@hasna/hooks 0.7.10 → 0.8.0

package/bin/index.js

@@ -1120,8 +1120,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
       args = args.slice();
       let launchWithNode = false;
       const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
-      function findFile(baseDir2, baseName) {
-        const localBin = path.resolve(baseDir2, baseName);
+      function findFile(baseDir, baseName) {
+        const localBin = path.resolve(baseDir, baseName);
         if (fs.existsSync(localBin))
           return localBin;
         if (sourceExt.includes(path.extname(baseName)))
@@ -1886,92 +1886,77 @@ var require_commander = __commonJS((exports) => {
   exports.InvalidOptionArgumentError = InvalidArgumentError;
 });
 
-// ../../node_modules/.bun/@hasna+paths@0.1.0/node_modules/@hasna/paths/dist/index.js
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
-function assertApp2(app) {
+// src/lib/app-home.ts
+import { existsSync as existsSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3, resolve as resolve2 } from "path";
+import { homedir as pathsResolverHomedir2 } from "os";
+import { join as pathsResolverJoin2 } from "path";
+function pathsResolverAssertApp2(app) {
   if (typeof app !== "string" || app.length === 0) {
     throw new TypeError("paths: app must be a non-empty string");
   }
-  if (!APP_SLUG_RE2.test(app)) {
+  if (!PATHS_RESOLVER_APP_SLUG_RE2.test(app)) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function envOf2(options) {
-  return options.env ?? process.env;
-}
-function envValue2(options, kind) {
-  const value = envOf2(options)[KIND_ENV2[kind]];
-  return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-function isMacOS2(platform) {
-  return platform === "darwin";
+function pathsResolverAssertKind2(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV2).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV2).join(", ")}`);
+  }
 }
-function baseDir2(kind, options) {
-  const override = envValue2(options, kind);
-  if (override)
+function pathsResolverBaseDir2(kind, options) {
+  pathsResolverAssertKind2(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV2[kind]];
+  if (typeof override === "string" && override.length > 0)
     return override;
-  const home = options.home ?? homedir3();
+  const home = options.home ?? pathsResolverHomedir2();
   const platform = options.platform ?? process.platform;
-  if (isMacOS2(platform)) {
+  if (platform === "darwin") {
     switch (kind) {
       case "config":
       case "data":
-        return join4(home, "Library", "Application Support", "Hasna");
+        return pathsResolverJoin2(home, "Library", "Application Support", "Hasna");
       case "cache":
-        return join4(home, "Library", "Caches", "Hasna");
+        return pathsResolverJoin2(home, "Library", "Caches", "Hasna");
       case "state":
-        return join4(home, "Library", "Logs", "Hasna");
+        return pathsResolverJoin2(home, "Library", "Logs", "Hasna");
     }
   }
   switch (kind) {
     case "config":
-      return join4(home, ".config", "hasna");
+      return pathsResolverJoin2(home, ".config", "hasna");
     case "data":
-      return join4(home, ".local", "share", "hasna");
+      return pathsResolverJoin2(home, ".local", "share", "hasna");
     case "state":
-      return join4(home, ".local", "state", "hasna");
+      return pathsResolverJoin2(home, ".local", "state", "hasna");
     case "cache":
-      return join4(home, ".cache", "hasna");
+      return pathsResolverJoin2(home, ".cache", "hasna");
   }
 }
-function resolvePath2(kind, options) {
-  assertApp2(options.app);
-  const appSegment = options.internal === true ? join4("internal", options.app) : options.app;
-  return join4(baseDir2(kind, options), appSegment);
+function pathsResolverResolve2(kind, options) {
+  pathsResolverAssertApp2(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin2("internal", options.app) : options.app;
+  return pathsResolverJoin2(pathsResolverBaseDir2(kind, options), appSegment);
 }
 function dataDir2(options) {
-  return resolvePath2("data", options);
+  return pathsResolverResolve2("data", options);
 }
-var KIND_ENV2, APP_SLUG_RE2;
-var init_dist = __esm(() => {
-  KIND_ENV2 = {
-    config: "HASNA_CONFIG_HOME",
-    data: "HASNA_DATA_HOME",
-    state: "HASNA_STATE_HOME",
-    cache: "HASNA_CACHE_HOME"
-  };
-  APP_SLUG_RE2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-});
-
-// src/lib/app-home.ts
-import { existsSync as existsSync3 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join6, resolve as resolve2 } from "path";
 function getHomeDir(env = process.env) {
-  return env.HOME || env.USERPROFILE || homedir5();
+  return env.HOME || env.USERPROFILE || homedir2();
 }
 function getResolverDataRoot(env = process.env) {
   return dataDir2({ app: "hooks", home: getHomeDir(env), env });
 }
 function getLegacyDataRoot(env = process.env) {
-  return join6(getHomeDir(env), ".hasna", "hooks");
+  return join3(getHomeDir(env), ".hasna", "hooks");
 }
 function adoptResolverDataRoot(resolved, env = process.env) {
   const dataOverride = env.HASNA_DATA_HOME;
   if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
     return true;
-  return existsSync3(join6(resolved, STORE_MARKER));
+  return existsSync3(join3(resolved, STORE_MARKER));
 }
 function getExplicitDataDir(env = process.env) {
   const dir = env.HASNA_HOOKS_DATA_DIR ?? env.HOOKS_DATA_DIR;
@@ -1999,7 +1984,7 @@ function getReportedDbPath(env = process.env) {
   const explicit = getExplicitDbPath(env);
   if (explicit)
     return explicit;
-  return join6(getEffectiveDataRoot(env), "hooks.db");
+  return join3(getEffectiveDataRoot(env), "hooks.db");
 }
 function getExplicitDbPath(env = process.env) {
   const db = env.HASNA_HOOKS_DB_PATH ?? env.HOOKS_DB_PATH;
@@ -2007,9 +1992,15 @@ function getExplicitDbPath(env = process.env) {
     return db.trim();
   return;
 }
-var STORE_MARKER = "hooks.db";
+var PATHS_RESOLVER_KIND_ENV2, PATHS_RESOLVER_APP_SLUG_RE2, STORE_MARKER = "hooks.db";
 var init_app_home = __esm(() => {
-  init_dist();
+  PATHS_RESOLVER_KIND_ENV2 = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  PATHS_RESOLVER_APP_SLUG_RE2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 });
 
 // src/lib/registry.ts
@@ -4196,690 +4187,294 @@ var require_cli_spinners = __commonJS((exports, module) => {
   module.exports = spinners;
 });
 
-// ../contracts/dist/client/transport.js
-import { readFileSync, statSync } from "fs";
-import { createRequire } from "module";
-import { join as join7 } from "path";
-function envToken(name) {
-  return name.toUpperCase().replace(/-/g, "_");
-}
-function clientTransportEnvKeys(name) {
-  const envSegment = envToken(name);
-  return {
-    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
-    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
-  };
+// src/config.ts
+import { join as join5 } from "path";
+function getHooksDataDir() {
+  return getEffectiveDataRoot();
 }
-function credentialOverrideEnvKey(name) {
-  return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
+function getCustomHooksDir() {
+  return join5(getHooksDataDir(), "hooks");
 }
-function credentialPointerEnvKey(name) {
-  return `HASNA_${envToken(name)}_API_KEY_REF`;
+function getLockPath() {
+  const explicit = process.env.HASNA_HOOKS_LOCK_PATH ?? process.env.HOOKS_LOCK_PATH;
+  if (explicit)
+    return explicit;
+  return join5(getHooksDataDir(), "hooks.lock");
 }
-function homeDir(env) {
-  const home = env.HOME?.trim();
-  return home ? home : null;
+var init_config = __esm(() => {
+  init_app_home();
+});
+
+// src/lib/semver.ts
+var NUMERIC_ID = "(0|[1-9]\\d{0,15})", ALNUM_ID = "\\d*[A-Za-z-][0-9A-Za-z-]*", SEMVER_PATTERN;
+var init_semver = __esm(() => {
+  SEMVER_PATTERN = new RegExp(`^${NUMERIC_ID}\\.${NUMERIC_ID}\\.${NUMERIC_ID}` + `(?:-(?:${NUMERIC_ID}|${ALNUM_ID})(?:\\.(?:${NUMERIC_ID}|${ALNUM_ID}))*)?` + `(?:\\+[0-9A-Za-z.-]+)?$`);
+});
+
+// src/lib/manifest.ts
+var exports_manifest = {};
+__export(exports_manifest, {
+  writeCustomHook: () => writeCustomHook,
+  shortManifestName: () => shortManifestName,
+  scriptRelFor: () => scriptRelFor,
+  resolveScript: () => resolveScript,
+  readCustomManifest: () => readCustomManifest,
+  parseManifest: () => parseManifest,
+  normalizeManifestName: () => normalizeManifestName,
+  manifestSchema: () => manifestSchema,
+  listCustomHooks: () => listCustomHooks,
+  isInlineScript: () => isInlineScript,
+  customHookDir: () => customHookDir,
+  assertContained: () => assertContained,
+  ScriptContainmentError: () => ScriptContainmentError,
+  HOOK_NAME_RE: () => HOOK_NAME_RE
+});
+import { existsSync as existsSync5, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "fs";
+import { basename, dirname, isAbsolute, join as join6, normalize, resolve as resolve3, sep } from "path";
+import { z } from "zod";
+function parseManifest(json) {
+  const parsed = JSON.parse(json);
+  return manifestSchema.parse(parsed);
 }
-function credentialDiskSourceList(name, env, profile = null) {
-  const home = homeDir(env);
-  if (!home || !SAFE_APP_SLUG.test(name))
-    return [];
-  const stem = profile ? `${name}.${profile}` : name;
-  const configStem = profile ? `${name}-${profile}` : name;
-  return [
-    {
-      path: join7(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
-      tier: "fleet-env",
-      deprecated: false
-    },
-    {
-      path: join7(home, HASNA_STATE_DIR, LEGACY_CLOUD_DIR, `${stem}.env`),
-      tier: "legacy-cloud",
-      deprecated: true
-    },
-    {
-      path: join7(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}.env`),
-      tier: "config",
-      deprecated: false
-    },
-    {
-      path: join7(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`),
-      tier: "config-legacy",
-      deprecated: true
-    }
-  ];
+function normalizeManifestName(name) {
+  return name.startsWith("hook-") ? name : `hook-${name}`;
 }
-function credentialDiskSources(name, env) {
-  return credentialDiskSourceList(name, env, null).map((s) => s.path);
+function shortManifestName(name) {
+  return name.startsWith("hook-") ? name.slice("hook-".length) : name;
 }
-function profileDiskSources(name, env, profile) {
-  return credentialDiskSourceList(name, env, profile).map((s) => s.path);
+function isWithin(child, parent) {
+  return child === parent || child.startsWith(parent + sep);
 }
-function parseEnvFile(text) {
-  const values = new Map;
-  for (const rawLine of text.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (line.length === 0 || line.startsWith("#"))
-      continue;
-    const withoutExport = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
-    const equals = withoutExport.indexOf("=");
-    if (equals <= 0)
-      continue;
-    const key = withoutExport.slice(0, equals).trim();
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
-      continue;
-    let value = withoutExport.slice(equals + 1).trim();
-    const quote = value[0];
-    if (quote === '"' || quote === "'") {
-      if (value.length < 2 || !value.endsWith(quote))
-        continue;
-      value = value.slice(1, -1);
-    }
-    if (value.length === 0)
-      continue;
-    values.set(key, value);
+function assertContainedLexical(target, root, raw) {
+  const lexical = resolve3(target);
+  const rootLexical = resolve3(root);
+  if (!isWithin(lexical, rootLexical)) {
+    throw new ScriptContainmentError(target, root, raw);
   }
-  return values;
+  return lexical;
 }
-function readAppConfigFile(path) {
-  let text;
-  try {
-    const stats = statSync(path);
-    if (!stats.isFile() || stats.size > MAX_CREDENTIAL_FILE_BYTES)
-      return null;
-    text = readFileSync(path, "utf8");
-  } catch {
-    return null;
+function realpathNearest(path) {
+  const tail = [];
+  let cur = path;
+  while (!existsSync5(cur)) {
+    const parent = dirname(cur);
+    if (parent === cur)
+      break;
+    tail.unshift(basename(cur));
+    cur = parent;
   }
-  return parseEnvFile(text);
+  return join6(realpathSync(cur), ...tail);
 }
-function readCredentialFile(path, apiKeyKeys) {
-  const values = readAppConfigFile(path);
-  if (!values)
-    return null;
-  for (const key of apiKeyKeys) {
-    const value = values.get(key)?.trim();
-    if (value)
-      return value;
+function assertContainedReal(root, target, raw) {
+  const rootReal = realpathSync(root);
+  const targetReal = realpathNearest(target);
+  if (!isWithin(targetReal, rootReal)) {
+    throw new ScriptContainmentError(target, root, raw);
   }
-  return null;
 }
-function assertUsableCredential(appName, source, value) {
-  if (VAULT_POINTER_SHAPE.test(value)) {
-    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+function assertContained(target, root, raw) {
+  const lexical = assertContainedLexical(target, root, raw);
+  assertContainedReal(root, lexical, raw);
+  return lexical;
+}
+function isInlineScript(manifest) {
+  return manifest.script_kind === "inline" || manifest.script_kind === undefined && manifest.script.includes(`
+`);
+}
+function scriptRelFor(manifest) {
+  if (isInlineScript(manifest)) {
+    const ext = manifest.script.trim().startsWith("#!") ? ".sh" : ".ts";
+    return `script${ext}`;
   }
-  if (!ILLEGAL_IN_HEADER_VALUE.test(value))
-    return;
-  throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
+  const rel = normalize(manifest.script);
+  if (isAbsolute(rel)) {
+    throw new Error(`manifest script must be relative or inline, got absolute path '${manifest.script}'`);
+  }
+  return rel;
 }
-function sealCredential(fields) {
-  const { apiKey } = fields;
-  const visible = {
-    tier: fields.tier,
-    source: fields.source,
-    deliberate: fields.deliberate,
-    deprecated: fields.deprecated,
-    diskCandidates: Object.freeze([...fields.diskCandidates]),
-    warning: fields.warning
-  };
-  const sealed = { ...visible };
-  Object.defineProperty(sealed, "apiKey", {
-    value: apiKey,
-    enumerable: false,
-    writable: false,
-    configurable: false
-  });
-  if (fields.pointerVaultKey !== undefined) {
-    Object.defineProperty(sealed, "pointerVaultKey", {
-      value: fields.pointerVaultKey,
-      enumerable: false,
-      writable: false,
-      configurable: false
-    });
+function resolveScript(manifest, manifestDir) {
+  if (isInlineScript(manifest))
+    return { path: scriptRelFor(manifest), content: manifest.script };
+  const rel = scriptRelFor(manifest);
+  const resolved = assertContained(join6(manifestDir, rel), manifestDir, manifest.script);
+  if (!existsSync5(resolved)) {
+    throw new Error(`manifest script file not found: ${resolved}`);
   }
-  Object.defineProperty(sealed, INSPECT_CUSTOM, {
-    value: () => ({ ...visible, apiKey: "[redacted]" }),
-    enumerable: false,
-    writable: false,
-    configurable: false
-  });
-  Object.defineProperty(sealed, CREDENTIAL_SEAL, {
-    value: true,
-    enumerable: false,
-    writable: false,
-    configurable: false
-  });
-  return Object.freeze(sealed);
+  return { path: rel, content: readFileSync(resolved, "utf-8") };
 }
-function firstEnvValue(env, keys) {
-  for (const key of keys) {
-    const value = env[key]?.trim();
-    if (value)
-      return { key, value };
+function customHookDir(name) {
+  return join6(getCustomHooksDir(), shortManifestName(name));
+}
+function readCustomManifest(name) {
+  const dir = customHookDir(name);
+  const manifestPath = join6(dir, "manifest.json");
+  if (!existsSync5(manifestPath))
+    return;
+  try {
+    const manifest = parseManifest(readFileSync(manifestPath, "utf-8"));
+    const script = resolveScript(manifest, dir);
+    const scriptIsInline = isInlineScript(manifest);
+    return { manifest, scriptPath: join6(dir, script.path), scriptContent: script.content, scriptIsInline };
+  } catch (err) {
+    if (err instanceof ScriptContainmentError)
+      throw err;
+    return;
   }
-  return null;
 }
-function deprecationNotified() {
-  const host = globalThis;
-  const existing = host[DEPRECATION_REGISTRY];
-  if (existing instanceof Set)
-    return existing;
-  const created = new Set;
-  host[DEPRECATION_REGISTRY] = created;
-  return created;
-}
-function defaultDeprecationSink(message) {
-  if (typeof process !== "undefined" && process.stderr) {
-    process.stderr.write(`${message}
-`);
+function listCustomHooks() {
+  const dir = getCustomHooksDir();
+  if (!existsSync5(dir))
+    return [];
+  const results = [];
+  for (const entry of readdirSafe(dir)) {
+    const parsed = readCustomManifest(entry);
+    if (parsed)
+      results.push(parsed);
   }
+  return results.sort((a, b) => a.manifest.name.localeCompare(b.manifest.name));
 }
-function resolveCredential(name, env, options = {}) {
-  const { apiKeyKeys } = clientTransportEnvKeys(name);
-  const diskPaths = credentialDiskSources(name, env);
-  const explicitKey = options.apiKey?.trim();
-  if (explicitKey) {
-    assertUsableCredential(name, "the explicit apiKey argument", explicitKey);
-    return sealCredential({
-      apiKey: explicitKey,
-      tier: "argument",
-      source: "explicit apiKey argument",
-      deliberate: true,
-      deprecated: false,
-      diskCandidates: diskPaths,
-      warning: null
-    });
-  }
-  const overrideKeyName = credentialOverrideEnvKey(name);
-  const overrideRaw = env[overrideKeyName];
-  if (overrideRaw !== undefined) {
-    const override = overrideRaw.trim();
-    if (!override) {
-      throw new CredentialResolutionError(name, `${overrideKeyName} is set but empty. It is a deliberate override, so it is not resolved around: ` + `either give it a real key or unset it to fall back to the credential on disk.`, [overrideKeyName]);
-    }
-    assertUsableCredential(name, overrideKeyName, override);
-    return sealCredential({
-      apiKey: override,
-      tier: "override",
-      source: overrideKeyName,
-      deliberate: true,
-      deprecated: false,
-      diskCandidates: diskPaths,
-      warning: null
-    });
-  }
-  const pointerKeyName = credentialPointerEnvKey(name);
-  const pointerRaw = env[pointerKeyName];
-  if (pointerRaw !== undefined) {
-    const pointer = pointerRaw.trim();
-    if (!pointer) {
-      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
-    }
-    if (!VAULT_POINTER_SHAPE.test(pointer)) {
-      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
-    }
-    return sealCredential({
-      apiKey: "",
-      pointerVaultKey: pointer,
-      tier: "pointer",
-      source: pointerKeyName,
-      deliberate: true,
-      deprecated: false,
-      diskCandidates: diskPaths,
-      warning: null
-    });
-  }
-  const profile = options.profile?.trim() || env[CREDENTIAL_PROFILE_ENV_KEY]?.trim();
-  if (profile) {
-    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
-    if (!SAFE_PROFILE.test(profile)) {
-      throw new CredentialResolutionError(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
-    }
-    const paths = profileDiskSources(name, env, profile);
-    for (const path of paths) {
-      const value = readCredentialFile(path, apiKeyKeys);
-      if (value) {
-        assertUsableCredential(name, path, value);
-        return sealCredential({
-          apiKey: value,
-          tier: "profile",
-          source: path,
-          deliberate: true,
-          deprecated: false,
-          diskCandidates: paths,
-          warning: null
-        });
-      }
-    }
-    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
-  }
-  const diskSourceList = credentialDiskSourceList(name, env, null);
-  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
-  if (diskHits.length > 0) {
-    const winner = diskHits[0];
-    assertUsableCredential(name, winner.src.path, winner.value);
-    const divergentSources = [
-      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
-      ...(() => {
-        const legacyHit = firstEnvValue(env, apiKeyKeys);
-        return legacyHit && legacyHit.value !== winner.value ? [legacyHit.key] : [];
-      })()
-    ];
-    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
-    let deprecated = winner.src.deprecated;
-    let finalWarning = warning;
-    if (winner.src.deprecated) {
-      deprecated = true;
-      const sink = options.onDeprecation ?? defaultDeprecationSink;
-      const notified = deprecationNotified();
-      const noticeKey = `${name}:${winner.src.path}`;
-      if (!notified.has(noticeKey)) {
-        notified.add(noticeKey);
-        const target = diskSourceList[0]?.path ?? "<none>";
-        const message = `[${name}] DEPRECATED: the API key came from ${winner.src.path} \u2014 a legacy credential location. ` + `The primary location is ${target} (~/.hasna/fleet-env/<app>.env). The legacy 'cloud' tiers are ` + `removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}. Migrate the key to the primary location.`;
-        sink(message);
-      }
-      finalWarning = [warning, `Legacy credential source: ${winner.src.path}. Removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}.`].filter(Boolean).join(" ") || null;
-    }
-    return sealCredential({
-      apiKey: winner.value,
-      tier: winner.src.tier,
-      source: winner.src.path,
-      deliberate: false,
-      deprecated,
-      diskCandidates: diskPaths,
-      warning: finalWarning
-    });
+function writeCustomHook(name, manifest, scriptContent, scriptRelPath) {
+  const dir = customHookDir(name);
+  if (isAbsolute(scriptRelPath)) {
+    throw new ScriptContainmentError(scriptRelPath, dir);
   }
-  const legacy = firstEnvValue(env, apiKeyKeys);
-  if (legacy) {
-    assertUsableCredential(name, legacy.key, legacy.value);
-    const where = diskPaths.length > 0 ? `Put the current key in ${diskPaths[0]} \u2014 it is re-read on every call, so rotations take effect immediately.` : `This environment has no HOME, so no credential file could be consulted at all; the disk tier is ` + `unavailable here and this process will keep using the environment snapshot.`;
-    const message = `[${name}] DEPRECATED: the API key came from ${legacy.key} in this process's environment. ` + `Environment variables are a snapshot taken when this process started, so a shell that started ` + `before a key rotation keeps using the old key until it exits. ${where}`;
-    const sink = options.onDeprecation ?? defaultDeprecationSink;
-    const notified = deprecationNotified();
-    if (!notified.has(name)) {
-      notified.add(name);
-      sink(message);
-    }
-    return sealCredential({
-      apiKey: legacy.value,
-      tier: "legacy-env",
-      source: legacy.key,
-      deliberate: false,
-      deprecated: true,
-      diskCandidates: diskPaths,
-      warning: message
-    });
+  const scriptPath = scriptRelPath.includes("/") ? join6(dir, scriptRelPath) : join6(dir, scriptRelPath);
+  assertContainedLexical(scriptPath, dir, scriptRelPath);
+  mkdirSync(dir, { recursive: true });
+  assertContainedReal(dir, scriptPath, scriptRelPath);
+  const scriptDir = dirname(scriptPath);
+  if (scriptDir !== dir)
+    mkdirSync(scriptDir, { recursive: true });
+  writeFileSync(scriptPath, scriptContent, "utf-8");
+  writeFileSync(join6(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + `
+`, "utf-8");
+  return { dir, scriptPath };
+}
+function readdirSafe(dir) {
+  try {
+    return readdirSync(dir);
+  } catch {
+    return [];
   }
-  return null;
 }
-var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, HASNA_STATE_DIR = ".hasna", FLEET_CREDENTIAL_DIR = "fleet-env", LEGACY_CLOUD_DIR = "cloud", CONFIG_DIR = ".config", CONFIG_NAMESPACE = "hasna", LEGACY_CLOUD_REMOVAL_DEADLINE = "2026-10-01", MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, INSPECT_CUSTOM, CREDENTIAL_SEAL, DEPRECATION_REGISTRY, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
-var init_transport = __esm(() => {
-  CredentialResolutionError = class CredentialResolutionError extends Error {
-    appName;
-    attempted;
-    constructor(appName, message, attempted) {
-      super(message);
-      this.name = "CredentialResolutionError";
-      this.appName = appName;
-      this.attempted = attempted;
+var HOOK_NAME_RE, manifestSchema, ScriptContainmentError;
+var init_manifest = __esm(() => {
+  init_config();
+  init_semver();
+  HOOK_NAME_RE = /^[\w-]+$/;
+  manifestSchema = z.object({
+    name: z.string().regex(HOOK_NAME_RE, "hook name must be /^[\\w-]+$/"),
+    version: z.string().regex(SEMVER_PATTERN, "version must be full semver (e.g. 1.2.3 or 1.2.3-beta.1)"),
+    description: z.string().optional(),
+    events: z.array(z.string()).min(1, "at least one event is required"),
+    script: z.string().min(1, "script must name a relative path or inline content"),
+    script_kind: z.enum(["inline", "file"]).optional(),
+    args: z.array(z.string()).optional(),
+    timeout_ms: z.number().int().positive().optional(),
+    env: z.record(z.string(), z.string()).optional()
+  });
+  ScriptContainmentError = class ScriptContainmentError extends Error {
+    constructor(path, hookDir, raw) {
+      super(raw && raw !== path ? `manifest script escapes the hook directory: '${path}' (from '${raw}') resolves outside '${hookDir}'` : `manifest script escapes the hook directory: '${path}' resolves outside '${hookDir}'`);
+      this.name = "ScriptContainmentError";
     }
   };
-  MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
-  SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
-  SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
-  ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
-  VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
-  INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
-  CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
-  DEPRECATION_REGISTRY = Symbol.for("hasna:contracts:credentialDeprecationNotices");
-  SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
-  requireSecretsSdk = createRequire(import.meta.url);
-  IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-  AUTHORITY_OVERRIDE_HEADERS = new Set([
-    "host",
-    ":authority",
-    "forwarded",
-    "x-forwarded-host",
-    "x-original-host"
-  ]);
 });
 
-// src/config.ts
-var exports_config = {};
-__export(exports_config, {
-  writeConfig: () => writeConfig,
-  resolveApiUrl: () => resolveApiUrl,
-  resolveApiKey: () => resolveApiKey,
-  readConfig: () => readConfig,
-  getLockPath: () => getLockPath,
-  getHooksDataDir: () => getHooksDataDir,
-  getCustomHooksDir: () => getCustomHooksDir,
-  getConfigPath: () => getConfigPath
+// src/lib/resolve.ts
+var exports_resolve = {};
+__export(exports_resolve, {
+  resolveScriptPath: () => resolveScriptPath,
+  resolveHookMeta: () => resolveHookMeta,
+  resolveHookDir: () => resolveHookDir,
+  resolveHook: () => resolveHook,
+  resolveBundledHooksDir: () => resolveBundledHooksDir
 });
-import { existsSync as existsSync5, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { join as join8 } from "path";
-function getHooksDataDir() {
-  return getEffectiveDataRoot();
-}
-function getCustomHooksDir() {
-  return join8(getHooksDataDir(), "hooks");
+import { dirname as dirname2, join as join7 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { fileURLToPath } from "url";
+function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
+  const sourceLayout = join7(moduleDir, "..", "..", "hooks");
+  if (existsSync6(join7(sourceLayout, "hook-gitguard")))
+    return sourceLayout;
+  return join7(moduleDir, "..", "hooks");
 }
-function getLockPath() {
-  const explicit = process.env.HASNA_HOOKS_LOCK_PATH ?? process.env.HOOKS_LOCK_PATH;
-  if (explicit)
-    return explicit;
-  return join8(getHooksDataDir(), "hooks.lock");
+function resolveHookDir(name) {
+  const custom = readCustomManifest(name);
+  if (custom)
+    return customHookDir(name);
+  const meta = getHook(shortManifestName(name));
+  if (!meta)
+    return;
+  const short = shortManifestName(name);
+  const bundledBase = resolveBundledHooksDir();
+  const direct = join7(bundledBase, short);
+  if (existsSync6(direct))
+    return direct;
+  const prefixed = join7(bundledBase, `hook-${short}`);
+  return existsSync6(prefixed) ? prefixed : undefined;
 }
-function getConfigPath() {
-  const explicit = process.env.HASNA_HOOKS_CONFIG_PATH ?? process.env.HOOKS_CONFIG_PATH;
-  if (explicit)
-    return explicit;
-  return join8(getHooksDataDir(), "config.json");
+function resolveScriptPath(name) {
+  const custom = readCustomManifest(name);
+  if (custom)
+    return custom.scriptPath;
+  const dir = resolveHookDir(name);
+  if (!dir)
+    return;
+  const script = join7(dir, "src", "hook.ts");
+  return existsSync6(script) ? script : undefined;
 }
-function readConfig() {
-  try {
-    const path = getConfigPath();
-    if (!existsSync5(path))
-      return {};
-    return JSON.parse(readFileSync2(path, "utf-8"));
-  } catch {
-    return {};
+function resolveHookMeta(name) {
+  const custom = readCustomManifest(name);
+  if (custom) {
+    const { manifest } = custom;
+    return {
+      name: shortManifestName(manifest.name),
+      displayName: manifest.description ? manifest.name : manifest.name,
+      description: manifest.description ?? "Custom hook",
+      version: manifest.version,
+      category: "Workflow Automation",
+      event: manifest.events[0] ?? "PostToolUse",
+      events: manifest.events,
+      matcher: "",
+      tags: ["custom"]
+    };
   }
+  return getHook(shortManifestName(name));
 }
-function writeConfig(config) {
-  const path = getConfigPath();
-  mkdirSync(join8(path, ".."), { recursive: true });
-  writeFileSync(path, JSON.stringify(config, null, 2) + `
-`, "utf-8");
-  return path;
-}
-function resolveApiUrl() {
-  const envUrl = process.env.HASNA_HOOKS_API_URL ?? process.env.HOOKS_API_URL ?? process.env.HASNA_HOOKS_REGISTRY_URL ?? process.env.HOOKS_REGISTRY_URL;
-  if (envUrl)
-    return envUrl.replace(/\/+$/, "");
-  const cfg = readConfig();
-  return cfg.api_url ? cfg.api_url.replace(/\/+$/, "") : undefined;
-}
-function resolveApiKey() {
-  return resolveCredential("hooks", process.env)?.apiKey;
+function resolveHook(name) {
+  const custom = readCustomManifest(name);
+  if (custom) {
+    const meta2 = resolveHookMeta(name);
+    return {
+      name: shortManifestName(custom.manifest.name),
+      source: "custom",
+      version: custom.manifest.version,
+      events: custom.manifest.events,
+      description: custom.manifest.description ?? "Custom hook",
+      scriptPath: custom.scriptPath,
+      meta: meta2,
+      timeoutMs: custom.manifest.timeout_ms ?? null
+    };
+  }
+  const meta = getHook(shortManifestName(name));
+  const scriptPath = resolveScriptPath(name);
+  if (!meta || !scriptPath)
+    return;
+  return {
+    name: shortManifestName(name),
+    source: "bundled",
+    version: meta.version,
+    events: meta.events && meta.events.length > 0 ? meta.events : [meta.event],
+    description: meta.description,
+    scriptPath,
+    meta,
+    timeoutMs: null
+  };
 }
-var init_config = __esm(() => {
-  init_transport();
-  init_app_home();
-});
-
-// src/lib/semver.ts
-var NUMERIC_ID = "(0|[1-9]\\d{0,15})", ALNUM_ID = "\\d*[A-Za-z-][0-9A-Za-z-]*", SEMVER_PATTERN;
-var init_semver = __esm(() => {
-  SEMVER_PATTERN = new RegExp(`^${NUMERIC_ID}\\.${NUMERIC_ID}\\.${NUMERIC_ID}` + `(?:-(?:${NUMERIC_ID}|${ALNUM_ID})(?:\\.(?:${NUMERIC_ID}|${ALNUM_ID}))*)?` + `(?:\\+[0-9A-Za-z.-]+)?$`);
-});
-
-// src/lib/manifest.ts
-var exports_manifest = {};
-__export(exports_manifest, {
-  writeCustomHook: () => writeCustomHook,
-  shortManifestName: () => shortManifestName,
-  scriptRelFor: () => scriptRelFor,
-  resolveScript: () => resolveScript,
-  readCustomManifest: () => readCustomManifest,
-  parseManifest: () => parseManifest,
-  normalizeManifestName: () => normalizeManifestName,
-  manifestSchema: () => manifestSchema,
-  listCustomHooks: () => listCustomHooks,
-  isInlineScript: () => isInlineScript,
-  customHookDir: () => customHookDir,
-  assertContained: () => assertContained,
-  ScriptContainmentError: () => ScriptContainmentError,
-  HOOK_NAME_RE: () => HOOK_NAME_RE
-});
-import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync3, readdirSync, realpathSync, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname, isAbsolute, join as join9, normalize, resolve as resolve3, sep } from "path";
-import { z } from "zod";
-function parseManifest(json) {
-  const parsed = JSON.parse(json);
-  return manifestSchema.parse(parsed);
-}
-function normalizeManifestName(name) {
-  return name.startsWith("hook-") ? name : `hook-${name}`;
-}
-function shortManifestName(name) {
-  return name.startsWith("hook-") ? name.slice("hook-".length) : name;
-}
-function isWithin(child, parent) {
-  return child === parent || child.startsWith(parent + sep);
-}
-function assertContainedLexical(target, root, raw) {
-  const lexical = resolve3(target);
-  const rootLexical = resolve3(root);
-  if (!isWithin(lexical, rootLexical)) {
-    throw new ScriptContainmentError(target, root, raw);
-  }
-  return lexical;
-}
-function realpathNearest(path) {
-  const tail = [];
-  let cur = path;
-  while (!existsSync6(cur)) {
-    const parent = dirname(cur);
-    if (parent === cur)
-      break;
-    tail.unshift(basename(cur));
-    cur = parent;
-  }
-  return join9(realpathSync(cur), ...tail);
-}
-function assertContainedReal(root, target, raw) {
-  const rootReal = realpathSync(root);
-  const targetReal = realpathNearest(target);
-  if (!isWithin(targetReal, rootReal)) {
-    throw new ScriptContainmentError(target, root, raw);
-  }
-}
-function assertContained(target, root, raw) {
-  const lexical = assertContainedLexical(target, root, raw);
-  assertContainedReal(root, lexical, raw);
-  return lexical;
-}
-function isInlineScript(manifest) {
-  return manifest.script_kind === "inline" || manifest.script_kind === undefined && manifest.script.includes(`
-`);
-}
-function scriptRelFor(manifest) {
-  if (isInlineScript(manifest)) {
-    const ext = manifest.script.trim().startsWith("#!") ? ".sh" : ".ts";
-    return `script${ext}`;
-  }
-  const rel = normalize(manifest.script);
-  if (isAbsolute(rel)) {
-    throw new Error(`manifest script must be relative or inline, got absolute path '${manifest.script}'`);
-  }
-  return rel;
-}
-function resolveScript(manifest, manifestDir) {
-  if (isInlineScript(manifest))
-    return { path: scriptRelFor(manifest), content: manifest.script };
-  const rel = scriptRelFor(manifest);
-  const resolved = assertContained(join9(manifestDir, rel), manifestDir, manifest.script);
-  if (!existsSync6(resolved)) {
-    throw new Error(`manifest script file not found: ${resolved}`);
-  }
-  return { path: rel, content: readFileSync3(resolved, "utf-8") };
-}
-function customHookDir(name) {
-  return join9(getCustomHooksDir(), shortManifestName(name));
-}
-function readCustomManifest(name) {
-  const dir = customHookDir(name);
-  const manifestPath = join9(dir, "manifest.json");
-  if (!existsSync6(manifestPath))
-    return;
-  try {
-    const manifest = parseManifest(readFileSync3(manifestPath, "utf-8"));
-    const script = resolveScript(manifest, dir);
-    const scriptIsInline = isInlineScript(manifest);
-    return { manifest, scriptPath: join9(dir, script.path), scriptContent: script.content, scriptIsInline };
-  } catch (err) {
-    if (err instanceof ScriptContainmentError)
-      throw err;
-    return;
-  }
-}
-function listCustomHooks() {
-  const dir = getCustomHooksDir();
-  if (!existsSync6(dir))
-    return [];
-  const results = [];
-  for (const entry of readdirSafe(dir)) {
-    const parsed = readCustomManifest(entry);
-    if (parsed)
-      results.push(parsed);
-  }
-  return results.sort((a, b) => a.manifest.name.localeCompare(b.manifest.name));
-}
-function writeCustomHook(name, manifest, scriptContent, scriptRelPath) {
-  const dir = customHookDir(name);
-  if (isAbsolute(scriptRelPath)) {
-    throw new ScriptContainmentError(scriptRelPath, dir);
-  }
-  const scriptPath = scriptRelPath.includes("/") ? join9(dir, scriptRelPath) : join9(dir, scriptRelPath);
-  assertContainedLexical(scriptPath, dir, scriptRelPath);
-  mkdirSync2(dir, { recursive: true });
-  assertContainedReal(dir, scriptPath, scriptRelPath);
-  const scriptDir = dirname(scriptPath);
-  if (scriptDir !== dir)
-    mkdirSync2(scriptDir, { recursive: true });
-  writeFileSync2(scriptPath, scriptContent, "utf-8");
-  writeFileSync2(join9(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + `
-`, "utf-8");
-  return { dir, scriptPath };
-}
-function readdirSafe(dir) {
-  try {
-    return readdirSync(dir);
-  } catch {
-    return [];
-  }
-}
-var HOOK_NAME_RE, manifestSchema, ScriptContainmentError;
-var init_manifest = __esm(() => {
-  init_config();
-  init_semver();
-  HOOK_NAME_RE = /^[\w-]+$/;
-  manifestSchema = z.object({
-    name: z.string().regex(HOOK_NAME_RE, "hook name must be /^[\\w-]+$/"),
-    version: z.string().regex(SEMVER_PATTERN, "version must be full semver (e.g. 1.2.3 or 1.2.3-beta.1)"),
-    description: z.string().optional(),
-    events: z.array(z.string()).min(1, "at least one event is required"),
-    script: z.string().min(1, "script must name a relative path or inline content"),
-    script_kind: z.enum(["inline", "file"]).optional(),
-    args: z.array(z.string()).optional(),
-    timeout_ms: z.number().int().positive().optional(),
-    env: z.record(z.string(), z.string()).optional()
-  });
-  ScriptContainmentError = class ScriptContainmentError extends Error {
-    constructor(path, hookDir, raw) {
-      super(raw && raw !== path ? `manifest script escapes the hook directory: '${path}' (from '${raw}') resolves outside '${hookDir}'` : `manifest script escapes the hook directory: '${path}' resolves outside '${hookDir}'`);
-      this.name = "ScriptContainmentError";
-    }
-  };
-});
-
-// src/lib/resolve.ts
-var exports_resolve = {};
-__export(exports_resolve, {
-  resolveScriptPath: () => resolveScriptPath,
-  resolveHookMeta: () => resolveHookMeta,
-  resolveHookDir: () => resolveHookDir,
-  resolveHook: () => resolveHook,
-  resolveBundledHooksDir: () => resolveBundledHooksDir
-});
-import { dirname as dirname2, join as join10 } from "path";
-import { existsSync as existsSync7 } from "fs";
-import { fileURLToPath } from "url";
-function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
-  const sourceLayout = join10(moduleDir, "..", "..", "hooks");
-  if (existsSync7(join10(sourceLayout, "hook-gitguard")))
-    return sourceLayout;
-  return join10(moduleDir, "..", "hooks");
-}
-function resolveHookDir(name) {
-  const custom = readCustomManifest(name);
-  if (custom)
-    return customHookDir(name);
-  const meta = getHook(shortManifestName(name));
-  if (!meta)
-    return;
-  const short = shortManifestName(name);
-  const bundledBase = resolveBundledHooksDir();
-  const direct = join10(bundledBase, short);
-  if (existsSync7(direct))
-    return direct;
-  const prefixed = join10(bundledBase, `hook-${short}`);
-  return existsSync7(prefixed) ? prefixed : undefined;
-}
-function resolveScriptPath(name) {
-  const custom = readCustomManifest(name);
-  if (custom)
-    return custom.scriptPath;
-  const dir = resolveHookDir(name);
-  if (!dir)
-    return;
-  const script = join10(dir, "src", "hook.ts");
-  return existsSync7(script) ? script : undefined;
-}
-function resolveHookMeta(name) {
-  const custom = readCustomManifest(name);
-  if (custom) {
-    const { manifest } = custom;
-    return {
-      name: shortManifestName(manifest.name),
-      displayName: manifest.description ? manifest.name : manifest.name,
-      description: manifest.description ?? "Custom hook",
-      version: manifest.version,
-      category: "Workflow Automation",
-      event: manifest.events[0] ?? "PostToolUse",
-      events: manifest.events,
-      matcher: "",
-      tags: ["custom"]
-    };
-  }
-  return getHook(shortManifestName(name));
-}
-function resolveHook(name) {
-  const custom = readCustomManifest(name);
-  if (custom) {
-    const meta2 = resolveHookMeta(name);
-    return {
-      name: shortManifestName(custom.manifest.name),
-      source: "custom",
-      version: custom.manifest.version,
-      events: custom.manifest.events,
-      description: custom.manifest.description ?? "Custom hook",
-      scriptPath: custom.scriptPath,
-      meta: meta2,
-      timeoutMs: custom.manifest.timeout_ms ?? null
-    };
-  }
-  const meta = getHook(shortManifestName(name));
-  const scriptPath = resolveScriptPath(name);
-  if (!meta || !scriptPath)
-    return;
-  return {
-    name: shortManifestName(name),
-    source: "bundled",
-    version: meta.version,
-    events: meta.events && meta.events.length > 0 ? meta.events : [meta.event],
-    description: meta.description,
-    scriptPath,
-    meta,
-    timeoutMs: null
-  };
-}
-var init_resolve = __esm(() => {
-  init_registry();
-  init_manifest();
+var init_resolve = __esm(() => {
+  init_registry();
+  init_manifest();
 });
 
 // src/db/schema.ts
@@ -5076,9 +4671,9 @@ var init_migrations = __esm(() => {
 });
 
 // src/db/legacy-import.ts
-import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
-import { join as join11 } from "path";
-import { homedir as homedir6 } from "os";
+import { existsSync as existsSync7, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join8 } from "path";
+import { homedir as homedir3 } from "os";
 function ensureMetaTable(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS _meta (
@@ -5101,7 +4696,7 @@ function nanoid() {
 function importJsonlFile(db, filePath) {
   let count = 0;
   try {
-    const lines = readFileSync4(filePath, "utf-8").split(`
+    const lines = readFileSync2(filePath, "utf-8").split(`
 `).filter(Boolean);
     for (const line of lines) {
       try {
@@ -5127,7 +4722,7 @@ function importJsonlFile(db, filePath) {
 function importErrorsLog(db, filePath) {
   let count = 0;
   try {
-    const lines = readFileSync4(filePath, "utf-8").split(`
+    const lines = readFileSync2(filePath, "utf-8").split(`
 `).filter(Boolean);
     const linePattern = /^\[(.+?)\]\s+(?:\[session:(\S+)\]\s+)?(.+?)\s+\u2014\s+(.+)$/;
     for (const line of lines) {
@@ -5152,25 +4747,25 @@ function importErrorsLog(db, filePath) {
   } catch {}
   return count;
 }
-function runLegacyImport(db, homeDir2 = homedir6()) {
+function runLegacyImport(db, homeDir = homedir3()) {
   try {
     if (isAlreadyDone(db))
       return;
     let total = 0;
-    const claudeProjectsDir = join11(homeDir2, ".claude", "projects");
-    if (existsSync8(claudeProjectsDir)) {
+    const claudeProjectsDir = join8(homeDir, ".claude", "projects");
+    if (existsSync7(claudeProjectsDir)) {
       try {
         const projectDirs = readdirSync2(claudeProjectsDir);
         for (const dir of projectDirs) {
-          const projectDir = join11(claudeProjectsDir, dir);
+          const projectDir = join8(claudeProjectsDir, dir);
           try {
             const files = readdirSync2(projectDir);
             for (const file of files) {
               if (file.match(/^session-log-\d{4}-\d{2}-\d{2}\.jsonl$/)) {
-                total += importJsonlFile(db, join11(projectDir, file));
+                total += importJsonlFile(db, join8(projectDir, file));
               }
               if (file === "errors.log") {
-                total += importErrorsLog(db, join11(projectDir, file));
+                total += importErrorsLog(db, join8(projectDir, file));
               }
             }
           } catch {}
@@ -5213,13 +4808,13 @@ __export(exports_db, {
   closeDb: () => closeDb
 });
 import { Database } from "bun:sqlite";
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, cpSync } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, cpSync } from "fs";
+import { join as join9 } from "path";
 function resolveDataDir() {
   const effective = getEffectiveDataRoot();
-  const oldDir = join12(getHomeDir(), ".hooks");
-  if (!existsSync9(effective) && existsSync9(oldDir)) {
-    mkdirSync3(effective, { recursive: true });
+  const oldDir = join9(getHomeDir(), ".hooks");
+  if (!existsSync8(effective) && existsSync8(oldDir)) {
+    mkdirSync2(effective, { recursive: true });
     cpSync(oldDir, effective, { recursive: true });
   }
   return effective;
@@ -5229,19 +4824,19 @@ function getDbPath() {
   if (explicitDb)
     return explicitDb;
   const dataDir3 = resolveDataDir();
-  return join12(dataDir3, "hooks.db");
+  return join9(dataDir3, "hooks.db");
 }
 function ensureDir(dbPath) {
   const dir = dbPath.substring(0, dbPath.lastIndexOf("/"));
-  if (dir && !existsSync9(dir)) {
-    mkdirSync3(dir, { recursive: true });
+  if (dir && !existsSync8(dir)) {
+    mkdirSync2(dir, { recursive: true });
   }
 }
 function getDb() {
   if (instance)
     return instance;
   const dbPath = getDbPath();
-  const isNew = dbPath === ":memory:" || !existsSync9(dbPath);
+  const isNew = dbPath === ":memory:" || !existsSync8(dbPath);
   ensureDir(dbPath);
   instance = new Database(dbPath);
   instance.exec("PRAGMA busy_timeout=5000");
@@ -5304,7 +4899,7 @@ __export(exports_store, {
   LockFileError: () => LockFileError
 });
 import { createHash } from "crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3, renameSync } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2, renameSync } from "fs";
 import { readFile as readFile2 } from "fs/promises";
 import { randomBytes } from "crypto";
 function sha256Of(input) {
@@ -5366,11 +4961,11 @@ function assertLockShape(parsed, path) {
 }
 function readLock() {
   const path = getLockPath();
-  if (!existsSync10(path))
+  if (!existsSync9(path))
     return { hooks: {} };
   let raw;
   try {
-    raw = readFileSync5(path, "utf-8");
+    raw = readFileSync3(path, "utf-8");
   } catch {
     throw new LockFileError(`hooks.lock (${path}) could not be read. Repair: fix permissions or move the file aside and run 'hooks sync'.`);
   }
@@ -5385,13 +4980,13 @@ function readLock() {
 }
 function writeLock(lock) {
   const path = getLockPath();
-  mkdirSync4(path.substring(0, path.lastIndexOf("/")) || ".", { recursive: true });
+  mkdirSync3(path.substring(0, path.lastIndexOf("/")) || ".", { recursive: true });
   const sorted = {};
   for (const name of Object.keys(lock.hooks).sort()) {
     sorted[name] = lock.hooks[name];
   }
   const tmp = `${path}.tmp-${randomBytes(8).toString("hex")}`;
-  writeFileSync3(tmp, JSON.stringify({ hooks: sorted }, null, 2) + `
+  writeFileSync2(tmp, JSON.stringify({ hooks: sorted }, null, 2) + `
 `, "utf-8");
   renameSync(tmp, path);
   return path;
@@ -5467,7 +5062,7 @@ async function verifyScriptHash(name, scriptPath) {
   return checkScriptHash(name, await sha256File(scriptPath));
 }
 function retrustHook(name, scriptPath, version, source) {
-  const actual = sha256Of(readFileSync5(scriptPath));
+  const actual = sha256Of(readFileSync3(scriptPath));
   const db = getDb();
   upsertHookRecord(db, {
     name,
@@ -5508,9 +5103,9 @@ __export(exports_installer, {
   getHookPath: () => getHookPath,
   buildCodewithTomlFragment: () => buildCodewithTomlFragment
 });
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join13, dirname as dirname3 } from "path";
-import { homedir as homedir7 } from "os";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync4, readdirSync as readdirSync3, rmdirSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { join as join10, dirname as dirname3 } from "path";
+import { homedir as homedir4 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
@@ -5549,25 +5144,25 @@ function getSettingsPath(scope = "global", target = "claude", codewithConfigPath
     return globalOverride;
   const dir = getTargetSettingsDir(target);
   if (scope === "project") {
-    return target === "codewith" ? join13(process.cwd(), dir, "config.toml") : join13(process.cwd(), dir, "settings.json");
+    return target === "codewith" ? join10(process.cwd(), dir, "config.toml") : join10(process.cwd(), dir, "settings.json");
   }
-  return target === "codewith" ? join13(homedir7(), dir, "config.toml") : join13(homedir7(), dir, "settings.json");
+  return target === "codewith" ? join10(homedir4(), dir, "config.toml") : join10(homedir4(), dir, "settings.json");
 }
 function getHookPath(name) {
   const shortName = shortHookName(name);
   const resolved = resolveHookDir(shortName);
   if (resolved)
     return resolved;
-  return join13(HOOKS_DIR, normalizeHookName(shortName));
+  return join10(HOOKS_DIR, normalizeHookName(shortName));
 }
 function hookExists(name) {
-  return existsSync11(getHookPath(name));
+  return existsSync10(getHookPath(name));
 }
 function readSettings(scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   try {
-    if (existsSync11(path)) {
-      return JSON.parse(readFileSync6(path, "utf-8"));
+    if (existsSync10(path)) {
+      return JSON.parse(readFileSync4(path, "utf-8"));
     }
   } catch (error) {
     console.warn(`[hooks] Failed to read settings at ${path}: ${error instanceof Error ? error.message : String(error)}`);
@@ -5577,10 +5172,10 @@ function readSettings(scope = "global", target = "claude") {
 function writeSettings(settings, scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   const dir = dirname3(path);
-  if (!existsSync11(dir)) {
-    mkdirSync5(dir, { recursive: true });
+  if (!existsSync10(dir)) {
+    mkdirSync4(dir, { recursive: true });
   }
-  writeFileSync4(path, JSON.stringify(settings, null, 2) + `
+  writeFileSync3(path, JSON.stringify(settings, null, 2) + `
 `);
 }
 function getTargetEventName(internalEvent, target) {
@@ -5666,7 +5261,7 @@ function buildCodewithTomlFragment(name, profile) {
 function readCodewithConfig(scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   try {
-    return existsSync11(path) ? readFileSync6(path, "utf-8") : "";
+    return existsSync10(path) ? readFileSync4(path, "utf-8") : "";
   } catch {
     return "";
   }
@@ -5674,13 +5269,13 @@ function readCodewithConfig(scope, configPath) {
 function appendCodewithFragment(fragment, scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   const dir = dirname3(path);
-  if (!existsSync11(dir))
-    mkdirSync5(dir, { recursive: true });
-  const existing = existsSync11(path) ? readFileSync6(path, "utf-8") : "";
+  if (!existsSync10(dir))
+    mkdirSync4(dir, { recursive: true });
+  const existing = existsSync10(path) ? readFileSync4(path, "utf-8") : "";
   const sep2 = existing.trim() ? `
 
 ` : "";
-  writeFileSync4(path, `${existing.replace(/\s*$/, "")}${sep2}${fragment}`);
+  writeFileSync3(path, `${existing.replace(/\s*$/, "")}${sep2}${fragment}`);
   return path;
 }
 function detectConflict(name, scope, target) {
@@ -5855,460 +5450,1347 @@ function removeHookFromAllEvents(settings, name) {
     }
   }
 }
-function unregisterHook(name, scope = "global", target = "claude") {
-  const settings = readSettings(scope, target);
-  if (!settings.hooks)
+function unregisterHook(name, scope = "global", target = "claude") {
+  const settings = readSettings(scope, target);
+  if (!settings.hooks)
+    return;
+  removeHookFromAllEvents(settings, name);
+  if (Object.keys(settings.hooks).length === 0) {
+    delete settings.hooks;
+  }
+  writeSettings(settings, scope, target);
+}
+function installHooks(names, options = {}) {
+  return names.map((name) => installHook(name, options));
+}
+function getRegisteredHooksForTarget(scope = "global", target = "claude") {
+  if (target === "codewith") {
+    const config = readCodewithConfig(scope);
+    const registered2 = [];
+    const re = /command\s*=\s*["']hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?["']/g;
+    let match;
+    while (match = re.exec(config)) {
+      registered2.push(match[1]);
+    }
+    return [...new Set(registered2)];
+  }
+  const settings = readSettings(scope, target);
+  if (!settings.hooks)
+    return [];
+  const registered = [];
+  for (const eventKey of Object.keys(settings.hooks)) {
+    for (const entry of settings.hooks[eventKey]) {
+      for (const hook of entry.hooks || []) {
+        const newMatch = hook.command?.match(/^hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?$/);
+        const oldMatch = hook.command?.match(/^hook-([\w-]+)$/);
+        const match = newMatch || oldMatch;
+        if (match) {
+          registered.push(match[1]);
+        }
+      }
+    }
+  }
+  return [...new Set(registered)];
+}
+function getRegisteredHooks(scope = "global") {
+  return getRegisteredHooksForTarget(scope, "claude");
+}
+function removeHook(name, scope = "global", target = "claude") {
+  const shortName = shortHookName(name);
+  if (target === "all") {
+    const claudeRemoved = removeHookForTarget(shortName, scope, "claude");
+    const geminiRemoved = removeHookForTarget(shortName, scope, "gemini");
+    return claudeRemoved || geminiRemoved;
+  }
+  if (target === "codewith") {
+    return false;
+  }
+  return removeHookForTarget(shortName, scope, target);
+}
+function removeHookForTarget(name, scope, target) {
+  const registered = getRegisteredHooksForTarget(scope, target);
+  if (!registered.includes(name)) {
+    return false;
+  }
+  unregisterHook(name, scope, target);
+  return true;
+}
+function removeCodewithHookEntry(configText, name) {
+  const sections = configText.split(/\n\s*\n/);
+  const nameRe = new RegExp(`^command\\s*=\\s*"hooks run ${escapeRegExp(name)}(?:\\s+--profile\\s+[\\w-]+)?"$`);
+  const entryHeaderRe = /^\[\[hooks\.([\w]+)\.hooks\]\]$/;
+  const eventHeaderRe = /^\[\[hooks\.([\w]+)\]\]$/;
+  const eventsWithEntries = new Set;
+  const kept = [];
+  let removed = false;
+  for (const section of sections) {
+    const lines = section.split(`
+`);
+    const entryMatch = entryHeaderRe.exec(lines[0] ?? "");
+    if (entryMatch) {
+      const event = entryMatch[1];
+      eventsWithEntries.add(event);
+      if (lines.some((line) => nameRe.test(line.trim()))) {
+        removed = true;
+        continue;
+      }
+      kept.push({ text: section });
+      continue;
+    }
+    const eventMatch = eventHeaderRe.exec(lines[0] ?? "");
+    kept.push({ text: section, eventHeaderFor: eventMatch ? eventMatch[1] : undefined });
+  }
+  const keptEntriesByEvent = new Set;
+  for (const item of kept) {
+    const m = entryHeaderRe.exec(item.text.split(`
+`)[0] ?? "");
+    if (m)
+      keptEntriesByEvent.add(m[1]);
+  }
+  const finalSections = kept.filter((item) => {
+    if (item.eventHeaderFor === undefined)
+      return true;
+    if (!eventsWithEntries.has(item.eventHeaderFor))
+      return true;
+    return keptEntriesByEvent.has(item.eventHeaderFor);
+  }).map((item) => item.text);
+  return {
+    text: finalSections.join(`
+
+`) + (configText.endsWith(`
+`) ? `
+` : ""),
+    removed
+  };
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function codewithHasHookEntryInText(configText, name) {
+  return new RegExp(`hooks run ${escapeRegExp(name)}(?:\\s+--profile\\s+[\\w-]+)?(?:$|\\s|")`).test(configText);
+}
+function codewithHasHookEntry(name, scope = "global") {
+  const path = getSettingsPath(scope, "codewith");
+  if (!existsSync10(path))
+    return false;
+  try {
+    return codewithHasHookEntryInText(readFileSync4(path, "utf-8"), name);
+  } catch {
+    return false;
+  }
+}
+function removeStoreDirFailClosed(dir) {
+  const entries = readdirSync3(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      removeStoreDirFailClosed(join10(dir, entry.name));
+    }
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) {
+      unlinkSync(join10(dir, entry.name));
+    }
+  }
+  rmdirSync(dir);
+}
+function uninstallHook(name, scope = "global", target = "claude") {
+  const shortName = shortHookName(name);
+  const custom = readCustomManifest(shortName);
+  const bundledMeta = custom ? undefined : getHook(shortName);
+  const existsInTarget = (t) => getRegisteredHooksForTarget("global", t).includes(shortName) || getRegisteredHooksForTarget("project", t).includes(shortName);
+  const registeredClaudeOrGemini = target === "all" ? existsInTarget("claude") || existsInTarget("gemini") : false;
+  const registeredGlobal = registeredClaudeOrGemini || getRegisteredHooksForTarget("global", target === "all" ? "claude" : target).includes(shortName);
+  const registeredProject = registeredClaudeOrGemini || getRegisteredHooksForTarget("project", target === "all" ? "claude" : target).includes(shortName);
+  const codewithOnly = (target === "codewith" || target === "all") && codewithHasHookEntry(shortName, scope);
+  if (!custom && !bundledMeta && !registeredGlobal && !registeredProject && !codewithOnly) {
+    return { name: shortName, removed: false, source: null, settingsScopes: [], storeDirRemoved: false, pinRemoved: false, dbRecordRemoved: false, registrationsRemaining: [], error: `Hook '${shortName}' not found` };
+  }
+  const writableTargets = target === "all" ? ["claude", "gemini"] : target === "codewith" ? [] : [target];
+  const scopes = [];
+  for (const s of ["global", "project"]) {
+    for (const t of writableTargets) {
+      if (getRegisteredHooksForTarget(s, t).includes(shortName)) {
+        unregisterHook(shortName, s, t);
+        if (!scopes.includes(s))
+          scopes.push(s);
+      }
+    }
+  }
+  const registrationsRemaining = [];
+  if (target === "codewith" || target === "all") {
+    const codewithPath = getSettingsPath(scope, "codewith");
+    if (existsSync10(codewithPath)) {
+      const before = readFileSync4(codewithPath, "utf-8");
+      const after = removeCodewithHookEntry(before, shortName);
+      if (after.removed) {
+        writeFileSync3(codewithPath, after.text, "utf-8");
+      }
+      if (codewithHasHookEntryInText(after.removed ? after.text : before, shortName)) {
+        registrationsRemaining.push("codewith");
+      }
+    }
+  }
+  if (custom) {
+    try {
+      removeStoreDirFailClosed(customHookDir(shortName));
+    } catch {
+      return {
+        name: shortName,
+        removed: false,
+        source: "custom",
+        settingsScopes: scopes,
+        storeDirRemoved: false,
+        pinRemoved: false,
+        dbRecordRemoved: false,
+        registrationsRemaining,
+        error: `Hook '${shortName}' store directory could not be removed; trust records preserved (no fail-open)`
+      };
+    }
+  }
+  const { removedPin, removedRecord } = removeHookFromStore(shortName);
+  return {
+    name: shortName,
+    removed: true,
+    source: custom ? "custom" : bundledMeta ? "bundled" : "registered-only",
+    settingsScopes: scopes,
+    storeDirRemoved: custom ? true : false,
+    pinRemoved: removedPin,
+    dbRecordRemoved: removedRecord,
+    registrationsRemaining
+  };
+}
+var __dirname2, HOOKS_DIR, EVENT_MAP, getInstalledHooks;
+var init_installer = __esm(() => {
+  init_registry();
+  init_resolve();
+  init_manifest();
+  init_store();
+  __dirname2 = dirname3(fileURLToPath2(import.meta.url));
+  HOOKS_DIR = existsSync10(join10(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join10(__dirname2, "..", "..", "hooks") : join10(__dirname2, "..", "hooks");
+  EVENT_MAP = {
+    claude: {
+      PreToolUse: "PreToolUse",
+      PostToolUse: "PostToolUse",
+      Stop: "Stop",
+      Notification: "Notification",
+      SessionStart: "SessionStart",
+      SessionEnd: "SessionEnd",
+      UserPromptSubmit: null,
+      SubagentStart: null
+    },
+    gemini: {
+      PreToolUse: "BeforeTool",
+      PostToolUse: "AfterTool",
+      Stop: "AfterAgent",
+      Notification: "Notification",
+      SessionStart: null,
+      SessionEnd: null,
+      UserPromptSubmit: null,
+      SubagentStart: null
+    },
+    codewith: {
+      PreToolUse: "PreToolUse",
+      PostToolUse: "PostToolUse",
+      Stop: "Stop",
+      Notification: null,
+      SessionStart: "SessionStart",
+      SessionEnd: null,
+      UserPromptSubmit: "UserPromptSubmit",
+      SubagentStart: "SubagentStart"
+    }
+  };
+  getInstalledHooks = getRegisteredHooks;
+});
+
+// src/lib/registration.ts
+function safeMatcherTest(pattern, value) {
+  try {
+    return new RegExp(pattern).test(value);
+  } catch {
+    return false;
+  }
+}
+function countSettingsWiring(settings) {
+  const hooks = settings.hooks;
+  if (!hooks || typeof hooks !== "object")
+    return 0;
+  let count = 0;
+  for (const eventKey of Object.keys(hooks)) {
+    const entries = hooks[eventKey];
+    if (!Array.isArray(entries))
+      continue;
+    for (const entry of entries) {
+      if (Array.isArray(entry?.hooks))
+        count += entry.hooks.length;
+    }
+  }
+  return count;
+}
+function hookRegisteredInSettings(settings, name, eventSpec, hookMatcher) {
+  const separator = eventSpec.indexOf(":");
+  const eventName = separator === -1 ? eventSpec : eventSpec.slice(0, separator);
+  const specMatcher = separator === -1 ? "" : eventSpec.slice(separator + 1);
+  const matcher = specMatcher || hookMatcher || "";
+  const hooks = settings.hooks?.[eventName];
+  if (!Array.isArray(hooks))
+    return false;
+  return hooks.some((entry) => entry?.hooks?.some((h) => {
+    const match = h?.command?.match(/^hooks run ([\w-]+)/);
+    if (!match || match[1] !== name)
+      return false;
+    if (!matcher)
+      return true;
+    const entryMatcher = typeof entry.matcher === "string" ? entry.matcher : "";
+    if (!entryMatcher)
+      return true;
+    return entryMatcher === matcher || safeMatcherTest(entryMatcher, matcher) || safeMatcherTest(matcher, entryMatcher);
+  }));
+}
+
+// src/lib/redact.ts
+function redactText(value) {
+  let out = value;
+  for (const pattern of SECRET_SHAPES) {
+    out = out.replace(pattern, REDACTED);
+  }
+  return out;
+}
+function redactValue2(value) {
+  if (typeof value === "string")
+    return redactText(value);
+  if (Array.isArray(value))
+    return value.map(redactValue2);
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+      out[key] = SECRET_KEY_NAMES.test(key) ? REDACTED : redactValue2(child);
+    }
+    return out;
+  }
+  return value;
+}
+function redactEventPayload(text) {
+  if (text === null || text === undefined)
+    return null;
+  try {
+    const parsed = JSON.parse(text);
+    return redactText(JSON.stringify(redactValue2(parsed)));
+  } catch {
+    return redactText(text);
+  }
+}
+function projectEventRowForRead(row) {
+  const out = { ...row };
+  for (const field of ["tool_input", "error", "metadata"]) {
+    const value = out[field];
+    if (typeof value === "string")
+      out[field] = redactEventPayload(value);
+    else if (value === null)
+      out[field] = null;
+  }
+  return out;
+}
+var REDACTED = "[REDACTED]", SECRET_KEY_NAMES, SECRET_SHAPES;
+var init_redact = __esm(() => {
+  SECRET_KEY_NAMES = /^(key|keys|token|tokens|secret|secrets|password|passwd|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret|refresh[_-]?token|authorization|auth|cookie|credential|credentials|session[_-]?id|otp|mfa[_-]?code|two[_-]?fa[_-]?code|verification[_-]?code|database_url|db_url|connection_string|dsn)$/i;
+  SECRET_SHAPES = [
+    /\bsk-(?:proj|svc|ant)-[A-Za-z0-9_-]{10,}/g,
+    /\bsk-[A-Za-z0-9]{16,}/g,
+    /\btpe_[A-Za-z0-9]{8,}/g,
+    /\b(?:rk|sk)_(?:live|test)_[A-Za-z0-9]{8,}/g,
+    /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+    /gh[pousr]_[A-Za-z0-9]{20,}/g,
+    /xox[baprs]-[A-Za-z0-9-]{20,}/g,
+    /AKIA[0-9A-Z]{16}/g,
+    /ASIA[0-9A-Z]{16}/g,
+    /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
+    /-----BEGIN [A-Z0-9 ]*PRIVAT[E] KEY-----/g,
+    /-----BEGIN OPENSSH PRIVAT[E] KEY-----/g,
+    /\bBearer\s+[A-Za-z0-9._~+/=-]{6,}/g,
+    /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:[^/\s@]+@/gi,
+    /\b(?:password|passwd|pwd|token|api[_-]?key|secret|access[_-]?key|client[_-]?secret|authorization|auth|credential|database_url|db_url|connection_string|dsn)\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;"']{6,})/gi
+  ];
+});
+
+// src/lib/profiles.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4, readdirSync as readdirSync4, rmSync, cpSync as cpSync2 } from "fs";
+import { join as join11 } from "path";
+function getProfilesDir() {
+  const newDir = join11(getEffectiveDataRoot(), "profiles");
+  const oldDir = join11(getHomeDir(), ".hooks", "profiles");
+  if (!existsSync11(newDir) && existsSync11(oldDir)) {
+    mkdirSync5(newDir, { recursive: true });
+    cpSync2(oldDir, newDir, { recursive: true });
+  }
+  return newDir;
+}
+function ensureProfilesDir() {
+  const dir = getProfilesDir();
+  if (!existsSync11(dir)) {
+    mkdirSync5(dir, { recursive: true });
+  }
+}
+function profilePath(id) {
+  return join11(getProfilesDir(), `${id}.json`);
+}
+function shortUuid() {
+  return crypto.randomUUID().slice(0, 8);
+}
+function createProfile(input) {
+  ensureProfilesDir();
+  const id = shortUuid();
+  const now2 = new Date().toISOString();
+  const profile = {
+    agent_id: id,
+    agent_type: input.agent_type,
+    created_at: now2,
+    last_seen_at: now2,
+    preferences: {}
+  };
+  if (input.name) {
+    profile.name = input.name;
+  }
+  writeFileSync4(profilePath(id), JSON.stringify(profile, null, 2) + `
+`);
+  return profile;
+}
+function getProfile(id) {
+  const path = profilePath(id);
+  try {
+    if (!existsSync11(path))
+      return null;
+    return JSON.parse(readFileSync5(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function listProfiles() {
+  const dir = getProfilesDir();
+  if (!existsSync11(dir))
+    return [];
+  try {
+    const files = readdirSync4(dir).filter((f) => f.endsWith(".json"));
+    const profiles = [];
+    for (const file of files) {
+      try {
+        const content = readFileSync5(join11(dir, file), "utf-8");
+        profiles.push(JSON.parse(content));
+      } catch {}
+    }
+    return profiles.sort((a, b) => new Date(a.created_at).getTime() - new Date(b.created_at).getTime());
+  } catch {
+    return [];
+  }
+}
+function touchProfile(id) {
+  const profile = getProfile(id);
+  if (!profile)
     return;
-  removeHookFromAllEvents(settings, name);
-  if (Object.keys(settings.hooks).length === 0) {
-    delete settings.hooks;
-  }
-  writeSettings(settings, scope, target);
+  profile.last_seen_at = new Date().toISOString();
+  writeFileSync4(profilePath(id), JSON.stringify(profile, null, 2) + `
+`);
 }
-function installHooks(names, options = {}) {
-  return names.map((name) => installHook(name, options));
+function exportProfiles() {
+  return listProfiles();
 }
-function getRegisteredHooksForTarget(scope = "global", target = "claude") {
-  if (target === "codewith") {
-    const config = readCodewithConfig(scope);
-    const registered2 = [];
-    const re = /command\s*=\s*["']hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?["']/g;
-    let match;
-    while (match = re.exec(config)) {
-      registered2.push(match[1]);
+function importProfiles(profiles) {
+  ensureProfilesDir();
+  let imported = 0;
+  let skipped = 0;
+  for (const profile of profiles) {
+    if (!profile.agent_id || !profile.agent_type) {
+      skipped++;
+      continue;
     }
-    return [...new Set(registered2)];
+    const path = profilePath(profile.agent_id);
+    if (existsSync11(path)) {
+      skipped++;
+      continue;
+    }
+    writeFileSync4(path, JSON.stringify(profile, null, 2) + `
+`);
+    imported++;
   }
-  const settings = readSettings(scope, target);
-  if (!settings.hooks)
+  return { imported, skipped };
+}
+var init_profiles = __esm(() => {
+  init_app_home();
+});
+
+// ../contracts/dist/client/transport.js
+import { isIP as isIP2 } from "net";
+import { spawnSync } from "child_process";
+import { closeSync, fstatSync, openSync, readFileSync as readFileSync6 } from "fs";
+import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
+import { createRequire } from "module";
+import { hostname as osHostname } from "os";
+import { isAbsolute as isAbsolute2, join as join12 } from "path";
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function clientTransportEnvKeys(name) {
+  const envSegment = envToken(name);
+  return {
+    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
+    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
+  };
+}
+function credentialOverrideEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
+}
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
+function homeDir(env) {
+  const home = env.HOME?.trim();
+  return home ? home : null;
+}
+function absoluteOverride(env, key) {
+  const value = env[key]?.trim();
+  return value && isAbsolute2(value) ? value : null;
+}
+function hasnaHomeDir(env) {
+  const override = absoluteOverride(env, HASNA_HOME_ENV_KEY);
+  if (override)
+    return override;
+  const home = homeDir(env);
+  return home ? join12(home, HASNA_HOME_DIR) : null;
+}
+function appConfigDir(name, env) {
+  const configRoot = absoluteOverride(env, HASNA_CONFIG_HOME_ENV_KEY);
+  if (configRoot)
+    return join12(configRoot, name);
+  const root = hasnaHomeDir(env);
+  return root ? join12(root, name, CONFIG_SUBDIR) : null;
+}
+function credentialDiskSourceList(name, env, profile = null) {
+  if (!SAFE_APP_SLUG.test(name))
     return [];
-  const registered = [];
-  for (const eventKey of Object.keys(settings.hooks)) {
-    for (const entry of settings.hooks[eventKey]) {
-      for (const hook of entry.hooks || []) {
-        const newMatch = hook.command?.match(/^hooks run ([\w-]+)(?:\s+--profile\s+[\w-]+)?$/);
-        const oldMatch = hook.command?.match(/^hook-([\w-]+)$/);
-        const match = newMatch || oldMatch;
-        if (match) {
-          registered.push(match[1]);
-        }
+  const directory = appConfigDir(name, env);
+  if (!directory)
+    return [];
+  const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
+  return [{ path: join12(directory, file), tier: "disk" }];
+}
+function credentialDiskSources(name, env) {
+  return credentialDiskSourceList(name, env, null).map((s) => s.path);
+}
+function profileDiskSources(name, env, profile) {
+  return credentialDiskSourceList(name, env, profile).map((s) => s.path);
+}
+function parseEnvFile(text) {
+  const values = new Map;
+  const unusable = new Set;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#"))
+      continue;
+    const withoutExport = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
+    const equals = withoutExport.indexOf("=");
+    if (equals <= 0)
+      continue;
+    const key = withoutExport.slice(0, equals).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    let value = withoutExport.slice(equals + 1).trim();
+    const quote = value[0];
+    if (quote === '"' || quote === "'") {
+      if (value.length < 2 || !value.endsWith(quote)) {
+        unusable.add(key);
+        continue;
       }
+      value = value.slice(1, -1);
     }
+    if (value.trim().length === 0) {
+      unusable.add(key);
+      continue;
+    }
+    if (values.has(key) && values.get(key) !== value)
+      unusable.add(key);
+    values.set(key, value);
   }
-  return [...new Set(registered)];
+  return { values, unusable };
 }
-function getRegisteredHooks(scope = "global") {
-  return getRegisteredHooksForTarget(scope, "claude");
+function configFileModeAllowed(mode) {
+  const permissions = mode & 4095;
+  return permissions === 256 || permissions === 384;
 }
-function removeHook(name, scope = "global", target = "claude") {
-  const shortName = shortHookName(name);
-  if (target === "all") {
-    const claudeRemoved = removeHookForTarget(shortName, scope, "claude");
-    const geminiRemoved = removeHookForTarget(shortName, scope, "gemini");
-    return claudeRemoved || geminiRemoved;
+function configFileReadsCoherent(before, after) {
+  return before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs;
+}
+function readAppConfigFile(path) {
+  const unsafe = (reason) => {
+    throw new CredentialFileUnsafeError(path, reason);
+  };
+  let fd = -1;
+  try {
+    fd = openSync(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR")
+      return null;
+    if (code === "ELOOP")
+      unsafe("the path is a symlink");
+    unsafe(`the path could not be opened (${code ?? "unknown error"})`);
   }
-  if (target === "codewith") {
-    return false;
+  try {
+    const before = fstatSync(fd);
+    if (!before.isFile())
+      unsafe("the path is not a regular file");
+    if (!configFileModeAllowed(before.mode)) {
+      unsafe(`permission mode ${(before.mode & 4095).toString(8).padStart(4, "0")} is not owner-only 0400 or 0600`);
+    }
+    const uid = process.getuid?.() ?? process.geteuid?.();
+    if (uid !== undefined && before.uid !== uid)
+      unsafe("the file is not owned by the current user");
+    if (before.size > MAX_CREDENTIAL_FILE_BYTES)
+      unsafe("the file exceeds the size limit");
+    const bytes = readFileSync6(fd);
+    const after = fstatSync(fd);
+    if (!configFileReadsCoherent(before, after)) {
+      unsafe("the file changed while being read");
+    }
+    return parseEnvFile(bytes.toString("utf8"));
+  } finally {
+    if (fd !== -1)
+      closeSync(fd);
   }
-  return removeHookForTarget(shortName, scope, target);
 }
-function removeHookForTarget(name, scope, target) {
-  const registered = getRegisteredHooksForTarget(scope, target);
-  if (!registered.includes(name)) {
-    return false;
+function readCredentialFile(path, apiKeyKeys) {
+  const parsed = readAppConfigFile(path);
+  if (!parsed)
+    return null;
+  for (const key of apiKeyKeys) {
+    if (parsed.unusable.has(key)) {
+      throw new CredentialFileUnsafeError(path, `${key} is declared but blank or malformed`);
+    }
   }
-  unregisterHook(name, scope, target);
-  return true;
+  const values = apiKeyKeys.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+  if (new Set(values).size > 1) {
+    throw new CredentialFileUnsafeError(path, "credential aliases disagree");
+  }
+  return values[0] ?? null;
 }
-function removeCodewithHookEntry(configText, name) {
-  const sections = configText.split(/\n\s*\n/);
-  const nameRe = new RegExp(`^command\\s*=\\s*"hooks run ${escapeRegExp(name)}(?:\\s+--profile\\s+[\\w-]+)?"$`);
-  const entryHeaderRe = /^\[\[hooks\.([\w]+)\.hooks\]\]$/;
-  const eventHeaderRe = /^\[\[hooks\.([\w]+)\]\]$/;
-  const eventsWithEntries = new Set;
-  const kept = [];
-  let removed = false;
-  for (const section of sections) {
-    const lines = section.split(`
-`);
-    const entryMatch = entryHeaderRe.exec(lines[0] ?? "");
-    if (entryMatch) {
-      const event = entryMatch[1];
-      eventsWithEntries.add(event);
-      if (lines.some((line) => nameRe.test(line.trim()))) {
-        removed = true;
-        continue;
-      }
-      kept.push({ text: section });
+function appConfigDiskValue(name, env, keys) {
+  const wanted = keys.filter((key) => !CREDENTIAL_SHAPED_KEY.test(key));
+  if (wanted.length === 0)
+    return null;
+  for (const path of credentialDiskSources(name, env)) {
+    const parsed = readAppConfigFile(path);
+    if (!parsed)
       continue;
+    if (wanted.some((key) => parsed.unusable.has(key))) {
+      return { key: wanted.find((key) => parsed.unusable.has(key)), value: "", path, unusable: true };
+    }
+    const values = wanted.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+    if (new Set(values).size > 1)
+      throw new CredentialFileUnsafeError(path, "configuration aliases disagree");
+    for (const key of wanted) {
+      if (parsed.unusable.has(key))
+        return { key, value: "", path, unusable: true };
+      const value = parsed.values.get(key)?.trim();
+      if (value)
+        return { key, value, path };
     }
-    const eventMatch = eventHeaderRe.exec(lines[0] ?? "");
-    kept.push({ text: section, eventHeaderFor: eventMatch ? eventMatch[1] : undefined });
   }
-  const keptEntriesByEvent = new Set;
-  for (const item of kept) {
-    const m = entryHeaderRe.exec(item.text.split(`
-`)[0] ?? "");
-    if (m)
-      keptEntriesByEvent.add(m[1]);
+  return null;
+}
+function assertUsableCredential(appName, source, value) {
+  if (VAULT_POINTER_SHAPE.test(value)) {
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
   }
-  const finalSections = kept.filter((item) => {
-    if (item.eventHeaderFor === undefined)
-      return true;
-    if (!eventsWithEntries.has(item.eventHeaderFor))
-      return true;
-    return keptEntriesByEvent.has(item.eventHeaderFor);
-  }).map((item) => item.text);
-  return {
-    text: finalSections.join(`
-
-`) + (configText.endsWith(`
-`) ? `
-` : ""),
-    removed
+  if (!ILLEGAL_IN_HEADER_VALUE.test(value))
+    return;
+  throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
+}
+function sealCredential(fields) {
+  const { apiKey } = fields;
+  const visible = {
+    tier: fields.tier,
+    source: fields.source,
+    deliberate: fields.deliberate,
+    diskCandidates: Object.freeze([...fields.diskCandidates]),
+    warning: fields.warning
   };
+  const sealed = { ...visible };
+  Object.defineProperty(sealed, "apiKey", {
+    value: apiKey,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  Object.defineProperty(sealed, INSPECT_CUSTOM, {
+    value: () => ({ ...visible, apiKey: "[redacted]" }),
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, CREDENTIAL_SEAL, {
+    value: true,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  return Object.freeze(sealed);
+}
+function firstEnvValue(env, keys) {
+  for (const key of keys) {
+    if (!Object.prototype.hasOwnProperty.call(env, key))
+      continue;
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
 }
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function isAmbientEnvironment(env) {
+  return env === process.env || env[AMBIENT_ENVIRONMENT] === true;
 }
-function codewithHasHookEntryInText(configText, name) {
-  return new RegExp(`hooks run ${escapeRegExp(name)}(?:\\s+--profile\\s+[\\w-]+)?(?:$|\\s|")`).test(configText);
+function defaultKeychainRunner(argv) {
+  const result = spawnSync(KEYCHAIN_SECURITY_BIN, [...argv], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: KEYCHAIN_SPAWN_TIMEOUT_MS
+  });
+  return {
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.error ? result.error.message : result.stderr ?? ""
+  };
 }
-function codewithHasHookEntry(name, scope = "global") {
-  const path = getSettingsPath(scope, "codewith");
-  if (!existsSync11(path))
+function keychainTierEnabled(env, options) {
+  if ((options.platform ?? process.platform) !== "darwin")
     return false;
+  if (options.enabled !== undefined)
+    return options.enabled;
+  return options.run !== undefined || isAmbientEnvironment(env);
+}
+function keychainAccount(env, options) {
+  const station = env[KEYCHAIN_STATION_ENV_KEY]?.trim();
+  if (station)
+    return station;
+  const host = (options.hostname ?? osHostname)().split(".")[0]?.trim() ?? "";
+  if (host)
+    return host;
+  const user = env.USER?.trim();
+  return user || null;
+}
+function keychainFailureHint(text) {
+  const line = text.split(/\r?\n/).find((entry) => entry.trim().length > 0)?.trim() ?? "";
+  const clean = line.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 200);
+  return clean ? `: ${clean}` : "";
+}
+function readKeychainItem(name, env, kind, options) {
+  if (!SAFE_APP_SLUG.test(name) || !keychainTierEnabled(env, options))
+    return null;
+  const account = keychainAccount(env, options);
+  if (!account)
+    return null;
+  const service = `${KEYCHAIN_SERVICE_PREFIX}.${name}.${kind}`;
+  const source = `keychain:${service}@${account}`;
+  const run = options.run ?? defaultKeychainRunner;
+  let result;
   try {
-    return codewithHasHookEntryInText(readFileSync6(path, "utf-8"), name);
-  } catch {
-    return false;
+    result = run(["find-generic-password", "-a", account, "-s", service, "-w"]);
+  } catch (error) {
+    const reason = keychainFailureHint(error instanceof Error ? error.message : String(error));
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} could not run${reason}. A Keychain failure is never resolved ` + `around: fix the keychain, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  if (result.status === KEYCHAIN_ITEM_NOT_FOUND_STATUS)
+    return null;
+  if (result.status !== 0) {
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} failed (security exited ` + `${result.status ?? "without a status"}${keychainFailureHint(result.stderr)}). A Keychain item that ` + `exists but cannot be read is never resolved around: unlock the keychain, run from a session that ` + `may use it, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  const value = result.stdout.trim();
+  if (!value) {
+    throw new CredentialResolutionError(name, `${source} exists but holds an empty value; a declared item never falls through to another ` + `identity. Store a value in it or delete the item.`, [source]);
+  }
+  return { value, source };
+}
+function keychainConfigValue(name, env, options = {}) {
+  return readKeychainItem(name, env, "api-url", options);
+}
+function snapshotClientEnvironment(name, env) {
+  const keys = clientTransportEnvKeys(name);
+  const ambient = isAmbientEnvironment(env);
+  const snapshot = Object.create(null);
+  for (const key of [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey(name),
+    credentialPointerEnvKey(name),
+    CREDENTIAL_PROFILE_ENV_KEY,
+    "HOME",
+    HASNA_HOME_ENV_KEY,
+    HASNA_CONFIG_HOME_ENV_KEY,
+    KEYCHAIN_STATION_ENV_KEY,
+    "USER"
+  ]) {
+    const descriptor = Object.getOwnPropertyDescriptor(env, key);
+    if (!descriptor)
+      continue;
+    if (!("value" in descriptor)) {
+      throw new CredentialResolutionError(name, `${key} is accessor-backed; client configuration requires own data properties.`, [key]);
+    }
+    if (descriptor.value !== undefined && typeof descriptor.value !== "string") {
+      throw new CredentialResolutionError(name, `${key} must be a string data property.`, [key]);
+    }
+    snapshot[key] = descriptor.value;
+  }
+  if (ambient) {
+    Object.defineProperty(snapshot, AMBIENT_ENVIRONMENT, {
+      value: true,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
   }
+  return Object.freeze(snapshot);
 }
-function uninstallHook(name, scope = "global", target = "claude") {
-  const shortName = shortHookName(name);
-  const custom = readCustomManifest(shortName);
-  const bundledMeta = custom ? undefined : getHook(shortName);
-  const existsInTarget = (t) => getRegisteredHooksForTarget("global", t).includes(shortName) || getRegisteredHooksForTarget("project", t).includes(shortName);
-  const registeredClaudeOrGemini = target === "all" ? existsInTarget("claude") || existsInTarget("gemini") : false;
-  const registeredGlobal = registeredClaudeOrGemini || getRegisteredHooksForTarget("global", target === "all" ? "claude" : target).includes(shortName);
-  const registeredProject = registeredClaudeOrGemini || getRegisteredHooksForTarget("project", target === "all" ? "claude" : target).includes(shortName);
-  const codewithOnly = (target === "codewith" || target === "all") && codewithHasHookEntry(shortName, scope);
-  if (!custom && !bundledMeta && !registeredGlobal && !registeredProject && !codewithOnly) {
-    return { name: shortName, removed: false, source: null, settingsScopes: [], storeDirRemoved: false, pinRemoved: false, dbRecordRemoved: false, registrationsRemaining: [], error: `Hook '${shortName}' not found` };
+function resolveCredential(name, env, options = {}) {
+  env = snapshotClientEnvironment(name, env);
+  const { apiKeyKeys } = clientTransportEnvKeys(name);
+  const diskPaths = credentialDiskSources(name, env);
+  if (options.apiKey !== undefined) {
+    const explicitKey = options.apiKey.trim();
+    if (!explicitKey) {
+      throw new CredentialResolutionError(name, "The explicit apiKey argument is blank; an explicit credential never falls through to another identity.", ["explicit apiKey argument"]);
+    }
+    assertUsableCredential(name, "the explicit apiKey argument", explicitKey);
+    return sealCredential({
+      apiKey: explicitKey,
+      tier: "argument",
+      source: "explicit apiKey argument",
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
   }
-  const writableTargets = target === "all" ? ["claude", "gemini"] : target === "codewith" ? [] : [target];
-  const scopes = [];
-  for (const s of ["global", "project"]) {
-    for (const t of writableTargets) {
-      if (getRegisteredHooksForTarget(s, t).includes(shortName)) {
-        unregisterHook(shortName, s, t);
-        if (!scopes.includes(s))
-          scopes.push(s);
-      }
+  const overrideKeyName = credentialOverrideEnvKey(name);
+  const overrideRaw = Object.prototype.hasOwnProperty.call(env, overrideKeyName) ? env[overrideKeyName] : undefined;
+  if (overrideRaw !== undefined) {
+    const override = overrideRaw.trim();
+    if (!override) {
+      throw new CredentialResolutionError(name, `${overrideKeyName} is set but empty. It is a deliberate override, so it is not resolved around: ` + `either give it a real key or unset it to fall back to the credential on disk.`, [overrideKeyName]);
     }
+    assertUsableCredential(name, overrideKeyName, override);
+    return sealCredential({
+      apiKey: override,
+      tier: "override",
+      source: overrideKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
   }
-  const registrationsRemaining = [];
-  if (target === "codewith" || target === "all") {
-    const codewithPath = getSettingsPath(scope, "codewith");
-    if (existsSync11(codewithPath)) {
-      const before = readFileSync6(codewithPath, "utf-8");
-      const after = removeCodewithHookEntry(before, shortName);
-      if (after.removed) {
-        writeFileSync4(codewithPath, after.text, "utf-8");
-      }
-      if (codewithHasHookEntryInText(after.removed ? after.text : before, shortName)) {
-        registrationsRemaining.push("codewith");
-      }
+  const pointerKeyName = credentialPointerEnvKey(name);
+  const pointerRaw = Object.prototype.hasOwnProperty.call(env, pointerKeyName) ? env[pointerKeyName] : undefined;
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE.test(pointer)) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
     }
+    return sealCredential({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
   }
-  if (custom) {
-    try {
-      rmSync(customHookDir(shortName), { recursive: true, force: true });
-    } catch {
-      return {
-        name: shortName,
-        removed: false,
-        source: "custom",
-        settingsScopes: scopes,
-        storeDirRemoved: false,
-        pinRemoved: false,
-        dbRecordRemoved: false,
-        registrationsRemaining,
-        error: `Hook '${shortName}' store directory could not be removed; trust records preserved (no fail-open)`
-      };
+  if (options.profile !== undefined && !options.profile.trim()) {
+    throw new CredentialResolutionError(name, "The explicit profile argument is blank; an explicit identity selection never falls through.", ["explicit profile argument"]);
+  }
+  const profileRaw = Object.prototype.hasOwnProperty.call(env, CREDENTIAL_PROFILE_ENV_KEY) ? env[CREDENTIAL_PROFILE_ENV_KEY] : undefined;
+  if (profileRaw !== undefined && !profileRaw.trim()) {
+    throw new CredentialResolutionError(name, `${CREDENTIAL_PROFILE_ENV_KEY} is set but blank.`, [CREDENTIAL_PROFILE_ENV_KEY]);
+  }
+  const profile = options.profile?.trim() || profileRaw?.trim();
+  if (profile) {
+    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
+    if (!SAFE_PROFILE.test(profile)) {
+      throw new CredentialResolutionError(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
+    }
+    const paths = profileDiskSources(name, env, profile);
+    for (const path of paths) {
+      const value = readCredentialFile(path, apiKeyKeys);
+      if (value) {
+        assertUsableCredential(name, path, value);
+        return sealCredential({
+          apiKey: value,
+          tier: "profile",
+          source: path,
+          deliberate: true,
+          diskCandidates: paths,
+          warning: null
+        });
+      }
     }
+    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
   }
-  const { removedPin, removedRecord } = removeHookFromStore(shortName);
-  return {
-    name: shortName,
-    removed: true,
-    source: custom ? "custom" : bundledMeta ? "bundled" : "registered-only",
-    settingsScopes: scopes,
-    storeDirRemoved: custom ? true : false,
-    pinRemoved: removedPin,
-    dbRecordRemoved: removedRecord,
-    registrationsRemaining
-  };
+  const definedEnvEntries = apiKeyKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, value: String(env[key]).trim() }));
+  const blankEnv = definedEnvEntries.find((entry) => entry.value.length === 0);
+  if (blankEnv) {
+    throw new CredentialResolutionError(name, `${blankEnv.key} is set but blank; a declared credential never falls through to another alias or identity.`, [blankEnv.key]);
+  }
+  if (definedEnvEntries.length > 1 && new Set(definedEnvEntries.map((entry) => entry.value)).size > 1) {
+    throw new CredentialResolutionError(name, `${definedEnvEntries.map((entry) => entry.key).join(" and ")} disagree; credential aliases must be identical or only one may be set.`, definedEnvEntries.map((entry) => entry.key));
+  }
+  const envHit = firstEnvValue(env, apiKeyKeys);
+  const keychainHit = readKeychainItem(name, env, "api-key", options.keychain ?? {});
+  if (keychainHit) {
+    assertUsableCredential(name, keychainHit.source, keychainHit.value);
+    const warning = envHit && envHit.value !== keychainHit.value ? `Credential sources disagree for '${name}': ${keychainHit.source} and ${envHit.key} hold ` + `different keys. ${keychainHit.source} wins, because the Keychain is re-read on every call while ` + `an environment variable is a snapshot. Reconcile them \u2014 a rotation that updated only one leaves ` + `the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: keychainHit.value,
+      tier: "keychain",
+      source: keychainHit.source,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  const diskSourceList = credentialDiskSourceList(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  if (diskHits.length > 0) {
+    const winner = diskHits[0];
+    assertUsableCredential(name, winner.src.path, winner.value);
+    const divergentSources = [
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
+      ...envHit && envHit.value !== winner.value ? [envHit.key] : []
+    ];
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: winner.value,
+      tier: winner.src.tier,
+      source: winner.src.path,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  if (envHit) {
+    assertUsableCredential(name, envHit.key, envHit.value);
+    return sealCredential({
+      apiKey: envHit.value,
+      tier: "env",
+      source: envHit.key,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  return null;
 }
-var __dirname2, HOOKS_DIR, EVENT_MAP, getInstalledHooks;
-var init_installer = __esm(() => {
-  init_registry();
-  init_resolve();
-  init_manifest();
-  init_store();
-  __dirname2 = dirname3(fileURLToPath2(import.meta.url));
-  HOOKS_DIR = existsSync11(join13(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join13(__dirname2, "..", "..", "hooks") : join13(__dirname2, "..", "hooks");
-  EVENT_MAP = {
-    claude: {
-      PreToolUse: "PreToolUse",
-      PostToolUse: "PostToolUse",
-      Stop: "Stop",
-      Notification: "Notification",
-      SessionStart: "SessionStart",
-      SessionEnd: "SessionEnd",
-      UserPromptSubmit: null,
-      SubagentStart: null
-    },
-    gemini: {
-      PreToolUse: "BeforeTool",
-      PostToolUse: "AfterTool",
-      Stop: "AfterAgent",
-      Notification: "Notification",
-      SessionStart: null,
-      SessionEnd: null,
-      UserPromptSubmit: null,
-      SubagentStart: null
-    },
-    codewith: {
-      PreToolUse: "PreToolUse",
-      PostToolUse: "PostToolUse",
-      Stop: "Stop",
-      Notification: null,
-      SessionStart: "SessionStart",
-      SessionEnd: null,
-      UserPromptSubmit: "UserPromptSubmit",
-      SubagentStart: "SubagentStart"
-    }
-  };
-  getInstalledHooks = getRegisteredHooks;
-});
-
-// src/lib/registration.ts
-function safeMatcherTest(pattern, value) {
-  try {
-    return new RegExp(pattern).test(value);
-  } catch {
+function defaultFleetGatewayBaseUrl(name) {
+  return `${DEFAULT_FLEET_GATEWAY_ORIGIN}/${validateAppSlug(name)}`;
+}
+function isValidDnsDomain(value) {
+  if (value.length === 0 || value.length > 253 || ASCII_CONTROL_PATTERN.test(value) || /[^\x00-\x7f]/.test(value)) {
     return false;
   }
+  return value.split(".").every((label) => label.length <= 63 && !label.startsWith("xn--") && DNS_LABEL_PATTERN.test(label));
 }
-function countSettingsWiring(settings) {
-  const hooks = settings.hooks;
-  if (!hooks || typeof hooks !== "object")
-    return 0;
-  let count = 0;
-  for (const eventKey of Object.keys(hooks)) {
-    const entries = hooks[eventKey];
-    if (!Array.isArray(entries))
-      continue;
-    for (const entry of entries) {
-      if (Array.isArray(entry?.hooks))
-        count += entry.hooks.length;
-    }
+function validateAppSlug(name) {
+  if (name.length > 63 || !DNS_LABEL_PATTERN.test(name)) {
+    throw new Error("App name must be one lowercase DNS label.");
   }
-  return count;
+  return name;
 }
-function hookRegisteredInSettings(settings, name, eventSpec, hookMatcher) {
-  const separator = eventSpec.indexOf(":");
-  const eventName = separator === -1 ? eventSpec : eventSpec.slice(0, separator);
-  const specMatcher = separator === -1 ? "" : eventSpec.slice(separator + 1);
-  const matcher = specMatcher || hookMatcher || "";
-  const hooks = settings.hooks?.[eventName];
-  if (!Array.isArray(hooks))
-    return false;
-  return hooks.some((entry) => entry?.hooks?.some((h) => {
-    const match = h?.command?.match(/^hooks run ([\w-]+)/);
-    if (!match || match[1] !== name)
-      return false;
-    if (!matcher)
-      return true;
-    const entryMatcher = typeof entry.matcher === "string" ? entry.matcher : "";
-    if (!entryMatcher)
-      return true;
-    return entryMatcher === matcher || safeMatcherTest(entryMatcher, matcher) || safeMatcherTest(matcher, entryMatcher);
-  }));
+function rawAuthority(value) {
+  const match = /^[a-z][a-z0-9+.-]*:\/\//i.exec(value);
+  if (!match)
+    throw new Error("API URL must be absolute.");
+  const afterScheme = value.slice(match[0].length);
+  const boundary = afterScheme.search(/[/?#]/);
+  const authority = boundary === -1 ? afterScheme : afterScheme.slice(0, boundary);
+  if (!authority)
+    throw new Error("API URL must include a hostname.");
+  return authority;
 }
-
-// src/lib/redact.ts
-function redactText(value) {
-  let out = value;
-  for (const pattern of SECRET_SHAPES) {
-    out = out.replace(pattern, REDACTED);
+function assertCanonicalPort(port) {
+  if (!/^[0-9]+$/.test(port) || port.length > 1 && port.startsWith("0")) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
+  }
+  const numericPort = Number(port);
+  if (!Number.isSafeInteger(numericPort) || numericPort < 1 || numericPort > 65535) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
   }
-  return out;
 }
-function redactValue2(value) {
-  if (typeof value === "string")
-    return redactText(value);
-  if (Array.isArray(value))
-    return value.map(redactValue2);
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const [key, child] of Object.entries(value)) {
-      out[key] = SECRET_KEY_NAMES.test(key) ? REDACTED : redactValue2(child);
+function canonicalAuthorityHostname(authority) {
+  let rawHostname;
+  if (authority.startsWith("[")) {
+    const closingBracket = authority.indexOf("]");
+    if (closingBracket === -1) {
+      throw new Error("API URL authority must contain a canonical hostname.");
+    }
+    rawHostname = authority.slice(0, closingBracket + 1);
+    const portSuffix = authority.slice(closingBracket + 1);
+    if (portSuffix) {
+      if (!portSuffix.startsWith(":")) {
+        throw new Error("API URL authority must contain a canonical hostname and port.");
+      }
+      assertCanonicalPort(portSuffix.slice(1));
+    }
+    if (isIP2(rawHostname.slice(1, -1)) !== 6) {
+      throw new Error("API URL authority must contain a canonical IPv6 literal.");
+    }
+  } else {
+    const firstColon = authority.indexOf(":");
+    const lastColon = authority.lastIndexOf(":");
+    if (firstColon !== lastColon) {
+      throw new Error("IPv6 API URL authorities must use brackets.");
+    }
+    if (lastColon !== -1) {
+      const port = authority.slice(lastColon + 1);
+      assertCanonicalPort(port);
+      rawHostname = authority.slice(0, lastColon);
+    } else {
+      rawHostname = authority;
+    }
+    const ipVersion = isIP2(rawHostname);
+    const numericAddressParts = rawHostname.split(".");
+    const looksLikeNonCanonicalIpv4 = numericAddressParts.every((part) => /^(?:0x[0-9a-f]+|[0-9]+)$/i.test(part));
+    if (ipVersion !== 4 && looksLikeNonCanonicalIpv4 || ipVersion !== 4 && !isValidDnsDomain(rawHostname.toLowerCase())) {
+      throw new Error("API URL authority must contain a canonical ASCII hostname.");
     }
-    return out;
   }
-  return value;
+  return rawHostname.toLowerCase();
 }
-function redactEventPayload(text) {
-  if (text === null || text === undefined)
-    return null;
-  try {
-    const parsed = JSON.parse(text);
-    return redactText(JSON.stringify(redactValue2(parsed)));
-  } catch {
-    return redactText(text);
-  }
+function isDeliberateLoopbackHttpAuthority(authority) {
+  return /^(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?$/i.test(authority);
 }
-function projectEventRowForRead(row) {
-  const out = { ...row };
-  for (const field of ["tool_input", "error", "metadata"]) {
-    const value = out[field];
-    if (typeof value === "string")
-      out[field] = redactEventPayload(value);
-    else if (value === null)
-      out[field] = null;
+function toV1BaseUrl(apiUrl) {
+  if (ASCII_CONTROL_PATTERN.test(apiUrl)) {
+    throw new Error("API URL must not contain ASCII control characters.");
   }
-  return out;
+  const input = apiUrl.trim();
+  const authority = rawAuthority(input);
+  if (authority.includes("@") || authority.includes("\\") || authority.includes("%") || /[^\x00-\x7f]/.test(authority)) {
+    throw new Error("API URL authority must be canonical ASCII without credentials.");
+  }
+  const canonicalHostname = canonicalAuthorityHostname(authority);
+  const url = new URL(input);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("API URL must use http or https.");
+  }
+  if (url.username || url.password) {
+    throw new Error("API URL must not include credentials.");
+  }
+  if (!url.hostname || url.hostname.endsWith(".")) {
+    throw new Error("API URL must include a canonical hostname.");
+  }
+  if (url.hostname.toLowerCase() !== canonicalHostname) {
+    throw new Error("API URL authority must not rely on parser hostname normalization.");
+  }
+  if (url.hostname.split(".").some((label) => label.toLowerCase().startsWith("xn--"))) {
+    throw new Error("API URL must not use IDN or punycode hostnames.");
+  }
+  if (url.protocol === "http:" && !isDeliberateLoopbackHttpAuthority(authority)) {
+    throw new Error("API URL may use http only for an exact loopback authority.");
+  }
+  if (url.search || url.hash) {
+    throw new Error("API URL must not include a query string or fragment.");
+  }
+  let path = url.pathname.replace(/\/+$/, "");
+  if (path.endsWith("/v1"))
+    path = path.slice(0, -"/v1".length);
+  url.pathname = `${path}/v1`;
+  return url.toString().replace(/\/+$/, "");
 }
-var REDACTED = "[REDACTED]", SECRET_KEY_NAMES, SECRET_SHAPES;
-var init_redact = __esm(() => {
-  SECRET_KEY_NAMES = /^(key|keys|token|tokens|secret|secrets|password|passwd|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret|refresh[_-]?token|authorization|auth|cookie|credential|credentials|session[_-]?id|otp|mfa[_-]?code|two[_-]?fa[_-]?code|verification[_-]?code|database_url|db_url|connection_string|dsn)$/i;
-  SECRET_SHAPES = [
-    /\bsk-(?:proj|svc|ant)-[A-Za-z0-9_-]{10,}/g,
-    /\bsk-[A-Za-z0-9]{16,}/g,
-    /\btpe_[A-Za-z0-9]{8,}/g,
-    /\b(?:rk|sk)_(?:live|test)_[A-Za-z0-9]{8,}/g,
-    /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
-    /gh[pousr]_[A-Za-z0-9]{20,}/g,
-    /xox[baprs]-[A-Za-z0-9-]{20,}/g,
-    /AKIA[0-9A-Z]{16}/g,
-    /ASIA[0-9A-Z]{16}/g,
-    /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
-    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/g,
-    /-----BEGIN OPENSSH PRIVATE KEY-----/g,
-    /\bBearer\s+[A-Za-z0-9._~+/=-]{6,}/g,
-    /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:[^/\s@]+@/gi,
-    /\b(?:password|passwd|pwd|token|api[_-]?key|secret|access[_-]?key|client[_-]?secret|authorization|auth|credential|database_url|db_url|connection_string|dsn)\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;"']{6,})/gi
+function resolveClientTransportSnapshot(name, env = process.env, options = {}) {
+  env = snapshotClientEnvironment(name, env);
+  const keys = clientTransportEnvKeys(name);
+  const definedUrlEntries = keys.apiUrlKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, raw: String(env[key]) }));
+  const blankUrl = definedUrlEntries.find((entry) => entry.raw.trim().length === 0);
+  if (blankUrl) {
+    throw new ClientTransportConfigurationError(name, `${blankUrl.key} is set but blank; public clients require an explicit HTTPS API URL and never select local storage.`, [blankUrl.key]);
+  }
+  const controlledUrl = definedUrlEntries.find((entry) => ASCII_CONTROL_PATTERN.test(entry.raw));
+  if (controlledUrl) {
+    throw new ClientTransportConfigurationError(name, `${controlledUrl.key} contains ASCII control characters.`, [controlledUrl.key]);
+  }
+  const usableUrlEntries = definedUrlEntries.map((entry) => ({ key: entry.key, value: entry.raw.trim() }));
+  if (usableUrlEntries.length > 1 && new Set(usableUrlEntries.map((entry) => entry.value)).size > 1) {
+    throw new ClientTransportConfigurationError(name, `${usableUrlEntries.map((entry) => entry.key).join(" and ")} disagree; client authority aliases must be identical or only one may be set.`, usableUrlEntries.map((entry) => entry.key));
+  }
+  const envUrlHit = usableUrlEntries[0] ?? null;
+  const keychainUrlHit = keychainConfigValue(name, env, options.credentials?.keychain);
+  const diskConfigUrlHit = appConfigDiskValue(name, env, keys.apiUrlKeys);
+  if (diskConfigUrlHit?.unusable) {
+    throw new ClientTransportConfigurationError(name, `${diskConfigUrlHit.key} in ${diskConfigUrlHit.path} is declared but blank or malformed; public clients require a valid HTTPS service authority.`, [diskConfigUrlHit.path]);
+  }
+  const urlCandidates = [
+    ...envUrlHit ? [envUrlHit] : [],
+    ...keychainUrlHit ? [{ key: keychainUrlHit.source, value: keychainUrlHit.value }] : [],
+    ...diskConfigUrlHit ? [{ key: diskConfigUrlHit.path, value: diskConfigUrlHit.value.trim() }] : []
   ];
+  const configuredUrl = urlCandidates[0] ?? null;
+  const divergentUrls = urlCandidates.filter((candidate) => candidate.value !== configuredUrl?.value);
+  if (configuredUrl && divergentUrls.length > 0) {
+    throw new ClientTransportConfigurationError(name, `${configuredUrl.key} and ${divergentUrls.map((candidate) => candidate.key).join(" and ")} select different service authorities; refusing to send a credential written for one authority to the other.`, urlCandidates.map((candidate) => candidate.key));
+  }
+  const warnings = [];
+  if (configuredUrl && !envUrlHit) {
+    warnings.push(`No ${keys.apiUrlKeys[0]} in the environment; the server URL in ${configuredUrl.key} was used, so this client connects to the server. ` + `Keep that entry aligned with the intended service authority.`);
+  }
+  const credential = resolveCredential(name, env, options.credentials);
+  if (!credential) {
+    const diskHint = credentialDiskSourcesForMessage(name, env);
+    const lead = configuredUrl ? `${configuredUrl.key} selects the HTTP server for '${name}', but no API key could be resolved` : `${keys.apiUrlKeys[0]} is not set and no API key could be resolved for '${name}'; a credential is required before the default fleet gateway authority applies`;
+    warnings.push(`${lead}; refusing to create an unauthenticated client \u2014 public clients never fall back to SQLite or another local store. ` + `Looked in the Keychain (macOS only), then for a credential file at ${diskHint}, then for ${keys.apiKeyKeys[0]} in the environment.`);
+    throw new ClientTransportConfigurationError(name, warnings.join(" "), [configuredUrl?.key ?? keys.apiUrlKeys[0]]);
+  }
+  if (credential.warning)
+    warnings.push(credential.warning);
+  let urlHit;
+  if (configuredUrl) {
+    urlHit = configuredUrl;
+  } else {
+    try {
+      urlHit = { key: DEFAULT_AUTHORITY_SOURCE, value: defaultFleetGatewayBaseUrl(name) };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new ClientTransportConfigurationError(name, `No ${keys.apiUrlKeys[0]} is configured and the default fleet gateway authority cannot be composed for '${name}': ${message}`, [keys.apiUrlKeys[0]]);
+    }
+  }
+  const apiUrlSource = urlHit.key;
+  let baseUrl;
+  try {
+    baseUrl = toV1BaseUrl(urlHit.value);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new ClientTransportConfigurationError(name, `Invalid API URL from ${apiUrlSource}: ${message}`, [apiUrlSource]);
+  }
+  return {
+    resolution: {
+      transport: "http",
+      transportSource: urlHit.key,
+      baseUrl,
+      apiUrlSource,
+      apiKeyPresent: true,
+      apiKeySource: credential.source,
+      apiKeyTier: credential.tier,
+      misconfigured: false,
+      warning: warnings.length > 0 ? warnings.join(" ") : null
+    },
+    credential
+  };
+}
+function resolveClientTransport(name, env = process.env, options = {}) {
+  return resolveClientTransportSnapshot(name, env, options).resolution;
+}
+function credentialDiskSourcesForMessage(name, env) {
+  const paths = credentialDiskSources(name, env);
+  return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
+}
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM, CREDENTIAL_SEAL, AMBIENT_ENVIRONMENT, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
+var init_transport = __esm(() => {
+  CredentialResolutionError = class CredentialResolutionError extends Error {
+    appName;
+    attempted;
+    constructor(appName, message, attempted) {
+      super(message);
+      this.name = "CredentialResolutionError";
+      this.appName = appName;
+      this.attempted = attempted;
+    }
+  };
+  CredentialFileUnsafeError = class CredentialFileUnsafeError extends Error {
+    path;
+    constructor(path, reason) {
+      super(`Refusing unsafe credential/config file ${path}: ${reason}.`);
+      this.name = "CredentialFileUnsafeError";
+      this.path = path;
+    }
+  };
+  MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+  SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+  ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+  VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
+  CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
+  INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+  CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
+  AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+  SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+  requireSecretsSdk = createRequire(import.meta.url);
+  ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
+  DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  ClientTransportConfigurationError = class ClientTransportConfigurationError extends Error {
+    appName;
+    sources;
+    constructor(appName, message, sources = []) {
+      super(message);
+      this.name = "ClientTransportConfigurationError";
+      this.appName = appName;
+      this.sources = Object.freeze([...sources]);
+    }
+  };
+  IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+  AUTHORITY_OVERRIDE_HEADERS = new Set([
+    "host",
+    ":authority",
+    "forwarded",
+    "x-forwarded-host",
+    "x-original-host"
+  ]);
 });
 
-// src/lib/profiles.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync3, rmSync as rmSync2, cpSync as cpSync2 } from "fs";
-import { join as join14 } from "path";
-function resolveProfilesDir() {
-  const newDir = join14(getEffectiveDataRoot(), "profiles");
-  const oldDir = join14(getHomeDir(), ".hooks", "profiles");
-  if (!existsSync12(newDir) && existsSync12(oldDir)) {
-    mkdirSync6(newDir, { recursive: true });
-    cpSync2(oldDir, newDir, { recursive: true });
-  }
-  return newDir;
+// src/lib/local-opt-in.ts
+function isHooksLocalOptIn(env = process.env) {
+  return HOOKS_LOCAL_OPT_IN_ENV_KEYS.some((key) => (env[key] ?? "").trim() !== "");
 }
-function ensureProfilesDir() {
-  if (!existsSync12(PROFILES_DIR)) {
-    mkdirSync6(PROFILES_DIR, { recursive: true });
-  }
+function hooksAuthorityEnvKeys() {
+  const keys = clientTransportEnvKeys("hooks");
+  return [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey("hooks"),
+    credentialPointerEnvKey("hooks"),
+    CREDENTIAL_PROFILE_ENV_KEY
+  ];
 }
-function profilePath(id) {
-  return join14(PROFILES_DIR, `${id}.json`);
+function hasHooksEnvAuthorityIntent(env = process.env) {
+  return hooksAuthorityEnvKeys().some((key) => (env[key] ?? "").trim() !== "");
 }
-function shortUuid() {
-  return crypto.randomUUID().slice(0, 8);
+function selectsHooksLocalStore(env = process.env) {
+  return !hasHooksEnvAuthorityIntent(env) && isHooksLocalOptIn(env);
 }
-function getProfilesDir() {
-  return PROFILES_DIR;
+function hooksResolverEnv(env) {
+  const blanks = hooksAuthorityEnvKeys().filter((key) => (key in env) && (env[key] ?? "").trim() === "");
+  if (blanks.length === 0)
+    return env;
+  const next = { ...env };
+  for (const key of blanks)
+    delete next[key];
+  return next;
 }
-function createProfile(input) {
-  ensureProfilesDir();
-  const id = shortUuid();
-  const now2 = new Date().toISOString();
-  const profile = {
-    agent_id: id,
-    agent_type: input.agent_type,
-    created_at: now2,
-    last_seen_at: now2,
-    preferences: {}
-  };
-  if (input.name) {
-    profile.name = input.name;
-  }
-  writeFileSync5(profilePath(id), JSON.stringify(profile, null, 2) + `
-`);
-  return profile;
+function isAmbientHooksEnv(env) {
+  if (typeof process !== "undefined" && env === process.env)
+    return true;
+  return env[CONTRACTS_AMBIENT_ENVIRONMENT] === true;
 }
-function getProfile(id) {
-  const path = profilePath(id);
-  try {
-    if (!existsSync12(path))
-      return null;
-    return JSON.parse(readFileSync7(path, "utf-8"));
-  } catch {
-    return null;
+function hooksResolverInputs(env, credentials = {}) {
+  const normalised = hooksResolverEnv(env);
+  if (normalised === env)
+    return { env: normalised, credentials };
+  const keychain = { ...credentials.keychain };
+  if (keychain.enabled === undefined && keychain.run === undefined) {
+    keychain.enabled = isAmbientHooksEnv(env);
   }
+  return { env: normalised, credentials: { ...credentials, keychain } };
 }
-function listProfiles() {
-  if (!existsSync12(PROFILES_DIR))
-    return [];
-  try {
-    const files = readdirSync3(PROFILES_DIR).filter((f) => f.endsWith(".json"));
-    const profiles = [];
-    for (const file of files) {
-      try {
-        const content = readFileSync7(join14(PROFILES_DIR, file), "utf-8");
-        profiles.push(JSON.parse(content));
-      } catch {}
-    }
-    return profiles.sort((a, b) => new Date(a.created_at).getTime() - new Date(b.created_at).getTime());
-  } catch {
-    return [];
-  }
+var HOOKS_LOCAL_OPT_IN_ENV_KEYS, CONTRACTS_AMBIENT_ENVIRONMENT;
+var init_local_opt_in = __esm(() => {
+  init_transport();
+  HOOKS_LOCAL_OPT_IN_ENV_KEYS = ["HASNA_HOOKS_LOCAL", "HOOKS_LOCAL"];
+  CONTRACTS_AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+});
+
+// src/lib/transport.ts
+var exports_transport = {};
+__export(exports_transport, {
+  rethrowHooksAuthorityFailure: () => rethrowHooksAuthorityFailure,
+  resolveHooksTransport: () => resolveHooksTransport,
+  resolveHooksServePublishKey: () => resolveHooksServePublishKey,
+  hooksRegistryOrigin: () => hooksRegistryOrigin,
+  announceHooksLocalMode: () => announceHooksLocalMode,
+  __resetHooksLocalNotice: () => __resetHooksLocalNotice
+});
+function __resetHooksLocalNotice() {
+  localNoticePrinted = false;
 }
-function touchProfile(id) {
-  const profile = getProfile(id);
-  if (!profile)
+function announceLocal(notice, reason) {
+  if (localNoticePrinted)
     return;
-  profile.last_seen_at = new Date().toISOString();
-  writeFileSync5(profilePath(id), JSON.stringify(profile, null, 2) + `
+  localNoticePrinted = true;
+  const line = `hooks: LOCAL mode \u2014 ${reason}; using the bundled registry and the local store at ` + `${getHooksDataDir()}, not a remote registry. Set HASNA_HOOKS_API_KEY (or the Keychain item ` + `hasna.credentials.hooks.api-key / ~/.hasna/hooks/config/credentials) to go remote.`;
+  if (notice)
+    notice(line);
+  else if (typeof process !== "undefined")
+    process.stderr.write(`${line}
 `);
 }
-function exportProfiles() {
-  return listProfiles();
+function announceHooksLocalMode(reason = "HASNA_HOOKS_LOCAL is set and nothing configures a registry authority", notice) {
+  announceLocal(notice, reason);
 }
-function importProfiles(profiles) {
-  ensureProfilesDir();
-  let imported = 0;
-  let skipped = 0;
-  for (const profile of profiles) {
-    if (!profile.agent_id || !profile.agent_type) {
-      skipped++;
-      continue;
-    }
-    const path = profilePath(profile.agent_id);
-    if (existsSync12(path)) {
-      skipped++;
-      continue;
+function hooksRegistryOrigin(v1BaseUrl) {
+  return v1BaseUrl.replace(/\/+$/, "").replace(/\/v1$/, "");
+}
+function rethrowHooksAuthorityFailure(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const name = error instanceof Error ? error.name : "";
+  if (name === "CredentialResolutionError" || name === "CredentialFileUnsafeError") {
+    throw new Error(`REMOTE_API_CREDENTIAL_INVALID: ${message} There is no local fallback: ` + "local mode is opt-in only (HASNA_HOOKS_LOCAL=1) and is disabled by default \u2014 failing closed", { cause: error });
+  }
+  if (/no API key could be resolved/.test(message)) {
+    if (/is not set and no API key could be resolved/.test(message)) {
+      throw new Error("REMOTE_API_CONFIG_MISSING: no hooks registry credential resolved from the Keychain item " + `hasna.credentials.hooks.api-key, ~/.hasna/hooks/config/credentials, or HASNA_HOOKS_API_KEY. ${message} ` + "There is no local fallback: local mode is opt-in only (HASNA_HOOKS_LOCAL=1, alias HOOKS_LOCAL=1) " + "and is disabled by default \u2014 failing closed instead of serving the local store", { cause: error });
     }
-    writeFileSync5(path, JSON.stringify(profile, null, 2) + `
-`);
-    imported++;
+    throw new Error("REMOTE_API_KEY_MISSING: the remote hooks registry requires HASNA_HOOKS_API_KEY, the Keychain item " + `hasna.credentials.hooks.api-key, or ~/.hasna/hooks/config/credentials. ${message} ` + "There is no local fallback: local mode is opt-in only (HASNA_HOOKS_LOCAL=1) and is disabled by default \u2014 failing closed", { cause: error });
   }
-  return { imported, skipped };
+  throw new Error(`REMOTE_API_URL_INVALID: ${message} local mode fallback is disabled`, { cause: error });
 }
-var PROFILES_DIR;
-var init_profiles = __esm(() => {
-  init_app_home();
-  PROFILES_DIR = resolveProfilesDir();
+function resolveHooksTransport(env = process.env, options = {}) {
+  if (selectsHooksLocalStore(env)) {
+    announceLocal(options.notice, "HASNA_HOOKS_LOCAL is set and nothing configures a registry authority");
+    return { mode: "local", source: "local-opt-in", authority: null };
+  }
+  const { env: resolverEnv, credentials } = hooksResolverInputs(env, options.credentials);
+  const tier1 = options.credentials?.apiKey;
+  const credentialOptions = tier1 !== undefined ? { ...credentials, apiKey: tier1 } : credentials;
+  let resolution;
+  let credential;
+  try {
+    credential = resolveCredential("hooks", resolverEnv, credentialOptions);
+    resolution = resolveClientTransport("hooks", resolverEnv, {
+      credentials: credential ? { ...credentialOptions, apiKey: credential.apiKey } : credentialOptions
+    });
+  } catch (error) {
+    rethrowHooksAuthorityFailure(error);
+  }
+  if (!credential) {
+    throw new Error("REMOTE_API_CONFIG_MISSING: no hooks registry credential resolved; " + "local mode fallback is disabled");
+  }
+  return {
+    mode: "remote",
+    source: `${credential.source}+${resolution.apiUrlSource ?? "default"}`,
+    authority: {
+      origin: hooksRegistryOrigin(resolution.baseUrl),
+      apiKey: credential.apiKey,
+      apiUrlSource: resolution.apiUrlSource,
+      apiKeySource: credential.source,
+      apiKeyTier: credential.tier,
+      v1BaseUrl: resolution.baseUrl,
+      warning: resolution.warning
+    }
+  };
+}
+function resolveHooksServePublishKey(env = process.env, options = {}) {
+  const { env: resolverEnv, credentials } = hooksResolverInputs(env, options.credentials);
+  const tier1 = options.credentials?.apiKey;
+  const credentialOptions = tier1 !== undefined ? { ...credentials, apiKey: tier1 } : credentials;
+  return resolveCredential("hooks", resolverEnv, credentialOptions)?.apiKey;
+}
+var localNoticePrinted = false;
+var init_transport2 = __esm(() => {
+  init_transport();
+  init_config();
+  init_local_opt_in();
 });
 
 // src/lib/db-writer.ts
@@ -6408,8 +6890,8 @@ var init_db_writer = __esm(() => {
 });
 
 // src/lib/hook-env.ts
-import { dirname as dirname4, isAbsolute as isAbsolute2 } from "path";
-import { existsSync as existsSync13, statSync as statSync2 } from "fs";
+import { dirname as dirname4, isAbsolute as isAbsolute3 } from "path";
+import { existsSync as existsSync12, statSync } from "fs";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
   if (DENY_PREFIXES.some((prefix) => upper.startsWith(prefix)))
@@ -6427,7 +6909,7 @@ function isBashFunctionEnvName(name) {
   return name.startsWith("BASH_FUNC_");
 }
 function isUnsafePathEntry(entry, home) {
-  if (entry === "" || !isAbsolute2(entry))
+  if (entry === "" || !isAbsolute3(entry))
     return true;
   if (home && (entry === home || entry.startsWith(home + "/")))
     return true;
@@ -6436,14 +6918,14 @@ function isUnsafePathEntry(entry, home) {
   if (entry === "/var/tmp" || entry.startsWith("/var/tmp/"))
     return true;
   try {
-    if ((statSync2(entry).mode & 2) !== 0)
+    if ((statSync(entry).mode & 2) !== 0)
       return true;
   } catch {}
   return false;
 }
 function sanitizeHookPath(pathValue, home) {
   const baseline = PATH_BASELINE.slice();
-  if (process.platform === "darwin" && existsSync13("/opt/homebrew/bin"))
+  if (process.platform === "darwin" && existsSync12("/opt/homebrew/bin"))
     baseline.push("/opt/homebrew/bin");
   const bunDir = dirname4(process.execPath);
   const seen = new Set;
@@ -6568,8 +7050,8 @@ __export(exports_run, {
   HookTimeoutError: () => HookTimeoutError
 });
 import { randomBytes as randomBytes2 } from "crypto";
-import { rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute3, join as join15 } from "path";
+import { rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
+import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute4, join as join13 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -6640,7 +7122,7 @@ async function readPipeWithDeadline(stream, deadlineMs) {
 async function executeVerifiedScript(options) {
   const scriptDir = dirname5(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
-  const tempPath = join15(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
+  const tempPath = join13(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
   let timedOut = false;
   const timeoutTimer = options.timeout ? setTimeout(() => {
@@ -6648,8 +7130,8 @@ async function executeVerifiedScript(options) {
     killGroup(proc, { leaderAlive: proc !== null && proc.exitCode === null });
   }, options.timeout) : null;
   try {
-    writeFileSync6(tempPath, options.content, { flag: "wx", mode: 384 });
-    proc = Bun.spawn([...interpreter.command, isAbsolute3(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
+    writeFileSync5(tempPath, options.content, { flag: "wx", mode: 384 });
+    proc = Bun.spawn([...interpreter.command, isAbsolute4(tempPath) ? tempPath : `./${tempPath}`, ...options.args ?? []], {
       stdin: new Response(options.stdin),
       stdout: "pipe",
       stderr: "pipe",
@@ -6670,7 +7152,7 @@ async function executeVerifiedScript(options) {
     if (timeoutTimer)
       clearTimeout(timeoutTimer);
     try {
-      rmSync3(tempPath, { force: true });
+      rmSync2(tempPath, { force: true });
     } catch {}
   }
 }
@@ -6731,15 +7213,15 @@ __export(exports_custom_install, {
   installCustomSource: () => installCustomSource,
   ensureCustomDir: () => ensureCustomDir
 });
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync8, rmSync as rmSync4 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync6, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
+import { join as join14 } from "path";
 import { tmpdir } from "os";
 function manifestAt(dir) {
-  const path = join16(dir, "manifest.json");
-  if (!existsSync14(path))
+  const path = join14(dir, "manifest.json");
+  if (!existsSync13(path))
     return;
   try {
-    return parseManifest(readFileSync8(path, "utf-8"));
+    return parseManifest(readFileSync7(path, "utf-8"));
   } catch {
     return;
   }
@@ -6758,8 +7240,8 @@ function writeFromManifest(manifest, srcDir, source, kind) {
   return { name, version: manifest.version, kind, source, dir, scriptPath };
 }
 async function cloneToTemp(gitUrl) {
-  const tmp = mkdtempSync(join16(tmpdir(), "hooks-install-"));
-  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join16(tmp, "repo")], {
+  const tmp = mkdtempSync(join14(tmpdir(), "hooks-install-"));
+  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join14(tmp, "repo")], {
     stdout: "pipe",
     stderr: "pipe"
   });
@@ -6769,10 +7251,10 @@ async function cloneToTemp(gitUrl) {
     proc.exited
   ]);
   if (exitCode !== 0) {
-    rmSync4(tmp, { recursive: true, force: true });
+    rmSync3(tmp, { recursive: true, force: true });
     throw new Error(`git clone failed (${exitCode}): ${stderr.trim()}`);
   }
-  return join16(tmp, "repo");
+  return join14(tmp, "repo");
 }
 function isGitUrl(value) {
   return value.startsWith("git@") || value.startsWith("ssh://") || value.startsWith("file://") || value.endsWith(".git");
@@ -6782,7 +7264,7 @@ function isCustomSource(value) {
     return true;
   if (value.startsWith("http://") || value.startsWith("https://"))
     return true;
-  return existsSync14(value);
+  return existsSync13(value);
 }
 async function installCustomSource(source) {
   if (isGitUrl(source)) {
@@ -6790,17 +7272,17 @@ async function installCustomSource(source) {
     try {
       return copyManifestDir(repoDir, source, "git");
     } finally {
-      rmSync4(repoDir, { recursive: true, force: true });
+      rmSync3(repoDir, { recursive: true, force: true });
     }
   }
   if (source.startsWith("http://") || source.startsWith("https://")) {
     return installManifestUrl(source);
   }
-  if (!existsSync14(source)) {
+  if (!existsSync13(source)) {
     throw new Error(`No such local path: ${source}`);
   }
   if (source.endsWith("manifest.json")) {
-    const manifest = parseManifest(readFileSync8(source, "utf-8"));
+    const manifest = parseManifest(readFileSync7(source, "utf-8"));
     return writeFromManifest(manifest, source.substring(0, source.lastIndexOf("/")), source, "local");
   }
   return copyManifestDir(source, source, "local");
@@ -6831,7 +7313,7 @@ async function installManifestUrl(url) {
 }
 function ensureCustomDir() {
   const dir = getCustomHooksDir();
-  mkdirSync7(dir, { recursive: true });
+  mkdirSync6(dir, { recursive: true });
   return dir;
 }
 var init_custom_install = __esm(() => {
@@ -6849,12 +7331,12 @@ __export(exports_sync, {
   commitSyncArtifacts: () => commitSyncArtifacts
 });
 import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 function sha256OfText(text) {
   return createHash2("sha256").update(text).digest("hex");
 }
 function sha256OfPath(path) {
-  return createHash2("sha256").update(readFileSync9(path)).digest("hex");
+  return createHash2("sha256").update(readFileSync8(path)).digest("hex");
 }
 function collectBundledCatalog() {
   const out = [];
@@ -6870,9 +7352,8 @@ function collectBundledCatalog() {
   }
   return out;
 }
-async function fetchJson(base, path, opts) {
+async function fetchJson(base, path, apiKey, opts) {
   const headers = { accept: "application/json" };
-  const apiKey = resolveApiKey();
   if (apiKey)
     headers["x-api-key"] = apiKey;
   const res = await fetch(`${base}${path}`, {
@@ -6881,7 +7362,7 @@ async function fetchJson(base, path, opts) {
     signal: AbortSignal.timeout(15000)
   });
   if (res.status === 401) {
-    throw new Error("registry requires API key \u2014 set HASNA_HOOKS_API_KEY or HOOKS_API_KEY (vault-delivered, never stored)");
+    throw new Error("registry requires API key \u2014 set HASNA_HOOKS_API_KEY, the Keychain item hasna.credentials.hooks.api-key, " + "or ~/.hasna/hooks/config/credentials (resolved per call, never stored)");
   }
   if (!res.ok) {
     throw new Error(`GET ${path} failed with status ${res.status}`);
@@ -6892,9 +7373,9 @@ async function fetchJson(base, path, opts) {
   }
   return body;
 }
-async function fetchRemoteState(apiUrl) {
-  const catalog = await fetchJson(apiUrl, "/api/v1/catalog");
-  const remoteLock = await fetchJson(apiUrl, "/api/v1/lock");
+async function fetchRemoteState(apiUrl, apiKey) {
+  const catalog = await fetchJson(apiUrl, "/api/v1/catalog", apiKey);
+  const remoteLock = await fetchJson(apiUrl, "/api/v1/lock", apiKey);
   if (!catalog.hooks || !Array.isArray(catalog.hooks)) {
     throw new Error("remote catalog is malformed: missing hooks array");
   }
@@ -6937,20 +7418,25 @@ function computeDiff(catalog, remoteLock) {
   return diff;
 }
 async function planSync(options = {}) {
-  const apiUrl = resolveApiUrl();
-  if (apiUrl) {
-    const { catalog, remoteLock } = await fetchRemoteState(apiUrl);
-    return { apiUrl, dryRun: options.dryRun ?? false, diff: computeDiff(catalog, remoteLock) };
+  const transport = resolveHooksTransport(options.env ?? process.env, {
+    credentials: options.credentials
+  });
+  if (transport.mode === "remote" && transport.authority) {
+    const { origin, apiKey } = transport.authority;
+    const { catalog, remoteLock } = await fetchRemoteState(origin, apiKey);
+    return { apiUrl: origin, dryRun: options.dryRun ?? false, diff: computeDiff(catalog, remoteLock) };
   }
   const diff = computeDiff(collectBundledCatalog(), null);
   return { apiUrl: null, dryRun: options.dryRun ?? false, diff };
 }
 async function syncHooks(options = {}) {
-  const apiUrl = resolveApiUrl();
-  const plan = await planSync();
+  const transport = resolveHooksTransport(options.env ?? process.env, {
+    credentials: options.credentials
+  });
+  const plan = await planSync(options);
   if (options.dryRun)
     return { ...plan, dryRun: true };
-  if (!apiUrl) {
+  if (transport.mode !== "remote" || !transport.authority) {
     const db = getDb();
     for (const entry of collectBundledCatalog()) {
       setPinnedHook(entry.name, { version: entry.version, sha256: entry.sha256, source: "bundled" });
@@ -6965,19 +7451,20 @@ async function syncHooks(options = {}) {
     }
     return plan;
   }
-  const { catalog, remoteLock } = await fetchRemoteState(apiUrl);
+  const { origin, apiKey } = transport.authority;
+  const { catalog, remoteLock } = await fetchRemoteState(origin, apiKey);
   const diff = computeDiff(catalog, remoteLock);
-  const staged = await stageSyncArtifacts(apiUrl, [...diff.added, ...diff.updated], remoteLock);
-  await commitSyncArtifacts(staged, apiUrl, remoteLock);
-  return { apiUrl, dryRun: false, diff };
+  const staged = await stageSyncArtifacts(origin, apiKey, [...diff.added, ...diff.updated], remoteLock);
+  await commitSyncArtifacts(staged, origin, remoteLock);
+  return { apiUrl: origin, dryRun: false, diff };
 }
-async function stageSyncArtifacts(apiUrl, names, remoteLock) {
+async function stageSyncArtifacts(apiUrl, apiKey, names, remoteLock) {
   const staged = [];
   for (const name of names) {
     const entry = remoteLock.hooks[name];
     if (!entry)
       continue;
-    const artifact = await fetchJson(apiUrl, `/api/v1/hooks/${encodeURIComponent(name)}/${encodeURIComponent(entry.version)}`);
+    const artifact = await fetchJson(apiUrl, `/api/v1/hooks/${encodeURIComponent(name)}/${encodeURIComponent(entry.version)}`, apiKey);
     if (!artifact.manifest || typeof artifact.script !== "string") {
       throw new Error(`artifact for '${name}@${entry.version}' is malformed`);
     }
@@ -7044,8 +7531,8 @@ async function commitSyncArtifacts(staged, apiUrl, remoteLock) {
     throw err;
   }
 }
-async function fetchPinnedHook(name, version, apiUrl) {
-  const remoteLock = await fetchJson(apiUrl, "/api/v1/lock");
+async function fetchPinnedHook(name, version, apiUrl, apiKey) {
+  const remoteLock = await fetchJson(apiUrl, "/api/v1/lock", apiKey);
   const entry = remoteLock.hooks?.[name];
   if (!entry) {
     throw new Error(`Hook '${name}' is not in the remote registry lock`);
@@ -7054,7 +7541,7 @@ async function fetchPinnedHook(name, version, apiUrl) {
   if (!isLatest && !(entry.versions ?? []).includes(version)) {
     throw new Error(`Hook '${name}' version ${version} is not in the remote registry (available: ${[entry.version, ...entry.versions ?? []].join(", ")})`);
   }
-  const artifact = await fetchJson(apiUrl, `/api/v1/hooks/${encodeURIComponent(name)}/${encodeURIComponent(version)}`, { withHeader: "_headerSha" });
+  const artifact = await fetchJson(apiUrl, `/api/v1/hooks/${encodeURIComponent(name)}/${encodeURIComponent(version)}`, apiKey, { withHeader: "_headerSha" });
   if (!artifact.manifest || typeof artifact.script !== "string") {
     throw new Error(`artifact for '${name}@${version}' is malformed`);
   }
@@ -7107,7 +7594,7 @@ async function fetchPinnedHook(name, version, apiUrl) {
 }
 var init_sync = __esm(() => {
   init_registry();
-  init_config();
+  init_transport2();
   init_db();
   init_store();
   init_manifest();
@@ -7747,7 +8234,7 @@ var init_openapi = __esm(() => {
         apiKey: {
           type: "http",
           scheme: "bearer",
-          description: "The registry API key (HASNA_HOOKS_API_KEY / HOOKS_API_KEY)."
+          description: "The registry API key \u2014 resolved by the client through the @hasna/contracts chain (HASNA_HOOKS_API_KEY, the Keychain item hasna.credentials.hooks.api-key, or ~/.hasna/hooks/config/credentials); the server compares the inbound bearer/x-api-key value."
         }
       }
     }
@@ -7764,13 +8251,13 @@ __export(exports_serve, {
   SERVE_HOST: () => SERVE_HOST,
   DEFAULT_SERVE_PORT: () => DEFAULT_SERVE_PORT
 });
-import { readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname6, join as join17 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
+import { dirname as dirname6, join as join15 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function packageVersion() {
   try {
-    const pkgPath = join17(dirname6(fileURLToPath3(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync10(pkgPath, "utf-8")).version || "0.0.0";
+    const pkgPath = join15(dirname6(fileURLToPath3(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync9(pkgPath, "utf-8")).version || "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -7927,12 +8414,11 @@ function resolveServeOptions(options) {
 }
 function startServeServer(options) {
   const { port, host } = resolveServeOptions(options);
-  const apiKey = resolveApiKey();
   const server = Bun.serve({
     hostname: host,
     port,
     async fetch(req) {
-      return handleServeRequest(req, apiKey);
+      return handleServeRequest(req, resolveHooksServePublishKey());
     }
   });
   console.error(`hooks registry listening on http://${host}:${port} (publish requires an API key)`);
@@ -7944,7 +8430,7 @@ var init_serve = __esm(() => {
   init_manifest();
   init_store();
   init_resolve();
-  init_config();
+  init_transport2();
   init_openapi();
   init_semver();
   if (false) {}
@@ -8046,17 +8532,17 @@ import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z2 } from "zod";
 import { createServer } from "http";
-import { existsSync as existsSync15, readFileSync as readFileSync11 } from "fs";
-import { join as join18, dirname as dirname7 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync10 } from "fs";
+import { join as join16, dirname as dirname7 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 async function runVerifiedHook(name, stdin, timeoutMs) {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
   const resolved = resolveHook2(name);
   const hookScript = resolveScriptPath2(name);
-  if (!resolved || !hookScript || !existsSync15(hookScript)) {
+  if (!resolved || !hookScript || !existsSync14(hookScript)) {
     throw new Error(`Hook '${name}' not found`);
   }
-  const content = readFileSync11(hookScript);
+  const content = readFileSync10(hookScript);
   const sha = sha256Of(content);
   const check = checkScriptHash(name, sha);
   if (!check.ok) {
@@ -8261,7 +8747,7 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     const issues = [];
     const healthy = [];
-    const settingsExist = existsSync15(settingsPath);
+    const settingsExist = existsSync14(settingsPath);
     if (!settingsExist) {
       issues.push({ hook: "(settings)", issue: `${settingsPath} not found`, severity: "warning" });
     }
@@ -8271,7 +8757,7 @@ function createHooksServer() {
       const meta = custom ? resolveHookMeta(name) : getHook(name);
       let hookHealthy = true;
       if (custom) {
-        if (!existsSync15(custom.scriptPath)) {
+        if (!existsSync14(custom.scriptPath)) {
           issues.push({ hook: name, issue: `Custom hook script missing: ${custom.scriptPath}`, severity: "error" });
           hookHealthy = false;
         }
@@ -8281,14 +8767,14 @@ function createHooksServer() {
           continue;
         }
         const hookDir = getHookPath(name);
-        if (!existsSync15(join18(hookDir, "src", "hook.ts"))) {
+        if (!existsSync14(join16(hookDir, "src", "hook.ts"))) {
           issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
           hookHealthy = false;
         }
       }
       if (meta && settingsExist) {
         try {
-          const settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
+          const settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
           if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
             const eventName = meta.event.split(":")[0];
             issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
@@ -8318,10 +8804,10 @@ function createHooksServer() {
         return { content: [{ type: "text", text: JSON.stringify({ error: `Hook '${name}' not found` }) }] };
       }
       const hookPath = getHookPath(name);
-      const readmePath = join18(hookPath, "README.md");
+      const readmePath = join16(hookPath, "README.md");
       let readme = "";
-      if (existsSync15(readmePath)) {
-        readme = readFileSync11(readmePath, "utf-8");
+      if (existsSync14(readmePath)) {
+        readme = readFileSync10(readmePath, "utf-8");
       }
       if (verbose) {
         return { content: [{ type: "text", text: JSON.stringify({ ...meta, readme }) }] };
@@ -8504,7 +8990,7 @@ function createHooksServer() {
     const ctx = {
       scope,
       settings_path: settingsPath,
-      settings_exists: existsSync15(settingsPath),
+      settings_exists: existsSync14(settingsPath),
       registered_hooks: hooks,
       hook_count: hooks.length,
       healthy,
@@ -8650,8 +9136,8 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     let settings = {};
     try {
-      if (existsSync15(settingsPath))
-        settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
+      if (existsSync14(settingsPath))
+        settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
     } catch {}
     if (!settings.hooks)
       settings.hooks = {};
@@ -8659,10 +9145,10 @@ function createHooksServer() {
     if (!disabled.includes(name))
       disabled.push(name);
     settings.hooks.__disabled = disabled;
-    const { writeFileSync: writeFileSync7, mkdirSync: mkdirSync8 } = await import("fs");
+    const { writeFileSync: writeFileSync6, mkdirSync: mkdirSync7 } = await import("fs");
     const { dirname: dirname8 } = await import("path");
-    mkdirSync8(dirname8(settingsPath), { recursive: true });
-    writeFileSync7(settingsPath, JSON.stringify(settings, null, 2) + `
+    mkdirSync7(dirname8(settingsPath), { recursive: true });
+    writeFileSync6(settingsPath, JSON.stringify(settings, null, 2) + `
 `);
     return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: true, scope }) }] };
   });
@@ -8673,15 +9159,15 @@ function createHooksServer() {
     const settingsPath = getSettingsPath(scope);
     let settings = {};
     try {
-      if (existsSync15(settingsPath))
-        settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
+      if (existsSync14(settingsPath))
+        settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
     } catch {}
     if (settings.hooks?.__disabled) {
       settings.hooks.__disabled = settings.hooks.__disabled.filter((n) => n !== name);
       if (settings.hooks.__disabled.length === 0)
         delete settings.hooks.__disabled;
-      const { writeFileSync: writeFileSync7 } = await import("fs");
-      writeFileSync7(settingsPath, JSON.stringify(settings, null, 2) + `
+      const { writeFileSync: writeFileSync6 } = await import("fs");
+      writeFileSync6(settingsPath, JSON.stringify(settings, null, 2) + `
 `);
     }
     return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: false, scope }) }] };
@@ -9038,9 +9524,9 @@ var init_server = __esm(() => {
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
-      const p = join18(__dirname3, rel);
-      if (existsSync15(p)) {
-        pkg = JSON.parse(readFileSync11(p, "utf-8"));
+      const p = join16(__dirname3, rel);
+      if (existsSync14(p)) {
+        pkg = JSON.parse(readFileSync10(p, "utf-8"));
         break;
       }
     }
@@ -9112,12 +9598,12 @@ var init_http = () => {};
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
 import { existsSync as existsSync2 } from "fs";
-import { join as join3 } from "path";
+import { join as join2 } from "path";
 import { existsSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2, resolve } from "path";
 import { homedir } from "os";
-import { join } from "path";
+import { join, resolve } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
 import { createHmac, timingSafeEqual } from "crypto";
 import { lookup as dnsLookup } from "dns/promises";
 import { isIP } from "net";
@@ -9221,75 +9707,72 @@ function channelMatchesEvent(channel, event) {
     return true;
   return channel.filters.some((filter) => eventMatchesFilter(event, filter));
 }
-var KIND_ENV = {
+var PATHS_RESOLVER_KIND_ENV = {
   config: "HASNA_CONFIG_HOME",
   data: "HASNA_DATA_HOME",
   state: "HASNA_STATE_HOME",
   cache: "HASNA_CACHE_HOME"
 };
-var APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-function assertApp(app) {
+var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp(app) {
   if (typeof app !== "string" || app.length === 0) {
     throw new TypeError("paths: app must be a non-empty string");
   }
-  if (!APP_SLUG_RE.test(app)) {
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function envOf(options) {
-  return options.env ?? process.env;
-}
-function envValue(options, kind) {
-  const value = envOf(options)[KIND_ENV[kind]];
-  return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-function isMacOS(platform) {
-  return platform === "darwin";
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
 }
-function baseDir(kind, options) {
-  const override = envValue(options, kind);
-  if (override)
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
     return override;
-  const home = options.home ?? homedir();
+  const home = options.home ?? pathsResolverHomedir();
   const platform = options.platform ?? process.platform;
-  if (isMacOS(platform)) {
+  if (platform === "darwin") {
     switch (kind) {
       case "config":
       case "data":
-        return join(home, "Library", "Application Support", "Hasna");
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
       case "cache":
-        return join(home, "Library", "Caches", "Hasna");
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
       case "state":
-        return join(home, "Library", "Logs", "Hasna");
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
     }
   }
   switch (kind) {
     case "config":
-      return join(home, ".config", "hasna");
+      return pathsResolverJoin(home, ".config", "hasna");
     case "data":
-      return join(home, ".local", "share", "hasna");
+      return pathsResolverJoin(home, ".local", "share", "hasna");
     case "state":
-      return join(home, ".local", "state", "hasna");
+      return pathsResolverJoin(home, ".local", "state", "hasna");
     case "cache":
-      return join(home, ".cache", "hasna");
+      return pathsResolverJoin(home, ".cache", "hasna");
   }
 }
-function resolvePath(kind, options) {
-  assertApp(options.app);
-  const appSegment = options.internal === true ? join("internal", options.app) : options.app;
-  return join(baseDir(kind, options), appSegment);
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
 }
 function dataDir(options) {
-  return resolvePath("data", options);
+  return pathsResolverResolve("data", options);
 }
 var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR";
 var HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME";
 var EVENTS_STORE_SENTINEL_FILE = "events.json";
 function effectiveHome() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || homedir2();
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir();
 }
 function legacyHomeDir() {
-  return join2(effectiveHome(), ".hasna", "events");
+  return join(effectiveHome(), ".hasna", "events");
 }
 function resolverHome() {
   return dataDir({ app: "events", home: effectiveHome() || undefined });
@@ -9298,7 +9781,7 @@ function adoptResolverHome(resolved, env = process.env) {
   const dataOverride = env.HASNA_DATA_HOME;
   if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
     return true;
-  return existsSync(join2(resolved, EVENTS_STORE_SENTINEL_FILE));
+  return existsSync(join(resolved, EVENTS_STORE_SENTINEL_FILE));
 }
 function exactEventsHome() {
   const dir = process.env[HASNA_EVENTS_DIR_ENV];
@@ -9339,9 +9822,9 @@ class JsonEventsStore {
   constructor(dataDir2 = getEventsDataDir()) {
     this.dataDir = dataDir2;
     this.runtime = localJsonRuntime(dataDir2);
-    this.channelsPath = join3(dataDir2, "channels.json");
-    this.eventsPath = join3(dataDir2, "events.json");
-    this.deliveriesPath = join3(dataDir2, "deliveries.json");
+    this.channelsPath = join2(dataDir2, "channels.json");
+    this.eventsPath = join2(dataDir2, "events.json");
+    this.deliveriesPath = join2(dataDir2, "deliveries.json");
   }
   async init() {
     await mkdir(this.dataDir, { recursive: true, mode: 448 });
@@ -9609,7 +10092,7 @@ async function getEventsStatus(dataDir2) {
   };
 }
 function statusFile(dataDir2, fileName, records) {
-  const path = join3(dataDir2, fileName);
+  const path = join2(dataDir2, fileName);
   return { path, exists: existsSync2(path), records };
 }
 var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
@@ -10543,6 +11026,13 @@ function parseMatcherExpression(value, label) {
     negated: false
   };
 }
+function webhookTargetPolicyFromEnv() {
+  const value = process.env.HASNA_EVENTS_ALLOW_PRIVATE_WEBHOOK_TARGETS;
+  if (!value)
+    return;
+  const hosts = value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+  return hosts.length > 0 ? { allowPrivateHosts: hosts } : undefined;
+}
 var DEFAULT_EVENT_LIST_LIMIT = 100;
 function parseJsonObject(value, fallback) {
   if (!value)
@@ -10568,7 +11058,7 @@ function parseHeaders(values) {
 function createClient(options) {
   if (options.createClient)
     return options.createClient();
-  return new EventsClient({ store: new JsonEventsStore(options.dataDir) });
+  return new EventsClient({ store: new JsonEventsStore(options.dataDir), webhookTargetPolicy: webhookTargetPolicyFromEnv() });
 }
 function print(value, json, text) {
   if (json)
@@ -10649,6 +11139,8 @@ function registerChannelCommands(program, options) {
         metadata: parseJsonObject(actionOptions.metadata, {})
       }, { honorFilters: actionOptions.honorFilters });
       print(result, json, `${result.status}: ${result.channelId}`);
+      if (result.status === "failed")
+        process.exitCode = 1;
     } catch (error) {
       fail(error, json);
     }
@@ -10759,8 +11251,8 @@ var {
 
 // src/cli/index.tsx
 import chalk2 from "chalk";
-import { existsSync as existsSync16, readFileSync as readFileSync12, rmSync as rmSync5 } from "fs";
-import { join as join19, dirname as dirname8 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync11, rmSync as rmSync4 } from "fs";
+import { join as join17, dirname as dirname8 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 
 // src/cli/components/App.tsx
@@ -11943,10 +12435,12 @@ init_store();
 init_semver();
 init_app_home();
 init_config();
+init_local_opt_in();
+init_transport2();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
 var __dirname4 = dirname8(fileURLToPath5(import.meta.url));
-var pkgPath = existsSync16(join19(__dirname4, "..", "package.json")) ? join19(__dirname4, "..", "package.json") : join19(__dirname4, "..", "..", "package.json");
-var pkg2 = JSON.parse(readFileSync12(pkgPath, "utf-8"));
+var pkgPath = existsSync15(join17(__dirname4, "..", "package.json")) ? join17(__dirname4, "..", "package.json") : join17(__dirname4, "..", "..", "package.json");
+var pkg2 = JSON.parse(readFileSync11(pkgPath, "utf-8"));
 var program2 = new Command;
 function resolveScope(options) {
   if (options.project)
@@ -11980,7 +12474,7 @@ function projectLogRows2(rows) {
 function readToken(tokenFile) {
   if (tokenFile) {
     try {
-      return readFileSync12(tokenFile, "utf-8").trim();
+      return readFileSync11(tokenFile, "utf-8").trim();
     } catch {
       return;
     }
@@ -12045,7 +12539,6 @@ program2.command("interactive", { isDefault: true }).alias("i").description("Int
 });
 program2.command("init").description("Register a new agent profile with a unique ID").option("-a, --agent <type>", "Agent type: claude, gemini, custom", "claude").option("-n, --name <name>", "Optional display name for the agent").option("-j, --json", "Output as JSON", false).option("--cloudflare", "Configure a remote registry (Cloudflare worker)", false).option("--api-url <url>", "Remote registry API URL (with --cloudflare)").option("--api-key <ref>", "Vault key NAME for the registry API key (never the value; with --cloudflare)").action(async (options) => {
   if (options.cloudflare) {
-    const { writeConfig: writeConfig2 } = await Promise.resolve().then(() => (init_config(), exports_config));
     if (!options.apiUrl) {
       const message = "--cloudflare requires --api-url <url>";
       if (options.json)
@@ -12055,22 +12548,39 @@ program2.command("init").description("Register a new agent profile with a unique
       return;
     }
     const apiKeyRef = options.apiKey ?? "hasna/hooks/live/api-key";
-    const config = { api_url: options.apiUrl.replace(/\/+$/, ""), api_key_ref: apiKeyRef };
-    const path = writeConfig2(config);
+    const apiUrl = options.apiUrl.replace(/\/+$/, "");
     if (options.json) {
-      console.log(JSON.stringify({ ok: true, api_url: config.api_url, api_key_ref: config.api_key_ref, config_path: path }));
+      console.log(JSON.stringify({
+        ok: true,
+        api_url: apiUrl,
+        api_key_ref: apiKeyRef,
+        env: {
+          HASNA_HOOKS_API_URL: apiUrl,
+          HASNA_HOOKS_API_KEY_REF: apiKeyRef
+        },
+        note: "config.json is retired; no file was written"
+      }));
       return;
     }
     console.log(chalk2.green(`
-\u2713 Remote registry configured
+\u2713 Remote registry configuration for ${apiUrl}
 `));
-    console.log(`  ${chalk2.dim("API URL:")}    ${config.api_url}`);
-    console.log(`  ${chalk2.dim("API key ref:")} ${config.api_key_ref}`);
-    console.log(`  ${chalk2.dim("Config:")}      ${path}`);
+    console.log(`  ${chalk2.dim("API URL:")}    ${apiUrl}`);
+    console.log(`  ${chalk2.dim("API key ref:")} ${apiKeyRef}`);
+    console.log();
+    console.log(chalk2.dim("  ~/.hasna/hooks/config.json is retired (hasna/apps#1720); the registry"));
+    console.log(chalk2.dim("  URL and key now resolve through @hasna/contracts, per call, in this order:"));
+    console.log(chalk2.dim("    HASNA_HOOKS_API_URL / HASNA_HOOKS_API_KEY (env)"));
+    console.log(chalk2.dim("    hasna.credentials.hooks.api-url / .api-key (macOS Keychain)"));
+    console.log(chalk2.dim("    ~/.hasna/hooks/config/credentials (disk, owner-only)"));
+    console.log();
+    console.log(chalk2.dim("  Configure the machine for this registry:"));
+    console.log(`    export HASNA_HOOKS_API_URL=${apiUrl}`);
+    console.log(`    export HASNA_HOOKS_API_KEY_REF=${apiKeyRef}   # resolved through the vault, never a value`);
     console.log();
-    console.log(chalk2.dim("  Presence of an API URL selects the remote registry; absence means local."));
-    console.log(chalk2.dim(`  Run the server with the key resolved from the vault, never the value:`));
-    console.log(`    secrets exec ${config.api_key_ref} --as HASNA_HOOKS_API_KEY -- hooks serve`);
+    console.log(chalk2.dim("  Run the server with the key resolved from the vault, never the value:"));
+    console.log(`    secrets exec ${apiKeyRef} --as HASNA_HOOKS_API_KEY -- hooks serve`);
+    console.log(chalk2.dim("  (or store the Keychain item hasna.credentials.hooks.api-key)"));
     console.log();
     return;
   }
@@ -12097,7 +12607,7 @@ program2.command("init").description("Register a new agent profile with a unique
   if (profile.name) {
     console.log(`  ${chalk2.dim("Name:")}       ${profile.name}`);
   }
-  console.log(`  ${chalk2.dim("Profile:")}    ${join19(getProfilesDir(), `${profile.agent_id}.json`)}`);
+  console.log(`  ${chalk2.dim("Profile:")}    ${join17(getProfilesDir(), `${profile.agent_id}.json`)}`);
   console.log();
   console.log(chalk2.dim("  Install hooks with this profile:"));
   console.log(`    hooks install gitguard --profile ${profile.agent_id}`);
@@ -12113,11 +12623,11 @@ program2.command("run").argument("<hook>", "Hook to run").option("--profile <id>
     process.exit(1);
   }
   const hookScript = resolveScriptPath2(hook);
-  if (!hookScript || !existsSync16(hookScript)) {
+  if (!hookScript || !existsSync15(hookScript)) {
     console.error(JSON.stringify({ error: `Hook script not found: ${hookScript ?? hook}` }));
     process.exit(1);
   }
-  const content = readFileSync12(hookScript);
+  const content = readFileSync11(hookScript);
   const sha = sha256Of2(content);
   const check = checkScriptHash2(hook, sha);
   if (!check.ok) {
@@ -12258,7 +12768,7 @@ program2.command("install").alias("add").argument("[hooks...]", "Hooks to instal
   }
   const { isCustomSource: isCustomSource2, installCustomSource: installCustomSource2 } = await Promise.resolve().then(() => (init_custom_install(), exports_custom_install));
   const { readCustomManifest: readCustomManifest2, HOOK_NAME_RE: HOOK_NAME_RE2 } = await Promise.resolve().then(() => (init_manifest(), exports_manifest));
-  const { resolveApiUrl: resolveApiUrl2 } = await Promise.resolve().then(() => (init_config(), exports_config));
+  const { resolveHooksTransport: resolveHooksTransport2 } = await Promise.resolve().then(() => (init_transport2(), exports_transport));
   const { sha256Of: sha256Of2, pinInstalledHook: pinInstalledHook2 } = await Promise.resolve().then(() => (init_store(), exports_store));
   const { readFileSync: readFileSyncFs } = await import("fs");
   function parseNameVersion(arg) {
@@ -12327,7 +12837,7 @@ Dry run \u2014 would install (${scope}, ${target}):
         const { customHookDir: customHookDir2 } = await Promise.resolve().then(() => (init_manifest(), exports_manifest));
         const { removeHookFromStore: removeHookFromStore2 } = await Promise.resolve().then(() => (init_store(), exports_store));
         try {
-          rmSync5(customHookDir2(custom.name), { recursive: true, force: true });
+          rmSync4(customHookDir2(custom.name), { recursive: true, force: true });
         } catch {}
         removeHookFromStore2(custom.name);
         throw pinError;
@@ -12351,11 +12861,13 @@ Dry run \u2014 would install (${scope}, ${target}):
   const installedPinned = [];
   for (const { arg, pinned } of pinnedRequests) {
     try {
-      const apiUrl = resolveApiUrl2();
-      if (!apiUrl)
-        throw new Error(`Cannot install '${arg}': no remote registry configured (set api_url or HASNA_HOOKS_API_URL)`);
+      const transport = resolveHooksTransport2();
+      if (transport.mode !== "remote" || !transport.authority) {
+        throw new Error(`Cannot install '${arg}': no remote registry configured (set HASNA_HOOKS_API_URL and HASNA_HOOKS_API_KEY, or opt into local mode with HASNA_HOOKS_LOCAL=1)`);
+      }
+      const { origin, apiKey } = transport.authority;
       const { fetchPinnedHook: fetchPinnedHook2 } = await Promise.resolve().then(() => (init_sync(), exports_sync));
-      const pinnedInstall = await fetchPinnedHook2(pinned.name, pinned.version, apiUrl);
+      const pinnedInstall = await fetchPinnedHook2(pinned.name, pinned.version, origin, apiKey);
       installedPinned.push(pinnedInstall.name);
       if (options.json) {
         console.log(JSON.stringify({ pinned: { request: arg, name: pinnedInstall.name, version: pinnedInstall.version, sha256: pinnedInstall.sha256, source: pinnedInstall.source } }));
@@ -12685,7 +13197,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
   const settingsPath = getSettingsPath(scope);
   const issues = [];
   const healthy = [];
-  const settingsExist = existsSync16(settingsPath);
+  const settingsExist = existsSync15(settingsPath);
   if (!settingsExist) {
     issues.push({ hook: "(settings)", issue: `${settingsPath} not found`, severity: "warning" });
   }
@@ -12693,7 +13205,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
   let wiringCount = 0;
   if (settingsExist) {
     try {
-      const settings = JSON.parse(readFileSync12(settingsPath, "utf-8"));
+      const settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
       wiringCount = countSettingsWiring(settings);
     } catch {}
   }
@@ -12702,7 +13214,7 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
     const meta = custom ? resolveHookMeta(name) : getHook(name);
     let hookHealthy = true;
     if (custom) {
-      if (!existsSync16(custom.scriptPath)) {
+      if (!existsSync15(custom.scriptPath)) {
         issues.push({ hook: name, issue: `Custom hook script missing: ${custom.scriptPath}`, severity: "error" });
         hookHealthy = false;
       }
@@ -12713,15 +13225,15 @@ program2.command("doctor").option("-g, --global", "Check global settings", false
         continue;
       }
       const hookDir = getHookPath(name);
-      const hookScript = join19(hookDir, "src", "hook.ts");
-      if (!existsSync16(hookScript)) {
+      const hookScript = join17(hookDir, "src", "hook.ts");
+      if (!existsSync15(hookScript)) {
         issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
         hookHealthy = false;
       }
     }
     if (meta && settingsExist) {
       try {
-        const settings = JSON.parse(readFileSync12(settingsPath, "utf-8"));
+        const settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
         if (!hookRegisteredInSettings(settings, name, meta.event, meta.matcher)) {
           const eventName = meta.event.split(":")[0];
           issues.push({ hook: name, issue: `Not registered under correct event (${eventName})`, severity: "error" });
@@ -12788,7 +13300,7 @@ program2.command("update").argument("[hooks...]", "Hooks to update (defaults to
   const { resolveHook: resolveHook2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
   const { sha256File: sha256File2, setPinnedHook: setPinnedHook2, upsertHookRecord: upsertHookRecord2 } = await Promise.resolve().then(() => (init_store(), exports_store));
   const { getDb: getDb2 } = await Promise.resolve().then(() => (init_db(), exports_db));
-  const { resolveApiUrl: resolveApiUrl2 } = await Promise.resolve().then(() => (init_config(), exports_config));
+  const { resolveHooksTransport: resolveHooksTransport2 } = await Promise.resolve().then(() => (init_transport2(), exports_transport));
   const { isCustomSource: isCustomSource2 } = await Promise.resolve().then(() => (init_custom_install(), exports_custom_install));
   const { HOOK_NAME_RE: HOOK_NAME_RE2 } = await Promise.resolve().then(() => (init_manifest(), exports_manifest));
   function parseNameVersion(arg) {
@@ -12810,11 +13322,13 @@ program2.command("update").argument("[hooks...]", "Hooks to update (defaults to
     const pinned = parseNameVersion(arg);
     if (pinned) {
       try {
-        const apiUrl = resolveApiUrl2();
-        if (!apiUrl)
-          throw new Error(`Cannot update '${arg}': no remote registry configured (set api_url or HASNA_HOOKS_API_URL)`);
+        const transport = resolveHooksTransport2();
+        if (transport.mode !== "remote" || !transport.authority) {
+          throw new Error(`Cannot update '${arg}': no remote registry configured (set HASNA_HOOKS_API_URL and HASNA_HOOKS_API_KEY, or opt into local mode with HASNA_HOOKS_LOCAL=1)`);
+        }
+        const { origin, apiKey } = transport.authority;
         const { fetchPinnedHook: fetchPinnedHook2 } = await Promise.resolve().then(() => (init_sync(), exports_sync));
-        const pinnedInstall = await fetchPinnedHook2(pinned.name, pinned.version, apiUrl);
+        const pinnedInstall = await fetchPinnedHook2(pinned.name, pinned.version, origin, apiKey);
         const registered = installHook(pinnedInstall.name, { scope, overwrite: true });
         if (!registered.success) {
           results.push({ hook: arg, success: false, error: registered.error ?? "registration failed" });
@@ -12888,10 +13402,10 @@ program2.command("docs").argument("[hook]", "Hook name (shows general docs if om
       return;
     }
     const hookPath = getHookPath(hook);
-    const readmePath = join19(hookPath, "README.md");
+    const readmePath = join17(hookPath, "README.md");
     let readme = "";
-    if (existsSync16(readmePath)) {
-      readme = readFileSync12(readmePath, "utf-8");
+    if (existsSync15(readmePath)) {
+      readme = readFileSync11(readmePath, "utf-8");
     }
     if (options.json) {
       console.log(JSON.stringify({ ...meta, readme }));
@@ -13075,8 +13589,8 @@ program2.command("profile-export").description("Export all agent profiles as JSO
   const profiles = exportProfiles();
   const json2 = JSON.stringify(profiles, null, 2);
   if (options.output) {
-    const { writeFileSync: writeFileSync7 } = await import("fs");
-    writeFileSync7(options.output, json2 + `
+    const { writeFileSync: writeFileSync6 } = await import("fs");
+    writeFileSync6(options.output, json2 + `
 `);
     console.log(chalk2.green(`\u2713 Exported ${profiles.length} profile(s) to ${options.output}`));
   } else {
@@ -13088,9 +13602,9 @@ program2.command("profile-import").argument("<file>", "JSON file to import profi
   if (file === "-") {
     raw = await new Response(Bun.stdin.stream()).text();
   } else {
-    const { readFileSync: readFileSync13 } = await import("fs");
+    const { readFileSync: readFileSync12 } = await import("fs");
     try {
-      raw = readFileSync13(file, "utf-8");
+      raw = readFileSync12(file, "utf-8");
     } catch {
       if (options.json) {
         console.log(JSON.stringify({ error: `Cannot read file: ${file}` }));
@@ -13370,14 +13884,14 @@ program2.command("trust").argument("<hook>", "Hook to trust").option("-j, --json
   console.log(chalk2.green(`\u2713 Trusted '${resolved.name}' v${resolved.version} (${resolved.source})`));
   console.log(chalk2.dim(`  sha256 ${result.actual}`));
 });
-program2.command("serve").option("-p, --port <port>", "Port (default 39428)").option("--host <host>", "Host to bind (default 127.0.0.1)").description("Serve the local hook registry over HTTP (catalog, artifacts, lock). The publish API key resolves from HASNA_HOOKS_API_KEY / HOOKS_API_KEY only \u2014 there is deliberately no --api-key flag (P1-8).").action(async (options) => {
+program2.command("serve").option("-p, --port <port>", "Port (default 39428)").option("--host <host>", "Host to bind (default 127.0.0.1)").description("Serve the local hook registry over HTTP (catalog, artifacts, lock). The publish API key resolves from the @hasna/contracts chain per request (HASNA_HOOKS_API_KEY, the Keychain item hasna.credentials.hooks.api-key, or ~/.hasna/hooks/config/credentials) \u2014 there is deliberately no --api-key flag (P1-8).").action(async (options) => {
   const { startServeServer: startServeServer2 } = await Promise.resolve().then(() => (init_serve(), exports_serve));
   startServeServer2({
     port: options.port ? parseInt(options.port, 10) : undefined,
     host: options.host
   });
 });
-program2.command("sync").option("--dry-run", "Print the plan without changing anything", false).option("-j, --json", "Output as JSON", false).description("Sync local hooks with the remote registry (or bundled registry when no API URL is configured)").action(async (options) => {
+program2.command("sync").option("--dry-run", "Print the plan without changing anything", false).option("-j, --json", "Output as JSON", false).description("Sync local hooks with the remote registry (or bundled registry when no registry credential resolves and local mode is opted into)").action(async (options) => {
   const { syncHooks: syncHooks2, planSync: planSync2 } = await Promise.resolve().then(() => (init_sync(), exports_sync));
   try {
     const plan = options.dryRun ? await syncHooks2({ dryRun: true }) : await syncHooks2();
@@ -13508,4 +14022,62 @@ program2.command("mcp").option("-s, --stdio", "Use stdio transport (one process
   }
 });
 registerEventsCommands(program2, { source: "hooks" });
+var API_INDEPENDENT_COMMANDS = new Set([
+  "run",
+  "serve",
+  "mcp",
+  "cf",
+  "migrate",
+  "init",
+  "profile-export",
+  "profile-import",
+  "channels",
+  "events"
+]);
+function failClosedForMissingApiEnv(detail) {
+  console.error(chalk2.red(`hooks: no registry credential resolved and local mode is not explicitly enabled.
+` + `The remote registry requires a STRICT pair \u2014 set HASNA_HOOKS_API_URL and HASNA_HOOKS_API_KEY, or the
+` + `Keychain items hasna.credentials.hooks.api-url / .api-key, or ~/.hasna/hooks/config/credentials.
+` + `config.json (api_url / api_key_ref) is RETIRED and no longer read. Or set
+` + `HASNA_HOOKS_LOCAL=1 to explicitly opt into local mode (bundled registry + local store).
+` + (detail ? `${detail}
+` : "") + "Refusing to silently fall back to local storage."));
+  process.exit(1);
+}
+function firstCommandToken(argv) {
+  for (const arg of argv) {
+    if (arg === "--")
+      continue;
+    if (arg.startsWith("-"))
+      continue;
+    return arg;
+  }
+  return null;
+}
+function enforceTransportGate() {
+  const argv = process.argv.slice(2);
+  if (argv.some((arg) => arg === "-h" || arg === "--help" || arg === "-V" || arg === "--version"))
+    return;
+  const token = firstCommandToken(argv);
+  if (token === "help")
+    return;
+  if (token !== null && API_INDEPENDENT_COMMANDS.has(token))
+    return;
+  if (hasHooksEnvAuthorityIntent(process.env))
+    return;
+  if (isHooksLocalOptIn(process.env)) {
+    announceHooksLocalMode();
+    return;
+  }
+  try {
+    const transport = resolveHooksTransport(process.env);
+    if (transport.mode !== "remote" || !transport.authority) {
+      failClosedForMissingApiEnv();
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    failClosedForMissingApiEnv(message);
+  }
+}
+enforceTransportGate();
 program2.parse();