@hasna/instructions 0.6.1 → 0.7.0

package/dist/server/index.js

@@ -70,9 +70,9 @@ function parseCursor(value) {
   const parsed = typeof value === "number" ? value : Number.parseInt(String(value ?? ""), 10);
   if (!Number.isFinite(parsed) || parsed < 0)
     return 0;
-  return Math.floor(parsed);
+  return Math.min(Math.floor(parsed), MAX_LIST_CURSOR);
 }
-var DEFAULT_LIST_LIMIT = 20, MAX_LIST_LIMIT = 100;
+var DEFAULT_LIST_LIMIT = 20, MAX_LIST_LIMIT = 100, MAX_LIST_CURSOR = 1e5;
 
 // src/lib/bounded-read.ts
 function normalizeBoundedReadOptions(options = {}) {
@@ -105,7 +105,7 @@ function boundedReadPage(items, total, options = {}) {
 }
 var init_bounded_read = () => {};
 
-// ../contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.0.2+e8014c875821e0be/node_modules/@hasna/contracts/dist/client/transport.js
 import { createRequire } from "module";
 var MAX_CREDENTIAL_FILE_BYTES, INSPECT_CUSTOM, CREDENTIAL_SEAL, AMBIENT_ENVIRONMENT, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
 var init_transport = __esm(() => {
@@ -125,7 +125,7 @@ var init_transport = __esm(() => {
   ]);
 });
 
-// ../contracts/dist/client/storage.js
+// ../../node_modules/.bun/@hasna+contracts@1.0.2+e8014c875821e0be/node_modules/@hasna/contracts/dist/client/storage.js
 import { createRequire as createRequire2 } from "module";
 var MAX_CREDENTIAL_FILE_BYTES2, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, AMBIENT_ENVIRONMENT2, SECRETS_PACKAGE_SPECIFIER2, requireSecretsSdk2, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2;
 var init_storage = __esm(() => {
@@ -5156,7 +5156,7 @@ var init_machine = __esm(() => {
   init_template();
 });
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/compose.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
   return (context, next) => {
     let index = -1;
@@ -5200,10 +5200,10 @@ var compose = (middleware, onError, onNotFound) => {
   };
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/request/constants.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/utils/buffer.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/utils/buffer.js
 var bufferToFormData = (arrayBuffer, contentType) => {
   const response = new Response(arrayBuffer, {
     headers: {
@@ -5213,7 +5213,9 @@ var bufferToFormData = (arrayBuffer, contentType) => {
   return response.formData();
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/utils/body.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/utils/body.js
+var MAX_NESTING_DEPTH = 32;
+var MAX_NESTED_OBJECTS = 1e4;
 var isRawRequest = (request) => ("headers" in request);
 var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
@@ -5243,6 +5245,7 @@ async function parseFormData(request, options) {
 }
 function convertFormDataToBodyData(formData, options) {
   const form = /* @__PURE__ */ Object.create(null);
+  const nestingState = { count: 0 };
   formData.forEach((value, key) => {
     const shouldParseAllValues = options.all || key.endsWith("[]");
     if (!shouldParseAllValues) {
@@ -5255,7 +5258,7 @@ function convertFormDataToBodyData(formData, options) {
     Object.entries(form).forEach(([key, value]) => {
       const shouldParseDotValues = key.includes(".");
       if (shouldParseDotValues) {
-        handleParsingNestedValues(form, key, value);
+        handleParsingNestedValues(form, key, value, nestingState);
         delete form[key];
       }
     });
@@ -5277,25 +5280,34 @@ var handleParsingAllValues = (form, key, value) => {
     }
   }
 };
-var handleParsingNestedValues = (form, key, value) => {
+var handleParsingNestedValues = (form, key, value, state) => {
   if (/(?:^|\.)__proto__\./.test(key)) {
     return;
   }
   let nestedForm = form;
-  const keys = key.split(".");
+  const keys = key.split(".", MAX_NESTING_DEPTH + 2);
+  if (keys.length > MAX_NESTING_DEPTH + 1) {
+    throwNestingLimitExceeded();
+  }
   keys.forEach((key2, index) => {
     if (index === keys.length - 1) {
       nestedForm[key2] = value;
     } else {
       if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        if (state.count++ >= MAX_NESTED_OBJECTS) {
+          throwNestingLimitExceeded();
+        }
         nestedForm[key2] = /* @__PURE__ */ Object.create(null);
       }
       nestedForm = nestedForm[key2];
     }
   });
 };
+var throwNestingLimitExceeded = () => {
+  throw new Error("Nesting limit exceeded");
+};
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/utils/url.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/utils/url.js
 var splitPath = (path) => {
   const paths = path.split("/");
   if (paths[0] === "") {
@@ -5425,6 +5437,10 @@ var _decodeURI = (value) => {
   return tryDecodeURIComponent(value);
 };
 var _getQueryParam = (url, key, multiple) => {
+  const hashIndex = url.indexOf("#", 8);
+  if (hashIndex !== -1) {
+    url = url.slice(0, hashIndex);
+  }
   let encoded;
   if (!multiple && key && key.indexOf("%") === -1 && key.indexOf("+") === -1) {
     let keyIndex2 = url.indexOf("?", 8);
@@ -5493,7 +5509,7 @@ var getQueryParams = (url, key) => {
 };
 var decodeURIComponent_ = decodeURIComponent;
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/request.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/request.js
 var HonoRequest = class {
   raw;
   #validatedData;
@@ -5510,13 +5526,13 @@ var HonoRequest = class {
     return key ? this.#getDecodedParam(key) : this.#getAllDecodedParams();
   }
   #getDecodedParam(key) {
-    const paramKey = this.#matchResult[0][this.routeIndex][1][key];
+    const paramKey = this.#matchResult[0][this.routeIndex]?.[1][key];
     const param = this.#getParamValue(paramKey);
     return param && tryDecodeURIComponent(param);
   }
   #getAllDecodedParams() {
     const decoded = {};
-    const keys = Object.keys(this.#matchResult[0][this.routeIndex][1]);
+    const keys = Object.keys(this.#matchResult[0][this.routeIndex]?.[1] ?? {});
     for (const key of keys) {
       const value = this.#getParamValue(this.#matchResult[0][this.routeIndex][1][key]);
       if (value !== undefined) {
@@ -5604,7 +5620,7 @@ var HonoRequest = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/utils/html.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/utils/html.js
 var HtmlEscapedCallbackPhase = {
   Stringify: 1,
   BeforeStream: 2,
@@ -5642,7 +5658,7 @@ var resolveCallback = async (str, phase, preserveCallbacks, context, buffer) =>
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/context.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/context.js
 var TEXT_PLAIN = "text/plain; charset=UTF-8";
 var setDefaultContentType = (contentType, headers) => {
   return {
@@ -5824,7 +5840,7 @@ var Context = class {
   };
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/router.js
 var METHOD_NAME_ALL = "ALL";
 var METHOD_NAME_ALL_LOWERCASE = "all";
 var METHODS = ["get", "post", "put", "delete", "options", "patch", "query"];
@@ -5832,10 +5848,10 @@ var MESSAGE_MATCHER_IS_ALREADY_BUILT = "Can not add a route since the matcher is
 var UnsupportedPathError = class extends Error {
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/utils/constants.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/utils/constants.js
 var COMPOSED_HANDLER = "__COMPOSED_HANDLER";
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/hono-base.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/hono-base.js
 var notFoundHandler = (c) => {
   return c.text("404 Not Found", 404);
 };
@@ -5867,13 +5883,14 @@ var Hono = class _Hono {
     const allMethods = [...METHODS, METHOD_NAME_ALL_LOWERCASE];
     allMethods.forEach((method) => {
       this[method] = (args1, ...args) => {
+        const methodName = method.toUpperCase();
         if (typeof args1 === "string") {
           this.#path = args1;
         } else {
-          this.#addRoute(method, this.#path, args1);
+          this.#addRoute(methodName, this.#path, args1);
         }
         args.forEach((handler) => {
-          this.#addRoute(method, this.#path, handler);
+          this.#addRoute(methodName, this.#path, handler);
         });
         return this;
       };
@@ -5882,9 +5899,10 @@ var Hono = class _Hono {
       for (const p of [path].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
-          handlers.map((handler) => {
-            this.#addRoute(m.toUpperCase(), this.#path, handler);
-          });
+          const methodName = m.toUpperCase();
+          for (const handler of handlers) {
+            this.#addRoute(methodName, this.#path, handler);
+          }
         }
       }
       return this;
@@ -5989,7 +6007,6 @@ var Hono = class _Hono {
     return this;
   }
   #addRoute(method, path, handler, baseRoutePath) {
-    method = method.toUpperCase();
     path = mergePath(this._basePath, path);
     const r = {
       basePath: baseRoutePath !== undefined ? mergePath(this._basePath, baseRoutePath) : this._basePath,
@@ -6060,7 +6077,10 @@ var Hono = class _Hono {
   };
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/reg-exp-router/matcher.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/router/utils.js
+var createNullObject = () => /* @__PURE__ */ Object.create(null);
+
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/matcher.js
 var emptyParam = [];
 function match(method, path) {
   const matchers = this.buildAllMatchers();
@@ -6081,7 +6101,7 @@ function match(method, path) {
   return match2(method, path);
 }
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/reg-exp-router/node.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/node.js
 var LABEL_REG_EXP_STR = "[^/]+";
 var ONLY_WILDCARD_REG_EXP_STR = ".*";
 var TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
@@ -6109,7 +6129,7 @@ function compareKey(a, b) {
 var Node = class _Node {
   #index;
   #varIndex;
-  #children = /* @__PURE__ */ Object.create(null);
+  #children = createNullObject();
   insert(tokens, index, paramMap, context, isStatic) {
     let node = this;
     for (let i = 0, len = tokens.length;i < len; i++) {
@@ -6184,12 +6204,12 @@ var Node = class _Node {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/reg-exp-router/trie.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/trie.js
 var Trie = class {
   #context = { varIndex: 0 };
   #root = new Node;
   #index = 0;
-  paths = /* @__PURE__ */ Object.create(null);
+  paths = createNullObject();
   insert(path, isStatic) {
     if (isStatic) {
       this.#root.insert(path.split(""), 0, [], this.#context, true);
@@ -6247,18 +6267,12 @@ var Trie = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/reg-exp-router/router.js
-var wildcardRegExpCache = /* @__PURE__ */ Object.create(null);
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/router.js
+var wildcardRegExpCache = createNullObject();
 function buildWildcardRegExp(path) {
-  return wildcardRegExpCache[path] ??= new RegExp(path === "*" ? "" : `^${path.replace(/\/\*$|([.\\+*[^\]$()])/g, (_, metaChar) => metaChar ? `\\${metaChar}` : "(?:|/.*)")}$`);
-}
-function clearWildcardRegExpCache() {
-  wildcardRegExpCache = /* @__PURE__ */ Object.create(null);
+  return wildcardRegExpCache[path] ??= new RegExp(`^${path.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g, (match2, metaChar) => metaChar ? `\\${metaChar}` : match2 === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match2 === "*" ? ONLY_WILDCARD_REG_EXP_STR : `/:${LABEL_REG_EXP_STR}`)}$`);
 }
 function findMiddleware(middleware, path) {
-  if (!middleware) {
-    return;
-  }
   for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) {
     if (buildWildcardRegExp(k).test(path)) {
       return [...middleware[k]];
@@ -6272,8 +6286,8 @@ var RegExpRouter = class {
   #routes;
   #tries;
   constructor() {
-    this.#middleware = { [METHOD_NAME_ALL]: /* @__PURE__ */ Object.create(null) };
-    this.#routes = { [METHOD_NAME_ALL]: /* @__PURE__ */ Object.create(null) };
+    this.#middleware = { [METHOD_NAME_ALL]: createNullObject() };
+    this.#routes = { [METHOD_NAME_ALL]: createNullObject() };
     this.#tries = { [METHOD_NAME_ALL]: new Trie };
   }
   #insertPath(method, path) {
@@ -6286,119 +6300,90 @@ var RegExpRouter = class {
   add(method, path, handler) {
     const middleware = this.#middleware;
     const routes = this.#routes;
-    if (!middleware || !routes) {
+    if (!middleware) {
       throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
     }
     if (!middleware[method]) {
       this.#tries[method] = new Trie;
-      [middleware, routes].forEach((handlerMap) => {
-        handlerMap[method] = /* @__PURE__ */ Object.create(null);
-        Object.keys(handlerMap[METHOD_NAME_ALL]).forEach((p) => {
+      for (const handlerMap of [middleware, routes]) {
+        handlerMap[method] = createNullObject();
+        for (const p in handlerMap[METHOD_NAME_ALL]) {
           handlerMap[method][p] = [...handlerMap[METHOD_NAME_ALL][p]];
           this.#insertPath(method, p);
-        });
-      });
+        }
+      }
     }
     if (path === "/*") {
       path = "*";
     }
-    const paramCount = (path.match(/\/:/g) || []).length;
+    const methods = method === METHOD_NAME_ALL ? Object.keys(middleware) : [method];
     if (/\*$/.test(path)) {
       const re = buildWildcardRegExp(path);
-      Object.keys(middleware).forEach((m) => {
-        if ((method === METHOD_NAME_ALL || method === m) && !middleware[m][path]) {
+      for (const m of methods) {
+        if (!middleware[m][path]) {
           this.#insertPath(m, path);
           middleware[m][path] = findMiddleware(middleware[m], path) || findMiddleware(middleware[METHOD_NAME_ALL], path) || [];
         }
-      });
-      Object.keys(middleware).forEach((m) => {
-        if (method === METHOD_NAME_ALL || method === m) {
-          Object.keys(middleware[m]).forEach((p) => {
-            re.test(p) && middleware[m][p].push([handler, paramCount]);
-          });
-        }
-      });
-      Object.keys(routes).forEach((m) => {
-        if (method === METHOD_NAME_ALL || method === m) {
-          Object.keys(routes[m]).forEach((p) => re.test(p) && routes[m][p].push([handler, paramCount]));
+      }
+      for (const handlerMap of [middleware, routes]) {
+        for (const m of methods) {
+          for (const p in handlerMap[m]) {
+            re.test(p) && handlerMap[m][p].push([handler, path]);
+          }
         }
-      });
+      }
       return;
     }
     const paths = checkOptionalParameter(path) || [path];
-    for (let i = 0, len = paths.length;i < len; i++) {
-      const path2 = paths[i];
-      Object.keys(routes).forEach((m) => {
-        if (method === METHOD_NAME_ALL || method === m) {
-          if (!routes[m][path2]) {
-            this.#insertPath(m, path2);
-            routes[m][path2] = [
-              ...findMiddleware(middleware[m], path2) || findMiddleware(middleware[METHOD_NAME_ALL], path2) || []
-            ];
-          }
-          routes[m][path2].push([handler, paramCount - len + i + 1]);
+    for (const path2 of paths) {
+      for (const m of methods) {
+        if (!routes[m][path2]) {
+          this.#insertPath(m, path2);
+          routes[m][path2] = findMiddleware(middleware[m], path2) || findMiddleware(middleware[METHOD_NAME_ALL], path2) || [];
         }
-      });
+        routes[m][path2].push([handler, path2]);
+      }
     }
   }
   match = match;
   buildAllMatchers() {
-    const matchers = /* @__PURE__ */ Object.create(null);
-    Object.keys(this.#routes).concat(Object.keys(this.#middleware)).forEach((method) => {
-      matchers[method] ||= this.#buildMatcher(method);
-    });
+    const matchers = createNullObject();
+    for (const method of Object.keys(this.#routes)) {
+      matchers[method] = this.#buildMatcher(method);
+    }
     this.#middleware = this.#routes = this.#tries = undefined;
-    clearWildcardRegExpCache();
+    wildcardRegExpCache = createNullObject();
     return matchers;
   }
   #buildMatcher(method) {
     const middleware = this.#middleware[method];
     const routes = this.#routes[method];
     const trie = this.#tries[method];
-    const staticMap = /* @__PURE__ */ Object.create(null);
+    const staticMap = createNullObject();
     const handlerData = [];
-    [middleware, routes].forEach((r) => {
+    const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
+    for (const r of [middleware, routes]) {
       for (const path in r) {
         const handlers = r[path];
         const pathData = trie.paths[path];
         if (!pathData) {
-          staticMap[path] = [handlers.map(([h]) => [h, /* @__PURE__ */ Object.create(null)]), emptyParam];
-          continue;
-        }
-        const paramAssoc = pathData[1];
-        handlerData[pathData[0]] = handlers.map(([h, paramCount]) => {
-          const paramIndexMap = /* @__PURE__ */ Object.create(null);
-          paramCount -= 1;
-          for (;paramCount >= 0; paramCount--) {
-            const [key, value] = paramAssoc[paramCount];
-            paramIndexMap[key] = value;
-          }
-          return [h, paramIndexMap];
-        });
-      }
-    });
-    const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
-    for (let i = 0, len = handlerData.length;i < len; i++) {
-      for (let j = 0, len2 = handlerData[i].length;j < len2; j++) {
-        const map = handlerData[i][j]?.[1];
-        if (!map) {
+          staticMap[path] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
           continue;
         }
-        const keys = Object.keys(map);
-        for (let k = 0, len3 = keys.length;k < len3; k++) {
-          map[keys[k]] = paramReplacementMap[map[keys[k]]];
-        }
+        handlerData[pathData[0]] = handlers.map(([h, handlerPath]) => [
+          h,
+          trie.paths[handlerPath][1].reduceRight((map, [key], i) => {
+            map[key] = paramReplacementMap[pathData[1][i][1]];
+            return map;
+          }, createNullObject())
+        ]);
       }
     }
-    const handlerMap = [];
-    for (const i in indexReplacementMap) {
-      handlerMap[i] = handlerData[indexReplacementMap[i]];
-    }
-    return [regexp, handlerMap, staticMap];
+    return [regexp, indexReplacementMap.map((i) => handlerData[i]), staticMap];
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/reg-exp-router/prepared-router.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/prepared-router.js
 var PreparedRegExpRouter = class {
   name = "PreparedRegExpRouter";
   #matchers;
@@ -6470,7 +6455,7 @@ var PreparedRegExpRouter = class {
   match = match;
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/smart-router/router.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/router/smart-router/router.js
 var SmartRouter = class {
   name = "SmartRouter";
   #routers = [];
@@ -6525,12 +6510,12 @@ var SmartRouter = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/trie-router/node.js
-var emptyParams = /* @__PURE__ */ Object.create(null);
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/router/trie-router/node.js
+var emptyParams = createNullObject();
 var order = 0;
 var Node2 = class _Node2 {
   #methods = [];
-  #children = /* @__PURE__ */ Object.create(null);
+  #children = createNullObject();
   #patterns = [];
   #pattern;
   #params = emptyParams;
@@ -6567,7 +6552,7 @@ var Node2 = class _Node2 {
       const m = node.#methods[i];
       const handlerSet = m[method] || m[METHOD_NAME_ALL];
       if (handlerSet) {
-        handlerSet.params = /* @__PURE__ */ Object.create(null);
+        handlerSet.params = createNullObject();
         handlerSets.push(handlerSet);
         for (let i2 = 0, len2 = handlerSet.possibleKeys.length;i2 < len2; i2++) {
           const key = handlerSet.possibleKeys[i2];
@@ -6673,7 +6658,7 @@ var Node2 = class _Node2 {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/router/trie-router/router.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/router/trie-router/router.js
 var TrieRouter = class {
   name = "TrieRouter";
   #node = new Node2;
@@ -6687,7 +6672,7 @@ var TrieRouter = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/hono.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/hono.js
 var Hono2 = class extends Hono {
   constructor(options = {}) {
     super(options);
@@ -6697,7 +6682,7 @@ var Hono2 = class extends Hono {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.3/node_modules/hono/dist/middleware/cors/index.js
+// ../../node_modules/.bun/hono@4.13.7/node_modules/hono/dist/middleware/cors/index.js
 var cors = (options) => {
   const opts = {
     origin: "*",
@@ -6814,7 +6799,7 @@ function getPackageVersion() {
 // src/server/v1.ts
 init_types();
 
-// ../contracts/dist/auth/index.js
+// ../../node_modules/.bun/@hasna+contracts@1.0.2+e8014c875821e0be/node_modules/@hasna/contracts/dist/auth/index.js
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
 var MAX_TENANT_ID_LENGTH = 64;
 var TENANT_ID_PATTERN = new RegExp(`^[A-Za-z0-9][A-Za-z0-9._-]{0,${MAX_TENANT_ID_LENGTH - 1}}$`);
@@ -7769,119 +7754,178 @@ function instructionsSchemaSql() {
   ];
 }
 
-// src/server/cloud.ts
-var INSTRUCTIONS_APP_SLUG = "instructions";
-function resolveCloudDatabaseUrl(env = process.env) {
-  return env.HASNA_INSTRUCTIONS_DATABASE_URL || env.INSTRUCTIONS_DATABASE_URL || env.DATABASE_URL || undefined;
-}
-function resolveSigningSecret(env = process.env) {
-  return env.HASNA_INSTRUCTIONS_API_SIGNING_KEY?.trim() || env.HASNA_API_SIGNING_KEY?.trim() || env.API_KEY_SIGNING_SECRET?.trim() || undefined;
-}
-function isPostgresBackendEnabled(env = process.env) {
-  return Boolean(resolveCloudDatabaseUrl(env));
-}
-var cachedClient = null;
-var cachedStore = null;
-var cachedVerifier = null;
-var schemaEnsured = null;
-function getClient() {
-  if (cachedClient)
-    return cachedClient;
-  const url = resolveCloudDatabaseUrl();
-  if (!url) {
-    throw new Error("Cloud /v1 requires a remote database URL (HASNA_INSTRUCTIONS_DATABASE_URL / INSTRUCTIONS_DATABASE_URL / DATABASE_URL).");
+// src/storage/cloud-store.ts
+init_types();
+init_bounded_read();
+init_instruction_graph();
+init_asset_plan();
+init_machine();
+import { createHash as createHash2, randomUUID } from "crypto";
+
+class CollectionChangedWhilePagingError extends Error {
+  constructor(label, detail) {
+    super(`${label} changed while paging: ${detail}`);
+    this.name = "CollectionChangedWhilePagingError";
   }
-  const pool2 = createPgPool({
-    connectionString: url,
-    max: 6,
-    idleTimeoutMillis: 30000,
-    connectionTimeoutMillis: 15000,
-    applicationName: "instructions-serve"
-  });
-  cachedClient = createQueryClient(pool2);
-  return cachedClient;
 }
-function getCloudClient() {
-  return getClient();
+function isBoundedPageConsistencyError(error) {
+  return error instanceof Error && (error.message.startsWith("bounded read returned ") || error.message.startsWith("bounded read did not advance "));
 }
-function authClient() {
-  const client = getClient();
-  return {
-    async many(sql, params = []) {
-      return client.many(sql, params);
-    },
-    async get(sql, params = []) {
-      return client.get(sql, params);
-    },
-    async execute(sql, params = []) {
-      await client.execute(sql, params);
+async function aggregateBoundedCollectionRead(label, readPage, identity, requireAscendingIdentity = false, retryBoundedPageConsistencyErrors = false) {
+  let lastError = null;
+  for (let attempt = 0;attempt < 2; attempt += 1) {
+    try {
+      const items = [];
+      const seen = new Set;
+      let expectedTotal = null;
+      let previousIdentity = null;
+      let cursor = 0;
+      while (true) {
+        let page;
+        try {
+          page = await readPage(cursor);
+        } catch (error) {
+          if (!retryBoundedPageConsistencyErrors || !isBoundedPageConsistencyError(error))
+            throw error;
+          throw new CollectionChangedWhilePagingError(label, error.message);
+        }
+        if (page.cursor !== cursor) {
+          throw new CollectionChangedWhilePagingError(label, `server returned cursor ${page.cursor} for requested cursor ${cursor}`);
+        }
+        if (expectedTotal === null)
+          expectedTotal = page.total;
+        else if (page.total !== expectedTotal) {
+          throw new CollectionChangedWhilePagingError(label, `total changed from ${expectedTotal} to ${page.total}`);
+        }
+        for (const item of page.items) {
+          const key = identity(item);
+          if (!key)
+            throw new CollectionChangedWhilePagingError(label, "an item had no stable identity");
+          if (seen.has(key))
+            throw new CollectionChangedWhilePagingError(label, `duplicate identity ${key}`);
+          if (requireAscendingIdentity && previousIdentity !== null && key <= previousIdentity) {
+            throw new CollectionChangedWhilePagingError(label, `identity order was not strictly increasing at ${key}`);
+          }
+          seen.add(key);
+          previousIdentity = key;
+          items.push(item);
+        }
+        if (page.complete) {
+          if (items.length !== expectedTotal) {
+            throw new CollectionChangedWhilePagingError(label, `received ${items.length} unique rows for total ${expectedTotal}`);
+          }
+          return { items, total: expectedTotal };
+        }
+        if (page.next_cursor === null || page.next_cursor <= cursor) {
+          throw new CollectionChangedWhilePagingError(label, `cursor did not advance from ${cursor}`);
+        }
+        cursor = page.next_cursor;
+      }
+    } catch (error) {
+      if (!(error instanceof CollectionChangedWhilePagingError))
+        throw error;
+      lastError = error;
     }
-  };
-}
-function getApiKeyStore() {
-  if (cachedStore)
-    return cachedStore;
-  cachedStore = new ApiKeyStore(authClient());
-  return cachedStore;
+  }
+  throw lastError ?? new CollectionChangedWhilePagingError(label, "read did not stabilize");
 }
-async function ensureCloudSchema() {
-  if (schemaEnsured)
-    return schemaEnsured;
-  schemaEnsured = (async () => {
-    const client = getClient();
-    for (const sql of instructionsSchemaSql()) {
-      await client.execute(sql);
-    }
-    await getApiKeyStore().ensureSchema();
-  })().catch((e) => {
-    schemaEnsured = null;
-    throw e;
-  });
-  return schemaEnsured;
+class StoreValidationError extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "StoreValidationError";
+  }
 }
-var honoMiddlewareCache = new Map;
-function getHonoAuthMiddleware(requiredScopes) {
-  const key = requiredScopes.join(",");
-  const cached2 = honoMiddlewareCache.get(key);
-  if (cached2)
-    return cached2;
-  const signingSecret = resolveSigningSecret();
-  if (!signingSecret) {
-    throw new Error("Cloud /v1 auth requires a signing secret (HASNA_INSTRUCTIONS_API_SIGNING_KEY / HASNA_API_SIGNING_KEY / API_KEY_SIGNING_SECRET).");
+
+class IdempotencyConflictError extends Error {
+  code = "IDEMPOTENCY_KEY_REUSED";
+  constructor() {
+    super("Idempotency-Key was already used for a different request body");
+    this.name = "IdempotencyConflictError";
+  }
+}
+var IDEMPOTENCY_SCHEMA_SQL = `CREATE TABLE IF NOT EXISTS instruction_idempotency_receipts (
+  principal TEXT NOT NULL,
+  operation TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  request_sha256 TEXT NOT NULL,
+  response_status INTEGER,
+  response_body JSONB,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  completed_at TIMESTAMPTZ,
+  PRIMARY KEY (principal, operation, idempotency_key),
+  CHECK (length(principal) BETWEEN 1 AND 512),
+  CHECK (length(operation) BETWEEN 1 AND 255),
+  CHECK (length(idempotency_key) BETWEEN 1 AND 255),
+  CHECK (length(request_sha256) = 64),
+  CHECK (
+    (response_status IS NULL AND response_body IS NULL AND completed_at IS NULL)
+    OR
+    (response_status BETWEEN 200 AND 599 AND response_body IS NOT NULL AND completed_at IS NOT NULL)
+  )
+)`;
+function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return JSON.stringify(value);
+  if (typeof value === "number")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().filter((key) => record[key] !== undefined).map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
   }
-  const store = getApiKeyStore();
-  const mw = honoApiKey({
-    app: INSTRUCTIONS_APP_SLUG,
-    signingSecret,
-    keyStatus: store.keyStatus,
-    requiredScopes
-  });
-  honoMiddlewareCache.set(key, mw);
-  return mw;
+  return JSON.stringify(null);
 }
-async function pingCloud() {
-  const client = getClient();
-  const row = await client.get("SELECT 1 AS ok");
-  return row?.ok === 1;
+function idempotencyBodyDigest(body) {
+  return createHash2("sha256").update(canonicalJson(body)).digest("hex");
 }
-async function closeCloud() {
-  if (cachedClient)
-    await cachedClient.close();
-  cachedClient = null;
-  cachedStore = null;
-  cachedVerifier = null;
-  honoMiddlewareCache.clear();
-  schemaEnsured = null;
-  honoMiddlewareCache.clear();
+function hasTransaction(client) {
+  return typeof client.transaction === "function";
+}
+var idempotencySchemaReady = new WeakSet;
+async function ensureIdempotencySchema(client) {
+  if (idempotencySchemaReady.has(client))
+    return;
+  await client.execute(IDEMPOTENCY_SCHEMA_SQL);
+  await client.execute("CREATE INDEX IF NOT EXISTS instruction_idempotency_receipts_created_at_idx ON instruction_idempotency_receipts (created_at)");
+  idempotencySchemaReady.add(client);
+}
+async function executeIdempotentRequest(client, input, perform) {
+  if (!hasTransaction(client)) {
+    throw new Error("durable idempotency requires a transactional PostgreSQL client");
+  }
+  await ensureIdempotencySchema(client);
+  const digest = idempotencyBodyDigest(input.body);
+  return client.transaction(async (tx) => {
+    const identity = [input.principal, input.operation, input.key];
+    const inserted = await tx.query(`INSERT INTO instruction_idempotency_receipts
+         (principal, operation, idempotency_key, request_sha256)
+       VALUES ($1,$2,$3,$4)
+       ON CONFLICT (principal, operation, idempotency_key) DO NOTHING
+       RETURNING true AS inserted`, [...identity, digest]);
+    const receipt = await tx.get(`SELECT request_sha256, response_status, response_body
+         FROM instruction_idempotency_receipts
+        WHERE principal = $1 AND operation = $2 AND idempotency_key = $3
+        FOR UPDATE`, identity);
+    if (!receipt)
+      throw new Error("idempotency receipt disappeared during transaction");
+    if (receipt.request_sha256 !== digest)
+      throw new IdempotencyConflictError;
+    if (inserted.rowCount === 0) {
+      if (receipt.response_status === null || receipt.response_body === null) {
+        throw new Error("idempotency receipt is incomplete after serialization");
+      }
+      return { status: Number(receipt.response_status), body: receipt.response_body, replayed: true };
+    }
+    const response = await perform(tx);
+    await tx.execute(`UPDATE instruction_idempotency_receipts
+          SET response_status = $5, response_body = $6::jsonb, completed_at = now()
+        WHERE principal = $1 AND operation = $2 AND idempotency_key = $3 AND request_sha256 = $4`, [...identity, digest, response.status, JSON.stringify(response.body)]);
+    return { ...response, replayed: false };
+  });
 }
-
-// src/storage/cloud-store.ts
-init_types();
-init_bounded_read();
-init_instruction_graph();
-init_asset_plan();
-init_machine();
-import { randomUUID } from "crypto";
 function slugify(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 }
@@ -7949,7 +7993,7 @@ async function uniqueSlug(client, name, excludeId) {
   }
   throw new Error(`could not allocate a unique slug for '${name}'`);
 }
-async function listConfigs(client, filter = {}) {
+function configFilterSql(filter) {
   const conditions = [];
   const params = [];
   const add = (sql, value) => {
@@ -7966,12 +8010,37 @@ async function listConfigs(client, filter = {}) {
     add("is_template = $?", filter.is_template);
   if (filter.search) {
     params.push(`%${filter.search}%`);
-    const p = `$${params.length}`;
-    conditions.push(`(name ILIKE ${p} OR description ILIKE ${p} OR content ILIKE ${p})`);
+    const parameter = `$${params.length}`;
+    conditions.push(`(name ILIKE ${parameter} OR description ILIKE ${parameter} OR content ILIKE ${parameter})`);
   }
-  const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
-  const rows = await client.many(`SELECT * FROM configs ${where} ORDER BY category, name`, params);
-  return rows.map(rowToConfig);
+  return {
+    where: conditions.length ? `WHERE ${conditions.join(" AND ")}` : "",
+    params
+  };
+}
+async function listConfigsPage(client, filter = {}, options = {}) {
+  const normalized = normalizeBoundedReadOptions(options);
+  const { where, params } = configFilterSql(filter);
+  const count = await client.get(`SELECT COUNT(*) AS total FROM configs ${where}`, params);
+  const rows = await client.many(`SELECT * FROM configs ${where} ORDER BY id LIMIT $${params.length + 1} OFFSET $${params.length + 2}`, [...params, normalized.limit, normalized.cursor]);
+  return boundedReadPage(rows.map(rowToConfig), Number(count?.total ?? 0), normalized);
+}
+async function listConfigIdentitiesPage(client, filterOrOptions = {}, maybeOptions) {
+  const filterKeys = ["category", "agent", "kind", "is_template", "search", "tags"];
+  const isFilterOnly = maybeOptions === undefined && filterKeys.some((key) => (key in filterOrOptions));
+  const filter = maybeOptions === undefined && !isFilterOnly ? {} : filterOrOptions;
+  const options = maybeOptions === undefined && !isFilterOnly ? filterOrOptions : maybeOptions ?? {};
+  const normalized = normalizeBoundedReadOptions(options);
+  const { where, params } = configFilterSql(filter);
+  const count = await client.get(`SELECT COUNT(*) AS total FROM configs ${where}`, params);
+  const rows = await client.many(`SELECT id, name, slug, kind, category, agent, format, is_template, version, created_at, updated_at, synced_at
+       FROM configs ${where} ORDER BY id LIMIT $${params.length + 1} OFFSET $${params.length + 2}`, [...params, normalized.limit, normalized.cursor]);
+  return boundedReadPage(rows.map((row) => ({
+    ...row,
+    created_at: toIso2(row.created_at),
+    updated_at: toIso2(row.updated_at),
+    synced_at: row.synced_at == null ? null : toIso2(row.synced_at)
+  })), Number(count?.total ?? 0), normalized);
 }
 async function getConfig(client, idOrSlug) {
   const row = await client.get("SELECT * FROM configs WHERE id = $1 OR slug = $1", [idOrSlug]);
@@ -7980,10 +8049,10 @@ async function getConfig(client, idOrSlug) {
   return rowToConfig(row);
 }
 async function createConfig(client, input) {
-  if (!input.name || !input.name.trim())
-    throw new Error("name is required");
-  if (!input.category)
-    throw new Error("category is required");
+  if (typeof input.name !== "string" || !input.name.trim())
+    throw new StoreValidationError("name is required", "NAME_REQUIRED");
+  if (typeof input.category !== "string" || !input.category.trim())
+    throw new StoreValidationError("category is required", "CATEGORY_REQUIRED");
   const id = randomUUID();
   const slug = await uniqueSlug(client, input.name);
   const snapshotId = randomUUID();
@@ -8092,10 +8161,20 @@ async function createSnapshotContent(client, idOrSlug, content, version) {
     throw new Error("snapshot insert failed");
   return { id: row.id, config_id: row.config_id, content: row.content, version: Number(row.version), created_at: toIso2(row.created_at) };
 }
-async function listSnapshots(client, idOrSlug) {
+async function listSnapshotsPage(client, idOrSlug, options = {}) {
   const config = await getConfig(client, idOrSlug);
-  const rows = await client.many("SELECT id, config_id, content, version, created_at FROM config_snapshots WHERE config_id = $1 ORDER BY version DESC", [config.id]);
-  return rows.map((r) => ({ id: r.id, config_id: r.config_id, content: r.content, version: Number(r.version), created_at: toIso2(r.created_at) }));
+  const normalized = normalizeBoundedReadOptions(options);
+  const count = await client.get("SELECT COUNT(*) AS total FROM config_snapshots WHERE config_id = $1", [config.id]);
+  const rows = await client.many(`SELECT id, config_id, content, version, created_at
+       FROM config_snapshots WHERE config_id = $1
+       ORDER BY version DESC, id LIMIT $2 OFFSET $3`, [config.id, normalized.limit, normalized.cursor]);
+  return boundedReadPage(rows.map((row) => ({
+    id: row.id,
+    config_id: row.config_id,
+    content: row.content,
+    version: Number(row.version),
+    created_at: toIso2(row.created_at)
+  })), Number(count?.total ?? 0), normalized);
 }
 async function getSnapshotById(client, snapshotId) {
   const row = await client.get("SELECT id, config_id, content, version, created_at FROM config_snapshots WHERE id = $1", [snapshotId]);
@@ -8125,40 +8204,31 @@ function rowToProfile(row) {
     updated_at: toIso2(row.updated_at)
   };
 }
-async function listProfiles(client) {
-  const profiles = [];
-  let cursor = 0;
-  while (true) {
-    const page = await listProfilesPage(client, { limit: 100, cursor });
-    profiles.push(...page.items);
-    if (page.complete)
-      return profiles;
-    cursor = page.next_cursor;
-  }
-}
 async function listProfilesPage(client, options = {}) {
   const normalized = normalizeBoundedReadOptions(options);
   const count = await client.get("SELECT COUNT(*) AS total FROM profiles");
-  const rows = await client.many("SELECT * FROM profiles ORDER BY name LIMIT $1 OFFSET $2", [normalized.limit, normalized.cursor]);
+  const rows = await client.many("SELECT * FROM profiles ORDER BY id LIMIT $1 OFFSET $2", [normalized.limit, normalized.cursor]);
   return boundedReadPage(rows.map(rowToProfile), Number(count?.total ?? 0), normalized);
 }
+async function listProfileIdentitiesPage(client, options = {}) {
+  const normalized = normalizeBoundedReadOptions(options);
+  const count = await client.get("SELECT COUNT(*) AS total FROM profiles");
+  const rows = await client.many(`SELECT id, name, slug, created_at, updated_at
+       FROM profiles ORDER BY id LIMIT $1 OFFSET $2`, [normalized.limit, normalized.cursor]);
+  return boundedReadPage(rows.map((row) => ({
+    id: row.id,
+    name: row.name,
+    slug: row.slug,
+    created_at: toIso2(row.created_at),
+    updated_at: toIso2(row.updated_at)
+  })), Number(count?.total ?? 0), normalized);
+}
 async function getProfile(client, idOrSlug) {
   const row = await client.get("SELECT * FROM profiles WHERE id = $1 OR slug = $1", [idOrSlug]);
   if (!row)
     throw new ProfileNotFoundError(idOrSlug);
   return rowToProfile(row);
 }
-async function getProfileConfigs(client, idOrSlug) {
-  const configs = [];
-  let cursor = 0;
-  while (true) {
-    const page = await getProfileConfigsPage(client, idOrSlug, { limit: 100, cursor });
-    configs.push(...page.items);
-    if (page.complete)
-      return configs;
-    cursor = page.next_cursor;
-  }
-}
 async function getProfileConfigsPage(client, idOrSlug, options = {}) {
   const profile = await getProfile(client, idOrSlug);
   const normalized = normalizeBoundedReadOptions(options);
@@ -8166,13 +8236,13 @@ async function getProfileConfigsPage(client, idOrSlug, options = {}) {
   const rows = await client.many(`SELECT c.* FROM configs c
        JOIN profile_configs pc ON pc.config_id = c.id
       WHERE pc.profile_id = $1
-      ORDER BY pc.sort_order
+      ORDER BY pc.sort_order, c.id
       LIMIT $2 OFFSET $3`, [profile.id, normalized.limit, normalized.cursor]);
   return boundedReadPage(rows.map(rowToConfig), Number(count?.total ?? 0), normalized);
 }
 async function createProfile(client, input) {
-  if (!input.name || !input.name.trim())
-    throw new Error("name is required");
+  if (typeof input.name !== "string" || !input.name.trim())
+    throw new StoreValidationError("name is required", "NAME_REQUIRED");
   const id = randomUUID();
   const slug = await uniqueProfileSlug(client, input.name);
   await client.execute(`INSERT INTO profiles (id, name, slug, description, selectors, variables, created_at, updated_at)
@@ -8224,18 +8294,32 @@ async function addConfigToProfile(client, profileIdOrSlug, configId) {
   await client.execute(`INSERT INTO profile_configs (profile_id, config_id, sort_order)
      VALUES ($1,$2,$3) ON CONFLICT (profile_id, config_id) DO NOTHING`, [profile.id, configId, order2]);
 }
-async function getProfileConfigBindings(client, profileIdOrSlug) {
-  const profile = await getProfile(client, profileIdOrSlug);
-  const rows = await client.many(`SELECT profile_id, config_id, sort_order, binding
-       FROM profile_configs
-      WHERE profile_id = $1
-      ORDER BY sort_order, config_id`, [profile.id]);
-  return rows.map((row) => ({
+function rowToProfileConfigBinding(row) {
+  return {
     profile_id: row.profile_id,
     config_id: row.config_id,
     sort_order: Number(row.sort_order),
     binding: row.binding == null ? legacyProfileConfigBinding() : normalizeProfileConfigBinding(row.binding)
-  }));
+  };
+}
+async function getProfileConfigBindingsPage(client, profileIdOrSlug, options = {}) {
+  const profile = await getProfile(client, profileIdOrSlug);
+  const normalized = normalizeBoundedReadOptions(options);
+  const count = await client.get("SELECT COUNT(*) AS total FROM profile_configs WHERE profile_id = $1", [profile.id]);
+  const rows = await client.many(`SELECT profile_id, config_id, sort_order, binding
+       FROM profile_configs
+      WHERE profile_id = $1
+      ORDER BY sort_order, config_id
+      LIMIT $2 OFFSET $3`, [profile.id, normalized.limit, normalized.cursor]);
+  return boundedReadPage(rows.map(rowToProfileConfigBinding), Number(count?.total ?? 0), normalized);
+}
+async function getProfileConfigBinding(client, profileId, configId) {
+  const row = await client.get(`SELECT profile_id, config_id, sort_order, binding
+       FROM profile_configs
+      WHERE profile_id = $1 AND config_id = $2`, [profileId, configId]);
+  if (!row)
+    throw new Error(`Config ${configId} is not a member of profile ${profileId}.`);
+  return rowToProfileConfigBinding(row);
 }
 async function setProfileConfigBinding(client, profileIdOrSlug, configId, binding) {
   const profile = await getProfile(client, profileIdOrSlug);
@@ -8243,12 +8327,39 @@ async function setProfileConfigBinding(client, profileIdOrSlug, configId, bindin
   const result = await client.query("UPDATE profile_configs SET binding = $1 WHERE profile_id = $2 AND config_id = $3", [JSON.stringify(normalized), profile.id, configId]);
   if ((result.rowCount ?? 0) !== 1)
     throw new Error(`Config ${configId} is not a member of profile ${profile.slug}.`);
-  return (await getProfileConfigBindings(client, profile.id)).find((row) => row.config_id === configId);
+  return getProfileConfigBinding(client, profile.id, configId);
 }
 async function removeConfigFromProfile(client, profileIdOrSlug, configId) {
   const profile = await getProfile(client, profileIdOrSlug);
   await client.execute("DELETE FROM profile_configs WHERE profile_id = $1 AND config_id = $2", [profile.id, configId]);
 }
+function rowToProfileAssetBinding(row) {
+  return {
+    profile_id: row.profile_id,
+    source_config_id: row.source_config_id,
+    sort_order: Number(row.sort_order),
+    binding: normalizeProfileAssetBinding(row.binding)
+  };
+}
+async function getProfileAssetBindingsPage(client, profileIdOrSlug, options = {}) {
+  const profile = await getProfile(client, profileIdOrSlug);
+  const normalized = normalizeBoundedReadOptions(options);
+  const count = await client.get("SELECT COUNT(*) AS total FROM profile_assets WHERE profile_id = $1", [profile.id]);
+  const rows = await client.many(`SELECT profile_id, source_config_id, sort_order, binding
+       FROM profile_assets
+      WHERE profile_id = $1
+      ORDER BY sort_order, asset_key
+      LIMIT $2 OFFSET $3`, [profile.id, normalized.limit, normalized.cursor]);
+  return boundedReadPage(rows.map(rowToProfileAssetBinding), Number(count?.total ?? 0), normalized);
+}
+async function getProfileAssetBinding(client, profileId, assetKey) {
+  const row = await client.get(`SELECT profile_id, source_config_id, sort_order, binding
+       FROM profile_assets
+      WHERE profile_id = $1 AND asset_key = $2`, [profileId, assetKey]);
+  if (!row)
+    throw new Error(`Asset ${assetKey} is not a member of profile ${profileId}.`);
+  return rowToProfileAssetBinding(row);
+}
 async function addAssetToProfile(client, profileIdOrSlug, sourceConfigId, binding) {
   const profile = await getProfile(client, profileIdOrSlug);
   await getConfig(client, sourceConfigId);
@@ -8256,7 +8367,7 @@ async function addAssetToProfile(client, profileIdOrSlug, sourceConfigId, bindin
   const maxRow = await client.get("SELECT MAX(sort_order) AS max_order FROM profile_assets WHERE profile_id = $1", [profile.id]);
   const order2 = (maxRow?.max_order ?? -1) + 1;
   await client.execute("INSERT INTO profile_assets (profile_id, source_config_id, asset_key, sort_order, binding) VALUES ($1,$2,$3,$4,$5::jsonb)", [profile.id, sourceConfigId, normalized.assetKey, order2, JSON.stringify(normalized)]);
-  return (await getProfileAssetBindings(client, profile.id)).find((row) => row.binding.assetKey === normalized.assetKey);
+  return getProfileAssetBinding(client, profile.id, normalized.assetKey);
 }
 async function setProfileAssetBinding(client, profileIdOrSlug, assetKey, binding) {
   const profile = await getProfile(client, profileIdOrSlug);
@@ -8266,17 +8377,7 @@ async function setProfileAssetBinding(client, profileIdOrSlug, assetKey, binding
   const result = await client.query("UPDATE profile_assets SET binding = $1::jsonb WHERE profile_id = $2 AND asset_key = $3", [JSON.stringify(normalized), profile.id, assetKey]);
   if ((result.rowCount ?? 0) !== 1)
     throw new Error(`Asset ${assetKey} is not a member of profile ${profile.slug}.`);
-  return (await getProfileAssetBindings(client, profile.id)).find((row) => row.binding.assetKey === assetKey);
-}
-async function getProfileAssetBindings(client, profileIdOrSlug) {
-  const profile = await getProfile(client, profileIdOrSlug);
-  const rows = await client.many("SELECT profile_id, source_config_id, sort_order, binding FROM profile_assets WHERE profile_id = $1 ORDER BY sort_order, asset_key", [profile.id]);
-  return rows.map((row) => ({
-    profile_id: row.profile_id,
-    source_config_id: row.source_config_id,
-    sort_order: Number(row.sort_order),
-    binding: normalizeProfileAssetBinding(row.binding)
-  }));
+  return getProfileAssetBinding(client, profile.id, assetKey);
 }
 async function removeAssetFromProfile(client, profileIdOrSlug, assetKey) {
   const profile = await getProfile(client, profileIdOrSlug);
@@ -8291,39 +8392,33 @@ async function resolveProfileForMachineRead(client, machine, options = {}) {
   const os = (machine.os ?? "").trim().toLowerCase();
   const osFamily = normalizeOsFamily(machine.os);
   const arch = (machine.arch ?? "").trim().toLowerCase();
-  let cursor = 0;
-  let scanned = 0;
-  let total = 0;
+  const readStableProfiles = (queryClient) => aggregateBoundedCollectionRead("profile resolution", (cursor) => listProfilesPage(queryClient, { limit, cursor }), (profile) => profile.id, true, true);
+  const stableRead = hasTransaction(client) ? await client.transaction(async (transaction) => {
+    await transaction.execute("SET TRANSACTION ISOLATION LEVEL REPEATABLE READ READ ONLY");
+    return readStableProfiles(transaction);
+  }) : await readStableProfiles(client);
   let selected = null;
-  while (true) {
-    const page = await listProfilesPage(client, { limit, cursor });
-    total = page.total;
-    scanned += page.items.length;
-    for (const p of page.items) {
-      if (!profileHasSelectors(p.selectors))
-        continue;
-      const s = p.selectors;
-      const osOk = !s.os?.length || s.os.some((c) => {
-        const value = c.trim().toLowerCase();
-        return value === os || normalizeOsFamily(c) === osFamily;
-      });
-      const archOk = !s.arch?.length || s.arch.some((c) => c.trim().toLowerCase() === arch);
-      const hostOk = !s.hostnames?.length || s.hostnames.some((c) => c.trim().toLowerCase() === host);
-      if (!osOk || !archOk || !hostOk)
-        continue;
-      const score = (p.selectors.hostnames?.length ? 100 : 0) + (p.selectors.os?.length ? 10 : 0) + (p.selectors.arch?.length ? 10 : 0);
-      if (!selected || score > selected.score || score === selected.score && p.name.localeCompare(selected.profile.name) < 0) {
-        selected = { profile: p, score };
-      }
+  for (const p of stableRead.items) {
+    if (!profileHasSelectors(p.selectors))
+      continue;
+    const s = p.selectors;
+    const osOk = !s.os?.length || s.os.some((c) => {
+      const value = c.trim().toLowerCase();
+      return value === os || normalizeOsFamily(c) === osFamily;
+    });
+    const archOk = !s.arch?.length || s.arch.some((c) => c.trim().toLowerCase() === arch);
+    const hostOk = !s.hostnames?.length || s.hostnames.some((c) => c.trim().toLowerCase() === host);
+    if (!osOk || !archOk || !hostOk)
+      continue;
+    const score = (p.selectors.hostnames?.length ? 100 : 0) + (p.selectors.os?.length ? 10 : 0) + (p.selectors.arch?.length ? 10 : 0);
+    if (!selected || score > selected.score || score === selected.score && p.name.localeCompare(selected.profile.name) < 0) {
+      selected = { profile: p, score };
     }
-    if (page.complete)
-      break;
-    cursor = page.next_cursor;
   }
   return {
     profile: selected?.profile ?? null,
-    scanned,
-    total,
+    scanned: stableRead.items.length,
+    total: stableRead.total,
     batch_limit: limit,
     source_bounded: true,
     complete: true,
@@ -8340,9 +8435,19 @@ function rowToMachine(row) {
     created_at: toIso2(row.created_at)
   };
 }
-async function listMachines(client) {
-  const rows = await client.many("SELECT * FROM machines ORDER BY last_applied_at DESC NULLS LAST");
-  return rows.map(rowToMachine);
+async function listMachinesPage(client, options = {}) {
+  const normalized = normalizeBoundedReadOptions(options);
+  const count = await client.get("SELECT COUNT(*) AS total FROM machines");
+  const rows = await client.many(`SELECT * FROM machines
+      ORDER BY id LIMIT $1 OFFSET $2`, [normalized.limit, normalized.cursor]);
+  return boundedReadPage(rows.map(rowToMachine), Number(count?.total ?? 0), normalized);
+}
+async function listMachineIdentitiesPage(client, options = {}) {
+  const normalized = normalizeBoundedReadOptions(options);
+  const count = await client.get("SELECT COUNT(*) AS total FROM machines");
+  const rows = await client.many(`SELECT id, hostname, os, arch, last_applied_at, created_at
+       FROM machines ORDER BY id LIMIT $1 OFFSET $2`, [normalized.limit, normalized.cursor]);
+  return boundedReadPage(rows.map(rowToMachine), Number(count?.total ?? 0), normalized);
 }
 async function registerMachine(client, hostname, os, arch) {
   const existing = await client.get("SELECT * FROM machines WHERE hostname = $1", [hostname]);
@@ -8365,38 +8470,229 @@ async function insertFeedback(client, input) {
   await client.execute("INSERT INTO feedback (id, message, email, category, version, created_at) VALUES ($1,$2,$3,$4,$5,now())", [randomUUID(), input.message, input.email ?? null, input.category ?? "general", input.version ?? null]);
 }
 
-// src/server/v1.ts
-var JSON_HEADERS = { "Content-Type": "application/json" };
-function json(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+// src/server/cloud.ts
+var INSTRUCTIONS_APP_SLUG = "instructions";
+function resolveCloudDatabaseUrl(env = process.env) {
+  return env.HASNA_INSTRUCTIONS_DATABASE_URL || env.INSTRUCTIONS_DATABASE_URL || env.DATABASE_URL || undefined;
 }
-function errorResponse(status, message, extra) {
-  return json({ error: message, ...extra ?? {} }, status);
+function resolveSigningSecret(env = process.env) {
+  return env.HASNA_INSTRUCTIONS_API_SIGNING_KEY?.trim() || env.HASNA_API_SIGNING_KEY?.trim() || env.API_KEY_SIGNING_SECRET?.trim() || undefined;
 }
-function completeLegacyPage(items) {
+function isPostgresBackendEnabled(env = process.env) {
+  return Boolean(resolveCloudDatabaseUrl(env));
+}
+var cachedClient = null;
+var cachedStore = null;
+var cachedVerifier = null;
+var schemaEnsured = null;
+function getClient() {
+  if (cachedClient)
+    return cachedClient;
+  const url = resolveCloudDatabaseUrl();
+  if (!url) {
+    throw new Error("Cloud /v1 requires a remote database URL (HASNA_INSTRUCTIONS_DATABASE_URL / INSTRUCTIONS_DATABASE_URL / DATABASE_URL).");
+  }
+  const pool2 = createPgPool({
+    connectionString: url,
+    max: 6,
+    idleTimeoutMillis: 30000,
+    connectionTimeoutMillis: 15000,
+    applicationName: "instructions-serve"
+  });
+  cachedClient = createQueryClient(pool2);
+  return cachedClient;
+}
+function getCloudClient() {
+  return getClient();
+}
+function authClient() {
+  const client = getClient();
   return {
-    items,
-    total: items.length,
-    limit: Math.max(items.length, 1),
-    cursor: 0,
-    next_cursor: null,
-    has_more: false,
-    complete: true,
-    truncated: false,
-    source_bounded: false
+    async many(sql, params = []) {
+      return client.many(sql, params);
+    },
+    async get(sql, params = []) {
+      return client.get(sql, params);
+    },
+    async execute(sql, params = []) {
+      await client.execute(sql, params);
+    }
+  };
+}
+function getApiKeyStore() {
+  if (cachedStore)
+    return cachedStore;
+  cachedStore = new ApiKeyStore(authClient());
+  return cachedStore;
+}
+async function ensureCloudSchema() {
+  if (schemaEnsured)
+    return schemaEnsured;
+  schemaEnsured = (async () => {
+    const client = getClient();
+    for (const sql of instructionsSchemaSql()) {
+      await client.execute(sql);
+    }
+    await ensureIdempotencySchema(client);
+    await getApiKeyStore().ensureSchema();
+  })().catch((e) => {
+    schemaEnsured = null;
+    throw e;
+  });
+  return schemaEnsured;
+}
+var honoMiddlewareCache = new Map;
+function getHonoAuthMiddleware(requiredScopes) {
+  const key = requiredScopes.join(",");
+  const cached2 = honoMiddlewareCache.get(key);
+  if (cached2)
+    return cached2;
+  const signingSecret = resolveSigningSecret();
+  if (!signingSecret) {
+    throw new Error("Cloud /v1 auth requires a signing secret (HASNA_INSTRUCTIONS_API_SIGNING_KEY / HASNA_API_SIGNING_KEY / API_KEY_SIGNING_SECRET).");
+  }
+  const store = getApiKeyStore();
+  const mw = honoApiKey({
+    app: INSTRUCTIONS_APP_SLUG,
+    signingSecret,
+    keyStatus: store.keyStatus,
+    requiredScopes
+  });
+  honoMiddlewareCache.set(key, mw);
+  return mw;
+}
+async function pingCloud() {
+  const client = getClient();
+  const row = await client.get("SELECT 1 AS ok");
+  return row?.ok === 1;
+}
+async function closeCloud() {
+  if (cachedClient)
+    await cachedClient.close();
+  cachedClient = null;
+  cachedStore = null;
+  cachedVerifier = null;
+  honoMiddlewareCache.clear();
+  schemaEnsured = null;
+  honoMiddlewareCache.clear();
+}
+
+// src/server/v1.ts
+var JSON_HEADERS = { "Content-Type": "application/json" };
+var MAX_REQUEST_BODY_BYTES = 1024 * 1024;
+var MAX_SEARCH_QUERY_CHARS = 512;
+var MAX_IDEMPOTENCY_KEY_CHARS = 255;
+
+class HttpInputError extends Error {
+  status;
+  code;
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "HttpInputError";
+  }
+}
+function json(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+}
+function errorResponse(status, message, extra) {
+  return json({ error: message, ...extra ?? {} }, status);
+}
+function pagePayload(alias, page) {
+  return {
+    ...page,
+    [alias]: page.items,
+    count: page.items.length
   };
 }
+function authenticatedPrincipalAuthority(principal) {
+  if (!principal)
+    throw new Error("authenticated principal is unavailable");
+  return [
+    principal.app,
+    `tenant:${principal.tid ?? "-"}`,
+    `agent:${principal.agent ?? "-"}`,
+    `kid:${principal.kid}`
+  ].join("|");
+}
+function readIdempotencyKey(req) {
+  const raw2 = req.headers.get("idempotency-key");
+  if (raw2 === null)
+    return null;
+  const key = raw2.trim();
+  if (key.length < 1 || key.length > MAX_IDEMPOTENCY_KEY_CHARS || /[^\x21-\x7e]/.test(key)) {
+    throw new HttpInputError(400, "INVALID_IDEMPOTENCY_KEY", `Idempotency-Key must contain 1-${MAX_IDEMPOTENCY_KEY_CHARS} visible ASCII characters`);
+  }
+  return key;
+}
+async function mutationResponse(req, client, context, operation, requestBody, status, perform) {
+  const key = readIdempotencyKey(req);
+  if (!key)
+    return json(await perform(client), status);
+  const result = await executeIdempotentRequest(client, {
+    principal: authenticatedPrincipalAuthority(context.principal),
+    operation,
+    key,
+    body: requestBody
+  }, async (transaction) => ({ status, body: await perform(transaction) }));
+  return json(result.body, result.status);
+}
 async function readJson(req) {
+  const declaredLength = req.headers.get("content-length");
+  if (declaredLength !== null) {
+    const parsed = Number(declaredLength);
+    if (!Number.isSafeInteger(parsed) || parsed < 0)
+      return null;
+    if (parsed > MAX_REQUEST_BODY_BYTES) {
+      throw new HttpInputError(413, "REQUEST_BODY_TOO_LARGE", "request body exceeds the 1 MiB limit");
+    }
+  }
+  if (!req.body)
+    return {};
+  const reader = req.body.getReader();
+  const chunks = [];
+  let total = 0;
   try {
-    const text = await req.text();
-    if (!text)
-      return {};
-    return JSON.parse(text);
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      if (!value)
+        continue;
+      total += value.byteLength;
+      if (total > MAX_REQUEST_BODY_BYTES) {
+        await reader.cancel();
+        throw new HttpInputError(413, "REQUEST_BODY_TOO_LARGE", "request body exceeds the 1 MiB limit");
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  if (total === 0)
+    return {};
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  try {
+    return JSON.parse(new TextDecoder().decode(bytes));
   } catch {
     return null;
   }
 }
-async function handleV1Request(req, url) {
+function boundedSearchQuery(value) {
+  if (value === null || value === "")
+    return;
+  if (value.length > MAX_SEARCH_QUERY_CHARS) {
+    throw new HttpInputError(400, "SEARCH_QUERY_TOO_LONG", `search query exceeds ${MAX_SEARCH_QUERY_CHARS} characters`);
+  }
+  return value;
+}
+async function handleV1Request(req, url, context = {}) {
   const path = url.pathname;
   if (path !== "/v1" && !path.startsWith("/v1/"))
     return null;
@@ -8404,7 +8700,8 @@ async function handleV1Request(req, url) {
   try {
     await ensureCloudSchema();
   } catch (e) {
-    return errorResponse(503, `database unavailable: ${e.message}`);
+    console.error("instructions /v1: database unavailable");
+    return errorResponse(503, "Instructions database is unavailable", { code: "DATABASE_UNAVAILABLE" });
   }
   const client = getCloudClient();
   const segments = path.split("/").filter(Boolean);
@@ -8415,25 +8712,31 @@ async function handleV1Request(req, url) {
     if (resource === "configs") {
       if (!id) {
         if (method === "GET") {
+          const search = boundedSearchQuery(url.searchParams.get("search"));
           const filter = {
             ...url.searchParams.get("category") ? { category: url.searchParams.get("category") } : {},
             ...url.searchParams.get("agent") ? { agent: url.searchParams.get("agent") } : {},
             ...url.searchParams.get("kind") ? { kind: url.searchParams.get("kind") } : {},
-            ...url.searchParams.get("search") ? { search: url.searchParams.get("search") } : {}
+            ...search ? { search } : {}
+          };
+          const options = {
+            limit: url.searchParams.get("limit") ?? undefined,
+            cursor: url.searchParams.get("cursor") ?? undefined
           };
-          const configs = await listConfigs(client, filter);
-          return json({ configs, count: configs.length });
+          if (url.searchParams.get("view") === "identity") {
+            const page2 = await listConfigIdentitiesPage(client, filter, options);
+            return json(pagePayload("configs", page2));
+          }
+          const page = await listConfigsPage(client, filter, options);
+          return json(pagePayload("configs", page));
         }
         if (method === "POST") {
           const body = await readJson(req);
           if (!body)
             return errorResponse(400, "invalid JSON body");
-          try {
-            const config = await createConfig(client, body);
-            return json({ config }, 201);
-          } catch (e) {
-            return errorResponse(400, e.message);
-          }
+          return await mutationResponse(req, client, context, "POST /v1/configs", body, 201, async (transaction) => ({
+            config: await createConfig(transaction, body)
+          }));
         }
         return errorResponse(405, `method ${method} not allowed on /v1/configs`);
       }
@@ -8455,13 +8758,17 @@ async function handleV1Request(req, url) {
           return json({ snapshot });
         }
         if (method === "GET") {
-          const snapshots = await listSnapshots(client, id);
-          return json({ snapshots, count: snapshots.length });
+          const page = await listSnapshotsPage(client, id, {
+            limit: url.searchParams.get("limit") ?? undefined,
+            cursor: url.searchParams.get("cursor") ?? undefined
+          });
+          return json(pagePayload("snapshots", page));
         }
         if (method === "POST") {
           const body = await readJson(req);
-          const snapshot = body && typeof body.content === "string" && typeof body.version === "number" ? await createSnapshotContent(client, id, body.content, body.version) : await createSnapshot(client, id);
-          return json({ snapshot }, 201);
+          return await mutationResponse(req, client, context, "POST /v1/configs/:id/snapshots", { config_id: id, ...body ?? {} }, 201, async (transaction) => ({
+            snapshot: body && typeof body.content === "string" && typeof body.version === "number" ? await createSnapshotContent(transaction, id, body.content, body.version) : await createSnapshot(transaction, id)
+          }));
         }
         return errorResponse(405, `method ${method} not allowed on /v1/configs/:id/snapshots`);
       }
@@ -8487,26 +8794,24 @@ async function handleV1Request(req, url) {
     if (resource === "profiles") {
       if (!id) {
         if (method === "GET") {
-          if (!url.searchParams.has("limit") && !url.searchParams.has("cursor")) {
-            const profiles = await listProfiles(client);
-            return json({ ...completeLegacyPage(profiles), profiles, count: profiles.length });
-          }
-          const page = await listProfilesPage(client, {
+          const options = {
             limit: url.searchParams.get("limit") ?? undefined,
             cursor: url.searchParams.get("cursor") ?? undefined
-          });
-          return json({ ...page, profiles: page.items, count: page.items.length });
+          };
+          if (url.searchParams.get("view") === "identity") {
+            const page2 = await listProfileIdentitiesPage(client, options);
+            return json(pagePayload("profiles", page2));
+          }
+          const page = await listProfilesPage(client, options);
+          return json(pagePayload("profiles", page));
         }
         if (method === "POST") {
           const body = await readJson(req);
           if (!body)
             return errorResponse(400, "invalid JSON body");
-          try {
-            const profile = await createProfile(client, body);
-            return json({ profile }, 201);
-          } catch (e) {
-            return errorResponse(400, e.message);
-          }
+          return await mutationResponse(req, client, context, "POST /v1/profiles", body, 201, async (transaction) => ({
+            profile: await createProfile(transaction, body)
+          }));
         }
         return errorResponse(405, `method ${method} not allowed on /v1/profiles`);
       }
@@ -8523,8 +8828,11 @@ async function handleV1Request(req, url) {
       if (action === "bindings") {
         if (method !== "GET")
           return errorResponse(405, `method ${method} not allowed on /v1/profiles/:id/bindings`);
-        const bindings = await getProfileConfigBindings(client, id);
-        return json({ bindings });
+        const page = await getProfileConfigBindingsPage(client, id, {
+          limit: url.searchParams.get("limit") ?? undefined,
+          cursor: url.searchParams.get("cursor") ?? undefined
+        });
+        return json(pagePayload("bindings", page));
       }
       if (action === "configs") {
         const configId = segments[4] ? decodeURIComponent(segments[4]) : undefined;
@@ -8532,8 +8840,10 @@ async function handleV1Request(req, url) {
           const body = await readJson(req);
           if (!body?.config_id)
             return errorResponse(400, "config_id is required");
-          await addConfigToProfile(client, id, body.config_id);
-          return json({ added: true });
+          return await mutationResponse(req, client, context, "POST /v1/profiles/:id/configs", { profile_id: id, config_id: body.config_id }, 200, async (transaction) => {
+            await addConfigToProfile(transaction, id, body.config_id);
+            return { added: true };
+          });
         }
         if (method === "DELETE" && configId) {
           await removeConfigFromProfile(client, id, configId);
@@ -8543,30 +8853,36 @@ async function handleV1Request(req, url) {
           const body = await readJson(req);
           if (!body?.binding)
             return errorResponse(400, "binding is required");
-          const binding = await setProfileConfigBinding(client, id, configId, body.binding);
-          return json({ binding });
+          return await mutationResponse(req, client, context, "PUT /v1/profiles/:id/configs/:configId", { profile_id: id, config_id: configId, binding: body.binding }, 200, async (transaction) => ({
+            binding: await setProfileConfigBinding(transaction, id, configId, body.binding)
+          }));
         }
         return errorResponse(405, `method ${method} not allowed on /v1/profiles/:id/configs`);
       }
       if (action === "assets") {
         const assetKey = segments[4] ? decodeURIComponent(segments[4]) : undefined;
         if (method === "GET" && !assetKey) {
-          const assets = await getProfileAssetBindings(client, id);
-          return json({ assets });
+          const page = await getProfileAssetBindingsPage(client, id, {
+            limit: url.searchParams.get("limit") ?? undefined,
+            cursor: url.searchParams.get("cursor") ?? undefined
+          });
+          return json(pagePayload("assets", page));
         }
         if (method === "POST" && !assetKey) {
           const body = await readJson(req);
           if (!body?.source_config_id || !body.binding)
             return errorResponse(400, "source_config_id and binding are required");
-          const asset = await addAssetToProfile(client, id, body.source_config_id, body.binding);
-          return json({ asset }, 201);
+          return await mutationResponse(req, client, context, "POST /v1/profiles/:id/assets", { profile_id: id, source_config_id: body.source_config_id, binding: body.binding }, 201, async (transaction) => ({
+            asset: await addAssetToProfile(transaction, id, body.source_config_id, body.binding)
+          }));
         }
         if (method === "PUT" && assetKey) {
           const body = await readJson(req);
           if (!body?.binding)
             return errorResponse(400, "binding is required");
-          const asset = await setProfileAssetBinding(client, id, assetKey, body.binding);
-          return json({ asset });
+          return await mutationResponse(req, client, context, "PUT /v1/profiles/:id/assets/:assetKey", { profile_id: id, asset_key: assetKey, binding: body.binding }, 200, async (transaction) => ({
+            asset: await setProfileAssetBinding(transaction, id, assetKey, body.binding)
+          }));
         }
         if (method === "DELETE" && assetKey) {
           await removeAssetFromProfile(client, id, assetKey);
@@ -8578,13 +8894,6 @@ async function handleV1Request(req, url) {
         return errorResponse(404, `unknown profile action: ${action}`);
       if (method === "GET") {
         const profile = await getProfile(client, id);
-        if (!url.searchParams.has("limit") && !url.searchParams.has("cursor")) {
-          const legacyConfigs = await getProfileConfigs(client, id);
-          return json({
-            profile: { ...profile, configs: legacyConfigs },
-            configs: completeLegacyPage(legacyConfigs)
-          });
-        }
         const configs = await getProfileConfigsPage(client, id, {
           limit: url.searchParams.get("limit") ?? undefined,
           cursor: url.searchParams.get("cursor") ?? undefined
@@ -8629,15 +8938,20 @@ async function handleV1Request(req, url) {
       }
       if (!id) {
         if (method === "GET") {
-          const machines = await listMachines(client);
-          return json({ machines, count: machines.length });
+          const options = {
+            limit: url.searchParams.get("limit") ?? undefined,
+            cursor: url.searchParams.get("cursor") ?? undefined
+          };
+          const page = url.searchParams.get("view") === "identity" ? await listMachineIdentitiesPage(client, options) : await listMachinesPage(client, options);
+          return json(pagePayload("machines", page));
         }
         if (method === "POST") {
           const body = await readJson(req);
           if (!body?.hostname)
             return errorResponse(400, "hostname is required");
-          const machine = await registerMachine(client, body.hostname, body.os ?? null, body.arch ?? null);
-          return json({ machine }, 201);
+          return await mutationResponse(req, client, context, "POST /v1/machines", body, 201, async (transaction) => ({
+            machine: await registerMachine(transaction, body.hostname, body.os ?? null, body.arch ?? null)
+          }));
         }
         return errorResponse(405, `method ${method} not allowed on /v1/machines`);
       }
@@ -8659,10 +8973,17 @@ async function handleV1Request(req, url) {
     }
     return errorResponse(404, `unknown /v1 resource: ${resource ?? "(root)"}`);
   } catch (e) {
+    if (e instanceof HttpInputError)
+      return errorResponse(e.status, e.message, { code: e.code });
+    if (e instanceof StoreValidationError)
+      return errorResponse(400, e.message, { code: e.code });
+    if (e instanceof IdempotencyConflictError)
+      return errorResponse(409, e.message, { code: e.code });
     if (e instanceof ConfigNotFoundError || e instanceof ProfileNotFoundError) {
       return errorResponse(404, e.message);
     }
-    return errorResponse(500, e.message || "internal error");
+    console.error("instructions /v1: request failed");
+    return errorResponse(500, "Instructions request failed", { code: "INTERNAL_ERROR" });
   }
 }
 
@@ -8702,6 +9023,88 @@ var profileSchema = {
     updated_at: { type: "string" }
   }
 };
+var configIdentitySchema = {
+  type: "object",
+  required: ["id", "name", "slug", "kind", "category", "agent", "format", "is_template", "version", "created_at", "updated_at", "synced_at"],
+  properties: {
+    id: { type: "string" },
+    name: { type: "string" },
+    slug: { type: "string" },
+    kind: { type: "string" },
+    category: { type: "string" },
+    agent: { type: "string" },
+    format: { type: "string" },
+    is_template: { type: "boolean" },
+    version: { type: "number" },
+    created_at: { type: "string" },
+    updated_at: { type: "string" },
+    synced_at: { type: "string", nullable: true }
+  }
+};
+var profileIdentitySchema = {
+  type: "object",
+  required: ["id", "name", "slug", "created_at", "updated_at"],
+  properties: {
+    id: { type: "string" },
+    name: { type: "string" },
+    slug: { type: "string" },
+    created_at: { type: "string" },
+    updated_at: { type: "string" }
+  }
+};
+var machineSchema = {
+  type: "object",
+  required: ["id", "hostname", "os", "arch", "last_applied_at", "created_at"],
+  properties: {
+    id: { type: "string" },
+    hostname: { type: "string" },
+    os: { type: "string", nullable: true },
+    arch: { type: "string", nullable: true },
+    last_applied_at: { type: "string", nullable: true },
+    created_at: { type: "string" }
+  }
+};
+var snapshotSchema = {
+  type: "object",
+  required: ["id", "config_id", "content", "version", "created_at"],
+  properties: {
+    id: { type: "string" },
+    config_id: { type: "string" },
+    content: { type: "string" },
+    version: { type: "number" },
+    created_at: { type: "string" }
+  }
+};
+var limitParameter = { name: "limit", in: "query", schema: { type: "integer", minimum: 1, maximum: 100 } };
+var cursorParameter = { name: "cursor", in: "query", schema: { type: "integer", minimum: 0, maximum: 1e5 } };
+var identityViewParameter = {
+  name: "view",
+  in: "query",
+  description: "Use identity for a metadata-only projection that omits instruction content, paths, outputs, and private profile fields.",
+  schema: { type: "string", enum: ["identity"] }
+};
+var idempotencyKeyParameter = {
+  name: "Idempotency-Key",
+  in: "header",
+  required: false,
+  description: "Optional visible-ASCII request key (1-255 characters). Replays the first committed response for the same authenticated principal, operation, and canonical JSON body; reuse with a different body returns 409.",
+  schema: { type: "string", minLength: 1, maxLength: 255, pattern: "^[!-~]+$" }
+};
+var idempotencyConflictResponse = {
+  description: "The Idempotency-Key was already used for a different request body.",
+  content: {
+    "application/json": {
+      schema: {
+        type: "object",
+        required: ["error", "code"],
+        properties: {
+          error: { type: "string" },
+          code: { type: "string", const: "IDEMPOTENCY_KEY_REUSED" }
+        }
+      }
+    }
+  }
+};
 function buildV1OpenApiDocument(version = getPackageVersion()) {
   return {
     openapi: "3.1.0",
@@ -8717,7 +9120,11 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
       },
       schemas: {
         Config: configSchema,
+        ConfigIdentity: configIdentitySchema,
         Profile: profileSchema,
+        ProfileIdentity: profileIdentitySchema,
+        Machine: machineSchema,
+        ConfigSnapshot: snapshotSchema,
         CreateConfigInput: {
           type: "object",
           required: ["name", "category", "content"],
@@ -8738,12 +9145,17 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           type: "object",
           properties: {
             name: { type: "string" },
+            kind: { type: "string" },
             category: { type: "string" },
             agent: { type: "string" },
+            target_path: { type: "string", nullable: true },
+            outputs: { type: "array", items: { type: "object" } },
+            format: { type: "string" },
             content: { type: "string" },
-            description: { type: "string" },
+            description: { type: "string", nullable: true },
             tags: { type: "array", items: { type: "string" } },
-            is_template: { type: "boolean" }
+            is_template: { type: "boolean" },
+            synced_at: { type: "string", nullable: true }
           }
         },
         CreateProfileInput: {
@@ -8756,6 +9168,38 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             variables: { type: "object" }
           }
         },
+        UpdateProfileInput: {
+          type: "object",
+          properties: {
+            name: { type: "string" },
+            description: { type: "string", nullable: true },
+            selectors: { type: "object" },
+            variables: { type: "object" }
+          }
+        },
+        PruneSnapshotsInput: {
+          type: "object",
+          properties: {
+            keep: { type: "integer", minimum: 0, default: 10 }
+          }
+        },
+        MachineAppliedInput: {
+          type: "object",
+          required: ["hostname"],
+          properties: {
+            hostname: { type: "string" }
+          }
+        },
+        FeedbackInput: {
+          type: "object",
+          required: ["message"],
+          properties: {
+            message: { type: "string" },
+            email: { type: "string" },
+            category: { type: "string" },
+            version: { type: "string" }
+          }
+        },
         AddProfileConfigInput: {
           type: "object",
           required: ["config_id"],
@@ -8890,7 +9334,111 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           type: "object",
           required: ["items", "total", "limit", "cursor", "next_cursor", "has_more", "complete", "truncated", "source_bounded"],
           properties: {
+            configs: { type: "array", items: { $ref: "#/components/schemas/Config" } },
             items: { type: "array", items: { $ref: "#/components/schemas/Config" } },
+            count: { type: "number" },
+            total: { type: "number" },
+            limit: { type: "number" },
+            cursor: { type: "number" },
+            next_cursor: { type: "number", nullable: true },
+            has_more: { type: "boolean" },
+            complete: { type: "boolean" },
+            truncated: { type: "boolean", const: false },
+            source_bounded: { type: "boolean" }
+          }
+        },
+        BoundedConfigIdentityPage: {
+          type: "object",
+          required: ["items", "total", "limit", "cursor", "next_cursor", "has_more", "complete", "truncated", "source_bounded"],
+          properties: {
+            configs: { type: "array", items: { $ref: "#/components/schemas/ConfigIdentity" } },
+            items: { type: "array", items: { $ref: "#/components/schemas/ConfigIdentity" } },
+            count: { type: "number" },
+            total: { type: "number" },
+            limit: { type: "number" },
+            cursor: { type: "number" },
+            next_cursor: { type: "number", nullable: true },
+            has_more: { type: "boolean" },
+            complete: { type: "boolean" },
+            truncated: { type: "boolean", const: false },
+            source_bounded: { type: "boolean" }
+          }
+        },
+        BoundedProfileIdentityPage: {
+          type: "object",
+          required: ["items", "total", "limit", "cursor", "next_cursor", "has_more", "complete", "truncated", "source_bounded"],
+          properties: {
+            profiles: { type: "array", items: { $ref: "#/components/schemas/ProfileIdentity" } },
+            items: { type: "array", items: { $ref: "#/components/schemas/ProfileIdentity" } },
+            count: { type: "number" },
+            total: { type: "number" },
+            limit: { type: "number" },
+            cursor: { type: "number" },
+            next_cursor: { type: "number", nullable: true },
+            has_more: { type: "boolean" },
+            complete: { type: "boolean" },
+            truncated: { type: "boolean", const: false },
+            source_bounded: { type: "boolean" }
+          }
+        },
+        BoundedSnapshotPage: {
+          type: "object",
+          required: ["items", "total", "limit", "cursor", "next_cursor", "has_more", "complete", "truncated", "source_bounded"],
+          properties: {
+            snapshots: { type: "array", items: { $ref: "#/components/schemas/ConfigSnapshot" } },
+            items: { type: "array", items: { $ref: "#/components/schemas/ConfigSnapshot" } },
+            count: { type: "number" },
+            total: { type: "number" },
+            limit: { type: "number" },
+            cursor: { type: "number" },
+            next_cursor: { type: "number", nullable: true },
+            has_more: { type: "boolean" },
+            complete: { type: "boolean" },
+            truncated: { type: "boolean", const: false },
+            source_bounded: { type: "boolean" }
+          }
+        },
+        BoundedMachinePage: {
+          type: "object",
+          required: ["items", "total", "limit", "cursor", "next_cursor", "has_more", "complete", "truncated", "source_bounded"],
+          properties: {
+            machines: { type: "array", items: { $ref: "#/components/schemas/Machine" } },
+            items: { type: "array", items: { $ref: "#/components/schemas/Machine" } },
+            count: { type: "number" },
+            total: { type: "number" },
+            limit: { type: "number" },
+            cursor: { type: "number" },
+            next_cursor: { type: "number", nullable: true },
+            has_more: { type: "boolean" },
+            complete: { type: "boolean" },
+            truncated: { type: "boolean", const: false },
+            source_bounded: { type: "boolean" }
+          }
+        },
+        BoundedProfileConfigBindingPage: {
+          type: "object",
+          required: ["items", "total", "limit", "cursor", "next_cursor", "has_more", "complete", "truncated", "source_bounded"],
+          properties: {
+            bindings: { type: "array", items: { $ref: "#/components/schemas/ProfileConfigBinding" } },
+            items: { type: "array", items: { $ref: "#/components/schemas/ProfileConfigBinding" } },
+            count: { type: "number" },
+            total: { type: "number" },
+            limit: { type: "number" },
+            cursor: { type: "number" },
+            next_cursor: { type: "number", nullable: true },
+            has_more: { type: "boolean" },
+            complete: { type: "boolean" },
+            truncated: { type: "boolean", const: false },
+            source_bounded: { type: "boolean" }
+          }
+        },
+        BoundedProfileAssetBindingPage: {
+          type: "object",
+          required: ["items", "total", "limit", "cursor", "next_cursor", "has_more", "complete", "truncated", "source_bounded"],
+          properties: {
+            assets: { type: "array", items: { $ref: "#/components/schemas/ProfileAssetBinding" } },
+            items: { type: "array", items: { $ref: "#/components/schemas/ProfileAssetBinding" } },
+            count: { type: "number" },
             total: { type: "number" },
             limit: { type: "number" },
             cursor: { type: "number" },
@@ -8934,18 +9482,20 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             { name: "category", in: "query", schema: { type: "string" } },
             { name: "agent", in: "query", schema: { type: "string" } },
             { name: "kind", in: "query", schema: { type: "string" } },
-            { name: "search", in: "query", schema: { type: "string" } }
+            { name: "search", in: "query", schema: { type: "string", maxLength: 512 } },
+            limitParameter,
+            cursorParameter,
+            identityViewParameter
           ],
           responses: {
             "200": {
               content: {
                 "application/json": {
                   schema: {
-                    type: "object",
-                    properties: {
-                      configs: { type: "array", items: { $ref: "#/components/schemas/Config" } },
-                      count: { type: "number" }
-                    }
+                    oneOf: [
+                      { $ref: "#/components/schemas/BoundedConfigPage" },
+                      { $ref: "#/components/schemas/BoundedConfigIdentityPage" }
+                    ]
                   }
                 }
               }
@@ -8955,6 +9505,7 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
         post: {
           operationId: "createConfig",
           summary: "Create a config",
+          parameters: [idempotencyKeyParameter],
           requestBody: {
             required: true,
             content: { "application/json": { schema: { $ref: "#/components/schemas/CreateConfigInput" } } }
@@ -8966,7 +9517,8 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
                   schema: { type: "object", properties: { config: { $ref: "#/components/schemas/Config" } } }
                 }
               }
-            }
+            },
+            "409": idempotencyConflictResponse
           }
         }
       },
@@ -9003,6 +9555,24 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
             }
           }
         },
+        put: {
+          operationId: "putConfig",
+          summary: "Update a config via PUT",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/UpdateConfigInput" } } }
+          },
+          responses: {
+            "200": {
+              content: {
+                "application/json": {
+                  schema: { type: "object", properties: { config: { $ref: "#/components/schemas/Config" } } }
+                }
+              }
+            }
+          }
+        },
         delete: {
           operationId: "deleteConfig",
           summary: "Delete a config",
@@ -9022,29 +9592,72 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
         get: {
           operationId: "listSnapshots",
           summary: "List a config's version snapshots",
-          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
-          responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { snapshots: { type: "array", items: { type: "object" } }, count: { type: "number" } } } } } } }
+          parameters: [
+            { name: "id", in: "path", required: true, schema: { type: "string" } },
+            limitParameter,
+            cursorParameter
+          ],
+          responses: { "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/BoundedSnapshotPage" } } } } }
         },
         post: {
           operationId: "createSnapshot",
           summary: "Snapshot a config's current content",
+          parameters: [
+            { name: "id", in: "path", required: true, schema: { type: "string" } },
+            idempotencyKeyParameter
+          ],
+          requestBody: {
+            required: false,
+            content: { "application/json": { schema: { type: "object", properties: { content: { type: "string" }, version: { type: "integer" } } } } }
+          },
+          responses: {
+            "201": { content: { "application/json": { schema: { type: "object", properties: { snapshot: { $ref: "#/components/schemas/ConfigSnapshot" } } } } } },
+            "409": idempotencyConflictResponse
+          }
+        }
+      },
+      "/v1/configs/{id}/snapshots/prune": {
+        post: {
+          operationId: "pruneSnapshots",
+          summary: "Prune older snapshots for a config",
           parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
-          responses: { "201": { content: { "application/json": { schema: { type: "object", properties: { snapshot: { type: "object" } } } } } } }
+          requestBody: {
+            required: false,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/PruneSnapshotsInput" } } }
+          },
+          responses: {
+            "200": { content: { "application/json": { schema: { type: "object", required: ["pruned"], properties: { pruned: { type: "integer" } } } } } }
+          }
+        }
+      },
+      "/v1/configs/{id}/snapshots/{version}": {
+        get: {
+          operationId: "getSnapshotByVersion",
+          summary: "Get one config snapshot by version",
+          parameters: [
+            { name: "id", in: "path", required: true, schema: { type: "string" } },
+            { name: "version", in: "path", required: true, schema: { type: "integer" } }
+          ],
+          responses: {
+            "200": { content: { "application/json": { schema: { type: "object", properties: { snapshot: { $ref: "#/components/schemas/ConfigSnapshot" } } } } } }
+          }
         }
       },
       "/v1/profiles": {
         get: {
           operationId: "listProfiles",
           summary: "List profiles with producer-side bounds",
-          parameters: [
-            { name: "limit", in: "query", schema: { type: "integer", minimum: 1, maximum: 100 } },
-            { name: "cursor", in: "query", schema: { type: "integer", minimum: 0 } }
-          ],
+          parameters: [limitParameter, cursorParameter, identityViewParameter],
           responses: {
             "200": {
               content: {
                 "application/json": {
-                  schema: { $ref: "#/components/schemas/BoundedProfilePage" }
+                  schema: {
+                    oneOf: [
+                      { $ref: "#/components/schemas/BoundedProfilePage" },
+                      { $ref: "#/components/schemas/BoundedProfileIdentityPage" }
+                    ]
+                  }
                 }
               }
             }
@@ -9053,11 +9666,15 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
         post: {
           operationId: "createProfile",
           summary: "Create a profile",
+          parameters: [idempotencyKeyParameter],
           requestBody: {
             required: true,
             content: { "application/json": { schema: { $ref: "#/components/schemas/CreateProfileInput" } } }
           },
-          responses: { "201": { content: { "application/json": { schema: { type: "object", properties: { profile: { $ref: "#/components/schemas/Profile" } } } } } } }
+          responses: {
+            "201": { content: { "application/json": { schema: { type: "object", properties: { profile: { $ref: "#/components/schemas/Profile" } } } } } },
+            "409": idempotencyConflictResponse
+          }
         }
       },
       "/v1/profiles/resolve": {
@@ -9092,6 +9709,31 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           ],
           responses: { "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/ProfileShowResponse" } } } } }
         },
+        patch: {
+          operationId: "updateProfile",
+          summary: "Update a profile",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/UpdateProfileInput" } } }
+          },
+          responses: {
+            "200": { content: { "application/json": { schema: { type: "object", properties: { profile: { $ref: "#/components/schemas/Profile" } } } } } }
+          }
+        },
+        put: {
+          operationId: "putProfile",
+          summary: "Update a profile via PUT",
+          description: "Compatibility update route. Like PATCH, omitted properties remain unchanged.",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/UpdateProfileInput" } } }
+          },
+          responses: {
+            "200": { content: { "application/json": { schema: { type: "object", properties: { profile: { $ref: "#/components/schemas/Profile" } } } } } }
+          }
+        },
         delete: {
           operationId: "deleteProfile",
           summary: "Delete a profile",
@@ -9106,7 +9748,8 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           description: "Requires an API key with the `instructions:write` scope.",
           security: [{ apiKey: [] }],
           parameters: [
-            { name: "id", in: "path", required: true, schema: { type: "string" } }
+            { name: "id", in: "path", required: true, schema: { type: "string" } },
+            idempotencyKeyParameter
           ],
           requestBody: {
             required: true,
@@ -9123,7 +9766,8 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
                   schema: { $ref: "#/components/schemas/ProfileConfigAddedResponse" }
                 }
               }
-            }
+            },
+            "409": idempotencyConflictResponse
           }
         }
       },
@@ -9134,13 +9778,17 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           security: [{ apiKey: [] }],
           parameters: [
             { name: "id", in: "path", required: true, schema: { type: "string" } },
-            { name: "configId", in: "path", required: true, schema: { type: "string" } }
+            { name: "configId", in: "path", required: true, schema: { type: "string" } },
+            idempotencyKeyParameter
           ],
           requestBody: {
             required: true,
             content: { "application/json": { schema: { type: "object", required: ["binding"], properties: { binding: { $ref: "#/components/schemas/ProfileConfigBindingSpec" } } } } }
           },
-          responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { binding: { $ref: "#/components/schemas/ProfileConfigBinding" } } } } } } }
+          responses: {
+            "200": { content: { "application/json": { schema: { type: "object", properties: { binding: { $ref: "#/components/schemas/ProfileConfigBinding" } } } } } },
+            "409": idempotencyConflictResponse
+          }
         },
         delete: {
           operationId: "removeConfigFromProfile",
@@ -9166,24 +9814,38 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
         get: {
           operationId: "getProfileConfigBindings",
           summary: "List schema-versioned config bindings for a profile",
-          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
-          responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { bindings: { type: "array", items: { $ref: "#/components/schemas/ProfileConfigBinding" } } } } } } } }
+          parameters: [
+            { name: "id", in: "path", required: true, schema: { type: "string" } },
+            limitParameter,
+            cursorParameter
+          ],
+          responses: { "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/BoundedProfileConfigBindingPage" } } } } }
         }
       },
       "/v1/profiles/{id}/assets": {
         get: {
           operationId: "getProfileAssetBindings",
           summary: "List typed asset bindings for a profile",
-          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
-          responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { assets: { type: "array", items: { $ref: "#/components/schemas/ProfileAssetBinding" } } } } } } } }
+          parameters: [
+            { name: "id", in: "path", required: true, schema: { type: "string" } },
+            limitParameter,
+            cursorParameter
+          ],
+          responses: { "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/BoundedProfileAssetBindingPage" } } } } }
         },
         post: {
           operationId: "addAssetToProfile",
           summary: "Add a content-addressed asset binding to a profile",
           security: [{ apiKey: [] }],
-          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          parameters: [
+            { name: "id", in: "path", required: true, schema: { type: "string" } },
+            idempotencyKeyParameter
+          ],
           requestBody: { required: true, content: { "application/json": { schema: { $ref: "#/components/schemas/AddProfileAssetInput" } } } },
-          responses: { "201": { content: { "application/json": { schema: { type: "object", properties: { asset: { $ref: "#/components/schemas/ProfileAssetBinding" } } } } } } }
+          responses: {
+            "201": { content: { "application/json": { schema: { type: "object", properties: { asset: { $ref: "#/components/schemas/ProfileAssetBinding" } } } } } },
+            "409": idempotencyConflictResponse
+          }
         }
       },
       "/v1/profiles/{id}/assets/{assetKey}": {
@@ -9193,10 +9855,14 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           security: [{ apiKey: [] }],
           parameters: [
             { name: "id", in: "path", required: true, schema: { type: "string" } },
-            { name: "assetKey", in: "path", required: true, schema: { type: "string" } }
+            { name: "assetKey", in: "path", required: true, schema: { type: "string" } },
+            idempotencyKeyParameter
           ],
           requestBody: { required: true, content: { "application/json": { schema: { type: "object", required: ["binding"], properties: { binding: { $ref: "#/components/schemas/ProfileAssetBindingSpec" } } } } } },
-          responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { asset: { $ref: "#/components/schemas/ProfileAssetBinding" } } } } } } }
+          responses: {
+            "200": { content: { "application/json": { schema: { type: "object", properties: { asset: { $ref: "#/components/schemas/ProfileAssetBinding" } } } } } },
+            "409": idempotencyConflictResponse
+          }
         },
         delete: {
           operationId: "removeAssetFromProfile",
@@ -9209,6 +9875,77 @@ function buildV1OpenApiDocument(version = getPackageVersion()) {
           responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { removed: { type: "boolean", const: true } } } } } } }
         }
       },
+      "/v1/snapshots/{id}": {
+        get: {
+          operationId: "getSnapshot",
+          summary: "Get a snapshot by id",
+          parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+          responses: {
+            "200": { content: { "application/json": { schema: { type: "object", properties: { snapshot: { $ref: "#/components/schemas/ConfigSnapshot" } } } } } }
+          }
+        }
+      },
+      "/v1/machines/applied": {
+        post: {
+          operationId: "markMachineApplied",
+          summary: "Mark a machine as having applied its resolved instructions",
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/MachineAppliedInput" } } }
+          },
+          responses: {
+            "200": { content: { "application/json": { schema: { type: "object", required: ["updated"], properties: { updated: { type: "boolean", const: true } } } } } }
+          }
+        }
+      },
+      "/v1/machines": {
+        get: {
+          operationId: "listMachines",
+          summary: "List registered machines with producer-side bounds",
+          parameters: [limitParameter, cursorParameter, identityViewParameter],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/BoundedMachinePage" } } } }
+          }
+        },
+        post: {
+          operationId: "registerMachine",
+          summary: "Register or refresh a machine",
+          parameters: [idempotencyKeyParameter],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  required: ["hostname"],
+                  properties: {
+                    hostname: { type: "string" },
+                    os: { type: "string", nullable: true },
+                    arch: { type: "string", nullable: true }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            "201": { content: { "application/json": { schema: { type: "object", properties: { machine: { $ref: "#/components/schemas/Machine" } } } } } },
+            "409": idempotencyConflictResponse
+          }
+        }
+      },
+      "/v1/feedback": {
+        post: {
+          operationId: "createFeedback",
+          summary: "Submit Instructions feedback",
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/FeedbackInput" } } }
+          },
+          responses: {
+            "201": { content: { "application/json": { schema: { type: "object", required: ["ok"], properties: { ok: { type: "boolean", const: true } } } } } }
+          }
+        }
+      },
       "/v1/stats": {
         get: {
           operationId: "getStats",
@@ -9241,7 +9978,7 @@ if (process.argv.includes("--version") || process.argv.includes("-V")) {
 if (process.argv.includes("--help") || process.argv.includes("-h")) {
   console.log(`Usage: instructions-serve [options]
 
-HTTP API server for @hasna/instructions (backend: sqlite or postgresql).
+HTTP API server for @hasna/instructions (PostgreSQL is required for /v1).
 
 Options:
   -V, --version  output the version number
@@ -9252,26 +9989,28 @@ Environment:
   PORT / INSTRUCTIONS_PORT        HTTP port (default: 3457)
   HOST / INSTRUCTIONS_HOST        bind host (default: localhost)
   HASNA_INSTRUCTIONS_DATABASE_URL / INSTRUCTIONS_DATABASE_URL / DATABASE_URL
-                                  postgresql backend URL (enables the cloud backend)`);
+                                  PostgreSQL backend URL (required for /v1)`);
   process.exit(0);
 }
 var PORT = Number(process.env["PORT"] ?? process.env["INSTRUCTIONS_PORT"] ?? 3457);
 var app = new Hono2;
 app.use("*", cors());
 function serviceBackend() {
-  return isPostgresBackendEnabled() ? "postgresql" : "sqlite";
+  return isPostgresBackendEnabled() ? "postgresql" : "unconfigured";
 }
 app.get("/health", (c) => c.json({ status: "ok", version: getPackageVersion(), backend: serviceBackend(), name: "instructions" }));
 app.get("/version", (c) => c.json({ status: "ok", version: getPackageVersion(), backend: serviceBackend(), name: "instructions" }));
 app.get("/ready", async (c) => {
   const version = getPackageVersion();
   const backend2 = serviceBackend();
-  if (backend2 === "postgresql") {
-    try {
-      await pingCloud();
-    } catch (e) {
-      return c.json({ status: "unavailable", version, backend: backend2, error: e.message }, 503);
-    }
+  if (backend2 !== "postgresql") {
+    return c.json({ status: "unavailable", version, backend: backend2, code: "SERVER_BACKEND_UNCONFIGURED" }, 503);
+  }
+  try {
+    await pingCloud();
+  } catch {
+    console.error("instructions ready: database unavailable");
+    return c.json({ status: "unavailable", version, backend: backend2, code: "DATABASE_UNAVAILABLE" }, 503);
   }
   return c.json({ status: "ready", version, backend: backend2 });
 });
@@ -9282,18 +10021,27 @@ app.use("/v1/*", async (c, next) => {
   let mw;
   try {
     mw = getHonoAuthMiddleware([isWrite ? "instructions:write" : "instructions:read"]);
-  } catch (e) {
-    return c.json({ error: e.message }, 503);
+  } catch {
+    return c.json({ error: "Instructions API is unavailable", code: "API_AUTH_UNCONFIGURED" }, 503);
   }
   return mw(c, next);
 });
 app.all("/v1/*", async (c) => {
-  const res = await handleV1Request(c.req.raw, new URL(c.req.url));
+  const res = await handleV1Request(c.req.raw, new URL(c.req.url), {
+    principal: c.get("apiKey")
+  });
   return res ?? c.json({ error: "Not found" }, 404);
 });
 var HOST = process.env["HOST"] ?? process.env["INSTRUCTIONS_HOST"] ?? "localhost";
-console.log(`instructions-serve listening on http://${HOST}:${PORT} (backend: ${serviceBackend()})`);
-var server_default = { port: PORT, hostname: HOST, fetch: app.fetch };
+var serverOptions = { port: PORT, hostname: HOST, fetch: app.fetch };
+if (import.meta.main) {
+  console.log(`instructions-serve listening on http://${HOST}:${PORT} (backend: ${serviceBackend()})`);
+  Bun.serve(serverOptions);
+}
+var server_default = app;
 export {
-  server_default as default
+  serviceBackend,
+  serverOptions,
+  server_default as default,
+  app
 };