terminalhire 0.40.4 → 0.40.6

package/dist/bin/jpi-bounties.js

@@ -10618,6 +10618,14 @@ function warnStderr(message) {
   process.stderr.write(`${message}
 `);
 }
+function makeWarnOnce() {
+  const seen = /* @__PURE__ */ new Set();
+  return (message) => {
+    if (seen.has(message)) return;
+    seen.add(message);
+    warnStderr(message);
+  };
+}
 function atomicWriteFileSync(filePath, content) {
   const dir = dirname(filePath);
   ensureStateDirForSecret(dir);
@@ -10663,11 +10671,11 @@ async function deleteKey() {
     if (e.code !== "ENOENT") throw e;
   }
 }
-async function resolveKey(filePath, opts) {
+async function resolveKey(filePath, opts, warnOnce) {
   if (opts.keyPolicy === "keychain-required") {
     const key = await tryLoadFromKeytar();
     if (!key) {
-      warnStderr(
+      warnOnce(
         `crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`
       );
       return null;
@@ -10677,8 +10685,9 @@ async function resolveKey(filePath, opts) {
   return loadOrCreateSharedKey();
 }
 function createEncryptedStore(filePath, opts) {
+  const warnOnce = makeWarnOnce();
   async function read() {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return opts.blank();
     if (!existsSync3(filePath)) return opts.blank();
     try {
@@ -10687,12 +10696,12 @@ function createEncryptedStore(filePath, opts) {
       const plaintext = decrypt(blob, key);
       return JSON.parse(plaintext);
     } catch {
-      warnStderr(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
+      warnOnce(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
       return opts.blank();
     }
   }
   async function write(value) {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return;
     const blob = encrypt(JSON.stringify(value), key);
     atomicWriteFileSync(filePath, JSON.stringify(blob, null, 2));

package/dist/bin/jpi-chat.js

@@ -5478,6 +5478,14 @@ function warnStderr(message) {
   process.stderr.write(`${message}
 `);
 }
+function makeWarnOnce() {
+  const seen = /* @__PURE__ */ new Set();
+  return (message) => {
+    if (seen.has(message)) return;
+    seen.add(message);
+    warnStderr(message);
+  };
+}
 function atomicWriteFileSync(filePath, content) {
   const dir = dirname(filePath);
   ensureStateDirForSecret(dir);
@@ -5523,11 +5531,11 @@ async function deleteKey() {
     if (e.code !== "ENOENT") throw e;
   }
 }
-async function resolveKey(filePath, opts) {
+async function resolveKey(filePath, opts, warnOnce) {
   if (opts.keyPolicy === "keychain-required") {
     const key = await tryLoadFromKeytar();
     if (!key) {
-      warnStderr(
+      warnOnce(
         `crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`
       );
       return null;
@@ -5537,8 +5545,9 @@ async function resolveKey(filePath, opts) {
   return loadOrCreateSharedKey();
 }
 function createEncryptedStore(filePath, opts) {
+  const warnOnce = makeWarnOnce();
   async function read() {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return opts.blank();
     if (!existsSync9(filePath)) return opts.blank();
     try {
@@ -5547,12 +5556,12 @@ function createEncryptedStore(filePath, opts) {
       const plaintext = decrypt2(blob, key);
       return JSON.parse(plaintext);
     } catch {
-      warnStderr(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
+      warnOnce(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
       return opts.blank();
     }
   }
   async function write(value) {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return;
     const blob = encrypt2(JSON.stringify(value), key);
     atomicWriteFileSync(filePath, JSON.stringify(blob, null, 2));

package/dist/bin/jpi-claim.js

@@ -24831,6 +24831,14 @@ function warnStderr(message) {
   process.stderr.write(`${message}
 `);
 }
+function makeWarnOnce() {
+  const seen = /* @__PURE__ */ new Set();
+  return (message) => {
+    if (seen.has(message)) return;
+    seen.add(message);
+    warnStderr(message);
+  };
+}
 function atomicWriteFileSync(filePath, content) {
   const dir = dirname4(filePath);
   ensureStateDirForSecret(dir);
@@ -24876,11 +24884,11 @@ async function deleteKey() {
     if (e.code !== "ENOENT") throw e;
   }
 }
-async function resolveKey(filePath, opts) {
+async function resolveKey(filePath, opts, warnOnce) {
   if (opts.keyPolicy === "keychain-required") {
     const key = await tryLoadFromKeytar();
     if (!key) {
-      warnStderr(
+      warnOnce(
         `crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`
       );
       return null;
@@ -24890,8 +24898,9 @@ async function resolveKey(filePath, opts) {
   return loadOrCreateSharedKey();
 }
 function createEncryptedStore(filePath, opts) {
+  const warnOnce = makeWarnOnce();
   async function read() {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return opts.blank();
     if (!existsSync6(filePath)) return opts.blank();
     try {
@@ -24900,12 +24909,12 @@ function createEncryptedStore(filePath, opts) {
       const plaintext = decrypt2(blob, key);
       return JSON.parse(plaintext);
     } catch {
-      warnStderr(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
+      warnOnce(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
       return opts.blank();
     }
   }
   async function write(value) {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return;
     const blob = encrypt2(JSON.stringify(value), key);
     atomicWriteFileSync(filePath, JSON.stringify(blob, null, 2));

package/dist/bin/jpi-contribute.js

@@ -2742,6 +2742,14 @@ function warnStderr(message) {
   process.stderr.write(`${message}
 `);
 }
+function makeWarnOnce() {
+  const seen = /* @__PURE__ */ new Set();
+  return (message) => {
+    if (seen.has(message)) return;
+    seen.add(message);
+    warnStderr(message);
+  };
+}
 function atomicWriteFileSync(filePath, content) {
   const dir = dirname(filePath);
   ensureStateDirForSecret(dir);
@@ -2787,11 +2795,11 @@ async function deleteKey() {
     if (e.code !== "ENOENT") throw e;
   }
 }
-async function resolveKey(filePath, opts) {
+async function resolveKey(filePath, opts, warnOnce) {
   if (opts.keyPolicy === "keychain-required") {
     const key = await tryLoadFromKeytar();
     if (!key) {
-      warnStderr(
+      warnOnce(
         `crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`
       );
       return null;
@@ -2801,8 +2809,9 @@ async function resolveKey(filePath, opts) {
   return loadOrCreateSharedKey();
 }
 function createEncryptedStore(filePath, opts) {
+  const warnOnce = makeWarnOnce();
   async function read() {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return opts.blank();
     if (!existsSync4(filePath)) return opts.blank();
     try {
@@ -2811,12 +2820,12 @@ function createEncryptedStore(filePath, opts) {
       const plaintext = decrypt(blob, key);
       return JSON.parse(plaintext);
     } catch {
-      warnStderr(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
+      warnOnce(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
       return opts.blank();
     }
   }
   async function write(value) {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return;
     const blob = encrypt(JSON.stringify(value), key);
     atomicWriteFileSync(filePath, JSON.stringify(blob, null, 2));

package/dist/bin/jpi-devs.js

@@ -10566,6 +10566,14 @@ function warnStderr(message) {
   process.stderr.write(`${message}
 `);
 }
+function makeWarnOnce() {
+  const seen = /* @__PURE__ */ new Set();
+  return (message) => {
+    if (seen.has(message)) return;
+    seen.add(message);
+    warnStderr(message);
+  };
+}
 function atomicWriteFileSync(filePath, content) {
   const dir = dirname(filePath);
   ensureStateDirForSecret(dir);
@@ -10611,11 +10619,11 @@ async function deleteKey() {
     if (e.code !== "ENOENT") throw e;
   }
 }
-async function resolveKey(filePath, opts) {
+async function resolveKey(filePath, opts, warnOnce) {
   if (opts.keyPolicy === "keychain-required") {
     const key = await tryLoadFromKeytar();
     if (!key) {
-      warnStderr(
+      warnOnce(
         `crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`
       );
       return null;
@@ -10625,8 +10633,9 @@ async function resolveKey(filePath, opts) {
   return loadOrCreateSharedKey();
 }
 function createEncryptedStore(filePath, opts) {
+  const warnOnce = makeWarnOnce();
   async function read() {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return opts.blank();
     if (!existsSync3(filePath)) return opts.blank();
     try {
@@ -10635,12 +10644,12 @@ function createEncryptedStore(filePath, opts) {
       const plaintext = decrypt(blob, key);
       return JSON.parse(plaintext);
     } catch {
-      warnStderr(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
+      warnOnce(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
       return opts.blank();
     }
   }
   async function write(value) {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return;
     const blob = encrypt(JSON.stringify(value), key);
     atomicWriteFileSync(filePath, JSON.stringify(blob, null, 2));

package/dist/bin/jpi-dispatch.js

@@ -11928,6 +11928,14 @@ function warnStderr(message) {
   process.stderr.write(`${message}
 `);
 }
+function makeWarnOnce() {
+  const seen = /* @__PURE__ */ new Set();
+  return (message) => {
+    if (seen.has(message)) return;
+    seen.add(message);
+    warnStderr(message);
+  };
+}
 function atomicWriteFileSync(filePath, content) {
   const dir = dirname(filePath);
   ensureStateDirForSecret(dir);
@@ -11973,11 +11981,11 @@ async function deleteKey() {
     if (e.code !== "ENOENT") throw e;
   }
 }
-async function resolveKey(filePath, opts) {
+async function resolveKey(filePath, opts, warnOnce) {
   if (opts.keyPolicy === "keychain-required") {
     const key = await tryLoadFromKeytar();
     if (!key) {
-      warnStderr(
+      warnOnce(
         `crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`
       );
       return null;
@@ -11987,8 +11995,9 @@ async function resolveKey(filePath, opts) {
   return loadOrCreateSharedKey();
 }
 function createEncryptedStore(filePath, opts) {
+  const warnOnce = makeWarnOnce();
   async function read() {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return opts.blank();
     if (!existsSync8(filePath)) return opts.blank();
     try {
@@ -11997,12 +12006,12 @@ function createEncryptedStore(filePath, opts) {
       const plaintext = decrypt2(blob, key);
       return JSON.parse(plaintext);
     } catch {
-      warnStderr(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
+      warnOnce(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
       return opts.blank();
     }
   }
   async function write(value) {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return;
     const blob = encrypt2(JSON.stringify(value), key);
     atomicWriteFileSync(filePath, JSON.stringify(blob, null, 2));
@@ -63618,15 +63627,11 @@ async function run25() {
   console.log("");
   console.log("  Fetching anonymous job index (no dev data sent)...");
   const jobsScript = resolveScript("jpi-jobs");
-  const seedChild = spawnSync3(
-    process.execPath,
-    [jobsScript, "--limit", "0"],
-    {
-      stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env, TERMINALHIRE_SEED_ONLY: "1" },
-      timeout: 15e3
-    }
-  );
+  const seedChild = spawnSync3(process.execPath, [jobsScript, "--limit", "0"], {
+    stdio: ["ignore", "pipe", "pipe"],
+    env: { ...process.env, TERMINALHIRE_SEED_ONLY: "1" },
+    timeout: 15e3
+  });
   if (seedChild.status === 0) {
     console.log("  Job cache seeded successfully.");
   } else {
@@ -63658,7 +63663,9 @@ async function run25() {
   console.log("");
   console.log("  This is the only step that modifies a system file.");
   console.log("  A timestamped backup is created before any change.");
-  console.log("  Disable at any time: node install.js --uninstall  (or terminalhire spinner --off)");
+  console.log(
+    "  Disable at any time: node install.js --uninstall  (or terminalhire spinner --off)"
+  );
   console.log("");
   try {
     const installMod = await import(pathToFileURL(resolveInstallJs()).href);
@@ -63677,9 +63684,10 @@ async function run25() {
   console.log("");
   console.log("  A statusLine that shows ONLY personal connection signals \u2014 \u{1F4AC} unread");
   console.log("  messages and inbound intro requests. Never job ads (those stay in the");
-  console.log("  spinner). Local cache read, zero network. Separate consent + backup;");
-  console.log("  it stays current across plugin updates and preserves any existing");
-  console.log("  statusLine you have. Remove any time: node statusline-install.js --uninstall");
+  console.log("  spinner). Local cache read, zero network. On by default; backs up and");
+  console.log("  preserves any existing statusLine, and stays current across plugin");
+  console.log("  updates. Answer n to skip, or remove later with:");
+  console.log("    terminalhire statusline --off");
   console.log("");
   try {
     const statuslineMod = await import(pathToFileURL(resolveStatuslineInstallJs()).href);
@@ -63687,7 +63695,9 @@ async function run25() {
       await statuslineMod.installStatusline({ ask: ask4 });
     } else {
       console.log("");
-      console.log("  statusLine setup unavailable in this build. Run manually: node statusline-install.js");
+      console.log(
+        "  statusLine setup unavailable in this build. Run manually: node statusline-install.js"
+      );
     }
   } catch {
     console.log("");
@@ -63716,7 +63726,9 @@ async function run25() {
   console.log("  this terminal (one-time OS registration; macOS may show an Automation");
   console.log("  prompt the first time a link is opened). Nothing is sent anywhere \u2014 it");
   console.log("  only wires th://claim/<token> links on this machine to a local, read-only");
-  console.log("  `terminalhire claim preview <token>`. Undo any time: terminalhire protocol unregister");
+  console.log(
+    "  `terminalhire claim preview <token>`. Undo any time: terminalhire protocol unregister"
+  );
   console.log("");
   const protocolAnswer = await ask4("Register th:// claim links now? [Y/n] (Enter = yes): ");
   const doProtocol = protocolAnswer === "" || protocolAnswer === "y" || protocolAnswer === "yes";

package/dist/bin/jpi-hub.js

@@ -11198,6 +11198,14 @@ function warnStderr(message) {
   process.stderr.write(`${message}
 `);
 }
+function makeWarnOnce() {
+  const seen = /* @__PURE__ */ new Set();
+  return (message) => {
+    if (seen.has(message)) return;
+    seen.add(message);
+    warnStderr(message);
+  };
+}
 function atomicWriteFileSync(filePath, content) {
   const dir = dirname(filePath);
   ensureStateDirForSecret(dir);
@@ -11243,11 +11251,11 @@ async function deleteKey() {
     if (e.code !== "ENOENT") throw e;
   }
 }
-async function resolveKey(filePath, opts) {
+async function resolveKey(filePath, opts, warnOnce) {
   if (opts.keyPolicy === "keychain-required") {
     const key = await tryLoadFromKeytar();
     if (!key) {
-      warnStderr(
+      warnOnce(
         `crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`
       );
       return null;
@@ -11257,8 +11265,9 @@ async function resolveKey(filePath, opts) {
   return loadOrCreateSharedKey();
 }
 function createEncryptedStore(filePath, opts) {
+  const warnOnce = makeWarnOnce();
   async function read() {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return opts.blank();
     if (!existsSync4(filePath)) return opts.blank();
     try {
@@ -11267,12 +11276,12 @@ function createEncryptedStore(filePath, opts) {
       const plaintext = decrypt(blob, key);
       return JSON.parse(plaintext);
     } catch {
-      warnStderr(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
+      warnOnce(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
       return opts.blank();
     }
   }
   async function write(value) {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return;
     const blob = encrypt(JSON.stringify(value), key);
     atomicWriteFileSync(filePath, JSON.stringify(blob, null, 2));

package/dist/bin/jpi-inbox.js

@@ -5478,6 +5478,14 @@ function warnStderr(message) {
   process.stderr.write(`${message}
 `);
 }
+function makeWarnOnce() {
+  const seen = /* @__PURE__ */ new Set();
+  return (message) => {
+    if (seen.has(message)) return;
+    seen.add(message);
+    warnStderr(message);
+  };
+}
 function atomicWriteFileSync(filePath, content) {
   const dir = dirname(filePath);
   ensureStateDirForSecret(dir);
@@ -5523,11 +5531,11 @@ async function deleteKey() {
     if (e.code !== "ENOENT") throw e;
   }
 }
-async function resolveKey(filePath, opts) {
+async function resolveKey(filePath, opts, warnOnce) {
   if (opts.keyPolicy === "keychain-required") {
     const key = await tryLoadFromKeytar();
     if (!key) {
-      warnStderr(
+      warnOnce(
         `crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`
       );
       return null;
@@ -5537,8 +5545,9 @@ async function resolveKey(filePath, opts) {
   return loadOrCreateSharedKey();
 }
 function createEncryptedStore(filePath, opts) {
+  const warnOnce = makeWarnOnce();
   async function read() {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return opts.blank();
     if (!existsSync9(filePath)) return opts.blank();
     try {
@@ -5547,12 +5556,12 @@ function createEncryptedStore(filePath, opts) {
       const plaintext = decrypt2(blob, key);
       return JSON.parse(plaintext);
     } catch {
-      warnStderr(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
+      warnOnce(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
       return opts.blank();
     }
   }
   async function write(value) {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return;
     const blob = encrypt2(JSON.stringify(value), key);
     atomicWriteFileSync(filePath, JSON.stringify(blob, null, 2));

package/dist/bin/jpi-init.js

@@ -10772,15 +10772,11 @@ async function run() {
   console.log("");
   console.log("  Fetching anonymous job index (no dev data sent)...");
   const jobsScript = resolveScript("jpi-jobs");
-  const seedChild = spawnSync(
-    process.execPath,
-    [jobsScript, "--limit", "0"],
-    {
-      stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env, TERMINALHIRE_SEED_ONLY: "1" },
-      timeout: 15e3
-    }
-  );
+  const seedChild = spawnSync(process.execPath, [jobsScript, "--limit", "0"], {
+    stdio: ["ignore", "pipe", "pipe"],
+    env: { ...process.env, TERMINALHIRE_SEED_ONLY: "1" },
+    timeout: 15e3
+  });
   if (seedChild.status === 0) {
     console.log("  Job cache seeded successfully.");
   } else {
@@ -10812,7 +10808,9 @@ async function run() {
   console.log("");
   console.log("  This is the only step that modifies a system file.");
   console.log("  A timestamped backup is created before any change.");
-  console.log("  Disable at any time: node install.js --uninstall  (or terminalhire spinner --off)");
+  console.log(
+    "  Disable at any time: node install.js --uninstall  (or terminalhire spinner --off)"
+  );
   console.log("");
   try {
     const installMod = await import(pathToFileURL(resolveInstallJs()).href);
@@ -10831,9 +10829,10 @@ async function run() {
   console.log("");
   console.log("  A statusLine that shows ONLY personal connection signals \u2014 \u{1F4AC} unread");
   console.log("  messages and inbound intro requests. Never job ads (those stay in the");
-  console.log("  spinner). Local cache read, zero network. Separate consent + backup;");
-  console.log("  it stays current across plugin updates and preserves any existing");
-  console.log("  statusLine you have. Remove any time: node statusline-install.js --uninstall");
+  console.log("  spinner). Local cache read, zero network. On by default; backs up and");
+  console.log("  preserves any existing statusLine, and stays current across plugin");
+  console.log("  updates. Answer n to skip, or remove later with:");
+  console.log("    terminalhire statusline --off");
   console.log("");
   try {
     const statuslineMod = await import(pathToFileURL(resolveStatuslineInstallJs()).href);
@@ -10841,7 +10840,9 @@ async function run() {
       await statuslineMod.installStatusline({ ask });
     } else {
       console.log("");
-      console.log("  statusLine setup unavailable in this build. Run manually: node statusline-install.js");
+      console.log(
+        "  statusLine setup unavailable in this build. Run manually: node statusline-install.js"
+      );
     }
   } catch {
     console.log("");
@@ -10870,7 +10871,9 @@ async function run() {
   console.log("  this terminal (one-time OS registration; macOS may show an Automation");
   console.log("  prompt the first time a link is opened). Nothing is sent anywhere \u2014 it");
   console.log("  only wires th://claim/<token> links on this machine to a local, read-only");
-  console.log("  `terminalhire claim preview <token>`. Undo any time: terminalhire protocol unregister");
+  console.log(
+    "  `terminalhire claim preview <token>`. Undo any time: terminalhire protocol unregister"
+  );
   console.log("");
   const protocolAnswer = await ask("Register th:// claim links now? [Y/n] (Enter = yes): ");
   const doProtocol = protocolAnswer === "" || protocolAnswer === "y" || protocolAnswer === "yes";

package/dist/bin/jpi-intro.js

@@ -1547,6 +1547,14 @@ function warnStderr(message) {
   process.stderr.write(`${message}
 `);
 }
+function makeWarnOnce() {
+  const seen = /* @__PURE__ */ new Set();
+  return (message) => {
+    if (seen.has(message)) return;
+    seen.add(message);
+    warnStderr(message);
+  };
+}
 function atomicWriteFileSync(filePath, content) {
   const dir = dirname(filePath);
   ensureStateDirForSecret(dir);
@@ -1592,11 +1600,11 @@ async function deleteKey() {
     if (e.code !== "ENOENT") throw e;
   }
 }
-async function resolveKey(filePath, opts) {
+async function resolveKey(filePath, opts, warnOnce) {
   if (opts.keyPolicy === "keychain-required") {
     const key = await tryLoadFromKeytar();
     if (!key) {
-      warnStderr(
+      warnOnce(
         `crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`
       );
       return null;
@@ -1606,8 +1614,9 @@ async function resolveKey(filePath, opts) {
   return loadOrCreateSharedKey();
 }
 function createEncryptedStore(filePath, opts) {
+  const warnOnce = makeWarnOnce();
   async function read() {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return opts.blank();
     if (!existsSync4(filePath)) return opts.blank();
     try {
@@ -1616,12 +1625,12 @@ function createEncryptedStore(filePath, opts) {
       const plaintext = decrypt(blob, key);
       return JSON.parse(plaintext);
     } catch {
-      warnStderr(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
+      warnOnce(`crypto-store: failed to decrypt ${filePath} \u2014 returning blank`);
       return opts.blank();
     }
   }
   async function write(value) {
-    const key = await resolveKey(filePath, opts);
+    const key = await resolveKey(filePath, opts, warnOnce);
     if (!key) return;
     const blob = encrypt(JSON.stringify(value), key);
     atomicWriteFileSync(filePath, JSON.stringify(blob, null, 2));