@hasna/instructions 0.6.1 → 0.7.1

package/dist/chunks/index-8rb7ng2y.js

@@ -0,0 +1,148 @@
+// @bun
+// src/storage/s3-config.ts
+var INSTRUCTIONS_S3_ENV = {
+  bucket: "HASNA_INSTRUCTIONS_S3_BUCKET",
+  prefix: "HASNA_INSTRUCTIONS_S3_PREFIX",
+  region: "HASNA_INSTRUCTIONS_AWS_REGION",
+  endpoint: "HASNA_INSTRUCTIONS_S3_ENDPOINT",
+  forcePathStyle: "HASNA_INSTRUCTIONS_S3_FORCE_PATH_STYLE",
+  accessKeyId: "HASNA_INSTRUCTIONS_S3_ACCESS_KEY_ID",
+  secretAccessKey: "HASNA_INSTRUCTIONS_S3_SECRET_ACCESS_KEY",
+  sessionToken: "HASNA_INSTRUCTIONS_S3_SESSION_TOKEN"
+};
+var INSTRUCTIONS_S3_ALIAS_ENV = {
+  bucket: "INSTRUCTIONS_S3_BUCKET",
+  prefix: "INSTRUCTIONS_S3_PREFIX",
+  region: "INSTRUCTIONS_AWS_REGION",
+  endpoint: "INSTRUCTIONS_S3_ENDPOINT",
+  forcePathStyle: "INSTRUCTIONS_S3_FORCE_PATH_STYLE",
+  accessKeyId: "INSTRUCTIONS_S3_ACCESS_KEY_ID",
+  secretAccessKey: "INSTRUCTIONS_S3_SECRET_ACCESS_KEY",
+  sessionToken: "INSTRUCTIONS_S3_SESSION_TOKEN"
+};
+var BUCKET_PATTERN = /^(?!xn--)[a-z0-9](?:[a-z0-9.-]{1,61}[a-z0-9])?$/;
+var REGION_PATTERN = /^[a-z]{2}(?:-gov)?-[a-z0-9-]+-\d$/;
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+function loadInstructionsS3Config(env = process.env) {
+  const bucket = readEnv(env, "bucket");
+  const configuredWithoutBucket = Object.keys(INSTRUCTIONS_S3_ENV).filter((key) => key !== "bucket").some((key) => readEnv(env, key) !== undefined);
+  if (!bucket) {
+    if (configuredWithoutBucket) {
+      throw new Error(`${INSTRUCTIONS_S3_ENV.bucket} is required when any Instructions S3 setting is configured`);
+    }
+    return;
+  }
+  validateBucket(bucket);
+  const prefix = normalizeInstructionsS3Prefix(readEnv(env, "prefix") ?? "instructions/");
+  const region = readEnv(env, "region") ?? "us-east-1";
+  validateRegion(region);
+  const endpoint = normalizeEndpoint(readEnv(env, "endpoint"));
+  const forcePathStyle = parseBoolean(readEnv(env, "forcePathStyle"), false);
+  const accessKeyId = readEnv(env, "accessKeyId");
+  const secretAccessKey = readEnv(env, "secretAccessKey");
+  const sessionToken = readEnv(env, "sessionToken");
+  if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) {
+    throw new Error(`${INSTRUCTIONS_S3_ENV.accessKeyId} and ${INSTRUCTIONS_S3_ENV.secretAccessKey} must be configured together`);
+  }
+  if (sessionToken && (!accessKeyId || !secretAccessKey)) {
+    throw new Error(`${INSTRUCTIONS_S3_ENV.sessionToken} requires a complete static credential pair`);
+  }
+  return {
+    provider: "s3",
+    bucket,
+    prefix,
+    region,
+    ...endpoint ? { endpoint } : {},
+    forcePathStyle,
+    ...accessKeyId && secretAccessKey ? {
+      credentials: {
+        accessKeyId,
+        secretAccessKey,
+        ...sessionToken ? { sessionToken } : {}
+      }
+    } : {}
+  };
+}
+function normalizeInstructionsS3Prefix(value) {
+  const trimmed = value.trim();
+  if (!trimmed || CONTROL_CHARACTERS.test(trimmed) || trimmed.includes("\\")) {
+    throw new Error("Instructions S3 prefix is invalid");
+  }
+  const withoutEdges = trimmed.replace(/^\/+|\/+$/g, "");
+  if (!withoutEdges || withoutEdges.includes("//")) {
+    throw new Error("Instructions S3 prefix is invalid");
+  }
+  const segments = withoutEdges.split("/");
+  for (const segment of segments) {
+    let decoded;
+    try {
+      decoded = decodeURIComponent(segment);
+    } catch {
+      throw new Error("Instructions S3 prefix contains invalid percent encoding");
+    }
+    if (!decoded || decoded === "." || decoded === ".." || decoded.includes("/") || decoded.includes("\\") || CONTROL_CHARACTERS.test(decoded)) {
+      throw new Error("Instructions S3 prefix contains an unsafe path segment");
+    }
+  }
+  return `${segments.join("/")}/`;
+}
+function readEnv(env, key) {
+  const canonical = INSTRUCTIONS_S3_ENV[key];
+  if (Object.prototype.hasOwnProperty.call(env, canonical))
+    return clean(env[canonical]);
+  return clean(env[INSTRUCTIONS_S3_ALIAS_ENV[key]]);
+}
+function clean(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+function parseBoolean(value, fallback) {
+  if (!value)
+    return fallback;
+  switch (value.toLowerCase()) {
+    case "1":
+    case "true":
+    case "yes":
+    case "on":
+      return true;
+    case "0":
+    case "false":
+    case "no":
+    case "off":
+      return false;
+    default:
+      throw new Error("Instructions S3 boolean setting is invalid");
+  }
+}
+function validateBucket(bucket) {
+  if (bucket.length < 3 || bucket.length > 63 || !BUCKET_PATTERN.test(bucket) || bucket.includes("..") || bucket.includes(".-") || bucket.includes("-.") || /^\d{1,3}(?:\.\d{1,3}){3}$/.test(bucket)) {
+    throw new Error("Instructions S3 bucket is invalid");
+  }
+}
+function validateRegion(region) {
+  if (!REGION_PATTERN.test(region))
+    throw new Error("Instructions AWS region is invalid");
+}
+function normalizeEndpoint(value) {
+  if (!value)
+    return;
+  let endpoint;
+  try {
+    endpoint = new URL(value);
+  } catch {
+    throw new Error("Instructions S3 endpoint is invalid");
+  }
+  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
+    throw new Error("Instructions S3 endpoint must not contain credentials, query parameters, or fragments");
+  }
+  if (endpoint.pathname !== "/") {
+    throw new Error("Instructions S3 endpoint must be an origin without a path");
+  }
+  const localHttp = endpoint.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(endpoint.hostname);
+  if (endpoint.protocol !== "https:" && !localHttp) {
+    throw new Error("Instructions S3 endpoint must use HTTPS (HTTP is allowed only for loopback development)");
+  }
+  return endpoint.origin;
+}
+
+export { INSTRUCTIONS_S3_ENV, INSTRUCTIONS_S3_ALIAS_ENV, loadInstructionsS3Config, normalizeInstructionsS3Prefix };

package/dist/chunks/{index-v7dkb384.js → index-aj66f6xr.js}

@@ -15,7 +15,7 @@ import {
   isTemplate,
   renderTemplate,
   renderTemplatePreview
-} from "./index-pkscjnj5.js";
+} from "./index-3djthcm6.js";
 import {
   __export,
   __require
@@ -203,6 +203,7 @@ import { randomUUID } from "crypto";
 // src/lib/compact-output.ts
 var DEFAULT_LIST_LIMIT = 20;
 var MAX_LIST_LIMIT = 100;
+var MAX_LIST_CURSOR = 1e5;
 function parseLimit(value, fallback = DEFAULT_LIST_LIMIT, max = MAX_LIST_LIMIT) {
   const parsed = typeof value === "number" ? value : Number.parseInt(String(value ?? ""), 10);
   if (!Number.isFinite(parsed) || parsed <= 0)
@@ -213,7 +214,7 @@ function parseCursor(value) {
   const parsed = typeof value === "number" ? value : Number.parseInt(String(value ?? ""), 10);
   if (!Number.isFinite(parsed) || parsed < 0)
     return 0;
-  return Math.floor(parsed);
+  return Math.min(Math.floor(parsed), MAX_LIST_CURSOR);
 }
 function paginate(items, opts = {}) {
   const limit = parseLimit(opts.limit, opts.defaultLimit ?? DEFAULT_LIST_LIMIT, opts.maxLimit ?? MAX_LIST_LIMIT);
@@ -243,28 +244,6 @@ function truncateText(value, max = 80) {
     return text.slice(0, max);
   return `${text.slice(0, max - 3)}...`;
 }
-function summarizeConfig(config, opts = {}) {
-  const summary = {
-    id: config.id,
-    slug: config.slug,
-    name: config.name,
-    category: config.category,
-    agent: config.agent,
-    kind: config.kind,
-    format: config.format,
-    target_path: config.target_path,
-    output_count: config.outputs.length,
-    version: config.version,
-    is_template: config.is_template
-  };
-  if (opts.verbose) {
-    summary.updated_at = config.updated_at;
-    summary.description = config.description;
-    summary.tags = config.tags;
-    summary.outputs = config.outputs;
-  }
-  return summary;
-}
 function summarizeProfile(profile, opts = {}) {
   const selectorCount = (profile.selectors.os?.length ?? 0) + (profile.selectors.arch?.length ?? 0) + (profile.selectors.hostnames?.length ?? 0);
   const summary = {
@@ -720,7 +699,7 @@ function optionalString(value, label) {
   return requiredString(value, label);
 }
 
-// ../contracts/dist/client/transport.js
+// ../../node_modules/.bun/@hasna+contracts@1.0.2+e8014c875821e0be/node_modules/@hasna/contracts/dist/client/transport.js
 import { createRequire } from "module";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
@@ -754,7 +733,7 @@ var AUTHORITY_OVERRIDE_HEADERS = new Set([
   "x-original-host"
 ]);
 
-// ../contracts/dist/client/storage.js
+// ../../node_modules/.bun/@hasna+contracts@1.0.2+e8014c875821e0be/node_modules/@hasna/contracts/dist/client/storage.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
 import { closeSync, fstatSync, openSync, readFileSync } from "fs";
@@ -2032,11 +2011,11 @@ function announceLocalInstructionsMode(write = (line) => process.stderr.write(`$
 }
 
 // src/data/config-store.ts
-function parseBoundedPagePayload(value, label) {
+function parseBoundedPagePayload(value, label, expected) {
   const page = value;
   const consumed = Number(page?.cursor) + (page?.items?.length ?? 0);
   const complete = Boolean(page && Number.isSafeInteger(page.total) && consumed >= Number(page.total));
-  if (!page || !Array.isArray(page.items) || !Number.isSafeInteger(page.total) || Number(page.total) < 0 || !Number.isSafeInteger(page.limit) || Number(page.limit) < 1 || !Number.isSafeInteger(page.cursor) || Number(page.cursor) < 0 || page.items.length > Number(page.limit) || typeof page.has_more !== "boolean" || typeof page.complete !== "boolean" || page.truncated !== false || page.next_cursor !== null && !Number.isSafeInteger(page.next_cursor) || page.complete !== complete || page.has_more !== !complete || page.next_cursor !== (complete ? null : consumed)) {
+  if (!page || !Array.isArray(page.items) || !Number.isSafeInteger(page.total) || Number(page.total) < 0 || !Number.isSafeInteger(page.limit) || Number(page.limit) < 1 || !Number.isSafeInteger(page.cursor) || Number(page.cursor) < 0 || page.items.length > Number(page.limit) || typeof page.has_more !== "boolean" || typeof page.complete !== "boolean" || page.truncated !== false || page.next_cursor !== null && !Number.isSafeInteger(page.next_cursor) || page.complete !== complete || page.has_more !== !complete || page.next_cursor !== (complete ? null : consumed) || expected !== undefined && Number(page.cursor) !== expected.cursor) {
     throw new Error(`${label} returned an invalid or truncated bounded-read envelope`);
   }
   return {
@@ -2048,7 +2027,7 @@ function parseBoundedOrLegacyPage(value, legacyItems, options, label) {
   if (value && typeof value === "object") {
     const candidate = value;
     if ("items" in candidate || "total" in candidate || "complete" in candidate || "truncated" in candidate || "next_cursor" in candidate) {
-      return parseBoundedPagePayload(value, label);
+      return parseBoundedPagePayload(value, label, normalizeBoundedReadOptions(options));
     }
   }
   if (!Array.isArray(legacyItems)) {
@@ -2058,13 +2037,85 @@ function parseBoundedOrLegacyPage(value, legacyItems, options, label) {
   const page = boundedReadPage(legacyItems.slice(normalized.cursor, normalized.cursor + normalized.limit), legacyItems.length, normalized);
   return { ...page, source_bounded: false };
 }
+function projectBoundedPage(page, project) {
+  return {
+    items: page.items.map(project),
+    total: page.total,
+    limit: page.limit,
+    cursor: page.cursor,
+    next_cursor: page.next_cursor,
+    has_more: page.has_more,
+    complete: page.complete,
+    truncated: page.truncated,
+    source_bounded: page.source_bounded
+  };
+}
+
+class CollectionChangedWhilePagingError extends Error {
+  constructor(label, detail) {
+    super(`${label} changed while paging: ${detail}`);
+    this.name = "CollectionChangedWhilePagingError";
+  }
+}
+var COLLECTION_READ_ATTEMPTS = 2;
+async function aggregateBoundedCollection(label, readPage, identity, options = {}) {
+  let lastError = null;
+  for (let attempt = 0;attempt < COLLECTION_READ_ATTEMPTS; attempt += 1) {
+    try {
+      const items = [];
+      const seen = new Set;
+      let expectedTotal = null;
+      let cursor = 0;
+      let previousIdentity = null;
+      while (true) {
+        const page = await readPage(cursor);
+        if (page.cursor !== cursor) {
+          throw new CollectionChangedWhilePagingError(label, `server returned cursor ${page.cursor} for requested cursor ${cursor}`);
+        }
+        if (expectedTotal === null)
+          expectedTotal = page.total;
+        else if (page.total !== expectedTotal) {
+          throw new CollectionChangedWhilePagingError(label, `total changed from ${expectedTotal} to ${page.total}`);
+        }
+        for (const item of page.items) {
+          const key = identity(item);
+          if (!key)
+            throw new CollectionChangedWhilePagingError(label, "an item had no stable identity");
+          if (seen.has(key))
+            throw new CollectionChangedWhilePagingError(label, `duplicate identity ${key}`);
+          if (options.requireAscendingIdentity && page.source_bounded && previousIdentity !== null && key <= previousIdentity) {
+            throw new CollectionChangedWhilePagingError(label, `identity order was not strictly increasing at ${key}`);
+          }
+          seen.add(key);
+          previousIdentity = key;
+          items.push(item);
+        }
+        if (page.complete) {
+          if (items.length !== expectedTotal) {
+            throw new CollectionChangedWhilePagingError(label, `received ${items.length} unique rows for total ${expectedTotal}`);
+          }
+          return items;
+        }
+        if (page.next_cursor === null || page.next_cursor <= cursor) {
+          throw new CollectionChangedWhilePagingError(label, `cursor did not advance from ${cursor}`);
+        }
+        cursor = page.next_cursor;
+      }
+    } catch (error) {
+      if (!(error instanceof CollectionChangedWhilePagingError))
+        throw error;
+      lastError = error;
+    }
+  }
+  throw lastError ?? new CollectionChangedWhilePagingError(label, "read did not stabilize");
+}
 function isNotFoundHttpError2(err) {
   return typeof err === "object" && err !== null && err.name === "HasnaHttpError" && err.status === 404;
 }
 var localStoreModulePromise = null;
 function localStoreModule() {
   if (!localStoreModulePromise)
-    localStoreModulePromise = import("./local-a9nen65z.js");
+    localStoreModulePromise = import("./local-0a9gja58.js");
   return localStoreModulePromise;
 }
 
@@ -2078,6 +2129,15 @@ class LocalConfigStore {
   async listConfigs(filter) {
     return (await localStoreModule()).listConfigs(filter, this.db);
   }
+  async listConfigsPage(filter = {}, options = {}) {
+    return (await localStoreModule()).listConfigsPage(filter, options, this.db);
+  }
+  async listConfigIdentitiesPage(filter = {}, options = {}) {
+    return (await localStoreModule()).listConfigIdentitiesPage(filter, options, this.db);
+  }
+  async listConfigSummariesPage(filter = {}, options = {}) {
+    return (await localStoreModule()).listConfigSummariesPage(filter, options, this.db);
+  }
   async getConfig(idOrSlug) {
     return (await localStoreModule()).getConfig(idOrSlug, this.db);
   }
@@ -2112,15 +2172,7 @@ class LocalConfigStore {
     return (await localStoreModule()).pruneSnapshots(configId, keep, this.db);
   }
   async listProfiles() {
-    const profiles = [];
-    let cursor = 0;
-    while (true) {
-      const page = await this.listProfilesPage({ limit: 100, cursor });
-      profiles.push(...page.items);
-      if (page.complete)
-        return profiles;
-      cursor = page.next_cursor;
-    }
+    return aggregateBoundedCollection("profile list", (cursor) => this.listProfilesPage({ limit: 100, cursor }), (profile) => profile.id);
   }
   async listProfilesPage(options = {}) {
     return (await localStoreModule()).listProfilesPage(options, this.db);
@@ -2129,15 +2181,7 @@ class LocalConfigStore {
     return (await localStoreModule()).getProfile(idOrSlug, this.db);
   }
   async getProfileConfigs(idOrSlug) {
-    const configs = [];
-    let cursor = 0;
-    while (true) {
-      const page = await this.getProfileConfigsPage(idOrSlug, { limit: 100, cursor });
-      configs.push(...page.items);
-      if (page.complete)
-        return configs;
-      cursor = page.next_cursor;
-    }
+    return aggregateBoundedCollection("profile membership", (cursor) => this.getProfileConfigsPage(idOrSlug, { limit: 100, cursor }), (config) => config.id);
   }
   async getProfileConfigsPage(idOrSlug, options = {}) {
     return (await localStoreModule()).getProfileConfigsPage(idOrSlug, options, this.db);
@@ -2197,6 +2241,43 @@ class LocalConfigStore {
     (await localStoreModule()).resetLocalDatabase();
   }
 }
+function toConfigIdentity(value) {
+  const record = value && typeof value === "object" ? value : {};
+  return {
+    id: String(record.id ?? ""),
+    name: String(record.name ?? ""),
+    slug: String(record.slug ?? ""),
+    kind: String(record.kind ?? ""),
+    category: String(record.category ?? ""),
+    agent: String(record.agent ?? ""),
+    format: String(record.format ?? ""),
+    is_template: Boolean(record.is_template),
+    version: Number(record.version ?? 0),
+    created_at: String(record.created_at ?? ""),
+    updated_at: String(record.updated_at ?? ""),
+    synced_at: record.synced_at == null ? null : String(record.synced_at)
+  };
+}
+function toConfigSummary(value) {
+  const record = value && typeof value === "object" ? value : {};
+  const outputs = Array.isArray(record.outputs) ? record.outputs : [];
+  return {
+    id: String(record.id ?? ""),
+    slug: String(record.slug ?? ""),
+    name: String(record.name ?? ""),
+    category: String(record.category ?? ""),
+    agent: String(record.agent ?? ""),
+    kind: String(record.kind ?? ""),
+    format: String(record.format ?? ""),
+    target_path: record.target_path == null ? null : String(record.target_path),
+    output_count: Number(record.output_count ?? outputs.length),
+    version: Number(record.version ?? 0),
+    is_template: Boolean(record.is_template),
+    ...record.updated_at !== undefined ? { updated_at: String(record.updated_at) } : {},
+    ...record.description !== undefined ? { description: record.description == null ? null : String(record.description) } : {},
+    ...Array.isArray(record.tags) ? { tags: record.tags.map(String) } : {}
+  };
+}
 
 class CloudConfigStore {
   mode = "api";
@@ -2218,7 +2299,8 @@ class CloudConfigStore {
       throw err;
     }
   }
-  async listConfigs(filter = {}) {
+  async listConfigsPage(filter = {}, options = {}) {
+    const normalized = normalizeBoundedReadOptions(options);
     const params = new URLSearchParams;
     if (filter.category)
       params.set("category", filter.category);
@@ -2228,16 +2310,75 @@ class CloudConfigStore {
       params.set("kind", filter.kind);
     if (filter.search)
       params.set("search", filter.search);
-    const qs = params.toString();
-    const { data } = await this.request("GET", `/configs${qs ? `?${qs}` : ""}`);
-    let configs = data?.configs ?? [];
+    for (const tag of filter.tags ?? [])
+      params.append("tag", tag);
+    params.set("limit", String(normalized.limit));
+    params.set("cursor", String(normalized.cursor));
+    const { data } = await this.request("GET", `/configs?${params.toString()}`);
+    return parseBoundedOrLegacyPage(data, data?.configs, normalized, "config list");
+  }
+  async listConfigIdentitiesPage(filter = {}, options = {}) {
+    const normalized = normalizeBoundedReadOptions(options);
+    const params = new URLSearchParams;
+    if (filter.category)
+      params.set("category", filter.category);
+    if (filter.agent)
+      params.set("agent", filter.agent);
+    if (filter.kind)
+      params.set("kind", filter.kind);
+    if (filter.search)
+      params.set("search", filter.search);
+    for (const tag of filter.tags ?? [])
+      params.append("tag", tag);
+    params.set("view", "identity");
+    params.set("limit", String(normalized.limit));
+    params.set("cursor", String(normalized.cursor));
+    const { data } = await this.request("GET", `/configs?${params.toString()}`);
+    const page = parseBoundedOrLegacyPage(data, data?.configs, normalized, "config identity list");
+    if (page.items.some((item) => {
+      const record = item && typeof item === "object" ? item : {};
+      return ["content", "target_path", "outputs", "description", "tags"].some((field) => Object.prototype.hasOwnProperty.call(record, field));
+    })) {
+      throw new Error("Instructions /v1 config identity projection is unavailable; deploy the identity endpoint before using compact lists");
+    }
+    return projectBoundedPage(page, toConfigIdentity);
+  }
+  async listConfigSummariesPage(filter = {}, options = {}) {
+    const normalized = normalizeBoundedReadOptions(options);
+    const params = new URLSearchParams;
+    if (filter.category)
+      params.set("category", filter.category);
+    if (filter.agent)
+      params.set("agent", filter.agent);
+    if (filter.kind)
+      params.set("kind", filter.kind);
+    if (filter.search)
+      params.set("search", filter.search);
+    for (const tag of filter.tags ?? [])
+      params.append("tag", tag);
+    params.set("view", "summary");
+    params.set("limit", String(normalized.limit));
+    params.set("cursor", String(normalized.cursor));
+    const { data } = await this.request("GET", `/configs?${params.toString()}`);
+    const page = parseBoundedOrLegacyPage(data, data?.configs, normalized, "config summary list");
+    if (page.items.some((item) => {
+      const record = item && typeof item === "object" ? item : {};
+      return Object.prototype.hasOwnProperty.call(record, "content") || Object.prototype.hasOwnProperty.call(record, "outputs");
+    })) {
+      throw new Error("Instructions /v1 config summary projection is unavailable; deploy the summary endpoint before using summary lists");
+    }
+    return projectBoundedPage(page, toConfigSummary);
+  }
+  async listConfigs(filter = {}) {
+    const configs = await aggregateBoundedCollection("config list", (cursor) => this.listConfigsPage(filter, { limit: 100, cursor }), (config) => config.id, { requireAscendingIdentity: true });
+    let filtered = configs;
     if (filter.tags && filter.tags.length > 0) {
-      configs = configs.filter((c) => filter.tags.every((t) => c.tags.includes(t)));
+      filtered = filtered.filter((config) => filter.tags.every((tag) => config.tags.includes(tag)));
     }
     if (filter.is_template !== undefined) {
-      configs = configs.filter((c) => c.is_template === filter.is_template);
+      filtered = filtered.filter((config) => config.is_template === filter.is_template);
     }
-    return configs;
+    return filtered;
   }
   async getConfig(idOrSlug) {
     const { status, data } = await this.request("GET", `/configs/${encodeURIComponent(idOrSlug)}`, undefined, { allow404: true });
@@ -2268,8 +2409,11 @@ class CloudConfigStore {
     return data ?? { total: 0 };
   }
   async listSnapshots(configId) {
-    const { data } = await this.request("GET", `/configs/${encodeURIComponent(configId)}/snapshots`);
-    return data?.snapshots ?? [];
+    return aggregateBoundedCollection("snapshot list", async (cursor) => {
+      const normalized = normalizeBoundedReadOptions({ limit: 100, cursor });
+      const { data } = await this.request("GET", `/configs/${encodeURIComponent(configId)}/snapshots?limit=${normalized.limit}&cursor=${normalized.cursor}`);
+      return parseBoundedOrLegacyPage(data, data?.snapshots, normalized, "snapshot list");
+    }, (snapshot) => snapshot.id);
   }
   async getSnapshot(id) {
     const { status, data } = await this.request("GET", `/snapshots/${encodeURIComponent(id)}`, undefined, { allow404: true });
@@ -2292,15 +2436,7 @@ class CloudConfigStore {
     return data?.pruned ?? 0;
   }
   async listProfiles() {
-    const profiles = [];
-    let cursor = 0;
-    while (true) {
-      const page = await this.listProfilesPage({ limit: 100, cursor });
-      profiles.push(...page.items);
-      if (page.complete)
-        return profiles;
-      cursor = page.next_cursor;
-    }
+    return aggregateBoundedCollection("profile list", (cursor) => this.listProfilesPage({ limit: 100, cursor }), (profile) => profile.id);
   }
   async listProfilesPage(options = {}) {
     const normalized = normalizeBoundedReadOptions(options);
@@ -2324,15 +2460,7 @@ class CloudConfigStore {
     return profile;
   }
   async getProfileConfigs(idOrSlug) {
-    const configs = [];
-    let cursor = 0;
-    while (true) {
-      const page = await this.getProfileConfigsPage(idOrSlug, { limit: 100, cursor });
-      configs.push(...page.items);
-      if (page.complete)
-        return configs;
-      cursor = page.next_cursor;
-    }
+    return aggregateBoundedCollection("profile membership", (cursor) => this.getProfileConfigsPage(idOrSlug, { limit: 100, cursor }), (config) => config.id);
   }
   async getProfileConfigsPage(idOrSlug, options = {}) {
     const normalized = normalizeBoundedReadOptions(options);
@@ -2346,20 +2474,26 @@ class CloudConfigStore {
     return parseBoundedOrLegacyPage(data.configs, data.profile.configs, normalized, "profile membership");
   }
   async getProfileConfigBindings(idOrSlug) {
-    const { status, data } = await this.requestProfileRoute(idOrSlug, (profileId) => `/profiles/${encodeURIComponent(profileId)}/bindings`, (value) => Array.isArray(value?.bindings));
-    if (status === 404) {
-      const profile = await this.getProfile(idOrSlug);
-      const configs = await this.getProfileConfigs(idOrSlug);
-      return configs.map((config, sort_order) => ({
-        profile_id: profile.id,
-        config_id: config.id,
-        sort_order,
-        binding: legacyProfileConfigBinding()
-      }));
-    }
-    if (!data || !Array.isArray(data.bindings))
-      throw new ProfileNotFoundError(idOrSlug);
-    return data.bindings;
+    let routeMissing = false;
+    const bindings = await aggregateBoundedCollection("profile config bindings", async (cursor) => {
+      const normalized = normalizeBoundedReadOptions({ limit: 100, cursor });
+      const { status, data } = await this.requestProfileRoute(idOrSlug, (profileId) => `/profiles/${encodeURIComponent(profileId)}/bindings?limit=${normalized.limit}&cursor=${normalized.cursor}`, (value) => Boolean(value && (Array.isArray(value.bindings) || Array.isArray(value.items))));
+      if (status === 404) {
+        routeMissing = true;
+        return { ...boundedReadPage([], 0, normalized), source_bounded: false };
+      }
+      return parseBoundedOrLegacyPage(data, data?.bindings, normalized, "profile config bindings");
+    }, (binding) => `${binding.profile_id}\x00${binding.config_id}`);
+    if (!routeMissing)
+      return bindings;
+    const profile = await this.getProfile(idOrSlug);
+    const configs = await this.getProfileConfigs(idOrSlug);
+    return configs.map((config, sort_order) => ({
+      profile_id: profile.id,
+      config_id: config.id,
+      sort_order,
+      binding: legacyProfileConfigBinding()
+    }));
   }
   async requestProfileRoute(idOrSlug, pathForId, isUsable) {
     const attempted = new Set;
@@ -2417,14 +2551,20 @@ class CloudConfigStore {
     await this.request("DELETE", `/profiles/${encodeURIComponent(profileIdOrSlug)}/configs/${encodeURIComponent(configId)}`, undefined, { allow404: true });
   }
   async getProfileAssetBindings(profileIdOrSlug) {
-    const { status, data } = await this.requestProfileRoute(profileIdOrSlug, (profileId) => `/profiles/${encodeURIComponent(profileId)}/assets`, (value) => Array.isArray(value?.assets));
-    if (status === 404) {
-      await this.getProfile(profileIdOrSlug);
-      return [];
-    }
-    if (!data || !Array.isArray(data.assets))
-      throw new ProfileNotFoundError(profileIdOrSlug);
-    return data.assets;
+    let routeMissing = false;
+    const assets = await aggregateBoundedCollection("profile asset bindings", async (cursor) => {
+      const normalized = normalizeBoundedReadOptions({ limit: 100, cursor });
+      const { status, data } = await this.requestProfileRoute(profileIdOrSlug, (profileId) => `/profiles/${encodeURIComponent(profileId)}/assets?limit=${normalized.limit}&cursor=${normalized.cursor}`, (value) => Boolean(value && (Array.isArray(value.assets) || Array.isArray(value.items))));
+      if (status === 404) {
+        routeMissing = true;
+        return { ...boundedReadPage([], 0, normalized), source_bounded: false };
+      }
+      return parseBoundedOrLegacyPage(data, data?.assets, normalized, "profile asset bindings");
+    }, (asset) => `${asset.profile_id}\x00${asset.binding.assetKey}`);
+    if (!routeMissing)
+      return assets;
+    await this.getProfile(profileIdOrSlug);
+    return [];
   }
   async addAssetToProfile(profileIdOrSlug, sourceConfigId, binding) {
     const { data } = await this.request("POST", `/profiles/${encodeURIComponent(profileIdOrSlug)}/assets`, { source_config_id: sourceConfigId, binding }, { idempotent: true });
@@ -2494,8 +2634,11 @@ class CloudConfigStore {
     await this.request("POST", "/machines/applied", { hostname });
   }
   async listMachines() {
-    const { data } = await this.request("GET", "/machines");
-    return data?.machines ?? [];
+    return aggregateBoundedCollection("machine list", async (cursor) => {
+      const normalized = normalizeBoundedReadOptions({ limit: 100, cursor });
+      const { data } = await this.request("GET", `/machines?limit=${normalized.limit}&cursor=${normalized.cursor}`);
+      return parseBoundedOrLegacyPage(data, data?.machines, normalized, "machine list");
+    }, (machine) => machine.id, { requireAscendingIdentity: true });
   }
   async sendFeedback(input) {
     await this.request("POST", "/feedback", {
@@ -7245,4 +7388,4 @@ function renderMachineAwareContentPreview(content, variables) {
   return isTemplate(content) ? renderTemplatePreview(content, variables) : { content, unresolved: [] };
 }
 
-export { pagedPayload, summarizeConfig, summarizeProfile, summarizeApplyResult, normalizeBoundedReadOptions, boundedReadPage, SESSION_RENDER_SCHEMA, SESSION_RENDER_MANIFEST_RELATIVE_PATH, isRetiredOrUnsupportedConfigAgent, retiredOrUnsupportedAgentReason, applyTransform, normalizeProfileAssetBinding, isCursorGlobalAuthorityPath, stampCursorGlobalAuthorityMarker, getReportedDbPath, getRawStoreRoot, ANTIGRAVITY_RULE_FILE_CHAR_LIMIT, SESSION_RENDERER_OWNER_ID, SESSION_RENDER_OWNED_CONFIG_TARGETS, SESSION_RENDER_EXCLUSIVE_MANAGED_PATHS, legacyProfileConfigBinding, normalizeProfileConfigBinding, hasInstructionsEnvAuthorityIntent, normalizeOsFamily, detectMachineContext, machineContextToVariables, resolveProfileVariables, templateizeMachineContent, renderMachineAwareContentPreview, resolveConfigStore };
+export { pagedPayload, summarizeProfile, summarizeApplyResult, normalizeBoundedReadOptions, boundedReadPage, SESSION_RENDER_SCHEMA, SESSION_RENDER_MANIFEST_RELATIVE_PATH, isRetiredOrUnsupportedConfigAgent, retiredOrUnsupportedAgentReason, applyTransform, normalizeProfileAssetBinding, isCursorGlobalAuthorityPath, stampCursorGlobalAuthorityMarker, getReportedDbPath, getRawStoreRoot, ANTIGRAVITY_RULE_FILE_CHAR_LIMIT, SESSION_RENDERER_OWNER_ID, SESSION_RENDER_OWNED_CONFIG_TARGETS, SESSION_RENDER_EXCLUSIVE_MANAGED_PATHS, legacyProfileConfigBinding, normalizeProfileConfigBinding, hasInstructionsEnvAuthorityIntent, normalizeOsFamily, detectMachineContext, machineContextToVariables, resolveProfileVariables, templateizeMachineContent, renderMachineAwareContentPreview, resolveConfigStore };