@hasna/instructions 0.5.6 → 0.6.0

package/dist/index.js

@@ -107,25 +107,799 @@ import { existsSync as existsSync2, mkdirSync, rmSync } from "fs";
 import { join as join3 } from "path";
 import { randomUUID } from "crypto";
 
-// src/lib/retired-storage-mode.ts
-var LEGACY_STORAGE_MODE_KEYS = [
-  "HASNA_INSTRUCTIONS_STORAGE_MODE",
-  "HASNA_INSTRUCTIONS_MODE",
-  "INSTRUCTIONS_STORAGE_MODE",
-  "INSTRUCTIONS_MODE"
-];
-function firstDefinedEnvKey(env, keys) {
-  for (const key of keys) {
-    if (Object.hasOwn(env, key) && env[key] !== undefined)
-      return key;
+// ../contracts/dist/client/transport.js
+import { isIP } from "net";
+import { spawnSync } from "child_process";
+import { closeSync, fstatSync, openSync, readFileSync } from "fs";
+import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
+import { createRequire } from "module";
+import { hostname as osHostname } from "os";
+import { isAbsolute, join } from "path";
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function clientTransportEnvKeys(name) {
+  const envSegment = envToken(name);
+  return {
+    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
+    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
+  };
+}
+function credentialOverrideEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
+}
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE";
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
+
+class CredentialResolutionError extends Error {
+  appName;
+  attempted;
+  constructor(appName, message, attempted) {
+    super(message);
+    this.name = "CredentialResolutionError";
+    this.appName = appName;
+    this.attempted = attempted;
+  }
+}
+
+class CredentialFileUnsafeError extends Error {
+  path;
+  constructor(path, reason) {
+    super(`Refusing unsafe credential/config file ${path}: ${reason}.`);
+    this.name = "CredentialFileUnsafeError";
+    this.path = path;
+  }
+}
+var HASNA_HOME_ENV_KEY = "HASNA_HOME";
+var HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME";
+var KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION";
+var HASNA_HOME_DIR = ".hasna";
+var CONFIG_SUBDIR = "config";
+var CREDENTIALS_FILE = "credentials";
+var KEYCHAIN_SECURITY_BIN = "/usr/bin/security";
+var KEYCHAIN_SERVICE_PREFIX = "hasna.credentials";
+var KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44;
+var KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4;
+var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+var SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+var SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+var ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+var VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
+function homeDir(env) {
+  const home = env.HOME?.trim();
+  return home ? home : null;
+}
+function absoluteOverride(env, key) {
+  const value = env[key]?.trim();
+  return value && isAbsolute(value) ? value : null;
+}
+function hasnaHomeDir(env) {
+  const override = absoluteOverride(env, HASNA_HOME_ENV_KEY);
+  if (override)
+    return override;
+  const home = homeDir(env);
+  return home ? join(home, HASNA_HOME_DIR) : null;
+}
+function appConfigDir(name, env) {
+  const configRoot = absoluteOverride(env, HASNA_CONFIG_HOME_ENV_KEY);
+  if (configRoot)
+    return join(configRoot, name);
+  const root = hasnaHomeDir(env);
+  return root ? join(root, name, CONFIG_SUBDIR) : null;
+}
+function credentialDiskSourceList(name, env, profile = null) {
+  if (!SAFE_APP_SLUG.test(name))
+    return [];
+  const directory = appConfigDir(name, env);
+  if (!directory)
+    return [];
+  const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
+  return [{ path: join(directory, file), tier: "disk" }];
+}
+function credentialDiskSources(name, env) {
+  return credentialDiskSourceList(name, env, null).map((s) => s.path);
+}
+function profileDiskSources(name, env, profile) {
+  return credentialDiskSourceList(name, env, profile).map((s) => s.path);
+}
+function parseEnvFile(text) {
+  const values = new Map;
+  const unusable = new Set;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#"))
+      continue;
+    const withoutExport = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
+    const equals = withoutExport.indexOf("=");
+    if (equals <= 0)
+      continue;
+    const key = withoutExport.slice(0, equals).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    let value = withoutExport.slice(equals + 1).trim();
+    const quote = value[0];
+    if (quote === '"' || quote === "'") {
+      if (value.length < 2 || !value.endsWith(quote)) {
+        unusable.add(key);
+        continue;
+      }
+      value = value.slice(1, -1);
+    }
+    if (value.trim().length === 0) {
+      unusable.add(key);
+      continue;
+    }
+    if (values.has(key) && values.get(key) !== value)
+      unusable.add(key);
+    values.set(key, value);
+  }
+  return { values, unusable };
+}
+function configFileModeAllowed(mode) {
+  const permissions = mode & 4095;
+  return permissions === 256 || permissions === 384;
+}
+function configFileReadsCoherent(before, after) {
+  return before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs;
+}
+function readAppConfigFile(path) {
+  const unsafe = (reason) => {
+    throw new CredentialFileUnsafeError(path, reason);
+  };
+  let fd = -1;
+  try {
+    fd = openSync(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR")
+      return null;
+    if (code === "ELOOP")
+      unsafe("the path is a symlink");
+    unsafe(`the path could not be opened (${code ?? "unknown error"})`);
+  }
+  try {
+    const before = fstatSync(fd);
+    if (!before.isFile())
+      unsafe("the path is not a regular file");
+    if (!configFileModeAllowed(before.mode)) {
+      unsafe(`permission mode ${(before.mode & 4095).toString(8).padStart(4, "0")} is not owner-only 0400 or 0600`);
+    }
+    const uid = process.getuid?.() ?? process.geteuid?.();
+    if (uid !== undefined && before.uid !== uid)
+      unsafe("the file is not owned by the current user");
+    if (before.size > MAX_CREDENTIAL_FILE_BYTES)
+      unsafe("the file exceeds the size limit");
+    const bytes = readFileSync(fd);
+    const after = fstatSync(fd);
+    if (!configFileReadsCoherent(before, after)) {
+      unsafe("the file changed while being read");
+    }
+    return parseEnvFile(bytes.toString("utf8"));
+  } finally {
+    if (fd !== -1)
+      closeSync(fd);
+  }
+}
+function readCredentialFile(path, apiKeyKeys) {
+  const parsed = readAppConfigFile(path);
+  if (!parsed)
+    return null;
+  for (const key of apiKeyKeys) {
+    if (parsed.unusable.has(key)) {
+      throw new CredentialFileUnsafeError(path, `${key} is declared but blank or malformed`);
+    }
+  }
+  const values = apiKeyKeys.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+  if (new Set(values).size > 1) {
+    throw new CredentialFileUnsafeError(path, "credential aliases disagree");
+  }
+  return values[0] ?? null;
+}
+var CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
+function appConfigDiskValue(name, env, keys) {
+  const wanted = keys.filter((key) => !CREDENTIAL_SHAPED_KEY.test(key));
+  if (wanted.length === 0)
+    return null;
+  for (const path of credentialDiskSources(name, env)) {
+    const parsed = readAppConfigFile(path);
+    if (!parsed)
+      continue;
+    if (wanted.some((key) => parsed.unusable.has(key))) {
+      return { key: wanted.find((key) => parsed.unusable.has(key)), value: "", path, unusable: true };
+    }
+    const values = wanted.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+    if (new Set(values).size > 1)
+      throw new CredentialFileUnsafeError(path, "configuration aliases disagree");
+    for (const key of wanted) {
+      if (parsed.unusable.has(key))
+        return { key, value: "", path, unusable: true };
+      const value = parsed.values.get(key)?.trim();
+      if (value)
+        return { key, value, path };
+    }
   }
   return null;
 }
-function assertNoLegacyStorageMode(env = process.env) {
-  const legacyKey = firstDefinedEnvKey(env, LEGACY_STORAGE_MODE_KEYS);
-  if (!legacyKey)
+function assertUsableCredential(appName, source, value) {
+  if (VAULT_POINTER_SHAPE.test(value)) {
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
+  if (!ILLEGAL_IN_HEADER_VALUE.test(value))
     return;
-  throw new Error(`${legacyKey} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `The client uses the local SQLite store, or the HTTP API selected by ` + `HASNA_INSTRUCTIONS_API_URL + HASNA_INSTRUCTIONS_API_KEY. ` + `On the server, set HASNA_INSTRUCTIONS_DATABASE_URL to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+  throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
+}
+var INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+var CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
+function sealCredential(fields) {
+  const { apiKey } = fields;
+  const visible = {
+    tier: fields.tier,
+    source: fields.source,
+    deliberate: fields.deliberate,
+    diskCandidates: Object.freeze([...fields.diskCandidates]),
+    warning: fields.warning
+  };
+  const sealed = { ...visible };
+  Object.defineProperty(sealed, "apiKey", {
+    value: apiKey,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  Object.defineProperty(sealed, INSPECT_CUSTOM, {
+    value: () => ({ ...visible, apiKey: "[redacted]" }),
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, CREDENTIAL_SEAL, {
+    value: true,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  return Object.freeze(sealed);
+}
+function firstEnvValue(env, keys) {
+  for (const key of keys) {
+    if (!Object.prototype.hasOwnProperty.call(env, key))
+      continue;
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+var AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+function isAmbientEnvironment(env) {
+  return env === process.env || env[AMBIENT_ENVIRONMENT] === true;
+}
+function defaultKeychainRunner(argv) {
+  const result = spawnSync(KEYCHAIN_SECURITY_BIN, [...argv], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: KEYCHAIN_SPAWN_TIMEOUT_MS
+  });
+  return {
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.error ? result.error.message : result.stderr ?? ""
+  };
+}
+function keychainTierEnabled(env, options) {
+  if ((options.platform ?? process.platform) !== "darwin")
+    return false;
+  if (options.enabled !== undefined)
+    return options.enabled;
+  return options.run !== undefined || isAmbientEnvironment(env);
+}
+function keychainAccount(env, options) {
+  const station = env[KEYCHAIN_STATION_ENV_KEY]?.trim();
+  if (station)
+    return station;
+  const host = (options.hostname ?? osHostname)().split(".")[0]?.trim() ?? "";
+  if (host)
+    return host;
+  const user = env.USER?.trim();
+  return user || null;
+}
+function keychainFailureHint(text) {
+  const line = text.split(/\r?\n/).find((entry) => entry.trim().length > 0)?.trim() ?? "";
+  const clean = line.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 200);
+  return clean ? `: ${clean}` : "";
+}
+function readKeychainItem(name, env, kind, options) {
+  if (!SAFE_APP_SLUG.test(name) || !keychainTierEnabled(env, options))
+    return null;
+  const account = keychainAccount(env, options);
+  if (!account)
+    return null;
+  const service = `${KEYCHAIN_SERVICE_PREFIX}.${name}.${kind}`;
+  const source = `keychain:${service}@${account}`;
+  const run = options.run ?? defaultKeychainRunner;
+  let result;
+  try {
+    result = run(["find-generic-password", "-a", account, "-s", service, "-w"]);
+  } catch (error) {
+    const reason = keychainFailureHint(error instanceof Error ? error.message : String(error));
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} could not run${reason}. A Keychain failure is never resolved ` + `around: fix the keychain, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  if (result.status === KEYCHAIN_ITEM_NOT_FOUND_STATUS)
+    return null;
+  if (result.status !== 0) {
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} failed (security exited ` + `${result.status ?? "without a status"}${keychainFailureHint(result.stderr)}). A Keychain item that ` + `exists but cannot be read is never resolved around: unlock the keychain, run from a session that ` + `may use it, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  const value = result.stdout.trim();
+  if (!value) {
+    throw new CredentialResolutionError(name, `${source} exists but holds an empty value; a declared item never falls through to another ` + `identity. Store a value in it or delete the item.`, [source]);
+  }
+  return { value, source };
+}
+function keychainConfigValue(name, env, options = {}) {
+  return readKeychainItem(name, env, "api-url", options);
+}
+function snapshotClientEnvironment(name, env) {
+  const keys = clientTransportEnvKeys(name);
+  const ambient = isAmbientEnvironment(env);
+  const snapshot = Object.create(null);
+  for (const key of [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey(name),
+    credentialPointerEnvKey(name),
+    CREDENTIAL_PROFILE_ENV_KEY,
+    "HOME",
+    HASNA_HOME_ENV_KEY,
+    HASNA_CONFIG_HOME_ENV_KEY,
+    KEYCHAIN_STATION_ENV_KEY,
+    "USER"
+  ]) {
+    const descriptor = Object.getOwnPropertyDescriptor(env, key);
+    if (!descriptor)
+      continue;
+    if (!("value" in descriptor)) {
+      throw new CredentialResolutionError(name, `${key} is accessor-backed; client configuration requires own data properties.`, [key]);
+    }
+    if (descriptor.value !== undefined && typeof descriptor.value !== "string") {
+      throw new CredentialResolutionError(name, `${key} must be a string data property.`, [key]);
+    }
+    snapshot[key] = descriptor.value;
+  }
+  if (ambient) {
+    Object.defineProperty(snapshot, AMBIENT_ENVIRONMENT, {
+      value: true,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  return Object.freeze(snapshot);
+}
+function resolveCredential(name, env, options = {}) {
+  env = snapshotClientEnvironment(name, env);
+  const { apiKeyKeys } = clientTransportEnvKeys(name);
+  const diskPaths = credentialDiskSources(name, env);
+  if (options.apiKey !== undefined) {
+    const explicitKey = options.apiKey.trim();
+    if (!explicitKey) {
+      throw new CredentialResolutionError(name, "The explicit apiKey argument is blank; an explicit credential never falls through to another identity.", ["explicit apiKey argument"]);
+    }
+    assertUsableCredential(name, "the explicit apiKey argument", explicitKey);
+    return sealCredential({
+      apiKey: explicitKey,
+      tier: "argument",
+      source: "explicit apiKey argument",
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const overrideKeyName = credentialOverrideEnvKey(name);
+  const overrideRaw = Object.prototype.hasOwnProperty.call(env, overrideKeyName) ? env[overrideKeyName] : undefined;
+  if (overrideRaw !== undefined) {
+    const override = overrideRaw.trim();
+    if (!override) {
+      throw new CredentialResolutionError(name, `${overrideKeyName} is set but empty. It is a deliberate override, so it is not resolved around: ` + `either give it a real key or unset it to fall back to the credential on disk.`, [overrideKeyName]);
+    }
+    assertUsableCredential(name, overrideKeyName, override);
+    return sealCredential({
+      apiKey: override,
+      tier: "override",
+      source: overrideKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const pointerKeyName = credentialPointerEnvKey(name);
+  const pointerRaw = Object.prototype.hasOwnProperty.call(env, pointerKeyName) ? env[pointerKeyName] : undefined;
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE.test(pointer)) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  if (options.profile !== undefined && !options.profile.trim()) {
+    throw new CredentialResolutionError(name, "The explicit profile argument is blank; an explicit identity selection never falls through.", ["explicit profile argument"]);
+  }
+  const profileRaw = Object.prototype.hasOwnProperty.call(env, CREDENTIAL_PROFILE_ENV_KEY) ? env[CREDENTIAL_PROFILE_ENV_KEY] : undefined;
+  if (profileRaw !== undefined && !profileRaw.trim()) {
+    throw new CredentialResolutionError(name, `${CREDENTIAL_PROFILE_ENV_KEY} is set but blank.`, [CREDENTIAL_PROFILE_ENV_KEY]);
+  }
+  const profile = options.profile?.trim() || profileRaw?.trim();
+  if (profile) {
+    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
+    if (!SAFE_PROFILE.test(profile)) {
+      throw new CredentialResolutionError(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
+    }
+    const paths = profileDiskSources(name, env, profile);
+    for (const path of paths) {
+      const value = readCredentialFile(path, apiKeyKeys);
+      if (value) {
+        assertUsableCredential(name, path, value);
+        return sealCredential({
+          apiKey: value,
+          tier: "profile",
+          source: path,
+          deliberate: true,
+          diskCandidates: paths,
+          warning: null
+        });
+      }
+    }
+    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
+  }
+  const definedEnvEntries = apiKeyKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, value: String(env[key]).trim() }));
+  const blankEnv = definedEnvEntries.find((entry) => entry.value.length === 0);
+  if (blankEnv) {
+    throw new CredentialResolutionError(name, `${blankEnv.key} is set but blank; a declared credential never falls through to another alias or identity.`, [blankEnv.key]);
+  }
+  if (definedEnvEntries.length > 1 && new Set(definedEnvEntries.map((entry) => entry.value)).size > 1) {
+    throw new CredentialResolutionError(name, `${definedEnvEntries.map((entry) => entry.key).join(" and ")} disagree; credential aliases must be identical or only one may be set.`, definedEnvEntries.map((entry) => entry.key));
+  }
+  const envHit = firstEnvValue(env, apiKeyKeys);
+  const keychainHit = readKeychainItem(name, env, "api-key", options.keychain ?? {});
+  if (keychainHit) {
+    assertUsableCredential(name, keychainHit.source, keychainHit.value);
+    const warning = envHit && envHit.value !== keychainHit.value ? `Credential sources disagree for '${name}': ${keychainHit.source} and ${envHit.key} hold ` + `different keys. ${keychainHit.source} wins, because the Keychain is re-read on every call while ` + `an environment variable is a snapshot. Reconcile them \u2014 a rotation that updated only one leaves ` + `the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: keychainHit.value,
+      tier: "keychain",
+      source: keychainHit.source,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  const diskSourceList = credentialDiskSourceList(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  if (diskHits.length > 0) {
+    const winner = diskHits[0];
+    assertUsableCredential(name, winner.src.path, winner.value);
+    const divergentSources = [
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
+      ...envHit && envHit.value !== winner.value ? [envHit.key] : []
+    ];
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: winner.value,
+      tier: winner.src.tier,
+      source: winner.src.path,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  if (envHit) {
+    assertUsableCredential(name, envHit.key, envHit.value);
+    return sealCredential({
+      apiKey: envHit.value,
+      tier: "env",
+      source: envHit.key,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  return null;
+}
+var SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+var requireSecretsSdk = createRequire(import.meta.url);
+var DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com";
+var DEFAULT_AUTHORITY_SOURCE = "default";
+function defaultFleetGatewayBaseUrl(name) {
+  return `${DEFAULT_FLEET_GATEWAY_ORIGIN}/${validateAppSlug(name)}`;
+}
+var ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
+var DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+function isValidDnsDomain(value) {
+  if (value.length === 0 || value.length > 253 || ASCII_CONTROL_PATTERN.test(value) || /[^\x00-\x7f]/.test(value)) {
+    return false;
+  }
+  return value.split(".").every((label) => label.length <= 63 && !label.startsWith("xn--") && DNS_LABEL_PATTERN.test(label));
+}
+function validateAppSlug(name) {
+  if (name.length > 63 || !DNS_LABEL_PATTERN.test(name)) {
+    throw new Error("App name must be one lowercase DNS label.");
+  }
+  return name;
+}
+function rawAuthority(value) {
+  const match = /^[a-z][a-z0-9+.-]*:\/\//i.exec(value);
+  if (!match)
+    throw new Error("API URL must be absolute.");
+  const afterScheme = value.slice(match[0].length);
+  const boundary = afterScheme.search(/[/?#]/);
+  const authority = boundary === -1 ? afterScheme : afterScheme.slice(0, boundary);
+  if (!authority)
+    throw new Error("API URL must include a hostname.");
+  return authority;
+}
+function assertCanonicalPort(port) {
+  if (!/^[0-9]+$/.test(port) || port.length > 1 && port.startsWith("0")) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
+  }
+  const numericPort = Number(port);
+  if (!Number.isSafeInteger(numericPort) || numericPort < 1 || numericPort > 65535) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
+  }
+}
+function canonicalAuthorityHostname(authority) {
+  let rawHostname;
+  if (authority.startsWith("[")) {
+    const closingBracket = authority.indexOf("]");
+    if (closingBracket === -1) {
+      throw new Error("API URL authority must contain a canonical hostname.");
+    }
+    rawHostname = authority.slice(0, closingBracket + 1);
+    const portSuffix = authority.slice(closingBracket + 1);
+    if (portSuffix) {
+      if (!portSuffix.startsWith(":")) {
+        throw new Error("API URL authority must contain a canonical hostname and port.");
+      }
+      assertCanonicalPort(portSuffix.slice(1));
+    }
+    if (isIP(rawHostname.slice(1, -1)) !== 6) {
+      throw new Error("API URL authority must contain a canonical IPv6 literal.");
+    }
+  } else {
+    const firstColon = authority.indexOf(":");
+    const lastColon = authority.lastIndexOf(":");
+    if (firstColon !== lastColon) {
+      throw new Error("IPv6 API URL authorities must use brackets.");
+    }
+    if (lastColon !== -1) {
+      const port = authority.slice(lastColon + 1);
+      assertCanonicalPort(port);
+      rawHostname = authority.slice(0, lastColon);
+    } else {
+      rawHostname = authority;
+    }
+    const ipVersion = isIP(rawHostname);
+    const numericAddressParts = rawHostname.split(".");
+    const looksLikeNonCanonicalIpv4 = numericAddressParts.every((part) => /^(?:0x[0-9a-f]+|[0-9]+)$/i.test(part));
+    if (ipVersion !== 4 && looksLikeNonCanonicalIpv4 || ipVersion !== 4 && !isValidDnsDomain(rawHostname.toLowerCase())) {
+      throw new Error("API URL authority must contain a canonical ASCII hostname.");
+    }
+  }
+  return rawHostname.toLowerCase();
+}
+function isDeliberateLoopbackHttpAuthority(authority) {
+  return /^(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?$/i.test(authority);
+}
+function toV1BaseUrl(apiUrl) {
+  if (ASCII_CONTROL_PATTERN.test(apiUrl)) {
+    throw new Error("API URL must not contain ASCII control characters.");
+  }
+  const input = apiUrl.trim();
+  const authority = rawAuthority(input);
+  if (authority.includes("@") || authority.includes("\\") || authority.includes("%") || /[^\x00-\x7f]/.test(authority)) {
+    throw new Error("API URL authority must be canonical ASCII without credentials.");
+  }
+  const canonicalHostname = canonicalAuthorityHostname(authority);
+  const url = new URL(input);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("API URL must use http or https.");
+  }
+  if (url.username || url.password) {
+    throw new Error("API URL must not include credentials.");
+  }
+  if (!url.hostname || url.hostname.endsWith(".")) {
+    throw new Error("API URL must include a canonical hostname.");
+  }
+  if (url.hostname.toLowerCase() !== canonicalHostname) {
+    throw new Error("API URL authority must not rely on parser hostname normalization.");
+  }
+  if (url.hostname.split(".").some((label) => label.toLowerCase().startsWith("xn--"))) {
+    throw new Error("API URL must not use IDN or punycode hostnames.");
+  }
+  if (url.protocol === "http:" && !isDeliberateLoopbackHttpAuthority(authority)) {
+    throw new Error("API URL may use http only for an exact loopback authority.");
+  }
+  if (url.search || url.hash) {
+    throw new Error("API URL must not include a query string or fragment.");
+  }
+  let path = url.pathname.replace(/\/+$/, "");
+  if (path.endsWith("/v1"))
+    path = path.slice(0, -"/v1".length);
+  url.pathname = `${path}/v1`;
+  return url.toString().replace(/\/+$/, "");
+}
+class ClientTransportConfigurationError extends Error {
+  appName;
+  sources;
+  constructor(appName, message, sources = []) {
+    super(message);
+    this.name = "ClientTransportConfigurationError";
+    this.appName = appName;
+    this.sources = Object.freeze([...sources]);
+  }
+}
+function resolveClientTransportSnapshot(name, env = process.env, options = {}) {
+  env = snapshotClientEnvironment(name, env);
+  const keys = clientTransportEnvKeys(name);
+  const definedUrlEntries = keys.apiUrlKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, raw: String(env[key]) }));
+  const blankUrl = definedUrlEntries.find((entry) => entry.raw.trim().length === 0);
+  if (blankUrl) {
+    throw new ClientTransportConfigurationError(name, `${blankUrl.key} is set but blank; public clients require an explicit HTTPS API URL and never select local storage.`, [blankUrl.key]);
+  }
+  const controlledUrl = definedUrlEntries.find((entry) => ASCII_CONTROL_PATTERN.test(entry.raw));
+  if (controlledUrl) {
+    throw new ClientTransportConfigurationError(name, `${controlledUrl.key} contains ASCII control characters.`, [controlledUrl.key]);
+  }
+  const usableUrlEntries = definedUrlEntries.map((entry) => ({ key: entry.key, value: entry.raw.trim() }));
+  if (usableUrlEntries.length > 1 && new Set(usableUrlEntries.map((entry) => entry.value)).size > 1) {
+    throw new ClientTransportConfigurationError(name, `${usableUrlEntries.map((entry) => entry.key).join(" and ")} disagree; client authority aliases must be identical or only one may be set.`, usableUrlEntries.map((entry) => entry.key));
+  }
+  const envUrlHit = usableUrlEntries[0] ?? null;
+  const keychainUrlHit = keychainConfigValue(name, env, options.credentials?.keychain);
+  const diskConfigUrlHit = appConfigDiskValue(name, env, keys.apiUrlKeys);
+  if (diskConfigUrlHit?.unusable) {
+    throw new ClientTransportConfigurationError(name, `${diskConfigUrlHit.key} in ${diskConfigUrlHit.path} is declared but blank or malformed; public clients require a valid HTTPS service authority.`, [diskConfigUrlHit.path]);
+  }
+  const urlCandidates = [
+    ...envUrlHit ? [envUrlHit] : [],
+    ...keychainUrlHit ? [{ key: keychainUrlHit.source, value: keychainUrlHit.value }] : [],
+    ...diskConfigUrlHit ? [{ key: diskConfigUrlHit.path, value: diskConfigUrlHit.value.trim() }] : []
+  ];
+  const configuredUrl = urlCandidates[0] ?? null;
+  const divergentUrls = urlCandidates.filter((candidate) => candidate.value !== configuredUrl?.value);
+  if (configuredUrl && divergentUrls.length > 0) {
+    throw new ClientTransportConfigurationError(name, `${configuredUrl.key} and ${divergentUrls.map((candidate) => candidate.key).join(" and ")} select different service authorities; refusing to send a credential written for one authority to the other.`, urlCandidates.map((candidate) => candidate.key));
+  }
+  const warnings = [];
+  if (configuredUrl && !envUrlHit) {
+    warnings.push(`No ${keys.apiUrlKeys[0]} in the environment; the server URL in ${configuredUrl.key} was used, so this client connects to the server. ` + `Keep that entry aligned with the intended service authority.`);
+  }
+  const credential = resolveCredential(name, env, options.credentials);
+  if (!credential) {
+    const diskHint = credentialDiskSourcesForMessage(name, env);
+    const lead = configuredUrl ? `${configuredUrl.key} selects the HTTP server for '${name}', but no API key could be resolved` : `${keys.apiUrlKeys[0]} is not set and no API key could be resolved for '${name}'; a credential is required before the default fleet gateway authority applies`;
+    warnings.push(`${lead}; refusing to create an unauthenticated client \u2014 public clients never fall back to SQLite or another local store. ` + `Looked in the Keychain (macOS only), then for a credential file at ${diskHint}, then for ${keys.apiKeyKeys[0]} in the environment.`);
+    throw new ClientTransportConfigurationError(name, warnings.join(" "), [configuredUrl?.key ?? keys.apiUrlKeys[0]]);
+  }
+  if (credential.warning)
+    warnings.push(credential.warning);
+  let urlHit;
+  if (configuredUrl) {
+    urlHit = configuredUrl;
+  } else {
+    try {
+      urlHit = { key: DEFAULT_AUTHORITY_SOURCE, value: defaultFleetGatewayBaseUrl(name) };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new ClientTransportConfigurationError(name, `No ${keys.apiUrlKeys[0]} is configured and the default fleet gateway authority cannot be composed for '${name}': ${message}`, [keys.apiUrlKeys[0]]);
+    }
+  }
+  const apiUrlSource = urlHit.key;
+  let baseUrl;
+  try {
+    baseUrl = toV1BaseUrl(urlHit.value);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new ClientTransportConfigurationError(name, `Invalid API URL from ${apiUrlSource}: ${message}`, [apiUrlSource]);
+  }
+  return {
+    resolution: {
+      transport: "http",
+      transportSource: urlHit.key,
+      baseUrl,
+      apiUrlSource,
+      apiKeyPresent: true,
+      apiKeySource: credential.source,
+      apiKeyTier: credential.tier,
+      misconfigured: false,
+      warning: warnings.length > 0 ? warnings.join(" ") : null
+    },
+    credential
+  };
+}
+function resolveClientTransport(name, env = process.env, options = {}) {
+  return resolveClientTransportSnapshot(name, env, options).resolution;
+}
+function credentialDiskSourcesForMessage(name, env) {
+  const paths = credentialDiskSources(name, env);
+  return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
+}
+var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+var AUTHORITY_OVERRIDE_HEADERS = new Set([
+  "host",
+  ":authority",
+  "forwarded",
+  "x-forwarded-host",
+  "x-original-host"
+]);
+
+// src/lib/local-opt-in.ts
+var INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS = ["HASNA_INSTRUCTIONS_LOCAL"];
+function instructionsLocalModeNotice() {
+  return `instructions: local mode \u2014 ${INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS[0]}=1 selects the on-box SQLite store, ` + `and no hosted authority was configured. Set HASNA_INSTRUCTIONS_API_KEY (or add the Keychain item ` + `hasna.credentials.instructions.api-key, or write ~/.hasna/instructions/config/credentials) to go hosted.`;
+}
+function isInstructionsLocalOptIn(env = process.env) {
+  return INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS.some((key) => (env[key] ?? "").trim() === "1");
+}
+function instructionsAuthorityEnvKeys() {
+  const keys = clientTransportEnvKeys("instructions");
+  return [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey("instructions"),
+    credentialPointerEnvKey("instructions"),
+    CREDENTIAL_PROFILE_ENV_KEY
+  ];
+}
+function hasInstructionsEnvAuthorityIntent(env = process.env) {
+  return instructionsAuthorityEnvKeys().some((key) => (env[key] ?? "").trim() !== "");
+}
+function selectsInstructionsLocalStore(env = process.env) {
+  return !hasInstructionsEnvAuthorityIntent(env) && isInstructionsLocalOptIn(env);
+}
+function instructionsResolverEnv(env) {
+  const blanks = instructionsAuthorityEnvKeys().filter((key) => (key in env) && (env[key] ?? "").trim() === "");
+  if (blanks.length === 0)
+    return env;
+  const next = { ...env };
+  for (const key of blanks)
+    delete next[key];
+  return next;
+}
+var CONTRACTS_AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+function isAmbientInstructionsEnv(env) {
+  if (typeof process !== "undefined" && env === process.env)
+    return true;
+  return env[CONTRACTS_AMBIENT_ENVIRONMENT] === true;
+}
+function instructionsResolverInputs(env, credentials = {}) {
+  const normalised = instructionsResolverEnv(env);
+  if (normalised === env)
+    return { env: normalised, credentials };
+  const keychain = { ...credentials.keychain };
+  if (keychain.enabled === undefined && keychain.run === undefined) {
+    keychain.enabled = isAmbientInstructionsEnv(env);
+  }
+  return { env: normalised, credentials: { ...credentials, keychain } };
 }
 
 // src/lib/raw-store-root.ts
@@ -133,87 +907,77 @@ import { resolve as resolve2 } from "path";
 
 // src/lib/app-home.ts
 import { existsSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2, resolve } from "path";
-
-// ../../node_modules/.bun/@hasna+paths@0.1.0/node_modules/@hasna/paths/dist/index.js
 import { homedir } from "os";
-import { join } from "path";
-var KIND_ENV = {
+import { join as join2, resolve } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+var PATHS_RESOLVER_KIND_ENV = {
   config: "HASNA_CONFIG_HOME",
   data: "HASNA_DATA_HOME",
   state: "HASNA_STATE_HOME",
   cache: "HASNA_CACHE_HOME"
 };
-var APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-function assertApp(app) {
+var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp(app) {
   if (typeof app !== "string" || app.length === 0) {
     throw new TypeError("paths: app must be a non-empty string");
   }
-  if (!APP_SLUG_RE.test(app)) {
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function envOf(options) {
-  return options.env ?? process.env;
-}
-function envValue(options, kind) {
-  const value = envOf(options)[KIND_ENV[kind]];
-  return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-function isMacOS(platform) {
-  return platform === "darwin";
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
 }
-function baseDir(kind, options) {
-  const override = envValue(options, kind);
-  if (override)
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
     return override;
-  const home = options.home ?? homedir();
+  const home = options.home ?? pathsResolverHomedir();
   const platform = options.platform ?? process.platform;
-  if (isMacOS(platform)) {
+  if (platform === "darwin") {
     switch (kind) {
       case "config":
       case "data":
-        return join(home, "Library", "Application Support", "Hasna");
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
       case "cache":
-        return join(home, "Library", "Caches", "Hasna");
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
       case "state":
-        return join(home, "Library", "Logs", "Hasna");
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
     }
   }
   switch (kind) {
     case "config":
-      return join(home, ".config", "hasna");
+      return pathsResolverJoin(home, ".config", "hasna");
     case "data":
-      return join(home, ".local", "share", "hasna");
+      return pathsResolverJoin(home, ".local", "share", "hasna");
     case "state":
-      return join(home, ".local", "state", "hasna");
+      return pathsResolverJoin(home, ".local", "state", "hasna");
     case "cache":
-      return join(home, ".cache", "hasna");
+      return pathsResolverJoin(home, ".cache", "hasna");
   }
 }
-function resolvePath(kind, options) {
-  assertApp(options.app);
-  const appSegment = options.internal === true ? join("internal", options.app) : options.app;
-  return join(baseDir(kind, options), appSegment);
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
 }
 function configDir(options) {
-  return resolvePath("config", options);
+  return pathsResolverResolve("config", options);
 }
-function stateDir(options) {
-  return resolvePath("state", options);
-}
-
-// src/lib/app-home.ts
 var HASNA_CONFIGS_HOME_ENV = "HASNA_CONFIGS_HOME";
-function homeDir(env = process.env) {
-  return env["HOME"] || env["USERPROFILE"] || homedir2();
+function homeDir2(env = process.env) {
+  return env["HOME"] || env["USERPROFILE"] || homedir();
 }
 function legacyStoreHome(env = process.env) {
-  return resolve(join2(homeDir(env), ".hasna", "instructions"));
+  return resolve(join2(homeDir2(env), ".hasna", "instructions"));
 }
 function resolverStoreHome(env = process.env) {
-  return configDir({ app: "configs", env, home: env.HOME || env.USERPROFILE || homedir2() });
+  return configDir({ app: "configs", env, home: env.HOME || env.USERPROFILE || homedir() });
 }
 function adoptResolverStoreHome(resolved, env = process.env) {
   const override = env.HASNA_CONFIG_HOME;
@@ -343,9 +1107,8 @@ var _db = null;
 function getDatabase(path) {
   if (_db)
     return _db;
-  assertNoLegacyStorageMode();
-  if (!path && process.env["HASNA_INSTRUCTIONS_API_URL"] && process.env["HASNA_INSTRUCTIONS_API_KEY"]) {
-    throw new Error("instructions is using the HTTP API transport (HASNA_INSTRUCTIONS_API_URL set): this command is not wired to the API yet. " + "Unset HASNA_INSTRUCTIONS_API_URL / HASNA_INSTRUCTIONS_API_KEY to use it against the local store.");
+  if (!path && hasInstructionsEnvAuthorityIntent(process.env)) {
+    throw new Error("instructions is using the hosted API transport (a HASNA_INSTRUCTIONS_* credential is configured): this command is not wired to the API yet. " + "Point this run at the local store (HASNA_INSTRUCTIONS_LOCAL=1 with no hosted credential) to use it against the local SQLite store.");
   }
   const dbPath = path || getDbPath();
   const db = new Database(dbPath);
@@ -642,7 +1405,7 @@ function getConfigStats(db) {
 }
 
 // src/lib/machine.ts
-import { arch as currentArch, homedir as homedir3, hostname as currentHostname, type as currentOsType } from "os";
+import { arch as currentArch, homedir as homedir2, hostname as currentHostname, type as currentOsType } from "os";
 import { existsSync as existsSync3 } from "fs";
 import { join as join4 } from "path";
 
@@ -717,10 +1480,10 @@ function normalizeOsFamily(os) {
   return value || "unknown";
 }
 function detectMachineContext(overrides = {}) {
-  const homeDir2 = overrides.home_dir ?? process.env["CONFIGS_HOME"] ?? process.env["HOME"] ?? homedir3();
+  const homeDir3 = overrides.home_dir ?? process.env["CONFIGS_HOME"] ?? process.env["HOME"] ?? homedir2();
   const os = overrides.os ?? currentOsType();
   const osFamily = normalizeOsFamily(os);
-  const bunBinDir = overrides.bun_bin_dir ?? join4(homeDir2, ".bun", "bin");
+  const bunBinDir = overrides.bun_bin_dir ?? join4(homeDir3, ".bun", "bin");
   const defaultBunPath = osFamily === "macos" && existsSync3(BREW_BUN_PATH) ? BREW_BUN_PATH : join4(bunBinDir, "bun");
   return {
     id: "current-machine",
@@ -730,8 +1493,8 @@ function detectMachineContext(overrides = {}) {
     last_applied_at: null,
     created_at: "",
     os_family: osFamily,
-    home_dir: homeDir2,
-    workspace_root: overrides.workspace_root ?? join4(homeDir2, osFamily === "macos" ? "Workspace" : "workspace"),
+    home_dir: homeDir3,
+    workspace_root: overrides.workspace_root ?? join4(homeDir3, osFamily === "macos" ? "Workspace" : "workspace"),
     bun_bin_dir: bunBinDir,
     bun_path: overrides.bun_path ?? defaultBunPath,
     path_prefix: overrides.path_prefix ?? (osFamily === "macos" ? `${join4("/opt", "homebrew", "bin")}:${bunBinDir}` : bunBinDir)
@@ -852,9 +1615,9 @@ import { createHash as createHash7 } from "crypto";
 
 // src/lib/session-render.ts
 import { createHash as createHash6 } from "crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync4, realpathSync as realpathSync2, statSync as statSync3 } from "fs";
-import { homedir as homedir7 } from "os";
-import { basename as basename4, dirname as dirname4, extname as extname2, isAbsolute as isAbsolute3, join as join9, parse as parse2, posix as posix2, relative as relative2, resolve as resolve8 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync5, realpathSync as realpathSync2, statSync as statSync3 } from "fs";
+import { homedir as homedir6 } from "os";
+import { basename as basename4, dirname as dirname4, extname as extname2, isAbsolute as isAbsolute4, join as join9, parse as parse2, posix as posix2, relative as relative2, resolve as resolve8 } from "path";
 
 // src/lib/global-agent-rules-standard.ts
 import { createHash } from "crypto";
@@ -1165,22 +1928,22 @@ import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
 import { execFileSync } from "child_process";
 import { dlopen, FFIType } from "bun:ffi";
 import {
-  closeSync,
+  closeSync as closeSync2,
   constants,
   existsSync as existsSync5,
-  fstatSync,
+  fstatSync as fstatSync2,
   fsyncSync,
   lstatSync,
   linkSync,
   mkdirSync as mkdirSync2,
-  openSync,
-  readFileSync,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
   renameSync,
   rmSync as rmSync2,
   statSync,
   writeFileSync
 } from "fs";
-import { basename, dirname as dirname2, isAbsolute, join as join6, parse, relative, resolve as resolve4 } from "path";
+import { basename, dirname as dirname2, isAbsolute as isAbsolute2, join as join6, parse, relative, resolve as resolve4 } from "path";
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
@@ -5375,11 +6138,71 @@ var SESSION_INSTRUCTION_LAYERS = [
 
 // src/lib/session-render-state.ts
 import { existsSync as existsSync4, readdirSync } from "fs";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir3 } from "os";
 import { dirname, join as join5, resolve as resolve3 } from "path";
+import { homedir as pathsResolverHomedir2 } from "os";
+import { join as pathsResolverJoin2 } from "path";
+var PATHS_RESOLVER_KIND_ENV2 = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var PATHS_RESOLVER_APP_SLUG_RE2 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp2(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE2.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind2(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV2).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV2).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir2(kind, options) {
+  pathsResolverAssertKind2(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV2[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir2();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin2(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin2(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin2(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin2(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin2(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin2(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin2(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve2(kind, options) {
+  pathsResolverAssertApp2(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin2("internal", options.app) : options.app;
+  return pathsResolverJoin2(pathsResolverBaseDir2(kind, options), appSegment);
+}
+function stateDir(options) {
+  return pathsResolverResolve2("state", options);
+}
 var SESSION_RENDER_STATE_APP = "instructions";
-function homeDir2(env = process.env) {
-  return env["HOME"] || env["USERPROFILE"] || homedir4();
+function homeDir3(env = process.env) {
+  return env["HOME"] || env["USERPROFILE"] || homedir3();
 }
 function legacySnapshotDir(targetHome) {
   return resolve3(join5(targetHome, ".hasna", "session-render-snapshots"));
@@ -5390,10 +6213,10 @@ function resolverSnapshotDir(env = process.env) {
     return stateDir({
       app: SESSION_RENDER_STATE_APP,
       env: { ...env, HASNA_STATE_HOME: undefined },
-      home: homeDir2(env)
+      home: homeDir3(env)
     });
   }
-  return stateDir({ app: SESSION_RENDER_STATE_APP, env, home: homeDir2(env) });
+  return stateDir({ app: SESSION_RENDER_STATE_APP, env, home: homeDir3(env) });
 }
 function adoptResolverSnapshotDir(resolved, env = process.env) {
   const override = env.HASNA_STATE_HOME;
@@ -5430,10 +6253,10 @@ var PROJECT_CONTEXT_MAX_APPROX_TOKENS = 1000;
 var PROJECT_CONTEXT_MAX_COMMANDS = 6;
 var PROJECT_CONTEXT_MAX_WARNINGS = 3;
 var PROJECT_CONTEXT_FRAGMENT_PATH = ".hasna/instructions/project-context.md";
-var PROJECT_CONTEXT_MANIFEST_PATH = ".hasna/project-context-manifest.json";
-var PROJECT_CONTEXT_CACHE_PATH = ".hasna/project-context-cache.json";
-var PROJECT_CONTEXT_LOCK_PATH = ".hasna/project-context.lock";
-var PROJECT_CONTEXT_SNAPSHOT_DIR = ".hasna/project-context-snapshots";
+var PROJECT_CONTEXT_MANIFEST_PATH = ".hasna/projects/project-context-manifest.json";
+var PROJECT_CONTEXT_CACHE_PATH = ".hasna/projects/project-context-cache.json";
+var PROJECT_CONTEXT_LOCK_PATH = ".hasna/projects/project-context.lock";
+var PROJECT_CONTEXT_SNAPSHOT_DIR = ".hasna/projects/project-context-snapshots";
 var PROJECT_CONTEXT_CACHE_SCHEMA = "hasna.instructions.project-context-cache/v1";
 var PROJECT_CONTEXT_MANAGED_COMMENT = "Managed by @hasna/configs project context";
 var SESSION_COMPATIBILITY_MANIFEST_MAX_BYTES = 8 * 1024 * 1024;
@@ -5483,7 +6306,7 @@ var safeOptionalDisplay = exports_external.string().min(1).max(512).refine(isSaf
 var isoTimestamp = exports_external.string().min(20).max(40).refine(isStrictIsoTimestamp, "must be a strict ISO timestamp with timezone");
 var revisionSchema = exports_external.string().min(1).max(512).refine((value) => revisionKey(value) !== null, "must be a monotonic rev-N or timestamp revision");
 var hashSchema = exports_external.string().regex(/^sha256:[a-f0-9]{64}$/);
-var absolutePath = exports_external.string().min(1).max(4096).refine((value) => isAbsolute(value), "must be absolute").refine(isSafeSingleLine, "must be safe").nullable();
+var absolutePath = exports_external.string().min(1).max(4096).refine((value) => isAbsolute2(value), "must be absolute").refine(isSafeSingleLine, "must be safe").nullable();
 var commandArg = exports_external.string().min(1).max(1024).refine((value) => isSafeCommandArgument(value), "unsafe argv item");
 var financeText = exports_external.string().min(1).max(512).refine((value) => value === value.trim(), "must be normalized");
 var financeLegalEntity = exports_external.string().min(1).max(256).refine((value) => value === value.trim(), "must be normalized");
@@ -6561,7 +7384,7 @@ function sanitizeLegacyEnvironment(value) {
   }
   const result = {};
   for (const [key, item] of Object.entries(value)) {
-    if (!/^[A-Z][A-Z0-9_]{0,63}$/.test(key) || typeof item !== "string" || !isAbsolute(item) || !isSafeSingleLine(item) || item.length > 4096) {
+    if (!/^[A-Z][A-Z0-9_]{0,63}$/.test(key) || typeof item !== "string" || !isAbsolute2(item) || !isSafeSingleLine(item) || item.length > 4096) {
       throw new ProjectContextError("PROJECT_CONTEXT_MANIFEST_INVALID", "provider session environment metadata contains an unsafe entry");
     }
     if (scanSecrets(`${key}=${item}`, "text").length > 0) {
@@ -6636,7 +7459,7 @@ function sanitizeLegacyFiles(value) {
   return value.map((entry) => {
     const file = entry;
     const relativePath = safeLegacyMetadataString(file["relativePath"], "");
-    if (!relativePath || isAbsolute(relativePath) || relativePath === ".." || relativePath.startsWith("../") || relativePath.includes("/../")) {
+    if (!relativePath || isAbsolute2(relativePath) || relativePath === ".." || relativePath.startsWith("../") || relativePath.includes("/../")) {
       throw new ProjectContextError("PROJECT_CONTEXT_MANIFEST_INVALID", "provider session file inventory contains an unsafe relative path");
     }
     const sha = safeLegacyMetadataString(file["sha256"], "");
@@ -6893,7 +7716,7 @@ function atomicWriteFile(path, content, workspaceRoot, defaultMode, expectedHash
     fd = anchoredOpenExclusive(directory, tempName, previousMode);
     writeFileSync(fd, content, { encoding: "utf8" });
     fsyncSync(fd);
-    closeSync(fd);
+    closeSync2(fd);
     fd = null;
     beforeInstall?.(tempPath);
     assertManagedDirectoryStable(dir, workspaceRoot, directory.identity);
@@ -6988,14 +7811,14 @@ function atomicWriteFile(path, content, workspaceRoot, defaultMode, expectedHash
     fsyncSync(directory.fd);
   } catch (error) {
     if (fd !== null)
-      closeSync(fd);
+      closeSync2(fd);
     if (!preserveTemp)
       directory.ops.unlinkat(directory.fd, tempName);
     if (directoryChanged)
       fsyncSync(directory.fd);
     throw error;
   } finally {
-    closeSync(directory.fd);
+    closeSync2(directory.fd);
   }
 }
 function atomicWritePortable(path, content, workspaceRoot, defaultMode, expectedHash, beforeInstall, maxObservedBytes, allowReplacement = false) {
@@ -7019,12 +7842,12 @@ function atomicWritePortable(path, content, workspaceRoot, defaultMode, expected
   let fd = null;
   let tempIdentity = null;
   try {
-    fd = openSync(tempPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, defaultMode);
-    const opened = fstatSync(fd);
+    fd = openSync2(tempPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, defaultMode);
+    const opened = fstatSync2(fd);
     tempIdentity = { dev: opened.dev, ino: opened.ino };
     writeFileSync(fd, content, { encoding: "utf8" });
     fsyncSync(fd);
-    closeSync(fd);
+    closeSync2(fd);
     fd = null;
     beforeInstall?.(tempPath);
     assertManagedDirectoryStable(dir, workspaceRoot, directoryIdentity);
@@ -7049,7 +7872,7 @@ function atomicWritePortable(path, content, workspaceRoot, defaultMode, expected
     fsyncDirectory(dir);
   } catch (error) {
     if (fd !== null)
-      closeSync(fd);
+      closeSync2(fd);
     if (tempIdentity && managedDirectoryMatches(dir, workspaceRoot, directoryIdentity)) {
       try {
         const current = lstatSync(tempPath);
@@ -7077,12 +7900,12 @@ function atomicWritePortableReplacement(path, content, workspaceRoot, expectedHa
   let fd = null;
   let tempIdentity = null;
   try {
-    fd = openSync(tempPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, current.mode & 511);
-    const opened = fstatSync(fd);
+    fd = openSync2(tempPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, current.mode & 511);
+    const opened = fstatSync2(fd);
     tempIdentity = { dev: opened.dev, ino: opened.ino };
     writeFileSync(fd, content, { encoding: "utf8" });
     fsyncSync(fd);
-    closeSync(fd);
+    closeSync2(fd);
     fd = null;
     beforeInstall?.(tempPath);
     assertManagedDirectoryStable(dir, workspaceRoot, directoryIdentity);
@@ -7100,7 +7923,7 @@ function atomicWritePortableReplacement(path, content, workspaceRoot, expectedHa
     fsyncDirectory(dir);
   } catch (error) {
     if (fd !== null)
-      closeSync(fd);
+      closeSync2(fd);
     if (tempIdentity && managedDirectoryMatches(dir, workspaceRoot, directoryIdentity)) {
       try {
         const candidate = lstatSync(tempPath);
@@ -7138,7 +7961,7 @@ function portableFileHash(path, workspaceRoot, maxObservedBytes) {
   if (maxObservedBytes !== null && stat.size > maxObservedBytes) {
     throw new ProjectContextHashRace(`managed output exceeds the safe read limit: ${relativePosix(workspaceRoot, path)}`);
   }
-  return createHash2("sha256").update(readFileSync(path)).digest("hex");
+  return createHash2("sha256").update(readFileSync2(path)).digest("hex");
 }
 function writeProjectContextCoordinatedFile(input) {
   atomicWriteFile(resolve4(input.path), input.content, assertSafeWorkspaceRoot(input.workspace_root), input.default_mode ?? 420, input.expected_hash, undefined, false, input.test_hooks?.before_install, input.force_portable_file_ops ?? false, input.max_observed_bytes, input.allow_portable_replacement ?? false);
@@ -7188,7 +8011,7 @@ function removeProjectContextCoordinatedFile(input) {
     }
     throw error;
   } finally {
-    closeSync(directory.fd);
+    closeSync2(directory.fd);
   }
 }
 function restoreAnchoredDisplacedFile(directory, displacedName, targetName, expected) {
@@ -7269,19 +8092,19 @@ function openAnchoredDirectory(path, workspaceRoot, providedOps, maxObservedByte
   const identity = captureManagedDirectoryIdentity(path, workspaceRoot);
   let fd;
   try {
-    fd = openSync(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    fd = openSync2(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
   } catch {
     throw new ProjectContextHashRace(`managed parent directory changed while opening: ${relativePosix(workspaceRoot, path)}`);
   }
   try {
-    const opened = fstatSync(fd);
+    const opened = fstatSync2(fd);
     if (!opened.isDirectory() || opened.dev !== identity.dev || opened.ino !== identity.ino) {
       throw new ProjectContextHashRace(`managed parent directory changed while opening: ${relativePosix(workspaceRoot, path)}`);
     }
     assertManagedDirectoryStable(path, workspaceRoot, identity);
     return { fd, path, workspaceRoot, identity, ops, maxObservedBytes };
   } catch (error) {
-    closeSync(fd);
+    closeSync2(fd);
     throw error;
   }
 }
@@ -7289,12 +8112,12 @@ function anchoredOpenExclusive(directory, name, mode) {
   const requestedMode = mode & 4095;
   let fd;
   try {
-    fd = openSync(join6(directory.path, name), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, requestedMode);
+    fd = openSync2(join6(directory.path, name), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, requestedMode);
   } catch {
     throw new ProjectContextHashRace(`could not create prepared managed file in ${relativePosix(directory.workspaceRoot, directory.path)}`);
   }
   try {
-    const opened = fstatSync(fd);
+    const opened = fstatSync2(fd);
     if (!opened.isFile()) {
       throw new ProjectContextHashRace("prepared managed output is not a regular file");
     }
@@ -7308,7 +8131,7 @@ function anchoredOpenExclusive(directory, name, mode) {
     }
     return fd;
   } catch (error) {
-    closeSync(fd);
+    closeSync2(fd);
     throw error;
   }
 }
@@ -7329,7 +8152,7 @@ function anchoredFileObservation(directory, name) {
   if (fd < 0)
     return null;
   try {
-    const stat = fstatSync(fd);
+    const stat = fstatSync2(fd);
     if (!stat.isFile())
       throw new ProjectContextHashRace("managed output is not a regular file");
     const relativePath = relativePosix(directory.workspaceRoot, join6(directory.path, name));
@@ -7340,11 +8163,11 @@ function anchoredFileObservation(directory, name) {
     return {
       dev: stat.dev,
       ino: stat.ino,
-      hash: createHash2("sha256").update(readFileSync(fd)).digest("hex"),
+      hash: createHash2("sha256").update(readFileSync2(fd)).digest("hex"),
       mode: stat.mode & 511
     };
   } finally {
-    closeSync(fd);
+    closeSync2(fd);
   }
 }
 function anchoredFileHash(directory, name) {
@@ -7516,8 +8339,8 @@ function acquireWorkspaceLock(workspaceRoot, lockPath, afterOpen, beforeStaleRem
   let linked = false;
   let preserveTemp = false;
   try {
-    fd = openSync(tempPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
-    const opened = fstatSync(fd);
+    fd = openSync2(tempPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+    const opened = fstatSync2(fd);
     openedIdentity = { dev: opened.dev, ino: opened.ino };
     const content = `${JSON.stringify({
       schema: "hasna.instructions.project-context-lock/v1",
@@ -7565,7 +8388,7 @@ function acquireWorkspaceLock(workspaceRoot, lockPath, afterOpen, beforeStaleRem
     }
     if (fd !== null) {
       try {
-        closeSync(fd);
+        closeSync2(fd);
       } catch {}
     }
     throw error;
@@ -7578,7 +8401,7 @@ function removeOwnedLockByInode(lockPath, identity, expectedHash) {
     const current = lstatSync(lockPath);
     if (current.isSymbolicLink() || current.dev !== identity.dev || current.ino !== identity.ino)
       return;
-    if (expectedHash !== undefined && sha2562(readFileSync(lockPath, "utf8")) !== expectedHash)
+    if (expectedHash !== undefined && sha2562(readFileSync2(lockPath, "utf8")) !== expectedHash)
       return;
     rmSync2(lockPath);
     fsyncDirectory(resolve4(lockPath, ".."));
@@ -7700,7 +8523,7 @@ function processStartIdentity(pid) {
     return null;
   if (process.platform === "linux") {
     try {
-      const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync2(`/proc/${pid}/stat`, "utf8");
       const close = stat.lastIndexOf(")");
       if (close < 0)
         return null;
@@ -7708,7 +8531,7 @@ function processStartIdentity(pid) {
       const startTicks = fields[19];
       if (!startTicks || !/^[0-9]+$/.test(startTicks))
         return null;
-      const bootId = readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
+      const bootId = readFileSync2("/proc/sys/kernel/random/boot_id", "utf8").trim();
       return /^[a-f0-9-]{36}$/i.test(bootId) ? `linux:${bootId}:${startTicks}` : null;
     } catch {
       return null;
@@ -7734,7 +8557,7 @@ function releaseWorkspaceLock(lockPath, lock, workspaceRoot) {
       removeOwnedLockByInode(lockPath, lock.identity, lock.contentHash);
     } finally {
       try {
-        closeSync(lock.fd);
+        closeSync2(lock.fd);
       } catch {}
     }
     return;
@@ -7746,8 +8569,8 @@ function releaseWorkspaceLock(lockPath, lock, workspaceRoot) {
   let releaseHash = null;
   let exchanged = false;
   try {
-    releaseFd = openSync(releasePath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
-    const opened = fstatSync(releaseFd);
+    releaseFd = openSync2(releasePath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+    const opened = fstatSync2(releaseFd);
     releaseIdentity = { dev: opened.dev, ino: opened.ino };
     const releaseContent = `${JSON.stringify({
       schema: "hasna.instructions.project-context-lock/v1",
@@ -7760,7 +8583,7 @@ function releaseWorkspaceLock(lockPath, lock, workspaceRoot) {
     releaseHash = sha2562(releaseContent);
     writeFileSync(releaseFd, releaseContent);
     fsyncSync(releaseFd);
-    closeSync(releaseFd);
+    closeSync2(releaseFd);
     releaseFd = null;
     atomicExchangePaths(releasePath, lockPath);
     exchanged = true;
@@ -7791,7 +8614,7 @@ function releaseWorkspaceLock(lockPath, lock, workspaceRoot) {
   } finally {
     if (releaseFd !== null) {
       try {
-        closeSync(releaseFd);
+        closeSync2(releaseFd);
       } catch {}
     }
     if (!exchanged && existsSync5(releasePath)) {
@@ -7800,21 +8623,21 @@ function releaseWorkspaceLock(lockPath, lock, workspaceRoot) {
       } catch {}
     }
     try {
-      closeSync(lock.fd);
+      closeSync2(lock.fd);
     } catch {}
   }
 }
 function fsyncDirectory(path) {
-  const fd = openSync(path, constants.O_RDONLY);
+  const fd = openSync2(path, constants.O_RDONLY);
   try {
     fsyncSync(fd);
   } finally {
-    closeSync(fd);
+    closeSync2(fd);
   }
 }
 function ensureSafeDirectory(path, workspaceRoot, mode) {
   const rel = relative(workspaceRoot, path);
-  if (rel === ".." || rel.startsWith("../") || isAbsolute(rel)) {
+  if (rel === ".." || rel.startsWith("../") || isAbsolute2(rel)) {
     throw new ProjectContextError("PROJECT_CONTEXT_PATH_ESCAPE", "managed directory escapes the workspace root");
   }
   const segments = rel.split(/[\\/]+/).filter(Boolean);
@@ -7946,7 +8769,7 @@ function assertCodewithTargetIsConsumed(workspaceRoot, runtime) {
   throw new ProjectContextError("PROJECT_CONTEXT_SHADOWED", ".codewith/CODEWITH.override.md shadows .codewith/CODEWITH.md");
 }
 function assertSafeWorkspaceRoot(path) {
-  if (!isAbsolute(path))
+  if (!isAbsolute2(path))
     throw new ProjectContextError("PROJECT_CONTEXT_PATH_INVALID", "workspace root must be absolute");
   const normalized = resolve4(path);
   if (normalized === parse(normalized).root)
@@ -7960,7 +8783,7 @@ function assertSafeWorkspaceRoot(path) {
 }
 function assertNoSymlinkSegments(root, target) {
   const rel = relative(root, target);
-  if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute(rel)) {
+  if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute2(rel)) {
     throw new ProjectContextError("PROJECT_CONTEXT_PATH_ESCAPE", "managed path escapes workspace root");
   }
   let current = root;
@@ -7989,7 +8812,7 @@ function readUtf8RegularFile(path, workspaceRoot, maxBytes = FOREIGN_INPUT_MAX_B
     throw new ProjectContextError("PROJECT_CONTEXT_PATH_INVALID", `managed path is not a regular file: ${path}`);
   if (stat.size > maxBytes)
     throw new ProjectContextError("PROJECT_CONTEXT_INPUT_TOO_LARGE", `managed input exceeds ${maxBytes} bytes`);
-  return readFileSync(path, "utf8");
+  return readFileSync2(path, "utf8");
 }
 function currentFileHash(path, workspaceRoot) {
   if (!existsSync5(path))
@@ -8012,7 +8835,7 @@ function fragmentMatchesBundle(path, bundle, workspaceRoot) {
 function durableSourcePath(path, workspaceRoot) {
   if (!path || path.startsWith("/dev/fd/"))
     return resolve4(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
-  const normalized = isAbsolute(path) ? resolve4(path) : resolve4(workspaceRoot, path);
+  const normalized = isAbsolute2(path) ? resolve4(path) : resolve4(workspaceRoot, path);
   if (normalized.startsWith("/dev/fd/"))
     return resolve4(workspaceRoot, ...PROJECT_CONTEXT_CACHE_PATH.split("/"));
   return normalized;
@@ -8355,7 +9178,7 @@ function compareProviderVersions(left, right) {
 
 // src/lib/asset-plan.ts
 import { createHash as createHash3 } from "crypto";
-import { isAbsolute as isAbsolute2, posix, resolve as resolve5 } from "path";
+import { isAbsolute as isAbsolute3, posix, resolve as resolve5 } from "path";
 var ASSET_PLAN_SCHEMA = "hasna.instructions.asset-plan/v1";
 var ASSET_CAPABILITY_SCHEMA = "hasna.instructions.asset-capability/v1";
 var ASSET_BUNDLE_SCHEMA = "hasna.instructions.asset-bundle/v1";
@@ -8617,7 +9440,7 @@ function resolveAssetDestination(item, roots) {
   const root = item.destination.root === "target-home" ? roots.targetHome : roots.projectRoot;
   if (!root)
     throw new Error(`Asset ${item.assetKey} requires an explicit project root.`);
-  if (!isAbsolute2(root))
+  if (!isAbsolute3(root))
     throw new Error(`Asset ${item.assetKey} destination root must be absolute.`);
   const relativePath = safeRelativePath(item.destination.relativePath);
   const target = resolve5(root, ...relativePath.split("/"));
@@ -8742,8 +9565,8 @@ function deepFreeze(value) {
 
 // src/lib/cursor-authority.ts
 import { createHash as createHash4 } from "crypto";
-import { lstatSync as lstatSync2, readFileSync as readFileSync2 } from "fs";
-import { homedir as homedir5 } from "os";
+import { lstatSync as lstatSync2, readFileSync as readFileSync3 } from "fs";
+import { homedir as homedir4 } from "os";
 import { join as join7, resolve as resolve6 } from "path";
 var CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH = ".cursor/rules/hasna-global.mdc";
 var CURSOR_GLOBAL_AUTHORITY_MAX_BYTES = 256 * 1024;
@@ -8753,8 +9576,8 @@ var CURSOR_GLOBAL_AUTHORITY_FRONTMATTER_PATTERN = /^---\n[\s\S]*?\n---(?:\n|$)/;
 function sha2564(content) {
   return createHash4("sha256").update(content).digest("hex");
 }
-function homeDir3() {
-  return process.env["HOME"] || homedir5();
+function homeDir4() {
+  return process.env["HOME"] || homedir4();
 }
 function markerPayload(content, markerLine, markerIndex) {
   const index = markerIndex ?? content.indexOf(markerLine);
@@ -8770,12 +9593,12 @@ function baseObservation(path) {
   };
 }
 function observeCursorGlobalAuthority(options = {}) {
-  const authorityPath = resolve6(join7(options.home ?? homeDir3(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
-  const readFile = options.readFile ?? ((path) => readFileSync2(path, "utf8"));
+  const authorityPath = resolve6(join7(options.home ?? homeDir4(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
+  const readFile = options.readFile ?? ((path) => readFileSync3(path, "utf8"));
   return observeCursorGlobalAuthorityPath(authorityPath, readFile);
 }
 function observeCursorGlobalAuthorityAtPath(authorityPath) {
-  return observeCursorGlobalAuthorityPath(resolve6(authorityPath), (path) => readFileSync2(path, "utf8"));
+  return observeCursorGlobalAuthorityPath(resolve6(authorityPath), (path) => readFileSync3(path, "utf8"));
 }
 function observeCursorGlobalAuthorityPath(authorityPath, readFile) {
   const base = baseObservation(authorityPath);
@@ -8920,7 +9743,7 @@ function observeCursorGlobalAuthorityPath(authorityPath, readFile) {
   };
 }
 function isCursorGlobalAuthorityPath(path) {
-  return resolve6(path) === resolve6(join7(homeDir3(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
+  return resolve6(path) === resolve6(join7(homeDir4(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
 }
 function stampCursorGlobalAuthorityMarker(content) {
   const existing = content.match(CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN);
@@ -8969,8 +9792,8 @@ function detectCursorAuthorityConflicts(observation = observeCursorGlobalAuthori
 
 // src/lib/session-authority.ts
 import { createHash as createHash5 } from "crypto";
-import { lstatSync as lstatSync3, readFileSync as readFileSync3, realpathSync, statSync as statSync2 } from "fs";
-import { homedir as homedir6 } from "os";
+import { lstatSync as lstatSync3, readFileSync as readFileSync4, realpathSync, statSync as statSync2 } from "fs";
+import { homedir as homedir5 } from "os";
 import { join as join8, resolve as resolve7 } from "path";
 var CLAUDE_LEGACY_AUTHORITY_RELATIVE_PATH = "AGENTS.md";
 var CLAUDE_LEGACY_AUTHORITY_MAX_BYTES = 256 * 1024;
@@ -8983,7 +9806,7 @@ function sha2565(content) {
   return createHash5("sha256").update(content).digest("hex");
 }
 function configHomeDir() {
-  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir6();
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir5();
 }
 function normalizeOwnedTargetPath(p) {
   const expanded = p.startsWith("~/") ? resolve7(configHomeDir(), p.slice(2)) : resolve7(p);
@@ -9036,7 +9859,7 @@ function detectClaudeAuthorityConflicts(targetHome, ownedAuthorities = []) {
       reason: `Claude target contains unmanaged AGENTS.md larger than ${CLAUDE_LEGACY_AUTHORITY_MAX_BYTES} bytes; authority cannot be classified safely.`
     }];
   }
-  const content = readFileSync3(authorityPath, "utf8");
+  const content = readFileSync4(authorityPath, "utf8");
   const owned = ownedAuthorities.find((authority) => normalizeOwnedTargetPath(authority.targetPath) === normalizeOwnedTargetPath(authorityPath));
   if (owned) {
     if (owned.content === content)
@@ -9353,7 +10176,7 @@ function yamlQuote2(value) {
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
 }
 function defaultTargetHome(tool, profile, sessionId) {
-  const home = process.env["HOME"] || homedir7();
+  const home = process.env["HOME"] || homedir6();
   return join9(home, ".hasna", "accounts", "profiles", tool, slug(profile));
 }
 function joinTarget(targetHome, relativePath) {
@@ -9929,7 +10752,7 @@ function buildOpenCodeFiles(targetHome, adapter, profile, sources, providerConfi
     ...sources.flatMap((source) => source.resolvedRules.map((rule) => rule.id))
   ]);
   const existingConfigPath = joinTarget(targetHome, adapter.configFile);
-  const selectedConfig = existsSync7(existingConfigPath) ? readOpenCodeConfig(readFileSync4(existingConfigPath, "utf8"), existingConfigPath) : providerConfig ? readOpenCodeConfig(providerConfig.content, providerConfig.sourceId) : {};
+  const selectedConfig = existsSync7(existingConfigPath) ? readOpenCodeConfig(readFileSync5(existingConfigPath, "utf8"), existingConfigPath) : providerConfig ? readOpenCodeConfig(providerConfig.content, providerConfig.sourceId) : {};
   const preservedInstructions = normalizeOpenCodeInstructions(selectedConfig["instructions"]).filter((path) => !pathIsManagedOpenCodeInstruction(path, adapter.managedDir));
   const config = {
     ...selectedConfig,
@@ -10070,7 +10893,7 @@ function buildAssetFiles(input, targetHome, blocked) {
       ...input.projectRoot ? { projectRoot: resolveSessionPath(input.projectRoot) } : {}
     });
     const relativePath = relative2(targetHome, path).replaceAll("\\", "/");
-    if (!relativePath || relativePath === ".." || relativePath.startsWith("../") || isAbsolute3(relativePath)) {
+    if (!relativePath || relativePath === ".." || relativePath.startsWith("../") || isAbsolute4(relativePath)) {
       throw new Error(`Asset ${item.assetKey} is outside the session snapshot root; use a project-scoped session plan for atomic application.`);
     }
     return {
@@ -10118,7 +10941,7 @@ function adapterFor(input) {
   return gatedNativeImports ? CODEWITH_NATIVE_ADAPTER : CODEWITH_FLATTENED_ADAPTER;
 }
 function getHomeDir() {
-  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir7();
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir6();
 }
 function cleanSessionPathInput(path) {
   const trimmed = path.trim();
@@ -10156,7 +10979,7 @@ function assertSafeRelativePath(relativePath) {
   return normalized;
 }
 function assertSafeTargetRoot(targetHome) {
-  if (!isAbsolute3(targetHome))
+  if (!isAbsolute4(targetHome))
     throw new Error(`Session render target must be an absolute path: ${targetHome}`);
   const normalized = resolve8(targetHome);
   if (normalized === parse2(normalized).root) {
@@ -10756,10 +11579,10 @@ function layerFromIdentityKind(kind, exportShape) {
 function contentFromIdentitySourcePaths(sourcePaths, exportPath, sourceId) {
   if (sourcePaths.length === 0 || !exportPath)
     return;
-  const baseDir2 = dirname4(resolveSessionPath(exportPath));
+  const baseDir = dirname4(resolveSessionPath(exportPath));
   const contents = [];
   for (const sourcePath of sourcePaths) {
-    const content = readIdentitySourcePath(sourcePath, baseDir2, sourceId);
+    const content = readIdentitySourcePath(sourcePath, baseDir, sourceId);
     if (content !== undefined)
       contents.push({ path: sourcePath.path, content });
   }
@@ -10772,8 +11595,8 @@ ${item.content.trimEnd()}`).join(`
 
 `));
 }
-function readIdentitySourcePath(sourcePath, baseDir2, sourceId) {
-  const resolvedPath = resolveIdentitySourcePath(sourcePath.path, baseDir2, sourceId);
+function readIdentitySourcePath(sourcePath, baseDir, sourceId) {
+  const resolvedPath = resolveIdentitySourcePath(sourcePath.path, baseDir, sourceId);
   if (!existsSync7(resolvedPath)) {
     if (sourcePath.required) {
       throw new Error(`Required identity instruction source path not found for ${sourceId}: ${sourcePath.path}`);
@@ -10784,28 +11607,28 @@ function readIdentitySourcePath(sourcePath, baseDir2, sourceId) {
   if (!stat.isFile()) {
     throw new Error(`Identity instruction source path is not a file for ${sourceId}: ${sourcePath.path}`);
   }
-  const realBase = realpathSync2(baseDir2);
+  const realBase = realpathSync2(baseDir);
   const realPath = realpathSync2(resolvedPath);
   if (!pathIsInside(realPath, realBase)) {
     throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${sourcePath.path}`);
   }
-  return readFileSync4(realPath, "utf-8");
+  return readFileSync5(realPath, "utf-8");
 }
-function resolveIdentitySourcePath(path, baseDir2, sourceId) {
+function resolveIdentitySourcePath(path, baseDir, sourceId) {
   const cleaned = cleanSessionPathInput(path);
   if (!cleaned)
     throw new Error(`Identity instruction source path cannot be empty for ${sourceId}.`);
   if (cleaned.includes("\\"))
     throw new Error(`Identity instruction source path must use POSIX separators for ${sourceId}: ${path}`);
-  const resolvedPath = isAbsolute3(cleaned) ? resolve8(cleaned) : resolve8(baseDir2, cleaned);
-  if (!pathIsInside(resolvedPath, resolve8(baseDir2))) {
+  const resolvedPath = isAbsolute4(cleaned) ? resolve8(cleaned) : resolve8(baseDir, cleaned);
+  if (!pathIsInside(resolvedPath, resolve8(baseDir))) {
     throw new Error(`Identity instruction source path escapes export directory for ${sourceId}: ${path}`);
   }
   return resolvedPath;
 }
-function pathIsInside(path, baseDir2) {
-  const rel = relative2(baseDir2, path);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
+function pathIsInside(path, baseDir) {
+  const rel = relative2(baseDir, path);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
 }
 function providerTargetsTool(targets, tool) {
   return targets.map((target) => target.toLowerCase()).some((target) => target === tool || target === "all" || target === "generic");
@@ -11678,63 +12501,1354 @@ function listMachines(db) {
   return d.query("SELECT * FROM machines ORDER BY last_applied_at DESC NULLS LAST").all();
 }
 
-// src/data/config-store.ts
-class CloudHttpError extends Error {
-  status;
-  body;
-  constructor(status, message, body) {
-    super(message);
-    this.status = status;
-    this.body = body;
-    this.name = "CloudHttpError";
-  }
-}
-function parseBoundedPagePayload(value, label) {
-  const page = value;
-  const consumed = Number(page?.cursor) + (page?.items?.length ?? 0);
-  const complete = Boolean(page && Number.isSafeInteger(page.total) && consumed >= Number(page.total));
-  if (!page || !Array.isArray(page.items) || !Number.isSafeInteger(page.total) || Number(page.total) < 0 || !Number.isSafeInteger(page.limit) || Number(page.limit) < 1 || !Number.isSafeInteger(page.cursor) || Number(page.cursor) < 0 || page.items.length > Number(page.limit) || typeof page.has_more !== "boolean" || typeof page.complete !== "boolean" || page.truncated !== false || page.next_cursor !== null && !Number.isSafeInteger(page.next_cursor) || page.complete !== complete || page.has_more !== !complete || page.next_cursor !== (complete ? null : consumed)) {
-    throw new CloudHttpError(502, `${label} returned an invalid or truncated bounded-read envelope`, value);
-  }
+// ../contracts/dist/client/storage.js
+import { isIP as isIP2 } from "net";
+import { spawnSync as spawnSync2 } from "child_process";
+import { closeSync as closeSync3, fstatSync as fstatSync3, openSync as openSync3, readFileSync as readFileSync6 } from "fs";
+import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";
+import { createRequire as createRequire2 } from "module";
+import { hostname as osHostname2 } from "os";
+import { isAbsolute as isAbsolute5, join as join10 } from "path";
+function envToken2(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function clientTransportEnvKeys2(name) {
+  const envSegment = envToken2(name);
   return {
-    ...page,
-    source_bounded: page.source_bounded ?? true
+    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
+    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
   };
 }
-function parseBoundedOrLegacyPage(value, legacyItems, options, label) {
-  if (value && typeof value === "object") {
-    const candidate = value;
-    if ("items" in candidate || "total" in candidate || "complete" in candidate || "truncated" in candidate || "next_cursor" in candidate) {
-      return parseBoundedPagePayload(value, label);
-    }
-  }
-  if (!Array.isArray(legacyItems)) {
-    throw new CloudHttpError(502, `${label} returned neither a bounded envelope nor a complete legacy array`, value);
-  }
-  const normalized = normalizeBoundedReadOptions(options);
-  const page = boundedReadPage(legacyItems.slice(normalized.cursor, normalized.cursor + normalized.limit), legacyItems.length, normalized);
-  return { ...page, source_bounded: false };
+function credentialOverrideEnvKey2(name) {
+  return `HASNA_${envToken2(name)}_API_KEY_OVERRIDE`;
 }
-var API_URL_ENV = "HASNA_INSTRUCTIONS_API_URL";
-var API_KEY_ENV = "HASNA_INSTRUCTIONS_API_KEY";
-function resolveCloudConfig(env = process.env) {
-  assertNoLegacyStorageMode(env);
-  const apiUrl = env[API_URL_ENV]?.trim();
-  const apiKey = env[API_KEY_ENV]?.trim();
-  if (!apiUrl && !apiKey)
-    return null;
-  if (!apiUrl || !apiKey) {
-    throw new Error(`API mode requires BOTH ${API_URL_ENV} and ${API_KEY_ENV}; only ` + `${apiUrl ? API_URL_ENV : API_KEY_ENV} is set. Set both to use the HTTP API, ` + `or unset both to use the local store.`);
-  }
-  return { apiUrl, apiKey };
+var CREDENTIAL_PROFILE_ENV_KEY2 = "HASNA_PROFILE";
+function credentialPointerEnvKey2(name) {
+  return `HASNA_${envToken2(name)}_API_KEY_REF`;
 }
-function isApiTransport(env = process.env) {
-  return resolveCloudConfig(env) !== null;
+
+class CredentialResolutionError2 extends Error {
+  appName;
+  attempted;
+  constructor(appName, message, attempted) {
+    super(message);
+    this.name = "CredentialResolutionError";
+    this.appName = appName;
+    this.attempted = attempted;
+  }
 }
 
-class LocalConfigStore {
-  db;
+class CredentialFileUnsafeError2 extends Error {
+  path;
+  constructor(path, reason) {
+    super(`Refusing unsafe credential/config file ${path}: ${reason}.`);
+    this.name = "CredentialFileUnsafeError";
+    this.path = path;
+  }
+}
+var HASNA_HOME_ENV_KEY2 = "HASNA_HOME";
+var HASNA_CONFIG_HOME_ENV_KEY2 = "HASNA_CONFIG_HOME";
+var KEYCHAIN_STATION_ENV_KEY2 = "HASNA_STATION";
+var HASNA_HOME_DIR2 = ".hasna";
+var CONFIG_SUBDIR2 = "config";
+var CREDENTIALS_FILE2 = "credentials";
+var KEYCHAIN_SECURITY_BIN2 = "/usr/bin/security";
+var KEYCHAIN_SERVICE_PREFIX2 = "hasna.credentials";
+var KEYCHAIN_ITEM_NOT_FOUND_STATUS2 = 44;
+var KEYCHAIN_SPAWN_TIMEOUT_MS2 = 1e4;
+var MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
+var SAFE_APP_SLUG2 = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+var SAFE_PROFILE2 = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+var ILLEGAL_IN_HEADER_VALUE2 = /[^\t\x20-\x7e]/;
+var VAULT_POINTER_SHAPE2 = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
+function homeDir5(env) {
+  const home = env.HOME?.trim();
+  return home ? home : null;
+}
+function absoluteOverride2(env, key) {
+  const value = env[key]?.trim();
+  return value && isAbsolute5(value) ? value : null;
+}
+function hasnaHomeDir2(env) {
+  const override = absoluteOverride2(env, HASNA_HOME_ENV_KEY2);
+  if (override)
+    return override;
+  const home = homeDir5(env);
+  return home ? join10(home, HASNA_HOME_DIR2) : null;
+}
+function appConfigDir2(name, env) {
+  const configRoot = absoluteOverride2(env, HASNA_CONFIG_HOME_ENV_KEY2);
+  if (configRoot)
+    return join10(configRoot, name);
+  const root = hasnaHomeDir2(env);
+  return root ? join10(root, name, CONFIG_SUBDIR2) : null;
+}
+function credentialDiskSourceList2(name, env, profile = null) {
+  if (!SAFE_APP_SLUG2.test(name))
+    return [];
+  const directory = appConfigDir2(name, env);
+  if (!directory)
+    return [];
+  const file = profile ? `${CREDENTIALS_FILE2}-${profile}` : CREDENTIALS_FILE2;
+  return [{ path: join10(directory, file), tier: "disk" }];
+}
+function credentialDiskSources2(name, env) {
+  return credentialDiskSourceList2(name, env, null).map((s) => s.path);
+}
+function profileDiskSources2(name, env, profile) {
+  return credentialDiskSourceList2(name, env, profile).map((s) => s.path);
+}
+function parseEnvFile2(text) {
+  const values = new Map;
+  const unusable = new Set;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#"))
+      continue;
+    const withoutExport = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
+    const equals = withoutExport.indexOf("=");
+    if (equals <= 0)
+      continue;
+    const key = withoutExport.slice(0, equals).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    let value = withoutExport.slice(equals + 1).trim();
+    const quote = value[0];
+    if (quote === '"' || quote === "'") {
+      if (value.length < 2 || !value.endsWith(quote)) {
+        unusable.add(key);
+        continue;
+      }
+      value = value.slice(1, -1);
+    }
+    if (value.trim().length === 0) {
+      unusable.add(key);
+      continue;
+    }
+    if (values.has(key) && values.get(key) !== value)
+      unusable.add(key);
+    values.set(key, value);
+  }
+  return { values, unusable };
+}
+function configFileModeAllowed2(mode) {
+  const permissions = mode & 4095;
+  return permissions === 256 || permissions === 384;
+}
+function configFileReadsCoherent2(before, after) {
+  return before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs;
+}
+function readAppConfigFile2(path) {
+  const unsafe = (reason) => {
+    throw new CredentialFileUnsafeError2(path, reason);
+  };
+  let fd = -1;
+  try {
+    fd = openSync3(path, O_RDONLY2 | O_NOFOLLOW2 | O_NONBLOCK2);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR")
+      return null;
+    if (code === "ELOOP")
+      unsafe("the path is a symlink");
+    unsafe(`the path could not be opened (${code ?? "unknown error"})`);
+  }
+  try {
+    const before = fstatSync3(fd);
+    if (!before.isFile())
+      unsafe("the path is not a regular file");
+    if (!configFileModeAllowed2(before.mode)) {
+      unsafe(`permission mode ${(before.mode & 4095).toString(8).padStart(4, "0")} is not owner-only 0400 or 0600`);
+    }
+    const uid = process.getuid?.() ?? process.geteuid?.();
+    if (uid !== undefined && before.uid !== uid)
+      unsafe("the file is not owned by the current user");
+    if (before.size > MAX_CREDENTIAL_FILE_BYTES2)
+      unsafe("the file exceeds the size limit");
+    const bytes = readFileSync6(fd);
+    const after = fstatSync3(fd);
+    if (!configFileReadsCoherent2(before, after)) {
+      unsafe("the file changed while being read");
+    }
+    return parseEnvFile2(bytes.toString("utf8"));
+  } finally {
+    if (fd !== -1)
+      closeSync3(fd);
+  }
+}
+function readCredentialFile2(path, apiKeyKeys) {
+  const parsed = readAppConfigFile2(path);
+  if (!parsed)
+    return null;
+  for (const key of apiKeyKeys) {
+    if (parsed.unusable.has(key)) {
+      throw new CredentialFileUnsafeError2(path, `${key} is declared but blank or malformed`);
+    }
+  }
+  const values = apiKeyKeys.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+  if (new Set(values).size > 1) {
+    throw new CredentialFileUnsafeError2(path, "credential aliases disagree");
+  }
+  return values[0] ?? null;
+}
+var CREDENTIAL_SHAPED_KEY2 = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
+function appConfigDiskValue2(name, env, keys) {
+  const wanted = keys.filter((key) => !CREDENTIAL_SHAPED_KEY2.test(key));
+  if (wanted.length === 0)
+    return null;
+  for (const path of credentialDiskSources2(name, env)) {
+    const parsed = readAppConfigFile2(path);
+    if (!parsed)
+      continue;
+    if (wanted.some((key) => parsed.unusable.has(key))) {
+      return { key: wanted.find((key) => parsed.unusable.has(key)), value: "", path, unusable: true };
+    }
+    const values = wanted.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+    if (new Set(values).size > 1)
+      throw new CredentialFileUnsafeError2(path, "configuration aliases disagree");
+    for (const key of wanted) {
+      if (parsed.unusable.has(key))
+        return { key, value: "", path, unusable: true };
+      const value = parsed.values.get(key)?.trim();
+      if (value)
+        return { key, value, path };
+    }
+  }
+  return null;
+}
+function assertUsableCredential2(appName, source, value) {
+  if (VAULT_POINTER_SHAPE2.test(value)) {
+    throw new CredentialResolutionError2(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey2(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
+  if (!ILLEGAL_IN_HEADER_VALUE2.test(value))
+    return;
+  throw new CredentialResolutionError2(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
+}
+var INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
+var CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
+var CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE = "caller-supplied CredentialProvider";
+function sealCredential2(fields) {
+  const { apiKey } = fields;
+  const visible = {
+    tier: fields.tier,
+    source: fields.source,
+    deliberate: fields.deliberate,
+    diskCandidates: Object.freeze([...fields.diskCandidates]),
+    warning: fields.warning
+  };
+  const sealed = { ...visible };
+  Object.defineProperty(sealed, "apiKey", {
+    value: apiKey,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  Object.defineProperty(sealed, INSPECT_CUSTOM2, {
+    value: () => ({ ...visible, apiKey: "[redacted]" }),
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, CREDENTIAL_SEAL2, {
+    value: true,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  return Object.freeze(sealed);
+}
+function isSealedCredential(credential) {
+  return credential[CREDENTIAL_SEAL2] === true;
+}
+function explicitCredential(appName, apiKey) {
+  const source = "explicit apiKey option";
+  assertUsableCredential2(appName, source, apiKey);
+  return sealCredential2({
+    apiKey,
+    tier: "argument",
+    source,
+    deliberate: true,
+    diskCandidates: [],
+    warning: null
+  });
+}
+function validateAndSealResolvedCredential(appName, credential) {
+  const apiKey = credential.apiKey;
+  assertUsableCredential2(appName, CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE, apiKey);
+  if (!isSealedCredential(credential)) {
+    return sealCredential2({
+      apiKey,
+      tier: "argument",
+      source: CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE,
+      deliberate: true,
+      diskCandidates: [],
+      warning: null
+    });
+  }
+  return sealCredential2({
+    apiKey,
+    tier: credential.tier,
+    source: credential.source,
+    deliberate: credential.deliberate,
+    diskCandidates: credential.diskCandidates,
+    warning: credential.warning,
+    ...credential.pointerVaultKey !== undefined ? { pointerVaultKey: credential.pointerVaultKey } : {}
+  });
+}
+function firstEnvValue2(env, keys) {
+  for (const key of keys) {
+    if (!Object.prototype.hasOwnProperty.call(env, key))
+      continue;
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+var AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
+function isAmbientEnvironment2(env) {
+  return env === process.env || env[AMBIENT_ENVIRONMENT2] === true;
+}
+function defaultKeychainRunner2(argv) {
+  const result = spawnSync2(KEYCHAIN_SECURITY_BIN2, [...argv], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: KEYCHAIN_SPAWN_TIMEOUT_MS2
+  });
+  return {
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.error ? result.error.message : result.stderr ?? ""
+  };
+}
+function keychainTierEnabled2(env, options) {
+  if ((options.platform ?? process.platform) !== "darwin")
+    return false;
+  if (options.enabled !== undefined)
+    return options.enabled;
+  return options.run !== undefined || isAmbientEnvironment2(env);
+}
+function keychainAccount2(env, options) {
+  const station = env[KEYCHAIN_STATION_ENV_KEY2]?.trim();
+  if (station)
+    return station;
+  const host = (options.hostname ?? osHostname2)().split(".")[0]?.trim() ?? "";
+  if (host)
+    return host;
+  const user = env.USER?.trim();
+  return user || null;
+}
+function keychainFailureHint2(text) {
+  const line = text.split(/\r?\n/).find((entry) => entry.trim().length > 0)?.trim() ?? "";
+  const clean = line.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 200);
+  return clean ? `: ${clean}` : "";
+}
+function readKeychainItem2(name, env, kind, options) {
+  if (!SAFE_APP_SLUG2.test(name) || !keychainTierEnabled2(env, options))
+    return null;
+  const account = keychainAccount2(env, options);
+  if (!account)
+    return null;
+  const service = `${KEYCHAIN_SERVICE_PREFIX2}.${name}.${kind}`;
+  const source = `keychain:${service}@${account}`;
+  const run = options.run ?? defaultKeychainRunner2;
+  let result;
+  try {
+    result = run(["find-generic-password", "-a", account, "-s", service, "-w"]);
+  } catch (error) {
+    const reason = keychainFailureHint2(error instanceof Error ? error.message : String(error));
+    throw new CredentialResolutionError2(name, `The Keychain lookup for ${source} could not run${reason}. A Keychain failure is never resolved ` + `around: fix the keychain, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  if (result.status === KEYCHAIN_ITEM_NOT_FOUND_STATUS2)
+    return null;
+  if (result.status !== 0) {
+    throw new CredentialResolutionError2(name, `The Keychain lookup for ${source} failed (security exited ` + `${result.status ?? "without a status"}${keychainFailureHint2(result.stderr)}). A Keychain item that ` + `exists but cannot be read is never resolved around: unlock the keychain, run from a session that ` + `may use it, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  const value = result.stdout.trim();
+  if (!value) {
+    throw new CredentialResolutionError2(name, `${source} exists but holds an empty value; a declared item never falls through to another ` + `identity. Store a value in it or delete the item.`, [source]);
+  }
+  return { value, source };
+}
+function keychainConfigValue2(name, env, options = {}) {
+  return readKeychainItem2(name, env, "api-url", options);
+}
+function snapshotClientEnvironment2(name, env) {
+  const keys = clientTransportEnvKeys2(name);
+  const ambient = isAmbientEnvironment2(env);
+  const snapshot = Object.create(null);
+  for (const key of [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey2(name),
+    credentialPointerEnvKey2(name),
+    CREDENTIAL_PROFILE_ENV_KEY2,
+    "HOME",
+    HASNA_HOME_ENV_KEY2,
+    HASNA_CONFIG_HOME_ENV_KEY2,
+    KEYCHAIN_STATION_ENV_KEY2,
+    "USER"
+  ]) {
+    const descriptor = Object.getOwnPropertyDescriptor(env, key);
+    if (!descriptor)
+      continue;
+    if (!("value" in descriptor)) {
+      throw new CredentialResolutionError2(name, `${key} is accessor-backed; client configuration requires own data properties.`, [key]);
+    }
+    if (descriptor.value !== undefined && typeof descriptor.value !== "string") {
+      throw new CredentialResolutionError2(name, `${key} must be a string data property.`, [key]);
+    }
+    snapshot[key] = descriptor.value;
+  }
+  if (ambient) {
+    Object.defineProperty(snapshot, AMBIENT_ENVIRONMENT2, {
+      value: true,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  return Object.freeze(snapshot);
+}
+function resolveCredential2(name, env, options = {}) {
+  env = snapshotClientEnvironment2(name, env);
+  const { apiKeyKeys } = clientTransportEnvKeys2(name);
+  const diskPaths = credentialDiskSources2(name, env);
+  if (options.apiKey !== undefined) {
+    const explicitKey = options.apiKey.trim();
+    if (!explicitKey) {
+      throw new CredentialResolutionError2(name, "The explicit apiKey argument is blank; an explicit credential never falls through to another identity.", ["explicit apiKey argument"]);
+    }
+    assertUsableCredential2(name, "the explicit apiKey argument", explicitKey);
+    return sealCredential2({
+      apiKey: explicitKey,
+      tier: "argument",
+      source: "explicit apiKey argument",
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const overrideKeyName = credentialOverrideEnvKey2(name);
+  const overrideRaw = Object.prototype.hasOwnProperty.call(env, overrideKeyName) ? env[overrideKeyName] : undefined;
+  if (overrideRaw !== undefined) {
+    const override = overrideRaw.trim();
+    if (!override) {
+      throw new CredentialResolutionError2(name, `${overrideKeyName} is set but empty. It is a deliberate override, so it is not resolved around: ` + `either give it a real key or unset it to fall back to the credential on disk.`, [overrideKeyName]);
+    }
+    assertUsableCredential2(name, overrideKeyName, override);
+    return sealCredential2({
+      apiKey: override,
+      tier: "override",
+      source: overrideKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const pointerKeyName = credentialPointerEnvKey2(name);
+  const pointerRaw = Object.prototype.hasOwnProperty.call(env, pointerKeyName) ? env[pointerKeyName] : undefined;
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError2(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE2.test(pointer)) {
+      throw new CredentialResolutionError2(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential2({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  if (options.profile !== undefined && !options.profile.trim()) {
+    throw new CredentialResolutionError2(name, "The explicit profile argument is blank; an explicit identity selection never falls through.", ["explicit profile argument"]);
+  }
+  const profileRaw = Object.prototype.hasOwnProperty.call(env, CREDENTIAL_PROFILE_ENV_KEY2) ? env[CREDENTIAL_PROFILE_ENV_KEY2] : undefined;
+  if (profileRaw !== undefined && !profileRaw.trim()) {
+    throw new CredentialResolutionError2(name, `${CREDENTIAL_PROFILE_ENV_KEY2} is set but blank.`, [CREDENTIAL_PROFILE_ENV_KEY2]);
+  }
+  const profile = options.profile?.trim() || profileRaw?.trim();
+  if (profile) {
+    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY2;
+    if (!SAFE_PROFILE2.test(profile)) {
+      throw new CredentialResolutionError2(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
+    }
+    const paths = profileDiskSources2(name, env, profile);
+    for (const path of paths) {
+      const value = readCredentialFile2(path, apiKeyKeys);
+      if (value) {
+        assertUsableCredential2(name, path, value);
+        return sealCredential2({
+          apiKey: value,
+          tier: "profile",
+          source: path,
+          deliberate: true,
+          diskCandidates: paths,
+          warning: null
+        });
+      }
+    }
+    throw new CredentialResolutionError2(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY2}.`, paths);
+  }
+  const definedEnvEntries = apiKeyKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, value: String(env[key]).trim() }));
+  const blankEnv = definedEnvEntries.find((entry) => entry.value.length === 0);
+  if (blankEnv) {
+    throw new CredentialResolutionError2(name, `${blankEnv.key} is set but blank; a declared credential never falls through to another alias or identity.`, [blankEnv.key]);
+  }
+  if (definedEnvEntries.length > 1 && new Set(definedEnvEntries.map((entry) => entry.value)).size > 1) {
+    throw new CredentialResolutionError2(name, `${definedEnvEntries.map((entry) => entry.key).join(" and ")} disagree; credential aliases must be identical or only one may be set.`, definedEnvEntries.map((entry) => entry.key));
+  }
+  const envHit = firstEnvValue2(env, apiKeyKeys);
+  const keychainHit = readKeychainItem2(name, env, "api-key", options.keychain ?? {});
+  if (keychainHit) {
+    assertUsableCredential2(name, keychainHit.source, keychainHit.value);
+    const warning = envHit && envHit.value !== keychainHit.value ? `Credential sources disagree for '${name}': ${keychainHit.source} and ${envHit.key} hold ` + `different keys. ${keychainHit.source} wins, because the Keychain is re-read on every call while ` + `an environment variable is a snapshot. Reconcile them \u2014 a rotation that updated only one leaves ` + `the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential2({
+      apiKey: keychainHit.value,
+      tier: "keychain",
+      source: keychainHit.source,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  const diskSourceList = credentialDiskSourceList2(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile2(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  if (diskHits.length > 0) {
+    const winner = diskHits[0];
+    assertUsableCredential2(name, winner.src.path, winner.value);
+    const divergentSources = [
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
+      ...envHit && envHit.value !== winner.value ? [envHit.key] : []
+    ];
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential2({
+      apiKey: winner.value,
+      tier: winner.src.tier,
+      source: winner.src.path,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  if (envHit) {
+    assertUsableCredential2(name, envHit.key, envHit.value);
+    return sealCredential2({
+      apiKey: envHit.value,
+      tier: "env",
+      source: envHit.key,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  return null;
+}
+var SECRETS_PACKAGE_SPECIFIER2 = "@hasna/" + "secrets";
+var requireSecretsSdk2 = createRequire2(import.meta.url);
+async function completePointerCredential(name, pointerResolution, env = process.env) {
+  const vaultKey = pointerResolution.pointerVaultKey;
+  const pointerEnvKey = pointerResolution.source;
+  if (!vaultKey) {
+    throw new CredentialResolutionError2(name, `Pointer resolution from ${pointerEnvKey} carries no vault item key; this is a defect in the resolver.`, [pointerEnvKey]);
+  }
+  let secretsSdk;
+  try {
+    secretsSdk = requireSecretsSdk2(SECRETS_PACKAGE_SPECIFIER2);
+  } catch {
+    throw new CredentialResolutionError2(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
+  }
+  let client;
+  try {
+    client = secretsSdk.createSecretsClientFromEnv(env);
+  } catch {
+    throw new CredentialResolutionError2(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets client could not be configured from this ` + `environment (the secrets service URL and key env are missing or invalid). A vault pointer is TERMINAL and ` + `never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  let secret;
+  try {
+    secret = await client.getSecret({ key: vaultKey });
+  } catch {
+    throw new CredentialResolutionError2(name, `${pointerEnvKey} names vault item '${vaultKey}', but the vault could not be reached or the item is ` + `unavailable. A vault pointer is TERMINAL and never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  const value = secret.value;
+  if (!value) {
+    throw new CredentialResolutionError2(name, `${pointerEnvKey} resolved vault item '${vaultKey}', but it holds no value. A vault pointer is TERMINAL.`, [pointerEnvKey]);
+  }
+  assertUsableCredential2(name, `${pointerEnvKey} -> vault:${vaultKey}`, value);
+  return sealCredential2({
+    apiKey: value,
+    tier: "pointer",
+    source: `${pointerEnvKey} -> vault:${vaultKey}`,
+    deliberate: true,
+    diskCandidates: pointerResolution.diskCandidates,
+    warning: null
+  });
+}
+var DEFAULT_FLEET_GATEWAY_ORIGIN2 = "https://api.hasna.com";
+var DEFAULT_AUTHORITY_SOURCE2 = "default";
+function defaultFleetGatewayBaseUrl2(name) {
+  return `${DEFAULT_FLEET_GATEWAY_ORIGIN2}/${validateAppSlug2(name)}`;
+}
+var ASCII_CONTROL_PATTERN2 = /[\u0000-\u001f\u007f]/;
+var DNS_LABEL_PATTERN2 = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+function isValidDnsDomain2(value) {
+  if (value.length === 0 || value.length > 253 || ASCII_CONTROL_PATTERN2.test(value) || /[^\x00-\x7f]/.test(value)) {
+    return false;
+  }
+  return value.split(".").every((label) => label.length <= 63 && !label.startsWith("xn--") && DNS_LABEL_PATTERN2.test(label));
+}
+function validateAppSlug2(name) {
+  if (name.length > 63 || !DNS_LABEL_PATTERN2.test(name)) {
+    throw new Error("App name must be one lowercase DNS label.");
+  }
+  return name;
+}
+function rawAuthority2(value) {
+  const match = /^[a-z][a-z0-9+.-]*:\/\//i.exec(value);
+  if (!match)
+    throw new Error("API URL must be absolute.");
+  const afterScheme = value.slice(match[0].length);
+  const boundary = afterScheme.search(/[/?#]/);
+  const authority = boundary === -1 ? afterScheme : afterScheme.slice(0, boundary);
+  if (!authority)
+    throw new Error("API URL must include a hostname.");
+  return authority;
+}
+function assertCanonicalPort2(port) {
+  if (!/^[0-9]+$/.test(port) || port.length > 1 && port.startsWith("0")) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
+  }
+  const numericPort = Number(port);
+  if (!Number.isSafeInteger(numericPort) || numericPort < 1 || numericPort > 65535) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
+  }
+}
+function canonicalAuthorityHostname2(authority) {
+  let rawHostname;
+  if (authority.startsWith("[")) {
+    const closingBracket = authority.indexOf("]");
+    if (closingBracket === -1) {
+      throw new Error("API URL authority must contain a canonical hostname.");
+    }
+    rawHostname = authority.slice(0, closingBracket + 1);
+    const portSuffix = authority.slice(closingBracket + 1);
+    if (portSuffix) {
+      if (!portSuffix.startsWith(":")) {
+        throw new Error("API URL authority must contain a canonical hostname and port.");
+      }
+      assertCanonicalPort2(portSuffix.slice(1));
+    }
+    if (isIP2(rawHostname.slice(1, -1)) !== 6) {
+      throw new Error("API URL authority must contain a canonical IPv6 literal.");
+    }
+  } else {
+    const firstColon = authority.indexOf(":");
+    const lastColon = authority.lastIndexOf(":");
+    if (firstColon !== lastColon) {
+      throw new Error("IPv6 API URL authorities must use brackets.");
+    }
+    if (lastColon !== -1) {
+      const port = authority.slice(lastColon + 1);
+      assertCanonicalPort2(port);
+      rawHostname = authority.slice(0, lastColon);
+    } else {
+      rawHostname = authority;
+    }
+    const ipVersion = isIP2(rawHostname);
+    const numericAddressParts = rawHostname.split(".");
+    const looksLikeNonCanonicalIpv4 = numericAddressParts.every((part) => /^(?:0x[0-9a-f]+|[0-9]+)$/i.test(part));
+    if (ipVersion !== 4 && looksLikeNonCanonicalIpv4 || ipVersion !== 4 && !isValidDnsDomain2(rawHostname.toLowerCase())) {
+      throw new Error("API URL authority must contain a canonical ASCII hostname.");
+    }
+  }
+  return rawHostname.toLowerCase();
+}
+function isDeliberateLoopbackHttpAuthority2(authority) {
+  return /^(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?$/i.test(authority);
+}
+function toV1BaseUrl2(apiUrl) {
+  if (ASCII_CONTROL_PATTERN2.test(apiUrl)) {
+    throw new Error("API URL must not contain ASCII control characters.");
+  }
+  const input = apiUrl.trim();
+  const authority = rawAuthority2(input);
+  if (authority.includes("@") || authority.includes("\\") || authority.includes("%") || /[^\x00-\x7f]/.test(authority)) {
+    throw new Error("API URL authority must be canonical ASCII without credentials.");
+  }
+  const canonicalHostname = canonicalAuthorityHostname2(authority);
+  const url = new URL(input);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("API URL must use http or https.");
+  }
+  if (url.username || url.password) {
+    throw new Error("API URL must not include credentials.");
+  }
+  if (!url.hostname || url.hostname.endsWith(".")) {
+    throw new Error("API URL must include a canonical hostname.");
+  }
+  if (url.hostname.toLowerCase() !== canonicalHostname) {
+    throw new Error("API URL authority must not rely on parser hostname normalization.");
+  }
+  if (url.hostname.split(".").some((label) => label.toLowerCase().startsWith("xn--"))) {
+    throw new Error("API URL must not use IDN or punycode hostnames.");
+  }
+  if (url.protocol === "http:" && !isDeliberateLoopbackHttpAuthority2(authority)) {
+    throw new Error("API URL may use http only for an exact loopback authority.");
+  }
+  if (url.search || url.hash) {
+    throw new Error("API URL must not include a query string or fragment.");
+  }
+  let path = url.pathname.replace(/\/+$/, "");
+  if (path.endsWith("/v1"))
+    path = path.slice(0, -"/v1".length);
+  url.pathname = `${path}/v1`;
+  return url.toString().replace(/\/+$/, "");
+}
+class ClientTransportConfigurationError2 extends Error {
+  appName;
+  sources;
+  constructor(appName, message, sources = []) {
+    super(message);
+    this.name = "ClientTransportConfigurationError";
+    this.appName = appName;
+    this.sources = Object.freeze([...sources]);
+  }
+}
+function resolveClientTransportSnapshot2(name, env = process.env, options = {}) {
+  env = snapshotClientEnvironment2(name, env);
+  const keys = clientTransportEnvKeys2(name);
+  const definedUrlEntries = keys.apiUrlKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, raw: String(env[key]) }));
+  const blankUrl = definedUrlEntries.find((entry) => entry.raw.trim().length === 0);
+  if (blankUrl) {
+    throw new ClientTransportConfigurationError2(name, `${blankUrl.key} is set but blank; public clients require an explicit HTTPS API URL and never select local storage.`, [blankUrl.key]);
+  }
+  const controlledUrl = definedUrlEntries.find((entry) => ASCII_CONTROL_PATTERN2.test(entry.raw));
+  if (controlledUrl) {
+    throw new ClientTransportConfigurationError2(name, `${controlledUrl.key} contains ASCII control characters.`, [controlledUrl.key]);
+  }
+  const usableUrlEntries = definedUrlEntries.map((entry) => ({ key: entry.key, value: entry.raw.trim() }));
+  if (usableUrlEntries.length > 1 && new Set(usableUrlEntries.map((entry) => entry.value)).size > 1) {
+    throw new ClientTransportConfigurationError2(name, `${usableUrlEntries.map((entry) => entry.key).join(" and ")} disagree; client authority aliases must be identical or only one may be set.`, usableUrlEntries.map((entry) => entry.key));
+  }
+  const envUrlHit = usableUrlEntries[0] ?? null;
+  const keychainUrlHit = keychainConfigValue2(name, env, options.credentials?.keychain);
+  const diskConfigUrlHit = appConfigDiskValue2(name, env, keys.apiUrlKeys);
+  if (diskConfigUrlHit?.unusable) {
+    throw new ClientTransportConfigurationError2(name, `${diskConfigUrlHit.key} in ${diskConfigUrlHit.path} is declared but blank or malformed; public clients require a valid HTTPS service authority.`, [diskConfigUrlHit.path]);
+  }
+  const urlCandidates = [
+    ...envUrlHit ? [envUrlHit] : [],
+    ...keychainUrlHit ? [{ key: keychainUrlHit.source, value: keychainUrlHit.value }] : [],
+    ...diskConfigUrlHit ? [{ key: diskConfigUrlHit.path, value: diskConfigUrlHit.value.trim() }] : []
+  ];
+  const configuredUrl = urlCandidates[0] ?? null;
+  const divergentUrls = urlCandidates.filter((candidate) => candidate.value !== configuredUrl?.value);
+  if (configuredUrl && divergentUrls.length > 0) {
+    throw new ClientTransportConfigurationError2(name, `${configuredUrl.key} and ${divergentUrls.map((candidate) => candidate.key).join(" and ")} select different service authorities; refusing to send a credential written for one authority to the other.`, urlCandidates.map((candidate) => candidate.key));
+  }
+  const warnings = [];
+  if (configuredUrl && !envUrlHit) {
+    warnings.push(`No ${keys.apiUrlKeys[0]} in the environment; the server URL in ${configuredUrl.key} was used, so this client connects to the server. ` + `Keep that entry aligned with the intended service authority.`);
+  }
+  const credential = resolveCredential2(name, env, options.credentials);
+  if (!credential) {
+    const diskHint = credentialDiskSourcesForMessage2(name, env);
+    const lead = configuredUrl ? `${configuredUrl.key} selects the HTTP server for '${name}', but no API key could be resolved` : `${keys.apiUrlKeys[0]} is not set and no API key could be resolved for '${name}'; a credential is required before the default fleet gateway authority applies`;
+    warnings.push(`${lead}; refusing to create an unauthenticated client \u2014 public clients never fall back to SQLite or another local store. ` + `Looked in the Keychain (macOS only), then for a credential file at ${diskHint}, then for ${keys.apiKeyKeys[0]} in the environment.`);
+    throw new ClientTransportConfigurationError2(name, warnings.join(" "), [configuredUrl?.key ?? keys.apiUrlKeys[0]]);
+  }
+  if (credential.warning)
+    warnings.push(credential.warning);
+  let urlHit;
+  if (configuredUrl) {
+    urlHit = configuredUrl;
+  } else {
+    try {
+      urlHit = { key: DEFAULT_AUTHORITY_SOURCE2, value: defaultFleetGatewayBaseUrl2(name) };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new ClientTransportConfigurationError2(name, `No ${keys.apiUrlKeys[0]} is configured and the default fleet gateway authority cannot be composed for '${name}': ${message}`, [keys.apiUrlKeys[0]]);
+    }
+  }
+  const apiUrlSource = urlHit.key;
+  let baseUrl;
+  try {
+    baseUrl = toV1BaseUrl2(urlHit.value);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new ClientTransportConfigurationError2(name, `Invalid API URL from ${apiUrlSource}: ${message}`, [apiUrlSource]);
+  }
+  return {
+    resolution: {
+      transport: "http",
+      transportSource: urlHit.key,
+      baseUrl,
+      apiUrlSource,
+      apiKeyPresent: true,
+      apiKeySource: credential.source,
+      apiKeyTier: credential.tier,
+      misconfigured: false,
+      warning: warnings.length > 0 ? warnings.join(" ") : null
+    },
+    credential
+  };
+}
+function credentialDiskSourcesForMessage2(name, env) {
+  const paths = credentialDiskSources2(name, env);
+  return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
+}
+
+class HasnaHttpError extends Error {
+  status;
+  method;
+  path;
+  credentialSource;
+  credentialTier;
+  constructor(method, path, status, body, credential) {
+    const guidance = credential ? `. ${credential.guidance}` : "";
+    super(`Hasna cloud request failed: ${method} ${path} -> ${status}${guidance}`);
+    this.name = "HasnaHttpError";
+    this.status = status;
+    this.method = method;
+    this.path = path;
+    Object.defineProperty(this, "body", {
+      value: body,
+      enumerable: status !== 401 && status !== 403,
+      writable: false,
+      configurable: false
+    });
+    this.credentialSource = credential?.source ?? null;
+    this.credentialTier = credential?.tier ?? null;
+  }
+}
+function currentCredential(name, apiKey) {
+  if (typeof apiKey === "function") {
+    return validateAndSealResolvedCredential(name, apiKey());
+  }
+  return explicitCredential(name, apiKey);
+}
+async function resolveRequestCredential(name, apiKey, env = process.env) {
+  const resolved = currentCredential(name, apiKey);
+  if (resolved.tier === "pointer") {
+    return completePointerCredential(name, resolved, env);
+  }
+  return resolved;
+}
+function authFailureGuidance(credential) {
+  const origin = `The API key for this request came from ${credential.source}`;
+  if (credential.deliberate) {
+    const remedy = credential.source === CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE ? `Fix that provider so it returns the current key, or replace it with resolveCredential() ` + `so diagnostics can name the original source.` : `Rotate that key, or unset the override to use the credential on disk.`;
+    return `${origin} \u2014 a credential you selected deliberately. It was NOT substituted with any other key: ` + `falling back here would authenticate as a different principal than the one you named, which is ` + `exactly the failure an override exists to prevent. ${remedy}`;
+  }
+  if (credential.tier === "env") {
+    const target = credential.diskCandidates[0];
+    const remedy = target ? `Store the CURRENT key in the Keychain or write it to ${target} \u2014 both are re-read on every call, so ` + `rotations take effect immediately and in every shell. Do not simply unset ${credential.source}: ` + `nothing was found in the Keychain or on disk, so that would leave this client with no credential at all.` : `This environment has no HOME or HASNA_HOME, so no credential file could be consulted; the disk tier is ` + `unavailable here and there is nothing to fall back to. Set HOME, or supply the key explicitly.`;
+    return `${origin}, a variable in this process's environment. If a wrapper injected it for this one process, the ` + `wrapper re-reads its store on every invocation and the stored key itself is being rejected \u2014 rotate it. ` + `If this SHELL exported it, the export is a snapshot taken when the shell started: a STALE SHELL that ` + `exported the key before it was rotated keeps sending the old one until it exits. ${remedy}`;
+  }
+  if (credential.tier === "keychain") {
+    return `${origin}, which was re-read from the Keychain on this very call \u2014 so a stale shell is NOT the cause ` + `here. The stored item is genuinely being rejected: update it with the current key, or re-run the fleet ` + `key distribution so this machine gets the current key.`;
+  }
+  return `${origin}, which was re-read from disk on this very call \u2014 so a stale shell is NOT the cause here. ` + `The stored credential is genuinely being rejected: rotate it, or re-run the fleet key distribution ` + `so this machine gets the current key.`;
+}
+var DEFAULT_RETRY_STATUSES = [408, 425, 429, 500, 502, 503, 504];
+var IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+var AUTHORITY_OVERRIDE_HEADERS2 = new Set([
+  "host",
+  ":authority",
+  "forwarded",
+  "x-forwarded-host",
+  "x-original-host"
+]);
+function assertNoAuthorityOverrideHeaders(headers, source) {
+  if (!headers)
+    return;
+  const forbidden = Object.keys(headers).find((name) => AUTHORITY_OVERRIDE_HEADERS2.has(name.trim().toLowerCase()));
+  if (forbidden) {
+    throw new Error(`Authenticated ${source} headers must not set authority header '${forbidden}'.`);
+  }
+}
+function appendQuery(path, query) {
+  if (!query)
+    return path;
+  const params = query instanceof URLSearchParams ? query : new URLSearchParams;
+  if (!(query instanceof URLSearchParams)) {
+    for (const [key, value] of Object.entries(query)) {
+      if (value === null || value === undefined)
+        continue;
+      if (Array.isArray(value)) {
+        for (const v of value)
+          params.append(key, String(v));
+      } else {
+        params.append(key, String(value));
+      }
+    }
+  }
+  const qs = params.toString();
+  if (!qs)
+    return path;
+  return `${path}${path.includes("?") ? "&" : "?"}${qs}`;
+}
+var defaultSleep = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
+function createHasnaHttpTransportInternal(options, requestBindingProvider) {
+  const fetchImpl = options.fetchImpl ?? ((input, init) => fetch(input, init));
+  const base = toV1BaseUrl2(options.baseUrl);
+  const timeoutMs = options.timeoutMs ?? 30000;
+  const sleep = options.sleepImpl ?? defaultSleep;
+  const defaultRetry = options.retry;
+  function resolveRetry(callRetry) {
+    const chosen = callRetry !== undefined ? callRetry : defaultRetry;
+    if (chosen === false)
+      return null;
+    const r = chosen ?? {};
+    return {
+      retries: r.retries ?? 2,
+      baseDelayMs: r.baseDelayMs ?? 200,
+      maxDelayMs: r.maxDelayMs ?? 2000,
+      retryStatuses: r.retryStatuses ?? [...DEFAULT_RETRY_STATUSES]
+    };
+  }
+  async function once(method, rel, url, body, opts, credential) {
+    assertNoAuthorityOverrideHeaders(options.headers, "transport");
+    assertNoAuthorityOverrideHeaders(opts.headers, "request");
+    const headers = {
+      "x-api-key": credential.apiKey,
+      Authorization: `Bearer ${credential.apiKey}`,
+      Accept: "application/json",
+      ...options.headers ?? {},
+      ...opts.headers ?? {}
+    };
+    if (opts.idempotencyKey)
+      headers["Idempotency-Key"] = opts.idempotencyKey;
+    const init = {
+      method,
+      headers,
+      redirect: "manual"
+    };
+    if (body !== undefined) {
+      headers["Content-Type"] = "application/json";
+      init.body = JSON.stringify(body);
+    }
+    const controller = new AbortController;
+    const onAbort = () => controller.abort();
+    if (opts.signal) {
+      if (opts.signal.aborted)
+        controller.abort();
+      else
+        opts.signal.addEventListener("abort", onAbort, { once: true });
+    }
+    const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? timeoutMs);
+    init.signal = controller.signal;
+    let response;
+    try {
+      response = await fetchImpl(url, init);
+    } catch (error) {
+      const err = error instanceof Error ? error : new Error(String(error));
+      if (opts.signal?.aborted)
+        return { ok: false, retryable: false, error: err };
+      return { ok: false, retryable: true, error: err };
+    } finally {
+      clearTimeout(timer);
+      if (opts.signal)
+        opts.signal.removeEventListener("abort", onAbort);
+    }
+    const authenticationFailure = response.status === 401 || response.status === 403;
+    let parsed = undefined;
+    if (authenticationFailure) {
+      try {
+        await response.body?.cancel();
+      } catch {}
+    } else {
+      const text = await response.text();
+      if (text.length > 0) {
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          parsed = text;
+        }
+      }
+    }
+    if (!response.ok) {
+      if (response.status >= 300 && response.status < 400) {
+        return {
+          ok: false,
+          retryable: false,
+          error: new HasnaHttpError(method, rel, response.status, parsed)
+        };
+      }
+      if (authenticationFailure) {
+        return {
+          ok: false,
+          retryable: false,
+          error: new HasnaHttpError(method, rel, response.status, undefined, {
+            source: credential.source,
+            tier: credential.tier,
+            guidance: authFailureGuidance(credential)
+          })
+        };
+      }
+      const retry = resolveRetry(opts.retry);
+      const retryable = retry ? retry.retryStatuses.includes(response.status) : false;
+      return { ok: false, retryable, error: new HasnaHttpError(method, rel, response.status, parsed) };
+    }
+    return { ok: true, value: parsed };
+  }
+  async function request(method, path, body, opts = {}) {
+    const upper = method.toUpperCase();
+    const rel = appendQuery(path.startsWith("/") ? path : `/${path}`, opts.query);
+    const retry = resolveRetry(opts.retry);
+    const methodRetryable = IDEMPOTENT_METHODS2.has(upper) || Boolean(opts.idempotencyKey);
+    const maxAttempts = retry && methodRetryable ? retry.retries + 1 : 1;
+    const binding = requestBindingProvider ? await requestBindingProvider() : {
+      baseUrl: base,
+      credential: await resolveRequestCredential(options.name, options.apiKey)
+    };
+    const url = `${binding.baseUrl}${rel}`;
+    const credential = binding.credential;
+    let last = null;
+    for (let attempt = 1;attempt <= maxAttempts; attempt++) {
+      const result = await once(upper, rel, url, body, opts, credential);
+      if (result.ok)
+        return result.value;
+      last = result;
+      const canRetry = retry !== null && methodRetryable && result.retryable && attempt < maxAttempts;
+      if (!canRetry)
+        break;
+      const backoff = Math.min(retry.maxDelayMs, retry.baseDelayMs * 2 ** (attempt - 1));
+      const jitter = Math.floor(Math.random() * (backoff / 2 + 1));
+      await sleep(backoff + jitter);
+    }
+    throw last.error;
+  }
+  return {
+    baseUrl: base,
+    request,
+    get: (path, opts) => request("GET", path, undefined, opts),
+    post: (path, body, opts) => request("POST", path, body, opts),
+    put: (path, body, opts) => request("PUT", path, body, opts),
+    patch: (path, body, opts) => request("PATCH", path, body, opts),
+    del: (path, body, opts) => request("DELETE", path, body, opts)
+  };
+}
+function createClientTransport(name, env = process.env, overrides) {
+  const credentialOptions = overrides?.credentials;
+  const snapshotOptions = { ...credentialOptions ? { credentials: credentialOptions } : {} };
+  const resolution = resolveClientTransportSnapshot2(name, env, snapshotOptions).resolution;
+  const sameBinding = (left, right) => left.resolution.baseUrl === right.resolution.baseUrl && left.credential.apiKey === right.credential.apiKey && left.credential.pointerVaultKey === right.credential.pointerVaultKey && left.credential.source === right.credential.source && left.credential.tier === right.credential.tier;
+  const unstableConfiguration = () => new ClientTransportConfigurationError2(name, "The configured service authority or credential changed while a request was being prepared; no authenticated request was sent.");
+  const requestBindingProvider = async () => {
+    const first = resolveClientTransportSnapshot2(name, env, snapshotOptions);
+    const reviewed = resolveClientTransportSnapshot2(name, env, snapshotOptions);
+    if (!sameBinding(first, reviewed))
+      throw unstableConfiguration();
+    if (reviewed.resolution.baseUrl !== resolution.baseUrl) {
+      throw new ClientTransportConfigurationError2(name, "The configured service authority changed; rebuild the client before sending credentials.");
+    }
+    const credential = await resolveRequestCredential(name, () => reviewed.credential, env);
+    const immediatelyBeforeDispatch = resolveClientTransportSnapshot2(name, env, snapshotOptions);
+    if (!sameBinding(reviewed, immediatelyBeforeDispatch))
+      throw unstableConfiguration();
+    if (immediatelyBeforeDispatch.resolution.baseUrl !== resolution.baseUrl) {
+      throw new ClientTransportConfigurationError2(name, "The configured service authority changed; rebuild the client before sending credentials.");
+    }
+    return { baseUrl: immediatelyBeforeDispatch.resolution.baseUrl, credential };
+  };
+  return {
+    transport: "http",
+    client: createHasnaHttpTransportInternal({
+      name,
+      baseUrl: resolution.baseUrl,
+      apiKey: () => {
+        throw new Error("The authenticated request binding provider was not invoked.");
+      },
+      ...overrides?.fetchImpl ? { fetchImpl: overrides.fetchImpl } : {},
+      ...overrides?.headers ? { headers: overrides.headers } : {},
+      ...overrides?.timeoutMs ? { timeoutMs: overrides.timeoutMs } : {},
+      ...overrides?.retry !== undefined ? { retry: overrides.retry } : {},
+      ...overrides?.sleepImpl ? { sleepImpl: overrides.sleepImpl } : {}
+    }, requestBindingProvider),
+    resolution
+  };
+}
+function resourcePath(resource) {
+  const trimmed = resource.replace(/^\/+|\/+$/g, "");
+  if (!trimmed)
+    throw new Error("resource must be a non-empty path segment");
+  return `/${trimmed}`;
+}
+function entityPath(resource, id) {
+  if (id === undefined || id === null || `${id}`.length === 0) {
+    throw new Error("id must be a non-empty string");
+  }
+  return `${resourcePath(resource)}/${encodeURIComponent(String(id))}`;
+}
+function newIdempotencyKey() {
+  const g = globalThis;
+  if (g.crypto?.randomUUID)
+    return g.crypto.randomUUID();
+  return `idmp_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 12)}`;
+}
+function extractItems(raw) {
+  if (Array.isArray(raw))
+    return raw;
+  if (raw && typeof raw === "object") {
+    const obj = raw;
+    for (const key of ["items", "data", "results", "rows", "records"]) {
+      if (Array.isArray(obj[key]))
+        return obj[key];
+    }
+  }
+  return [];
+}
+function extractTotal(raw) {
+  if (raw && typeof raw === "object") {
+    const obj = raw;
+    for (const key of ["total", "count", "totalCount", "total_count"]) {
+      if (typeof obj[key] === "number")
+        return obj[key];
+    }
+  }
+  return null;
+}
+function extractCursor(raw) {
+  if (raw && typeof raw === "object") {
+    const obj = raw;
+    for (const key of ["cursor", "nextCursor", "next_cursor", "next"]) {
+      if (typeof obj[key] === "string")
+        return obj[key];
+    }
+  }
+  return null;
+}
+function isNotFoundHttpError(error) {
+  return typeof error === "object" && error !== null && error.name === "HasnaHttpError" && error.status === 404;
+}
+function createHasnaStorageClient(name, transport) {
+  return {
+    name,
+    baseUrl: transport.baseUrl,
+    transport,
+    async list(resource, options = {}) {
+      const raw = await transport.get(resourcePath(resource), options);
+      return {
+        items: extractItems(raw),
+        total: extractTotal(raw),
+        cursor: extractCursor(raw),
+        raw
+      };
+    },
+    async get(resource, id, options = {}) {
+      try {
+        return await transport.get(entityPath(resource, id), options);
+      } catch (error) {
+        if (isNotFoundHttpError(error))
+          return null;
+        throw error;
+      }
+    },
+    async create(resource, body, options = {}) {
+      const { idempotencyKey, ...rest } = options;
+      return transport.post(resourcePath(resource), body, {
+        ...rest,
+        idempotencyKey: idempotencyKey ?? newIdempotencyKey()
+      });
+    },
+    async update(resource, id, patch, options = {}) {
+      const { method = "PATCH", idempotencyKey, ...rest } = options;
+      const call = method === "PUT" ? transport.put : transport.patch;
+      return call(entityPath(resource, id), patch, { ...rest, ...idempotencyKey ? { idempotencyKey } : {} });
+    },
+    async delete(resource, id, options = {}) {
+      try {
+        await transport.del(entityPath(resource, id), undefined, options);
+      } catch (error) {
+        if (isNotFoundHttpError(error))
+          return;
+        throw error;
+      }
+    }
+  };
+}
+function resolveStorageClient(name, env = process.env, overrides) {
+  const wired = createClientTransport(name, env, overrides);
+  return { transport: "http", client: createHasnaStorageClient(name, wired.client) };
+}
+
+// src/lib/transport-resolver.ts
+var INSTRUCTIONS_APP = "instructions";
+var INSTRUCTIONS_LOCAL_OPT_IN_ENV = INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS[0];
+function rethrowInstructionsAuthorityFailure(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const name = error instanceof Error ? error.name : "";
+  const failure = (code, lead) => {
+    throw new Error(`${code}: ${lead} ${message} There is no local fallback: local SQLite is opt-in only ` + `(${INSTRUCTIONS_LOCAL_OPT_IN_ENV}=1) and is disabled by default \u2014 failing closed`, { cause: error });
+  };
+  if (name === "CredentialResolutionError" || name === "CredentialFileUnsafeError") {
+    return failure("REMOTE_API_CREDENTIAL_INVALID", "The configured Instructions credential could not be used.");
+  }
+  if (/no API key could be resolved/.test(message)) {
+    if (/is not set and no API key could be resolved/.test(message)) {
+      return failure("REMOTE_API_CONFIG_MISSING", "no Instructions credential resolved from the Keychain item " + "hasna.credentials.instructions.api-key, ~/.hasna/instructions/config/credentials, " + `or ${clientTransportEnvKeys(INSTRUCTIONS_APP).apiKeyKeys[0]}.`);
+    }
+    return failure("REMOTE_API_KEY_MISSING", "an Instructions authority is configured but no API key resolved \u2014 looked in " + "hasna.credentials.instructions.api-key, ~/.hasna/instructions/config/credentials, " + `and ${clientTransportEnvKeys(INSTRUCTIONS_APP).apiKeyKeys[0]}.`);
+  }
+  return failure("REMOTE_API_URL_INVALID", "the configured Instructions authority is invalid.");
+}
+function resolveInstructionsClientTransport(env = process.env, options = {}) {
+  const inputs = instructionsResolverInputs(env, options.credentials);
+  try {
+    return resolveClientTransport(INSTRUCTIONS_APP, inputs.env, {
+      credentials: inputs.credentials
+    });
+  } catch (error) {
+    rethrowInstructionsAuthorityFailure(error);
+  }
+}
+function resolveInstructionsStorageClient(env = process.env, options = {}) {
+  const inputs = instructionsResolverInputs(env, options.credentials);
+  try {
+    return resolveStorageClient(INSTRUCTIONS_APP, inputs.env, {
+      fetchImpl: (input, init) => fetch(input, { ...init, redirect: "manual" }),
+      credentials: inputs.credentials
+    });
+  } catch (error) {
+    rethrowInstructionsAuthorityFailure(error);
+  }
+}
+function getInstructionsTransportStatus(env = process.env, options = {}) {
+  if (selectsInstructionsLocalStore(env)) {
+    return {
+      selected: false,
+      ok: true,
+      transport: "local",
+      api_url_configured: false,
+      api_key_configured: false,
+      api_url_source: null,
+      api_key_source: null,
+      api_key_tier: null,
+      v1_base_url: null,
+      issues: [],
+      local_fallback: false
+    };
+  }
+  try {
+    const resolution = resolveInstructionsClientTransport(env, options);
+    return {
+      selected: true,
+      ok: true,
+      transport: "http",
+      api_url_configured: resolution.apiUrlSource !== null && resolution.apiUrlSource !== "default",
+      api_key_configured: resolution.apiKeyPresent,
+      api_url_source: resolution.apiUrlSource,
+      api_key_source: resolution.apiKeySource,
+      api_key_tier: resolution.apiKeyTier,
+      v1_base_url: resolution.baseUrl,
+      issues: [],
+      local_fallback: false
+    };
+  } catch (error) {
+    const issue = error instanceof Error ? error.message : String(error);
+    const keys = clientTransportEnvKeys(INSTRUCTIONS_APP);
+    const declared = (names) => names.some((key) => (env[key] ?? "").trim() !== "");
+    return {
+      selected: true,
+      ok: false,
+      transport: "invalid",
+      api_url_configured: declared(keys.apiUrlKeys),
+      api_key_configured: declared(keys.apiKeyKeys),
+      api_url_source: null,
+      api_key_source: null,
+      api_key_tier: null,
+      v1_base_url: null,
+      issues: [issue],
+      local_fallback: false
+    };
+  }
+}
+var localNoticePrinted = false;
+function announceLocalInstructionsMode(write = (line) => process.stderr.write(`${line}
+`)) {
+  if (localNoticePrinted)
+    return false;
+  localNoticePrinted = true;
+  write(instructionsLocalModeNotice());
+  return true;
+}
+
+// src/data/config-store.ts
+function parseBoundedPagePayload(value, label) {
+  const page = value;
+  const consumed = Number(page?.cursor) + (page?.items?.length ?? 0);
+  const complete = Boolean(page && Number.isSafeInteger(page.total) && consumed >= Number(page.total));
+  if (!page || !Array.isArray(page.items) || !Number.isSafeInteger(page.total) || Number(page.total) < 0 || !Number.isSafeInteger(page.limit) || Number(page.limit) < 1 || !Number.isSafeInteger(page.cursor) || Number(page.cursor) < 0 || page.items.length > Number(page.limit) || typeof page.has_more !== "boolean" || typeof page.complete !== "boolean" || page.truncated !== false || page.next_cursor !== null && !Number.isSafeInteger(page.next_cursor) || page.complete !== complete || page.has_more !== !complete || page.next_cursor !== (complete ? null : consumed)) {
+    throw new Error(`${label} returned an invalid or truncated bounded-read envelope`);
+  }
+  return {
+    ...page,
+    source_bounded: page.source_bounded ?? true
+  };
+}
+function parseBoundedOrLegacyPage(value, legacyItems, options, label) {
+  if (value && typeof value === "object") {
+    const candidate = value;
+    if ("items" in candidate || "total" in candidate || "complete" in candidate || "truncated" in candidate || "next_cursor" in candidate) {
+      return parseBoundedPagePayload(value, label);
+    }
+  }
+  if (!Array.isArray(legacyItems)) {
+    throw new Error(`${label} returned neither a bounded envelope nor a complete legacy array`);
+  }
+  const normalized = normalizeBoundedReadOptions(options);
+  const page = boundedReadPage(legacyItems.slice(normalized.cursor, normalized.cursor + normalized.limit), legacyItems.length, normalized);
+  return { ...page, source_bounded: false };
+}
+var LOCAL_OPT_IN_ENV = INSTRUCTIONS_LOCAL_OPT_IN_ENV;
+function isLocalOptIn(env = process.env) {
+  return isInstructionsLocalOptIn(env);
+}
+function isApiTransport(env = process.env) {
+  const { transport } = resolveInstructionsStorageClient(env);
+  return transport === "http";
+}
+function isCloudAuthError(err) {
+  return typeof err === "object" && err !== null && err.name === "HasnaHttpError" && (err.status === 401 || err.status === 403);
+}
+function isNotFoundHttpError2(err) {
+  return typeof err === "object" && err !== null && err.name === "HasnaHttpError" && err.status === 404;
+}
+function formatCliError(err, env = process.env) {
+  if (isCloudAuthError(err)) {
+    return [
+      `Instructions cloud API rejected the request (HTTP ${err.status}: authentication failed).`,
+      `  The API key in use is missing, expired, or revoked (the transport never echoes the server's 401/403 body).`,
+      `  To continue, either:`,
+      `    - set a valid key:   export HASNA_INSTRUCTIONS_API_KEY=<new-key>`,
+      `      (or add the Keychain item hasna.credentials.instructions.api-key, or write`,
+      `       ~/.hasna/instructions/config/credentials)`,
+      `    - or opt in to the local store explicitly:   export ${LOCAL_OPT_IN_ENV}=1`
+    ].join(`
+`);
+  }
+  return err instanceof Error ? err.message : String(err);
+}
+
+class LocalConfigStore {
+  db;
   mode = "local";
+  v1BaseUrl = null;
   constructor(db) {
     this.db = db;
   }
@@ -11863,50 +13977,22 @@ class LocalConfigStore {
 
 class CloudConfigStore {
   mode = "api";
-  base;
-  apiKey;
-  timeoutMs;
-  constructor(config) {
-    this.base = `${config.apiUrl.replace(/\/+$/, "")}/v1`;
-    this.apiKey = config.apiKey;
-    this.timeoutMs = config.timeoutMs ?? 30000;
+  v1BaseUrl;
+  client;
+  constructor(client) {
+    this.client = client;
+    this.v1BaseUrl = client.baseUrl;
   }
   async request(method, path, body, opts = {}) {
-    const controller = new AbortController;
-    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-    const headers = {
-      Authorization: `Bearer ${this.apiKey}`,
-      Accept: "application/json"
-    };
-    if (body !== undefined)
-      headers["Content-Type"] = "application/json";
-    if (opts.idempotent)
-      headers["Idempotency-Key"] = randomUUID3();
     try {
-      const res = await fetch(`${this.base}${path}`, {
-        method,
-        headers,
-        body: body === undefined ? undefined : JSON.stringify(body),
-        signal: controller.signal
+      const data = await this.client.transport.request(method, path, body, {
+        ...opts.idempotent ? { idempotencyKey: randomUUID3() } : {}
       });
-      if (res.status === 404 && opts.allow404)
+      return { status: 200, data };
+    } catch (err) {
+      if (opts.allow404 && isNotFoundHttpError2(err))
         return { status: 404, data: null };
-      const text = await res.text();
-      let parsed = null;
-      if (text) {
-        try {
-          parsed = JSON.parse(text);
-        } catch {
-          parsed = text;
-        }
-      }
-      if (!res.ok) {
-        const message = (parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : undefined) ?? `HTTP ${res.status} on ${method} ${path}`;
-        throw new CloudHttpError(res.status, message, parsed);
-      }
-      return { status: res.status, data: parsed };
-    } finally {
-      clearTimeout(timer);
+      throw err;
     }
   }
   async listConfigs(filter = {}) {
@@ -12062,7 +14148,7 @@ class CloudConfigStore {
     if (first.status !== 404) {
       if (isUsable(first.data))
         return first;
-      throw new CloudHttpError(502, "profile follow-up returned an invalid response", first.data);
+      throw new Error(`Cloud /v1 returned an invalid profile response for ${pathForId(idOrSlug)}`);
     }
     const profiles = await this.listProfiles();
     const profile = profiles.find((candidate) => candidate.id === idOrSlug || candidate.slug === idOrSlug);
@@ -12075,7 +14161,7 @@ class CloudConfigStore {
       if (response.status !== 404) {
         if (isUsable(response.data))
           return response;
-        throw new CloudHttpError(502, "profile follow-up returned an invalid response", response.data);
+        throw new Error(`Cloud /v1 returned an invalid profile response for ${pathForId(candidate)}`);
       }
     }
     return { status: 404, data: null };
@@ -12158,7 +14244,7 @@ class CloudConfigStore {
     }
     if (data && "complete" in data) {
       if (data.complete !== true || data.truncated !== false) {
-        throw new CloudHttpError(502, "profile resolve returned an incomplete or truncated read", data);
+        throw new Error("Cloud /v1 profile resolve returned an incomplete or truncated read");
       }
       return { ...data, source_bounded: data.source_bounded ?? true };
     }
@@ -12174,7 +14260,7 @@ class CloudConfigStore {
       };
     }
     {
-      throw new CloudHttpError(502, "profile resolve returned an incomplete or truncated read", data);
+      throw new Error("Cloud /v1 profile resolve returned an incomplete or truncated read");
     }
   }
   async registerMachine(hostname2, os, arch2) {
@@ -12197,24 +14283,29 @@ class CloudConfigStore {
     });
   }
   async reset() {
-    throw new Error("`init --force` cannot wipe the shared cloud store from a client. " + "Unset HASNA_INSTRUCTIONS_API_URL / HASNA_INSTRUCTIONS_API_KEY to reset the local store instead.");
+    throw new Error("`init --force` cannot wipe the shared cloud store from a client. " + "Point this run at the local store (HASNA_INSTRUCTIONS_LOCAL=1 with no hosted credential) to reset it instead.");
   }
 }
-function resolveConfigStore(env = process.env) {
-  const cloud = resolveCloudConfig(env);
-  return cloud ? new CloudConfigStore(cloud) : new LocalConfigStore;
+function resolveConfigStore(env = process.env, options = {}) {
+  if (selectsInstructionsLocalStore(env)) {
+    if (env === process.env)
+      announceLocalInstructionsMode();
+    return new LocalConfigStore;
+  }
+  const { client } = resolveInstructionsStorageClient(env, options);
+  return new CloudConfigStore(client);
 }
 // src/status.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
 
 // src/lib/apply.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync6, realpathSync as realpathSync3, writeFileSync as writeFileSync2 } from "fs";
-import { basename as basename5, dirname as dirname6, join as join11, resolve as resolve9 } from "path";
-import { homedir as homedir8 } from "os";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync8, realpathSync as realpathSync3, writeFileSync as writeFileSync2 } from "fs";
+import { basename as basename5, dirname as dirname6, join as join12, resolve as resolve9 } from "path";
+import { homedir as homedir7 } from "os";
 
 // src/lib/session-render-ownership.ts
-import { existsSync as existsSync8, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
-import { dirname as dirname5, join as join10, parse as parse3, relative as relative3, sep } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync7, statSync as statSync4 } from "fs";
+import { dirname as dirname5, join as join11, parse as parse3, relative as relative3, sep } from "path";
 var MANIFEST_ANCESTOR_LIMIT = 24;
 var MANAGED_PATH_SEGMENTS = SESSION_RENDER_EXCLUSIVE_MANAGED_PATHS.map((managedPath) => managedPath.split("/").filter(Boolean));
 var manifestCache = new Map;
@@ -12248,7 +14339,7 @@ function readManifestRelativePaths(manifestPath) {
   }
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync5(manifestPath, "utf-8"));
+    manifest = JSON.parse(readFileSync7(manifestPath, "utf-8"));
   } catch {
     return null;
   }
@@ -12265,7 +14356,7 @@ function sessionRenderManifestClaimsPath(absolutePath2) {
   const root = parse3(absolutePath2).root;
   let home = dirname5(absolutePath2);
   for (let depth = 0;depth < MANIFEST_ANCESTOR_LIMIT; depth += 1) {
-    const manifestPath = join10(home, ...SESSION_RENDER_MANIFEST_RELATIVE_PATH.split("/"));
+    const manifestPath = join11(home, ...SESSION_RENDER_MANIFEST_RELATIVE_PATH.split("/"));
     const relativePaths = readManifestRelativePaths(manifestPath);
     if (relativePaths) {
       const claimed = relative3(home, absolutePath2).split(sep).join("/");
@@ -12285,7 +14376,7 @@ function sessionRenderOwnsPath(absolutePath2) {
 
 // src/lib/apply.ts
 function getConfigHome() {
-  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir8();
+  return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir7();
 }
 function expandPath(p) {
   if (p.startsWith("~/")) {
@@ -12332,7 +14423,7 @@ async function writeConfigResult(config, targetPath, content, opts, meta = {}) {
   }
   const path = expandPath(renderedTargetPath);
   const renderedForTarget = isCursorGlobalAuthorityPath(path) ? stampCursorGlobalAuthorityMarker(renderedContent) : renderedContent;
-  const previousContent = existsSync9(path) ? readFileSync6(path, "utf-8") : null;
+  const previousContent = existsSync9(path) ? readFileSync8(path, "utf-8") : null;
   const changed = previousContent !== renderedForTarget;
   if (!opts.dryRun) {
     const dir = dirname6(path);
@@ -12372,7 +14463,7 @@ function wouldDestroyACredential(targetPath, renderedContent, format) {
     const path = expandPath(targetPath);
     if (!existsSync9(path))
       return [];
-    current = readFileSync6(path, "utf-8");
+    current = readFileSync8(path, "utf-8");
   } catch {
     return secretTokens;
   }
@@ -12696,14 +14787,14 @@ function sessionRendererOwnsCanonicalTarget(normalized, opts) {
     getConfigHome(),
     opts.vars?.["HOME_DIR"]
   ].filter((home) => typeof home === "string" && home.length > 0));
-  if ([...homes].some((home) => SESSION_RENDER_OWNED_CONFIG_TARGETS.some((relativePath) => normalized === normalizeTargetPath(join11(home, ...relativePath.split("/"))))))
+  if ([...homes].some((home) => SESSION_RENDER_OWNED_CONFIG_TARGETS.some((relativePath) => normalized === normalizeTargetPath(join12(home, ...relativePath.split("/"))))))
     return true;
   return sessionRenderOwnsPath(normalized);
 }
 
 // src/lib/package-version.ts
-import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname7, join as join12 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
+import { dirname as dirname7, join as join13 } from "path";
 import { fileURLToPath } from "url";
 var cached = null;
 function getPackageVersion() {
@@ -12712,9 +14803,9 @@ function getPackageVersion() {
   try {
     let dir = dirname7(fileURLToPath(import.meta.url));
     for (let i = 0;i < 8; i++) {
-      const pkgPath = join12(dir, "package.json");
+      const pkgPath = join13(dir, "package.json");
       if (existsSync10(pkgPath)) {
-        const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
+        const pkg = JSON.parse(readFileSync9(pkgPath, "utf8"));
         if (pkg.name === "@hasna/instructions" && pkg.version) {
           cached = pkg.version;
           return cached;
@@ -12732,18 +14823,18 @@ function getPackageVersion() {
 
 // src/lib/managed-skill-runtimes.ts
 import { createHash as createHash8 } from "crypto";
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import {
   existsSync as existsSync11,
   lstatSync as lstatSync4,
   mkdirSync as mkdirSync4,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync10,
   renameSync as renameSync2,
   rmSync as rmSync3,
   writeFileSync as writeFileSync3
 } from "fs";
-import { homedir as homedir9 } from "os";
-import { dirname as dirname8, join as join13, parse as parse4, relative as relative4, resolve as resolve10 } from "path";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname8, join as join14, parse as parse4, relative as relative4, resolve as resolve10 } from "path";
 var INBOX_CONVERSATIONS_MINIMUM_VERSION = "0.5.28";
 var INBOX_SKILL_MARKERS = [
   [".claude", "skills", "inbox", "SKILL.md"],
@@ -12769,7 +14860,7 @@ function findSymlinkedAncestor(path) {
   let current = parsed.root;
   const rel = relative4(parsed.root, normalized);
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join13(current, segment);
+    current = join14(current, segment);
     if (!existsSync11(current))
       return null;
     if (lstatSync4(current).isSymbolicLink())
@@ -12787,9 +14878,9 @@ function packagedInboxSkillPath(explicitPath) {
   if (explicitPath)
     return explicitPath;
   const candidates = [
-    join13(import.meta.dir, "..", "..", "assets", "skills", "inbox", "SKILL.md"),
-    join13(import.meta.dir, "..", "assets", "skills", "inbox", "SKILL.md"),
-    join13(process.cwd(), "assets", "skills", "inbox", "SKILL.md")
+    join14(import.meta.dir, "..", "..", "assets", "skills", "inbox", "SKILL.md"),
+    join14(import.meta.dir, "..", "assets", "skills", "inbox", "SKILL.md"),
+    join14(process.cwd(), "assets", "skills", "inbox", "SKILL.md")
   ];
   const found = candidates.find((candidate) => existsSync11(candidate));
   if (!found) {
@@ -12803,7 +14894,7 @@ function readCanonicalSkill(explicitPath) {
   if (!stat?.isFile()) {
     throw new Error("packaged inbox skill contract is not a regular file");
   }
-  const content = readFileSync8(assetPath, "utf8");
+  const content = readFileSync10(assetPath, "utf8");
   if (!content.includes("conversations watch --from <agent> --all")) {
     throw new Error("packaged inbox skill contract does not declare the canonical conversations watcher");
   }
@@ -12813,7 +14904,7 @@ function readCanonicalSkill(explicitPath) {
   return { content, sha256: sha2568(content) };
 }
 function runProbe(command, args) {
-  const result = spawnSync(command, args, {
+  const result = spawnSync3(command, args, {
     encoding: "utf8",
     timeout: 5000,
     stdio: ["ignore", "pipe", "pipe"]
@@ -12840,8 +14931,8 @@ function compareVersions(left, right) {
   }
   return 0;
 }
-function inspectSkillMarkers(homeDir4) {
-  return INBOX_SKILL_MARKERS.map((parts) => join13(homeDir4, ...parts)).map((path) => {
+function inspectSkillMarkers(homeDir6) {
+  return INBOX_SKILL_MARKERS.map((parts) => join14(homeDir6, ...parts)).map((path) => {
     const stat = lstatOrNull(path);
     if (!stat)
       return null;
@@ -12850,16 +14941,16 @@ function inspectSkillMarkers(homeDir4) {
     }
     return {
       path,
-      content: readFileSync8(path, "utf8"),
+      content: readFileSync10(path, "utf8"),
       mode: stat.mode & 511,
       regular: true
     };
   }).filter((snapshot) => snapshot !== null);
 }
 function inspectInbox(options) {
-  const homeDir4 = options.homeDir ?? homedir9();
+  const homeDir6 = options.homeDir ?? homedir8();
   const runtimeCommand = options.conversationsCommand ?? "conversations";
-  const snapshots = inspectSkillMarkers(homeDir4);
+  const snapshots = inspectSkillMarkers(homeDir6);
   const skillPresent = snapshots.length > 0;
   let canonicalContent = null;
   let canonicalSha256 = null;
@@ -12984,7 +15075,7 @@ function writeAtomic(path, content, mode) {
 }
 var DEFAULT_SKILL_WRITE_FILE_OPERATIONS = {
   lstat: lstatOrNull,
-  read: (path) => readFileSync8(path, "utf8"),
+  read: (path) => readFileSync10(path, "utf8"),
   write: writeAtomic
 };
 function writeSkillContractsTransactional(snapshots, canonicalContent, fileOperations = DEFAULT_SKILL_WRITE_FILE_OPERATIONS) {
@@ -13177,7 +15268,7 @@ async function getConfigsStatus(store = resolveConfigStore(), options = {}) {
       missingTargets += 1;
       continue;
     }
-    const disk = readFileSync9(targetPath, "utf-8");
+    const disk = readFileSync11(targetPath, "utf-8");
     const { content: redactedDisk } = redactContent(disk, redactFormatForTarget(config.target_path, config.format));
     if (redactedDisk !== config.content) {
       driftedTargets += 1;
@@ -13269,8 +15360,8 @@ async function getConfigsStatus(store = resolveConfigStore(), options = {}) {
 }
 // src/lib/provider-context.ts
 import { createHash as createHash9 } from "crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync4 } from "fs";
+import { join as join15 } from "path";
 var PROVIDER_CONTEXT_DIR = ".hasna/provider-context";
 var PROVIDER_CONTEXT_MANIFEST = "manifest.json";
 var PROVIDER_CONTEXT_SCHEMA = "hasna.instructions.provider-context/v1";
@@ -13415,18 +15506,18 @@ function resolveAndRenderProviderContext(opts) {
   const recordedEndpoint = originAccepted ? `${opts.origin.host}${opts.origin.pathPrefix || ""}` : null;
   const reason = entry === null && opts.rawEndpoint ? originAccepted ? `endpoint "${recordedEndpoint}" is not in the provider-context registry; using the invariant fragment` : "endpoint rejected (embedded credentials or unparseable); using the invariant fragment" : null;
   const content = renderProviderFragment(entry);
-  const dir = join14(opts.homeDir, PROVIDER_CONTEXT_DIR);
+  const dir = join15(opts.homeDir, PROVIDER_CONTEXT_DIR);
   if (!existsSync13(dir))
     mkdirSync5(dir, { recursive: true });
   const filename = `${entry ? entry.key : "invariant"}.md`;
-  const fragmentPath2 = join14(dir, filename);
+  const fragmentPath2 = join15(dir, filename);
   const fragmentSha256 = sha2569(content);
   writeFileSync4(fragmentPath2, content, "utf8");
-  const manifestPath = join14(dir, PROVIDER_CONTEXT_MANIFEST);
+  const manifestPath = join15(dir, PROVIDER_CONTEXT_MANIFEST);
   let manifest = { schema: PROVIDER_CONTEXT_SCHEMA, fragments: {} };
   try {
     if (existsSync13(manifestPath)) {
-      const parsed = JSON.parse(readFileSync10(manifestPath, "utf8"));
+      const parsed = JSON.parse(readFileSync12(manifestPath, "utf8"));
       if (parsed && typeof parsed === "object")
         manifest = parsed;
     }
@@ -13536,10 +15627,10 @@ var PG_MIGRATIONS = [
   `CREATE INDEX IF NOT EXISTS profile_assets_source_config_idx ON profile_assets (source_config_id)`
 ];
 // src/lib/station-profile.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync14, lstatSync as lstatSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync11, readdirSync as readdirSync2, writeFileSync as writeFileSync5 } from "fs";
-import { arch as osArch, homedir as homedir10, hostname as osHostname, platform as osPlatform, userInfo as osUserInfo } from "os";
-import { dirname as dirname9, join as join15 } from "path";
+import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync14, lstatSync as lstatSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync13, readdirSync as readdirSync2, writeFileSync as writeFileSync5 } from "fs";
+import { arch as osArch, homedir as homedir9, hostname as osHostname3, platform as osPlatform, userInfo as osUserInfo } from "os";
+import { dirname as dirname9, join as join16 } from "path";
 var STATION_PROFILE_CACHE_FILENAME = "station-profile.md";
 var STATION_PROFILE_SOURCE_ID = "station-profile";
 var STATION_PROFILE_LAYER = "machine";
@@ -13549,23 +15640,23 @@ var STATION_PROFILE_FULL_NAMES_MAX = 6;
 var STATION_PROFILE_PRIMARY_SCOPE = "@hasna";
 var MACHINES_MANIFEST_PATH_ENV = "HASNA_MACHINES_MANIFEST_PATH";
 var BUN_INSTALL_ENV = "BUN_INSTALL";
-function homeDir4(env = process.env) {
-  return env["HOME"] || env["USERPROFILE"] || homedir10();
+function homeDir6(env = process.env) {
+  return env["HOME"] || env["USERPROFILE"] || homedir9();
 }
 function getStationProfileCachePath(env = process.env) {
-  return join15(getRawStoreRoot(env), STATION_PROFILE_CACHE_FILENAME);
+  return join16(getRawStoreRoot(env), STATION_PROFILE_CACHE_FILENAME);
 }
 function getMachinesManifestPath(env = process.env) {
-  return env[MACHINES_MANIFEST_PATH_ENV] || join15(homeDir4(env), ".hasna", "machines", "machines.json");
+  return env[MACHINES_MANIFEST_PATH_ENV] || join16(homeDir6(env), ".hasna", "machines", "machines.json");
 }
 function getBunGlobalModulesDir(env = process.env) {
-  return join15(env[BUN_INSTALL_ENV] || join15(homeDir4(env), ".bun"), "install", "global", "node_modules");
+  return join16(env[BUN_INSTALL_ENV] || join16(homeDir6(env), ".bun"), "install", "global", "node_modules");
 }
 function readMachinesManifest(path) {
   try {
     if (!existsSync14(path))
       return null;
-    const parsed = JSON.parse(readFileSync11(path, "utf8"));
+    const parsed = JSON.parse(readFileSync13(path, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
       return null;
     const machines = parsed["machines"];
@@ -13595,7 +15686,7 @@ function metadataUser(record) {
 }
 function probeMachineStatus(machineId) {
   try {
-    const result = spawnSync2("machines", ["details", "--json", "--machine", machineId], {
+    const result = spawnSync4("machines", ["details", "--json", "--machine", machineId], {
       encoding: "utf8",
       timeout: 3000,
       stdio: ["ignore", "pipe", "pipe"]
@@ -13617,11 +15708,11 @@ function probeMachineStatus(machineId) {
   }
 }
 function resolveStationProfileMachine(env = process.env, options = {}) {
-  const hostname2 = osHostname();
+  const hostname2 = osHostname3();
   const record = findLocalManifestMachine(readMachinesManifest(getMachinesManifestPath(env)), hostname2);
-  const home = homeDir4(env);
+  const home = homeDir6(env);
   const platform = stringField(record, "platform") ?? osPlatform();
-  const workspacePath = stringField(record, "workspacePath") ?? join15(home, platform === "darwin" ? "Workspace" : "workspace");
+  const workspacePath = stringField(record, "workspacePath") ?? join16(home, platform === "darwin" ? "Workspace" : "workspace");
   const machine = {
     id: stringField(record, "id") ?? hostname2,
     hostname: stringField(record, "hostname") ?? hostname2,
@@ -13638,7 +15729,7 @@ function resolveStationProfileMachine(env = process.env, options = {}) {
   return machine;
 }
 function scopedPackageNames(modulesDir, scope) {
-  const scopeDir = join15(modulesDir, scope);
+  const scopeDir = join16(modulesDir, scope);
   try {
     if (!existsSync14(scopeDir))
       return null;
@@ -13650,7 +15741,7 @@ function scopedPackageNames(modulesDir, scope) {
 function readdirNames(dir) {
   return readdirSync2(dir).filter((name) => {
     try {
-      return lstatSync5(join15(dir, name)).isDirectory();
+      return lstatSync5(join16(dir, name)).isDirectory();
     } catch {
       return false;
     }
@@ -13735,7 +15826,7 @@ function refreshStationProfile(options = {}) {
   const path = getStationProfileCachePath(env);
   const generatedAt = new Date().toISOString();
   if (!options.dryRun) {
-    const existing = existsSync14(path) ? readFileSync11(path, "utf8") : null;
+    const existing = existsSync14(path) ? readFileSync13(path, "utf8") : null;
     if (existing !== content) {
       mkdirSync6(dirname9(path), { recursive: true });
       writeFileSync5(path, content, "utf8");
@@ -13756,7 +15847,7 @@ function readStationProfile(env = process.env) {
   try {
     if (!existsSync14(path))
       return null;
-    return readFileSync11(path, "utf8");
+    return readFileSync13(path, "utf8");
   } catch {
     return null;
   }
@@ -13781,11 +15872,11 @@ import {
   existsSync as existsSync15,
   lstatSync as lstatSync6,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync14,
   readdirSync as readdirSync3,
   statSync as statSync5
 } from "fs";
-import { dirname as dirname10, isAbsolute as isAbsolute4, join as join16, parse as parse5, relative as relative5, resolve as resolve11 } from "path";
+import { dirname as dirname10, isAbsolute as isAbsolute6, join as join17, parse as parse5, relative as relative5, resolve as resolve11 } from "path";
 class SessionApplyError extends Error {
   constructor(message) {
     super(message);
@@ -13949,7 +16040,7 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
       });
       continue;
     }
-    const actualSha256 = sha25610(readFileSync12(target, "utf-8"));
+    const actualSha256 = sha25610(readFileSync14(target, "utf-8"));
     if (actualSha256 !== file.sha256) {
       drifted.push({
         path: target,
@@ -13975,10 +16066,10 @@ function restoreSessionRenderSnapshot(snapshotPath, options = {}) {
   const resolvedSnapshotPath = resolve11(snapshotPath);
   const snapshotDir = getSessionRenderSnapshotDir(targetHome);
   const snapshotDirRelative = relative5(snapshotDir, resolvedSnapshotPath);
-  const insideSnapshotDir = snapshotDirRelative !== ".." && !snapshotDirRelative.startsWith("../") && !isAbsolute4(snapshotDirRelative);
+  const insideSnapshotDir = snapshotDirRelative !== ".." && !snapshotDirRelative.startsWith("../") && !isAbsolute6(snapshotDirRelative);
   if (!insideSnapshotDir) {
     const snapshotRelativePath = relative5(targetHome, resolvedSnapshotPath);
-    if (snapshotRelativePath === "" || snapshotRelativePath === ".." || snapshotRelativePath.startsWith("../") || isAbsolute4(snapshotRelativePath)) {
+    if (snapshotRelativePath === "" || snapshotRelativePath === ".." || snapshotRelativePath.startsWith("../") || isAbsolute6(snapshotRelativePath)) {
       throw new SessionApplyError("Session snapshot must be stored inside its session-render snapshot location.");
     }
   }
@@ -14107,7 +16198,7 @@ function readSessionRenderSnapshot(snapshotPath) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync12(resolved, "utf8"));
+    parsed = JSON.parse(readFileSync14(resolved, "utf8"));
   } catch {
     throw new SessionApplyError(`Session snapshot is not valid JSON: ${snapshotPath}`);
   }
@@ -14185,7 +16276,7 @@ function reconstructPreRollbackLegacyV1Snapshot(snapshot, previousFiles, previou
   }
   let parsedManifest;
   try {
-    parsedManifest = JSON.parse(readFileSync12(manifestPath, "utf8"));
+    parsedManifest = JSON.parse(readFileSync14(manifestPath, "utf8"));
   } catch {
     throw new SessionApplyError(`Pre-rollback legacy v1 applied manifest is not valid JSON: ${snapshotPath}`);
   }
@@ -14285,7 +16376,7 @@ function assertNoNewerSessionSnapshot(snapshotPath, createdAt, targetHome) {
     if (candidateStat.isSymbolicLink() || !candidateStat.isFile() || candidateStat.size > 32 * 1024 * 1024)
       continue;
     try {
-      const candidate = JSON.parse(readFileSync12(candidatePath, "utf8"));
+      const candidate = JSON.parse(readFileSync14(candidatePath, "utf8"));
       const candidateCreatedAtMs = typeof candidate.createdAt === "string" ? Date.parse(candidate.createdAt) : Number.NaN;
       if ((candidate.schema === "hasna.configs.session-render-snapshot/v1" || candidate.schema === "hasna.configs.session-render-snapshot/v2") && typeof candidate.targetHome === "string" && resolve11(candidate.targetHome) === targetHome && Number.isFinite(candidateCreatedAtMs) && candidateCreatedAtMs >= createdAtMs) {
         throw new SessionApplyError(`Cannot restore pre-rollback legacy v1 snapshot after a newer session snapshot exists: ${candidatePath}`);
@@ -14363,7 +16454,7 @@ function resolveSnapshotFilePath(relativePath, recordedPath, targetHome) {
 }
 function planFileResult(plan, file, targetHome, previousHashes, previousManifest, options) {
   const target = resolvePlannedFilePath(plan, file, targetHome);
-  const previousContent = existsSync15(target) ? readFileSync12(target, "utf-8") : null;
+  const previousContent = existsSync15(target) ? readFileSync14(target, "utf-8") : null;
   const previousSha256 = previousContent === null ? null : sha25610(previousContent);
   const previouslyManaged = isPreviouslyManaged(file, previousSha256, previousHashes, previousManifest);
   const changed = previousContent !== file.content;
@@ -14464,7 +16555,7 @@ function planStaleFileResult(file, targetHome, options) {
   const target = resolveManifestRelativePath(file.relativePath, targetHome);
   if (!existsSync15(target))
     return null;
-  const previousContent = readFileSync12(target, "utf-8");
+  const previousContent = readFileSync14(target, "utf-8");
   const previousSha256 = sha25610(previousContent);
   if (!options.force && previousSha256 !== file.sha256) {
     return {
@@ -14511,7 +16602,7 @@ function isPreviouslyManaged(file, previousSha256, previousHashes, previousManif
 function resolvePlannedFilePath(plan, file, targetHome) {
   const target = resolve11(targetHome, ...file.relativePath.split("/"));
   const rel = relative5(targetHome, target);
-  if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute4(rel)) {
+  if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute6(rel)) {
     throw new SessionApplyError(`Session file escapes target home: ${file.relativePath}`);
   }
   if (resolve11(file.path) !== target) {
@@ -14523,7 +16614,7 @@ function resolvePlannedFilePath(plan, file, targetHome) {
 function resolveManifestRelativePath(relativePath, targetHome) {
   const target = resolve11(targetHome, ...relativePath.split(/[\\/]+/));
   const rel = relative5(targetHome, target);
-  if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute4(rel)) {
+  if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute6(rel)) {
     throw new SessionApplyError(`Session manifest file escapes target home: ${relativePath}`);
   }
   assertNoSymlinkSegments2(targetHome, target);
@@ -14533,7 +16624,7 @@ function readPreviousManifest(path) {
   if (!existsSync15(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync12(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync14(path, "utf-8"));
     if (parsed.schema !== SESSION_RENDER_SCHEMA)
       return null;
     if (!Array.isArray(parsed.files))
@@ -14578,7 +16669,7 @@ function currentSessionFileHash(path, targetHome) {
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw new SessionApplyError(`Session apply path is not a regular file: ${path}`);
   }
-  return sha25610(readFileSync12(path, "utf-8"));
+  return sha25610(readFileSync14(path, "utf-8"));
 }
 function requiredPreviousHash(result) {
   if (result.previousSha256 === null) {
@@ -14588,7 +16679,7 @@ function requiredPreviousHash(result) {
 }
 function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousManifest, coordination, allowPortableFallback, forcePortableFileOps) {
   const existingFiles = results.filter((result) => result.action === "update" || result.action === "delete").filter((result) => existsSync15(result.path)).map((result) => {
-    const content = readFileSync12(result.path, "utf-8");
+    const content = readFileSync14(result.path, "utf-8");
     return {
       path: result.path,
       relativePath: result.relativePath,
@@ -14606,7 +16697,7 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
     };
   }
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
-  const snapshotPath = join16(getSessionRenderSnapshotDir(targetHome), `${timestamp}-${randomUUID4()}.json`);
+  const snapshotPath = join17(getSessionRenderSnapshotDir(targetHome), `${timestamp}-${randomUUID4()}.json`);
   const afterFiles = results.map((result) => {
     if (result.action === "conflict") {
       throw new SessionApplyError(`Cannot snapshot unresolved conflict: ${result.relativePath}`);
@@ -14652,7 +16743,7 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
   };
 }
 function assertSafeTargetHome(targetHome) {
-  if (!isAbsolute4(targetHome))
+  if (!isAbsolute6(targetHome))
     throw new SessionApplyError(`Session target home must be absolute: ${targetHome}`);
   const normalized = resolve11(targetHome);
   if (normalized === parse5(normalized).root) {
@@ -14669,7 +16760,7 @@ function assertNoSymlinkSegments2(root, target) {
   const rel = relative5(root, target);
   let current = root;
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join16(current, segment);
+    current = join17(current, segment);
     if (existsSync15(current) && lstatSync6(current).isSymbolicLink()) {
       throw new SessionApplyError(`Session apply path uses a symlink: ${current}`);
     }
@@ -14681,7 +16772,7 @@ function assertNoSymlinkAncestors3(path) {
   let current = parsed.root;
   const rel = relative5(parsed.root, normalized);
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join16(current, segment);
+    current = join17(current, segment);
     if (!existsSync15(current))
       return;
     if (lstatSync6(current).isSymbolicLink()) {
@@ -14695,9 +16786,6 @@ function sha25610(content) {
 // src/lib/project-dashboard-standard.ts
 var PROJECT_DASHBOARD_STANDARD_SLUG = "agent-managed-project-dashboard-standard";
 var PROJECT_DASHBOARD_PROFILE_VARIABLES = {
-  PROJECT_DASHBOARD_DIR: ".hasna/project",
-  PROJECT_DASHBOARD_RENDER_MANIFEST: ".hasna/project/dashboard/render.json",
-  PROJECT_DASHBOARD_SNAPSHOTS_DIR: ".hasna/project/dashboard/snapshots",
   PROJECT_CHANNEL_PREFIX: ""
 };
 var PROJECT_DASHBOARD_STANDARD_CONTENT = `# Agent-Managed Project Dashboard Standard
@@ -14708,9 +16796,13 @@ evidence, tasks, knowledge, and dashboard output consistent.
 
 ## Canonical Files
 
-- Project manifest root: \`.hasna/project/\`
-- Dashboard render manifest: \`.hasna/project/dashboard/render.json\`
-- Latest snapshot: \`.hasna/project/dashboard/snapshots/latest.snapshot.json\`
+There is exactly one project-layout convention: the canonical per-workspace
+store \`~/.hasna/projects/workspaces/<workspace_id>/\`. Never create a project
+layout directory inside the project folder itself.
+
+- Per-workspace store root: \`~/.hasna/projects/workspaces/<workspace_id>/\`
+- Dashboard render manifest: \`~/.hasna/projects/workspaces/<workspace_id>/dashboard/render.json\`
+- Latest snapshot: \`~/.hasna/projects/workspaces/<workspace_id>/dashboard/snapshots/latest.snapshot.json\`
 - Dashboard schema ids come from \`@hasna/contracts\`.
 - Project folders may contain private documents, but render JSON must contain
   only ids, counts, statuses, resource refs, evidence refs, and redacted
@@ -14993,13 +17085,13 @@ async function ensureDangerousOperationGuardStandardConfig(store = resolveConfig
   }
 }
 // src/lib/sync.ts
-import { existsSync as existsSync17, readdirSync as readdirSync5, readFileSync as readFileSync14 } from "fs";
-import { basename as basename6, extname as extname3, join as join18 } from "path";
+import { existsSync as existsSync17, readdirSync as readdirSync5, readFileSync as readFileSync16 } from "fs";
+import { basename as basename6, extname as extname3, join as join19 } from "path";
 
 // src/lib/sync-dir.ts
-import { existsSync as existsSync16, readdirSync as readdirSync4, readFileSync as readFileSync13, statSync as statSync6 } from "fs";
-import { join as join17, relative as relative6 } from "path";
-import { homedir as homedir11 } from "os";
+import { existsSync as existsSync16, readdirSync as readdirSync4, readFileSync as readFileSync15, statSync as statSync6 } from "fs";
+import { join as join18, relative as relative6 } from "path";
+import { homedir as homedir10 } from "os";
 var SKIP = [".db", ".db-shm", ".db-wal", ".log", ".lock", ".DS_Store", "node_modules", ".git"];
 function shouldSkip(p) {
   return SKIP.some((s) => p.includes(s));
@@ -15009,9 +17101,9 @@ async function syncFromDir(dir, opts = {}) {
   const absDir = expandPath(dir);
   if (!existsSync16(absDir))
     return { added: 0, updated: 0, unchanged: 0, skipped: [`Not found: ${absDir}`] };
-  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync4(absDir).map((f) => join17(absDir, f)).filter((f) => statSync6(f).isFile());
+  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync4(absDir).map((f) => join18(absDir, f)).filter((f) => statSync6(f).isFile());
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
-  const home = homedir11();
+  const home = homedir10();
   const allConfigs = await store.listConfigs();
   for (const file of files) {
     if (shouldSkip(file)) {
@@ -15019,7 +17111,7 @@ async function syncFromDir(dir, opts = {}) {
       continue;
     }
     try {
-      const content = readFileSync13(file, "utf-8");
+      const content = readFileSync15(file, "utf-8");
       if (content.length > 500000) {
         result.skipped.push(file + " (too large)");
         continue;
@@ -15046,7 +17138,7 @@ async function syncFromDir(dir, opts = {}) {
 }
 async function syncToDir(dir, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
-  const home = homedir11();
+  const home = homedir10();
   const absDir = expandPath(dir);
   const normalized = dir.startsWith("~/") ? dir : absDir.replace(home, "~");
   const configs = (await store.listConfigs()).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
@@ -15070,7 +17162,7 @@ async function syncToDir(dir, opts = {}) {
 }
 function walkDir(dir, files = []) {
   for (const entry of readdirSync4(dir, { withFileTypes: true })) {
-    const full = join17(dir, entry.name);
+    const full = join18(dir, entry.name);
     if (shouldSkip(full))
       continue;
     if (entry.isDirectory())
@@ -15204,11 +17296,11 @@ async function syncProject(opts) {
   const allConfigs = await store.listConfigs();
   const machine = detectMachineContext();
   for (const pf of PROJECT_CONFIG_FILES) {
-    const abs = join18(absDir, pf.file);
+    const abs = join19(absDir, pf.file);
     if (!existsSync17(abs))
       continue;
     try {
-      const rawContent = readFileSync14(abs, "utf-8");
+      const rawContent = readFileSync16(abs, "utf-8");
       if (rawContent.length > 500000) {
         result.skipped.push(pf.file);
         continue;
@@ -15237,20 +17329,20 @@ async function syncProject(opts) {
     }
   }
   for (const ruleDir of [
-    { dir: join18(absDir, ".claude", "rules"), agent: "claude", namePrefix: "rules" },
-    { dir: join18(absDir, ".agents", "rules"), agent: "antigravity", namePrefix: "antigravity-rules" },
-    { dir: join18(absDir, ".cursor", "rules"), agent: "cursor", namePrefix: "cursor-rules" },
-    { dir: join18(absDir, ".github", "instructions"), agent: "copilot", namePrefix: "copilot-instructions" },
-    { dir: join18(absDir, ".devin", "rules"), agent: "devin", namePrefix: "devin-rules" },
-    { dir: join18(absDir, ".windsurf", "rules"), agent: "windsurf-legacy", namePrefix: "windsurf-rules" },
-    { dir: join18(absDir, ".clinerules"), agent: "cline", namePrefix: "cline-rules" }
+    { dir: join19(absDir, ".claude", "rules"), agent: "claude", namePrefix: "rules" },
+    { dir: join19(absDir, ".agents", "rules"), agent: "antigravity", namePrefix: "antigravity-rules" },
+    { dir: join19(absDir, ".cursor", "rules"), agent: "cursor", namePrefix: "cursor-rules" },
+    { dir: join19(absDir, ".github", "instructions"), agent: "copilot", namePrefix: "copilot-instructions" },
+    { dir: join19(absDir, ".devin", "rules"), agent: "devin", namePrefix: "devin-rules" },
+    { dir: join19(absDir, ".windsurf", "rules"), agent: "windsurf-legacy", namePrefix: "windsurf-rules" },
+    { dir: join19(absDir, ".clinerules"), agent: "cline", namePrefix: "cline-rules" }
   ]) {
     if (!existsSync17(ruleDir.dir))
       continue;
     const mdFiles = readdirSync5(ruleDir.dir).filter((f) => f.endsWith(".md") || f.endsWith(".mdc"));
     for (const f of mdFiles) {
-      const abs = join18(ruleDir.dir, f);
-      const raw = readFileSync14(abs, "utf-8");
+      const abs = join19(ruleDir.dir, f);
+      const raw = readFileSync16(abs, "utf-8");
       const redacted = redactContent(raw, "markdown");
       const machineAware = templateizeMachineContent(redacted.content, machine);
       const content = machineAware.content;
@@ -15296,13 +17388,13 @@ async function syncKnown(opts = {}) {
       const extensions = known.rulesExtensions ?? [".md", ".mdc"];
       const ruleFiles = readdirSync5(absDir).filter((f) => extensions.some((ext) => f.endsWith(ext)));
       for (const f of ruleFiles) {
-        const abs2 = join18(absDir, f);
+        const abs2 = join19(absDir, f);
         const targetPath = abs2.replace(home, "~");
         if (existingOutputOwners.has(normalizeTargetPath(targetPath)) || isKnownGeneratedTargetPath(targetPath)) {
           result.skipped.push(`${targetPath} (generated output)`);
           continue;
         }
-        const raw = readFileSync14(abs2, "utf-8");
+        const raw = readFileSync16(abs2, "utf-8");
         const redacted = redactContent(raw, "markdown");
         const machineAware = templateizeMachineContent(redacted.content, machine);
         const content = machineAware.content;
@@ -15335,7 +17427,7 @@ async function syncKnown(opts = {}) {
       continue;
     }
     try {
-      const rawContent = normalizeKnownConfigSource(known, readFileSync14(abs, "utf-8"));
+      const rawContent = normalizeKnownConfigSource(known, readFileSync16(abs, "utf-8"));
       if (rawContent.length > 500000) {
         result.skipped.push(known.path + " (too large)");
         continue;
@@ -15440,7 +17532,7 @@ function buildDiff(expectedContent, targetPath, storedFormat, showSecrets) {
   const path = expandPath(targetPath);
   if (!existsSync17(path))
     return `(file not found on disk: ${path})`;
-  const diskContent = readFileSync14(path, "utf-8");
+  const diskContent = readFileSync16(path, "utf-8");
   if (diskContent === expectedContent)
     return "(no diff \u2014 identical)";
   const format = redactFormatForTarget(targetPath, storedFormat);
@@ -15599,14 +17691,14 @@ function detectFormat(filePath) {
 }
 // src/lib/export.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync8, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
-import { join as join19, resolve as resolve12 } from "path";
+import { join as join20, resolve as resolve12 } from "path";
 import { tmpdir } from "os";
 async function exportConfigs(outputPath, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const configs = await store.listConfigs(opts.filter);
   const absOutput = resolve12(outputPath);
-  const tmpDir = join19(tmpdir(), `configs-export-${Date.now()}`);
-  const contentsDir = join19(tmpDir, "contents");
+  const tmpDir = join20(tmpdir(), `configs-export-${Date.now()}`);
+  const contentsDir = join20(tmpDir, "contents");
   try {
     mkdirSync8(contentsDir, { recursive: true });
     const manifest = {
@@ -15614,10 +17706,10 @@ async function exportConfigs(outputPath, opts = {}) {
       exported_at: new Date().toISOString(),
       configs: configs.map(({ content: _content, ...meta }) => meta)
     };
-    writeFileSync6(join19(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
+    writeFileSync6(join20(tmpDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf-8");
     for (const config of configs) {
       const fileName = `${config.slug}.${config.format === "text" ? "txt" : config.format}`;
-      writeFileSync6(join19(contentsDir, fileName), config.content, "utf-8");
+      writeFileSync6(join20(contentsDir, fileName), config.content, "utf-8");
     }
     const proc = Bun.spawn(["tar", "czf", absOutput, "-C", tmpDir, "."], {
       stdout: "pipe",
@@ -15636,14 +17728,14 @@ async function exportConfigs(outputPath, opts = {}) {
   }
 }
 // src/lib/import.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync9, readFileSync as readFileSync15, rmSync as rmSync5 } from "fs";
-import { join as join20, resolve as resolve13 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync9, readFileSync as readFileSync17, rmSync as rmSync5 } from "fs";
+import { join as join21, resolve as resolve13 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 async function importConfigs(bundlePath, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const conflict = opts.conflict ?? "skip";
   const absPath = resolve13(bundlePath);
-  const tmpDir = join20(tmpdir2(), `configs-import-${Date.now()}`);
+  const tmpDir = join21(tmpdir2(), `configs-import-${Date.now()}`);
   const result = { created: 0, updated: 0, skipped: 0, errors: [] };
   try {
     mkdirSync9(tmpDir, { recursive: true });
@@ -15656,15 +17748,15 @@ async function importConfigs(bundlePath, opts = {}) {
       const stderr = await new Response(proc.stderr).text();
       throw new Error(`tar extraction failed: ${stderr}`);
     }
-    const manifestPath = join20(tmpDir, "manifest.json");
+    const manifestPath = join21(tmpDir, "manifest.json");
     if (!existsSync19(manifestPath))
       throw new Error("Invalid bundle: missing manifest.json");
-    const manifest = JSON.parse(readFileSync15(manifestPath, "utf-8"));
+    const manifest = JSON.parse(readFileSync17(manifestPath, "utf-8"));
     for (const meta of manifest.configs) {
       try {
         const ext = meta.format === "text" ? "txt" : meta.format;
-        const contentFile = join20(tmpDir, "contents", `${meta.slug}.${ext}`);
-        const content = existsSync19(contentFile) ? readFileSync15(contentFile, "utf-8") : "";
+        const contentFile = join21(tmpDir, "contents", `${meta.slug}.${ext}`);
+        const content = existsSync19(contentFile) ? readFileSync17(contentFile, "utf-8") : "";
         let existing = null;
         try {
           existing = await store.getConfig(meta.slug);
@@ -15705,9 +17797,9 @@ async function importConfigs(bundlePath, opts = {}) {
 }
 // src/lib/package-manager-guard.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync20, lstatSync as lstatSync7, readdirSync as readdirSync6, readFileSync as readFileSync16 } from "fs";
-import { homedir as homedir12 } from "os";
-import { basename as basename7, dirname as dirname11, isAbsolute as isAbsolute5, join as join21, relative as relative7, resolve as resolve14 } from "path";
+import { existsSync as existsSync20, lstatSync as lstatSync7, readdirSync as readdirSync6, readFileSync as readFileSync18 } from "fs";
+import { homedir as homedir11 } from "os";
+import { basename as basename7, dirname as dirname11, isAbsolute as isAbsolute7, join as join22, relative as relative7, resolve as resolve14 } from "path";
 var SKIP_DIRS = new Set([
   ".git",
   "node_modules",
@@ -15776,9 +17868,9 @@ function scanPackageManagerSecrets(options = {}) {
     }
   }
   if (options.includeHome) {
-    const home = homedir12();
+    const home = homedir11();
     for (const name of HOME_FILES) {
-      const file = join21(home, name);
+      const file = join22(home, name);
       if (!existsSync20(file))
         continue;
       const text = readTextFile(file);
@@ -15803,12 +17895,12 @@ function collectRepoFiles(root) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name))
           continue;
-        visit(join21(dir, entry.name));
+        visit(join22(dir, entry.name));
         continue;
       }
       if (!entry.isFile())
         continue;
-      const file = join21(dir, entry.name);
+      const file = join22(dir, entry.name);
       if (shouldScanRepoFile(file))
         out.push(file);
     }
@@ -15846,7 +17938,7 @@ function readTextFile(file) {
     const stat = lstatSync7(file);
     if (!stat.isFile() || stat.size > 5000000)
       return null;
-    const buf = readFileSync16(file);
+    const buf = readFileSync18(file);
     if (buf.includes(0))
       return null;
     return buf.toString("utf-8");
@@ -16076,10 +18168,10 @@ function stripInlineComment(value) {
   return value.replace(/\s[#;].*$/, "").trim();
 }
 function displayPath(file, root) {
-  const home = homedir12();
+  const home = homedir11();
   if (root === home && (file === home || file.startsWith(home + "/")))
     return "~/" + toPosix(relative7(home, file));
-  if (isAbsolute5(root) && file.startsWith(root + "/"))
+  if (isAbsolute7(root) && file.startsWith(root + "/"))
     return toPosix(relative7(root, file));
   if (file === home || file.startsWith(home + "/"))
     return "~/" + toPosix(relative7(home, file));
@@ -16115,7 +18207,6 @@ export {
   resolveSessionPath,
   resolveProfileVariables,
   resolveConfigStore,
-  resolveCloudConfig,
   resolveAssetDestination,
   resolveAndRenderProviderContext,
   resolveAgentOperatingRulesPayload,
@@ -16147,13 +18238,19 @@ export {
   machineContextToVariables,
   legacyProfileConfigBinding,
   isTemplate,
+  isLocalOptIn,
+  isInstructionsLocalOptIn,
+  isCloudAuthError,
   isApiTransport,
+  instructionsLocalModeNotice,
   inspectManagedSkillRuntimes,
   importConfigs,
   hasSecrets,
   getStationProfileCachePath,
   getRawStoreRoot,
+  getInstructionsTransportStatus,
   getConfigsStatus,
+  formatCliError,
   extractTemplateVars,
   exportConfigs,
   expandPath,
@@ -16190,6 +18287,7 @@ export {
   applyConfigsWithReport,
   applyConfigs,
   applyConfig,
+  announceLocalInstructionsMode,
   TemplateRenderError,
   SessionApplyError,
   STATION_PROFILE_SOURCE_ID,
@@ -16231,6 +18329,7 @@ export {
   PLATFORM_PROFILE_PRESETS,
   PG_MIGRATIONS,
   LocalConfigStore,
+  LOCAL_OPT_IN_ENV,
   LEGACY_CONFIGS_PACKAGE,
   LEGACY_CONFIGS_EXECUTABLE,
   LEGACY_CONFIGS_COMPAT_VERSION,
@@ -16239,6 +18338,8 @@ export {
   INSTRUCTION_GRAPH_PLAN_SCHEMA,
   INSTRUCTION_FALLBACKS,
   INSTRUCTION_ACTIVATION_MODES,
+  INSTRUCTIONS_LOCAL_OPT_IN_ENV_KEYS,
+  INSTRUCTIONS_LOCAL_OPT_IN_ENV,
   INBOX_CONVERSATIONS_MINIMUM_VERSION,
   GLOBAL_AGENT_RULES_STANDARD_SLUG,
   GLOBAL_AGENT_RULES_STANDARD_CONTENT,
@@ -16246,7 +18347,6 @@ export {
   DANGEROUS_OPERATION_GUARD_STANDARD_CONTENT,
   ConfigNotFoundError,
   ConfigApplyError,
-  CloudHttpError,
   CloudConfigStore,
   CONFIG_TRANSFORMS,
   CONFIG_KINDS,