@hasna/instructions 0.7.0 → 0.7.1

package/README.md

@@ -52,9 +52,13 @@ existing row.
 
 ```bash
 instructions --help
-instructions list                    # compact, paged summary
-instructions list --verbose          # expanded metadata, still paged
-instructions list --json             # full machine-readable records
+instructions list                                      # compact, paged summary
+instructions list --verbose                            # expanded metadata, still paged
+instructions list --json                               # legacy complete full-record array
+instructions list --json --detail compact --limit 20   # bounded identity envelope
+instructions list --json --detail compact --fields id,slug,name,version
+instructions list --json --detail full --limit 20      # explicit bounded content read
+instructions list --json --detail compact --all        # explicit complete metadata read
 instructions show <slug>             # full metadata + content
 instructions inspect <slug>          # alias for show
 instructions profile resolve
@@ -68,7 +72,9 @@ small. Human output is capped at 20 rows unless you pass `--limit`; use
 `--cursor` to continue from the next page. Detail is explicit:
 
 - `--verbose` expands list rows with descriptions, tags, and paths.
-- `--json` preserves full machine-readable records for automation.
+- Legacy `--json` with no modern detail flags preserves the complete full-record array for automation. Explicit `--limit`/`--cursor` now bound that legacy array.
+- `--detail compact` returns a content-free `{ configs, _meta }` identity envelope through the already-deployed `/v1/configs?view=identity` projection. Add `--fields` (including immutable `id`), `--all`, or `--pretty` as needed.
+- `--detail full` is the explicit content-bearing envelope; it is bounded unless `--all` is supplied.
 - `show`/`inspect` and `snapshot show` print full config or snapshot content.
 
 `instructions report --json` emits the stable `schema_version: 1` report
@@ -330,6 +336,14 @@ credentials may come from Bun's standard AWS chain (including an ECS task role);
 explicit static credentials are optional and must be a complete pair. Status
 never prints credential values or the bucket name.
 
+The production deployment runs the immutable predeploy backup push and verify
+as direct Bun commands in the exact candidate image. The GitHub runner alone
+parses the push receipt, then supplies the recorded payload and manifest version
+IDs to verification; it also checks the receipt digest and size, COMPLIANCE
+Object Lock retention for both versions, and an exact versioned-payload
+readback. Every backup gate completes before any ECR push, database migration,
+or ECS update.
+
 The public importable surface is available at `@hasna/instructions/storage`.
 
 ## Data Directory

package/dist/chunks/{apply-7svah2qm.js → apply-c3sd4agz.js}

@@ -8,8 +8,8 @@ import {
   getConfigHome,
   normalizeTargetPath,
   previewConfigs
-} from "./index-fwbs6tma.js";
-import"./index-4pfq42t5.js";
+} from "./index-ypcef3a2.js";
+import"./index-aj66f6xr.js";
 import"./index-35z65jsa.js";
 import"./index-3djthcm6.js";
 import"./index-nnwp92tk.js";

package/dist/chunks/{apply-jp13sa1e.js → apply-pnn7a3y7.js}

@@ -8,8 +8,8 @@ import {
   getConfigHome,
   normalizeTargetPath,
   previewConfigs
-} from "./index-z3ma4aqk.js";
-import"./index-7m4j8a33.js";
+} from "./index-r7nfef2g.js";
+import"./index-6jncnnw7.js";
 import"./index-n3fjspr0.js";
 import"./index-fpeyzn3n.js";
 import"./index-bsan4c16.js";

package/dist/chunks/{index-7m4j8a33.js → index-6jncnnw7.js}

@@ -11722,6 +11722,19 @@ function parseBoundedOrLegacyPage(value, legacyItems, options, label) {
   const page = boundedReadPage(legacyItems.slice(normalized.cursor, normalized.cursor + normalized.limit), legacyItems.length, normalized);
   return { ...page, source_bounded: false };
 }
+function projectBoundedPage(page, project) {
+  return {
+    items: page.items.map(project),
+    total: page.total,
+    limit: page.limit,
+    cursor: page.cursor,
+    next_cursor: page.next_cursor,
+    has_more: page.has_more,
+    complete: page.complete,
+    truncated: page.truncated,
+    source_bounded: page.source_bounded
+  };
+}
 
 class CollectionChangedWhilePagingError extends Error {
   constructor(label, detail) {
@@ -11806,7 +11819,7 @@ function formatCliError(err, env = process.env) {
 var localStoreModulePromise = null;
 function localStoreModule() {
   if (!localStoreModulePromise)
-    localStoreModulePromise = import("./local-zxa5dpf4.js");
+    localStoreModulePromise = import("./local-969ye538.js");
   return localStoreModulePromise;
 }
 
@@ -11820,6 +11833,15 @@ class LocalConfigStore {
   async listConfigs(filter) {
     return (await localStoreModule()).listConfigs(filter, this.db);
   }
+  async listConfigsPage(filter = {}, options = {}) {
+    return (await localStoreModule()).listConfigsPage(filter, options, this.db);
+  }
+  async listConfigIdentitiesPage(filter = {}, options = {}) {
+    return (await localStoreModule()).listConfigIdentitiesPage(filter, options, this.db);
+  }
+  async listConfigSummariesPage(filter = {}, options = {}) {
+    return (await localStoreModule()).listConfigSummariesPage(filter, options, this.db);
+  }
   async getConfig(idOrSlug) {
     return (await localStoreModule()).getConfig(idOrSlug, this.db);
   }
@@ -11923,6 +11945,43 @@ class LocalConfigStore {
     (await localStoreModule()).resetLocalDatabase();
   }
 }
+function toConfigIdentity(value) {
+  const record = value && typeof value === "object" ? value : {};
+  return {
+    id: String(record.id ?? ""),
+    name: String(record.name ?? ""),
+    slug: String(record.slug ?? ""),
+    kind: String(record.kind ?? ""),
+    category: String(record.category ?? ""),
+    agent: String(record.agent ?? ""),
+    format: String(record.format ?? ""),
+    is_template: Boolean(record.is_template),
+    version: Number(record.version ?? 0),
+    created_at: String(record.created_at ?? ""),
+    updated_at: String(record.updated_at ?? ""),
+    synced_at: record.synced_at == null ? null : String(record.synced_at)
+  };
+}
+function toConfigSummary(value) {
+  const record = value && typeof value === "object" ? value : {};
+  const outputs = Array.isArray(record.outputs) ? record.outputs : [];
+  return {
+    id: String(record.id ?? ""),
+    slug: String(record.slug ?? ""),
+    name: String(record.name ?? ""),
+    category: String(record.category ?? ""),
+    agent: String(record.agent ?? ""),
+    kind: String(record.kind ?? ""),
+    format: String(record.format ?? ""),
+    target_path: record.target_path == null ? null : String(record.target_path),
+    output_count: Number(record.output_count ?? outputs.length),
+    version: Number(record.version ?? 0),
+    is_template: Boolean(record.is_template),
+    ...record.updated_at !== undefined ? { updated_at: String(record.updated_at) } : {},
+    ...record.description !== undefined ? { description: record.description == null ? null : String(record.description) } : {},
+    ...Array.isArray(record.tags) ? { tags: record.tags.map(String) } : {}
+  };
+}
 
 class CloudConfigStore {
   mode = "api";
@@ -11944,7 +12003,7 @@ class CloudConfigStore {
       throw err;
     }
   }
-  async listConfigsPageRemote(filter, options) {
+  async listConfigsPage(filter = {}, options = {}) {
     const normalized = normalizeBoundedReadOptions(options);
     const params = new URLSearchParams;
     if (filter.category)
@@ -11955,13 +12014,67 @@ class CloudConfigStore {
       params.set("kind", filter.kind);
     if (filter.search)
       params.set("search", filter.search);
+    for (const tag of filter.tags ?? [])
+      params.append("tag", tag);
     params.set("limit", String(normalized.limit));
     params.set("cursor", String(normalized.cursor));
     const { data } = await this.request("GET", `/configs?${params.toString()}`);
     return parseBoundedOrLegacyPage(data, data?.configs, normalized, "config list");
   }
+  async listConfigIdentitiesPage(filter = {}, options = {}) {
+    const normalized = normalizeBoundedReadOptions(options);
+    const params = new URLSearchParams;
+    if (filter.category)
+      params.set("category", filter.category);
+    if (filter.agent)
+      params.set("agent", filter.agent);
+    if (filter.kind)
+      params.set("kind", filter.kind);
+    if (filter.search)
+      params.set("search", filter.search);
+    for (const tag of filter.tags ?? [])
+      params.append("tag", tag);
+    params.set("view", "identity");
+    params.set("limit", String(normalized.limit));
+    params.set("cursor", String(normalized.cursor));
+    const { data } = await this.request("GET", `/configs?${params.toString()}`);
+    const page = parseBoundedOrLegacyPage(data, data?.configs, normalized, "config identity list");
+    if (page.items.some((item) => {
+      const record = item && typeof item === "object" ? item : {};
+      return ["content", "target_path", "outputs", "description", "tags"].some((field) => Object.prototype.hasOwnProperty.call(record, field));
+    })) {
+      throw new Error("Instructions /v1 config identity projection is unavailable; deploy the identity endpoint before using compact lists");
+    }
+    return projectBoundedPage(page, toConfigIdentity);
+  }
+  async listConfigSummariesPage(filter = {}, options = {}) {
+    const normalized = normalizeBoundedReadOptions(options);
+    const params = new URLSearchParams;
+    if (filter.category)
+      params.set("category", filter.category);
+    if (filter.agent)
+      params.set("agent", filter.agent);
+    if (filter.kind)
+      params.set("kind", filter.kind);
+    if (filter.search)
+      params.set("search", filter.search);
+    for (const tag of filter.tags ?? [])
+      params.append("tag", tag);
+    params.set("view", "summary");
+    params.set("limit", String(normalized.limit));
+    params.set("cursor", String(normalized.cursor));
+    const { data } = await this.request("GET", `/configs?${params.toString()}`);
+    const page = parseBoundedOrLegacyPage(data, data?.configs, normalized, "config summary list");
+    if (page.items.some((item) => {
+      const record = item && typeof item === "object" ? item : {};
+      return Object.prototype.hasOwnProperty.call(record, "content") || Object.prototype.hasOwnProperty.call(record, "outputs");
+    })) {
+      throw new Error("Instructions /v1 config summary projection is unavailable; deploy the summary endpoint before using summary lists");
+    }
+    return projectBoundedPage(page, toConfigSummary);
+  }
   async listConfigs(filter = {}) {
-    const configs = await aggregateBoundedCollection("config list", (cursor) => this.listConfigsPageRemote(filter, { limit: 100, cursor }), (config) => config.id, { requireAscendingIdentity: true });
+    const configs = await aggregateBoundedCollection("config list", (cursor) => this.listConfigsPage(filter, { limit: 100, cursor }), (config) => config.id, { requireAscendingIdentity: true });
     let filtered = configs;
     if (filter.tags && filter.tags.length > 0) {
       filtered = filtered.filter((config) => filter.tags.every((tag) => config.tags.includes(tag)));
@@ -12027,7 +12140,7 @@ class CloudConfigStore {
     return data?.pruned ?? 0;
   }
   async listProfiles() {
-    return aggregateBoundedCollection("profile list", (cursor) => this.listProfilesPage({ limit: 100, cursor }), (profile) => profile.id, { requireAscendingIdentity: true });
+    return aggregateBoundedCollection("profile list", (cursor) => this.listProfilesPage({ limit: 100, cursor }), (profile) => profile.id);
   }
   async listProfilesPage(options = {}) {
     const normalized = normalizeBoundedReadOptions(options);

package/dist/chunks/{index-4pfq42t5.js → index-aj66f6xr.js}

@@ -244,28 +244,6 @@ function truncateText(value, max = 80) {
     return text.slice(0, max);
   return `${text.slice(0, max - 3)}...`;
 }
-function summarizeConfig(config, opts = {}) {
-  const summary = {
-    id: config.id,
-    slug: config.slug,
-    name: config.name,
-    category: config.category,
-    agent: config.agent,
-    kind: config.kind,
-    format: config.format,
-    target_path: config.target_path,
-    output_count: config.outputs.length,
-    version: config.version,
-    is_template: config.is_template
-  };
-  if (opts.verbose) {
-    summary.updated_at = config.updated_at;
-    summary.description = config.description;
-    summary.tags = config.tags;
-    summary.outputs = config.outputs;
-  }
-  return summary;
-}
 function summarizeProfile(profile, opts = {}) {
   const selectorCount = (profile.selectors.os?.length ?? 0) + (profile.selectors.arch?.length ?? 0) + (profile.selectors.hostnames?.length ?? 0);
   const summary = {
@@ -2059,6 +2037,19 @@ function parseBoundedOrLegacyPage(value, legacyItems, options, label) {
   const page = boundedReadPage(legacyItems.slice(normalized.cursor, normalized.cursor + normalized.limit), legacyItems.length, normalized);
   return { ...page, source_bounded: false };
 }
+function projectBoundedPage(page, project) {
+  return {
+    items: page.items.map(project),
+    total: page.total,
+    limit: page.limit,
+    cursor: page.cursor,
+    next_cursor: page.next_cursor,
+    has_more: page.has_more,
+    complete: page.complete,
+    truncated: page.truncated,
+    source_bounded: page.source_bounded
+  };
+}
 
 class CollectionChangedWhilePagingError extends Error {
   constructor(label, detail) {
@@ -2124,7 +2115,7 @@ function isNotFoundHttpError2(err) {
 var localStoreModulePromise = null;
 function localStoreModule() {
   if (!localStoreModulePromise)
-    localStoreModulePromise = import("./local-5wvv5xv3.js");
+    localStoreModulePromise = import("./local-0a9gja58.js");
   return localStoreModulePromise;
 }
 
@@ -2138,6 +2129,15 @@ class LocalConfigStore {
   async listConfigs(filter) {
     return (await localStoreModule()).listConfigs(filter, this.db);
   }
+  async listConfigsPage(filter = {}, options = {}) {
+    return (await localStoreModule()).listConfigsPage(filter, options, this.db);
+  }
+  async listConfigIdentitiesPage(filter = {}, options = {}) {
+    return (await localStoreModule()).listConfigIdentitiesPage(filter, options, this.db);
+  }
+  async listConfigSummariesPage(filter = {}, options = {}) {
+    return (await localStoreModule()).listConfigSummariesPage(filter, options, this.db);
+  }
   async getConfig(idOrSlug) {
     return (await localStoreModule()).getConfig(idOrSlug, this.db);
   }
@@ -2241,6 +2241,43 @@ class LocalConfigStore {
     (await localStoreModule()).resetLocalDatabase();
   }
 }
+function toConfigIdentity(value) {
+  const record = value && typeof value === "object" ? value : {};
+  return {
+    id: String(record.id ?? ""),
+    name: String(record.name ?? ""),
+    slug: String(record.slug ?? ""),
+    kind: String(record.kind ?? ""),
+    category: String(record.category ?? ""),
+    agent: String(record.agent ?? ""),
+    format: String(record.format ?? ""),
+    is_template: Boolean(record.is_template),
+    version: Number(record.version ?? 0),
+    created_at: String(record.created_at ?? ""),
+    updated_at: String(record.updated_at ?? ""),
+    synced_at: record.synced_at == null ? null : String(record.synced_at)
+  };
+}
+function toConfigSummary(value) {
+  const record = value && typeof value === "object" ? value : {};
+  const outputs = Array.isArray(record.outputs) ? record.outputs : [];
+  return {
+    id: String(record.id ?? ""),
+    slug: String(record.slug ?? ""),
+    name: String(record.name ?? ""),
+    category: String(record.category ?? ""),
+    agent: String(record.agent ?? ""),
+    kind: String(record.kind ?? ""),
+    format: String(record.format ?? ""),
+    target_path: record.target_path == null ? null : String(record.target_path),
+    output_count: Number(record.output_count ?? outputs.length),
+    version: Number(record.version ?? 0),
+    is_template: Boolean(record.is_template),
+    ...record.updated_at !== undefined ? { updated_at: String(record.updated_at) } : {},
+    ...record.description !== undefined ? { description: record.description == null ? null : String(record.description) } : {},
+    ...Array.isArray(record.tags) ? { tags: record.tags.map(String) } : {}
+  };
+}
 
 class CloudConfigStore {
   mode = "api";
@@ -2262,7 +2299,7 @@ class CloudConfigStore {
       throw err;
     }
   }
-  async listConfigsPageRemote(filter, options) {
+  async listConfigsPage(filter = {}, options = {}) {
     const normalized = normalizeBoundedReadOptions(options);
     const params = new URLSearchParams;
     if (filter.category)
@@ -2273,13 +2310,67 @@ class CloudConfigStore {
       params.set("kind", filter.kind);
     if (filter.search)
       params.set("search", filter.search);
+    for (const tag of filter.tags ?? [])
+      params.append("tag", tag);
     params.set("limit", String(normalized.limit));
     params.set("cursor", String(normalized.cursor));
     const { data } = await this.request("GET", `/configs?${params.toString()}`);
     return parseBoundedOrLegacyPage(data, data?.configs, normalized, "config list");
   }
+  async listConfigIdentitiesPage(filter = {}, options = {}) {
+    const normalized = normalizeBoundedReadOptions(options);
+    const params = new URLSearchParams;
+    if (filter.category)
+      params.set("category", filter.category);
+    if (filter.agent)
+      params.set("agent", filter.agent);
+    if (filter.kind)
+      params.set("kind", filter.kind);
+    if (filter.search)
+      params.set("search", filter.search);
+    for (const tag of filter.tags ?? [])
+      params.append("tag", tag);
+    params.set("view", "identity");
+    params.set("limit", String(normalized.limit));
+    params.set("cursor", String(normalized.cursor));
+    const { data } = await this.request("GET", `/configs?${params.toString()}`);
+    const page = parseBoundedOrLegacyPage(data, data?.configs, normalized, "config identity list");
+    if (page.items.some((item) => {
+      const record = item && typeof item === "object" ? item : {};
+      return ["content", "target_path", "outputs", "description", "tags"].some((field) => Object.prototype.hasOwnProperty.call(record, field));
+    })) {
+      throw new Error("Instructions /v1 config identity projection is unavailable; deploy the identity endpoint before using compact lists");
+    }
+    return projectBoundedPage(page, toConfigIdentity);
+  }
+  async listConfigSummariesPage(filter = {}, options = {}) {
+    const normalized = normalizeBoundedReadOptions(options);
+    const params = new URLSearchParams;
+    if (filter.category)
+      params.set("category", filter.category);
+    if (filter.agent)
+      params.set("agent", filter.agent);
+    if (filter.kind)
+      params.set("kind", filter.kind);
+    if (filter.search)
+      params.set("search", filter.search);
+    for (const tag of filter.tags ?? [])
+      params.append("tag", tag);
+    params.set("view", "summary");
+    params.set("limit", String(normalized.limit));
+    params.set("cursor", String(normalized.cursor));
+    const { data } = await this.request("GET", `/configs?${params.toString()}`);
+    const page = parseBoundedOrLegacyPage(data, data?.configs, normalized, "config summary list");
+    if (page.items.some((item) => {
+      const record = item && typeof item === "object" ? item : {};
+      return Object.prototype.hasOwnProperty.call(record, "content") || Object.prototype.hasOwnProperty.call(record, "outputs");
+    })) {
+      throw new Error("Instructions /v1 config summary projection is unavailable; deploy the summary endpoint before using summary lists");
+    }
+    return projectBoundedPage(page, toConfigSummary);
+  }
   async listConfigs(filter = {}) {
-    const configs = await aggregateBoundedCollection("config list", (cursor) => this.listConfigsPageRemote(filter, { limit: 100, cursor }), (config) => config.id, { requireAscendingIdentity: true });
+    const configs = await aggregateBoundedCollection("config list", (cursor) => this.listConfigsPage(filter, { limit: 100, cursor }), (config) => config.id, { requireAscendingIdentity: true });
     let filtered = configs;
     if (filter.tags && filter.tags.length > 0) {
       filtered = filtered.filter((config) => filter.tags.every((tag) => config.tags.includes(tag)));
@@ -2345,7 +2436,7 @@ class CloudConfigStore {
     return data?.pruned ?? 0;
   }
   async listProfiles() {
-    return aggregateBoundedCollection("profile list", (cursor) => this.listProfilesPage({ limit: 100, cursor }), (profile) => profile.id, { requireAscendingIdentity: true });
+    return aggregateBoundedCollection("profile list", (cursor) => this.listProfilesPage({ limit: 100, cursor }), (profile) => profile.id);
   }
   async listProfilesPage(options = {}) {
     const normalized = normalizeBoundedReadOptions(options);
@@ -7297,4 +7388,4 @@ function renderMachineAwareContentPreview(content, variables) {
   return isTemplate(content) ? renderTemplatePreview(content, variables) : { content, unresolved: [] };
 }
 
-export { pagedPayload, summarizeConfig, summarizeProfile, summarizeApplyResult, normalizeBoundedReadOptions, boundedReadPage, SESSION_RENDER_SCHEMA, SESSION_RENDER_MANIFEST_RELATIVE_PATH, isRetiredOrUnsupportedConfigAgent, retiredOrUnsupportedAgentReason, applyTransform, normalizeProfileAssetBinding, isCursorGlobalAuthorityPath, stampCursorGlobalAuthorityMarker, getReportedDbPath, getRawStoreRoot, ANTIGRAVITY_RULE_FILE_CHAR_LIMIT, SESSION_RENDERER_OWNER_ID, SESSION_RENDER_OWNED_CONFIG_TARGETS, SESSION_RENDER_EXCLUSIVE_MANAGED_PATHS, legacyProfileConfigBinding, normalizeProfileConfigBinding, hasInstructionsEnvAuthorityIntent, normalizeOsFamily, detectMachineContext, machineContextToVariables, resolveProfileVariables, templateizeMachineContent, renderMachineAwareContentPreview, resolveConfigStore };
+export { pagedPayload, summarizeProfile, summarizeApplyResult, normalizeBoundedReadOptions, boundedReadPage, SESSION_RENDER_SCHEMA, SESSION_RENDER_MANIFEST_RELATIVE_PATH, isRetiredOrUnsupportedConfigAgent, retiredOrUnsupportedAgentReason, applyTransform, normalizeProfileAssetBinding, isCursorGlobalAuthorityPath, stampCursorGlobalAuthorityMarker, getReportedDbPath, getRawStoreRoot, ANTIGRAVITY_RULE_FILE_CHAR_LIMIT, SESSION_RENDERER_OWNER_ID, SESSION_RENDER_OWNED_CONFIG_TARGETS, SESSION_RENDER_EXCLUSIVE_MANAGED_PATHS, legacyProfileConfigBinding, normalizeProfileConfigBinding, hasInstructionsEnvAuthorityIntent, normalizeOsFamily, detectMachineContext, machineContextToVariables, resolveProfileVariables, templateizeMachineContent, renderMachineAwareContentPreview, resolveConfigStore };

package/dist/chunks/{index-bzyxvwcd.js → index-jg8ptcwh.js}

@@ -5,7 +5,7 @@ import {
   expandPath,
   getConfigHome,
   normalizeTargetPath
-} from "./index-fwbs6tma.js";
+} from "./index-ypcef3a2.js";
 import {
   applyTransform,
   detectMachineContext,
@@ -13,7 +13,7 @@ import {
   resolveConfigStore,
   retiredOrUnsupportedAgentReason,
   templateizeMachineContent
-} from "./index-4pfq42t5.js";
+} from "./index-aj66f6xr.js";
 import {
   isSecretVarName,
   redactContent,

package/dist/chunks/{index-arrrx0ed.js → index-mvckkf15.js}

@@ -73,18 +73,20 @@ function createInstructionsS3ObjectStore(config, createClient = (options) => new
   return {
     async putIfAbsent(key, bytes, options) {
       assertSafeInstructionsObjectKey(key);
+      let credentials;
+      try {
+        credentials = resolveRequestCredentials(config);
+      } catch {
+        throw new Error("Instructions S3 conditional object creation failed");
+      }
       for (let attempt = 1;attempt <= CONDITIONAL_CREATE_ATTEMPTS; attempt += 1) {
         let response;
         const controller = new AbortController;
         try {
-          const url = client.presign(key, { method: "PUT", expiresIn: 60 });
-          response = await runWithDeadline(() => requestFetch(url, {
+          const signed = signConditionalCreateRequest(config, key, bytes, options.contentType, credentials, new Date);
+          response = await runWithDeadline(() => requestFetch(signed.url, {
             method: "PUT",
-            headers: {
-              "content-type": options.contentType,
-              "content-md5": createHash("md5").update(bytes).digest("base64"),
-              "if-none-match": "*"
-            },
+            headers: signed.headers,
             body: Uint8Array.from(bytes),
             redirect: "error",
             signal: controller.signal
@@ -220,7 +222,7 @@ function resolveRequestCredentials(config) {
   const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
   const sessionToken = process.env.AWS_SESSION_TOKEN?.trim();
   if (!accessKeyId || !secretAccessKey) {
-    throw new Error("Instructions S3 exact-version reads require explicit or AWS environment credentials");
+    throw new Error("Instructions S3 signed requests require explicit or AWS environment credentials");
   }
   return { accessKeyId, secretAccessKey, ...sessionToken ? { sessionToken } : {} };
 }
@@ -235,25 +237,43 @@ function signVersionedRequest(config, key, versionId, method, credentials, now)
     "x-amz-date": amzDate,
     ...credentials.sessionToken ? { "x-amz-security-token": credentials.sessionToken } : {}
   });
-  const signedHeaderNames = [
-    "host",
-    "x-amz-content-sha256",
-    "x-amz-date",
-    ...credentials.sessionToken ? ["x-amz-security-token"] : []
-  ].sort();
-  const canonicalHeaders = signedHeaderNames.map((name) => `${name}:${headers.get(name).trim()}
-`).join("");
   const canonicalQuery = `versionId=${awsEncode(versionId)}`;
+  authorizeRequest(method, url, canonicalQuery, headers, EMPTY_SHA256, credentials, config.region, shortDate, amzDate);
+  return { url: url.toString(), headers };
+}
+function signConditionalCreateRequest(config, key, bytes, contentType, credentials, now) {
+  const url = buildObjectUrl(config, key);
+  const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+  const shortDate = amzDate.slice(0, 8);
+  const payloadHash = createHash("sha256").update(bytes).digest("hex");
+  const headers = new Headers({
+    "content-md5": createHash("md5").update(bytes).digest("base64"),
+    "content-type": contentType,
+    host: url.host,
+    "if-none-match": "*",
+    "x-amz-content-sha256": payloadHash,
+    "x-amz-date": amzDate,
+    ...credentials.sessionToken ? { "x-amz-security-token": credentials.sessionToken } : {}
+  });
+  authorizeRequest("PUT", url, "", headers, payloadHash, credentials, config.region, shortDate, amzDate);
+  return { url: url.toString(), headers };
+}
+function authorizeRequest(method, url, canonicalQuery, headers, payloadHash, credentials, region, shortDate, amzDate) {
+  const signedHeaderNames = [];
+  headers.forEach((_value, name) => signedHeaderNames.push(name));
+  signedHeaderNames.sort();
+  const canonicalHeaders = signedHeaderNames.map((name) => `${name}:${headers.get(name).trim().replace(/\s+/g, " ")}
+`).join("");
   const canonicalRequest = [
     method,
     url.pathname,
     canonicalQuery,
     canonicalHeaders,
     signedHeaderNames.join(";"),
-    EMPTY_SHA256
+    payloadHash
   ].join(`
 `);
-  const scope = `${shortDate}/${config.region}/s3/aws4_request`;
+  const scope = `${shortDate}/${region}/s3/aws4_request`;
   const stringToSign = [
     "AWS4-HMAC-SHA256",
     amzDate,
@@ -262,12 +282,11 @@ function signVersionedRequest(config, key, versionId, method, credentials, now)
   ].join(`
 `);
   const dateKey = hmac(`AWS4${credentials.secretAccessKey}`, shortDate);
-  const regionKey = hmac(dateKey, config.region);
+  const regionKey = hmac(dateKey, region);
   const serviceKey = hmac(regionKey, "s3");
   const signingKey = hmac(serviceKey, "aws4_request");
   const signature = createHmac("sha256", signingKey).update(stringToSign).digest("hex");
   headers.set("authorization", `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaderNames.join(";")}, Signature=${signature}`);
-  return { url: url.toString(), headers };
 }
 function buildObjectUrl(config, key) {
   const encodedKey = key.split("/").map(awsEncode).join("/");

package/dist/chunks/{index-1cnyjnd7.js → index-pdpg8a44.js}

@@ -5,7 +5,7 @@ import {
   expandPath,
   getConfigHome,
   normalizeTargetPath
-} from "./index-z3ma4aqk.js";
+} from "./index-r7nfef2g.js";
 import {
   applyTransform,
   detectMachineContext,
@@ -16,7 +16,7 @@ import {
   resolveConfigStore,
   retiredOrUnsupportedAgentReason,
   templateizeMachineContent
-} from "./index-7m4j8a33.js";
+} from "./index-6jncnnw7.js";
 
 // src/lib/sync.ts
 import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";

package/dist/chunks/{index-z3ma4aqk.js → index-r7nfef2g.js}

@@ -18,7 +18,7 @@ import {
   resolveProfileVariables,
   scanSecrets,
   stampCursorGlobalAuthorityMarker
-} from "./index-7m4j8a33.js";
+} from "./index-6jncnnw7.js";
 import {
   ConfigApplyError,
   parseTemplateVars

package/dist/chunks/{index-fwbs6tma.js → index-ypcef3a2.js}

@@ -15,7 +15,7 @@ import {
   resolveConfigStore,
   resolveProfileVariables,
   stampCursorGlobalAuthorityMarker
-} from "./index-4pfq42t5.js";
+} from "./index-aj66f6xr.js";
 import {
   isSecretVarName,
   redactFormatForTarget,