surface>", "explicit provider asset surface (for example cline cli or ide)").option("--asset-scope <scope>", "asset scope (global|project|session)").option("--allow-asset-installers", "opt in to planned provider installers; planning never invokes them").option("--codewith-native-imports", "select the gated Codewith native @ import adapter").option("--allow-empty-sources", "allow an explicit empty render plan").option("--check-global-coverage", "verify every registered, non-retired global-* source is in this render (expected read fresh from the registry, independent of this plan); on shortfall warn, exit non-zero, and for apply refuse to write (todos 102d6d0a, O15-00694)").option("--no-station-profile", "do not inject the cached station-profile source").option("--json", "output dry-run JSON").action(async (opts) => {
   try {
     const tool = opts.tool;
     if (!SESSION_RENDER_TOOLS.includes(tool)) {
@@ -20756,6 +20766,8 @@ sessionCmd.command("plan").description("Produce a dry-run render plan for profil
       });
       if (plan.blocked)
         process.exitCode = 1;
+      if (globalCoverage && !globalCoverage.complete)
+        process.exitCode = 1;
       return;
     }
     console.log(chalk.bold(`${plan.tool} session render plan`) + chalk.dim(` (${plan.adapter.mode})`));
@@ -20784,13 +20796,15 @@ sessionCmd.command("plan").description("Produce a dry-run render plan for profil
     }
     if (plan.blocked)
       process.exitCode = 1;
+    if (globalCoverage && !globalCoverage.complete)
+      process.exitCode = 1;
     console.log(chalk.dim("Dry run only. No files were written."));
   } catch (e) {
     console.error(chalk.red(formatCliError(e)));
     process.exit(1);
   }
 });
-sessionCmd.command("apply").description("Write a session render plan to its managed target home or explicit project root").requiredOption("--tool <tool>", `target tool (${SESSION_RENDER_TOOLS.join("|")})`).requiredOption("--profile <profile>", "account/profile name that owns the rendered instruction home").option("--target-home <path>", "override generated profile-scoped target home").option("--project-root <path>", "repository root for project-scoped adapters such as Cursor").option("--session-id <id>", "session id to include in the manifest").option("--source <layer:id=path>", `instruction source file; layers: ${SESSION_SOURCE_LAYER_HELP}`, collectOption, []).option("--config <layer:id-or-slug>", "stored config source by id/slug; repeatable; layer aliases match --source", collectOption, []).option("--identity-export <path>", "OpenIdentities configs instruction export JSON; repeatable", collectOption, []).option("--replace-source <replacer-id>[=<target-source-id>]", "source id that broadly replaces earlier layers, or targets one earlier source", collectOption, []).option("--compile-profile <id-or-slug>", "compile persisted config bindings from this Instructions profile").option("--provider-version <semver>", "installed provider version used for capability matching").option("--provider-variant <variant>", "explicit provider capability variant (for example OpenCode v2-agents)").option("--model <model>", "active model used for model activation").option("--path <path>", "active path recorded in the graph context").option("--manual <config-id-or-slug>", "manually activate a binding; repeatable", collectOption, []).option("--asset-surface <surface>", "explicit provider asset surface (for example cline cli or ide)").option("--asset-scope <scope>", "asset scope (global|project|session)").option("--codewith-native-imports", "select the gated Codewith native @ import adapter").option("--allow-empty-sources", "allow an explicit empty render").option("--check-global-coverage", "warn (non-fatal) when a registered, non-retired global-* source is absent from this render's --config list; expected is read fresh from the registry, independent of this plan (todos 102d6d0a)").option("--no-station-profile", "do not inject the cached station-profile source").option("--dry-run", "preview writes and conflicts without writing").option("--force", "overwrite existing unmanaged files").option("--json", "output apply JSON").action(async (opts) => {
+sessionCmd.command("apply").description("Write a session render plan to its managed target home or explicit project root").requiredOption("--tool <tool>", `target tool (${SESSION_RENDER_TOOLS.join("|")})`).requiredOption("--profile <profile>", "account/profile name that owns the rendered instruction home").option("--target-home <path>", "override generated profile-scoped target home").option("--project-root <path>", "repository root for project-scoped adapters such as Cursor").option("--session-id <id>", "session id to include in the manifest").option("--source <layer:id=path>", `instruction source file; layers: ${SESSION_SOURCE_LAYER_HELP}`, collectOption, []).option("--config <layer:id-or-slug>", "stored config source by id/slug; repeatable; layer aliases match --source", collectOption, []).option("--identity-export <path>", "OpenIdentities configs instruction export JSON; repeatable", collectOption, []).option("--replace-source <replacer-id>[=<target-source-id>]", "source id that broadly replaces earlier layers, or targets one earlier source", collectOption, []).option("--compile-profile <id-or-slug>", "compile persisted config bindings from this Instructions profile").option("--provider-version <semver>", "installed provider version used for capability matching").option("--provider-variant <variant>", "explicit provider capability variant (for example OpenCode v2-agents)").option("--model <model>", "active model used for model activation").option("--path <path>", "active path recorded in the graph context").option("--manual <config-id-or-slug>", "manually activate a binding; repeatable", collectOption, []).option("--asset-surface <surface>", "explicit provider asset surface (for example cline cli or ide)").option("--asset-scope <scope>", "asset scope (global|project|session)").option("--codewith-native-imports", "select the gated Codewith native @ import adapter").option("--allow-empty-sources", "allow an explicit empty render").option("--check-global-coverage", "verify every registered, non-retired global-* source is in this render (expected read fresh from the registry, independent of this plan); on shortfall warn, exit non-zero, and for apply refuse to write (todos 102d6d0a, O15-00694)").option("--no-station-profile", "do not inject the cached station-profile source").option("--dry-run", "preview writes and conflicts without writing").option("--force", "overwrite existing unmanaged files").option("--json", "output apply JSON").action(async (opts) => {
   try {
     const tool = opts.tool;
     if (!SESSION_RENDER_TOOLS.includes(tool)) {
@@ -20800,6 +20814,21 @@ sessionCmd.command("apply").description("Write a session render plan to its mana
     const store = resolveConfigStore();
     const plan = await buildSessionRenderPlan(opts, tool, store, "apply");
     const globalCoverage = opts.checkGlobalCoverage ? await checkGlobalSourceCoverage(plan, store) : null;
+    if (globalCoverage && !globalCoverage.complete) {
+      if (opts.json) {
+        printJson({
+          ...planJsonForOutput(plan),
+          globalSourceCoverage: globalCoverage
+        });
+      } else {
+        for (const warning of formatGlobalSourceCoverageWarnings(globalCoverage)) {
+          console.error(chalk.red(`refused: ${warning}`));
+        }
+        console.error(chalk.red(`Refusing to apply: ${globalCoverage.missingSlugs.length} registered global-* source(s) absent from this render. Wire them into --config or tag them retired-global-source.`));
+      }
+      process.exitCode = 1;
+      return;
+    }
     const ownedClaudeAuthorities = tool === "claude" ? await loadOwnedClaudeAuthorities(store) : undefined;
     const result = applySessionRender(plan, { dryRun: opts.dryRun, force: opts.force, ownedClaudeAuthorities });
     if (opts.json) {

package/dist/index.js

@@ -8773,8 +8773,18 @@ function isCursorGlobalAuthorityPath(path) {
   return resolve4(path) === resolve4(join5(homeDir(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
 }
 function stampCursorGlobalAuthorityMarker(content) {
-  if (CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN.test(content))
-    return content;
+  const existing = content.match(CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN);
+  if (existing) {
+    const markerLine2 = existing[0];
+    const index = existing.index ?? content.indexOf(markerLine2);
+    const payload = markerPayload(content, markerLine2, index);
+    if (sha2564(payload) === existing[1].slice("sha256:".length)) {
+      return content;
+    }
+    const digest2 = sha2564(payload);
+    const freshMarkerLine = `<!-- ${CURSOR_GLOBAL_AUTHORITY_MANAGED_MARKER} hash=sha256:${digest2} -->`;
+    return content.slice(0, index) + freshMarkerLine + content.slice(index + markerLine2.length);
+  }
   const digest = sha2564(content);
   const markerLine = `<!-- ${CURSOR_GLOBAL_AUTHORITY_MANAGED_MARKER} hash=sha256:${digest} -->`;
   const frontmatter = content.match(CURSOR_GLOBAL_AUTHORITY_FRONTMATTER_PATTERN)?.[0];

package/dist/lib/cursor-authority.d.ts

@@ -79,8 +79,17 @@ export declare function isCursorGlobalAuthorityPath(path: string): boolean;
  * opens with a `---` frontmatter block is stamped AFTER the closing `---`,
  * matching how the package's own session-render cursor files place their
  * managed marker; plain content without frontmatter is stamped at the top.
- * Content that already carries a valid marker anywhere is returned unchanged
- * (idempotent re-apply).
+ *
+ * Idempotency is hash-correctness-based, not presence-based: content whose
+ * existing marker's hash still matches its current payload is returned
+ * unchanged (re-apply no-op), while content carrying a STALE marker — the
+ * payload changed after stamping, e.g. a template re-render that expanded
+ * {{VAR}} placeholders — is re-stamped in place with the hash of the current
+ * payload. Presence-based idempotency propagated an invalid stamp forever:
+ * the observer recomputed the payload hash, reported
+ * marker-integrity-mismatch, and every re-apply reproduced the same invalid
+ * file, leaving the cursor project render blocked with no repair path
+ * (H-00154, station01 ~/.cursor/rules/hasna-global.mdc).
  */
 export declare function stampCursorGlobalAuthorityMarker(content: string): string;
 export declare function detectCursorAuthorityConflicts(observation?: CursorAuthorityObservation): CursorAuthorityConflict[];

package/dist/lib/cursor-authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cursor-authority.d.ts","sourceRoot":"","sources":["../../src/lib/cursor-authority.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,qCAAqC,mCAAmC,CAAC;AACtF,eAAO,MAAM,iCAAiC,QAAa,CAAC;AAC5D,eAAO,MAAM,sCAAsC,sDAAsD,CAAC;AAQ1G,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAChG,MAAM,MAAM,gCAAgC,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAC9F,MAAM,MAAM,wBAAwB,GAChC,SAAS,GACT,gBAAgB,GAChB,iBAAiB,GACjB,2BAA2B,GAC3B,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,OAAO,qCAAqC,CAAC;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,uBAAuB,CAAC;IAClC,MAAM,EAAE,gCAAgC,CAAC;IACzC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE;QACV,MAAM,EAAE,YAAY,CAAC;QACrB,SAAS,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;QAC9C,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,wBAAwB,CAAC;KACrC,CAAC;CACH;AAED,MAAM,MAAM,2BAA2B,GACnC,6BAA6B,GAC7B,6BAA6B,CAAC;AAElC,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,OAAO,qCAAqC,CAAC;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,2BAA2B,CAAC;IAClC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE;QACV,MAAM,EAAE,YAAY,CAAC;QACrB,SAAS,EAAE,WAAW,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,OAAO,CAAC,wBAAwB,EAAE,SAAS,GAAG,gBAAgB,CAAC,CAAC;KAC5E,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACrC;AAUD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/F;AAUD;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,iCAAsC,GAC9C,0BAA0B,CAI5B;AAED,wBAAgB,kCAAkC,CAChD,aAAa,EAAE,MAAM,GACpB,0BAA0B,CAK5B;AAoKD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASxE;AAED,wBAAgB,8BAA8B,CAC5C,WAAW,6BAAiC,GAC3C,uBAAuB,EAAE,CAsB3B"}
+{"version":3,"file":"cursor-authority.d.ts","sourceRoot":"","sources":["../../src/lib/cursor-authority.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,qCAAqC,mCAAmC,CAAC;AACtF,eAAO,MAAM,iCAAiC,QAAa,CAAC;AAC5D,eAAO,MAAM,sCAAsC,sDAAsD,CAAC;AAQ1G,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAChG,MAAM,MAAM,gCAAgC,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAC9F,MAAM,MAAM,wBAAwB,GAChC,SAAS,GACT,gBAAgB,GAChB,iBAAiB,GACjB,2BAA2B,GAC3B,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,OAAO,qCAAqC,CAAC;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,uBAAuB,CAAC;IAClC,MAAM,EAAE,gCAAgC,CAAC;IACzC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE;QACV,MAAM,EAAE,YAAY,CAAC;QACrB,SAAS,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;QAC9C,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,wBAAwB,CAAC;KACrC,CAAC;CACH;AAED,MAAM,MAAM,2BAA2B,GACnC,6BAA6B,GAC7B,6BAA6B,CAAC;AAElC,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,OAAO,qCAAqC,CAAC;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,2BAA2B,CAAC;IAClC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE;QACV,MAAM,EAAE,YAAY,CAAC;QACrB,SAAS,EAAE,WAAW,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,OAAO,CAAC,wBAAwB,EAAE,SAAS,GAAG,gBAAgB,CAAC,CAAC;KAC5E,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACrC;AAUD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAI/F;AAUD;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,iCAAsC,GAC9C,0BAA0B,CAI5B;AAED,wBAAgB,kCAAkC,CAChD,aAAa,EAAE,MAAM,GACpB,0BAA0B,CAK5B;AAoKD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAoBxE;AAED,wBAAgB,8BAA8B,CAC5C,WAAW,6BAAiC,GAC3C,uBAAuB,EAAE,CAsB3B"}

package/dist/mcp/index.js

@@ -5709,12 +5709,28 @@ function sha256(content) {
 function homeDir() {
   return process.env["HOME"] || homedir3();
 }
+function markerPayload(content, markerLine, markerIndex) {
+  const index = markerIndex ?? content.indexOf(markerLine);
+  if (index < 0)
+    return content;
+  return content.slice(0, index) + content.slice(index + markerLine.length).replace(/^\n/, "");
+}
 function isCursorGlobalAuthorityPath(path) {
   return resolve3(path) === resolve3(join6(homeDir(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
 }
 function stampCursorGlobalAuthorityMarker(content) {
-  if (CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN.test(content))
-    return content;
+  const existing = content.match(CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN);
+  if (existing) {
+    const markerLine2 = existing[0];
+    const index = existing.index ?? content.indexOf(markerLine2);
+    const payload = markerPayload(content, markerLine2, index);
+    if (sha256(payload) === existing[1].slice("sha256:".length)) {
+      return content;
+    }
+    const digest2 = sha256(payload);
+    const freshMarkerLine = `<!-- ${CURSOR_GLOBAL_AUTHORITY_MANAGED_MARKER} hash=sha256:${digest2} -->`;
+    return content.slice(0, index) + freshMarkerLine + content.slice(index + markerLine2.length);
+  }
   const digest = sha256(content);
   const markerLine = `<!-- ${CURSOR_GLOBAL_AUTHORITY_MANAGED_MARKER} hash=sha256:${digest} -->`;
   const frontmatter = content.match(CURSOR_GLOBAL_AUTHORITY_FRONTMATTER_PATTERN)?.[0];
@@ -8062,7 +8078,7 @@ var init_sync_dir = __esm(() => {
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@hasna/instructions",
-    version: "0.5.1",
+    version: "0.5.3",
     description: "AI coding agent instruction & configuration manager \u2014 store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.",
     type: "module",
     main: "dist/index.js",

package/dist/server/index.js

@@ -16,7 +16,7 @@ var __export = (target, all) => {
 };
 var __require = import.meta.require;
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/compose.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
   return (context, next) => {
     let index = -1;
@@ -60,10 +60,10 @@ var compose = (middleware, onError, onNotFound) => {
   };
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/request/constants.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/utils/buffer.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/utils/buffer.js
 var bufferToFormData = (arrayBuffer, contentType) => {
   const response = new Response(arrayBuffer, {
     headers: {
@@ -73,7 +73,7 @@ var bufferToFormData = (arrayBuffer, contentType) => {
   return response.formData();
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/utils/body.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/utils/body.js
 var isRawRequest = (request) => ("headers" in request);
 var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
@@ -155,7 +155,7 @@ var handleParsingNestedValues = (form, key, value) => {
   });
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/utils/url.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/utils/url.js
 var splitPath = (path) => {
   const paths = path.split("/");
   if (paths[0] === "") {
@@ -353,7 +353,7 @@ var getQueryParams = (url, key) => {
 };
 var decodeURIComponent_ = decodeURIComponent;
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/request.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/request.js
 var HonoRequest = class {
   raw;
   #validatedData;
@@ -464,7 +464,7 @@ var HonoRequest = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/utils/html.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/utils/html.js
 var HtmlEscapedCallbackPhase = {
   Stringify: 1,
   BeforeStream: 2,
@@ -502,7 +502,7 @@ var resolveCallback = async (str, phase, preserveCallbacks, context, buffer) =>
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/context.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/context.js
 var TEXT_PLAIN = "text/plain; charset=UTF-8";
 var setDefaultContentType = (contentType, headers) => {
   return {
@@ -684,7 +684,7 @@ var Context = class {
   };
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/router.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router.js
 var METHOD_NAME_ALL = "ALL";
 var METHOD_NAME_ALL_LOWERCASE = "all";
 var METHODS = ["get", "post", "put", "delete", "options", "patch", "query"];
@@ -692,10 +692,10 @@ var MESSAGE_MATCHER_IS_ALREADY_BUILT = "Can not add a route since the matcher is
 var UnsupportedPathError = class extends Error {
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/utils/constants.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/utils/constants.js
 var COMPOSED_HANDLER = "__COMPOSED_HANDLER";
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/hono-base.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/hono-base.js
 var notFoundHandler = (c) => {
   return c.text("404 Not Found", 404);
 };
@@ -920,7 +920,7 @@ var Hono = class _Hono {
   };
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/router/reg-exp-router/matcher.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/reg-exp-router/matcher.js
 var emptyParam = [];
 function match(method, path) {
   const matchers = this.buildAllMatchers();
@@ -941,7 +941,7 @@ function match(method, path) {
   return match2(method, path);
 }
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/router/reg-exp-router/node.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/reg-exp-router/node.js
 var LABEL_REG_EXP_STR = "[^/]+";
 var ONLY_WILDCARD_REG_EXP_STR = ".*";
 var TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
@@ -1044,7 +1044,7 @@ var Node = class _Node {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/router/reg-exp-router/trie.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/reg-exp-router/trie.js
 var Trie = class {
   #context = { varIndex: 0 };
   #root = new Node;
@@ -1107,7 +1107,7 @@ var Trie = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/router/reg-exp-router/router.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/reg-exp-router/router.js
 var wildcardRegExpCache = /* @__PURE__ */ Object.create(null);
 function buildWildcardRegExp(path) {
   return wildcardRegExpCache[path] ??= new RegExp(path === "*" ? "" : `^${path.replace(/\/\*$|([.\\+*[^\]$()])/g, (_, metaChar) => metaChar ? `\\${metaChar}` : "(?:|/.*)")}$`);
@@ -1258,7 +1258,7 @@ var RegExpRouter = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/router/reg-exp-router/prepared-router.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/reg-exp-router/prepared-router.js
 var PreparedRegExpRouter = class {
   name = "PreparedRegExpRouter";
   #matchers;
@@ -1330,7 +1330,7 @@ var PreparedRegExpRouter = class {
   match = match;
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/router/smart-router/router.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/smart-router/router.js
 var SmartRouter = class {
   name = "SmartRouter";
   #routers = [];
@@ -1385,78 +1385,53 @@ var SmartRouter = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/router/trie-router/node.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/trie-router/node.js
 var emptyParams = /* @__PURE__ */ Object.create(null);
-var hasChildren = (children) => {
-  for (const _ in children) {
-    return true;
-  }
-  return false;
-};
+var order = 0;
 var Node2 = class _Node2 {
-  #methods;
-  #children;
-  #patterns;
-  #order = 0;
+  #methods = [];
+  #children = /* @__PURE__ */ Object.create(null);
+  #patterns = [];
+  #pattern;
   #params = emptyParams;
-  constructor(method, handler, children) {
-    this.#children = children || /* @__PURE__ */ Object.create(null);
-    this.#methods = [];
-    if (method && handler) {
-      const m = /* @__PURE__ */ Object.create(null);
-      m[method] = { handler, possibleKeys: [], score: 0 };
-      this.#methods = [m];
-    }
-    this.#patterns = [];
-  }
   insert(method, path, handler) {
-    this.#order = ++this.#order;
     let curNode = this;
     const parts = splitRoutingPath(path);
-    const possibleKeys = [];
-    for (let i = 0, len = parts.length;i < len; i++) {
-      const p = parts[i];
-      const nextP = parts[i + 1];
-      const pattern = getPattern(p, nextP);
-      const key = Array.isArray(pattern) ? pattern[0] : p;
-      if (key in curNode.#children) {
-        curNode = curNode.#children[key];
-        if (pattern) {
-          possibleKeys.push(pattern[1]);
-        }
-        continue;
+    const possibleKeys = /* @__PURE__ */ new Set;
+    let i = 0;
+    for (const p of parts) {
+      const nextP = parts[++i];
+      const pattern = getPattern(p, nextP) || (nextP === undefined && p && p.indexOf("*") === p.length - 1 ? p : null);
+      const isParam = Array.isArray(pattern);
+      const key = isParam ? pattern[0] : pattern || p;
+      const child = curNode.#children[key] ||= new _Node2;
+      if (pattern && !child.#pattern) {
+        child.#pattern = pattern;
+        curNode.#patterns.push(child);
       }
-      curNode.#children[key] = new _Node2;
-      if (pattern) {
-        curNode.#patterns.push(pattern);
-        possibleKeys.push(pattern[1]);
+      curNode = child;
+      if (isParam) {
+        possibleKeys.add(pattern[1]);
       }
-      curNode = curNode.#children[key];
     }
     curNode.#methods.push({
       [method]: {
         handler,
-        possibleKeys: possibleKeys.filter((v, i, a) => a.indexOf(v) === i),
-        score: this.#order
+        possibleKeys: [...possibleKeys],
+        score: ++order
       }
     });
-    return curNode;
   }
   #pushHandlerSets(handlerSets, node, method, nodeParams, params) {
     for (let i = 0, len = node.#methods.length;i < len; i++) {
       const m = node.#methods[i];
       const handlerSet = m[method] || m[METHOD_NAME_ALL];
-      const processedSet = {};
-      if (handlerSet !== undefined) {
+      if (handlerSet) {
         handlerSet.params = /* @__PURE__ */ Object.create(null);
         handlerSets.push(handlerSet);
-        if (nodeParams !== emptyParams || params && params !== emptyParams) {
-          for (let i2 = 0, len2 = handlerSet.possibleKeys.length;i2 < len2; i2++) {
-            const key = handlerSet.possibleKeys[i2];
-            const processed = processedSet[handlerSet.score];
-            handlerSet.params[key] = params?.[key] && !processed ? params[key] : nodeParams[key] ?? params?.[key];
-            processedSet[handlerSet.score] = true;
-          }
+        for (let i2 = 0, len2 = handlerSet.possibleKeys.length;i2 < len2; i2++) {
+          const key = handlerSet.possibleKeys[i2];
+          handlerSet.params[key] = params?.[key] && !i2 ? params[key] : nodeParams[key] ?? params?.[key];
         }
       }
     }
@@ -1488,33 +1463,33 @@ var Node2 = class _Node2 {
             tempNodes.push(nextNode);
           }
         }
-        for (let k = 0, len3 = node.#patterns.length;k < len3; k++) {
-          const pattern = node.#patterns[k];
+        for (const child of node.#patterns) {
+          const pattern = child.#pattern;
           const params = node.#params === emptyParams ? {} : { ...node.#params };
-          if (pattern === "*") {
-            const astNode = node.#children["*"];
-            if (astNode) {
-              this.#pushHandlerSets(handlerSets, astNode, method, node.#params);
-              astNode.#params = params;
-              tempNodes.push(astNode);
+          if (typeof pattern === "string") {
+            if (pattern === "*" || part.startsWith(pattern.slice(0, -1))) {
+              this.#pushHandlerSets(handlerSets, child, method, node.#params);
+              if (pattern === "*") {
+                child.#params = params;
+                tempNodes.push(child);
+              }
             }
             continue;
           }
-          const [key, name, matcher] = pattern;
-          if (!part && !(matcher instanceof RegExp)) {
+          const [, name, matcher] = pattern;
+          if (!part && matcher === true) {
             continue;
           }
-          const child = node.#children[key];
-          if (matcher instanceof RegExp) {
-            if (partOffsets === null) {
-              partOffsets = new Array(len);
+          if (matcher !== true) {
+            if (!partOffsets) {
+              partOffsets = [];
               let offset = path[0] === "/" ? 1 : 0;
               for (let p = 0;p < len; p++) {
                 partOffsets[p] = offset;
                 offset += parts[p].length + 1;
               }
             }
-            const restPathString = path.substring(partOffsets[i]);
+            const restPathString = path.slice(partOffsets[i]);
             const m = matcher.exec(restPathString);
             if (m) {
               params[name] = m[0];
@@ -1522,11 +1497,12 @@ var Node2 = class _Node2 {
               if (m[0].length === restPathString.length && child.#children["*"]) {
                 this.#pushHandlerSets(handlerSets, child.#children["*"], method, node.#params, params);
               }
-              if (hasChildren(child.#children)) {
+              for (const _ in child.#children) {
                 child.#params = params;
                 const componentCount = m[0].match(/\//g)?.length ?? 0;
                 const targetCurNodes = curNodesQueue[componentCount] ||= [];
                 targetCurNodes.push(child);
+                break;
               }
               continue;
             }
@@ -1548,7 +1524,7 @@ var Node2 = class _Node2 {
       const shifted = curNodesQueue.shift();
       curNodes = shifted ? tempNodes.concat(shifted) : tempNodes;
     }
-    if (handlerSets.length > 1) {
+    if (handlerSets[1]) {
       handlerSets.sort((a, b) => {
         return a.score - b.score;
       });
@@ -1557,29 +1533,21 @@ var Node2 = class _Node2 {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/router/trie-router/router.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/trie-router/router.js
 var TrieRouter = class {
   name = "TrieRouter";
-  #node;
-  constructor() {
-    this.#node = new Node2;
-  }
+  #node = new Node2;
   add(method, path, handler) {
-    const results = checkOptionalParameter(path);
-    if (results) {
-      for (let i = 0, len = results.length;i < len; i++) {
-        this.#node.insert(method, results[i], handler);
-      }
-      return;
+    for (const result of checkOptionalParameter(path) || [path]) {
+      this.#node.insert(method, result, handler);
     }
-    this.#node.insert(method, path, handler);
   }
   match(method, path) {
     return this.#node.search(method, path);
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/hono.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/hono.js
 var Hono2 = class extends Hono {
   constructor(options = {}) {
     super(options);
@@ -1589,7 +1557,7 @@ var Hono2 = class extends Hono {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.2/node_modules/hono/dist/middleware/cors/index.js
+// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/middleware/cors/index.js
 var cors = (options) => {
   const opts = {
     origin: "*",
@@ -1639,7 +1607,7 @@ var cors = (options) => {
     }
     if (c.req.method === "OPTIONS") {
       if (opts.origin !== "*") {
-        set("Vary", "Origin");
+        c.res.headers.append("Vary", "Origin");
       }
       if (opts.maxAge != null) {
         set("Access-Control-Max-Age", opts.maxAge.toString());
@@ -1747,7 +1715,7 @@ class ProfileNotFoundError extends Error {
   }
 }
 
-// ../contracts/dist/auth/index.js
+// ../../node_modules/.bun/@hasna+contracts@0.14.0+e8014c875821e0be/node_modules/@hasna/contracts/dist/auth/index.js
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
 var MAX_TENANT_ID_LENGTH = 64;
 var TENANT_ID_PATTERN = new RegExp(`^[A-Za-z0-9][A-Za-z0-9._-]{0,${MAX_TENANT_ID_LENGTH - 1}}$`);
@@ -8132,9 +8100,9 @@ async function deleteProfile2(client, idOrSlug) {
 async function addConfigToProfile2(client, profileIdOrSlug, configId) {
   const profile = await getProfile2(client, profileIdOrSlug);
   const maxRow = await client.get("SELECT MAX(sort_order) AS max_order FROM profile_configs WHERE profile_id = $1", [profile.id]);
-  const order = (maxRow?.max_order ?? -1) + 1;
+  const order2 = (maxRow?.max_order ?? -1) + 1;
   await client.execute(`INSERT INTO profile_configs (profile_id, config_id, sort_order)
-     VALUES ($1,$2,$3) ON CONFLICT (profile_id, config_id) DO NOTHING`, [profile.id, configId, order]);
+     VALUES ($1,$2,$3) ON CONFLICT (profile_id, config_id) DO NOTHING`, [profile.id, configId, order2]);
 }
 async function getProfileConfigBindings2(client, profileIdOrSlug) {
   const profile = await getProfile2(client, profileIdOrSlug);
@@ -8166,8 +8134,8 @@ async function addAssetToProfile2(client, profileIdOrSlug, sourceConfigId, bindi
   await getConfig2(client, sourceConfigId);
   const normalized = normalizeProfileAssetBinding(binding);
   const maxRow = await client.get("SELECT MAX(sort_order) AS max_order FROM profile_assets WHERE profile_id = $1", [profile.id]);
-  const order = (maxRow?.max_order ?? -1) + 1;
-  await client.execute("INSERT INTO profile_assets (profile_id, source_config_id, asset_key, sort_order, binding) VALUES ($1,$2,$3,$4,$5::jsonb)", [profile.id, sourceConfigId, normalized.assetKey, order, JSON.stringify(normalized)]);
+  const order2 = (maxRow?.max_order ?? -1) + 1;
+  await client.execute("INSERT INTO profile_assets (profile_id, source_config_id, asset_key, sort_order, binding) VALUES ($1,$2,$3,$4,$5::jsonb)", [profile.id, sourceConfigId, normalized.assetKey, order2, JSON.stringify(normalized)]);
   return (await getProfileAssetBindings2(client, profile.id)).find((row) => row.binding.assetKey === normalized.assetKey);
 }
 async function setProfileAssetBinding2(client, profileIdOrSlug, assetKey, binding) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/instructions",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "AI coding agent instruction & configuration manager — store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.",
   "type": "module",
   "main": "dist/index.js",