@hasna/recordings 0.3.13 → 0.5.0

package/dist/sdk/resolve.d.ts

@@ -0,0 +1,53 @@
+import { RecordingsV1Client, type RecordingsV1ClientOptions } from "./v1.generated.js";
+import type { RecordsCredentialChainOptions } from "../http/client.js";
+/** The unhosted `recordings-serve` a workstation runs. Never a hosted authority. */
+export declare const RECORDINGS_LOCAL_SERVE_URL = "http://localhost:8874";
+type Env = Record<string, string | undefined>;
+export interface RecordingsSdkTransport {
+    /** `"http"` for a resolved hosted authority, `"local-serve"` for the unhosted default. */
+    mode: "http" | "local-serve";
+    /**
+     * Origin (plus any gateway path prefix) WITHOUT the `/v1` suffix, so a caller
+     * that composes `/v1/...` gets exactly one version segment.
+     */
+    baseUrl: string;
+    /** The credential, or null in local mode. */
+    apiKey: string | null;
+    /** WHERE the credential came from — an env key NAME, a Keychain reference, a path. Never a value. */
+    apiKeySource: string | null;
+    /** WHERE the authority came from, or `"local-serve"`. */
+    apiUrlSource: string;
+}
+export interface ResolveRecordingsSdkTransportOptions {
+    /** Tier 1: an explicit authority. Used verbatim, minus a trailing slash. */
+    baseUrl?: string | undefined;
+    /** Tier 1: an explicit credential. */
+    apiKey?: string | undefined;
+    /** Tier 1 profile selection and the injectable `security` runner tests use. */
+    credentials?: RecordsCredentialChainOptions;
+    /** Defaults to `process.env`. */
+    env?: Env;
+    /** Where the one-line local-mode notice goes. Defaults to `process.stderr`. */
+    notice?: (line: string) => void;
+}
+/** Reset the once-per-process local-mode notice. Test seam only. */
+export declare function __resetRecordingsSdkLocalNotice(): void;
+/**
+ * Resolve the SDK's authority and credential. Explicit arguments win; otherwise
+ * the @hasna/contracts chain decides, and only the deliberate unhosted opt-in
+ * lands on the local serve. Every refusal throws — there is no fallback.
+ */
+export declare function resolveRecordingsSdkTransport(options?: ResolveRecordingsSdkTransportOptions): RecordingsSdkTransport;
+/**
+ * Build the hosted `/v1` client with the fleet resolver behind it — the
+ * generated {@link RecordingsV1Client} takes an explicit `baseUrl` and has no
+ * environment surface of its own, which left every caller writing a private
+ * copy of the chain.
+ *
+ * Throws when no credential resolves and takes the unhosted opt-in: this client
+ * speaks only to the hosted authority, so there is no local mode to degrade
+ * to.
+ */
+export declare function createRecordingsV1Client(options?: ResolveRecordingsSdkTransportOptions & Pick<RecordingsV1ClientOptions, "fetch" | "headers">): RecordingsV1Client;
+export {};
+//# sourceMappingURL=resolve.d.ts.map

package/dist/sdk/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/sdk/resolve.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAKvF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAEvE,oFAAoF;AACpF,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAElE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE9C,MAAM,WAAW,sBAAsB;IACrC,0FAA0F;IAC1F,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC;IAC7B;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,qGAAqG;IACrG,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oCAAoC;IACnD,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,+EAA+E;IAC/E,WAAW,CAAC,EAAE,6BAA6B,CAAC;IAC5C,iCAAiC;IACjC,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,+EAA+E;IAC/E,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAID,oEAAoE;AACpE,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAiBD;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,GAAE,oCAAyC,GACjD,sBAAsB,CA+FxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,oCAAoC,GAAG,IAAI,CAAC,yBAAyB,EAAE,OAAO,GAAG,SAAS,CAAM,GACxG,kBAAkB,CAqDpB"}

package/dist/sdk/v1.generated.d.ts

@@ -1,6 +1,9 @@
 export interface Recording {
     "id"?: string;
     "audio_path"?: string | null;
+    "audio_object_key"?: string | null;
+    "audio_sha256"?: string | null;
+    "audio_bytes"?: number | null;
     "raw_text"?: string;
     "processed_text"?: string | null;
     "processing_mode"?: "raw" | "enhanced";
@@ -40,6 +43,9 @@ export interface CreateRecordingInput {
     "id"?: string;
     "raw_text": string;
     "audio_path"?: string;
+    "audio_object_key"?: string;
+    "audio_sha256"?: string;
+    "audio_bytes"?: number;
     "processed_text"?: string;
     "processing_mode"?: "raw" | "enhanced";
     "model_used"?: string;

package/dist/sdk/v1.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"v1.generated.d.ts","sourceRoot":"","sources":["../../src/sdk/v1.generated.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,SAAS;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE;AAEpjB,MAAM,WAAW,KAAK;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE;AAE/L,MAAM,WAAW,OAAO;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE;AAEzJ,MAAM,WAAW,oBAAoB;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE;AAE1d,MAAM,WAAW,kBAAkB;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AAE/F,MAAM,WAAW,oBAAoB;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE;AAEhG,MAAM,WAAW,yBAAyB;IACxC,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,qBAAa,QAAS,SAAQ,KAAK;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAmB,QAAQ,CAAC,IAAI,EAAE,OAAO;gBAAvD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,IAAI,EAAE,OAAO;CAI7E;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;gBAEzC,OAAO,EAAE,yBAAyB;YAQhC,OAAO;IA8BnB,kBAAkB;IACZ,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ5F,iCAAiC;IAC3B,aAAa,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,KAAK,CAAA;KAAE,CAAC;IAQ/F,iCAAiC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,KAAK,CAAA;KAAE,CAAC;IAQ5E,oBAAoB;IACd,YAAY,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,UAAU,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAQlG,kCAAkC;IAC5B,eAAe,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAQvG,kCAAkC;IAC5B,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAQlF,sBAAsB;IAChB,cAAc,CAAC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;QAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAQnV,yBAAyB;IACnB,eAAe,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,WAAW,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAQ3G,4BAA4B;IACtB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,WAAW,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAQxF,+BAA+B;IACzB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAQvF,qCAAqC;IAC/B,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CAOrL"}
+{"version":3,"file":"v1.generated.d.ts","sourceRoot":"","sources":["../../src/sdk/v1.generated.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,SAAS;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE;AAEvpB,MAAM,WAAW,KAAK;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE;AAE/L,MAAM,WAAW,OAAO;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE;AAEzJ,MAAM,WAAW,oBAAoB;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE;AAExiB,MAAM,WAAW,kBAAkB;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AAE/F,MAAM,WAAW,oBAAoB;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE;AAEhG,MAAM,WAAW,yBAAyB;IACxC,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,qBAAa,QAAS,SAAQ,KAAK;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAmB,QAAQ,CAAC,IAAI,EAAE,OAAO;gBAAvD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,IAAI,EAAE,OAAO;CAI7E;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;gBAEzC,OAAO,EAAE,yBAAyB;YAQhC,OAAO;IA8BnB,kBAAkB;IACZ,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ5F,iCAAiC;IAC3B,aAAa,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,KAAK,CAAA;KAAE,CAAC;IAQ/F,iCAAiC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,KAAK,CAAA;KAAE,CAAC;IAQ5E,oBAAoB;IACd,YAAY,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,UAAU,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAQlG,kCAAkC;IAC5B,eAAe,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAQvG,kCAAkC;IAC5B,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAQlF,sBAAsB;IAChB,cAAc,CAAC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;QAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAQnV,yBAAyB;IACnB,eAAe,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,WAAW,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAQ3G,4BAA4B;IACtB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,WAAW,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAQxF,+BAA+B;IACzB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAQvF,qCAAqC;IAC/B,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CAOrL"}

package/dist/server/client-ip.d.ts

@@ -0,0 +1,39 @@
+export declare const TRUST_PROXY_ENV = "RECORDINGS_TRUST_PROXY";
+export declare const TRUSTED_PROXIES_ENV = "RECORDINGS_TRUSTED_PROXIES";
+/** Reject anything that is not a bare IP literal (optionally bracketed / ported). */
+export declare function normalizeIpLiteral(raw: string | null | undefined): string | null;
+/** Parse and validate `X-Forwarded-For` into bare IP literals, left -> right. */
+export declare function parseForwardedFor(header: string | null | undefined): string[];
+/** Parse the trusted-proxy allowlist: bare IPs and CIDR blocks (v4 + v6). */
+export declare function parseTrustedProxies(raw: string | null | undefined): string[];
+/** True when `ip` is one of the trusted proxies, exactly or inside a CIDR. */
+export declare function isTrustedAddress(ip: string | null | undefined, trusted: readonly string[]): boolean;
+export declare const TRUST_TRUE_VALUES: Set<string>;
+/** Operator opt-in: true only when this service sits behind trusted proxies. */
+export declare function resolveTrustProxy(env?: NodeJS.ProcessEnv): boolean;
+/** Trusted proxy addresses/CIDRs configured by the operator (validated). */
+export declare function trustedProxiesFromEnv(env?: NodeJS.ProcessEnv): string[];
+export interface RequestClientIpInput {
+    headers: Headers;
+    /** Socket peer address, e.g. `server.requestIP(req)?.address`. */
+    socketAddress?: string | null;
+    trustProxy?: boolean;
+    /** Validated entries from `parseTrustedProxies`. */
+    trustedProxies?: readonly string[];
+}
+/**
+ * Resolve the address rate-limit buckets and audit rows are keyed on.
+ *
+ * Trust is OFF by default: forwarding headers are ignored entirely and the
+ * socket peer address is used, so local/dev behavior is unchanged and a
+ * spoofed `x-forwarded-for` can never mint fresh buckets.
+ *
+ * With trust ON the rule is: validated `x-real-ip` (the gateway overwrites it
+ * with the true client IP; direct spoofing is moot because the socket peer is
+ * itself a trusted proxy) -> first untrusted entry of `x-forwarded-for`
+ * counted from the RIGHT (skipping trusted proxies) -> socket peer. Any entry
+ * that is not a bare IP literal is dropped; a header that yields nothing falls
+ * back to the socket peer, which no header can forge.
+ */
+export declare function resolveRequestClientIp(input: RequestClientIpInput): string | null;
+//# sourceMappingURL=client-ip.d.ts.map

package/dist/server/client-ip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-ip.d.ts","sourceRoot":"","sources":["../../src/server/client-ip.ts"],"names":[],"mappings":"AAkCA,eAAO,MAAM,eAAe,2BAA2B,CAAC;AACxD,eAAO,MAAM,mBAAmB,+BAA+B,CAAC;AAEhE,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAyBhF;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAM7E;AA0ED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAY5E;AAWD,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC7B,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAYT;AAED,eAAO,MAAM,iBAAiB,aAAsC,CAAC;AAErE,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE/E;AAED,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CAEpF;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,CAqBjF"}

package/dist/server/cloud-config.d.ts

@@ -2,6 +2,18 @@
 export type DataBackend = "sqlite" | "postgresql";
 /** Resolve the PostgreSQL DSN from the supported env vars (priority order). */
 export declare function resolveDatabaseUrl(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Resolve the PostgreSQL DSN used by the one-shot `migrate` operator verb.
+ *
+ * In the two-role deploy model the MIGRATION role owns the schema (it runs
+ * DDL) while the RUNTIME role (`resolveDatabaseUrl`, used by `/v1` and
+ * `/ready`) is DML-only, so the strict `assertCloudSchemaReady` posture
+ * contract can pass. A dedicated migration DSN is configured via
+ * `HASNA_RECORDINGS_MIGRATE_DATABASE_URL` (or `RECORDINGS_MIGRATE_DATABASE_URL`);
+ * when none is set the migrate falls back to the runtime DSN for
+ * single-role setups.
+ */
+export declare function resolveMigrationDatabaseUrl(env?: NodeJS.ProcessEnv): string | undefined;
 /**
  * The backend this process will use: `postgresql` when a DSN is present,
  * `sqlite` otherwise.

package/dist/server/cloud-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-config.d.ts","sourceRoot":"","sources":["../../src/server/cloud-config.ts"],"names":[],"mappings":"AASA,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,YAAY,CAAC;AAElD,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAO3F;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAEpF;AAED,6DAA6D;AAC7D,wBAAgB,wBAAwB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEtF;AAED,+DAA+D;AAC/D,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAO7F;AAED,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAWjF"}
+{"version":3,"file":"cloud-config.d.ts","sourceRoot":"","sources":["../../src/server/cloud-config.ts"],"names":[],"mappings":"AASA,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,YAAY,CAAC;AAElD,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAO3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAMpG;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAEpF;AAED,6DAA6D;AAC7D,wBAAgB,wBAAwB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEtF;AAED,+DAA+D;AAC/D,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAO7F;AAED,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAWjF"}

package/dist/server/cloud-readiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-readiness.d.ts","sourceRoot":"","sources":["../../src/server/cloud-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAkL9D,sFAAsF;AACtF,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GAC9B,OAAO,CAAC,IAAI,CAAC,CAqHf;AAED,kFAAkF;AAClF,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CAoHf;AAED,gFAAgF;AAChF,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAI7F;AAED,qFAAqF;AACrF,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,CAAC,GACtC,OAAO,CAAC,OAAO,CAAC,CAIlB"}
+{"version":3,"file":"cloud-readiness.d.ts","sourceRoot":"","sources":["../../src/server/cloud-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAoL9D,sFAAsF;AACtF,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GAC9B,OAAO,CAAC,IAAI,CAAC,CAqHf;AAED,kFAAkF;AAClF,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CAsIf;AAED,gFAAgF;AAChF,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAI7F;AAED,qFAAqF;AACrF,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,CAAC,GACtC,OAAO,CAAC,OAAO,CAAC,CAIlB"}

package/dist/server/cloud.d.ts

@@ -14,7 +14,7 @@ import { type ApiKeyVerifier } from "@hasna/contracts/auth";
 import { ApiKeyStore } from "@hasna/contracts/auth";
 import { PgAdapterAsync } from "../db/remote-storage.js";
 export declare const RECORDINGS_APP_SLUG = "recordings";
-export { isPostgresBackendEnabled, resolveDataBackend, requireSigningSecret, resolveDatabaseUrl, resolveSigningSecret, } from "./cloud-config.js";
+export { isPostgresBackendEnabled, resolveDataBackend, requireSigningSecret, resolveDatabaseUrl, resolveMigrationDatabaseUrl, resolveSigningSecret, } from "./cloud-config.js";
 export type { DataBackend } from "./cloud-config.js";
 /** The pure-remote Postgres adapter backing every `/v1` handler. */
 export declare function getCloudPg(): PgAdapterAsync;
@@ -25,12 +25,30 @@ export declare function getApiKeyStore(): ApiKeyStore;
  * `api_keys` table. Fails closed when no signing secret is configured.
  */
 export declare function getCloudVerifier(): ApiKeyVerifier;
+/**
+ * The one-shot migrate operator adapter: resolves the MIGRATION DSN
+ * (`HASNA_RECORDINGS_MIGRATE_DATABASE_URL` / `RECORDINGS_MIGRATE_DATABASE_URL`,
+ * falling back to the runtime DSN). In the two-role deploy model this role
+ * owns the schema (runs DDL); the runtime `DATABASE_URL` role is DML-only.
+ */
+export declare function getMigrationPg(): PgAdapterAsync;
 /**
  * Apply the owner-managed relational and API-key schemas. This is intentionally
  * separate from runtime readiness so it can bootstrap an empty database and
  * upgrade a migration-17 database before the migration-18 contract is checked.
  */
-export declare function migrateCloudSchema(): Promise<void>;
+export declare function migrateCloudSchema(pg?: PgAdapterAsync): Promise<void>;
+/**
+ * One-shot `recordings-serve migrate` orchestration shared by the compiled
+ * server entrypoint and the source `scripts/migrate.ts` runner.
+ *
+ * The schema is applied with the MIGRATION role; the shape contract is then
+ * validated. When a dedicated migration DSN is configured (two-role deploy
+ * model), the RUNTIME role's full DML-only posture is validated afterwards so
+ * a misconfigured runtime role fails here with the exact contract message
+ * instead of surfacing later as an opaque /ready or /v1 503.
+ */
+export declare function runRecordedMigration(): Promise<void>;
 /** Request-path gate: validate the externally managed schema and DML-only role. */
 export declare function ensureCloudSchema(): Promise<void>;
 export declare function pingCloudConnectivity(pg?: Pick<PgAdapterAsync, "get">): Promise<boolean>;

package/dist/server/cloud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/server/cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAwB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAYzD,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAChD,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAOrD,oEAAoE;AACpE,wBAAgB,UAAU,IAAI,cAAc,CAU3C;AAsBD,wBAAgB,cAAc,IAAI,WAAW,CAI5C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,cAAc,CAsBjD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAExD;AAED,mFAAmF;AACnF,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOvD;AAED,wBAAsB,qBAAqB,CACzC,EAAE,GAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAgB,GAC7C,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wEAAwE;AACxE,wBAAsB,SAAS,CAC7B,EAAE,GAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,CAAgB,GACrD,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,4BAA4B;AAC5B,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAMhD"}
+{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/server/cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAwB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAczD,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAChD,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAOrD,oEAAoE;AACpE,wBAAgB,UAAU,IAAI,cAAc,CAU3C;AAqBD,wBAAgB,cAAc,IAAI,WAAW,CAI5C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,cAAc,CAsBjD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,cAAc,CAQ/C;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,GAAE,cAA6B,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzF;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAmB1D;AAED,mFAAmF;AACnF,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOvD;AAED,wBAAsB,qBAAqB,CACzC,EAAE,GAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAgB,GAC7C,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wEAAwE;AACxE,wBAAsB,SAAS,CAC7B,EAAE,GAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,CAAgB,GACrD,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,4BAA4B;AAC5B,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAMhD"}