@hasna/instructions 0.6.1 → 0.7.1

package/dist/cli/index.js

@@ -1,8 +1,5 @@
 #!/usr/bin/env bun
 // @bun
-import {
-  slugify
-} from "../chunks/index-ma2xmp6c.js";
 import {
   KNOWN_CONFIGS,
   detectAgent,
@@ -12,12 +9,13 @@ import {
   syncKnown,
   syncProject,
   syncToDisk
-} from "../chunks/index-85n5wnd8.js";
+} from "../chunks/index-pdpg8a44.js";
 import {
   applyConfigsWithReport,
+  compactPathForConfigHome,
   expandPath,
   normalizeTargetPath
-} from "../chunks/index-e9epbsvs.js";
+} from "../chunks/index-r7nfef2g.js";
 import {
   CloudConfigStore,
   DEFAULT_LIST_LIMIT,
@@ -35,7 +33,6 @@ import {
   ensureCodewithSharedTodosStorageStandardConfig,
   ensureGlobalAgentRulesStandardConfig,
   formatCliError,
-  getRawStoreRoot,
   getSessionRenderSnapshotDir,
   isRetiredOrUnsupportedConfigAgent,
   normalizeProfileAssetBinding,
@@ -64,10 +61,18 @@ import {
   truncateText,
   withProjectContextSessionGuard,
   writeProjectContextCoordinatedFile
-} from "../chunks/index-1hpwskwd.js";
+} from "../chunks/index-6jncnnw7.js";
 import {
+  INSTRUCTIONS_DOMAIN_ARCHIVE_SCHEMA,
   extractTemplateVars
-} from "../chunks/index-pkscjnj5.js";
+} from "../chunks/index-n3fjspr0.js";
+import {
+  slugify
+} from "../chunks/index-ma2xmp6c.js";
+import {
+  getRawStoreRoot,
+  selectsInstructionsLocalStore
+} from "../chunks/index-fpeyzn3n.js";
 import {
   __commonJS,
   __require,
@@ -3224,11 +3229,11 @@ function setPath(input, path, replacement) {
   if (last && last in cursor)
     cursor[last] = replacement;
 }
+var MAX_PACKAGE_BYTES = 1024 * 1024;
 var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
 var INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
 var CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
 var AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
-var SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
 var requireSecretsSdk = createRequire(import.meta.url);
 var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
 var AUTHORITY_OVERRIDE_HEADERS = new Set([
@@ -3779,9 +3784,9 @@ var {
 
 // src/cli/index.tsx
 import chalk from "chalk";
-import { existsSync as existsSync12, lstatSync as lstatSync4, readFileSync as readFileSync8, readSync, writeSync } from "fs";
+import { existsSync as existsSync11, lstatSync as lstatSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync7, readSync, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync5, writeSync } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename, join as join11, resolve as resolve6 } from "path";
+import { basename, dirname as dirname6, join as join10, resolve as resolve6 } from "path";
 
 // src/lib/config-target-identity.ts
 function findConfigsByTargetPath(configs, targetPath) {
@@ -3820,124 +3825,690 @@ function findDuplicateTargetPathGroups(configs) {
 }
 
 // src/lib/export.ts
-import { existsSync as existsSync3, mkdirSync, rmSync, writeFileSync } from "fs";
-import { join as join3, resolve as resolve2 } from "path";
+import { createHash } from "crypto";
+import { existsSync as existsSync3, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import { dirname, join as join3, resolve as resolve2 } from "path";
 import { tmpdir } from "os";
-async function exportConfigs(outputPath, opts = {}) {
+var ARCHIVE_EXCLUSIONS = [
+  {
+    entity: "api_keys",
+    classification: "security_state",
+    reason: "API credentials are security state and must be provisioned independently, never copied in a domain archive."
+  },
+  {
+    entity: "idempotency_receipts",
+    classification: "transport_state",
+    reason: "Request replay receipts are transport state and are not portable business-domain data."
+  },
+  {
+    entity: "feedback",
+    classification: "out_of_domain",
+    reason: "Feedback is product telemetry, not part of the Instructions configuration domain."
+  }
+];
+function compareText(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function canonicalize(value) {
+  if (Array.isArray(value))
+    return value.map(canonicalize);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined).sort(([left], [right]) => compareText(left, right)).map(([key, entry]) => [key, canonicalize(entry)]));
+  }
+  return value;
+}
+function canonicalDomainJson(value) {
+  return JSON.stringify(canonicalize(value));
+}
+function logicalAssetLocator(locator, idToSlug) {
+  const match = /^config:\/\/([^@]+)@(\d+)$/.exec(locator);
+  if (!match)
+    return locator;
+  let configId;
+  try {
+    configId = decodeURIComponent(match[1]);
+  } catch {
+    return locator;
+  }
+  const slug = idToSlug.get(configId);
+  return slug ? `config-slug://${encodeURIComponent(slug)}@${match[2]}` : locator;
+}
+function logicalCollections(domain, options) {
+  const configs = [...domain.configs].sort((left, right) => compareText(left.slug, right.slug));
+  const snapshots = domain.config_snapshots.map((snapshot) => ({
+    config_slug: snapshot.config_slug,
+    version: snapshot.version,
+    content: snapshot.content,
+    ...options.includeOperationalTimestamps ? { created_at: snapshot.created_at } : {}
+  })).sort((left, right) => compareText(left.config_slug, right.config_slug) || left.version - right.version || compareText(left.content, right.content) || compareText("created_at" in left ? left.created_at ?? "" : "", "created_at" in right ? right.created_at ?? "" : ""));
+  const profiles = [...domain.profiles].sort((left, right) => compareText(left.slug, right.slug));
+  const configBindings = [...domain.profile_config_bindings].sort((left, right) => compareText(left.profile_slug, right.profile_slug) || left.sort_order - right.sort_order || compareText(left.config_slug, right.config_slug));
+  const assetBindings = [...domain.profile_asset_bindings].sort((left, right) => compareText(left.profile_slug, right.profile_slug) || left.sort_order - right.sort_order || compareText(left.binding.assetKey, right.binding.assetKey));
+  const machines = [...domain.machines].sort((left, right) => compareText(left.hostname, right.hostname));
+  const idToSlug = new Map(configs.map((config) => [config.id, config.slug]));
+  const configOrder = new Map;
+  const assetOrder = new Map;
+  return {
+    configs: configs.map((config) => ({
+      slug: config.slug,
+      name: config.name,
+      kind: config.kind,
+      category: config.category,
+      agent: config.agent,
+      target_path: config.target_path,
+      outputs: config.outputs,
+      format: config.format,
+      content: config.content,
+      description: config.description,
+      tags: [...config.tags].sort(compareText),
+      is_template: config.is_template,
+      version: config.version,
+      ...options.includeOperationalTimestamps ? {
+        created_at: config.created_at,
+        updated_at: config.updated_at,
+        synced_at: config.synced_at
+      } : {}
+    })),
+    config_snapshots: snapshots,
+    profiles: profiles.map((profile) => ({
+      slug: profile.slug,
+      name: profile.name,
+      description: profile.description,
+      selectors: profile.selectors,
+      variables: profile.variables,
+      ...options.includeOperationalTimestamps ? {
+        created_at: profile.created_at,
+        updated_at: profile.updated_at
+      } : {}
+    })),
+    profile_config_bindings: configBindings.map((row) => {
+      const order = configOrder.get(row.profile_slug) ?? 0;
+      configOrder.set(row.profile_slug, order + 1);
+      return {
+        profile_slug: row.profile_slug,
+        config_slug: row.config_slug,
+        order,
+        binding: row.binding
+      };
+    }),
+    profile_asset_bindings: assetBindings.map((row) => {
+      const order = assetOrder.get(row.profile_slug) ?? 0;
+      assetOrder.set(row.profile_slug, order + 1);
+      return {
+        profile_slug: row.profile_slug,
+        source_config_slug: row.source_config_slug,
+        order,
+        binding: {
+          ...row.binding,
+          source: {
+            ...row.binding.source,
+            locator: logicalAssetLocator(row.binding.source.locator, idToSlug)
+          }
+        }
+      };
+    }),
+    machines: machines.map((machine) => ({
+      hostname: machine.hostname,
+      os: machine.os,
+      arch: machine.arch,
+      ...options.includeOperationalTimestamps ? {
+        created_at: machine.created_at,
+        last_applied_at: machine.last_applied_at
+      } : {
+        applied: machine.last_applied_at !== null
+      }
+    }))
+  };
+}
+function computeIntegrity(domain, options) {
+  const collections = logicalCollections(domain, options);
+  const counts = {
+    configs: collections.configs.length,
+    config_snapshots: collections.config_snapshots.length,
+    profiles: collections.profiles.length,
+    profile_config_bindings: collections.profile_config_bindings.length,
+    profile_asset_bindings: collections.profile_asset_bindings.length,
+    machines: collections.machines.length
+  };
+  const hashes = {
+    configs: sha256(canonicalDomainJson(collections.configs)),
+    config_snapshots: sha256(canonicalDomainJson(collections.config_snapshots)),
+    profiles: sha256(canonicalDomainJson(collections.profiles)),
+    profile_config_bindings: sha256(canonicalDomainJson(collections.profile_config_bindings)),
+    profile_asset_bindings: sha256(canonicalDomainJson(collections.profile_asset_bindings)),
+    machines: sha256(canonicalDomainJson(collections.machines))
+  };
+  return {
+    algorithm: "sha256",
+    canonicalization: options.canonicalization,
+    counts,
+    hashes,
+    domain_sha256: sha256(canonicalDomainJson({ counts, hashes }))
+  };
+}
+function computeDomainIntegrity(domain) {
+  return computeIntegrity(domain, {
+    includeOperationalTimestamps: true,
+    canonicalization: "hasna.instructions.logical-json/v1"
+  });
+}
+function computeRestorableDomainIntegrity(domain) {
+  return computeIntegrity(domain, {
+    includeOperationalTimestamps: false,
+    canonicalization: "hasna.instructions.restorable-logical-json/v1"
+  });
+}
+function assertArray(value, label) {
+  if (!Array.isArray(value))
+    throw new Error(`Invalid v2 archive: ${label} must be an array`);
+}
+function assertUnique(values, label) {
+  const seen = new Set;
+  for (const value of values) {
+    if (!value || seen.has(value))
+      throw new Error(`Invalid v2 archive: duplicate or empty ${label} ${JSON.stringify(value)}`);
+    seen.add(value);
+  }
+}
+function assertTimestamp(value, label, nullable = false) {
+  if (nullable && value === null)
+    return;
+  if (typeof value !== "string" || value.length === 0 || Number.isNaN(Date.parse(value))) {
+    throw new Error(`Invalid v2 archive: ${label} must be ${nullable ? "null or " : ""}an ISO timestamp`);
+  }
+}
+function validateInstructionsDomainArchive(value) {
+  if (!value || typeof value !== "object")
+    throw new Error("Invalid v2 archive: domain payload must be an object");
+  const domain = value;
+  if (domain.schema !== INSTRUCTIONS_DOMAIN_ARCHIVE_SCHEMA)
+    throw new Error("Invalid v2 archive: unsupported domain schema");
+  assertArray(domain.configs, "configs");
+  assertArray(domain.config_snapshots, "config_snapshots");
+  assertArray(domain.profiles, "profiles");
+  assertArray(domain.profile_config_bindings, "profile_config_bindings");
+  assertArray(domain.profile_asset_bindings, "profile_asset_bindings");
+  assertArray(domain.machines, "machines");
+  const typed = domain;
+  assertUnique(typed.configs.map((row) => row.slug), "config slug");
+  assertUnique(typed.profiles.map((row) => row.slug), "profile slug");
+  assertUnique(typed.machines.map((row) => row.hostname), "machine hostname");
+  assertUnique(typed.config_snapshots.map((row) => row.id), "config snapshot id");
+  assertUnique(typed.profile_config_bindings.map((row) => `${row.profile_slug}:${row.config_slug}`), "profile config binding");
+  assertUnique(typed.profile_asset_bindings.map((row) => `${row.profile_slug}:${row.binding.assetKey}`), "profile asset binding");
+  const configsBySlug = new Map(typed.configs.map((row) => [row.slug, row]));
+  const configSlugs = new Set(configsBySlug.keys());
+  const profileSlugs = new Set(typed.profiles.map((row) => row.slug));
+  for (const config of typed.configs) {
+    assertTimestamp(config.created_at, `config ${config.slug} created_at`);
+    assertTimestamp(config.updated_at, `config ${config.slug} updated_at`);
+    assertTimestamp(config.synced_at, `config ${config.slug} synced_at`, true);
+    if (!Number.isSafeInteger(config.version) || config.version < 1)
+      throw new Error(`Invalid v2 archive: config ${config.slug} has invalid version`);
+  }
+  for (const row of typed.config_snapshots) {
+    const config = configsBySlug.get(row.config_slug);
+    if (!config) {
+      throw new Error(`Invalid v2 archive: snapshot references missing config ${row.config_slug}`);
+    }
+    if (!Number.isSafeInteger(row.version) || row.version < 1 || row.version > config.version) {
+      throw new Error(`Invalid v2 archive: config ${row.config_slug} has an invalid snapshot version`);
+    }
+    assertTimestamp(row.created_at, `snapshot ${row.config_slug}@${row.version} created_at`);
+  }
+  for (const profile of typed.profiles) {
+    assertTimestamp(profile.created_at, `profile ${profile.slug} created_at`);
+    assertTimestamp(profile.updated_at, `profile ${profile.slug} updated_at`);
+  }
+  for (const row of typed.profile_config_bindings) {
+    if (!profileSlugs.has(row.profile_slug) || !configSlugs.has(row.config_slug)) {
+      throw new Error(`Invalid v2 archive: profile config binding has a missing logical reference`);
+    }
+  }
+  for (const row of typed.profile_asset_bindings) {
+    if (!profileSlugs.has(row.profile_slug) || !configSlugs.has(row.source_config_slug)) {
+      throw new Error(`Invalid v2 archive: profile asset binding has a missing logical reference`);
+    }
+  }
+  for (const machine of typed.machines) {
+    assertTimestamp(machine.created_at, `machine ${machine.hostname} created_at`);
+    assertTimestamp(machine.last_applied_at, `machine ${machine.hostname} last_applied_at`, true);
+  }
+  return typed;
+}
+function matchesFilter(config, filter) {
+  if (!filter)
+    return true;
+  if (filter.category && config.category !== filter.category)
+    return false;
+  if (filter.agent && config.agent !== filter.agent)
+    return false;
+  if (filter.kind && config.kind !== filter.kind)
+    return false;
+  if (filter.is_template !== undefined && config.is_template !== filter.is_template)
+    return false;
+  if (filter.tags?.length && !filter.tags.every((tag) => config.tags.includes(tag)))
+    return false;
+  if (filter.search) {
+    const needle = filter.search.toLocaleLowerCase();
+    if (![config.name, config.description ?? "", config.content].some((value) => value.toLocaleLowerCase().includes(needle)))
+      return false;
+  }
+  return true;
+}
+async function collectInstructionsDomain(opts = {}) {
   const store = opts.store ?? resolveConfigStore();
-  const configs = await store.listConfigs(opts.filter);
+  const selectedProfile = opts.profileId ? await store.getProfile(opts.profileId) : null;
+  const listedConfigs = selectedProfile ? await store.getProfileConfigs(selectedProfile.id) : await store.listConfigs(opts.filter);
+  const configs = listedConfigs.filter((config) => matchesFilter(config, selectedProfile ? opts.filter : undefined));
+  configs.sort((left, right) => compareText(left.slug, right.slug));
+  const selectedIds = new Set(configs.map((config) => config.id));
+  const profiles = (selectedProfile ? [selectedProfile] : await store.listProfiles()).sort((left, right) => compareText(left.slug, right.slug));
+  const profileById = new Map(profiles.map((profile) => [profile.id, profile]));
+  const configById = new Map(configs.map((config) => [config.id, config]));
+  const configSnapshots = [];
+  for (const config of configs) {
+    for (const snapshot of await store.listSnapshots(config.id)) {
+      configSnapshots.push({
+        id: snapshot.id,
+        config_slug: config.slug,
+        content: snapshot.content,
+        version: snapshot.version,
+        created_at: snapshot.created_at
+      });
+    }
+  }
+  configSnapshots.sort((left, right) => compareText(left.config_slug, right.config_slug) || left.version - right.version || compareText(left.id, right.id));
+  const profileConfigBindings = (await Promise.all(profiles.map(async (profile) => (await store.getProfileConfigBindings(profile.id)).filter((row) => selectedIds.has(row.config_id)).map((row) => ({
+    profile_slug: profile.slug,
+    config_slug: configById.get(row.config_id).slug,
+    sort_order: row.sort_order,
+    binding: row.binding
+  }))))).flat().sort((left, right) => compareText(left.profile_slug, right.profile_slug) || left.sort_order - right.sort_order || compareText(left.config_slug, right.config_slug));
+  const profileAssetBindings = (await Promise.all(profiles.map(async (profile) => (await store.getProfileAssetBindings(profile.id)).filter((row) => selectedIds.has(row.source_config_id)).map((row) => ({
+    profile_slug: profile.slug,
+    source_config_slug: configById.get(row.source_config_id).slug,
+    sort_order: row.sort_order,
+    binding: row.binding
+  }))))).flat().sort((left, right) => compareText(left.profile_slug, right.profile_slug) || left.sort_order - right.sort_order || compareText(left.binding.assetKey, right.binding.assetKey));
+  const archivedProfiles = profiles.filter((profile) => profileById.has(profile.id));
+  const machines = (await store.listMachines()).sort((left, right) => compareText(left.hostname, right.hostname));
+  return {
+    schema: INSTRUCTIONS_DOMAIN_ARCHIVE_SCHEMA,
+    configs,
+    config_snapshots: configSnapshots,
+    profiles: archivedProfiles,
+    profile_config_bindings: profileConfigBindings,
+    profile_asset_bindings: profileAssetBindings,
+    machines
+  };
+}
+async function exportConfigs(outputPath, opts = {}) {
+  const domain = validateInstructionsDomainArchive(await collectInstructionsDomain(opts));
+  const integrity = computeDomainIntegrity(domain);
+  const payload = `${JSON.stringify(domain, null, 2)}
+`;
+  const manifest = {
+    schema: INSTRUCTIONS_DOMAIN_ARCHIVE_SCHEMA,
+    version: "2.0.0",
+    exported_at: new Date().toISOString(),
+    payload: {
+      path: "domain.json",
+      sha256: sha256(payload),
+      size_bytes: Buffer.byteLength(payload)
+    },
+    integrity,
+    exclusions: ARCHIVE_EXCLUSIONS
+  };
   const absOutput = resolve2(outputPath);
-  const tmpDir = join3(tmpdir(), `configs-export-${Date.now()}`);
-  const contentsDir = join3(tmpDir, "contents");
+  mkdirSync(dirname(absOutput), { recursive: true });
+  const stagingDir = mkdtempSync(join3(tmpdir(), "instructions-domain-export-"));
   try {
-    mkdirSync(contentsDir, { recursive: true });
-    const manifest = {
-      version: "1.0.0",
-      exported_at: new Date().toISOString(),
-      configs: configs.map(({ content: _content, ...meta }) => meta)
-    };
-    writeFileSync(join3(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
-    for (const config of configs) {
-      const fileName = `${config.slug}.${config.format === "text" ? "txt" : config.format}`;
-      writeFileSync(join3(contentsDir, fileName), config.content, "utf-8");
-    }
-    const proc = Bun.spawn(["tar", "czf", absOutput, "-C", tmpDir, "."], {
+    writeFileSync(join3(stagingDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+`, "utf-8");
+    writeFileSync(join3(stagingDir, "domain.json"), payload, "utf-8");
+    const proc = Bun.spawn(["tar", "czf", absOutput, "-C", stagingDir, "manifest.json", "domain.json"], {
       stdout: "pipe",
       stderr: "pipe"
     });
     const exitCode = await proc.exited;
     if (exitCode !== 0) {
       const stderr = await new Response(proc.stderr).text();
-      throw new Error(`tar failed: ${stderr}`);
+      throw new Error(`tar failed: ${stderr.trim()}`);
     }
-    return { path: absOutput, count: configs.length };
+    return { path: absOutput, count: domain.configs.length, counts: integrity.counts, integrity };
   } finally {
-    if (existsSync3(tmpDir)) {
-      rmSync(tmpDir, { recursive: true, force: true });
-    }
+    if (existsSync3(stagingDir))
+      rmSync(stagingDir, { recursive: true, force: true });
   }
 }
 
 // src/lib/import.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync, rmSync as rmSync2 } from "fs";
-import { join as join5, resolve as resolve3 } from "path";
-import { tmpdir as tmpdir2 } from "os";
-async function importConfigs(bundlePath, opts = {}) {
-  const store = opts.store ?? resolveConfigStore();
-  const conflict = opts.conflict ?? "skip";
-  const absPath = resolve3(bundlePath);
-  const tmpDir = join5(tmpdir2(), `configs-import-${Date.now()}`);
-  const result = { created: 0, updated: 0, skipped: 0, errors: [] };
+import { createHash as createHash2 } from "crypto";
+import { resolve as resolve3 } from "path";
+function compareText2(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function emptyMutationCounts() {
+  return { created: 0, updated: 0, skipped: 0 };
+}
+function emptyResult() {
+  return {
+    created: 0,
+    updated: 0,
+    skipped: 0,
+    counts: {
+      configs: emptyMutationCounts(),
+      config_snapshots: { created: 0, skipped: 0 },
+      profiles: emptyMutationCounts(),
+      profile_config_bindings: emptyMutationCounts(),
+      profile_asset_bindings: emptyMutationCounts(),
+      machines: emptyMutationCounts()
+    },
+    errors: [],
+    integrity: null
+  };
+}
+function sha2562(value) {
+  return createHash2("sha256").update(value).digest("hex");
+}
+function normalizeMemberName(name) {
+  let normalized = name;
+  while (normalized.startsWith("./"))
+    normalized = normalized.slice(2);
+  if (normalized.startsWith("/") || normalized.includes("\x00") || normalized.split("/").some((segment) => segment === "..")) {
+    throw new Error(`Invalid archive member path: ${JSON.stringify(name)}`);
+  }
+  return normalized;
+}
+async function openArchive(path) {
+  const list = Bun.spawn(["tar", "tzf", path], { stdout: "pipe", stderr: "pipe" });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    list.exited,
+    new Response(list.stdout).text(),
+    new Response(list.stderr).text()
+  ]);
+  if (exitCode !== 0)
+    throw new Error(`tar listing failed: ${stderr.trim()}`);
+  const members = new Map;
+  for (const raw of stdout.split(`
+`).filter(Boolean)) {
+    const normalized = normalizeMemberName(raw);
+    if (normalized.length === 0)
+      continue;
+    if (members.has(normalized))
+      throw new Error(`Invalid archive: duplicate member ${normalized}`);
+    members.set(normalized, raw);
+  }
+  return {
+    members,
+    async read(member) {
+      const actual = members.get(member);
+      if (!actual)
+        throw new Error(`Invalid archive: missing ${member}`);
+      const proc = Bun.spawn(["tar", "xOzf", path, "--", actual], { stdout: "pipe", stderr: "pipe" });
+      const [code, content, memberError] = await Promise.all([
+        proc.exited,
+        new Response(proc.stdout).text(),
+        new Response(proc.stderr).text()
+      ]);
+      if (code !== 0)
+        throw new Error(`tar read failed for ${member}: ${memberError.trim()}`);
+      return content;
+    }
+  };
+}
+function isNotFound(error) {
+  return Boolean(error && typeof error === "object" && (error.name === "ConfigNotFoundError" || error.name === "ProfileNotFoundError" || error.status === 404));
+}
+async function findConfig(store, slug) {
   try {
-    mkdirSync2(tmpDir, { recursive: true });
-    const proc = Bun.spawn(["tar", "xzf", absPath, "-C", tmpDir], {
-      stdout: "pipe",
-      stderr: "pipe"
+    return await store.getConfig(slug);
+  } catch (error) {
+    if (isNotFound(error))
+      return null;
+    throw error;
+  }
+}
+function verifyCounts(actual, expected) {
+  if (canonicalDomainJson(actual) !== canonicalDomainJson(expected)) {
+    throw new Error("Archive integrity failure: manifest counts do not match the domain payload");
+  }
+}
+async function readV2(reader, manifest) {
+  if (manifest.schema !== INSTRUCTIONS_DOMAIN_ARCHIVE_SCHEMA || manifest.version !== "2.0.0" || manifest.payload?.path !== "domain.json" || manifest.integrity?.algorithm !== "sha256" || manifest.integrity?.canonicalization !== "hasna.instructions.logical-json/v1") {
+    throw new Error("Invalid v2 archive manifest");
+  }
+  const payload = await reader.read("domain.json");
+  if (Buffer.byteLength(payload) !== manifest.payload.size_bytes || sha2562(payload) !== manifest.payload.sha256) {
+    throw new Error("Archive integrity failure: domain payload hash or size does not match the manifest");
+  }
+  const domain = validateInstructionsDomainArchive(JSON.parse(payload));
+  const actual = computeDomainIntegrity(domain);
+  verifyCounts(actual.counts, manifest.integrity.counts);
+  if (canonicalDomainJson(actual) !== canonicalDomainJson(manifest.integrity)) {
+    throw new Error("Archive integrity failure: logical domain hashes do not match the manifest");
+  }
+  return domain;
+}
+function configInput(config, content) {
+  return {
+    name: config.name,
+    kind: config.kind,
+    category: config.category,
+    agent: config.agent,
+    target_path: config.target_path,
+    outputs: config.outputs,
+    format: config.format,
+    content,
+    description: config.description ?? undefined,
+    tags: config.tags,
+    is_template: config.is_template
+  };
+}
+async function restoreNewConfig(store, archived, domain) {
+  const snapshots = domain.config_snapshots.filter((row) => row.config_slug === archived.slug).sort((left, right) => left.version - right.version || compareText2(left.content, right.content) || compareText2(left.id, right.id));
+  let restored = await store.createConfig(configInput(archived, archived.content));
+  for (let version = 2;version <= archived.version; version++) {
+    restored = await store.updateConfig(restored.id, {
+      content: archived.content,
+      ...version === archived.version ? {
+        name: archived.name,
+        kind: archived.kind,
+        category: archived.category,
+        agent: archived.agent,
+        target_path: archived.target_path,
+        outputs: archived.outputs,
+        format: archived.format,
+        description: archived.description,
+        tags: archived.tags,
+        is_template: archived.is_template,
+        synced_at: archived.synced_at
+      } : {}
     });
-    const exitCode = await proc.exited;
-    if (exitCode !== 0) {
-      const stderr = await new Response(proc.stderr).text();
-      throw new Error(`tar extraction failed: ${stderr}`);
+  }
+  await store.pruneSnapshots(restored.id, 0);
+  for (const snapshot of snapshots) {
+    await store.createSnapshot(restored.id, snapshot.content, snapshot.version);
+  }
+  const restoredSnapshots = (await store.listSnapshots(restored.id)).map(({ version, content: snapshotContent }) => ({ version, content: snapshotContent })).sort((left, right) => left.version - right.version || compareText2(left.content, right.content));
+  const expectedSnapshots = snapshots.map(({ version, content: snapshotContent }) => ({ version, content: snapshotContent })).sort((left, right) => left.version - right.version || compareText2(left.content, right.content));
+  if (restored.version !== archived.version || restored.content !== archived.content || canonicalDomainJson(restoredSnapshots) !== canonicalDomainJson(expectedSnapshots)) {
+    throw new Error(`restored config or snapshot history did not match archive for ${archived.slug}`);
+  }
+  return restored;
+}
+function rewriteAssetLocator(binding, archivedSourceId, restoredSourceId) {
+  const match = /^config:\/\/([^@]+)@(\d+)$/.exec(binding.source.locator);
+  if (!match)
+    return binding;
+  let locatorId;
+  try {
+    locatorId = decodeURIComponent(match[1]);
+  } catch {
+    return binding;
+  }
+  if (locatorId !== archivedSourceId)
+    return binding;
+  return {
+    ...binding,
+    source: {
+      ...binding.source,
+      locator: `config://${encodeURIComponent(restoredSourceId)}@${match[2]}`
     }
-    const manifestPath = join5(tmpDir, "manifest.json");
-    if (!existsSync5(manifestPath))
-      throw new Error("Invalid bundle: missing manifest.json");
-    const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
-    for (const meta of manifest.configs) {
-      try {
-        const ext = meta.format === "text" ? "txt" : meta.format;
-        const contentFile = join5(tmpDir, "contents", `${meta.slug}.${ext}`);
-        const content = existsSync5(contentFile) ? readFileSync(contentFile, "utf-8") : "";
-        let existing = null;
-        try {
-          existing = await store.getConfig(meta.slug);
-        } catch {}
-        if (existing) {
-          if (conflict === "skip") {
-            result.skipped++;
-          } else if (conflict === "overwrite" || conflict === "version") {
-            await store.updateConfig(existing.id, { content, description: meta.description ?? undefined, tags: meta.tags, outputs: meta.outputs });
-            result.updated++;
-          }
-        } else {
-          await store.createConfig({
-            name: meta.name,
-            kind: meta.kind,
-            category: meta.category,
-            agent: meta.agent,
-            target_path: meta.target_path ?? undefined,
-            outputs: meta.outputs,
-            format: meta.format,
-            content,
-            description: meta.description ?? undefined,
-            tags: meta.tags,
-            is_template: meta.is_template
-          });
-          result.created++;
-        }
-      } catch (err) {
-        result.errors.push(`${meta.slug}: ${err instanceof Error ? err.message : String(err)}`);
+  };
+}
+async function assertEmptyV2Destination(store) {
+  const [configs, profiles, machines] = await Promise.all([
+    store.listConfigs(),
+    store.listProfiles(),
+    store.listMachines()
+  ]);
+  if (configs.length > 0 || profiles.length > 0 || machines.length > 0) {
+    throw new Error(`Instructions domain archive v2 recovery requires an empty destination ` + `(found configs=${configs.length}, profiles=${profiles.length}, machines=${machines.length})`);
+  }
+}
+async function importV2(domain, manifest, store, conflict) {
+  if (conflict !== "skip") {
+    throw new Error(`Instructions domain archive v2 does not support ${conflict}; restore into an empty destination`);
+  }
+  await assertEmptyV2Destination(store);
+  const result = emptyResult();
+  result.integrity = manifest.integrity;
+  const configMap = new Map;
+  for (const archived of domain.configs) {
+    const restored = await restoreNewConfig(store, archived, domain);
+    configMap.set(archived.slug, restored);
+    result.counts.configs.created++;
+    result.created++;
+    result.counts.config_snapshots.created += domain.config_snapshots.filter((row) => row.config_slug === archived.slug).length;
+  }
+  const profileMap = new Map;
+  for (const archived of domain.profiles) {
+    const created = await store.createProfile({
+      name: archived.name,
+      description: archived.description ?? undefined,
+      selectors: archived.selectors,
+      variables: archived.variables
+    });
+    profileMap.set(archived.slug, created);
+    result.counts.profiles.created++;
+  }
+  for (const archived of domain.profiles) {
+    const restoredProfile = profileMap.get(archived.slug);
+    if (!restoredProfile)
+      throw new Error(`post-create profile mapping missing for ${archived.slug}`);
+    const archivedMembership = domain.profile_config_bindings.filter((row) => row.profile_slug === archived.slug).sort((left, right) => left.sort_order - right.sort_order || compareText2(left.config_slug, right.config_slug));
+    const archivedAssets = domain.profile_asset_bindings.filter((row) => row.profile_slug === archived.slug).sort((left, right) => left.sort_order - right.sort_order || compareText2(left.binding.assetKey, right.binding.assetKey));
+    for (const row of archivedMembership) {
+      const config = configMap.get(row.config_slug);
+      if (!config)
+        throw new Error(`missing restored config ${row.config_slug}`);
+      await store.addConfigToProfile(restoredProfile.id, config.id);
+      await store.setProfileConfigBinding(restoredProfile.id, config.id, row.binding);
+      result.counts.profile_config_bindings.created++;
+    }
+    for (const row of archivedAssets) {
+      const source = configMap.get(row.source_config_slug);
+      const archivedSource = domain.configs.find((config) => config.slug === row.source_config_slug);
+      if (!source || !archivedSource)
+        throw new Error(`missing restored asset source ${row.source_config_slug}`);
+      await store.addAssetToProfile(restoredProfile.id, source.id, rewriteAssetLocator(row.binding, archivedSource.id, source.id));
+      result.counts.profile_asset_bindings.created++;
+    }
+  }
+  for (const archived of domain.machines) {
+    const restored = await store.registerMachine(archived.hostname, archived.os ?? undefined, archived.arch ?? undefined);
+    if (archived.last_applied_at !== null)
+      await store.updateMachineApplied(restored.hostname);
+    result.counts.machines.created++;
+  }
+  const restoredDomain = await collectInstructionsDomain({ store });
+  const expected = computeRestorableDomainIntegrity(domain);
+  const actual = computeRestorableDomainIntegrity(restoredDomain);
+  if (canonicalDomainJson(actual) !== canonicalDomainJson(expected)) {
+    throw new Error(`Post-restore logical integrity verification failed: expected ${expected.domain_sha256}, got ${actual.domain_sha256}`);
+  }
+  return result;
+}
+async function importV1(reader, manifest, store, conflict) {
+  const result = emptyResult();
+  if (!Array.isArray(manifest.configs))
+    throw new Error("Invalid v1 bundle: configs must be an array");
+  for (const meta of manifest.configs) {
+    const ext = meta.format === "text" ? "txt" : meta.format;
+    const contentPath = `contents/${meta.slug}.${ext}`;
+    const content = reader.members.has(contentPath) ? await reader.read(contentPath) : "";
+    const existing = await findConfig(store, meta.slug);
+    if (existing) {
+      if (conflict === "skip") {
+        result.skipped++;
+        result.counts.configs.skipped++;
+      } else {
+        await store.updateConfig(existing.id, {
+          name: meta.name,
+          kind: meta.kind,
+          category: meta.category,
+          agent: meta.agent,
+          target_path: meta.target_path,
+          outputs: meta.outputs,
+          format: meta.format,
+          content,
+          description: meta.description,
+          tags: meta.tags,
+          is_template: meta.is_template,
+          synced_at: meta.synced_at
+        });
+        result.updated++;
+        result.counts.configs.updated++;
       }
+    } else {
+      await store.createConfig(configInput({ ...meta, content }, content));
+      result.created++;
+      result.counts.configs.created++;
     }
-    return result;
-  } finally {
-    if (existsSync5(tmpDir)) {
-      rmSync2(tmpDir, { recursive: true, force: true });
-    }
   }
+  return result;
+}
+async function importConfigs(bundlePath, opts = {}) {
+  const store = opts.store ?? resolveConfigStore();
+  const conflict = opts.conflict ?? "skip";
+  const reader = await openArchive(resolve3(bundlePath));
+  const manifestText = await reader.read("manifest.json");
+  let manifest;
+  try {
+    manifest = JSON.parse(manifestText);
+  } catch {
+    throw new Error("Invalid bundle: manifest.json is not valid JSON");
+  }
+  if (!manifest || typeof manifest !== "object" || typeof manifest.version !== "string") {
+    throw new Error("Invalid bundle: manifest version is missing");
+  }
+  if (manifest.version === "2.0.0") {
+    const v2 = manifest;
+    const domain = await readV2(reader, v2);
+    return importV2(domain, v2, store, conflict);
+  }
+  if (manifest.version.startsWith("1.")) {
+    return importV1(reader, manifest, store, conflict);
+  }
+  throw new Error(`Unsupported Instructions archive version: ${manifest.version}`);
 }
 
 // src/lib/session-apply.ts
-import { createHash, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID3 } from "crypto";
 import {
-  existsSync as existsSync6,
+  existsSync as existsSync5,
   lstatSync,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync,
   readdirSync,
   statSync
 } from "fs";
-import { dirname, isAbsolute, join as join6, parse, relative, resolve as resolve4 } from "path";
+import { dirname as dirname2, isAbsolute, join as join5, parse, relative, resolve as resolve4 } from "path";
 class SessionApplyError extends Error {
   constructor(message) {
     super(message);
@@ -4068,8 +4639,8 @@ function assertClaudeAuthorityStillClear(plan, targetHome, ownedClaudeAuthoritie
   throw new SessionApplyError(`Claude authority changed after planning; refusing to apply: ${summary}`);
 }
 function ensureSessionTargetHome(targetHome) {
-  if (!existsSync6(targetHome))
-    mkdirSync3(targetHome, { recursive: true, mode: 448 });
+  if (!existsSync5(targetHome))
+    mkdirSync2(targetHome, { recursive: true, mode: 448 });
   assertSafeTargetHome(targetHome);
 }
 function checkSessionRenderDrift(targetHome, manifestPath) {
@@ -4091,7 +4662,7 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
   const drifted = [];
   for (const file of previousManifest.files) {
     const target = resolveManifestRelativePath(file.relativePath, safeTargetHome);
-    if (!existsSync6(target)) {
+    if (!existsSync5(target)) {
       missing.push({
         path: target,
         relativePath: file.relativePath,
@@ -4101,7 +4672,7 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
       });
       continue;
     }
-    const actualSha256 = sha256(readFileSync2(target, "utf-8"));
+    const actualSha256 = sha2563(readFileSync(target, "utf-8"));
     if (actualSha256 !== file.sha256) {
       drifted.push({
         path: target,
@@ -4248,7 +4819,7 @@ function requiredRestoreHash(file) {
 }
 function readSessionRenderSnapshot(snapshotPath) {
   const resolved = resolve4(snapshotPath);
-  if (!existsSync6(resolved))
+  if (!existsSync5(resolved))
     throw new SessionApplyError(`Session snapshot not found: ${snapshotPath}`);
   const stat = lstatSync(resolved);
   if (stat.isSymbolicLink() || !stat.isFile()) {
@@ -4259,7 +4830,7 @@ function readSessionRenderSnapshot(snapshotPath) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync2(resolved, "utf8"));
+    parsed = JSON.parse(readFileSync(resolved, "utf8"));
   } catch {
     throw new SessionApplyError(`Session snapshot is not valid JSON: ${snapshotPath}`);
   }
@@ -4281,7 +4852,7 @@ function readSessionRenderSnapshot(snapshotPath) {
   const previousManifest = snapshot.previousManifest;
   const previousFiles = new Map;
   for (const file of snapshot.files) {
-    if (!file || typeof file.relativePath !== "string" || typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.content !== "string" || sha256(file.content) !== file.sha256) {
+    if (!file || typeof file.relativePath !== "string" || typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.content !== "string" || sha2563(file.content) !== file.sha256) {
       throw new SessionApplyError(`Session snapshot previous file metadata is invalid: ${snapshotPath}`);
     }
     resolveSnapshotFilePath(file.relativePath, file.path, targetHome);
@@ -4337,7 +4908,7 @@ function reconstructPreRollbackLegacyV1Snapshot(snapshot, previousFiles, previou
   }
   let parsedManifest;
   try {
-    parsedManifest = JSON.parse(readFileSync2(manifestPath, "utf8"));
+    parsedManifest = JSON.parse(readFileSync(manifestPath, "utf8"));
   } catch {
     throw new SessionApplyError(`Pre-rollback legacy v1 applied manifest is not valid JSON: ${snapshotPath}`);
   }
@@ -4429,15 +5000,15 @@ function assertNoNewerSessionSnapshot(snapshotPath, createdAt, targetHome) {
   if (!Number.isFinite(createdAtMs)) {
     throw new SessionApplyError(`Pre-rollback legacy v1 snapshot has an invalid creation time: ${snapshotPath}`);
   }
-  for (const entry of readdirSync(dirname(snapshotPath))) {
-    const candidatePath = resolve4(dirname(snapshotPath), entry);
+  for (const entry of readdirSync(dirname2(snapshotPath))) {
+    const candidatePath = resolve4(dirname2(snapshotPath), entry);
     if (candidatePath === resolve4(snapshotPath) || !entry.endsWith(".json"))
       continue;
     const candidateStat = lstatSync(candidatePath);
     if (candidateStat.isSymbolicLink() || !candidateStat.isFile() || candidateStat.size > 32 * 1024 * 1024)
       continue;
     try {
-      const candidate = JSON.parse(readFileSync2(candidatePath, "utf8"));
+      const candidate = JSON.parse(readFileSync(candidatePath, "utf8"));
       const candidateCreatedAtMs = typeof candidate.createdAt === "string" ? Date.parse(candidate.createdAt) : Number.NaN;
       if ((candidate.schema === "hasna.configs.session-render-snapshot/v1" || candidate.schema === "hasna.configs.session-render-snapshot/v2") && typeof candidate.targetHome === "string" && resolve4(candidate.targetHome) === targetHome && Number.isFinite(candidateCreatedAtMs) && candidateCreatedAtMs >= createdAtMs) {
         throw new SessionApplyError(`Cannot restore pre-rollback legacy v1 snapshot after a newer session snapshot exists: ${candidatePath}`);
@@ -4497,7 +5068,7 @@ function inferLegacySnapshotAction(file, previousFiles, previousManifestFiles, p
     return "create";
   }
   if (file.role === "manifest" && previousManifest) {
-    const previousManifestSha256 = sha256(`${JSON.stringify(previousManifest, null, 2)}
+    const previousManifestSha256 = sha2563(`${JSON.stringify(previousManifest, null, 2)}
 `);
     if (previousManifestSha256 !== file.sha256) {
       throw new SessionApplyError(`Cannot infer legacy v1 manifest action without a before-image: ${file.relativePath}`);
@@ -4515,8 +5086,8 @@ function resolveSnapshotFilePath(relativePath, recordedPath, targetHome) {
 }
 function planFileResult(plan, file, targetHome, previousHashes, previousManifest, options) {
   const target = resolvePlannedFilePath(plan, file, targetHome);
-  const previousContent = existsSync6(target) ? readFileSync2(target, "utf-8") : null;
-  const previousSha256 = previousContent === null ? null : sha256(previousContent);
+  const previousContent = existsSync5(target) ? readFileSync(target, "utf-8") : null;
+  const previousSha256 = previousContent === null ? null : sha2563(previousContent);
   const previouslyManaged = isPreviouslyManaged(file, previousSha256, previousHashes, previousManifest);
   const changed = previousContent !== file.content;
   if (previousContent !== null && !options.force && !previouslyManaged) {
@@ -4614,10 +5185,10 @@ function planStaleFileResults(plan, targetHome, previousManifest, currentRelativ
 }
 function planStaleFileResult(file, targetHome, options) {
   const target = resolveManifestRelativePath(file.relativePath, targetHome);
-  if (!existsSync6(target))
+  if (!existsSync5(target))
     return null;
-  const previousContent = readFileSync2(target, "utf-8");
-  const previousSha256 = sha256(previousContent);
+  const previousContent = readFileSync(target, "utf-8");
+  const previousSha256 = sha2563(previousContent);
   if (!options.force && previousSha256 !== file.sha256) {
     return {
       path: target,
@@ -4682,10 +5253,10 @@ function resolveManifestRelativePath(relativePath, targetHome) {
   return target;
 }
 function readPreviousManifest(path) {
-  if (!existsSync6(path))
+  if (!existsSync5(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
     if (parsed.schema !== SESSION_RENDER_SCHEMA)
       return null;
     if (!Array.isArray(parsed.files))
@@ -4724,13 +5295,13 @@ function assertExpectedSessionFileHash(path, targetHome, expectedHash) {
 }
 function currentSessionFileHash(path, targetHome) {
   assertNoSymlinkSegments(targetHome, path);
-  if (!existsSync6(path))
+  if (!existsSync5(path))
     return null;
   const stat = lstatSync(path);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw new SessionApplyError(`Session apply path is not a regular file: ${path}`);
   }
-  return sha256(readFileSync2(path, "utf-8"));
+  return sha2563(readFileSync(path, "utf-8"));
 }
 function requiredPreviousHash(result) {
   if (result.previousSha256 === null) {
@@ -4739,13 +5310,13 @@ function requiredPreviousHash(result) {
   return result.previousSha256;
 }
 function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousManifest, coordination, allowPortableFallback, forcePortableFileOps) {
-  const existingFiles = results.filter((result) => result.action === "update" || result.action === "delete").filter((result) => existsSync6(result.path)).map((result) => {
-    const content = readFileSync2(result.path, "utf-8");
+  const existingFiles = results.filter((result) => result.action === "update" || result.action === "delete").filter((result) => existsSync5(result.path)).map((result) => {
+    const content = readFileSync(result.path, "utf-8");
     return {
       path: result.path,
       relativePath: result.relativePath,
       role: result.role,
-      sha256: sha256(content),
+      sha256: sha2563(content),
       content
     };
   });
@@ -4758,7 +5329,7 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
     };
   }
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
-  const snapshotPath = join6(getSessionRenderSnapshotDir(targetHome), `${timestamp}-${randomUUID3()}.json`);
+  const snapshotPath = join5(getSessionRenderSnapshotDir(targetHome), `${timestamp}-${randomUUID3()}.json`);
   const afterFiles = results.map((result) => {
     if (result.action === "conflict") {
       throw new SessionApplyError(`Cannot snapshot unresolved conflict: ${result.relativePath}`);
@@ -4811,7 +5382,7 @@ function assertSafeTargetHome(targetHome) {
     throw new SessionApplyError(`Session target home cannot be the filesystem root: ${targetHome}`);
   }
   assertNoSymlinkAncestors(normalized);
-  if (existsSync6(normalized) && lstatSync(normalized).isSymbolicLink()) {
+  if (existsSync5(normalized) && lstatSync(normalized).isSymbolicLink()) {
     throw new SessionApplyError(`Session target home cannot be a symlink: ${normalized}`);
   }
   return normalized;
@@ -4821,8 +5392,8 @@ function assertNoSymlinkSegments(root, target) {
   const rel = relative(root, target);
   let current = root;
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join6(current, segment);
-    if (existsSync6(current) && lstatSync(current).isSymbolicLink()) {
+    current = join5(current, segment);
+    if (existsSync5(current) && lstatSync(current).isSymbolicLink()) {
       throw new SessionApplyError(`Session apply path uses a symlink: ${current}`);
     }
   }
@@ -4833,16 +5404,16 @@ function assertNoSymlinkAncestors(path) {
   let current = parsed.root;
   const rel = relative(parsed.root, normalized);
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join6(current, segment);
-    if (!existsSync6(current))
+    current = join5(current, segment);
+    if (!existsSync5(current))
       return;
     if (lstatSync(current).isSymbolicLink()) {
       throw new SessionApplyError(`Session apply path uses a symlink ancestor: ${current}`);
     }
   }
 }
-function sha256(content) {
-  return createHash("sha256").update(content).digest("hex");
+function sha2563(content) {
+  return createHash3("sha256").update(content).digest("hex");
 }
 
 // src/lib/global-source-coverage.ts
@@ -4878,9 +5449,9 @@ function formatGlobalSourceCoverageWarnings(result) {
 
 // src/lib/station-profile.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync7, lstatSync as lstatSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { arch as osArch, homedir as homedir2, hostname as osHostname, platform as osPlatform, userInfo as osUserInfo } from "os";
-import { dirname as dirname2, join as join7 } from "path";
+import { dirname as dirname3, join as join6 } from "path";
 var STATION_PROFILE_CACHE_FILENAME = "station-profile.md";
 var STATION_PROFILE_SOURCE_ID = "station-profile";
 var STATION_PROFILE_LAYER = "machine";
@@ -4894,19 +5465,19 @@ function homeDir(env = process.env) {
   return env["HOME"] || env["USERPROFILE"] || homedir2();
 }
 function getStationProfileCachePath(env = process.env) {
-  return join7(getRawStoreRoot(env), STATION_PROFILE_CACHE_FILENAME);
+  return join6(getRawStoreRoot(env), STATION_PROFILE_CACHE_FILENAME);
 }
 function getMachinesManifestPath(env = process.env) {
-  return env[MACHINES_MANIFEST_PATH_ENV] || join7(homeDir(env), ".hasna", "machines", "machines.json");
+  return env[MACHINES_MANIFEST_PATH_ENV] || join6(homeDir(env), ".hasna", "machines", "machines.json");
 }
 function getBunGlobalModulesDir(env = process.env) {
-  return join7(env[BUN_INSTALL_ENV] || join7(homeDir(env), ".bun"), "install", "global", "node_modules");
+  return join6(env[BUN_INSTALL_ENV] || join6(homeDir(env), ".bun"), "install", "global", "node_modules");
 }
 function readMachinesManifest(path) {
   try {
-    if (!existsSync7(path))
+    if (!existsSync6(path))
       return null;
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return null;
     const machines = parsed["machines"];
@@ -4962,7 +5533,7 @@ function resolveStationProfileMachine(env = process.env, options = {}) {
   const record = findLocalManifestMachine(readMachinesManifest(getMachinesManifestPath(env)), hostname);
   const home = homeDir(env);
   const platform = stringField(record, "platform") ?? osPlatform();
-  const workspacePath = stringField(record, "workspacePath") ?? join7(home, platform === "darwin" ? "Workspace" : "workspace");
+  const workspacePath = stringField(record, "workspacePath") ?? join6(home, platform === "darwin" ? "Workspace" : "workspace");
   const machine = {
     id: stringField(record, "id") ?? hostname,
     hostname: stringField(record, "hostname") ?? hostname,
@@ -4979,9 +5550,9 @@ function resolveStationProfileMachine(env = process.env, options = {}) {
   return machine;
 }
 function scopedPackageNames(modulesDir, scope) {
-  const scopeDir = join7(modulesDir, scope);
+  const scopeDir = join6(modulesDir, scope);
   try {
-    if (!existsSync7(scopeDir))
+    if (!existsSync6(scopeDir))
       return null;
     return readdirNames(scopeDir).sort();
   } catch {
@@ -4991,7 +5562,7 @@ function scopedPackageNames(modulesDir, scope) {
 function readdirNames(dir) {
   return readdirSync2(dir).filter((name) => {
     try {
-      return lstatSync2(join7(dir, name)).isDirectory();
+      return lstatSync2(join6(dir, name)).isDirectory();
     } catch {
       return false;
     }
@@ -5001,7 +5572,7 @@ function resolveStationProfilePackages(env = process.env) {
   const modulesDir = getBunGlobalModulesDir(env);
   let scopeDirs;
   try {
-    if (!existsSync7(modulesDir))
+    if (!existsSync6(modulesDir))
       return null;
     scopeDirs = readdirNames(modulesDir).filter((name) => name.startsWith("@") && name.toLowerCase().includes("hasna"));
   } catch {
@@ -5076,9 +5647,9 @@ function refreshStationProfile(options = {}) {
   const path = getStationProfileCachePath(env);
   const generatedAt = new Date().toISOString();
   if (!options.dryRun) {
-    const existing = existsSync7(path) ? readFileSync3(path, "utf8") : null;
+    const existing = existsSync6(path) ? readFileSync2(path, "utf8") : null;
     if (existing !== content) {
-      mkdirSync4(dirname2(path), { recursive: true });
+      mkdirSync3(dirname3(path), { recursive: true });
       writeFileSync2(path, content, "utf8");
     }
   }
@@ -5095,9 +5666,9 @@ function refreshStationProfile(options = {}) {
 function readStationProfile(env = process.env) {
   const path = getStationProfileCachePath(env);
   try {
-    if (!existsSync7(path))
+    if (!existsSync6(path))
       return null;
-    return readFileSync3(path, "utf8");
+    return readFileSync2(path, "utf8");
   } catch {
     return null;
   }
@@ -5421,19 +5992,19 @@ async function ensureDangerousOperationGuardStandardConfig(store = resolveConfig
 }
 
 // src/lib/managed-skill-runtimes.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { spawnSync as spawnSync2 } from "child_process";
 import {
-  existsSync as existsSync8,
+  existsSync as existsSync7,
   lstatSync as lstatSync3,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync4,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync3,
   renameSync,
-  rmSync as rmSync3,
+  rmSync as rmSync2,
   writeFileSync as writeFileSync3
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join8, parse as parse2, relative as relative2, resolve as resolve5 } from "path";
+import { dirname as dirname4, join as join7, parse as parse2, relative as relative2, resolve as resolve5 } from "path";
 var INBOX_CONVERSATIONS_MINIMUM_VERSION = "0.5.28";
 var INBOX_SKILL_MARKERS = [
   [".claude", "skills", "inbox", "SKILL.md"],
@@ -5443,8 +6014,8 @@ var INBOX_SKILL_MARKERS = [
   [".cursor", "skills", "inbox", "SKILL.md"]
 ];
 var REQUIRED_WATCH_FLAGS = ["--from <agent>", "--all", "--full-content"];
-function sha2562(content) {
-  return createHash2("sha256").update(content).digest("hex");
+function sha2564(content) {
+  return createHash4("sha256").update(content).digest("hex");
 }
 function lstatOrNull(path) {
   try {
@@ -5459,8 +6030,8 @@ function findSymlinkedAncestor(path) {
   let current = parsed.root;
   const rel = relative2(parsed.root, normalized);
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join8(current, segment);
-    if (!existsSync8(current))
+    current = join7(current, segment);
+    if (!existsSync7(current))
       return null;
     if (lstatSync3(current).isSymbolicLink())
       return current;
@@ -5476,16 +6047,7 @@ function assertNoSymlinkAncestors2(path) {
 function packagedInboxSkillPath(explicitPath) {
   if (explicitPath)
     return explicitPath;
-  const candidates = [
-    join8(import.meta.dir, "..", "..", "assets", "skills", "inbox", "SKILL.md"),
-    join8(import.meta.dir, "..", "assets", "skills", "inbox", "SKILL.md"),
-    join8(process.cwd(), "assets", "skills", "inbox", "SKILL.md")
-  ];
-  const found = candidates.find((candidate) => existsSync8(candidate));
-  if (!found) {
-    throw new Error(`packaged inbox skill contract is missing (checked ${candidates.length} package-relative locations)`);
-  }
-  return found;
+  throw new Error("Bundled skill contracts are retired; use the Skills CLI to manage private skills");
 }
 function readCanonicalSkill(explicitPath) {
   const assetPath = packagedInboxSkillPath(explicitPath);
@@ -5493,14 +6055,14 @@ function readCanonicalSkill(explicitPath) {
   if (!stat?.isFile()) {
     throw new Error("packaged inbox skill contract is not a regular file");
   }
-  const content = readFileSync4(assetPath, "utf8");
+  const content = readFileSync3(assetPath, "utf8");
   if (!content.includes("conversations watch --from <agent> --all")) {
     throw new Error("packaged inbox skill contract does not declare the canonical conversations watcher");
   }
   if (!content.includes("There is no separate")) {
     throw new Error("packaged inbox skill contract does not retire the legacy executable");
   }
-  return { content, sha256: sha2562(content) };
+  return { content, sha256: sha2564(content) };
 }
 function runProbe(command, args) {
   const result = spawnSync2(command, args, {
@@ -5531,7 +6093,7 @@ function compareVersions(left, right) {
   return 0;
 }
 function inspectSkillMarkers(homeDir2) {
-  return INBOX_SKILL_MARKERS.map((parts) => join8(homeDir2, ...parts)).map((path) => {
+  return INBOX_SKILL_MARKERS.map((parts) => join7(homeDir2, ...parts)).map((path) => {
     const stat = lstatOrNull(path);
     if (!stat)
       return null;
@@ -5540,7 +6102,7 @@ function inspectSkillMarkers(homeDir2) {
     }
     return {
       path,
-      content: readFileSync4(path, "utf8"),
+      content: readFileSync3(path, "utf8"),
       mode: stat.mode & 511,
       regular: true
     };
@@ -5575,7 +6137,7 @@ function inspectInbox(options) {
   let reason = "skill not installed";
   if (skillPresent) {
     const nonRegular = snapshots.some((snapshot) => !snapshot.regular);
-    const symlinkAncestor = snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname3(path))).find((found) => found !== null);
+    const symlinkAncestor = snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname4(path))).find((found) => found !== null);
     if (nonRegular)
       reason = "managed skill target is not a regular file";
     else if (symlinkAncestor)
@@ -5659,13 +6221,13 @@ function projectUpdatedStatus(status, contractCount) {
   };
 }
 function cleanup(path) {
-  rmSync3(path, { force: true });
+  rmSync2(path, { force: true });
 }
 function writeAtomic(path, content, mode) {
-  assertNoSymlinkAncestors2(dirname3(path));
+  assertNoSymlinkAncestors2(dirname4(path));
   const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
   try {
-    mkdirSync5(dirname3(path), { recursive: true, mode: 493 });
+    mkdirSync4(dirname4(path), { recursive: true, mode: 493 });
     writeFileSync3(tempPath, content, { mode, flag: "wx" });
     renameSync(tempPath, path);
   } finally {
@@ -5674,7 +6236,7 @@ function writeAtomic(path, content, mode) {
 }
 var DEFAULT_SKILL_WRITE_FILE_OPERATIONS = {
   lstat: lstatOrNull,
-  read: (path) => readFileSync4(path, "utf8"),
+  read: (path) => readFileSync3(path, "utf8"),
   write: writeAtomic
 };
 function writeSkillContractsTransactional(snapshots, canonicalContent, fileOperations = DEFAULT_SKILL_WRITE_FILE_OPERATIONS) {
@@ -5741,7 +6303,7 @@ async function reconcileManagedSkillRuntimes(options = {}) {
       dry_run: dryRun
     };
   }
-  const symlinkedAncestor = before.snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname3(path))).find((found) => found !== null);
+  const symlinkedAncestor = before.snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname4(path))).find((found) => found !== null);
   if (symlinkedAncestor) {
     return {
       runtimes: [{ ...status, action: "failed", dry_run: dryRun, skill_contracts_changed: 0 }],
@@ -5818,28 +6380,28 @@ async function reconcileManagedSkillRuntimes(options = {}) {
 }
 
 // src/status.ts
-import { existsSync as existsSync10, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync5 } from "fs";
 
 // src/lib/package-version.ts
-import { existsSync as existsSync9, readFileSync as readFileSync5 } from "fs";
-import { dirname as dirname4, join as join9 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync4 } from "fs";
+import { dirname as dirname5, join as join8 } from "path";
 import { fileURLToPath } from "url";
 var cached = null;
 function getPackageVersion() {
   if (cached)
     return cached;
   try {
-    let dir = dirname4(fileURLToPath(import.meta.url));
+    let dir = dirname5(fileURLToPath(import.meta.url));
     for (let i = 0;i < 8; i++) {
-      const pkgPath = join9(dir, "package.json");
-      if (existsSync9(pkgPath)) {
-        const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
+      const pkgPath = join8(dir, "package.json");
+      if (existsSync8(pkgPath)) {
+        const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
         if (pkg.name === "@hasna/instructions" && pkg.version) {
           cached = pkg.version;
           return cached;
         }
       }
-      const parent = dirname4(dir);
+      const parent = dirname5(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -5908,11 +6470,11 @@ async function getConfigsStatus(store = resolveConfigStore(), options = {}) {
       continue;
     knownTargets += 1;
     const targetPath = expandPath(config.target_path);
-    if (!existsSync10(targetPath)) {
+    if (!existsSync9(targetPath)) {
       missingTargets += 1;
       continue;
     }
-    const disk = readFileSync6(targetPath, "utf-8");
+    const disk = readFileSync5(targetPath, "utf-8");
     const { content: redactedDisk } = redactContent(disk, redactFormatForTarget(config.target_path, config.format));
     if (redactedDisk !== config.content) {
       driftedTargets += 1;
@@ -6004,9 +6566,9 @@ async function getConfigsStatus(store = resolveConfigStore(), options = {}) {
 }
 
 // src/lib/provider-context.ts
-import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10 } from "path";
+import { createHash as createHash5 } from "crypto";
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
 var PROVIDER_CONTEXT_DIR = ".hasna/provider-context";
 var PROVIDER_CONTEXT_MANIFEST = "manifest.json";
 var PROVIDER_CONTEXT_SCHEMA = "hasna.instructions.provider-context/v1";
@@ -6141,8 +6703,8 @@ function renderPerEndpointFragment(entry) {
 function renderProviderFragment(entry) {
   return entry ? renderPerEndpointFragment(entry) : INVARIANT_FRAGMENT;
 }
-function sha2563(content) {
-  return createHash3("sha256").update(content).digest("hex");
+function sha2565(content) {
+  return createHash5("sha256").update(content).digest("hex");
 }
 function resolveAndRenderProviderContext(opts) {
   const entry = matchProviderEndpoint(opts.origin);
@@ -6151,18 +6713,18 @@ function resolveAndRenderProviderContext(opts) {
   const recordedEndpoint = originAccepted ? `${opts.origin.host}${opts.origin.pathPrefix || ""}` : null;
   const reason = entry === null && opts.rawEndpoint ? originAccepted ? `endpoint "${recordedEndpoint}" is not in the provider-context registry; using the invariant fragment` : "endpoint rejected (embedded credentials or unparseable); using the invariant fragment" : null;
   const content = renderProviderFragment(entry);
-  const dir = join10(opts.homeDir, PROVIDER_CONTEXT_DIR);
-  if (!existsSync11(dir))
-    mkdirSync6(dir, { recursive: true });
+  const dir = join9(opts.homeDir, PROVIDER_CONTEXT_DIR);
+  if (!existsSync10(dir))
+    mkdirSync5(dir, { recursive: true });
   const filename = `${entry ? entry.key : "invariant"}.md`;
-  const fragmentPath = join10(dir, filename);
-  const fragmentSha256 = sha2563(content);
+  const fragmentPath = join9(dir, filename);
+  const fragmentSha256 = sha2565(content);
   writeFileSync4(fragmentPath, content, "utf8");
-  const manifestPath = join10(dir, PROVIDER_CONTEXT_MANIFEST);
+  const manifestPath = join9(dir, PROVIDER_CONTEXT_MANIFEST);
   let manifest = { schema: PROVIDER_CONTEXT_SCHEMA, fragments: {} };
   try {
-    if (existsSync11(manifestPath)) {
-      const parsed = JSON.parse(readFileSync7(manifestPath, "utf8"));
+    if (existsSync10(manifestPath)) {
+      const parsed = JSON.parse(readFileSync6(manifestPath, "utf8"));
       if (parsed && typeof parsed === "object")
         manifest = parsed;
     }
@@ -6228,6 +6790,9 @@ function printLine(text = "") {
 function printJson(value) {
   printLine(JSON.stringify(value, null, 2));
 }
+function printMachineJson(value, pretty = false) {
+  printLine(JSON.stringify(value, null, pretty ? 2 : undefined));
+}
 function printManagedSkillRuntimeReport(report) {
   for (const runtime of report.runtimes) {
     if (!runtime.skill_present)
@@ -6249,7 +6814,7 @@ function fmtConfig(c, format) {
     `  ${chalk.cyan("category:")} ${c.category}  ${chalk.cyan("agent:")} ${c.agent}  ${chalk.cyan("kind:")} ${c.kind}`,
     `  ${chalk.cyan("format:")} ${c.format}  ${chalk.cyan("version:")} ${c.version}${c.target_path ? `  ${chalk.cyan("path:")} ${c.target_path}` : ""}`,
     c.description ? `  ${chalk.dim(c.description)}` : "",
-    c.tags.length > 0 ? `  ${chalk.dim("tags: " + c.tags.join(", "))}` : ""
+    c.tags?.length ? `  ${chalk.dim("tags: " + c.tags.join(", "))}` : ""
   ].filter(Boolean).join(`
 `);
 }
@@ -6267,7 +6832,7 @@ function printConfigRows(configs) {
   for (const c of configs) {
     const type = `${c.category}/${c.agent}`;
     const path = c.kind === "reference" ? "(ref)" : c.target_path ?? "(no path)";
-    console.log(`${pad(c.slug, 32)} ${pad(type, 15)} ${pad(c.format, 8)} ${pad(truncateMiddle(path, 44), 44)} ${String(c.outputs.length).padStart(3)} ${c.version}`);
+    console.log(`${pad(c.slug, 32)} ${pad(type, 15)} ${pad(c.format, 8)} ${pad(truncateMiddle(path, 44), 44)} ${String(c.output_count).padStart(3)} ${c.version}`);
   }
 }
 function splitCsv(value) {
@@ -6305,7 +6870,7 @@ function parseSessionSource(value, order) {
   if (!path)
     throw new Error(`Invalid --source "${value}" (expected path or id=path)`);
   const absPath = resolveSessionPath(path);
-  if (!existsSync12(absPath))
+  if (!existsSync11(absPath))
     throw new Error(`Instruction source file not found: ${absPath}`);
   const content = readSessionInstructionSourceFile(absPath);
   const source = sourceFromFilePath(absPath, content, order);
@@ -6359,7 +6924,7 @@ function readSessionInstructionSourceFile(path) {
   if (stat.size > SESSION_MANAGED_INPUT_MAX_BYTES) {
     throw new Error(`SESSION_SOURCE_INPUT_TOO_LARGE: instruction source file exceeds ${SESSION_MANAGED_INPUT_MAX_BYTES} bytes`);
   }
-  return readFileSync8(path, "utf-8");
+  return readFileSync7(path, "utf-8");
 }
 function parseLayeredReference(value) {
   const trimmed = value.trim();
@@ -6386,9 +6951,9 @@ async function collectSessionSources(opts, tool, store) {
   }
   for (const value of opts.identityExport ?? []) {
     const path = resolveSessionPath(value);
-    if (!existsSync12(path))
+    if (!existsSync11(path))
       throw new Error(`Identity instruction export not found: ${path}`);
-    const parsed = JSON.parse(readFileSync8(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync7(path, "utf-8"));
     sources.push(...sourcesFromIdentityExport(parsed, { path, tool, orderOffset: sources.length }));
   }
   return sources.map((source) => {
@@ -6520,7 +7085,7 @@ function readProjectContextBundleOption(value, allowMissing = false) {
   if (value === "-")
     return { json: readBoundedProjectContextStdin() };
   const path = resolveSessionPath(value);
-  if (!existsSync12(path)) {
+  if (!existsSync11(path)) {
     if (allowMissing)
       return {};
     throw new ProjectContextError("PROJECT_CONTEXT_INPUT_MISSING", `bundle file not found: ${path}`);
@@ -6532,7 +7097,7 @@ function readProjectContextBundleOption(value, allowMissing = false) {
   if (stat.size > PROJECT_CONTEXT_MAX_INPUT_BYTES) {
     throw new ProjectContextError("PROJECT_CONTEXT_INPUT_TOO_LARGE", `bundle exceeds ${PROJECT_CONTEXT_MAX_INPUT_BYTES} bytes`);
   }
-  return { json: readFileSync8(path, "utf8"), sourcePath: path };
+  return { json: readFileSync7(path, "utf8"), sourcePath: path };
 }
 function readBoundedProjectContextStdin() {
   const chunks = [];
@@ -6619,24 +7184,245 @@ async function getMachineProfileContext(opts, store, readOptions = {}) {
   const profile = resolution.profile;
   return { machine, profile, resolution, vars: resolveProfileVariables(profile, machine) };
 }
-program.command("list").alias("ls").description("List stored configs").option("-c, --category <cat>", "filter by category").option("-a, --agent <agent>", "filter by agent").option("-k, --kind <kind>", "filter by kind (file|reference)").option("-t, --tag <tag>", "filter by tag").option("-s, --search <query>", "search name/description/content").option("-f, --format <fmt>", "output format: compact|table|json", "compact").option("--brief", "shorthand for --format compact").option("--verbose", "show expanded metadata for each listed config").option("--json", "output full matching records as JSON").option("--limit <n>", `max rows for human output (default ${DEFAULT_LIST_LIMIT})`).option("--cursor <n>", "zero-based pagination cursor for human output").action(async (opts) => {
-  const fmt = opts.json ? "json" : opts.verbose ? "table" : opts.brief ? "compact" : opts.format;
-  const configs = await resolveConfigStore().listConfigs({
+var COMPACT_CONFIG_FIELDS = [
+  "id",
+  "slug",
+  "name",
+  "kind",
+  "category",
+  "agent",
+  "format",
+  "is_template",
+  "version",
+  "updated_at"
+];
+var OPTIONAL_CONFIG_IDENTITY_FIELDS = ["created_at", "synced_at"];
+var FULL_CONFIG_FIELDS = [
+  "id",
+  "name",
+  "slug",
+  "kind",
+  "category",
+  "agent",
+  "target_path",
+  "outputs",
+  "format",
+  "content",
+  "description",
+  "tags",
+  "is_template",
+  "version",
+  "created_at",
+  "updated_at",
+  "synced_at"
+];
+function parseConfigListDetail(value) {
+  if (value === undefined)
+    return;
+  if (value === "compact" || value === "full")
+    return value;
+  throw new Error('--detail must be "compact" or "full"');
+}
+function parseConfigListFields(value, detail) {
+  if (value === undefined)
+    return;
+  const raw = String(value);
+  if (raw.length > 1024)
+    throw new Error("--fields exceeds 1024 characters");
+  const fields = raw.split(",").map((field) => field.trim());
+  if (fields.length === 0 || fields.some((field) => field.length === 0)) {
+    throw new Error("--fields must contain non-empty comma-separated field names");
+  }
+  if (fields.length > 32)
+    throw new Error("--fields accepts at most 32 fields");
+  if (new Set(fields).size !== fields.length)
+    throw new Error("--fields must not contain duplicate names");
+  const allowed = new Set(detail === "full" ? FULL_CONFIG_FIELDS : [...COMPACT_CONFIG_FIELDS, ...OPTIONAL_CONFIG_IDENTITY_FIELDS]);
+  const unknown = fields.filter((field) => !allowed.has(field));
+  if (unknown.length > 0)
+    throw new Error(`Unknown ${detail} config field(s): ${unknown.join(", ")}`);
+  if (!fields.includes("id"))
+    throw new Error("--fields must include the immutable id field");
+  if (detail !== "full" && fields.includes("content")) {
+    throw new Error("Config content requires --detail full");
+  }
+  return fields;
+}
+function projectConfigFields(record, fields) {
+  return Object.fromEntries(fields.map((field) => [field, record[field]]));
+}
+async function readAllConfigIdentityPages(store, filter) {
+  const items = [];
+  const seen = new Set;
+  let cursor = 0;
+  let expectedTotal = null;
+  let sourceBounded = true;
+  let previousId = null;
+  while (true) {
+    const page = await store.listConfigIdentitiesPage(filter, { limit: 100, cursor });
+    sourceBounded = sourceBounded && page.source_bounded;
+    if (expectedTotal === null)
+      expectedTotal = page.total;
+    else if (page.total !== expectedTotal)
+      throw new Error("Config collection changed while paging");
+    for (const item of page.items) {
+      if (seen.has(item.id))
+        throw new Error(`Config collection repeated ${item.id} while paging`);
+      if (page.source_bounded && previousId !== null && item.id <= previousId)
+        throw new Error("Config collection order changed while paging");
+      seen.add(item.id);
+      previousId = page.source_bounded ? item.id : null;
+      items.push(item);
+    }
+    if (page.next_cursor === null)
+      break;
+    if (page.next_cursor <= cursor)
+      throw new Error("Config identity pagination did not advance");
+    cursor = page.next_cursor;
+  }
+  if (expectedTotal !== null && items.length !== expectedTotal) {
+    throw new Error(`Config collection returned ${items.length} of ${expectedTotal} rows`);
+  }
+  return { items, source_bounded: sourceBounded };
+}
+async function readAllConfigPages(store, filter) {
+  const items = [];
+  const seen = new Set;
+  let cursor = 0;
+  let expectedTotal = null;
+  let sourceBounded = true;
+  let previousId = null;
+  while (true) {
+    const page = await store.listConfigsPage(filter, { limit: 100, cursor });
+    sourceBounded = sourceBounded && page.source_bounded;
+    if (expectedTotal === null)
+      expectedTotal = page.total;
+    else if (page.total !== expectedTotal)
+      throw new Error("Config collection changed while paging");
+    for (const item of page.items) {
+      if (seen.has(item.id))
+        throw new Error(`Config collection repeated ${item.id} while paging`);
+      if (page.source_bounded && previousId !== null && item.id <= previousId)
+        throw new Error("Config collection order changed while paging");
+      seen.add(item.id);
+      previousId = page.source_bounded ? item.id : null;
+      items.push(item);
+    }
+    if (page.next_cursor === null)
+      break;
+    if (page.next_cursor <= cursor)
+      throw new Error("Config pagination did not advance");
+    cursor = page.next_cursor;
+  }
+  if (expectedTotal !== null && items.length !== expectedTotal) {
+    throw new Error(`Config collection returned ${items.length} of ${expectedTotal} rows`);
+  }
+  return { items, source_bounded: sourceBounded };
+}
+function configListEnvelope(records, page, detail, fields) {
+  const complete = page.cursor === 0 && !page.has_more;
+  const truncated = !complete;
+  const truncationReason = page.cursor > 0 ? page.has_more ? "cursor_and_limit" : "cursor" : page.has_more ? "limit" : null;
+  return {
+    configs: records,
+    _meta: {
+      schema_version: 1,
+      count: records.length,
+      total: page.total,
+      limit: page.limit,
+      cursor: page.cursor,
+      next_cursor: page.next_cursor,
+      has_more: page.has_more,
+      complete,
+      truncated,
+      truncation_reason: truncationReason,
+      detail,
+      fields: [...fields],
+      source_bounded: page.source_bounded
+    }
+  };
+}
+program.command("list").alias("ls").description("List stored configs").option("-c, --category <cat>", "filter by category").option("-a, --agent <agent>", "filter by agent").option("-k, --kind <kind>", "filter by kind (file|reference)").option("-t, --tag <tag>", "filter by tag").option("-s, --search <query>", "search name/description/content").option("-f, --format <fmt>", "output format: compact|table|json", "compact").option("--brief", "shorthand for --format compact").option("--verbose", "show expanded metadata for each listed config").option("--json", "output machine-readable records (legacy default: complete full array)").option("--detail <level>", "JSON detail: compact|full; enables a bounded metadata envelope").option("--fields <fields>", "comma-separated JSON fields; implies --detail compact").option("--all", "explicitly read every matching row").option("--pretty", "pretty-print modern JSON output (modern JSON is compact by default)").option("--limit <n>", `max rows (default ${DEFAULT_LIST_LIMIT} for bounded output)`).option("--cursor <n>", "zero-based pagination cursor").action(async (opts) => {
+  const requestedDetail = parseConfigListDetail(opts.detail);
+  const modernJson = requestedDetail !== undefined || opts.fields !== undefined;
+  const jsonRequested = Boolean(opts.json || opts.format === "json");
+  if (modernJson && !jsonRequested)
+    throw new Error("--detail and --fields require JSON output");
+  if (opts.all && !modernJson)
+    throw new Error("--all requires JSON output with --detail or --fields");
+  if (opts.pretty && !jsonRequested)
+    throw new Error("--pretty requires JSON output");
+  const detail = requestedDetail ?? "compact";
+  const fields = parseConfigListFields(opts.fields, detail) ?? (detail === "full" ? [...FULL_CONFIG_FIELDS] : [...COMPACT_CONFIG_FIELDS]);
+  const filter = {
     category: opts.category,
     agent: opts.agent,
     kind: opts.kind,
     tags: opts.tag ? [opts.tag] : undefined,
     search: opts.search
-  });
+  };
+  const store = resolveConfigStore();
+  if (modernJson) {
+    if (opts.all && (opts.cursor !== undefined || opts.limit !== undefined)) {
+      throw new Error("--all cannot be combined with --limit or --cursor");
+    }
+    let page2;
+    if (opts.all) {
+      if (detail === "full") {
+        const completeRead = await readAllConfigPages(store, filter);
+        page2 = {
+          items: completeRead.items,
+          total: completeRead.items.length,
+          limit: Math.max(completeRead.items.length, 1),
+          cursor: 0,
+          next_cursor: null,
+          has_more: false,
+          complete: true,
+          truncated: false,
+          source_bounded: completeRead.source_bounded
+        };
+      } else {
+        const completeRead = await readAllConfigIdentityPages(store, filter);
+        page2 = {
+          items: completeRead.items,
+          total: completeRead.items.length,
+          limit: Math.max(completeRead.items.length, 1),
+          cursor: 0,
+          next_cursor: null,
+          has_more: false,
+          complete: true,
+          truncated: false,
+          source_bounded: completeRead.source_bounded
+        };
+      }
+    } else {
+      page2 = detail === "full" ? await store.listConfigsPage(filter, { limit: opts.limit, cursor: opts.cursor }) : await store.listConfigIdentitiesPage(filter, { limit: opts.limit, cursor: opts.cursor });
+    }
+    const records = page2.items.map((item) => projectConfigFields(item, fields));
+    printMachineJson(configListEnvelope(records, {
+      total: page2.total,
+      limit: opts.all ? null : page2.limit,
+      cursor: page2.cursor,
+      next_cursor: page2.next_cursor,
+      has_more: page2.has_more,
+      complete: page2.complete,
+      source_bounded: page2.source_bounded
+    }, detail, fields), Boolean(opts.pretty));
+    return;
+  }
+  const fmt = opts.json ? "json" : opts.verbose ? "table" : opts.brief ? "compact" : opts.format;
   if (fmt === "json") {
+    const configs = opts.limit !== undefined || opts.cursor !== undefined ? (await store.listConfigsPage(filter, { limit: opts.limit, cursor: opts.cursor })).items : await store.listConfigs(filter);
     printJson(configs);
     return;
   }
-  if (configs.length === 0) {
+  const page = opts.all ? (() => {
+    throw new Error("--all is only available with --json and --detail");
+  })() : await store.listConfigSummariesPage(filter, { limit: opts.limit, cursor: opts.cursor });
+  if (page.total === 0) {
     console.log(chalk.dim("No configs found."));
     return;
   }
-  const page = paginate(configs, { limit: opts.limit, cursor: opts.cursor });
   if (fmt === "compact") {
     printConfigRows(page.items);
   } else {
@@ -6645,7 +7431,7 @@ program.command("list").alias("ls").description("List stored configs").option("-
       console.log();
     }
   }
-  pageFooter("configs list", page, "Use --verbose for expanded rows, --json for full records, or `configs show <slug>` for content.");
+  pageFooter("configs list", page, "Use --verbose for expanded rows, --json --detail compact for metadata, or `configs show <slug>` for content.");
 });
 program.command("show <id>").alias("inspect").description("Show a config's content and metadata").option("-f, --format <fmt>", "output format: table|json|content", "table").action(async (id, opts) => {
   try {
@@ -6692,15 +7478,15 @@ program.command("tag <id>").description("Add or remove tags on a stored config (
 });
 program.command("add <path>").description("Ingest a file into the config DB").option("-n, --name <name>", "config name (defaults to filename)").option("-c, --category <cat>", "category override").option("-a, --agent <agent>", "agent override").option("-k, --kind <kind>", "kind: file|reference", "file").option("--template", "mark as template (has {{VAR}} placeholders)").option("--update", "if a config already owns this path, update that row in place instead of refusing").action(async (filePath, opts) => {
   const abs = resolve6(filePath);
-  if (!existsSync12(abs)) {
+  if (!existsSync11(abs)) {
     console.error(chalk.red(`File not found: ${abs}`));
     process.exit(1);
   }
-  const rawContent = readFileSync8(abs, "utf-8");
+  const rawContent = readFileSync7(abs, "utf-8");
   const storedFmt = detectFormat(abs);
   const fmt = redactFormatForTarget(abs, storedFmt);
   const { content, redacted, isTemplate } = redactContent(rawContent, fmt);
-  const targetPath = abs.startsWith(homedir4()) ? abs.replace(homedir4(), "~") : abs;
+  const targetPath = compactPathForConfigHome(abs);
   const name = opts.name || filePath.split("/").pop();
   const store = resolveConfigStore();
   const allConfigs = await store.listConfigs();
@@ -6875,7 +7661,7 @@ program.command("sync").description("Sync known AI coding configs from disk into
       for (const entry of entries) {
         if (!entry.isDirectory())
           continue;
-        const projDir = join11(absDir, entry.name);
+        const projDir = join10(absDir, entry.name);
         const hasAgentConfig = [
           "CLAUDE.md",
           ".mcp.json",
@@ -6888,7 +7674,7 @@ program.command("sync").description("Sync known AI coding configs from disk into
           ".aicopilot",
           ".cursor",
           ".agents"
-        ].some((marker) => existsSync12(join11(projDir, marker)));
+        ].some((marker) => existsSync11(join10(projDir, marker)));
         if (!hasAgentConfig)
           continue;
         const result2 = await syncProject({ projectDir: projDir, dryRun: opts.dryRun, store });
@@ -6918,28 +7704,25 @@ program.command("sync").description("Sync known AI coding configs from disk into
     }
   }
 });
-program.command("export").description("Export configs as a tar.gz bundle").option("-o, --output <path>", "output file", "./configs-export.tar.gz").option("-c, --category <cat>", "filter by category").action(async (opts) => {
+program.command("export").description("Export the complete Instructions configuration domain as a tar.gz bundle").option("-o, --output <path>", "output file", "./instructions-domain-export.tar.gz").option("-c, --category <cat>", "filter by category").action(async (opts) => {
   const result = await exportConfigs(opts.output, {
     filter: opts.category ? { category: opts.category } : undefined,
     store: resolveConfigStore()
   });
-  console.log(chalk.green("\u2713") + ` Exported ${result.count} configs to ${result.path}`);
+  console.log(chalk.green("\u2713") + ` Exported domain to ${result.path}: configs=${result.counts.configs} snapshots=${result.counts.config_snapshots} profiles=${result.counts.profiles} profile_bindings=${result.counts.profile_config_bindings} assets=${result.counts.profile_asset_bindings} machines=${result.counts.machines}`);
 });
-program.command("import <file>").description("Import configs from a tar.gz bundle").option("--overwrite", "overwrite existing configs").action(async (file, opts) => {
+program.command("import <file>").description("Restore a v2 Instructions domain archive into an empty destination, or import legacy v1").option("--overwrite", "overwrite existing configs in a legacy v1 archive (v2 rejects this option)").action(async (file, opts) => {
   const result = await importConfigs(file, {
     conflict: opts.overwrite ? "overwrite" : "skip",
     store: resolveConfigStore()
   });
+  if (result.errors.length > 0)
+    throw new Error(`Import failed: ${result.errors.join("; ")}`);
   console.log(chalk.green("\u2713") + ` Import complete: +${result.created} updated:${result.updated} skipped:${result.skipped}`);
-  if (result.errors.length > 0) {
-    console.log(chalk.red("Errors:"));
-    for (const e of result.errors)
-      console.log(chalk.red("  " + e));
-  }
 });
 program.command("whoami").description("Show setup summary").action(async () => {
   const store = resolveConfigStore();
-  const dbPath = store.mode === "api" ? store.v1BaseUrl : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join11(getRawStoreRoot(), "instructions.db");
+  const dbPath = store.mode === "api" ? store.v1BaseUrl : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join10(getRawStoreRoot(), "instructions.db");
   const stats = await store.getConfigStats();
   console.log(chalk.bold("@hasna/instructions") + chalk.dim(" v" + pkg.version));
   console.log(chalk.cyan(store.mode === "api" ? "API:" : "DB:") + " " + dbPath);
@@ -7647,7 +8430,7 @@ templateCmd.command("vars <id>").description("Show template variables").action(a
 });
 templateCmd.command("render <id>").description("Render a template config with variables and optionally apply to disk").option("--var <vars...>", "set variables as KEY=VALUE pairs").option("--env", "use environment variables to fill template vars").option("--apply", "write rendered output to target_path").option("--dry-run", "preview rendered output without writing").action(async (id, opts) => {
   try {
-    const { renderTemplate } = await import("../chunks/template-ke972qqe.js");
+    const { renderTemplate } = await import("../chunks/template-wgnzdn7h.js");
     const c = await resolveConfigStore().getConfig(id);
     const vars = {};
     if (opts.var) {
@@ -7661,7 +8444,7 @@ templateCmd.command("render <id>").description("Render a template config with va
       }
     }
     if (opts.env) {
-      const { extractTemplateVars: extractTemplateVars2 } = await import("../chunks/template-ke972qqe.js");
+      const { extractTemplateVars: extractTemplateVars2 } = await import("../chunks/template-wgnzdn7h.js");
       for (const v of extractTemplateVars2(c.content)) {
         if (!(v.name in vars) && process.env[v.name]) {
           vars[v.name] = process.env[v.name];
@@ -7710,7 +8493,7 @@ program.command("scan [id]").description("Scan configs for secrets. Defaults to
   } else if (opts.all) {
     configs = await store.listConfigs(opts.category ? { kind: "file", category: opts.category } : { kind: "file" });
   } else {
-    const { KNOWN_CONFIGS: KNOWN_CONFIGS2 } = await import("../chunks/sync-m46fc257.js");
+    const { KNOWN_CONFIGS: KNOWN_CONFIGS2 } = await import("../chunks/sync-xtkbm5br.js");
     const slugs = [
       ...KNOWN_CONFIGS2.filter((k) => !k.rulesDir).map((k) => k.name)
     ];
@@ -8004,7 +8787,7 @@ command = "${mcpBinary}"
 args = []
 `;
         if (ex(configPath)) {
-          const content = readFileSync8(configPath, "utf-8");
+          const content = readFileSync7(configPath, "utf-8");
           if (findTomlTableLines(content.split(`
 `), "mcp_servers.configs")) {
             console.log(chalk.dim("= Already installed in Codex"));
@@ -8066,7 +8849,7 @@ mcpCmd.command("uninstall").alias("remove").description("Remove configs MCP serv
           console.log(chalk.dim("= Not installed in Codex (no config.toml)"));
           continue;
         }
-        const content = readFileSync8(configPath, "utf-8");
+        const content = readFileSync7(configPath, "utf-8");
         const lines = content.split(`
 `);
         const table = findTomlTableLines(lines, "mcp_servers.configs");
@@ -8085,7 +8868,7 @@ mcpCmd.command("uninstall").alias("remove").description("Remove configs MCP serv
         console.log(chalk.green("\u2713") + " Removed from Codex");
       } else if (target === "antigravity") {
         const { existsSync: ex, readFileSync: rf, writeFileSync: wf } = await import("fs");
-        const configPath = join11(homedir4(), ".gemini", "config", "mcp_config.json");
+        const configPath = join10(homedir4(), ".gemini", "config", "mcp_config.json");
         if (!ex(configPath)) {
           console.log(chalk.dim("= Not installed in Antigravity (no mcp_config.json)"));
           continue;
@@ -8113,6 +8896,40 @@ mcpCmd.command("uninstall").alias("remove").description("Remove configs MCP serv
   if (failed)
     process.exitCode = 1;
 });
+program.command("migrate-legacy").description("Migrate the historical ~/.hasna/configs/configs.db store into the current local Instructions SQLite store").option("--source <path>", "legacy configs.db path").option("--destination <path>", "current instructions.db path").option("--backup <path>", "exclusive destination backup path").option("--apply", "apply the migration (default is a no-write dry-run)").option("--merge-preserve-destination", "merge into a non-empty destination without overwriting existing rows").option("--confirm-local", "confirm this is an explicit on-box local-store operation").option("--json", "print a structured metadata-only result").action(async (opts) => {
+  if (!selectsInstructionsLocalStore(process.env)) {
+    throw new Error("migrate-legacy is local-only: set HASNA_INSTRUCTIONS_LOCAL=1 and remove every hosted Instructions authority/credential first");
+  }
+  if (!opts.confirmLocal) {
+    throw new Error("migrate-legacy requires --confirm-local");
+  }
+  const destinationPath = resolve6(opts.destination || process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join10(getRawStoreRoot(), "instructions.db"));
+  const database = await import("../chunks/database-wstmr56z.js");
+  database.getDatabase(destinationPath);
+  database.resetDatabase();
+  const { migrateLegacyInstructionsStore } = await import("../chunks/legacy-store-migration-z2m5yzyk.js");
+  const result = migrateLegacyInstructionsStore({
+    ...opts.source ? { sourcePath: resolve6(opts.source) } : {},
+    destinationPath,
+    ...opts.backup ? { backupPath: resolve6(opts.backup) } : {},
+    dryRun: !opts.apply,
+    ...opts.mergePreserveDestination ? { mergePolicy: "preserve-destination" } : {},
+    operatorConfirmed: true
+  });
+  if (opts.json) {
+    printJson(result);
+    return;
+  }
+  const total = Object.values(result.migrated).reduce((sum, count) => sum + count, 0);
+  const skipped = Object.values(result.skipped).reduce((sum, count) => sum + count, 0);
+  const mode = result.dryRun ? "Dry-run" : "Migrated";
+  console.log(chalk.green("\u2713") + ` ${mode}: ${total} row(s), skipped ${skipped}, conflicts ${result.conflicts}`);
+  if (result.snapshotsCreated > 0) {
+    console.log(chalk.dim(`  created ${result.snapshotsCreated} missing current-version snapshot(s)`));
+  }
+  if (result.backupCreated)
+    console.log(chalk.dim("  destination backup created before mutation"));
+});
 program.command("init").description("First-time setup: sync all known configs, create default profile").option("--force", "delete existing DB and start fresh").action(async (opts) => {
   const store = resolveConfigStore();
   if (opts.force) {
@@ -8172,7 +8989,7 @@ DB stats:`));
     if (count > 0)
       console.log(`  ${key.padEnd(18)} ${count}`);
   }
-  const location = store.mode === "api" ? store.v1BaseUrl : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join11(getRawStoreRoot(), "instructions.db");
+  const location = store.mode === "api" ? store.v1BaseUrl : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join10(getRawStoreRoot(), "instructions.db");
   console.log(chalk.dim(`
 ${store.mode === "api" ? "API" : "DB"}: ${location}`));
 });
@@ -8231,24 +9048,187 @@ managedSkillsCmd.command("apply").option("--dry-run", "preview without writing")
   if (report.failed > 0)
     process.exitCode = 1;
 });
+function normalizeBackupVersionOptions(opts) {
+  const payloadVersionId = opts.payloadVersionId?.trim();
+  const manifestVersionId = opts.manifestVersionId?.trim();
+  if (Boolean(payloadVersionId) !== Boolean(manifestVersionId)) {
+    throw new Error("S3 backup payload and manifest version ids must be provided together");
+  }
+  return payloadVersionId && manifestVersionId ? { payloadVersionId, manifestVersionId } : {};
+}
+var storageCmd = program.command("storage").description("Inspect and use the optional native S3 backup plane");
+storageCmd.command("status").description("Show redacted S3 configuration status without opening SQLite or contacting S3").option("--json", "output JSON").action(async (opts) => {
+  const { loadInstructionsS3Config } = await import("../chunks/s3-config-hhght91k.js");
+  const config = loadInstructionsS3Config(process.env);
+  const status = config ? {
+    configured: true,
+    provider: "s3",
+    region: config.region,
+    prefix: config.prefix,
+    endpointConfigured: Boolean(config.endpoint),
+    forcePathStyle: config.forcePathStyle,
+    credentialSource: config.credentials ? "static-explicit" : "runtime-default-chain",
+    includesCredentialValues: false,
+    databaseAuthority: false
+  } : {
+    configured: false,
+    provider: null,
+    region: null,
+    prefix: null,
+    endpointConfigured: false,
+    forcePathStyle: false,
+    credentialSource: null,
+    includesCredentialValues: false,
+    databaseAuthority: false
+  };
+  if (opts.json)
+    printJson(status);
+  else if (!config)
+    console.log(chalk.dim("S3 backup storage is not configured."));
+  else
+    console.log(chalk.green("\u2713") + ` S3 backup storage configured (${config.region}, prefix ${config.prefix}; database authority: no)`);
+});
+var storageBackupCmd = storageCmd.command("backup").description("Push, pull, and verify immutable Instructions backup objects");
+storageBackupCmd.command("push <file>").description("Upload an immutable backup archive and integrity manifest").requiredOption("--id <backup-id>", "stable immutable backup identifier").option("--content-type <type>", "payload content type", "application/gzip").option("--dry-run", "plan keys and hashes without contacting S3").option("--json", "output JSON").action(async (file, opts) => {
+  const abs = resolve6(file);
+  if (!existsSync11(abs) || !lstatSync4(abs).isFile())
+    throw new Error(`Backup file not found: ${abs}`);
+  const [{ loadInstructionsS3Config }, backup, objectStore] = await Promise.all([
+    import("../chunks/s3-config-hhght91k.js"),
+    import("../chunks/s3-backup-hxe3zpfz.js"),
+    import("../chunks/s3-object-store-n0s82swt.js")
+  ]);
+  const config = loadInstructionsS3Config(process.env);
+  if (!config)
+    throw new Error("S3 backup storage is not configured (set HASNA_INSTRUCTIONS_S3_BUCKET)");
+  const bytes = await Bun.file(abs).bytes();
+  if (opts.dryRun) {
+    const plan = await backup.planInstructionsBackupPush({
+      store: { get: async () => {
+        return;
+      }, head: async () => {
+        return;
+      } },
+      prefix: config.prefix,
+      backupId: opts.id,
+      bytes,
+      contentType: opts.contentType
+    });
+    if (opts.json)
+      printJson(plan);
+    else
+      console.log(chalk.dim(`Would upload ${plan.sizeBytes} bytes to ${plan.payloadKey} (sha256 ${plan.sha256})`));
+    return;
+  }
+  const result = await backup.pushInstructionsBackup({
+    store: objectStore.createInstructionsS3ObjectStore(config),
+    prefix: config.prefix,
+    backupId: opts.id,
+    bytes,
+    contentType: opts.contentType
+  });
+  const safe = {
+    status: result.status,
+    backupId: result.manifest.backupId,
+    sha256: result.manifest.sha256,
+    sizeBytes: result.manifest.sizeBytes,
+    ...result.versions ? result.versions : {}
+  };
+  if (opts.json)
+    printJson(safe);
+  else
+    console.log(chalk.green("\u2713") + ` S3 backup ${result.status}: ${safe.backupId} (${safe.sizeBytes} bytes, sha256 ${safe.sha256})`);
+});
+storageBackupCmd.command("verify <backup-id>").description("Verify the immutable S3 payload against its manifest").option("--payload-version-id <version-id>", "exact immutable S3 payload VersionId").option("--manifest-version-id <version-id>", "exact immutable S3 manifest VersionId").option("--json", "output JSON").action(async (backupId, opts) => {
+  const versions = normalizeBackupVersionOptions(opts);
+  const [{ loadInstructionsS3Config }, backup, objectStore] = await Promise.all([
+    import("../chunks/s3-config-hhght91k.js"),
+    import("../chunks/s3-backup-hxe3zpfz.js"),
+    import("../chunks/s3-object-store-n0s82swt.js")
+  ]);
+  const config = loadInstructionsS3Config(process.env);
+  if (!config)
+    throw new Error("S3 backup storage is not configured (set HASNA_INSTRUCTIONS_S3_BUCKET)");
+  const verified = await backup.verifyInstructionsBackup({
+    store: objectStore.createInstructionsS3ObjectStore(config),
+    prefix: config.prefix,
+    backupId,
+    ...versions
+  });
+  const safe = {
+    ...verified,
+    ...verified.versions ? verified.versions : {},
+    versions: undefined
+  };
+  if (opts.json)
+    printJson(safe);
+  else
+    console.log(chalk.green("\u2713") + ` Verified ${verified.backupId}: ${verified.sizeBytes} bytes, sha256 ${verified.sha256}${verified.versionPinned ? " (exact S3 versions)" : ""}`);
+});
+storageBackupCmd.command("pull <backup-id>").description("Download and verify an immutable S3 backup before writing it locally").requiredOption("-o, --output <path>", "destination archive path").option("--payload-version-id <version-id>", "exact immutable S3 payload VersionId").option("--manifest-version-id <version-id>", "exact immutable S3 manifest VersionId").option("--force", "replace an existing regular destination file").option("--json", "output JSON").action(async (backupId, opts) => {
+  const versions = normalizeBackupVersionOptions(opts);
+  const [{ loadInstructionsS3Config }, backup, objectStore] = await Promise.all([
+    import("../chunks/s3-config-hhght91k.js"),
+    import("../chunks/s3-backup-hxe3zpfz.js"),
+    import("../chunks/s3-object-store-n0s82swt.js")
+  ]);
+  const config = loadInstructionsS3Config(process.env);
+  if (!config)
+    throw new Error("S3 backup storage is not configured (set HASNA_INSTRUCTIONS_S3_BUCKET)");
+  const pulled = await backup.pullInstructionsBackup({
+    store: objectStore.createInstructionsS3ObjectStore(config),
+    prefix: config.prefix,
+    backupId,
+    ...versions
+  });
+  const output = resolve6(opts.output);
+  if (existsSync11(output)) {
+    if (!opts.force)
+      throw new Error(`Refusing to overwrite existing backup file: ${output}`);
+    if (!lstatSync4(output).isFile() || lstatSync4(output).isSymbolicLink()) {
+      throw new Error(`Refusing to replace a non-regular backup destination: ${output}`);
+    }
+  }
+  mkdirSync6(dirname6(output), { recursive: true, mode: 448 });
+  const temp = join10(dirname6(output), `.${basename(output)}.tmp-${process.pid}-${Date.now()}`);
+  try {
+    writeFileSync5(temp, pulled.bytes, { flag: "wx", mode: 384 });
+    renameSync2(temp, output);
+  } catch (error) {
+    try {
+      unlinkSync(temp);
+    } catch {}
+    throw error;
+  }
+  const safe = {
+    backupId: pulled.manifest.backupId,
+    output,
+    sha256: pulled.manifest.sha256,
+    sizeBytes: pulled.manifest.sizeBytes,
+    versionPinned: pulled.versionPinned,
+    ...pulled.versions ? pulled.versions : {}
+  };
+  if (opts.json)
+    printJson(safe);
+  else
+    console.log(chalk.green("\u2713") + ` Restored ${safe.backupId} to ${safe.output} (${safe.sizeBytes} bytes)`);
+});
 program.command("backup").description("Export configs to a timestamped backup file").action(async () => {
   const { mkdirSync: mk } = await import("fs");
-  const backupDir = join11(getRawStoreRoot(), "backups");
+  const backupDir = join10(getRawStoreRoot(), "backups");
   mk(backupDir, { recursive: true });
   const ts = new Date().toISOString().replace(/[:.]/g, "-").replace("T", "-").slice(0, 19);
-  const outPath = join11(backupDir, `configs-${ts}.tar.gz`);
+  const outPath = join10(backupDir, `configs-${ts}.tar.gz`);
   const result = await exportConfigs(outPath, { store: resolveConfigStore() });
   const { statSync: st } = await import("fs");
   const size = st(outPath).size;
   console.log(chalk.green("\u2713") + ` Backup: ${result.count} configs \u2192 ${outPath} (${(size / 1024).toFixed(1)}KB)`);
 });
-program.command("restore <file>").description("Restore configs from a backup file").option("--overwrite", "overwrite existing configs (default: skip)").action(async (file, opts) => {
+program.command("restore <file>").description("Restore a v2 domain backup into an empty destination, or restore legacy v1 configs").option("--overwrite", "overwrite existing configs in a legacy v1 archive (v2 rejects this option)").action(async (file, opts) => {
   const result = await importConfigs(file, { conflict: opts.overwrite ? "overwrite" : "skip", store: resolveConfigStore() });
+  if (result.errors.length > 0)
+    throw new Error(`Restore failed: ${result.errors.join("; ")}`);
   console.log(chalk.green("\u2713") + ` Restored: +${result.created} updated:${result.updated} skipped:${result.skipped}`);
-  if (result.errors.length > 0) {
-    for (const e of result.errors)
-      console.log(chalk.red("  " + e));
-  }
 });
 program.command("doctor").description("Validate configs: syntax, permissions, missing files, secrets").action(async () => {
   const store = resolveConfigStore();
@@ -8264,9 +9244,9 @@ program.command("doctor").description("Validate configs: syntax, permissions, mi
   console.log(chalk.cyan("Known files on disk:"));
   for (const k of KNOWN_CONFIGS) {
     if (k.rulesDir) {
-      existsSync12(expandPath(k.rulesDir)) ? pass(`${k.rulesDir}/ exists`) : k.optional ? skip(`${k.rulesDir}/ (optional)`) : fail2(`${k.rulesDir}/ not found`);
+      existsSync11(expandPath(k.rulesDir)) ? pass(`${k.rulesDir}/ exists`) : k.optional ? skip(`${k.rulesDir}/ (optional)`) : fail2(`${k.rulesDir}/ not found`);
     } else {
-      existsSync12(expandPath(k.path)) ? pass(k.path) : k.optional ? skip(`${k.path} (optional)`) : fail2(`${k.path} not found`);
+      existsSync11(expandPath(k.path)) ? pass(k.path) : k.optional ? skip(`${k.path} (optional)`) : fail2(`${k.path} not found`);
     }
   }
   const allConfigs = await store.listConfigs();
@@ -8412,7 +9392,7 @@ program.command("watch").description("Watch known config files for changes and a
   const store = resolveConfigStore();
   const interval = Number(opts.interval);
   const { statSync: st } = await import("fs");
-  const { expandPath: expandPath2 } = await import("../chunks/apply-sfzja1f3.js");
+  const { expandPath: expandPath2 } = await import("../chunks/apply-pnn7a3y7.js");
   console.log(chalk.bold("@hasna/instructions watch") + chalk.dim(` \u2014 polling every ${interval}ms`));
   console.log(chalk.dim(`Watching known config files for changes\u2026
 `));
@@ -8420,16 +9400,16 @@ program.command("watch").description("Watch known config files for changes and a
   for (const k of KNOWN_CONFIGS) {
     if (k.rulesDir) {
       const absDir = expandPath2(k.rulesDir);
-      if (!existsSync12(absDir))
+      if (!existsSync11(absDir))
         continue;
       const { readdirSync: readdirSync3 } = await import("fs");
       for (const f of readdirSync3(absDir).filter((f2) => f2.endsWith(".md"))) {
-        const abs = join11(absDir, f);
+        const abs = join10(absDir, f);
         mtimes.set(abs, st(abs).mtimeMs);
       }
     } else {
       const abs = expandPath2(k.path);
-      if (existsSync12(abs))
+      if (existsSync11(abs))
         mtimes.set(abs, st(abs).mtimeMs);
     }
   }
@@ -8437,7 +9417,7 @@ program.command("watch").description("Watch known config files for changes and a
   const tick = async () => {
     let changed = 0;
     for (const [abs, oldMtime] of mtimes) {
-      if (!existsSync12(abs))
+      if (!existsSync11(abs))
         continue;
       const newMtime = st(abs).mtimeMs;
       if (newMtime !== oldMtime) {
@@ -8449,10 +9429,10 @@ program.command("watch").description("Watch known config files for changes and a
     for (const k of KNOWN_CONFIGS) {
       if (k.rulesDir) {
         const absDir = expandPath2(k.rulesDir);
-        if (!existsSync12(absDir))
+        if (!existsSync11(absDir))
           continue;
         for (const f of rd(absDir).filter((f2) => f2.endsWith(".md"))) {
-          const abs = join11(absDir, f);
+          const abs = join10(absDir, f);
           if (!mtimes.has(abs)) {
             mtimes.set(abs, st(abs).mtimeMs);
             changed++;
@@ -8460,7 +9440,7 @@ program.command("watch").description("Watch known config files for changes and a
         }
       } else {
         const abs = expandPath2(k.path);
-        if (existsSync12(abs) && !mtimes.has(abs)) {
+        if (existsSync11(abs) && !mtimes.has(abs)) {
           mtimes.set(abs, st(abs).mtimeMs);
           changed++;
         }
@@ -8488,11 +9468,11 @@ program.command("report").description("Summary of stored configs, drift, and eco
     if (!c.target_path)
       continue;
     const abs = expandPath(c.target_path);
-    if (!existsSync12(abs)) {
+    if (!existsSync11(abs)) {
       missing++;
       continue;
     }
-    const disk = readFileSync8(abs, "utf-8");
+    const disk = readFileSync7(abs, "utf-8");
     const { content: redactedDisk } = redactContent(disk, redactFormatForTarget(c.target_path, c.format));
     if (redactedDisk !== c.content)
       drifted++;
@@ -8559,7 +9539,7 @@ program.command("clean").description("Remove configs from DB whose target files
     if (!c.target_path)
       continue;
     const abs = expandPath(c.target_path);
-    if (!existsSync12(abs)) {
+    if (!existsSync11(abs)) {
       if (printed < maxPrinted) {
         if (opts.dryRun) {
           console.log(chalk.yellow("  would remove:") + ` ${c.slug} ${chalk.dim(`(${truncateMiddle(c.target_path, 88)})`)}`);