@runalabs/rill-cli 0.1.10 → 0.1.12

package/dist/cli.js

@@ -5,9 +5,389 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/agent-session.ts
+import { hostname, homedir } from "os";
+import { mkdir, rm, stat } from "fs/promises";
+import { join } from "path";
+import { createHash, randomBytes } from "crypto";
+var JWT_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var CLAIM_GRANT = "urn:workos:agent-auth:grant-type:claim";
+var AgentAuthError = class extends Error {
+  constructor(code, message) {
+    super(`${code}: ${message}`);
+    this.code = code;
+  }
+};
+function parseAuthorization(value) {
+  if (!value?.startsWith("{")) return null;
+  const saved = JSON.parse(value);
+  if (saved.version !== 1 || typeof saved.anonymous !== "boolean") throw new Error("Saved Rill authorization is invalid. Run rill connect --email <your-email>.");
+  return saved;
+}
+async function request(apiUrl, path, body, form = false) {
+  const url2 = new URL(apiUrl);
+  if (url2.protocol !== "https:" && !["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)) throw new Error("Agent authentication requires HTTPS.");
+  const response = await fetch(`${apiUrl}${path}`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(15e3),
+    headers: { "Content-Type": form ? "application/x-www-form-urlencoded" : "application/json" },
+    body: form ? new URLSearchParams(Object.entries(body).map(([key, value2]) => [key, String(value2)])) : JSON.stringify(body)
+  });
+  const value = await response.json();
+  if (!response.ok) throw new AgentAuthError(value.error ?? "authentication_failed", value.error_description ?? "Could not authorize Rill.");
+  return value;
+}
+function withTokens(saved, tokens) {
+  return {
+    ...saved,
+    accessToken: tokens.access_token,
+    accessExpiresAt: Date.now() + tokens.expires_in * 1e3,
+    ...tokens.identity_assertion ? { identityAssertion: tokens.identity_assertion, assertionExpires: tokens.assertion_expires } : {}
+  };
+}
+var save = (apiUrl, value) => saveCredential(apiUrl, JSON.stringify(value));
+var pending = /* @__PURE__ */ new Map();
+async function loadAgentCredential(apiUrl) {
+  if (process.env.RILL_TOKEN) return process.env.RILL_TOKEN;
+  const inFlight = pending.get(apiUrl);
+  if (inFlight) return inFlight;
+  const promise2 = (async () => {
+    const raw = await loadStoredCredential(apiUrl);
+    const saved = parseAuthorization(raw);
+    if (!saved) return raw;
+    if (saved.accessToken && (saved.accessExpiresAt ?? 0) > Date.now() + 6e4) return saved.accessToken;
+    if (!saved.identityAssertion && saved.anonymous && saved.registrationToken) return null;
+    if (!saved.identityAssertion) throw new Error("Connection is awaiting approval. Run rill connect --email <your-email>.");
+    const tokens = await request(apiUrl, "/oauth2/token", { grant_type: JWT_GRANT, assertion: saved.identityAssertion }, true);
+    await save(apiUrl, withTokens(saved, tokens));
+    return tokens.access_token;
+  })();
+  pending.set(apiUrl, promise2);
+  try {
+    return await promise2;
+  } finally {
+    pending.delete(apiUrl);
+  }
+}
+async function ensureAnonymousCredential(apiUrl) {
+  const root = join(homedir(), ".rill", "auth-locks");
+  await mkdir(root, { recursive: true, mode: 448 });
+  const lock = join(root, createHash("sha256").update(apiUrl).digest("hex"));
+  const deadline = Date.now() + 3e4;
+  while (true) {
+    try {
+      await mkdir(lock, { mode: 448 });
+      break;
+    } catch (error51) {
+      if (error51.code !== "EEXIST") throw error51;
+      const info = await stat(lock).catch(() => null);
+      if (info && Date.now() - info.mtimeMs > 12e4) {
+        await rm(lock, { recursive: true, force: true });
+        continue;
+      }
+      if (Date.now() > deadline) throw new Error("Another Rill process is setting up authorization. Retry shortly.");
+      await new Promise((resolve) => setTimeout(resolve, 200));
+    }
+  }
+  try {
+    return await createAnonymousCredential(apiUrl);
+  } finally {
+    await rm(lock, { recursive: true, force: true });
+  }
+}
+async function createAnonymousCredential(apiUrl) {
+  const existing = await loadAgentCredential(apiUrl);
+  if (existing) return existing;
+  const stored = parseAuthorization(await loadStoredCredential(apiUrl));
+  const initial = stored?.registrationToken ? stored : { version: 1, anonymous: true, registrationToken: randomBytes(32).toString("hex") };
+  await save(apiUrl, initial);
+  const registered = await request(apiUrl, "/agent/identity", { type: "anonymous", analytics_enabled: process.env.RILL_ANONYMOUS_ANALYTICS !== "0" && process.env.DO_NOT_TRACK !== "1", registration_token: initial.registrationToken, name: `${hostname()} \xB7 ${process.platform}` });
+  const saved = { ...initial, registrationToken: void 0, identityAssertion: registered.identity_assertion, assertionExpires: registered.assertion_expires, claimToken: registered.claim_token };
+  await save(apiUrl, saved);
+  process.stderr.write("Recording anonymously: three recordings, up to five minutes each. Recordings and share links expire after seven days. Run rill connect --email <your-email> to keep them.\n");
+  return await loadAgentCredential(apiUrl);
+}
+async function connectAgent(apiUrl, email3) {
+  if (process.env.RILL_TOKEN) throw new Error("Unset RILL_TOKEN before connecting a local identity.");
+  let saved = parseAuthorization(await loadStoredCredential(apiUrl));
+  let claim;
+  if (saved?.claimToken && saved.anonymous) {
+    try {
+      const result = await request(apiUrl, "/agent/identity/claim", { claim_token: saved.claimToken, email: email3 });
+      claim = result.claim_attempt;
+    } catch (error51) {
+      if (!(error51 instanceof AgentAuthError) || error51.code !== "claim_expired") throw error51;
+    }
+  }
+  if (!claim) {
+    await save(apiUrl, saved ?? { version: 1, anonymous: true });
+    const result = await request(apiUrl, "/agent/identity", { type: "service_auth", login_hint: email3, name: `${hostname()} \xB7 ${process.platform}` });
+    saved = { version: 1, anonymous: true, claimToken: result.claim_token };
+    await save(apiUrl, saved);
+    claim = result.claim;
+  }
+  process.stderr.write(`Open ${claim.verification_uri}
+Sign in as ${email3} and enter ${claim.user_code}. Approve only the request you started.
+`);
+  const deadline = Date.now() + claim.expires_in * 1e3;
+  let interval = claim.interval;
+  while (Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, interval * 1e3));
+    try {
+      const tokens = await request(apiUrl, "/oauth2/token", { grant_type: CLAIM_GRANT, claim_token: saved.claimToken }, true);
+      const connected = withTokens({ version: 1, anonymous: false }, tokens);
+      await save(apiUrl, connected);
+      return { status: "authenticated", expiresAt: connected.assertionExpires, apiUrl };
+    } catch (error51) {
+      if (error51 instanceof AgentAuthError && error51.code === "expired_token") throw new AgentAuthError("expired_token", "The approval attempt expired. Run rill connect again to request a fresh code using the same saved claim token.");
+      if (error51 instanceof AgentAuthError && error51.code === "authorization_pending") continue;
+      if (error51 instanceof AgentAuthError && error51.code === "slow_down") {
+        interval += 5;
+        continue;
+      }
+      throw error51;
+    }
+  }
+  throw new AgentAuthError("expired_token", "Connection request expired. Run rill connect again to restart the approval attempt using the same saved claim token.");
+}
+
+// src/keychain.ts
+import { spawn } from "child_process";
+var service = "rill";
+async function saveCredential(apiUrl, token) {
+  if (process.platform === "darwin") {
+    await run("security", ["add-generic-password", "-U", "-a", apiUrl, "-s", service, "-w", token]);
+    return;
+  }
+  if (process.platform === "linux") {
+    await run("secret-tool", ["store", "--label=Rill agent credential", "service", service, "api-url", apiUrl], token);
+    return;
+  }
+  throw new Error("OS keychain storage is not supported on this platform yet. Use RILL_TOKEN.");
+}
+function loadCredential(apiUrl) {
+  return loadAgentCredential(apiUrl);
+}
+async function loadStoredCredential(apiUrl) {
+  try {
+    if (process.platform === "darwin") return (await run("security", ["find-generic-password", "-a", apiUrl, "-s", service, "-w"])).trim() || null;
+    if (process.platform === "linux") return (await run("secret-tool", ["lookup", "service", service, "api-url", apiUrl])).trim() || null;
+  } catch (error51) {
+    const code = error51.exitCode;
+    if (process.platform === "darwin" && code === 44) return null;
+    if (process.platform === "linux" && code === 1 && !error51.message.trim()) return null;
+    throw new Error("Cannot read the OS credential store. Unlock your keychain or enable Secret Service; your identity has not been replaced.");
+  }
+  throw new Error("Local authorization requires macOS Keychain or Linux Secret Service.");
+}
+function run(command, args, input) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"] });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
+    child.stderr.on("data", (chunk) => stderr.push(Buffer.from(chunk)));
+    child.once("error", reject);
+    child.once("exit", (code) => code === 0 ? resolve(Buffer.concat(stdout).toString("utf8")) : reject(Object.assign(new Error(Buffer.concat(stderr).toString("utf8").trim()), { exitCode: code })));
+    if (input) child.stdin.end(input);
+    else child.stdin.end();
+  });
+}
+
+// src/control-plane.ts
+import { createReadStream } from "fs";
+import { readFile, stat as stat2 } from "fs/promises";
+import { Upload } from "tus-js-client";
+var ControlPlaneError = class extends Error {
+  constructor(code, message, recovery, details, httpStatus) {
+    super(`${code}: ${message}${recovery ? `: ${recovery}` : ""}`);
+    this.code = code;
+    this.recovery = recovery;
+    this.details = details;
+    this.httpStatus = httpStatus;
+    this.name = "ControlPlaneError";
+  }
+};
+var ControlPlaneHttpError = class extends Error {
+  constructor(httpStatus) {
+    super(`Request failed (${httpStatus}).`);
+    this.httpStatus = httpStatus;
+    this.name = "ControlPlaneHttpError";
+  }
+};
+var ControlPlaneClient = class {
+  constructor(apiUrl, token) {
+    this.apiUrl = apiUrl;
+    this.token = token;
+  }
+  encodingCapabilities() {
+    return this.request("/api/encoding/capabilities");
+  }
+  beginEncoding(id, manifest) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}`, { method: "POST", body: JSON.stringify(manifest) });
+  }
+  encodingStatus(id) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}`);
+  }
+  uploadEncodingPart(id, part, bytes) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}/parts/${part}`, { method: "PUT", headers: { "Content-Type": "application/octet-stream", "Content-Length": String(bytes.length) }, body: new Uint8Array(bytes), signal: AbortSignal.timeout(12e4) });
+  }
+  completeEncoding(id) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}/complete`, { method: "POST" });
+  }
+  retryEncoding(id) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}/retry`, { method: "POST" });
+  }
+  createCloudRun(input) {
+    return this.request("/api/cloud/runs", { method: "POST", body: JSON.stringify(input) });
+  }
+  cloudRun(id) {
+    return this.request(`/api/cloud/runs/${encodeURIComponent(id)}`);
+  }
+  cancelCloudRun(id) {
+    return this.request(`/api/cloud/runs/${encodeURIComponent(id)}/cancel`, { method: "POST" });
+  }
+  health() {
+    return this.request("/api/health", {}, false);
+  }
+  agentSession() {
+    return this.request("/api/agent/session", { signal: AbortSignal.timeout(5e3) });
+  }
+  reportCliCommand(input) {
+    return this.request("/api/analytics/cli-command", { method: "POST", body: JSON.stringify(input) });
+  }
+  createRecording(input) {
+    return this.request("/api/recordings", { method: "POST", body: JSON.stringify(input) });
+  }
+  markRecordingStarted(recordingId, input) {
+    return this.request(`/api/recordings/${recordingId}/local-started`, {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+  }
+  markRecordingStopped(recordingId, input) {
+    return this.request(`/api/recordings/${recordingId}/local-stopped`, {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+  }
+  submitRecordingFeedback(recordingId, input) {
+    return this.request(recordingId ? `/api/recordings/${recordingId}/feedback` : "/api/feedback", {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+  }
+  provisionVideo(recordingId, input) {
+    return this.request(`/api/recordings/${recordingId}/video-upload`, { method: "POST", body: JSON.stringify(input) });
+  }
+  recordingStatus(recordingId) {
+    return this.request(`/api/recordings/${recordingId}`);
+  }
+  cancelRecording(recordingId, reason = "cancelled_by_agent") {
+    return this.request(`/api/recordings/${recordingId}/cancel`, {
+      method: "POST",
+      body: JSON.stringify({ reason })
+    });
+  }
+  async waitUntilPlayable(recordingId, timeoutMs = 10 * 6e4) {
+    const deadline = Date.now() + timeoutMs;
+    let intervalMs = 1e3;
+    while (Date.now() < deadline) {
+      const recording = await this.recordingStatus(recordingId);
+      if (recording.status === "ready" && recording.shareUrl) {
+        return { ...recording, shareUrl: new URL(recording.shareUrl, this.apiUrl).toString() };
+      }
+      if (recording.status === "failed") throw new Error(`processing_failed: ${recording.failure_message ?? "Cloudflare Stream could not process the recording."}`);
+      process.stderr.write(`\rprocessing ${recording.status.padEnd(12)}`);
+      await new Promise((resolve) => setTimeout(resolve, intervalMs));
+      intervalMs = Math.min(5e3, Math.round(intervalMs * 1.4));
+    }
+    throw new Error("processing_failed: Timed out waiting for the recording to become playable. Run `rill record status <recording-id>` to continue checking.");
+  }
+  async uploadVideo(uploadUrl, filePath) {
+    const file2 = await stat2(filePath);
+    if (uploadUrl.startsWith(this.apiUrl)) {
+      const response = await fetch(uploadUrl, { method: "PUT", headers: { "Content-Length": String(file2.size) }, body: createReadStream(filePath), duplex: "half" });
+      if (!response.ok) throw new Error(`Video upload failed (${response.status}).`);
+      return;
+    }
+    await new Promise((resolve, reject) => {
+      const upload = new Upload(createReadStream(filePath), {
+        uploadUrl,
+        uploadSize: file2.size,
+        retryDelays: [0, 1e3, 3e3, 5e3, 1e4],
+        removeFingerprintOnSuccess: true,
+        onError: reject,
+        onSuccess: () => resolve(),
+        onProgress: (sent, total) => process.stderr.write(`\ruploading ${Math.round(sent / total * 100)}%`)
+      });
+      upload.start();
+    });
+    process.stderr.write("\n");
+  }
+  async uploadDiagnostics(recordingId, filePath, summary) {
+    const body = await readFile(filePath);
+    return this.request(`/api/recordings/${recordingId}/diagnostics`, { method: "PUT", headers: { "Content-Encoding": "gzip", "Content-Type": "application/x-ndjson", "Content-Length": String(body.length), "X-Rill-Summary": JSON.stringify(summary) }, body });
+  }
+  listRecordings() {
+    return this.request("/api/recordings");
+  }
+  createDeviceAuthorization(input) {
+    return this.request("/api/device/authorizations", { method: "POST", body: JSON.stringify(input) }, false);
+  }
+  pollDeviceAuthorization(deviceCode) {
+    return this.request("/api/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) }, false);
+  }
+  inspect(shareUrl) {
+    if (/^rec_[a-zA-Z0-9_-]+$/.test(shareUrl)) return this.request(`/api/recordings/${encodeURIComponent(shareUrl)}`);
+    const url2 = new URL(shareUrl);
+    const slug = url2.pathname.split("/").filter(Boolean).at(-1);
+    if (!slug) throw new Error("The share URL does not contain a slug.");
+    return fetch(`${url2.origin}/api/public/shares/${encodeURIComponent(slug)}/context`, { headers: { Accept: "application/json" } }).then(async (response) => {
+      if (!response.ok) throw new Error(`Could not inspect the share link (${response.status}).`);
+      return response.json();
+    });
+  }
+  async request(path, init = {}, authenticated = true) {
+    const headers = new Headers(init.headers);
+    if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
+    if (authenticated) {
+      const token = typeof this.token === "function" ? await this.token() : this.token;
+      if (!token) throw new Error("authentication_required: Run `rill login` or set RILL_TOKEN.");
+      headers.set("Authorization", `Bearer ${token}`);
+    }
+    const response = await fetch(`${this.apiUrl}${path}`, { ...init, headers });
+    const value = await response.json().catch(() => null);
+    if (!response.ok && value?.error?.code && value.error.message) {
+      throw new ControlPlaneError(value.error.code, value.error.message, value.error.recovery, value.error.details, response.status);
+    }
+    if (!response.ok) throw new ControlPlaneHttpError(response.status);
+    return value;
+  }
+};
+
+// src/whoami.ts
+async function whoami(apiUrl) {
+  const token = await loadCredential(apiUrl);
+  if (!token) return { schemaVersion: 1, status: "not_connected", authenticated: false, apiUrl };
+  const session = await new ControlPlaneClient(apiUrl, token).agentSession();
+  return {
+    schemaVersion: 1,
+    status: session.anonymous ? "anonymous" : "connected",
+    authenticated: true,
+    apiUrl,
+    anonymous: Boolean(session.anonymous),
+    email: session.email ?? null,
+    workspaceId: session.workspaceId ?? null,
+    scopes: session.scopes,
+    expiresAt: session.expiresAt
+  };
+}
+
 // src/remote-encoding.ts
 import { open, readFile as readFile2 } from "fs/promises";
-import { join } from "path";
+import { join as join2 } from "path";
 
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -142,7 +522,7 @@ __export(external_exports, {
   guid: () => guid2,
   hash: () => hash,
   hex: () => hex2,
-  hostname: () => hostname2,
+  hostname: () => hostname3,
   httpUrl: () => httpUrl,
   includes: () => _includes,
   instanceof: () => _instanceof,
@@ -1553,7 +1933,7 @@ __export(regexes_exports, {
   extendedDuration: () => extendedDuration,
   guid: () => guid,
   hex: () => hex,
-  hostname: () => hostname,
+  hostname: () => hostname2,
   html5Email: () => html5Email,
   httpProtocol: () => httpProtocol,
   idnEmail: () => idnEmail,
@@ -1631,7 +2011,7 @@ var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]
 var cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
 var base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
 var base64url = /^[A-Za-z0-9_-]*$/;
-var hostname = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
+var hostname2 = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
 var domain = /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
 var httpProtocol = /^https?$/;
 var e164 = /^\+[1-9]\d{6,14}$/;
@@ -12503,7 +12883,7 @@ __export(schemas_exports2, {
   guid: () => guid2,
   hash: () => hash,
   hex: () => hex2,
-  hostname: () => hostname2,
+  hostname: () => hostname3,
   httpUrl: () => httpUrl,
   instanceof: () => _instanceof,
   int: () => int,
@@ -13123,7 +13503,7 @@ var ZodCustomStringFormat = /* @__PURE__ */ $constructor("ZodCustomStringFormat"
 function stringFormat(format, fnOrRegex, _params = {}) {
   return _stringFormat(ZodCustomStringFormat, format, fnOrRegex, _params);
 }
-function hostname2(_params) {
+function hostname3(_params) {
   return _stringFormat(ZodCustomStringFormat, "hostname", regexes_exports.hostname, _params);
 }
 function hex2(_params) {
@@ -14538,173 +14918,6 @@ var frameManifestSchema = external_exports.object({
   if (m.frames.at(-1).timestamp - m.frames[0].timestamp > m.durationSeconds + 1) ctx.addIssue({ code: "custom", message: "Frame timestamps exceed capture duration." });
 });
 
-// src/control-plane.ts
-import { createReadStream } from "fs";
-import { readFile, stat } from "fs/promises";
-import { Upload } from "tus-js-client";
-var ControlPlaneError = class extends Error {
-  constructor(code, message, recovery, details, httpStatus) {
-    super(`${code}: ${message}${recovery ? `: ${recovery}` : ""}`);
-    this.code = code;
-    this.recovery = recovery;
-    this.details = details;
-    this.httpStatus = httpStatus;
-    this.name = "ControlPlaneError";
-  }
-};
-var ControlPlaneHttpError = class extends Error {
-  constructor(httpStatus) {
-    super(`Request failed (${httpStatus}).`);
-    this.httpStatus = httpStatus;
-    this.name = "ControlPlaneHttpError";
-  }
-};
-var ControlPlaneClient = class {
-  constructor(apiUrl, token) {
-    this.apiUrl = apiUrl;
-    this.token = token;
-  }
-  encodingCapabilities() {
-    return this.request("/api/encoding/capabilities");
-  }
-  beginEncoding(id, manifest) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}`, { method: "POST", body: JSON.stringify(manifest) });
-  }
-  encodingStatus(id) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}`);
-  }
-  uploadEncodingPart(id, part, bytes) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}/parts/${part}`, { method: "PUT", headers: { "Content-Type": "application/octet-stream", "Content-Length": String(bytes.length) }, body: new Uint8Array(bytes), signal: AbortSignal.timeout(12e4) });
-  }
-  completeEncoding(id) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}/complete`, { method: "POST" });
-  }
-  retryEncoding(id) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}/retry`, { method: "POST" });
-  }
-  createCloudRun(input) {
-    return this.request("/api/cloud/runs", { method: "POST", body: JSON.stringify(input) });
-  }
-  cloudRun(id) {
-    return this.request(`/api/cloud/runs/${encodeURIComponent(id)}`);
-  }
-  cancelCloudRun(id) {
-    return this.request(`/api/cloud/runs/${encodeURIComponent(id)}/cancel`, { method: "POST" });
-  }
-  health() {
-    return this.request("/api/health", {}, false);
-  }
-  agentSession() {
-    return this.request("/api/agent/session", { signal: AbortSignal.timeout(5e3) });
-  }
-  reportCliCommand(input) {
-    return this.request("/api/analytics/cli-command", { method: "POST", body: JSON.stringify(input) });
-  }
-  createRecording(input) {
-    return this.request("/api/recordings", { method: "POST", body: JSON.stringify(input) });
-  }
-  markRecordingStarted(recordingId, input) {
-    return this.request(`/api/recordings/${recordingId}/local-started`, {
-      method: "POST",
-      body: JSON.stringify(input)
-    });
-  }
-  markRecordingStopped(recordingId, input) {
-    return this.request(`/api/recordings/${recordingId}/local-stopped`, {
-      method: "POST",
-      body: JSON.stringify(input)
-    });
-  }
-  submitRecordingFeedback(recordingId, input) {
-    return this.request(recordingId ? `/api/recordings/${recordingId}/feedback` : "/api/feedback", {
-      method: "POST",
-      body: JSON.stringify(input)
-    });
-  }
-  provisionVideo(recordingId, input) {
-    return this.request(`/api/recordings/${recordingId}/video-upload`, { method: "POST", body: JSON.stringify(input) });
-  }
-  recordingStatus(recordingId) {
-    return this.request(`/api/recordings/${recordingId}`);
-  }
-  cancelRecording(recordingId, reason = "cancelled_by_agent") {
-    return this.request(`/api/recordings/${recordingId}/cancel`, {
-      method: "POST",
-      body: JSON.stringify({ reason })
-    });
-  }
-  async waitUntilPlayable(recordingId, timeoutMs = 10 * 6e4) {
-    const deadline = Date.now() + timeoutMs;
-    let intervalMs = 1e3;
-    while (Date.now() < deadline) {
-      const recording = await this.recordingStatus(recordingId);
-      if (recording.status === "ready" && recording.shareUrl) {
-        return { ...recording, shareUrl: new URL(recording.shareUrl, this.apiUrl).toString() };
-      }
-      if (recording.status === "failed") throw new Error(`processing_failed: ${recording.failure_message ?? "Cloudflare Stream could not process the recording."}`);
-      process.stderr.write(`\rprocessing ${recording.status.padEnd(12)}`);
-      await new Promise((resolve) => setTimeout(resolve, intervalMs));
-      intervalMs = Math.min(5e3, Math.round(intervalMs * 1.4));
-    }
-    throw new Error("processing_failed: Timed out waiting for the recording to become playable. Run `rill record status <recording-id>` to continue checking.");
-  }
-  async uploadVideo(uploadUrl, filePath) {
-    const file2 = await stat(filePath);
-    if (uploadUrl.startsWith(this.apiUrl)) {
-      const response = await fetch(uploadUrl, { method: "PUT", headers: { "Content-Length": String(file2.size) }, body: createReadStream(filePath), duplex: "half" });
-      if (!response.ok) throw new Error(`Video upload failed (${response.status}).`);
-      return;
-    }
-    await new Promise((resolve, reject) => {
-      const upload = new Upload(createReadStream(filePath), {
-        uploadUrl,
-        uploadSize: file2.size,
-        retryDelays: [0, 1e3, 3e3, 5e3, 1e4],
-        removeFingerprintOnSuccess: true,
-        onError: reject,
-        onSuccess: () => resolve(),
-        onProgress: (sent, total) => process.stderr.write(`\ruploading ${Math.round(sent / total * 100)}%`)
-      });
-      upload.start();
-    });
-    process.stderr.write("\n");
-  }
-  async uploadDiagnostics(recordingId, filePath, summary) {
-    const body = await readFile(filePath);
-    return this.request(`/api/recordings/${recordingId}/diagnostics`, { method: "PUT", headers: { "Content-Encoding": "gzip", "Content-Type": "application/x-ndjson", "Content-Length": String(body.length), "X-Rill-Summary": JSON.stringify(summary) }, body });
-  }
-  createDeviceAuthorization(input) {
-    return this.request("/api/device/authorizations", { method: "POST", body: JSON.stringify(input) }, false);
-  }
-  pollDeviceAuthorization(deviceCode) {
-    return this.request("/api/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) }, false);
-  }
-  inspect(shareUrl) {
-    const url2 = new URL(shareUrl);
-    const slug = url2.pathname.split("/").filter(Boolean).at(-1);
-    if (!slug) throw new Error("The share URL does not contain a slug.");
-    return fetch(`${url2.origin}/api/public/shares/${encodeURIComponent(slug)}/context`, { headers: { Accept: "application/json" } }).then(async (response) => {
-      if (!response.ok) throw new Error(`Could not inspect the share link (${response.status}).`);
-      return response.json();
-    });
-  }
-  async request(path, init = {}, authenticated = true) {
-    const headers = new Headers(init.headers);
-    if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
-    if (authenticated) {
-      if (!this.token) throw new Error("authentication_required: Run `rill login` or set RILL_TOKEN.");
-      headers.set("Authorization", `Bearer ${this.token}`);
-    }
-    const response = await fetch(`${this.apiUrl}${path}`, { ...init, headers });
-    const value = await response.json().catch(() => null);
-    if (!response.ok && value?.error?.code && value.error.message) {
-      throw new ControlPlaneError(value.error.code, value.error.message, value.error.recovery, value.error.details, response.status);
-    }
-    if (!response.ok) throw new ControlPlaneHttpError(response.status);
-    return value;
-  }
-};
-
 // src/remote-encoding.ts
 async function withFrameUploadRetry(upload, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
   for (let attempt = 0; ; attempt++) {
@@ -14723,14 +14936,14 @@ Frame upload interrupted; retrying in ${delay / 1e3}s.
   }
 }
 async function submitFrameCapture(client, id, directory) {
-  const manifest = frameManifestSchema.parse(JSON.parse(await readFile2(join(directory, "capture-manifest.json"), "utf8")));
+  const manifest = frameManifestSchema.parse(JSON.parse(await readFile2(join2(directory, "capture-manifest.json"), "utf8")));
   let status = await client.beginEncoding(id, manifest);
   if (status.status === "failed") status = await client.retryEncoding(id);
   if (status.status !== "uploading") {
     if (["expired", "cancelled"].includes(status.status)) throw new Error(`Capture ${status.status}; it cannot be retried.`);
     return status;
   }
-  const file2 = await open(join(directory, "frames.bin"), "r");
+  const file2 = await open(join2(directory, "frames.bin"), "r");
   try {
     const total = manifest.frames.reduce((n, f) => n + f.size, 0);
     if ((await file2.stat()).size !== total) throw new Error("Capture bytes do not match the manifest.");
@@ -14766,22 +14979,22 @@ async function waitForEncoding(client, id, timeoutMs = 30 * 6e4) {
 
 // src/cli.ts
 import { spawn as spawn6 } from "child_process";
+import { hostname as hostname4 } from "os";
 import { Command } from "commander";
-import { hostname as hostname3 } from "os";
 import { basename, dirname as dirname2 } from "path";
-import { readdir as readdir2, rm as rm4, stat as stat3 } from "fs/promises";
+import { readdir as readdir2, rm as rm5, stat as stat4 } from "fs/promises";
 
 // ../recorder/src/client.ts
-import { request } from "http";
-import { spawn } from "child_process";
+import { request as request2 } from "http";
+import { spawn as spawn2 } from "child_process";
 
 // ../recorder/src/paths.ts
-import { homedir, tmpdir } from "os";
-import { join as join2 } from "path";
-var rillDirectory = () => process.env.RILL_HOME ?? join2(homedir(), ".rill");
-var daemonSocketPath = () => process.env.RILL_SOCKET ?? join2(rillDirectory(), "recorder-v2.sock");
-var daemonStatePath = () => join2(rillDirectory(), "sessions-v2.json");
-var recordingTempRoot = () => process.env.RILL_TEMP ?? join2(tmpdir(), "rill-recordings");
+import { homedir as homedir2, tmpdir } from "os";
+import { join as join3 } from "path";
+var rillDirectory = () => process.env.RILL_HOME ?? join3(homedir2(), ".rill");
+var daemonSocketPath = () => process.env.RILL_SOCKET ?? join3(rillDirectory(), "recorder-v2.sock");
+var daemonStatePath = () => join3(rillDirectory(), "sessions-v2.json");
+var recordingTempRoot = () => process.env.RILL_TEMP ?? join3(tmpdir(), "rill-recordings");
 
 // ../recorder/src/client.ts
 async function ensureDaemon(cliEntryPath) {
@@ -14790,7 +15003,7 @@ async function ensureDaemon(cliEntryPath) {
     return;
   } catch {
   }
-  const child = spawn(process.execPath, [cliEntryPath, "daemon"], { detached: true, stdio: "ignore", env: process.env });
+  const child = spawn2(process.execPath, [cliEntryPath, "daemon"], { detached: true, stdio: "ignore", env: process.env });
   child.unref();
   const deadline = Date.now() + 1e4;
   while (Date.now() < deadline) {
@@ -14815,7 +15028,7 @@ function recordingStatus(recordingId) {
 function callDaemon(method, path, body) {
   return new Promise((resolve, reject) => {
     const payload = body === void 0 ? void 0 : Buffer.from(JSON.stringify(body));
-    const outgoing = request({ socketPath: daemonSocketPath(), method, path, headers: payload ? { "Content-Type": "application/json", "Content-Length": payload.length } : void 0 }, (incoming) => {
+    const outgoing = request2({ socketPath: daemonSocketPath(), method, path, headers: payload ? { "Content-Type": "application/json", "Content-Length": payload.length } : void 0 }, (incoming) => {
       const chunks = [];
       incoming.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
       incoming.on("end", () => {
@@ -14835,17 +15048,17 @@ function callDaemon(method, path, body) {
 }
 
 // ../recorder/src/retention.ts
-import { readdir, readFile as readFile3, rm } from "fs/promises";
-import { join as join3 } from "path";
+import { readdir, readFile as readFile3, rm as rm2 } from "fs/promises";
+import { join as join4 } from "path";
 async function purgeExpiredRemoteCaptures(root, now = Date.now()) {
   const removed = [];
   for (const id of await readdir(root).catch(() => [])) {
     if (!/^rec_[a-zA-Z0-9_-]+$/.test(id)) continue;
-    const directory = join3(root, id);
+    const directory = join4(root, id);
     try {
-      const marker = JSON.parse(await readFile3(join3(directory, "remote-capture.json"), "utf8"));
+      const marker = JSON.parse(await readFile3(join4(directory, "remote-capture.json"), "utf8"));
       if (typeof marker.expiresAt !== "number" || marker.expiresAt > now) continue;
-      await rm(directory, { recursive: true, force: true });
+      await rm2(directory, { recursive: true, force: true });
       removed.push(id);
     } catch {
     }
@@ -14856,7 +15069,7 @@ async function hasRetainedRemoteCaptures(root) {
   for (const id of await readdir(root).catch(() => [])) {
     if (!/^rec_[a-zA-Z0-9_-]+$/.test(id)) continue;
     try {
-      const marker = JSON.parse(await readFile3(join3(root, id, "remote-capture.json"), "utf8"));
+      const marker = JSON.parse(await readFile3(join4(root, id, "remote-capture.json"), "utf8"));
       if (typeof marker.expiresAt === "number" && Number.isFinite(marker.expiresAt)) return true;
     } catch {
     }
@@ -14866,8 +15079,8 @@ async function hasRetainedRemoteCaptures(root) {
 
 // ../recorder/src/daemon.ts
 import { createServer as createServer2 } from "http";
-import { mkdir as mkdir4, readFile as readFile5, unlink, writeFile as writeFile4, rename, stat as stat2 } from "fs/promises";
-import { dirname, join as join7 } from "path";
+import { mkdir as mkdir5, readFile as readFile5, unlink, writeFile as writeFile4, rename, stat as stat3 } from "fs/promises";
+import { dirname, join as join8 } from "path";
 
 // ../contracts/src/recording.ts
 var cursorAppearanceSchema = external_exports.object({
@@ -15028,10 +15241,10 @@ async function attachCursorOverlay(page, cdp, input) {
 
 // ../recorder/src/session.ts
 import { chromium } from "playwright-core";
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { createServer } from "net";
-import { mkdir as mkdir3, mkdtemp, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { join as join6 } from "path";
+import { mkdir as mkdir4, mkdtemp, rm as rm3, writeFile as writeFile3 } from "fs/promises";
+import { join as join7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 
 // ../recorder/src/bundle.ts
@@ -15111,9 +15324,9 @@ function redactJson(value, depth = 0) {
 }
 
 // ../recorder/src/encoding.ts
-import { open as open2, writeFile, mkdir } from "fs/promises";
-import { spawn as spawn2 } from "child_process";
-import { join as join4 } from "path";
+import { open as open2, writeFile, mkdir as mkdir2 } from "fs/promises";
+import { spawn as spawn3 } from "child_process";
+import { join as join5 } from "path";
 var active = 0;
 var waiting = [];
 function encodingConcurrency() {
@@ -15143,11 +15356,11 @@ async function encodeFrames(directory, manifest, output, signal) {
       lines.push(`file 'frame-${String(i).padStart(6, "0")}.jpg'`, `duration ${Math.max(1 / 60, duration3).toFixed(6)}`);
     }
     lines.push(`file 'frame-${String(manifest.frames.length - 1).padStart(6, "0")}.jpg'`);
-    await writeFile(join4(directory, "frames.ffconcat"), lines.join("\n") + "\n", { mode: 384 });
+    await writeFile(join5(directory, "frames.ffconcat"), lines.join("\n") + "\n", { mode: 384 });
     const threads = Number(process.env.RILL_FFMPEG_THREADS ?? 1);
     if (!Number.isInteger(threads) || threads < 1 || threads > 16) throw new Error("Invalid RILL_FFMPEG_THREADS");
     await new Promise((resolve, reject) => {
-      const child = spawn2(process.env.RILL_FFMPEG ?? "ffmpeg", ["-hide_banner", "-loglevel", "error", "-protocol_whitelist", "file", "-f", "concat", "-safe", "1", "-i", "frames.ffconcat", "-vsync", "vfr", "-pix_fmt", "yuv420p", "-c:v", "libvpx-vp9", "-deadline", "good", "-cpu-used", "4", "-threads", String(threads), "-b:v", "0", "-crf", "32", "-y", output], { cwd: directory, stdio: ["ignore", "ignore", "pipe"] });
+      const child = spawn3(process.env.RILL_FFMPEG ?? "ffmpeg", ["-hide_banner", "-loglevel", "error", "-protocol_whitelist", "file", "-f", "concat", "-safe", "1", "-i", "frames.ffconcat", "-vsync", "vfr", "-pix_fmt", "yuv420p", "-c:v", "libvpx-vp9", "-deadline", "good", "-cpu-used", "4", "-threads", String(threads), "-b:v", "0", "-crf", "32", "-y", output], { cwd: directory, stdio: ["ignore", "ignore", "pipe"] });
       let stderr = "";
       child.stderr.on("data", (chunk) => {
         stderr = (stderr + String(chunk)).slice(-2e3);
@@ -15172,8 +15385,8 @@ async function encodeFrames(directory, manifest, output, signal) {
 }
 
 // ../recorder/src/screencast.ts
-import { mkdir as mkdir2, writeFile as writeFile2, readFile as readFile4, open as open3 } from "fs/promises";
-import { join as join5 } from "path";
+import { mkdir as mkdir3, writeFile as writeFile2, readFile as readFile4, open as open3 } from "fs/promises";
+import { join as join6 } from "path";
 var ScreencastRecorder = class {
   constructor(session, directory, width, height) {
     this.session = session;
@@ -15188,7 +15401,7 @@ var ScreencastRecorder = class {
   frameBytes = 0;
   captureError;
   async start() {
-    await mkdir2(this.directory, { recursive: true, mode: 448 });
+    await mkdir3(this.directory, { recursive: true, mode: 448 });
     this.session.on("Page.screencastFrame", (payload) => {
       const bytes = Buffer.from(payload.data, "base64");
       if (this.frameCounter >= 36e3 || this.frameBytes + bytes.length > ENCODING_MAX_BYTES || bytes.length > ENCODING_PART_BYTES) {
@@ -15197,7 +15410,7 @@ var ScreencastRecorder = class {
         return;
       }
       this.frameBytes += bytes.length;
-      const path = join5(this.directory, `frame-${String(this.frameCounter).padStart(6, "0")}.jpg`);
+      const path = join6(this.directory, `frame-${String(this.frameCounter).padStart(6, "0")}.jpg`);
       this.frameCounter += 1;
       const write = writeFile2(path, bytes, { mode: 384 }).then(() => {
         this.frames.push({ path, timestamp: payload.metadata.timestamp ?? Date.now() / 1e3 });
@@ -15221,7 +15434,7 @@ var ScreencastRecorder = class {
     if (!this.frames.length) throw new Error("No video frames were captured.");
     const ordered = this.frames.toSorted((a, b) => a.timestamp - b.timestamp);
     const frames = [];
-    const bundle = await open3(join5(this.directory, "frames.bin"), "w", 384);
+    const bundle = await open3(join6(this.directory, "frames.bin"), "w", 384);
     try {
       for (const frame of ordered) {
         const bytes = await readFile4(frame.path);
@@ -15232,7 +15445,7 @@ var ScreencastRecorder = class {
       await bundle.close();
     }
     const manifest = frameManifestSchema.parse({ version: 1, durationSeconds: Math.min(600, expectedDurationSeconds), width: this.width, height: this.height, frames });
-    await writeFile2(join5(this.directory, "capture-manifest.json"), JSON.stringify(manifest), { mode: 384 });
+    await writeFile2(join6(this.directory, "capture-manifest.json"), JSON.stringify(manifest), { mode: 384 });
     if (!captureOnly) await encodeFrames(this.directory, manifest, outputPath);
     return { frameCount: this.frames.length, outputPath };
   }
@@ -15281,11 +15494,11 @@ var RecordingSession = class _RecordingSession {
   static async start(options) {
     const width = options.width ?? 1280;
     const height = options.height ?? 720;
-    await mkdir3(options.outputDirectory, { recursive: true, mode: 448 });
-    if (options.encoding === "remote") await writeFile3(join6(options.outputDirectory, "remote-capture.json"), JSON.stringify({ expiresAt: Date.now() + 864e5 }), { mode: 384 });
+    await mkdir4(options.outputDirectory, { recursive: true, mode: 448 });
+    if (options.encoding === "remote") await writeFile3(join7(options.outputDirectory, "remote-capture.json"), JSON.stringify({ expiresAt: Date.now() + 864e5 }), { mode: 384 });
     const runtime = options.cdpUrl ? await connectAttached(options.cdpUrl, options.outputDirectory) : await launchManaged({ headed: options.headed ?? false, width, height, outputDirectory: options.outputDirectory, proxyServer: options.proxyServer });
     const cdpSession = await runtime.context.newCDPSession(runtime.page);
-    const screencast = new ScreencastRecorder(cdpSession, join6(options.outputDirectory, "frames"), width, height);
+    const screencast = new ScreencastRecorder(cdpSession, join7(options.outputDirectory, "frames"), width, height);
     const session = new _RecordingSession(options, { ...runtime, screencast });
     try {
       await session.attachDiagnostics(options.captureNetworkBodies ?? false);
@@ -15317,8 +15530,8 @@ var RecordingSession = class _RecordingSession {
     if (this.maxTimer) clearTimeout(this.maxTimer);
     const durationSeconds = Math.max(0.1, (Date.now() - this.startedAt.getTime()) / 1e3);
     const outputDirectory = this.outputDirectory;
-    const videoPath = join6(outputDirectory, "recording.webm");
-    const diagnosticsPath = join6(outputDirectory, "diagnostics-v1.ndjson.gz");
+    const videoPath = join7(outputDirectory, "recording.webm");
+    const diagnosticsPath = join7(outputDirectory, "diagnostics-v1.ndjson.gz");
     const bundle = {
       schemaVersion: 1,
       capturePolicyVersion: "safe-default-v1",
@@ -15341,13 +15554,13 @@ var RecordingSession = class _RecordingSession {
       if (this.browserProcess) {
         await this.browser.close().catch(() => void 0);
         await terminateBrowser(this.browserProcess);
-        if (this.profileDirectory) await rm2(this.profileDirectory, { recursive: true, force: true }).catch(() => void 0);
+        if (this.profileDirectory) await rm3(this.profileDirectory, { recursive: true, force: true }).catch(() => void 0);
       }
     }
     const consoleErrors = this.consoleEvents.filter((event) => event.severity === "error").length;
     const failedRequests = this.networkEvents.filter((event) => event.failureReason).length;
     const httpErrors = this.networkEvents.filter((event) => (event.status ?? 0) >= 400).length;
-    return { recordingId: this.recordingId, videoPath, ...this.encoding === "remote" ? { frameDirectory: join6(outputDirectory, "frames") } : {}, diagnosticsPath, durationSeconds, stoppedReason: reason, diagnostics: { consoleErrors, failedRequests, httpErrors, truncated: this.truncated, bodyCaptureEnabled: this.captureNetworkBodies } };
+    return { recordingId: this.recordingId, videoPath, ...this.encoding === "remote" ? { frameDirectory: join7(outputDirectory, "frames") } : {}, diagnosticsPath, durationSeconds, stoppedReason: reason, diagnostics: { consoleErrors, failedRequests, httpErrors, truncated: this.truncated, bodyCaptureEnabled: this.captureNetworkBodies } };
   }
   captureNetworkBodies = false;
   encoding = "local";
@@ -15399,34 +15612,34 @@ var RecordingSession = class _RecordingSession {
       this.consoleEvents.push(event);
       pushTimeline({ offsetMs: event.offsetMs, type: "exception", label: event.text.slice(0, 160), severity: "error" });
     });
-    this.page.on("request", (request2) => {
+    this.page.on("request", (request3) => {
       if (this.diagnosticsPaused) return;
       if (this.networkEvents.length >= 5e3) {
         this.truncated = true;
         return;
       }
       const started = offset();
-      this.requestStart.set(request2, started);
-      const event = { id: `net_${this.networkEvents.length + 1}`, offsetMs: started, method: request2.method(), url: sanitizeUrl(request2.url()), resourceType: request2.resourceType() };
-      if (captureNetworkBodies && request2.postData()) {
-        const redacted = redactBody(request2.postData(), request2.headers()["content-type"]);
+      this.requestStart.set(request3, started);
+      const event = { id: `net_${this.networkEvents.length + 1}`, offsetMs: started, method: request3.method(), url: sanitizeUrl(request3.url()), resourceType: request3.resourceType() };
+      if (captureNetworkBodies && request3.postData()) {
+        const redacted = redactBody(request3.postData(), request3.headers()["content-type"]);
         event.requestBody = redacted.body;
         event.bodyOmittedReason = redacted.omittedReason;
         if (redacted.body) this.bodyBytes += Buffer.byteLength(redacted.body);
       }
       this.networkEvents.push(event);
-      this.requestEvents.set(request2, event);
+      this.requestEvents.set(request3, event);
     });
     this.page.on("response", (response) => this.updateResponse(response));
-    this.page.on("requestfailed", (request2) => {
-      const event = this.requestEvents.get(request2);
+    this.page.on("requestfailed", (request3) => {
+      const event = this.requestEvents.get(request3);
       if (!event) return;
-      event.failureReason = request2.failure()?.errorText ?? "request_failed";
-      event.durationMs = Math.max(0, offset() - (this.requestStart.get(request2) ?? offset()));
+      event.failureReason = request3.failure()?.errorText ?? "request_failed";
+      event.durationMs = Math.max(0, offset() - (this.requestStart.get(request3) ?? offset()));
       pushTimeline({ offsetMs: event.offsetMs, type: "network", label: `${event.method} ${event.url} \u2192 ${event.failureReason}`, severity: "error" });
     });
-    this.page.on("requestfinished", async (request2) => {
-      const response = await request2.response();
+    this.page.on("requestfinished", async (request3) => {
+      const response = await request3.response();
       if (response) await this.captureResponseBody(response);
     });
   }
@@ -15459,7 +15672,7 @@ var RecordingSession = class _RecordingSession {
 };
 async function launchManaged(options) {
   const port = await getAvailablePort();
-  const profileDirectory = await mkdtemp(join6(tmpdir2(), "rill-chrome-"));
+  const profileDirectory = await mkdtemp(join7(tmpdir2(), "rill-chrome-"));
   const executable = findChromeExecutable();
   const args = [
     `--remote-debugging-port=${port}`,
@@ -15477,7 +15690,7 @@ async function launchManaged(options) {
     "about:blank"
   ];
   const env = options.proxyServer ? Object.fromEntries(Object.entries(process.env).filter(([key]) => ["PATH", "HOME", "TMPDIR", "DISPLAY", "LANG", "LD_LIBRARY_PATH", "XDG_RUNTIME_DIR"].includes(key))) : process.env;
-  const browserProcess = spawn3(executable, args, { stdio: ["ignore", "ignore", "pipe"], detached: false, env });
+  const browserProcess = spawn4(executable, args, { stdio: ["ignore", "ignore", "pipe"], detached: false, env });
   const cdpUrl = `http://127.0.0.1:${port}`;
   try {
     await waitForCdp(cdpUrl, browserProcess);
@@ -15488,7 +15701,7 @@ async function launchManaged(options) {
     return { cdpUrl, browser, context, page, browserProcess, profileDirectory };
   } catch (error51) {
     await terminateBrowser(browserProcess);
-    await rm2(profileDirectory, { recursive: true, force: true }).catch(() => void 0);
+    await rm3(profileDirectory, { recursive: true, force: true }).catch(() => void 0);
     throw error51;
   }
 }
@@ -15539,14 +15752,14 @@ var sessions = /* @__PURE__ */ new Map();
 var lastActivity = Date.now();
 async function runDaemon() {
   const socketPath = daemonSocketPath();
-  await mkdir4(dirname(socketPath), { recursive: true, mode: 448 });
-  await mkdir4(recordingTempRoot(), { recursive: true, mode: 448 });
+  await mkdir5(dirname(socketPath), { recursive: true, mode: 448 });
+  await mkdir5(recordingTempRoot(), { recursive: true, mode: 448 });
   await restoreRecoverableSessions();
   await purgeExpiredCaptures();
   await unlink(socketPath).catch((error51) => {
     if (error51.code !== "ENOENT") throw error51;
   });
-  const server = createServer2((request2, response) => void route(request2, response));
+  const server = createServer2((request3, response) => void route(request3, response));
   server.listen(socketPath, () => process.platform !== "win32" && import("fs/promises").then(({ chmod }) => chmod(socketPath, 384)));
   const idleTimer = setInterval(() => {
     void (async () => {
@@ -15565,16 +15778,16 @@ async function runDaemon() {
   process.once("SIGTERM", close);
   process.once("SIGINT", close);
 }
-async function route(request2, response) {
+async function route(request3, response) {
   lastActivity = Date.now();
-  const url2 = new URL(request2.url ?? "/", "http://daemon.local");
-  if (request2.method === "GET" && url2.pathname === "/health") return json2(response, 200, { ok: true, pid: process.pid });
-  if (request2.method === "POST" && url2.pathname === "/sessions") {
+  const url2 = new URL(request3.url ?? "/", "http://daemon.local");
+  if (request3.method === "GET" && url2.pathname === "/health") return json2(response, 200, { ok: true, pid: process.pid });
+  if (request3.method === "POST" && url2.pathname === "/sessions") {
     if ([...sessions.values()].filter((entry) => entry.state === "recording").length >= 2) return json2(response, 429, { error: { code: "quota_exceeded", message: "This recorder already has two active sessions." } });
     try {
-      const input = await readJson(request2);
+      const input = await readJson(request3);
       if (!/^rec_[a-zA-Z0-9_-]+$/.test(input.recordingId)) return json2(response, 400, { error: { code: "validation_failed", message: "recordingId is required." } });
-      const outputDirectory = join7(recordingTempRoot(), input.recordingId);
+      const outputDirectory = join8(recordingTempRoot(), input.recordingId);
       const session = await RecordingSession.start({ ...input, outputDirectory });
       const status = session.status();
       const entry = { session, base: { recordingId: status.recordingId, cdpUrl: status.cdpUrl, startedAt: status.startedAt }, state: "recording" };
@@ -15591,8 +15804,8 @@ async function route(request2, response) {
   if (match) {
     const entry = sessions.get(decodeURIComponent(match[1]));
     if (!entry) return json2(response, 404, { error: { code: "recording_not_found", message: "The local recording session was not found." } });
-    if (request2.method === "GET" && !match[2]) return json2(response, 200, serializeEntry(entry));
-    if (request2.method === "POST" && match[2] === "stop") {
+    if (request3.method === "GET" && !match[2]) return json2(response, 200, serializeEntry(entry));
+    if (request3.method === "POST" && match[2] === "stop") {
       if (entry.state === "ready") return json2(response, 200, serializeEntry(entry));
       await finalizeEntry(entry, "agent_request");
       return json2(response, entry.result ? 200 : 500, serializeEntry(entry));
@@ -15633,10 +15846,10 @@ async function persistState() {
 `, { mode: 384 });
   await rename(temporary, daemonStatePath());
 }
-async function readJson(request2) {
+async function readJson(request3) {
   const chunks = [];
   let size = 0;
-  for await (const chunk of request2) {
+  for await (const chunk of request3) {
     const buffer = Buffer.from(chunk);
     size += buffer.length;
     if (size > 1e6) throw new Error("Request body exceeds 1 MB.");
@@ -15652,7 +15865,7 @@ async function purgeExpiredCaptures() {
   const removed = await purgeExpiredRemoteCaptures(recordingTempRoot());
   for (const id of removed) sessions.delete(id);
   let changed = removed.length > 0;
-  for (const [id, entry] of sessions) if (entry.result?.frameDirectory && !await stat2(entry.result.frameDirectory).catch(() => null)) {
+  for (const [id, entry] of sessions) if (entry.result?.frameDirectory && !await stat3(entry.result.frameDirectory).catch(() => null)) {
     sessions.delete(id);
     changed = true;
   }
@@ -15689,44 +15902,6 @@ function cliFailureCode(error51) {
   return message.match(/^([a-z][a-z0-9_]{0,79}):/)?.[1] ?? "unexpected_error";
 }
 
-// src/keychain.ts
-import { spawn as spawn4 } from "child_process";
-var service = "rill";
-async function saveCredential(apiUrl, token) {
-  if (process.platform === "darwin") {
-    await run("security", ["add-generic-password", "-U", "-a", apiUrl, "-s", service, "-w", token]);
-    return;
-  }
-  if (process.platform === "linux") {
-    await run("secret-tool", ["store", "--label=Rill agent credential", "service", service, "api-url", apiUrl], token);
-    return;
-  }
-  throw new Error("OS keychain storage is not supported on this platform yet. Use RILL_TOKEN.");
-}
-async function loadCredential(apiUrl) {
-  if (process.env.RILL_TOKEN) return process.env.RILL_TOKEN;
-  try {
-    if (process.platform === "darwin") return (await run("security", ["find-generic-password", "-a", apiUrl, "-s", service, "-w"])).trim();
-    if (process.platform === "linux") return (await run("secret-tool", ["lookup", "service", service, "api-url", apiUrl])).trim();
-  } catch {
-    return null;
-  }
-  return null;
-}
-function run(command, args, input) {
-  return new Promise((resolve, reject) => {
-    const child = spawn4(command, args, { stdio: ["pipe", "pipe", "pipe"] });
-    const stdout = [];
-    const stderr = [];
-    child.stdout.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
-    child.stderr.on("data", (chunk) => stderr.push(Buffer.from(chunk)));
-    child.once("error", reject);
-    child.once("exit", (code) => code === 0 ? resolve(Buffer.concat(stdout).toString("utf8")) : reject(new Error(Buffer.concat(stderr).toString("utf8").trim() || `${command} exited with ${code}.`)));
-    if (input) child.stdin.end(input);
-    else child.stdin.end();
-  });
-}
-
 // src/output.ts
 function emit(value, pretty = false) {
   process.stdout.write(`${JSON.stringify(value, null, pretty ? 2 : void 0)}
@@ -15855,7 +16030,7 @@ async function runDoctor(apiUrl, overrides = {}) {
   } else {
     const token = await dependencies.loadCredential(apiUrl);
     if (!token) {
-      checks.push({ name: "authentication", status: "fail", message: "No Rill agent credential is available.", recovery: `Run \`rill --api-url ${apiUrl} login\` or set RILL_TOKEN.` });
+      checks.push({ name: "authentication", status: health.anonymousAccess ? "warn" : "fail", message: health.anonymousAccess ? "The first recording will create an anonymous identity in your OS credential store. Anonymous recordings expire after seven days." : "No Rill agent credential is available.", recovery: `Run \`rill --api-url ${apiUrl} login\` or set RILL_TOKEN.` });
     } else {
       try {
         const session = await dependencies.agentSession(apiUrl, token);
@@ -15873,10 +16048,10 @@ async function runDoctor(apiUrl, overrides = {}) {
     checks.push({ name: "ffmpeg", status: "skip", message: "Remote encoding does not require local FFmpeg." });
     try {
       const token = await dependencies.loadCredential(apiUrl);
-      if (!token || !(await dependencies.encodingCapabilities(apiUrl, token)).enabled) throw new Error("Remote encoding is not enabled for this workspace.");
-      checks.push({ name: "encoding", status: "pass", message: "Remote encoding is enabled." });
+      if (!(token ? (await dependencies.encodingCapabilities(apiUrl, token)).enabled : health?.anonymousAccess && health.anonymousRemoteEncoding)) throw new Error("Remote encoding is not enabled for this workspace.");
+      checks.push({ name: "encoding", status: "pass", message: token ? "Remote encoding is enabled." : "Remote encoding is available for the first anonymous recording." });
     } catch (error51) {
-      checks.push({ name: "encoding", status: "fail", message: errorMessage(error51), recovery: "Use --encoding local until your workspace joins the private trial." });
+      checks.push({ name: "encoding", status: "fail", message: errorMessage(error51), recovery: "Remote encoding must be enabled on the server before using the default recording workflow." });
     }
   }
   return { schemaVersion: 1, status: checks.some((check2) => check2.status === "fail") ? "error" : "ok", apiUrl, checks, ...runFeedbackFields(feedbackEnabled) };
@@ -15990,10 +16165,10 @@ function controlPlaneUrl(environmentUrl) {
 async function removeLocalCapture(id) {
   await ensureDaemon(process.argv[1]);
   const local = await recordingStatus(id).catch(() => null);
-  if (local?.result?.frameDirectory) await rm4(dirname2(local.result.videoPath), { recursive: true, force: true });
+  if (local?.result?.frameDirectory) await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
 }
-function watchEncoding(apiUrl, id, token) {
-  const child = spawn6(process.execPath, [process.argv[1], "--api-url", apiUrl, "encoding-watch", id], { detached: true, stdio: "ignore", env: { ...process.env, RILL_TOKEN: token } });
+function watchEncoding(apiUrl, id) {
+  const child = spawn6(process.execPath, [process.argv[1], "--api-url", apiUrl, "encoding-watch", id], { detached: true, stdio: "ignore", env: { ...process.env } });
   child.on("error", () => void 0);
   child.unref();
 }
@@ -16009,8 +16184,9 @@ program.command("doctor").description("Validate Rill prerequisites before record
 });
 async function authorize(quiet = false) {
   const options = program.opts();
+  if (parseAuthorization(await loadStoredCredential(options.apiUrl))?.anonymous) throw new Error("Use rill connect --email <your-email> to keep and claim this anonymous identity before using account access.");
   const client = new ControlPlaneClient(options.apiUrl, null);
-  const authorization = await client.createDeviceAuthorization({ deviceName: `${hostname3()} \xB7 ${process.platform}` });
+  const authorization = await client.createDeviceAuthorization({ deviceName: `${hostname4()} \xB7 ${process.platform}` });
   process.stderr.write(`Open ${authorization.verificationUri} and enter ${authorization.userCode}
 `);
   const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open";
@@ -16029,7 +16205,17 @@ async function authorize(quiet = false) {
   }
   throw new Error("Device authorization expired.");
 }
-program.command("login").description("Authorize Rill once.").action(async () => {
+program.command("whoami").description("Show the current verified agent identity without starting sign-in.").action(async () => {
+  const options = program.opts();
+  const identity = await whoami(options.apiUrl);
+  emit(identity, options.pretty);
+  if (!identity.authenticated) process.exitCode = 1;
+});
+program.command("connect").description("Connect this agent once, with renewable account access.").requiredOption("--email <email>", "Email of the Rill account approving access").action(async (input) => {
+  const options = program.opts();
+  emit({ schemaVersion: 1, ...await connectAgent(options.apiUrl, input.email) }, options.pretty);
+});
+program.command("login").description("Authorize Rill using the existing device login flow.").action(async () => {
   await authorize();
 });
 var record2 = program.command("record").description("Run a cloud browser from a URL and prompt, or manage a local recording.").argument("[url]").option("-p, --prompt <prompt>").option("--expectation <text>").option("--account <name>", "Saved website test account").option("--id <uuid>", "Retry a submission with the same run ID").option("--no-wait").action(async (url2, commandOptions) => {
@@ -16059,15 +16245,15 @@ var record2 = program.command("record").description("Run a cloud browser from a
 var cloudRun = program.command("run").description("Retrieve or cancel a cloud run.");
 for (const action of ["status", "cancel"]) cloudRun.command(action).argument("<run-id>").action(async (id) => {
   const options = program.opts();
-  const client = new ControlPlaneClient(options.apiUrl, await loadCredential(options.apiUrl));
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   const run2 = await (action === "status" ? client.cloudRun(id) : client.cancelCloudRun(id));
   if (options.json || options.pretty) emit(customerRun(run2), options.pretty);
   else process.stdout.write(formatCloudRun(run2));
 });
 record2.command("start").option("--encoding <mode>", "remote or local", "remote").option("--url <url>").option("--title <title>").option("--description <description>", "").option("--headed").option("--cdp-url <url>").option("--width <pixels>", "", "1280").option("--height <pixels>", "", "720").option("--max-duration <seconds>", "", "600").action(async (commandOptions) => {
   const options = program.opts();
-  const token = await loadCredential(options.apiUrl);
-  const client = new ControlPlaneClient(options.apiUrl, token);
+  await ensureAnonymousCredential(options.apiUrl);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   const result = await withRunFeedback(() => client.agentSession(), async (rememberRecording) => {
     if (!["local", "remote"].includes(commandOptions.encoding)) throw new Error("Encoding must be remote or local.");
     if (commandOptions.encoding === "remote" && !(await client.encodingCapabilities()).enabled) throw new Error("Remote encoding is unavailable for this workspace. Use --encoding local.");
@@ -16079,7 +16265,7 @@ record2.command("start").option("--encoding <mode>", "remote or local", "remote"
     const local = await startRecordingWithCompensation(remote, {
       startLocal: async () => {
         await ensureDaemon(process.argv[1]);
-        return startRecording({ encoding: commandOptions.encoding, recordingId: remote.recordingId, url: commandOptions.url, cdpUrl: commandOptions.cdpUrl, headed: Boolean(commandOptions.headed), width, height, maxDurationSeconds: Number(commandOptions.maxDuration), captureNetworkBodies: remote.bodyCaptureEnabled, cursorAppearance: remote.cursorAppearance });
+        return startRecording({ encoding: commandOptions.encoding, recordingId: remote.recordingId, url: commandOptions.url, cdpUrl: commandOptions.cdpUrl, headed: Boolean(commandOptions.headed), width, height, maxDurationSeconds: Math.min(Number(commandOptions.maxDuration), remote.maxDurationSeconds ?? 600), captureNetworkBodies: remote.bodyCaptureEnabled, cursorAppearance: remote.cursorAppearance });
       },
       cancelRemote: (recordingId, reason) => client.cancelRecording(recordingId, reason)
     });
@@ -16090,7 +16276,7 @@ record2.command("start").option("--encoding <mode>", "remote or local", "remote"
       headed: Boolean(commandOptions.headed),
       attached: Boolean(commandOptions.cdpUrl)
     }).catch(() => void 0);
-    return { schemaVersion: 1, recordingId: remote.recordingId, status: local.status, cdpUrl: local.cdpUrl, bodyCaptureEnabled: remote.bodyCaptureEnabled, maxDurationSeconds: Number(commandOptions.maxDuration) };
+    return { schemaVersion: 1, recordingId: remote.recordingId, status: local.status, cdpUrl: local.cdpUrl, bodyCaptureEnabled: remote.bodyCaptureEnabled, anonymous: remote.anonymous ?? false, expiresAt: remote.expiresAt ?? null, maxDurationSeconds: Math.min(Number(commandOptions.maxDuration), remote.maxDurationSeconds ?? 600) };
   });
   emit(result, options.pretty);
 });
@@ -16099,8 +16285,7 @@ record2.command("stop").argument("<recording-id>").option("--no-wait").option("-
   await ensureDaemon(process.argv[1]);
   const local = await stopRecording(recordingId);
   if (!local.result) throw new Error(local.error ?? "The recorder did not produce an artifact.");
-  const token = await loadCredential(options.apiUrl);
-  const client = new ControlPlaneClient(options.apiUrl, token);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   const stopped = await client.markRecordingStopped(recordingId, {
     durationSeconds: local.result.durationSeconds,
     stoppedReason: local.result.stoppedReason,
@@ -16112,11 +16297,11 @@ record2.command("stop").argument("<recording-id>").option("--no-wait").option("-
     const accepted = await submitFrameCapture(client, recordingId, local.result.frameDirectory);
     const result2 = commandOptions.wait && record2.opts().wait !== false ? await waitForEncoding(client, recordingId) : accepted;
     emit({ schemaVersion: 1, ...result2, ...recordingFeedbackFields(recordingId, stopped?.feedbackRequested ?? false) }, options.pretty);
-    if (result2.status === "ready") await rm4(dirname2(local.result.videoPath), { recursive: true, force: true });
-    else watchEncoding(options.apiUrl, recordingId, token);
+    if (result2.status === "ready") await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
+    else watchEncoding(options.apiUrl, recordingId);
     return;
   }
-  const video = await stat3(local.result.videoPath);
+  const video = await stat4(local.result.videoPath);
   const provisioned = await client.provisionVideo(recordingId, { sizeBytes: video.size, filename: basename(local.result.videoPath), uploadKind: "recorded_browser" });
   await Promise.all([client.uploadVideo(provisioned.uploadUrl, local.result.videoPath), client.uploadDiagnostics(recordingId, local.result.diagnosticsPath, local.result.diagnostics)]);
   const remote = commandOptions.wait === false || record2.opts().wait === false ? null : await client.waitUntilPlayable(recordingId);
@@ -16126,17 +16311,18 @@ record2.command("stop").argument("<recording-id>").option("--no-wait").option("-
     recordingId,
     status: remote ? "ready" : "processing",
     shareUrl: remote?.shareUrl ?? null,
+    expiresAt: remote?.expires_at ?? null,
     durationSeconds: local.result.durationSeconds,
     stoppedReason: local.result.stoppedReason,
     diagnostics: local.result.diagnostics,
     ...recordingFeedbackFields(recordingId, stopped?.feedbackRequested ?? false)
   };
   emit(result, options.pretty);
-  if (remote) await rm4(dirname2(local.result.videoPath), { recursive: true, force: true });
+  if (remote) await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
 });
 record2.command("retry").argument("<recording-id>").option("--no-wait").action(async (recordingId, commandOptions) => {
   const options = program.opts();
-  const client = new ControlPlaneClient(options.apiUrl, await loadCredential(options.apiUrl));
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   const current = await client.encodingStatus(recordingId).catch((error51) => {
     if (error51 instanceof ControlPlaneError && error51.code === "recording_not_found") return null;
     throw error51;
@@ -16154,17 +16340,17 @@ record2.command("retry").argument("<recording-id>").option("--no-wait").action(a
   const result = commandOptions.wait && record2.opts().wait !== false ? await waitForEncoding(client, recordingId) : accepted;
   emit({ schemaVersion: 1, ...result }, options.pretty);
   if (result.status === "ready") await removeLocalCapture(recordingId);
-  else watchEncoding(options.apiUrl, recordingId, await loadCredential(options.apiUrl));
+  else watchEncoding(options.apiUrl, recordingId);
 });
 program.command("encoding-watch", { hidden: true }).argument("<recording-id>").action(async (id) => {
   if (!/^rec_[a-zA-Z0-9_-]+$/.test(id)) throw new Error("Invalid recording ID");
   const options = program.opts();
-  const client = new ControlPlaneClient(options.apiUrl, await loadCredential(options.apiUrl));
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   const result = await waitForEncoding(client, id, 864e5);
   if (result.status === "ready") {
     await ensureDaemon(process.argv[1]);
     const local = await recordingStatus(id).catch(() => null);
-    if (local?.result?.frameDirectory) await rm4(dirname2(local.result.videoPath), { recursive: true, force: true });
+    if (local?.result?.frameDirectory) await rm5(dirname2(local.result.videoPath), { recursive: true, force: true });
   }
 });
 var feedback = program.command("feedback").description("Submit a short Rill product review for a recorded run.");
@@ -16174,7 +16360,7 @@ feedback.command("submit").argument("[recording-id]", "Omit only when setup fail
   if (![commandOptions.helped, commandOptions.friction, commandOptions.improvement].some((value) => value.trim())) throw new Error("validation_failed: Include at least one short feedback answer.");
   const options = program.opts();
   const token = await loadCredential(options.apiUrl);
-  const client = new ControlPlaneClient(options.apiUrl, token);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   await client.submitRecordingFeedback(recordingId ?? null, {
     outcome: commandOptions.outcome,
     whatHelped: commandOptions.helped,
@@ -16183,10 +16369,14 @@ feedback.command("submit").argument("[recording-id]", "Omit only when setup fail
   });
   emit(feedbackSubmissionReceipt(recordingId ?? null), options.pretty);
 });
+record2.command("list").description("List recordings visible to this connection.").action(async () => {
+  const options = program.opts();
+  emit(await new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl)).listRecordings(), options.pretty);
+});
 record2.command("status").argument("<recording-id>").action(async (recordingId) => {
   const options = program.opts();
   const token = await loadCredential(options.apiUrl);
-  const client = new ControlPlaneClient(options.apiUrl, token);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   try {
     const encoding = await client.encodingStatus(recordingId);
     const remote = encoding.status === "ready" ? await client.recordingStatus(recordingId) : {};
@@ -16208,24 +16398,24 @@ record2.command("status").argument("<recording-id>").action(async (recordingId)
 record2.command("cancel").argument("<recording-id>").description("Cancel an active recording and release its remote quota slot.").action(async (recordingId) => {
   const options = program.opts();
   const token = await loadCredential(options.apiUrl);
-  const client = new ControlPlaneClient(options.apiUrl, token);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   emit(await client.cancelRecording(recordingId), options.pretty);
 });
 program.command("upload").argument("<video-file>").option("--title <title>").option("--no-wait").action(async (videoFile, commandOptions) => {
   const options = program.opts();
-  const token = await loadCredential(options.apiUrl);
-  const client = new ControlPlaneClient(options.apiUrl, token);
-  const file2 = await stat3(videoFile);
+  await ensureAnonymousCredential(options.apiUrl);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
+  const file2 = await stat4(videoFile);
   const recording = await client.createRecording({ title: commandOptions.title ?? basename(videoFile), sourceUrl: null });
   const upload = await client.provisionVideo(recording.recordingId, { sizeBytes: file2.size, filename: basename(videoFile), uploadKind: "existing_video" });
   await client.uploadVideo(upload.uploadUrl, videoFile);
   const remote = commandOptions.wait === false ? null : await client.waitUntilPlayable(recording.recordingId);
   if (remote) process.stderr.write("\n");
-  emit({ schemaVersion: 1, recordingId: recording.recordingId, status: remote ? "ready" : "processing", shareUrl: remote?.shareUrl ?? null, diagnosticsAvailable: false }, options.pretty);
+  emit({ schemaVersion: 1, recordingId: recording.recordingId, status: remote ? "ready" : "processing", shareUrl: remote?.shareUrl ?? null, expiresAt: remote?.expires_at ?? recording.expiresAt ?? null, diagnosticsAvailable: false }, options.pretty);
 });
 program.command("inspect").argument("<share-url>").action(async (shareUrl) => {
   const options = program.opts();
-  emit(await new ControlPlaneClient(options.apiUrl, null).inspect(shareUrl), options.pretty);
+  emit(await new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl)).inspect(shareUrl), options.pretty);
 });
 var drafts = program.command("drafts");
 drafts.command("list").action(async () => {
@@ -16241,9 +16431,9 @@ drafts.command("purge").action(async () => {
   let purged = 0;
   for (const name of names) {
     const path = `${root}/${name}`;
-    const metadata = await stat3(path);
+    const metadata = await stat4(path);
     if (Date.now() - metadata.mtimeMs > 24 * 60 * 60 * 1e3) {
-      await rm4(path, { recursive: true, force: true });
+      await rm5(path, { recursive: true, force: true });
       purged += 1;
     }
   }
@@ -16255,7 +16445,7 @@ program.hook("preAction", async (_command, actionCommand) => {
   const options = program.opts();
   const token = await loadCredential(options.apiUrl).catch(() => null);
   if (!token) return;
-  const client = new ControlPlaneClient(options.apiUrl, token);
+  const client = new ControlPlaneClient(options.apiUrl, () => loadCredential(options.apiUrl));
   await startCliTelemetry(client, command);
 });
 async function startCliTelemetry(client, command) {