@hasna/hooks 0.9.4 → 0.9.5

package/bin/index.js

@@ -6352,14 +6352,19 @@ var init_profiles = __esm(() => {
   init_app_home();
 });
 
-// ../../node_modules/.bun/@hasna+contracts@1.0.2+e0db24ae03127387/node_modules/@hasna/contracts/dist/client/transport.js
+// ../contracts/dist/client/transport.js
 import { isIP as isIP2 } from "net";
 import { spawnSync } from "child_process";
-import { closeSync as closeSync2, fstatSync, openSync as openSync2, readFileSync as readFileSync7 } from "fs";
-import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
-import { createRequire as createRequire2 } from "module";
+import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync22 } from "fs";
+import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";
 import { hostname as osHostname } from "os";
-import { isAbsolute as isAbsolute2, join as join12 } from "path";
+import { isAbsolute as isAbsolute2, join as join22 } from "path";
+import { createRequire as createRequire2 } from "module";
+import { fileURLToPath as fileURLToPath22 } from "url";
+import { closeSync as closeSync3, fstatSync, lstatSync as lstatSync2, openSync as openSync3, readFileSync as readFileSync7, realpathSync as realpathSync2, statSync } from "fs";
+import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
+import { basename as basename2, dirname as dirname5, join as join12, relative, sep as sep2 } from "path";
+import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
@@ -6376,6 +6381,112 @@ function credentialOverrideEnvKey(name) {
 function credentialPointerEnvKey(name) {
   return `HASNA_${envToken(name)}_API_KEY_REF`;
 }
+function e(e2, n, r) {
+  throw new Error(r ? `No known conditions for "${n}" specifier in "${e2}" package` : `Missing "${n}" specifier in "${e2}" package`);
+}
+function n(n2, i, o, f) {
+  let s, u, l = r(n2, o), c = function(e2) {
+    let n3 = new Set(["default", ...e2.conditions || []]);
+    return e2.unsafe || n3.add(e2.require ? "require" : "import"), e2.unsafe || n3.add(e2.browser ? "browser" : "node"), n3;
+  }(f || {}), a = i[l];
+  if (a === undefined) {
+    let e2, n3, r, t;
+    for (t in i)
+      n3 && t.length < n3.length || (t[t.length - 1] === "/" && l.startsWith(t) ? (u = l.substring(t.length), n3 = t) : t.length > 1 && (r = t.indexOf("*", 1), ~r && (e2 = RegExp("^" + t.substring(0, r) + "(.*)" + t.substring(1 + r) + "$").exec(l), e2 && e2[1] && (u = e2[1], n3 = t))));
+    a = i[n3];
+  }
+  return a || e(n2, l), s = t(a, c), s || e(n2, l, 1), u && function(e2, n3) {
+    let r, t = 0, i2 = e2.length, o2 = /[*]/g, f2 = /[/]$/;
+    for (;t < i2; t++)
+      e2[t] = o2.test(r = e2[t]) ? r.replace(o2, n3) : f2.test(r) ? r + n3 : r;
+  }(s, u), s;
+}
+function r(e2, n2, r2) {
+  if (e2 === n2 || n2 === ".")
+    return ".";
+  let t = e2 + "/", i = t.length, o = n2.slice(0, i) === t, f = o ? n2.slice(i) : n2;
+  return f[0] === "#" ? f : o || !r2 ? f.slice(0, 2) === "./" ? f : "./" + f : f;
+}
+function t(e2, n2, r2) {
+  if (e2) {
+    if (typeof e2 == "string")
+      return r2 && r2.add(e2), [e2];
+    let i, o;
+    if (Array.isArray(e2)) {
+      for (o = r2 || new Set, i = 0;i < e2.length; i++)
+        t(e2[i], n2, o);
+      if (!r2 && o.size)
+        return [...o];
+    } else
+      for (i in e2)
+        if (n2.has(i))
+          return t(e2[i], n2, r2);
+  }
+}
+function o(e2, r2, t2) {
+  let i, o2 = e2.exports;
+  if (o2) {
+    if (typeof o2 == "string")
+      o2 = { ".": o2 };
+    else
+      for (i in o2) {
+        i[0] !== "." && (o2 = { ".": o2 });
+        break;
+      }
+    return n(e2.name, o2, r2 || ".", t2);
+  }
+}
+function entryPoint(directory) {
+  const root = realpathSync2(directory);
+  const fd = openSync3(join12(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  let pkg;
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.size > MAX_PACKAGE_BYTES2)
+      throw new Error("Invalid Secrets package metadata");
+    pkg = JSON.parse(readFileSync7(fd, "utf8"));
+  } finally {
+    closeSync3(fd);
+  }
+  if (!pkg || typeof pkg !== "object" || !("name" in pkg) || pkg.name !== PACKAGE) {
+    throw new Error("Invalid Secrets package identity");
+  }
+  const target = o(pkg, ".")?.[0];
+  if (typeof target !== "string" || !target.startsWith("./"))
+    throw new Error("Missing Secrets import export");
+  const parts = target.slice(2).split("/");
+  if (/[\\%?#\0]/.test(target) || parts.some((part) => !part || part === "." || part === ".." || part === "node_modules")) {
+    throw new Error("Invalid Secrets import export");
+  }
+  const file = realpathSync2(join12(root, ...parts));
+  const within = relative(root, file);
+  if (!within || within === ".." || within.startsWith(`..${sep2}`) || !statSync(file).isFile()) {
+    throw new Error("Secrets import export escapes its package or is not a file");
+  }
+  return pathToFileURL(file).href;
+}
+function resolveInstalledSecrets(parentUrl) {
+  let directory = dirname5(fileURLToPath3(parentUrl));
+  for (;; ) {
+    if (basename2(directory) !== "node_modules") {
+      const candidate = join12(directory, "node_modules", PACKAGE);
+      let absent = false;
+      try {
+        lstatSync2(candidate);
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          throw error;
+        absent = true;
+      }
+      if (!absent)
+        return entryPoint(candidate);
+    }
+    const parent = dirname5(directory);
+    if (parent === directory)
+      throw new Error("Secrets SDK is not installed for this consumer");
+    directory = parent;
+  }
+}
 function homeDir(env) {
   const home = env.HOME?.trim();
   return home ? home : null;
@@ -6389,14 +6500,14 @@ function hasnaHomeDir(env) {
   if (override)
     return override;
   const home = homeDir(env);
-  return home ? join12(home, HASNA_HOME_DIR) : null;
+  return home ? join22(home, HASNA_HOME_DIR) : null;
 }
 function appConfigDir(name, env) {
   const configRoot = absoluteOverride(env, HASNA_CONFIG_HOME_ENV_KEY);
   if (configRoot)
-    return join12(configRoot, name);
+    return join22(configRoot, name);
   const root = hasnaHomeDir(env);
-  return root ? join12(root, name, CONFIG_SUBDIR) : null;
+  return root ? join22(root, name, CONFIG_SUBDIR) : null;
 }
 function credentialDiskSourceList(name, env, profile = null) {
   if (!SAFE_APP_SLUG.test(name))
@@ -6405,7 +6516,7 @@ function credentialDiskSourceList(name, env, profile = null) {
   if (!directory)
     return [];
   const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
-  return [{ path: join12(directory, file), tier: "disk" }];
+  return [{ path: join22(directory, file), tier: "disk" }];
 }
 function credentialDiskSources(name, env) {
   return credentialDiskSourceList(name, env, null).map((s) => s.path);
@@ -6459,7 +6570,7 @@ function readAppConfigFile(path) {
   };
   let fd = -1;
   try {
-    fd = openSync2(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+    fd = openSync2(path, O_RDONLY2 | O_NOFOLLOW2 | O_NONBLOCK2);
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT" || code === "ENOTDIR")
@@ -6469,7 +6580,7 @@ function readAppConfigFile(path) {
     unsafe(`the path could not be opened (${code ?? "unknown error"})`);
   }
   try {
-    const before = fstatSync(fd);
+    const before = fstatSync2(fd);
     if (!before.isFile())
       unsafe("the path is not a regular file");
     if (!configFileModeAllowed(before.mode)) {
@@ -6480,8 +6591,8 @@ function readAppConfigFile(path) {
       unsafe("the file is not owned by the current user");
     if (before.size > MAX_CREDENTIAL_FILE_BYTES2)
       unsafe("the file exceeds the size limit");
-    const bytes = readFileSync7(fd);
-    const after = fstatSync(fd);
+    const bytes = readFileSync22(fd);
+    const after = fstatSync2(fd);
     if (!configFileReadsCoherent(before, after)) {
       unsafe("the file changed while being read");
     }
@@ -6491,20 +6602,28 @@ function readAppConfigFile(path) {
       closeSync2(fd);
   }
 }
-function readCredentialFile(path, apiKeyKeys) {
+function readCredentialFile(path, apiKeyKeys, pointerKey) {
   const parsed = readAppConfigFile(path);
   if (!parsed)
     return null;
-  for (const key of apiKeyKeys) {
+  for (const key of [...apiKeyKeys, pointerKey]) {
     if (parsed.unusable.has(key)) {
       throw new CredentialFileUnsafeError(path, `${key} is declared but blank or malformed`);
     }
   }
   const values = apiKeyKeys.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+  const pointer = parsed.values.get(pointerKey)?.trim();
+  if (pointer !== undefined) {
+    if (!VAULT_POINTER_SHAPE.test(pointer))
+      throw new CredentialFileUnsafeError(path, `${pointerKey} must name a vault item`);
+    if (values.length)
+      throw new CredentialFileUnsafeError(path, "a credential file cannot select both a literal key and a vault reference");
+    return { apiKey: "", pointerVaultKey: pointer };
+  }
   if (new Set(values).size > 1) {
     throw new CredentialFileUnsafeError(path, "credential aliases disagree");
   }
-  return values[0] ?? null;
+  return values[0] === undefined ? null : { apiKey: values[0] };
 }
 function appConfigDiskValue(name, env, keys) {
   const wanted = keys.filter((key) => !CREDENTIAL_SHAPED_KEY.test(key));
@@ -6576,6 +6695,18 @@ function sealCredential(fields) {
   });
   return Object.freeze(sealed);
 }
+function explicitCredential(appName, apiKey) {
+  const source = "explicit apiKey option";
+  assertUsableCredential(appName, source, apiKey);
+  return sealCredential({
+    apiKey,
+    tier: "argument",
+    source,
+    deliberate: true,
+    diskCandidates: [],
+    warning: null
+  });
+}
 function firstEnvValue(env, keys) {
   for (const key of keys) {
     if (!Object.prototype.hasOwnProperty.call(env, key))
@@ -6761,12 +6892,13 @@ function resolveCredential(name, env, options = {}) {
     }
     const paths = profileDiskSources(name, env, profile);
     for (const path of paths) {
-      const value = readCredentialFile(path, apiKeyKeys);
+      const value = readCredentialFile(path, apiKeyKeys, pointerKeyName);
       if (value) {
-        assertUsableCredential(name, path, value);
+        if (!value.pointerVaultKey)
+          assertUsableCredential(name, path, value.apiKey);
         return sealCredential({
-          apiKey: value,
-          tier: "profile",
+          ...value,
+          tier: value.pointerVaultKey ? "pointer" : "profile",
           source: path,
           deliberate: true,
           diskCandidates: paths,
@@ -6774,7 +6906,7 @@ function resolveCredential(name, env, options = {}) {
         });
       }
     }
-    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
+    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} or ${pointerKeyName} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
   }
   const definedEnvEntries = apiKeyKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, value: String(env[key]).trim() }));
   const blankEnv = definedEnvEntries.find((entry) => entry.value.length === 0);
@@ -6799,17 +6931,27 @@ function resolveCredential(name, env, options = {}) {
     });
   }
   const diskSourceList = credentialDiskSourceList(name, env, null);
-  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys, pointerKeyName) })).filter((hit) => hit.value !== null);
   if (diskHits.length > 0) {
     const winner = diskHits[0];
-    assertUsableCredential(name, winner.src.path, winner.value);
+    if (winner.value.pointerVaultKey) {
+      return sealCredential({
+        ...winner.value,
+        tier: "pointer",
+        source: winner.src.path,
+        deliberate: false,
+        diskCandidates: diskPaths,
+        warning: null
+      });
+    }
+    assertUsableCredential(name, winner.src.path, winner.value.apiKey);
     const divergentSources = [
-      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
-      ...envHit && envHit.value !== winner.value ? [envHit.key] : []
+      ...diskHits.slice(1).filter((hit) => hit.value.apiKey !== winner.value.apiKey || hit.value.pointerVaultKey !== winner.value.pointerVaultKey).map((hit) => hit.src.path),
+      ...envHit && envHit.value !== winner.value.apiKey ? [envHit.key] : []
     ];
     const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
     return sealCredential({
-      apiKey: winner.value,
+      apiKey: winner.value.apiKey,
       tier: winner.src.tier,
       source: winner.src.path,
       deliberate: false,
@@ -6830,6 +6972,53 @@ function resolveCredential(name, env, options = {}) {
   }
   return null;
 }
+async function completePointerCredential(name, pointerResolution, env = process.env) {
+  const secretsEnv = snapshotClientEnvironment("secrets", env);
+  const vaultKey = pointerResolution.pointerVaultKey;
+  const pointerEnvKey = pointerResolution.source;
+  if (!vaultKey) {
+    throw new CredentialResolutionError(name, `Pointer resolution from ${pointerEnvKey} carries no vault item key; this is a defect in the resolver.`, [pointerEnvKey]);
+  }
+  if (name === "secrets") {
+    throw new CredentialResolutionError(name, "The Secrets bootstrap credential cannot reference the same hosted vault; configure an independent bootstrap provider.", [pointerEnvKey]);
+  }
+  let secretsSdk;
+  try {
+    const sdkUrl = resolveInstalledSecrets(import.meta.url);
+    secretsSdk = requireSecretsSdk2(fileURLToPath22(sdkUrl));
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
+  }
+  let client;
+  try {
+    const bootstrap = resolveCredential("secrets", secretsEnv);
+    if (!bootstrap || bootstrap.tier === "pointer") {
+      throw new CredentialResolutionError("secrets", "The Secrets vault requires an independent, non-reference bootstrap credential.", bootstrap ? [bootstrap.source] : []);
+    }
+    client = secretsSdk.createSecretsClientFromEnv(secretsEnv);
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets client could not be configured from this ` + `environment (the secrets service URL and key env are missing or invalid). A vault pointer is TERMINAL and ` + `never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  let secret;
+  try {
+    secret = await client.getSecret({ key: vaultKey });
+  } catch {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the vault could not be reached or the item is ` + `unavailable. A vault pointer is TERMINAL and never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  const value = secret.value;
+  if (!value) {
+    throw new CredentialResolutionError(name, `${pointerEnvKey} resolved vault item '${vaultKey}', but it holds no value. A vault pointer is TERMINAL.`, [pointerEnvKey]);
+  }
+  assertUsableCredential(name, `${pointerEnvKey} -> vault:${vaultKey}`, value);
+  return sealCredential({
+    apiKey: value,
+    tier: "pointer",
+    source: `${pointerEnvKey} -> vault:${vaultKey}`,
+    deliberate: pointerResolution.deliberate,
+    diskCandidates: pointerResolution.diskCandidates,
+    warning: null
+  });
+}
 function defaultFleetGatewayBaseUrl(name) {
   return `${DEFAULT_FLEET_GATEWAY_ORIGIN}/${validateAppSlug(name)}`;
 }
@@ -7032,8 +7221,9 @@ function credentialDiskSourcesForMessage(name, env) {
   const paths = credentialDiskSources(name, env);
   return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
 }
-var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES2, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, AMBIENT_ENVIRONMENT2, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk2, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2;
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", PACKAGE = "@hasna/secrets", MAX_PACKAGE_BYTES2, CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES2, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, AMBIENT_ENVIRONMENT2, requireSecretsSdk2, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2;
 var init_transport = __esm(() => {
+  MAX_PACKAGE_BYTES2 = 1024 * 1024;
   CredentialResolutionError = class CredentialResolutionError extends Error {
     appName;
     attempted;
@@ -7061,7 +7251,6 @@ var init_transport = __esm(() => {
   INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
   CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
   AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
-  SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
   requireSecretsSdk2 = createRequire2(import.meta.url);
   ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
   DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
@@ -7150,7 +7339,9 @@ var exports_transport = {};
 __export(exports_transport, {
   rethrowHooksAuthorityFailure: () => rethrowHooksAuthorityFailure,
   resolveHooksTransport: () => resolveHooksTransport,
+  resolveHooksServePublishKeyAsync: () => resolveHooksServePublishKeyAsync,
   resolveHooksServePublishKey: () => resolveHooksServePublishKey,
+  resolveHooksRequestAuthority: () => resolveHooksRequestAuthority,
   hooksRegistryOrigin: () => hooksRegistryOrigin,
   announceHooksLocalMode: () => announceHooksLocalMode,
   __resetHooksLocalNotice: () => __resetHooksLocalNotice
@@ -7189,6 +7380,40 @@ function rethrowHooksAuthorityFailure(error) {
   }
   throw new Error(`REMOTE_API_URL_INVALID: ${message} local mode fallback is disabled`, { cause: error });
 }
+function sameCredential(left, right) {
+  return left === null || right === null ? left === right : left.apiKey === right.apiKey && left.pointerVaultKey === right.pointerVaultKey && left.source === right.source && left.tier === right.tier;
+}
+function changedBinding() {
+  throw new Error("REMOTE_API_CREDENTIAL_INVALID: The configured Hooks authority or credential changed while preparing a request; no request was sent.");
+}
+async function resolveHooksRequestAuthority(authority) {
+  if (authority.origin !== hooksRegistryOrigin(authority.v1BaseUrl))
+    changedBinding();
+  const binding = authorityBindings.get(authority);
+  if (!binding)
+    return { ...authority, apiKey: explicitCredential("hooks", authority.apiKey).apiKey };
+  const snapshot = () => {
+    const next = resolveHooksTransport(binding.env, binding.options);
+    if (next.mode !== "remote" || !next.authority || next.authority.v1BaseUrl !== authority.v1BaseUrl)
+      changedBinding();
+    return { authority: next.authority, binding: authorityBindings.get(next.authority) };
+  };
+  const first = snapshot();
+  const reviewed = snapshot();
+  if (!sameCredential(first.binding.credential, reviewed.binding.credential))
+    changedBinding();
+  let credential = reviewed.binding.credential;
+  try {
+    if (credential.tier === "pointer")
+      credential = await completePointerCredential("hooks", credential, binding.env);
+  } catch (error) {
+    rethrowHooksAuthorityFailure(error);
+  }
+  const final = snapshot();
+  if (!sameCredential(reviewed.binding.credential, final.binding.credential))
+    changedBinding();
+  return { ...reviewed.authority, apiKey: credential.apiKey };
+}
 function resolveHooksTransport(env = process.env, options = {}) {
   if (selectsHooksLocalStore(env)) {
     announceLocal(options.notice, "HASNA_HOOKS_LOCAL is set and nothing configures a registry authority");
@@ -7202,7 +7427,7 @@ function resolveHooksTransport(env = process.env, options = {}) {
   try {
     credential = resolveCredential("hooks", resolverEnv, credentialOptions);
     resolution = resolveClientTransport("hooks", resolverEnv, {
-      credentials: credential ? { ...credentialOptions, apiKey: credential.apiKey } : credentialOptions
+      credentials: credential && credential.tier !== "pointer" ? { ...credentialOptions, apiKey: credential.apiKey } : credentialOptions
     });
   } catch (error) {
     rethrowHooksAuthorityFailure(error);
@@ -7210,31 +7435,50 @@ function resolveHooksTransport(env = process.env, options = {}) {
   if (!credential) {
     throw new Error("REMOTE_API_CONFIG_MISSING: no hooks registry credential resolved; " + "local mode fallback is disabled");
   }
+  const authority = {
+    origin: hooksRegistryOrigin(resolution.baseUrl),
+    apiKey: credential.apiKey,
+    apiUrlSource: resolution.apiUrlSource,
+    apiKeySource: credential.source,
+    apiKeyTier: credential.tier,
+    v1BaseUrl: resolution.baseUrl,
+    warning: resolution.warning
+  };
+  authorityBindings.set(authority, { env, options, credential });
   return {
     mode: "remote",
     source: `${credential.source}+${resolution.apiUrlSource ?? "default"}`,
-    authority: {
-      origin: hooksRegistryOrigin(resolution.baseUrl),
-      apiKey: credential.apiKey,
-      apiUrlSource: resolution.apiUrlSource,
-      apiKeySource: credential.source,
-      apiKeyTier: credential.tier,
-      v1BaseUrl: resolution.baseUrl,
-      warning: resolution.warning
-    }
+    authority
   };
 }
 function resolveHooksServePublishKey(env = process.env, options = {}) {
   const { env: resolverEnv, credentials } = hooksResolverInputs(env, options.credentials);
   const tier1 = options.credentials?.apiKey;
   const credentialOptions = tier1 !== undefined ? { ...credentials, apiKey: tier1 } : credentials;
-  return resolveCredential("hooks", resolverEnv, credentialOptions)?.apiKey;
+  const credential = resolveCredential("hooks", resolverEnv, credentialOptions);
+  if (credential?.tier === "pointer")
+    throw new Error("Vault references require resolveHooksServePublishKeyAsync().");
+  return credential?.apiKey;
 }
-var localNoticePrinted = false;
+async function resolveHooksServePublishKeyAsync(env = process.env, options = {}) {
+  const { env: resolverEnv, credentials } = hooksResolverInputs(env, options.credentials);
+  const read = () => resolveCredential("hooks", resolverEnv, credentials);
+  const selected = read();
+  if (!selected || selected.tier !== "pointer")
+    return selected?.apiKey;
+  if (!sameCredential(selected, read()))
+    changedBinding();
+  const completed = await completePointerCredential("hooks", selected, env);
+  if (!sameCredential(selected, read()))
+    changedBinding();
+  return completed.apiKey;
+}
+var localNoticePrinted = false, authorityBindings;
 var init_transport2 = __esm(() => {
   init_transport();
   init_config();
   init_local_opt_in();
+  authorityBindings = new WeakMap;
 });
 
 // src/lib/db-writer.ts
@@ -7356,8 +7600,8 @@ var init_db_writer = __esm(() => {
 });
 
 // src/lib/hook-env.ts
-import { dirname as dirname5, isAbsolute as isAbsolute3 } from "path";
-import { existsSync as existsSync13, realpathSync as realpathSync2, statSync } from "fs";
+import { dirname as dirname6, isAbsolute as isAbsolute3 } from "path";
+import { existsSync as existsSync13, realpathSync as realpathSync3, statSync as statSync2 } from "fs";
 import { tmpdir } from "os";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
@@ -7386,7 +7630,7 @@ function isUnsafePathEntry(entry, home) {
     return true;
   const canonical = (path) => {
     try {
-      return realpathSync2(path);
+      return realpathSync3(path);
     } catch {
       return path;
     }
@@ -7398,7 +7642,7 @@ function isUnsafePathEntry(entry, home) {
       return true;
   }
   try {
-    if ((statSync(entry).mode & 2) !== 0)
+    if ((statSync2(entry).mode & 2) !== 0)
       return true;
   } catch {}
   return false;
@@ -7407,7 +7651,7 @@ function sanitizeHookPath(pathValue, home) {
   const baseline = PATH_BASELINE.slice();
   if (process.platform === "darwin" && existsSync13("/opt/homebrew/bin"))
     baseline.push("/opt/homebrew/bin");
-  const bunDir = dirname5(process.execPath);
+  const bunDir = dirname6(process.execPath);
   const seen = new Set;
   const out = [];
   for (const dir of baseline) {
@@ -7532,9 +7776,9 @@ __export(exports_run, {
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute4, join as join13 } from "path";
+import { basename as basename3, dirname as dirname7, isAbsolute as isAbsolute4, join as join13 } from "path";
 function extensionOf(scriptPath) {
-  const base = basename2(scriptPath);
+  const base = basename3(scriptPath);
   const dot = base.lastIndexOf(".");
   return dot > 0 ? base.slice(dot + 1) : "ts";
 }
@@ -7546,9 +7790,9 @@ function shebangInterpreter(firstLine) {
     return null;
   const parts = rest.split(/\s+/);
   if (parts[0] === "env" || parts[0] === "/usr/bin/env") {
-    return parts[1] && parts[1] !== "-S" ? basename2(parts[1]) : parts[2] ? basename2(parts[2]) : null;
+    return parts[1] && parts[1] !== "-S" ? basename3(parts[1]) : parts[2] ? basename3(parts[2]) : null;
   }
-  return basename2(parts[0]);
+  return basename3(parts[0]);
 }
 function interpreterFor(name, scriptPath, content) {
   const ext = extensionOf(scriptPath);
@@ -7582,8 +7826,8 @@ async function readPipeWithDeadline(stream, deadlineMs) {
         result = await Promise.race([
           reader.read(),
           new Promise((_, reject) => {
-            const t = setTimeout(() => reject(new Error("pipe-drain-deadline")), remaining);
-            t.unref?.();
+            const t2 = setTimeout(() => reject(new Error("pipe-drain-deadline")), remaining);
+            t2.unref?.();
           })
         ]);
       } catch {
@@ -7601,7 +7845,7 @@ async function readPipeWithDeadline(stream, deadlineMs) {
   return chunks.join("");
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname6(options.scriptPath);
+  const scriptDir = dirname7(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
   const tempPath = join13(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
@@ -7836,7 +8080,14 @@ function collectBundledCatalog() {
 }
 async function fetchJson(base, path, apiKey, opts) {
   const headers = { accept: "application/json" };
-  if (apiKey)
+  if (typeof apiKey === "object") {
+    if (apiKey.origin !== base)
+      throw new Error("Hooks registry authority does not match the request target");
+    const resolved = await resolveHooksRequestAuthority(apiKey);
+    if (resolved.origin !== base)
+      throw new Error("Hooks registry authority changed before dispatch");
+    headers["x-api-key"] = resolved.apiKey;
+  } else if (apiKey)
     headers["x-api-key"] = apiKey;
   const res = await fetch(`${base}${path}`, {
     headers,
@@ -7904,8 +8155,8 @@ async function planSync(options = {}) {
     credentials: options.credentials
   });
   if (transport.mode === "remote" && transport.authority) {
-    const { origin, apiKey } = transport.authority;
-    const { catalog, remoteLock } = await fetchRemoteState(origin, apiKey);
+    const { origin } = transport.authority;
+    const { catalog, remoteLock } = await fetchRemoteState(origin, transport.authority);
     return { apiUrl: origin, dryRun: options.dryRun ?? false, diff: computeDiff(catalog, remoteLock) };
   }
   const diff = computeDiff(collectBundledCatalog(), null);
@@ -7933,10 +8184,10 @@ async function syncHooks(options = {}) {
     }
     return plan;
   }
-  const { origin, apiKey } = transport.authority;
-  const { catalog, remoteLock } = await fetchRemoteState(origin, apiKey);
+  const { origin } = transport.authority;
+  const { catalog, remoteLock } = await fetchRemoteState(origin, transport.authority);
   const diff = computeDiff(catalog, remoteLock);
-  const staged = await stageSyncArtifacts(origin, apiKey, [...diff.added, ...diff.updated], remoteLock);
+  const staged = await stageSyncArtifacts(origin, transport.authority, [...diff.added, ...diff.updated], remoteLock);
   await commitSyncArtifacts(staged, origin, remoteLock);
   return { apiUrl: origin, dryRun: false, diff };
 }
@@ -8597,8 +8848,8 @@ function secureEqual(a, b) {
   const ab = enc.encode(a);
   const bb = enc.encode(b);
   let diff = ab.length ^ bb.length;
-  const n = Math.max(ab.length, bb.length);
-  for (let i = 0;i < n; i++) {
+  const n2 = Math.max(ab.length, bb.length);
+  for (let i = 0;i < n2; i++) {
     diff |= (ab[i] ?? 0) ^ (bb[i] ?? 0);
   }
   return diff === 0;
@@ -8769,11 +9020,11 @@ __export(exports_serve, {
   DEFAULT_SERVE_PORT: () => DEFAULT_SERVE_PORT
 });
 import { readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname7, join as join15 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { dirname as dirname8, join as join15 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 function packageVersion() {
   try {
-    const pkgPath = join15(dirname7(fileURLToPath3(import.meta.url)), "..", "package.json");
+    const pkgPath = join15(dirname8(fileURLToPath4(import.meta.url)), "..", "package.json");
     return JSON.parse(readFileSync10(pkgPath, "utf-8")).version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -8935,7 +9186,7 @@ function startServeServer(options) {
     hostname: host,
     port,
     async fetch(req) {
-      return handleServeRequest(req, resolveHooksServePublishKey());
+      return handleServeRequest(req, await resolveHooksServePublishKeyAsync());
     }
   });
   console.error(`hooks registry listening on http://${host}:${server.port} (publish requires an API key)`);
@@ -9076,8 +9327,8 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z as z2 } from "zod";
 import { createServer } from "http";
 import { existsSync as existsSync15, readFileSync as readFileSync11 } from "fs";
-import { join as join16, dirname as dirname8 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { join as join16, dirname as dirname9 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
 async function runVerifiedHook(name, stdin, timeoutMs) {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
   const resolved = resolveHook2(name);
@@ -9151,8 +9402,8 @@ async function runVerifiedHook(name, stdin, timeoutMs) {
   return ran;
 }
 function formatInstallResults(results, extra) {
-  const installed = results.filter((r) => r.success).map((r) => r.hook);
-  const failed = results.filter((r) => !r.success).map((r) => ({ hook: r.hook, error: r.error }));
+  const installed = results.filter((r2) => r2.success).map((r2) => r2.hook);
+  const failed = results.filter((r2) => !r2.success).map((r2) => ({ hook: r2.hook, error: r2.error }));
   return {
     content: [{
       type: "text",
@@ -9515,8 +9766,8 @@ function createHooksServer() {
       }
       return installHook(name, { scope, overwrite: true });
     });
-    const updated = results.filter((r) => r.success).map((r) => r.hook);
-    const failed = results.filter((r) => !r.success).map((r) => ({ hook: r.hook, error: r.error }));
+    const updated = results.filter((r2) => r2.success).map((r2) => r2.hook);
+    const failed = results.filter((r2) => !r2.success).map((r2) => ({ hook: r2.hook, error: r2.error }));
     return { content: [{ type: "text", text: JSON.stringify({ updated, failed, total: results.length }) }] };
   });
   defineTool("hooks_context", "Get compact agent context in one call: installed hooks, active profile summary, settings path, and doctor status.", {
@@ -9603,7 +9854,7 @@ function createHooksServer() {
         return { name, decision: "block", error: err instanceof Error ? err.message : String(err) };
       }
     }));
-    const blocked = results.find((r) => r.decision === "block");
+    const blocked = results.find((r2) => r2.decision === "block");
     return {
       content: [{
         type: "text",
@@ -9637,8 +9888,8 @@ function createHooksServer() {
     const target = agent_type === "gemini" ? "gemini" : "claude";
     const toInstall = hooks && hooks.length > 0 ? hooks : ["gitguard", "checkpoint", "checktests", "protectfiles"];
     const results = toInstall.map((h) => installHook(h, { scope, overwrite: false, profile: profile.agent_id, target }));
-    const installed = results.filter((r) => r.success).map((r) => r.hook);
-    const failed = results.filter((r) => !r.success).map((r) => ({ hook: r.hook, error: r.error }));
+    const installed = results.filter((r2) => r2.success).map((r2) => r2.hook);
+    const failed = results.filter((r2) => !r2.success).map((r2) => ({ hook: r2.hook, error: r2.error }));
     return {
       content: [{
         type: "text",
@@ -9696,8 +9947,8 @@ function createHooksServer() {
       disabled.push(name);
     settings.hooks.__disabled = disabled;
     const { writeFileSync: writeFileSync7, mkdirSync: mkdirSync8 } = await import("fs");
-    const { dirname: dirname9 } = await import("path");
-    mkdirSync8(dirname9(settingsPath), { recursive: true });
+    const { dirname: dirname10 } = await import("path");
+    mkdirSync8(dirname10(settingsPath), { recursive: true });
     writeFileSync7(settingsPath, JSON.stringify(settings, null, 2) + `
 `);
     return { content: [{ type: "text", text: JSON.stringify({ hook: name, disabled: true, scope }) }] };
@@ -9713,7 +9964,7 @@ function createHooksServer() {
         settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
     } catch {}
     if (settings.hooks?.__disabled) {
-      settings.hooks.__disabled = settings.hooks.__disabled.filter((n) => n !== name);
+      settings.hooks.__disabled = settings.hooks.__disabled.filter((n2) => n2 !== name);
       if (settings.hooks.__disabled.length === 0)
         delete settings.hooks.__disabled;
       const { writeFileSync: writeFileSync7 } = await import("fs");
@@ -9770,9 +10021,9 @@ function createHooksServer() {
       const m = s.match(/^(\d+)(s|m|h|d)$/);
       if (!m)
         return null;
-      const n = parseInt(m[1]);
+      const n2 = parseInt(m[1]);
       const ms = { s: 1000, m: 60000, h: 3600000, d: 86400000 }[m[2]];
-      return new Date(Date.now() - n * ms).toISOString();
+      return new Date(Date.now() - n2 * ms).toISOString();
     }
     let sql = "SELECT * FROM hook_events WHERE 1=1";
     const params = [];
@@ -9810,10 +10061,10 @@ function createHooksServer() {
   defineTool("hooks_log_tail", "Show recent hook events from SQLite. Compact summaries by default.", {
     n: z2.number().default(20).describe("Number of most recent events to return"),
     compact: z2.boolean().default(true).describe("Return compact event summaries by default. Set false for full rows.")
-  }, async ({ n, compact }) => {
+  }, async ({ n: n2, compact }) => {
     const { getDb: getDb2 } = await Promise.resolve().then(() => (init_db(), exports_db));
     const db = getDb2();
-    const maxRows = boundedLimit(n, 20, compact ? 100 : 500);
+    const maxRows = boundedLimit(n2, 20, compact ? 100 : 500);
     const rows = db.query("SELECT * FROM hook_events ORDER BY timestamp DESC LIMIT ?").all(maxRows);
     const projected = projectLogRows(rows);
     return {
@@ -9840,9 +10091,9 @@ function createHooksServer() {
       const m = s.match(/^(\d+)(s|m|h|d)$/);
       if (!m)
         return s;
-      const n = parseInt(m[1]);
+      const n2 = parseInt(m[1]);
       const ms = { s: 1000, m: 60000, h: 3600000, d: 86400000 }[m[2]];
-      return new Date(Date.now() - n * ms).toISOString();
+      return new Date(Date.now() - n2 * ms).toISOString();
     }
     const ts = since.match(/^\d{4}/) ? since : parseDuration(since);
     const rows = db.query("SELECT * FROM hook_events WHERE error IS NOT NULL AND timestamp >= ? ORDER BY timestamp DESC LIMIT ?").all(ts, maxRows);
@@ -9868,20 +10119,20 @@ function createHooksServer() {
       const m = s.match(/^(\d+)(s|m|h|d)$/);
       if (!m)
         return s;
-      const n = parseInt(m[1]);
+      const n2 = parseInt(m[1]);
       const ms = { s: 1000, m: 60000, h: 3600000, d: 86400000 }[m[2]];
-      return new Date(Date.now() - n * ms).toISOString();
+      return new Date(Date.now() - n2 * ms).toISOString();
     }
     const ts = since.match(/^\d{4}/) ? since : parseDuration(since);
     const totals = db.query("SELECT hook_name, COUNT(*) as total, SUM(CASE WHEN error IS NOT NULL THEN 1 ELSE 0 END) as errors FROM hook_events WHERE timestamp >= ? GROUP BY hook_name ORDER BY total DESC").all(ts);
-    const summary = totals.map((r) => ({
-      hook_name: r.hook_name,
-      total: r.total,
-      errors: r.errors,
-      error_rate: r.total > 0 ? (r.errors / r.total * 100).toFixed(1) + "%" : "0%"
+    const summary = totals.map((r2) => ({
+      hook_name: r2.hook_name,
+      total: r2.total,
+      errors: r2.errors,
+      error_rate: r2.total > 0 ? (r2.errors / r2.total * 100).toFixed(1) + "%" : "0%"
     }));
-    const grandTotal = totals.reduce((s, r) => s + r.total, 0);
-    const grandErrors = totals.reduce((s, r) => s + r.errors, 0);
+    const grandTotal = totals.reduce((s, r2) => s + r2.total, 0);
+    const grandErrors = totals.reduce((s, r2) => s + r2.errors, 0);
     return {
       content: [{
         type: "text",
@@ -9912,8 +10163,8 @@ function createHooksServer() {
         pkg.version
       ]);
       return { content: [{ type: "text", text: "Feedback saved. Thank you!" }] };
-    } catch (e) {
-      return { content: [{ type: "text", text: String(e) }], isError: true };
+    } catch (e2) {
+      return { content: [{ type: "text", text: String(e2) }], isError: true };
     }
   });
   defineTool("register_agent", "Register an agent session. Returns agent_id. Auto-triggers a heartbeat.", {
@@ -10080,7 +10331,7 @@ var init_server = __esm(() => {
   init_redact();
   init_authority();
   init_storage();
-  __dirname3 = dirname8(fileURLToPath4(import.meta.url));
+  __dirname3 = dirname9(fileURLToPath5(import.meta.url));
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
@@ -11829,8 +12080,8 @@ var {
 // src/cli/index.tsx
 import chalk2 from "chalk";
 import { existsSync as existsSync16, readFileSync as readFileSync12, rmSync as rmSync4 } from "fs";
-import { join as join17, dirname as dirname9 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import { join as join17, dirname as dirname10 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
 
 // src/cli/components/App.tsx
 import { useState as useState7 } from "react";
@@ -13017,7 +13268,7 @@ init_local_opt_in();
 init_transport2();
 init_db();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
-var __dirname4 = dirname9(fileURLToPath5(import.meta.url));
+var __dirname4 = dirname10(fileURLToPath6(import.meta.url));
 var pkgPath = existsSync16(join17(__dirname4, "..", "package.json")) ? join17(__dirname4, "..", "package.json") : join17(__dirname4, "..", "..", "package.json");
 var pkg2 = JSON.parse(readFileSync12(pkgPath, "utf-8"));
 var program2 = new Command;
@@ -13144,19 +13395,19 @@ function printDisclosureHint(hidden, detailCommand, options = {}) {
   }
 }
 function editDistance(a, b) {
-  const m = a.length, n = b.length;
-  const dp = Array.from({ length: m + 1 }, (_, i) => [i, ...Array(n).fill(0)]);
-  for (let j = 0;j <= n; j++)
+  const m = a.length, n2 = b.length;
+  const dp = Array.from({ length: m + 1 }, (_, i) => [i, ...Array(n2).fill(0)]);
+  for (let j = 0;j <= n2; j++)
     dp[0][j] = j;
   for (let i = 1;i <= m; i++) {
-    for (let j = 1;j <= n; j++) {
+    for (let j = 1;j <= n2; j++) {
       dp[i][j] = a[i - 1] === b[j - 1] ? dp[i - 1][j - 1] : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
     }
   }
-  return dp[m][n];
+  return dp[m][n2];
 }
 function suggestHooks(name, max = 3) {
-  return HOOKS.map((h) => ({ name: h.name, dist: editDistance(name.toLowerCase(), h.name.toLowerCase()) })).filter(({ dist }) => dist <= 4).sort((a, b) => a.dist - b.dist).slice(0, max).map(({ name: n }) => n);
+  return HOOKS.map((h) => ({ name: h.name, dist: editDistance(name.toLowerCase(), h.name.toLowerCase()) })).filter(({ dist }) => dist <= 4).sort((a, b) => a.dist - b.dist).slice(0, max).map(({ name: n2 }) => n2);
 }
 program2.name("hooks").description("Install hooks for AI coding agents").version(pkg2.version);
 program2.command("interactive", { isDefault: true }).alias("i").description("Interactive hook browser").action(() => {
@@ -13437,10 +13688,10 @@ program2.command("install").alias("add").argument("[hooks...]", "Hooks to instal
     return { name, version };
   }
   const pinnedRequests = toInstall.map((arg) => ({ arg, pinned: parseNameVersion(arg) })).filter((x) => x.pinned !== null);
-  const customSources = toInstall.filter((n) => !getHook(n) && isCustomSource2(n));
+  const customSources = toInstall.filter((n2) => !getHook(n2) && isCustomSource2(n2));
   if (options.dryRun) {
-    const known = toInstall.filter((n) => getHook(n));
-    const unknown = toInstall.filter((n) => !getHook(n) && !isCustomSource2(n) && !parseNameVersion(n) && !readCustomManifest2(n));
+    const known = toInstall.filter((n2) => getHook(n2));
+    const unknown = toInstall.filter((n2) => !getHook(n2) && !isCustomSource2(n2) && !parseNameVersion(n2) && !readCustomManifest2(n2));
     if (options.json) {
       console.log(JSON.stringify({
         dryRun: true,
@@ -13514,7 +13765,7 @@ Dry run \u2014 would install (${scope}, ${target}):
   for (const { arg, pinned } of pinnedRequests) {
     try {
       const transport = resolveHooksTransport2();
-      const pinnedInstall = transport.mode === "remote" && transport.authority ? await fetchPinnedHook2(pinned.name, pinned.version, transport.authority.origin, transport.authority.apiKey) : await installPinnedFromBundled2(pinned.name, pinned.version);
+      const pinnedInstall = transport.mode === "remote" && transport.authority ? await fetchPinnedHook2(pinned.name, pinned.version, transport.authority.origin, transport.authority) : await installPinnedFromBundled2(pinned.name, pinned.version);
       installedPinned.push(pinnedInstall.name);
       if (options.json) {
         console.log(JSON.stringify({ pinned: { request: arg, name: pinnedInstall.name, version: pinnedInstall.version, sha256: pinnedInstall.sha256, source: pinnedInstall.source } }));
@@ -13533,7 +13784,7 @@ Dry run \u2014 would install (${scope}, ${target}):
     }
   }
   const namesToRegister = [...new Set([
-    ...toInstall.filter((n) => !isCustomSource2(n) && !parseNameVersion(n)),
+    ...toInstall.filter((n2) => !isCustomSource2(n2) && !parseNameVersion(n2)),
     ...installedCustom,
     ...installedPinned
   ])];
@@ -13557,22 +13808,22 @@ Dry run \u2014 would install (${scope}, ${target}):
   }
   if (options.json) {
     console.log(JSON.stringify({
-      installed: results.filter((r) => r.success).map((r) => r.hook),
-      failed: results.filter((r) => !r.success).map((r) => ({ hook: r.hook, error: r.error })),
-      fragments: results.filter((r) => r.success && r.fragment).map((r) => ({ hook: r.hook, fragment: r.fragment, applied: r.applied, configPath: r.configPath, note: r.note })),
+      installed: results.filter((r2) => r2.success).map((r2) => r2.hook),
+      failed: results.filter((r2) => !r2.success).map((r2) => ({ hook: r2.hook, error: r2.error })),
+      fragments: results.filter((r2) => r2.success && r2.fragment).map((r2) => ({ hook: r2.hook, fragment: r2.fragment, applied: r2.applied, configPath: r2.configPath, note: r2.note })),
       total: results.length,
-      success: results.filter((r) => r.success).length,
+      success: results.filter((r2) => r2.success).length,
       scope,
       target,
-      applied: results.some((r) => r.applied),
-      ...target === "codex" ? { notes: results.filter((r) => r.success && r.note).map((r) => r.note) } : {}
+      applied: results.some((r2) => r2.applied),
+      ...target === "codex" ? { notes: results.filter((r2) => r2.success && r2.note).map((r2) => r2.note) } : {}
     }));
-    if (results.some((r) => !r.success)) {
+    if (results.some((r2) => !r2.success)) {
       process.exitCode = 1;
     }
     return;
   }
-  const successCount = results.filter((r) => r.success).length;
+  const successCount = results.filter((r2) => r2.success).length;
   const settingsFile = target === "codewith" ? options.applyCodewith ? options.codewithConfig : "TOML fragment only (configs should apply)" : formatSettingsPath(scope, target);
   console.log(chalk2.bold(`
 Installing hooks (${scope}, ${target})...
@@ -14024,7 +14275,7 @@ program2.command("update").argument("[hooks...]", "Hooks to update (defaults to
     if (pinned) {
       try {
         const transport = resolveHooksTransport2();
-        const pinnedInstall = transport.mode === "remote" && transport.authority ? await fetchPinnedHook2(pinned.name, pinned.version, transport.authority.origin, transport.authority.apiKey) : await installPinnedFromBundled2(pinned.name, pinned.version);
+        const pinnedInstall = transport.mode === "remote" && transport.authority ? await fetchPinnedHook2(pinned.name, pinned.version, transport.authority.origin, transport.authority) : await installPinnedFromBundled2(pinned.name, pinned.version);
         const registered = installHook(pinnedInstall.name, { scope, overwrite: true });
         if (!registered.success) {
           results.push({ hook: arg, success: false, error: registered.error ?? "registration failed" });
@@ -14065,10 +14316,10 @@ program2.command("update").argument("[hooks...]", "Hooks to update (defaults to
   }
   if (options.json) {
     console.log(JSON.stringify({
-      updated: results.filter((r) => r.success).map((r) => r.hook),
-      failed: results.filter((r) => !r.success).map((r) => ({ hook: r.hook, error: r.error }))
+      updated: results.filter((r2) => r2.success).map((r2) => r2.hook),
+      failed: results.filter((r2) => !r2.success).map((r2) => ({ hook: r2.hook, error: r2.error }))
     }));
-    if (results.some((r) => !r.success)) {
+    if (results.some((r2) => !r2.success)) {
       process.exitCode = 1;
     }
     return;
@@ -14083,7 +14334,7 @@ Updating hooks...
       console.log(chalk2.red(`\u2717 ${result.hook}: ${result.error}`));
     }
   }
-  if (results.some((r) => !r.success)) {
+  if (results.some((r2) => !r2.success)) {
     process.exitCode = 1;
   }
 });
@@ -14428,16 +14679,16 @@ logCmd.command("errors").description("Show hook events that contain errors").opt
     const m = s.match(/^(\d+)(s|m|h|d)$/);
     if (!m)
       return 86400000;
-    const n = parseInt(m[1]);
+    const n2 = parseInt(m[1]);
     switch (m[2]) {
       case "s":
-        return n * 1000;
+        return n2 * 1000;
       case "m":
-        return n * 60 * 1000;
+        return n2 * 60 * 1000;
       case "h":
-        return n * 60 * 60 * 1000;
+        return n2 * 60 * 60 * 1000;
       case "d":
-        return n * 24 * 60 * 60 * 1000;
+        return n2 * 24 * 60 * 60 * 1000;
       default:
         return 86400000;
     }