@hasna/recordings 0.3.13 → 0.5.0

package/dist/cli/index.js

@@ -900,10 +900,10 @@ function collectValues(value, previous) {
 
 // src/cli/index.ts
 import chalk from "chalk";
-import { spawnSync as spawnSync7 } from "child_process";
+import { spawnSync as spawnSync9 } from "child_process";
 import {
   existsSync as existsSync8,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   readdirSync as readdirSync2
 } from "fs";
 import { dirname as dirname5, join as pathJoin } from "path";
@@ -1117,6 +1117,9 @@ var DEFAULT_CONFIG = {
   db_path: "",
   audio_dir: "",
   max_recording_seconds: 1800,
+  s3_bucket: "",
+  s3_prefix: "",
+  s3_region: "",
   config_warnings: []
 };
 function loadConfig(configPath) {
@@ -1143,6 +1146,9 @@ function loadConfig(configPath) {
   if (process.env.RECORDINGS_API_KEY) {
     config.openai_api_key = process.env.RECORDINGS_API_KEY;
   }
+  if (process.env.RECORDINGS_OPENAI_API_KEY) {
+    config.openai_api_key = process.env.RECORDINGS_OPENAI_API_KEY;
+  }
   if (process.env.RECORDINGS_ENHANCEMENT_KEY) {
     config.enhancement_api_key = process.env.RECORDINGS_ENHANCEMENT_KEY;
   }
@@ -1186,14 +1192,26 @@ function loadConfig(configPath) {
   if (process.env.RECORDINGS_AUDIO_DIR) {
     config.audio_dir = process.env.RECORDINGS_AUDIO_DIR;
   }
+  if (process.env.HASNA_RECORDINGS_S3_BUCKET) {
+    config.s3_bucket = process.env.HASNA_RECORDINGS_S3_BUCKET;
+  } else if (process.env.RECORDINGS_S3_BUCKET) {
+    config.s3_bucket = process.env.RECORDINGS_S3_BUCKET;
+  }
+  if (process.env.HASNA_RECORDINGS_S3_PREFIX) {
+    config.s3_prefix = process.env.HASNA_RECORDINGS_S3_PREFIX;
+  } else if (process.env.RECORDINGS_S3_PREFIX) {
+    config.s3_prefix = process.env.RECORDINGS_S3_PREFIX;
+  }
+  if (process.env.RECORDINGS_S3_REGION) {
+    config.s3_region = process.env.RECORDINGS_S3_REGION;
+  } else if (process.env.AWS_REGION) {
+    config.s3_region = process.env.AWS_REGION;
+  }
   if (process.env.RECORDINGS_MAX_SECONDS) {
     config.max_recording_seconds = parseInt(process.env.RECORDINGS_MAX_SECONDS, 10);
   }
-  if (!config.openai_api_key) {
-    config.openai_api_key = loadSecretKey("OPENAI_API_KEY");
-  }
   if (!config.enhancement_api_key) {
-    config.enhancement_api_key = config.openai_api_key || loadSecretKey("OPENAI_API_KEY");
+    config.enhancement_api_key = config.openai_api_key;
   }
   if (!explicitTranscriberModel) {
     config.transcriber_model = config.enhancement_model;
@@ -1373,51 +1391,6 @@ function mergeDirectoryContents(sourceDir, targetDir) {
     }
   }
 }
-function loadSecretKey(keyName) {
-  const secretsPath = join3(getHomeDir(), ".secrets");
-  if (!existsSync2(secretsPath))
-    return "";
-  for (const candidate of listSecretFiles(secretsPath)) {
-    try {
-      const content = readFileSync(candidate, "utf-8");
-      const match = content.match(new RegExp(`export\\s+${keyName}\\s*=\\s*"([^"]+)"`));
-      const doubleQuotedValue = match?.[1];
-      if (doubleQuotedValue !== undefined)
-        return doubleQuotedValue;
-      const match2 = content.match(new RegExp(`export\\s+${keyName}\\s*=\\s*'([^']+)'`));
-      const singleQuotedValue = match2?.[1];
-      if (singleQuotedValue !== undefined)
-        return singleQuotedValue;
-      const match3 = content.match(new RegExp(`${keyName}\\s*=\\s*(.+)`));
-      const unquotedValue = match3?.[1];
-      if (unquotedValue !== undefined)
-        return unquotedValue.trim().replace(/^["']|["']$/g, "");
-    } catch {}
-  }
-  return "";
-}
-function listSecretFiles(path) {
-  try {
-    const stats = statSync(path);
-    if (stats.isFile())
-      return [path];
-    if (!stats.isDirectory())
-      return [];
-    return readdirSync(path).sort().flatMap((entry) => {
-      const child = join3(path, entry);
-      try {
-        const childStats = statSync(child);
-        if (childStats.isDirectory())
-          return listSecretFiles(child);
-        if (childStats.isFile() && child.endsWith(".env"))
-          return [child];
-      } catch {}
-      return [];
-    });
-  } catch {
-    return [];
-  }
-}
 function getHomeDir() {
   return process.env["HOME"] || process.env["USERPROFILE"] || homedir3();
 }
@@ -1547,6 +1520,11 @@ var MIGRATIONS = [
   `,
   `
   ALTER TABLE agents ADD COLUMN active_project_id TEXT REFERENCES projects(id) ON DELETE SET NULL;
+  `,
+  `
+  ALTER TABLE recordings ADD COLUMN audio_object_key TEXT;
+  ALTER TABLE recordings ADD COLUMN audio_sha256 TEXT;
+  ALTER TABLE recordings ADD COLUMN audio_bytes INTEGER;
   `
 ];
 var CURRENT_MIGRATION_LEVEL = MIGRATIONS.length - 1;
@@ -1602,6 +1580,9 @@ function repairSchemaDrift(db) {
   ensureColumn(db, "recordings", "task_list_id", "TEXT");
   ensureColumn(db, "recordings", "machine_id", "TEXT");
   ensureColumn(db, "recordings", "metadata", "TEXT DEFAULT '{}'");
+  ensureColumn(db, "recordings", "audio_object_key", "TEXT");
+  ensureColumn(db, "recordings", "audio_sha256", "TEXT");
+  ensureColumn(db, "recordings", "audio_bytes", "INTEGER");
   ensureColumn(db, "agents", "active_project_id", "TEXT REFERENCES projects(id) ON DELETE SET NULL");
 }
 function ensureColumn(db, table, column, definition) {
@@ -1677,6 +1658,9 @@ function parseRow(row) {
   return {
     id: row["id"],
     audio_path: row["audio_path"] || null,
+    audio_object_key: row["audio_object_key"] || null,
+    audio_sha256: row["audio_sha256"] || null,
+    audio_bytes: Number(row["audio_bytes"] ?? 0) || null,
     raw_text: row["raw_text"],
     processed_text: row["processed_text"] || null,
     processing_mode: row["processing_mode"] || "raw",
@@ -1708,9 +1692,9 @@ function createRecording(input, db, idempotencyKey) {
     }
     const tagsJson = JSON.stringify(input.tags || []);
     const metadataJson = JSON.stringify(input.metadata || {});
-    const insertResult = d.query(`INSERT INTO recordings (id, audio_path, raw_text, processed_text, processing_mode, model_used, enhancement_model, duration_ms, language, tags, agent_id, project_id, session_id, goal, role, task_list_id, machine_id, metadata)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-     ON CONFLICT(id) DO NOTHING`).run(id, input.audio_path || null, input.raw_text, input.processed_text || null, input.processing_mode || "raw", input.model_used || "gpt-4o-transcribe", input.enhancement_model || null, input.duration_ms || 0, input.language || null, tagsJson, input.agent_id || null, input.project_id || null, input.session_id || null, input.goal || null, input.role || null, input.task_list_id || null, input.machine_id || null, metadataJson);
+    const insertResult = d.query(`INSERT INTO recordings (id, audio_path, audio_object_key, audio_sha256, audio_bytes, raw_text, processed_text, processing_mode, model_used, enhancement_model, duration_ms, language, tags, agent_id, project_id, session_id, goal, role, task_list_id, machine_id, metadata)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(id) DO NOTHING`).run(id, input.audio_path || null, input.audio_object_key || null, input.audio_sha256 || null, input.audio_bytes || null, input.raw_text, input.processed_text || null, input.processing_mode || "raw", input.model_used || "gpt-4o-transcribe", input.enhancement_model || null, input.duration_ms || 0, input.language || null, tagsJson, input.agent_id || null, input.project_id || null, input.session_id || null, input.goal || null, input.role || null, input.task_list_id || null, input.machine_id || null, metadataJson);
     if (insertResult.changes === 0) {
       const existing = getRecording(id, d);
       if (existing?.id === id)
@@ -1727,6 +1711,13 @@ function createRecording(input, db, idempotencyKey) {
   });
   return create();
 }
+function updateRecordingAudio(id, audioObjectKey, audioSha256, audioBytes, db) {
+  const d = db || getDatabase();
+  const result = d.query(`UPDATE recordings SET audio_object_key = ?, audio_sha256 = ?, audio_bytes = ? WHERE id = ?`).run(audioObjectKey, audioSha256, audioBytes, id);
+  if (result.changes === 0)
+    return null;
+  return getRecording(id, d);
+}
 function getRecording(id, db) {
   const d = db || getDatabase();
   let row = d.query("SELECT * FROM recordings WHERE id = ?").get(id);
@@ -1928,7 +1919,7 @@ function setAgentFocus(idOrName, projectId, db) {
 // package.json
 var package_default = {
   name: "@hasna/recordings",
-  version: "0.3.13",
+  version: "0.5.0",
   type: "module",
   description: "Speech-to-text recording tool with MCP and CLI \u2014 records, transcribes, and optionally enhances text using AI",
   repository: {
@@ -1954,6 +1945,19 @@ var package_default = {
     "./sdk": {
       import: "./dist/sdk/index.js",
       types: "./dist/sdk/index.d.ts"
+    },
+    "./contracts/hosted-v1": {
+      import: "./dist/contracts/hosted-v1.js",
+      types: "./dist/contracts/hosted-v1.d.ts"
+    },
+    "./contracts/stream-v1": {
+      import: "./dist/contracts/stream-v1.js",
+      types: "./dist/contracts/stream-v1.d.ts"
+    },
+    "./contracts/fixtures/v1": "./contracts/v1/fixtures.json",
+    "./hosted": {
+      import: "./dist/hosted/index.js",
+      types: "./dist/hosted/index.d.ts"
     }
   },
   engines: {
@@ -1962,20 +1966,20 @@ var package_default = {
   scripts: {
     clean: "rm -rf dist",
     build: "bun run clean && bun run build:cli && bun run build:mcp && bun run build:serve && bun run build:lib && tsc --emitDeclarationOnly --outDir dist",
-    "build:cli": "bun build src/cli/index.ts --target=bun --outfile=dist/cli/index.js --external=commander --external=chalk --external=openai",
-    "build:mcp": "bun build src/mcp/index.ts --target=bun --outfile=dist/mcp/index.js --external=@modelcontextprotocol/sdk --external=openai",
-    "build:serve": "bun build src/server/index.ts --target=bun --outfile=dist/server/index.js --external=@modelcontextprotocol/sdk --external=@hasna/contracts --external=openai --external=pg",
-    "build:lib": "bun build src/index.ts src/storage.ts src/sdk/index.ts --target=bun --outdir=dist --external=openai",
+    "build:cli": "bun build src/cli/index.ts --target=bun --outfile=dist/cli/index.js --external=commander --external=chalk --external=openai --external=@aws-sdk/client-s3",
+    "build:mcp": "bun build src/mcp/index.ts --target=bun --outfile=dist/mcp/index.js --external=@modelcontextprotocol/sdk --external=openai --external=@aws-sdk/client-s3",
+    "build:serve": "bun build src/server/index.ts --target=bun --outfile=dist/server/index.js --external=@modelcontextprotocol/sdk --external=@hasna/contracts --external=openai --external=pg --external=@aws-sdk/client-s3",
+    "build:lib": "bun build src/index.ts src/storage.ts src/sdk/index.ts --target=bun --outdir=dist --external=openai --external=@aws-sdk/client-s3 && bun run build:contracts",
     "build:native-fs-guard": "/bin/bash scripts/build_native_fs_guard.sh",
     "generate:sdk": "bun run scripts/generate-sdk.ts",
     migrate: "bun run scripts/migrate.ts",
     typecheck: "tsc --noEmit",
     "typecheck:tcc-contract": "tsc --noEmit -p tsconfig.tcc-contract.json",
-    test: "bun test",
+    test: "bun scripts/release-suite-gate.ts --all",
     "verify:ci-suite": "bun scripts/ci-linux-suite.ts --check",
     "verify:ci-suite:run": "bun scripts/ci-linux-suite.ts --verify-run",
     "verify:ci-native": "bun scripts/ci-native-build.ts",
-    "test:gated": 'bun scripts/ci-linux-suite.ts --check && RECORDINGS_TEST_TIMEOUT_MS="${RECORDINGS_TEST_TIMEOUT_MS:-120000}" bun test --timeout "$RECORDINGS_TEST_TIMEOUT_MS" $(bun scripts/ci-linux-suite.ts --gated)',
+    "test:gated": "bun scripts/release-suite-gate.ts",
     "test:vacuity-battery": 'bun scripts/vacuity-manifest-gen.ts > "${TMPDIR:-/tmp}/vacuity-corrupt-sites.tsv" && bun scripts/vacuity-mutation-battery.ts "${TMPDIR:-/tmp}/vacuity-corrupt-sites.tsv"',
     "test:vacuity-battery:source": "bun scripts/vacuity-mutation-battery.ts scripts/vacuity-manifests/source-side.tsv",
     "test:vacuity-battery:chain": "bun scripts/vacuity-mutation-battery.ts scripts/vacuity-manifests/install-chain.tsv",
@@ -1993,11 +1997,16 @@ var package_default = {
     "prepack:platform-gate": `bash -c 'if [ "$(uname -s)" = Darwin ]; then bun run build:native-fs-guard; else echo "WARN: native fs-guard build skipped on $(uname -s) \u2014 dry-run/CI pack; publish recordings from macOS"; fi'`,
     prepublishOnly: "bun run typecheck && bun run release-suite-gate",
     "release-suite-gate": "bun run scripts/release-suite-gate.ts",
-    "typecheck:shortcut-contract": "tsc --noEmit -p tsconfig.test.json"
+    "typecheck:shortcut-contract": "tsc --noEmit -p tsconfig.test.json",
+    "build:contracts": "bun build src/contracts/hosted-v1.ts src/contracts/stream-v1.ts src/hosted/index.ts --target=bun --root src --outdir=dist --splitting --external=@hasna/contracts"
   },
   files: [
     "dist/",
+    "!dist/__tests__/",
     "scripts/",
+    "!scripts/test-recorder-fixtures.ts",
+    "!scripts/**/__pycache__/",
+    "!scripts/**/*.pyc",
     "Dockerfile.package",
     "bun.lock",
     "src/native/Recordings/App/",
@@ -2009,10 +2018,14 @@ var package_default = {
     "src/native/Recordings/build.sh",
     "packaging/macos/",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "contracts/v1/fixtures.json",
+    "docs/wire-contracts.md",
+    "docs/hosted-sdk.md"
   ],
   dependencies: {
-    "@hasna/contracts": "0.14.1",
+    "@aws-sdk/client-s3": "^3.1007.0",
+    "@hasna/contracts": "1.0.2",
     "@hasna/events": "0.1.11",
     "@modelcontextprotocol/sdk": "^1.12.1",
     chalk: "^5.4.1",
@@ -2022,7 +2035,7 @@ var package_default = {
     zod: "^3.24.2"
   },
   devDependencies: {
-    "@types/bun": "^1.2.5",
+    "@types/bun": "1.3.14",
     "@types/pg": "^8.11.11",
     "node-api-headers": "1.9.0",
     typescript: "^5.8.2"
@@ -2046,8 +2059,12 @@ function saveFeedback(input) {
 
 // ../contracts/dist/client/transport.js
 import { isIP } from "net";
-import { readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import { join as join4 } from "path";
+import { spawnSync as spawnSync2 } from "child_process";
+import { closeSync, fstatSync, openSync, readFileSync as readFileSync2 } from "fs";
+import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
+import { createRequire } from "module";
+import { hostname as osHostname } from "os";
+import { isAbsolute as isAbsolute2, join as join4 } from "path";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
@@ -2062,6 +2079,9 @@ function credentialOverrideEnvKey(name) {
   return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
 }
 var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE";
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
 
 class CredentialResolutionError extends Error {
   appName;
@@ -2073,34 +2093,70 @@ class CredentialResolutionError extends Error {
     this.attempted = attempted;
   }
 }
-var HASNA_STATE_DIR = ".hasna";
-var FLEET_CREDENTIAL_DIR = "cloud";
-var CONFIG_DIR = ".config";
-var CONFIG_NAMESPACE = "hasna";
+
+class CredentialFileUnsafeError extends Error {
+  path;
+  constructor(path, reason) {
+    super(`Refusing unsafe credential/config file ${path}: ${reason}.`);
+    this.name = "CredentialFileUnsafeError";
+    this.path = path;
+  }
+}
+var HASNA_HOME_ENV_KEY = "HASNA_HOME";
+var HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME";
+var KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION";
+var HASNA_HOME_DIR = ".hasna";
+var CONFIG_SUBDIR = "config";
+var CREDENTIALS_FILE = "credentials";
+var KEYCHAIN_SECURITY_BIN = "/usr/bin/security";
+var KEYCHAIN_SERVICE_PREFIX = "hasna.credentials";
+var KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44;
+var KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4;
 var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
 var SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 var SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
 var ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+var VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
 function homeDir(env) {
   const home = env.HOME?.trim();
   return home ? home : null;
 }
-function credentialDiskSources(name, env) {
-  return profileDiskSources(name, env, null);
+function absoluteOverride(env, key) {
+  const value = env[key]?.trim();
+  return value && isAbsolute2(value) ? value : null;
 }
-function profileDiskSources(name, env, profile) {
+function hasnaHomeDir(env) {
+  const override = absoluteOverride(env, HASNA_HOME_ENV_KEY);
+  if (override)
+    return override;
   const home = homeDir(env);
-  if (!home || !SAFE_APP_SLUG.test(name))
+  return home ? join4(home, HASNA_HOME_DIR) : null;
+}
+function appConfigDir(name, env) {
+  const configRoot = absoluteOverride(env, HASNA_CONFIG_HOME_ENV_KEY);
+  if (configRoot)
+    return join4(configRoot, name);
+  const root = hasnaHomeDir(env);
+  return root ? join4(root, name, CONFIG_SUBDIR) : null;
+}
+function credentialDiskSourceList(name, env, profile = null) {
+  if (!SAFE_APP_SLUG.test(name))
     return [];
-  const stem = profile ? `${name}.${profile}` : name;
-  const configStem = profile ? `${name}-${profile}` : name;
-  return [
-    join4(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
-    join4(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`)
-  ];
+  const directory = appConfigDir(name, env);
+  if (!directory)
+    return [];
+  const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
+  return [{ path: join4(directory, file), tier: "disk" }];
+}
+function credentialDiskSources(name, env) {
+  return credentialDiskSourceList(name, env, null).map((s) => s.path);
+}
+function profileDiskSources(name, env, profile) {
+  return credentialDiskSourceList(name, env, profile).map((s) => s.path);
 }
 function parseEnvFile(text) {
   const values = new Map;
+  const unusable = new Set;
   for (const rawLine of text.split(/\r?\n/)) {
     const line = rawLine.trim();
     if (line.length === 0 || line.startsWith("#"))
@@ -2115,38 +2171,81 @@ function parseEnvFile(text) {
     let value = withoutExport.slice(equals + 1).trim();
     const quote = value[0];
     if (quote === '"' || quote === "'") {
-      if (value.length < 2 || !value.endsWith(quote))
+      if (value.length < 2 || !value.endsWith(quote)) {
+        unusable.add(key);
         continue;
+      }
       value = value.slice(1, -1);
     }
-    if (value.length === 0)
+    if (value.trim().length === 0) {
+      unusable.add(key);
       continue;
+    }
+    if (values.has(key) && values.get(key) !== value)
+      unusable.add(key);
     values.set(key, value);
   }
-  return values;
+  return { values, unusable };
+}
+function configFileModeAllowed(mode) {
+  const permissions = mode & 4095;
+  return permissions === 256 || permissions === 384;
+}
+function configFileReadsCoherent(before, after) {
+  return before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs;
 }
 function readAppConfigFile(path) {
-  let text;
+  const unsafe = (reason) => {
+    throw new CredentialFileUnsafeError(path, reason);
+  };
+  let fd = -1;
   try {
-    const stats = statSync2(path);
-    if (!stats.isFile() || stats.size > MAX_CREDENTIAL_FILE_BYTES)
+    fd = openSync(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR")
       return null;
-    text = readFileSync2(path, "utf8");
-  } catch {
-    return null;
+    if (code === "ELOOP")
+      unsafe("the path is a symlink");
+    unsafe(`the path could not be opened (${code ?? "unknown error"})`);
+  }
+  try {
+    const before = fstatSync(fd);
+    if (!before.isFile())
+      unsafe("the path is not a regular file");
+    if (!configFileModeAllowed(before.mode)) {
+      unsafe(`permission mode ${(before.mode & 4095).toString(8).padStart(4, "0")} is not owner-only 0400 or 0600`);
+    }
+    const uid = process.getuid?.() ?? process.geteuid?.();
+    if (uid !== undefined && before.uid !== uid)
+      unsafe("the file is not owned by the current user");
+    if (before.size > MAX_CREDENTIAL_FILE_BYTES)
+      unsafe("the file exceeds the size limit");
+    const bytes = readFileSync2(fd);
+    const after = fstatSync(fd);
+    if (!configFileReadsCoherent(before, after)) {
+      unsafe("the file changed while being read");
+    }
+    return parseEnvFile(bytes.toString("utf8"));
+  } finally {
+    if (fd !== -1)
+      closeSync(fd);
   }
-  return parseEnvFile(text);
 }
 function readCredentialFile(path, apiKeyKeys) {
-  const values = readAppConfigFile(path);
-  if (!values)
+  const parsed = readAppConfigFile(path);
+  if (!parsed)
     return null;
   for (const key of apiKeyKeys) {
-    const value = values.get(key)?.trim();
-    if (value)
-      return value;
+    if (parsed.unusable.has(key)) {
+      throw new CredentialFileUnsafeError(path, `${key} is declared but blank or malformed`);
+    }
   }
-  return null;
+  const values = apiKeyKeys.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+  if (new Set(values).size > 1) {
+    throw new CredentialFileUnsafeError(path, "credential aliases disagree");
+  }
+  return values[0] ?? null;
 }
 var CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
 function appConfigDiskValue(name, env, keys) {
@@ -2154,11 +2253,19 @@ function appConfigDiskValue(name, env, keys) {
   if (wanted.length === 0)
     return null;
   for (const path of credentialDiskSources(name, env)) {
-    const values = readAppConfigFile(path);
-    if (!values)
+    const parsed = readAppConfigFile(path);
+    if (!parsed)
       continue;
+    if (wanted.some((key) => parsed.unusable.has(key))) {
+      return { key: wanted.find((key) => parsed.unusable.has(key)), value: "", path, unusable: true };
+    }
+    const values = wanted.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+    if (new Set(values).size > 1)
+      throw new CredentialFileUnsafeError(path, "configuration aliases disagree");
     for (const key of wanted) {
-      const value = values.get(key)?.trim();
+      if (parsed.unusable.has(key))
+        return { key, value: "", path, unusable: true };
+      const value = parsed.values.get(key)?.trim();
       if (value)
         return { key, value, path };
     }
@@ -2166,20 +2273,21 @@ function appConfigDiskValue(name, env, keys) {
   return null;
 }
 function assertUsableCredential(appName, source, value) {
+  if (VAULT_POINTER_SHAPE.test(value)) {
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
   if (!ILLEGAL_IN_HEADER_VALUE.test(value))
     return;
   throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
 }
 var INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
 var CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
-var CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE = "caller-supplied CredentialProvider";
 function sealCredential(fields) {
   const { apiKey } = fields;
   const visible = {
     tier: fields.tier,
     source: fields.source,
     deliberate: fields.deliberate,
-    deprecated: fields.deprecated,
     diskCandidates: Object.freeze([...fields.diskCandidates]),
     warning: fields.warning
   };
@@ -2190,6 +2298,14 @@ function sealCredential(fields) {
     writable: false,
     configurable: false
   });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
   Object.defineProperty(sealed, INSPECT_CUSTOM, {
     value: () => ({ ...visible, apiKey: "[redacted]" }),
     enumerable: false,
@@ -2204,88 +2320,142 @@ function sealCredential(fields) {
   });
   return Object.freeze(sealed);
 }
-function isSealedCredential(credential) {
-  return credential[CREDENTIAL_SEAL] === true;
-}
-function explicitCredential(appName, apiKey) {
-  const source = "explicit apiKey option";
-  assertUsableCredential(appName, source, apiKey);
-  return sealCredential({
-    apiKey,
-    tier: "argument",
-    source,
-    deliberate: true,
-    deprecated: false,
-    diskCandidates: [],
-    warning: null
-  });
-}
-function validateAndSealResolvedCredential(appName, credential) {
-  const apiKey = credential.apiKey;
-  assertUsableCredential(appName, CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE, apiKey);
-  if (!isSealedCredential(credential)) {
-    return sealCredential({
-      apiKey,
-      tier: "argument",
-      source: CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE,
-      deliberate: true,
-      deprecated: false,
-      diskCandidates: [],
-      warning: null
-    });
-  }
-  return sealCredential({
-    apiKey,
-    tier: credential.tier,
-    source: credential.source,
-    deliberate: credential.deliberate,
-    deprecated: credential.deprecated,
-    diskCandidates: credential.diskCandidates,
-    warning: credential.warning
-  });
-}
 function firstEnvValue(env, keys) {
   for (const key of keys) {
+    if (!Object.prototype.hasOwnProperty.call(env, key))
+      continue;
     const value = env[key]?.trim();
     if (value)
       return { key, value };
   }
   return null;
 }
-var DEPRECATION_REGISTRY = Symbol.for("hasna:contracts:credentialDeprecationNotices");
-function deprecationNotified() {
-  const host = globalThis;
-  const existing = host[DEPRECATION_REGISTRY];
-  if (existing instanceof Set)
-    return existing;
-  const created = new Set;
-  host[DEPRECATION_REGISTRY] = created;
-  return created;
-}
-function defaultDeprecationSink(message) {
-  if (typeof process !== "undefined" && process.stderr) {
-    process.stderr.write(`${message}
-`);
+var AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+function isAmbientEnvironment(env) {
+  return env === process.env || env[AMBIENT_ENVIRONMENT] === true;
+}
+function defaultKeychainRunner(argv) {
+  const result = spawnSync2(KEYCHAIN_SECURITY_BIN, [...argv], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: KEYCHAIN_SPAWN_TIMEOUT_MS
+  });
+  return {
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.error ? result.error.message : result.stderr ?? ""
+  };
+}
+function keychainTierEnabled(env, options) {
+  if ((options.platform ?? process.platform) !== "darwin")
+    return false;
+  if (options.enabled !== undefined)
+    return options.enabled;
+  return options.run !== undefined || isAmbientEnvironment(env);
+}
+function keychainAccount(env, options) {
+  const station = env[KEYCHAIN_STATION_ENV_KEY]?.trim();
+  if (station)
+    return station;
+  const host = (options.hostname ?? osHostname)().split(".")[0]?.trim() ?? "";
+  if (host)
+    return host;
+  const user = env.USER?.trim();
+  return user || null;
+}
+function keychainFailureHint(text) {
+  const line = text.split(/\r?\n/).find((entry) => entry.trim().length > 0)?.trim() ?? "";
+  const clean = line.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 200);
+  return clean ? `: ${clean}` : "";
+}
+function readKeychainItem(name, env, kind, options) {
+  if (!SAFE_APP_SLUG.test(name) || !keychainTierEnabled(env, options))
+    return null;
+  const account = keychainAccount(env, options);
+  if (!account)
+    return null;
+  const service = `${KEYCHAIN_SERVICE_PREFIX}.${name}.${kind}`;
+  const source = `keychain:${service}@${account}`;
+  const run = options.run ?? defaultKeychainRunner;
+  let result;
+  try {
+    result = run(["find-generic-password", "-a", account, "-s", service, "-w"]);
+  } catch (error) {
+    const reason = keychainFailureHint(error instanceof Error ? error.message : String(error));
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} could not run${reason}. A Keychain failure is never resolved ` + `around: fix the keychain, or delete the item to fall through to the credential on disk.`, [source]);
   }
+  if (result.status === KEYCHAIN_ITEM_NOT_FOUND_STATUS)
+    return null;
+  if (result.status !== 0) {
+    throw new CredentialResolutionError(name, `The Keychain lookup for ${source} failed (security exited ` + `${result.status ?? "without a status"}${keychainFailureHint(result.stderr)}). A Keychain item that ` + `exists but cannot be read is never resolved around: unlock the keychain, run from a session that ` + `may use it, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  const value = result.stdout.trim();
+  if (!value) {
+    throw new CredentialResolutionError(name, `${source} exists but holds an empty value; a declared item never falls through to another ` + `identity. Store a value in it or delete the item.`, [source]);
+  }
+  return { value, source };
+}
+function keychainConfigValue(name, env, options = {}) {
+  return readKeychainItem(name, env, "api-url", options);
+}
+function snapshotClientEnvironment(name, env) {
+  const keys = clientTransportEnvKeys(name);
+  const ambient = isAmbientEnvironment(env);
+  const snapshot = Object.create(null);
+  for (const key of [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey(name),
+    credentialPointerEnvKey(name),
+    CREDENTIAL_PROFILE_ENV_KEY,
+    "HOME",
+    HASNA_HOME_ENV_KEY,
+    HASNA_CONFIG_HOME_ENV_KEY,
+    KEYCHAIN_STATION_ENV_KEY,
+    "USER"
+  ]) {
+    const descriptor = Object.getOwnPropertyDescriptor(env, key);
+    if (!descriptor)
+      continue;
+    if (!("value" in descriptor)) {
+      throw new CredentialResolutionError(name, `${key} is accessor-backed; client configuration requires own data properties.`, [key]);
+    }
+    if (descriptor.value !== undefined && typeof descriptor.value !== "string") {
+      throw new CredentialResolutionError(name, `${key} must be a string data property.`, [key]);
+    }
+    snapshot[key] = descriptor.value;
+  }
+  if (ambient) {
+    Object.defineProperty(snapshot, AMBIENT_ENVIRONMENT, {
+      value: true,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  return Object.freeze(snapshot);
 }
 function resolveCredential(name, env, options = {}) {
+  env = snapshotClientEnvironment(name, env);
   const { apiKeyKeys } = clientTransportEnvKeys(name);
   const diskPaths = credentialDiskSources(name, env);
-  const explicitKey = options.apiKey?.trim();
-  if (explicitKey) {
+  if (options.apiKey !== undefined) {
+    const explicitKey = options.apiKey.trim();
+    if (!explicitKey) {
+      throw new CredentialResolutionError(name, "The explicit apiKey argument is blank; an explicit credential never falls through to another identity.", ["explicit apiKey argument"]);
+    }
     assertUsableCredential(name, "the explicit apiKey argument", explicitKey);
     return sealCredential({
       apiKey: explicitKey,
       tier: "argument",
       source: "explicit apiKey argument",
       deliberate: true,
-      deprecated: false,
       diskCandidates: diskPaths,
       warning: null
     });
   }
   const overrideKeyName = credentialOverrideEnvKey(name);
-  const overrideRaw = env[overrideKeyName];
+  const overrideRaw = Object.prototype.hasOwnProperty.call(env, overrideKeyName) ? env[overrideKeyName] : undefined;
   if (overrideRaw !== undefined) {
     const override = overrideRaw.trim();
     if (!override) {
@@ -2297,12 +2467,38 @@ function resolveCredential(name, env, options = {}) {
       tier: "override",
       source: overrideKeyName,
       deliberate: true,
-      deprecated: false,
       diskCandidates: diskPaths,
       warning: null
     });
   }
-  const profile = options.profile?.trim() || env[CREDENTIAL_PROFILE_ENV_KEY]?.trim();
+  const pointerKeyName = credentialPointerEnvKey(name);
+  const pointerRaw = Object.prototype.hasOwnProperty.call(env, pointerKeyName) ? env[pointerKeyName] : undefined;
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE.test(pointer)) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  if (options.profile !== undefined && !options.profile.trim()) {
+    throw new CredentialResolutionError(name, "The explicit profile argument is blank; an explicit identity selection never falls through.", ["explicit profile argument"]);
+  }
+  const profileRaw = Object.prototype.hasOwnProperty.call(env, CREDENTIAL_PROFILE_ENV_KEY) ? env[CREDENTIAL_PROFILE_ENV_KEY] : undefined;
+  if (profileRaw !== undefined && !profileRaw.trim()) {
+    throw new CredentialResolutionError(name, `${CREDENTIAL_PROFILE_ENV_KEY} is set but blank.`, [CREDENTIAL_PROFILE_ENV_KEY]);
+  }
+  const profile = options.profile?.trim() || profileRaw?.trim();
   if (profile) {
     const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
     if (!SAFE_PROFILE.test(profile)) {
@@ -2318,7 +2514,6 @@ function resolveCredential(name, env, options = {}) {
           tier: "profile",
           source: path,
           deliberate: true,
-          deprecated: false,
           diskCandidates: paths,
           warning: null
         });
@@ -2326,51 +2521,67 @@ function resolveCredential(name, env, options = {}) {
     }
     throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
   }
-  const diskHits = diskPaths.map((path) => ({ path, value: readCredentialFile(path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  const definedEnvEntries = apiKeyKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, value: String(env[key]).trim() }));
+  const blankEnv = definedEnvEntries.find((entry) => entry.value.length === 0);
+  if (blankEnv) {
+    throw new CredentialResolutionError(name, `${blankEnv.key} is set but blank; a declared credential never falls through to another alias or identity.`, [blankEnv.key]);
+  }
+  if (definedEnvEntries.length > 1 && new Set(definedEnvEntries.map((entry) => entry.value)).size > 1) {
+    throw new CredentialResolutionError(name, `${definedEnvEntries.map((entry) => entry.key).join(" and ")} disagree; credential aliases must be identical or only one may be set.`, definedEnvEntries.map((entry) => entry.key));
+  }
+  const envHit = firstEnvValue(env, apiKeyKeys);
+  const keychainHit = readKeychainItem(name, env, "api-key", options.keychain ?? {});
+  if (keychainHit) {
+    assertUsableCredential(name, keychainHit.source, keychainHit.value);
+    const warning = envHit && envHit.value !== keychainHit.value ? `Credential sources disagree for '${name}': ${keychainHit.source} and ${envHit.key} hold ` + `different keys. ${keychainHit.source} wins, because the Keychain is re-read on every call while ` + `an environment variable is a snapshot. Reconcile them \u2014 a rotation that updated only one leaves ` + `the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: keychainHit.value,
+      tier: "keychain",
+      source: keychainHit.source,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  const diskSourceList = credentialDiskSourceList(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
   if (diskHits.length > 0) {
     const winner = diskHits[0];
-    assertUsableCredential(name, winner.path, winner.value);
+    assertUsableCredential(name, winner.src.path, winner.value);
     const divergentSources = [
-      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.path),
-      ...(() => {
-        const legacyHit = firstEnvValue(env, apiKeyKeys);
-        return legacyHit && legacyHit.value !== winner.value ? [legacyHit.key] : [];
-      })()
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
+      ...envHit && envHit.value !== winner.value ? [envHit.key] : []
     ];
-    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
     return sealCredential({
       apiKey: winner.value,
-      tier: "disk",
-      source: winner.path,
+      tier: winner.src.tier,
+      source: winner.src.path,
       deliberate: false,
-      deprecated: false,
       diskCandidates: diskPaths,
       warning
     });
   }
-  const legacy = firstEnvValue(env, apiKeyKeys);
-  if (legacy) {
-    assertUsableCredential(name, legacy.key, legacy.value);
-    const where = diskPaths.length > 0 ? `Put the current key in ${diskPaths[0]} \u2014 it is re-read on every call, so rotations take effect immediately.` : `This environment has no HOME, so no credential file could be consulted at all; the disk tier is ` + `unavailable here and this process will keep using the environment snapshot.`;
-    const message = `[${name}] DEPRECATED: the API key came from ${legacy.key} in this process's environment. ` + `Environment variables are a snapshot taken when this process started, so a shell that started ` + `before a key rotation keeps using the old key until it exits. ${where}`;
-    const sink = options.onDeprecation ?? defaultDeprecationSink;
-    const notified = deprecationNotified();
-    if (!notified.has(name)) {
-      notified.add(name);
-      sink(message);
-    }
+  if (envHit) {
+    assertUsableCredential(name, envHit.key, envHit.value);
     return sealCredential({
-      apiKey: legacy.value,
-      tier: "legacy-env",
-      source: legacy.key,
+      apiKey: envHit.value,
+      tier: "env",
+      source: envHit.key,
       deliberate: false,
-      deprecated: true,
       diskCandidates: diskPaths,
-      warning: message
+      warning: null
     });
   }
   return null;
 }
+var SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+var requireSecretsSdk = createRequire(import.meta.url);
+var DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com";
+var DEFAULT_AUTHORITY_SOURCE = "default";
+function defaultFleetGatewayBaseUrl(name) {
+  return `${DEFAULT_FLEET_GATEWAY_ORIGIN}/${validateAppSlug(name)}`;
+}
 var ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
 var DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 function isValidDnsDomain(value) {
@@ -2379,23 +2590,835 @@ function isValidDnsDomain(value) {
   }
   return value.split(".").every((label) => label.length <= 63 && !label.startsWith("xn--") && DNS_LABEL_PATTERN.test(label));
 }
-function firstEnv(env, keys, options = {}) {
-  for (const key of keys) {
-    const raw = env[key];
-    const value = raw?.trim();
-    if (value)
-      return { key, value: options.preserveRaw ? raw : value };
+function validateAppSlug(name) {
+  if (name.length > 63 || !DNS_LABEL_PATTERN.test(name)) {
+    throw new Error("App name must be one lowercase DNS label.");
+  }
+  return name;
+}
+function rawAuthority(value) {
+  const match = /^[a-z][a-z0-9+.-]*:\/\//i.exec(value);
+  if (!match)
+    throw new Error("API URL must be absolute.");
+  const afterScheme = value.slice(match[0].length);
+  const boundary = afterScheme.search(/[/?#]/);
+  const authority = boundary === -1 ? afterScheme : afterScheme.slice(0, boundary);
+  if (!authority)
+    throw new Error("API URL must include a hostname.");
+  return authority;
+}
+function assertCanonicalPort(port) {
+  if (!/^[0-9]+$/.test(port) || port.length > 1 && port.startsWith("0")) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
+  }
+  const numericPort = Number(port);
+  if (!Number.isSafeInteger(numericPort) || numericPort < 1 || numericPort > 65535) {
+    throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
+  }
+}
+function canonicalAuthorityHostname(authority) {
+  let rawHostname;
+  if (authority.startsWith("[")) {
+    const closingBracket = authority.indexOf("]");
+    if (closingBracket === -1) {
+      throw new Error("API URL authority must contain a canonical hostname.");
+    }
+    rawHostname = authority.slice(0, closingBracket + 1);
+    const portSuffix = authority.slice(closingBracket + 1);
+    if (portSuffix) {
+      if (!portSuffix.startsWith(":")) {
+        throw new Error("API URL authority must contain a canonical hostname and port.");
+      }
+      assertCanonicalPort(portSuffix.slice(1));
+    }
+    if (isIP(rawHostname.slice(1, -1)) !== 6) {
+      throw new Error("API URL authority must contain a canonical IPv6 literal.");
+    }
+  } else {
+    const firstColon = authority.indexOf(":");
+    const lastColon = authority.lastIndexOf(":");
+    if (firstColon !== lastColon) {
+      throw new Error("IPv6 API URL authorities must use brackets.");
+    }
+    if (lastColon !== -1) {
+      const port = authority.slice(lastColon + 1);
+      assertCanonicalPort(port);
+      rawHostname = authority.slice(0, lastColon);
+    } else {
+      rawHostname = authority;
+    }
+    const ipVersion = isIP(rawHostname);
+    const numericAddressParts = rawHostname.split(".");
+    const looksLikeNonCanonicalIpv4 = numericAddressParts.every((part) => /^(?:0x[0-9a-f]+|[0-9]+)$/i.test(part));
+    if (ipVersion !== 4 && looksLikeNonCanonicalIpv4 || ipVersion !== 4 && !isValidDnsDomain(rawHostname.toLowerCase())) {
+      throw new Error("API URL authority must contain a canonical ASCII hostname.");
+    }
+  }
+  return rawHostname.toLowerCase();
+}
+function isDeliberateLoopbackHttpAuthority(authority) {
+  return /^(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?$/i.test(authority);
+}
+function toV1BaseUrl(apiUrl) {
+  if (ASCII_CONTROL_PATTERN.test(apiUrl)) {
+    throw new Error("API URL must not contain ASCII control characters.");
+  }
+  const input = apiUrl.trim();
+  const authority = rawAuthority(input);
+  if (authority.includes("@") || authority.includes("\\") || authority.includes("%") || /[^\x00-\x7f]/.test(authority)) {
+    throw new Error("API URL authority must be canonical ASCII without credentials.");
+  }
+  const canonicalHostname = canonicalAuthorityHostname(authority);
+  const url = new URL(input);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("API URL must use http or https.");
+  }
+  if (url.username || url.password) {
+    throw new Error("API URL must not include credentials.");
+  }
+  if (!url.hostname || url.hostname.endsWith(".")) {
+    throw new Error("API URL must include a canonical hostname.");
+  }
+  if (url.hostname.toLowerCase() !== canonicalHostname) {
+    throw new Error("API URL authority must not rely on parser hostname normalization.");
+  }
+  if (url.hostname.split(".").some((label) => label.toLowerCase().startsWith("xn--"))) {
+    throw new Error("API URL must not use IDN or punycode hostnames.");
+  }
+  if (url.protocol === "http:" && !isDeliberateLoopbackHttpAuthority(authority)) {
+    throw new Error("API URL may use http only for an exact loopback authority.");
+  }
+  if (url.search || url.hash) {
+    throw new Error("API URL must not include a query string or fragment.");
+  }
+  let path = url.pathname.replace(/\/+$/, "");
+  if (path.endsWith("/v1"))
+    path = path.slice(0, -"/v1".length);
+  url.pathname = `${path}/v1`;
+  return url.toString().replace(/\/+$/, "");
+}
+class ClientTransportConfigurationError extends Error {
+  appName;
+  sources;
+  constructor(appName, message, sources = []) {
+    super(message);
+    this.name = "ClientTransportConfigurationError";
+    this.appName = appName;
+    this.sources = Object.freeze([...sources]);
+  }
+}
+function resolveClientTransportSnapshot(name, env = process.env, options = {}) {
+  env = snapshotClientEnvironment(name, env);
+  const keys = clientTransportEnvKeys(name);
+  const definedUrlEntries = keys.apiUrlKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, raw: String(env[key]) }));
+  const blankUrl = definedUrlEntries.find((entry) => entry.raw.trim().length === 0);
+  if (blankUrl) {
+    throw new ClientTransportConfigurationError(name, `${blankUrl.key} is set but blank; public clients require an explicit HTTPS API URL and never select local storage.`, [blankUrl.key]);
+  }
+  const controlledUrl = definedUrlEntries.find((entry) => ASCII_CONTROL_PATTERN.test(entry.raw));
+  if (controlledUrl) {
+    throw new ClientTransportConfigurationError(name, `${controlledUrl.key} contains ASCII control characters.`, [controlledUrl.key]);
+  }
+  const usableUrlEntries = definedUrlEntries.map((entry) => ({ key: entry.key, value: entry.raw.trim() }));
+  if (usableUrlEntries.length > 1 && new Set(usableUrlEntries.map((entry) => entry.value)).size > 1) {
+    throw new ClientTransportConfigurationError(name, `${usableUrlEntries.map((entry) => entry.key).join(" and ")} disagree; client authority aliases must be identical or only one may be set.`, usableUrlEntries.map((entry) => entry.key));
+  }
+  const envUrlHit = usableUrlEntries[0] ?? null;
+  const keychainUrlHit = keychainConfigValue(name, env, options.credentials?.keychain);
+  const diskConfigUrlHit = appConfigDiskValue(name, env, keys.apiUrlKeys);
+  if (diskConfigUrlHit?.unusable) {
+    throw new ClientTransportConfigurationError(name, `${diskConfigUrlHit.key} in ${diskConfigUrlHit.path} is declared but blank or malformed; public clients require a valid HTTPS service authority.`, [diskConfigUrlHit.path]);
+  }
+  const urlCandidates = [
+    ...envUrlHit ? [envUrlHit] : [],
+    ...keychainUrlHit ? [{ key: keychainUrlHit.source, value: keychainUrlHit.value }] : [],
+    ...diskConfigUrlHit ? [{ key: diskConfigUrlHit.path, value: diskConfigUrlHit.value.trim() }] : []
+  ];
+  const configuredUrl = urlCandidates[0] ?? null;
+  const divergentUrls = urlCandidates.filter((candidate) => candidate.value !== configuredUrl?.value);
+  if (configuredUrl && divergentUrls.length > 0) {
+    throw new ClientTransportConfigurationError(name, `${configuredUrl.key} and ${divergentUrls.map((candidate) => candidate.key).join(" and ")} select different service authorities; refusing to send a credential written for one authority to the other.`, urlCandidates.map((candidate) => candidate.key));
+  }
+  const warnings = [];
+  if (configuredUrl && !envUrlHit) {
+    warnings.push(`No ${keys.apiUrlKeys[0]} in the environment; the server URL in ${configuredUrl.key} was used, so this client connects to the server. ` + `Keep that entry aligned with the intended service authority.`);
+  }
+  const credential = resolveCredential(name, env, options.credentials);
+  if (!credential) {
+    const diskHint = credentialDiskSourcesForMessage(name, env);
+    const lead = configuredUrl ? `${configuredUrl.key} selects the HTTP server for '${name}', but no API key could be resolved` : `${keys.apiUrlKeys[0]} is not set and no API key could be resolved for '${name}'; a credential is required before the default fleet gateway authority applies`;
+    warnings.push(`${lead}; refusing to create an unauthenticated client \u2014 public clients never fall back to SQLite or another local store. ` + `Looked in the Keychain (macOS only), then for a credential file at ${diskHint}, then for ${keys.apiKeyKeys[0]} in the environment.`);
+    throw new ClientTransportConfigurationError(name, warnings.join(" "), [configuredUrl?.key ?? keys.apiUrlKeys[0]]);
+  }
+  if (credential.warning)
+    warnings.push(credential.warning);
+  let urlHit;
+  if (configuredUrl) {
+    urlHit = configuredUrl;
+  } else {
+    try {
+      urlHit = { key: DEFAULT_AUTHORITY_SOURCE, value: defaultFleetGatewayBaseUrl(name) };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new ClientTransportConfigurationError(name, `No ${keys.apiUrlKeys[0]} is configured and the default fleet gateway authority cannot be composed for '${name}': ${message}`, [keys.apiUrlKeys[0]]);
+    }
+  }
+  const apiUrlSource = urlHit.key;
+  let baseUrl;
+  try {
+    baseUrl = toV1BaseUrl(urlHit.value);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new ClientTransportConfigurationError(name, `Invalid API URL from ${apiUrlSource}: ${message}`, [apiUrlSource]);
+  }
+  return {
+    resolution: {
+      transport: "http",
+      transportSource: urlHit.key,
+      baseUrl,
+      apiUrlSource,
+      apiKeyPresent: true,
+      apiKeySource: credential.source,
+      apiKeyTier: credential.tier,
+      misconfigured: false,
+      warning: warnings.length > 0 ? warnings.join(" ") : null
+    },
+    credential
+  };
+}
+function resolveClientTransport(name, env = process.env, options = {}) {
+  return resolveClientTransportSnapshot(name, env, options).resolution;
+}
+function credentialDiskSourcesForMessage(name, env) {
+  const paths = credentialDiskSources(name, env);
+  return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
+}
+var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+var AUTHORITY_OVERRIDE_HEADERS = new Set([
+  "host",
+  ":authority",
+  "forwarded",
+  "x-forwarded-host",
+  "x-original-host"
+]);
+
+// ../contracts/dist/client/storage.js
+import { isIP as isIP2 } from "net";
+import { spawnSync as spawnSync3 } from "child_process";
+import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readFileSync as readFileSync3 } from "fs";
+import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";
+import { createRequire as createRequire2 } from "module";
+import { hostname as osHostname2 } from "os";
+import { isAbsolute as isAbsolute3, join as join5 } from "path";
+function envToken2(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function clientTransportEnvKeys2(name) {
+  const envSegment = envToken2(name);
+  return {
+    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
+    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
+  };
+}
+function credentialOverrideEnvKey2(name) {
+  return `HASNA_${envToken2(name)}_API_KEY_OVERRIDE`;
+}
+var CREDENTIAL_PROFILE_ENV_KEY2 = "HASNA_PROFILE";
+function credentialPointerEnvKey2(name) {
+  return `HASNA_${envToken2(name)}_API_KEY_REF`;
+}
+
+class CredentialResolutionError2 extends Error {
+  appName;
+  attempted;
+  constructor(appName, message, attempted) {
+    super(message);
+    this.name = "CredentialResolutionError";
+    this.appName = appName;
+    this.attempted = attempted;
+  }
+}
+
+class CredentialFileUnsafeError2 extends Error {
+  path;
+  constructor(path, reason) {
+    super(`Refusing unsafe credential/config file ${path}: ${reason}.`);
+    this.name = "CredentialFileUnsafeError";
+    this.path = path;
+  }
+}
+var HASNA_HOME_ENV_KEY2 = "HASNA_HOME";
+var HASNA_CONFIG_HOME_ENV_KEY2 = "HASNA_CONFIG_HOME";
+var KEYCHAIN_STATION_ENV_KEY2 = "HASNA_STATION";
+var HASNA_HOME_DIR2 = ".hasna";
+var CONFIG_SUBDIR2 = "config";
+var CREDENTIALS_FILE2 = "credentials";
+var KEYCHAIN_SECURITY_BIN2 = "/usr/bin/security";
+var KEYCHAIN_SERVICE_PREFIX2 = "hasna.credentials";
+var KEYCHAIN_ITEM_NOT_FOUND_STATUS2 = 44;
+var KEYCHAIN_SPAWN_TIMEOUT_MS2 = 1e4;
+var MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
+var SAFE_APP_SLUG2 = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+var SAFE_PROFILE2 = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+var ILLEGAL_IN_HEADER_VALUE2 = /[^\t\x20-\x7e]/;
+var VAULT_POINTER_SHAPE2 = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
+function homeDir2(env) {
+  const home = env.HOME?.trim();
+  return home ? home : null;
+}
+function absoluteOverride2(env, key) {
+  const value = env[key]?.trim();
+  return value && isAbsolute3(value) ? value : null;
+}
+function hasnaHomeDir2(env) {
+  const override = absoluteOverride2(env, HASNA_HOME_ENV_KEY2);
+  if (override)
+    return override;
+  const home = homeDir2(env);
+  return home ? join5(home, HASNA_HOME_DIR2) : null;
+}
+function appConfigDir2(name, env) {
+  const configRoot = absoluteOverride2(env, HASNA_CONFIG_HOME_ENV_KEY2);
+  if (configRoot)
+    return join5(configRoot, name);
+  const root = hasnaHomeDir2(env);
+  return root ? join5(root, name, CONFIG_SUBDIR2) : null;
+}
+function credentialDiskSourceList2(name, env, profile = null) {
+  if (!SAFE_APP_SLUG2.test(name))
+    return [];
+  const directory = appConfigDir2(name, env);
+  if (!directory)
+    return [];
+  const file = profile ? `${CREDENTIALS_FILE2}-${profile}` : CREDENTIALS_FILE2;
+  return [{ path: join5(directory, file), tier: "disk" }];
+}
+function credentialDiskSources2(name, env) {
+  return credentialDiskSourceList2(name, env, null).map((s) => s.path);
+}
+function profileDiskSources2(name, env, profile) {
+  return credentialDiskSourceList2(name, env, profile).map((s) => s.path);
+}
+function parseEnvFile2(text) {
+  const values = new Map;
+  const unusable = new Set;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#"))
+      continue;
+    const withoutExport = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
+    const equals = withoutExport.indexOf("=");
+    if (equals <= 0)
+      continue;
+    const key = withoutExport.slice(0, equals).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    let value = withoutExport.slice(equals + 1).trim();
+    const quote = value[0];
+    if (quote === '"' || quote === "'") {
+      if (value.length < 2 || !value.endsWith(quote)) {
+        unusable.add(key);
+        continue;
+      }
+      value = value.slice(1, -1);
+    }
+    if (value.trim().length === 0) {
+      unusable.add(key);
+      continue;
+    }
+    if (values.has(key) && values.get(key) !== value)
+      unusable.add(key);
+    values.set(key, value);
+  }
+  return { values, unusable };
+}
+function configFileModeAllowed2(mode) {
+  const permissions = mode & 4095;
+  return permissions === 256 || permissions === 384;
+}
+function configFileReadsCoherent2(before, after) {
+  return before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs;
+}
+function readAppConfigFile2(path) {
+  const unsafe = (reason) => {
+    throw new CredentialFileUnsafeError2(path, reason);
+  };
+  let fd = -1;
+  try {
+    fd = openSync2(path, O_RDONLY2 | O_NOFOLLOW2 | O_NONBLOCK2);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR")
+      return null;
+    if (code === "ELOOP")
+      unsafe("the path is a symlink");
+    unsafe(`the path could not be opened (${code ?? "unknown error"})`);
+  }
+  try {
+    const before = fstatSync2(fd);
+    if (!before.isFile())
+      unsafe("the path is not a regular file");
+    if (!configFileModeAllowed2(before.mode)) {
+      unsafe(`permission mode ${(before.mode & 4095).toString(8).padStart(4, "0")} is not owner-only 0400 or 0600`);
+    }
+    const uid = process.getuid?.() ?? process.geteuid?.();
+    if (uid !== undefined && before.uid !== uid)
+      unsafe("the file is not owned by the current user");
+    if (before.size > MAX_CREDENTIAL_FILE_BYTES2)
+      unsafe("the file exceeds the size limit");
+    const bytes = readFileSync3(fd);
+    const after = fstatSync2(fd);
+    if (!configFileReadsCoherent2(before, after)) {
+      unsafe("the file changed while being read");
+    }
+    return parseEnvFile2(bytes.toString("utf8"));
+  } finally {
+    if (fd !== -1)
+      closeSync2(fd);
+  }
+}
+function readCredentialFile2(path, apiKeyKeys) {
+  const parsed = readAppConfigFile2(path);
+  if (!parsed)
+    return null;
+  for (const key of apiKeyKeys) {
+    if (parsed.unusable.has(key)) {
+      throw new CredentialFileUnsafeError2(path, `${key} is declared but blank or malformed`);
+    }
+  }
+  const values = apiKeyKeys.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+  if (new Set(values).size > 1) {
+    throw new CredentialFileUnsafeError2(path, "credential aliases disagree");
+  }
+  return values[0] ?? null;
+}
+var CREDENTIAL_SHAPED_KEY2 = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
+function appConfigDiskValue2(name, env, keys) {
+  const wanted = keys.filter((key) => !CREDENTIAL_SHAPED_KEY2.test(key));
+  if (wanted.length === 0)
+    return null;
+  for (const path of credentialDiskSources2(name, env)) {
+    const parsed = readAppConfigFile2(path);
+    if (!parsed)
+      continue;
+    if (wanted.some((key) => parsed.unusable.has(key))) {
+      return { key: wanted.find((key) => parsed.unusable.has(key)), value: "", path, unusable: true };
+    }
+    const values = wanted.map((key) => parsed.values.get(key)?.trim()).filter((value) => Boolean(value));
+    if (new Set(values).size > 1)
+      throw new CredentialFileUnsafeError2(path, "configuration aliases disagree");
+    for (const key of wanted) {
+      if (parsed.unusable.has(key))
+        return { key, value: "", path, unusable: true };
+      const value = parsed.values.get(key)?.trim();
+      if (value)
+        return { key, value, path };
+    }
+  }
+  return null;
+}
+function assertUsableCredential2(appName, source, value) {
+  if (VAULT_POINTER_SHAPE2.test(value)) {
+    throw new CredentialResolutionError2(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey2(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
+  if (!ILLEGAL_IN_HEADER_VALUE2.test(value))
+    return;
+  throw new CredentialResolutionError2(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
+}
+var INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
+var CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
+var CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE = "caller-supplied CredentialProvider";
+function sealCredential2(fields) {
+  const { apiKey } = fields;
+  const visible = {
+    tier: fields.tier,
+    source: fields.source,
+    deliberate: fields.deliberate,
+    diskCandidates: Object.freeze([...fields.diskCandidates]),
+    warning: fields.warning
+  };
+  const sealed = { ...visible };
+  Object.defineProperty(sealed, "apiKey", {
+    value: apiKey,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  Object.defineProperty(sealed, INSPECT_CUSTOM2, {
+    value: () => ({ ...visible, apiKey: "[redacted]" }),
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, CREDENTIAL_SEAL2, {
+    value: true,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  return Object.freeze(sealed);
+}
+function isSealedCredential(credential) {
+  return credential[CREDENTIAL_SEAL2] === true;
+}
+function explicitCredential(appName, apiKey) {
+  const source = "explicit apiKey option";
+  assertUsableCredential2(appName, source, apiKey);
+  return sealCredential2({
+    apiKey,
+    tier: "argument",
+    source,
+    deliberate: true,
+    diskCandidates: [],
+    warning: null
+  });
+}
+function validateAndSealResolvedCredential(appName, credential) {
+  const apiKey = credential.apiKey;
+  assertUsableCredential2(appName, CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE, apiKey);
+  if (!isSealedCredential(credential)) {
+    return sealCredential2({
+      apiKey,
+      tier: "argument",
+      source: CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE,
+      deliberate: true,
+      diskCandidates: [],
+      warning: null
+    });
+  }
+  return sealCredential2({
+    apiKey,
+    tier: credential.tier,
+    source: credential.source,
+    deliberate: credential.deliberate,
+    diskCandidates: credential.diskCandidates,
+    warning: credential.warning,
+    ...credential.pointerVaultKey !== undefined ? { pointerVaultKey: credential.pointerVaultKey } : {}
+  });
+}
+function firstEnvValue2(env, keys) {
+  for (const key of keys) {
+    if (!Object.prototype.hasOwnProperty.call(env, key))
+      continue;
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+var AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
+function isAmbientEnvironment2(env) {
+  return env === process.env || env[AMBIENT_ENVIRONMENT2] === true;
+}
+function defaultKeychainRunner2(argv) {
+  const result = spawnSync3(KEYCHAIN_SECURITY_BIN2, [...argv], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: KEYCHAIN_SPAWN_TIMEOUT_MS2
+  });
+  return {
+    status: result.status,
+    stdout: result.stdout ?? "",
+    stderr: result.error ? result.error.message : result.stderr ?? ""
+  };
+}
+function keychainTierEnabled2(env, options) {
+  if ((options.platform ?? process.platform) !== "darwin")
+    return false;
+  if (options.enabled !== undefined)
+    return options.enabled;
+  return options.run !== undefined || isAmbientEnvironment2(env);
+}
+function keychainAccount2(env, options) {
+  const station = env[KEYCHAIN_STATION_ENV_KEY2]?.trim();
+  if (station)
+    return station;
+  const host = (options.hostname ?? osHostname2)().split(".")[0]?.trim() ?? "";
+  if (host)
+    return host;
+  const user = env.USER?.trim();
+  return user || null;
+}
+function keychainFailureHint2(text) {
+  const line = text.split(/\r?\n/).find((entry) => entry.trim().length > 0)?.trim() ?? "";
+  const clean = line.replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 200);
+  return clean ? `: ${clean}` : "";
+}
+function readKeychainItem2(name, env, kind, options) {
+  if (!SAFE_APP_SLUG2.test(name) || !keychainTierEnabled2(env, options))
+    return null;
+  const account = keychainAccount2(env, options);
+  if (!account)
+    return null;
+  const service = `${KEYCHAIN_SERVICE_PREFIX2}.${name}.${kind}`;
+  const source = `keychain:${service}@${account}`;
+  const run = options.run ?? defaultKeychainRunner2;
+  let result;
+  try {
+    result = run(["find-generic-password", "-a", account, "-s", service, "-w"]);
+  } catch (error) {
+    const reason = keychainFailureHint2(error instanceof Error ? error.message : String(error));
+    throw new CredentialResolutionError2(name, `The Keychain lookup for ${source} could not run${reason}. A Keychain failure is never resolved ` + `around: fix the keychain, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  if (result.status === KEYCHAIN_ITEM_NOT_FOUND_STATUS2)
+    return null;
+  if (result.status !== 0) {
+    throw new CredentialResolutionError2(name, `The Keychain lookup for ${source} failed (security exited ` + `${result.status ?? "without a status"}${keychainFailureHint2(result.stderr)}). A Keychain item that ` + `exists but cannot be read is never resolved around: unlock the keychain, run from a session that ` + `may use it, or delete the item to fall through to the credential on disk.`, [source]);
+  }
+  const value = result.stdout.trim();
+  if (!value) {
+    throw new CredentialResolutionError2(name, `${source} exists but holds an empty value; a declared item never falls through to another ` + `identity. Store a value in it or delete the item.`, [source]);
+  }
+  return { value, source };
+}
+function keychainConfigValue2(name, env, options = {}) {
+  return readKeychainItem2(name, env, "api-url", options);
+}
+function snapshotClientEnvironment2(name, env) {
+  const keys = clientTransportEnvKeys2(name);
+  const ambient = isAmbientEnvironment2(env);
+  const snapshot = Object.create(null);
+  for (const key of [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey2(name),
+    credentialPointerEnvKey2(name),
+    CREDENTIAL_PROFILE_ENV_KEY2,
+    "HOME",
+    HASNA_HOME_ENV_KEY2,
+    HASNA_CONFIG_HOME_ENV_KEY2,
+    KEYCHAIN_STATION_ENV_KEY2,
+    "USER"
+  ]) {
+    const descriptor = Object.getOwnPropertyDescriptor(env, key);
+    if (!descriptor)
+      continue;
+    if (!("value" in descriptor)) {
+      throw new CredentialResolutionError2(name, `${key} is accessor-backed; client configuration requires own data properties.`, [key]);
+    }
+    if (descriptor.value !== undefined && typeof descriptor.value !== "string") {
+      throw new CredentialResolutionError2(name, `${key} must be a string data property.`, [key]);
+    }
+    snapshot[key] = descriptor.value;
+  }
+  if (ambient) {
+    Object.defineProperty(snapshot, AMBIENT_ENVIRONMENT2, {
+      value: true,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
+  return Object.freeze(snapshot);
+}
+function resolveCredential2(name, env, options = {}) {
+  env = snapshotClientEnvironment2(name, env);
+  const { apiKeyKeys } = clientTransportEnvKeys2(name);
+  const diskPaths = credentialDiskSources2(name, env);
+  if (options.apiKey !== undefined) {
+    const explicitKey = options.apiKey.trim();
+    if (!explicitKey) {
+      throw new CredentialResolutionError2(name, "The explicit apiKey argument is blank; an explicit credential never falls through to another identity.", ["explicit apiKey argument"]);
+    }
+    assertUsableCredential2(name, "the explicit apiKey argument", explicitKey);
+    return sealCredential2({
+      apiKey: explicitKey,
+      tier: "argument",
+      source: "explicit apiKey argument",
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const overrideKeyName = credentialOverrideEnvKey2(name);
+  const overrideRaw = Object.prototype.hasOwnProperty.call(env, overrideKeyName) ? env[overrideKeyName] : undefined;
+  if (overrideRaw !== undefined) {
+    const override = overrideRaw.trim();
+    if (!override) {
+      throw new CredentialResolutionError2(name, `${overrideKeyName} is set but empty. It is a deliberate override, so it is not resolved around: ` + `either give it a real key or unset it to fall back to the credential on disk.`, [overrideKeyName]);
+    }
+    assertUsableCredential2(name, overrideKeyName, override);
+    return sealCredential2({
+      apiKey: override,
+      tier: "override",
+      source: overrideKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const pointerKeyName = credentialPointerEnvKey2(name);
+  const pointerRaw = Object.prototype.hasOwnProperty.call(env, pointerKeyName) ? env[pointerKeyName] : undefined;
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError2(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE2.test(pointer)) {
+      throw new CredentialResolutionError2(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential2({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  if (options.profile !== undefined && !options.profile.trim()) {
+    throw new CredentialResolutionError2(name, "The explicit profile argument is blank; an explicit identity selection never falls through.", ["explicit profile argument"]);
+  }
+  const profileRaw = Object.prototype.hasOwnProperty.call(env, CREDENTIAL_PROFILE_ENV_KEY2) ? env[CREDENTIAL_PROFILE_ENV_KEY2] : undefined;
+  if (profileRaw !== undefined && !profileRaw.trim()) {
+    throw new CredentialResolutionError2(name, `${CREDENTIAL_PROFILE_ENV_KEY2} is set but blank.`, [CREDENTIAL_PROFILE_ENV_KEY2]);
+  }
+  const profile = options.profile?.trim() || profileRaw?.trim();
+  if (profile) {
+    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY2;
+    if (!SAFE_PROFILE2.test(profile)) {
+      throw new CredentialResolutionError2(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
+    }
+    const paths = profileDiskSources2(name, env, profile);
+    for (const path of paths) {
+      const value = readCredentialFile2(path, apiKeyKeys);
+      if (value) {
+        assertUsableCredential2(name, path, value);
+        return sealCredential2({
+          apiKey: value,
+          tier: "profile",
+          source: path,
+          deliberate: true,
+          diskCandidates: paths,
+          warning: null
+        });
+      }
+    }
+    throw new CredentialResolutionError2(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY2}.`, paths);
+  }
+  const definedEnvEntries = apiKeyKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, value: String(env[key]).trim() }));
+  const blankEnv = definedEnvEntries.find((entry) => entry.value.length === 0);
+  if (blankEnv) {
+    throw new CredentialResolutionError2(name, `${blankEnv.key} is set but blank; a declared credential never falls through to another alias or identity.`, [blankEnv.key]);
+  }
+  if (definedEnvEntries.length > 1 && new Set(definedEnvEntries.map((entry) => entry.value)).size > 1) {
+    throw new CredentialResolutionError2(name, `${definedEnvEntries.map((entry) => entry.key).join(" and ")} disagree; credential aliases must be identical or only one may be set.`, definedEnvEntries.map((entry) => entry.key));
+  }
+  const envHit = firstEnvValue2(env, apiKeyKeys);
+  const keychainHit = readKeychainItem2(name, env, "api-key", options.keychain ?? {});
+  if (keychainHit) {
+    assertUsableCredential2(name, keychainHit.source, keychainHit.value);
+    const warning = envHit && envHit.value !== keychainHit.value ? `Credential sources disagree for '${name}': ${keychainHit.source} and ${envHit.key} hold ` + `different keys. ${keychainHit.source} wins, because the Keychain is re-read on every call while ` + `an environment variable is a snapshot. Reconcile them \u2014 a rotation that updated only one leaves ` + `the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential2({
+      apiKey: keychainHit.value,
+      tier: "keychain",
+      source: keychainHit.source,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  const diskSourceList = credentialDiskSourceList2(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile2(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  if (diskHits.length > 0) {
+    const winner = diskHits[0];
+    assertUsableCredential2(name, winner.src.path, winner.value);
+    const divergentSources = [
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
+      ...envHit && envHit.value !== winner.value ? [envHit.key] : []
+    ];
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential2({
+      apiKey: winner.value,
+      tier: winner.src.tier,
+      source: winner.src.path,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  if (envHit) {
+    assertUsableCredential2(name, envHit.key, envHit.value);
+    return sealCredential2({
+      apiKey: envHit.value,
+      tier: "env",
+      source: envHit.key,
+      deliberate: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  return null;
+}
+var SECRETS_PACKAGE_SPECIFIER2 = "@hasna/" + "secrets";
+var requireSecretsSdk2 = createRequire2(import.meta.url);
+async function completePointerCredential(name, pointerResolution, env = process.env) {
+  const vaultKey = pointerResolution.pointerVaultKey;
+  const pointerEnvKey = pointerResolution.source;
+  if (!vaultKey) {
+    throw new CredentialResolutionError2(name, `Pointer resolution from ${pointerEnvKey} carries no vault item key; this is a defect in the resolver.`, [pointerEnvKey]);
+  }
+  let secretsSdk;
+  try {
+    secretsSdk = requireSecretsSdk2(SECRETS_PACKAGE_SPECIFIER2);
+  } catch {
+    throw new CredentialResolutionError2(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
+  }
+  let client;
+  try {
+    client = secretsSdk.createSecretsClientFromEnv(env);
+  } catch {
+    throw new CredentialResolutionError2(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets client could not be configured from this ` + `environment (the secrets service URL and key env are missing or invalid). A vault pointer is TERMINAL and ` + `never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  let secret;
+  try {
+    secret = await client.getSecret({ key: vaultKey });
+  } catch {
+    throw new CredentialResolutionError2(name, `${pointerEnvKey} names vault item '${vaultKey}', but the vault could not be reached or the item is ` + `unavailable. A vault pointer is TERMINAL and never falls through to a literal or disk credential.`, [pointerEnvKey]);
+  }
+  const value = secret.value;
+  if (!value) {
+    throw new CredentialResolutionError2(name, `${pointerEnvKey} resolved vault item '${vaultKey}', but it holds no value. A vault pointer is TERMINAL.`, [pointerEnvKey]);
+  }
+  assertUsableCredential2(name, `${pointerEnvKey} -> vault:${vaultKey}`, value);
+  return sealCredential2({
+    apiKey: value,
+    tier: "pointer",
+    source: `${pointerEnvKey} -> vault:${vaultKey}`,
+    deliberate: true,
+    diskCandidates: pointerResolution.diskCandidates,
+    warning: null
+  });
+}
+var DEFAULT_FLEET_GATEWAY_ORIGIN2 = "https://api.hasna.com";
+var DEFAULT_AUTHORITY_SOURCE2 = "default";
+function defaultFleetGatewayBaseUrl2(name) {
+  return `${DEFAULT_FLEET_GATEWAY_ORIGIN2}/${validateAppSlug2(name)}`;
+}
+var ASCII_CONTROL_PATTERN2 = /[\u0000-\u001f\u007f]/;
+var DNS_LABEL_PATTERN2 = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+function isValidDnsDomain2(value) {
+  if (value.length === 0 || value.length > 253 || ASCII_CONTROL_PATTERN2.test(value) || /[^\x00-\x7f]/.test(value)) {
+    return false;
   }
-  return null;
+  return value.split(".").every((label) => label.length <= 63 && !label.startsWith("xn--") && DNS_LABEL_PATTERN2.test(label));
 }
-function firstEnvDefinedKey(env, keys) {
-  for (const key of keys) {
-    if (env[key] !== undefined)
-      return key;
+function validateAppSlug2(name) {
+  if (name.length > 63 || !DNS_LABEL_PATTERN2.test(name)) {
+    throw new Error("App name must be one lowercase DNS label.");
   }
-  return null;
+  return name;
 }
-function rawAuthority(value) {
+function rawAuthority2(value) {
   const match = /^[a-z][a-z0-9+.-]*:\/\//i.exec(value);
   if (!match)
     throw new Error("API URL must be absolute.");
@@ -2406,7 +3429,7 @@ function rawAuthority(value) {
     throw new Error("API URL must include a hostname.");
   return authority;
 }
-function assertCanonicalPort(port) {
+function assertCanonicalPort2(port) {
   if (!/^[0-9]+$/.test(port) || port.length > 1 && port.startsWith("0")) {
     throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
   }
@@ -2415,7 +3438,7 @@ function assertCanonicalPort(port) {
     throw new Error("API URL authority must contain a canonical port between 1 and 65535.");
   }
 }
-function canonicalAuthorityHostname(authority) {
+function canonicalAuthorityHostname2(authority) {
   let rawHostname;
   if (authority.startsWith("[")) {
     const closingBracket = authority.indexOf("]");
@@ -2428,9 +3451,9 @@ function canonicalAuthorityHostname(authority) {
       if (!portSuffix.startsWith(":")) {
         throw new Error("API URL authority must contain a canonical hostname and port.");
       }
-      assertCanonicalPort(portSuffix.slice(1));
+      assertCanonicalPort2(portSuffix.slice(1));
     }
-    if (isIP(rawHostname.slice(1, -1)) !== 6) {
+    if (isIP2(rawHostname.slice(1, -1)) !== 6) {
       throw new Error("API URL authority must contain a canonical IPv6 literal.");
     }
   } else {
@@ -2441,33 +3464,33 @@ function canonicalAuthorityHostname(authority) {
     }
     if (lastColon !== -1) {
       const port = authority.slice(lastColon + 1);
-      assertCanonicalPort(port);
+      assertCanonicalPort2(port);
       rawHostname = authority.slice(0, lastColon);
     } else {
       rawHostname = authority;
     }
-    const ipVersion = isIP(rawHostname);
+    const ipVersion = isIP2(rawHostname);
     const numericAddressParts = rawHostname.split(".");
     const looksLikeNonCanonicalIpv4 = numericAddressParts.every((part) => /^(?:0x[0-9a-f]+|[0-9]+)$/i.test(part));
-    if (ipVersion !== 4 && looksLikeNonCanonicalIpv4 || ipVersion !== 4 && !isValidDnsDomain(rawHostname.toLowerCase())) {
+    if (ipVersion !== 4 && looksLikeNonCanonicalIpv4 || ipVersion !== 4 && !isValidDnsDomain2(rawHostname.toLowerCase())) {
       throw new Error("API URL authority must contain a canonical ASCII hostname.");
     }
   }
   return rawHostname.toLowerCase();
 }
-function isDeliberateLoopbackHttpAuthority(authority) {
+function isDeliberateLoopbackHttpAuthority2(authority) {
   return /^(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]+)?$/i.test(authority);
 }
-function toV1BaseUrl(apiUrl) {
-  if (ASCII_CONTROL_PATTERN.test(apiUrl)) {
+function toV1BaseUrl2(apiUrl) {
+  if (ASCII_CONTROL_PATTERN2.test(apiUrl)) {
     throw new Error("API URL must not contain ASCII control characters.");
   }
   const input = apiUrl.trim();
-  const authority = rawAuthority(input);
+  const authority = rawAuthority2(input);
   if (authority.includes("@") || authority.includes("\\") || authority.includes("%") || /[^\x00-\x7f]/.test(authority)) {
     throw new Error("API URL authority must be canonical ASCII without credentials.");
   }
-  const canonicalHostname = canonicalAuthorityHostname(authority);
+  const canonicalHostname = canonicalAuthorityHostname2(authority);
   const url = new URL(input);
   if (url.protocol !== "http:" && url.protocol !== "https:") {
     throw new Error("API URL must use http or https.");
@@ -2484,7 +3507,7 @@ function toV1BaseUrl(apiUrl) {
   if (url.hostname.split(".").some((label) => label.toLowerCase().startsWith("xn--"))) {
     throw new Error("API URL must not use IDN or punycode hostnames.");
   }
-  if (url.protocol === "http:" && !isDeliberateLoopbackHttpAuthority(authority)) {
+  if (url.protocol === "http:" && !isDeliberateLoopbackHttpAuthority2(authority)) {
     throw new Error("API URL may use http only for an exact loopback authority.");
   }
   if (url.search || url.hash) {
@@ -2496,106 +3519,104 @@ function toV1BaseUrl(apiUrl) {
   url.pathname = `${path}/v1`;
   return url.toString().replace(/\/+$/, "");
 }
-function resolveClientTransport(name, env = process.env, options = {}) {
-  const keys = clientTransportEnvKeys(name);
-  const envUrlHit = firstEnv(env, keys.apiUrlKeys, { preserveRaw: true });
-  const explicitLocalKey = envUrlHit ? null : firstEnvDefinedKey(env, keys.apiUrlKeys);
-  const diskUrlHit = envUrlHit || explicitLocalKey ? null : appConfigDiskValue(name, env, keys.apiUrlKeys);
-  const urlHit = envUrlHit ?? (diskUrlHit ? { key: diskUrlHit.path, value: diskUrlHit.value } : null);
-  const keyHit = firstEnv(env, keys.apiKeyKeys);
-  const warnings = [];
-  if (!urlHit) {
-    if (explicitLocalKey) {
-      const overriddenPointer = appConfigDiskValue(name, env, keys.apiUrlKeys);
-      if (overriddenPointer) {
-        warnings.push(`${explicitLocalKey} is defined but blank, which selects the local store. ` + `The server URL in ${overriddenPointer.path} was NOT selected: an explicit blank wins over a disk pointer.`);
-      }
-      return {
-        transport: "sqlite",
-        transportSource: explicitLocalKey,
-        baseUrl: null,
-        apiUrlSource: null,
-        apiKeyPresent: Boolean(keyHit),
-        apiKeySource: keyHit ? keyHit.key : null,
-        apiKeyTier: null,
-        misconfigured: false,
-        warning: warnings.length > 0 ? warnings.join(" ") : null
-      };
-    }
-    return {
-      transport: "sqlite",
-      transportSource: "default",
-      baseUrl: null,
-      apiUrlSource: null,
-      apiKeyPresent: Boolean(keyHit),
-      apiKeySource: keyHit ? keyHit.key : null,
-      apiKeyTier: null,
-      misconfigured: false,
-      warning: null
-    };
+class ClientTransportConfigurationError2 extends Error {
+  appName;
+  sources;
+  constructor(appName, message, sources = []) {
+    super(message);
+    this.name = "ClientTransportConfigurationError";
+    this.appName = appName;
+    this.sources = Object.freeze([...sources]);
+  }
+}
+function resolveClientTransportSnapshot2(name, env = process.env, options = {}) {
+  env = snapshotClientEnvironment2(name, env);
+  const keys = clientTransportEnvKeys2(name);
+  const definedUrlEntries = keys.apiUrlKeys.filter((key) => Object.prototype.hasOwnProperty.call(env, key) && env[key] !== undefined).map((key) => ({ key, raw: String(env[key]) }));
+  const blankUrl = definedUrlEntries.find((entry) => entry.raw.trim().length === 0);
+  if (blankUrl) {
+    throw new ClientTransportConfigurationError2(name, `${blankUrl.key} is set but blank; public clients require an explicit HTTPS API URL and never select local storage.`, [blankUrl.key]);
+  }
+  const controlledUrl = definedUrlEntries.find((entry) => ASCII_CONTROL_PATTERN2.test(entry.raw));
+  if (controlledUrl) {
+    throw new ClientTransportConfigurationError2(name, `${controlledUrl.key} contains ASCII control characters.`, [controlledUrl.key]);
+  }
+  const usableUrlEntries = definedUrlEntries.map((entry) => ({ key: entry.key, value: entry.raw.trim() }));
+  if (usableUrlEntries.length > 1 && new Set(usableUrlEntries.map((entry) => entry.value)).size > 1) {
+    throw new ClientTransportConfigurationError2(name, `${usableUrlEntries.map((entry) => entry.key).join(" and ")} disagree; client authority aliases must be identical or only one may be set.`, usableUrlEntries.map((entry) => entry.key));
+  }
+  const envUrlHit = usableUrlEntries[0] ?? null;
+  const keychainUrlHit = keychainConfigValue2(name, env, options.credentials?.keychain);
+  const diskConfigUrlHit = appConfigDiskValue2(name, env, keys.apiUrlKeys);
+  if (diskConfigUrlHit?.unusable) {
+    throw new ClientTransportConfigurationError2(name, `${diskConfigUrlHit.key} in ${diskConfigUrlHit.path} is declared but blank or malformed; public clients require a valid HTTPS service authority.`, [diskConfigUrlHit.path]);
+  }
+  const urlCandidates = [
+    ...envUrlHit ? [envUrlHit] : [],
+    ...keychainUrlHit ? [{ key: keychainUrlHit.source, value: keychainUrlHit.value }] : [],
+    ...diskConfigUrlHit ? [{ key: diskConfigUrlHit.path, value: diskConfigUrlHit.value.trim() }] : []
+  ];
+  const configuredUrl = urlCandidates[0] ?? null;
+  const divergentUrls = urlCandidates.filter((candidate) => candidate.value !== configuredUrl?.value);
+  if (configuredUrl && divergentUrls.length > 0) {
+    throw new ClientTransportConfigurationError2(name, `${configuredUrl.key} and ${divergentUrls.map((candidate) => candidate.key).join(" and ")} select different service authorities; refusing to send a credential written for one authority to the other.`, urlCandidates.map((candidate) => candidate.key));
   }
-  if (diskUrlHit) {
-    warnings.push(`No ${keys.apiUrlKeys[0]} in the environment; the server URL in ${diskUrlHit.path} was used, so this client connects to the server. ` + `Unset the pointer or remove the file to stay on the local store.`);
+  const warnings = [];
+  if (configuredUrl && !envUrlHit) {
+    warnings.push(`No ${keys.apiUrlKeys[0]} in the environment; the server URL in ${configuredUrl.key} was used, so this client connects to the server. ` + `Keep that entry aligned with the intended service authority.`);
   }
-  const credential = resolveCredential(name, env, options.credentials);
+  const credential = resolveCredential2(name, env, options.credentials);
   if (!credential) {
-    const diskHint = credentialDiskSourcesForMessage(name, env);
-    warnings.push(`${urlHit.key} selects the HTTP server for '${name}', but no API key could be resolved; ` + `refusing to route and leaving the local sqlite store selected. ` + `Looked for a credential file at ${diskHint}, then for ${keys.apiKeyKeys[0]} in the environment.`);
-    return {
-      transport: "sqlite",
-      transportSource: urlHit.key,
-      baseUrl: null,
-      apiUrlSource: urlHit.key,
-      apiKeyPresent: false,
-      apiKeySource: null,
-      apiKeyTier: null,
-      misconfigured: true,
-      warning: warnings.join(" ")
-    };
+    const diskHint = credentialDiskSourcesForMessage2(name, env);
+    const lead = configuredUrl ? `${configuredUrl.key} selects the HTTP server for '${name}', but no API key could be resolved` : `${keys.apiUrlKeys[0]} is not set and no API key could be resolved for '${name}'; a credential is required before the default fleet gateway authority applies`;
+    warnings.push(`${lead}; refusing to create an unauthenticated client \u2014 public clients never fall back to SQLite or another local store. ` + `Looked in the Keychain (macOS only), then for a credential file at ${diskHint}, then for ${keys.apiKeyKeys[0]} in the environment.`);
+    throw new ClientTransportConfigurationError2(name, warnings.join(" "), [configuredUrl?.key ?? keys.apiUrlKeys[0]]);
   }
   if (credential.warning)
     warnings.push(credential.warning);
+  let urlHit;
+  if (configuredUrl) {
+    urlHit = configuredUrl;
+  } else {
+    try {
+      urlHit = { key: DEFAULT_AUTHORITY_SOURCE2, value: defaultFleetGatewayBaseUrl2(name) };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new ClientTransportConfigurationError2(name, `No ${keys.apiUrlKeys[0]} is configured and the default fleet gateway authority cannot be composed for '${name}': ${message}`, [keys.apiUrlKeys[0]]);
+    }
+  }
   const apiUrlSource = urlHit.key;
   let baseUrl;
   try {
-    baseUrl = toV1BaseUrl(urlHit.value);
+    baseUrl = toV1BaseUrl2(urlHit.value);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    warnings.push(`Invalid API URL from ${apiUrlSource}: ${message}. Using local store.`);
-    return {
-      transport: "sqlite",
+    throw new ClientTransportConfigurationError2(name, `Invalid API URL from ${apiUrlSource}: ${message}`, [apiUrlSource]);
+  }
+  return {
+    resolution: {
+      transport: "http",
       transportSource: urlHit.key,
-      baseUrl: null,
-      apiUrlSource: urlHit.key,
+      baseUrl,
+      apiUrlSource,
       apiKeyPresent: true,
       apiKeySource: credential.source,
       apiKeyTier: credential.tier,
-      misconfigured: true,
-      warning: warnings.join(" ")
-    };
-  }
-  return {
-    transport: "http",
-    transportSource: urlHit.key,
-    baseUrl,
-    apiUrlSource,
-    apiKeyPresent: true,
-    apiKeySource: credential.source,
-    apiKeyTier: credential.tier,
-    misconfigured: false,
-    warning: warnings.length > 0 ? warnings.join(" ") : null
+      misconfigured: false,
+      warning: warnings.length > 0 ? warnings.join(" ") : null
+    },
+    credential
   };
 }
-function credentialDiskSourcesForMessage(name, env) {
-  const paths = credentialDiskSources(name, env);
-  return paths.length > 0 ? paths.join(" or ") : "<no HOME set in this environment, so no credential file was consulted>";
+function credentialDiskSourcesForMessage2(name, env) {
+  const paths = credentialDiskSources2(name, env);
+  return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
 }
 
 class HasnaHttpError extends Error {
   status;
   method;
   path;
-  body;
   credentialSource;
   credentialTier;
   constructor(method, path, status, body, credential) {
@@ -2605,7 +3626,12 @@ class HasnaHttpError extends Error {
     this.status = status;
     this.method = method;
     this.path = path;
-    this.body = body;
+    Object.defineProperty(this, "body", {
+      value: body,
+      enumerable: status !== 401 && status !== 403,
+      writable: false,
+      configurable: false
+    });
     this.credentialSource = credential?.source ?? null;
     this.credentialTier = credential?.tier ?? null;
   }
@@ -2616,22 +3642,32 @@ function currentCredential(name, apiKey) {
   }
   return explicitCredential(name, apiKey);
 }
+async function resolveRequestCredential(name, apiKey, env = process.env) {
+  const resolved = currentCredential(name, apiKey);
+  if (resolved.tier === "pointer") {
+    return completePointerCredential(name, resolved, env);
+  }
+  return resolved;
+}
 function authFailureGuidance(credential) {
   const origin = `The API key for this request came from ${credential.source}`;
   if (credential.deliberate) {
     const remedy = credential.source === CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE ? `Fix that provider so it returns the current key, or replace it with resolveCredential() ` + `so diagnostics can name the original source.` : `Rotate that key, or unset the override to use the credential on disk.`;
     return `${origin} \u2014 a credential you selected deliberately. It was NOT substituted with any other key: ` + `falling back here would authenticate as a different principal than the one you named, which is ` + `exactly the failure an override exists to prevent. ${remedy}`;
   }
-  if (credential.deprecated) {
+  if (credential.tier === "env") {
     const target = credential.diskCandidates[0];
-    const remedy = target ? `Write the CURRENT key to ${target} \u2014 that file is re-read on every call, so rotations take ` + `effect immediately and in every shell. Do not simply unset ${credential.source}: nothing was ` + `found on disk, so that would leave this client with no credential at all.` : `This environment has no HOME, so no credential file could be consulted; the disk tier is ` + `unavailable here and there is nothing to fall back to. Set HOME, or supply the key explicitly.`;
-    return `${origin}, a variable in this process's environment \u2014 which is a snapshot taken when the process ` + `started. A STALE SHELL is the most common cause of this error: this shell exported the key before ` + `it was rotated, and will keep sending the old one until it exits. ${remedy}`;
+    const remedy = target ? `Store the CURRENT key in the Keychain or write it to ${target} \u2014 both are re-read on every call, so ` + `rotations take effect immediately and in every shell. Do not simply unset ${credential.source}: ` + `nothing was found in the Keychain or on disk, so that would leave this client with no credential at all.` : `This environment has no HOME or HASNA_HOME, so no credential file could be consulted; the disk tier is ` + `unavailable here and there is nothing to fall back to. Set HOME, or supply the key explicitly.`;
+    return `${origin}, a variable in this process's environment. If a wrapper injected it for this one process, the ` + `wrapper re-reads its store on every invocation and the stored key itself is being rejected \u2014 rotate it. ` + `If this SHELL exported it, the export is a snapshot taken when the shell started: a STALE SHELL that ` + `exported the key before it was rotated keeps sending the old one until it exits. ${remedy}`;
+  }
+  if (credential.tier === "keychain") {
+    return `${origin}, which was re-read from the Keychain on this very call \u2014 so a stale shell is NOT the cause ` + `here. The stored item is genuinely being rejected: update it with the current key, or re-run the fleet ` + `key distribution so this machine gets the current key.`;
   }
   return `${origin}, which was re-read from disk on this very call \u2014 so a stale shell is NOT the cause here. ` + `The stored credential is genuinely being rejected: rotate it, or re-run the fleet key distribution ` + `so this machine gets the current key.`;
 }
 var DEFAULT_RETRY_STATUSES = [408, 425, 429, 500, 502, 503, 504];
-var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-var AUTHORITY_OVERRIDE_HEADERS = new Set([
+var IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+var AUTHORITY_OVERRIDE_HEADERS2 = new Set([
   "host",
   ":authority",
   "forwarded",
@@ -2641,7 +3677,7 @@ var AUTHORITY_OVERRIDE_HEADERS = new Set([
 function assertNoAuthorityOverrideHeaders(headers, source) {
   if (!headers)
     return;
-  const forbidden = Object.keys(headers).find((name) => AUTHORITY_OVERRIDE_HEADERS.has(name.trim().toLowerCase()));
+  const forbidden = Object.keys(headers).find((name) => AUTHORITY_OVERRIDE_HEADERS2.has(name.trim().toLowerCase()));
   if (forbidden) {
     throw new Error(`Authenticated ${source} headers must not set authority header '${forbidden}'.`);
   }
@@ -2668,9 +3704,9 @@ function appendQuery(path, query) {
   return `${path}${path.includes("?") ? "&" : "?"}${qs}`;
 }
 var defaultSleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
-function createHasnaHttpTransport(options) {
+function createHasnaHttpTransportInternal(options, requestBindingProvider) {
   const fetchImpl = options.fetchImpl ?? ((input, init) => fetch(input, init));
-  const base = toV1BaseUrl(options.baseUrl);
+  const base = toV1BaseUrl2(options.baseUrl);
   const timeoutMs = options.timeoutMs ?? 30000;
   const sleep = options.sleepImpl ?? defaultSleep;
   const defaultRetry = options.retry;
@@ -2730,13 +3766,20 @@ function createHasnaHttpTransport(options) {
       if (opts.signal)
         opts.signal.removeEventListener("abort", onAbort);
     }
-    const text = await response.text();
+    const authenticationFailure = response.status === 401 || response.status === 403;
     let parsed = undefined;
-    if (text.length > 0) {
+    if (authenticationFailure) {
       try {
-        parsed = JSON.parse(text);
-      } catch {
-        parsed = text;
+        await response.body?.cancel();
+      } catch {}
+    } else {
+      const text = await response.text();
+      if (text.length > 0) {
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+          parsed = text;
+        }
       }
     }
     if (!response.ok) {
@@ -2747,11 +3790,11 @@ function createHasnaHttpTransport(options) {
           error: new HasnaHttpError(method, rel, response.status, parsed)
         };
       }
-      if (response.status === 401 || response.status === 403) {
+      if (authenticationFailure) {
         return {
           ok: false,
           retryable: false,
-          error: new HasnaHttpError(method, rel, response.status, parsed, {
+          error: new HasnaHttpError(method, rel, response.status, undefined, {
             source: credential.source,
             tier: credential.tier,
             guidance: authFailureGuidance(credential)
@@ -2767,11 +3810,15 @@ function createHasnaHttpTransport(options) {
   async function request(method, path, body, opts = {}) {
     const upper = method.toUpperCase();
     const rel = appendQuery(path.startsWith("/") ? path : `/${path}`, opts.query);
-    const url = `${base}${rel}`;
     const retry = resolveRetry(opts.retry);
-    const methodRetryable = IDEMPOTENT_METHODS.has(upper) || Boolean(opts.idempotencyKey);
+    const methodRetryable = IDEMPOTENT_METHODS2.has(upper) || Boolean(opts.idempotencyKey);
     const maxAttempts = retry && methodRetryable ? retry.retries + 1 : 1;
-    const credential = currentCredential(options.name, options.apiKey);
+    const binding = requestBindingProvider ? await requestBindingProvider() : {
+      baseUrl: base,
+      credential: await resolveRequestCredential(options.name, options.apiKey)
+    };
+    const url = `${binding.baseUrl}${rel}`;
+    const credential = binding.credential;
     let last = null;
     for (let attempt = 1;attempt <= maxAttempts; attempt++) {
       const result = await once(upper, rel, url, body, opts, credential);
@@ -2799,49 +3846,44 @@ function createHasnaHttpTransport(options) {
 }
 function createClientTransport(name, env = process.env, overrides) {
   const credentialOptions = overrides?.credentials;
-  const resolution = resolveClientTransport(name, env, { ...credentialOptions ? { credentials: credentialOptions } : {} });
-  if (resolution.misconfigured) {
-    throw new Error(resolution.warning ?? `Client for '${name}' is misconfigured for the API client.`);
-  }
-  if (resolution.transport === "sqlite" || !resolution.baseUrl) {
-    return { transport: "sqlite", client: null, resolution };
-  }
-  const credentialProvider = () => {
-    const resolved = resolveCredential(name, env, credentialOptions);
-    if (!resolved) {
-      throw new Error(`Client for '${name}' resolved to the http transport but no API key is available any more. ` + `Looked at ${credentialDiskSourcesForMessage(name, env)}, then the environment. ` + `A credential file that was removed after this client was built is the usual cause.`);
-    }
-    return resolved;
+  const snapshotOptions = { ...credentialOptions ? { credentials: credentialOptions } : {} };
+  const resolution = resolveClientTransportSnapshot2(name, env, snapshotOptions).resolution;
+  const sameBinding = (left, right) => left.resolution.baseUrl === right.resolution.baseUrl && left.credential.apiKey === right.credential.apiKey && left.credential.pointerVaultKey === right.credential.pointerVaultKey && left.credential.source === right.credential.source && left.credential.tier === right.credential.tier;
+  const unstableConfiguration = () => new ClientTransportConfigurationError2(name, "The configured service authority or credential changed while a request was being prepared; no authenticated request was sent.");
+  const requestBindingProvider = async () => {
+    const first = resolveClientTransportSnapshot2(name, env, snapshotOptions);
+    const reviewed = resolveClientTransportSnapshot2(name, env, snapshotOptions);
+    if (!sameBinding(first, reviewed))
+      throw unstableConfiguration();
+    if (reviewed.resolution.baseUrl !== resolution.baseUrl) {
+      throw new ClientTransportConfigurationError2(name, "The configured service authority changed; rebuild the client before sending credentials.");
+    }
+    const credential = await resolveRequestCredential(name, () => reviewed.credential, env);
+    const immediatelyBeforeDispatch = resolveClientTransportSnapshot2(name, env, snapshotOptions);
+    if (!sameBinding(reviewed, immediatelyBeforeDispatch))
+      throw unstableConfiguration();
+    if (immediatelyBeforeDispatch.resolution.baseUrl !== resolution.baseUrl) {
+      throw new ClientTransportConfigurationError2(name, "The configured service authority changed; rebuild the client before sending credentials.");
+    }
+    return { baseUrl: immediatelyBeforeDispatch.resolution.baseUrl, credential };
   };
   return {
     transport: "http",
-    client: createHasnaHttpTransport({
+    client: createHasnaHttpTransportInternal({
       name,
       baseUrl: resolution.baseUrl,
-      apiKey: credentialProvider,
+      apiKey: () => {
+        throw new Error("The authenticated request binding provider was not invoked.");
+      },
       ...overrides?.fetchImpl ? { fetchImpl: overrides.fetchImpl } : {},
       ...overrides?.headers ? { headers: overrides.headers } : {},
       ...overrides?.timeoutMs ? { timeoutMs: overrides.timeoutMs } : {},
       ...overrides?.retry !== undefined ? { retry: overrides.retry } : {},
       ...overrides?.sleepImpl ? { sleepImpl: overrides.sleepImpl } : {}
-    }),
+    }, requestBindingProvider),
     resolution
   };
 }
-
-// ../contracts/dist/client/storage.js
-var MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
-var INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
-var CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
-var DEPRECATION_REGISTRY2 = Symbol.for("hasna:contracts:credentialDeprecationNotices");
-var IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-var AUTHORITY_OVERRIDE_HEADERS2 = new Set([
-  "host",
-  ":authority",
-  "forwarded",
-  "x-forwarded-host",
-  "x-original-host"
-]);
 function resourcePath(resource) {
   const trimmed = resource.replace(/^\/+|\/+$/g, "");
   if (!trimmed)
@@ -2941,145 +3983,336 @@ function createHasnaStorageClient(name, transport) {
     }
   };
 }
+function resolveStorageClient(name, env = process.env, overrides) {
+  const wired = createClientTransport(name, env, overrides);
+  return { transport: "http", client: createHasnaStorageClient(name, wired.client) };
+}
+
+// src/lib/local-opt-in.ts
+var RECORDINGS_LOCAL_OPT_IN_ENV_KEYS = [
+  "HASNA_RECORDINGS_LOCAL",
+  "RECORDINGS_LOCAL"
+];
+function isRecordingsLocalOptIn(env = process.env) {
+  return RECORDINGS_LOCAL_OPT_IN_ENV_KEYS.some((key) => (env[key] ?? "").trim() !== "");
+}
+var RECORDINGS_CARVED_LEGACY_ENV_KEYS = [
+  "RECORDINGS_API_URL",
+  "RECORDINGS_API_KEY"
+];
+function recordingsAuthorityEnvKeys() {
+  const keys = clientTransportEnvKeys("recordings");
+  return [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey("recordings"),
+    credentialPointerEnvKey("recordings"),
+    CREDENTIAL_PROFILE_ENV_KEY
+  ].filter((key) => !RECORDINGS_CARVED_LEGACY_ENV_KEYS.includes(key));
+}
+function hasRecordingsEnvAuthorityIntent(env = process.env) {
+  return recordingsAuthorityEnvKeys().some((key) => (env[key] ?? "").trim() !== "");
+}
+function selectsRecordingsLocalStore(env = process.env) {
+  return !hasRecordingsEnvAuthorityIntent(env) && isRecordingsLocalOptIn(env);
+}
+function recordingsResolverEnv(env) {
+  const carved = RECORDINGS_CARVED_LEGACY_ENV_KEYS.filter((key) => (key in env));
+  const blanks = recordingsAuthorityEnvKeys().filter((key) => (key in env) && (env[key] ?? "").trim() === "");
+  const removed = new Set([...carved, ...blanks]);
+  if (removed.size === 0)
+    return env;
+  const next = { ...env };
+  for (const key of removed)
+    delete next[key];
+  return next;
+}
+var CONTRACTS_AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+function isAmbientRecordingsEnv(env) {
+  if (typeof process !== "undefined" && env === process.env) {
+    return true;
+  }
+  return env[CONTRACTS_AMBIENT_ENVIRONMENT] === true;
+}
+function recordingsResolverInputs(env, credentials = {}) {
+  const normalised = recordingsResolverEnv(env);
+  if (normalised === env)
+    return { env: normalised, credentials };
+  const keychain = { ...credentials.keychain };
+  if (keychain.enabled === undefined && keychain.run === undefined) {
+    keychain.enabled = isAmbientRecordingsEnv(env);
+  }
+  return { env: normalised, credentials: { ...credentials, keychain } };
+}
 
 // src/http/client.ts
-function envToken2(name) {
-  return name.toUpperCase().replace(/-/g, "_");
+var RETRY_STATUSES = new Set([408, 425, 429, 500, 502, 503, 504]);
+var IDEMPOTENT = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+function throwRecordingsAuthorityFailure(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const name = error instanceof Error ? error.name : "";
+  if (name === "CredentialResolutionError" || name === "CredentialFileUnsafeError") {
+    throw new Error(`REMOTE_API_CREDENTIAL_INVALID: ${message} There is no local fallback: ` + "local SQLite is opt-in only (HASNA_RECORDINGS_LOCAL=1) and is disabled by default \u2014 failing closed", { cause: error });
+  }
+  if (/no API key could be resolved/.test(message)) {
+    if (/is not set and no API key could be resolved/.test(message)) {
+      throw new Error("REMOTE_API_CONFIG_MISSING: no Recordings credential resolved from the Keychain item " + `hasna.credentials.recordings.api-key, ~/.hasna/recordings/config/credentials, or HASNA_RECORDINGS_API_KEY. ${message} ` + "There is no local fallback: local SQLite is opt-in only (HASNA_RECORDINGS_LOCAL=1, alias RECORDINGS_LOCAL=1) " + "and is disabled by default \u2014 failing closed instead of serving the local store", { cause: error });
+    }
+    throw new Error("REMOTE_API_KEY_MISSING: remote Recordings storage requires HASNA_RECORDINGS_API_KEY, the Keychain item " + `hasna.credentials.recordings.api-key, or ~/.hasna/recordings/config/credentials. ${message} ` + "There is no local fallback: local SQLite is opt-in only (HASNA_RECORDINGS_LOCAL=1) and is disabled by default \u2014 failing closed", { cause: error });
+  }
+  throw new Error(`REMOTE_API_URL_INVALID: ${message} local SQLite fallback is disabled`, { cause: error });
 }
-function envKeys(name) {
-  const token = envToken2(name);
+function toRecordsAuthority(resolution) {
   return {
-    storeKeys: [`HASNA_${token}_CLIENT_STORE`, `${token}_CLIENT_STORE`],
-    apiUrlKeys: [`HASNA_${token}_API_URL`],
-    apiKeyKeys: [`HASNA_${token}_API_KEY`]
+    transport: resolution.transport,
+    transportSource: resolution.transportSource,
+    baseUrl: resolution.baseUrl,
+    apiUrlSource: resolution.apiUrlSource,
+    apiKeyPresent: resolution.apiKeyPresent,
+    apiKeySource: resolution.apiKeySource,
+    apiKeyTier: resolution.apiKeyTier,
+    misconfigured: resolution.misconfigured,
+    warning: resolution.warning
   };
 }
-function normalizeClientStore(value) {
-  const normalized = value.trim().toLowerCase();
-  if (normalized === "sqlite")
-    return "sqlite";
-  if (normalized === "http" || normalized === "https")
-    return "http";
-  throw new Error(`Unknown client store: ${value}. Use sqlite or http.`);
-}
-function firstEnv2(env, keys) {
-  for (const key of keys) {
-    const value = env[key]?.trim();
-    if (value)
-      return { key, value };
+function resolveRecordingsTransport(env = process.env, options = {}) {
+  if (selectsRecordingsLocalStore(env)) {
+    return { transport: "sqlite", selected: false, source: "local-opt-in", authority: null };
   }
-  return null;
-}
-function toV1BaseUrl2(apiUrl) {
-  const url = new URL(apiUrl);
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new Error("API URL must use http or https.");
+  const resolverInputs = recordingsResolverInputs(env, options.credentials);
+  let resolution;
+  try {
+    resolution = resolveClientTransport("recordings", resolverInputs.env, {
+      credentials: resolverInputs.credentials
+    });
+  } catch (error) {
+    throwRecordingsAuthorityFailure(error);
   }
-  let path = url.pathname.replace(/\/+$/, "");
-  if (path.endsWith("/v1"))
-    path = path.slice(0, -"/v1".length);
-  url.pathname = `${path}/v1`;
-  url.search = "";
-  url.hash = "";
-  return url.toString().replace(/\/+$/, "");
+  return {
+    transport: "http",
+    selected: true,
+    source: `${resolution.apiKeySource ?? resolution.apiKeyTier}+${resolution.apiUrlSource ?? "default"}`,
+    authority: toRecordsAuthority(resolution)
+  };
 }
-function resolveTransport(name, env = process.env) {
-  const keys = envKeys(name);
-  const storeHit = firstEnv2(env, keys.storeKeys);
-  const urlHit = firstEnv2(env, keys.apiUrlKeys);
-  const keyHit = firstEnv2(env, keys.apiKeyKeys);
-  let requested = "sqlite";
-  let modeSource = "default";
-  if (storeHit) {
-    requested = normalizeClientStore(storeHit.value);
-    modeSource = storeHit.key;
-  } else if (urlHit && keyHit) {
-    requested = "http";
-    modeSource = "auto:api-url+api-key";
-  } else if (urlHit || keyHit) {
-    const missing = urlHit ? keys.apiKeyKeys[0] : keys.apiUrlKeys[0];
-    const present = urlHit ? keys.apiUrlKeys[0] : keys.apiKeyKeys[0];
+function getRecordingsTransportStatus(env = process.env, options = {}) {
+  let resolution;
+  try {
+    resolution = resolveRecordingsTransport(env, options);
+  } catch (error) {
+    const issue = error instanceof Error ? error.message : String(error);
+    const envKeys = clientTransportEnvKeys("recordings");
+    const declared = (keys) => keys.some((key) => (env[key] ?? "").trim() !== "");
     return {
-      transport: "sqlite",
-      requested,
-      modeSource,
-      baseUrl: null,
-      apiKeyPresent: Boolean(keyHit),
-      misconfigured: true,
-      warning: `${present} is set but ${missing} is not: the hosted API is only ` + `selected when BOTH are present. Set ${missing}, or unset ${present} to ` + `use the on-box store.`
+      selected: true,
+      ok: false,
+      transport: "invalid",
+      api_url_configured: declared(envKeys.apiUrlKeys),
+      api_key_configured: declared(envKeys.apiKeyKeys),
+      api_url_source: null,
+      api_key_source: null,
+      api_key_tier: null,
+      v1_base_url: null,
+      issues: [issue],
+      local_fallback: false
     };
   }
-  if (requested === "sqlite") {
-    return { transport: "sqlite", requested, modeSource, baseUrl: null, apiKeyPresent: Boolean(keyHit), misconfigured: false, warning: null };
-  }
-  if (!urlHit) {
+  if (!resolution.selected) {
     return {
-      transport: "sqlite",
-      requested,
-      modeSource,
-      baseUrl: null,
-      apiKeyPresent: Boolean(keyHit),
-      misconfigured: true,
-      warning: `${modeSource}=http but no API URL is set (${keys.apiUrlKeys[0]}). Refusing to route to the API.`
+      selected: false,
+      ok: true,
+      transport: resolution.transport,
+      api_url_configured: false,
+      api_key_configured: false,
+      api_url_source: null,
+      api_key_source: null,
+      api_key_tier: null,
+      v1_base_url: null,
+      issues: [],
+      local_fallback: false
     };
   }
-  if (!keyHit) {
-    return {
-      transport: "sqlite",
-      requested,
-      modeSource,
-      baseUrl: null,
-      apiKeyPresent: false,
-      misconfigured: true,
-      warning: `${modeSource}=http but no API key is set (${keys.apiKeyKeys[0]}). Refusing to route to the API.`
-    };
+  const authority = resolution.authority;
+  return {
+    selected: true,
+    ok: true,
+    transport: resolution.transport,
+    api_url_configured: authority.apiUrlSource !== null && authority.apiUrlSource !== "default",
+    api_key_configured: authority.apiKeyPresent,
+    api_url_source: authority.apiUrlSource,
+    api_key_source: authority.apiKeySource,
+    api_key_tier: authority.apiKeyTier,
+    v1_base_url: authority.baseUrl,
+    issues: [],
+    local_fallback: false
+  };
+}
+function resolveRecordingsCloudClient(env = process.env, options = {}) {
+  if (selectsRecordingsLocalStore(env))
+    return null;
+  const resolverInputs = recordingsResolverInputs(env, options.credentials);
+  let resolved;
+  try {
+    resolved = resolveStorageClient("recordings", resolverInputs.env, {
+      fetchImpl: (input, init) => globalThis.fetch(input, { ...init, redirect: "manual" }),
+      credentials: resolverInputs.credentials
+    });
+  } catch (error) {
+    throwRecordingsAuthorityFailure(error);
   }
-  const rawUrl = urlHit.value;
-  let baseUrl;
+  const client = resolved.client;
+  return client;
+}
+
+// src/store.ts
+import { createHash as createHash2, randomUUID as randomUUID5 } from "crypto";
+
+// src/lib/audio-artifact-storage.ts
+import { GetObjectCommand, PutObjectCommand, S3Client as AwsS3Client } from "@aws-sdk/client-s3";
+import { createHash } from "crypto";
+import { readFile as readFile2 } from "fs/promises";
+import { extname } from "path";
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var DEFAULT_S3_PREFIX = "recordings";
+var AUDIO_CONTENT_TYPES = {
+  wav: "audio/wav",
+  mp3: "audio/mpeg",
+  m4a: "audio/mp4",
+  aac: "audio/aac",
+  webm: "audio/webm",
+  ogg: "audio/ogg",
+  flac: "audio/flac"
+};
+function contentTypeForExtension(extension) {
+  return AUDIO_CONTENT_TYPES[extension.toLowerCase()] ?? "application/octet-stream";
+}
+
+class AudioArtifactStorage {
+  bucket;
+  prefix;
+  s3;
+  constructor(options = {}) {
+    this.bucket = options.bucket;
+    this.prefix = (options.prefix || DEFAULT_S3_PREFIX).replace(/^\/+|\/+$/g, "");
+    this.s3 = this.bucket ? options.client ?? new AwsS3Client({ region: options.region || process.env.AWS_REGION || "us-east-1" }) : undefined;
+  }
+  get usesS3() {
+    return Boolean(this.bucket);
+  }
+  objectKeyFor(recordingId, sha256, extension) {
+    assertSha256(sha256);
+    const safeExtension = extension.toLowerCase().match(/^[a-z0-9]+/)?.[0] || "bin";
+    return `${this.prefix}/${recordingId}/${sha256}.${safeExtension}`;
+  }
+  async uploadAudio(recordingId, audioPath) {
+    if (!this.bucket || !this.s3)
+      return null;
+    const bytes = await readFileBytes(audioPath);
+    if (!bytes)
+      return null;
+    const sha256 = sha256Hex(bytes);
+    const extension = extensionOf(audioPath);
+    const key = this.objectKeyFor(recordingId, sha256, extension);
+    await this.s3.send(new PutObjectCommand({
+      Bucket: this.bucket,
+      Key: key,
+      Body: bytes,
+      ContentType: contentTypeForExtension(extension)
+    }));
+    return { objectKey: key, sha256, bytes: bytes.byteLength };
+  }
+  async readAudio(objectKey) {
+    if (!this.bucket || !this.s3)
+      return null;
+    try {
+      const response = await this.s3.send(new GetObjectCommand({ Bucket: this.bucket, Key: objectKey }));
+      return await bodyToBytes(response.Body);
+    } catch {
+      return null;
+    }
+  }
+}
+function resolveAudioArtifactStorage(env = process.env, client) {
+  const bucket = env.HASNA_RECORDINGS_S3_BUCKET || env.RECORDINGS_S3_BUCKET || undefined;
+  const prefix = env.HASNA_RECORDINGS_S3_PREFIX || env.RECORDINGS_S3_PREFIX || undefined;
+  const region = env.RECORDINGS_S3_REGION || env.AWS_REGION || undefined;
+  return new AudioArtifactStorage({ bucket, prefix, region, client });
+}
+async function uploadAudioAtCreation(recordingId, audioPath, storage = resolveAudioArtifactStorage()) {
+  if (!audioPath)
+    return null;
+  if (!storage.usesS3)
+    return null;
   try {
-    baseUrl = toV1BaseUrl2(rawUrl);
+    const uploaded = await storage.uploadAudio(recordingId, audioPath);
+    if (!uploaded)
+      return null;
+    console.warn(`recordings: uploaded audio for ${recordingId} to ${uploaded.objectKey}`);
+    return uploaded;
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return { transport: "sqlite", requested, modeSource, baseUrl: null, apiKeyPresent: true, misconfigured: true, warning: `Invalid API URL: ${message}.` };
+    console.warn(`recordings: audio upload failed for ${recordingId} (${String(error instanceof Error ? error.message : error)}); keeping local audio_path only`);
+    return null;
   }
-  return { transport: "http", requested, modeSource, baseUrl, apiKeyPresent: true, misconfigured: false, warning: null };
 }
-var RETRY_STATUSES = new Set([408, 425, 429, 500, 502, 503, 504]);
-var IDEMPOTENT = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-function resolveStoreClient(name, env = process.env) {
-  const resolution = resolveTransport(name, env);
-  if (resolution.misconfigured) {
-    const wired2 = createClientTransport(name, env);
-    if (wired2.transport === "http") {
-      return {
-        transport: "http",
-        client: createHasnaStorageClient(name, wired2.client),
-        resolution: {
-          transport: "http",
-          requested: "http",
-          modeSource: resolution.modeSource === "default" ? "auto:api-url+seam-credential" : resolution.modeSource,
-          baseUrl: wired2.resolution.baseUrl,
-          apiKeyPresent: true,
-          misconfigured: false,
-          warning: null
-        }
-      };
+function assertSha256(value) {
+  if (!SHA256_HEX.test(value)) {
+    throw new Error("audio digest must be a lowercase hex sha-256; refusing to build a storage key from it");
+  }
+}
+function sha256Hex(bytes) {
+  const hash = createHash("sha256");
+  hash.update(bytes);
+  return hash.digest("hex");
+}
+async function readFileBytes(path) {
+  try {
+    return new Uint8Array(await readFile2(path));
+  } catch {
+    return null;
+  }
+}
+function extensionOf(path) {
+  const extension = extname(path).replace(/^\./, "").toLowerCase();
+  return extension || "bin";
+}
+async function bodyToBytes(body) {
+  if (!body)
+    return new Uint8Array(0);
+  if (body instanceof Uint8Array)
+    return body;
+  if (typeof body.transformToByteArray === "function") {
+    return new Uint8Array(await body.transformToByteArray());
+  }
+  if (typeof body.getReader === "function") {
+    const reader = body.getReader();
+    const chunks2 = [];
+    for (;; ) {
+      const { value, done } = await reader.read();
+      if (done)
+        break;
+      if (value)
+        chunks2.push(value);
     }
-    throw new Error(resolution.warning ?? `Client for '${name}' is misconfigured for the /v1 API.`);
+    return concat(chunks2);
   }
-  if (resolution.transport === "sqlite" || !resolution.baseUrl) {
-    return { transport: "sqlite", client: null, resolution };
+  const chunks = [];
+  for await (const chunk of body) {
+    chunks.push(typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk);
   }
-  const wired = createClientTransport(name, env);
-  if (wired.transport !== "http") {
-    throw new Error(`Client for '${name}' resolved to the /v1 API without an API key.`);
+  return concat(chunks);
+}
+function concat(chunks) {
+  const total = chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0);
+  const merged = new Uint8Array(new ArrayBuffer(total));
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
   }
-  return { transport: "http", client: createHasnaStorageClient(name, wired.client), resolution };
+  return merged;
 }
 
 // src/store.ts
-import { createHash, randomUUID as randomUUID5 } from "crypto";
-var APP = "recordings";
 function listQuery(filter) {
   if (!filter)
     return {};
@@ -3109,7 +4342,15 @@ var localStore = {
   mode: "sqlite",
   baseUrl: null,
   async createRecording(input, idempotencyKey) {
-    return withLocalStoreReaderLease(() => createRecording(input, undefined, idempotencyKey));
+    return withLocalStoreReaderLease(async () => {
+      const recording = createRecording(input, undefined, idempotencyKey);
+      if (!recording.audio_path)
+        return recording;
+      const uploaded = await uploadAudioAtCreation(recording.id, recording.audio_path, localArtifactStorageFor());
+      if (!uploaded)
+        return recording;
+      return updateRecordingAudio(recording.id, uploaded.objectKey, uploaded.sha256, uploaded.bytes) ?? recording;
+    });
   },
   async getRecording(id) {
     return withLocalStoreReaderLease(() => getRecording(id));
@@ -3303,7 +4544,7 @@ function apiStore(client) {
   };
 }
 function recordingPageFingerprint(items) {
-  const hash = createHash("sha256");
+  const hash = createHash2("sha256");
   const ids = items.map((item) => String(item.id ?? "")).sort();
   for (const id of ids) {
     hash.update(String(id.length));
@@ -3339,19 +4580,23 @@ async function countStoreRecordings(store, filter) {
   throw new Error(`Legacy Store exceeded ${maxPageRequests} pages while counting recordings`);
 }
 var cached = null;
-function getStore(env = process.env) {
-  if (env === process.env && cached)
+var localArtifactStorageOverride;
+function localArtifactStorageFor() {
+  return localArtifactStorageOverride ?? resolveAudioArtifactStorage();
+}
+function getStore(env = process.env, options = {}) {
+  if (env === process.env && cached && options.credentials === undefined)
     return cached;
-  const resolved = resolveStoreClient(APP, env);
-  const store = resolved.transport === "http" ? apiStore(resolved.client) : localStore;
-  if (env === process.env)
+  const client = resolveRecordingsCloudClient(env, options);
+  const store = client ? apiStore(client) : localStore;
+  if (env === process.env && options.credentials === undefined)
     cached = store;
   return store;
 }
 
 // src/lib/recorder.ts
 import { spawn as spawn2 } from "child_process";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 import { existsSync as existsSync3 } from "fs";
 
 // src/types/index.ts
@@ -3402,7 +4647,7 @@ function startRecording(config) {
   }
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
   const filename = `recording-${timestamp}.${config.audio_format}`;
-  const filepath = join5(config.audio_dir, filename);
+  const filepath = join6(config.audio_dir, filename);
   const args = buildRecordArgs(filepath, config);
   const [command, ...commandArgs] = args;
   if (command === undefined) {
@@ -3474,7 +4719,7 @@ function buildRecordArgs(filepath, config) {
 async function recordDuration(seconds, config) {
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
   const filename = `recording-${timestamp}.${config.audio_format}`;
-  const filepath = join5(config.audio_dir, filename);
+  const filepath = join6(config.audio_dir, filename);
   const args = [
     "rec",
     "-r",
@@ -3512,7 +4757,7 @@ var _client = null;
 var _clientApiKey = null;
 function getClient(config) {
   if (!config.openai_api_key) {
-    throw new TranscriptionError("OpenAI API key not configured. Set OPENAI_API_KEY env var or add to ~/.secrets");
+    throw new TranscriptionError("OpenAI API key not configured. Set OPENAI_API_KEY env var (e.g. " + "'secrets exec <key> --as OPENAI_API_KEY -- recordings \u2026')");
   }
   if (_client && _clientApiKey === config.openai_api_key)
     return _client;
@@ -3537,7 +4782,7 @@ async function verifyTranscriptionCredential(config, model, options = {}) {
       status: null,
       model,
       role,
-      message: `no API key configured for the ${role} role. ` + "Set OPENAI_API_KEY env var or add to ~/.secrets"
+      message: `no API key configured for the ${role} role. ` + "Set OPENAI_API_KEY env var (e.g. 'secrets exec <key> --as OPENAI_API_KEY -- recordings \u2026')"
     };
   }
   try {
@@ -3646,9 +4891,9 @@ ${trimmed}`;
 }
 
 // src/lib/capture-probe.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync3, rmSync as rmSync2 } from "fs";
-import { join as join6 } from "path";
+import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync4, rmSync as rmSync2 } from "fs";
+import { join as join7 } from "path";
 import { tmpdir } from "os";
 
 // src/lib/macos-bundle.ts
@@ -3664,7 +4909,7 @@ var WAVE_FORMAT_PCM = 1;
 var WAVE_FORMAT_EXTENSIBLE = 65534;
 var SUBFORMAT_OFFSET_IN_EXTENSION = 8;
 function readWavPeak(filepath) {
-  const buf = readFileSync3(filepath);
+  const buf = readFileSync4(filepath);
   if (buf.length < RIFF_HEADER_BYTES) {
     throw new Error(`not a RIFF file (${buf.length} bytes): ${filepath}`);
   }
@@ -3739,9 +4984,9 @@ function probeMicrophoneCapture(config, options = {}) {
     peak: 0,
     silent: null
   };
-  const filepath = join6(tmpdir(), `recordings-capture-probe-${process.pid}-${Date.now()}.wav`);
+  const filepath = join7(tmpdir(), `recordings-capture-probe-${process.pid}-${Date.now()}.wav`);
   try {
-    const result = spawnSync2(executable, [
+    const result = spawnSync4(executable, [
       "-q",
       "-r",
       String(config.sample_rate),
@@ -3839,37 +5084,37 @@ function captureProbeSubject(env = process.env, options = {}) {
   const termProgram = env.TERM_PROGRAM?.trim();
   const hasTty = options.hasTty ?? Boolean(process.stdin.isTTY || process.stdout.isTTY);
   if (overSsh) {
-    const subject2 = "the SSH session (sshd), not HasnaRecordings.app";
+    const subject2 = "the SSH session (sshd), not Hasna Recordings.app";
     return {
       headless: true,
       subject_known: true,
       subject: subject2,
-      note: "Running over SSH: macOS cannot display a consent prompt to a session with no GUI, " + "so Microphone stays not_determined and a silent capture here says NOTHING about " + "whether HasnaRecordings.app can record. Judge the app by its own TCC entry and its log."
+      note: "Running over SSH: macOS cannot display a consent prompt to a session with no GUI, " + "so Microphone stays not_determined and a silent capture here says NOTHING about " + "whether Hasna Recordings.app can record. Judge the app by its own TCC entry and its log."
     };
   }
   if (inTmux) {
-    const subject2 = "the tmux server, not HasnaRecordings.app and not this pane's shell";
+    const subject2 = "the tmux server, not Hasna Recordings.app and not this pane's shell";
     return {
       headless: false,
       subject_known: true,
       subject: subject2,
-      note: "Running inside tmux: TCC attributes this capture to the tmux binary, which holds its " + "own grant. tmux also snapshots the environment at pane creation, so SSH variables may " + "be missing even in a remote session \u2014 treat a silent result as inconclusive about both " + "HasnaRecordings.app and about whether anyone could have been prompted."
+      note: "Running inside tmux: TCC attributes this capture to the tmux binary, which holds its " + "own grant. tmux also snapshots the environment at pane creation, so SSH variables may " + "be missing even in a remote session \u2014 treat a silent result as inconclusive about both " + "Hasna Recordings.app and about whether anyone could have been prompted."
     };
   }
   if (!termProgram && !hasTty) {
     return {
       headless: true,
       subject_known: false,
-      subject: "an unidentified responsible process (not HasnaRecordings.app)",
-      note: "The responsible process could not be identified: no SSH variables, no TERM_PROGRAM and " + "no tty, which is what launchd, cron, CI and sudo look like. Whatever holds the grant, it " + "is not HasnaRecordings.app, and nothing here can be shown a consent prompt. Inconclusive."
+      subject: "an unidentified responsible process (not Hasna Recordings.app)",
+      note: "The responsible process could not be identified: no SSH variables, no TERM_PROGRAM and " + "no tty, which is what launchd, cron, CI and sudo look like. Whatever holds the grant, it " + "is not Hasna Recordings.app, and nothing here can be shown a consent prompt. Inconclusive."
     };
   }
-  const subject = `${termProgram || "the terminal application running this command"}, not HasnaRecordings.app`;
+  const subject = `${termProgram || "the terminal application running this command"}, not Hasna Recordings.app`;
   return {
     headless: false,
     subject_known: Boolean(termProgram),
     subject,
-    note: `Grants are per responsible process: this probe exercises ${subject}. ` + "A pass proves the microphone hardware and the input device work; it does not " + "transfer to HasnaRecordings.app, which needs its own grant."
+    note: `Grants are per responsible process: this probe exercises ${subject}. ` + "A pass proves the microphone hardware and the input device work; it does not " + "transfer to Hasna Recordings.app, which needs its own grant."
   };
 }
 var TCC_UNREADABLE_STATE = TCC_DATABASE_UNREADABLE_STATE;
@@ -3899,7 +5144,7 @@ function microphoneGrantInstruction(options) {
   const bundlePath = candidates[0] ?? null;
   const steps = [];
   if (!bundlePath) {
-    steps.push("No HasnaRecordings.app bundle was found on disk, so there is nothing to grant Microphone to yet. " + "Install the app first ('recordings app install').");
+    steps.push("No Hasna Recordings.app bundle was found on disk, so there is nothing to grant Microphone to yet. " + "Install the app first ('recordings app install').");
     return {
       bundle_path: null,
       bundle_identifier: RECORDINGS_BUNDLE_IDENTIFIER,
@@ -3908,10 +5153,10 @@ function microphoneGrantInstruction(options) {
     };
   }
   if (candidates.length > 1) {
-    steps.push(`AMBIGUOUS: ${candidates.length} HasnaRecordings.app bundles exist (${candidates.join(", ")}). ` + "A TCC grant is bound to the bundle's code signature, so granting one does not grant the " + "other, and the toggle in Settings does not say which is which. Remove the bundles you are " + "not running before granting, or the grant may attach to the wrong one.");
+    steps.push(`AMBIGUOUS: ${candidates.length} Hasna Recordings.app bundles exist (${candidates.join(", ")}). ` + "A TCC grant is bound to the bundle's code signature, so granting one does not grant the " + "other, and the toggle in Settings does not say which is which. Remove the bundles you are " + "not running before granting, or the grant may attach to the wrong one.");
   }
   steps.push(`At the keyboard on the machine itself (not over SSH), launch ${bundlePath} and start a ` + "recording once. macOS shows the consent sheet titled " + `"\u201CRecordings\u201D would like to access the microphone" \u2014 click Allow.`);
-  steps.push("If no sheet appears, open System Settings \u2192 Privacy & Security \u2192 Microphone " + "and switch ON the row named \u201CRecordings\u201D. " + `That row is bundle ${RECORDINGS_BUNDLE_IDENTIFIER} at ${bundlePath}; the binary that ` + `receives the grant is ${join6(bundlePath, "Contents", "MacOS", "Recordings")}.`);
+  steps.push("If no sheet appears, open System Settings \u2192 Privacy & Security \u2192 Microphone " + "and switch ON the row named \u201CRecordings\u201D. " + `That row is bundle ${RECORDINGS_BUNDLE_IDENTIFIER} at ${bundlePath}; the binary that ` + `receives the grant is ${join7(bundlePath, "Contents", "MacOS", "Recordings")}.`);
   if (options.requestState === "never_requested") {
     steps.push("Note: the app has never requested microphone access on this machine (no TCC entry exists), " + "so the Microphone list will NOT contain a \u201CRecordings\u201D row until the app asks once. " + "Do the launch-and-record step first; the Settings toggle only exists afterwards.");
   } else if (options.requestState === "unknown") {
@@ -3930,7 +5175,7 @@ function microphoneGrantInstruction(options) {
 // src/lib/persistence-probe.ts
 import { Database as Database2 } from "bun:sqlite";
 import { existsSync as existsSync5 } from "fs";
-var AUTO_FLIP_MODE_SOURCE = "auto:api-url+api-key";
+var ENV_CREDENTIAL_MODE_SOURCE = "env";
 function safeBaseUrl(baseUrl) {
   if (!baseUrl)
     return baseUrl;
@@ -3974,42 +5219,51 @@ function localStoreIsBehindSchema(dbPath) {
     return null;
   }
 }
-function describeActiveStore(config, env = process.env) {
+function describeActiveStore(config, env = process.env, options = {}) {
   const localDbPath = config.db_path;
   const localDbPresent = existsSync5(localDbPath);
-  const localDbRecordings = localDbPresent ? readLocalRecordingCount(localDbPath) : null;
-  let resolution;
-  try {
-    resolution = resolveTransport(APP, env);
-  } catch (error) {
+  const status = getRecordingsTransportStatus(env, options);
+  if (!status.ok) {
+    const issues = status.issues.length > 0 ? status.issues.join(" ") : null;
     return {
-      transport: "sqlite",
+      transport: "none",
       mode_source: "unresolved",
       base_url: null,
       local_db_path: localDbPath,
       local_db_present: localDbPresent,
-      local_db_recordings: localDbRecordings,
+      local_db_recordings: null,
+      divergent: false,
+      warning: issues ? redactKeyMaterial(issues) : null
+    };
+  }
+  if (!status.selected) {
+    return {
+      transport: "sqlite",
+      mode_source: "local-opt-in",
+      base_url: null,
+      local_db_path: localDbPath,
+      local_db_present: localDbPresent,
+      local_db_recordings: localDbPresent ? readLocalRecordingCount(localDbPath) : null,
       divergent: false,
-      warning: redactKeyMaterial(`could not resolve the active store: ${error.message}`)
+      warning: null
     };
   }
-  const divergent = resolution.transport === "http" && (localDbRecordings ?? 0) > 0;
+  const localDbRecordings = localDbPresent ? readLocalRecordingCount(localDbPath) : null;
+  const divergent = (localDbRecordings ?? 0) > 0;
   const warnings = [];
-  if (resolution.warning)
-    warnings.push(resolution.warning);
-  if (resolution.transport === "http" && localDbPresent && localDbRecordings === null) {
-    warnings.push(`writes go to ${safeBaseUrl(resolution.baseUrl)}, and ${localDbPath} exists but could not be counted, ` + "so whether a second dataset is sitting there is UNKNOWN \u2014 not 'none'.");
+  if (status.api_key_tier === ENV_CREDENTIAL_MODE_SOURCE) {
+    warnings.push("the credential came from the process environment (HASNA_RECORDINGS_API_KEY): a shell export is a " + "snapshot taken when the shell started, so a rotation stays invisible until that shell exits. " + "Check `launchctl getenv HASNA_RECORDINGS_API_KEY` too: a launchd session variable " + "is inherited by the GUI app as well as by shells, and is invisible in a login profile. " + "Prefer the Keychain item hasna.credentials.recordings.api-key or " + "~/.hasna/recordings/config/credentials, both re-read on every call.");
   }
-  if (divergent) {
-    warnings.push(`writes go to ${safeBaseUrl(resolution.baseUrl)}, but ${localDbPath} still holds ` + `${localDbRecordings} recordings from an earlier on-box-only period. ` + "That file is NOT the live store \u2014 auditing it undercounts and looks like data loss.");
+  if (localDbPresent && localDbRecordings === null) {
+    warnings.push(`writes go to ${safeBaseUrl(status.v1_base_url)}, and ${localDbPath} exists but could not be counted, ` + "so whether a second dataset is sitting there is UNKNOWN \u2014 not 'none'.");
   }
-  if (resolution.transport === "http" && resolution.modeSource === AUTO_FLIP_MODE_SOURCE) {
-    warnings.push("the API transport was selected by the mere PRESENCE of " + "HASNA_RECORDINGS_API_URL + HASNA_RECORDINGS_API_KEY. " + "Check `launchctl getenv HASNA_RECORDINGS_API_URL` too: a launchd session variable " + "is inherited by the GUI app as well as by shells, and is invisible in a login profile.");
+  if (divergent) {
+    warnings.push(`writes go to ${safeBaseUrl(status.v1_base_url)}, but ${localDbPath} still holds ` + `${localDbRecordings} recordings from an earlier on-box-only period. ` + "That file is NOT the live store \u2014 auditing it undercounts and looks like data loss.");
   }
   return {
-    transport: resolution.transport,
-    mode_source: resolution.modeSource,
-    base_url: safeBaseUrl(resolution.baseUrl),
+    transport: "http",
+    mode_source: `${status.api_key_source ?? status.api_key_tier}+${status.api_url_source ?? "default"}`,
+    base_url: safeBaseUrl(status.v1_base_url),
     local_db_path: localDbPath,
     local_db_present: localDbPresent,
     local_db_recordings: localDbRecordings,
@@ -4017,6 +5271,20 @@ function describeActiveStore(config, env = process.env) {
     warning: warnings.length > 0 ? warnings.join(" ") : null
   };
 }
+function activeStoreFailClosed(description) {
+  return description.transport === "none";
+}
+function describeActiveStoreLine(description, paint) {
+  if (activeStoreFailClosed(description)) {
+    const refusal = description.warning ? ` (${description.warning})` : "";
+    const file = description.local_db_present ? `${description.local_db_path} is present but NOT opened` : `${description.local_db_path} absent`;
+    return paint.fail(`\u2717 Active store: none \u2014 fail-closed${refusal}; ${file}`);
+  }
+  if (description.transport === "sqlite") {
+    return paint.pass(`\u2713 Active store: sqlite \u2192 ${description.local_db_path} (selected by ${description.mode_source})`);
+  }
+  return paint.pass(`\u2713 Active store: http \u2192 ${description.base_url ?? "?"} (selected by ${description.mode_source})`);
+}
 var PROBE_SEVERITY_GLYPHS = {
   pass: "\u2713",
   warn: "?",
@@ -4443,13 +5711,13 @@ ${block}` : block;
 }
 
 // src/cli/macos-permissions.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync6, mkdtempSync, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync2 } from "fs";
+import { spawnSync as spawnSync5 } from "child_process";
+import { existsSync as existsSync6, mkdtempSync, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join7 } from "path";
-var defaultPermissionHelperRunner = (executable, arguments_, options) => spawnSync3(executable, arguments_, options);
+import { join as join8 } from "path";
+var defaultPermissionHelperRunner = (executable, arguments_, options) => spawnSync5(executable, arguments_, options);
 function runMacOSPermissionRequest(appPath, runner = defaultPermissionHelperRunner) {
-  const executable = join7(appPath, "Contents", "MacOS", "Recordings");
+  const executable = join8(appPath, "Contents", "MacOS", "Recordings");
   const result = runner(executable, ["--request-permissions", "--open-permission-settings"], { stdio: "inherit" });
   return {
     exitCode: result.error ? 1 : result.status ?? 1,
@@ -4460,8 +5728,8 @@ var CODESIGN_REQUIREMENT_SATISFIED_STATUS = 0;
 var CODESIGN_REQUIREMENT_UNSATISFIED_STATUS = 3;
 function tccDatabasePaths(home) {
   return [
-    join7(home, "Library", "Application Support", "com.apple.TCC", "TCC.db"),
-    join7("/", "Library", "Application Support", "com.apple.TCC", "TCC.db")
+    join8(home, "Library", "Application Support", "com.apple.TCC", "TCC.db"),
+    join8("/", "Library", "Application Support", "com.apple.TCC", "TCC.db")
   ];
 }
 function tccAuthValueLabel(value) {
@@ -4478,7 +5746,7 @@ function tccAuthValueLabel(value) {
       return `unknown(${value})`;
   }
 }
-var defaultCodesignRequirementRunner = (requirementPath, appPath) => spawnSync3("/usr/bin/codesign", ["--verify", "--verbose=2", "-R", requirementPath, appPath], { encoding: "utf8", stdio: ["ignore", "ignore", "ignore"] });
+var defaultCodesignRequirementRunner = (requirementPath, appPath) => spawnSync5("/usr/bin/codesign", ["--verify", "--verbose=2", "-R", requirementPath, appPath], { encoding: "utf8", stdio: ["ignore", "ignore", "ignore"] });
 function verifyStoredRequirementWithCodesign(csreqHex, appPath, runner = defaultCodesignRequirementRunner, bundleExists = existsSync6) {
   const normalized = csreqHex.trim();
   if (normalized.length === 0 || normalized.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(normalized)) {
@@ -4488,8 +5756,8 @@ function verifyStoredRequirementWithCodesign(csreqHex, appPath, runner = default
     return "unverifiable";
   let scratchDirectory = null;
   try {
-    scratchDirectory = mkdtempSync(join7(tmpdir2(), "recordings-tcc-csreq-"));
-    const requirementPath = join7(scratchDirectory, "tcc-requirement.bin");
+    scratchDirectory = mkdtempSync(join8(tmpdir2(), "recordings-tcc-csreq-"));
+    const requirementPath = join8(scratchDirectory, "tcc-requirement.bin");
     writeFileSync2(requirementPath, Buffer.from(normalized, "hex"));
     const result = runner(requirementPath, appPath);
     if (result.error)
@@ -4509,7 +5777,7 @@ function verifyStoredRequirementWithCodesign(csreqHex, appPath, runner = default
 var defaultTccPermissionProbe = {
   databasePresence: (dbPath) => {
     try {
-      statSync3(dbPath);
+      statSync2(dbPath);
       return "present";
     } catch (error) {
       return error.code === "ENOENT" ? "absent" : "indeterminate";
@@ -4517,7 +5785,7 @@ var defaultTccPermissionProbe = {
   },
   readAccessRow: (dbPath, service) => {
     const sql = "select ifnull(auth_value, '') || '|' || ifnull(hex(csreq), '') from access where service = '" + service.replace(/'/g, "''") + "' and client = '" + RECORDINGS_BUNDLE_IDENTIFIER + "' and client_type = 0 order by last_modified desc limit 1;";
-    const result = spawnSync3("/usr/bin/sqlite3", [dbPath, sql], {
+    const result = spawnSync5("/usr/bin/sqlite3", [dbPath, sql], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -4538,7 +5806,7 @@ var defaultTccPermissionProbe = {
   verifyStoredRequirement: (csreqHex, appPath) => verifyStoredRequirementWithCodesign(csreqHex, appPath),
   describeStoredRequirement: (csreqHex) => describeStoredRequirementWithCsreq(csreqHex)
 };
-function describeStoredRequirementWithCsreq(csreqHex, runner = (requirementPath) => spawnSync3("/usr/bin/csreq", ["-r", requirementPath, "-t"], {
+function describeStoredRequirementWithCsreq(csreqHex, runner = (requirementPath) => spawnSync5("/usr/bin/csreq", ["-r", requirementPath, "-t"], {
   encoding: "utf8",
   stdio: ["ignore", "pipe", "ignore"]
 })) {
@@ -4548,8 +5816,8 @@ function describeStoredRequirementWithCsreq(csreqHex, runner = (requirementPath)
   }
   let scratchDirectory = null;
   try {
-    scratchDirectory = mkdtempSync(join7(tmpdir2(), "recordings-tcc-decode-"));
-    const requirementPath = join7(scratchDirectory, "tcc-requirement.bin");
+    scratchDirectory = mkdtempSync(join8(tmpdir2(), "recordings-tcc-decode-"));
+    const requirementPath = join8(scratchDirectory, "tcc-requirement.bin");
     writeFileSync2(requirementPath, Buffer.from(normalized, "hex"));
     const result = runner(requirementPath);
     if (result.error || result.status !== 0)
@@ -4638,7 +5906,7 @@ function describeTccAuthorizationSubject(appPath) {
 }
 
 // src/cli/macos-shortcut.ts
-import { spawnSync as spawnSync4 } from "child_process";
+import { spawnSync as spawnSync6 } from "child_process";
 import { existsSync as existsSync7 } from "fs";
 var TRIGGER_DEFAULTS_EXECUTABLE = process.platform === "darwin" ? "/usr/bin/defaults" : process.env.RECORDINGS_TEST_DEFAULTS_EXECUTABLE ?? null;
 var RECORDINGS_BUNDLE_ID = RECORDINGS_BUNDLE_IDENTIFIER;
@@ -4845,14 +6113,14 @@ var defaultBundleIdentifierReader = (bundlePath) => {
   if (!existsSync7(`${bundlePath}/Contents/Info.plist`) && !existsSync7(`${bundlePath}/Contents/Info`)) {
     return null;
   }
-  const result = spawnSync4(TRIGGER_DEFAULTS_EXECUTABLE, ["read", `${bundlePath}/Contents/Info`, "CFBundleIdentifier"], { encoding: "utf8" });
+  const result = spawnSync6(TRIGGER_DEFAULTS_EXECUTABLE, ["read", `${bundlePath}/Contents/Info`, "CFBundleIdentifier"], { encoding: "utf8" });
   if (result.status !== 0)
     return null;
   return result.stdout.trim() || null;
 };
 var PROCESS_LISTER_EXECUTABLE = process.platform === "darwin" ? "/bin/ps" : process.env.RECORDINGS_TEST_PS_EXECUTABLE ?? "/bin/ps";
 var defaultProcessLister = () => {
-  const result = spawnSync4(PROCESS_LISTER_EXECUTABLE, ["-Awwo", "comm="], { encoding: "utf8" });
+  const result = spawnSync6(PROCESS_LISTER_EXECUTABLE, ["-Awwo", "comm="], { encoding: "utf8" });
   if (result.status !== 0)
     return null;
   return result.stdout;
@@ -4897,7 +6165,7 @@ function isThisApp(candidate, readBundleIdentifier) {
 function readDefault(key) {
   if (TRIGGER_DEFAULTS_EXECUTABLE === null)
     return null;
-  const result = spawnSync4(TRIGGER_DEFAULTS_EXECUTABLE, ["read", RECORDINGS_BUNDLE_ID, key], {
+  const result = spawnSync6(TRIGGER_DEFAULTS_EXECUTABLE, ["read", RECORDINGS_BUNDLE_ID, key], {
     encoding: "utf8"
   });
   if (result.status !== 0)
@@ -4908,7 +6176,7 @@ function writeDefault(key, value) {
   if (TRIGGER_DEFAULTS_EXECUTABLE === null) {
     throw new Error(`cannot write ${key}: this machine has no readable app UserDefaults domain`);
   }
-  const result = spawnSync4(TRIGGER_DEFAULTS_EXECUTABLE, ["write", RECORDINGS_BUNDLE_ID, key, "-string", value], {
+  const result = spawnSync6(TRIGGER_DEFAULTS_EXECUTABLE, ["write", RECORDINGS_BUNDLE_ID, key, "-string", value], {
     encoding: "utf8"
   });
   if (result.status !== 0) {
@@ -4944,14 +6212,14 @@ function writeUseFnKey(enabled) {
   if (TRIGGER_DEFAULTS_EXECUTABLE === null) {
     throw new Error(`cannot write ${USE_FN_KEY_DEFAULTS_KEY}: this machine has no readable app UserDefaults domain`);
   }
-  const result = spawnSync4(TRIGGER_DEFAULTS_EXECUTABLE, ["write", RECORDINGS_BUNDLE_ID, USE_FN_KEY_DEFAULTS_KEY, "-bool", enabled ? "true" : "false"], { encoding: "utf8" });
+  const result = spawnSync6(TRIGGER_DEFAULTS_EXECUTABLE, ["write", RECORDINGS_BUNDLE_ID, USE_FN_KEY_DEFAULTS_KEY, "-bool", enabled ? "true" : "false"], { encoding: "utf8" });
   if (result.status !== 0) {
     throw new Error(`defaults write ${USE_FN_KEY_DEFAULTS_KEY} failed: ${result.stderr?.trim() || `exit ${result.status}`}`);
   }
 }
 
 // src/cli/trigger-probe.ts
-import { closeSync, openSync, readSync, statSync as statSync4 } from "fs";
+import { closeSync as closeSync3, openSync as openSync3, readSync, statSync as statSync3 } from "fs";
 var FN_BLOCKING_ACCESSIBILITY_STATES = [
   "denied",
   "stale_allowed_for_previous_app_build"
@@ -5070,12 +6338,12 @@ function readAppLogTail(logPath, maxBytes = APP_LOG_TAIL_BYTES) {
     return null;
   let handle = null;
   try {
-    const size = statSync4(logPath).size;
+    const size = statSync3(logPath).size;
     if (size === 0)
       return null;
     const length = Math.min(size, maxBytes);
     const buffer = Buffer.allocUnsafe(length);
-    handle = openSync(logPath, "r");
+    handle = openSync3(logPath, "r");
     const read = readSync(handle, buffer, 0, length, size - length);
     return buffer.subarray(0, read).toString("utf8");
   } catch {
@@ -5083,7 +6351,7 @@ function readAppLogTail(logPath, maxBytes = APP_LOG_TAIL_BYTES) {
   } finally {
     if (handle !== null) {
       try {
-        closeSync(handle);
+        closeSync3(handle);
       } catch {}
     }
   }
@@ -5190,10 +6458,10 @@ function currentMachineId(env = process.env, hostName = hostname()) {
 }
 
 // src/lib/bun-runtime.ts
-import { accessSync, constants as fsConstants, realpathSync as realpathSync3, statSync as statSync5 } from "fs";
-import { isAbsolute as isAbsolute2 } from "path";
+import { accessSync, constants as fsConstants, realpathSync as realpathSync3, statSync as statSync4 } from "fs";
+import { isAbsolute as isAbsolute4 } from "path";
 import { randomBytes } from "crypto";
-import { spawnSync as spawnSync5 } from "child_process";
+import { spawnSync as spawnSync7 } from "child_process";
 var BUN_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 var INSTALLER_ENVIRONMENT_KEYS = [
   "HOME",
@@ -5207,19 +6475,19 @@ var INSTALLER_ENVIRONMENT_KEYS = [
 ];
 var INSTALLER_PATH = "/usr/bin:/bin:/usr/sbin:/sbin";
 function validateBunExecutable(candidate) {
-  if (!isAbsolute2(candidate))
+  if (!isAbsolute4(candidate))
     return { reason: "path is not absolute" };
   let executable;
   try {
     executable = realpathSync3(candidate);
-    if (!statSync5(executable).isFile())
+    if (!statSync4(executable).isFile())
       return { reason: "resolved path is not a regular file" };
     accessSync(executable, fsConstants.X_OK);
   } catch {
     return { reason: "path is missing, inaccessible, or not executable" };
   }
   const nonce = randomBytes(24).toString("hex");
-  const probe = spawnSync5(executable, [
+  const probe = spawnSync7(executable, [
     "-e",
     `
         import { realpathSync, statSync } from "node:fs";
@@ -5283,20 +6551,20 @@ function createInstallerEnvironment(environment, bunExecutable) {
 }
 
 // src/lib/release-install-policy.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import {
   chmodSync as chmodSync2,
-  closeSync as closeSync2,
+  closeSync as closeSync4,
   constants,
-  fstatSync,
+  fstatSync as fstatSync3,
   fsyncSync,
   mkdtempSync as mkdtempSync2,
-  openSync as openSync2,
-  readFileSync as readFileSync4,
+  openSync as openSync4,
+  readFileSync as readFileSync5,
   rmSync as rmSync4,
   writeFileSync as writeFileSync3
 } from "fs";
-import { isAbsolute as isAbsolute3, join as join8 } from "path";
+import { isAbsolute as isAbsolute5, join as join9 } from "path";
 var LOWER_SHA256 = /^[a-f0-9]{64}$/;
 var LOWER_SOURCE_SHA = /^[a-f0-9]{40}$/;
 var RELEASE_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
@@ -5356,7 +6624,7 @@ function prepareReleaseInstallInputs(input) {
     throw new Error("Team ID must be 10 uppercase alphanumeric characters");
   }
   const manifestBytes = readBoundedRegularFile(input.manifestPath, "manifest", MAX_MANIFEST_BYTES);
-  const actualManifestSha256 = createHash2("sha256").update(manifestBytes).digest("hex");
+  const actualManifestSha256 = createHash3("sha256").update(manifestBytes).digest("hex");
   if (actualManifestSha256 !== input.manifestSha256) {
     throw new Error("manifest does not match the operator-approved SHA-256");
   }
@@ -5366,10 +6634,10 @@ function prepareReleaseInstallInputs(input) {
   assertReleaseManifest(manifest, input);
   assertReleaseEnvelope(envelope, manifest, manifestBytes.byteLength, input);
   const snapshotRoot = input.snapshotRoot ?? "/private/tmp";
-  if (!isAbsolute3(snapshotRoot)) {
+  if (!isAbsolute5(snapshotRoot)) {
     throw new Error("release snapshot root must be absolute");
   }
-  const snapshotDirectory = mkdtempSync2(join8(snapshotRoot, "recordings-release-install."));
+  const snapshotDirectory = mkdtempSync2(join9(snapshotRoot, "recordings-release-install."));
   let cleaned = false;
   const cleanup = () => {
     if (cleaned)
@@ -5381,9 +6649,9 @@ function prepareReleaseInstallInputs(input) {
     rmSync4(snapshotDirectory, { recursive: true, force: true });
   };
   try {
-    const manifestSnapshot = join8(snapshotDirectory, `${input.manifestSha256}.manifest.json`);
-    const envelopeDigest = createHash2("sha256").update(envelopeBytes).digest("hex");
-    const envelopeSnapshot = join8(snapshotDirectory, `${envelopeDigest}.envelope.json`);
+    const manifestSnapshot = join9(snapshotDirectory, `${input.manifestSha256}.manifest.json`);
+    const envelopeDigest = createHash3("sha256").update(envelopeBytes).digest("hex");
+    const envelopeSnapshot = join9(snapshotDirectory, `${envelopeDigest}.envelope.json`);
     writeSnapshot(manifestSnapshot, manifestBytes);
     writeSnapshot(envelopeSnapshot, envelopeBytes);
     chmodSync2(snapshotDirectory, 320);
@@ -5394,19 +6662,19 @@ function prepareReleaseInstallInputs(input) {
   }
 }
 function assertAbsolutePath(value, label) {
-  if (!isAbsolute3(value))
+  if (!isAbsolute5(value))
     throw new Error(`${label} path must be absolute`);
 }
 function readBoundedRegularFile(path, label, maximum) {
-  const descriptor = openSync2(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  const descriptor = openSync4(path, constants.O_RDONLY | constants.O_NOFOLLOW);
   try {
-    const metadata = fstatSync(descriptor);
+    const metadata = fstatSync3(descriptor);
     if (!metadata.isFile() || metadata.size < 1 || metadata.size > maximum) {
       throw new Error(`${label} must be a non-empty bounded regular file`);
     }
-    return readFileSync4(descriptor);
+    return readFileSync5(descriptor);
   } finally {
-    closeSync2(descriptor);
+    closeSync4(descriptor);
   }
 }
 function parseObject(bytes, label) {
@@ -5486,22 +6754,22 @@ function isObject(value) {
 }
 function writeSnapshot(path, bytes) {
   writeFileSync3(path, bytes, { flag: "wx", mode: 256 });
-  const descriptor = openSync2(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  const descriptor = openSync4(path, constants.O_RDONLY | constants.O_NOFOLLOW);
   try {
     fsyncSync(descriptor);
   } finally {
-    closeSync2(descriptor);
+    closeSync4(descriptor);
   }
 }
 
 // src/cli/desktop-snapshot.ts
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync3, renameSync as renameSync2, rmSync as rmSync5, statSync as statSync6 } from "fs";
-import { dirname as dirname4, join as join9, resolve as resolve3 } from "path";
-import { spawnSync as spawnSync6 } from "child_process";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync3, renameSync as renameSync2, rmSync as rmSync5, statSync as statSync5 } from "fs";
+import { dirname as dirname4, join as join10, resolve as resolve3 } from "path";
+import { spawnSync as spawnSync8 } from "child_process";
 var SCREEN_CAPTURE_EXECUTABLE = "/usr/sbin/screencapture";
 var DEFAULT_DESKTOP_SNAPSHOT = "desktop-snapshot.png";
 function runScreenCapture(executable, arguments_) {
-  const result = spawnSync6(executable, arguments_, {
+  const result = spawnSync8(executable, arguments_, {
     encoding: "utf8",
     stdio: ["ignore", "ignore", "pipe"]
   });
@@ -5518,9 +6786,9 @@ function exportDesktopSnapshot(output = DEFAULT_DESKTOP_SNAPSHOT, dependencies =
   const destination = resolve3(dependencies.cwd ?? process.cwd(), output);
   const destinationDirectory = dirname4(destination);
   mkdirSync4(destinationDirectory, { recursive: true });
-  const stagingDirectory = mkdtempSync3(join9(destinationDirectory, ".recordings-desktop-"));
+  const stagingDirectory = mkdtempSync3(join10(destinationDirectory, ".recordings-desktop-"));
   chmodSync3(stagingDirectory, 448);
-  const stagingPath = join9(stagingDirectory, "snapshot.png");
+  const stagingPath = join10(stagingDirectory, "snapshot.png");
   try {
     const capture = dependencies.capture ?? runScreenCapture;
     const result = capture(SCREEN_CAPTURE_EXECUTABLE, [
@@ -5540,7 +6808,7 @@ function exportDesktopSnapshot(output = DEFAULT_DESKTOP_SNAPSHOT, dependencies =
     }
     let size = 0;
     try {
-      const snapshot = statSync6(stagingPath);
+      const snapshot = statSync5(stagingPath);
       if (snapshot.isFile())
         size = snapshot.size;
     } catch {}
@@ -5643,7 +6911,7 @@ Output:`));
     })
   });
   if (parentOpts.json) {
-    console.log(JSON.stringify(recording, null, 2));
+    await printJSON(recording);
   } else {
     console.log(chalk.dim(`
 Saved as ${recording.id.slice(0, 8)}`));
@@ -5695,7 +6963,7 @@ program.command("transcribe <file>").description("Transcribe an existing audio f
     })
   }, recordingId);
   if (parentOpts.json) {
-    console.log(JSON.stringify(recording, null, 2));
+    await printJSON(recording);
   } else if (processed.mode === "enhanced") {
     console.log(chalk.green("Enhanced:"));
     console.log(processed.text);
@@ -5750,7 +7018,7 @@ program.command("save-text [text]").description("Save already-transcribed text a
     metadata
   }, recordingId);
   if (parentOpts.json) {
-    console.log(JSON.stringify(recording, null, 2));
+    await printJSON(recording);
   } else if (processed.mode === "enhanced") {
     console.log(processed.text);
   } else {
@@ -5772,11 +7040,11 @@ ${text}`;
   try {
     const result = await enhanceText(text, instruction, config);
     if (parentOpts.json) {
-      console.log(JSON.stringify({
+      await printJSON({
         raw_text: text,
         processed_text: result.enhanced,
         model_used: result.model
-      }, null, 2));
+      });
     } else {
       console.log(result.enhanced);
     }
@@ -5815,7 +7083,7 @@ program.command("save <text>").description("Save raw text as a recording (no aud
       machine_id: currentMachineId()
     });
     if (parentOpts.json) {
-      console.log(JSON.stringify(recording, null, 2));
+      await printJSON(recording);
     } else {
       console.log(chalk.green(`\u2713 Saved recording ${recording.id}`));
     }
@@ -5842,7 +7110,7 @@ program.command("list").description("List recordings in compact form").option("-
   const store = getStore();
   const recordings = await store.listRecordings(filter);
   if (parentOpts.json) {
-    console.log(JSON.stringify(recordings, null, 2));
+    await printJSON(recordings);
     return;
   }
   const total = await countStoreRecordings(store, withoutPagination(filter));
@@ -5874,7 +7142,7 @@ program.command("search <query>").description("Search recordings by text content
   const store = getStore();
   const results = await store.searchRecordings(query, filter);
   if (parentOpts.json) {
-    console.log(JSON.stringify(results, null, 2));
+    await printJSON(results);
     return;
   }
   const total = await countStoreRecordings(store, withoutPagination({ ...filter, search: query }));
@@ -5900,7 +7168,7 @@ program.command("stats").description("Show recording statistics").action(async (
   const parentOpts = program.opts();
   const stats = await getStore().getRecordingStats();
   if (parentOpts.json) {
-    console.log(JSON.stringify(stats, null, 2));
+    await printJSON(stats);
     return;
   }
   console.log(chalk.bold(`Recording Statistics
@@ -5926,7 +7194,7 @@ program.command("agents").description("List registered agents").option("-n, --li
   const agents = await getStore().listAgents();
   const page = parentOpts.json ? maybePageJson(agents, pagination, opts) : pageItems(agents, pagination);
   if (parentOpts.json) {
-    console.log(JSON.stringify(page, null, 2));
+    await printJSON(page);
     return;
   }
   if (page.length === 0) {
@@ -5953,7 +7221,7 @@ projectCommand.command("register").description("Register a project in the active
   const parentOpts = program.opts();
   const project = await getStore().registerProject(opts.name, opts.path, opts.description);
   if (parentOpts.json) {
-    console.log(JSON.stringify(project, null, 2));
+    await printJSON(project);
     return;
   }
   console.log(`${chalk.cyan(truncateText(project.id, 80))} ${chalk.bold(truncateText(project.name, 80))} \u2014 ${truncatePath(project.path, 120)}`);
@@ -5964,7 +7232,7 @@ program.command("projects").description("List registered projects").option("-n,
   const projects = await getStore().listProjects();
   const page = parentOpts.json ? maybePageJson(projects, pagination, opts) : pageItems(projects, pagination);
   if (parentOpts.json) {
-    console.log(JSON.stringify(page, null, 2));
+    await printJSON(page);
     return;
   }
   if (page.length === 0) {
@@ -5989,10 +7257,10 @@ program.command("projects").description("List registered projects").option("-n,
 });
 program.command("init").description("Initialize .recordings/ in current directory").action(() => {
   const { mkdirSync: mkdirSync5, writeFileSync: writeFileSync4, existsSync: existsSync9 } = __require("fs");
-  const { join: join10 } = __require("path");
-  const dir = join10(process.cwd(), ".recordings");
-  const audioDir = join10(dir, "audio");
-  const configFile = join10(dir, "config.json");
+  const { join: join11 } = __require("path");
+  const dir = join11(process.cwd(), ".recordings");
+  const audioDir = join11(dir, "audio");
+  const configFile = join11(dir, "config.json");
   mkdirSync5(audioDir, { recursive: true });
   if (!existsSync9(configFile)) {
     const defaultConf = {
@@ -6015,9 +7283,9 @@ program.command("init").description("Initialize .recordings/ in current director
   console.log(chalk.dim("  db:     .recordings/recordings.db"));
 });
 var appCommand = program.command("app").description("Manage the macOS app installed from this package");
-appCommand.command("install").description("Install a release or explicitly approved local-only HasnaRecordings.app artifact").requiredOption("--artifact <path>", "Finalized HasnaRecordings.app ZIP artifact").requiredOption("--manifest <path>", "Artifact provenance manifest").option("--envelope <path>", "Signed release envelope (required for release artifacts)").option("--expected-team-id <team>", "Required Developer ID TeamIdentifier for release artifacts").requiredOption("--manifest-sha256 <sha256>", "Authenticated release-manifest SHA-256").requiredOption("--expected-source-sha <sha>", "Exact approved 40-character source commit").requiredOption("--expected-version <version>", "Exact approved release version").option("--expected-hostname <hostname>", "Exact deployment hostname to verify before any install mutation").option("--artifact-policy <policy>", "Artifact policy: release or local-only", "release").option("--approved-target <station>", "Exact approved target; fleet for release artifacts", "fleet").option("--variant <variant>", "Artifact variant the operator intends to install: full or bar (default: full)", "full").option("--approved-target-identity-kind <kind>", "Target identity kind: hardware_uuid_sha256 or tailscale_node_id_sha256").option("--approved-target-identity-sha256 <sha256>", "Authenticated SHA-256 of the approved target identity; none for release artifacts", "none").option("--acknowledge-local-signing-and-permissions", "Acknowledge local-only ad-hoc identity and possible permission reauthorization").option("--expected-old-identity-sha256 <sha256>", "Exact installed identity approved for migration").option("--expected-new-identity-sha256 <sha256>", "Exact candidate identity approved for migration").option("--allow-signing-identity-migration", "Allow one reviewed signer change that requires new macOS permission approval").option("--allow-adhoc-identity-migration", "Accept that replacing an ad-hoc signed local-only app voids its Microphone and Accessibility grants").option("--launch", "Launch and verify the canonical app after installation").option("--launch-timeout <seconds>", "Canonical process launch timeout").action((opts) => {
+appCommand.command("install").description("Install a release or explicitly approved local-only Hasna Recordings.app artifact").requiredOption("--artifact <path>", "Finalized Hasna Recordings.app ZIP artifact").requiredOption("--manifest <path>", "Artifact provenance manifest").option("--envelope <path>", "Signed release envelope (required for release artifacts)").option("--expected-team-id <team>", "Required Developer ID TeamIdentifier for release artifacts").requiredOption("--manifest-sha256 <sha256>", "Authenticated release-manifest SHA-256").requiredOption("--expected-source-sha <sha>", "Exact approved 40-character source commit").requiredOption("--expected-version <version>", "Exact approved release version").option("--expected-hostname <hostname>", "Exact deployment hostname to verify before any install mutation").option("--artifact-policy <policy>", "Artifact policy: release or local-only", "release").option("--approved-target <station>", "Exact approved target; fleet for release artifacts", "fleet").option("--variant <variant>", "Artifact variant the operator intends to install: full or bar (default: full)", "full").option("--approved-target-identity-kind <kind>", "Target identity kind: hardware_uuid_sha256 or tailscale_node_id_sha256").option("--approved-target-identity-sha256 <sha256>", "Authenticated SHA-256 of the approved target identity; none for release artifacts", "none").option("--acknowledge-local-signing-and-permissions", "Acknowledge local-only ad-hoc identity and possible permission reauthorization").option("--expected-old-identity-sha256 <sha256>", "Exact installed identity approved for migration").option("--expected-new-identity-sha256 <sha256>", "Exact candidate identity approved for migration").option("--allow-signing-identity-migration", "Allow one reviewed signer change that requires new macOS permission approval").option("--allow-adhoc-identity-migration", "Accept that replacing an ad-hoc signed local-only app voids its Microphone and Accessibility grants").option("--launch", "Launch and verify the canonical app after installation").option("--launch-timeout <seconds>", "Canonical process launch timeout").action((opts) => {
   if (process.platform !== "darwin") {
-    console.error(chalk.red("HasnaRecordings.app installation is only supported on macOS"));
+    console.error(chalk.red("Hasna Recordings.app installation is only supported on macOS"));
     process.exit(1);
   }
   if (opts.variant !== "full" && opts.variant !== "bar") {
@@ -6037,7 +7305,7 @@ appCommand.command("install").description("Install a release or explicitly appro
     try {
       assertReleaseOnlyOptions(opts);
       if (opts.expectedHostname) {
-        const hostnameResult = spawnSync7("/bin/hostname", ["-s"], {
+        const hostnameResult = spawnSync9("/bin/hostname", ["-s"], {
           encoding: "utf8",
           stdio: ["ignore", "pipe", "ignore"],
           env: {
@@ -6066,7 +7334,7 @@ appCommand.command("install").description("Install a release or explicitly appro
       process.exit(1);
     }
     const home = process.env.HOME || process.env.USERPROFILE || "";
-    const canonicalAppPath = pathJoin(home, "Applications", "HasnaRecordings.app");
+    const canonicalAppPath = pathJoin(home, "Applications", "Hasna Recordings.app");
     const legacyInstallPaths = findLegacyMacOSAppPaths(home, canonicalAppPath);
     const installedAppPath = resolveInstalledAppPath(home, canonicalAppPath, legacyInstallPaths);
     const updateClientPath = pathJoin(installedAppPath, "Contents", "Helpers", "recordings-update-client");
@@ -6077,7 +7345,7 @@ appCommand.command("install").description("Install a release or explicitly appro
     }
     const result2 = (() => {
       try {
-        return spawnSync7(updateClientPath, [
+        return spawnSync9(updateClientPath, [
           "install",
           "--artifact",
           opts.artifact,
@@ -6176,7 +7444,7 @@ appCommand.command("install").description("Install a release or explicitly appro
   if (opts.launch)
     installerArgs.push("--launch");
   const installerEnvironment = createInstallerEnvironment(process.env, bunExecutable);
-  const result = spawnSync7("/bin/bash", installerArgs, {
+  const result = spawnSync9("/bin/bash", installerArgs, {
     stdio: "inherit",
     env: installerEnvironment
   });
@@ -6186,7 +7454,7 @@ appCommand.command("install").description("Install a release or explicitly appro
   }
   process.exit(result.status ?? 1);
 });
-appCommand.command("status").description("Show installed HasnaRecordings.app status").option("--verbose", "Show package paths, code hash, and log path").action((opts) => {
+appCommand.command("status").description("Show installed Hasna Recordings.app status").option("--verbose", "Show package paths, code hash, and log path").action((opts) => {
   const status = getMacOSAppStatus();
   const trigger = probeTriggerDiagnostics({
     accessibilityPermission: process.platform === "darwin" ? status.accessibility_permission : null,
@@ -6226,7 +7494,7 @@ appCommand.command("status").description("Show installed HasnaRecordings.app sta
     console.log(chalk.dim("Use --verbose for paths/code hash/log, or --json for the full status object."));
   }
 });
-appCommand.command("permissions").description("Show macOS permission state for HasnaRecordings.app").action(() => {
+appCommand.command("permissions").description("Show macOS permission state for Hasna Recordings.app").action(() => {
   const status = getMacOSAppStatus();
   const permissions = {
     platform: status.platform,
@@ -6234,7 +7502,7 @@ appCommand.command("permissions").description("Show macOS permission state for H
     installed_app_path: status.installed_app_path,
     installed: status.installed,
     legacy_install_paths: status.legacy_install_paths,
-    permission_subject: describeTccAuthorizationSubject(status.installed_app_path),
+    permission_subject: describeTccAuthorizationSubject(status.installed ? status.installed_app_path : null),
     microphone: status.microphone_permission,
     accessibility: status.accessibility_permission,
     app_code_hash: status.app_code_hash,
@@ -6262,21 +7530,21 @@ appCommand.command("permissions").description("Show macOS permission state for H
   }
   console.log(`Log: ${permissions.log_path}`);
 });
-appCommand.command("reset-permissions").description("Reset macOS Microphone and Accessibility permissions for HasnaRecordings.app").action(() => {
+appCommand.command("reset-permissions").description("Reset macOS Microphone and Accessibility permissions for Hasna Recordings.app").action(() => {
   if (process.platform !== "darwin") {
     console.error(chalk.red("Permission reset is only available on macOS"));
     process.exit(1);
   }
   resetMacOSPermissions();
 });
-appCommand.command("request-permissions").description("Open HasnaRecordings.app and trigger macOS Microphone and Accessibility permission prompts").option("--reset", "Reset existing Microphone and Accessibility decisions before requesting").action((opts) => {
+appCommand.command("request-permissions").description("Open Hasna Recordings.app and trigger macOS Microphone and Accessibility permission prompts").option("--reset", "Reset existing Microphone and Accessibility decisions before requesting").action((opts) => {
   if (process.platform !== "darwin") {
     console.error(chalk.red("Permission prompts are only available on macOS"));
     process.exit(1);
   }
   const status = getMacOSAppStatus();
   if (!status.installed) {
-    console.error(chalk.red("HasnaRecordings.app is not installed. Run: recordings app install"));
+    console.error(chalk.red("Hasna Recordings.app is not installed. Run: recordings app install"));
     process.exit(1);
   }
   if (opts.reset) {
@@ -6288,14 +7556,14 @@ appCommand.command("request-permissions").description("Open HasnaRecordings.app
   }
   process.exit(result.exitCode);
 });
-appCommand.command("log").description("Show the HasnaRecordings.app diagnostic log").option("-n, --lines <lines>", "Number of lines to print", String(DEFAULT_LOG_LINES)).action((opts) => {
+appCommand.command("log").description("Show the Hasna Recordings.app diagnostic log").option("-n, --lines <lines>", "Number of lines to print", String(DEFAULT_LOG_LINES)).action((opts) => {
   const status = getMacOSAppStatus();
   if (!existsSync8(status.log_path)) {
     console.log("");
     return;
   }
   const lines = Math.max(1, parseInt(opts.lines, 10) || DEFAULT_LOG_LINES);
-  const result = spawnSync7("tail", ["-n", String(lines), status.log_path], {
+  const result = spawnSync9("tail", ["-n", String(lines), status.log_path], {
     encoding: "utf8"
   });
   if (result.error) {
@@ -6314,17 +7582,17 @@ appCommand.command("snapshot [output]").description("Write the current main desk
     console.log(chalk.green(`Desktop snapshot written: ${path}`));
   }
 });
-appCommand.command("open").description("Open the installed HasnaRecordings.app").action(() => {
+appCommand.command("open").description("Open the installed Hasna Recordings.app").action(() => {
   const status = getMacOSAppStatus();
   if (process.platform !== "darwin") {
-    console.error(chalk.red("HasnaRecordings.app can only be opened on macOS"));
+    console.error(chalk.red("Hasna Recordings.app can only be opened on macOS"));
     process.exit(1);
   }
   if (!status.installed) {
-    console.error(chalk.red("HasnaRecordings.app is not installed. Run: recordings app install"));
+    console.error(chalk.red("Hasna Recordings.app is not installed. Run: recordings app install"));
     process.exit(1);
   }
-  const result = spawnSync7("open", [status.installed_app_path], { stdio: "inherit" });
+  const result = spawnSync9("open", [status.installed_app_path], { stdio: "inherit" });
   if (result.error) {
     console.error(chalk.red(result.error.message));
     process.exit(1);
@@ -6410,8 +7678,9 @@ program.command("check").description("Check system dependencies (sox, API keys)
       persistence_probe: persistence,
       trigger
     }, null, 2));
-    if (probeFailed || triggerFailed)
+    if (probeFailed || triggerFailed || activeStoreFailClosed(activeStore)) {
       process.exitCode = 1;
+    }
     return;
   }
   if (deps.available) {
@@ -6422,14 +7691,18 @@ program.command("check").description("Check system dependencies (sox, API keys)
   if (config.openai_api_key) {
     console.log(chalk.green(`\u2713 OpenAI API key present`) + chalk.dim(opts.probe ? "" : " (presence only \u2014 run 'recordings check --probe' to verify it is accepted)"));
   } else {
-    console.log(chalk.red(`\u2717 OpenAI API key not found. Set OPENAI_API_KEY env var or add to ~/.secrets`));
+    console.log(chalk.red(`\u2717 OpenAI API key not found. Set OPENAI_API_KEY (e.g. ` + `'secrets exec <key> --as OPENAI_API_KEY -- recordings \u2026')`));
   }
   if (enhKey) {
     console.log(chalk.green(`\u2713 Enhancement API key present (model: ${transcriberModel})`) + chalk.dim(opts.probe ? "" : " (presence only \u2014 'recordings check --probe' verifies it is accepted)"));
   } else {
     console.log(chalk.yellow(`\u26A0 Enhancement API key not configured \u2014 enhancement disabled`));
   }
-  console.log(chalk.green("\u2713") + ` Active store: ${activeStore.transport}` + (activeStore.base_url ? ` \u2192 ${activeStore.base_url}` : ` \u2192 ${activeStore.local_db_path}`) + chalk.dim(` (selected by ${activeStore.mode_source})`));
+  console.log(describeActiveStoreLine(activeStore, {
+    pass: (text) => chalk.green(text),
+    warn: (text) => chalk.yellow(text),
+    fail: (text) => chalk.red(text)
+  }));
   if (activeStore.divergent) {
     console.log(chalk.yellow("\u26A0") + ` Two datasets present: ${activeStore.local_db_recordings} recordings sit in ` + `${activeStore.local_db_path}, which is NOT the live store.`);
   }
@@ -6453,7 +7726,7 @@ program.command("check").description("Check system dependencies (sox, API keys)
       console.log(chalk.dim("  Could not read the TCC database. This is NOT a denial and NOT proof the app never " + "asked. Reading it needs Full Disk Access, which is held by the session's " + "RESPONSIBLE process and inherited by its children \u2014 not granted per-tool: on " + "a fleet Mac `bun` is explicitly denied and still reads the database over SSH, " + "because it inherits sshd's grant. So re-run from a plain ssh shell rather than " + "granting Full Disk Access to tmux or bun, and not under sudo, which changes the " + "responsible process. A missing sqlite3, a locked database or a corrupt file " + "produce this same state, so the cause is not established either."));
     }
     if (!micOk && !micUnreadable) {
-      console.log(chalk.dim("  HasnaRecordings.app cannot capture audio without this. macOS does not error when it is " + "missing \u2014 it delivers silent audio. This grant CANNOT be set remotely; it needs a " + "human at the keyboard:"));
+      console.log(chalk.dim("  Hasna Recordings.app cannot capture audio without this. macOS does not error when it is " + "missing \u2014 it delivers silent audio. This grant CANNOT be set remotely; it needs a " + "human at the keyboard:"));
       const instruction = microphoneGrantInstruction({
         installedAppPath: macStatus.installed_app_path,
         otherAppPaths: macStatus.legacy_install_paths,
@@ -6486,7 +7759,7 @@ program.command("check").description("Check system dependencies (sox, API keys)
     });
     console.log(persistenceMarker + ` Persistence round-trip: ${persistence.message}`);
   }
-  if (probeFailed || triggerFailed)
+  if (probeFailed || triggerFailed || activeStoreFailClosed(activeStore))
     process.exitCode = 1;
 });
 function reportTriggerDiagnosis(trigger) {
@@ -6612,7 +7885,7 @@ Bye.`));
     }
   });
 });
-program.command("shortcut").description("Show or change the global recording trigger (macOS). Exits non-zero when a change was " + "written while HasnaRecordings.app was running, because the running instance keeps the " + "trigger it registered with \u2014 the write is stored but not armed until it is reopened.").option("--set <chord>", 'Set the app hotkey, e.g. "f13" or "ctrl+opt+r"').option("--reset", "Reset the app hotkey to the app's built-in default").option("--fn <state>", "Use fn/Globe as push-to-talk: on|off").option("--keys", "List the key names accepted by --set").option("--script", "Write the app-less toggle script and print its path").option("--raycast", "Generate a Raycast script command (requires Raycast)").option("--karabiner", "Generate a Karabiner-Elements rule (requires Karabiner-Elements)").option("--skhd", "Print an skhd hotkey config (requires skhd)").option("--hammerspoon", "Print a Hammerspoon config (requires Hammerspoon)").action((opts) => {
+program.command("shortcut").description("Show or change the global recording trigger (macOS). Exits non-zero when a change was " + "written while Hasna Recordings.app was running, because the running instance keeps the " + "trigger it registered with \u2014 the write is stored but not armed until it is reopened.").option("--set <chord>", 'Set the app hotkey, e.g. "f13" or "ctrl+opt+r"').option("--reset", "Reset the app hotkey to the app's built-in default").option("--fn <state>", "Use fn/Globe as push-to-talk: on|off").option("--keys", "List the key names accepted by --set").option("--script", "Write the app-less toggle script and print its path").option("--raycast", "Generate a Raycast script command (requires Raycast)").option("--karabiner", "Generate a Karabiner-Elements rule (requires Karabiner-Elements)").option("--skhd", "Print an skhd hotkey config (requires skhd)").option("--hammerspoon", "Print a Hammerspoon config (requires Hammerspoon)").action((opts) => {
   const { writeFileSync: writeFileSync4, mkdirSync: mkdirSync5, chmodSync: chmodSync4, existsSync: existsSync9 } = __require("fs");
   const { join: pathJoin2 } = __require("path");
   const { homedir: getHome } = __require("os");
@@ -6726,10 +7999,10 @@ program.command("shortcut").description("Show or change the global recording tri
   function reportPickup() {
     const pickup = describeTriggerPickup(runningBundles());
     if (pickup.armed) {
-      console.log(chalk.dim("  HasnaRecordings.app is not running; it will register this on next launch."));
+      console.log(chalk.dim("  Hasna Recordings.app is not running; it will register this on next launch."));
       return;
     }
-    console.log(chalk.yellow("  HasnaRecordings.app is running and still holds the previous trigger.") + `
+    console.log(chalk.yellow("  Hasna Recordings.app is running and still holds the previous trigger.") + `
   Quit and reopen it to arm this one:`);
     for (const path of pickup.runningBundlePaths)
       console.log(chalk.dim(`    ${path}`));
@@ -6788,7 +8061,7 @@ program.command("shortcut").description("Show or change the global recording tri
 ` + `    ${fnGrant.settingsPath} > enable Recordings`);
         const target = grantTargetPaths();
         if (target.paths.length === 0) {
-          console.log(chalk.dim("    (no installed HasnaRecordings.app found to grant it to)"));
+          console.log(chalk.dim("    (no installed Hasna Recordings.app found to grant it to)"));
         }
         for (const path of target.paths) {
           console.log(chalk.dim(`    grant it to: ${path}${target.running ? "" : " (not running \u2014 installed copy)"}`));
@@ -6815,7 +8088,7 @@ program.command("shortcut").description("Show or change the global recording tri
 # Toggle recording on/off. Run this from a global hotkey.
 # Each press toggles: start recording -> stop + transcribe + copy to clipboard
 #
-# This is the app-less path. If HasnaRecordings.app is running, prefer its own hotkey
+# This is the app-less path. If Hasna Recordings.app is running, prefer its own hotkey
 # ("recordings shortcut --set ..."): the app streams transcription and pastes into
 # the focused field, which this script cannot do.
 set -e
@@ -7012,7 +8285,7 @@ async function readSaveTextInput(text, opts) {
   }
   let rawText;
   if (opts.textFile !== undefined) {
-    rawText = readFileSync5(opts.textFile, "utf8");
+    rawText = readFileSync6(opts.textFile, "utf8");
   } else if (opts.stdin) {
     rawText = await Bun.stdin.text();
   } else {
@@ -7106,7 +8379,7 @@ async function printRecordingDetail(id) {
     return;
   }
   if (parentOpts.json) {
-    console.log(JSON.stringify(recording, null, 2));
+    await printJSON(recording);
     return;
   }
   console.log(formatRecordingDetail(recording));
@@ -7226,7 +8499,7 @@ function relativeHint(value) {
   return `${Math.floor(hours / 24)}d ago`;
 }
 program.command("mcp").description("Install recordings MCP server into Claude Code, Codex, or Gemini").option("--claude", "Install into Claude Code (via `claude mcp add`)").option("--codex", "Install into Codex (~/.codex/config.toml)").option("--gemini", "Install into Gemini (~/.gemini/settings.json)").option("--all", "Install into all supported agents").option("--uninstall", "Remove recordings MCP from config").action(async (opts) => {
-  const { readFileSync: readFileSync6, writeFileSync: writeFileSync4, existsSync: fileExists } = __require("fs");
+  const { readFileSync: readFileSync7, writeFileSync: writeFileSync4, existsSync: fileExists } = __require("fs");
   const { join: pathJoin2 } = __require("path");
   const { homedir: getHome } = __require("os");
   const { execSync } = __require("child_process");
@@ -7259,7 +8532,7 @@ program.command("mcp").description("Install recordings MCP server into Claude Co
       if (target === "codex") {
         const configPath = pathJoin2(home, ".codex", "config.toml");
         if (fileExists(configPath)) {
-          const content = readFileSync6(configPath, "utf-8");
+          const content = readFileSync7(configPath, "utf-8");
           if (opts.uninstall) {
             const { content: next, removed } = removeCodexServerBlock(content, "recordings");
             writeFileSync4(configPath, next, "utf-8");
@@ -7277,7 +8550,7 @@ program.command("mcp").description("Install recordings MCP server into Claude Co
         const configPath = pathJoin2(home, ".gemini", "settings.json");
         let config = {};
         if (fileExists(configPath)) {
-          config = JSON.parse(readFileSync6(configPath, "utf-8"));
+          config = JSON.parse(readFileSync7(configPath, "utf-8"));
         }
         const servers = config["mcpServers"] || {};
         if (opts.uninstall) {
@@ -7316,7 +8589,7 @@ program.command("feedback <message>").description("Send feedback").option("--ema
 function getMacOSAppStatus() {
   const packageRoot = findPackageRoot();
   const home = process.env.HOME || process.env.USERPROFILE || "";
-  const canonicalAppPath = pathJoin(home, "Applications", "HasnaRecordings.app");
+  const canonicalAppPath = pathJoin(home, "Applications", "Hasna Recordings.app");
   const legacyInstallPaths = findLegacyMacOSAppPaths(home, canonicalAppPath);
   const installedAppPath = resolveInstalledAppPath(home, canonicalAppPath, legacyInstallPaths);
   const installedAppPathForGrants = existsSync8(installedAppPath) ? installedAppPath : null;
@@ -7364,7 +8637,7 @@ function buildPermissionWarnings(status) {
     warnings.push(`no app bundle exists at ${status.installed_app_path}, so the states above describe no ` + "installed code \u2014 install the app before trusting them");
   }
   if (status.ambiguous_installations) {
-    warnings.push("more than one HasnaRecordings.app is installed, so the states above may describe a bundle " + `other than the one macOS granted: reporting on ${status.installed_app_path}, also ` + `present are ${status.legacy_install_paths.join(", ")}`);
+    warnings.push("more than one Hasna Recordings.app is installed, so the states above may describe a bundle " + `other than the one macOS granted: reporting on ${status.installed_app_path}, also ` + `present are ${status.legacy_install_paths.join(", ")}`);
   }
   for (const [service, durability] of [
     ["Microphone", status.microphone_grant_durability],
@@ -7387,8 +8660,11 @@ function buildPermissionWarnings(status) {
 function resolveInstalledAppPath(home, canonicalPath, legacyPaths) {
   const preference = [
     canonicalPath,
+    pathJoin("/", "Applications", "Hasna Recordings.app"),
+    pathJoin(home, "Applications", "HasnaRecordings.app"),
     pathJoin("/", "Applications", "HasnaRecordings.app"),
     pathJoin("/", "Applications", "Recordings.app"),
+    pathJoin(home, ".hasna", "recordings", "Hasna Recordings.app"),
     pathJoin(home, ".hasna", "recordings", "HasnaRecordings.app"),
     pathJoin(home, ".hasna", "recordings", "Recordings.app")
   ];
@@ -7400,15 +8676,18 @@ function resolveInstalledAppPath(home, canonicalPath, legacyPaths) {
 }
 function findLegacyMacOSAppPaths(home, canonicalPath) {
   const candidates = [
-    pathJoin(home, ".hasna", "recordings", "Recordings.app"),
+    pathJoin(home, "Applications", "HasnaRecordings.app"),
     pathJoin(home, ".hasna", "recordings", "HasnaRecordings.app"),
+    pathJoin("/", "Applications", "HasnaRecordings.app"),
+    pathJoin(home, ".hasna", "recordings", "Recordings.app"),
+    pathJoin(home, ".hasna", "recordings", "Hasna Recordings.app"),
     pathJoin("/", "Applications", "Recordings.app"),
-    pathJoin("/", "Applications", "HasnaRecordings.app")
+    pathJoin("/", "Applications", "Hasna Recordings.app")
   ];
   const userApplications = pathJoin(home, "Applications");
   if (existsSync8(userApplications)) {
     for (const entry of readdirSync2(userApplications, { withFileTypes: true })) {
-      if (entry.isDirectory() && (entry.name.startsWith("Recordings.app.") || entry.name.startsWith("HasnaRecordings.app."))) {
+      if (entry.isDirectory() && (entry.name.startsWith("Recordings.app.") || entry.name.startsWith("Hasna Recordings.app.") || entry.name.startsWith("HasnaRecordings.app."))) {
         candidates.push(pathJoin(userApplications, entry.name));
       }
     }
@@ -7418,7 +8697,7 @@ function findLegacyMacOSAppPaths(home, canonicalPath) {
 function resetMacOSPermissions() {
   const services = ["Microphone", "Accessibility"];
   for (const service of services) {
-    const result = spawnSync7("/usr/bin/tccutil", ["reset", service, RECORDINGS_BUNDLE_IDENTIFIER], { stdio: "inherit" });
+    const result = spawnSync9("/usr/bin/tccutil", ["reset", service, RECORDINGS_BUNDLE_IDENTIFIER], { stdio: "inherit" });
     if (result.error) {
       console.error(chalk.red(result.error.message));
       process.exit(1);
@@ -7436,7 +8715,7 @@ function getCodeSigningInfo(appPath) {
       authorities: []
     };
   }
-  const result = spawnSync7("/usr/bin/codesign", ["-d", "-r-", "--verbose=4", appPath], {
+  const result = spawnSync9("/usr/bin/codesign", ["-d", "-r-", "--verbose=4", appPath], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -7465,7 +8744,7 @@ function findPackageRoot() {
     const packagePath = pathJoin(current, "package.json");
     if (existsSync8(packagePath)) {
       try {
-        const pkg = JSON.parse(readFileSync5(packagePath, "utf8"));
+        const pkg = JSON.parse(readFileSync6(packagePath, "utf8"));
         if (pkg.name === "@hasna/recordings") {
           return current;
         }
@@ -7481,6 +8760,17 @@ function findPackageRoot() {
 function getMacOSInstallerPath(packageRoot = findPackageRoot()) {
   return pathJoin(packageRoot, "scripts", "install_macos_app.sh");
 }
+async function printJSON(value) {
+  await new Promise((resolve4, reject) => {
+    process.stdout.write(`${JSON.stringify(value, null, 2)}
+`, (error) => {
+      if (error)
+        reject(error);
+      else
+        resolve4();
+    });
+  });
+}
 program.parseAsync().catch((error) => {
   const msg = error instanceof Error ? error.message : String(error);
   console.error(`ERROR: ${msg}`);