@hasna/domains 0.0.46 → 0.0.47

package/dist/cli/index.js

@@ -2084,6 +2084,7 @@ var require_commander = __commonJS((exports) => {
 // ../contracts/dist/client/storage.js
 import { isIP } from "net";
 import { readFileSync, statSync } from "fs";
+import { createRequire } from "module";
 import { join } from "path";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
@@ -2098,24 +2099,48 @@ function clientTransportEnvKeys(name) {
 function credentialOverrideEnvKey(name) {
   return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
 }
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
 function homeDir(env) {
   const home = env.HOME?.trim();
   return home ? home : null;
 }
-function credentialDiskSources(name, env) {
-  return profileDiskSources(name, env, null);
-}
-function profileDiskSources(name, env, profile) {
+function credentialDiskSourceList(name, env, profile = null) {
   const home = homeDir(env);
   if (!home || !SAFE_APP_SLUG.test(name))
     return [];
   const stem = profile ? `${name}.${profile}` : name;
   const configStem = profile ? `${name}-${profile}` : name;
   return [
-    join(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
-    join(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`)
+    {
+      path: join(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
+      tier: "fleet-env",
+      deprecated: false
+    },
+    {
+      path: join(home, HASNA_STATE_DIR, LEGACY_CLOUD_DIR, `${stem}.env`),
+      tier: "legacy-cloud",
+      deprecated: true
+    },
+    {
+      path: join(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}.env`),
+      tier: "config",
+      deprecated: false
+    },
+    {
+      path: join(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`),
+      tier: "config-legacy",
+      deprecated: true
+    }
   ];
 }
+function credentialDiskSources(name, env) {
+  return credentialDiskSourceList(name, env, null).map((s) => s.path);
+}
+function profileDiskSources(name, env, profile) {
+  return credentialDiskSourceList(name, env, profile).map((s) => s.path);
+}
 function parseEnvFile(text) {
   const values = new Map;
   for (const rawLine of text.split(/\r?\n/)) {
@@ -2182,6 +2207,9 @@ function appConfigDiskValue(name, env, keys) {
   return null;
 }
 function assertUsableCredential(appName, source, value) {
+  if (VAULT_POINTER_SHAPE.test(value)) {
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
   if (!ILLEGAL_IN_HEADER_VALUE.test(value))
     return;
   throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
@@ -2203,6 +2231,14 @@ function sealCredential(fields) {
     writable: false,
     configurable: false
   });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
   Object.defineProperty(sealed, INSPECT_CUSTOM, {
     value: () => ({ ...visible, apiKey: "[redacted]" }),
     enumerable: false,
@@ -2254,7 +2290,8 @@ function validateAndSealResolvedCredential(appName, credential) {
     deliberate: credential.deliberate,
     deprecated: credential.deprecated,
     diskCandidates: credential.diskCandidates,
-    warning: credential.warning
+    warning: credential.warning,
+    ...credential.pointerVaultKey !== undefined ? { pointerVaultKey: credential.pointerVaultKey } : {}
   });
 }
 function firstEnvValue(env, keys) {
@@ -2314,6 +2351,27 @@ function resolveCredential(name, env, options = {}) {
       warning: null
     });
   }
+  const pointerKeyName = credentialPointerEnvKey(name);
+  const pointerRaw = env[pointerKeyName];
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE.test(pointer)) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
   const profile = options.profile?.trim() || env[CREDENTIAL_PROFILE_ENV_KEY]?.trim();
   if (profile) {
     const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
@@ -2338,26 +2396,42 @@ function resolveCredential(name, env, options = {}) {
     }
     throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
   }
-  const diskHits = diskPaths.map((path) => ({ path, value: readCredentialFile(path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  const diskSourceList = credentialDiskSourceList(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
   if (diskHits.length > 0) {
     const winner = diskHits[0];
-    assertUsableCredential(name, winner.path, winner.value);
+    assertUsableCredential(name, winner.src.path, winner.value);
     const divergentSources = [
-      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.path),
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
       ...(() => {
         const legacyHit = firstEnvValue(env, apiKeyKeys);
         return legacyHit && legacyHit.value !== winner.value ? [legacyHit.key] : [];
       })()
     ];
-    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    let deprecated = winner.src.deprecated;
+    let finalWarning = warning;
+    if (winner.src.deprecated) {
+      deprecated = true;
+      const sink = options.onDeprecation ?? defaultDeprecationSink;
+      const notified = deprecationNotified();
+      const noticeKey = `${name}:${winner.src.path}`;
+      if (!notified.has(noticeKey)) {
+        notified.add(noticeKey);
+        const target = diskSourceList[0]?.path ?? "<none>";
+        const message = `[${name}] DEPRECATED: the API key came from ${winner.src.path} \u2014 a legacy credential location. ` + `The primary location is ${target} (~/.hasna/fleet-env/<app>.env). The legacy 'cloud' tiers are ` + `removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}. Migrate the key to the primary location.`;
+        sink(message);
+      }
+      finalWarning = [warning, `Legacy credential source: ${winner.src.path}. Removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}.`].filter(Boolean).join(" ") || null;
+    }
     return sealCredential({
       apiKey: winner.value,
-      tier: "disk",
-      source: winner.path,
+      tier: winner.src.tier,
+      source: winner.src.path,
       deliberate: false,
-      deprecated: false,
+      deprecated,
       diskCandidates: diskPaths,
-      warning
+      warning: finalWarning
     });
   }
   const legacy = firstEnvValue(env, apiKeyKeys);
@@ -2383,6 +2457,45 @@ function resolveCredential(name, env, options = {}) {
   }
   return null;
 }
+async function completePointerCredential(name, pointerResolution, env = process.env) {
+  const vaultKey = pointerResolution.pointerVaultKey;
+  const pointerEnvKey = pointerResolution.source;
+  if (!vaultKey) {
+    throw new CredentialResolutionError(name, `Pointer resolution from ${pointerEnvKey} carries no vault item key; this is a defect in the resolver.`, [pointerEnvKey]);
+  }
+  let secretsSdk;
+  try {
+    secretsSdk = requireSecretsSdk(SECRETS_PACKAGE_SPECIFIER);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
+  }
+  let client;
+  try {
+    client = secretsSdk.createSecretsClientFromEnv(env);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets client could not be configured from this ` + `environment (the secrets service URL and key env are missing or invalid). A vault pointer is TERMINAL and ` + `never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  let secret;
+  try {
+    secret = await client.getSecret({ key: vaultKey });
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the vault could not be reached or the item is ` + `unavailable. A vault pointer is TERMINAL and never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  const value = secret.value;
+  if (!value) {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} resolved vault item '${vaultKey}', but it holds no value. A vault pointer is TERMINAL.`, [pointerEnvKey]);
+  }
+  assertUsableCredential(name, `${pointerEnvKey} -> vault:${vaultKey}`, value);
+  return sealCredential({
+    apiKey: value,
+    tier: "pointer",
+    source: `${pointerEnvKey} -> vault:${vaultKey}`,
+    deliberate: true,
+    deprecated: false,
+    diskCandidates: pointerResolution.diskCandidates,
+    warning: null
+  });
+}
 function isValidDnsDomain(value) {
   if (value.length === 0 || value.length > 253 || ASCII_CONTROL_PATTERN.test(value) || /[^\x00-\x7f]/.test(value)) {
     return false;
@@ -2606,6 +2719,13 @@ function currentCredential(name, apiKey) {
   }
   return explicitCredential(name, apiKey);
 }
+async function resolveRequestCredential(name, apiKey, env = process.env) {
+  const resolved = currentCredential(name, apiKey);
+  if (resolved.tier === "pointer") {
+    return completePointerCredential(name, resolved, env);
+  }
+  return resolved;
+}
 function authFailureGuidance(credential) {
   const origin = `The API key for this request came from ${credential.source}`;
   if (credential.deliberate) {
@@ -2751,7 +2871,7 @@ function createHasnaHttpTransport(options) {
     const retry = resolveRetry(opts.retry);
     const methodRetryable = IDEMPOTENT_METHODS.has(upper) || Boolean(opts.idempotencyKey);
     const maxAttempts = retry && methodRetryable ? retry.retries + 1 : 1;
-    const credential = currentCredential(options.name, options.apiKey);
+    const credential = await resolveRequestCredential(options.name, options.apiKey);
     let last = null;
     for (let attempt = 1;attempt <= maxAttempts; attempt++) {
       const result = await once(upper, rel, url, body, opts, credential);
@@ -2914,7 +3034,7 @@ function resolveStorageClient(name, env = process.env, overrides) {
   }
   return { transport: "sqlite", client: null };
 }
-var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, HASNA_STATE_DIR = ".hasna", FLEET_CREDENTIAL_DIR = "cloud", CONFIG_DIR = ".config", CONFIG_NAMESPACE = "hasna", MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM, CREDENTIAL_SEAL, CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE = "caller-supplied CredentialProvider", DEPRECATION_REGISTRY, ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, HasnaHttpError, DEFAULT_RETRY_STATUSES, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS, defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, HASNA_STATE_DIR = ".hasna", FLEET_CREDENTIAL_DIR = "fleet-env", LEGACY_CLOUD_DIR = "cloud", CONFIG_DIR = ".config", CONFIG_NAMESPACE = "hasna", LEGACY_CLOUD_REMOVAL_DEADLINE = "2026-10-01", MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM, CREDENTIAL_SEAL, CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE = "caller-supplied CredentialProvider", DEPRECATION_REGISTRY, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk, ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, HasnaHttpError, DEFAULT_RETRY_STATUSES, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS, defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var init_storage = __esm(() => {
   CredentialResolutionError = class CredentialResolutionError extends Error {
     appName;
@@ -2930,10 +3050,13 @@ var init_storage = __esm(() => {
   SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
   SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
   ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+  VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
   CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
   INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
   CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
   DEPRECATION_REGISTRY = Symbol.for("hasna:contracts:credentialDeprecationNotices");
+  SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+  requireSecretsSdk = createRequire(import.meta.url);
   ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
   DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
   HasnaHttpError = class HasnaHttpError extends Error {
@@ -2967,6 +3090,7 @@ var init_storage = __esm(() => {
 });
 
 // ../contracts/dist/client/transport.js
+import { createRequire as createRequire2 } from "module";
 function envToken2(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
@@ -2977,12 +3101,14 @@ function clientTransportEnvKeys2(name) {
     apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
   };
 }
-var MAX_CREDENTIAL_FILE_BYTES2, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, DEPRECATION_REGISTRY2, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2;
+var MAX_CREDENTIAL_FILE_BYTES2, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, DEPRECATION_REGISTRY2, SECRETS_PACKAGE_SPECIFIER2, requireSecretsSdk2, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2;
 var init_transport = __esm(() => {
   MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
   INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
   CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
   DEPRECATION_REGISTRY2 = Symbol.for("hasna:contracts:credentialDeprecationNotices");
+  SECRETS_PACKAGE_SPECIFIER2 = "@hasna/" + "secrets";
+  requireSecretsSdk2 = createRequire2(import.meta.url);
   IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
   AUTHORITY_OVERRIDE_HEADERS2 = new Set([
     "host",
@@ -3263,22 +3389,132 @@ var init_migrations = __esm(() => {
   ];
 });
 
+// ../../node_modules/.bun/@hasna+paths@0.1.0/node_modules/@hasna/paths/dist/index.js
+import { homedir } from "os";
+import { join as join2 } from "path";
+function assertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function envOf(options) {
+  return options.env ?? process.env;
+}
+function envValue(options, kind) {
+  const value = envOf(options)[KIND_ENV[kind]];
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function isMacOS(platform) {
+  return platform === "darwin";
+}
+function baseDir(kind, options) {
+  const override = envValue(options, kind);
+  if (override)
+    return override;
+  const home = options.home ?? homedir();
+  const platform = options.platform ?? process.platform;
+  if (isMacOS(platform)) {
+    switch (kind) {
+      case "config":
+      case "data":
+        return join2(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return join2(home, "Library", "Caches", "Hasna");
+      case "state":
+        return join2(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return join2(home, ".config", "hasna");
+    case "data":
+      return join2(home, ".local", "share", "hasna");
+    case "state":
+      return join2(home, ".local", "state", "hasna");
+    case "cache":
+      return join2(home, ".cache", "hasna");
+  }
+}
+function resolvePath(kind, options) {
+  assertApp(options.app);
+  const appSegment = options.internal === true ? join2("internal", options.app) : options.app;
+  return join2(baseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return resolvePath("data", options);
+}
+var KIND_ENV, APP_SLUG_RE;
+var init_dist = __esm(() => {
+  KIND_ENV = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+});
+
+// src/lib/app-home.ts
+import { existsSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3, resolve } from "path";
+function effectiveHome(env = process.env) {
+  return env["HOME"] || env["USERPROFILE"] || homedir2();
+}
+function legacyHomeDir(env = process.env) {
+  return join3(effectiveHome(env), ".hasna", APP);
+}
+function resolverHome(env = process.env) {
+  const home = env["HOME"] || env["USERPROFILE"];
+  return dataDir({ app: APP, home, env });
+}
+function adoptResolverHome(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync(join3(resolved, "domains.db"));
+}
+function exactAppOverride(env = process.env) {
+  const override = env["HASNA_DOMAINS_HOME"] ?? env["DOMAINS_HOME"] ?? env["HASNA_DOMAINS_DIR"] ?? env["DOMAINS_DIR"];
+  return override && override.trim() ? override.trim() : undefined;
+}
+function appHome(env = process.env) {
+  const override = exactAppOverride(env);
+  if (override)
+    return resolve(override);
+  const resolved = resolverHome(env);
+  return adoptResolverHome(resolved, env) ? resolve(resolved) : resolve(legacyHomeDir(env));
+}
+function getDefaultDbPath(env = process.env) {
+  return join3(appHome(env), `${APP}.db`);
+}
+function getDefaultConfigPath(env = process.env) {
+  return join3(appHome(env), "config.json");
+}
+var APP = "domains";
+var init_app_home = __esm(() => {
+  init_dist();
+});
+
 // src/db/database.ts
 import { Database } from "bun:sqlite";
 import { createHash } from "crypto";
 import {
   copyFileSync,
-  existsSync,
+  existsSync as existsSync2,
   mkdirSync,
   readFileSync as readFileSync2,
   readdirSync,
   statSync as statSync2,
   writeFileSync
 } from "fs";
-import { dirname, join as join2, resolve } from "path";
-import { homedir } from "os";
+import { dirname, join as join4, resolve as resolve2 } from "path";
+import { homedir as homedir3 } from "os";
 function canonicalHome(env) {
-  return env["HOME"] || env["USERPROFILE"] || homedir();
+  return env["HOME"] || env["USERPROFILE"] || homedir3();
 }
 function sha256File(path) {
   return createHash("sha256").update(readFileSync2(path)).digest("hex");
@@ -3286,20 +3522,20 @@ function sha256File(path) {
 function migrateLegacyDataDir(env = process.env, dryRun = false) {
   const report = { dryRun, wouldCopy: [], copied: [] };
   const home = canonicalHome(env);
-  const xdgData = env["XDG_DATA_HOME"]?.trim() || join2(home, ".local", "share");
-  const oldDir = join2(xdgData, "open-domains");
-  const oldDb = join2(oldDir, "domains.db");
-  if (!existsSync(oldDb))
+  const xdgData = env["XDG_DATA_HOME"]?.trim() || join4(home, ".local", "share");
+  const oldDir = join4(xdgData, "open-domains");
+  const oldDb = join4(oldDir, "domains.db");
+  if (!existsSync2(oldDb))
     return report;
-  const canonicalDir = join2(home, ".hasna", "domains");
-  const newDb = join2(canonicalDir, "domains.db");
-  if (existsSync(newDb))
+  const canonicalDir = join4(home, ".hasna", "domains");
+  const newDb = join4(canonicalDir, "domains.db");
+  if (existsSync2(newDb))
     return report;
-  if (existsSync(join2(canonicalDir, ".migrated-from-xdg.receipt.json")))
+  if (existsSync2(join4(canonicalDir, ".migrated-from-xdg.receipt.json")))
     return report;
   if (dryRun) {
     for (const name of ["domains.db", "domains.db-wal", "domains.db-shm"]) {
-      if (existsSync(join2(oldDir, name)) && !existsSync(join2(canonicalDir, name))) {
+      if (existsSync2(join4(oldDir, name)) && !existsSync2(join4(canonicalDir, name))) {
         report.wouldCopy.push(name);
       }
     }
@@ -3308,11 +3544,11 @@ function migrateLegacyDataDir(env = process.env, dryRun = false) {
   mkdirSync(canonicalDir, { recursive: true });
   const copied = [];
   for (const name of ["domains.db", "domains.db-wal", "domains.db-shm"]) {
-    const from = join2(oldDir, name);
-    if (!existsSync(from))
+    const from = join4(oldDir, name);
+    if (!existsSync2(from))
       continue;
-    const to = join2(canonicalDir, name);
-    if (existsSync(to))
+    const to = join4(canonicalDir, name);
+    if (existsSync2(to))
       continue;
     copyFileSync(from, to);
     copied.push({ name, bytes: statSync2(to).size, sha256: sha256File(to) });
@@ -3321,7 +3557,7 @@ function migrateLegacyDataDir(env = process.env, dryRun = false) {
   if (statSync2(newDb).size !== statSync2(oldDb).size || sha256File(newDb) !== sha256File(oldDb)) {
     throw new Error(`Refusing migration: copied ${newDb} does not byte-match ${oldDb}; the canonical root was not populated.`);
   }
-  writeFileSync(join2(canonicalDir, ".migrated-from-xdg.receipt.json"), `${JSON.stringify({
+  writeFileSync(join4(canonicalDir, ".migrated-from-xdg.receipt.json"), `${JSON.stringify({
     migratedAt: new Date().toISOString(),
     from: oldDir,
     to: canonicalDir,
@@ -3335,26 +3571,26 @@ function getDbPath(env = process.env) {
     return env["DOMAINS_DB_PATH"];
   if (env["HASNA_DOMAINS_DB_PATH"])
     return env["HASNA_DOMAINS_DB_PATH"];
-  const explicit = env["DOMAINS_DIR"] ?? env["HASNA_DOMAINS_DIR"];
+  const explicit = exactAppOverride(env);
   if (explicit) {
-    return join2(explicit, "domains.db");
+    return join4(explicit, "domains.db");
   }
-  const home = canonicalHome(env);
-  const canonicalDir = join2(home, ".hasna", "domains");
-  migrateLegacyDataDir(env);
-  migrateDotfile("domains", canonicalDir, env);
-  return join2(canonicalDir, "domains.db");
+  if (!adoptResolverHome(resolverHome(env), env)) {
+    migrateLegacyDataDir(env);
+    migrateDotfile("domains", legacyHomeDir(env), env);
+  }
+  return getDefaultDbPath(env);
 }
 function migrateDotfile(name, newDir, env) {
   const home = canonicalHome(env);
-  const oldDir = join2(home, `.${name}`);
-  if (!existsSync(oldDir) || existsSync(newDir))
+  const oldDir = join4(home, `.${name}`);
+  if (!existsSync2(oldDir) || existsSync2(newDir))
     return;
   mkdirSync(newDir, { recursive: true });
   for (const file of readdirSync(oldDir)) {
-    const oldPath = join2(oldDir, file);
+    const oldPath = join4(oldDir, file);
     if (statSync2(oldPath).isFile())
-      copyFileSync(oldPath, join2(newDir, file));
+      copyFileSync(oldPath, join4(newDir, file));
   }
 }
 function getDatabase() {
@@ -3362,7 +3598,7 @@ function getDatabase() {
     return _db;
   const dbPath = getDbPath();
   if (dbPath !== ":memory:") {
-    const dir = dirname(resolve(dbPath));
+    const dir = dirname(resolve2(dbPath));
     mkdirSync(dir, { recursive: true });
   }
   _db = new Database(dbPath);
@@ -3395,6 +3631,7 @@ function getDatabase() {
 var _db = null;
 var init_database = __esm(() => {
   init_migrations();
+  init_app_home();
 });
 
 // src/db/domain-records.ts
@@ -4898,7 +5135,7 @@ function assertNoStoreConflict(env) {
   throw new Error(`Refusing to resolve the hosted domains store while ${pathVar} is set: that variable ` + `names a local sqlite file, so the configuration asks for BOTH stores at once and ` + `nothing here can tell which you meant. Writing to the wrong one is silent \u2014 a plain ` + `\`bun run\` script that set ${pathVar} put 230 rows into the production portfolio on ` + `2026-08-07 while reporting success. Pick one: unset HASNA_DOMAINS_API_URL and ` + `HASNA_DOMAINS_API_KEY to use ${pathVar}; unset ${pathVar} to use the hosted store; or set ` + `${ALLOW_CLOUD_WITH_LOCAL_PATH}=1 if you really intend the hosted store with that variable present.`);
 }
 function requireHostedClient(env, flip) {
-  const resolved = resolveStorageClient(APP, withoutRetiredModeKeys(env));
+  const resolved = resolveStorageClient(APP2, withoutRetiredModeKeys(env));
   if (resolved.transport !== "http") {
     throw new Error(`Hosted domains client was requested (${flip.urlSource} + ${flip.keySource}) but ` + `@hasna/contracts resolved transport '${resolved.transport}'. Refusing to read the wrong dataset.`);
   }
@@ -4923,7 +5160,7 @@ function isCloudStore(env = process.env) {
   requireHostedClient(env, flip);
   return true;
 }
-var APP = "domains", DOMAINS_PAGE_SIZE = 1000, RETIRED_MODE_KEYS, ALLOW_CLOUD_IN_TESTS = "HASNA_DOMAINS_ALLOW_CLOUD_IN_TESTS", ALLOW_CLOUD_WITH_LOCAL_PATH = "HASNA_DOMAINS_ALLOW_CLOUD_WITH_LOCAL_PATH", LOCAL_PATH_VARS, warnedCloudDowngrade = false;
+var APP2 = "domains", DOMAINS_PAGE_SIZE = 1000, RETIRED_MODE_KEYS, ALLOW_CLOUD_IN_TESTS = "HASNA_DOMAINS_ALLOW_CLOUD_IN_TESTS", ALLOW_CLOUD_WITH_LOCAL_PATH = "HASNA_DOMAINS_ALLOW_CLOUD_WITH_LOCAL_PATH", LOCAL_PATH_VARS, warnedCloudDowngrade = false;
 var init_store = __esm(() => {
   init_storage();
   init_transport();
@@ -4949,14 +5186,14 @@ var init_store = __esm(() => {
 
 // src/lib/version.ts
 import { readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2, resolve as resolve2 } from "path";
+import { dirname as dirname2, resolve as resolve3 } from "path";
 import { fileURLToPath } from "url";
 function getPackageVersion() {
   if (cachedVersion)
     return cachedVersion;
   try {
     const moduleDir = dirname2(fileURLToPath(import.meta.url));
-    const packageJsonPath = resolve2(moduleDir, "../../package.json");
+    const packageJsonPath = resolve3(moduleDir, "../../package.json");
     const pkg = JSON.parse(readFileSync3(packageJsonPath, "utf8"));
     cachedVersion = pkg.version ?? "0.0.0";
   } catch {
@@ -7188,7 +7425,7 @@ var require_client = __commonJS((exports) => {
     };
   };
   var sleep = (seconds) => {
-    return new Promise((resolve3) => setTimeout(resolve3, seconds * 1000));
+    return new Promise((resolve4) => setTimeout(resolve4, seconds * 1000));
   };
   var waiterServiceDefaults = {
     minDelay: 2,
@@ -7317,8 +7554,8 @@ var require_client = __commonJS((exports) => {
   };
   var abortTimeout = (abortSignal) => {
     let onAbort;
-    const promise = new Promise((resolve3) => {
-      onAbort = () => resolve3({ state: WaiterState.ABORTED });
+    const promise = new Promise((resolve4) => {
+      onAbort = () => resolve4({ state: WaiterState.ABORTED });
       if (typeof abortSignal.addEventListener === "function") {
         abortSignal.addEventListener("abort", onAbort);
       } else {
@@ -7971,8 +8208,8 @@ var require_client = __commonJS((exports) => {
 
 // ../../node_modules/.bun/@smithy+core@3.33.2/node_modules/@smithy/core/dist-cjs/submodules/config/index.js
 var require_config = __commonJS((exports) => {
-  var { homedir: homedir2 } = __require("os");
-  var { sep, join: join3 } = __require("path");
+  var { homedir: homedir4 } = __require("os");
+  var { sep, join: join5 } = __require("path");
   var { createHash: createHash2 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
@@ -8121,7 +8358,7 @@ var require_config = __commonJS((exports) => {
       return `${HOMEDRIVE}${HOMEPATH}`;
     const homeDirCacheKey = getHomeDirCacheKey();
     if (!homeDirCache[homeDirCacheKey])
-      homeDirCache[homeDirCacheKey] = homedir2();
+      homeDirCache[homeDirCacheKey] = homedir4();
     return homeDirCache[homeDirCacheKey];
   };
   var ENV_PROFILE = "AWS_PROFILE";
@@ -8130,7 +8367,7 @@ var require_config = __commonJS((exports) => {
   var getSSOTokenFilepath = (id) => {
     const hasher = createHash2("sha1");
     const cacheName = hasher.update(id).digest("hex");
-    return join3(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
+    return join5(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
   };
   var tokenIntercept = {};
   var getSSOTokenFromFile = async (id) => {
@@ -8157,9 +8394,9 @@ var require_config = __commonJS((exports) => {
     ...data.default && { default: data.default }
   });
   var ENV_CONFIG_PATH = "AWS_CONFIG_FILE";
-  var getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || join3(getHomeDir(), ".aws", "config");
+  var getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || join5(getHomeDir(), ".aws", "config");
   var ENV_CREDENTIALS_PATH = "AWS_SHARED_CREDENTIALS_FILE";
-  var getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || join3(getHomeDir(), ".aws", "credentials");
+  var getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || join5(getHomeDir(), ".aws", "credentials");
   var prefixKeyRegex = /^([\w-]+)\s(["'])?([\w-@+.%:/]+)\2$/;
   var profileNameBlockList = ["__proto__", "profile __proto__"];
   var parseIni = (iniData) => {
@@ -8225,11 +8462,11 @@ var require_config = __commonJS((exports) => {
     const relativeHomeDirPrefix = "~/";
     let resolvedFilepath = filepath;
     if (filepath.startsWith(relativeHomeDirPrefix)) {
-      resolvedFilepath = join3(homeDir2, filepath.slice(2));
+      resolvedFilepath = join5(homeDir2, filepath.slice(2));
     }
     let resolvedConfigFilepath = configFilepath;
     if (configFilepath.startsWith(relativeHomeDirPrefix)) {
-      resolvedConfigFilepath = join3(homeDir2, configFilepath.slice(2));
+      resolvedConfigFilepath = join5(homeDir2, configFilepath.slice(2));
     }
     const parsedFiles = await Promise.all([
       readFile(resolvedConfigFilepath, {
@@ -8446,7 +8683,7 @@ var require_config = __commonJS((exports) => {
   };
   var imdsRequest = async (options) => {
     const { request } = __require("http");
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const req = request({
         hostname: options.hostname,
         port: options.port,
@@ -8474,7 +8711,7 @@ var require_config = __commonJS((exports) => {
         const chunks = [];
         res.on("data", (chunk) => chunks.push(chunk));
         res.on("end", () => {
-          resolve3(Buffer.concat(chunks));
+          resolve4(Buffer.concat(chunks));
           req.destroy();
         });
       });
@@ -10825,7 +11062,7 @@ ${value}\r
     if (isReadableStream(stream)) {
       return headStream$1(stream, bytes);
     }
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const collector = new Collector$1;
       collector.limit = bytes;
       stream.pipe(collector);
@@ -10836,7 +11073,7 @@ ${value}\r
       collector.on("error", reject);
       collector.on("finish", function() {
         const bytes2 = concatBytes(this.buffers);
-        resolve3(bytes2);
+        resolve4(bytes2);
       });
     });
   };
@@ -10950,7 +11187,7 @@ ${value}\r
     if (isReadableStream(stream)) {
       return collectReadableStream(stream);
     }
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const collector = new Collector;
       const nodeStream = stream;
       nodeStream.pipe(collector);
@@ -10961,7 +11198,7 @@ ${value}\r
       collector.on("error", reject);
       collector.on("finish", function() {
         const bytes = concatBytes(this.bufferedBytes);
-        resolve3(bytes);
+        resolve4(bytes);
       });
     });
   };
@@ -11153,7 +11390,7 @@ var require_checksum = __commonJS((exports) => {
       callback();
     }
   }
-  var fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve3, reject) => {
+  var fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve4, reject) => {
     if (!isReadStream(fileStream)) {
       reject(new Error("Unable to calculate hash for non-file streams."));
       return;
@@ -11171,7 +11408,7 @@ var require_checksum = __commonJS((exports) => {
     });
     hashCalculator.on("error", reject);
     hashCalculator.on("finish", function() {
-      hash.digest().then(resolve3).catch(reject);
+      hash.digest().then(resolve4).catch(reject);
     });
   });
   var isReadStream = (stream) => typeof stream.path === "string";
@@ -11182,14 +11419,14 @@ var require_checksum = __commonJS((exports) => {
     const hash = new hashCtor;
     const hashCalculator = new HashCalculator(hash);
     readableStream.pipe(hashCalculator);
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       readableStream.on("error", (err) => {
         hashCalculator.end();
         reject(err);
       });
       hashCalculator.on("error", reject);
       hashCalculator.on("finish", () => {
-        hash.digest().then(resolve3).catch(reject);
+        hash.digest().then(resolve4).catch(reject);
       });
     });
   };
@@ -12295,7 +12532,7 @@ var require_event_streams = __commonJS((exports) => {
       streamEnded = true;
     });
     while (!generationEnded) {
-      const value = await new Promise((resolve3) => setTimeout(() => resolve3(records.shift()), 0));
+      const value = await new Promise((resolve4) => setTimeout(() => resolve4(records.shift()), 0));
       if (value) {
         yield value;
       }
@@ -13175,8 +13412,8 @@ var require_protocols = __commonJS((exports) => {
     async build() {
       const { hostname, protocol = "https", port, path: basePath } = await this.context.endpoint();
       this.path = basePath;
-      for (const resolvePath of this.resolvePathStack) {
-        resolvePath(this.path);
+      for (const resolvePath2 of this.resolvePathStack) {
+        resolvePath2(this.path);
       }
       return new HttpRequest({
         protocol,
@@ -13790,7 +14027,7 @@ var require_retry = __commonJS((exports) => {
       }
     };
   }
-  var cooldown = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
+  var cooldown = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
   var isRetryStrategyV2 = (retryStrategy) => typeof retryStrategy.acquireInitialRetryToken !== "undefined" && typeof retryStrategy.refreshRetryTokenForRetry !== "undefined" && typeof retryStrategy.recordSuccess !== "undefined";
   var getRetryErrorInfo = (error, logger) => {
     const errorInfo = {
@@ -13889,7 +14126,7 @@ var require_retry = __commonJS((exports) => {
       this.refillTokenBucket();
       while (amount > this.availableTokens) {
         const delay = (amount - this.availableTokens) / this.fillRate * 1000;
-        await new Promise((resolve3) => DefaultRateLimiter.setTimeoutFn(resolve3, delay));
+        await new Promise((resolve4) => DefaultRateLimiter.setTimeoutFn(resolve4, delay));
         this.refillTokenBucket();
       }
       this.availableTokens = this.availableTokens - amount;
@@ -14231,7 +14468,7 @@ var require_retry = __commonJS((exports) => {
             const delayFromResponse = getDelayFromRetryAfterHeader(err.$response);
             const delay = Math.max(delayFromResponse || 0, delayFromDecider);
             totalDelay += delay;
-            await new Promise((resolve3) => setTimeout(resolve3, delay));
+            await new Promise((resolve4) => setTimeout(resolve4, delay));
             continue;
           }
           if (!err.$metadata) {
@@ -17706,7 +17943,7 @@ var init_node_http = () => {};
 
 // ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/httpRequest.js
 function httpRequest(options) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const req = node_http.request({
       method: "GET",
       ...options,
@@ -17731,7 +17968,7 @@ function httpRequest(options) {
         chunks.push(chunk);
       });
       res.on("end", () => {
-        resolve3(Buffer.concat(chunks));
+        resolve4(Buffer.concat(chunks));
         req.destroy();
       });
     });
@@ -17955,9 +18192,9 @@ var import_config6, IMDS_PATH = "/latest/meta-data/iam/security-credentials/", I
       let fallbackBlockedFromProcessEnv = false;
       const configValue = await import_config6.loadConfig({
         environmentVariableSelector: (env) => {
-          const envValue = env[AWS_EC2_METADATA_V1_DISABLED];
-          fallbackBlockedFromProcessEnv = !!envValue && envValue !== "false";
-          if (envValue === undefined) {
+          const envValue2 = env[AWS_EC2_METADATA_V1_DISABLED];
+          fallbackBlockedFromProcessEnv = !!envValue2 && envValue2 !== "false";
+          if (envValue2 === undefined) {
             throw new import_config6.CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`, { logger: init.logger });
           }
           return fallbackBlockedFromProcessEnv;
@@ -18225,21 +18462,21 @@ var require_dist_cjs4 = __commonJS((exports) => {
     let sendBody = true;
     if (!externalAgent && expect === "100-continue") {
       sendBody = await Promise.race([
-        new Promise((resolve3) => {
-          timeoutId = Number(timing.setTimeout(() => resolve3(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
+        new Promise((resolve4) => {
+          timeoutId = Number(timing.setTimeout(() => resolve4(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
         }),
-        new Promise((resolve3) => {
+        new Promise((resolve4) => {
           httpRequest2.on("continue", () => {
             timing.clearTimeout(timeoutId);
-            resolve3(true);
+            resolve4(true);
           });
           httpRequest2.on("response", () => {
             timing.clearTimeout(timeoutId);
-            resolve3(false);
+            resolve4(false);
           });
           httpRequest2.on("error", () => {
             timing.clearTimeout(timeoutId);
-            resolve3(false);
+            resolve4(false);
           });
         })
       ]);
@@ -18314,13 +18551,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return socketWarningTimestamp;
     }
     constructor(options) {
-      this.configProvider = new Promise((resolve3, reject) => {
+      this.configProvider = new Promise((resolve4, reject) => {
         if (typeof options === "function") {
           options().then((_options) => {
-            resolve3(this.resolveDefaultConfig(_options));
+            resolve4(this.resolveDefaultConfig(_options));
           }).catch(reject);
         } else {
-          resolve3(this.resolveDefaultConfig(options));
+          resolve4(this.resolveDefaultConfig(options));
         }
       });
     }
@@ -18352,7 +18589,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
           timing.clearTimeout(socketTimeoutId);
           timing.clearTimeout(keepAliveTimeoutId);
         };
-        const resolve3 = async (arg) => {
+        const resolve4 = async (arg) => {
           await writeRequestBodyPromise;
           clearTimeouts();
           _resolve(arg);
@@ -18416,7 +18653,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             headers: getTransformedHeaders(res.headers),
             body: res
           });
-          resolve3({ response: httpResponse });
+          resolve4({ response: httpResponse });
         });
         req.on("error", (err) => {
           if (NODEJS_TIMEOUT_ERROR_CODES.includes(err.code)) {
@@ -18748,13 +18985,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return new NodeHttp2Handler(instanceOrOptions);
     }
     constructor(options) {
-      this.configProvider = new Promise((resolve3, reject) => {
+      this.configProvider = new Promise((resolve4, reject) => {
         if (typeof options === "function") {
           options().then((opts) => {
-            resolve3(opts || {});
+            resolve4(opts || {});
           }).catch(reject);
         } else {
-          resolve3(options || {});
+          resolve4(options || {});
         }
       });
     }
@@ -18779,7 +19016,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return new Promise((_resolve, _reject) => {
         let fulfilled = false;
         let writeRequestBodyPromise = undefined;
-        const resolve3 = async (arg) => {
+        const resolve4 = async (arg) => {
           await writeRequestBodyPromise;
           _resolve(arg);
         };
@@ -18864,7 +19101,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             body: clientHttp2Stream
           });
           fulfilled = true;
-          resolve3({ response: httpResponse });
+          resolve4({ response: httpResponse });
           if (useIsolatedSession) {
             session.close();
           }
@@ -18990,7 +19227,7 @@ var retryWrapper = (toRetry, maxRetries, delayMs) => {
       try {
         return await toRetry();
       } catch (e) {
-        await new Promise((resolve3) => setTimeout(resolve3, delayMs));
+        await new Promise((resolve4) => setTimeout(resolve4, delayMs));
       }
     }
     return await toRetry();
@@ -28282,8 +28519,8 @@ var require_signin = __commonJS((exports) => {
 // ../../node_modules/.bun/@aws-sdk+credential-provider-login@3.972.76/node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js
 import { createHash as createHash2, createPrivateKey, createPublicKey, sign } from "crypto";
 import { promises as fs2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join3 } from "path";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname3, join as join5 } from "path";
 var import_config20, import_protocols3, LoginCredentialsFetcher;
 var init_LoginCredentialsFetcher = __esm(() => {
   import_config20 = __toESM(require_config(), 1);
@@ -28450,10 +28687,10 @@ var init_LoginCredentialsFetcher = __esm(() => {
       await fs2.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
     }
     getTokenFilePath() {
-      const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join3(homedir2(), ".aws", "login", "cache");
+      const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join5(homedir4(), ".aws", "login", "cache");
       const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
       const loginSessionSha256 = createHash2("sha256").update(loginSessionBytes).digest("hex");
-      return join3(directory, `${loginSessionSha256}.json`);
+      return join5(directory, `${loginSessionSha256}.json`);
     }
     derToRawSignature(derSignature) {
       let offset = 2;
@@ -38438,9 +38675,9 @@ __export(exports_config, {
   applyPurchaseProfile: () => applyPurchaseProfile
 });
 import { createHash as createHash3 } from "crypto";
-import { copyFileSync as copyFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join4 } from "path";
+import { copyFileSync as copyFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname4, join as join6 } from "path";
 function getPurchaseProfile() {
   return process.env["DOMAINS_PURCHASE_AWS_PROFILE"] ?? loadConfig4().purchase_aws_profile ?? undefined;
 }
@@ -38453,20 +38690,20 @@ function applyPurchaseProfile() {
   return profile;
 }
 function canonicalHome2(env) {
-  return env["HOME"] || env["USERPROFILE"] || homedir3();
+  return env["HOME"] || env["USERPROFILE"] || homedir5();
 }
 function migrateLegacyConfig(env = process.env, dryRun = false) {
   const report = { dryRun, wouldCopy: false, copied: false };
   const home = canonicalHome2(env);
-  const canonicalDir = join4(home, ".hasna", "domains");
-  const newPath = join4(canonicalDir, "config.json");
-  if (existsSync2(newPath))
+  const canonicalDir = join6(home, ".hasna", "domains");
+  const newPath = join6(canonicalDir, "config.json");
+  if (existsSync3(newPath))
     return report;
-  if (existsSync2(join4(canonicalDir, ".migrated-from-xdg-config.receipt.json")))
+  if (existsSync3(join6(canonicalDir, ".migrated-from-xdg-config.receipt.json")))
     return report;
-  const xdgConfig = env["XDG_CONFIG_HOME"]?.trim() || join4(home, ".config");
-  const oldPath = join4(xdgConfig, "open-domains", "config.json");
-  if (!existsSync2(oldPath))
+  const xdgConfig = env["XDG_CONFIG_HOME"]?.trim() || join6(home, ".config");
+  const oldPath = join6(xdgConfig, "open-domains", "config.json");
+  if (!existsSync3(oldPath))
     return report;
   report.wouldCopy = true;
   if (dryRun)
@@ -38478,7 +38715,7 @@ function migrateLegacyConfig(env = process.env, dryRun = false) {
   if (!oldBytes.equals(newBytes)) {
     throw new Error(`Refusing migration: copied ${newPath} does not byte-match ${oldPath}; the canonical config was not populated.`);
   }
-  writeFileSync2(join4(canonicalDir, ".migrated-from-xdg-config.receipt.json"), `${JSON.stringify({
+  writeFileSync2(join6(canonicalDir, ".migrated-from-xdg-config.receipt.json"), `${JSON.stringify({
     migratedAt: new Date().toISOString(),
     from: oldPath,
     to: newPath,
@@ -38494,13 +38731,15 @@ function getConfigPath(env = process.env) {
     return env["DOMAINS_CONFIG_PATH"];
   const dir = env["DOMAINS_CONFIG_DIR"];
   if (dir)
-    return join4(dir, "config.json");
-  migrateLegacyConfig(env);
-  return join4(canonicalHome2(env), ".hasna", "domains", "config.json");
+    return join6(dir, "config.json");
+  if (!adoptResolverHome(resolverHome(env), env)) {
+    migrateLegacyConfig(env);
+  }
+  return getDefaultConfigPath(env);
 }
 function loadConfig4(env = process.env) {
   const path = getConfigPath(env);
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return {};
   try {
     return JSON.parse(readFileSync5(path, "utf-8"));
@@ -38511,7 +38750,7 @@ function loadConfig4(env = process.env) {
 function saveConfig(config, env = process.env) {
   const path = getConfigPath(env);
   const dir = dirname4(path);
-  if (!existsSync2(dir))
+  if (!existsSync3(dir))
     mkdirSync2(dir, { recursive: true });
   writeFileSync2(path, JSON.stringify(config, null, 2), "utf-8");
 }
@@ -38560,7 +38799,9 @@ function getConfigKey(keyPath) {
   }
   return;
 }
-var init_config = () => {};
+var init_config = __esm(() => {
+  init_app_home();
+});
 
 // src/lib/compact-output.ts
 function parseLimit(value, fallback = DEFAULT_LIST_LIMIT, maxLimit = MAX_LIST_LIMIT) {
@@ -41357,9 +41598,9 @@ __export(exports_commander, {
 });
 import { chmod, mkdir, readFile, rename, writeFile as writeFile2 } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
-import { existsSync as existsSync4 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join6 } from "path";
+import { existsSync as existsSync5 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join8 } from "path";
 import { createHmac, timingSafeEqual } from "crypto";
 import { lookup as dnsLookup } from "dns/promises";
 import { isIP as isIP2 } from "net";
@@ -41464,7 +41705,7 @@ function channelMatchesEvent(channel, event) {
   return channel.filters.some((filter) => eventMatchesFilter(event, filter));
 }
 function getEventsDataDir(override) {
-  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join6(homedir5(), ".hasna", "events");
+  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join8(homedir7(), ".hasna", "events");
 }
 function getActiveEventsDirEnv() {
   if (process.env[HASNA_EVENTS_DIR_ENV])
@@ -41480,12 +41721,12 @@ class JsonEventsStore {
   channelsPath;
   eventsPath;
   deliveriesPath;
-  constructor(dataDir = getEventsDataDir()) {
-    this.dataDir = dataDir;
-    this.runtime = localJsonRuntime(dataDir);
-    this.channelsPath = join6(dataDir, "channels.json");
-    this.eventsPath = join6(dataDir, "events.json");
-    this.deliveriesPath = join6(dataDir, "deliveries.json");
+  constructor(dataDir2 = getEventsDataDir()) {
+    this.dataDir = dataDir2;
+    this.runtime = localJsonRuntime(dataDir2);
+    this.channelsPath = join8(dataDir2, "channels.json");
+    this.eventsPath = join8(dataDir2, "events.json");
+    this.deliveriesPath = join8(dataDir2, "deliveries.json");
   }
   async init() {
     await mkdir(this.dataDir, { recursive: true, mode: 448 });
@@ -41602,7 +41843,7 @@ class JsonEventsStore {
     };
   }
   async ensureArrayFile(path) {
-    if (!existsSync4(path)) {
+    if (!existsSync5(path)) {
       await writeFile2(path, `[]
 `, { encoding: "utf-8", mode: 384 });
     }
@@ -41632,7 +41873,7 @@ class JsonEventsStore {
     });
   }
 }
-function localJsonRuntime(dataDir = getEventsDataDir()) {
+function localJsonRuntime(dataDir2 = getEventsDataDir()) {
   return {
     mode: "local-files",
     name: "json-events-store",
@@ -41645,7 +41886,7 @@ function localJsonRuntime(dataDir = getEventsDataDir()) {
     durable: true,
     idempotency: "best-effort-local",
     replayCursors: true,
-    description: `Local JSON files in ${dataDir}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+    description: `Local JSON files in ${dataDir2}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
   };
 }
 function encodeLocalJsonEventCursor(offset, options = {}) {
@@ -41709,8 +41950,8 @@ function assertCursorFilter(name, cursorValue, optionValue) {
 function findEventByIdentity(events, identity2) {
   return events.find((event) => identity2.id !== undefined && event.id === identity2.id || identity2.dedupeKey !== undefined && event.dedupeKey === identity2.dedupeKey);
 }
-async function getEventsStatus(dataDir) {
-  const store = new JsonEventsStore(dataDir);
+async function getEventsStatus(dataDir2) {
+  const store = new JsonEventsStore(dataDir2);
   await store.init();
   const [channels, events, deliveries] = await Promise.all([
     store.listChannels(),
@@ -41752,9 +41993,9 @@ async function getEventsStatus(dataDir) {
     }
   };
 }
-function statusFile(dataDir, fileName, records) {
-  const path = join6(dataDir, fileName);
-  return { path, exists: existsSync4(path), records };
+function statusFile(dataDir2, fileName, records) {
+  const path = join8(dataDir2, fileName);
+  return { path, exists: existsSync5(path), records };
 }
 function buildSignatureBase(timestamp, body) {
   return `${timestamp}.${body}`;
@@ -42055,7 +42296,7 @@ async function pinnedNativeRequest(target, addresses, method, headers, body, sig
       callback(null, entries);
     }
   };
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const request = isHttps ? nodeHttpsRequest(requestOptions, onResponse) : nodeHttpRequest(requestOptions, onResponse);
     const onAbort = () => {
       const error = new Error("The operation was aborted.");
@@ -42082,7 +42323,7 @@ async function pinnedNativeRequest(target, addresses, method, headers, body, sig
           else if (Array.isArray(value))
             headersRecord[name] = value.join(", ");
         }
-        resolve3(new Response(Buffer.concat(chunks), { status: response.statusCode ?? 200, headers: headersRecord }));
+        resolve4(new Response(Buffer.concat(chunks), { status: response.statusCode ?? 200, headers: headersRecord }));
       });
     }
   });
@@ -42179,7 +42420,7 @@ async function dispatchCommand(event, channel) {
     HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
     HASNA_EVENT_JSON: eventJson
   };
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const child = spawn(channel.command.command, channel.command.args ?? [], {
       cwd: channel.command.cwd,
       env,
@@ -42197,7 +42438,7 @@ async function dispatchCommand(event, channel) {
     });
     child.on("error", (error) => {
       clearTimeout(timeout);
-      resolve3({
+      resolve4({
         attempt: 1,
         status: "failed",
         startedAt,
@@ -42210,7 +42451,7 @@ async function dispatchCommand(event, channel) {
     child.on("close", (code, signal) => {
       clearTimeout(timeout);
       const success = code === 0;
-      resolve3({
+      resolve4({
         attempt: 1,
         status: success ? "success" : "failed",
         startedAt,
@@ -45577,15 +45818,15 @@ ${"\u2500".repeat(45)}`);
 
 // src/cli/commands/mcp-install.ts
 init_stdout();
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname5, join as join5 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname5, join as join7 } from "path";
 import { execSync as execSync2 } from "child_process";
 var MCP_SERVER_NAME = "domains";
 function getClaudeConfigPaths() {
   return {
-    global: join5(homedir4(), ".claude", "claude_desktop_config.json"),
-    project: join5(process.cwd(), ".claude", "settings.json")
+    global: join7(homedir6(), ".claude", "claude_desktop_config.json"),
+    project: join7(process.cwd(), ".claude", "settings.json")
   };
 }
 function getMcpBinaryPath() {
@@ -45597,12 +45838,12 @@ function getMcpBinaryPath() {
 }
 function ensureConfigDir(configPath) {
   const dir = dirname5(configPath);
-  if (!existsSync3(dir)) {
+  if (!existsSync4(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
 }
 function readConfig(configPath) {
-  if (!existsSync3(configPath))
+  if (!existsSync4(configPath))
     return {};
   try {
     return JSON.parse(readFileSync7(configPath, "utf-8"));
@@ -45631,7 +45872,7 @@ function registerMcpCommand(program2) {
   mcp.command("uninstall").description("Remove domains MCP server from Claude Code config").option("--project", "Remove from project config instead of global").action((opts) => {
     const paths = getClaudeConfigPaths();
     const configPath = opts.project ? paths.project : paths.global;
-    if (!existsSync3(configPath)) {
+    if (!existsSync4(configPath)) {
       printLine("Config file not found \u2014 nothing to remove.");
       return;
     }
@@ -45649,7 +45890,7 @@ function registerMcpCommand(program2) {
     const paths = getClaudeConfigPaths();
     const status = [];
     for (const [scope, configPath] of [["global", paths.global], ["project", paths.project]]) {
-      if (!existsSync3(configPath)) {
+      if (!existsSync4(configPath)) {
         status.push({ scope, config_path: configPath, exists: false, registered: false });
         continue;
       }
@@ -46287,6 +46528,20 @@ var PG_MIGRATIONS = [
 var OWNER_DSN_ENV = "HASNA_DOMAINS_DATABASE_URL_OWNER";
 var APP_DSN_ENV = "HASNA_DOMAINS_DATABASE_URL";
 var LEGACY_DSN_ENV = "DATABASE_URL";
+var ACKNOWLEDGED_LEGACY_MIGRATION_IDS = [
+  "domains_apikeys_tenancy_0001",
+  "domains_apikeys_tenancy_0002",
+  "domains_tenancy_0001",
+  "domains_tenancy_0002",
+  "domains_tenancy_0003",
+  "domains_tenancy_0004",
+  "domains_tenancy_0005",
+  "domains_tenancy_0006",
+  "domains_tenancy_0007",
+  "domains_tenancy_0008",
+  "domains_tenancy_0009",
+  "domains_tenancy_0010"
+];
 function buildMigrations() {
   const migrations2 = [];
   PG_MIGRATIONS.forEach((sql, i4) => {
@@ -46312,7 +46567,7 @@ async function runMigrations(opts = {}) {
   try {
     const client = wrapExecutor(pool2);
     const ledger = new MigrationLedger(client, buildMigrations(), {
-      acknowledgedLegacyIds: ["domains_apikeys_tenancy_0001"]
+      acknowledgedLegacyIds: ACKNOWLEDGED_LEGACY_MIGRATION_IDS
     });
     return await ledger.migrate(opts.dryRun ? { dryRun: true } : {});
   } finally {
@@ -47223,13 +47478,13 @@ async function loadRdapBootstrap(path) {
   return map;
 }
 function whoisRaw(server, query2, timeoutMs = 25000) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const chunks = [];
     let settled = false;
     const done = (r4) => {
       if (!settled) {
         settled = true;
-        resolve3(r4);
+        resolve4(r4);
       }
     };
     const sock = net.createConnection({ host: server, port: 43 });