@hasna/contacts 0.7.0 → 0.8.1

package/README.md

@@ -14,33 +14,87 @@ npm install -g @hasna/contacts
 ## Configure the client
 
 Every CLI, MCP, and package data operation uses one authenticated HTTPS `/v1`
-authority. There is no built-in hosted URL and no local database fallback.
+authority resolved by the shared `@hasna/contracts` client chain
+(hasna/apps#1720), resolved fresh on every request. There is no local database
+fallback and no per-app env chain of its own.
+
+Once a contacts API key resolves from any tier, the authority defaults to the
+fleet gateway `https://api.hasna.com/contacts` — no URL configuration is
+needed on a station. The credential tiers, in order:
+
+1. explicit arguments / deliberate pointers — `HASNA_CONTACTS_API_KEY_OVERRIDE`, `HASNA_PROFILE`, `HASNA_CONTACTS_API_KEY_REF` (secrets vault)
+2. macOS Keychain — `hasna.credentials.contacts.api-key` / `.api-url`, account `HASNA_STATION` → `hostname -s` → `$USER`
+3. disk — `~/.hasna/contacts/config/credentials` (owner-only 0400/0600, `HASNA_CONTACTS_API_KEY=…` or the `HASNA_CONTACTS_API_URL=…` alias)
+4. environment — `HASNA_CONTACTS_API_KEY`
+
+| Env var | Meaning |
+|---|---|
+| `HASNA_CONTACTS_API_URL` | Explicit API base URL (HTTPS; overrides the fleet gateway). Legacy alias: `CONTACTS_API_URL`. |
+| `HASNA_CONTACTS_API_KEY` | API key (env tier). Legacy alias: `CONTACTS_API_KEY`. |
+| `HASNA_CONTACTS_API_KEY_OVERRIDE` | Deliberate per-run override that outranks the Keychain and disk. |
+| `HASNA_CONTACTS_API_KEY_REF` | Secrets-vault pointer (`namespace/app/live/api_key`); terminal when unresolvable. |
+| `HASNA_PROFILE` | Selects which identity (`credentials-<profile>`) the disk tier reads. |
+| `HASNA_STATION` | Keychain account when set; else short hostname, then `$USER`. |
+| `HASNA_HOME` | Replaces `~` for the `~/.hasna/…` credential/disk root. |
+| `HASNA_CONFIG_HOME` | Replaces `~/.hasna/<app>/config` entirely. |
 
 ```bash
+# Fully explicit:
 export HASNA_CONTACTS_API_URL="https://contacts.example.com"
-# Provision the API key through the @hasna/contracts credential chain. For
-# example, put HASNA_CONTACTS_API_KEY in the shared fleet/config credential chain,
-# or configure HASNA_CONTACTS_API_KEY_REF for the secrets client.
+export HASNA_CONTACTS_API_KEY="…"     # or configure the Keychain/disk tiers
 contacts connection --json
 ```
 
-An absent or invalid URL/key fails closed. `HASNA_CONTACTS_STORAGE_MODE`,
-`CONTACTS_STORAGE_MODE`, contacts DB-path variables, and contacts database URLs
-are rejected in client processes. PostgreSQL URLs belong only to
-`contacts-serve` and the migration task.
+An absent URL and key fails closed: operations exit non-zero and never open a
+local store; `contacts connection` reports `transport: "unconfigured"`.
+The fail-closed message starts on the FIRST stderr line — it names what is
+missing and where the credential should live (`HASNA_CONTACTS_API_KEY`, the
+Keychain item, the credentials-file path), never a value.
+`HASNA_CONTACTS_STORAGE_MODE`, `CONTACTS_STORAGE_MODE`, contacts DB-path
+variables, and contacts database URLs are rejected in client processes.
+PostgreSQL URLs belong only to `contacts-serve` and the migration task.
 
 ## CLI Usage
 
 ```bash
-contacts status            # CLI version, API endpoint, storage mode, record counts
+contacts status            # CLI version, resolved /v1 authority + sources, storage mode, record counts
 contacts status --json
 contacts --help
 ```
 
-`contacts status` answers even on a box without an API key: an unconfigured
-client reports storage `unconfigured` (a failed request on a configured box
-reports storage `error` with the failure message) instead of crashing, so
-agents can observe the configuration drift the command exists to expose.
+`contacts status` reports the authority the shared resolver actually decided
+(`api`, the `/v1` base URL) and where each half came from — `api_url_source`,
+`api_key_source`, `api_key_tier`: an env key name, a Keychain item reference,
+a credentials-file path, or `default` for the fleet gateway; never a value.
+It answers even on a box without an API key: an unconfigured client reports
+storage `unconfigured` with the resolver's `issue` (a failed request on a
+configured box reports storage `error` with the failure message) instead of
+crashing, so agents can observe the configuration drift the command exists to
+expose. `status` and `connection` are diagnostics and exit 0 with that report;
+every data verb fails closed (non-zero exit, no local store).
+
+## SDK
+
+```ts
+import { createContactsClient, ContactsV1Client } from "@hasna/contacts/sdk";
+
+// Through the fleet resolver — the same @hasna/contracts chain the CLI and MCP
+// server use: credential and authority resolved at construction, the key
+// re-resolved on every request, the authority pinned. Nothing resolving throws.
+const client = createContactsClient();
+const { contacts } = await client.listContacts();
+
+// Explicit pin: a caller-supplied baseUrl always requires a caller-supplied
+// apiKey — the SDK never attaches an ambient credential to it.
+const pinned = new ContactsV1Client({ baseUrl: "https://contacts.example.com", apiKey: "…" });
+```
+
+`createContactsClient()` resolves the literal tiers only — an explicit
+`apiKey`, `HASNA_CONTACTS_API_KEY_OVERRIDE`, the Keychain item, the
+credentials file, `HASNA_CONTACTS_API_KEY`. The secrets-vault pointer
+`HASNA_CONTACTS_API_KEY_REF` is refused with
+`CONTACTS_CREDENTIAL_POINTER_UNSUPPORTED` (the SDK resolves synchronously per
+request and cannot complete a vault lookup); the CLI and MCP server accept it.
 
 
 ## Audiences, consent, and suppression
@@ -76,6 +130,22 @@ suppressed addresses; the audience `--policy` (`opt_in`, `opt_out`,
 contacts-mcp
 ```
 
+`contacts-mcp` fails closed at startup: with no credential resolvable through
+the chain above it exits non-zero BEFORE the stdio transport is connected or
+the HTTP port is bound — an `initialize` request is never answered by an
+unauthenticated server — and creates nothing under the app home. The first
+stderr line names where the credential should live (the Keychain item, the
+credentials-file path, `HASNA_CONTACTS_API_KEY`), never a value.
+`--help` / `--version` answer ahead of the gate; every tool still re-resolves
+the credential per request once the server is up.
+
+The deliberate tiers are honoured at the gate as well. The secrets-vault
+pointer `HASNA_CONTACTS_API_KEY_REF` is dereferenced once at startup (the
+chain alone only checks the pointer's shape): a pointer the vault cannot
+complete, a `HASNA_PROFILE` whose credentials file is missing, or an unsafe
+(not owner-only) credentials file is a one-line refusal naming the pointer,
+the file, or the item — never resolved around, never a stack trace.
+
 ## HTTP mode
 
 Long-lived Streamable HTTP transport (stateless, bind `127.0.0.1` only):

package/dist/cli/commands/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/core.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqBzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAg4B5E"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/core.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqBzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAu5B5E"}

package/dist/cli/index.js

@@ -3621,6 +3621,13 @@ function parseMatcherExpression(value, label) {
     negated: false
   };
 }
+function webhookTargetPolicyFromEnv() {
+  const value = process.env.HASNA_EVENTS_ALLOW_PRIVATE_WEBHOOK_TARGETS;
+  if (!value)
+    return;
+  const hosts = value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+  return hosts.length > 0 ? { allowPrivateHosts: hosts } : undefined;
+}
 var DEFAULT_EVENT_LIST_LIMIT = 100;
 function parseJsonObject(value, fallback) {
   if (!value)
@@ -3646,7 +3653,7 @@ function parseHeaders(values) {
 function createClient(options) {
   if (options.createClient)
     return options.createClient();
-  return new EventsClient({ store: new JsonEventsStore(options.dataDir) });
+  return new EventsClient({ store: new JsonEventsStore(options.dataDir), webhookTargetPolicy: webhookTargetPolicyFromEnv() });
 }
 function print(value, json, text) {
   if (json)
@@ -3727,6 +3734,8 @@ function registerChannelCommands(program, options) {
         metadata: parseJsonObject(actionOptions.metadata, {})
       }, { honorFilters: actionOptions.honorFilters });
       print(result, json, `${result.status}: ${result.channelId}`);
+      if (result.status === "failed")
+        process.exitCode = 1;
     } catch (error) {
       fail(error, json);
     }
@@ -3840,6 +3849,7 @@ import chalk2 from "chalk";
 
 // src/cloud/http-storage.ts
 import {
+  ClientTransportConfigurationError,
   createHasnaHttpTransport,
   resolveCredential,
   resolveClientTransport as resolveSharedClientTransport
@@ -3929,6 +3939,27 @@ function assertConfigurationUnchanged(env, expected) {
     invalid();
 }
 
+// src/cloud/resolver-inputs.ts
+import {
+  clientTransportEnvKeys as clientTransportEnvKeys2,
+  credentialOverrideEnvKey,
+  credentialPointerEnvKey,
+  CREDENTIAL_PROFILE_ENV_KEY
+} from "@hasna/contracts/client";
+var CONTRACTS_AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+function isAmbientContactsEnv(env) {
+  if (typeof process !== "undefined" && env === process.env)
+    return true;
+  return env[CONTRACTS_AMBIENT_ENVIRONMENT] === true;
+}
+function contactsResolverCredentials(env, credentials = {}) {
+  const keychain = { ...credentials.keychain };
+  if (keychain.enabled === undefined && keychain.run === undefined) {
+    keychain.enabled = isAmbientContactsEnv(env);
+  }
+  return { ...credentials, keychain };
+}
+
 // src/cloud/http-storage.ts
 var RETIRED_CLIENT_SELECTOR_KEYS = [
   "HASNA_CONTACTS_STORAGE_MODE",
@@ -3964,37 +3995,44 @@ class ContactsClientConfigurationError extends Error {
     this.name = "ContactsClientConfigurationError";
   }
 }
-function unconfiguredResolution(resolution, issue) {
+function unconfiguredResolution(issue, resolution, warning = null) {
   return {
     transport: "unconfigured",
     baseUrl: null,
-    apiUrlSource: resolution.apiUrlSource,
-    apiKeyPresent: resolution.apiKeyPresent,
-    apiKeySource: resolution.apiKeySource,
-    apiKeyTier: resolution.apiKeyTier,
+    apiUrlSource: resolution?.apiUrlSource ?? null,
+    apiKeyPresent: resolution?.apiKeyPresent ?? false,
+    apiKeySource: resolution?.apiKeySource ?? null,
+    apiKeyTier: resolution?.apiKeyTier ?? null,
     configured: false,
     misconfigured: true,
     issue,
-    warning: null
+    warning
   };
 }
-function resolveContactsClientTransport(name, env = process.env) {
+function resolveContactsClientTransport(name, env = process.env, credentials = {}) {
   if (name !== "contacts") {
     throw new ContactsClientConfigurationError("CONTACTS_CLIENT_NAME_INVALID", "This resolver only accepts the contacts app slug.");
   }
   assertNoRetiredClientSelectors(env);
   const stamp = clientConfigurationStamp(env);
-  const resolution = resolveSharedClientTransport(name, env);
-  assertConfigurationUnchanged(env, stamp);
-  if (resolution.transport !== "http" || !resolution.baseUrl) {
-    const issue = resolution.misconfigured ? "The configured contacts API URL or credential is invalid or incomplete." : "HASNA_CONTACTS_API_URL and a resolvable contacts API key are required; no local fallback exists.";
-    return unconfiguredResolution(resolution, issue);
+  let resolution;
+  try {
+    resolution = resolveSharedClientTransport(name, env, {
+      credentials: contactsResolverCredentials(env, credentials)
+    });
+  } catch (error) {
+    assertConfigurationUnchanged(env, stamp);
+    if (error instanceof ClientTransportConfigurationError) {
+      return unconfiguredResolution(error.message, null);
+    }
+    throw error;
   }
+  assertConfigurationUnchanged(env, stamp);
   try {
     assertHttpsBaseUrl(resolution.baseUrl);
   } catch (error) {
     return {
-      ...unconfiguredResolution(resolution, error instanceof Error ? error.message : String(error)),
+      ...unconfiguredResolution(error instanceof Error ? error.message : String(error), resolution),
       apiKeyPresent: resolution.apiKeyPresent
     };
   }
@@ -4008,7 +4046,7 @@ function resolveContactsClientTransport(name, env = process.env) {
     configured: true,
     misconfigured: false,
     issue: null,
-    warning: null
+    warning: resolution.warning
   };
 }
 function resourcePath(resource) {
@@ -4062,20 +4100,21 @@ function createStorageClient(name, transport) {
     }
   };
 }
-function resolveContactsStorageClient(name, env = process.env) {
-  const resolution = resolveContactsClientTransport(name, env);
+function resolveContactsStorageClient(name, env = process.env, credentials = {}) {
+  const resolution = resolveContactsClientTransport(name, env, credentials);
   if (!resolution.configured || !resolution.baseUrl) {
     throw new ContactsClientConfigurationError("CONTACTS_API_NOT_CONFIGURED", `${resolution.issue ?? "The contacts API client is not configured."} ` + "Configure HASNA_CONTACTS_API_URL and a contacts API key; the client will not read or create a local SQLite database.");
   }
   const baseUrl = resolution.baseUrl;
+  const chainOptions = contactsResolverCredentials(env, credentials);
   const request = async (method, path, body, opts) => {
     const stamp = clientConfigurationStamp(env);
     const snapshot = { ...env };
-    const current = resolveContactsClientTransport(name, snapshot);
+    const current = resolveContactsClientTransport(name, snapshot, chainOptions);
     if (!current.configured || current.baseUrl !== baseUrl) {
       throw new ContactsClientConfigurationError("CONTACTS_AUTHORITY_CHANGED", "Client authority changed or disappeared; construct a new client before sending data.");
     }
-    const credential = resolveCredential(name, snapshot);
+    const credential = resolveCredential(name, snapshot, chainOptions);
     if (!credential)
       throw new ContactsClientConfigurationError("CONTACTS_API_NOT_CONFIGURED", "No credential is available.");
     assertConfigurationUnchanged(env, stamp);
@@ -5375,12 +5414,22 @@ function collect(val, prev) {
 }
 function registerCoreCommands(program2, version) {
   program2.command("status").description("Show CLI version, API endpoint, storage mode, and record counts").option("--json", "Output as JSON").action(async (opts) => {
-    const baseUrl = process.env["HASNA_CONTACTS_API_URL"]?.trim();
-    const apiLine = baseUrl ? baseUrl : "(not configured \u2014 set HASNA_CONTACTS_API_URL plus a contacts API key)";
+    let apiLine = "(not configured \u2014 set HASNA_CONTACTS_API_URL plus a contacts API key)";
+    let apiUrlSource = null;
+    let apiKeySource = null;
+    let apiKeyTier = null;
+    let issue = null;
     let counts;
     let storage;
     let failure;
     try {
+      const resolution = resolveContactsClientTransport("contacts");
+      apiUrlSource = resolution.apiUrlSource;
+      apiKeySource = resolution.apiKeySource;
+      apiKeyTier = resolution.apiKeyTier;
+      issue = resolution.issue;
+      if (resolution.configured && resolution.baseUrl)
+        apiLine = resolution.baseUrl;
       const store = getStore();
       const [contacts, companies] = await Promise.all([
         store.listContacts({ limit: 1 }),
@@ -5400,7 +5449,11 @@ function registerCoreCommands(program2, version) {
       service: "contacts",
       version,
       api: apiLine,
+      api_url_source: apiUrlSource,
+      api_key_source: apiKeySource,
+      api_key_tier: apiKeyTier,
       storage,
+      ...issue !== null ? { issue } : {},
       ...failure !== undefined ? { error: failure } : {},
       ...counts ? { counts } : {}
     };
@@ -5410,7 +5463,13 @@ function registerCoreCommands(program2, version) {
     }
     console.log(chalk2.bold(`contacts v${version}`));
     console.log(`API:      ${apiLine}`);
+    if (apiUrlSource)
+      console.log(`API URL source: ${apiUrlSource}`);
+    if (apiKeySource)
+      console.log(`API key source: ${apiKeySource}${apiKeyTier ? ` (${apiKeyTier})` : ""}`);
     console.log(`Storage:  ${storage}`);
+    if (issue !== null)
+      console.log(chalk2.yellow(`Issue:    ${issue}`));
     if (failure !== undefined)
       console.log(chalk2.red(`Error:    ${failure}`));
     if (counts) {
@@ -12177,10 +12236,8 @@ import chalk7 from "chalk";
 import { homedir as pathsResolverHomedir2 } from "os";
 import { join as pathsResolverJoin2 } from "path";
 var PATHS_RESOLVER_KIND_ENV2 = {
-  config: "HASNA_CONFIG_HOME",
   data: "HASNA_DATA_HOME",
-  state: "HASNA_STATE_HOME",
-  cache: "HASNA_CACHE_HOME"
+  state: "HASNA_STATE_HOME"
 };
 var PATHS_RESOLVER_APP_SLUG_RE2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 function pathsResolverAssertApp2(app) {
@@ -12206,24 +12263,17 @@ function pathsResolverBaseDir2(kind, options) {
   const platform = options.platform ?? process.platform;
   if (platform === "darwin") {
     switch (kind) {
-      case "config":
       case "data":
         return pathsResolverJoin2(home, "Library", "Application Support", "Hasna");
-      case "cache":
-        return pathsResolverJoin2(home, "Library", "Caches", "Hasna");
       case "state":
         return pathsResolverJoin2(home, "Library", "Logs", "Hasna");
     }
   }
   switch (kind) {
-    case "config":
-      return pathsResolverJoin2(home, ".config", "hasna");
     case "data":
       return pathsResolverJoin2(home, ".local", "share", "hasna");
     case "state":
       return pathsResolverJoin2(home, ".local", "state", "hasna");
-    case "cache":
-      return pathsResolverJoin2(home, ".cache", "hasna");
   }
 }
 function pathsResolverResolve2(kind, options) {
@@ -12409,8 +12459,7 @@ registerEventCommands2(program, { source: "contacts", eventsCommandName: "hasna-
 program.parseAsync(process.argv).catch((err) => {
   const message = err instanceof Error ? err.message : String(err);
   const isApiUnavailable = err instanceof Error && err.name === "ApiUnavailableError";
-  console.error(`
-` + (isApiUnavailable ? chalk8.yellow(message) : chalk8.red(message)) + `
+  console.error((isApiUnavailable ? chalk8.yellow(message) : chalk8.red(message)) + `
 `);
   process.exit(1);
 });

package/dist/cloud/http-storage.d.ts

@@ -2,18 +2,20 @@
  * Canonical contacts client transport.
  *
  * Public clients have exactly one data path: an authenticated HTTPS `/v1`
- * authority. The server URL is always explicit; this module never composes or
- * guesses a hosted URL. API-key resolution and per-request rotation are owned
- * by `@hasna/contracts/client`, so key material is never exposed by status
- * objects or cached in this package.
+ * authority, resolved by `@hasna/contracts/client` — the ONE fleet resolver.
+ * The authority defaults to the fleet gateway `https://api.hasna.com/contacts`
+ * once any credential tier resolves, and `HASNA_CONTACTS_API_URL`, the
+ * Keychain `api-url` item, or the credentials file override it. API-key
+ * resolution and per-request rotation are owned by the shared resolver, so
+ * key material is never exposed by status objects or cached in this package.
  *
  * SQLite, PostgreSQL DSNs, and storage/deployment modes are not client
  * transports. A stale selector is a configuration error, not a reason to read
  * a different data set.
  */
-import { type ClientTransportResolution as SharedClientTransportResolution, type HasnaHttpTransport, type HasnaRequestOptions, type QueryParams } from "@hasna/contracts/client";
-export type Env = Record<string, string | undefined>;
-export type { QueryParams };
+import { type CredentialChainOptions, type CredentialTier, type HasnaHttpTransport, type HasnaRequestOptions, type QueryParams } from "@hasna/contracts/client";
+import type { Env } from "./resolver-inputs.js";
+export type { Env, QueryParams };
 export declare const RETIRED_CLIENT_SELECTOR_KEYS: readonly ["HASNA_CONTACTS_STORAGE_MODE", "CONTACTS_STORAGE_MODE", "HASNA_CONTACTS_MODE", "CONTACTS_MODE", "HASNA_CONTACTS_DB_PATH", "CONTACTS_DB_PATH", "HASNA_CONTACTS_DATABASE_URL", "CONTACTS_DATABASE_URL"];
 export declare class ContactsClientConfigurationError extends Error {
     readonly code: string;
@@ -25,17 +27,23 @@ export interface ClientTransportResolution {
     apiUrlSource: string | null;
     apiKeyPresent: boolean;
     apiKeySource: string | null;
-    apiKeyTier: SharedClientTransportResolution["apiKeyTier"];
+    apiKeyTier: CredentialTier | null;
     configured: boolean;
     misconfigured: boolean;
     issue: string | null;
     warning: string | null;
 }
 /**
- * Resolve value-free connection diagnostics. This function does not invent a
- * default authority and never reports a local transport as usable.
+ * Resolve value-free connection diagnostics.
+ *
+ * @hasna/contracts 1.0.2 THROWS `ClientTransportConfigurationError` for every
+ * incomplete or invalid configuration — nothing resolves to a local or
+ * partial transport any more. A refusal of that class is reported here as
+ * `unconfigured` (never as a usable transport); the shared resolver's own
+ * hard refusals — a blank declared variable, a conflict, an unreadable
+ * credential file — stay hard errors, exactly as the resolver throws them.
  */
-export declare function resolveContactsClientTransport(name: string, env?: Env): ClientTransportResolution;
+export declare function resolveContactsClientTransport(name: string, env?: Env, credentials?: CredentialChainOptions): ClientTransportResolution;
 export interface StorageClient {
     readonly name: string;
     readonly baseUrl: string;
@@ -55,5 +63,5 @@ export interface ResolveStorageClientResult {
     resolution: ClientTransportResolution;
 }
 /** Build the sole contacts client. Any incomplete configuration is terminal. */
-export declare function resolveContactsStorageClient(name: string, env?: Env): ResolveStorageClientResult;
+export declare function resolveContactsStorageClient(name: string, env?: Env, credentials?: CredentialChainOptions): ResolveStorageClientResult;
 //# sourceMappingURL=http-storage.d.ts.map

package/dist/cloud/http-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-storage.d.ts","sourceRoot":"","sources":["../../src/cloud/http-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAIL,KAAK,yBAAyB,IAAI,+BAA+B,EACjE,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAGjC,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AACrD,YAAY,EAAE,WAAW,EAAE,CAAC;AAE5B,eAAO,MAAM,4BAA4B,iNAS/B,CAAC;AA2BX,qBAAa,gCAAiC,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAInD;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,OAAO,GAAG,cAAc,CAAC;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,+BAA+B,CAAC,YAAY,CAAC,CAAC;IAC1D,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAoBD;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,GAAiB,GAAG,yBAAyB,CAuC9G;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG;QAAE,MAAM,CAAC,EAAE,OAAO,GAAG,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzI,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;CACvG;AAqBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,aAAa,CAgC9F;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,yBAAyB,CAAC;CACvC;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,GAAiB,GAAG,0BAA0B,CA6C7G"}
+{"version":3,"file":"http-storage.d.ts","sourceRoot":"","sources":["../../src/cloud/http-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAML,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAC;AAEhD,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;AAEjC,eAAO,MAAM,4BAA4B,iNAS/B,CAAC;AA2BX,qBAAa,gCAAiC,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAInD;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,OAAO,GAAG,cAAc,CAAC;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,GAAiB,EACtB,WAAW,GAAE,sBAA2B,GACvC,yBAAyB,CA4C3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG;QAAE,MAAM,CAAC,EAAE,OAAO,GAAG,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzI,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;CACvG;AAqBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,aAAa,CAgC9F;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,yBAAyB,CAAC;CACvC;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,GAAiB,EACtB,WAAW,GAAE,sBAA2B,GACvC,0BAA0B,CAkD5B"}

package/dist/cloud/resolver-inputs.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The credential-chain seam between @hasna/contracts 1.0.2 and this package.
+ *
+ * Contacts never builds its own credential or authority chain: the CLI, the
+ * MCP server and the store all funnel through
+ * `resolveContactsClientTransport`, which hands @hasna/contracts the
+ * environment unchanged, per request, fresh. The one thing this module owns
+ * is the ambient gate for the resolver's Keychain tier (#1788).
+ *
+ * The Keychain belongs to the MACHINE, so the resolver consults it only when
+ * it is handed the live process environment (or a snapshot the resolver
+ * itself marked ambient) — a caller-built env object is the hermetic seam and
+ * must never drag a machine identity into a test. A copy made on the way in
+ * silently loses that gate, and the per-request re-resolution in
+ * `resolveContactsStorageClient` does make a copy: a snapshot of the env so a
+ * concurrent mutation cannot tear one resolution. A copy that drops the
+ * Keychain gate would, on a Mac station whose only credential is the Keychain
+ * item, turn every request into a fresh failure — or, with a credential on
+ * disk, into a DIFFERENT principal with no notice.
+ *
+ * So the ambient answer is decided HERE, on the ORIGINAL env, before any copy
+ * exists, and carried across as the documented `keychain.enabled` control.
+ * A caller's explicit `keychain` options always win; the injected `run`
+ * runner (which @hasna/contracts already treats as "enabled") is left alone.
+ */
+import { type CredentialChainOptions } from "@hasna/contracts/client";
+export type Env = Record<string, string | undefined>;
+/**
+ * Is this the environment the machine's ambient credential stores belong to?
+ *
+ * The same test @hasna/contracts performs, run on the env BEFORE any copy
+ * exists — which is the whole point of asking here.
+ */
+export declare function isAmbientContactsEnv(env: Env): boolean;
+/** Every env name the resolver may consult for the contacts authority or
+ * credential — canonical names, the legacy aliases, the deliberate pointers,
+ * and the profile selector. */
+export declare function contactsAuthorityEnvKeys(): string[];
+/**
+ * The credential chain options a contacts surface hands the resolver.
+ *
+ * On the identity path (`env === process.env`, or a snapshot @hasna/contracts
+ * itself marked ambient) this passes through untouched and the resolver runs
+ * its own ambient test. On a CALLER-BUILT env — every hermetic test env, and
+ * the per-request snapshot in `resolveContactsStorageClient` — the Keychain
+ * tier would silently switch off the moment a copy is made; the caller's
+ * explicit controls still win, and otherwise the tier is pinned to what the
+ * ORIGINAL env was: ambient in, enabled; hermetic in, disabled.
+ */
+export declare function contactsResolverCredentials(env: Env, credentials?: CredentialChainOptions): CredentialChainOptions;
+//# sourceMappingURL=resolver-inputs.d.ts.map

package/dist/cloud/resolver-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-inputs.d.ts","sourceRoot":"","sources":["../../src/cloud/resolver-inputs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAKL,KAAK,sBAAsB,EAE5B,MAAM,yBAAyB,CAAC;AAEjC,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAMrD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAGtD;AAED;;+BAE+B;AAC/B,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CASnD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,GAAG,EACR,WAAW,GAAE,sBAA2B,GACvC,sBAAsB,CAMxB"}

package/dist/db/paths.d.ts

@@ -1,4 +1,4 @@
-export type PathKind = "config" | "data" | "state" | "cache";
+export type PathKind = "data" | "state";
 export interface PathsResolverOptions {
     app: string;
     internal?: boolean;
@@ -9,12 +9,12 @@ export interface PathsResolverOptions {
 export declare function dataDir(options: PathsResolverOptions): string;
 export declare function stateDir(options: PathsResolverOptions): string;
 /**
- * The @hasna/paths data root for retained server/legacy utilities. It creates
- * only the requested target directory and never scans or adopts older homes.
+ * The data root for retained server/legacy utilities. It creates only the
+ * requested target directory and never scans or adopts older homes.
  */
 export declare function getDataDir(): string;
 /**
- * The @hasna/paths state root for retained server/legacy utilities.
+ * The state root for retained server/legacy utilities.
  */
 export declare function getStateDir(): string;
 export declare function getDbPath(): string;

package/dist/db/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/db/paths.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAS7D,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AA0DD,wBAAgB,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAE7D;AACD,wBAAgB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAE9D;AAWD;;;GAGG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAKnC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAKpC;AAED,wBAAgB,SAAS,IAAI,MAAM,CAIlC"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/db/paths.ts"],"names":[],"mappings":"AA6BA,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAOxC,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAmDD,wBAAgB,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAE7D;AACD,wBAAgB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAE9D;AAWD;;;GAGG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAKnC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAKpC;AAED,wBAAgB,SAAS,IAAI,MAAM,CAIlC"}

package/dist/generated/storage-kit/backend.d.ts

@@ -0,0 +1,19 @@
+export declare const SERVER_DATA_BACKENDS: readonly ["postgresql"];
+export type ServerDataBackend = (typeof SERVER_DATA_BACKENDS)[number];
+export type Env = Record<string, string | undefined>;
+/** Upper-snake env token for an app name, e.g. `todos` -> `TODOS`. */
+export declare function envToken(name: string): string;
+export interface ServerDataBackendEnvKeys {
+    databaseUrlKeys: string[];
+}
+export declare function serverDataBackendEnvKeys(name: string): ServerDataBackendEnvKeys;
+export interface ServerDataBackendResolution {
+    backend: ServerDataBackend;
+    source: string;
+    databaseUrlPresent: boolean;
+    databaseUrlSource: string;
+}
+export declare function resolveServerDataBackend(name: string, env?: Env): ServerDataBackendResolution;
+/** Resolve the required PostgreSQL URL without logging it. */
+export declare function resolveDatabaseUrl(name: string, env?: Env): string;
+//# sourceMappingURL=backend.d.ts.map

package/dist/generated/storage-kit/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/backend.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,oBAAoB,yBAA0B,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAErD,sEAAsE;AACtE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAK/E;AA8CD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,GAAiB,GACrB,2BAA2B,CAS7B;AAED,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,GAAiB,GAAG,MAAM,CAG/E"}

package/dist/generated/storage-kit/index.d.ts

@@ -1,4 +1,5 @@
-export declare const KIT_VERSION = "0.4.2";
+export declare const KIT_VERSION = "1.0.2";
+export * from "./backend.js";
 export * from "./tls.js";
 export * from "./query.js";
 export * from "./pool.js";

package/dist/generated/storage-kit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/index.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/index.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}

package/dist/generated/storage-kit/migrations.d.ts

@@ -27,11 +27,32 @@ export declare function checksumSql(sql: string): string;
 export declare function defineMigration(id: string, sql: string): Migration;
 export interface MigrationRunnerOptions {
     ledgerTable?: string;
+    /**
+     * Applied-ledger rows whose ids the build ACKNOWLEDGES as non-reproducible
+     * history: a migration that was applied to the ledger by an out-of-band
+     * operation or by a build whose id scheme no longer exists, so no current
+     * source can reproduce its id or its SQL.
+     *
+     * An acknowledged id:
+     *   - passes the downgrade guard (it IS recognized — as history),
+     *   - is never checksum-compared (its SQL is gone, so no checksum can be
+     *     computed for it; storing an arbitrary placeholder in `checksum` is
+     *     what the prod ledger already holds for such rows),
+     *   - is never re-applied and never re-inserted (it is already in the
+     *     ledger; the plan covers declared migrations only).
+     *
+     * The list is EXPLICIT and OPT-IN: an acknowledged id may not also be a
+     * declared migration (enforced at construction), and any OTHER applied row
+     * unknown to the build still fails the downgrade guard. Every declared
+     * migration keeps its checksum bind unchanged.
+     */
+    acknowledgedLegacyIds?: readonly string[];
 }
 export declare class MigrationLedger {
     private readonly client;
     private readonly migrations;
     private readonly ledgerTable;
+    private readonly acknowledgedLegacyIds;
     constructor(client: TypedQueryClient, migrations: readonly Migration[], options?: MigrationRunnerOptions);
     ensureLedger(): Promise<void>;
     listApplied(): Promise<AppliedMigration[]>;

package/dist/generated/storage-kit/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/migrations.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,sBAAsB,CAAC;AAElE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAED,yDAAyD;AACzD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAElE;AAQD,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJ7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAGlB,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,SAAS,SAAS,EAAE,EACjD,OAAO,GAAE,sBAA2B;IAUhC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAU7B,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAKlC,WAAW;IAWzB,oEAAoE;IACpE,OAAO,CAAC,SAAS;IAsBjB,yEAAyE;IACnE,OAAO,CAAC,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,eAAe,CAAC;CAiBzE;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,OAAO,GAAE,sBAA2B,GACnC,eAAe,CAEjB"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/migrations.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAuEnD,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,sBAAsB,CAAC;AAElE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAED,yDAAyD;AACzD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAElE;AAQD,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;;;;;;;OAkBG;IACH,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,qBAAa,eAAe;IAKxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAsB;gBAGzC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,SAAS,SAAS,EAAE,EACjD,OAAO,GAAE,sBAA2B;IA2BhC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAU7B,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAKlC,WAAW;IAWzB,oEAAoE;IACpE,OAAO,CAAC,SAAS;IA0BjB,yEAAyE;IACnE,OAAO,CAAC,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,eAAe,CAAC;CAqBzE;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,OAAO,GAAE,sBAA2B,GACnC,eAAe,CAEjB"}

package/dist/generated/storage-kit/own.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Read `key` from `source` only when `source` OWNS it.
+ *
+ * Returns `undefined` for an inherited property and for a null/undefined or
+ * non-object source, so a guarded read is a drop-in for `source?.[key]` that
+ * cannot be answered by the prototype chain.
+ */
+export declare function ownProp<T>(source: unknown, key: string): T | undefined;
+/** `ownProp` narrowed to a string, so a polluted non-string cannot slip through. */
+export declare function ownString(source: unknown, key: string): string | undefined;
+//# sourceMappingURL=own.d.ts.map