@hasna/recordings 0.2.14 → 0.3.2

package/dist/cli/macos-permissions.d.ts

@@ -1,3 +1,5 @@
+import { RECORDINGS_BUNDLE_IDENTIFIER, TCC_DATABASE_UNREADABLE_STATE } from "../lib/macos-bundle.js";
+export { RECORDINGS_BUNDLE_IDENTIFIER, TCC_DATABASE_UNREADABLE_STATE };
 export interface PermissionHelperProcessResult {
     status: number | null;
     error?: Error;
@@ -10,4 +12,74 @@ export interface PermissionHelperResult {
     errorMessage?: string;
 }
 export declare function runMacOSPermissionRequest(appPath: string, runner?: PermissionHelperRunner): PermissionHelperResult;
+export interface TccAccessRow {
+    authValue: string;
+    csreqHex: string;
+}
+export type TccAccessLookup = {
+    kind: "row";
+    row: TccAccessRow;
+} | {
+    kind: "absent";
+} | {
+    kind: "unreadable";
+    detail: string;
+};
+export type TccIdentityVerification = "satisfied" | "unsatisfied" | "unverifiable";
+export type TccAuthorizationState = "allowed" | "stale_allowed_for_previous_app_build" | "allowed_identity_unverified" | "unverified_no_installed_bundle" | "denied" | "unknown" | "limited" | "not_determined" | "undetermined_tcc_database_unreadable" | "unsupported" | `unknown(${string})`;
+export type CodesignRequirementRunner = (requirementPath: string, appPath: string) => PermissionHelperProcessResult;
+export interface TccPermissionProbe {
+    /**
+     * Three-valued, and it has to be. This was `databaseExists: (dbPath) => boolean` backed by
+     * `existsSync`, which returns `false` for ANY `stat` error rather than just `ENOENT`. When
+     * `stat()` on the TCC path is itself refused, the caller took the "no database here" branch,
+     * never recorded a refusal, and returned `not_determined` — which
+     * `classifyPermissionState` maps to `never_requested`, producing the operator-facing claim
+     * "the app has never requested microphone access (no TCC entry exists)" on a machine whose
+     * grant row demonstrably exists. That is the exact flagship lie this module was written to kill,
+     * reached through the one path that looked too boring to check.
+     *
+     * Demonstrated on real macOS: a file present but `open()`-refused (`/etc/master.passwd`) gives
+     * `existsSync=true` and was handled correctly, while a path whose `stat()` is refused
+     * (`/private/var/db/dslocal/nodes/Default/users/root.plist`) gives `existsSync=false` and
+     * bypassed the fix entirely.
+     *
+     * `indeterminate` must be treated as unreadable, never as absent.
+     */
+    databasePresence: (dbPath: string) => "present" | "absent" | "indeterminate";
+    readAccessRow: (dbPath: string, service: string) => TccAccessLookup;
+    verifyStoredRequirement: (csreqHex: string, appPath: string) => TccIdentityVerification;
+    describeStoredRequirement?: (csreqHex: string) => string | null;
+}
+export declare function tccDatabasePaths(home: string): string[];
+export declare function tccAuthValueLabel(value: string): string;
+export declare function verifyStoredRequirementWithCodesign(csreqHex: string, appPath: string, runner?: CodesignRequirementRunner, bundleExists?: (path: string) => boolean): TccIdentityVerification;
+export declare function describeStoredRequirementWithCsreq(csreqHex: string, runner?: (requirementPath: string) => {
+    status: number | null;
+    stdout?: string;
+    error?: Error;
+}): string | null;
+export declare function resolveTccPermission(options: {
+    service: string;
+    home: string;
+    appPath: string | null;
+    probe?: TccPermissionProbe;
+}): TccAuthorizationState;
+export interface TccGrantReport {
+    state: TccAuthorizationState;
+    storedRequirement: string | null;
+    durability: TccGrantDurability;
+}
+export declare function resolveTccGrant(options: {
+    service: string;
+    home: string;
+    appPath: string | null;
+    probe?: TccPermissionProbe;
+}): TccGrantReport;
+export type TccGrantDurability = "survives_rebuild_developer_id" | "survives_rebuild_certificate_anchored" | "dies_on_rebuild_cdhash_pinned" | "unknown";
+export declare function classifyTccGrantDurability(options: {
+    designatedRequirement: string | null;
+    adHocSigned: boolean;
+}): TccGrantDurability;
+export declare function describeTccAuthorizationSubject(appPath: string | null): string;
 //# sourceMappingURL=macos-permissions.d.ts.map

package/dist/cli/macos-permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"macos-permissions.d.ts","sourceRoot":"","sources":["../../src/cli/macos-permissions.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,MAAM,MAAM,sBAAsB,GAAG,CACnC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAAE,EACpB,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,KAC1B,6BAA6B,CAAC;AAEnC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAQD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,sBAAsD,GAC7D,sBAAsB,CAWxB"}
+{"version":3,"file":"macos-permissions.d.ts","sourceRoot":"","sources":["../../src/cli/macos-permissions.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC9B,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,CAAC;AAEvE,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,MAAM,MAAM,sBAAsB,GAAG,CACnC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAAE,EACpB,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,KAC1B,6BAA6B,CAAC;AAEnC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAQD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,sBAAsD,GAC7D,sBAAsB,CAWxB;AAMD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAOD,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,YAAY,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAM3C,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,aAAa,GAAG,cAAc,CAAC;AAEnF,MAAM,MAAM,qBAAqB,GAC7B,SAAS,GACT,sCAAsC,GACtC,6BAA6B,GAG7B,gCAAgC,GAChC,QAAQ,GACR,SAAS,GACT,SAAS,GACT,gBAAgB,GAChB,sCAAsC,GACtC,aAAa,GACb,WAAW,MAAM,GAAG,CAAC;AAEzB,MAAM,MAAM,yBAAyB,GAAG,CACtC,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,KACZ,6BAA6B,CAAC;AAEnC,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,GAAG,QAAQ,GAAG,eAAe,CAAC;IAC7E,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,eAAe,CAAC;IACpE,uBAAuB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,uBAAuB,CAAC;IAIxF,yBAAyB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACjE;AASD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAKvD;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAavD;AAeD,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,yBAA4D,EACpE,YAAY,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GACnD,uBAAuB,CAsBzB;AAuDD,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,CAAC,eAAe,EAAE,MAAM,KAAK;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAMxF,GACH,MAAM,GAAG,IAAI,CAwBf;AAMD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B,GAAG,qBAAqB,CAExB;AAMD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,kBAAkB,CAAC;CAChC;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B,GAAG,cAAc,CA6DjB;AAeD,MAAM,MAAM,kBAAkB,GAC1B,+BAA+B,GAC/B,uCAAuC,GACvC,+BAA+B,GAC/B,SAAS,CAAC;AAEd,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,kBAAkB,CAsBrB;AASD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAK9E"}

package/dist/cli/macos-shortcut.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Read and write the native macOS app's global recording trigger.
+ *
+ * The app registers its global hotkey through sindresorhus/KeyboardShortcuts (pinned
+ * 1.12.0 in src/native/Recordings/Package.swift), which persists the binding in the
+ * app's own UserDefaults domain. This module is the CLI-side mirror of that storage
+ * contract, so the trigger can be inspected and changed without opening the app's
+ * Settings window — the only place it was previously reachable.
+ *
+ * Storage contract, as implemented by KeyboardShortcuts 1.12.0:
+ *   key   = "KeyboardShortcuts_" + Name.rawValue        (KeyboardShortcuts.swift)
+ *   value = a JSON *string* (not a dict) encoding        (Shortcut.swift)
+ *           { "carbonKeyCode": Int, "carbonModifiers": Int }
+ * `carbonModifiers` is the OR of the classic Carbon modifier constants, per
+ * NSEvent.ModifierFlags.carbon in KeyboardShortcuts/Utilities.swift.
+ *
+ * The Swift side owns the shortcut *name* and its default; both are pinned against
+ * the Swift source by src/__tests__/macos-shortcut-contract.test.ts so the two
+ * languages cannot drift silently.
+ */
+/**
+ * The `defaults` binary every read and write below goes through, or null when this machine
+ * has no app UserDefaults to reach at all.
+ *
+ * Pinned absolutely on macOS, so PATH cannot redirect the read that decides whether a
+ * trigger is armed — the same rule `scripts/macos_artifact.ts` applies to codesign
+ * (`CODESIGN_EXECUTABLE`, macos_artifact.ts:46-48, pinned by
+ * src/__tests__/macos-artifact-command-pinning.test.ts). Production macOS never consults
+ * the environment override.
+ *
+ * `null` off macOS is the load-bearing part. There is no `defaults` and no app there, and
+ * the previous code spawned `/usr/bin/defaults` anyway: `spawnSync` set `error` with a null
+ * status, `readDefault` mapped that to null, and the caller could not tell "this key is
+ * not set" from "there is nothing here to ask". A null executable makes the difference
+ * explicit, so a non-macOS `check` can say nothing about the trigger instead of reporting
+ * a machine with no app as one whose fn key is switched off.
+ *
+ * The off-macOS override is what lets a Linux host exercise this module's real code paths —
+ * including `recordings check`'s exit code — against a stand-in `defaults`, which is
+ * otherwise untestable anywhere in this fleet: the only Mac is the owner's production
+ * machine and it is observation-only.
+ */
+export declare const TRIGGER_DEFAULTS_EXECUTABLE: string | null;
+/**
+ * Blocker 3, discharged on rebase.
+ *
+ * This was `export const RECORDINGS_BUNDLE_ID = "com.hasna.recordings"` — a second definition of
+ * the identifier `macos-permissions.ts` already owns. The duplication was not carelessness: the
+ * canonical constant arrives with #24 and does not exist on this branch's base, so importing it
+ * before the rebase would have left the branch uncompilable rather than merely duplicated. The
+ * review ruling was recorded as a TODO(rebase) and is now honoured instead of carried forward.
+ *
+ * Kept as a re-export under the old name so the UserDefaults call sites below and the contract
+ * test keep reading, while there is exactly one definition. The identifier is the same value TCC
+ * keys grants to and the same domain the app writes its own preferences under — that is precisely
+ * why one owner matters: a bundle that does not carry it is not this app, whatever it is named.
+ *
+ * The same TODO also required reconciling `showGrantTargets()` here with #24's
+ * `describeTccAuthorizationSubject()`. They are NOT the same question and both are kept:
+ * `describeTccAuthorizationSubject()` names the single bundle a TCC grant is being reported FOR
+ * (one path, or a statement that no bundle is installed), while `showGrantTargets()` enumerates
+ * every candidate an operator might have to grant — running instances first, falling back to
+ * installed copies, labelling which case it is reporting. Collapsing them would lose the
+ * multiple-candidate disclosure, which is the whole point of the readout. They now share the one
+ * identifier definition, which is what the ruling was protecting against.
+ */
+export declare const RECORDINGS_BUNDLE_ID = "com.hasna.recordings";
+/** Matches `userDefaultsPrefix` in KeyboardShortcuts.swift. */
+export declare const SHORTCUT_USER_DEFAULTS_PREFIX = "KeyboardShortcuts_";
+/** Matches `Self("toggleRecording")` in RecordingsLib/RecordingEngine.swift. */
+export declare const TOGGLE_RECORDING_SHORTCUT_NAME = "toggleRecording";
+/** Matches the `useFnKey` UserDefaults key read in RecordingsLib/RecordingEngine.swift. */
+export declare const USE_FN_KEY_DEFAULTS_KEY = "useFnKey";
+/** Matches the Swift declaration `default: .init(.f5)` in RecordingEngine.swift. */
+export declare const DEFAULT_TOGGLE_RECORDING_CHORD = "f5";
+export declare const TOGGLE_RECORDING_DEFAULTS_KEY = "KeyboardShortcuts_toggleRecording";
+/**
+ * What each trigger costs in TCC grants, and why. Kept as data rather than prose baked
+ * into the command so the CLI, the tests, and any future surface all state the same
+ * thing — and so the claim can be pinned against the Swift source that implements it.
+ *
+ * Verified against the shipped bundle on 2026-07-27 with `nm -u` on
+ * Recordings.app/Contents/MacOS/Recordings, which lists `_RegisterEventHotKey` (the
+ * hotkey) and `_CGEventTapCreate` + `_AXIsProcessTrusted` (the fn monitor).
+ */
+export interface TriggerGrantRequirement {
+    id: "hotkey" | "fn";
+    label: string;
+    /** How the trigger is implemented — this is what decides the grant. */
+    mechanism: string;
+    /** null when the trigger needs no TCC grant at all. */
+    tccService: string | null;
+    /** null when there is nothing for the owner to switch on. */
+    settingsPath: string | null;
+}
+export declare const TRIGGER_GRANT_REQUIREMENTS: readonly TriggerGrantRequirement[];
+export interface Shortcut {
+    carbonKeyCode: number;
+    carbonModifiers: number;
+}
+export interface TriggerState {
+    /** null when no binding is stored — the app then writes its own default at launch. */
+    shortcut: Shortcut | null;
+    /** Raw stored string, kept for diagnostics when parsing fails. */
+    rawShortcut: string | null;
+    useFnKey: boolean;
+}
+export declare class ShortcutParseError extends Error {
+}
+export declare function listBindableKeys(): string[];
+/**
+ * Parse a chord such as "f13", "ctrl+opt+r" or "⌘⇧Space" into its Carbon encoding.
+ * Modifier-only chords are rejected: Carbon's RegisterEventHotKey needs a real key.
+ */
+export declare function parseShortcutChord(input: string): Shortcut;
+/** Render a stored shortcut the way macOS would show it, e.g. "⌃⌥R" or "F13". */
+export declare function formatShortcut(shortcut: Shortcut): string;
+/** Injectable so the process scan can be tested without a running app. */
+export type ProcessLister = () => string | null;
+/** Reads a bundle's CFBundleIdentifier, or null when it is not a readable bundle. */
+export type BundleIdentifierReader = (bundlePath: string) => string | null;
+export interface BundleScanProbes {
+    listProcesses?: ProcessLister;
+    readBundleIdentifier?: BundleIdentifierReader;
+}
+/**
+ * Bundle paths of the Recordings.app instances currently running.
+ *
+ * TCC grants key to a specific bundle (and, for an unstably-signed build, to its cdhash),
+ * so "which bundle is running" is the only honest answer to "where does the Accessibility
+ * grant have to go". Reporting a nominal install path instead is how a permission readout
+ * ends up naming a bundle that is not the one being denied.
+ */
+export declare function runningAppBundlePaths(probes?: BundleScanProbes): string[];
+export declare function parseStoredShortcut(raw: string | null): Shortcut | null;
+export declare function readTriggerState(): TriggerState;
+export declare function writeShortcut(shortcut: Shortcut): void;
+export declare function writeUseFnKey(enabled: boolean): void;
+//# sourceMappingURL=macos-shortcut.d.ts.map

package/dist/cli/macos-shortcut.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"macos-shortcut.d.ts","sourceRoot":"","sources":["../../src/cli/macos-shortcut.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,GAAG,IAGU,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,oBAAoB,yBAA+B,CAAC;AAEjE,+DAA+D;AAC/D,eAAO,MAAM,6BAA6B,uBAAuB,CAAC;AAElE,gFAAgF;AAChF,eAAO,MAAM,8BAA8B,oBAAoB,CAAC;AAEhE,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAElD,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD,eAAO,MAAM,6BAA6B,sCAAsE,CAAC;AAEjH;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,6DAA6D;IAC7D,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,eAAO,MAAM,0BAA0B,EAAE,SAAS,uBAAuB,EAqBxE,CAAC;AAwFF,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,kEAAkE;IAClE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;CAAG;AAEhD,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAE3C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAoD1D;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CASzD;AAED,0EAA0E;AAC1E,MAAM,MAAM,aAAa,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC;AAEhD,qFAAqF;AACrF,MAAM,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AA8B3E,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;CAC/C;AAwBD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,GAAE,gBAAqB,GAAG,MAAM,EAAE,CA0C7E;AAgDD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,CAWvE;AAED,wBAAgB,gBAAgB,IAAI,YAAY,CAS/C;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAMtD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgBpD"}

package/dist/cli/trigger-probe.d.ts

@@ -0,0 +1,172 @@
+/**
+ * Whether a global recording trigger can actually fire, as a diagnosis rather than a dump.
+ *
+ * Why this exists: on 2026-07-27 the owner's fn key was dead for days with `useFnKey=0` in the
+ * `com.hasna.recordings` defaults domain, and every diagnostic reported green throughout —
+ * `recordings check` looked at sox and API keys, `app status` at the bundle, `app permissions`
+ * at TCC grants, and not one of them looked at the trigger. The machinery to read the trigger
+ * arrived with PR #26 (`readTriggerState`, `TRIGGER_GRANT_REQUIREMENTS` in
+ * `./macos-shortcut.ts`) but was wired only into the new `recordings shortcut` command, which
+ * is no use to the person who does not yet know what is wrong. This module turns those reads
+ * into a verdict the commands an operator already runs can report and fail on.
+ *
+ * Two rules shape everything below.
+ *
+ * 1. Conservative about failure. A false "your trigger is dead" on a working machine is worse
+ *    than the silence being fixed, so each trigger is three-valued — `yes`, `no`, `unknown` —
+ *    and the command only fails when EVERY trigger is a definite `no`. Anything undecidable
+ *    is reported loudly and counted as usable.
+ * 2. Cheap. `runningAppBundlePaths()` in `./macos-shortcut.ts` walks `ps` and spawns a
+ *    `defaults` read per path candidate; it was measured at ~11.6 s per call. Nothing here
+ *    calls it. The storage read is two `defaults` reads of the app's own domain, and the
+ *    runtime observation is a bounded tail of a log file. A `check` that takes 12 seconds is a
+ *    `check` nobody runs, which would reintroduce the silence by another route.
+ */
+import { type Shortcut, type TriggerState } from "./macos-shortcut.js";
+/** Three-valued on purpose — see rule 1 in the module comment. */
+export type TriggerCapability = "yes" | "no" | "unknown";
+/**
+ * What the stored hotkey value means, which is three things and not two.
+ *
+ * KeyboardShortcuts 1.12.0 (pinned in src/native/Recordings/Package.swift) decides this, and
+ * the app inherits its decision:
+ *
+ *   - key ABSENT      -> `Name.init(_:default:)` applies the declared default, but only
+ *                        `if !userDefaultsContains(name:)` (Name.swift:39-45). So an absent key
+ *                        means the app registers F5 the next time it launches: a trigger
+ *                        exists, it is just not written down yet.
+ *   - key = JSON      -> that chord, decoded by `getShortcut` (KeyboardShortcuts.swift:293-301).
+ *   - key = Bool false -> `setShortcut(nil, ...)` routes to `userDefaultsDisable`, which writes
+ *                        `false` rather than removing the key (KeyboardShortcuts.swift:279-289,
+ *                        434-442). `userDefaultsContains` is then true, so the default is NOT
+ *                        applied and `getShortcut` returns nil: NOTHING is registered. This is
+ *                        the state a user reaches by clearing the shortcut in Settings, and it
+ *                        is the only state in which "no hotkey is bound" is literally true.
+ *
+ * `parseStoredShortcut` collapses the last two to null, and `recordings shortcut` renders the
+ * cleared case as "unreadable (0)" — accurate about the bytes, silent about the consequence.
+ */
+export type HotkeyBindingState = "bound" | "default_pending" | "cleared" | "unreadable";
+export interface HotkeyBinding {
+    state: HotkeyBindingState;
+    /** How the effective chord renders, or null when nothing will be registered. */
+    chord: string | null;
+    /** Only set for `bound` — a pending default is not a stored value and must not read as one. */
+    shortcut: Shortcut | null;
+    /** Kept verbatim: the raw value is the evidence when the state is `unreadable`. */
+    stored_raw: string | null;
+    can_fire: TriggerCapability;
+    defaults_key: string;
+}
+export interface FnTriggerState {
+    use_fn_key: boolean;
+    /** The TCC state as `getMacOSAppStatus()` resolved it, or null when it was not measured. */
+    accessibility_permission: string | null;
+    can_fire: TriggerCapability;
+    defaults_key: string;
+}
+/**
+ * The app's own last report of its trigger, parsed out of its diagnostic log.
+ *
+ * This is the only honest answer to "is the fn event tap actually running": the tap lives
+ * inside the app, `FnKeyMonitor.isRunning` asks `CGEvent.tapIsEnabled` about it, and a CLI in
+ * another process cannot observe it. `RecordingEngine.logResolvedTrigger()` writes exactly
+ * that, so reading it costs a file read instead of a process scan — and it carries the
+ * app-side blocked reason too, which the menu-bar status line can lose to an unrelated
+ * erasure bug.
+ *
+ * It is an OBSERVATION, not live state: the app logs this at init and whenever the trigger
+ * changes, so it can be arbitrarily old. Every consumer below says when it was made.
+ */
+export interface AppTriggerObservation {
+    observed_at: string | null;
+    /** As the app resolved it, e.g. "carbonKeyCode=96 carbonModifiers=0" or "none". */
+    shortcut_stored: string | null;
+    use_fn_key: boolean;
+    fn_monitor_running: boolean;
+    microphone: string | null;
+    accessibility: string | null;
+    /** The app's own blocked reason, or null when it reported `blocked=none`. */
+    blocked: string | null;
+}
+export interface TriggerDiagnosis {
+    /** false only when every trigger is a definite `no`. This is what gates the exit code. */
+    can_fire: boolean;
+    /** One line, built once so text output and `--json` cannot drift apart. */
+    summary: string;
+    defaults_domain: string;
+    hotkey: HotkeyBinding;
+    fn: FnTriggerState;
+    app_observation: AppTriggerObservation | null;
+    /** Reasons the trigger provably cannot fire. Non-empty exactly when `can_fire` is false. */
+    failures: string[];
+    /** Real problems that do not prove nothing can fire. */
+    warnings: string[];
+    /** Context that is not a problem. */
+    notes: string[];
+}
+export declare function resolveHotkeyBinding(state: TriggerState): HotkeyBinding;
+export declare function resolveFnTrigger(useFnKey: boolean, accessibilityPermission: string | null): FnTriggerState;
+/**
+ * Parse the app's last resolved-trigger log line.
+ *
+ * Field extraction is anchored on the following field name rather than split on whitespace,
+ * because two values legitimately contain spaces: `shortcutStored=carbonKeyCode=96
+ * carbonModifiers=0` embeds both a space and a second `=`, and `blocked=` carries free prose.
+ * Order is fixed by the single `log()` statement that produces the line
+ * (`RecordingEngine.logResolvedTrigger()`), and
+ * src/__tests__/trigger-diagnosis.test.ts renders that statement's own format string through
+ * this parser so the two cannot drift apart silently.
+ *
+ * Returns null rather than a half-filled record when the two booleans that decide anything are
+ * missing: an unparseable line means the runtime state is unknown, which is a different claim
+ * from "the tap is not running".
+ */
+export declare function parseTriggerBindingsLog(logText: string | null): AppTriggerObservation | null;
+/**
+ * The tail of the app's diagnostic log, or null when there is nothing to read.
+ *
+ * Bounded because the log is append-only with no rotation. Reading all of it would make the
+ * cost of `check` a function of how long the app has been running, and the whole point of
+ * putting this in `check` is that it stays fast enough to be run. A trigger line older than
+ * the window reads as "no observation", which is reported as unknown — never as a failure.
+ */
+export declare function readAppLogTail(logPath: string | null, maxBytes?: number): string | null;
+export interface DiagnoseTriggerInput {
+    trigger: TriggerState;
+    accessibilityPermission: string | null;
+    observation: AppTriggerObservation | null;
+}
+export declare function diagnoseTrigger(input: DiagnoseTriggerInput): TriggerDiagnosis;
+export interface ProbeTriggerInput {
+    /** As `getMacOSAppStatus()` resolved it, or null when it was not measured on this platform. */
+    accessibilityPermission: string | null;
+    /** `MacOSAppStatus.log_path`, which mirrors where the Swift `NativeAppLog` writes. */
+    appLogPath: string | null;
+}
+/**
+ * Read the trigger and diagnose it, or return null when this machine has no app UserDefaults
+ * to ask.
+ *
+ * Gated on the capability rather than on `process.platform`: what the diagnosis needs is a
+ * readable `defaults` domain, and off macOS `TRIGGER_DEFAULTS_EXECUTABLE` is null, so callers
+ * get null and report nothing rather than describing a machine with no app as one whose fn key
+ * is switched off.
+ */
+export declare function probeTriggerDiagnostics(input: ProbeTriggerInput): TriggerDiagnosis | null;
+export interface TriggerPickup {
+    /** Whether the value just written is the value that will actually fire. */
+    armed: boolean;
+    runningBundlePaths: string[];
+}
+/**
+ * Whether a trigger write took effect.
+ *
+ * A write lands in UserDefaults, which decides what the NEXT launch registers; a running
+ * instance keeps the binding it registered with. `recordings shortcut --fn on` printed that
+ * truthfully and then exited 0, so `recordings shortcut --fn on && echo armed` printed
+ * "armed" while the trigger was not armed — the same class of false green this whole surface
+ * exists to remove, just in an exit code instead of a status line.
+ */
+export declare function describeTriggerPickup(runningBundlePaths: string[]): TriggerPickup;
+//# sourceMappingURL=trigger-probe.d.ts.map

package/dist/cli/trigger-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trigger-probe.d.ts","sourceRoot":"","sources":["../../src/cli/trigger-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,EASL,KAAK,QAAQ,EACb,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAE7B,kEAAkE;AAClE,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,IAAI,GAAG,SAAS,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,CAAC;AAExF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,gFAAgF;IAChF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,+FAA+F;IAC/F,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,mFAAmF;IACnF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,4FAA4F;IAC5F,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mFAAmF;IACnF,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,OAAO,CAAC;IACpB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,QAAQ,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB,EAAE,EAAE,cAAc,CAAC;IACnB,eAAe,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC9C,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,qCAAqC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AA0BD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,aAAa,CAmDvE;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,OAAO,EACjB,uBAAuB,EAAE,MAAM,GAAG,IAAI,GACrC,cAAc,CAgBhB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,qBAAqB,GAAG,IAAI,CAyB5F;AAkBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,SAAqB,GAAG,MAAM,GAAG,IAAI,CAwBnG;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,YAAY,CAAC;IACtB,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,WAAW,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC3C;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,gBAAgB,CA8G7E;AAsBD,MAAM,WAAW,iBAAiB;IAChC,+FAA+F;IAC/F,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,sFAAsF;IACtF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,iBAAiB,GAAG,gBAAgB,GAAG,IAAI,CAOzF;AAED,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,kBAAkB,EAAE,MAAM,EAAE,GAAG,aAAa,CAEjF"}

package/dist/db/database.d.ts

@@ -1,5 +1,14 @@
 import { Database } from "bun:sqlite";
 import { SqliteAdapter } from "./sqlite-adapter.js";
+export declare const MIGRATIONS: string[];
+/**
+ * Migration id a fully-migrated store carries in `_migrations`.
+ *
+ * Exposed so a diagnostic can tell a current store from a legacy one by reading
+ * it, rather than by opening it read-write — which is itself the act of
+ * migrating, and therefore the thing being checked for.
+ */
+export declare const CURRENT_MIGRATION_LEVEL: number;
 export declare function getDatabase(dbPath?: string): Database;
 export declare function closeDatabase(): void;
 export declare function resetDatabase(): void;

package/dist/db/database.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/db/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA+FpD,wBAAgB,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAiBrD;AAsED,wBAAgB,aAAa,IAAI,IAAI,CAMpC;AAED,wBAAgB,aAAa,IAAI,IAAI,CAGpC;AAED,oEAAoE;AACpE,wBAAgB,UAAU,IAAI,aAAa,CAK1C;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC"}
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/db/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,eAAO,MAAM,UAAU,UAqFtB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAwB,CAAC;AAE7D,wBAAgB,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAiBrD;AA0ED,wBAAgB,aAAa,IAAI,IAAI,CAMpC;AAED,wBAAgB,aAAa,IAAI,IAAI,CAGpC;AAED,oEAAoE;AACpE,wBAAgB,UAAU,IAAI,aAAa,CAK1C;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC"}

package/dist/http/client.d.ts

@@ -1,12 +1,24 @@
 export type Env = Record<string, string | undefined>;
-export type StorageMode = "local" | "cloud";
-export declare function defaultCloudBaseUrl(name: string): string;
+/** Where a client reads and writes. Two arms, no third. */
+export type ClientStore = "sqlite" | "http";
+/**
+ * Fallback API base URL when the client store resolves to `http` and no
+ * `HASNA_<APP>_API_URL` is set. It points at the app's own server on the same
+ * machine (`recordings-serve`'s default port — see DEFAULT_PORT in
+ * src/server/index.ts). This default deliberately contains no internal-infra
+ * hostname: a remote deployment sets `HASNA_<APP>_API_URL` explicitly. The
+ * `name` argument is retained for signature compatibility with the public
+ * `@hasna/recordings/storage` surface; it no longer derives a hostname.
+ */
+export declare function defaultApiBaseUrl(name: string): string;
 export declare function toV1BaseUrl(apiUrl: string): string;
-export type TransportKind = "local" | "cloud-http";
+export type TransportKind = ClientStore;
 export interface TransportResolution {
+    /** The store actually in use. `sqlite` whenever routing to `http` was refused. */
     transport: TransportKind;
-    mode: StorageMode;
-    deprecatedAlias: string | null;
+    /** The store that was asked for. Differs from `transport` only when misconfigured. */
+    requested: ClientStore;
+    /** What decided it: an env var NAME, `auto:api-url+api-key`, or `default`. Never a value. */
     modeSource: string;
     baseUrl: string | null;
     apiKeyPresent: boolean;
@@ -64,11 +76,11 @@ export interface StorageClient {
 }
 export declare function createStorageClient(name: string, transport: HttpTransport): StorageClient;
 export type ResolveResult = {
-    transport: "local";
+    transport: "sqlite";
     client: null;
     resolution: TransportResolution;
 } | {
-    transport: "cloud-http";
+    transport: "http";
     client: StorageClient;
     resolution: TransportResolution;
 };

package/dist/http/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/http/client.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AACrD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,CAAC;AAkB5C,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAyBD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAWlD;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,YAAY,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,aAAa,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAMD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,GAAiB,GAAG,mBAAmB,CAoD1F;AAED,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBACX,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;CAQxE;AAED,KAAK,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC1E,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,aAAa,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;AAElI,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtG,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACnF,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAkBD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAmF5E;AAQD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChG,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAaD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,GAAG,aAAa,CAmCzF;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,mBAAmB,CAAA;CAAE,GACrE;IAAE,SAAS,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAMxF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,GAAiB,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,aAAa,CAa/G"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/http/client.ts"],"names":[],"mappings":"AA0BA,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAErD,2DAA2D;AAC3D,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,MAAM,CAAC;AA+B5C;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAmDD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAWlD;AAED,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AAExC,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,SAAS,EAAE,aAAa,CAAC;IACzB,sFAAsF;IACtF,SAAS,EAAE,WAAW,CAAC;IACvB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAMD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,GAAiB,GAAG,mBAAmB,CAiD1F;AAED,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBACX,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;CAQxE;AAED,KAAK,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC1E,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,aAAa,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;AAElI,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACtG,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACnF,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClF,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAkBD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAoF5E;AAQD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChG,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAaD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,GAAG,aAAa,CAmCzF;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,SAAS,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,mBAAmB,CAAA;CAAE,GACtE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAMlF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,GAAiB,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,aAAa,CAa/G"}

package/dist/index.d.ts

@@ -3,11 +3,13 @@ export { RecordingNotFoundError, RecordingError, TranscriptionError, Enhancement
 export { getStore, __resetStore, APP } from "./store.js";
 export type { Store, RecordingStats, FeedbackInput } from "./store.js";
 export { resolveStorageClient, resolveTransport, createHttpTransport, createStorageClient, HasnaHttpError, } from "./http/client.js";
-export type { StorageClient, StorageMode, TransportResolution, HttpTransport, } from "./http/client.js";
+export type { StorageClient, ClientStore, TransportResolution, HttpTransport, } from "./http/client.js";
 export { loadConfig, getDataDir, ensureDataDir, DEFAULT_CONFIG, DEFAULT_TRANSCRIPTION_MODEL, DEFAULT_REALTIME_SESSION_MODEL, DEFAULT_REALTIME_TRANSCRIPTION_MODEL, normalizeModelSlots, normalizePostProcessingConfig, normalizePostProcessingMode, } from "./lib/config.js";
 export { transcribeAudio, transcribeBuffer, resetClient, } from "./lib/transcriber.js";
 export { needsEnhancement, enhanceText, processText, resetEnhancementClient, } from "./lib/enhancer.js";
 export { startRecording, stopRecording, isRecording, getCurrentFile, checkRecordingDeps, recordDuration, } from "./lib/recorder.js";
+export { probeMicrophoneCapture, captureProbePrecondition, captureProbeSubject, microphoneGrantInstruction, classifyPermissionState, readWavPeak, DEFAULT_PROBE_SECONDS, MAX_PROBE_SECONDS, SILENCE_PEAK_THRESHOLD, DEFAULT_RECORD_EXECUTABLE, RECORDINGS_BUNDLE_IDENTIFIER, TCC_UNREADABLE_STATE, type CaptureProbeResult, type CaptureProbeSubject, type MicrophoneGrantInstruction, type PermissionRequestState, type WavPeak, } from "./lib/capture-probe.js";
+export { describeActiveStore, probeRecordingPersistence, safeBaseUrl, AUTO_FLIP_MODE_SOURCE, PERSISTENCE_PROBE_TAG, PERSISTENCE_PROBE_MARKER_PREFIX, type ActiveStoreDescription, type PersistenceProbeResult, } from "./lib/persistence-probe.js";
 export { RecordingsV1Client, RecordingsV1ApiError, } from "./sdk/index.js";
 export type { RecordingsV1ClientOptions, RecordingsV1Recording, RecordingsV1Agent, RecordingsV1Project, RecordingsV1CreateRecordingInput, RecordingsV1RegisterAgentInput, RecordingsV1RegisterProjectInput, } from "./sdk/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,SAAS,EACT,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,KAAK,EACL,OAAO,EACP,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACzD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,UAAU,EACV,UAAU,EACV,aAAa,EACb,cAAc,EACd,2BAA2B,EAC3B,8BAA8B,EAC9B,oCAAoC,EACpC,mBAAmB,EACnB,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gCAAgC,EAChC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,SAAS,EACT,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,KAAK,EACL,OAAO,EACP,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACzD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,UAAU,EACV,UAAU,EACV,aAAa,EACb,cAAc,EACd,2BAA2B,EAC3B,8BAA8B,EAC9B,oCAAoC,EACpC,mBAAmB,EACnB,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,yBAAyB,EACzB,4BAA4B,EAC5B,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,OAAO,GACb,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,WAAW,EACX,qBAAqB,EACrB,qBAAqB,EACrB,+BAA+B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,GAC5B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gCAAgC,EAChC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,gBAAgB,CAAC"}