@hasna/domains 0.0.46 → 0.0.47

package/dist/mcp/index.js

@@ -5228,7 +5228,7 @@ var require_client = __commonJS((exports) => {
     };
   };
   var sleep = (seconds) => {
-    return new Promise((resolve3) => setTimeout(resolve3, seconds * 1000));
+    return new Promise((resolve4) => setTimeout(resolve4, seconds * 1000));
   };
   var waiterServiceDefaults = {
     minDelay: 2,
@@ -5357,8 +5357,8 @@ var require_client = __commonJS((exports) => {
   };
   var abortTimeout = (abortSignal) => {
     let onAbort;
-    const promise = new Promise((resolve3) => {
-      onAbort = () => resolve3({ state: WaiterState.ABORTED });
+    const promise = new Promise((resolve4) => {
+      onAbort = () => resolve4({ state: WaiterState.ABORTED });
       if (typeof abortSignal.addEventListener === "function") {
         abortSignal.addEventListener("abort", onAbort);
       } else {
@@ -6011,8 +6011,8 @@ var require_client = __commonJS((exports) => {
 
 // ../../node_modules/.bun/@smithy+core@3.33.2/node_modules/@smithy/core/dist-cjs/submodules/config/index.js
 var require_config = __commonJS((exports) => {
-  var { homedir: homedir2 } = __require("os");
-  var { sep, join: join3 } = __require("path");
+  var { homedir: homedir4 } = __require("os");
+  var { sep, join: join5 } = __require("path");
   var { createHash: createHash2 } = __require("crypto");
   var { readFile: readFile$1 } = __require("fs/promises");
   var { IniSectionType } = require_dist_cjs();
@@ -6161,7 +6161,7 @@ var require_config = __commonJS((exports) => {
       return `${HOMEDRIVE}${HOMEPATH}`;
     const homeDirCacheKey = getHomeDirCacheKey();
     if (!homeDirCache[homeDirCacheKey])
-      homeDirCache[homeDirCacheKey] = homedir2();
+      homeDirCache[homeDirCacheKey] = homedir4();
     return homeDirCache[homeDirCacheKey];
   };
   var ENV_PROFILE = "AWS_PROFILE";
@@ -6170,7 +6170,7 @@ var require_config = __commonJS((exports) => {
   var getSSOTokenFilepath = (id) => {
     const hasher = createHash2("sha1");
     const cacheName = hasher.update(id).digest("hex");
-    return join3(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
+    return join5(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
   };
   var tokenIntercept = {};
   var getSSOTokenFromFile = async (id) => {
@@ -6197,9 +6197,9 @@ var require_config = __commonJS((exports) => {
     ...data.default && { default: data.default }
   });
   var ENV_CONFIG_PATH = "AWS_CONFIG_FILE";
-  var getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || join3(getHomeDir(), ".aws", "config");
+  var getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || join5(getHomeDir(), ".aws", "config");
   var ENV_CREDENTIALS_PATH = "AWS_SHARED_CREDENTIALS_FILE";
-  var getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || join3(getHomeDir(), ".aws", "credentials");
+  var getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || join5(getHomeDir(), ".aws", "credentials");
   var prefixKeyRegex = /^([\w-]+)\s(["'])?([\w-@+.%:/]+)\2$/;
   var profileNameBlockList = ["__proto__", "profile __proto__"];
   var parseIni = (iniData) => {
@@ -6265,11 +6265,11 @@ var require_config = __commonJS((exports) => {
     const relativeHomeDirPrefix = "~/";
     let resolvedFilepath = filepath;
     if (filepath.startsWith(relativeHomeDirPrefix)) {
-      resolvedFilepath = join3(homeDir2, filepath.slice(2));
+      resolvedFilepath = join5(homeDir2, filepath.slice(2));
     }
     let resolvedConfigFilepath = configFilepath;
     if (configFilepath.startsWith(relativeHomeDirPrefix)) {
-      resolvedConfigFilepath = join3(homeDir2, configFilepath.slice(2));
+      resolvedConfigFilepath = join5(homeDir2, configFilepath.slice(2));
     }
     const parsedFiles = await Promise.all([
       readFile(resolvedConfigFilepath, {
@@ -6486,7 +6486,7 @@ var require_config = __commonJS((exports) => {
   };
   var imdsRequest = async (options) => {
     const { request } = __require("http");
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const req = request({
         hostname: options.hostname,
         port: options.port,
@@ -6514,7 +6514,7 @@ var require_config = __commonJS((exports) => {
         const chunks = [];
         res.on("data", (chunk) => chunks.push(chunk));
         res.on("end", () => {
-          resolve3(Buffer.concat(chunks));
+          resolve4(Buffer.concat(chunks));
           req.destroy();
         });
       });
@@ -8865,7 +8865,7 @@ ${value}\r
     if (isReadableStream(stream)) {
       return headStream$1(stream, bytes);
     }
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const collector = new Collector$1;
       collector.limit = bytes;
       stream.pipe(collector);
@@ -8876,7 +8876,7 @@ ${value}\r
       collector.on("error", reject);
       collector.on("finish", function() {
         const bytes2 = concatBytes(this.buffers);
-        resolve3(bytes2);
+        resolve4(bytes2);
       });
     });
   };
@@ -8990,7 +8990,7 @@ ${value}\r
     if (isReadableStream(stream)) {
       return collectReadableStream(stream);
     }
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const collector = new Collector;
       const nodeStream = stream;
       nodeStream.pipe(collector);
@@ -9001,7 +9001,7 @@ ${value}\r
       collector.on("error", reject);
       collector.on("finish", function() {
         const bytes = concatBytes(this.bufferedBytes);
-        resolve3(bytes);
+        resolve4(bytes);
       });
     });
   };
@@ -9193,7 +9193,7 @@ var require_checksum = __commonJS((exports) => {
       callback();
     }
   }
-  var fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve3, reject) => {
+  var fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve4, reject) => {
     if (!isReadStream(fileStream)) {
       reject(new Error("Unable to calculate hash for non-file streams."));
       return;
@@ -9211,7 +9211,7 @@ var require_checksum = __commonJS((exports) => {
     });
     hashCalculator.on("error", reject);
     hashCalculator.on("finish", function() {
-      hash.digest().then(resolve3).catch(reject);
+      hash.digest().then(resolve4).catch(reject);
     });
   });
   var isReadStream = (stream) => typeof stream.path === "string";
@@ -9222,14 +9222,14 @@ var require_checksum = __commonJS((exports) => {
     const hash = new hashCtor;
     const hashCalculator = new HashCalculator(hash);
     readableStream.pipe(hashCalculator);
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       readableStream.on("error", (err) => {
         hashCalculator.end();
         reject(err);
       });
       hashCalculator.on("error", reject);
       hashCalculator.on("finish", () => {
-        hash.digest().then(resolve3).catch(reject);
+        hash.digest().then(resolve4).catch(reject);
       });
     });
   };
@@ -10335,7 +10335,7 @@ var require_event_streams = __commonJS((exports) => {
       streamEnded = true;
     });
     while (!generationEnded) {
-      const value = await new Promise((resolve3) => setTimeout(() => resolve3(records.shift()), 0));
+      const value = await new Promise((resolve4) => setTimeout(() => resolve4(records.shift()), 0));
       if (value) {
         yield value;
       }
@@ -11215,8 +11215,8 @@ var require_protocols = __commonJS((exports) => {
     async build() {
       const { hostname, protocol = "https", port, path: basePath } = await this.context.endpoint();
       this.path = basePath;
-      for (const resolvePath of this.resolvePathStack) {
-        resolvePath(this.path);
+      for (const resolvePath2 of this.resolvePathStack) {
+        resolvePath2(this.path);
       }
       return new HttpRequest({
         protocol,
@@ -11830,7 +11830,7 @@ var require_retry = __commonJS((exports) => {
       }
     };
   }
-  var cooldown = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
+  var cooldown = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
   var isRetryStrategyV2 = (retryStrategy) => typeof retryStrategy.acquireInitialRetryToken !== "undefined" && typeof retryStrategy.refreshRetryTokenForRetry !== "undefined" && typeof retryStrategy.recordSuccess !== "undefined";
   var getRetryErrorInfo = (error, logger) => {
     const errorInfo = {
@@ -11929,7 +11929,7 @@ var require_retry = __commonJS((exports) => {
       this.refillTokenBucket();
       while (amount > this.availableTokens) {
         const delay = (amount - this.availableTokens) / this.fillRate * 1000;
-        await new Promise((resolve3) => DefaultRateLimiter.setTimeoutFn(resolve3, delay));
+        await new Promise((resolve4) => DefaultRateLimiter.setTimeoutFn(resolve4, delay));
         this.refillTokenBucket();
       }
       this.availableTokens = this.availableTokens - amount;
@@ -12271,7 +12271,7 @@ var require_retry = __commonJS((exports) => {
             const delayFromResponse = getDelayFromRetryAfterHeader(err.$response);
             const delay = Math.max(delayFromResponse || 0, delayFromDecider);
             totalDelay += delay;
-            await new Promise((resolve3) => setTimeout(resolve3, delay));
+            await new Promise((resolve4) => setTimeout(resolve4, delay));
             continue;
           }
           if (!err.$metadata) {
@@ -15604,7 +15604,7 @@ var init_node_http = () => {};
 
 // ../../node_modules/.bun/@smithy+credential-provider-imds@4.5.2/node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/httpRequest.js
 function httpRequest(options) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const req = node_http.request({
       method: "GET",
       ...options,
@@ -15629,7 +15629,7 @@ function httpRequest(options) {
         chunks.push(chunk);
       });
       res.on("end", () => {
-        resolve3(Buffer.concat(chunks));
+        resolve4(Buffer.concat(chunks));
         req.destroy();
       });
     });
@@ -15853,9 +15853,9 @@ var import_config6, IMDS_PATH = "/latest/meta-data/iam/security-credentials/", I
       let fallbackBlockedFromProcessEnv = false;
       const configValue = await import_config6.loadConfig({
         environmentVariableSelector: (env) => {
-          const envValue = env[AWS_EC2_METADATA_V1_DISABLED];
-          fallbackBlockedFromProcessEnv = !!envValue && envValue !== "false";
-          if (envValue === undefined) {
+          const envValue2 = env[AWS_EC2_METADATA_V1_DISABLED];
+          fallbackBlockedFromProcessEnv = !!envValue2 && envValue2 !== "false";
+          if (envValue2 === undefined) {
             throw new import_config6.CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`, { logger: init.logger });
           }
           return fallbackBlockedFromProcessEnv;
@@ -16123,21 +16123,21 @@ var require_dist_cjs4 = __commonJS((exports) => {
     let sendBody = true;
     if (!externalAgent && expect === "100-continue") {
       sendBody = await Promise.race([
-        new Promise((resolve3) => {
-          timeoutId = Number(timing.setTimeout(() => resolve3(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
+        new Promise((resolve4) => {
+          timeoutId = Number(timing.setTimeout(() => resolve4(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
         }),
-        new Promise((resolve3) => {
+        new Promise((resolve4) => {
           httpRequest2.on("continue", () => {
             timing.clearTimeout(timeoutId);
-            resolve3(true);
+            resolve4(true);
           });
           httpRequest2.on("response", () => {
             timing.clearTimeout(timeoutId);
-            resolve3(false);
+            resolve4(false);
           });
           httpRequest2.on("error", () => {
             timing.clearTimeout(timeoutId);
-            resolve3(false);
+            resolve4(false);
           });
         })
       ]);
@@ -16212,13 +16212,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return socketWarningTimestamp;
     }
     constructor(options) {
-      this.configProvider = new Promise((resolve3, reject) => {
+      this.configProvider = new Promise((resolve4, reject) => {
         if (typeof options === "function") {
           options().then((_options) => {
-            resolve3(this.resolveDefaultConfig(_options));
+            resolve4(this.resolveDefaultConfig(_options));
           }).catch(reject);
         } else {
-          resolve3(this.resolveDefaultConfig(options));
+          resolve4(this.resolveDefaultConfig(options));
         }
       });
     }
@@ -16250,7 +16250,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
           timing.clearTimeout(socketTimeoutId);
           timing.clearTimeout(keepAliveTimeoutId);
         };
-        const resolve3 = async (arg) => {
+        const resolve4 = async (arg) => {
           await writeRequestBodyPromise;
           clearTimeouts();
           _resolve(arg);
@@ -16314,7 +16314,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             headers: getTransformedHeaders(res.headers),
             body: res
           });
-          resolve3({ response: httpResponse });
+          resolve4({ response: httpResponse });
         });
         req.on("error", (err) => {
           if (NODEJS_TIMEOUT_ERROR_CODES.includes(err.code)) {
@@ -16646,13 +16646,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return new NodeHttp2Handler(instanceOrOptions);
     }
     constructor(options) {
-      this.configProvider = new Promise((resolve3, reject) => {
+      this.configProvider = new Promise((resolve4, reject) => {
         if (typeof options === "function") {
           options().then((opts) => {
-            resolve3(opts || {});
+            resolve4(opts || {});
           }).catch(reject);
         } else {
-          resolve3(options || {});
+          resolve4(options || {});
         }
       });
     }
@@ -16677,7 +16677,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return new Promise((_resolve, _reject) => {
         let fulfilled = false;
         let writeRequestBodyPromise = undefined;
-        const resolve3 = async (arg) => {
+        const resolve4 = async (arg) => {
           await writeRequestBodyPromise;
           _resolve(arg);
         };
@@ -16762,7 +16762,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             body: clientHttp2Stream
           });
           fulfilled = true;
-          resolve3({ response: httpResponse });
+          resolve4({ response: httpResponse });
           if (useIsolatedSession) {
             session.close();
           }
@@ -16888,7 +16888,7 @@ var retryWrapper = (toRetry, maxRetries, delayMs) => {
       try {
         return await toRetry();
       } catch (e) {
-        await new Promise((resolve3) => setTimeout(resolve3, delayMs));
+        await new Promise((resolve4) => setTimeout(resolve4, delayMs));
       }
     }
     return await toRetry();
@@ -26096,8 +26096,8 @@ var require_signin = __commonJS((exports) => {
 // ../../node_modules/.bun/@aws-sdk+credential-provider-login@3.972.76/node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js
 import { createHash as createHash2, createPrivateKey, createPublicKey, sign } from "crypto";
 import { promises as fs2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join3 } from "path";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname3, join as join5 } from "path";
 var import_config20, import_protocols3, LoginCredentialsFetcher;
 var init_LoginCredentialsFetcher = __esm(() => {
   import_config20 = __toESM(require_config(), 1);
@@ -26264,10 +26264,10 @@ var init_LoginCredentialsFetcher = __esm(() => {
       await fs2.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
     }
     getTokenFilePath() {
-      const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join3(homedir2(), ".aws", "login", "cache");
+      const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join5(homedir4(), ".aws", "login", "cache");
       const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
       const loginSessionSha256 = createHash2("sha256").update(loginSessionBytes).digest("hex");
-      return join3(directory, `${loginSessionSha256}.json`);
+      return join5(directory, `${loginSessionSha256}.json`);
     }
     derToRawSignature(derSignature) {
       let offset = 2;
@@ -26841,9 +26841,9 @@ async function startMcpHttpServer(buildServer, options) {
     res.writeHead(404, { "Content-Type": "text/plain" });
     res.end("Not Found");
   });
-  await new Promise((resolve3, reject) => {
+  await new Promise((resolve4, reject) => {
     httpServer.once("error", reject);
-    httpServer.listen(requestedPort, host, () => resolve3());
+    httpServer.listen(requestedPort, host, () => resolve4());
   });
   const addr = httpServer.address();
   const port = typeof addr === "object" && addr ? addr.port : requestedPort;
@@ -26851,8 +26851,8 @@ async function startMcpHttpServer(buildServer, options) {
   return {
     port,
     host,
-    close: () => new Promise((resolve3, reject) => {
-      httpServer.close((err) => err ? reject(err) : resolve3());
+    close: () => new Promise((resolve4, reject) => {
+      httpServer.close((err) => err ? reject(err) : resolve4());
     })
   };
 }
@@ -26996,6 +26996,7 @@ import { StdioServerTransport as StdioServerTransport2 } from "@modelcontextprot
 // ../contracts/dist/client/storage.js
 import { isIP } from "net";
 import { readFileSync, statSync } from "fs";
+import { createRequire } from "module";
 import { join } from "path";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
@@ -27011,6 +27012,9 @@ function credentialOverrideEnvKey(name) {
   return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
 }
 var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE";
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
 
 class CredentialResolutionError extends Error {
   appName;
@@ -27023,31 +27027,55 @@ class CredentialResolutionError extends Error {
   }
 }
 var HASNA_STATE_DIR = ".hasna";
-var FLEET_CREDENTIAL_DIR = "cloud";
+var FLEET_CREDENTIAL_DIR = "fleet-env";
+var LEGACY_CLOUD_DIR = "cloud";
 var CONFIG_DIR = ".config";
 var CONFIG_NAMESPACE = "hasna";
+var LEGACY_CLOUD_REMOVAL_DEADLINE = "2026-10-01";
 var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
 var SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 var SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
 var ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+var VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
 function homeDir(env) {
   const home = env.HOME?.trim();
   return home ? home : null;
 }
-function credentialDiskSources(name, env) {
-  return profileDiskSources(name, env, null);
-}
-function profileDiskSources(name, env, profile) {
+function credentialDiskSourceList(name, env, profile = null) {
   const home = homeDir(env);
   if (!home || !SAFE_APP_SLUG.test(name))
     return [];
   const stem = profile ? `${name}.${profile}` : name;
   const configStem = profile ? `${name}-${profile}` : name;
   return [
-    join(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
-    join(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`)
+    {
+      path: join(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
+      tier: "fleet-env",
+      deprecated: false
+    },
+    {
+      path: join(home, HASNA_STATE_DIR, LEGACY_CLOUD_DIR, `${stem}.env`),
+      tier: "legacy-cloud",
+      deprecated: true
+    },
+    {
+      path: join(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}.env`),
+      tier: "config",
+      deprecated: false
+    },
+    {
+      path: join(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`),
+      tier: "config-legacy",
+      deprecated: true
+    }
   ];
 }
+function credentialDiskSources(name, env) {
+  return credentialDiskSourceList(name, env, null).map((s) => s.path);
+}
+function profileDiskSources(name, env, profile) {
+  return credentialDiskSourceList(name, env, profile).map((s) => s.path);
+}
 function parseEnvFile(text) {
   const values = new Map;
   for (const rawLine of text.split(/\r?\n/)) {
@@ -27115,6 +27143,9 @@ function appConfigDiskValue(name, env, keys) {
   return null;
 }
 function assertUsableCredential(appName, source, value) {
+  if (VAULT_POINTER_SHAPE.test(value)) {
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
   if (!ILLEGAL_IN_HEADER_VALUE.test(value))
     return;
   throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
@@ -27139,6 +27170,14 @@ function sealCredential(fields) {
     writable: false,
     configurable: false
   });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
   Object.defineProperty(sealed, INSPECT_CUSTOM, {
     value: () => ({ ...visible, apiKey: "[redacted]" }),
     enumerable: false,
@@ -27190,7 +27229,8 @@ function validateAndSealResolvedCredential(appName, credential) {
     deliberate: credential.deliberate,
     deprecated: credential.deprecated,
     diskCandidates: credential.diskCandidates,
-    warning: credential.warning
+    warning: credential.warning,
+    ...credential.pointerVaultKey !== undefined ? { pointerVaultKey: credential.pointerVaultKey } : {}
   });
 }
 function firstEnvValue(env, keys) {
@@ -27251,6 +27291,27 @@ function resolveCredential(name, env, options = {}) {
       warning: null
     });
   }
+  const pointerKeyName = credentialPointerEnvKey(name);
+  const pointerRaw = env[pointerKeyName];
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE.test(pointer)) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
   const profile = options.profile?.trim() || env[CREDENTIAL_PROFILE_ENV_KEY]?.trim();
   if (profile) {
     const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
@@ -27275,26 +27336,42 @@ function resolveCredential(name, env, options = {}) {
     }
     throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
   }
-  const diskHits = diskPaths.map((path) => ({ path, value: readCredentialFile(path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  const diskSourceList = credentialDiskSourceList(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
   if (diskHits.length > 0) {
     const winner = diskHits[0];
-    assertUsableCredential(name, winner.path, winner.value);
+    assertUsableCredential(name, winner.src.path, winner.value);
     const divergentSources = [
-      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.path),
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
       ...(() => {
         const legacyHit = firstEnvValue(env, apiKeyKeys);
         return legacyHit && legacyHit.value !== winner.value ? [legacyHit.key] : [];
       })()
     ];
-    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    let deprecated = winner.src.deprecated;
+    let finalWarning = warning;
+    if (winner.src.deprecated) {
+      deprecated = true;
+      const sink = options.onDeprecation ?? defaultDeprecationSink;
+      const notified = deprecationNotified();
+      const noticeKey = `${name}:${winner.src.path}`;
+      if (!notified.has(noticeKey)) {
+        notified.add(noticeKey);
+        const target = diskSourceList[0]?.path ?? "<none>";
+        const message = `[${name}] DEPRECATED: the API key came from ${winner.src.path} \u2014 a legacy credential location. ` + `The primary location is ${target} (~/.hasna/fleet-env/<app>.env). The legacy 'cloud' tiers are ` + `removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}. Migrate the key to the primary location.`;
+        sink(message);
+      }
+      finalWarning = [warning, `Legacy credential source: ${winner.src.path}. Removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}.`].filter(Boolean).join(" ") || null;
+    }
     return sealCredential({
       apiKey: winner.value,
-      tier: "disk",
-      source: winner.path,
+      tier: winner.src.tier,
+      source: winner.src.path,
       deliberate: false,
-      deprecated: false,
+      deprecated,
       diskCandidates: diskPaths,
-      warning
+      warning: finalWarning
     });
   }
   const legacy = firstEnvValue(env, apiKeyKeys);
@@ -27320,6 +27397,47 @@ function resolveCredential(name, env, options = {}) {
   }
   return null;
 }
+var SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+var requireSecretsSdk = createRequire(import.meta.url);
+async function completePointerCredential(name, pointerResolution, env = process.env) {
+  const vaultKey = pointerResolution.pointerVaultKey;
+  const pointerEnvKey = pointerResolution.source;
+  if (!vaultKey) {
+    throw new CredentialResolutionError(name, `Pointer resolution from ${pointerEnvKey} carries no vault item key; this is a defect in the resolver.`, [pointerEnvKey]);
+  }
+  let secretsSdk;
+  try {
+    secretsSdk = requireSecretsSdk(SECRETS_PACKAGE_SPECIFIER);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
+  }
+  let client;
+  try {
+    client = secretsSdk.createSecretsClientFromEnv(env);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets client could not be configured from this ` + `environment (the secrets service URL and key env are missing or invalid). A vault pointer is TERMINAL and ` + `never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  let secret;
+  try {
+    secret = await client.getSecret({ key: vaultKey });
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the vault could not be reached or the item is ` + `unavailable. A vault pointer is TERMINAL and never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  const value = secret.value;
+  if (!value) {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} resolved vault item '${vaultKey}', but it holds no value. A vault pointer is TERMINAL.`, [pointerEnvKey]);
+  }
+  assertUsableCredential(name, `${pointerEnvKey} -> vault:${vaultKey}`, value);
+  return sealCredential({
+    apiKey: value,
+    tier: "pointer",
+    source: `${pointerEnvKey} -> vault:${vaultKey}`,
+    deliberate: true,
+    deprecated: false,
+    diskCandidates: pointerResolution.diskCandidates,
+    warning: null
+  });
+}
 var ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
 var DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 function isValidDnsDomain(value) {
@@ -27565,6 +27683,13 @@ function currentCredential(name, apiKey) {
   }
   return explicitCredential(name, apiKey);
 }
+async function resolveRequestCredential(name, apiKey, env = process.env) {
+  const resolved = currentCredential(name, apiKey);
+  if (resolved.tier === "pointer") {
+    return completePointerCredential(name, resolved, env);
+  }
+  return resolved;
+}
 function authFailureGuidance(credential) {
   const origin = `The API key for this request came from ${credential.source}`;
   if (credential.deliberate) {
@@ -27720,7 +27845,7 @@ function createHasnaHttpTransport(options) {
     const retry = resolveRetry(opts.retry);
     const methodRetryable = IDEMPOTENT_METHODS.has(upper) || Boolean(opts.idempotencyKey);
     const maxAttempts = retry && methodRetryable ? retry.retries + 1 : 1;
-    const credential = currentCredential(options.name, options.apiKey);
+    const credential = await resolveRequestCredential(options.name, options.apiKey);
     let last = null;
     for (let attempt = 1;attempt <= maxAttempts; attempt++) {
       const result = await once(upper, rel, url, body, opts, credential);
@@ -27885,6 +28010,7 @@ function resolveStorageClient(name, env = process.env, overrides) {
 }
 
 // ../contracts/dist/client/transport.js
+import { createRequire as createRequire2 } from "module";
 function envToken2(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
@@ -27899,6 +28025,8 @@ var MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
 var INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
 var CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
 var DEPRECATION_REGISTRY2 = Symbol.for("hasna:contracts:credentialDeprecationNotices");
+var SECRETS_PACKAGE_SPECIFIER2 = "@hasna/" + "secrets";
+var requireSecretsSdk2 = createRequire2(import.meta.url);
 var IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
 var AUTHORITY_OVERRIDE_HEADERS2 = new Set([
   "host",
@@ -27913,15 +28041,15 @@ import { Database } from "bun:sqlite";
 import { createHash } from "crypto";
 import {
   copyFileSync,
-  existsSync,
+  existsSync as existsSync2,
   mkdirSync,
   readFileSync as readFileSync2,
   readdirSync,
   statSync as statSync2,
   writeFileSync
 } from "fs";
-import { dirname, join as join2, resolve } from "path";
-import { homedir } from "os";
+import { dirname, join as join4, resolve as resolve2 } from "path";
+import { homedir as homedir3 } from "os";
 
 // src/db/migrations.ts
 var MIGRATIONS = [
@@ -28190,10 +28318,116 @@ var MIGRATIONS = [
   }
 ];
 
+// src/lib/app-home.ts
+import { existsSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3, resolve } from "path";
+
+// ../../node_modules/.bun/@hasna+paths@0.1.0/node_modules/@hasna/paths/dist/index.js
+import { homedir } from "os";
+import { join as join2 } from "path";
+var KIND_ENV = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function assertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function envOf(options) {
+  return options.env ?? process.env;
+}
+function envValue(options, kind) {
+  const value = envOf(options)[KIND_ENV[kind]];
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function isMacOS(platform) {
+  return platform === "darwin";
+}
+function baseDir(kind, options) {
+  const override = envValue(options, kind);
+  if (override)
+    return override;
+  const home = options.home ?? homedir();
+  const platform = options.platform ?? process.platform;
+  if (isMacOS(platform)) {
+    switch (kind) {
+      case "config":
+      case "data":
+        return join2(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return join2(home, "Library", "Caches", "Hasna");
+      case "state":
+        return join2(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return join2(home, ".config", "hasna");
+    case "data":
+      return join2(home, ".local", "share", "hasna");
+    case "state":
+      return join2(home, ".local", "state", "hasna");
+    case "cache":
+      return join2(home, ".cache", "hasna");
+  }
+}
+function resolvePath(kind, options) {
+  assertApp(options.app);
+  const appSegment = options.internal === true ? join2("internal", options.app) : options.app;
+  return join2(baseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return resolvePath("data", options);
+}
+
+// src/lib/app-home.ts
+var APP = "domains";
+function effectiveHome(env = process.env) {
+  return env["HOME"] || env["USERPROFILE"] || homedir2();
+}
+function legacyHomeDir(env = process.env) {
+  return join3(effectiveHome(env), ".hasna", APP);
+}
+function resolverHome(env = process.env) {
+  const home = env["HOME"] || env["USERPROFILE"];
+  return dataDir({ app: APP, home, env });
+}
+function adoptResolverHome(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync(join3(resolved, "domains.db"));
+}
+function exactAppOverride(env = process.env) {
+  const override = env["HASNA_DOMAINS_HOME"] ?? env["DOMAINS_HOME"] ?? env["HASNA_DOMAINS_DIR"] ?? env["DOMAINS_DIR"];
+  return override && override.trim() ? override.trim() : undefined;
+}
+function appHome(env = process.env) {
+  const override = exactAppOverride(env);
+  if (override)
+    return resolve(override);
+  const resolved = resolverHome(env);
+  return adoptResolverHome(resolved, env) ? resolve(resolved) : resolve(legacyHomeDir(env));
+}
+function getDefaultDbPath(env = process.env) {
+  return join3(appHome(env), `${APP}.db`);
+}
+function getDefaultConfigPath(env = process.env) {
+  return join3(appHome(env), "config.json");
+}
+
 // src/db/database.ts
 var _db = null;
 function canonicalHome(env) {
-  return env["HOME"] || env["USERPROFILE"] || homedir();
+  return env["HOME"] || env["USERPROFILE"] || homedir3();
 }
 function sha256File(path) {
   return createHash("sha256").update(readFileSync2(path)).digest("hex");
@@ -28201,20 +28435,20 @@ function sha256File(path) {
 function migrateLegacyDataDir(env = process.env, dryRun = false) {
   const report = { dryRun, wouldCopy: [], copied: [] };
   const home = canonicalHome(env);
-  const xdgData = env["XDG_DATA_HOME"]?.trim() || join2(home, ".local", "share");
-  const oldDir = join2(xdgData, "open-domains");
-  const oldDb = join2(oldDir, "domains.db");
-  if (!existsSync(oldDb))
+  const xdgData = env["XDG_DATA_HOME"]?.trim() || join4(home, ".local", "share");
+  const oldDir = join4(xdgData, "open-domains");
+  const oldDb = join4(oldDir, "domains.db");
+  if (!existsSync2(oldDb))
     return report;
-  const canonicalDir = join2(home, ".hasna", "domains");
-  const newDb = join2(canonicalDir, "domains.db");
-  if (existsSync(newDb))
+  const canonicalDir = join4(home, ".hasna", "domains");
+  const newDb = join4(canonicalDir, "domains.db");
+  if (existsSync2(newDb))
     return report;
-  if (existsSync(join2(canonicalDir, ".migrated-from-xdg.receipt.json")))
+  if (existsSync2(join4(canonicalDir, ".migrated-from-xdg.receipt.json")))
     return report;
   if (dryRun) {
     for (const name of ["domains.db", "domains.db-wal", "domains.db-shm"]) {
-      if (existsSync(join2(oldDir, name)) && !existsSync(join2(canonicalDir, name))) {
+      if (existsSync2(join4(oldDir, name)) && !existsSync2(join4(canonicalDir, name))) {
         report.wouldCopy.push(name);
       }
     }
@@ -28223,11 +28457,11 @@ function migrateLegacyDataDir(env = process.env, dryRun = false) {
   mkdirSync(canonicalDir, { recursive: true });
   const copied = [];
   for (const name of ["domains.db", "domains.db-wal", "domains.db-shm"]) {
-    const from = join2(oldDir, name);
-    if (!existsSync(from))
+    const from = join4(oldDir, name);
+    if (!existsSync2(from))
       continue;
-    const to = join2(canonicalDir, name);
-    if (existsSync(to))
+    const to = join4(canonicalDir, name);
+    if (existsSync2(to))
       continue;
     copyFileSync(from, to);
     copied.push({ name, bytes: statSync2(to).size, sha256: sha256File(to) });
@@ -28236,7 +28470,7 @@ function migrateLegacyDataDir(env = process.env, dryRun = false) {
   if (statSync2(newDb).size !== statSync2(oldDb).size || sha256File(newDb) !== sha256File(oldDb)) {
     throw new Error(`Refusing migration: copied ${newDb} does not byte-match ${oldDb}; the canonical root was not populated.`);
   }
-  writeFileSync(join2(canonicalDir, ".migrated-from-xdg.receipt.json"), `${JSON.stringify({
+  writeFileSync(join4(canonicalDir, ".migrated-from-xdg.receipt.json"), `${JSON.stringify({
     migratedAt: new Date().toISOString(),
     from: oldDir,
     to: canonicalDir,
@@ -28250,26 +28484,26 @@ function getDbPath(env = process.env) {
     return env["DOMAINS_DB_PATH"];
   if (env["HASNA_DOMAINS_DB_PATH"])
     return env["HASNA_DOMAINS_DB_PATH"];
-  const explicit = env["DOMAINS_DIR"] ?? env["HASNA_DOMAINS_DIR"];
+  const explicit = exactAppOverride(env);
   if (explicit) {
-    return join2(explicit, "domains.db");
+    return join4(explicit, "domains.db");
   }
-  const home = canonicalHome(env);
-  const canonicalDir = join2(home, ".hasna", "domains");
-  migrateLegacyDataDir(env);
-  migrateDotfile("domains", canonicalDir, env);
-  return join2(canonicalDir, "domains.db");
+  if (!adoptResolverHome(resolverHome(env), env)) {
+    migrateLegacyDataDir(env);
+    migrateDotfile("domains", legacyHomeDir(env), env);
+  }
+  return getDefaultDbPath(env);
 }
 function migrateDotfile(name, newDir, env) {
   const home = canonicalHome(env);
-  const oldDir = join2(home, `.${name}`);
-  if (!existsSync(oldDir) || existsSync(newDir))
+  const oldDir = join4(home, `.${name}`);
+  if (!existsSync2(oldDir) || existsSync2(newDir))
     return;
   mkdirSync(newDir, { recursive: true });
   for (const file of readdirSync(oldDir)) {
-    const oldPath = join2(oldDir, file);
+    const oldPath = join4(oldDir, file);
     if (statSync2(oldPath).isFile())
-      copyFileSync(oldPath, join2(newDir, file));
+      copyFileSync(oldPath, join4(newDir, file));
   }
 }
 function getDatabase() {
@@ -28277,7 +28511,7 @@ function getDatabase() {
     return _db;
   const dbPath = getDbPath();
   if (dbPath !== ":memory:") {
-    const dir = dirname(resolve(dbPath));
+    const dir = dirname(resolve2(dbPath));
     mkdirSync(dir, { recursive: true });
   }
   _db = new Database(dbPath);
@@ -29168,7 +29402,7 @@ function deleteDomainReputation(id) {
 }
 
 // src/db/store.ts
-var APP = "domains";
+var APP2 = "domains";
 var DOMAINS_PAGE_SIZE = 1000;
 class LocalStore {
   transport = "local";
@@ -29781,7 +30015,7 @@ function assertNoStoreConflict(env) {
   throw new Error(`Refusing to resolve the hosted domains store while ${pathVar} is set: that variable ` + `names a local sqlite file, so the configuration asks for BOTH stores at once and ` + `nothing here can tell which you meant. Writing to the wrong one is silent \u2014 a plain ` + `\`bun run\` script that set ${pathVar} put 230 rows into the production portfolio on ` + `2026-08-07 while reporting success. Pick one: unset HASNA_DOMAINS_API_URL and ` + `HASNA_DOMAINS_API_KEY to use ${pathVar}; unset ${pathVar} to use the hosted store; or set ` + `${ALLOW_CLOUD_WITH_LOCAL_PATH}=1 if you really intend the hosted store with that variable present.`);
 }
 function requireHostedClient(env, flip) {
-  const resolved = resolveStorageClient(APP, withoutRetiredModeKeys(env));
+  const resolved = resolveStorageClient(APP2, withoutRetiredModeKeys(env));
   if (resolved.transport !== "http") {
     throw new Error(`Hosted domains client was requested (${flip.urlSource} + ${flip.keySource}) but ` + `@hasna/contracts resolved transport '${resolved.transport}'. Refusing to read the wrong dataset.`);
   }
@@ -29802,7 +30036,7 @@ import { domainToASCII } from "url";
 
 // src/lib/version.ts
 import { readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2, resolve as resolve2 } from "path";
+import { dirname as dirname2, resolve as resolve3 } from "path";
 import { fileURLToPath } from "url";
 var cachedVersion = null;
 function getPackageVersion() {
@@ -29810,7 +30044,7 @@ function getPackageVersion() {
     return cachedVersion;
   try {
     const moduleDir = dirname2(fileURLToPath(import.meta.url));
-    const packageJsonPath = resolve2(moduleDir, "../../package.json");
+    const packageJsonPath = resolve3(moduleDir, "../../package.json");
     const pkg = JSON.parse(readFileSync3(packageJsonPath, "utf8"));
     cachedVersion = pkg.version ?? "0.0.0";
   } catch {
@@ -39466,24 +39700,24 @@ async function syncAll(dbFns) {
 
 // src/lib/config.ts
 import { createHash as createHash3 } from "crypto";
-import { copyFileSync as copyFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join4 } from "path";
+import { copyFileSync as copyFileSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname4, join as join6 } from "path";
 function canonicalHome2(env) {
-  return env["HOME"] || env["USERPROFILE"] || homedir3();
+  return env["HOME"] || env["USERPROFILE"] || homedir5();
 }
 function migrateLegacyConfig(env = process.env, dryRun = false) {
   const report = { dryRun, wouldCopy: false, copied: false };
   const home = canonicalHome2(env);
-  const canonicalDir = join4(home, ".hasna", "domains");
-  const newPath = join4(canonicalDir, "config.json");
-  if (existsSync2(newPath))
+  const canonicalDir = join6(home, ".hasna", "domains");
+  const newPath = join6(canonicalDir, "config.json");
+  if (existsSync3(newPath))
     return report;
-  if (existsSync2(join4(canonicalDir, ".migrated-from-xdg-config.receipt.json")))
+  if (existsSync3(join6(canonicalDir, ".migrated-from-xdg-config.receipt.json")))
     return report;
-  const xdgConfig = env["XDG_CONFIG_HOME"]?.trim() || join4(home, ".config");
-  const oldPath = join4(xdgConfig, "open-domains", "config.json");
-  if (!existsSync2(oldPath))
+  const xdgConfig = env["XDG_CONFIG_HOME"]?.trim() || join6(home, ".config");
+  const oldPath = join6(xdgConfig, "open-domains", "config.json");
+  if (!existsSync3(oldPath))
     return report;
   report.wouldCopy = true;
   if (dryRun)
@@ -39495,7 +39729,7 @@ function migrateLegacyConfig(env = process.env, dryRun = false) {
   if (!oldBytes.equals(newBytes)) {
     throw new Error(`Refusing migration: copied ${newPath} does not byte-match ${oldPath}; the canonical config was not populated.`);
   }
-  writeFileSync2(join4(canonicalDir, ".migrated-from-xdg-config.receipt.json"), `${JSON.stringify({
+  writeFileSync2(join6(canonicalDir, ".migrated-from-xdg-config.receipt.json"), `${JSON.stringify({
     migratedAt: new Date().toISOString(),
     from: oldPath,
     to: newPath,
@@ -39511,13 +39745,15 @@ function getConfigPath(env = process.env) {
     return env["DOMAINS_CONFIG_PATH"];
   const dir = env["DOMAINS_CONFIG_DIR"];
   if (dir)
-    return join4(dir, "config.json");
-  migrateLegacyConfig(env);
-  return join4(canonicalHome2(env), ".hasna", "domains", "config.json");
+    return join6(dir, "config.json");
+  if (!adoptResolverHome(resolverHome(env), env)) {
+    migrateLegacyConfig(env);
+  }
+  return getDefaultConfigPath(env);
 }
 function loadConfig4(env = process.env) {
   const path = getConfigPath(env);
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return {};
   try {
     return JSON.parse(readFileSync5(path, "utf-8"));