@hasna/instructions 0.6.1 → 0.7.0

package/dist/chunks/{index-1hpwskwd.js → index-7m4j8a33.js}

@@ -15,7 +15,14 @@ import {
   isTemplate,
   renderTemplate,
   renderTemplatePreview
-} from "./index-pkscjnj5.js";
+} from "./index-n3fjspr0.js";
+import {
+  INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS,
+  clientTransportEnvKeys,
+  instructionsLocalModeNotice,
+  instructionsResolverInputs,
+  selectsInstructionsLocalStore
+} from "./index-fpeyzn3n.js";
 import {
   __export,
   __require
@@ -24,6 +31,7 @@ import {
 // src/lib/compact-output.ts
 var DEFAULT_LIST_LIMIT = 20;
 var MAX_LIST_LIMIT = 100;
+var MAX_LIST_CURSOR = 1e5;
 function parseLimit(value, fallback = DEFAULT_LIST_LIMIT, max = MAX_LIST_LIMIT) {
   const parsed = typeof value === "number" ? value : Number.parseInt(String(value ?? ""), 10);
   if (!Number.isFinite(parsed) || parsed <= 0)
@@ -34,7 +42,7 @@ function parseCursor(value) {
   const parsed = typeof value === "number" ? value : Number.parseInt(String(value ?? ""), 10);
   if (!Number.isFinite(parsed) || parsed < 0)
     return 0;
-  return Math.floor(parsed);
+  return Math.min(Math.floor(parsed), MAX_LIST_CURSOR);
 }
 function paginate(items, opts = {}) {
   const limit = parseLimit(opts.limit, opts.defaultLimit ?? DEFAULT_LIST_LIMIT, opts.maxLimit ?? MAX_LIST_LIMIT);
@@ -110,9 +118,9 @@ import { createHash as createHash6 } from "crypto";
 
 // src/lib/session-render.ts
 import { createHash as createHash5 } from "crypto";
-import { existsSync as existsSync5, readFileSync as readFileSync4, realpathSync as realpathSync2, statSync as statSync3 } from "fs";
-import { homedir as homedir5 } from "os";
-import { basename as basename4, dirname as dirname4, extname as extname2, isAbsolute as isAbsolute3, join as join6, parse as parse2, posix as posix2, relative as relative2, resolve as resolve8 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync4, realpathSync as realpathSync2, statSync as statSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { basename as basename4, dirname as dirname4, extname as extname2, isAbsolute as isAbsolute3, join as join5, parse as parse2, posix as posix2, relative as relative2, resolve as resolve6 } from "path";
 
 // src/lib/codewith-shared-todos-storage-standard.ts
 var CODEWITH_SHARED_TODOS_STORAGE_STANDARD_SLUG = "codewith-shared-todos-storage-standard";
@@ -8161,105 +8169,6 @@ function detectClaudeAuthorityConflicts(targetHome, ownedAuthorities = []) {
     reason: knownLegacy ? "Claude target contains unmanaged legacy AGENTS.md with no-worktree directives; migrate or remove it through an owned authority path before applying." : "Claude target contains unmanaged AGENTS.md with unknown authority content; refusing to guess whether it conflicts with the managed Claude render."
   }];
 }
-// src/lib/raw-store-root.ts
-import { resolve as resolve7 } from "path";
-
-// src/lib/app-home.ts
-import { existsSync as existsSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join5, resolve as resolve6 } from "path";
-import { homedir as pathsResolverHomedir2 } from "os";
-import { join as pathsResolverJoin2 } from "path";
-var PATHS_RESOLVER_KIND_ENV2 = {
-  config: "HASNA_CONFIG_HOME",
-  data: "HASNA_DATA_HOME",
-  state: "HASNA_STATE_HOME",
-  cache: "HASNA_CACHE_HOME"
-};
-var PATHS_RESOLVER_APP_SLUG_RE2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-function pathsResolverAssertApp2(app) {
-  if (typeof app !== "string" || app.length === 0) {
-    throw new TypeError("paths: app must be a non-empty string");
-  }
-  if (!PATHS_RESOLVER_APP_SLUG_RE2.test(app)) {
-    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
-  }
-}
-function pathsResolverAssertKind2(kind) {
-  if (!Object.keys(PATHS_RESOLVER_KIND_ENV2).includes(kind)) {
-    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV2).join(", ")}`);
-  }
-}
-function pathsResolverBaseDir2(kind, options) {
-  pathsResolverAssertKind2(kind);
-  const env = options.env ?? process.env;
-  const override = env[PATHS_RESOLVER_KIND_ENV2[kind]];
-  if (typeof override === "string" && override.length > 0)
-    return override;
-  const home = options.home ?? pathsResolverHomedir2();
-  const platform = options.platform ?? process.platform;
-  if (platform === "darwin") {
-    switch (kind) {
-      case "config":
-      case "data":
-        return pathsResolverJoin2(home, "Library", "Application Support", "Hasna");
-      case "cache":
-        return pathsResolverJoin2(home, "Library", "Caches", "Hasna");
-      case "state":
-        return pathsResolverJoin2(home, "Library", "Logs", "Hasna");
-    }
-  }
-  switch (kind) {
-    case "config":
-      return pathsResolverJoin2(home, ".config", "hasna");
-    case "data":
-      return pathsResolverJoin2(home, ".local", "share", "hasna");
-    case "state":
-      return pathsResolverJoin2(home, ".local", "state", "hasna");
-    case "cache":
-      return pathsResolverJoin2(home, ".cache", "hasna");
-  }
-}
-function pathsResolverResolve2(kind, options) {
-  pathsResolverAssertApp2(options.app);
-  const appSegment = options.internal === true ? pathsResolverJoin2("internal", options.app) : options.app;
-  return pathsResolverJoin2(pathsResolverBaseDir2(kind, options), appSegment);
-}
-function configDir(options) {
-  return pathsResolverResolve2("config", options);
-}
-var HASNA_CONFIGS_HOME_ENV = "HASNA_CONFIGS_HOME";
-function homeDir3(env = process.env) {
-  return env["HOME"] || env["USERPROFILE"] || homedir4();
-}
-function legacyStoreHome(env = process.env) {
-  return resolve6(join5(homeDir3(env), ".hasna", "instructions"));
-}
-function resolverStoreHome(env = process.env) {
-  return configDir({ app: "configs", env, home: env.HOME || env.USERPROFILE || homedir4() });
-}
-function adoptResolverStoreHome(resolved, env = process.env) {
-  const override = env.HASNA_CONFIG_HOME;
-  if (typeof override === "string" && override.trim().length > 0)
-    return true;
-  return existsSync4(join5(resolved, "instructions.db"));
-}
-function exactStoreHome(env = process.env) {
-  const v = env[HASNA_CONFIGS_HOME_ENV];
-  return v && v.trim() ? v.trim() : undefined;
-}
-function getConfigsStoreHome(env = process.env) {
-  const exact = exactStoreHome(env);
-  if (exact)
-    return resolve6(exact);
-  const resolved = resolverStoreHome(env);
-  return adoptResolverStoreHome(resolved, env) ? resolve6(resolved) : legacyStoreHome(env);
-}
-
-// src/lib/raw-store-root.ts
-function getRawStoreRoot(env = process.env) {
-  return resolve7(getConfigsStoreHome(env));
-}
 
 // src/lib/session-render.ts
 var ANTIGRAVITY_RULE_FILE_CHAR_LIMIT = 12000;
@@ -8542,13 +8451,13 @@ function yamlQuote2(value) {
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
 }
 function defaultTargetHome(tool, profile, sessionId) {
-  const home = process.env["HOME"] || homedir5();
-  return join6(home, ".hasna", "accounts", "profiles", tool, slug(profile));
+  const home = process.env["HOME"] || homedir4();
+  return join5(home, ".hasna", "accounts", "profiles", tool, slug(profile));
 }
 function joinTarget(targetHome, relativePath) {
   const safeTargetHome = assertSafeTargetRoot(targetHome);
   const safeRelativePath2 = assertSafeRelativePath(relativePath);
-  return join6(safeTargetHome, ...safeRelativePath2.split("/"));
+  return join5(safeTargetHome, ...safeRelativePath2.split("/"));
 }
 function makeFile(targetHome, relativePath, role, content, sourceIds) {
   const safeTargetHome = assertSafeTargetRoot(targetHome);
@@ -9118,7 +9027,7 @@ function buildOpenCodeFiles(targetHome, adapter, profile, sources, providerConfi
     ...sources.flatMap((source) => source.resolvedRules.map((rule) => rule.id))
   ]);
   const existingConfigPath = joinTarget(targetHome, adapter.configFile);
-  const selectedConfig = existsSync5(existingConfigPath) ? readOpenCodeConfig(readFileSync4(existingConfigPath, "utf8"), existingConfigPath) : providerConfig ? readOpenCodeConfig(providerConfig.content, providerConfig.sourceId) : {};
+  const selectedConfig = existsSync4(existingConfigPath) ? readOpenCodeConfig(readFileSync4(existingConfigPath, "utf8"), existingConfigPath) : providerConfig ? readOpenCodeConfig(providerConfig.content, providerConfig.sourceId) : {};
   const preservedInstructions = normalizeOpenCodeInstructions(selectedConfig["instructions"]).filter((path) => !pathIsManagedOpenCodeInstruction(path, adapter.managedDir));
   const config = {
     ...selectedConfig,
@@ -9321,7 +9230,7 @@ function adapterFor(input) {
   return gatedNativeImports ? CODEWITH_NATIVE_ADAPTER : CODEWITH_FLATTENED_ADAPTER;
 }
 function getHomeDir() {
-  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir5();
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir4();
 }
 function cleanSessionPathInput(path) {
   const trimmed = path.trim();
@@ -9336,16 +9245,16 @@ function resolveSessionPath(path) {
     throw new Error("Session render path cannot be empty.");
   const home = getHomeDir();
   if (cleaned === "~")
-    return resolve8(home);
+    return resolve6(home);
   if (cleaned.startsWith("~/"))
-    return resolve8(home, cleaned.slice(2));
+    return resolve6(home, cleaned.slice(2));
   if (cleaned === "{{HOME}}" || cleaned === "${HOME}")
-    return resolve8(home);
+    return resolve6(home);
   if (cleaned.startsWith("{{HOME}}/"))
-    return resolve8(home, cleaned.slice("{{HOME}}/".length));
+    return resolve6(home, cleaned.slice("{{HOME}}/".length));
   if (cleaned.startsWith("${HOME}/"))
-    return resolve8(home, cleaned.slice("${HOME}/".length));
-  return resolve8(cleaned);
+    return resolve6(home, cleaned.slice("${HOME}/".length));
+  return resolve6(cleaned);
 }
 function assertSafeRelativePath(relativePath) {
   if (!relativePath.trim())
@@ -9361,7 +9270,7 @@ function assertSafeRelativePath(relativePath) {
 function assertSafeTargetRoot(targetHome) {
   if (!isAbsolute3(targetHome))
     throw new Error(`Session render target must be an absolute path: ${targetHome}`);
-  const normalized = resolve8(targetHome);
+  const normalized = resolve6(targetHome);
   if (normalized === parse2(normalized).root) {
     throw new Error(`Session render target cannot be the filesystem root: ${targetHome}`);
   }
@@ -9596,7 +9505,7 @@ function planSessionRender(input) {
         sourceId: input.providerConfig.sourceId,
         selectedPayloadSha256: sha2565(input.providerConfig.content),
         renderedPayloadSha256: files.find((file) => file.relativePath === adapter.configFile)?.sha256 ?? sha2565(input.providerConfig.content),
-        selected: !existsSync5(joinTarget(targetHome, adapter.configFile))
+        selected: !existsSync4(joinTarget(targetHome, adapter.configFile))
       }
     } : {},
     ...projectContext ? {
@@ -9879,7 +9788,7 @@ ${item.content.trimEnd()}`).join(`
 }
 function readIdentitySourcePath(sourcePath, baseDir, sourceId) {
   const resolvedPath = resolveIdentitySourcePath(sourcePath.path, baseDir, sourceId);
-  if (!existsSync5(resolvedPath)) {
+  if (!existsSync4(resolvedPath)) {
     if (sourcePath.required) {
       throw new Error(`Required identity instruction source path not found for ${sourceId}: ${sourcePath.path}`);
     }
@@ -9902,8 +9811,8 @@ function resolveIdentitySourcePath(path, baseDir, sourceId) {
     throw new Error(`Identity instruction source path cannot be empty for ${sourceId}.`);
   if (cleaned.includes("\\"))
     throw new Error(`Identity instruction source path must use POSIX separators for ${sourceId}: ${path}`);
-  const resolvedPath = isAbsolute3(cleaned) ? resolve8(cleaned) : resolve8(baseDir, cleaned);
-  if (!pathIsInside(resolvedPath, resolve8(baseDir))) {
+  const resolvedPath = isAbsolute3(cleaned) ? resolve6(cleaned) : resolve6(baseDir, cleaned);
+  if (!pathIsInside(resolvedPath, resolve6(baseDir))) {
     throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${path}`);
   }
   return resolvedPath;
@@ -10559,12 +10468,18 @@ function deepFreeze2(value) {
   return Object.freeze(value);
 }
 
-// ../contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.0.2+e8014c875821e0be/node_modules/@hasna/contracts/dist/client/storage.js
+import { isIP } from "net";
+import { spawnSync } from "child_process";
+import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync5 } from "fs";
+import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
 import { createRequire } from "module";
+import { hostname as osHostname } from "os";
+import { isAbsolute as isAbsolute4, join as join6 } from "path";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
-function clientTransportEnvKeys(name) {
+function clientTransportEnvKeys2(name) {
   const envSegment = envToken(name);
   return {
     apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
@@ -10578,46 +10493,6 @@ var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE";
 function credentialPointerEnvKey(name) {
   return `HASNA_${envToken(name)}_API_KEY_REF`;
 }
-var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
-var INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
-var CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
-var AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
-var SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
-var requireSecretsSdk = createRequire(import.meta.url);
-var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-var AUTHORITY_OVERRIDE_HEADERS = new Set([
-  "host",
-  ":authority",
-  "forwarded",
-  "x-forwarded-host",
-  "x-original-host"
-]);
-
-// ../contracts/dist/client/storage.js
-import { isIP } from "net";
-import { spawnSync } from "child_process";
-import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync5 } from "fs";
-import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
-import { createRequire as createRequire2 } from "module";
-import { hostname as osHostname } from "os";
-import { isAbsolute as isAbsolute4, join as join7 } from "path";
-function envToken2(name) {
-  return name.toUpperCase().replace(/-/g, "_");
-}
-function clientTransportEnvKeys2(name) {
-  const envSegment = envToken2(name);
-  return {
-    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
-    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
-  };
-}
-function credentialOverrideEnvKey2(name) {
-  return `HASNA_${envToken2(name)}_API_KEY_OVERRIDE`;
-}
-var CREDENTIAL_PROFILE_ENV_KEY2 = "HASNA_PROFILE";
-function credentialPointerEnvKey2(name) {
-  return `HASNA_${envToken2(name)}_API_KEY_REF`;
-}
 
 class CredentialResolutionError extends Error {
   appName;
@@ -10648,12 +10523,12 @@ var KEYCHAIN_SECURITY_BIN = "/usr/bin/security";
 var KEYCHAIN_SERVICE_PREFIX = "hasna.credentials";
 var KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44;
 var KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4;
-var MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
+var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
 var SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 var SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
 var ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
 var VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
-function homeDir4(env) {
+function homeDir3(env) {
   const home = env.HOME?.trim();
   return home ? home : null;
 }
@@ -10665,15 +10540,15 @@ function hasnaHomeDir(env) {
   const override = absoluteOverride(env, HASNA_HOME_ENV_KEY);
   if (override)
     return override;
-  const home = homeDir4(env);
-  return home ? join7(home, HASNA_HOME_DIR) : null;
+  const home = homeDir3(env);
+  return home ? join6(home, HASNA_HOME_DIR) : null;
 }
 function appConfigDir(name, env) {
   const configRoot = absoluteOverride(env, HASNA_CONFIG_HOME_ENV_KEY);
   if (configRoot)
-    return join7(configRoot, name);
+    return join6(configRoot, name);
   const root = hasnaHomeDir(env);
-  return root ? join7(root, name, CONFIG_SUBDIR) : null;
+  return root ? join6(root, name, CONFIG_SUBDIR) : null;
 }
 function credentialDiskSourceList(name, env, profile = null) {
   if (!SAFE_APP_SLUG.test(name))
@@ -10682,7 +10557,7 @@ function credentialDiskSourceList(name, env, profile = null) {
   if (!directory)
     return [];
   const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
-  return [{ path: join7(directory, file), tier: "disk" }];
+  return [{ path: join6(directory, file), tier: "disk" }];
 }
 function credentialDiskSources(name, env) {
   return credentialDiskSourceList(name, env, null).map((s) => s.path);
@@ -10755,7 +10630,7 @@ function readAppConfigFile(path) {
     const uid = process.getuid?.() ?? process.geteuid?.();
     if (uid !== undefined && before.uid !== uid)
       unsafe("the file is not owned by the current user");
-    if (before.size > MAX_CREDENTIAL_FILE_BYTES2)
+    if (before.size > MAX_CREDENTIAL_FILE_BYTES)
       unsafe("the file exceeds the size limit");
     const bytes = readFileSync5(fd);
     const after = fstatSync2(fd);
@@ -10810,14 +10685,14 @@ function appConfigDiskValue(name, env, keys) {
 }
 function assertUsableCredential(appName, source, value) {
   if (VAULT_POINTER_SHAPE.test(value)) {
-    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey2(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
   }
   if (!ILLEGAL_IN_HEADER_VALUE.test(value))
     return;
   throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
 }
-var INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
-var CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
+var INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+var CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
 var CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE = "caller-supplied CredentialProvider";
 function sealCredential(fields) {
   const { apiKey } = fields;
@@ -10843,13 +10718,13 @@ function sealCredential(fields) {
       configurable: false
     });
   }
-  Object.defineProperty(sealed, INSPECT_CUSTOM2, {
+  Object.defineProperty(sealed, INSPECT_CUSTOM, {
     value: () => ({ ...visible, apiKey: "[redacted]" }),
     enumerable: false,
     writable: false,
     configurable: false
   });
-  Object.defineProperty(sealed, CREDENTIAL_SEAL2, {
+  Object.defineProperty(sealed, CREDENTIAL_SEAL, {
     value: true,
     enumerable: false,
     writable: false,
@@ -10858,7 +10733,7 @@ function sealCredential(fields) {
   return Object.freeze(sealed);
 }
 function isSealedCredential(credential) {
-  return credential[CREDENTIAL_SEAL2] === true;
+  return credential[CREDENTIAL_SEAL] === true;
 }
 function explicitCredential(appName, apiKey) {
   const source = "explicit apiKey option";
@@ -10905,9 +10780,9 @@ function firstEnvValue(env, keys) {
   }
   return null;
 }
-var AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
+var AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
 function isAmbientEnvironment(env) {
-  return env === process.env || env[AMBIENT_ENVIRONMENT2] === true;
+  return env === process.env || env[AMBIENT_ENVIRONMENT] === true;
 }
 function defaultKeychainRunner(argv) {
   const result = spawnSync(KEYCHAIN_SECURITY_BIN, [...argv], {
@@ -10980,9 +10855,9 @@ function snapshotClientEnvironment(name, env) {
   for (const key of [
     ...keys.apiUrlKeys,
     ...keys.apiKeyKeys,
-    credentialOverrideEnvKey2(name),
-    credentialPointerEnvKey2(name),
-    CREDENTIAL_PROFILE_ENV_KEY2,
+    credentialOverrideEnvKey(name),
+    credentialPointerEnvKey(name),
+    CREDENTIAL_PROFILE_ENV_KEY,
     "HOME",
     HASNA_HOME_ENV_KEY,
     HASNA_CONFIG_HOME_ENV_KEY,
@@ -11001,7 +10876,7 @@ function snapshotClientEnvironment(name, env) {
     snapshot[key] = descriptor.value;
   }
   if (ambient) {
-    Object.defineProperty(snapshot, AMBIENT_ENVIRONMENT2, {
+    Object.defineProperty(snapshot, AMBIENT_ENVIRONMENT, {
       value: true,
       enumerable: false,
       writable: false,
@@ -11029,7 +10904,7 @@ function resolveCredential(name, env, options = {}) {
       warning: null
     });
   }
-  const overrideKeyName = credentialOverrideEnvKey2(name);
+  const overrideKeyName = credentialOverrideEnvKey(name);
   const overrideRaw = Object.prototype.hasOwnProperty.call(env, overrideKeyName) ? env[overrideKeyName] : undefined;
   if (overrideRaw !== undefined) {
     const override = overrideRaw.trim();
@@ -11046,7 +10921,7 @@ function resolveCredential(name, env, options = {}) {
       warning: null
     });
   }
-  const pointerKeyName = credentialPointerEnvKey2(name);
+  const pointerKeyName = credentialPointerEnvKey(name);
   const pointerRaw = Object.prototype.hasOwnProperty.call(env, pointerKeyName) ? env[pointerKeyName] : undefined;
   if (pointerRaw !== undefined) {
     const pointer = pointerRaw.trim();
@@ -11069,13 +10944,13 @@ function resolveCredential(name, env, options = {}) {
   if (options.profile !== undefined && !options.profile.trim()) {
     throw new CredentialResolutionError(name, "The explicit profile argument is blank; an explicit identity selection never falls through.", ["explicit profile argument"]);
   }
-  const profileRaw = Object.prototype.hasOwnProperty.call(env, CREDENTIAL_PROFILE_ENV_KEY2) ? env[CREDENTIAL_PROFILE_ENV_KEY2] : undefined;
+  const profileRaw = Object.prototype.hasOwnProperty.call(env, CREDENTIAL_PROFILE_ENV_KEY) ? env[CREDENTIAL_PROFILE_ENV_KEY] : undefined;
   if (profileRaw !== undefined && !profileRaw.trim()) {
-    throw new CredentialResolutionError(name, `${CREDENTIAL_PROFILE_ENV_KEY2} is set but blank.`, [CREDENTIAL_PROFILE_ENV_KEY2]);
+    throw new CredentialResolutionError(name, `${CREDENTIAL_PROFILE_ENV_KEY} is set but blank.`, [CREDENTIAL_PROFILE_ENV_KEY]);
   }
   const profile = options.profile?.trim() || profileRaw?.trim();
   if (profile) {
-    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY2;
+    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
     if (!SAFE_PROFILE.test(profile)) {
       throw new CredentialResolutionError(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
     }
@@ -11094,7 +10969,7 @@ function resolveCredential(name, env, options = {}) {
         });
       }
     }
-    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY2}.`, paths);
+    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
   }
   const definedEnvEntries = apiKeyKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, value: String(env[key]).trim() }));
   const blankEnv = definedEnvEntries.find((entry) => entry.value.length === 0);
@@ -11150,8 +11025,8 @@ function resolveCredential(name, env, options = {}) {
   }
   return null;
 }
-var SECRETS_PACKAGE_SPECIFIER2 = "@hasna/" + "secrets";
-var requireSecretsSdk2 = createRequire2(import.meta.url);
+var SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+var requireSecretsSdk = createRequire(import.meta.url);
 async function completePointerCredential(name, pointerResolution, env = process.env) {
   const vaultKey = pointerResolution.pointerVaultKey;
   const pointerEnvKey = pointerResolution.source;
@@ -11160,7 +11035,7 @@ async function completePointerCredential(name, pointerResolution, env = process.
   }
   let secretsSdk;
   try {
-    secretsSdk = requireSecretsSdk2(SECRETS_PACKAGE_SPECIFIER2);
+    secretsSdk = requireSecretsSdk(SECRETS_PACKAGE_SPECIFIER);
   } catch {
     throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
   }
@@ -11457,8 +11332,8 @@ function authFailureGuidance(credential) {
   return `${origin}, which was re-read from disk on this very call \u2014 so a stale shell is NOT the cause here. ` + `The stored credential is genuinely being rejected: rotate it, or re-run the fleet key distribution ` + `so this machine gets the current key.`;
 }
 var DEFAULT_RETRY_STATUSES = [408, 425, 429, 500, 502, 503, 504];
-var IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-var AUTHORITY_OVERRIDE_HEADERS2 = new Set([
+var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+var AUTHORITY_OVERRIDE_HEADERS = new Set([
   "host",
   ":authority",
   "forwarded",
@@ -11468,7 +11343,7 @@ var AUTHORITY_OVERRIDE_HEADERS2 = new Set([
 function assertNoAuthorityOverrideHeaders(headers, source) {
   if (!headers)
     return;
-  const forbidden = Object.keys(headers).find((name) => AUTHORITY_OVERRIDE_HEADERS2.has(name.trim().toLowerCase()));
+  const forbidden = Object.keys(headers).find((name) => AUTHORITY_OVERRIDE_HEADERS.has(name.trim().toLowerCase()));
   if (forbidden) {
     throw new Error(`Authenticated ${source} headers must not set authority header '${forbidden}'.`);
   }
@@ -11494,7 +11369,7 @@ function appendQuery(path, query) {
     return path;
   return `${path}${path.includes("?") ? "&" : "?"}${qs}`;
 }
-var defaultSleep = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
+var defaultSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 function createHasnaHttpTransportInternal(options, requestBindingProvider) {
   const fetchImpl = options.fetchImpl ?? ((input, init) => fetch(input, init));
   const base = toV1BaseUrl(options.baseUrl);
@@ -11602,7 +11477,7 @@ function createHasnaHttpTransportInternal(options, requestBindingProvider) {
     const upper = method.toUpperCase();
     const rel = appendQuery(path.startsWith("/") ? path : `/${path}`, opts.query);
     const retry = resolveRetry(opts.retry);
-    const methodRetryable = IDEMPOTENT_METHODS2.has(upper) || Boolean(opts.idempotencyKey);
+    const methodRetryable = IDEMPOTENT_METHODS.has(upper) || Boolean(opts.idempotencyKey);
     const maxAttempts = retry && methodRetryable ? retry.retries + 1 : 1;
     const binding = requestBindingProvider ? await requestBindingProvider() : {
       baseUrl: base,
@@ -11779,56 +11654,6 @@ function resolveStorageClient(name, env = process.env, overrides) {
   return { transport: "http", client: createHasnaStorageClient(name, wired.client) };
 }
 
-// src/lib/local-opt-in.ts
-var INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS = ["HASNA_INSTRUCTIONS_LOCAL"];
-function instructionsLocalModeNotice() {
-  return `instructions: local mode \u2014 ${INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS[0]}=1 selects the on-box SQLite store, ` + `and no hosted authority was configured. Set HASNA_INSTRUCTIONS_API_KEY (or add the Keychain item ` + `hasna.credentials.instructions.api-key, or write ~/.hasna/instructions/config/credentials) to go hosted.`;
-}
-function isInstructionsLocalOptIn(env = process.env) {
-  return INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS.some((key) => (env[key] ?? "").trim() === "1");
-}
-function instructionsAuthorityEnvKeys() {
-  const keys = clientTransportEnvKeys("instructions");
-  return [
-    ...keys.apiUrlKeys,
-    ...keys.apiKeyKeys,
-    credentialOverrideEnvKey("instructions"),
-    credentialPointerEnvKey("instructions"),
-    CREDENTIAL_PROFILE_ENV_KEY
-  ];
-}
-function hasInstructionsEnvAuthorityIntent(env = process.env) {
-  return instructionsAuthorityEnvKeys().some((key) => (env[key] ?? "").trim() !== "");
-}
-function selectsInstructionsLocalStore(env = process.env) {
-  return !hasInstructionsEnvAuthorityIntent(env) && isInstructionsLocalOptIn(env);
-}
-function instructionsResolverEnv(env) {
-  const blanks = instructionsAuthorityEnvKeys().filter((key) => (key in env) && (env[key] ?? "").trim() === "");
-  if (blanks.length === 0)
-    return env;
-  const next = { ...env };
-  for (const key of blanks)
-    delete next[key];
-  return next;
-}
-var CONTRACTS_AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
-function isAmbientInstructionsEnv(env) {
-  if (typeof process !== "undefined" && env === process.env)
-    return true;
-  return env[CONTRACTS_AMBIENT_ENVIRONMENT] === true;
-}
-function instructionsResolverInputs(env, credentials = {}) {
-  const normalised = instructionsResolverEnv(env);
-  if (normalised === env)
-    return { env: normalised, credentials };
-  const keychain = { ...credentials.keychain };
-  if (keychain.enabled === undefined && keychain.run === undefined) {
-    keychain.enabled = isAmbientInstructionsEnv(env);
-  }
-  return { env: normalised, credentials: { ...credentials, keychain } };
-}
-
 // src/lib/transport-resolver.ts
 var INSTRUCTIONS_APP = "instructions";
 var INSTRUCTIONS_LOCAL_OPT_IN_ENV = INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS[0];
@@ -11871,11 +11696,11 @@ function announceLocalInstructionsMode(write = (line) => process.stderr.write(`$
 }
 
 // src/data/config-store.ts
-function parseBoundedPagePayload(value, label) {
+function parseBoundedPagePayload(value, label, expected) {
   const page = value;
   const consumed = Number(page?.cursor) + (page?.items?.length ?? 0);
   const complete = Boolean(page && Number.isSafeInteger(page.total) && consumed >= Number(page.total));
-  if (!page || !Array.isArray(page.items) || !Number.isSafeInteger(page.total) || Number(page.total) < 0 || !Number.isSafeInteger(page.limit) || Number(page.limit) < 1 || !Number.isSafeInteger(page.cursor) || Number(page.cursor) < 0 || page.items.length > Number(page.limit) || typeof page.has_more !== "boolean" || typeof page.complete !== "boolean" || page.truncated !== false || page.next_cursor !== null && !Number.isSafeInteger(page.next_cursor) || page.complete !== complete || page.has_more !== !complete || page.next_cursor !== (complete ? null : consumed)) {
+  if (!page || !Array.isArray(page.items) || !Number.isSafeInteger(page.total) || Number(page.total) < 0 || !Number.isSafeInteger(page.limit) || Number(page.limit) < 1 || !Number.isSafeInteger(page.cursor) || Number(page.cursor) < 0 || page.items.length > Number(page.limit) || typeof page.has_more !== "boolean" || typeof page.complete !== "boolean" || page.truncated !== false || page.next_cursor !== null && !Number.isSafeInteger(page.next_cursor) || page.complete !== complete || page.has_more !== !complete || page.next_cursor !== (complete ? null : consumed) || expected !== undefined && Number(page.cursor) !== expected.cursor) {
     throw new Error(`${label} returned an invalid or truncated bounded-read envelope`);
   }
   return {
@@ -11887,7 +11712,7 @@ function parseBoundedOrLegacyPage(value, legacyItems, options, label) {
   if (value && typeof value === "object") {
     const candidate = value;
     if ("items" in candidate || "total" in candidate || "complete" in candidate || "truncated" in candidate || "next_cursor" in candidate) {
-      return parseBoundedPagePayload(value, label);
+      return parseBoundedPagePayload(value, label, normalizeBoundedReadOptions(options));
     }
   }
   if (!Array.isArray(legacyItems)) {
@@ -11897,6 +11722,65 @@ function parseBoundedOrLegacyPage(value, legacyItems, options, label) {
   const page = boundedReadPage(legacyItems.slice(normalized.cursor, normalized.cursor + normalized.limit), legacyItems.length, normalized);
   return { ...page, source_bounded: false };
 }
+
+class CollectionChangedWhilePagingError extends Error {
+  constructor(label, detail) {
+    super(`${label} changed while paging: ${detail}`);
+    this.name = "CollectionChangedWhilePagingError";
+  }
+}
+var COLLECTION_READ_ATTEMPTS = 2;
+async function aggregateBoundedCollection(label, readPage, identity, options = {}) {
+  let lastError = null;
+  for (let attempt = 0;attempt < COLLECTION_READ_ATTEMPTS; attempt += 1) {
+    try {
+      const items = [];
+      const seen = new Set;
+      let expectedTotal = null;
+      let cursor = 0;
+      let previousIdentity = null;
+      while (true) {
+        const page = await readPage(cursor);
+        if (page.cursor !== cursor) {
+          throw new CollectionChangedWhilePagingError(label, `server returned cursor ${page.cursor} for requested cursor ${cursor}`);
+        }
+        if (expectedTotal === null)
+          expectedTotal = page.total;
+        else if (page.total !== expectedTotal) {
+          throw new CollectionChangedWhilePagingError(label, `total changed from ${expectedTotal} to ${page.total}`);
+        }
+        for (const item of page.items) {
+          const key = identity(item);
+          if (!key)
+            throw new CollectionChangedWhilePagingError(label, "an item had no stable identity");
+          if (seen.has(key))
+            throw new CollectionChangedWhilePagingError(label, `duplicate identity ${key}`);
+          if (options.requireAscendingIdentity && page.source_bounded && previousIdentity !== null && key <= previousIdentity) {
+            throw new CollectionChangedWhilePagingError(label, `identity order was not strictly increasing at ${key}`);
+          }
+          seen.add(key);
+          previousIdentity = key;
+          items.push(item);
+        }
+        if (page.complete) {
+          if (items.length !== expectedTotal) {
+            throw new CollectionChangedWhilePagingError(label, `received ${items.length} unique rows for total ${expectedTotal}`);
+          }
+          return items;
+        }
+        if (page.next_cursor === null || page.next_cursor <= cursor) {
+          throw new CollectionChangedWhilePagingError(label, `cursor did not advance from ${cursor}`);
+        }
+        cursor = page.next_cursor;
+      }
+    } catch (error) {
+      if (!(error instanceof CollectionChangedWhilePagingError))
+        throw error;
+      lastError = error;
+    }
+  }
+  throw lastError ?? new CollectionChangedWhilePagingError(label, "read did not stabilize");
+}
 var LOCAL_OPT_IN_ENV = INSTRUCTIONS_LOCAL_OPT_IN_ENV;
 function isCloudAuthError(err) {
   return typeof err === "object" && err !== null && err.name === "HasnaHttpError" && (err.status === 401 || err.status === 403);
@@ -11922,7 +11806,7 @@ function formatCliError(err, env = process.env) {
 var localStoreModulePromise = null;
 function localStoreModule() {
   if (!localStoreModulePromise)
-    localStoreModulePromise = import("./local-0d8qrc92.js");
+    localStoreModulePromise = import("./local-zxa5dpf4.js");
   return localStoreModulePromise;
 }
 
@@ -11970,15 +11854,7 @@ class LocalConfigStore {
     return (await localStoreModule()).pruneSnapshots(configId, keep, this.db);
   }
   async listProfiles() {
-    const profiles = [];
-    let cursor = 0;
-    while (true) {
-      const page = await this.listProfilesPage({ limit: 100, cursor });
-      profiles.push(...page.items);
-      if (page.complete)
-        return profiles;
-      cursor = page.next_cursor;
-    }
+    return aggregateBoundedCollection("profile list", (cursor) => this.listProfilesPage({ limit: 100, cursor }), (profile) => profile.id);
   }
   async listProfilesPage(options = {}) {
     return (await localStoreModule()).listProfilesPage(options, this.db);
@@ -11987,15 +11863,7 @@ class LocalConfigStore {
     return (await localStoreModule()).getProfile(idOrSlug, this.db);
   }
   async getProfileConfigs(idOrSlug) {
-    const configs = [];
-    let cursor = 0;
-    while (true) {
-      const page = await this.getProfileConfigsPage(idOrSlug, { limit: 100, cursor });
-      configs.push(...page.items);
-      if (page.complete)
-        return configs;
-      cursor = page.next_cursor;
-    }
+    return aggregateBoundedCollection("profile membership", (cursor) => this.getProfileConfigsPage(idOrSlug, { limit: 100, cursor }), (config) => config.id);
   }
   async getProfileConfigsPage(idOrSlug, options = {}) {
     return (await localStoreModule()).getProfileConfigsPage(idOrSlug, options, this.db);
@@ -12076,7 +11944,8 @@ class CloudConfigStore {
       throw err;
     }
   }
-  async listConfigs(filter = {}) {
+  async listConfigsPageRemote(filter, options) {
+    const normalized = normalizeBoundedReadOptions(options);
     const params = new URLSearchParams;
     if (filter.category)
       params.set("category", filter.category);
@@ -12086,16 +11955,21 @@ class CloudConfigStore {
       params.set("kind", filter.kind);
     if (filter.search)
       params.set("search", filter.search);
-    const qs = params.toString();
-    const { data } = await this.request("GET", `/configs${qs ? `?${qs}` : ""}`);
-    let configs = data?.configs ?? [];
+    params.set("limit", String(normalized.limit));
+    params.set("cursor", String(normalized.cursor));
+    const { data } = await this.request("GET", `/configs?${params.toString()}`);
+    return parseBoundedOrLegacyPage(data, data?.configs, normalized, "config list");
+  }
+  async listConfigs(filter = {}) {
+    const configs = await aggregateBoundedCollection("config list", (cursor) => this.listConfigsPageRemote(filter, { limit: 100, cursor }), (config) => config.id, { requireAscendingIdentity: true });
+    let filtered = configs;
     if (filter.tags && filter.tags.length > 0) {
-      configs = configs.filter((c) => filter.tags.every((t) => c.tags.includes(t)));
+      filtered = filtered.filter((config) => filter.tags.every((tag) => config.tags.includes(tag)));
     }
     if (filter.is_template !== undefined) {
-      configs = configs.filter((c) => c.is_template === filter.is_template);
+      filtered = filtered.filter((config) => config.is_template === filter.is_template);
     }
-    return configs;
+    return filtered;
   }
   async getConfig(idOrSlug) {
     const { status, data } = await this.request("GET", `/configs/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
@@ -12126,8 +12000,11 @@ class CloudConfigStore {
     return data ?? { total: 0 };
   }
   async listSnapshots(configId) {
-    const { data } = await this.request("GET", `/configs/${encodeURIComponent(configId)}/snapshots`);
-    return data?.snapshots ?? [];
+    return aggregateBoundedCollection("snapshot list", async (cursor) => {
+      const normalized = normalizeBoundedReadOptions({ limit: 100, cursor });
+      const { data } = await this.request("GET", `/configs/${encodeURIComponent(configId)}/snapshots?limit=${normalized.limit}&cursor=${normalized.cursor}`);
+      return parseBoundedOrLegacyPage(data, data?.snapshots, normalized, "snapshot list");
+    }, (snapshot) => snapshot.id);
   }
   async getSnapshot(id) {
     const { status, data } = await this.request("GET", `/snapshots/${encodeURIComponent(id)}`, undefined, { allow404: true });
@@ -12150,15 +12027,7 @@ class CloudConfigStore {
     return data?.pruned ?? 0;
   }
   async listProfiles() {
-    const profiles = [];
-    let cursor = 0;
-    while (true) {
-      const page = await this.listProfilesPage({ limit: 100, cursor });
-      profiles.push(...page.items);
-      if (page.complete)
-        return profiles;
-      cursor = page.next_cursor;
-    }
+    return aggregateBoundedCollection("profile list", (cursor) => this.listProfilesPage({ limit: 100, cursor }), (profile) => profile.id, { requireAscendingIdentity: true });
   }
   async listProfilesPage(options = {}) {
     const normalized = normalizeBoundedReadOptions(options);
@@ -12182,15 +12051,7 @@ class CloudConfigStore {
     return profile;
   }
   async getProfileConfigs(idOrSlug) {
-    const configs = [];
-    let cursor = 0;
-    while (true) {
-      const page = await this.getProfileConfigsPage(idOrSlug, { limit: 100, cursor });
-      configs.push(...page.items);
-      if (page.complete)
-        return configs;
-      cursor = page.next_cursor;
-    }
+    return aggregateBoundedCollection("profile membership", (cursor) => this.getProfileConfigsPage(idOrSlug, { limit: 100, cursor }), (config) => config.id);
   }
   async getProfileConfigsPage(idOrSlug, options = {}) {
     const normalized = normalizeBoundedReadOptions(options);
@@ -12204,20 +12065,26 @@ class CloudConfigStore {
     return parseBoundedOrLegacyPage(data.configs, data.profile.configs, normalized, "profile membership");
   }
   async getProfileConfigBindings(idOrSlug) {
-    const { status, data } = await this.requestProfileRoute(idOrSlug, (profileId) => `/profiles/${encodeURIComponent(profileId)}/bindings`, (value) => Array.isArray(value?.bindings));
-    if (status === 404) {
-      const profile = await this.getProfile(idOrSlug);
-      const configs = await this.getProfileConfigs(idOrSlug);
-      return configs.map((config, sort_order) => ({
-        profile_id: profile.id,
-        config_id: config.id,
-        sort_order,
-        binding: legacyProfileConfigBinding()
-      }));
-    }
-    if (!data || !Array.isArray(data.bindings))
-      throw new ProfileNotFoundError(idOrSlug);
-    return data.bindings;
+    let routeMissing = false;
+    const bindings = await aggregateBoundedCollection("profile config bindings", async (cursor) => {
+      const normalized = normalizeBoundedReadOptions({ limit: 100, cursor });
+      const { status, data } = await this.requestProfileRoute(idOrSlug, (profileId) => `/profiles/${encodeURIComponent(profileId)}/bindings?limit=${normalized.limit}&cursor=${normalized.cursor}`, (value) => Boolean(value && (Array.isArray(value.bindings) || Array.isArray(value.items))));
+      if (status === 404) {
+        routeMissing = true;
+        return { ...boundedReadPage([], 0, normalized), source_bounded: false };
+      }
+      return parseBoundedOrLegacyPage(data, data?.bindings, normalized, "profile config bindings");
+    }, (binding) => `${binding.profile_id}\x00${binding.config_id}`);
+    if (!routeMissing)
+      return bindings;
+    const profile = await this.getProfile(idOrSlug);
+    const configs = await this.getProfileConfigs(idOrSlug);
+    return configs.map((config, sort_order) => ({
+      profile_id: profile.id,
+      config_id: config.id,
+      sort_order,
+      binding: legacyProfileConfigBinding()
+    }));
   }
   async requestProfileRoute(idOrSlug, pathForId, isUsable) {
     const attempted = new Set;
@@ -12275,14 +12142,20 @@ class CloudConfigStore {
     await this.request("DELETE", `/profiles/${encodeURIComponent(profileIdOrSlug)}/configs/${encodeURIComponent(configId)}`, undefined, { allow404: true });
   }
   async getProfileAssetBindings(profileIdOrSlug) {
-    const { status, data } = await this.requestProfileRoute(profileIdOrSlug, (profileId) => `/profiles/${encodeURIComponent(profileId)}/assets`, (value) => Array.isArray(value?.assets));
-    if (status === 404) {
-      await this.getProfile(profileIdOrSlug);
-      return [];
-    }
-    if (!data || !Array.isArray(data.assets))
-      throw new ProfileNotFoundError(profileIdOrSlug);
-    return data.assets;
+    let routeMissing = false;
+    const assets = await aggregateBoundedCollection("profile asset bindings", async (cursor) => {
+      const normalized = normalizeBoundedReadOptions({ limit: 100, cursor });
+      const { status, data } = await this.requestProfileRoute(profileIdOrSlug, (profileId) => `/profiles/${encodeURIComponent(profileId)}/assets?limit=${normalized.limit}&cursor=${normalized.cursor}`, (value) => Boolean(value && (Array.isArray(value.assets) || Array.isArray(value.items))));
+      if (status === 404) {
+        routeMissing = true;
+        return { ...boundedReadPage([], 0, normalized), source_bounded: false };
+      }
+      return parseBoundedOrLegacyPage(data, data?.assets, normalized, "profile asset bindings");
+    }, (asset) => `${asset.profile_id}\x00${asset.binding.assetKey}`);
+    if (!routeMissing)
+      return assets;
+    await this.getProfile(profileIdOrSlug);
+    return [];
   }
   async addAssetToProfile(profileIdOrSlug, sourceConfigId, binding) {
     const { data } = await this.request("POST", `/profiles/${encodeURIComponent(profileIdOrSlug)}/assets`, { source_config_id: sourceConfigId, binding }, { idempotent: true });
@@ -12352,8 +12225,11 @@ class CloudConfigStore {
     await this.request("POST", "/machines/applied", { hostname });
   }
   async listMachines() {
-    const { data } = await this.request("GET", "/machines");
-    return data?.machines ?? [];
+    return aggregateBoundedCollection("machine list", async (cursor) => {
+      const normalized = normalizeBoundedReadOptions({ limit: 100, cursor });
+      const { data } = await this.request("GET", `/machines?limit=${normalized.limit}&cursor=${normalized.cursor}`);
+      return parseBoundedOrLegacyPage(data, data?.machines, normalized, "machine list");
+    }, (machine) => machine.id, { requireAscendingIdentity: true });
   }
   async sendFeedback(input) {
     await this.request("POST", "/feedback", {
@@ -12603,9 +12479,9 @@ async function ensureGlobalAgentRulesStandardConfig(store = resolveConfigStore()
 }
 
 // src/lib/machine.ts
-import { arch as currentArch, homedir as homedir6, hostname as currentHostname, type as currentOsType } from "os";
-import { existsSync as existsSync6 } from "fs";
-import { join as join8 } from "path";
+import { arch as currentArch, homedir as homedir5, hostname as currentHostname, type as currentOsType } from "os";
+import { existsSync as existsSync5 } from "fs";
+import { join as join7 } from "path";
 var BREW_BUN_PATH = "/opt/homebrew/bin/bun";
 function normalizeOsFamily(os) {
   const value = (os ?? "").trim().toLowerCase();
@@ -12618,11 +12494,11 @@ function normalizeOsFamily(os) {
   return value || "unknown";
 }
 function detectMachineContext(overrides = {}) {
-  const homeDir5 = overrides.home_dir ?? process.env["CONFIGS_HOME"] ?? process.env["HOME"] ?? homedir6();
+  const homeDir4 = overrides.home_dir ?? process.env["CONFIGS_HOME"] ?? process.env["HOME"] ?? homedir5();
   const os = overrides.os ?? currentOsType();
   const osFamily = normalizeOsFamily(os);
-  const bunBinDir = overrides.bun_bin_dir ?? join8(homeDir5, ".bun", "bin");
-  const defaultBunPath = osFamily === "macos" && existsSync6(BREW_BUN_PATH) ? BREW_BUN_PATH : join8(bunBinDir, "bun");
+  const bunBinDir = overrides.bun_bin_dir ?? join7(homeDir4, ".bun", "bin");
+  const defaultBunPath = osFamily === "macos" && existsSync5(BREW_BUN_PATH) ? BREW_BUN_PATH : join7(bunBinDir, "bun");
   return {
     id: "current-machine",
     hostname: overrides.hostname ?? currentHostname(),
@@ -12631,11 +12507,11 @@ function detectMachineContext(overrides = {}) {
     last_applied_at: null,
     created_at: "",
     os_family: osFamily,
-    home_dir: homeDir5,
-    workspace_root: overrides.workspace_root ?? join8(homeDir5, osFamily === "macos" ? "Workspace" : "workspace"),
+    home_dir: homeDir4,
+    workspace_root: overrides.workspace_root ?? join7(homeDir4, osFamily === "macos" ? "Workspace" : "workspace"),
     bun_bin_dir: bunBinDir,
     bun_path: overrides.bun_path ?? defaultBunPath,
-    path_prefix: overrides.path_prefix ?? (osFamily === "macos" ? `${join8("/opt", "homebrew", "bin")}:${bunBinDir}` : bunBinDir)
+    path_prefix: overrides.path_prefix ?? (osFamily === "macos" ? `${join7("/opt", "homebrew", "bin")}:${bunBinDir}` : bunBinDir)
   };
 }
 function machineContextToVariables(machine) {
@@ -12699,4 +12575,4 @@ function renderMachineAwareContentPreview(content, variables) {
   return isTemplate(content) ? renderTemplatePreview(content, variables) : { content, unresolved: [] };
 }
 
-export { DEFAULT_LIST_LIMIT, parseLimit, paginate, truncateText, truncateMiddle, normalizeBoundedReadOptions, boundedReadPage, ensureGlobalAgentRulesStandardConfig, ensureCodewithSharedTodosStorageStandardConfig, redactFormatForTarget, redactContent, scanSecrets, isSecretVarName, SESSION_RENDER_MANAGED_MARKER, SESSION_RENDER_SCHEMA, SESSION_RENDER_MANIFEST_RELATIVE_PATH, SESSION_INSTRUCTION_LAYERS, getSessionRenderSnapshotDir, sessionRenderSnapshotWorkspaceRoot, PROJECT_CONTEXT_MAX_INPUT_BYTES, SESSION_MANAGED_INPUT_MAX_BYTES, ProjectContextError, parseProjectContextBundle, planProjectContext, observeProjectContextSessionGuard, withProjectContextSessionGuard, applyProjectContext, writeProjectContextCoordinatedFile, removeProjectContextCoordinatedFile, isRetiredOrUnsupportedConfigAgent, retiredOrUnsupportedAgentReason, applyTransform, normalizeProfileAssetBinding, observeCursorGlobalAuthorityAtPath, isCursorGlobalAuthorityPath, stampCursorGlobalAuthorityMarker, detectCursorAuthorityConflicts, detectClaudeAuthorityConflicts, getRawStoreRoot, ANTIGRAVITY_RULE_FILE_CHAR_LIMIT, SESSION_RENDERER_OWNER_ID, SESSION_RENDER_TOOLS, SESSION_RENDER_OWNED_CONFIG_TARGETS, SESSION_RENDER_EXCLUSIVE_MANAGED_PATHS, normalizeSessionInstructionSourceId, resolveSessionPath, planSessionRender, sourceFromFilePath, sourceFromConfig, sourcesFromIdentityExport, legacyProfileConfigBinding, normalizeProfileConfigBinding, planProfileSessionRender, hasInstructionsEnvAuthorityIntent, normalizeOsFamily, detectMachineContext, machineContextToVariables, resolveProfileVariables, templateizeMachineContent, renderMachineAwareContentPreview, formatCliError, CloudConfigStore, resolveConfigStore };
+export { DEFAULT_LIST_LIMIT, parseLimit, paginate, truncateText, truncateMiddle, normalizeBoundedReadOptions, boundedReadPage, ensureGlobalAgentRulesStandardConfig, ensureCodewithSharedTodosStorageStandardConfig, redactFormatForTarget, redactContent, scanSecrets, isSecretVarName, SESSION_RENDER_MANAGED_MARKER, SESSION_RENDER_SCHEMA, SESSION_RENDER_MANIFEST_RELATIVE_PATH, SESSION_INSTRUCTION_LAYERS, getSessionRenderSnapshotDir, sessionRenderSnapshotWorkspaceRoot, PROJECT_CONTEXT_MAX_INPUT_BYTES, SESSION_MANAGED_INPUT_MAX_BYTES, ProjectContextError, parseProjectContextBundle, planProjectContext, observeProjectContextSessionGuard, withProjectContextSessionGuard, applyProjectContext, writeProjectContextCoordinatedFile, removeProjectContextCoordinatedFile, isRetiredOrUnsupportedConfigAgent, retiredOrUnsupportedAgentReason, applyTransform, normalizeProfileAssetBinding, observeCursorGlobalAuthorityAtPath, isCursorGlobalAuthorityPath, stampCursorGlobalAuthorityMarker, detectCursorAuthorityConflicts, detectClaudeAuthorityConflicts, ANTIGRAVITY_RULE_FILE_CHAR_LIMIT, SESSION_RENDERER_OWNER_ID, SESSION_RENDER_TOOLS, SESSION_RENDER_OWNED_CONFIG_TARGETS, SESSION_RENDER_EXCLUSIVE_MANAGED_PATHS, normalizeSessionInstructionSourceId, resolveSessionPath, planSessionRender, sourceFromFilePath, sourceFromConfig, sourcesFromIdentityExport, legacyProfileConfigBinding, normalizeProfileConfigBinding, planProfileSessionRender, normalizeOsFamily, detectMachineContext, machineContextToVariables, resolveProfileVariables, templateizeMachineContent, renderMachineAwareContentPreview, formatCliError, CloudConfigStore, resolveConfigStore };