diff --git a/conftest.py b/conftest.py
index c94232e4..86d564bc 100644
--- a/conftest.py
+++ b/conftest.py
@@ -55,6 +55,19 @@ def _clean_deepgram_env(monkeypatch):
             monkeypatch.delenv(key, raising=False)
 
 
+@pytest.fixture(autouse=True)
+def _speak_tests_run_as_a_person(request, monkeypatch):
+    """Speak tests run as a person by default: the agent rules key off hard
+    agent markers, which a developer's own shell may set (CLAUDECODE=1).
+    Tests that need agent mode patch ``is_ai_agent`` themselves."""
+    if "deepctl-cmd-speak" not in request.path.parts:
+        return
+    from deepctl_core.output import AI_AGENT_ENV_MARKERS
+
+    for name in (*AI_AGENT_ENV_MARKERS, "OR_APP_NAME", "OR_SITE_URL"):
+        monkeypatch.delenv(name, raising=False)
+
+
 @pytest.fixture(autouse=True)
 def _disable_telemetry(monkeypatch):
     """Keep tests that call `main()` from initializing real telemetry.
@@ -64,3 +77,14 @@ def _disable_telemetry(monkeypatch):
     """
     monkeypatch.setenv("DEEPCTL_TELEMETRY_DISABLED", "1")
     monkeypatch.setenv("DEEPCTL_TELEMETRY_DSN", "http://k@127.0.0.1:9/1")
+
+
+@pytest.fixture(autouse=True)
+def _restore_sigint():
+    """`main()` installs its own SIGINT handler; put pytest's back."""
+    import signal
+
+    before = signal.getsignal(signal.SIGINT)
+    yield
+    if before is not None:
+        signal.signal(signal.SIGINT, before)
diff --git a/packages/deepctl-cmd-debug-audio/README.md b/packages/deepctl-cmd-debug-audio/README.md
index 832eb13c..ac7a1d16 100644
--- a/packages/deepctl-cmd-debug-audio/README.md
+++ b/packages/deepctl-cmd-debug-audio/README.md
@@ -38,7 +38,6 @@ pipx run deepctl --help
 - `click>=8.2.0,<9`
 - `rich>=13.0.0,<16`
 - `pydantic>=2.0.0,<3`
-- `ffmpeg-python>=0.2.0`
 - `httpx>=0.24.0,<1`
 
 ## License
diff --git a/packages/deepctl-cmd-debug-audio/pyproject.toml b/packages/deepctl-cmd-debug-audio/pyproject.toml
index 57061a62..0aba4d52 100644
--- a/packages/deepctl-cmd-debug-audio/pyproject.toml
+++ b/packages/deepctl-cmd-debug-audio/pyproject.toml
@@ -26,7 +26,6 @@ dependencies = [
     "click>=8.2.0,<9",
     "rich>=13.0.0,<16",
     "pydantic>=2.0.0,<3",
-    "ffmpeg-python>=0.2.0",
     "httpx>=0.24.0,<1",
 ]
 
diff --git a/packages/deepctl-cmd-debug-audio/src/deepctl_cmd_debug_audio/command.py b/packages/deepctl-cmd-debug-audio/src/deepctl_cmd_debug_audio/command.py
index aec07b51..710db3d8 100644
--- a/packages/deepctl-cmd-debug-audio/src/deepctl_cmd_debug_audio/command.py
+++ b/packages/deepctl-cmd-debug-audio/src/deepctl_cmd_debug_audio/command.py
@@ -8,7 +8,6 @@
 from typing import Any
 from urllib.parse import urlparse
 
-import ffmpeg  # type: ignore[import-untyped]
 from deepctl_core import (
     AuthManager,
     BaseCommand,
@@ -45,6 +44,32 @@ def _ffprobe_input(file_path: str) -> str:
 console = get_console()
 status_console = get_status_console()
 
+# Seconds a single ffprobe run may take before it is abandoned.
+FFPROBE_TIMEOUT_S = 30
+
+
+def _probe_input(path: str) -> list[str]:
+    """ffprobe's input arguments, always last on the command line.
+
+    The input is always a local file (URLs are downloaded first), so ffprobe
+    may open it only through the file protocol: tcp:, concat:, pipe: and the
+    rest are refused. It is named as ``file:<absolute path>``
+    (``_ffprobe_input``), so ffprobe reads it as a file and never as an
+    option, whatever it is called.
+    """
+    return ["-protocol_whitelist", "file", _ffprobe_input(path)]
+
+
+def _run_ffprobe(cmd: list[str]) -> "subprocess.CompletedProcess[bytes]":
+    """Run ffprobe from an argv list: no shell, no stdin, bounded in time."""
+    return subprocess.run(
+        cmd,
+        stdin=subprocess.DEVNULL,
+        capture_output=True,
+        timeout=FFPROBE_TIMEOUT_S,
+        check=False,
+    )
+
 
 def _human_output() -> bool:
     """True when stdout is for a person, not a parser."""
@@ -239,17 +264,37 @@ def run_ffprobe(
                 # value stays one argument, and run ffprobe directly
                 cmd = [ffprobe_bin, "-v", "quiet", "-print_format", "json"]
                 cmd.extend(shlex.split(custom_args))
-                cmd.append(_ffprobe_input(file_path))
+                cmd.extend(_probe_input(file_path))
 
-                result = subprocess.run(cmd, capture_output=True, text=True)
+                result = _run_ffprobe(cmd)
                 if result.returncode != 0:
-                    raise Exception(f"ffprobe failed: {result.stderr}")
-
-                return dict(json.loads(result.stdout))
-            else:
-                # Use python-ffmpeg for standard probe
-                probe = ffmpeg.probe(_ffprobe_input(file_path), cmd=ffprobe_bin)
-                return dict(probe)
+                    stderr = result.stderr.decode("utf-8", errors="replace")
+                    raise Exception(f"ffprobe failed: {stderr}")
+
+                return dict(json.loads(result.stdout.decode("utf-8")))
+            # The standard probe: the argv ffmpeg-python's probe() built,
+            # plus the file-only protocol whitelist.
+            cmd = [
+                ffprobe_bin,
+                "-show_format",
+                "-show_streams",
+                "-of",
+                "json",
+                *_probe_input(file_path),
+            ]
+            probe = _run_ffprobe(cmd)
+            if probe.returncode != 0:
+                # stderr is captured, so say what ffprobe said: its last line.
+                said = [
+                    line.strip()
+                    for line in (probe.stderr or b"")
+                    .decode("utf-8", "replace")
+                    .splitlines()
+                    if line.strip()
+                ]
+                why = said[-1][:300] if said else f"exit {probe.returncode}"
+                raise Exception(f"ffprobe couldn't read the file: {why}")
+            return dict(json.loads(probe.stdout.decode("utf-8")))
         except Exception as e:
             raise Exception(f"Failed to probe file: {e!s}")
 
diff --git a/packages/deepctl-cmd-debug-audio/tests/unit/test_audio_command.py b/packages/deepctl-cmd-debug-audio/tests/unit/test_audio_command.py
index e8680cd9..fd9ac68b 100644
--- a/packages/deepctl-cmd-debug-audio/tests/unit/test_audio_command.py
+++ b/packages/deepctl-cmd-debug-audio/tests/unit/test_audio_command.py
@@ -2,9 +2,15 @@
 
 import json
 import os
+import shutil
+import socket
+import subprocess
+import threading
+import time
 from unittest.mock import MagicMock, Mock, patch
 
 import pytest
+from deepctl_cmd_debug_audio import command as command_module
 from deepctl_cmd_debug_audio.command import AudioCommand
 from deepctl_cmd_debug_audio.models import (
     AudioDebugResult,
@@ -12,7 +18,6 @@
     AudioInfo,
     AudioStream,
 )
-from deepctl_cmd_debug_audio import command as command_module
 from deepctl_core import AuthManager, Config, DeepgramClient
 
 
@@ -26,6 +31,15 @@ def _ffprobe_lookup_via_which(monkeypatch):
     )
 
 
+def _completed(returncode: int, stdout: str, stderr: bytes = b"") -> Mock:
+    """A subprocess.run result carrying ffprobe's bytes output."""
+    result = Mock()
+    result.returncode = returncode
+    result.stdout = stdout.encode("utf-8")
+    result.stderr = stderr
+    return result
+
+
 class TestAudioCommand:
     """Test cases for AudioCommand."""
 
@@ -109,30 +123,103 @@ def test_check_ffmpeg_installed(self, mock_which, command):
         assert command.check_ffmpeg_installed() is False
 
     @patch("shutil.which", return_value="/usr/bin/ffprobe")
-    @patch("ffmpeg.probe")
+    @patch("subprocess.run")
     def test_run_ffprobe_standard(
-        self, mock_probe, mock_which, command, sample_probe_data
+        self, mock_run, mock_which, command, sample_probe_data
     ):
-        """Test running ffprobe without custom arguments."""
-        mock_probe.return_value = sample_probe_data
+        """The standard probe runs ffprobe's JSON argv as a list, no shell."""
+        mock_run.return_value = _completed(0, json.dumps(sample_probe_data))
 
         result = command.run_ffprobe("test.mp3")
 
         assert result == sample_probe_data
-        mock_probe.assert_called_once_with(
-            "file:" + os.path.abspath("test.mp3"), cmd="/usr/bin/ffprobe"
+        mock_run.assert_called_once()
+        args, kwargs = mock_run.call_args
+        assert args[0] == [
+            "/usr/bin/ffprobe",
+            "-show_format",
+            "-show_streams",
+            "-of",
+            "json",
+            "-protocol_whitelist",
+            "file",
+            "file:" + os.path.abspath("test.mp3"),
+        ]
+        assert kwargs.get("shell", False) is False
+        assert kwargs["timeout"] == 30
+        assert kwargs["capture_output"] is True
+        assert kwargs["stdin"] is subprocess.DEVNULL
+
+    @pytest.mark.parametrize(
+        ("given", "probed"),
+        [
+            ("-v.wav", "file:" + os.path.abspath("-v.wav")),
+            ("-show_entries.wav", "file:" + os.path.abspath("-show_entries.wav")),
+            ("/abs/-v.wav", "file:" + os.path.abspath("/abs/-v.wav")),
+            ("dir/-v.wav", "file:" + os.path.abspath("dir/-v.wav")),
+        ],
+    )
+    @patch("shutil.which", return_value="/usr/bin/ffprobe")
+    @patch("subprocess.run")
+    def test_run_ffprobe_never_passes_a_path_as_an_option(
+        self, mock_run, mock_which, command, sample_probe_data, given, probed
+    ):
+        """A file name that starts with "-" reaches ffprobe as a file."""
+        mock_run.return_value = _completed(0, json.dumps(sample_probe_data))
+
+        command.run_ffprobe(given)
+        assert mock_run.call_args[0][0][-3:] == ["-protocol_whitelist", "file", probed]
+
+        command.run_ffprobe(given, "-show_streams")
+        assert mock_run.call_args[0][0][-3:] == ["-protocol_whitelist", "file", probed]
+
+    @patch("shutil.which", return_value="/usr/bin/ffprobe")
+    @patch("subprocess.run")
+    def test_run_ffprobe_failure_says_what_ffprobe_said(
+        self, mock_run, mock_which, command
+    ):
+        """A non-zero ffprobe exit shows the last line ffprobe wrote."""
+        mock_run.return_value = _completed(
+            1, "", b"ffprobe version 7\n\nbroken.mp4: moov atom not found\n"
         )
 
+        with pytest.raises(Exception) as exc:
+            command.run_ffprobe("broken.mp4")
+
+        assert str(exc.value) == (
+            "Failed to probe file: ffprobe couldn't read the file: "
+            "broken.mp4: moov atom not found"
+        )
+
+        mock_run.return_value = _completed(1, "", b"")
+        with pytest.raises(Exception) as exc:
+            command.run_ffprobe("broken.mp4")
+        assert str(exc.value).endswith("ffprobe couldn't read the file: exit 1")
+
+    @patch("shutil.which", return_value="/usr/bin/ffprobe")
+    @patch("subprocess.run")
+    def test_run_ffprobe_timeout_is_a_probe_failure(
+        self, mock_run, mock_which, command
+    ):
+        """An ffprobe that hangs past the timeout is reported, not waited on."""
+        import subprocess
+
+        mock_run.side_effect = subprocess.TimeoutExpired(["ffprobe"], 30)
+
+        with pytest.raises(Exception) as exc:
+            command.run_ffprobe("slow.mp4")
+
+        assert str(exc.value).startswith("Failed to probe file: ")
+        assert "timed out after 30 seconds" in str(exc.value)
+
     @patch("shutil.which", return_value="/usr/bin/ffprobe")
     @patch("subprocess.run")
     def test_run_ffprobe_custom_args(
         self, mock_run, mock_which, command, sample_probe_data
     ):
-        """Test running ffprobe with custom arguments."""
-        mock_result = Mock()
-        mock_result.returncode = 0
-        mock_result.stdout = json.dumps(sample_probe_data)
-        mock_run.return_value = mock_result
+        """Custom arguments go before the input, which keeps the file-only
+        whitelist, the timeout and the closed stdin."""
+        mock_run.return_value = _completed(0, json.dumps(sample_probe_data))
 
         result = command.run_ffprobe("test.mp3", "-show_streams -show_format")
 
@@ -145,23 +232,44 @@ def test_run_ffprobe_custom_args(
             "json",
             "-show_streams",
             "-show_format",
+            "-protocol_whitelist",
+            "file",
             "file:" + os.path.abspath("test.mp3"),
         ]
         mock_run.assert_called_once()
         assert mock_run.call_args[0][0] == expected_cmd
+        assert mock_run.call_args[1]["timeout"] == 30
+        assert mock_run.call_args[1]["stdin"] is subprocess.DEVNULL
+
+    @patch("shutil.which", return_value="/usr/bin/ffprobe")
+    @patch("subprocess.run")
+    def test_run_ffprobe_custom_args_cannot_widen_the_whitelist(
+        self, mock_run, mock_which, command, sample_probe_data
+    ):
+        """A user-supplied -protocol_whitelist comes before ours, so the
+        file-only one is the one that applies to the input."""
+        mock_run.return_value = _completed(0, json.dumps(sample_probe_data))
+
+        command.run_ffprobe("test.mp3", "-protocol_whitelist file,tcp")
+
+        assert mock_run.call_args[0][0][-3:] == [
+            "-protocol_whitelist",
+            "file",
+            "file:" + os.path.abspath("test.mp3"),
+        ]
 
     @patch("shutil.which", return_value="/usr/bin/ffprobe")
-    @patch("ffmpeg.probe")
+    @patch("subprocess.run")
     def test_option_like_file_name_is_probed_as_a_file(
-        self, mock_probe, mock_which, command, sample_probe_data, tmp_path, monkeypatch
+        self, mock_run, mock_which, command, sample_probe_data, tmp_path, monkeypatch
     ):
         """A file named "-f lavfi" is an input, not options."""
-        mock_probe.return_value = sample_probe_data
+        mock_run.return_value = _completed(0, json.dumps(sample_probe_data))
         monkeypatch.chdir(tmp_path)
 
         command.run_ffprobe("-f lavfi")
 
-        target = mock_probe.call_args.args[0]
+        target = mock_run.call_args[0][0][-1]
         assert target == f"file:{tmp_path}{os.sep}-f lavfi"
         assert not target.startswith("-")
 
@@ -171,7 +279,7 @@ def test_custom_args_are_split_like_a_shell(
         self, mock_run, mock_which, command, sample_probe_data
     ):
         """--ffprobe-args keeps a quoted value as one argument (shlex)."""
-        mock_run.return_value = Mock(returncode=0, stdout=json.dumps(sample_probe_data))
+        mock_run.return_value = _completed(0, json.dumps(sample_probe_data))
 
         command.run_ffprobe(
             "-f lavfi", "-show_entries 'format=duration,size' -select_streams a"
@@ -183,6 +291,8 @@ def test_custom_args_are_split_like_a_shell(
             "format=duration,size",
             "-select_streams",
             "a",
+            "-protocol_whitelist",
+            "file",
             "file:" + os.path.abspath("-f lavfi"),
         ]
 
@@ -235,10 +345,10 @@ def test_handle_ffmpeg_not_installed(
         assert result.ffmpeg_installed is False
 
     @patch("shutil.which")
-    @patch("ffmpeg.probe")
+    @patch("subprocess.run")
     def test_handle_success(
         self,
-        mock_probe,
+        mock_run,
         mock_which,
         command,
         mock_config,
@@ -248,7 +358,7 @@ def test_handle_success(
     ):
         """Test successful audio file analysis."""
         mock_which.return_value = "/usr/bin/ffprobe"
-        mock_probe.return_value = sample_probe_data
+        mock_run.return_value = _completed(0, json.dumps(sample_probe_data))
 
         result = command.handle(
             config=mock_config,
@@ -264,10 +374,10 @@ def test_handle_success(
         assert result.audio_info.format.filename == "test.mp3"
 
     @patch("shutil.which")
-    @patch("ffmpeg.probe")
+    @patch("subprocess.run")
     def test_handle_probe_error(
         self,
-        mock_probe,
+        mock_run,
         mock_which,
         command,
         mock_config,
@@ -276,7 +386,7 @@ def test_handle_probe_error(
     ):
         """Test handling ffprobe errors."""
         mock_which.return_value = "/usr/bin/ffprobe"
-        mock_probe.side_effect = Exception("Failed to probe file")
+        mock_run.return_value = _completed(1, "", b"Invalid data found")
 
         result = command.handle(
             config=mock_config,
@@ -382,9 +492,7 @@ def test_analysis_failure_panel_goes_to_stderr(
     def test_human_rendering_is_suppressed_for_machines(
         self, _ffmpeg, _format, command, mocks, probe_data, capsys
     ):
-        with patch.object(
-            AudioCommand, "run_ffprobe", return_value=probe_data
-        ):
+        with patch.object(AudioCommand, "run_ffprobe", return_value=probe_data):
             result = command.handle(*mocks, file="test.mp3")
         captured = capsys.readouterr()
 
@@ -392,16 +500,12 @@ def test_human_rendering_is_suppressed_for_machines(
         assert captured.out == ""
         assert "Analyzing audio file" in captured.err
 
-    @patch(
-        "deepctl_cmd_debug_audio.command.get_output_format", return_value="default"
-    )
+    @patch("deepctl_cmd_debug_audio.command.get_output_format", return_value="default")
     @patch.object(AudioCommand, "check_ffmpeg_installed", return_value=True)
     def test_human_rendering_still_prints_for_humans(
         self, _ffmpeg, _format, command, mocks, probe_data, capsys
     ):
-        with patch.object(
-            AudioCommand, "run_ffprobe", return_value=probe_data
-        ):
+        with patch.object(AudioCommand, "run_ffprobe", return_value=probe_data):
             command.handle(*mocks, file="test.mp3")
         captured = capsys.readouterr()
 
@@ -423,3 +527,81 @@ def test_ffprobe_never_from_current_directory(tmp_path, monkeypatch):
     assert command.check_ffmpeg_installed() is False
     with pytest.raises(Exception, match="ffprobe not found"):
         command.run_ffprobe("a.wav")
+
+
+# -- real ffprobe: the argv hardening holds against the binary itself -------
+
+_FFPROBE = shutil.which("ffprobe")
+needs_ffprobe = pytest.mark.skipif(_FFPROBE is None, reason="ffprobe not installed")
+
+
+def _write_wav(path) -> None:
+    import wave
+
+    with wave.open(str(path), "wb") as w:
+        w.setnchannels(1)
+        w.setsampwidth(2)
+        w.setframerate(16000)
+        w.writeframes(b"\x00\x00" * 1600)
+
+
+@pytest.fixture
+def real_command(monkeypatch):
+    """An AudioCommand that uses the real ffprobe on PATH."""
+    monkeypatch.setattr(command_module, "resolve_tool", lambda *a: _FFPROBE)
+    return AudioCommand()
+
+
+@needs_ffprobe
+class TestRealFfprobe:
+    def test_dash_named_file_is_probed_as_a_file(
+        self, real_command, tmp_path, monkeypatch
+    ):
+        monkeypatch.chdir(tmp_path)
+        _write_wav(tmp_path / "-v.wav")
+
+        for custom in (None, "-show_streams"):
+            data = real_command.run_ffprobe("-v.wav", custom)
+            assert data["streams"][0]["codec_name"] == "pcm_s16le"
+
+    def test_tcp_input_is_refused_without_connecting(self, real_command):
+        listener = socket.socket()
+        listener.bind(("127.0.0.1", 0))
+        listener.listen(1)
+        listener.settimeout(0.2)
+        port = listener.getsockname()[1]
+        accepted: list[object] = []
+        stop = threading.Event()
+
+        def accept() -> None:
+            while not stop.is_set():
+                try:
+                    accepted.append(listener.accept()[0])
+                except OSError:
+                    continue
+
+        thread = threading.Thread(target=accept, daemon=True)
+        thread.start()
+        try:
+            for custom in (None, "-show_streams", "-protocol_whitelist file,tcp"):
+                with pytest.raises(Exception, match="^Failed to probe file: "):
+                    real_command.run_ffprobe(f"tcp://127.0.0.1:{port}", custom)
+            time.sleep(0.3)
+        finally:
+            stop.set()
+            thread.join(2)
+            listener.close()
+        assert accepted == []
+
+    def test_concat_input_is_refused(self, real_command, tmp_path, monkeypatch):
+        monkeypatch.chdir(tmp_path)
+        _write_wav(tmp_path / "a.wav")
+
+        with pytest.raises(Exception, match="^Failed to probe file: "):
+            real_command.run_ffprobe("concat:a.wav|a.wav")
+
+    def test_pipe_input_returns_promptly(self, real_command):
+        start = time.monotonic()
+        with pytest.raises(Exception, match="^Failed to probe file: "):
+            real_command.run_ffprobe("pipe:0")
+        assert time.monotonic() - start < 5
diff --git a/packages/deepctl-cmd-debug-browser/README.md b/packages/deepctl-cmd-debug-browser/README.md
index 61b1710f..d31d5043 100644
--- a/packages/deepctl-cmd-debug-browser/README.md
+++ b/packages/deepctl-cmd-debug-browser/README.md
@@ -39,7 +39,7 @@ pipx run deepctl --help
 - `rich>=13.0.0,<16`
 - `pydantic>=2.0.0,<3`
 - `httpx>=0.24.0,<1`
-- `aiohttp>=3.9.0`
+- `websockets>=13.1,<18`
 
 ## License
 
diff --git a/packages/deepctl-cmd-debug-browser/pyproject.toml b/packages/deepctl-cmd-debug-browser/pyproject.toml
index 9be8c267..bef237b3 100644
--- a/packages/deepctl-cmd-debug-browser/pyproject.toml
+++ b/packages/deepctl-cmd-debug-browser/pyproject.toml
@@ -27,7 +27,7 @@ dependencies = [
     "rich>=13.0.0,<16",
     "pydantic>=2.0.0,<3",
     "httpx>=0.24.0,<1",
-    "aiohttp>=3.9.0",
+    "websockets>=13.1,<18",
 ]
 
 [project.optional-dependencies]
diff --git a/packages/deepctl-cmd-debug-browser/src/deepctl_cmd_debug_browser/command.py b/packages/deepctl-cmd-debug-browser/src/deepctl_cmd_debug_browser/command.py
index f765fa43..781382cd 100644
--- a/packages/deepctl-cmd-debug-browser/src/deepctl_cmd_debug_browser/command.py
+++ b/packages/deepctl-cmd-debug-browser/src/deepctl_cmd_debug_browser/command.py
@@ -2,17 +2,26 @@
 
 import importlib.resources
 import json
+import logging
+import re
 import socket
 import time
 import webbrowser
 from pathlib import Path
-from typing import Any
-
-from deepctl_core import AuthManager, BaseCommand, Config, DeepgramClient
-from rich.console import Console
+from typing import TYPE_CHECKING, Any
+from urllib.parse import parse_qs, urlsplit
+
+from deepctl_core import (
+    AuthManager,
+    BaseCommand,
+    Config,
+    DeepgramClient,
+    get_status_console,
+)
 from rich.panel import Panel
 from rich.progress import Progress, SpinnerColumn, TextColumn
 from rich.table import Table
+from rich.text import Text
 
 from .models import (
     BrowserCapabilities,
@@ -22,24 +31,111 @@
     WebSocketMessage,
 )
 
-console = Console()
+if TYPE_CHECKING:
+    from websockets.asyncio.server import Server, ServerConnection
+    from websockets.http11 import Request, Response
+
+# Everything this command prints is chrome, and the page link carries the
+# session token, so all of it goes to stderr: under -o json or yaml, stdout
+# holds only the result.
+console = get_status_console()
+
+PORT_RANGE = range(3000, 3100)
+MAX_FRAME_BYTES = 2**20
+# What the page can make this process keep: messages by count and by total
+# size, and capability names.
+MAX_MESSAGES = 1000
+MAX_MESSAGE_BYTES = 8 * 2**20  # counted as stored JSON
+MAX_MESSAGE_TEXT = 64 * 2**10  # a longer frame is dropped
+CAPABILITY_KEYS = (
+    "web_audio_api",
+    "audio_context",
+    "audio_worklet",
+    "websocket_api",
+    "fetch_api",
+    "es6_features",
+    "dom_apis",
+    "console_api",
+    "timer_apis",
+    "secure_context",
+    "microphone_access",
+    "websocket_deepgram",
+)
+_CONTROL = re.compile(r"[\x00-\x1f\x7f]")
+# The same fixed body for every 403: it echoes nothing from the request and
+# doesn't say which check failed.
+FORBIDDEN = "Forbidden. Open the exact link that dg debug browser printed.\n"
+LINK_NOTE = "It works only while this command runs."
+
+# The page and the WebSocket are only for the local browser this command
+# opens: loopback Host, the page's own Origin, and the session token.
+PAGE_HEADERS = (
+    ("Content-Type", "text/html; charset=utf-8"),
+    ("Cache-Control", "no-store"),
+    ("X-Content-Type-Options", "nosniff"),
+    ("X-Frame-Options", "DENY"),
+    ("Content-Security-Policy", "frame-ancestors 'none'"),
+    ("Referrer-Policy", "no-referrer"),
+)
+
+
+def _quiet_logger() -> logging.Logger:
+    """A logger for the server that never writes request headers anywhere,
+    whatever the root logger's level or handlers."""
+    logger = logging.getLogger("deepctl.debug.browser.server")
+    if not logger.handlers:
+        logger.addHandler(logging.NullHandler())
+    logger.propagate = False
+    logger.setLevel(logging.CRITICAL + 1)
+    return logger
+
+
+def _untrusted(text: str, style: str = "") -> Text:
+    """Text from the page for rich to print as it is: plain ASCII, control
+    characters and anything non-ASCII as backslash escapes, in a Text object
+    so neither markup nor :emoji: codes in it are interpreted."""
+    text = text.encode("ascii", "backslashreplace").decode("ascii")
+    return Text(_CONTROL.sub(lambda m: f"\\x{ord(m.group()):02x}", text), style=style)
 
 
-# aiohttp and asyncio (with ssl) load only when the servers start, so
-# `dg debug browser --help` doesn't import them (W3.2).
+def _count(n: int, one: str, many: str) -> str:
+    return f"{n} {one if n == 1 else many}"
+
+
+def _print_link(lead: str, url: str, note: str) -> None:
+    """The page link, whole on one line so it can be copied, then a dim note.
+    These lines are the only place the session token is shown (stderr)."""
+    console.print(f"\n{lead} [cyan]{url}[/cyan]", soft_wrap=True)
+    console.print(f"[dim]{note}[/dim]", soft_wrap=True)
+
+
+def _respond(
+    connection: "ServerConnection",
+    status: int,
+    text: str,
+    headers: tuple[tuple[str, str], ...] = (),
+) -> "Response":
+    """A complete response that ends the connection.
+
+    connection.respond() also marks the handshake as refused, so websockets
+    never runs the WebSocket handler for it (13.x would for a hand-built
+    Response).
+    """
+    response = connection.respond(status, text)
+    if headers:
+        del response.headers["Content-Type"]
+        for name, value in headers:
+            response.headers[name] = value
+    return response
+
+
+# asyncio (with ssl) loads only when the server starts, so
+# `dg debug browser --help` doesn't import it.
 def __getattr__(name: str) -> Any:
     if name == "asyncio":
         import asyncio
 
         return asyncio
-    if name == "web":
-        from aiohttp import web
-
-        return web
-    if name == "WSMsgType":
-        from aiohttp import WSMsgType
-
-        return WSMsgType
     raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
 
 
@@ -72,6 +168,12 @@ def __init__(self) -> None:
         self.ws_clients: set[Any] = set()
         self.debug_complete = False
         self.start_time: float | None = None
+        self._token = ""
+        self._server: Server | None = None
+        self.browser_opened = False
+        self._stored_bytes = 0
+        self.dropped_messages = 0
+        self.dropped_capabilities = 0
 
     def get_arguments(self) -> list[dict[str, Any]]:
         """Get command arguments and options."""
@@ -111,119 +213,198 @@ def get_arguments(self) -> list[dict[str, Any]]:
     def find_available_port(self, start_port: int = 3000) -> int:
         """Find an available port starting from the given port."""
         for port in range(start_port, start_port + 100):
-            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-            try:
-                sock.bind(("localhost", port))
-                sock.close()
+            with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+                try:
+                    sock.bind(("127.0.0.1", port))
+                except OSError:
+                    continue
                 return port
-            except OSError:
-                continue
         raise RuntimeError(f"Could not find available port starting from {start_port}")
 
-    async def websocket_handler(self, request: Any) -> Any:
-        """Handle WebSocket connections from the browser."""
-        from aiohttp import WSMsgType, web
+    @staticmethod
+    def _allowed(values: list[str], form: str, port: int) -> bool:
+        """True if there is one value, and it is `form` for 127.0.0.1 or
+        localhost on `port` (case-insensitive; on port 80 without the port,
+        as browsers send it)."""
+        forms = [form]
+        if port == 80:
+            forms.append(form.replace(":{port}", ""))
+        return len(values) == 1 and values[0].lower() in {
+            f.format(host=host, port=port)
+            for f in forms
+            for host in ("127.0.0.1", "localhost")
+        }
 
-        ws = web.WebSocketResponse()
-        await ws.prepare(request)
-        self.ws_clients.add(ws)
+    def _token_ok(self, target: str) -> bool:
+        import hmac
+
+        tokens = parse_qs(urlsplit(target).query).get("t", [])
+        return len(tokens) == 1 and hmac.compare_digest(
+            tokens[0].encode("utf-8", "surrogateescape"),
+            self._token.encode(),
+        )
 
+    def _process_request(
+        self, connection: "ServerConnection", request: "Request"
+    ) -> "Response | None":
+        """Serve the page, refuse, or let a /ws upgrade through.
+
+        Runs before any WebSocket handshake. Rejections are fixed text and
+        never echo the Host, Origin or token back.
+        """
+        # websockets < 17 closes the connection on other methods itself,
+        # without a response.
+        if getattr(request, "method", "GET") != "GET":
+            return _respond(connection, 405, "Method not allowed.\n")
+        port = connection.local_address[1]
+        if not self._allowed(request.headers.get_all("Host"), "{host}:{port}", port):
+            return _respond(connection, 403, FORBIDDEN)
+        path = urlsplit(request.path).path
+        if path not in ("/", "/ws"):
+            return _respond(connection, 404, "Not found.\n")
+        if not self._token_ok(request.path):
+            return _respond(connection, 403, FORBIDDEN)
+        if path == "/":
+            return _respond(connection, 200, self._page(), PAGE_HEADERS)
+        origins = request.headers.get_all("Origin")
+        if not self._allowed(origins, "http://{host}:{port}", port):
+            return _respond(connection, 403, FORBIDDEN)
+        return None
+
+    @staticmethod
+    def _page() -> str:
+        """The debug page, read from the package."""
         try:
-            async for msg in ws:
-                if msg.type == WSMsgType.TEXT:
-                    data = json.loads(msg.data)
-                    ws_msg = WebSocketMessage(
-                        type=MessageType(data.get("type", "info")),
-                        data=data.get("data", {}),
-                        message=data.get("message"),
-                    )
-                    self.messages.append(ws_msg)
-
-                    # Handle different message types
-                    if ws_msg.type == MessageType.CAPABILITY_CHECK:
-                        cap_data = ws_msg.data.get("result", {})
-                        cap_key = ws_msg.data.get("capability")
-                        if cap_key and cap_data:
-                            self.capabilities_data[cap_key] = BrowserCapability(
-                                **cap_data
-                            )
-
-                    elif ws_msg.type == MessageType.COMPLETE:
-                        # Store complete capabilities
-                        if "capabilities" in ws_msg.data:
-                            caps = ws_msg.data["capabilities"]
-                            # Convert all capability data
-                            cap_dict = {}
-                            for key in [
-                                "web_audio_api",
-                                "audio_context",
-                                "audio_worklet",
-                                "websocket_api",
-                                "fetch_api",
-                                "es6_features",
-                                "dom_apis",
-                                "console_api",
-                                "timer_apis",
-                                "secure_context",
-                                "microphone_access",
-                                "websocket_deepgram",
-                            ]:
-                                if key in caps:
-                                    cap_dict[key] = BrowserCapability(**caps[key])
-                                elif key in self.capabilities_data:
-                                    cap_dict[key] = self.capabilities_data[key]
-
-                            # Store complete capabilities
-                            self.capabilities_data = {
-                                **cap_dict,
-                                "user_agent": caps.get("user_agent", "Unknown"),
-                                "overall_compatible": caps.get(
-                                    "overall_compatible", False
-                                ),
-                            }
-                        self.debug_complete = True
-                elif msg.type == WSMsgType.ERROR:
-                    console.print(f"[red]WebSocket error: {ws.exception()}[/red]")
+            files = importlib.resources.files("deepctl_cmd_debug_browser")
+            html_content = (files / "static" / "debug.html").read_text()
+        except Exception:
+            # Fallback to Path-based approach
+            html_path = Path(__file__).parent / "static" / "debug.html"
+            html_content = html_path.read_text()
+        return html_content
+
+    def _handle_text(self, text: str) -> None:
+        """Record one message from the page.
+
+        Raises ValueError, TypeError or AttributeError for a frame that isn't
+        a valid message; nothing is recorded then.
+        """
+        if len(text) > MAX_MESSAGE_TEXT:
+            self.dropped_messages += 1
+            return
+        data = json.loads(text)
+        ws_msg = WebSocketMessage(
+            type=MessageType(data.get("type", "info")),
+            data=data.get("data", {}),
+            message=data.get("message"),
+        )
+        capabilities = self.capabilities_data
+
+        # Handle different message types
+        if ws_msg.type == MessageType.CAPABILITY_CHECK:
+            cap_data = ws_msg.data.get("result", {})
+            cap_key = ws_msg.data.get("capability")
+            if cap_key and cap_key not in CAPABILITY_KEYS:
+                self.dropped_capabilities += 1
+            elif cap_key and cap_data:
+                capabilities = {
+                    **capabilities,
+                    cap_key: BrowserCapability(**cap_data),
+                }
+
+        elif ws_msg.type == MessageType.COMPLETE:
+            # Store complete capabilities
+            if "capabilities" in ws_msg.data:
+                caps = ws_msg.data["capabilities"]
+                # Convert all capability data
+                cap_dict = {}
+                for key in CAPABILITY_KEYS:
+                    if key in caps:
+                        cap_dict[key] = BrowserCapability(**caps[key])
+                    elif key in self.capabilities_data:
+                        cap_dict[key] = self.capabilities_data[key]
+
+                # Store complete capabilities
+                capabilities = {
+                    **cap_dict,
+                    "user_agent": caps.get("user_agent", "Unknown"),
+                    "overall_compatible": caps.get("overall_compatible", False),
+                }
+
+        size = len(ws_msg.model_dump_json())
+        if (
+            len(self.messages) < MAX_MESSAGES
+            and self._stored_bytes + size <= MAX_MESSAGE_BYTES
+        ):
+            self.messages.append(ws_msg)
+            self._stored_bytes += size
+        else:
+            self.dropped_messages += 1
+        self.capabilities_data = capabilities
+        if ws_msg.type == MessageType.COMPLETE:
+            self.debug_complete = True
+
+    async def websocket_handler(self, ws: "ServerConnection") -> None:
+        """Handle WebSocket connections from the browser.
+
+        Text frames carry JSON messages; a frame that isn't a valid message
+        is dropped and the connection stays open. Binary frames are ignored.
+        """
+        from websockets.exceptions import ConnectionClosed
+
+        self.ws_clients.add(ws)
+        try:
+            async for frame in ws:
+                if isinstance(frame, str):
+                    try:
+                        self._handle_text(frame)
+                    except (ValueError, TypeError, AttributeError):
+                        continue
+        except ConnectionClosed:
+            pass
         finally:
             self.ws_clients.discard(ws)
-            await ws.close()
 
-        return ws
+    async def _start_server(self, port: int | None) -> int:
+        """Listen on 127.0.0.1 and return the port.
 
-    async def http_handler(self, request: Any) -> Any:
-        """Serve the debug HTML page."""
-        from aiohttp import web
+        A given port is tried once and an OSError propagates (0 picks any
+        free port). Otherwise the first port in 3000-3099 that binds is used.
+        """
+        from websockets.asyncio.server import serve
 
-        if request.path == "/":
-            # Read the HTML template from the static directory
+        for candidate in PORT_RANGE if port is None else [port]:
             try:
-                files = importlib.resources.files("deepctl_cmd_debug_browser")
-                html_content = (files / "static" / "debug.html").read_text()
-            except Exception:
-                # Fallback to Path-based approach
-                html_path = Path(__file__).parent / "static" / "debug.html"
-                html_content = html_path.read_text()
+                self._server = await serve(
+                    self.websocket_handler,
+                    "127.0.0.1",
+                    candidate,
+                    process_request=self._process_request,
+                    max_size=MAX_FRAME_BYTES,
+                    ping_interval=None,
+                    server_header=None,
+                    logger=_quiet_logger(),
+                )
+            except OSError:
+                if port is not None:
+                    raise
+                continue
+            bound: int = next(iter(self._server.sockets)).getsockname()[1]
+            return bound
+        raise RuntimeError(
+            f"Could not find available port starting from {PORT_RANGE.start}"
+        )
 
-            return web.Response(text=html_content, content_type="text/html")
-        return web.Response(status=404)
+    async def _stop_server(self) -> None:
+        if self._server is not None:
+            self._server.close()
+            await self._server.wait_closed()
+            self._server = None
 
     async def run_servers(self, port: int, timeout: int) -> dict[str, Any]:
-        """Run both HTTP and WebSocket servers."""
+        """Wait for the page to finish its checks, or for the timeout."""
         import asyncio
 
-        from aiohttp import web
-
-        # Create aiohttp app
-        app = web.Application()
-        app.router.add_get("/", self.http_handler)
-        app.router.add_get("/ws", self.websocket_handler)
-
-        # Start HTTP server (which also handles WebSocket)
-        runner = web.AppRunner(app)
-        await runner.setup()
-        site = web.TCPSite(runner, "localhost", port)
-        await site.start()
-
         console.print(
             f"\n[green]✓[/green] Debug server started on port [cyan]{port}[/cyan]"
         )
@@ -233,9 +414,6 @@ async def run_servers(self, port: int, timeout: int) -> dict[str, Any]:
         while not self.debug_complete and (time.time() - start_time) < timeout:
             await asyncio.sleep(0.1)
 
-        # Cleanup
-        await runner.cleanup()
-
         return {
             "completed": self.debug_complete,
             "timed_out": not self.debug_complete
@@ -274,7 +452,7 @@ def display_results(
                     log_table.add_row(
                         time_str,
                         f"[{type_style}]{msg.type.value}[/{type_style}]",
-                        msg.message or "",
+                        _untrusted(msg.message or ""),
                     )
 
             console.print(log_table)
@@ -314,14 +492,21 @@ def display_results(
                     status_color = "green" if cap.supported else "red"
                     cap_table.add_row(
                         display_name,
-                        f"[{status_color}]{status_icon} {cap.details}[/{status_color}]",
-                        cap.version or "",
+                        Text.assemble(
+                            f"{status_icon} ",
+                            _untrusted(str(cap.details)),
+                            style=status_color,
+                        ),
+                        _untrusted(cap.version or ""),
                     )
 
             console.print(cap_table)
 
             # Overall compatibility
-            console.print(f"\n[bold]User Agent:[/bold] {capabilities.user_agent}")
+            console.print(
+                Text("\nUser Agent:", style="bold"),
+                _untrusted(capabilities.user_agent),
+            )
             if capabilities.overall_compatible:
                 console.print(
                     "[bold green]✓ Browser is fully compatible with "
@@ -358,6 +543,7 @@ def handle(
     ) -> Any:
         """Handle browser debug command execution."""
         import asyncio
+        import secrets
 
         port = kwargs.get("port")
         no_browser = kwargs.get("no_browser", False)
@@ -365,10 +551,7 @@ def handle(
         save_report = kwargs.get("save_report")
 
         self.start_time = time.time()
-
-        # Find available port
-        if not port:
-            port = self.find_available_port()
+        self._token = secrets.token_urlsafe(16)
 
         # Show initial message
         console.print(
@@ -380,7 +563,23 @@ def handle(
             )
         )
 
-        url = f"http://localhost:{port}"
+        # Listen first, so the URL shown is the one that is being served.
+        loop = asyncio.new_event_loop()
+        asyncio.set_event_loop(loop)
+        try:
+            port = loop.run_until_complete(self._start_server(port or None))
+            result = self._serve(loop, port, timeout, no_browser)
+        finally:
+            loop.run_until_complete(self._stop_server())
+            loop.close()
+
+        return self._finish(port, timeout, save_report, result)
+
+    def _serve(
+        self, loop: Any, port: int, timeout: int, no_browser: bool
+    ) -> dict[str, Any]:
+        """Point the browser at the page, then wait for its checks."""
+        url = f"http://127.0.0.1:{port}/?t={self._token}"
 
         # Prompt user to open browser
         if not no_browser:
@@ -389,18 +588,18 @@ def handle(
                     "\n[yellow]Press Enter to open the debugger in your browser...[/yellow]"
                 )
                 input()
-            else:
-                console.print(
-                    f"\n[dim]Opening [cyan]{url}[/cyan] in your browser...[/dim]"
-                )
+            _print_link(
+                "Opening the debugger in your browser:",
+                url,
+                f"If it doesn't open, paste the link into your browser. {LINK_NOTE}",
+            )
             webbrowser.open(url)
-            browser_opened = True
+            self.browser_opened = True
         else:
-            console.print(
-                f"\n[dim]Open [cyan]{url}[/cyan] in your browser to start "
-                f"debugging[/dim]"
+            _print_link(
+                "Open this link in your browser to start debugging:", url, LINK_NOTE
             )
-            browser_opened = False
+            self.browser_opened = False
 
         # Run the async event loop
         with Progress(
@@ -410,18 +609,20 @@ def handle(
             transient=True,
         ) as progress:
             task = progress.add_task("Waiting for browser connection...", total=None)
-
-            # Run servers
-            loop = asyncio.new_event_loop()
-            asyncio.set_event_loop(loop)
-
-            try:
-                result = loop.run_until_complete(self.run_servers(port, timeout))
-            finally:
-                loop.close()
-
+            result: dict[str, Any] = loop.run_until_complete(
+                self.run_servers(port, timeout)
+            )
             progress.update(task, completed=True)
+        return result
 
+    def _finish(
+        self,
+        port: int,
+        timeout: int,
+        save_report: str | None,
+        result: dict[str, Any],
+    ) -> BrowserDebugResult:
+        """Show the results and build the command result."""
         # Process results
         capabilities = None
         if self.capabilities_data and "overall_compatible" in self.capabilities_data:
@@ -462,6 +663,22 @@ def handle(
             console.print("[dim]No browser connection was established.[/dim]")
         else:
             console.print("\n[yellow]Debug session ended[/yellow]")
+        left_out = []
+        if self.dropped_messages:
+            left_out.append(
+                _count(self.dropped_messages, "message", "messages")
+                + " over the size limit"
+            )
+        if self.dropped_capabilities:
+            left_out.append(
+                _count(
+                    self.dropped_capabilities,
+                    "unknown capability name",
+                    "unknown capability names",
+                )
+            )
+        if left_out:
+            console.print(f"[dim]Left out of the results: {', '.join(left_out)}[/dim]")
 
         # Build result
         errors = [
@@ -483,7 +700,7 @@ def handle(
             errors=errors,
             warnings=warnings,
             duration_seconds=result["duration"],
-            browser_opened=browser_opened,
+            browser_opened=self.browser_opened,
         )
 
         # Save report if requested
diff --git a/packages/deepctl-cmd-debug-browser/src/deepctl_cmd_debug_browser/static/debug.html b/packages/deepctl-cmd-debug-browser/src/deepctl_cmd_debug_browser/static/debug.html
index b5bf50f0..12b7ece1 100644
--- a/packages/deepctl-cmd-debug-browser/src/deepctl_cmd_debug_browser/static/debug.html
+++ b/packages/deepctl-cmd-debug-browser/src/deepctl_cmd_debug_browser/static/debug.html
@@ -232,8 +232,8 @@ <h2>Debug Complete!</h2>
     </div>
 
     <script>
-        const WS_PORT = window.location.port;
-        const WS_URL = `ws://localhost:${WS_PORT}/ws`;
+        const WS_TOKEN = new URLSearchParams(window.location.search).get('t') || '';
+        const WS_URL = `ws://${window.location.host}/ws?t=${encodeURIComponent(WS_TOKEN)}`;
 
         let ws = null;
         let checkResults = {};
diff --git a/packages/deepctl-cmd-debug-browser/tests/unit/test_browser_command.py b/packages/deepctl-cmd-debug-browser/tests/unit/test_browser_command.py
index 986f41f7..c27822e2 100644
--- a/packages/deepctl-cmd-debug-browser/tests/unit/test_browser_command.py
+++ b/packages/deepctl-cmd-debug-browser/tests/unit/test_browser_command.py
@@ -1,10 +1,95 @@
 """Unit tests for browser debug command."""
 
-from unittest.mock import AsyncMock, MagicMock, Mock, patch
+import asyncio
+import json
+import logging
+import socket
+import threading
+from typing import Any
+from unittest.mock import AsyncMock, Mock, patch
+from urllib.parse import parse_qs, urlsplit
 
 import pytest
-from aiohttp import WSMsgType
 from deepctl_cmd_debug_browser import BrowserCommand, BrowserDebugResult
+from deepctl_cmd_debug_browser.command import (
+    CAPABILITY_KEYS,
+    FORBIDDEN,
+    MAX_MESSAGE_BYTES,
+    MAX_MESSAGE_TEXT,
+    MAX_MESSAGES,
+    PAGE_HEADERS,
+)
+
+
+def _free_port() -> int:
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return int(s.getsockname()[1])
+
+
+async def _raw(port: int, request: str) -> tuple[int, dict[str, str], bytes]:
+    """Send one raw HTTP request; return status, headers and body.
+
+    Status 0 means the server closed the connection without a response.
+    """
+    reader, writer = await asyncio.open_connection("127.0.0.1", port)
+    writer.write(request.encode("latin-1"))
+    await writer.drain()
+    data = await asyncio.wait_for(reader.read(), 10)
+    writer.close()
+    if not data:
+        return 0, {}, b""
+    head, _, body = data.partition(b"\r\n\r\n")
+    lines = head.decode("latin-1").split("\r\n")
+    headers = {}
+    for line in lines[1:]:
+        name, _, value = line.partition(":")
+        headers[name.strip().lower()] = value.strip()
+    return int(lines[0].split()[1]), headers, body
+
+
+def _get(path: str, port: int, host: str | None = None, **extra: str) -> str:
+    lines = [f"GET {path} HTTP/1.1", f"Host: {host or f'127.0.0.1:{port}'}"]
+    lines += [f"{k.replace('_', '-')}: {v}" for k, v in extra.items()]
+    return "\r\n".join(lines) + "\r\n\r\n"
+
+
+def _upgrade(path: str, port: int, host: str | None = None, **extra: str) -> str:
+    return _get(
+        path,
+        port,
+        host,
+        Upgrade="websocket",
+        Connection="Upgrade",
+        Sec_WebSocket_Key="dGhlIHNhbXBsZSBub25jZQ==",
+        Sec_WebSocket_Version="13",
+        **extra,
+    )
+
+
+class _CountingCommand(BrowserCommand):
+    """Counts WebSocket handler runs (a refused request must not start one)."""
+
+    handler_runs = 0
+
+    async def websocket_handler(self, ws):  # type: ignore[no-untyped-def]
+        self.handler_runs += 1
+        await super().websocket_handler(ws)
+
+
+class _Server:
+    """A real BrowserCommand server on a free loopback port."""
+
+    def __init__(self) -> None:
+        self.cmd = _CountingCommand()
+        self.cmd._token = "tok-123"
+
+    async def __aenter__(self) -> "_Server":
+        self.port = await self.cmd._start_server(0)
+        return self
+
+    async def __aexit__(self, *exc: object) -> None:
+        await self.cmd._stop_server()
 
 
 class TestBrowserCommand:
@@ -106,17 +191,23 @@ def test_handle_with_browser(self, mock_input, mock_browser_open):
                 timeout=60,
             )
 
-        # Verify browser was opened
+        # Verify browser was opened, on the loopback URL with the token
         mock_browser_open.assert_called_once()
+        url = urlsplit(mock_browser_open.call_args[0][0])
+        assert url.hostname == "127.0.0.1"
+        assert 3000 <= url.port < 3100
+        assert parse_qs(url.query)["t"] == [cmd._token]
 
         # Verify result
         assert isinstance(result, BrowserDebugResult)
         assert result.status == "success"
         assert result.browser_opened is True
+        assert result.port == url.port
 
     def test_handle_no_browser(self):
         """Test command execution without opening browser."""
         cmd = BrowserCommand()
+        port = _free_port()
 
         # Mock the async run_servers method
         with patch.object(
@@ -132,7 +223,7 @@ def test_handle_no_browser(self):
                 config=Mock(),
                 auth_manager=Mock(),
                 client=Mock(),
-                port=3005,
+                port=port,
                 no_browser=True,
                 timeout=60,
             )
@@ -141,43 +232,389 @@ def test_handle_no_browser(self):
         assert isinstance(result, BrowserDebugResult)
         assert result.status == "timeout"
         assert result.browser_opened is False
-        assert result.port == 3005
+        assert result.port == port
+
+    def test_given_port_in_use_raises(self):
+        """A --port that is taken fails, as it did before (no fallback)."""
+        cmd = BrowserCommand()
+        with socket.socket() as busy:
+            busy.bind(("127.0.0.1", 0))
+            busy.listen()
+            port = busy.getsockname()[1]
+            try:
+                cmd.handle(
+                    config=Mock(),
+                    auth_manager=Mock(),
+                    client=Mock(),
+                    port=port,
+                    no_browser=True,
+                    timeout=0,
+                )
+            except OSError:
+                pass
+            else:  # pragma: no cover
+                raise AssertionError("expected OSError")
+
+    def test_websocket_handler(self):
+        """Messages from the page are recorded; bad frames are dropped and
+        the connection stays open."""
+        from websockets.asyncio.client import connect
+
+        async def main() -> BrowserCommand:
+            async with _Server() as srv:
+                url = f"ws://127.0.0.1:{srv.port}/ws?t=tok-123"
+                origin = f"http://127.0.0.1:{srv.port}"
+                async with connect(url, origin=origin) as ws:
+                    await ws.send(
+                        json.dumps(
+                            {"type": "info", "message": "Test message", "data": {}}
+                        )
+                    )
+                    await ws.send("not json")
+                    await ws.send(json.dumps({"type": "nope", "data": {}}))
+                    await ws.send(json.dumps([1, 2]))
+                    await ws.send(b"\x00\x01")
+                    await ws.send(
+                        json.dumps(
+                            {
+                                "type": "capability_check",
+                                "data": {"capability": "web_audio_api", "result": "x"},
+                            }
+                        )
+                    )
+                    await ws.send(
+                        '{"type": "capability_check", "data": {"capability": '
+                        '"web_audio_api", "result": {"name": "Web Audio API", '
+                        '"supported": true, "details": "Supported", "required": true}}}'
+                    )
+                    await ws.send(json.dumps({"type": "complete", "data": {}}))
+                    for _ in range(100):
+                        if srv.cmd.debug_complete:
+                            break
+                        await asyncio.sleep(0.02)
+                    await ws.ping()  # still open after the bad frames
+                return srv.cmd
+
+        cmd = asyncio.run(main())
+        assert [m.type.value for m in cmd.messages] == [
+            "info",
+            "capability_check",
+            "complete",
+        ]
+        assert cmd.messages[0].message == "Test message"
+        assert cmd.capabilities_data["web_audio_api"].supported is True
+        assert cmd.debug_complete is True
+        assert cmd.ws_clients == set()
 
-    @pytest.mark.asyncio
-    async def test_websocket_handler(self):
-        """Test WebSocket message handling."""
+    def test_messages_are_capped(self):
         cmd = BrowserCommand()
+        for _ in range(MAX_MESSAGES + 5):
+            cmd._handle_text('{"type": "info", "message": "m", "data": {}}')
+        cmd._handle_text('{"type": "complete", "data": {}}')
+        assert len(cmd.messages) == MAX_MESSAGES
+        assert cmd.debug_complete is True
 
-        # Create mock messages
-        mock_msg1 = Mock()
-        mock_msg1.type = WSMsgType.TEXT
-        mock_msg1.data = (
-            '{"type": "info", "message": "Test message", "data": {}}'
+    def test_stored_messages_are_capped_by_size(self):
+        cmd = BrowserCommand()
+        too_long = json.dumps(
+            {"type": "info", "message": "m" * MAX_MESSAGE_TEXT, "data": {}}
         )
+        cmd._handle_text(too_long)
+        assert cmd.messages == []
+        assert cmd.dropped_messages == 1
+        # object-heavy frames are counted by what is stored, not by input size
+        heavy = json.dumps(
+            {"type": "info", "message": "m", "data": {"a": [{}] * 10000}}
+        )
+        for _ in range(400):
+            cmd._handle_text(heavy)
+        assert cmd._stored_bytes <= MAX_MESSAGE_BYTES
+        assert 0 < len(cmd.messages) < 400
+        assert cmd.dropped_messages == 1 + 400 - len(cmd.messages)
 
-        mock_msg2 = Mock()
-        mock_msg2.type = WSMsgType.TEXT
-        mock_msg2.data = '{"type": "capability_check", "data": {"capability": "web_audio_api", "result": {"name": "Web Audio API", "supported": true, "details": "Supported", "required": true}}}'
+    def test_only_known_capability_names_are_kept(self):
+        cmd = BrowserCommand()
+        result = {"name": "x", "supported": True}
+        for name in [f"cap{i}" for i in range(300)] + list(CAPABILITY_KEYS):
+            cmd._handle_text(
+                json.dumps(
+                    {
+                        "type": "capability_check",
+                        "data": {"capability": name, "result": result},
+                    }
+                )
+            )
+        assert set(cmd.capabilities_data) == set(CAPABILITY_KEYS)
+        assert cmd.dropped_capabilities == 300
 
-        # Mock WebSocketResponse
-        mock_ws = AsyncMock()
-        mock_ws.prepare = AsyncMock()
-        mock_ws.close = AsyncMock()
-        mock_ws.__aiter__.return_value = [mock_msg1, mock_msg2]
+    def test_find_available_port_closes_sockets(self):
+        import gc
+        import warnings
 
-        # Mock request
-        mock_request = Mock()
+        cmd = BrowserCommand()
+        # Only this call's sockets count: collect what earlier tests left.
+        gc.collect()
+        with socket.socket() as busy:
+            busy.bind(("127.0.0.1", 0))
+            taken = busy.getsockname()[1]
+            with warnings.catch_warnings(record=True) as caught:
+                warnings.simplefilter("always")
+                assert cmd.find_available_port(taken) != taken
+                gc.collect()
+        assert not [w for w in caught if issubclass(w.category, ResourceWarning)]
+
+    def test_page_text_is_printed_as_plain_ascii(self):
+        import io
+
+        from deepctl_cmd_debug_browser import command as cmdmod
+        from deepctl_cmd_debug_browser.models import (
+            BrowserCapabilities,
+            BrowserCapability,
+            MessageType,
+            WebSocketMessage,
+        )
+        from rich.console import Console
 
-        # Patch WebSocketResponse creation
-        with patch("aiohttp.web.WebSocketResponse", return_value=mock_ws):
-            result = await cmd.websocket_handler(mock_request)
+        out = io.StringIO()
+        with patch.object(
+            cmdmod, "console", Console(file=out, width=300, force_terminal=False)
+        ):
+            BrowserCommand().display_results(
+                None,
+                [
+                    WebSocketMessage(
+                        type=MessageType.INFO,
+                        data={},
+                        message="[bold]x\x1b[2J\u00e9 :smile: y\\\\\\",
+                    )
+                ],
+            )
+            BrowserCommand().display_results(
+                BrowserCapabilities(
+                    **{
+                        key: BrowserCapability(
+                            name=key, supported=True, details="d\\\\\\ :smile:"
+                        )
+                        for key in CAPABILITY_KEYS
+                    },
+                    user_agent="[bold]UA :smile:",
+                    overall_compatible=True,
+                ),
+                [],
+            )
+        text = out.getvalue()
+        assert "[bold]x\\x1b[2J\\xe9 :smile: y\\\\\\" in text
+        assert "d\\\\\\ :smile:" in text
+        assert "User Agent: [bold]UA :smile:" in text
+        assert "[/" not in text
+
+
+class TestBrowserSecurity:
+    """The local server only talks to the page this command opened."""
+
+    @pytest.mark.parametrize(
+        ("port", "host", "origin", "allowed"),
+        [
+            (80, "127.0.0.1", "http://127.0.0.1", True),
+            (80, "localhost", "http://localhost", True),
+            (80, "127.0.0.1:80", "http://127.0.0.1:80", True),
+            (80, "evil.example", "http://127.0.0.1", False),
+            (80, "127.0.0.1", "http://evil.example", False),
+            (3000, "127.0.0.1", "http://127.0.0.1:3000", False),
+            (3000, "127.0.0.1:3000", "http://127.0.0.1", False),
+        ],
+    )
+    def test_bare_host_and_origin_only_on_port_80(self, port, host, origin, allowed):
+        """Browsers leave the default port out of Host and Origin."""
+        from websockets.datastructures import Headers
+        from websockets.http11 import Request
+
+        class Conn:
+            local_address = ("127.0.0.1", port)
+
+            def respond(self, status: int, text: str) -> Any:
+                return Mock(status_code=status, headers=Headers())
 
-        # Check messages were processed
-        assert len(cmd.messages) == 2
-        assert cmd.messages[0].type.value == "info"
-        assert cmd.messages[0].message == "Test message"
-        assert "web_audio_api" in cmd.capabilities_data
-        assert result == mock_ws
+        cmd = BrowserCommand()
+        cmd._token = "tok-123"
+        request = Request(
+            "/ws?t=tok-123",
+            Headers([("Host", host), ("Upgrade", "websocket"), ("Origin", origin)]),
+        )
+        result = cmd._process_request(Conn(), request)  # type: ignore[arg-type]
+        assert (result is None) is allowed
+
+    def test_listens_on_ipv4_loopback_only(self):
+        async def main() -> list[tuple[int, str]]:
+            async with _Server() as srv:
+                return [
+                    (s.family, s.getsockname()[0])
+                    for s in srv.cmd._server.sockets  # type: ignore[union-attr]
+                ]
+
+        assert asyncio.run(main()) == [(socket.AF_INET, "127.0.0.1")]
+
+    def test_page_with_token(self):
+        async def main() -> tuple[int, dict[str, str], bytes]:
+            async with _Server() as srv:
+                page = await _raw(srv.port, _get("/?t=tok-123", srv.port))
+                await asyncio.sleep(0.1)
+                assert srv.cmd.handler_runs == 0
+                return page
+
+        status, headers, body = asyncio.run(main())
+        assert status == 200
+        for name, value in PAGE_HEADERS:
+            assert headers[name.lower()] == value
+        assert "server" not in headers
+        assert b"WS_URL" in body
+        assert "location.host" in body.decode()
+
+    def test_localhost_host_is_accepted(self):
+        async def main() -> int:
+            async with _Server() as srv:
+                req = _get("/?t=tok-123", srv.port, host=f"LOCALHOST:{srv.port}")
+                return (await _raw(srv.port, req))[0]
+
+        assert asyncio.run(main()) == 200
+
+    def test_refusals_are_fixed_text(self):
+        async def main() -> dict[str, tuple[int, bytes]]:
+            out = {}
+            async with _Server() as srv:
+                p = srv.port
+                origin = f"http://127.0.0.1:{p}"
+                cases = {
+                    "page-no-token": _get("/", p),
+                    "page-bad-token": _get("/?t=evil-token", p),
+                    "page-two-tokens": _get("/?t=tok-123&t=tok-123", p),
+                    "page-evil-host": _get("/?t=tok-123", p, host=f"evil.example:{p}"),
+                    "page-wrong-port": _get("/?t=tok-123", p, host="127.0.0.1:1"),
+                    "ws-no-token": _upgrade("/ws", p, Origin=origin),
+                    "ws-bad-token": _upgrade("/ws?t=evil-token", p, Origin=origin),
+                    "ws-evil-host": _upgrade(
+                        "/ws?t=tok-123", p, host=f"evil.example:{p}", Origin=origin
+                    ),
+                    "ws-no-origin": _upgrade("/ws?t=tok-123", p),
+                    "ws-evil-origin": _upgrade(
+                        "/ws?t=tok-123", p, Origin="http://evil.example"
+                    ),
+                    "ws-null-origin": _upgrade("/ws?t=tok-123", p, Origin="null"),
+                    "ws-other-port": _upgrade(
+                        "/ws?t=tok-123", p, Origin="http://127.0.0.1:1"
+                    ),
+                }
+                for name, req in cases.items():
+                    status, _, body = await _raw(p, req)
+                    out[name] = (status, body)
+                await asyncio.sleep(0.1)
+                assert srv.cmd.handler_runs == 0
+            return out
+
+        for name, (status, body) in asyncio.run(main()).items():
+            assert (status, body) == (403, FORBIDDEN.encode()), name
+        assert FORBIDDEN == (
+            "Forbidden. Open the exact link that dg debug browser printed.\n"
+        )
+
+    def test_valid_upgrade_gets_101(self):
+        async def main() -> list[int]:
+            async with _Server() as srv:
+                p = srv.port
+                return [
+                    (await _raw_status_only(p, _upgrade("/ws?t=tok-123", p, Origin=o)))
+                    for o in (f"http://127.0.0.1:{p}", f"http://localhost:{p}")
+                ]
+
+        assert asyncio.run(main()) == [101, 101]
+
+    def test_unknown_path_and_methods(self, caplog):
+        caplog.set_level(logging.DEBUG)
+
+        async def main() -> list[int]:
+            async with _Server() as srv:
+                p = srv.port
+                post = _get("/?t=tok-123", p).replace("GET", "POST", 1)
+                return [
+                    (await _raw(p, _get("/x?t=tok-123", p)))[0],
+                    (await _raw(p, _get("/static/debug.html?t=tok-123", p)))[0],
+                    (await _raw(p, post))[0],
+                ]
+
+        statuses = asyncio.run(main())
+        assert statuses[:2] == [404, 404]
+        # 405 from us on websockets 17; older versions close without a reply
+        assert statuses[2] in (0, 405)
+        assert "Traceback" not in caplog.text
+        assert "tok-123" not in caplog.text
+
+    def test_token_not_in_result_or_report(self, tmp_path):
+        cmd = BrowserCommand()
+        with patch.object(
+            cmd,
+            "run_servers",
+            new=AsyncMock(
+                return_value={"completed": False, "timed_out": True, "duration": 0.0}
+            ),
+        ):
+            result = cmd.handle(
+                config=Mock(),
+                auth_manager=Mock(),
+                client=Mock(),
+                port=_free_port(),
+                no_browser=True,
+                timeout=0,
+                save_report=str(tmp_path / "r.json"),
+            )
+        assert cmd._token
+        assert cmd._token not in result.model_dump_json()
+        assert cmd._token not in (tmp_path / "r.json").read_text()
+
+    def test_end_to_end_page_session(self):
+        """handle() serves the page and completes when the page says so."""
+        from websockets.sync.client import connect
+
+        cmd = BrowserCommand()
+        cmd._guided = False
+        seen = {}
+
+        def page(url: str) -> None:
+            parts = urlsplit(url)
+            seen["url"] = url
+            ws_url = f"ws://{parts.netloc}/ws?{parts.query}"
+            with connect(ws_url, origin=f"http://{parts.netloc}") as ws:
+                ws.send(json.dumps({"type": "info", "message": "hi", "data": {}}))
+                ws.send(json.dumps({"type": "complete", "data": {}}))
+
+        def open_browser(url: str) -> bool:
+            threading.Thread(target=page, args=(url,), daemon=True).start()
+            return True
+
+        with patch(
+            "deepctl_cmd_debug_browser.command.webbrowser.open",
+            side_effect=open_browser,
+        ):
+            result = cmd.handle(
+                config=Mock(),
+                auth_manager=Mock(),
+                client=Mock(),
+                port=None,
+                no_browser=False,
+                timeout=20,
+            )
+        assert result.status == "success"
+        assert [m.message for m in result.messages] == ["hi", None]
+        assert seen["url"] == f"http://127.0.0.1:{result.port}/?t={cmd._token}"
+
+
+async def _raw_status_only(port: int, request: str) -> int:
+    """Status of an upgrade request (the connection stays open on 101)."""
+    reader, writer = await asyncio.open_connection("127.0.0.1", port)
+    writer.write(request.encode("latin-1"))
+    await writer.drain()
+    line = await asyncio.wait_for(reader.readline(), 10)
+    writer.close()
+    return int(line.split()[1])
 
 
 class TestBrowserGuidedGate:
@@ -189,26 +626,16 @@ def _run_handle(self, guided: bool):
         cmd._guided = guided
         called = {"input": 0, "open": 0}
 
-        with patch("builtins.input", side_effect=lambda: called.__setitem__("input", called["input"] + 1)), patch(
-            "deepctl_cmd_debug_browser.command.webbrowser.open",
-            side_effect=lambda _url: called.__setitem__("open", called["open"] + 1),
-        ), patch.object(
-            cmd, "find_available_port", return_value=3100
-        ), patch(
-            "deepctl_cmd_debug_browser.command.web.AppRunner"
-        ) as mock_runner_cls, patch(
-            "deepctl_cmd_debug_browser.command.web.TCPSite"
-        ) as mock_site_cls, patch(
-            "deepctl_cmd_debug_browser.command.asyncio.sleep",
-            new=AsyncMock(),
+        with (
+            patch(
+                "builtins.input",
+                side_effect=lambda: called.__setitem__("input", called["input"] + 1),
+            ),
+            patch(
+                "deepctl_cmd_debug_browser.command.webbrowser.open",
+                side_effect=lambda _url: called.__setitem__("open", called["open"] + 1),
+            ),
         ):
-            mock_runner = AsyncMock()
-            mock_runner_cls.return_value = mock_runner
-            mock_runner.setup = AsyncMock()
-            mock_runner.cleanup = AsyncMock()
-            mock_site = AsyncMock()
-            mock_site_cls.return_value = mock_site
-            mock_site.start = AsyncMock()
             cmd.handle(
                 config=Mock(),
                 auth_manager=Mock(),
@@ -229,3 +656,182 @@ def test_non_guided_invocation_opens_browser_immediately(self):
         called = self._run_handle(guided=False)
         assert called["input"] == 0
         assert called["open"] == 1
+
+
+IMPORT_CHECK = (
+    "import sys, deepctl_core; before = set(sys.modules); "
+    "import deepctl_cmd_debug_browser.command; "
+    "bad = sorted(m for m in set(sys.modules) - before for f in "
+    "('asyncio', 'ssl', 'websockets', 'aiohttp') if m == f or m.startswith(f + '.')); "
+    "print(' '.join(bad))"
+)
+
+
+def test_command_module_adds_no_network_stack_on_import():
+    """`dg debug browser --help` must not pay for websockets or asyncio."""
+    import subprocess
+    import sys
+
+    proc = subprocess.run(
+        [sys.executable, "-c", IMPORT_CHECK],
+        capture_output=True,
+        text=True,
+        timeout=120,
+    )
+    assert proc.returncode == 0, proc.stderr[-1500:]
+    assert proc.stdout.strip() == ""
+
+
+def _flat(text: str) -> str:
+    return " ".join(text.split())
+
+
+def _timed_out(cmd: BrowserCommand) -> Any:
+    return patch.object(
+        cmd,
+        "run_servers",
+        new=AsyncMock(
+            return_value={"completed": False, "timed_out": True, "duration": 0.0}
+        ),
+    )
+
+
+class TestBrowserLinkLines:
+    """Every mode shows the page link, on stderr only."""
+
+    @pytest.mark.parametrize(
+        ("no_browser", "guided", "lead", "note"),
+        [
+            (
+                True,
+                False,
+                "Open this link in your browser to start debugging:",
+                "It works only while this command runs.",
+            ),
+            (
+                False,
+                False,
+                "Opening the debugger in your browser:",
+                "If it doesn't open, paste the link into your browser. "
+                "It works only while this command runs.",
+            ),
+            (
+                False,
+                True,
+                "Opening the debugger in your browser:",
+                "If it doesn't open, paste the link into your browser. "
+                "It works only while this command runs.",
+            ),
+        ],
+        ids=["no-browser", "auto-open", "guided"],
+    )
+    def test_link_is_shown_on_stderr(self, no_browser, guided, lead, note, capsys):
+        cmd = BrowserCommand()
+        cmd._guided = guided
+        order: list[str] = []
+        before: list[str] = []
+
+        def enter() -> str:
+            order.append("enter")
+            out, err = capsys.readouterr()
+            before.append(out)
+            assert "?t=" not in err  # the link comes after Enter
+            return ""
+
+        with (
+            _timed_out(cmd),
+            patch("builtins.input", side_effect=enter),
+            patch(
+                "deepctl_cmd_debug_browser.command.webbrowser.open",
+                side_effect=lambda url: order.append("open") or True,
+            ),
+        ):
+            result = cmd.handle(
+                config=Mock(),
+                auth_manager=Mock(),
+                client=Mock(),
+                port=None,
+                no_browser=no_browser,
+                timeout=0,
+            )
+        out, err = capsys.readouterr()
+        url = f"http://127.0.0.1:{result.port}/?t={cmd._token}"
+        assert "".join(before) + out == ""
+        assert f"{lead} {url}\n" in err  # the whole link on one line
+        assert note in _flat(err)
+        assert order == ([] if no_browser else (["enter"] if guided else []) + ["open"])
+
+    def test_left_out_line_names_only_non_zero_parts(self, capsys):
+        cmd = BrowserCommand()
+        result = {"completed": False, "timed_out": False, "duration": 0.0}
+        for messages, names, line in [
+            (0, 0, None),
+            (1, 0, "Left out of the results: 1 message over the size limit"),
+            (0, 1, "Left out of the results: 1 unknown capability name"),
+            (
+                3,
+                2,
+                "Left out of the results: 3 messages over the size limit, "
+                "2 unknown capability names",
+            ),
+        ]:
+            cmd.dropped_messages, cmd.dropped_capabilities = messages, names
+            cmd._finish(0, 0, None, result)
+            err = _flat(capsys.readouterr().err)
+            if line is None:
+                assert "Left out" not in err
+            else:
+                assert line in err
+
+
+def test_link_token_reaches_stderr_only(tmp_path):
+    """`dg -o json debug browser`: the token-bearing link is printed to stderr
+    and nowhere else: not stdout (the JSON result), the saved report, or any
+    log record at DEBUG."""
+    import os
+    import re
+    import subprocess
+    import sys
+
+    script = (
+        "import logging, sys\n"
+        "from deepctl.main import main\n"
+        "log_path, report_path = sys.argv[1], sys.argv[2]\n"
+        "class Keep(logging.Handler):\n"
+        "    def emit(self, record):\n"
+        "        with open(log_path, 'a') as f:\n"
+        "            f.write(self.format(record) + '\\n')\n"
+        "logging.basicConfig(level=logging.DEBUG, handlers=[Keep()], force=True)\n"
+        "sys.argv = ['dg', '-o', 'json', 'debug', 'browser', '--no-browser',\n"
+        "            '--timeout', '1', '--save-report', report_path]\n"
+        "main()\n"
+    )
+    log, report = tmp_path / "log.txt", tmp_path / "report.json"
+    log.write_text("")
+    env = {
+        **os.environ,
+        "HOME": str(tmp_path),
+        "DEEPCTL_TELEMETRY_DISABLED": "1",
+        "DEEPCTL_TELEMETRY_DSN": "http://k@127.0.0.1:9/1",
+    }
+    proc = subprocess.run(
+        [sys.executable, "-c", script, str(log), str(report)],
+        capture_output=True,
+        text=True,
+        timeout=120,
+        env=env,
+        stdin=subprocess.DEVNULL,
+        cwd=tmp_path,
+    )
+    found = re.findall(r"http://127\.0\.0\.1:\d+/\?t=([A-Za-z0-9_-]+)", proc.stderr)
+    assert len(found) == 1, proc.stderr[-2000:]
+    token = found[0]
+    assert json.loads(proc.stdout)["status"] == "timeout"
+    for where, text in [
+        ("stdout", proc.stdout),
+        ("report", report.read_text()),
+        ("log", log.read_text()),
+    ]:
+        assert token not in text, where
+        assert "?t=" not in text, where
+    assert log.read_text(), "the DEBUG handler saw no records"
diff --git a/packages/deepctl-cmd-debug-browser/tests/unit/test_websockets_floor.py b/packages/deepctl-cmd-debug-browser/tests/unit/test_websockets_floor.py
new file mode 100644
index 00000000..a20bf8fa
--- /dev/null
+++ b/packages/deepctl-cmd-debug-browser/tests/unit/test_websockets_floor.py
@@ -0,0 +1,22 @@
+"""Every package that imports websockets declares the same floor.
+
+13.1 is the oldest release the redirect matrix covers for each socket
+dg opens (listen, Flux speak, the debug probe and this server).
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+PACKAGES = Path(__file__).resolve().parents[3]
+
+
+def test_websockets_floor_matches_across_packages():
+    floors = {}
+    for toml in sorted(PACKAGES.glob("*/pyproject.toml")):
+        found = re.findall(r'"websockets([^"]*)"', toml.read_text(encoding="utf-8"))
+        if found:
+            floors[toml.parent.name] = found
+    assert "deepctl-cmd-debug-browser" in floors
+    assert {spec for specs in floors.values() for spec in specs} == {">=13.1,<18"}, floors
diff --git a/packages/deepctl-cmd-debug-network/README.md b/packages/deepctl-cmd-debug-network/README.md
index 2da03160..b79e01c5 100644
--- a/packages/deepctl-cmd-debug-network/README.md
+++ b/packages/deepctl-cmd-debug-network/README.md
@@ -39,7 +39,6 @@ pipx run deepctl --help
 - `rich>=13.0.0,<16`
 - `pydantic>=2.0.0,<3`
 - `httpx>=0.24.0,<1`
-- `requests>=2.31,<3.0`
 
 ## License
 
diff --git a/packages/deepctl-cmd-debug-network/pyproject.toml b/packages/deepctl-cmd-debug-network/pyproject.toml
index a37b284d..1af030f6 100644
--- a/packages/deepctl-cmd-debug-network/pyproject.toml
+++ b/packages/deepctl-cmd-debug-network/pyproject.toml
@@ -27,7 +27,6 @@ dependencies = [
     "rich>=13.0.0,<16",
     "pydantic>=2.0.0,<3",
     "httpx>=0.24.0,<1",
-    "requests>=2.31,<3.0",
 ]
 
 [project.scripts]
diff --git a/packages/deepctl-cmd-debug-network/src/deepctl_cmd_debug_network/command.py b/packages/deepctl-cmd-debug-network/src/deepctl_cmd_debug_network/command.py
index 3edc4ed7..d80b0fb8 100644
--- a/packages/deepctl-cmd-debug-network/src/deepctl_cmd_debug_network/command.py
+++ b/packages/deepctl-cmd-debug-network/src/deepctl_cmd_debug_network/command.py
@@ -6,8 +6,7 @@
 import subprocess
 import sys
 import time
-import warnings
-from typing import Any
+from typing import TYPE_CHECKING, Any
 from urllib.parse import urlparse
 
 from deepctl_core import AuthManager, BaseCommand, Config, DeepgramClient
@@ -26,6 +25,11 @@
     TLSTestResult,
 )
 
+if TYPE_CHECKING:
+    import ssl
+
+    import httpx
+
 console = Console()
 
 # Default Deepgram endpoints to test
@@ -35,9 +39,74 @@
 }
 
 
+def _is_ssl_error(exc: BaseException) -> bool:
+    """True when an httpx error was caused by a TLS failure (the case
+    requests raised as SSLError)."""
+    import ssl
+
+    seen: set[int] = set()
+    current: BaseException | None = exc
+    while current is not None and id(current) not in seen:
+        if isinstance(current, ssl.SSLError):
+            return True
+        seen.add(id(current))
+        current = current.__cause__ or current.__context__
+    return False
+
+
+def _requests_ca_bundle() -> str | None:
+    """The CA bundle requests would have used from the environment.
+
+    httpx reads SSL_CERT_FILE and SSL_CERT_DIR itself; when either is set it
+    wins. Otherwise REQUESTS_CA_BUNDLE, then CURL_CA_BUNDLE, as requests
+    resolved them (an empty value counts as unset).
+    """
+    if os.environ.get("SSL_CERT_FILE") or os.environ.get("SSL_CERT_DIR"):
+        return None
+    return (
+        os.environ.get("REQUESTS_CA_BUNDLE") or os.environ.get("CURL_CA_BUNDLE") or None
+    )
+
+
+def _verify_setting(verify: bool) -> "bool | ssl.SSLContext":
+    """httpx's verify argument: False stays False; True becomes an SSL
+    context on the requests-style bundle when one is set in the
+    environment, and otherwise stays True (httpx defaults, which honour
+    SSL_CERT_FILE / SSL_CERT_DIR)."""
+    import ssl
+
+    if not verify:
+        return False
+    bundle = _requests_ca_bundle()
+    if bundle is None:
+        return True
+    if os.path.isdir(bundle):
+        return ssl.create_default_context(capath=bundle)
+    if not os.path.isfile(bundle):
+        # requests' wording for the same mistake.
+        raise OSError(
+            "Could not find a suitable TLS CA certificate bundle, "
+            f"invalid path: {bundle}"
+        )
+    return ssl.create_default_context(cafile=bundle)
+
+
+def _dist_version(name: str) -> str:
+    """Installed version of a distribution, read without importing it."""
+    from importlib.metadata import PackageNotFoundError, version
+
+    try:
+        return version(name)
+    except PackageNotFoundError:
+        return "not installed"
+
+
 class NetworkCommand(BaseCommand):
     """Debug network connectivity issues with Deepgram services."""
 
+    # Tests swap in an httpx.MockTransport; None means the real network.
+    _transport: "httpx.BaseTransport | None" = None
+
     name = "network"
     help = "Debug network connectivity issues with Deepgram services"
     short_help = "Debug network issues"
@@ -105,6 +174,29 @@ def get_arguments(self) -> list[dict[str, Any]]:
             },
         ]
 
+    def _http_client(
+        self, *, timeout: float, verify: bool = True, follow_redirects: bool = False
+    ) -> "httpx.Client":
+        """A throwaway client for one diagnostic request.
+
+        Never the shared CLI client: it carries no credentials (httpx does
+        not read ~/.netrc), and a verify=False client must not outlive its
+        one test. trust_env applies HTTP(S)_PROXY / NO_PROXY as requests did.
+
+        CA trust, first match wins (verify=False skips all of it):
+        SSL_CERT_FILE or SSL_CERT_DIR (read by httpx), then
+        REQUESTS_CA_BUNDLE, then CURL_CA_BUNDLE, then httpx's default bundle.
+        """
+        import httpx
+
+        return httpx.Client(
+            timeout=timeout,
+            verify=_verify_setting(verify),
+            follow_redirects=follow_redirects,
+            trust_env=True,
+            transport=self._transport,
+        )
+
     def handle(
         self,
         config: Config,
@@ -169,7 +261,7 @@ def handle(
                 progress.remove_task(task)
 
             # 5. Python requests tests
-            task = progress.add_task("Testing Python requests library...", total=None)
+            task = progress.add_task("Testing Python HTTP client...", total=None)
             self._test_python_requests(endpoint, result, timeout)
             progress.remove_task(task)
 
@@ -208,14 +300,12 @@ def handle(
 
     def _collect_environment_info(self, result: NetworkDebugResult) -> None:
         """Collect environment information."""
-        import requests
-        import urllib3
-
         result.environment_info = {
             "python_version": sys.version,
             "platform": sys.platform,
-            "requests_version": requests.__version__,
-            "urllib3_version": getattr(urllib3, "__version__", "unknown"),
+            "requests_version": _dist_version("requests"),
+            "urllib3_version": _dist_version("urllib3"),
+            "httpx_version": _dist_version("httpx"),
             "proxy_env_vars": {
                 "http_proxy": os.environ.get("http_proxy", "Not set"),
                 "https_proxy": os.environ.get("https_proxy", "Not set"),
@@ -265,28 +355,25 @@ def _test_basic_connectivity(
         self, hostname: str, result: NetworkDebugResult, timeout: int
     ) -> None:
         """Test basic HTTPS connectivity."""
-        import requests
-
         endpoint_test = EndpointTestResult(
             name="HTTPS", url=f"https://{hostname}", reachable=False
         )
 
         try:
             start_time = time.time()
-            response = requests.get(
-                f"https://{hostname}/", timeout=timeout, allow_redirects=False
-            )
+            with self._http_client(timeout=timeout) as http:
+                response = http.get(f"https://{hostname}/")
             endpoint_test.response_time_ms = (time.time() - start_time) * 1000
             endpoint_test.status_code = response.status_code
             endpoint_test.reachable = True
             endpoint_test.ssl_valid = True
 
-        except requests.exceptions.SSLError as e:
-            endpoint_test.error = f"SSL Error: {e!s}"
-            endpoint_test.ssl_valid = False
-            result.network_issues_detected = True
         except Exception as e:
-            endpoint_test.error = str(e)
+            if _is_ssl_error(e):
+                endpoint_test.error = f"SSL Error: {e!s}"
+                endpoint_test.ssl_valid = False
+            else:
+                endpoint_test.error = str(e)
             result.network_issues_detected = True
 
         result.endpoint_results.append(endpoint_test)
@@ -413,8 +500,6 @@ def _test_revocation_endpoints(
         simulate_blocked_crl: bool = False,
     ) -> None:
         """Test accessibility of CRL/OCSP/CA issuer endpoints."""
-        import requests
-
         all_endpoints = []
 
         for cert in tls_result.certificate_chain:
@@ -451,7 +536,8 @@ def _test_revocation_endpoints(
             else:
                 try:
                     start_time = time.time()
-                    response = requests.head(url, timeout=5, allow_redirects=True)
+                    with self._http_client(timeout=5, follow_redirects=True) as http:
+                        response = http.head(url)
                     endpoint_test.response_time_ms = (time.time() - start_time) * 1000
                     endpoint_test.status_code = response.status_code
                     endpoint_test.accessible = response.status_code < 400
@@ -465,10 +551,8 @@ def _test_revocation_endpoints(
     def _test_python_requests(
         self, hostname: str, result: NetworkDebugResult, timeout: int
     ) -> None:
-        """Test connectivity using Python requests library."""
-        import requests
-        import urllib3
-
+        """Test connectivity with Python's HTTP client (httpx), with and
+        without certificate verification. Each request gets its own client."""
         # Test with SSL verification enabled
         test_with_verify = PythonRequestsTest(
             url=f"https://{hostname}/", success=False, ssl_verify_enabled=True
@@ -476,21 +560,18 @@ def _test_python_requests(
 
         try:
             start_time = time.time()
-            response = requests.get(
-                f"https://{hostname}/",
-                timeout=timeout,
-                verify=True,
-                allow_redirects=False,
-            )
+            with self._http_client(timeout=timeout, verify=True) as http:
+                response = http.get(f"https://{hostname}/")
             test_with_verify.response_time_ms = (time.time() - start_time) * 1000
             test_with_verify.status_code = response.status_code
             test_with_verify.success = True
 
-        except requests.exceptions.SSLError as e:
-            test_with_verify.error = f"SSL verification failed: {e!s}"
-            result.network_issues_detected = True
         except Exception as e:
-            test_with_verify.error = str(e)
+            if _is_ssl_error(e):
+                test_with_verify.error = f"SSL verification failed: {e!s}"
+                result.network_issues_detected = True
+            else:
+                test_with_verify.error = str(e)
 
         result.python_requests_tests.append(test_with_verify)
 
@@ -500,25 +581,17 @@ def _test_python_requests(
         )
 
         try:
-            # Disable SSL warnings temporarily
-            urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
-
+            # An isolated, credential-free client that is closed right after
+            # this one request; nothing else ever sees verify=False.
             start_time = time.time()
-            response = requests.get(
-                f"https://{hostname}/",
-                timeout=timeout,
-                verify=False,
-                allow_redirects=False,
-            )
+            with self._http_client(timeout=timeout, verify=False) as http:
+                response = http.get(f"https://{hostname}/")
             test_without_verify.response_time_ms = (time.time() - start_time) * 1000
             test_without_verify.status_code = response.status_code
             test_without_verify.success = True
 
         except Exception as e:
             test_without_verify.error = str(e)
-        finally:
-            # Re-enable warnings
-            warnings.resetwarnings()
 
         result.python_requests_tests.append(test_without_verify)
 
@@ -670,8 +743,6 @@ def _test_multi_region_latency(
         self, result: NetworkDebugResult, timeout: int
     ) -> None:
         """Test latency to known Deepgram endpoints."""
-        import requests
-
         endpoints = [
             ("api.deepgram.com", "Primary API"),
         ]
@@ -704,11 +775,8 @@ def _test_multi_region_latency(
 
                 # HTTPS connection timing
                 connect_start = time.time()
-                resp = requests.get(
-                    f"https://{hostname}/",
-                    timeout=timeout,
-                    allow_redirects=False,
-                )
+                with self._http_client(timeout=timeout) as http:
+                    resp = http.get(f"https://{hostname}/")
                 total_ms = (time.time() - connect_start) * 1000
                 connect_ms = total_ms - dns_ms if total_ms and dns_ms else None
                 tls_ms = connect_ms * 0.6 if connect_ms else None
@@ -855,7 +923,7 @@ def _display_results(self, result: NetworkDebugResult, verbose: bool) -> None:
 
         # Python Requests Tests
         if result.python_requests_tests:
-            console.print("[bold]Python Requests Library Tests:[/bold]")
+            console.print("[bold]Python HTTP Client Tests (httpx):[/bold]")
             for test in result.python_requests_tests:
                 verify_status = (
                     "with SSL verification"
diff --git a/packages/deepctl-cmd-debug-network/src/deepctl_cmd_debug_network/models.py b/packages/deepctl-cmd-debug-network/src/deepctl_cmd_debug_network/models.py
index 5b44787f..8fe048fc 100644
--- a/packages/deepctl-cmd-debug-network/src/deepctl_cmd_debug_network/models.py
+++ b/packages/deepctl-cmd-debug-network/src/deepctl_cmd_debug_network/models.py
@@ -70,9 +70,11 @@ class TLSTestResult(BaseModel):
 
 
 class PythonRequestsTest(BaseModel):
-    """Result of testing with Python requests library."""
+    """Result of one Python HTTP client request (the payload keeps its
+    requests-era name; ``library`` says which client made it)."""
 
     url: str
+    library: str = "httpx"
     success: bool
     status_code: int | None = None
     response_time_ms: float | None = None
diff --git a/packages/deepctl-cmd-debug-network/tests/unit/test_network_command.py b/packages/deepctl-cmd-debug-network/tests/unit/test_network_command.py
index be4dae1f..667a17dd 100644
--- a/packages/deepctl-cmd-debug-network/tests/unit/test_network_command.py
+++ b/packages/deepctl-cmd-debug-network/tests/unit/test_network_command.py
@@ -2,12 +2,13 @@
 
 import json
 import socket
+import ssl
 import subprocess
 from datetime import datetime
 from unittest.mock import MagicMock, Mock, call, patch
 
+import httpx
 import pytest
-import requests
 from deepctl_cmd_debug_network import NetworkCommand
 from deepctl_cmd_debug_network.models import (
     CertificateInfo,
@@ -28,6 +29,53 @@ def network_command():
     return NetworkCommand()
 
 
+class _MockHTTP:
+    """Routes every request the command makes to an httpx.MockTransport and
+    records the requests and the clients that carried them."""
+
+    def __init__(self, command, monkeypatch):
+        self.requests: list[httpx.Request] = []
+        self.clients: list[dict] = []
+        self.status_code = 404
+        self.error: Exception | None = None
+        command._transport = httpx.MockTransport(self._handle)
+        original = command._http_client
+
+        def recording_client(**kwargs):
+            client = original(**kwargs)
+            kwargs = {"verify": True, "follow_redirects": False, **kwargs}
+            self.clients.append({"kwargs": kwargs, "client": client})
+            return client
+
+        monkeypatch.setattr(command, "_http_client", recording_client)
+
+    def _handle(self, request: httpx.Request) -> httpx.Response:
+        self.requests.append(request)
+        if self.error is not None:
+            raise self.error
+        return httpx.Response(self.status_code)
+
+
+def _ssl_connect_error() -> httpx.ConnectError:
+    """What httpx raises for a failed certificate check: a ConnectError
+    whose cause is the ssl module's verification error."""
+    try:
+        try:
+            raise ssl.SSLCertVerificationError(
+                1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed"
+            )
+        except ssl.SSLError as exc:
+            raise httpx.ConnectError(str(exc)) from exc
+    except httpx.ConnectError as err:
+        return err
+
+
+@pytest.fixture
+def mock_http(network_command, monkeypatch):
+    """Every HTTP request goes to a MockTransport; nothing reaches the net."""
+    return _MockHTTP(network_command, monkeypatch)
+
+
 @pytest.fixture
 def mock_config():
     """Create mock config."""
@@ -69,9 +117,7 @@ def test_get_arguments(self, network_command):
         assert len(args) == 7
 
         # Check endpoint argument
-        endpoint_arg = next(
-            arg for arg in args if "--endpoint" in arg["names"]
-        )
+        endpoint_arg = next(arg for arg in args if "--endpoint" in arg["names"])
         assert (
             endpoint_arg["help"]
             == "Specific endpoint to test (default: api.deepgram.com)"
@@ -84,13 +130,8 @@ def test_get_arguments(self, network_command):
         assert verbose_arg["is_flag"] is True
 
         # Check skip-commands flag
-        skip_arg = next(
-            arg for arg in args if "--skip-commands" in arg["names"]
-        )
-        assert (
-            skip_arg["help"]
-            == "Skip system command execution (openssl, curl, etc.)"
-        )
+        skip_arg = next(arg for arg in args if "--skip-commands" in arg["names"])
+        assert skip_arg["help"] == "Skip system command execution (openssl, curl, etc.)"
         assert skip_arg["is_flag"] is True
 
         # Check timeout argument
@@ -107,8 +148,7 @@ def test_get_arguments(self, network_command):
             arg for arg in args if "--simulate-blocked-crl" in arg["names"]
         )
         assert (
-            simulate_arg["help"]
-            == "Simulate blocked CRL/OCSP endpoints (for testing)"
+            simulate_arg["help"] == "Simulate blocked CRL/OCSP endpoints (for testing)"
         )
         assert simulate_arg["is_flag"] is True
 
@@ -118,9 +158,7 @@ def test_get_arguments(self, network_command):
         assert save_arg["type"] == str
 
         # Check test-websocket flag
-        ws_arg = next(
-            arg for arg in args if "--test-websocket" in arg["names"]
-        )
+        ws_arg = next(arg for arg in args if "--test-websocket" in arg["names"])
         assert ws_arg["help"] == "Also test WebSocket connectivity (wss://)"
         assert ws_arg["is_flag"] is True
 
@@ -145,9 +183,7 @@ def test_dns_resolution_success(self, mock_getaddrinfo, network_command):
     @patch("socket.getaddrinfo")
     def test_dns_resolution_failure(self, mock_getaddrinfo, network_command):
         """Test failed DNS resolution."""
-        mock_getaddrinfo.side_effect = socket.gaierror(
-            "Name resolution failed"
-        )
+        mock_getaddrinfo.side_effect = socket.gaierror("Name resolution failed")
 
         result = NetworkDebugResult(status="success")
         network_command._test_dns_resolution("api.deepgram.com", result, 10)
@@ -158,17 +194,12 @@ def test_dns_resolution_failure(self, mock_getaddrinfo, network_command):
         assert dns_result.error == "Name resolution failed"
         assert result.network_issues_detected is True
 
-    @patch("requests.get")
-    def test_basic_connectivity_success(self, mock_get, network_command):
+    def test_basic_connectivity_success(self, mock_http, network_command):
         """Test successful basic HTTPS connectivity."""
-        mock_response = Mock()
-        mock_response.status_code = 404  # Expected for root endpoint
-        mock_get.return_value = mock_response
+        mock_http.status_code = 404  # Expected for root endpoint
 
         result = NetworkDebugResult(status="success")
-        network_command._test_basic_connectivity(
-            "api.deepgram.com", result, 10
-        )
+        network_command._test_basic_connectivity("api.deepgram.com", result, 10)
 
         assert len(result.endpoint_results) == 1
         endpoint = result.endpoint_results[0]
@@ -178,17 +209,12 @@ def test_basic_connectivity_success(self, mock_get, network_command):
         assert endpoint.status_code == 404
         assert endpoint.ssl_valid is True
 
-    @patch("requests.get")
-    def test_basic_connectivity_ssl_error(self, mock_get, network_command):
+    def test_basic_connectivity_ssl_error(self, mock_http, network_command):
         """Test basic connectivity with SSL error."""
-        mock_get.side_effect = requests.exceptions.SSLError(
-            "SSL certificate verification failed"
-        )
+        mock_http.error = _ssl_connect_error()
 
         result = NetworkDebugResult(status="success")
-        network_command._test_basic_connectivity(
-            "api.deepgram.com", result, 10
-        )
+        network_command._test_basic_connectivity("api.deepgram.com", result, 10)
 
         assert len(result.endpoint_results) == 1
         endpoint = result.endpoint_results[0]
@@ -236,7 +262,7 @@ def test_analyze_tls_certificates(self, mock_run, network_command):
         assert tls_result.connected is True
         assert len(tls_result.certificate_chain) == 2
 
-    def test_test_revocation_endpoints_success(self, network_command):
+    def test_test_revocation_endpoints_success(self, mock_http, network_command):
         """Test successful revocation endpoint testing."""
         tls_result = TLSTestResult(
             hostname="api.deepgram.com", port=443, connected=True
@@ -252,18 +278,19 @@ def test_test_revocation_endpoints_success(self, network_command):
 
         result = NetworkDebugResult(status="success")
 
-        with patch("requests.head") as mock_head:
-            mock_head.return_value = Mock(status_code=200)
-            network_command._test_revocation_endpoints(
-                tls_result, result, False
-            )
+        mock_http.status_code = 200
+        network_command._test_revocation_endpoints(tls_result, result, False)
 
         assert len(tls_result.revocation_endpoints) == 3
         for endpoint in tls_result.revocation_endpoints:
             assert endpoint.accessible is True
             assert endpoint.status_code == 200
+        assert {r.method for r in mock_http.requests} == {"HEAD"}
+        assert all(c["kwargs"]["follow_redirects"] for c in mock_http.clients)
 
-    def test_test_revocation_endpoints_simulated_block(self, network_command):
+    def test_test_revocation_endpoints_simulated_block(
+        self, mock_http, network_command
+    ):
         """Test revocation endpoints with simulated blocking."""
         tls_result = TLSTestResult(
             hostname="api.deepgram.com", port=443, connected=True
@@ -277,6 +304,7 @@ def test_test_revocation_endpoints_simulated_block(self, network_command):
         )
         tls_result.certificate_chain.append(cert)
 
+        mock_http.status_code = 200
         result = NetworkDebugResult(status="success")
         network_command._test_revocation_endpoints(
             tls_result, result, simulate_blocked_crl=True
@@ -284,19 +312,13 @@ def test_test_revocation_endpoints_simulated_block(self, network_command):
 
         # Check that CRL and OCSP endpoints are marked as blocked
         ocsp_endpoints = [
-            e
-            for e in tls_result.revocation_endpoints
-            if e.endpoint_type == "ocsp"
+            e for e in tls_result.revocation_endpoints if e.endpoint_type == "ocsp"
         ]
         crl_endpoints = [
-            e
-            for e in tls_result.revocation_endpoints
-            if e.endpoint_type == "crl"
+            e for e in tls_result.revocation_endpoints if e.endpoint_type == "crl"
         ]
         ca_endpoints = [
-            e
-            for e in tls_result.revocation_endpoints
-            if e.endpoint_type == "ca_issuer"
+            e for e in tls_result.revocation_endpoints if e.endpoint_type == "ca_issuer"
         ]
 
         for endpoint in ocsp_endpoints + crl_endpoints:
@@ -304,16 +326,12 @@ def test_test_revocation_endpoints_simulated_block(self, network_command):
             assert "simulated corporate firewall blocking" in endpoint.error
 
         for endpoint in ca_endpoints:
-            assert (
-                endpoint.accessible is True
-            )  # CA issuer endpoints not blocked
+            assert endpoint.accessible is True  # CA issuer endpoints not blocked
 
-    @patch("requests.get")
-    def test_python_requests_tests(self, mock_get, network_command):
-        """Test Python requests library connectivity tests."""
-        mock_response = Mock()
-        mock_response.status_code = 404
-        mock_get.return_value = mock_response
+    def test_python_requests_tests(self, mock_http, network_command):
+        """The Python HTTP client tests run once with and once without
+        certificate verification, each on its own client."""
+        mock_http.status_code = 404
 
         result = NetworkDebugResult(status="success")
         network_command._test_python_requests("api.deepgram.com", result, 10)
@@ -325,19 +343,95 @@ def test_python_requests_tests(self, mock_get, network_command):
         assert test_with_verify.ssl_verify_enabled is True
         assert test_with_verify.success is True
         assert test_with_verify.status_code == 404
+        assert test_with_verify.library == "httpx"
 
         # Test without SSL verification
         test_without_verify = result.python_requests_tests[1]
         assert test_without_verify.ssl_verify_enabled is False
         assert test_without_verify.success is True
         assert test_without_verify.status_code == 404
+        assert test_without_verify.library == "httpx"
+
+        # Two throwaway clients, the second alone with verify=False, both
+        # closed after their one request.
+        assert [c["kwargs"]["verify"] for c in mock_http.clients] == [True, False]
+        assert len({id(c["client"]) for c in mock_http.clients}) == 2
+        assert all(c["client"].is_closed for c in mock_http.clients)
+        assert [str(r.url) for r in mock_http.requests] == [
+            "https://api.deepgram.com/",
+            "https://api.deepgram.com/",
+        ]
+
+    def test_python_requests_ssl_error(self, mock_http, network_command):
+        """A failed certificate check is reported as an SSL failure."""
+        mock_http.error = _ssl_connect_error()
+
+        result = NetworkDebugResult(status="success")
+        network_command._test_python_requests("api.deepgram.com", result, 10)
+
+        with_verify, without_verify = result.python_requests_tests
+        assert with_verify.success is False
+        assert with_verify.error.startswith("SSL verification failed: ")
+        assert "CERTIFICATE_VERIFY_FAILED" in with_verify.error
+        assert without_verify.success is False
+        assert result.network_issues_detected is True
+
+    def test_python_requests_timeout(self, mock_http, network_command):
+        """A timeout is a plain failure, not an SSL one."""
+        mock_http.error = httpx.ConnectTimeout("timed out")
+
+        result = NetworkDebugResult(status="success")
+        network_command._test_python_requests("api.deepgram.com", result, 3)
+
+        with_verify, without_verify = result.python_requests_tests
+        assert with_verify.success is False
+        assert with_verify.error == "timed out"
+        assert without_verify.error == "timed out"
+        assert result.network_issues_detected is False
+        assert all(c["kwargs"]["timeout"] == 3 for c in mock_http.clients)
+
+    def test_basic_connectivity_timeout(self, mock_http, network_command):
+        """A timeout is not an SSL failure, but it is a network issue."""
+        mock_http.error = httpx.ReadTimeout("read timed out")
+
+        result = NetworkDebugResult(status="success")
+        network_command._test_basic_connectivity("api.deepgram.com", result, 10)
+
+        endpoint = result.endpoint_results[0]
+        assert endpoint.reachable is False
+        assert endpoint.ssl_valid is True  # the model default, as before
+        assert endpoint.error == "read timed out"
+        assert result.network_issues_detected is True
+
+    def test_requests_carry_no_credentials(
+        self, mock_http, network_command, monkeypatch
+    ):
+        """No diagnostic request sends an Authorization header, even with a
+        key in the environment, and none follows a redirect except the
+        revocation HEADs."""
+        monkeypatch.setenv("DEEPGRAM_API_KEY", "sentinel-fake-key-w27")
+        result = NetworkDebugResult(status="success")
+
+        network_command._test_basic_connectivity("api.deepgram.com", result, 10)
+        network_command._test_python_requests("api.deepgram.com", result, 10)
+
+        assert len(mock_http.requests) == 3
+        for request in mock_http.requests:
+            assert "authorization" not in request.headers
+            assert "sentinel-fake-key-w27" not in str(request.headers)
+        assert not any(c["kwargs"]["follow_redirects"] for c in mock_http.clients)
+
+    def test_http_client_trusts_the_environment(self, network_command):
+        """The diagnostic client reads proxy/CA env vars like requests did."""
+        with network_command._http_client(timeout=5) as client:
+            assert client.trust_env is True
+            assert client.follow_redirects is False
+            assert client.timeout == httpx.Timeout(5)
 
     @patch("subprocess.run")
     def test_run_system_diagnostics(self, mock_run, network_command):
         """Test system diagnostic command execution."""
-        with patch.object(
-            network_command, "_command_exists", return_value=True
-        ):
+        with patch.object(network_command, "_command_exists", return_value=True):
             mock_run.return_value = Mock(
                 returncode=0,
                 stdout=b"PING api.deepgram.com: 3 packets transmitted, 3 received",
@@ -345,9 +439,7 @@ def test_run_system_diagnostics(self, mock_run, network_command):
             )
 
             result = NetworkDebugResult(status="success")
-            network_command._run_system_diagnostics(
-                "api.deepgram.com", result, False
-            )
+            network_command._run_system_diagnostics("api.deepgram.com", result, False)
 
             # Should have executed multiple commands
             assert len(result.command_results) > 0
@@ -359,9 +451,7 @@ def test_run_system_diagnostics(self, mock_run, network_command):
     @patch("subprocess.run")
     def test_test_websocket_connectivity(self, mock_run, network_command):
         """Test WebSocket connectivity testing."""
-        with patch.object(
-            network_command, "_command_exists", return_value=True
-        ):
+        with patch.object(network_command, "_command_exists", return_value=True):
             mock_run.return_value = Mock(
                 returncode=0,
                 stdout=b"HTTP/1.1 401 Unauthorized\r\n",
@@ -369,14 +459,10 @@ def test_test_websocket_connectivity(self, mock_run, network_command):
             )
 
             result = NetworkDebugResult(status="success")
-            network_command._test_websocket_connectivity(
-                "api.deepgram.com", result, 10
-            )
+            network_command._test_websocket_connectivity("api.deepgram.com", result, 10)
 
             # Check WebSocket test was added to endpoint results
-            ws_results = [
-                e for e in result.endpoint_results if e.name == "WebSocket"
-            ]
+            ws_results = [e for e in result.endpoint_results if e.name == "WebSocket"]
             assert len(ws_results) == 1
             ws_result = ws_results[0]
             assert ws_result.url == "wss://api.deepgram.com/v1/listen"
@@ -460,13 +546,12 @@ def test_generate_recommendations_with_blocked_crl(self, network_command):
         assert any("r11.c.lencr.org" in r for r in result.recommendations)
 
     @patch("socket.getaddrinfo")
-    @patch("requests.get")
     @patch("subprocess.run")
     def test_handle_default_endpoint(
         self,
         mock_run,
-        mock_get,
         mock_getaddrinfo,
+        mock_http,
         network_command,
         mock_config,
         mock_auth_manager,
@@ -479,7 +564,7 @@ def test_handle_default_endpoint(
         ]
 
         # Mock HTTPS connectivity
-        mock_get.return_value = Mock(status_code=404)
+        mock_http.status_code = 404
 
         # Mock subprocess calls
         mock_run.return_value = Mock(returncode=0, stdout=b"", stderr=b"")
@@ -495,13 +580,12 @@ def test_handle_default_endpoint(
         assert len(result.endpoint_results) > 0
 
     @patch("socket.getaddrinfo")
-    @patch("requests.get")
     @patch("subprocess.run")
     def test_handle_custom_endpoint(
         self,
         mock_run,
-        mock_get,
         mock_getaddrinfo,
+        mock_http,
         network_command,
         mock_config,
         mock_auth_manager,
@@ -514,7 +598,7 @@ def test_handle_custom_endpoint(
         ]
 
         # Mock HTTPS connectivity
-        mock_get.return_value = Mock(status_code=200)
+        mock_http.status_code = 200
 
         # Mock subprocess calls
         mock_run.return_value = Mock(returncode=0, stdout=b"", stderr=b"")
@@ -539,19 +623,87 @@ def test_collect_environment_info(self, network_command):
         assert "platform" in result.environment_info
         assert "requests_version" in result.environment_info
         assert "urllib3_version" in result.environment_info
+        assert "httpx_version" in result.environment_info
+        assert result.environment_info["httpx_version"] == httpx.__version__
         assert "proxy_env_vars" in result.environment_info
 
     def test_collect_environment_info_with_proxy(self, network_command):
         """Test environment information collection with proxy configured."""
         result = NetworkDebugResult(status="success")
 
-        with patch.dict(
-            "os.environ", {"https_proxy": "http://proxy.example.com:8080"}
-        ):
+        with patch.dict("os.environ", {"https_proxy": "http://proxy.example.com:8080"}):
             network_command._collect_environment_info(result)
 
         assert result.proxy_detected is True
-        assert (
-            result.proxy_settings["https_proxy"]
-            == "http://proxy.example.com:8080"
-        )
+        assert result.proxy_settings["https_proxy"] == "http://proxy.example.com:8080"
+
+
+# -- CA bundle environment, as requests resolved it ------------------------
+
+_CA_VARS = ("SSL_CERT_FILE", "SSL_CERT_DIR", "REQUESTS_CA_BUNDLE", "CURL_CA_BUNDLE")
+
+
+@pytest.fixture
+def clean_ca_env(monkeypatch):
+    for var in _CA_VARS:
+        monkeypatch.delenv(var, raising=False)
+    return monkeypatch
+
+
+@pytest.mark.parametrize(
+    ("env", "expected"),
+    [
+        ({}, None),
+        ({"REQUESTS_CA_BUNDLE": "/r.pem"}, "/r.pem"),
+        ({"CURL_CA_BUNDLE": "/c.pem"}, "/c.pem"),
+        ({"REQUESTS_CA_BUNDLE": "/r.pem", "CURL_CA_BUNDLE": "/c.pem"}, "/r.pem"),
+        ({"REQUESTS_CA_BUNDLE": "", "CURL_CA_BUNDLE": "/c.pem"}, "/c.pem"),
+        ({"SSL_CERT_FILE": "/s.pem", "REQUESTS_CA_BUNDLE": "/r.pem"}, None),
+        ({"SSL_CERT_DIR": "/s", "CURL_CA_BUNDLE": "/c.pem"}, None),
+    ],
+)
+def test_requests_ca_bundle_precedence(clean_ca_env, env, expected):
+    """SSL_CERT_FILE/SSL_CERT_DIR (httpx's own) win; then REQUESTS_CA_BUNDLE,
+    then CURL_CA_BUNDLE."""
+    from deepctl_cmd_debug_network.command import _requests_ca_bundle
+
+    for var, value in env.items():
+        clean_ca_env.setenv(var, value)
+    assert _requests_ca_bundle() == expected
+
+
+def test_verify_setting_uses_the_requests_bundle(clean_ca_env):
+    import certifi
+    from deepctl_cmd_debug_network.command import _verify_setting
+
+    assert _verify_setting(True) is True
+    clean_ca_env.setenv("REQUESTS_CA_BUNDLE", certifi.where())
+    context = _verify_setting(True)
+    assert isinstance(context, ssl.SSLContext)
+    assert context.verify_mode == ssl.CERT_REQUIRED
+    assert context.cert_store_stats()["x509_ca"] > 0
+    # verify=False is never turned back on by the environment.
+    assert _verify_setting(False) is False
+
+
+def test_verify_setting_accepts_a_bundle_directory(clean_ca_env, tmp_path):
+    from deepctl_cmd_debug_network.command import _verify_setting
+
+    clean_ca_env.setenv("CURL_CA_BUNDLE", str(tmp_path))
+    assert isinstance(_verify_setting(True), ssl.SSLContext)
+
+
+def test_missing_bundle_is_reported_like_requests(
+    clean_ca_env, mock_http, network_command, tmp_path
+):
+    """A bad REQUESTS_CA_BUNDLE path fails the verified request with
+    requests' message; the verify=False request is unaffected."""
+    clean_ca_env.setenv("REQUESTS_CA_BUNDLE", str(tmp_path / "missing.pem"))
+    result = NetworkDebugResult(status="success")
+
+    network_command._test_python_requests("api.deepgram.com", result, 10)
+
+    with_verify, without_verify = result.python_requests_tests
+    assert with_verify.success is False
+    assert "Could not find a suitable TLS CA certificate bundle" in with_verify.error
+    assert without_verify.success is True
diff --git a/packages/deepctl-cmd-debug-probe/README.md b/packages/deepctl-cmd-debug-probe/README.md
index 4afe3808..dbb70ddb 100644
--- a/packages/deepctl-cmd-debug-probe/README.md
+++ b/packages/deepctl-cmd-debug-probe/README.md
@@ -38,7 +38,7 @@ pipx run deepctl --help
 - `click>=8.2.0,<9`
 - `rich>=13.0.0,<16`
 - `pydantic>=2.0.0,<3`
-- `aiohttp>=3.11.0`
+- `websockets>=13.0,<18`
 
 ## License
 
diff --git a/packages/deepctl-cmd-debug-probe/pyproject.toml b/packages/deepctl-cmd-debug-probe/pyproject.toml
index 2b373fcb..841f49c4 100644
--- a/packages/deepctl-cmd-debug-probe/pyproject.toml
+++ b/packages/deepctl-cmd-debug-probe/pyproject.toml
@@ -27,7 +27,7 @@ dependencies = [
     "click>=8.2.0,<9",
     "rich>=13.0.0,<16",
     "pydantic>=2.0.0,<3",
-    "aiohttp>=3.11.0",
+    "websockets>=13.1,<18",
 ]
 
 [project.scripts]
diff --git a/packages/deepctl-cmd-debug-probe/src/deepctl_cmd_debug_probe/access.py b/packages/deepctl-cmd-debug-probe/src/deepctl_cmd_debug_probe/access.py
new file mode 100644
index 00000000..73013b9c
--- /dev/null
+++ b/packages/deepctl-cmd-debug-probe/src/deepctl_cmd_debug_probe/access.py
@@ -0,0 +1,63 @@
+"""Which local clients may use the probe proxy, and how request-derived text
+is printed.
+
+Host names this listener, and an Origin, if sent, is a page on this machine.
+"""
+
+from __future__ import annotations
+
+import re
+
+from rich.text import Text
+
+# Browsers send Origin on every WebSocket handshake; native clients usually
+# send none. Only pages served from this machine may use the proxy.
+LOOPBACK_ORIGIN = re.compile(
+    r"https?://(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]{1,5})?"
+)
+_CONTROL = re.compile(r"[\x00-\x1f\x7f]")
+_C0_C1_DEL = re.compile(r"[\x00-\x1f\x7f-\x9f]")
+
+
+def allowed_hosts(port: int) -> set[str]:
+    """Host values that name a listener on 127.0.0.1:`port`."""
+    hosts = {f"127.0.0.1:{port}", f"localhost:{port}"}
+    if port == 80:
+        hosts |= {"127.0.0.1", "localhost"}
+    return hosts
+
+
+def refusal_reason(hosts: list[str], origins: list[str], port: int) -> str | None:
+    """ "host" or "origin" if the request is refused, None to accept it.
+
+    Host must be 127.0.0.1:PORT or localhost:PORT in any case (a bare host
+    on port 80). Origin may be absent (native clients) or a loopback page
+    origin; anything else, "null" included, is refused.
+    """
+    if len(hosts) != 1 or hosts[0].lower() not in allowed_hosts(port):
+        return "host"
+    if origins and (
+        len(origins) != 1 or not LOOPBACK_ORIGIN.fullmatch(origins[0].lower())
+    ):
+        return "origin"
+    return None
+
+
+def printable(text: str) -> str:
+    """`text` from a request as plain ASCII: control characters and anything
+    non-ASCII become backslash escapes."""
+    text = text.encode("ascii", "backslashreplace").decode("ascii")
+    return _CONTROL.sub(lambda m: f"\\x{ord(m.group()):02x}", text)
+
+
+def untrusted(text: str, style: str = "") -> Text:
+    """`text` from a request for rich to print as it is: a Text object, so
+    neither markup nor :emoji: codes in it are interpreted."""
+    return Text(printable(text), style=style)
+
+
+def readable(text: str, style: str = "") -> Text:
+    """Text from upstream (transcripts) for rich to print as it is: a Text
+    object, so markup and :emoji: codes aren't interpreted, with C0 and C1
+    control characters and DEL removed and all other Unicode kept."""
+    return Text(_C0_C1_DEL.sub("", text), style=style)
diff --git a/packages/deepctl-cmd-debug-probe/src/deepctl_cmd_debug_probe/command.py b/packages/deepctl-cmd-debug-probe/src/deepctl_cmd_debug_probe/command.py
index 9a800cdd..fd67c637 100644
--- a/packages/deepctl-cmd-debug-probe/src/deepctl_cmd_debug_probe/command.py
+++ b/packages/deepctl-cmd-debug-probe/src/deepctl_cmd_debug_probe/command.py
@@ -28,6 +28,30 @@ def _find_available_port(start: int = 3100, end: int = 3199) -> int | None:
     return None
 
 
+def _handle_sigint(loop: Any, callback: Any) -> tuple[bool, Any]:
+    """Run `callback` on the event loop for SIGINT (POSIX), so Ctrl+C never
+    lands inside a connection handler. Returns whether it was installed and
+    the handler it replaced, to put back afterwards.
+
+    SIGINT is left exactly as it is when it isn't ours to replace: ignored
+    (a background job in a script starts with SIGINT ignored, or `trap ''
+    INT`), so the proxy keeps running as before; or a handler not installed
+    from Python (`signal.getsignal` returns None), which `signal.signal`
+    couldn't restore. Where the loop can't take signals (Windows), Ctrl+C
+    raises KeyboardInterrupt instead.
+    """
+    import signal
+
+    previous = signal.getsignal(signal.SIGINT)
+    if previous is signal.SIG_IGN or previous is None:
+        return False, previous
+    try:
+        loop.add_signal_handler(signal.SIGINT, callback)
+    except (NotImplementedError, RuntimeError, ValueError):
+        return False, previous
+    return True, previous
+
+
 class ProbeCommand(BaseCommand):
     """WebSocket proxy with periodic ffprobe analysis of streaming audio."""
 
@@ -95,8 +119,7 @@ def handle(
     ) -> Any:
         """Handle debug probe command execution."""
         import asyncio
-
-        from aiohttp import web
+        import signal
 
         from .proxy import ProbeProxy
 
@@ -173,27 +196,40 @@ def handle(
 
         # Run the proxy server
         start_time = time.time()
-        app = web.Application()
-        app.router.add_route("GET", "/{path:.*}", proxy.handle_connection)
-
+        loop = asyncio.new_event_loop()
+        asyncio.set_event_loop(loop)
+
+        def interrupt() -> None:
+            """First Ctrl+C: stop listening, let open connections finish and
+            print their summaries. Second: end them now."""
+            if proxy._stop.is_set():
+                proxy.abort()
+            else:
+                console.print("\n[yellow]Shutting down probe proxy...[/yellow]")
+                proxy._stop.set()
+
+        installed, previous = _handle_sigint(loop, interrupt)
+        serve_task = loop.create_task(proxy.run(port))
         try:
-            loop = asyncio.new_event_loop()
-            asyncio.set_event_loop(loop)
-
-            runner = web.AppRunner(app)
-            loop.run_until_complete(runner.setup())
-
-            site = web.TCPSite(runner, "127.0.0.1", port)
-            loop.run_until_complete(site.start())
-
-            # Run until Ctrl+C
-            loop.run_forever()
-
-        except KeyboardInterrupt:
-            console.print("\n[yellow]Shutting down probe proxy...[/yellow]")
+            while True:
+                try:
+                    # Run until Ctrl+C
+                    loop.run_until_complete(serve_task)
+                    break
+                except KeyboardInterrupt:
+                    # Windows, or wherever the loop doesn't take SIGINT.
+                    if serve_task.done():  # it landed inside the task
+                        serve_task.exception()
+                        break
+                    interrupt()
         finally:
-            loop.run_until_complete(runner.cleanup())
-            loop.close()
+            try:
+                loop.run_until_complete(loop.shutdown_default_executor())
+            finally:
+                if installed:
+                    loop.remove_signal_handler(signal.SIGINT)
+                    signal.signal(signal.SIGINT, previous)
+                loop.close()
 
         duration = time.time() - start_time
 
diff --git a/packages/deepctl-cmd-debug-probe/src/deepctl_cmd_debug_probe/proxy.py b/packages/deepctl-cmd-debug-probe/src/deepctl_cmd_debug_probe/proxy.py
index b4488342..ba2834cd 100644
--- a/packages/deepctl-cmd-debug-probe/src/deepctl_cmd_debug_probe/proxy.py
+++ b/packages/deepctl-cmd-debug-probe/src/deepctl_cmd_debug_probe/proxy.py
@@ -3,56 +3,61 @@
 from __future__ import annotations
 
 import asyncio
+import contextlib
 import json
-import re
+import logging
+import os
+import signal
+import tempfile
 import time
 import uuid
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Any
+from urllib.parse import urlsplit
 
-import aiohttp
-from aiohttp import web
-from deepctl_core.websocket import RedirectRefused, redirect_refused
-from deepctl_shared_utils import probe_buffer
+from deepctl_core.websocket import RedirectRefused
+from deepctl_shared_utils.ffprobe import (
+    _parse_probe_data,  # lockstep sibling; same parsing as probe_buffer
+    get_ffprobe_path,
+)
 from rich.console import Console
-from rich.markup import escape
+from rich.text import Text
+from websockets.asyncio.server import Server, ServerConnection, serve
+from websockets.exceptions import ConnectionClosed, WebSocketException
 
+from .access import readable, refusal_reason, untrusted
 from .models import ProbeConnectionStats, ProbeSnapshot
 
 if TYPE_CHECKING:
     from deepctl_core import Config
+    from deepctl_shared_utils.ffprobe_models import AudioProbeResult
+    from websockets.asyncio.client import ClientConnection
+    from websockets.http11 import Request, Response
 
 console = Console()
 
-# Browsers send Origin on every WebSocket handshake; native clients usually
-# send none. Only pages served from this machine may use the proxy.
-_LOOPBACK_ORIGIN = re.compile(
-    r"https?://(?:localhost|127\.0\.0\.1|\[::1\])(?::[0-9]{1,5})?"
-)
+# Frames up to 4 MiB each way, the limit earlier releases allowed.
+MAX_FRAME_BYTES = 4 * 2**20
 
 
-def _refuse_redirects(upstream_url: str) -> aiohttp.TraceConfig:
-    """A trace hook that stops aiohttp before it follows a redirect.
+def _quiet_logger(name: str) -> logging.Logger:
+    """A logger that never writes headers (the upstream one carries the API
+    key) anywhere, whatever the root logger's level or handlers."""
+    logger = logging.getLogger(f"deepctl.debug.probe.{name}")
+    if not logger.handlers:
+        logger.addHandler(logging.NullHandler())
+    logger.propagate = False
+    logger.setLevel(logging.CRITICAL + 1)
+    return logger
 
-    aiohttp's ws_connect has no allow_redirects switch; it follows a 3xx
-    on the upgrade and would then stream the audio to the new host. The
-    hook runs after the 3xx arrives and before any request to the new
-    location, so nothing reaches it.
-    """
 
-    async def on_redirect(
-        _session: aiohttp.ClientSession,
-        _ctx: object,
-        params: aiohttp.TraceRequestRedirectParams,
-    ) -> None:
-        location = params.response.headers.get("Location")
-        params.response.close()
-        raise redirect_refused(
-            upstream_url, location, command="dg debug probe", payload="audio"
-        )
+def _refuse(connection: ServerConnection, status: int, text: str) -> Response:
+    """A fixed plain-text response; nothing from the request is echoed.
 
-    trace = aiohttp.TraceConfig()
-    trace.on_request_redirect.append(on_redirect)
-    return trace
+    connection.respond() also marks the handshake as refused, so websockets
+    never runs the handler, and never connects upstream, for it (13.x would
+    for a hand-built Response).
+    """
+    return connection.respond(status, text)
 
 
 class ProbeProxy:
@@ -78,6 +83,17 @@ def __init__(
         self.probe_interval_seconds = probe_interval_seconds
         self.verbose = verbose
         self.connections: list[ProbeConnectionStats] = []
+        # Where connections go: wss:// plus the fixed host, then the client's
+        # path and query. Tests point it at a loopback ws:// server.
+        self._upstream_base = f"wss://{upstream_host}"
+        self._stop = asyncio.Event()
+        # Open client and upstream connections, and pending upstream
+        # connects, so a second Ctrl+C can end them at once.
+        self._live: set[Any] = set()
+        self._connecting: set[asyncio.Future[Any]] = set()
+        self._aborting = False
+        self._ffprobes: set[asyncio.subprocess.Process] = set()
+        self._reaping: set[asyncio.Future[None]] = set()
 
     def _detect_stream_type(self, path: str) -> str:
         """Detect stream type from the request path."""
@@ -89,48 +105,105 @@ def _detect_stream_type(self, path: str) -> str:
             return "agent"
         return "unknown"
 
-    def _refusal_reason(self, request: web.Request) -> str | None:
-        """Return why a connection is refused, or None to accept it.
-
-        Host must name this listener as 127.0.0.1:PORT or localhost:PORT.
-        Origin may be absent (native clients) or a loopback page origin;
-        anything else, including "null", is refused.
+    def process_request(
+        self, connection: ServerConnection, request: Request
+    ) -> Response | None:
+        """Accept only a WebSocket upgrade from a local page or a native
+        client, checked before the handshake and before any upstream
+        connection: the Host must name this listener and an Origin, if sent,
+        must be a page on this machine (see `access`).
         """
-        sockname = (
-            request.transport.get_extra_info("sockname")
-            if request.transport is not None
-            else None
+        # websockets < 17 closes the connection on other methods itself,
+        # without a response.
+        if getattr(request, "method", "GET") != "GET":
+            return _refuse(connection, 405, "Method not allowed.\n")
+        if not request.path.startswith("/"):
+            return _refuse(connection, 400, "Bad request.\n")
+        origins = request.headers.get_all("Origin")
+        reason = refusal_reason(
+            request.headers.get_all("Host"), origins, connection.local_address[1]
         )
-        if not sockname:
-            return "host"
-        port = sockname[1]
-        allowed_hosts = {f"127.0.0.1:{port}", f"localhost:{port}"}
-        if port == 80:
-            allowed_hosts |= {"127.0.0.1", "localhost"}
-        hosts = request.headers.getall("Host", [])
-        if len(hosts) != 1 or hosts[0].lower() not in allowed_hosts:
-            return "host"
-        origins = request.headers.getall("Origin", [])
-        if not origins:
-            return None
-        if len(origins) != 1 or not _LOOPBACK_ORIGIN.fullmatch(origins[0].lower()):
-            return "origin"
+        if reason == "origin":
+            console.print(
+                Text("Refused a connection from ", style="yellow"),
+                untrusted(", ".join(origins)),
+                Text(": only pages on this machine can connect.", style="yellow"),
+                sep="",
+            )
+        if reason is not None:
+            return _refuse(connection, 403, "Forbidden.\n")
+        if "websocket" not in request.headers.get("Upgrade", "").lower():
+            return _refuse(connection, 400, "Bad request.\n")
         return None
 
-    async def handle_connection(self, request: web.Request) -> web.StreamResponse:
-        """Handle an incoming WebSocket connection."""
-        # Checked before the handshake and before anything is sent upstream.
-        reason = self._refusal_reason(request)
-        if reason is not None:
-            console.print(escape(f"[conn] refused: {reason} not allowed"))
-            return web.Response(status=403, text="Forbidden\n")
+    async def _connect_upstream(
+        self, url: str, headers: dict[str, str]
+    ) -> ClientConnection:
+        """Open the upstream WebSocket. The API key goes only here, and a
+        redirect on the upgrade is refused (``RedirectRefused``), never
+        followed."""
+        from deepctl_core.websocket import open_async
+
+        conn: ClientConnection = await open_async(
+            url,
+            headers,
+            command="dg debug probe",
+            payload="audio",
+            open_timeout=10,
+            close_timeout=30,
+            max_size=MAX_FRAME_BYTES,
+            compression=None,
+            ping_interval=None,
+            logger=_quiet_logger("upstream"),
+        )
+        return conn
+
+    async def start(self, port: int) -> Server:
+        """Listen on 127.0.0.1:`port` (0 for any free port)."""
+        server: Server = await serve(
+            self.handle_connection,
+            "127.0.0.1",
+            port,
+            process_request=self.process_request,
+            max_size=MAX_FRAME_BYTES,
+            ping_interval=None,
+            server_header=None,
+            logger=_quiet_logger("server"),
+        )
+        return server
 
-        ws_client = web.WebSocketResponse()
-        await ws_client.prepare(request)
+    def abort(self) -> None:
+        """End every open connection now, without close handshakes.
 
+        For a second Ctrl+C: running ffprobe snapshots are stopped and the
+        final probe is skipped; each handler still prints its summary, and
+        `run` returns once they have.
+        """
+        self._aborting = True
+        self._stop.set()
+        for task in list(self._connecting):
+            task.cancel()
+        for conn in list(self._live):
+            conn.transport.abort()
+        for proc in list(self._ffprobes):
+            self._reaping.add(asyncio.ensure_future(self._stop_ffprobe(proc)))
+
+    async def run(self, port: int) -> None:
+        """Serve until `_stop` is set or this task is cancelled; then close
+        the listener and wait for every connection's summary."""
+        server = await self.start(port)
+        try:
+            await self._stop.wait()
+        finally:
+            server.close()
+            await server.wait_closed()
+            await asyncio.gather(*self._reaping)
+
+    async def handle_connection(self, ws_client: ServerConnection) -> None:
+        """Handle an incoming WebSocket connection."""
         conn_id = str(uuid.uuid4())[:8]
-        path = request.path
-        query_string = request.query_string
+        target = ws_client.request.path  # type: ignore[union-attr]
+        path = urlsplit(target).path
         stream_type = self._detect_stream_type(path)
 
         stats = ProbeConnectionStats(
@@ -140,56 +213,88 @@ async def handle_connection(self, request: web.Request) -> web.StreamResponse:
         )
         self.connections.append(stats)
 
-        upstream_url = f"wss://{self.upstream_host}{path}"
-        if query_string:
-            upstream_url = f"{upstream_url}?{query_string}"
+        upstream_url = self._upstream_base + target
 
         upstream_headers = {
             "Authorization": f"Token {self.api_key}",
         }
 
         console.print(
-            f"\n[green]New connection[/green] [{conn_id}] "
-            f"type={stream_type} path={path}"
+            Text.from_markup(
+                f"\n[green]New connection[/green] [{conn_id}] type={stream_type} path="
+            ),
+            untrusted(path),
+            sep="",
         )
 
         start_time = time.time()
         last_probe_time = start_time
         last_probe_bytes = 0
 
+        ws_upstream: ClientConnection | None = None
+        dropped = [0, 0]  # frames and bytes read but not relayed while stopping
+        self._live.add(ws_client)
         try:
-            async with (
-                aiohttp.ClientSession(
-                    trace_configs=[_refuse_redirects(upstream_url)]
-                ) as session,
-                session.ws_connect(
-                    upstream_url,
-                    headers=upstream_headers,
-                    timeout=aiohttp.ClientWSTimeout(ws_close=30.0),
-                ) as ws_upstream,
-            ):
+            connecting = asyncio.ensure_future(
+                self._connect_upstream(upstream_url, upstream_headers)
+            )
+            self._connecting.add(connecting)
+            try:
+                ws_upstream = await connecting
+            except RedirectRefused as e:
+                console.print(
+                    Text.from_markup(
+                        f"[red]Upstream connection refused[/red] [{conn_id}]: "
+                    ),
+                    untrusted(e.message),
+                    sep="",
+                )
+                return
+            except (WebSocketException, OSError, asyncio.TimeoutError) as e:
+                console.print(
+                    Text.from_markup(
+                        f"[red]Upstream connection failed[/red] [{conn_id}]: "
+                    ),
+                    untrusted(str(e)),
+                    sep="",
+                )
+                return
+            except asyncio.CancelledError:
+                if not self._aborting:
+                    raise
+                return  # abort() during the upstream handshake
+            finally:
+                self._connecting.discard(connecting)
+
+            self._live.add(ws_upstream)
+            async with ws_upstream:
 
                 async def forward_client_to_upstream() -> None:
                     nonlocal last_probe_time, last_probe_bytes
 
                     async for msg in ws_client:
-                        if msg.type == aiohttp.WSMsgType.BINARY:
-                            stats.bytes_sent += len(msg.data)
+                        if self._stop.is_set():
+                            # Shutting down: read past what the client queued
+                            # (so its close frame arrives) without relaying it
+                            # or probing it snapshot by snapshot.
+                            dropped[0] += 1
+                            dropped[1] += len(msg)
+                            continue
+                        if isinstance(msg, bytes):
+                            stats.bytes_sent += len(msg)
                             stats.frames_sent += 1
 
                             # Keep only the tail of the buffer to bound memory
-                            stats.audio_buffer += msg.data
+                            stats.audio_buffer += msg
                             if len(stats.audio_buffer) > self.MAX_BUFFER_BYTES:
                                 stats.audio_buffer = stats.audio_buffer[
                                     -self.MAX_BUFFER_BYTES :
                                 ]
 
-                            await ws_upstream.send_bytes(msg.data)
+                            await ws_upstream.send(msg)
 
                             if self.verbose:
-                                console.print(
-                                    f"  [dim]→ binary {len(msg.data)} bytes[/dim]"
-                                )
+                                console.print(f"  [dim]→ binary {len(msg)} bytes[/dim]")
 
                             # Check probe thresholds
                             now = time.time()
@@ -200,84 +305,147 @@ async def forward_client_to_upstream() -> None:
                                 bytes_since >= self.probe_interval_bytes
                                 or time_since >= self.probe_interval_seconds
                             ):
-                                self._run_probe_snapshot(stats, now)
+                                await self._run_probe_snapshot(stats, now)
                                 last_probe_time = now
                                 last_probe_bytes = stats.bytes_sent
-
-                        elif msg.type == aiohttp.WSMsgType.TEXT:
+                        else:
                             stats.text_frames_sent += 1
-                            await ws_upstream.send_str(msg.data)
-                        elif msg.type in (
-                            aiohttp.WSMsgType.CLOSE,
-                            aiohttp.WSMsgType.ERROR,
-                        ):
-                            break
+                            await ws_upstream.send(msg)
 
                 async def forward_upstream_to_client() -> None:
                     async for msg in ws_upstream:
-                        if ws_client.closed:
-                            break
-
-                        if msg.type == aiohttp.WSMsgType.BINARY:
-                            stats.bytes_received += len(msg.data)
+                        if isinstance(msg, bytes):
+                            stats.bytes_received += len(msg)
                             stats.frames_received += 1
-                            await ws_client.send_bytes(msg.data)
-                        elif msg.type == aiohttp.WSMsgType.TEXT:
+                            await ws_client.send(msg)
+                        else:
                             stats.text_frames_received += 1
-                            await ws_client.send_str(msg.data)
+                            await ws_client.send(msg)
 
                             # Parse transcript from Deepgram response
-                            self._parse_transcript(msg.data, stats)
-                        elif msg.type in (
-                            aiohttp.WSMsgType.CLOSE,
-                            aiohttp.WSMsgType.ERROR,
-                        ):
-                            break
-
-                # Run both forwarders concurrently. If one fails,
-                # cancel the other instead of letting it dangle.
-                task_c2u = asyncio.ensure_future(forward_client_to_upstream())
-                task_u2c = asyncio.ensure_future(forward_upstream_to_client())
-                try:
-                    await asyncio.gather(task_c2u, task_u2c)
-                except Exception:
-                    pass
-                finally:
-                    for task in (task_c2u, task_u2c):
-                        if not task.done():
-                            task.cancel()
-                    # Suppress CancelledError from the cancelled task
-                    await asyncio.gather(task_c2u, task_u2c, return_exceptions=True)
-
-        except RedirectRefused as e:
+                            self._parse_transcript(msg, stats)
+
+                await self._relay(
+                    forward_client_to_upstream(), forward_upstream_to_client()
+                )
+
+        except Exception as e:
             console.print(
-                f"[red]Upstream connection refused[/red] [{conn_id}]: "
-                f"{escape(e.message)}"
+                Text.from_markup(f"[red]Connection error[/red] [{conn_id}]: "),
+                untrusted(str(e)),
+                sep="",
             )
-        except aiohttp.ClientError as e:
-            console.print(f"[red]Upstream connection failed[/red] [{conn_id}]: {e}")
-        except Exception as e:
-            console.print(f"[red]Connection error[/red] [{conn_id}]: {e}")
         finally:
+            self._live.difference_update({ws_client, ws_upstream})
             stats.duration_seconds = time.time() - start_time
 
-            # Final probe
-            if stats.audio_buffer:
+            # Final probe (not after a second Ctrl+C)
+            if stats.audio_buffer and not self._aborting:
                 console.print(f"\n[bold]Final probe[/bold] [{conn_id}]:")
-                self._run_probe_snapshot(stats, time.time())
-
-            self._print_connection_summary(stats)
+                await self._run_probe_snapshot(stats, time.time())
 
-            if not ws_client.closed:
-                await ws_client.close()
+            self._print_connection_summary(stats, *dropped)
 
-        return ws_client
+            await ws_client.close(1000)
 
-    def _run_probe_snapshot(
+    async def _probe(self, audio: bytes) -> AudioProbeResult | None:
+        """ffprobe the audio, as probe_buffer does, as an asyncio subprocess:
+        other connections and Ctrl+C aren't held up, and abort() can stop it.
+        """
+        ffprobe_bin = get_ffprobe_path(self.config) if audio else None
+        if not ffprobe_bin:
+            return None
+        tmp_name = None
+        try:
+            with tempfile.NamedTemporaryFile(
+                suffix=".raw", delete=False, prefix="deepctl_probe_"
+            ) as tmp_file:
+                tmp_name = tmp_file.name
+                tmp_file.write(audio)
+            proc = await asyncio.create_subprocess_exec(
+                ffprobe_bin,
+                "-v",
+                "quiet",
+                "-print_format",
+                "json",
+                "-show_format",
+                "-show_streams",
+                tmp_name,
+                stdin=asyncio.subprocess.DEVNULL,
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.DEVNULL,
+                # its own process group, so stopping it also stops anything
+                # it started (a wrapper script's children hold stdout open)
+                start_new_session=True,
+            )
+            self._ffprobes.add(proc)
+            try:
+                out, _ = await asyncio.wait_for(proc.communicate(), 10)
+            except asyncio.TimeoutError:
+                await self._stop_ffprobe(proc)
+                return None
+            finally:
+                self._ffprobes.discard(proc)
+            if proc.returncode != 0:
+                return None
+            return _parse_probe_data(json.loads(out))
+        except (json.JSONDecodeError, OSError):
+            return None
+        finally:
+            if tmp_name:
+                with contextlib.suppress(OSError):
+                    os.unlink(tmp_name)
+
+    @staticmethod
+    async def _stop_ffprobe(proc: asyncio.subprocess.Process) -> None:
+        """SIGTERM to ffprobe's process group, up to 1 s to exit, then
+        SIGKILL."""
+
+        def send(sig: int) -> None:
+            with contextlib.suppress(ProcessLookupError, PermissionError):
+                if hasattr(os, "killpg"):
+                    os.killpg(proc.pid, sig)
+                else:  # Windows
+                    proc.send_signal(sig)
+
+        if proc.returncode is not None:
+            return
+        send(signal.SIGTERM)
+        try:
+            await asyncio.wait_for(proc.wait(), 1)
+        except asyncio.TimeoutError:
+            send(getattr(signal, "SIGKILL", signal.SIGTERM))
+            await proc.wait()
+
+    @staticmethod
+    async def _relay(*directions: Any) -> None:
+        """Run both directions; when either ends (a close, an error, or the
+        other side going away) cancel the other."""
+
+        async def quietly(direction: Any) -> None:
+            try:
+                await direction
+            except ConnectionClosed:
+                pass
+
+        tasks = [asyncio.ensure_future(quietly(d)) for d in directions]
+        try:
+            await asyncio.wait(tasks, return_when=asyncio.FIRST_COMPLETED)
+        finally:
+            for task in tasks:
+                if not task.done():
+                    task.cancel()
+            # Suppress CancelledError from the cancelled task
+            results = await asyncio.gather(*tasks, return_exceptions=True)
+        for result in results:
+            if isinstance(result, Exception):
+                raise result
+
+    async def _run_probe_snapshot(
         self, stats: ProbeConnectionStats, timestamp: float
     ) -> None:
         """Run a probe snapshot on the accumulated audio buffer."""
-        result = probe_buffer(stats.audio_buffer, "probe", self.config)
+        result = await self._probe(stats.audio_buffer)
         snapshot = ProbeSnapshot(
             timestamp=timestamp,
             bytes_at_probe=stats.bytes_sent,
@@ -323,13 +491,18 @@ def _parse_transcript(self, text: str, stats: ProbeConnectionStats) -> None:
                 if transcript and is_final:
                     stats.transcripts.append(transcript)
                     console.print(
-                        f"  [green]transcript[/green] [{stats.connection_id}]: "
-                        f"{transcript[:120]}"
+                        Text.from_markup(
+                            f"  [green]transcript[/green] [{stats.connection_id}]: "
+                        ),
+                        readable(transcript[:120]),
+                        sep="",
                     )
         except (json.JSONDecodeError, AttributeError):
             pass
 
-    def _print_connection_summary(self, stats: ProbeConnectionStats) -> None:
+    def _print_connection_summary(
+        self, stats: ProbeConnectionStats, dropped: int = 0, dropped_bytes: int = 0
+    ) -> None:
         """Print summary for a completed connection."""
         console.print(f"\n[blue]Connection closed[/blue] [{stats.connection_id}]")
         console.print(f"  Type: {stats.stream_type}")
@@ -348,6 +521,12 @@ def _print_connection_summary(self, stats: ProbeConnectionStats) -> None:
             f"({stats.frames_received} binary, "
             f"{stats.text_frames_received} text frames)"
         )
+        if dropped:
+            console.print(
+                "  Not forwarded (arrived while stopping): "
+                f"{dropped_bytes:,} {'byte' if dropped_bytes == 1 else 'bytes'} "
+                f"({dropped} {'frame' if dropped == 1 else 'frames'})"
+            )
         console.print(f"  Probe snapshots: {len(stats.snapshots)}")
         if stats.transcripts:
             console.print(f"  Transcripts received: {len(stats.transcripts)}")
diff --git a/packages/deepctl-cmd-debug-probe/tests/unit/test_probe.py b/packages/deepctl-cmd-debug-probe/tests/unit/test_probe.py
index 0cb0d903..34fa059d 100644
--- a/packages/deepctl-cmd-debug-probe/tests/unit/test_probe.py
+++ b/packages/deepctl-cmd-debug-probe/tests/unit/test_probe.py
@@ -1,13 +1,9 @@
 """Tests for debug probe command and proxy."""
 
-import asyncio
-import io
 import json
 from unittest.mock import Mock, patch
 
-import aiohttp
 import pytest
-from aiohttp import web
 from deepctl_cmd_debug_probe.command import ProbeCommand, _find_available_port
 from deepctl_cmd_debug_probe.models import (
     ProbeConnectionStats,
@@ -15,7 +11,6 @@
     ProbeSnapshot,
 )
 from deepctl_cmd_debug_probe.proxy import ProbeProxy
-from rich.console import Console
 
 
 class TestModels:
@@ -191,31 +186,24 @@ def test_all_ports_taken(self, mock_socket_cls):
         assert port is None
 
 
-_REAL_SESSION = aiohttp.ClientSession
-
-
-class _PlainUpstream:
-    """A real aiohttp session whose ws_connect goes over plain http to a
-    loopback stub instead of wss. It takes the same arguments as
-    ClientSession, so the proxy's trace hook is installed as usual."""
-
-    def __init__(self, *args, **kwargs):
-        self._session = _REAL_SESSION(*args, **kwargs)
-
-    async def __aenter__(self):
-        await self._session.__aenter__()
-        return self
-
-    async def __aexit__(self, *exc):
-        return await self._session.__aexit__(*exc)
-
-    def ws_connect(self, url, **kwargs):
-        return self._session.ws_connect(url.replace("wss://", "http://", 1), **kwargs)
+IMPORT_CHECK = (
+    "import sys, deepctl_core; before = set(sys.modules); "
+    "import deepctl_cmd_debug_probe.command; "
+    "bad = sorted(m for m in set(sys.modules) - before for f in "
+    "('asyncio', 'ssl', 'websockets', 'aiohttp') if m == f or m.startswith(f + '.')); "
+    "print(' '.join(bad))"
+)
 
 
 def _probe_through_redirect(location: str):
     """Proxy one client stream to an upstream that answers the upgrade with
     a redirect. Returns (origin requests, target requests, console text)."""
+    import asyncio
+    import io
+
+    from rich.console import Console
+    from websockets.asyncio.client import connect as ws_connect
+
     origin_reqs: list[bytes] = []
     target_reqs: list[bytes] = []
 
@@ -242,37 +230,33 @@ async def target(reader, writer):
             target_reqs.append(await read_head(reader) or b"<conn>")
             writer.close()
 
+        stubs = []
         for name, handler in (("origin", origin), ("target", target)):
             srv = await asyncio.start_server(handler, "127.0.0.1", 0)
+            stubs.append(srv)
             ports[name] = srv.sockets[0].getsockname()[1]
 
-        proxy = ProbeProxy(
-            api_key="fa1ce0000000000000000000000000000000000d",
-            upstream_host=f"127.0.0.1:{ports['origin']}",
-        )
-        app = web.Application()
-        app.router.add_route("GET", "/{path:.*}", proxy.handle_connection)
-        runner = web.AppRunner(app)
-        await runner.setup()
-        site = web.TCPSite(runner, "127.0.0.1", 0)
-        await site.start()
-        port = runner.addresses[0][1]
+        proxy = ProbeProxy(api_key="fa1ce0000000000000000000000000000000000d")
+        proxy._upstream_base = f"ws://127.0.0.1:{ports['origin']}"
+        server = await proxy.start(0)
+        port = next(iter(server.sockets)).getsockname()[1]
         try:
-            async with _REAL_SESSION() as client:
-                ws = await client.ws_connect(f"http://127.0.0.1:{port}/v1/listen?x=1")
-                await ws.send_bytes(b"\0\0" * 800)
-                await asyncio.wait_for(ws.receive(), 5)
-                await ws.close()
+            async with ws_connect(f"ws://127.0.0.1:{port}/v1/listen?x=1") as ws:
+                await ws.send(b"\0\0" * 800)
+                try:
+                    await asyncio.wait_for(ws.recv(), 5)
+                except Exception:
+                    pass
         finally:
-            await runner.cleanup()
+            server.close()
+            await server.wait_closed()
+            for srv in stubs:
+                srv.close()
 
     out = io.StringIO()
-    with (
-        patch("deepctl_cmd_debug_probe.proxy.aiohttp.ClientSession", _PlainUpstream),
-        patch(
-            "deepctl_cmd_debug_probe.proxy.console",
-            Console(file=out, force_terminal=False, width=300),
-        ),
+    with patch(
+        "deepctl_cmd_debug_probe.proxy.console",
+        Console(file=out, force_terminal=False, width=300),
     ):
         asyncio.run(run())
     return origin_reqs, target_reqs, out.getvalue()
@@ -281,7 +265,6 @@ async def target(reader, writer):
 class TestProbeUpstreamRedirect:
     """The upstream connect never follows a redirect."""
 
-    # aiohttp follows http(s) Locations itself; ws:// ones it rejects.
     @pytest.mark.parametrize(
         "location", ["http://{target}/second", "ws://{target}/second", "/second"]
     )
@@ -289,6 +272,7 @@ def test_redirect_refused_and_nothing_reaches_the_target(self, location):
         origin, target, text = _probe_through_redirect(location)
         assert target == []
         assert len(origin) == 1
+        assert b"Token fa1ce0" in origin[0]
         assert "Upstream connection refused" in text
         assert "dg debug probe doesn't follow redirects, so no audio was sent." in (
             " ".join(text.split())
@@ -296,94 +280,205 @@ def test_redirect_refused_and_nothing_reaches_the_target(self, location):
         assert "fa1ce0" not in text
 
 
-class _CountingSession:
-    """Stands in for aiohttp.ClientSession; counts upstream connect attempts."""
+def test_command_module_adds_no_network_stack_on_import():
+    """`dg debug probe --help` must not pay for websockets or asyncio."""
+    import subprocess
+    import sys
 
-    connects = 0
+    proc = subprocess.run(
+        [sys.executable, "-c", IMPORT_CHECK],
+        capture_output=True,
+        text=True,
+        timeout=120,
+    )
+    assert proc.returncode == 0, proc.stderr[-1500:]
+    assert proc.stdout.strip() == ""
 
-    def __init__(self, *args, **kwargs):
-        pass
 
-    async def __aenter__(self):
-        return self
+def _free_port() -> int:
+    import socket
 
-    async def __aexit__(self, *exc):
-        return False
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        return int(s.getsockname()[1])
 
-    def ws_connect(self, *args, **kwargs):
-        type(self).connects += 1
-        raise aiohttp.ClientError("no upstream in tests")
 
+def _run_probe(**proxy_hooks):
+    """Run ProbeCommand.handle with a fake key and ffprobe check. Each hook
+    is a callable(proxy, loop, port) run when the proxy starts serving."""
+    from deepctl_cmd_debug_probe import proxy as proxymod
 
-def _handshake(headers: list[tuple[str, str]] | None, host: str | None = None):
-    """Start a real proxy on 127.0.0.1, send one upgrade request, return
-    (status line, response bytes, upstream connects, console text).
+    original = proxymod.ProbeProxy.run
 
-    host is a format string; {port} becomes the listener's port.
-    """
+    async def run(self, port):
+        import asyncio
 
-    async def run():
-        proxy = ProbeProxy(api_key="fa1ce0000000000000000000000000000000000d")
-        app = web.Application()
-        app.router.add_route("GET", "/{path:.*}", proxy.handle_connection)
-        runner = web.AppRunner(app)
-        await runner.setup()
-        site = web.TCPSite(runner, "127.0.0.1", 0)
-        await site.start()
-        port = runner.addresses[0][1]
-        try:
-            reader, writer = await asyncio.open_connection("127.0.0.1", port)
-            lines = [
-                "GET /v1/listen?encoding=linear16 HTTP/1.1",
-                "Host: " + (host or "127.0.0.1:{port}").format(port=port),
-                "Upgrade: websocket",
-                "Connection: Upgrade",
-                "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==",
-                "Sec-WebSocket-Version: 13",
-            ]
-            lines += [f"{k}: {v}" for k, v in (headers or [])]
-            writer.write(("\r\n".join(lines) + "\r\n\r\n").encode())
-            await writer.drain()
-            data = await asyncio.wait_for(reader.read(4096), 5)
-            # Let an accepted handler reach the upstream connect.
-            for _ in range(50):
-                if _CountingSession.connects or not data.startswith(b"HTTP/1.1 101"):
-                    break
-                await asyncio.sleep(0.01)
-            writer.close()
-            return data
-        finally:
-            await runner.cleanup()
+        loop = asyncio.get_running_loop()
+        for hook in proxy_hooks.values():
+            hook(self, loop, port)
+        await original(self, port)
 
-    _CountingSession.connects = 0
-    out = io.StringIO()
+    auth = Mock()
+    auth.get_api_key.return_value = "fa1ce0000000000000000000000000000000000d"
     with (
-        patch("deepctl_cmd_debug_probe.proxy.aiohttp.ClientSession", _CountingSession),
-        patch(
-            "deepctl_cmd_debug_probe.proxy.console",
-            Console(file=out, force_terminal=False, width=200),
-        ),
+        patch("deepctl_cmd_debug_probe.command.require_ffprobe", return_value=True),
+        patch.object(proxymod.ProbeProxy, "run", run),
     ):
-        data = asyncio.run(run())
-    status = data.split(b"\r\n", 1)[0].decode()
-    return status, data, _CountingSession.connects, out.getvalue()
+        return ProbeCommand().handle(Mock(), auth, Mock(), port=_free_port())
+
+
+class TestInterrupt:
+    """Ctrl+C handling in handle(): POSIX signal handler, Windows fallback."""
+
+    def test_sigint_on_the_loop_stops_and_restores_the_previous_handler(
+        self, capsys
+    ):
+        import os
+        import signal
+
+        seen = []
+
+        def custom(signum, frame):  # pragma: no cover - never called
+            seen.append(signum)
+
+        old = signal.signal(signal.SIGINT, custom)
+        try:
+            result = _run_probe(
+                kill=lambda proxy, loop, port: loop.call_later(
+                    0.3, os.kill, os.getpid(), signal.SIGINT
+                )
+            )
+            assert signal.getsignal(signal.SIGINT) is custom
+        finally:
+            signal.signal(signal.SIGINT, old)
+        assert result.status == "success"
+        assert seen == []
+        assert "Shutting down probe proxy" in capsys.readouterr().out
+
+    def test_ignored_sigint_stays_ignored(self):
+        """A background job in a script starts with SIGINT ignored: kill -INT
+        must not stop the proxy, and SIGINT stays ignored afterwards."""
+        import json
+        import subprocess
+        import sys
+
+        code = """
+import json, os, signal, sys
+sys.path[:0] = {path!r}
+signal.signal(signal.SIGINT, signal.SIG_IGN)
+from test_probe import _run_probe
+def hooks(proxy, loop, port):
+    loop.call_later(0.3, os.kill, os.getpid(), signal.SIGINT)
+    loop.call_later(1.5, proxy._stop.set)
+result = _run_probe(hooks=hooks)
+ign = [l for l in open("/proc/self/status") if l.startswith("SigIgn")]
+print(json.dumps({{
+    "status": result.status,
+    "ignored": signal.getsignal(signal.SIGINT) is signal.SIG_IGN,
+    "sigign": ign[0].split()[1] if ign else None,
+}}))
+""".format(path=[str(__import__("pathlib").Path(__file__).parent)])
+        proc = subprocess.run(
+            [sys.executable, "-c", code], capture_output=True, text=True, timeout=60
+        )
+        assert proc.returncode == 0, proc.stderr[-2000:]
+        out = json.loads(proc.stdout.strip().splitlines()[-1])
+        assert out["status"] == "success"
+        assert out["ignored"] is True
+        if out["sigign"] is not None:  # Linux: the SIGINT bit is still set
+            assert int(out["sigign"], 16) & (1 << (2 - 1))
+        assert "Shutting down probe proxy" not in proc.stdout
+
+    def test_keyboard_interrupt_path_first_and_second_press(self, capsys):
+        """Where the loop can't take SIGINT (Windows), Ctrl+C raises
+        KeyboardInterrupt from the loop: the first stops listening and the
+        second aborts open connections."""
+        import time
+
+        from deepctl_cmd_debug_probe import command as cmdmod
+
+        def press(*_args):
+            raise KeyboardInterrupt
+
+        calls = []
+
+        def hooks(proxy, loop, port):
+            original = proxy.abort
+
+            def abort():
+                calls.append("abort")
+                original()
+
+            proxy.abort = abort
+            # keep a connection open so the first press can't finish at once
+            loop.create_task(_hold_connection(proxy, port))
+            loop.call_later(0.5, press)
+            loop.call_later(0.8, press)
+
+        with patch.object(
+            cmdmod, "_handle_sigint", lambda loop, cb: (False, None)
+        ):
+            t0 = time.monotonic()
+            result = _run_probe(hooks=hooks)
+        assert time.monotonic() - t0 < 10
+        assert result.status == "success"
+        assert calls == ["abort"]
+        assert "Shutting down probe proxy" in capsys.readouterr().out
+
+
+async def _hold_connection(proxy, port):
+    """Open a connection through `proxy` whose upstream never answers the
+    handshake, so shutdown waits for it until abort()."""
+    import asyncio
+
+    from websockets.asyncio.client import connect
+
+    async def never(reader, writer):
+        await reader.read()  # never answers; ends when the proxy hangs up
+        writer.close()
+
+    hang = await asyncio.start_server(never, "127.0.0.1", 0)
+    proxy._upstream_base = f"ws://127.0.0.1:{hang.sockets[0].getsockname()[1]}"
+    for _ in range(100):
+        try:
+            ws = await connect(f"ws://127.0.0.1:{port}/v1/listen")
+            break
+        except OSError:
+            await asyncio.sleep(0.02)
+    await ws.wait_closed()
+    hang.close()
 
 
 class TestProbeConnectionChecks:
-    """Only local pages and native clients may use the proxy."""
+    """0.4.2's Host and Origin cases, on the websockets proxy: checked in
+    process_request, before the handshake and any upstream connection."""
+
+    KEY = "fa1ce0000000000000000000000000000000000d"
+
+    def _status(self, headers, port=3100):
+        from websockets.datastructures import Headers
+        from websockets.http11 import Request
+
+        class Conn:
+            local_address = ("127.0.0.1", port)
 
-    def test_foreign_origin_refused_before_upstream(self):
-        status, data, connects, text = _handshake([("Origin", "https://evil.example")])
-        assert status == "HTTP/1.1 403 Forbidden"
-        assert connects == 0
-        assert b"evil" not in data
-        assert "[conn] refused: origin not allowed" in text
-        assert "evil" not in text
+            def respond(self, status, text):
+                assert text == "Forbidden.\n"
+                return status
+
+        if not any(k == "Host" for k, _ in headers):
+            headers = [("Host", f"127.0.0.1:{port}"), *headers]
+        request = Request(
+            "/v1/listen?encoding=linear16",
+            Headers([*headers, ("Upgrade", "websocket")]),
+        )
+        return ProbeProxy(api_key=self.KEY).process_request(Conn(), request)
+
+    def test_foreign_origin_refused(self):
+        assert self._status([("Origin", "https://evil.example")]) == 403
 
     def test_null_origin_refused(self):
-        status, _, connects, _ = _handshake([("Origin", "null")])
-        assert status == "HTTP/1.1 403 Forbidden"
-        assert connects == 0
+        assert self._status([("Origin", "null")]) == 403
 
     @pytest.mark.parametrize(
         "origin",
@@ -395,10 +490,7 @@ def test_null_origin_refused(self):
         ],
     )
     def test_loopback_origin_allowed(self, origin):
-        status, _, connects, text = _handshake([("Origin", origin)])
-        assert status == "HTTP/1.1 101 Switching Protocols"
-        assert connects == 1
-        assert "refused" not in text
+        assert self._status([("Origin", origin)]) is None
 
     @pytest.mark.parametrize(
         "origin",
@@ -411,33 +503,20 @@ def test_loopback_origin_allowed(self, origin):
         ],
     )
     def test_lookalike_origin_refused(self, origin):
-        status, _, connects, _ = _handshake([("Origin", origin)])
-        assert status == "HTTP/1.1 403 Forbidden"
-        assert connects == 0
+        assert self._status([("Origin", origin)]) == 403
 
     def test_two_origins_refused(self):
-        status, _, connects, _ = _handshake(
-            [("Origin", "http://localhost:5173"), ("Origin", "https://evil.example")]
-        )
-        assert status == "HTTP/1.1 403 Forbidden"
-        assert connects == 0
+        headers = [("Origin", "http://localhost:5173"), ("Origin", "https://evil.example")]
+        assert self._status(headers) == 403
 
     def test_no_origin_allowed(self):
-        status, _, connects, _ = _handshake([])
-        assert status == "HTTP/1.1 101 Switching Protocols"
-        assert connects == 1
+        assert self._status([]) is None
 
     def test_localhost_host_allowed_any_case(self):
-        status, _, connects, _ = _handshake([], host="LocalHost:{port}")
-        assert status == "HTTP/1.1 101 Switching Protocols"
-        assert connects == 1
+        assert self._status([("Host", "LocalHost:3100")]) is None
 
     @pytest.mark.parametrize(
         "host", ["evil.example:3100", "evil.example", "localhost", "127.0.0.1:1"]
     )
     def test_foreign_host_refused(self, host):
-        status, data, connects, text = _handshake([], host=host)
-        assert status == "HTTP/1.1 403 Forbidden"
-        assert connects == 0
-        assert b"evil" not in data
-        assert "[conn] refused: host not allowed" in text
+        assert self._status([("Host", host)]) == 403
diff --git a/packages/deepctl-cmd-debug-probe/tests/unit/test_proxy_loopback.py b/packages/deepctl-cmd-debug-probe/tests/unit/test_proxy_loopback.py
new file mode 100644
index 00000000..43eeda4b
--- /dev/null
+++ b/packages/deepctl-cmd-debug-probe/tests/unit/test_proxy_loopback.py
@@ -0,0 +1,737 @@
+"""The probe proxy against real loopback servers: relay, refusals, run loop.
+
+The upstream is a websockets server on a free 127.0.0.1 port, reached
+through the proxy's `_upstream_base` seam. Nothing is mocked.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import json
+import logging
+from typing import TYPE_CHECKING, Any
+
+import pytest
+from deepctl_cmd_debug_probe.proxy import ProbeProxy
+from websockets.asyncio.client import connect
+from websockets.asyncio.server import serve
+from websockets.exceptions import ConnectionClosed
+
+if TYPE_CHECKING:
+    from websockets.datastructures import Headers
+    from websockets.http11 import Response
+
+KEY = "fa1ce0000000000000000000000000000000000d"
+RESULTS = json.dumps(
+    {
+        "type": "Results",
+        "is_final": True,
+        "channel": {"alternatives": [{"transcript": "fake words"}]},
+    }
+)
+
+
+_SILENT = logging.getLogger("test.fake-upstream")
+_SILENT.propagate = False
+_SILENT.setLevel(logging.CRITICAL + 1)
+
+
+class FakeUpstream:
+    """Records each handshake's headers and echoes every frame back."""
+
+    def __init__(self, status: int = 101) -> None:
+        self.status = status
+        self.handshakes: list[Headers] = []
+        self.paths: list[str] = []
+        self.received: list[str | bytes] = []
+
+    def process_request(self, connection: Any, request: Any) -> Response | None:
+        self.handshakes.append(request.headers)
+        self.paths.append(request.path)
+        if self.status != 101:
+            return connection.respond(self.status, "Unauthorized.\n")
+        return None
+
+    async def handler(self, ws: Any) -> None:
+        await ws.send(RESULTS)
+        async for msg in ws:
+            self.received.append(msg)
+            await ws.send(msg)
+
+    async def __aenter__(self) -> FakeUpstream:
+        self.server = await serve(
+            self.handler,
+            "127.0.0.1",
+            0,
+            process_request=self.process_request,
+            max_size=8 * 2**20,
+            # The fake's own handshake log would show the key it receives.
+            logger=_SILENT,
+        )
+        self.port = next(iter(self.server.sockets)).getsockname()[1]
+        return self
+
+    async def __aexit__(self, *exc: object) -> None:
+        self.server.close()
+        await self.server.wait_closed()
+
+
+class Proxy:
+    """A ProbeProxy listening on a free port, pointed at `upstream`."""
+
+    def __init__(self, upstream: FakeUpstream) -> None:
+        self.proxy = ProbeProxy(api_key=KEY, probe_interval_bytes=10**9)
+        self.proxy._upstream_base = f"ws://127.0.0.1:{upstream.port}"
+
+    async def __aenter__(self) -> Proxy:
+        self.server = await self.proxy.start(0)
+        self.port = next(iter(self.server.sockets)).getsockname()[1]
+        return self
+
+    async def __aexit__(self, *exc: object) -> None:
+        self.server.close()
+        await self.server.wait_closed()
+
+
+async def _status(port: int, request: str) -> tuple[int, bytes]:
+    """Status and body; status 0 if the server closed without a response."""
+    reader, writer = await asyncio.open_connection("127.0.0.1", port)
+    writer.write(request.encode("latin-1"))
+    await writer.drain()
+    try:
+        head = await asyncio.wait_for(reader.readuntil(b"\r\n\r\n"), 10)
+    except asyncio.IncompleteReadError:
+        writer.close()
+        return 0, b""
+    status = int(head.split()[1])
+    body = b""
+    if status != 101:
+        body = await asyncio.wait_for(reader.read(), 10)
+    writer.close()
+    return status, body
+
+
+def _upgrade(port: int, target: str = "/v1/listen", **headers: str) -> str:
+    lines = [
+        f"GET {target} HTTP/1.1",
+        f"Host: {headers.pop('Host', f'127.0.0.1:{port}')}",
+        "Upgrade: websocket",
+        "Connection: Upgrade",
+        "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==",
+        "Sec-WebSocket-Version: 13",
+        *(f"{k}: {v}" for k, v in headers.items()),
+    ]
+    return "\r\n".join(lines) + "\r\n\r\n"
+
+
+def test_relay_preserves_frames_and_uses_only_the_proxy_key(capsys):
+    frames: list[str | bytes] = [bytes(range(256)) * 32 for _ in range(5)]
+    frames.insert(2, '{"type": "KeepAlive"}')
+    frames.append(b"\x01\x02" * 2**20)  # one 2 MiB frame
+
+    async def main() -> tuple[FakeUpstream, list[str | bytes], ProbeProxy]:
+        async with FakeUpstream() as up, Proxy(up) as px:
+            echoed: list[str | bytes] = []
+            url = f"ws://127.0.0.1:{px.port}/v1/listen?encoding=linear16&x=%20y"
+            async with connect(
+                url,
+                additional_headers={"Authorization": "Token client-own-key"},
+                subprotocols=["token", "client-subprotocol-key"],  # type: ignore[list-item]
+                max_size=8 * 2**20,
+            ) as ws:
+                assert await ws.recv() == RESULTS
+                for frame in frames:
+                    await ws.send(frame)
+                    echoed.append(await ws.recv())
+            for _ in range(100):
+                if px.proxy.connections[0].duration_seconds is not None:
+                    break
+                await asyncio.sleep(0.02)
+            return up, echoed, px.proxy
+
+    up, echoed, proxy = asyncio.run(main())
+
+    assert up.received == frames
+    assert echoed == frames
+    assert [type(f) for f in echoed] == [type(f) for f in frames]
+    digest = hashlib.sha256(b"".join(f for f in frames if isinstance(f, bytes)))
+    assert (
+        digest.hexdigest()
+        == hashlib.sha256(
+            b"".join(f for f in up.received if isinstance(f, bytes))
+        ).hexdigest()
+    )
+
+    (headers,) = up.handshakes
+    assert headers.get_all("Authorization") == [f"Token {KEY}"]
+    assert "Sec-WebSocket-Protocol" not in headers
+    assert up.paths == ["/v1/listen?encoding=linear16&x=%20y"]
+
+    (stats,) = proxy.connections
+    assert stats.path == "/v1/listen"
+    assert stats.stream_type == "stt"
+    assert stats.frames_sent == 6
+    assert stats.text_frames_sent == 1
+    assert stats.text_frames_received == 2
+    assert stats.frames_received == 6
+    assert stats.transcripts == ["fake words"]
+    assert len(stats.audio_buffer) == ProbeProxy.MAX_BUFFER_BYTES
+
+    out = capsys.readouterr()
+    assert KEY not in out.out + out.err
+
+
+@pytest.mark.parametrize(
+    "origin",
+    [None, "http://localhost:5173", "https://127.0.0.1", "http://[::1]:8080"],
+)
+def test_loopback_or_no_origin_is_accepted(origin):
+    async def main() -> int:
+        async with FakeUpstream() as up, Proxy(up) as px:
+            extra = {"Origin": origin} if origin else {}
+            status, _ = await _status(px.port, _upgrade(px.port, **extra))
+            return status
+
+    assert asyncio.run(main()) == 101
+
+
+@pytest.mark.parametrize(
+    "headers",
+    [
+        {"Origin": "https://evil.example"},
+        {"Origin": "null"},
+        {"Origin": "http://localhost.evil.example"},
+        {"Origin": "file://"},
+        {"Origin": "http://localhost:"},
+        {"Origin": "http://local\thost:5173"},
+        {"Host": "evil.example:{port}"},
+        {"Host": "127.0.0.1:1"},
+    ],
+    ids=lambda h: "-".join(f"{k}={v}" for k, v in h.items()),
+)
+def test_refused_before_any_upstream_connection(headers, capsys):
+    async def main() -> tuple[int, bytes, FakeUpstream]:
+        async with FakeUpstream() as up, Proxy(up) as px:
+            extra = {k: v.format(port=px.port) for k, v in headers.items()}
+            status, body = await _status(px.port, _upgrade(px.port, **extra))
+            return status, body, up
+
+    status, body, up = asyncio.run(main())
+    assert (status, body) == (403, b"Forbidden.\n")
+    assert up.handshakes == []
+    out = " ".join(capsys.readouterr().out.split())  # rich wraps at 80 columns
+    if "Origin" in headers:
+        shown = headers["Origin"].replace("\t", "\\x09")
+        assert (
+            f"Refused a connection from {shown}: "
+            "only pages on this machine can connect." in out
+        )
+
+
+def test_absolute_form_target_gets_400():
+    async def main() -> tuple[int, FakeUpstream]:
+        async with FakeUpstream() as up, Proxy(up) as px:
+            status, _ = await _status(
+                px.port, _upgrade(px.port, target="http://evil.example/v1/listen")
+            )
+            return status, up
+
+    status, up = asyncio.run(main())
+    assert status == 400
+    assert up.handshakes == []
+
+
+def test_plain_get_and_other_methods_are_refused(caplog):
+    caplog.set_level(logging.DEBUG)
+
+    async def main() -> list[int]:
+        async with FakeUpstream() as up, Proxy(up) as px:
+            plain = f"GET /v1/listen HTTP/1.1\r\nHost: 127.0.0.1:{px.port}\r\n\r\n"
+            post = plain.replace("GET", "POST", 1)
+            statuses = [(await _status(px.port, r))[0] for r in (plain, post)]
+            assert up.handshakes == []
+            return statuses
+
+    plain, post = asyncio.run(main())
+    assert plain == 400
+    # 405 from the proxy on websockets 17; older versions close without a reply
+    assert post in (0, 405)
+    assert "Traceback" not in caplog.text
+
+
+def test_markup_in_the_path_prints_literally(capsys):
+    async def main() -> None:
+        async with FakeUpstream() as up, Proxy(up) as px:
+            url = f"ws://127.0.0.1:{px.port}/v1/listen[bold]x"
+            ws = await connect(url)
+            await ws.recv()
+            await ws.close()
+
+    asyncio.run(main())
+    assert "path=/v1/listen[bold]x" in capsys.readouterr().out
+
+
+def test_upstream_401_reports_and_keeps_serving(capsys, caplog):
+    caplog.set_level(logging.DEBUG)
+
+    async def main() -> list[tuple[int | None, str | None]]:
+        closes = []
+        async with FakeUpstream(status=401) as up, Proxy(up) as px:
+            for _ in range(2):
+                async with connect(f"ws://127.0.0.1:{px.port}/v1/listen") as ws:
+                    with pytest.raises(ConnectionClosed):
+                        await ws.recv()
+                    closes.append((ws.protocol.close_code, ws.protocol.close_reason))
+            assert len(up.handshakes) == 2
+        return closes
+
+    assert asyncio.run(main()) == [(1000, ""), (1000, "")]
+    out = capsys.readouterr()
+    assert out.out.count("Upstream connection failed") == 2
+    assert "HTTP 401" in out.out
+    for text in (out.out, out.err, caplog.text):
+        assert KEY not in text
+
+
+def test_key_never_logged_at_debug(caplog, capsys):
+    caplog.set_level(logging.DEBUG)
+
+    async def main() -> None:
+        async with (
+            FakeUpstream() as up,
+            Proxy(up) as px,
+            connect(f"ws://127.0.0.1:{px.port}/v1/listen") as ws,
+        ):
+            await ws.recv()
+            await ws.send(b"\x00" * 64)
+            await ws.recv()
+
+    asyncio.run(main())
+    out = capsys.readouterr()
+    for text in (out.out, out.err, caplog.text):
+        assert KEY not in text
+        assert KEY[-4:] not in text
+
+
+def test_listens_on_ipv4_loopback_only():
+    async def main() -> list[tuple[int, str]]:
+        async with FakeUpstream() as up, Proxy(up) as px:
+            return [(s.family, s.getsockname()[0]) for s in px.server.sockets]
+
+    import socket
+
+    assert asyncio.run(main()) == [(socket.AF_INET, "127.0.0.1")]
+
+
+def test_run_stops_on_event_and_on_cancel_after_summaries(capsys):
+    """`run` returns when `_stop` is set; cancelling it (Ctrl+C) closes the
+    listener and waits for open connections to finish their summaries."""
+
+    async def main() -> ProbeProxy:
+        async with FakeUpstream() as up:
+            proxy = ProbeProxy(api_key=KEY)
+            proxy._upstream_base = f"ws://127.0.0.1:{up.port}"
+            with __import__("socket").socket() as s:
+                s.bind(("127.0.0.1", 0))
+                port = s.getsockname()[1]
+
+            task = asyncio.ensure_future(proxy.run(port))
+            for _ in range(100):
+                try:
+                    ws = await connect(f"ws://127.0.0.1:{port}/v1/listen")
+                    break
+                except OSError:
+                    await asyncio.sleep(0.02)
+            await ws.recv()
+            await ws.send(b"\x00" * 1000)
+            await ws.recv()
+            task.cancel()
+            with pytest.raises(asyncio.CancelledError):
+                await task
+            assert ws.protocol.close_code is not None
+
+            proxy._stop = asyncio.Event()
+            task = asyncio.ensure_future(proxy.run(port))
+            await asyncio.sleep(0.05)
+            proxy._stop.set()
+            await asyncio.wait_for(task, 10)
+            return proxy
+
+    proxy = asyncio.run(main())
+    (stats,) = proxy.connections
+    assert stats.duration_seconds is not None
+    out = capsys.readouterr().out
+    assert "Connection closed" in out
+    assert "Sent: 1,000 bytes (1 binary, 0 text frames)" in out
+
+
+async def _raw_status(port: int, data: bytes) -> int:
+    """Status of a raw request; 0 if the server closed without a response."""
+    reader, writer = await asyncio.open_connection("127.0.0.1", port)
+    writer.write(data)
+    await writer.drain()
+    line = await asyncio.wait_for(reader.readline(), 10)
+    writer.close()
+    return int(line.split()[1]) if line else 0
+
+
+def test_non_ascii_origin_does_not_wedge_the_console(monkeypatch):
+    """A strict UTF-8 stdout (a UTF-8 terminal) and a raw non-ASCII Origin
+    byte: the refusal still prints, and later connections still work."""
+    import io
+
+    from deepctl_cmd_debug_probe import proxy as proxymod
+    from rich.console import Console
+
+    out = io.BytesIO()
+    strict = io.TextIOWrapper(out, encoding="utf-8", errors="strict")
+    monkeypatch.setattr(
+        proxymod, "console", Console(file=strict, width=200, force_terminal=False)
+    )
+
+    async def main() -> tuple[list[int], str | bytes]:
+        async with FakeUpstream() as up, Proxy(up) as px:
+            hostile = (
+                _upgrade(px.port)
+                .encode("latin-1")
+                .replace(
+                    b"\r\n\r\n",
+                    b"\r\nOrigin: https://evil.example/\xff\x9b[bold]\r\n\r\n",
+                )
+            )
+            bad_path = _upgrade(px.port, target="/v1/listen\xff\x1b[2J").encode(
+                "latin-1"
+            )
+            statuses = [
+                await _raw_status(px.port, hostile),
+                await _raw_status(px.port, bad_path),
+            ]
+            async with connect(f"ws://127.0.0.1:{px.port}/v1/listen") as ws:
+                first = await asyncio.wait_for(ws.recv(), 10)
+            evil = _upgrade(px.port, Origin="https://evil.example").encode("latin-1")
+            statuses.append(await _raw_status(px.port, evil))
+            assert up.handshakes
+            return statuses, first
+
+    statuses, first = asyncio.run(main())
+    # websockets 17 refuses a non-ASCII target itself; older ones accept it
+    assert statuses[0] == statuses[2] == 403
+    assert statuses[1] in (0, 101)
+    assert first == RESULTS
+    strict.flush()
+    text = out.getvalue().decode("ascii")  # nothing but ASCII reached it
+    assert "Refused a connection from https://evil.example/\\" in text
+    if statuses[1] == 101:
+        assert "path=/v1/listen\\" in text
+        assert "\\x1b[2J" in text
+
+
+@pytest.mark.parametrize(
+    ("port", "host", "allowed"),
+    [
+        (80, "localhost", True),
+        (80, "127.0.0.1", True),
+        (80, "LOCALHOST:80", True),
+        (80, "evil.example", False),
+        (3100, "localhost", False),
+        (3100, "127.0.0.1", False),
+        (3100, "localhost:3100", True),
+    ],
+)
+def test_bare_host_only_on_port_80(port, host, allowed):
+    """On port 80 the browser sends the Host without a port."""
+    from websockets.datastructures import Headers
+    from websockets.http11 import Request
+
+    class Conn:
+        local_address = ("127.0.0.1", port)
+
+        def respond(self, status: int, text: str) -> int:
+            return status
+
+    request = Request(
+        "/v1/listen",
+        Headers(
+            [("Host", host), ("Upgrade", "websocket"), ("Origin", "http://localhost")]
+        ),
+    )
+    result = ProbeProxy(api_key=KEY).process_request(Conn(), request)  # type: ignore[arg-type]
+    assert result == (None if allowed else 403)
+
+
+def test_access_policy():
+    from deepctl_cmd_debug_probe.access import printable, refusal_reason, untrusted
+
+    def reason(origin: str | None, host: str = "127.0.0.1:3100") -> str | None:
+        return refusal_reason([host], [origin] if origin else [], 3100)
+
+    for ok in (
+        None,
+        "http://localhost",
+        "HTTPS://[::1]:8443",
+        "http://127.0.0.1:99999",
+    ):
+        assert reason(ok) is None, ok
+    for bad in (
+        "null",
+        "http://localhost:",
+        "http://localhost/",
+        "http://localhost?",
+        "http://localhost#",
+        "http://local\thost",
+        "http://localhost.evil.example",
+        "ws://localhost",
+        "http://[::1%25eth0]",
+    ):
+        assert reason(bad) == "origin", bad
+    assert reason(None, "127.0.0.1:3101") == "host"
+    assert refusal_reason(["127.0.0.1:3100"] * 2, [], 3100) == "host"
+    assert refusal_reason([], [], 3100) == "host"
+    assert printable("a[b]\x1b\x9b\udcff\u00e9") == "a[b]\\x1b\\x9b\\udcff\\xe9"
+    assert untrusted("[bold]:smile:\\\\\\").plain == "[bold]:smile:\\\\\\"
+
+
+def _fake_ffprobe(tmp_path: Any, body: str) -> str:
+    """An executable that runs `body` (Python) and prints an empty probe."""
+    import os
+    import sys
+
+    path = tmp_path / "ffprobe"
+    path.write_text(
+        f"#!{sys.executable}\nimport signal, sys, time\n{body}\nprint('{{}}')\n"
+    )
+    os.chmod(path, 0o755)
+    return str(path)
+
+
+class _DeafUpstream:
+    """Completes the handshake, then never reads again (ignores close)."""
+
+    async def __aenter__(self) -> _DeafUpstream:
+        import base64
+
+        async def handle(reader: Any, writer: Any) -> None:
+            head = await reader.readuntil(b"\r\n\r\n")
+            key = next(
+                line.split(b":", 1)[1].strip()
+                for line in head.split(b"\r\n")
+                if line.lower().startswith(b"sec-websocket-key:")
+            )
+            accept = base64.b64encode(
+                hashlib.sha1(key + b"258EAFA5-E914-47DA-95CA-C5AB0DC85B11").digest()
+            )
+            writer.write(
+                b"HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\n"
+                b"Connection: Upgrade\r\nSec-WebSocket-Accept: " + accept + b"\r\n\r\n"
+            )
+            self.writers.append(writer)
+            await asyncio.sleep(3600)
+
+        self.writers: list[Any] = []
+        self.server = await asyncio.start_server(handle, "127.0.0.1", 0)
+        self.port = self.server.sockets[0].getsockname()[1]
+        return self
+
+    async def __aexit__(self, *exc: object) -> None:
+        for w in self.writers:
+            w.transport.abort()
+        self.server.close()
+
+
+def test_snapshots_do_not_block_the_loop_and_stop_waits_for_summaries(
+    monkeypatch, capsys, tmp_path
+):
+    """ffprobe runs off the loop: while one connection's snapshot runs,
+    another is relayed, and a stop during the snapshot still ends with that
+    connection's summary."""
+    import time
+
+    from deepctl_cmd_debug_probe import proxy as proxymod
+
+    marker = tmp_path / "started"
+    monkeypatch.setattr(
+        proxymod,
+        "get_ffprobe_path",
+        lambda _config=None: _fake_ffprobe(
+            tmp_path, f"open({str(marker)!r}, 'w').close(); time.sleep(1.5)"
+        ),
+    )
+
+    async def main() -> tuple[float, ProbeProxy]:
+        async with FakeUpstream() as up:
+            proxy = ProbeProxy(api_key=KEY, probe_interval_bytes=1)
+            proxy._upstream_base = f"ws://127.0.0.1:{up.port}"
+            server = await proxy.start(0)
+            port = next(iter(server.sockets)).getsockname()[1]
+            server.close()
+            await server.wait_closed()
+            task = asyncio.ensure_future(proxy.run(port))
+            await asyncio.sleep(0.2)
+            a = await connect(f"ws://127.0.0.1:{port}/v1/listen")
+            await a.recv()
+            await a.send(b"\x00" * 100)  # starts a 1.5 s snapshot
+            while not marker.exists():
+                await asyncio.sleep(0.01)
+            t0 = time.monotonic()
+            b = await connect(f"ws://127.0.0.1:{port}/v1/listen")
+            await b.recv()
+            await b.send("ping")
+            assert await b.recv() == "ping"
+            relayed_in = time.monotonic() - t0
+            for _ in range(30):  # a backlog: 30 more 1.5 s snapshots if drained
+                await a.send(b"\x00" * 100)
+            proxy._stop.set()  # what the first Ctrl+C does, mid-snapshot
+            await asyncio.wait_for(task, 10)
+            return relayed_in, proxy
+
+    relayed_in, proxy = asyncio.run(main())
+    assert relayed_in < 1.0
+    assert all(c.duration_seconds is not None for c in proxy.connections)
+    out = capsys.readouterr().out
+    assert out.count("Connection closed") == 2
+    assert "Not forwarded (arrived while stopping): 3,000 bytes (30 frames)" in out
+
+
+def test_abort_ends_connections_without_waiting_for_close_timeout(capsys):
+    """The second Ctrl+C: an upstream that never answers the close no longer
+    holds shutdown for close_timeout (30 s)."""
+    import time
+
+    async def main() -> float:
+        async with _DeafUpstream() as up:
+            proxy = ProbeProxy(api_key=KEY)
+            proxy._upstream_base = f"ws://127.0.0.1:{up.port}"
+            server = await proxy.start(0)
+            port = next(iter(server.sockets)).getsockname()[1]
+            server.close()
+            await server.wait_closed()
+            task = asyncio.ensure_future(proxy.run(port))
+            await asyncio.sleep(0.2)
+            ws = await connect(f"ws://127.0.0.1:{port}/v1/listen")
+            await ws.send(b"\x00" * 10)
+            await asyncio.sleep(0.3)
+            proxy._stop.set()
+            await asyncio.sleep(1)
+            assert not task.done()  # waiting on the deaf upstream's close
+            t0 = time.monotonic()
+            proxy.abort()
+            await asyncio.wait_for(task, 10)
+            return time.monotonic() - t0
+
+    assert asyncio.run(main()) < 3
+    assert "Connection closed" in capsys.readouterr().out
+
+
+def test_abort_during_upstream_handshake():
+    async def main() -> ProbeProxy:
+        async def never(reader: Any, writer: Any) -> None:
+            await reader.read()  # never answers; ends when the proxy hangs up
+            writer.close()
+
+        hang = await asyncio.start_server(never, "127.0.0.1", 0)
+        proxy = ProbeProxy(api_key=KEY)
+        proxy._upstream_base = f"ws://127.0.0.1:{hang.sockets[0].getsockname()[1]}"
+        server = await proxy.start(0)
+        port = next(iter(server.sockets)).getsockname()[1]
+        server.close()
+        await server.wait_closed()
+        task = asyncio.ensure_future(proxy.run(port))
+        await asyncio.sleep(0.2)
+        ws = await connect(f"ws://127.0.0.1:{port}/v1/listen")
+        await asyncio.sleep(0.3)
+        proxy.abort()
+        await asyncio.wait_for(task, 5)
+        await ws.close()
+        hang.close()
+        return proxy
+
+    proxy = asyncio.run(main())
+    assert proxy.connections[0].duration_seconds is not None
+
+
+def test_second_stop_kills_a_running_ffprobe_and_skips_the_final_probe(
+    monkeypatch, capsys, tmp_path
+):
+    """abort() during a snapshot: ffprobe (here one that ignores SIGTERM) is
+    killed within about a second, and no final probe starts."""
+    import time
+
+    from deepctl_cmd_debug_probe import proxy as proxymod
+
+    runs = tmp_path / "runs"
+    runs.mkdir()
+    monkeypatch.setattr(
+        proxymod,
+        "get_ffprobe_path",
+        lambda _config=None: _fake_ffprobe(
+            tmp_path,
+            "signal.signal(signal.SIGTERM, signal.SIG_IGN)\n"
+            f"open({str(runs)!r} + '/%d' % time.time_ns(), 'w').close()\n"
+            "time.sleep(30)",
+        ),
+    )
+
+    async def main() -> float:
+        async with FakeUpstream() as up:
+            proxy = ProbeProxy(api_key=KEY, probe_interval_bytes=1)
+            proxy._upstream_base = f"ws://127.0.0.1:{up.port}"
+            server = await proxy.start(0)
+            port = next(iter(server.sockets)).getsockname()[1]
+            server.close()
+            await server.wait_closed()
+            task = asyncio.ensure_future(proxy.run(port))
+            await asyncio.sleep(0.2)
+            ws = await connect(f"ws://127.0.0.1:{port}/v1/listen")
+            await ws.recv()
+            await ws.send(b"\x00" * 100)
+            while not any(runs.iterdir()):
+                await asyncio.sleep(0.01)
+            proxy._stop.set()
+            await asyncio.sleep(0.2)
+            t0 = time.monotonic()
+            proxy.abort()
+            await asyncio.wait_for(task, 5)
+            return time.monotonic() - t0
+
+    elapsed = asyncio.run(main())
+    assert elapsed < 1.5
+    assert len(list(runs.iterdir())) == 1  # no final probe
+    assert "Connection closed" in capsys.readouterr().out
+
+
+def test_transcripts_print_literally_and_keep_unicode(capsys):
+    from deepctl_cmd_debug_probe.models import ProbeConnectionStats
+
+    stats = ProbeConnectionStats(connection_id="1234abcd")
+    transcript = "[bold]x[/bold] :smile: \u3053\u3093\u306b\u3061\u306f\x1b[2J\x9b"
+    ProbeProxy(api_key=KEY)._parse_transcript(
+        json.dumps(
+            {
+                "is_final": True,
+                "channel": {"alternatives": [{"transcript": transcript}]},
+            }
+        ),
+        stats,
+    )
+    out = capsys.readouterr().out
+    assert "[bold]x[/bold] :smile: \u3053\u3093\u306b\u3061\u306f[2J" in out
+    assert "\x1b" not in out and "\x9b" not in out
+    assert stats.transcripts == [transcript]
+
+
+@pytest.mark.parametrize(
+    ("frames", "size", "line"),
+    [
+        (1, 1, "Not forwarded (arrived while stopping): 1 byte (1 frame)"),
+        (2, 1234, "Not forwarded (arrived while stopping): 1,234 bytes (2 frames)"),
+    ],
+)
+def test_not_forwarded_line_counts(frames, size, line, capsys):
+    from deepctl_cmd_debug_probe.models import ProbeConnectionStats
+
+    stats = ProbeConnectionStats(connection_id="1234abcd")
+    ProbeProxy(api_key=KEY)._print_connection_summary(stats, frames, size)
+    assert f"  {line}\n" in capsys.readouterr().out
+    ProbeProxy(api_key=KEY)._print_connection_summary(stats)
+    assert "Not forwarded" not in capsys.readouterr().out
diff --git a/packages/deepctl-cmd-listen/README.extra.md b/packages/deepctl-cmd-listen/README.extra.md
new file mode 100644
index 00000000..d42da3eb
--- /dev/null
+++ b/packages/deepctl-cmd-listen/README.extra.md
@@ -0,0 +1,5 @@
+## URL sources
+
+`dg listen <URL>` checks a URL by format only (an http or https scheme and a host). Pass `--check-url` to check that the URL responds first: a HEAD request, then a 1-byte GET if needed. That check sends no Deepgram API key and keeps no cookies, but any `user:pass@` you put in the URL goes with it, as with any fetch.
+
+Status lines and errors show the URL as `scheme://host/…/<last path segment>`, without user info, query string or fragment. In `-o json` and `-o yaml` output, `source_path` keeps the full path (automation needs it to identify the file) but drops the user info, query string and fragment. If your host puts a token in the URL path, treat `source_path` as sensitive. The request to Deepgram always uses the full URL.
diff --git a/packages/deepctl-cmd-listen/README.md b/packages/deepctl-cmd-listen/README.md
index 297ae958..e767a5a7 100644
--- a/packages/deepctl-cmd-listen/README.md
+++ b/packages/deepctl-cmd-listen/README.md
@@ -31,6 +31,12 @@ pipx run deepctl --help
 |---------|-------------|
 | `deepctl listen` | `deepctl_cmd_listen.command:ListenCommand` |
 
+## URL sources
+
+`dg listen <URL>` checks a URL by format only (an http or https scheme and a host). Pass `--check-url` to check that the URL responds first: a HEAD request, then a 1-byte GET if needed. That check sends no Deepgram API key and keeps no cookies, but any `user:pass@` you put in the URL goes with it, as with any fetch.
+
+Status lines and errors show the URL as `scheme://host/…/<last path segment>`, without user info, query string or fragment. In `-o json` and `-o yaml` output, `source_path` keeps the full path (automation needs it to identify the file) but drops the user info, query string and fragment. If your host puts a token in the URL path, treat `source_path` as sensitive. The request to Deepgram always uses the full URL.
+
 ## Dependencies
 
 - `click>=8.2.0,<9`
@@ -39,7 +45,6 @@ pipx run deepctl --help
 - `websockets>=13.1,<18`
 - `deepgram-captions>=2.0.0`
 - `sounddevice>=0.4.6`
-- `numpy>=1.24.0`
 
 ## License
 
diff --git a/packages/deepctl-cmd-listen/pyproject.toml b/packages/deepctl-cmd-listen/pyproject.toml
index c770b6ee..e41dc167 100644
--- a/packages/deepctl-cmd-listen/pyproject.toml
+++ b/packages/deepctl-cmd-listen/pyproject.toml
@@ -30,7 +30,6 @@ dependencies = [
     "websockets>=13.1,<18",
     "deepgram-captions>=2.0.0",
     "sounddevice>=0.4.6",
-    "numpy>=1.24.0",
 ]
 
 [project.scripts]
diff --git a/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/captions.py b/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/captions.py
index 479225eb..bfe1980c 100644
--- a/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/captions.py
+++ b/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/captions.py
@@ -95,8 +95,10 @@ class StreamingCaptionWriter:
     word-level speaker data is present.
     """
 
-    def __init__(self, fmt: str) -> None:
+    def __init__(self, fmt: str, *, echo: bool = True) -> None:
         self.fmt = fmt  # "webvtt" | "srt"
+        # False under a machine format: collect words, print nothing.
+        self.echo = echo
         self._count = 0
         self._all_words: list[dict[str, Any]] = []
 
@@ -106,13 +108,13 @@ def print_header(self, note: str | None = None) -> None:
         For WebVTT, an optional NOTE block can carry metadata (model, language,
         etc.) in a spec-compliant way. SRT has no header equivalent.
         """
-        if self.fmt == "webvtt":
-            print("WEBVTT")
-            print()
+        if self.echo and self.fmt == "webvtt":
+            print("WEBVTT", flush=True)
+            print(flush=True)
             if note:
-                print("NOTE")
-                print(note)
-                print()
+                print("NOTE", flush=True)
+                print(note, flush=True)
+                print(flush=True)
 
     def write_entry(
         self,
@@ -132,22 +134,24 @@ def write_entry(
 
         self._count += 1
         self._all_words.extend(words)
+        if not self.echo:
+            return
 
         text = " ".join(w.get("punctuated_word") or w.get("word", "") for w in words)
         first_speaker: int | None = words[0].get("speaker") if words else None
 
         if self.fmt == "webvtt":
-            print(f"{_fmt_webvtt(start)} --> {_fmt_webvtt(end)}")
+            print(f"{_fmt_webvtt(start)} --> {_fmt_webvtt(end)}", flush=True)
             prefix = f"<v Speaker {first_speaker}>" if first_speaker is not None else ""
-            print(f"{prefix}{text}")
-            print()
+            print(f"{prefix}{text}", flush=True)
+            print(flush=True)
         else:
-            print(self._count)
-            print(f"{_fmt_srt(start)} --> {_fmt_srt(end)}")
+            print(self._count, flush=True)
+            print(f"{_fmt_srt(start)} --> {_fmt_srt(end)}", flush=True)
             if first_speaker is not None:
-                print(f"[Speaker {first_speaker}]")
-            print(text)
-            print()
+                print(f"[Speaker {first_speaker}]", flush=True)
+            print(text, flush=True)
+            print(flush=True)
 
     @property
     def accumulated_words(self) -> list[dict[str, Any]]:
diff --git a/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/command.py b/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/command.py
index fac2995c..93c7e3ba 100644
--- a/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/command.py
+++ b/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/command.py
@@ -14,26 +14,40 @@
 from __future__ import annotations
 
 import json
+import os
+import signal
 import sys
 import threading
 from pathlib import Path
 from typing import TYPE_CHECKING, Any
-from urllib.parse import urlencode
+from urllib.parse import urlencode, urlsplit
 
 import click
 from deepctl_core import (
     AuthManager,
     BaseCommand,
     BaseResult,
+    CodedErrorResult,
     Config,
     DeepgramClient,
 )
-from deepctl_core.output import _agentic
-from deepctl_core.websocket import connect_async
+from deepctl_core.hosts import CredentialHostError
+from deepctl_core.output import (
+    _agentic,
+    format_source,
+    get_output_format,
+    is_ai_agent,
+    print_error,
+    print_hint,
+    print_info,
+    print_warning,
+)
 from rich.console import Console
+from rich.markup import escape
 from rich.prompt import Confirm, Prompt
 from rich.table import Table
 
+from . import messages as msg
 from .captions import (
     StreamingCaptionWriter,
     captions_from_prerecorded,
@@ -47,11 +61,13 @@
     format_diarized_transcript,
     format_diarized_words,
 )
-from .models import ListenResult
+from .models import ListenCodedError, ListenResult
 
 if TYPE_CHECKING:
     import asyncio
 
+    from . import live
+
 # Status messages → stderr so stdout stays clean for transcript piping
 status = Console(stderr=True)
 # Structured output (table, json) → stdout
@@ -62,9 +78,15 @@
 # vocabulary ("pci", "ssn", …) earns an opaque HTTP 400 from the v2 endpoint.
 _FLUX_REDACT = ("numbers", "aggressive_numbers")
 
+# --timeout's default: a large file can take minutes to upload and process.
+_PRERECORDED_TIMEOUT_S = 300.0
+# One instance, so `dg transcribe` (an alias) has equal arguments.
+_TIMEOUT_TYPE = click.FloatRange(min=1)
+
 
 def _is_url(s: str) -> bool:
-    return s.startswith(("http://", "https://"))
+    # Schemes are case-insensitive: HTTPS://... is a URL, not a file path.
+    return s[:8].lower().startswith(("http://", "https://"))
 
 
 def _ws_base(client: DeepgramClient) -> str:
@@ -79,41 +101,74 @@ def _ws_base(client: DeepgramClient) -> str:
     return f"{'ws' if scheme.lower() in ('http', 'ws') else 'wss'}://{rest}"
 
 
-def _live_connect(url: str, api_key: str | None) -> Any:
-    """Open the live WebSocket for ``async with``, without redirects.
-
-    A 3xx on the upgrade, same origin or not, stops the command before a
-    second connection is opened, so the key and the audio go only to the
-    host that passed the host check.
-    """
-    return connect_async(
-        url,
-        {"Authorization": f"Token {api_key}"},
-        command="dg listen",
-        payload="audio",
-    )
-
-
 # asyncio (and with it ssl) loads only when a live stream starts, so
 # `dg listen --help` and the prerecorded path don't import it.
+# The live engine imports asyncio, so it loads lazily too.
 def __getattr__(name: str) -> Any:
     if name == "asyncio":
         import asyncio
 
         return asyncio
+    if name == "live":
+        from . import live
+
+        return live
     raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
 
 
-async def _cancel_and_drain(*tasks: asyncio.Task[Any]) -> None:
-    """Cancel tasks and consume their terminal exceptions during teardown."""
-    for task in tasks:
-        if not task.done():
-            task.cancel()
-    for task in tasks:
-        try:
-            await task
-        except BaseException:
-            pass
+def _machine_format() -> bool:
+    """True when live transcript lines stay off stdout: a machine format
+    that was asked for (``-o json``/``-o yaml``) or chosen because of a hard
+    AI-agent signal. The final result is then the only payload.
+    JSON implied by soft detection alone (CI, cron, no TERM) keeps 0.4.0's
+    live lines, since those pipelines read stdout as a stream."""
+    return get_output_format() in ("json", "yaml") and format_source() in (
+        "explicit",
+        "hard_agent",
+    )
+
+
+_freeze_registered = False
+
+
+def _freeze_at_exit() -> None:
+    """At interpreter exit, move every live object out of the collector's
+    reach. The final collection then takes a few ms instead of about 100,
+    so dg exits right after the server's close (plan T23). Registered with
+    atexit, so a long-lived host that runs the command is unaffected."""
+    global _freeze_registered
+    if _freeze_registered:
+        return
+    _freeze_registered = True
+    import atexit
+    import gc
+
+    atexit.register(gc.freeze)
+
+
+def _stdin_fd() -> int:
+    """The descriptor live stdin streaming reads (a seam for tests)."""
+    return 0
+
+
+def _prog() -> str:
+    """The program name to show in messages and ``next_step``.
+
+    The bare name when it resolves on PATH to the running executable;
+    otherwise ``dg``.
+    """
+    import shutil
+
+    try:
+        argv0 = sys.argv[0]
+        name = os.path.basename(argv0)
+        if name in ("dg", "deepgram", "deepctl"):
+            found = shutil.which(name)
+            if found and os.path.realpath(found) == os.path.realpath(argv0):
+                return name
+    except Exception:
+        pass
+    return "dg"
 
 
 class ListenCommand(BaseCommand):
@@ -132,6 +187,19 @@ class ListenCommand(BaseCommand):
     requires_project = False
     ci_friendly = True
 
+    #: Live transcript lines go to stdout; False under a machine format.
+    _echo: bool = True
+    #: ``--verbose``: under a machine format, finals go to stderr as INFO.
+    _verbose: bool = False
+    #: Host of the live socket, for network_unavailable details.
+    _ws_host: str = ""
+    #: Set after a SIGTERM drain; exit_code_for re-raises it.
+    _reraise_signal: int | None = None
+    #: The finals kept by the last live session, for a late stdout failure.
+    _live_kept: dict[str, Any] | None = None
+    #: Writing the final result to stdout failed; the run exits 1.
+    _output_failed: bool = False
+
     examples = [
         "dg listen audio.mp3",
         "dg listen https://example.com/call.mp3 --diarize",
@@ -298,6 +366,26 @@ def get_arguments(self) -> list[dict[str, Any]]:
                 "is_flag": True,
                 "is_option": True,
             },
+            {
+                "names": ["--check-url"],
+                "help": (
+                    "Check that the URL responds before transcribing: a HEAD "
+                    "request, then a 1-byte GET if needed. Sends no Deepgram "
+                    "API key."
+                ),
+                "is_flag": True,
+                "is_option": True,
+            },
+            {
+                "names": ["--timeout"],
+                "help": (
+                    "Seconds to wait at each step (connecting, sending, the "
+                    "response) before giving up. Not a limit on the whole run. "
+                    "Default: 300. Files and URLs only."
+                ),
+                "type": _TIMEOUT_TYPE,
+                "is_option": True,
+            },
             # ── Caption output ────────────────────────────────────────
             {
                 "names": ["--webvtt"],
@@ -323,16 +411,39 @@ def get_arguments(self) -> list[dict[str, Any]]:
 
     # ── Entry point ────────────────────────────────────────────────────
 
+    def pre_auth_check(self, config: Config, **kwargs: Any) -> Any | None:
+        """Under a hard AI-agent signal, refuse a run with no source.
+
+        Without SOURCE or --mic, a non-TTY stdin would be streamed until an
+        end of input that may never come. Agents name stdin with ``-``
+        explicitly. Runs before authentication, so nothing is sent.
+        """
+        if kwargs.get("source") is not None or kwargs.get("mic"):
+            return None
+        if not is_ai_agent():
+            return None
+        prog = _prog()
+        text = msg.E_LISTEN_NO_SOURCE.format(prog=prog)
+        print_error(escape(text))
+        print_hint(escape(msg.H_LISTEN_NO_SOURCE))
+        return ListenCodedError(
+            error=text,
+            code=msg.CODE_INVALID_ARGUMENT,
+            hint=msg.H_LISTEN_NO_SOURCE,
+            next_step=f"{prog} {self.name} --help",
+        )
+
     def handle(
         self,
         config: Config,
         auth_manager: AuthManager,
         client: DeepgramClient,
         **kwargs: Any,
-    ) -> BaseResult:
+    ) -> BaseResult | CodedErrorResult:
         source: str | None = kwargs.get("source")
         use_mic: bool = kwargs.get("mic", False)
         guided_flow = False
+        self._verbose = config.get("output.verbose", False) is True
 
         # ── Resolve mode ───────────────────────────────────────────────
         if source == "-":
@@ -402,14 +513,25 @@ def handle(
         # from an explicit flag, so they stay silent; --interim still gates
         # client-side display.)
         if api_version >= 2 and diarize:
-            status.print(
-                "[yellow]Note:[/yellow] --diarize is not supported by Flux STT "
-                "(listen v2) models; ignoring it."
+            print_warning(
+                "Flux models don't support --diarize, so it was ignored.",
+                stderr=True,
+                ignore_quiet=True,
             )
             diarize = False
         save_to = kwargs.get("save_to")
         probe = kwargs.get("probe", False)
         no_validate = kwargs.get("no_validate", False)
+        check_url = kwargs.get("check_url", False)
+        if check_url and mode != "prerecorded_url":
+            raise click.UsageError("--check-url works only with a URL source.")
+        if check_url and no_validate:
+            raise click.UsageError("--check-url can't be used with --no-validate.")
+        timeout: float | None = kwargs.get("timeout")
+        if timeout is not None and mode in ("stream_mic", "stream_stdin"):
+            raise click.UsageError(
+                "--timeout applies only to a file or URL source, not to --mic or stdin."
+            )
 
         # Flux STT (listen v2) is streaming-only — there is no v2 pre-recorded
         # REST endpoint, so a file/URL routes to /v1/listen and the server
@@ -481,6 +603,7 @@ def handle(
                 no_validate=no_validate,
                 caption_format=caption_format,
                 config=config,
+                timeout_s=timeout or _PRERECORDED_TIMEOUT_S,
             )
         elif mode == "prerecorded_url":
             assert source is not None
@@ -504,6 +627,8 @@ def handle(
                 no_validate=no_validate,
                 caption_format=caption_format,
                 config=config,
+                timeout_s=timeout or _PRERECORDED_TIMEOUT_S,
+                check_url=check_url,
             )
         elif mode == "stream_mic":
             return self._stream_mic(
@@ -612,33 +737,55 @@ def _prerecorded(
         no_validate: bool,
         caption_format: str | None,
         config: Config,
-    ) -> BaseResult:
+        timeout_s: float = _PRERECORDED_TIMEOUT_S,
+        check_url: bool = False,
+    ) -> BaseResult | CodedErrorResult:
         from deepctl_shared_utils import (
             probe_file,
             require_ffprobe,
-            validate_audio_file,
-            validate_url,
+        )
+        from deepctl_shared_utils.validation import (
+            audio_file_problem,
+            display_url,
+            output_url,
+            scrub_url_text,
+            url_problem,
         )
 
         source_kind = "url" if is_url else "file"
+        # A presigned URL carries its token in the query string, and some
+        # hosts put one in the path: never show it, nor one passed where a
+        # file path was expected. Status lines and errors show the host and
+        # the last path segment; the result's source_path keeps the path.
+        url_like = is_url or "://" in source
+        shown = display_url(source) if url_like else source
+
+        # The file validated (and probed) must be the file uploaded: its
+        # identity now, compared again once the upload opens it.
+        file_id: tuple[int, int] | None = None
+        if not is_url:
+            import os
+
+            try:
+                st = os.stat(source)
+                file_id = (st.st_dev, st.st_ino)
+            except OSError:
+                pass  # reported below (or by the upload, with --no-validate)
 
         # ── Validation ─────────────────────────────────────────────────
         if not no_validate:
+            # One line per failure, worded here; warnings as WARN lines.
             if is_url:
-                if not validate_url(source, check_accessibility=True):
-                    return BaseResult(
-                        status="error", message=f"URL is not accessible: {source}"
-                    )
+                # The format only, unless --check-url asks for a HEAD request.
+                problem, warnings = url_problem(source, check_accessibility=check_url)
+            elif not Path(source).exists():
+                problem, warnings = f"File not found: {shown}", []
             else:
-                if not Path(source).exists():
-                    return BaseResult(
-                        status="error", message=f"File not found: {source}"
-                    )
-                if not validate_audio_file(source):
-                    return BaseResult(
-                        status="error",
-                        message=f"File does not appear to be audio: {source}",
-                    )
+                problem, warnings = audio_file_problem(source)
+            for warning in warnings:
+                print_warning(escape(warning), stderr=True)
+            if problem is not None:
+                return BaseResult(status="error", message=problem)
 
         # ── Optional ffprobe analysis ──────────────────────────────────
         probe_info: dict[str, Any] | None = None
@@ -683,19 +830,30 @@ def _prerecorded(
             options["numerals"] = "true"
 
         # ── Call API ───────────────────────────────────────────────────
-        status.print(f"[dim]Transcribing[/dim] {source}")
+        status.print(f"[dim]Transcribing[/dim] {escape(shown)}")
         status.print(f"[dim]Model:[/dim] {model}  [dim]Language:[/dim] {language}")
 
+        from deepctl_core.upload import UploadFileError, coded_result
+
         try:
             if is_url:
-                result_dict = client.transcribe_url(source, options)
+                result_dict = client.transcribe_url(
+                    source, options, timeout_s=timeout_s
+                )
             else:
-                result_dict = client.transcribe_file(source, options)
+                result_dict = client.transcribe_file(
+                    source, options, timeout_s=timeout_s, file_id=file_id
+                )
+        except UploadFileError as e:
+            return coded_result(e)
+        except FileNotFoundError:  # --no-validate and no such file
+            raise click.ClickException(f"File not found: {shown}") from None
         except Exception as e:
             # Raise (not return an error result) so an API rejection — e.g. a
             # --redact value the v1 endpoint refuses — exits non-zero and is
             # visible, rather than printing nothing and exiting 0.
-            raise click.ClickException(f"Transcription failed: {e}")
+            detail = scrub_url_text(e, source) if url_like else e
+            raise click.ClickException(f"Transcription failed: {detail}")
 
         # ── Format transcript ──────────────────────────────────────────
         if diarize:
@@ -731,7 +889,7 @@ def _prerecorded(
         return ListenResult(
             status="success",
             source=source_kind,
-            source_path=source,
+            source_path=output_url(source) if url_like else source,
             mode="prerecorded",
             model=model,
             language=language,
@@ -745,7 +903,7 @@ def _prerecorded(
             duration_seconds=duration_seconds,
         )
 
-    # ── Live mic handler ───────────────────────────────────────────────
+    # ── Live streaming (mic and stdin) ─────────────────────────────────
 
     def _stream_mic(
         self,
@@ -764,18 +922,30 @@ def _stream_mic(
         channels: int,
         save_to: str | None,
         caption_format: str | None,
-    ) -> BaseResult:
+    ) -> BaseResult | ListenCodedError:
+        import asyncio
+
+        from . import live
+
+        self._echo = not _machine_format()
+        # From here on Ctrl-C ends the mic session, even before the
+        # session's own handler is in place (imports, connecting).
+        early = live.EarlyStop()
+        early.install()
         caption_writer: StreamingCaptionWriter | None = None
 
         if caption_format:
-            caption_writer = StreamingCaptionWriter(caption_format)
+            caption_writer = StreamingCaptionWriter(caption_format, echo=self._echo)
             note = f"Model: {model} · Language: {language}"
             if diarize:
                 note += " · Speaker labels enabled"
             note += " · Ctrl+C to stop"
-            caption_writer.print_header(
-                note=note if caption_format == "webvtt" else None
-            )
+            try:
+                caption_writer.print_header(
+                    note=note if caption_format == "webvtt" else None
+                )
+            except BrokenPipeError:
+                live.silence_stdout()
         else:
             status.print(
                 f"[green]✓[/green] Listening on microphone · {model} · Ctrl+C to stop"
@@ -783,10 +953,9 @@ def _stream_mic(
             if diarize:
                 status.print("[dim]Speaker labels enabled[/dim]")
 
-        import asyncio
-
         try:
-            result = asyncio.run(
+            _freeze_at_exit()
+            return asyncio.run(
                 self._ws_mic(
                     client,
                     model=model,
@@ -801,42 +970,30 @@ def _stream_mic(
                     sample_rate=sample_rate,
                     channels=channels,
                     caption_writer=caption_writer,
+                    caption_format=caption_format,
+                    save_to=save_to,
+                    early=early,
                 )
             )
-        except KeyboardInterrupt:
-            status.print("\n[yellow]Stopped.[/yellow]")
-            result = ListenResult(status="success", source="mic", mode="live")
         except click.ClickException:
             raise
+        except CredentialHostError:
+            raise
         except Exception as e:
             err = str(e)
-            msg = f"Microphone error: {err}"
+            msg_text = f"Microphone error: {err}"
             if (
                 "Invalid input device" in err
                 or "PortAudio" in err
                 or "No Default Input" in err
             ):
-                msg += (
+                msg_text += (
                     "\n\nOn macOS, make sure your terminal has microphone access:"
                     "\n  System Settings → Privacy & Security → Microphone"
                 )
-            return BaseResult(status="error", message=msg)
-
-        # Save captions or transcript
-        if save_to:
-            if caption_writer and caption_writer.accumulated_words:
-                content = captions_from_words(
-                    caption_writer.accumulated_words, caption_format or "webvtt"
-                )
-            elif result.transcript:
-                content = result.transcript
-            else:
-                content = ""
-            if content:
-                self._save_transcript(content, save_to)
-                status.print(f"[green]✓[/green] Saved to {save_to}")
-
-        return result
+            return BaseResult(status="error", message=msg_text)
+        finally:
+            early.restore()
 
     async def _ws_mic(
         self,
@@ -854,12 +1011,16 @@ async def _ws_mic(
         sample_rate: int,
         channels: int,
         caption_writer: StreamingCaptionWriter | None = None,
-    ) -> ListenResult:
+        caption_format: str | None = None,
+        save_to: str | None = None,
+        early: live.EarlyStop | None = None,
+    ) -> BaseResult | ListenCodedError:
         import asyncio
 
-        import numpy as np
         import sounddevice as sd
 
+        from . import live
+
         url = self._ws_url(
             client,
             api_version=api_version,
@@ -875,82 +1036,92 @@ async def _ws_mic(
             sample_rate=sample_rate,
             channels=channels,
         )
+        self._ws_host = urlsplit(url).hostname or ""
         api_key = client.auth_manager.get_api_key()
         full_transcript: list[str] = []
         v2_state = self._new_v2_state() if api_version >= 2 else None
-        stop_event = threading.Event()
 
-        async with _live_connect(url, api_key) as ws:
+        loop = asyncio.get_running_loop()
+        queue: asyncio.Queue[Any] = asyncio.Queue(maxsize=live.QUEUE_MAX)
+        closing = threading.Event()
+        buffer = live.DropOldestBuffer(loop, queue, closing)
+        stream: Any = None
+
+        def callback(indata: Any, frames: int, t: Any, s: Any) -> None:
+            if s and not closing.is_set():
+                print_warning(
+                    f"Audio warning: {escape(str(s))}",
+                    stderr=True,
+                    ignore_quiet=True,
+                )
+            buffer.offer_threadsafe(bytes(indata))
 
-            async def send_audio() -> None:
-                loop = asyncio.get_event_loop()
-                q: asyncio.Queue[bytes] = asyncio.Queue()
+        def start_mic() -> None:
+            nonlocal stream
+            stream = sd.RawInputStream(
+                samplerate=sample_rate,
+                channels=channels,
+                dtype="int16",
+                callback=callback,
+                blocksize=live.frame_bytes("linear16", sample_rate, channels)
+                // (2 * channels),
+            )
+            stream.start()
 
-                def callback(indata: Any, frames: int, t: Any, s: Any) -> None:
-                    if s:
-                        status.print(f"[yellow]Audio warning: {s}[/yellow]")
-                    loop.call_soon_threadsafe(q.put_nowait, bytes(indata))
+        def on_message(raw: str | bytes) -> None:
+            self._handle_ws_message(
+                raw,
+                full_transcript,
+                diarize=diarize,
+                interim=interim,
+                caption_writer=caption_writer,
+                v2_state=v2_state,
+            )
 
-                stream = sd.RawInputStream(
-                    samplerate=sample_rate,
-                    channels=channels,
-                    dtype=np.int16,
-                    callback=callback,
-                    blocksize=int(sample_rate * 0.1),
-                )
-                stream.start()
+        try:
+            outcome = await live.run_session(
+                url,
+                {"Authorization": f"Token {api_key}"},
+                on_message=on_message,
+                queue=queue,
+                closing=closing,
+                start_source=start_mic,
+                keepalive=api_version < 2,
+                byte_rate=live.bytes_per_second("linear16", sample_rate, channels),
+                stop=early.bind(loop) if early is not None else None,
+            )
+            if early is not None and outcome.signal is None:
+                outcome.signal = early.signum
+        finally:
+            closing.set()
+            if stream is not None:
                 try:
-                    while not stop_event.is_set():
-                        try:
-                            data = await asyncio.wait_for(q.get(), timeout=0.5)
-                            await ws.send(data)
-                        except asyncio.TimeoutError:
-                            continue
-                finally:
                     stream.stop()
                     stream.close()
-                    await ws.send(json.dumps({"type": "CloseStream"}))
-
-            async def recv_transcripts() -> None:
-                async for msg in ws:
-                    self._handle_ws_message(
-                        msg,
-                        full_transcript,
-                        diarize=diarize,
-                        interim=interim,
-                        caption_writer=caption_writer,
-                        v2_state=v2_state,
-                    )
-
-            send_task = asyncio.create_task(send_audio())
-            recv_task = asyncio.create_task(recv_transcripts())
-            try:
-                await asyncio.gather(send_task, recv_task)
-            except (KeyboardInterrupt, asyncio.CancelledError):
-                stop_event.set()
-                await _cancel_and_drain(send_task, recv_task)
-            except BaseException:
-                stop_event.set()
-                await _cancel_and_drain(send_task, recv_task)
-                raise
-
-        # Flux may close mid-turn without an EndOfTurn; emit what we have.
-        if v2_state is not None:
-            self._flush_v2(v2_state, full_transcript, caption_writer=caption_writer)
+                except Exception:
+                    pass
 
-        return ListenResult(
-            status="success",
+        if buffer.dropped_buffers:
+            rate = live.bytes_per_second("linear16", sample_rate, channels)
+            print_warning(
+                msg.W_MIC_DROPPED.format(
+                    seconds=f"{buffer.dropped_bytes / rate if rate else 0.0:.1f}"
+                ),
+                stderr=True,
+            )
+        return self._finish_live(
+            outcome,
             source="mic",
-            mode="live",
             model=model,
             language=language,
-            diarized=diarize,
-            transcript=" ".join(full_transcript),
-            caption_format=caption_writer.fmt if caption_writer else None,
+            diarize=diarize,
+            transcript_acc=full_transcript,
+            caption_writer=caption_writer,
+            caption_format=caption_format,
+            save_to=save_to,
+            v2_state=v2_state,
         )
 
-    # ── Live stdin handler ─────────────────────────────────────────────
-
     def _stream_stdin(
         self,
         client: DeepgramClient,
@@ -969,69 +1140,61 @@ def _stream_stdin(
         channels: int,
         save_to: str | None,
         caption_format: str | None,
-    ) -> BaseResult:
+    ) -> BaseResult | ListenCodedError:
+        import asyncio
+
+        from . import live
+
+        self._echo = not _machine_format()
         resolved_encoding = encoding or "linear16"
         if not encoding:
-            status.print(
-                "[dim]No --encoding specified — assuming linear16. "
-                "Pass --encoding to suppress this warning.[/dim]"
+            print_warning(
+                "No --encoding specified — assuming linear16. "
+                "Pass --encoding to suppress this warning.",
+                stderr=True,
+                ignore_quiet=True,
             )
 
         caption_writer: StreamingCaptionWriter | None = None
 
         if caption_format:
-            caption_writer = StreamingCaptionWriter(caption_format)
+            caption_writer = StreamingCaptionWriter(caption_format, echo=self._echo)
             note = f"Model: {model} · Language: {language}"
             if diarize:
                 note += " · Speaker labels enabled"
             note += " · Ctrl+D to finish"
-            caption_writer.print_header(
-                note=note if caption_format == "webvtt" else None
-            )
+            try:
+                caption_writer.print_header(
+                    note=note if caption_format == "webvtt" else None
+                )
+            except BrokenPipeError:
+                live.silence_stdout()
         else:
             status.print(
                 f"[green]✓[/green] Streaming stdin · {model} · send EOF (Ctrl+D) to finish"
             )
 
-        import asyncio
-
-        try:
-            result = asyncio.run(
-                self._ws_stdin(
-                    client,
-                    model=model,
-                    language=language,
-                    api_version=api_version,
-                    diarize=diarize,
-                    smart_format=smart_format,
-                    punctuate=punctuate,
-                    interim=interim,
-                    redact=redact,
-                    numerals=numerals,
-                    encoding=resolved_encoding,
-                    sample_rate=sample_rate,
-                    channels=channels,
-                    caption_writer=caption_writer,
-                )
+        _freeze_at_exit()
+        return asyncio.run(
+            self._ws_stdin(
+                client,
+                model=model,
+                language=language,
+                api_version=api_version,
+                diarize=diarize,
+                smart_format=smart_format,
+                punctuate=punctuate,
+                interim=interim,
+                redact=redact,
+                numerals=numerals,
+                encoding=resolved_encoding,
+                sample_rate=sample_rate,
+                channels=channels,
+                caption_writer=caption_writer,
+                caption_format=caption_format,
+                save_to=save_to,
             )
-        except KeyboardInterrupt:
-            status.print("\n[yellow]Stopped.[/yellow]")
-            result = ListenResult(status="success", source="stdin", mode="live")
-
-        if save_to:
-            if caption_writer and caption_writer.accumulated_words:
-                content = captions_from_words(
-                    caption_writer.accumulated_words, caption_format or "webvtt"
-                )
-            elif result.transcript:
-                content = result.transcript
-            else:
-                content = ""
-            if content:
-                self._save_transcript(content, save_to)
-                status.print(f"[green]✓[/green] Saved to {save_to}")
-
-        return result
+        )
 
     async def _ws_stdin(
         self,
@@ -1050,9 +1213,13 @@ async def _ws_stdin(
         sample_rate: int,
         channels: int,
         caption_writer: StreamingCaptionWriter | None = None,
-    ) -> ListenResult:
+        caption_format: str | None = None,
+        save_to: str | None = None,
+    ) -> BaseResult | ListenCodedError:
         import asyncio
 
+        from . import live
+
         url = self._ws_url(
             client,
             api_version=api_version,
@@ -1068,95 +1235,250 @@ async def _ws_stdin(
             sample_rate=sample_rate,
             channels=channels,
         )
+        self._ws_host = urlsplit(url).hostname or ""
         api_key = client.auth_manager.get_api_key()
         full_transcript: list[str] = []
         v2_state = self._new_v2_state() if api_version >= 2 else None
 
-        async with _live_connect(url, api_key) as ws:
-            loop = asyncio.get_running_loop()
-            audio_queue: asyncio.Queue[bytes | Exception | None] = asyncio.Queue()
-            stop_reader = threading.Event()
-
-            def post_audio(item: bytes | Exception | None) -> None:
-                if stop_reader.is_set():
-                    return
-                try:
-                    loop.call_soon_threadsafe(audio_queue.put_nowait, item)
-                except RuntimeError:
-                    # The event loop already closed after a stream failure.
-                    pass
+        loop = asyncio.get_running_loop()
+        queue: asyncio.Queue[Any] = asyncio.Queue(maxsize=live.QUEUE_MAX)
+        closing = threading.Event()
+        reader = live.StdinReader(
+            loop,
+            queue,
+            closing,
+            read_size=live.frame_bytes(encoding, sample_rate, channels),
+            fd=_stdin_fd(),
+        )
 
-            def read_stdin() -> None:
-                try:
-                    while not stop_reader.is_set():
-                        data = sys.stdin.buffer.read(4096)
-                        if stop_reader.is_set():
-                            return
-                        post_audio(data or None)
-                        if not data:
-                            return
-                except Exception as exc:
-                    post_audio(exc)
-
-            reader_thread = threading.Thread(
-                target=read_stdin,
-                name="deepctl-stdin-reader",
-                daemon=True,
+        def on_message(raw: str | bytes) -> None:
+            self._handle_ws_message(
+                raw,
+                full_transcript,
+                diarize=diarize,
+                interim=interim,
+                caption_writer=caption_writer,
+                v2_state=v2_state,
             )
 
-            async def send_audio() -> None:
-                reader_thread.start()
-                try:
-                    while True:
-                        item = await audio_queue.get()
-                        if item is None:
-                            break
-                        if isinstance(item, Exception):
-                            raise item
-                        await ws.send(item)
-                    await ws.send(json.dumps({"type": "CloseStream"}))
-                finally:
-                    stop_reader.set()
-
-            async def recv_transcripts() -> None:
-                async for msg in ws:
-                    self._handle_ws_message(
-                        msg,
-                        full_transcript,
-                        diarize=diarize,
-                        interim=interim,
-                        caption_writer=caption_writer,
-                        v2_state=v2_state,
-                    )
+        outcome = await live.run_session(
+            url,
+            {"Authorization": f"Token {api_key}"},
+            on_message=on_message,
+            queue=queue,
+            closing=closing,
+            start_source=reader.start,
+            keepalive=api_version < 2,
+            byte_rate=live.bytes_per_second(encoding, sample_rate, channels),
+        )
+        return self._finish_live(
+            outcome,
+            source="stdin",
+            model=model,
+            language=language,
+            diarize=diarize,
+            transcript_acc=full_transcript,
+            caption_writer=caption_writer,
+            caption_format=caption_format,
+            save_to=save_to,
+            v2_state=v2_state,
+        )
 
-            send_task = asyncio.create_task(send_audio())
-            recv_task = asyncio.create_task(recv_transcripts())
-            try:
-                await asyncio.gather(send_task, recv_task)
-            except (KeyboardInterrupt, asyncio.CancelledError):
-                # Mirror the mic path: on Ctrl-C drain the tasks but do NOT
-                # re-raise, so we fall through to _flush_v2 + the return below
-                # and the partial transcript (and --save-to) survive. Fatal
-                # errors still propagate via the BaseException clause.
-                await _cancel_and_drain(send_task, recv_task)
-            except BaseException:
-                await _cancel_and_drain(send_task, recv_task)
-                raise
+    def _finish_live(
+        self,
+        outcome: live.LiveOutcome,
+        *,
+        source: str,
+        model: str,
+        language: str,
+        diarize: bool,
+        transcript_acc: list[str],
+        caption_writer: StreamingCaptionWriter | None,
+        caption_format: str | None,
+        save_to: str | None,
+        v2_state: dict[str, Any] | None,
+    ) -> BaseResult | ListenCodedError:
+        """Turn a session outcome into the command result, after the socket
+        is closed: flush Flux turns, report, and run ``--save-to``."""
+        from . import live
 
         # Flux may close mid-turn without an EndOfTurn; emit what we have.
         if v2_state is not None:
-            self._flush_v2(v2_state, full_transcript, caption_writer=caption_writer)
+            try:
+                self._flush_v2(v2_state, transcript_acc, caption_writer=caption_writer)
+            except BrokenPipeError:
+                live.silence_stdout()
+            except OSError as exc:
+                live.silence_stdout()
+                if outcome.status == "success":
+                    outcome = live.output_failed(exc)
+
+        if outcome.status == "cancelled":
+            status.print("\n[yellow]Stopped.[/yellow]")
+            if outcome.incomplete:
+                print_warning(msg.W_LISTEN_STOP_INCOMPLETE, stderr=True)
+            if outcome.signal == getattr(signal, "SIGTERM", None):
+                # Drained like Ctrl-C; the process then ends by SIGTERM
+                # (exit_code_for), so supervisors see the status they sent.
+                self._reraise_signal = outcome.signal
+
+        transcript = " ".join(transcript_acc)
+        saved_to: str | None = None
+        if save_to:
+            if caption_writer and caption_writer.accumulated_words:
+                content = captions_from_words(
+                    caption_writer.accumulated_words, caption_format or "webvtt"
+                )
+            else:
+                content = transcript
+            if content:
+                self._save_transcript(content, save_to)
+                saved_to = save_to
+                status.print(f"[green]✓[/green] Saved to {save_to}")
 
-        return ListenResult(
+        def kept() -> dict[str, Any]:
+            # The finals received so far travel with a failure.
+            out: dict[str, Any] = {
+                "transcript": transcript,
+                "transcript_chars": len(transcript),
+            }
+            if saved_to:
+                out["saved_to"] = saved_to
+            return out
+
+        self._live_kept = kept()
+        if outcome.status == "drain_timeout":
+            limit = round(outcome.drain_limit_s, 3)
+            template = (
+                msg.E_DRAIN_CAP
+                if outcome.drain_reason == "cap"
+                else msg.E_DRAIN_TIMEOUT
+            )
+            text = template.format(limit_s=f"{limit:g}")
+            return self._coded_failure(
+                text,
+                code=msg.CODE_STREAM_DRAIN_TIMEOUT,
+                hint_human=msg.H_DRAIN_TIMEOUT,
+                hint_agent=msg.H_DRAIN_TIMEOUT,
+                details={
+                    "reason": outcome.drain_reason or "idle",
+                    "limit_s": limit,
+                    **kept(),
+                },
+            )
+        if outcome.status == "error" and outcome.kind == "server":
+            server: dict[str, Any] = {}
+            if outcome.close_code is not None:
+                server["close_code"] = outcome.close_code
+            if outcome.request_id:
+                server["request_id"] = outcome.request_id
+            return self._coded_failure(
+                outcome.error or "",
+                code=msg.CODE_SERVER_ERROR,
+                hint_human=msg.H_SERVER,
+                hint_agent=msg.A_SERVER,
+                details={**server, **kept()},
+            )
+        if outcome.status == "error" and outcome.kind == "network":
+            return self._coded_failure(
+                outcome.error or msg.E_LISTEN_CONNECTION_LOST,
+                code=msg.CODE_NETWORK_UNAVAILABLE,
+                hint_human=msg.H_NETWORK,
+                hint_agent=msg.A_NETWORK.format(prog=_prog()),
+                details={
+                    "host": self._ws_host,
+                    "reason": "connection lost",
+                    **kept(),
+                },
+            )
+
+        if outcome.status == "error" and outcome.kind == "output":
+            return self._output_unwritable(outcome.os_error or "", kept())
+        if outcome.status == "error" and outcome.kind == "read":
+            # Reading stdin failed (EISDIR, EBADF, EIO on a hang-up). The
+            # fix is the same as for a missing source: pass a file or URL.
+            return self._coded_failure(
+                outcome.error or "",
+                code=msg.CODE_INVALID_ARGUMENT,
+                hint_human=msg.H_LISTEN_STDIN_UNREADABLE,
+                hint_agent=msg.A_LISTEN_STDIN_UNREADABLE,
+                details=kept(),
+                next_step=f"{_prog()} {self.name} --help",
+            )
+
+        if outcome.status == "error":
+            # An error of no known kind: report it without a stdin hint.
+            return self._coded_failure(
+                outcome.error or msg.E_LISTEN_CONNECTION_LOST,
+                code=msg.CODE_NETWORK_UNAVAILABLE,
+                hint_human=msg.H_NETWORK,
+                hint_agent=msg.A_NETWORK.format(prog=_prog()),
+                details={"host": self._ws_host, "reason": "connection lost", **kept()},
+            )
+
+        result = ListenResult(
             status="success",
-            source="stdin",
+            source=source,
             mode="live",
             model=model,
             language=language,
             diarized=diarize,
-            transcript=" ".join(full_transcript),
+            transcript=transcript,
             caption_format=caption_writer.fmt if caption_writer else None,
         )
+        if outcome.status == "cancelled" and not (
+            source == "mic" and outcome.signal == signal.SIGINT
+        ):
+            # Ctrl-C is how a mic session normally ends: the transcript so
+            # far is the result, exit 0. Other sources, and SIGTERM for
+            # every source, stay "cancelled". Ctrl-Break on Windows is a
+            # hard stop like SIGTERM, so it stays "cancelled" on mic too.
+            result.status = "cancelled"
+        return result
+
+    def _coded_failure(
+        self,
+        text: str,
+        *,
+        code: str,
+        hint_human: str,
+        hint_agent: str,
+        details: dict[str, Any],
+        next_step: str | None = None,
+    ) -> ListenCodedError:
+        """Report a live-stream failure on stderr and return its envelope."""
+        hint = hint_agent if (_agentic or is_ai_agent()) else hint_human
+        print_error(escape(text))
+        print_hint(escape(hint))
+        return ListenCodedError(
+            error=text, code=code, hint=hint, next_step=next_step, details=details
+        )
+
+    def _output_unwritable(
+        self, os_error: str, kept: dict[str, Any]
+    ) -> ListenCodedError:
+        """stdout couldn't be written: fd 1 is already silenced,
+        so the envelope goes to stderr only, as its two lines."""
+        return self._coded_failure(
+            msg.E_OUTPUT_UNWRITABLE.format(output="stdout", reason=os_error),
+            code=msg.CODE_OUTPUT_UNWRITABLE,
+            hint_human=msg.H_OUTPUT_UNWRITABLE,
+            hint_agent=msg.A_OUTPUT_UNWRITABLE.format(prog=_prog(), reason=os_error),
+            details={"path": "-", "reason": os_error, **kept},
+        )
+
+    def exit_code_for(self, result: Any) -> int:
+        """A SIGTERM-drained stream ends by SIGTERM itself: the
+        result is already written, so flush and re-raise it here. A final
+        result that couldn't be written to stdout exits 1."""
+        if self._reraise_signal is not None:
+            signum, self._reraise_signal = self._reraise_signal, None
+            from . import live
+
+            live.die_by_signal(signum)
+        if self._output_failed:
+            return 1
+        return super().exit_code_for(result)
 
     # ── Shared WebSocket helpers ───────────────────────────────────────
 
@@ -1248,7 +1570,9 @@ def _handle_ws_message(
         if msg_type == "Error" and v2_state is not None:
             code = data.get("code") or "UNKNOWN_ERROR"
             description = data.get("description") or "No description provided"
-            raise click.ClickException(f"Flux STT error ({code}): {description}")
+            raise click.ClickException(
+                msg.E_LISTEN_FLUX_ERROR.format(flux_code=code, description=description)
+            )
 
         if msg_type != "Results":
             return
@@ -1277,18 +1601,37 @@ def _handle_ws_message(
                 line = format_diarized_words(words)
                 if line:
                     transcript_acc.append(line)
-                    print(line, flush=True)
+                    self._print_final(line)
                     return
 
             transcript = alt.get("transcript", "")
             if transcript:
                 transcript_acc.append(transcript)
-                print(transcript, flush=True)
+                self._print_final(transcript)
 
         elif interim and not caption_writer:
             transcript = alt.get("transcript", "")
             if transcript:
-                print(f"\r{transcript}          ", end="", flush=True)
+                self._print_interim(transcript)
+
+    def _print_final(self, line: str) -> None:
+        """A final transcript line: stdout, or under a machine format only
+        ``INFO:`` on stderr with ``--verbose`` (the result is the payload)."""
+        if self._echo:
+            print(line, flush=True)
+        else:
+            if self._verbose:
+                try:
+                    print_info(escape(line), stderr=True)
+                except OSError:
+                    # A failing stderr is not a failing stdout: keep
+                    # streaming, and keep the result that is the payload.
+                    pass
+
+    def _print_interim(self, text: str) -> None:
+        """An interim rewrite; dropped under a machine format."""
+        if self._echo:
+            print(f"\r{text}          ", end="", flush=True)
 
     @staticmethod
     def _new_v2_state() -> dict[str, Any]:
@@ -1343,7 +1686,7 @@ def _handle_v2_turn(
         if event == "EndOfTurn":
             self._emit_v2_turn(st, transcript_acc, caption_writer=caption_writer)
         elif event == "Update" and interim and not caption_writer and transcript:
-            print(f"\r{transcript}          ", end="", flush=True)
+            self._print_interim(transcript)
 
     def _emit_v2_turn(
         self,
@@ -1366,7 +1709,7 @@ def _emit_v2_turn(
             transcript_acc.append(transcript)
         else:
             transcript_acc.append(transcript)
-            print(transcript, flush=True)
+            self._print_final(transcript)
 
     @staticmethod
     def _timed_v2_words(
@@ -1422,29 +1765,61 @@ def output_result(self, result: Any, config: Config) -> None:
         import json as _json
         from datetime import date, datetime
 
+        from . import live
+
         def _default(obj: Any) -> str:
             if isinstance(obj, (datetime, date)):
                 return obj.isoformat()
             return str(obj)
 
-        from deepctl_core.output import get_output_format
-
         fmt = get_output_format()
 
-        if not isinstance(result, ListenResult) or result.status != "success":
-            super().output_result(result, config)
+        # Live: transcript lines (or captions) were printed as they arrived.
+        # Under a machine format nothing was, and the final result, whatever
+        # its status, is the one payload on stdout.
+        if isinstance(result, ListenResult) and result.mode == "live":
+            if fmt not in ("json", "yaml"):
+                return
+            payload = result.model_dump(exclude_none=True)
+            try:
+                if fmt == "json":
+                    sys.stdout.write(
+                        _json.dumps(
+                            payload, indent=2, ensure_ascii=False, default=_default
+                        )
+                        + "\n"
+                    )
+                    sys.stdout.flush()
+                else:
+                    import yaml
+
+                    sys.stdout.write(
+                        yaml.safe_dump(payload, sort_keys=False, allow_unicode=True)
+                    )
+                    sys.stdout.flush()
+            except BrokenPipeError:
+                # The reader went away (`| true`): end quietly, exit as is.
+                live.silence_stdout()
+            except OSError as exc:
+                # stdout can't take the result (ENOSPC, EIO): output_unwritable
+                # on stderr, exit 1.
+                live.silence_stdout()
+                reason = live.output_failed(exc).os_error or ""
+                kept = self._live_kept or {
+                    "transcript": result.transcript,
+                    "transcript_chars": len(result.transcript),
+                }
+                self._output_unwritable(reason, kept)
+                self._output_failed = True
             return
 
-        # Live results are printed in real-time; only show a brief summary
-        if result.mode == "live":
-            if result.caption_format:
-                return  # captions were already printed incrementally
-            if result.status == "success" and not result.transcript:
-                return  # nothing to add
-            if fmt == "json":
-                out.print_json(
-                    _json.dumps(result.model_dump(exclude_none=True), default=_default)
-                )
+        if not isinstance(result, ListenResult) or result.status != "success":
+            try:
+                super().output_result(result, config)
+            except OSError:
+                # Already reported on stderr; keep the exit flush from
+                # failing again on a full or broken stdout.
+                live.silence_stdout()
             return
 
         # Caption mode: print captions to stdout regardless of output format
@@ -1480,7 +1855,12 @@ def _print_prerecorded_result(self, result: ListenResult) -> None:
         table.add_column("Key", style="dim")
         table.add_column("Value")
 
-        table.add_row("Source", result.source_path)
+        source_shown = result.source_path
+        if result.source == "url":
+            from deepctl_shared_utils.validation import display_url
+
+            source_shown = display_url(source_shown)
+        table.add_row("Source", source_shown)
         table.add_row("Model", model_name or result.model)
         if model_version:
             table.add_row("Version", model_version)
diff --git a/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/live.py b/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/live.py
new file mode 100644
index 00000000..32d28e92
--- /dev/null
+++ b/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/live.py
@@ -0,0 +1,751 @@
+"""Live streaming engine for ``dg listen`` (stdin and microphone).
+
+One WebSocket session: audio goes up from a bounded queue, transcripts come
+down to a callback, and the session ends one of four ways:
+
+- the server closes the stream (exit 0, or 1 if it reported an error);
+- stdin reaches end of input: ``CloseStream``, then wait for the server to
+  close under an idle deadline and an absolute cap (``stream_drain_timeout``
+  if either expires);
+- Ctrl-C (or Ctrl-Break on Windows): ``CloseStream``, then wait at most
+  ``STOP_DRAIN_S`` for the server's last results (exit 2). On ``--mic``,
+  Ctrl-C is how the session ends, so it exits 0; Ctrl-Break stays a hard
+  stop (exit 2). SIGTERM on POSIX drains the same way, and the command
+  then re-raises it. A second signal ends the process at once;
+- the connection fails (exit 1).
+
+Stdin is read with ``os.read(0, cap)`` in a daemon thread that hands each
+buffer to the event loop and waits until the bounded queue accepts it, so a
+slow uplink holds back the producer instead of filling memory. The thread is
+never joined. Before every read and every hand-off it checks ``closing``,
+which shutdown sets before it cancels any task; anything raised in the thread
+(including a cancelled hand-off while the loop shuts down) ends the thread
+quietly. ``loop.connect_read_pipe`` isn't used: it rejects a regular file on
+stdin, misbehaves on ``/dev/null``, sets ``O_NONBLOCK`` on a descriptor shared
+with the parent, and doesn't work with the Windows Proactor loop.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import re
+import signal
+import threading
+import time
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Any
+
+import click
+from deepctl_core.signals import die_by_signal as die_by_signal  # re-export
+
+from . import messages as msg
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+# ── Tunables ────────────────────────────────────────────────────────────────
+
+#: Each read takes at most this much audio. The plan allows 20-100 ms; 50 ms
+#: keeps frames small for latency while a regular file still goes up in a
+#: reasonable number of messages. A pipe read returns whatever is there, so
+#: paced input goes up at the writer's own pace whatever this is.
+FRAME_MS = 50
+#: Read size when the encoding gives no byte rate (opus, flac, containers).
+DEFAULT_READ_BYTES = 4096
+#: Audio buffers waiting to be sent. With FRAME_MS that is 1.6 s of audio.
+QUEUE_MAX = 32
+#: Ctrl-C: how long to wait for the server's last results after CloseStream.
+STOP_DRAIN_S = 1.0
+#: End of input: give up when the server has sent nothing for this long.
+EOF_IDLE_S = 10.0
+#: End of input: the absolute cap is max(EOF_CAP_MIN_S, 2 x the work left).
+EOF_CAP_MIN_S = 30.0
+#: Send a KeepAlive after this long without audio (listen v1 only).
+KEEPALIVE_AFTER_S = 5.0
+#: Bound on the WebSocket closing handshake once the outcome is known.
+CLOSE_TIMEOUT_S = 1.0
+
+#: Bytes per sample for encodings whose byte rate is known from the rate.
+_PCM_WIDTH = {"linear16": 2, "linear32": 4, "mulaw": 1, "alaw": 1}
+
+CLOSE_STREAM = json.dumps({"type": "CloseStream"})
+KEEP_ALIVE = json.dumps({"type": "KeepAlive"})
+
+
+def bytes_per_second(encoding: str | None, sample_rate: int, channels: int) -> int:
+    """Byte rate of raw PCM, mulaw or alaw audio; 0 when it isn't knowable."""
+    width = _PCM_WIDTH.get((encoding or "").lower())
+    if not width or sample_rate <= 0 or channels <= 0:
+        return 0
+    return width * sample_rate * channels
+
+
+def frame_bytes(encoding: str | None, sample_rate: int, channels: int) -> int:
+    """Largest read for one frame: FRAME_MS of audio, or a fixed size.
+
+    Rounded down to whole sample frames so a read never splits a sample.
+    """
+    rate = bytes_per_second(encoding, sample_rate, channels)
+    if not rate:
+        return DEFAULT_READ_BYTES
+    width = _PCM_WIDTH[(encoding or "").lower()] * channels
+    size = rate * FRAME_MS // 1000
+    return max(width, size - size % width)
+
+
+# ── Audio sources ───────────────────────────────────────────────────────────
+
+
+class StdinReader:
+    """Reads a file descriptor in a daemon thread into a bounded queue.
+
+    Puts ``bytes`` for audio, ``b""`` once at end of input, or the
+    ``OSError`` a read raised. Never joined: a read blocked on an idle pipe
+    can't be interrupted portably, and the process may exit while it waits.
+    """
+
+    def __init__(
+        self,
+        loop: asyncio.AbstractEventLoop,
+        queue: asyncio.Queue[Any],
+        closing: threading.Event,
+        *,
+        read_size: int,
+        fd: int = 0,
+    ) -> None:
+        self._loop = loop
+        self._queue = queue
+        self._closing = closing
+        self._read_size = read_size
+        self._fd = fd
+
+    def start(self) -> None:
+        threading.Thread(
+            target=self._run, name="deepctl-stdin-reader", daemon=True
+        ).start()
+
+    def _put(self, item: Any) -> bool:
+        """Hand ``item`` to the loop and wait for the queue to take it."""
+        if self._closing.is_set() or self._loop.is_closed():
+            return False
+        coro = self._queue.put(item)
+        try:
+            future = asyncio.run_coroutine_threadsafe(coro, self._loop)
+        except BaseException:
+            # The loop closed between the check and the call.
+            coro.close()
+            return False
+        future.result()
+        return True
+
+    def _run(self) -> None:
+        try:
+            # Keep Ctrl-C on the main thread, where the handler runs; a
+            # signal routed here would only interrupt the read.
+            if hasattr(signal, "pthread_sigmask"):
+                signal.pthread_sigmask(
+                    signal.SIG_BLOCK, {signal.SIGINT, signal.SIGTERM}
+                )
+            while not self._closing.is_set():
+                try:
+                    data = os.read(self._fd, self._read_size)
+                except BlockingIOError:
+                    # The parent left O_NONBLOCK on the shared descriptor.
+                    # Wait for data rather than change its flags.
+                    _wait_readable(self._fd)
+                    continue
+                except OSError as exc:
+                    self._put(exc)
+                    return
+                if self._closing.is_set():
+                    return
+                if not self._put(data) or not data:
+                    return
+        except BaseException:
+            # Shutdown cancelled the hand-off, or the loop is gone. Either
+            # way the session no longer wants audio.
+            return
+
+
+def _wait_readable(fd: int) -> None:
+    """Block (in short slices) until ``fd`` has data or is at end of input."""
+    import select
+
+    try:
+        select.select([fd], [], [], 0.2)
+    except (OSError, ValueError):
+        time.sleep(0.2)
+
+
+class DropOldestBuffer:
+    """Microphone hand-off: the audio callback can't block, so when the queue
+    is full the oldest buffer goes. Counts what it dropped."""
+
+    def __init__(
+        self,
+        loop: asyncio.AbstractEventLoop,
+        queue: asyncio.Queue[Any],
+        closing: threading.Event,
+    ) -> None:
+        self._loop = loop
+        self._queue = queue
+        self._closing = closing
+        self.dropped_buffers = 0
+        self.dropped_bytes = 0
+
+    def offer(self, data: bytes) -> None:
+        """Call on the event loop: enqueue ``data``, dropping the oldest."""
+        if self._queue.full():
+            try:
+                old = self._queue.get_nowait()
+            except asyncio.QueueEmpty:
+                pass
+            else:
+                self.dropped_buffers += 1
+                if isinstance(old, (bytes, bytearray)):
+                    self.dropped_bytes += len(old)
+        self._queue.put_nowait(data)
+
+    def offer_threadsafe(self, data: bytes) -> None:
+        """Call from the audio thread; never raises, never blocks."""
+        if self._closing.is_set():
+            return
+        try:
+            self._loop.call_soon_threadsafe(self.offer, data)
+        except BaseException:
+            pass
+
+
+# ── Session ─────────────────────────────────────────────────────────────────
+
+
+@dataclass
+class LiveOutcome:
+    """How a live session ended."""
+
+    #: "success" (server closed), "cancelled" (Ctrl-C or SIGTERM), "error",
+    #: or "drain_timeout" (end of input, the server never finished).
+    status: str = "success"
+    #: Error text for "error" (already scrubbed and safe to print).
+    error: str | None = None
+    #: For "error": "server" (error close or error frame), "network" (the
+    #: connection dropped), "read" (stdin failed) or "output" (stdout
+    #: couldn't be written; fd 1 now points at the null device).
+    kind: str | None = None
+    #: For an "output" error: the OS error text (strerror), cleaned.
+    os_error: str | None = None
+    #: The server's close code, for a "server" error that closed the socket.
+    close_code: int | None = None
+    #: The request id the server reported, when it sent one.
+    request_id: str | None = None
+    #: The signal that stopped a "cancelled" session.
+    signal: int | None = None
+    #: The reader of stdout went away; the session ended quietly.
+    stdout_closed: bool = False
+    #: Ctrl-C: True when the server hadn't finished within STOP_DRAIN_S.
+    incomplete: bool = False
+    #: "idle" or "cap" for a drain timeout.
+    drain_reason: str | None = None
+    #: The bound that expired, in seconds, for a drain timeout.
+    drain_limit_s: float = 0.0
+
+
+@dataclass
+class _Clock:
+    last_server: float = 0.0
+    last_audio: float = 0.0
+    first_send: float | None = None
+    eof_at: float | None = None
+    bytes_sent: int = 0
+    last_final_end: float = 0.0
+
+
+def _final_end(data: dict[str, Any]) -> float | None:
+    """Audio time covered by a final result, if this message is one."""
+    if data.get("type") == "Results" and data.get("is_final"):
+        try:
+            return float(data.get("start", 0.0)) + float(data.get("duration", 0.0))
+        except (TypeError, ValueError):
+            return None
+    if data.get("type") == "TurnInfo" and data.get("event") == "EndOfTurn":
+        try:
+            return float(data.get("audio_window_end", 0.0))
+        except (TypeError, ValueError):
+            return None
+    return None
+
+
+_AUTH_RE = re.compile(r"(?i)\b(token|bearer)\s+\S+")
+
+
+def _clean(text: object, limit: int = 200, secrets: tuple[str, ...] = ()) -> str:
+    """Server-supplied text for a message: one line, printable, no
+    credentials, bounded. Secrets are scrubbed before the cut, so a
+    truncation can't leave part of one."""
+    out = "".join(ch if ch.isprintable() else " " for ch in str(text))
+    for secret in secrets:
+        if len(secret) >= 8:  # a real credential, not a stray letter
+            out = out.replace(secret, "****" + secret[-4:])
+    out = _AUTH_RE.sub(r"\1 ****", out)
+    return out.strip()[:limit]
+
+
+def _closed_outcome(exc: BaseException, secrets: tuple[str, ...]) -> LiveOutcome | None:
+    """The outcome for a connection that ended, or None for a clean close."""
+    try:
+        from websockets.exceptions import ConnectionClosed, ConnectionClosedOK
+    except Exception:  # pragma: no cover - websockets is a hard dependency
+        return LiveOutcome(
+            status="error", kind="network", error=_clean(exc, 200, secrets)
+        )
+    if isinstance(exc, ConnectionClosedOK):
+        return None
+    if isinstance(exc, ConnectionClosed):
+        rcvd = getattr(exc, "rcvd", None)
+        if rcvd is not None:
+            reason = _clean(getattr(rcvd, "reason", ""), 200, secrets)
+            code = getattr(rcvd, "code", None)
+            text = (
+                msg.E_LISTEN_SERVER_CLOSED.format(close_code=code, close_reason=reason)
+                if reason
+                else msg.E_LISTEN_SERVER_CLOSED_NO_REASON.format(close_code=code)
+            )
+            return LiveOutcome(
+                status="error",
+                kind="server",
+                error=text,
+                close_code=code if isinstance(code, int) else None,
+            )
+        return LiveOutcome(
+            status="error", kind="network", error=msg.E_LISTEN_CONNECTION_LOST
+        )
+    return LiveOutcome(
+        status="error",
+        kind="network",
+        error=_clean(exc, 200, secrets) or exc.__class__.__name__,
+    )
+
+
+def silence_stdout() -> None:
+    """The reader of stdout went away (EPIPE): point fd 1 at the null
+    device, so buffered output and later writes, including the flush at
+    exit, succeed quietly."""
+    try:
+        devnull = os.open(os.devnull, os.O_WRONLY)
+        os.dup2(devnull, 1)
+        os.close(devnull)
+    except OSError:
+        pass
+
+
+def output_failed(exc: OSError, secrets: tuple[str, ...] = ()) -> LiveOutcome:
+    """The outcome for a stdout write that failed with something other
+    than EPIPE."""
+    reason = _clean(exc.strerror or exc, 200, secrets) or exc.__class__.__name__
+    return LiveOutcome(
+        status="error",
+        kind="output",
+        error=msg.E_OUTPUT_UNWRITABLE.format(output="stdout", reason=reason),
+        os_error=reason,
+    )
+
+
+def _is_connection_closed(exc: BaseException) -> bool:
+    try:
+        from websockets.exceptions import ConnectionClosed
+    except Exception:  # pragma: no cover - websockets is a hard dependency
+        return False
+    return isinstance(exc, ConnectionClosed)
+
+
+class _SignalGuard:
+    """Ctrl-C (and Ctrl-Break on Windows) and, on POSIX, SIGTERM → ``stop``.
+
+    The first signal starts the drain; ``signum`` records which one it was.
+    A second signal ends the process at once: by SIGTERM if either signal
+    was SIGTERM, else with exit 2. Uses ``signal.signal`` rather than
+    ``loop.add_signal_handler``, which is Unix-only. Outside the main thread
+    (tests) it installs nothing.
+    """
+
+    def __init__(self, loop: asyncio.AbstractEventLoop, stop: asyncio.Event) -> None:
+        self._loop = loop
+        self._stop = stop
+        self._count = 0
+        self._previous: dict[int, Any] = {}
+        self.signum: int | None = None
+
+    def _handler(self, signum: int, _frame: Any) -> None:
+        self._count += 1
+        if self._count == 1:
+            self.signum = signum
+            try:
+                self._loop.call_soon_threadsafe(self._stop.set)
+                return
+            except BaseException:
+                pass
+        # Second signal, or the loop is already gone: leave without
+        # draining. stdout was flushed line by line.
+        sigterm = getattr(signal, "SIGTERM", None)
+        if sigterm is not None and sigterm in (signum, self.signum) and os.name != "nt":
+            die_by_signal(sigterm)
+        os._exit(2)
+
+    def install(self) -> None:
+        if threading.current_thread() is not threading.main_thread():
+            return
+        sigs = [signal.SIGINT]
+        sigbreak = getattr(signal, "SIGBREAK", None)
+        if sigbreak is not None:
+            sigs.append(sigbreak)
+        if os.name != "nt":
+            sigs.append(signal.SIGTERM)
+        for sig in sigs:
+            try:
+                self._previous[sig] = signal.signal(sig, self._handler)
+            except (OSError, ValueError):
+                pass
+
+    def restore(self) -> None:
+        for sig, previous in self._previous.items():
+            try:
+                signal.signal(sig, previous)
+            except (OSError, ValueError, TypeError):
+                pass
+        self._previous.clear()
+
+
+class EarlyStop:
+    """Ctrl-C for a mic session before ``run_session`` installs its guard.
+
+    Installed before the banner, so a Ctrl-C during the imports or while
+    connecting is recorded instead of raising ``KeyboardInterrupt``; once
+    ``bind`` hands over the session's ``stop`` event, it ends the session
+    like the guard's first signal would. A second Ctrl-C exits at once.
+    asyncio.run leaves a non-default SIGINT handler alone, so this one stays
+    in place until ``restore``. Outside the main thread it does nothing.
+    """
+
+    def __init__(self) -> None:
+        self.signum: int | None = None
+        self._loop: asyncio.AbstractEventLoop | None = None
+        self._stop: asyncio.Event | None = None
+        self._previous: Any = None
+        self._installed = False
+
+    def _handler(self, signum: int, _frame: Any) -> None:
+        if self.signum is not None:
+            os._exit(2)
+        self.signum = signum
+        if self._loop is not None and self._stop is not None:
+            try:
+                self._loop.call_soon_threadsafe(self._stop.set)
+            except RuntimeError:
+                pass
+
+    def install(self) -> None:
+        if threading.current_thread() is not threading.main_thread():
+            return
+        try:
+            self._previous = signal.signal(signal.SIGINT, self._handler)
+            self._installed = True
+        except (OSError, ValueError):
+            pass
+
+    def bind(self, loop: asyncio.AbstractEventLoop) -> asyncio.Event:
+        """The ``stop`` event for ``run_session``; already set if Ctrl-C came."""
+        self._stop = asyncio.Event()
+        self._loop = loop
+        if self.signum is not None:
+            self._stop.set()
+        return self._stop
+
+    def restore(self) -> None:
+        if self._installed:
+            try:
+                signal.signal(signal.SIGINT, self._previous)
+            except (OSError, ValueError, TypeError):
+                pass
+            self._installed = False
+
+
+async def _cancel_all(*tasks: asyncio.Task[Any] | None) -> None:
+    live = [t for t in tasks if t is not None]
+    for task in live:
+        if not task.done():
+            task.cancel()
+    for task in live:
+        try:
+            await task
+        except BaseException:
+            pass
+
+
+def _open(url: str, headers: dict[str, str], **options: Any) -> Any:
+    """Open the live socket; a redirect on the upgrade, to the same origin
+    or another, raises ``RedirectRefused`` before a second connection, so
+    the key and the audio go only to the host that passed the host check."""
+    from deepctl_core.websocket import open_async
+
+    return open_async(url, headers, command="dg listen", payload="audio", **options)
+
+
+async def run_session(
+    url: str,
+    headers: dict[str, str],
+    *,
+    on_message: Callable[[str | bytes], None],
+    queue: asyncio.Queue[Any],
+    closing: threading.Event,
+    start_source: Callable[[], None],
+    keepalive: bool,
+    byte_rate: int,
+    stop: asyncio.Event | None = None,
+) -> LiveOutcome:
+    """Run one live session; see the module docstring for how it ends.
+
+    ``queue`` carries audio ``bytes``, ``b""`` at end of input, or an
+    exception from the source. ``start_source`` starts the producer once the
+    socket is open. ``byte_rate`` is the audio byte rate when it is known
+    (raw PCM, mulaw, alaw), else 0. ``closing`` is set before any task is
+    cancelled, so the producer stops handing over audio first.
+    """
+    loop = asyncio.get_running_loop()
+    stop = stop or asyncio.Event()
+    guard = _SignalGuard(loop, stop)
+    guard.install()
+    clock = _Clock()
+    now = time.monotonic
+    # Values that must never be echoed back (the credential in the header).
+    secrets = tuple(v.split(" ", 1)[-1] for v in headers.values())
+    request_id: str | None = None
+    ws: Any = None
+    tasks: dict[str, asyncio.Task[Any] | None] = {}
+    last: list[LiveOutcome] = []
+
+    def track(raw: str | bytes) -> None:
+        nonlocal request_id
+        clock.last_server = now()
+        try:
+            data = json.loads(raw)
+        except Exception:
+            return
+        if isinstance(data, dict):
+            rid = data.get("request_id") or (data.get("metadata") or {}).get(
+                "request_id"
+            )
+            if isinstance(rid, str) and not request_id:
+                request_id = _clean(rid, 100, secrets)
+            end = _final_end(data)
+            if end is not None:
+                clock.last_final_end = max(clock.last_final_end, end)
+
+    async def receive() -> LiveOutcome | None:
+        """Read until the server closes. Returns the failure, or None."""
+        try:
+            async for raw in ws:
+                track(raw)
+                try:
+                    on_message(raw)
+                except BrokenPipeError:
+                    raise
+                except OSError as exc:
+                    # stdout can't be written (ENOSPC, EIO, ...): an output
+                    # failure, not a network one. Silence fd 1 so the exit
+                    # flush can't fail again.
+                    silence_stdout()
+                    return output_failed(exc, secrets)
+        except BrokenPipeError:
+            # Whoever read stdout is gone (``| head -n 1``): end quietly.
+            silence_stdout()
+            return LiveOutcome(stdout_closed=True)
+        except click.ClickException as exc:
+            # A server-reported error frame (Flux "Error").
+            return LiveOutcome(
+                status="error", kind="server", error=_clean(exc.message, 200, secrets)
+            )
+        except Exception as exc:
+            return _closed_outcome(exc, secrets)
+        return None
+
+    def ended(result: LiveOutcome | None) -> LiveOutcome:
+        out = result or LiveOutcome()
+        out.request_id = request_id
+        last.append(out)
+        return out
+
+    async def send_audio() -> str:
+        """Send audio until end of input, then CloseStream. Returns "eof"."""
+        while True:
+            item = await queue.get()
+            if isinstance(item, BaseException):
+                raise item
+            if not item:
+                break
+            await ws.send(item)
+            t = now()
+            clock.last_audio = t
+            if clock.first_send is None:
+                clock.first_send = t
+            clock.bytes_sent += len(item)
+        clock.eof_at = now()
+        await ws.send(CLOSE_STREAM)
+        return "eof"
+
+    async def keep_alive() -> None:
+        last = now()
+        while True:
+            await asyncio.sleep(0.5)
+            t = now()
+            if t - max(clock.last_audio, last) >= KEEPALIVE_AFTER_S:
+                await ws.send(KEEP_ALIVE)
+                last = t
+
+    def eof_cap() -> float:
+        if byte_rate:
+            behind = clock.bytes_sent / byte_rate - clock.last_final_end
+        else:
+            start = clock.first_send if clock.first_send is not None else clock.eof_at
+            behind = (clock.eof_at or now()) - (start or now())
+        return max(EOF_CAP_MIN_S, 2.0 * max(0.0, behind))
+
+    async def finish_on_stop(deadline: float) -> LiveOutcome:
+        """Ctrl-C: stop sending, CloseStream, wait for the server until deadline."""
+        closing.set()
+        await _cancel_all(tasks.get("send"), tasks.get("keepalive"))
+        recv = tasks["recv"]
+        assert recv is not None
+        if clock.eof_at is None and not recv.done():
+            try:
+                await asyncio.wait_for(
+                    ws.send(CLOSE_STREAM), max(0.0, deadline - now())
+                )
+            except BaseException:
+                pass
+        if not recv.done():
+            await asyncio.wait({recv}, timeout=max(0.0, deadline - now()))
+        done = recv.done() and not recv.cancelled()
+        return LiveOutcome(
+            status="cancelled",
+            incomplete=not done,
+            signal=guard.signum,
+            request_id=request_id,
+        )
+
+    try:
+        stop_wait = asyncio.ensure_future(stop.wait())
+        tasks["stop"] = stop_wait
+        connect = asyncio.ensure_future(
+            _open(url, headers, compression=None, close_timeout=CLOSE_TIMEOUT_S)
+        )
+        tasks["connect"] = connect
+        await asyncio.wait({connect, stop_wait}, return_when=asyncio.FIRST_COMPLETED)
+        if not connect.done():
+            closing.set()
+            await _cancel_all(connect)
+            return LiveOutcome(status="cancelled", signal=guard.signum)
+        ws = connect.result()
+        clock.last_server = clock.last_audio = now()
+
+        start_source()
+        recv = asyncio.ensure_future(receive())
+        send = asyncio.ensure_future(send_audio())
+        tasks.update(recv=recv, send=send)
+        if keepalive:
+            tasks["keepalive"] = asyncio.ensure_future(keep_alive())
+
+        # ── Streaming ─────────────────────────────────────────────────
+        await asyncio.wait({recv, send, stop_wait}, return_when=asyncio.FIRST_COMPLETED)
+
+        if stop_wait.done():
+            return await finish_on_stop(now() + STOP_DRAIN_S)
+
+        if recv.done():
+            return ended(recv.result())
+
+        # The sender finished first: end of input, or a failure.
+        try:
+            send.result()
+        except Exception as exc:
+            if _is_connection_closed(exc):
+                # The socket went away while sending; the receiver has the
+                # reason (or soon will).
+                await asyncio.wait({recv}, timeout=CLOSE_TIMEOUT_S)
+                return ended(
+                    recv.result() if recv.done() else _closed_outcome(exc, secrets)
+                )
+            reason = getattr(exc, "strerror", None) or exc
+            return ended(
+                LiveOutcome(
+                    status="error",
+                    kind="read",
+                    error=msg.E_LISTEN_STDIN_UNREADABLE.format(
+                        os_error=_clean(reason, 200, secrets)
+                    ),
+                )
+            )
+
+        # ── End of input: drain ───────────────────────────────────────
+        await _cancel_all(tasks.get("keepalive"))
+        assert clock.eof_at is not None
+        cap = eof_cap()
+        cap_at = clock.eof_at + cap
+        while True:
+            idle_at = max(clock.eof_at, clock.last_server) + EOF_IDLE_S
+            wake = min(idle_at, cap_at)
+            remaining = wake - now()
+            if remaining <= 0:
+                closing.set()
+                if cap_at <= idle_at:
+                    return ended(
+                        LiveOutcome(
+                            status="drain_timeout",
+                            drain_reason="cap",
+                            drain_limit_s=cap,
+                        )
+                    )
+                return ended(
+                    LiveOutcome(
+                        status="drain_timeout",
+                        drain_reason="idle",
+                        drain_limit_s=EOF_IDLE_S,
+                    )
+                )
+            await asyncio.wait(
+                {recv, stop_wait},
+                timeout=remaining,
+                return_when=asyncio.FIRST_COMPLETED,
+            )
+            if recv.done():
+                return ended(recv.result())
+            if stop_wait.done():
+                return await finish_on_stop(now() + STOP_DRAIN_S)
+    finally:
+        # Order matters: stop the producer before cancelling anything, so a
+        # hand-off cancelled below can't surface in the reader thread.
+        closing.set()
+        await _cancel_all(*(t for k, t in tasks.items() if k != "recv"))
+        recv_task = tasks.get("recv")
+        if ws is not None:
+            if recv_task is None or not recv_task.done():
+                # The server hasn't closed: don't wait for its handshake.
+                transport = getattr(ws, "transport", None)
+                if transport is not None:
+                    transport.abort()
+            close = getattr(ws, "close", None)
+            if close is not None:
+                try:
+                    await asyncio.wait_for(close(), CLOSE_TIMEOUT_S)
+                except BaseException:
+                    pass
+        await _cancel_all(recv_task)
+        guard.restore()
+        # A signal that landed while the server was closing still counts:
+        # the clean close becomes a stop by that signal.
+        if guard.signum is not None:
+            for out in last:
+                if out.status == "success" and not out.stdout_closed:
+                    out.status = "cancelled"
+                    out.signal = guard.signum
diff --git a/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/messages.py b/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/messages.py
new file mode 100644
index 00000000..9d812f79
--- /dev/null
+++ b/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/messages.py
@@ -0,0 +1,100 @@
+"""User-facing strings for ``dg listen``'s live path, keyed by message ID.
+
+Every ID and string matches the error catalogue (``error_codes.json``)
+exactly; the attribute name is the ID with ``-`` as ``_``.
+"""
+
+from __future__ import annotations
+
+# ── Catalogue ──────────────────────────────────────────────────────────────
+
+CODE_INVALID_ARGUMENT = "invalid_argument"
+CODE_STREAM_DRAIN_TIMEOUT = "stream_drain_timeout"
+CODE_SERVER_ERROR = "server_error"
+CODE_NETWORK_UNAVAILABLE = "network_unavailable"
+CODE_OUTPUT_UNWRITABLE = "output_unwritable"
+
+# invalid_argument: a hard agent signal, no SOURCE, no --mic.
+E_LISTEN_NO_SOURCE = (
+    "{prog} listen needs a file, a URL, --mic, or - to read audio from stdin."
+)
+H_LISTEN_NO_SOURCE = (
+    "Pass a file path or URL. To stream audio from stdin, pass - explicitly."
+)
+
+# invalid_argument: reading stdin failed.
+E_LISTEN_STDIN_UNREADABLE = "Couldn't read audio from stdin: {os_error}."
+H_LISTEN_STDIN_UNREADABLE = (
+    "Pass a file path or URL instead, or make sure stdin is an open pipe "
+    "or file with audio in it."
+)
+A_LISTEN_STDIN_UNREADABLE = (
+    "Pass the audio file path or URL as SOURCE instead of reading stdin, then retry."
+)
+
+# stream_drain_timeout: end of input, then the idle deadline or the cap.
+E_DRAIN_TIMEOUT = (
+    "The server sent nothing for {limit_s} s after the audio ended, "
+    "so results may be incomplete."
+)
+E_DRAIN_CAP = (
+    "The server was still sending results {limit_s} s after the audio ended, "
+    "so results may be incomplete."
+)
+H_DRAIN_TIMEOUT = "Results received so far were kept. Try again if you need the rest."
+
+# server_error / network_unavailable hints (the error text is the stream's own).
+H_SERVER = (
+    "Try again in a moment. If it keeps failing, contact Deepgram support "
+    "with the request ID in details."
+)
+A_SERVER = (
+    "Retry once after a few seconds. If it fails again, tell the user and "
+    "include details.request_id."
+)
+H_NETWORK = "Check your network connection and proxy settings, then try again."
+A_NETWORK = (
+    "{prog} can't reach Deepgram from this environment. If you run in a "
+    "sandbox, ask the user to allow network access for {prog}."
+)
+
+# ── Live-stream messages ───────────────────────────────────────────────────
+
+# Ctrl-C or SIGTERM: the server didn't finish within the 1 s drain.
+W_LISTEN_STOP_INCOMPLETE = (
+    "The server hadn't sent its last results after 1 s, "
+    "so the transcript may be incomplete."
+)
+
+# Microphone: audio dropped because sending fell behind. Once per stream.
+W_MIC_DROPPED = (
+    "Dropped {seconds} s of microphone audio because the connection couldn't keep up."
+)
+
+# server_error: the server closed the stream with an error close code.
+E_LISTEN_SERVER_CLOSED = (
+    "The server ended the stream with an error ({close_code}): {close_reason}"
+)
+E_LISTEN_SERVER_CLOSED_NO_REASON = (
+    "The server ended the stream with an error ({close_code})."
+)
+
+# server_error: Flux (listen v2) reported an error in an Error frame.
+E_LISTEN_FLUX_ERROR = "Flux STT error ({flux_code}): {description}"
+
+# network_unavailable: the connection dropped without a closing handshake.
+E_LISTEN_CONNECTION_LOST = "The connection to the server was lost."
+
+# output_unwritable: writing the transcript or the final result to stdout
+# failed with an error other than EPIPE (ENOSPC, EIO, ...).
+# {reason} is details.reason. The texts are shared with speak.
+E_OUTPUT_UNWRITABLE = "Couldn't write the output to {output}: {reason}."
+H_OUTPUT_UNWRITABLE = (
+    "Choose another destination, or fix this one (free space, permissions), "
+    "then try again."
+)
+A_OUTPUT_UNWRITABLE = (
+    "If you chose this destination, choose another one. Otherwise tell the "
+    "user {prog} couldn't write its output ({reason}), and don't retry until "
+    "it's fixed."
+)
diff --git a/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/models.py b/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/models.py
index f05f5921..f79214b7 100644
--- a/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/models.py
+++ b/packages/deepctl-cmd-listen/src/deepctl_cmd_listen/models.py
@@ -4,7 +4,7 @@
 
 from typing import Any
 
-from deepctl_core import BaseResult
+from deepctl_core import BaseResult, CodedErrorResult
 
 
 class ListenResult(BaseResult):
@@ -30,3 +30,20 @@ class ListenResult(BaseResult):
     full_result: dict[str, Any] | None = None  # raw Deepgram API response
     probe_info: dict[str, Any] | None = None
     duration_seconds: float = 0.0
+
+
+class ListenCodedError(CodedErrorResult):
+    """A coded error from ``dg listen``, keys in the catalogue's order.
+
+    ``details`` is left out of the payload when there are none.
+    """
+
+    next_step: str | None = None
+    schema_version: int = 1
+    details: dict[str, Any] | None = None
+
+    def model_dump(self, **kwargs: Any) -> dict[str, Any]:
+        data = super().model_dump(**kwargs)
+        if data.get("details") is None:
+            data.pop("details", None)
+        return data
diff --git a/packages/deepctl-cmd-listen/tests/unit/test_listen_command.py b/packages/deepctl-cmd-listen/tests/unit/test_listen_command.py
index 6b92fe2d..10d5401a 100644
--- a/packages/deepctl-cmd-listen/tests/unit/test_listen_command.py
+++ b/packages/deepctl-cmd-listen/tests/unit/test_listen_command.py
@@ -17,6 +17,7 @@
 
 
 def _install_flux_error_websockets(monkeypatch, ready=None):
+    """A server that sends one Flux Error frame (after ``ready()``), then ends."""
     import asyncio
     import json
     import sys
@@ -31,12 +32,17 @@ def _install_flux_error_websockets(monkeypatch, ready=None):
     )
 
     class _FakeWS:
+        transport = None
+
         def __init__(self):
             self.messages = iter([error_frame])
 
         async def send(self, _data):
             return None
 
+        async def close(self):
+            return None
+
         def __aiter__(self):
             return self
 
@@ -48,17 +54,70 @@ async def __anext__(self):
             except StopIteration:
                 raise StopAsyncIteration from None
 
-    class _FakeConnect:
-        async def __aenter__(self):
-            return _FakeWS()
+    _install_websockets(monkeypatch, _FakeWS())
 
-        async def __aexit__(self, *_args):
-            return False
 
-    monkeypatch.setattr(
-        "deepctl_cmd_listen.command._live_connect",
-        lambda *_args, **_kwargs: _FakeConnect(),
-    )
+def _install_websockets(monkeypatch, ws):
+    """Make ``await websockets.connect(...)`` return ``ws``."""
+    import sys
+    import types
+
+    class _Connect:
+        def __await__(self):
+            async def _open():
+                return ws
+
+            return _open().__await__()
+
+    fake = types.ModuleType("websockets")
+    fake.connect = lambda *_args, **_kwargs: _Connect()
+    monkeypatch.setitem(sys.modules, "websockets", fake)
+    monkeypatch.setattr("deepctl_cmd_listen.live._open", fake.connect)
+
+
+def _stdin_pipe(monkeypatch, data=b"", *, close=True):
+    """Point the live stdin reader at a pipe holding ``data``.
+
+    Returns the write end when ``close`` is False (the pipe stays open, so
+    the reader blocks), else None.
+    """
+    import os
+
+    r, w = os.pipe()
+    if data:
+        os.write(w, data)
+    if close:
+        os.close(w)
+        w = None
+    monkeypatch.setattr("deepctl_cmd_listen.command._stdin_fd", lambda: r)
+    return w
+
+
+class _EndOnCloseStream:
+    """A server that ends the stream when CloseStream arrives."""
+
+    transport = None
+
+    def __init__(self):
+        import asyncio
+
+        self.sent = []
+        self.ended = asyncio.Event()
+
+    async def send(self, data):
+        self.sent.append(data)
+        if "CloseStream" in str(data):
+            self.ended.set()
+
+    async def close(self):
+        self.ended.set()
+
+    def __aiter__(self):
+        return self
+
+    async def __anext__(self):
+        await self.ended.wait()
+        raise StopAsyncIteration
 
 
 class TestListenCommand:
@@ -229,12 +288,14 @@ def test_handle_stdin_routes_to_stream_stdin(
             assert call_kwargs["encoding"] == "linear16"
             assert result.source == "stdin"
 
+    @patch("deepctl_cmd_listen.command.print_warning")
     @patch("deepctl_cmd_listen.command.status")
     @patch("deepctl_cmd_listen.command.sys")
     def test_handle_warns_diarize_ignored_on_flux(
         self,
         mock_sys,
         mock_status,
+        mock_warning,
         command,
         mock_config,
         mock_auth_manager,
@@ -261,20 +322,57 @@ async def fake_ws_mic(_client, **kwargs):
                 diarize=True,
             )
 
-        printed = " ".join(
-            str(c.args[0]) for c in mock_status.print.call_args_list if c.args
-        )
-        assert "not supported by Flux STT" in printed
+        # The note is a warning (WARN: in agent mode), not status chrome.
+        calls = mock_status.print.call_args_list + mock_warning.call_args_list
+        printed = " ".join(str(c.args[0]) for c in calls if c.args)
+        assert "Flux models don't support --diarize" in printed
         assert "Speaker labels enabled" not in printed
         assert mock_ws.call_args.kwargs["diarize"] is False
         assert result.diarized is False
 
+    @patch("deepctl_cmd_listen.command.status")
+    @patch("deepctl_cmd_listen.command.sys")
+    def test_diarize_warning_prints_under_quiet(
+        self,
+        mock_sys,
+        mock_status,
+        command,
+        mock_config,
+        mock_auth_manager,
+        mock_client,
+        monkeypatch,
+        capsys,
+    ):
+        """`dg -q listen ... --diarize`: --quiet hides INFO/OK lines, not this
+        WARN."""
+        from deepctl_core import output
+
+        monkeypatch.setitem(output._output_config, "quiet", True)
+        monkeypatch.setitem(output._output_config, "agentic", True)
+        mock_sys.stdin.isatty.return_value = True
+
+        async def fake_ws_mic(_client, **kwargs):
+            return ListenResult(status="success", source="mic", mode="live")
+
+        with patch.object(command, "_ws_mic", side_effect=fake_ws_mic):
+            command.handle(
+                config=mock_config,
+                auth_manager=mock_auth_manager,
+                client=mock_client,
+                mic=True,
+                model="flux-general-en",
+                diarize=True,
+            )
+        assert "WARN: Flux models don't support --diarize, so it was ignored." in capsys.readouterr().err
+
+    @patch("deepctl_cmd_listen.command.print_warning")
     @patch("deepctl_cmd_listen.command.status")
     @patch("deepctl_cmd_listen.command.sys")
     def test_handle_no_diarize_warning_on_v1(
         self,
         mock_sys,
         mock_status,
+        mock_warning,
         command,
         mock_config,
         mock_auth_manager,
@@ -294,10 +392,10 @@ def test_handle_no_diarize_warning_on_v1(
                 diarize=True,
             )
 
-        printed = " ".join(
-            str(c.args[0]) for c in mock_status.print.call_args_list if c.args
-        )
-        assert "not supported by Flux STT" not in printed
+        # The note is a warning (WARN: in agent mode), not status chrome.
+        calls = mock_status.print.call_args_list + mock_warning.call_args_list
+        printed = " ".join(str(c.args[0]) for c in calls if c.args)
+        assert "don't support --diarize" not in printed
 
     @pytest.mark.parametrize("source", ["call.wav", "https://example.com/call.wav"])
     def test_click_flux_prerecorded_source_errors(self, source, command, mock_config):
@@ -326,6 +424,7 @@ def test_click_flux_error_frame_exits_nonzero(
     ):
         """A stdin Error frame propagates through the stream and Click boundary."""
         _install_flux_error_websockets(monkeypatch)
+        _stdin_pipe(monkeypatch)
 
         result = self.invoke_click(
             command,
@@ -922,46 +1021,39 @@ def test_captions_use_audio_window_and_survive_batch_save(self, command):
         assert "my account" in batch
         assert "00:00:01,000 --> 00:00:02,500" in batch
 
-    def test_ws_mic_flushes_final_turn_on_keyboard_interrupt(
-        self, command, monkeypatch
-    ):
-        """Ctrl-C during a Flux mic stream must still flush the in-flight turn.
-
-        The interrupt surfaces at the ``asyncio.gather`` await; ``_ws_mic`` has
-        to catch it, run ``_flush_v2``, and return the accumulated transcript
-        (rather than letting the final turn vanish)."""
+    def test_ws_mic_flushes_final_turn_on_ctrl_c(self, command, monkeypatch):
+        """Ctrl-C during a Flux mic stream must still flush the in-flight turn,
+        with CloseStream sent. Ctrl-C is how a mic session ends, so the
+        result is a success (exit 0), as in 0.4.0."""
         import asyncio as _asyncio
+        import signal
         import sys
         import types
         from unittest.mock import MagicMock
 
-        # _ws_mic imports these at call time; stub them so no hardware/net is hit.
-        for name in ("sounddevice", "numpy"):
-            monkeypatch.setitem(sys.modules, name, types.ModuleType(name))
-
-        class _FakeWS:
-            async def send(self, *a):
-                return None
-
-            def __aiter__(self):
-                return self
+        class _FakeInputStream:
+            def __init__(self, **_kwargs):
+                pass
 
-            async def __anext__(self):
-                raise StopAsyncIteration
+            def start(self):
+                pass
 
-        class _FakeConnect:
-            async def __aenter__(self):
-                return _FakeWS()
+            def stop(self):
+                pass
 
-            async def __aexit__(self, *a):
-                return False
+            def close(self):
+                pass
 
-        monkeypatch.setattr(
-            "deepctl_cmd_listen.command._live_connect",
-            lambda *a, **k: _FakeConnect(),
-        )
+        fake_sd = types.ModuleType("sounddevice")
+        fake_sd.RawInputStream = _FakeInputStream
+        fake_np = types.ModuleType("numpy")
+        fake_np.int16 = "int16"
+        monkeypatch.setitem(sys.modules, "sounddevice", fake_sd)
+        monkeypatch.setitem(sys.modules, "numpy", fake_np)
+        ws = _EndOnCloseStream()
+        _install_websockets(monkeypatch, ws)
 
-        # A turn received but never finalized (no EndOfTurn before the interrupt).
+        # A turn received but never finalized (no EndOfTurn before Ctrl-C).
         seeded = {
             "turns": {
                 0: {
@@ -976,18 +1068,12 @@ async def __aexit__(self, *a):
         }
         monkeypatch.setattr(command, "_new_v2_state", lambda: seeded)
 
-        async def _interrupt(*a, **k):
-            raise KeyboardInterrupt
-
-        monkeypatch.setattr("deepctl_cmd_listen.command.asyncio.gather", _interrupt)
-
         client = MagicMock()
         client.config.get_profile.return_value.base_url = "https://api.deepgram.com"
         client.auth_manager.get_api_key.return_value = "k"
 
-        # Drive on a plain loop (not asyncio.run) so the patched gather can't
-        # interfere with run()'s own shutdown machinery.
         loop = _asyncio.new_event_loop()
+        loop.call_later(0.1, signal.raise_signal, signal.SIGINT)
         try:
             result = loop.run_until_complete(
                 command._ws_mic(
@@ -1009,6 +1095,204 @@ async def _interrupt(*a, **k):
             loop.close()
 
         assert result.transcript == "hello world"
+        assert result.status == "success"
+        assert command.exit_code_for(result) == 0
+        assert '{"type": "CloseStream"}' in ws.sent
+
+    def test_ws_mic_streams_raw_int16_frames_without_numpy(self, command, monkeypatch):
+        """The mic path opens a raw int16 stream and forwards each callback
+        buffer to the socket byte for byte, with numpy unimportable."""
+        import asyncio as _asyncio
+        import json as _json
+        import signal
+        import sys
+        import types
+        from array import array
+        from unittest.mock import MagicMock
+
+        from deepctl_cmd_listen import live
+
+        # Any `import numpy` now raises ImportError.
+        monkeypatch.setitem(sys.modules, "numpy", None)
+
+        # Fixed fixture: three 4-sample blocks of native-order int16, as
+        # PortAudio delivers them to the callback.
+        samples = [0, 1, -1, 32767, -32768, 1234, -1234, 7, 8, 9, -9, 0]
+        blocks = [array("h", samples[i : i + 4]).tobytes() for i in range(0, 12, 4)]
+
+        opened: dict = {}
+
+        class _FakeRawInputStream:
+            def __init__(self, **kwargs):
+                opened.update(kwargs)
+                self.events: list[str] = []
+                opened["stream"] = self
+
+            def start(self):
+                self.events.append("start")
+                for block in blocks:
+                    # sounddevice hands the callback a CFFI buffer; a
+                    # memoryview is the same buffer-protocol object.
+                    opened["callback"](memoryview(block), 4, None, None)
+
+            def stop(self):
+                self.events.append("stop")
+
+            def close(self):
+                self.events.append("close")
+
+        fake_sd = types.ModuleType("sounddevice")
+        fake_sd.RawInputStream = _FakeRawInputStream
+        monkeypatch.setitem(sys.modules, "sounddevice", fake_sd)
+
+        ws = _EndOnCloseStream()
+        _install_websockets(monkeypatch, ws)
+
+        client = MagicMock()
+        client.config.get_profile.return_value.base_url = "https://api.deepgram.com"
+        client.auth_manager.get_api_key.return_value = "k"
+
+        loop = _asyncio.new_event_loop()
+        # The user's Ctrl-C, once the three blocks are on the socket.
+        loop.call_later(0.2, signal.raise_signal, signal.SIGINT)
+        try:
+            loop.run_until_complete(
+                command._ws_mic(
+                    client,
+                    model="nova-3",
+                    language="en-US",
+                    api_version=1,
+                    diarize=False,
+                    smart_format=True,
+                    punctuate=True,
+                    interim=False,
+                    redact=(),
+                    numerals=False,
+                    sample_rate=16000,
+                    channels=1,
+                )
+            )
+        finally:
+            loop.close()
+
+        audio = [frame for frame in ws.sent if isinstance(frame, bytes)]
+        assert opened["dtype"] == "int16"
+        assert opened["samplerate"] == 16000
+        assert opened["channels"] == 1
+        assert opened["blocksize"] == live.frame_bytes("linear16", 16000, 1) // 2
+        assert audio == blocks
+        assert _json.loads(ws.sent[-1]) == {"type": "CloseStream"}
+        assert opened["stream"].events == ["start", "stop", "close"]
+
+    def test_sigint_during_mic_capture_stops_cleanly(self, command, monkeypatch):
+        """A real SIGINT while frames are flowing stops the capture: the
+        stream is stopped and closed, CloseStream is sent, and the transcript
+        so far is kept on every Python version. Ctrl-C is how a mic session
+        ends, so the result is success, exit 0."""
+        import json as _json
+        import os
+        import signal
+        import sys
+        import threading
+        import time
+        import types
+        from unittest.mock import MagicMock
+
+        if signal.getsignal(signal.SIGINT) is not signal.default_int_handler:
+            pytest.skip("SIGINT is not Python's default handler here")
+        monkeypatch.setitem(sys.modules, "numpy", None)
+
+        events: list[str] = []
+
+        class _PacedStream:
+            def __init__(self, *, callback, blocksize, samplerate, **kwargs):
+                self._callback = callback
+                self._period = blocksize / samplerate
+                self._stop = threading.Event()
+                self._thread = threading.Thread(target=self._run, daemon=True)
+
+            def _run(self):
+                while not self._stop.wait(self._period):
+                    self._callback(memoryview(b"\x01\x00" * 800), 800, None, None)
+
+            def start(self):
+                events.append("start")
+                self._thread.start()
+
+            def stop(self):
+                events.append("stop")
+                self._stop.set()
+
+            def close(self):
+                events.append("close")
+
+        fake_sd = types.ModuleType("sounddevice")
+        fake_sd.RawInputStream = _PacedStream
+        monkeypatch.setitem(sys.modules, "sounddevice", fake_sd)
+
+        class _OneResultThenEndOnClose(_EndOnCloseStream):
+            def __init__(self):
+                super().__init__()
+                self._said = False
+                self._pressed = False
+
+            async def send(self, data):
+                await super().send(data)
+                audio = [f for f in self.sent if isinstance(f, bytes)]
+                if len(audio) == 3 and not self._pressed:
+                    # Frames are flowing: the user presses Ctrl-C, once (a
+                    # later CloseStream send must not schedule another).
+                    self._pressed = True
+                    threading.Timer(0.05, os.kill, (os.getpid(), signal.SIGINT)).start()
+
+            async def __anext__(self):
+                if not self._said:
+                    self._said = True
+                    return _json.dumps(
+                        {
+                            "type": "Results",
+                            "is_final": True,
+                            "start": 0.0,
+                            "duration": 1.0,
+                            "channel": {
+                                "alternatives": [{"transcript": "hi", "words": []}]
+                            },
+                        }
+                    )
+                return await super().__anext__()
+
+        ws = _OneResultThenEndOnClose()
+        _install_websockets(monkeypatch, ws)
+
+        client = MagicMock()
+        client.config.get_profile.return_value.base_url = "https://api.deepgram.com"
+        client.auth_manager.get_api_key.return_value = "k"
+
+        start = time.monotonic()
+        result = command._stream_mic(
+            client,
+            model="nova-3",
+            language="en-US",
+            api_version=1,
+            diarize=False,
+            smart_format=True,
+            punctuate=True,
+            interim=False,
+            redact=(),
+            numerals=False,
+            sample_rate=16000,
+            channels=1,
+            save_to=None,
+            caption_format=None,
+        )
+
+        assert time.monotonic() - start < 5
+        assert events == ["start", "stop", "close"]
+        assert all(isinstance(frame, bytes) for frame in ws.sent[:3])
+        assert _json.loads(ws.sent[-1]) == {"type": "CloseStream"}
+        assert result.status == "success"
+        assert result.transcript == "hi"
+        assert command.exit_code_for(result) == 0
 
     def test_end_of_turn_with_empty_transcript_is_noop(self, command, capsys):
         """An EndOfTurn that never carried text emits nothing (no blank line)."""
@@ -1125,106 +1409,54 @@ def close(self):
 
         fake_sounddevice = types.ModuleType("sounddevice")
         fake_sounddevice.RawInputStream = _FakeInputStream
-        fake_numpy = types.ModuleType("numpy")
-        fake_numpy.int16 = "int16"
         monkeypatch.setitem(sys.modules, "sounddevice", fake_sounddevice)
-        monkeypatch.setitem(sys.modules, "numpy", fake_numpy)
 
         client = MagicMock()
         client.config.get_profile.return_value.base_url = "https://api.deepgram.com"
         client.auth_manager.get_api_key.return_value = "test-key"
 
-        with pytest.raises(click.ClickException) as exc_info:
-            command._stream_mic(
-                client,
-                model="flux-general-en",
-                language="en-US",
-                api_version=2,
-                diarize=False,
-                smart_format=True,
-                punctuate=True,
-                interim=False,
-                redact=(),
-                numerals=False,
-                sample_rate=16000,
-                channels=1,
-                save_to=None,
-                caption_format=None,
-            )
+        result = command._stream_mic(
+            client,
+            model="flux-general-en",
+            language="en-US",
+            api_version=2,
+            diarize=False,
+            smart_format=True,
+            punctuate=True,
+            interim=False,
+            redact=(),
+            numerals=False,
+            sample_rate=16000,
+            channels=1,
+            save_to=None,
+            caption_format=None,
+        )
 
-        assert "INVALID_AUDIO" in exc_info.value.message
-        assert "audio stream is invalid" in exc_info.value.message
+        assert result.status == "error"
+        assert result.code == "server_error"
+        assert command.exit_code_for(result) == 1
+        assert "INVALID_AUDIO" in result.error
+        assert "audio stream is invalid" in result.error
         assert events == {"started": True, "stopped": True, "closed": True}
 
     def test_stream_stdin_flux_error_does_not_wait_for_blocked_input(
         self, command, monkeypatch
     ):
-        import asyncio as _asyncio
-        import json as _json
-        import sys
+        """A server error ends the stream while stdin is still open and idle."""
+        import os
         import threading
-        import types
         from unittest.mock import MagicMock
 
-        read_started = threading.Event()
-        release_read = threading.Event()
-
-        class _BlockingBuffer:
-            def read(self, _size):
-                read_started.set()
-                release_read.wait()
-                return b""
-
-        fake_stdin = types.SimpleNamespace(buffer=_BlockingBuffer())
-        monkeypatch.setattr(
-            "deepctl_cmd_listen.command.sys.stdin", fake_stdin, raising=False
-        )
-
-        error_frame = _json.dumps(
-            {
-                "type": "Error",
-                "code": "INVALID_AUDIO",
-                "description": "audio stream is invalid",
-            }
-        )
-
-        class _FakeWS:
-            def __init__(self):
-                self.sent_error = False
-
-            async def send(self, _data):
-                return None
-
-            def __aiter__(self):
-                return self
-
-            async def __anext__(self):
-                if self.sent_error:
-                    raise StopAsyncIteration
-                while not read_started.is_set():
-                    await _asyncio.sleep(0)
-                self.sent_error = True
-                return error_frame
-
-        class _FakeConnect:
-            async def __aenter__(self):
-                return _FakeWS()
-
-            async def __aexit__(self, *_args):
-                return False
-
-        monkeypatch.setattr(
-            "deepctl_cmd_listen.command._live_connect",
-            lambda *_args, **_kwargs: _FakeConnect(),
-        )
+        writer = _stdin_pipe(monkeypatch, close=False)
+        _install_flux_error_websockets(monkeypatch)
 
         client = MagicMock()
         client.config.get_profile.return_value.base_url = "https://api.deepgram.com"
         client.auth_manager.get_api_key.return_value = "test-key"
-        errors = []
+        results = []
 
         def run_stream():
-            try:
+            results.append(
                 command._stream_stdin(
                     client,
                     model="flux-general-en",
@@ -1242,61 +1474,34 @@ def run_stream():
                     save_to=None,
                     caption_format=None,
                 )
-            except BaseException as exc:
-                errors.append(exc)
+            )
 
         stream_thread = threading.Thread(target=run_stream, daemon=True)
         stream_thread.start()
-        assert read_started.wait(timeout=1)
-        stream_thread.join(timeout=1)
-        exited_before_stdin = not stream_thread.is_alive()
-        release_read.set()
-        stream_thread.join(timeout=1)
-
-        assert exited_before_stdin
-        assert len(errors) == 1
-        assert isinstance(errors[0], click.ClickException)
-        assert "INVALID_AUDIO" in errors[0].message
-
-    def test_stream_stdin_keyboard_interrupt_preserves_transcript_and_save_to(
+        stream_thread.join(timeout=2)
+        exited_while_stdin_open = not stream_thread.is_alive()
+        os.close(writer)
+
+        assert exited_while_stdin_open
+        (result,) = results
+        assert result.status == "error"
+        assert result.code == "server_error"
+        assert "INVALID_AUDIO" in result.error
+
+    def test_stream_stdin_ctrl_c_preserves_transcript_and_save_to(
         self, command, monkeypatch, tmp_path
     ):
         """Ctrl-C on `dg listen -` (stdin) keeps the partial transcript and
-        writes --save-to, mirroring the mic path. The stdin path used to
-        re-raise the interrupt and drop both."""
-        import sys
-        import types
+        writes --save-to, and ends as cancelled (exit 2)."""
+        import os
+        import signal
+        import threading
         from unittest.mock import MagicMock
 
-        # No real stdin read: return EOF at once if the reader thread starts.
-        fake_stdin = types.SimpleNamespace(
-            buffer=types.SimpleNamespace(read=lambda _n: b"")
-        )
-        monkeypatch.setattr(
-            "deepctl_cmd_listen.command.sys.stdin", fake_stdin, raising=False
-        )
-
-        class _FakeWS:
-            async def send(self, *a):
-                return None
-
-            def __aiter__(self):
-                return self
-
-            async def __anext__(self):
-                raise StopAsyncIteration
-
-        class _FakeConnect:
-            async def __aenter__(self):
-                return _FakeWS()
-
-            async def __aexit__(self, *a):
-                return False
-
-        monkeypatch.setattr(
-            "deepctl_cmd_listen.command._live_connect",
-            lambda *a, **k: _FakeConnect(),
-        )
+        writer = _stdin_pipe(monkeypatch, close=False)
+        ws = _EndOnCloseStream()
+        _install_websockets(monkeypatch, ws)
+        threading.Timer(0.2, os.kill, (os.getpid(), signal.SIGINT)).start()
 
         # A turn received but never finalized before the interrupt.
         seeded = {
@@ -1313,11 +1518,6 @@ async def __aexit__(self, *a):
         }
         monkeypatch.setattr(command, "_new_v2_state", lambda: seeded)
 
-        async def _interrupt(*a, **k):
-            raise KeyboardInterrupt
-
-        monkeypatch.setattr("deepctl_cmd_listen.command.asyncio.gather", _interrupt)
-
         client = MagicMock()
         client.config.get_profile.return_value.base_url = "https://api.deepgram.com"
         client.auth_manager.get_api_key.return_value = "k"
@@ -1341,5 +1541,8 @@ async def _interrupt(*a, **k):
             caption_format=None,
         )
 
+        os.close(writer)
         assert result.transcript == "hello world"
+        assert result.status == "cancelled"
+        assert command.exit_code_for(result) == 2
         assert save_to.read_text().strip() == "hello world"
diff --git a/packages/deepctl-cmd-listen/tests/unit/test_listen_output.py b/packages/deepctl-cmd-listen/tests/unit/test_listen_output.py
new file mode 100644
index 00000000..727a8af6
--- /dev/null
+++ b/packages/deepctl-cmd-listen/tests/unit/test_listen_output.py
@@ -0,0 +1,189 @@
+"""Live listen: a failed stdout write is output_unwritable, not a network
+error, and the stdin catch-all only takes read errors."""
+
+from __future__ import annotations
+
+import errno
+import os
+from unittest.mock import Mock
+
+import pytest
+from deepctl_cmd_listen import command as listen_cmd
+from deepctl_cmd_listen import live
+from deepctl_cmd_listen.command import ListenCommand
+from deepctl_cmd_listen.models import ListenCodedError, ListenResult
+from deepctl_core import Config
+
+
+@pytest.fixture
+def command(monkeypatch):
+    monkeypatch.setattr(listen_cmd, "is_ai_agent", lambda: True)
+    return ListenCommand()
+
+
+def _finish(command, outcome, **kw):
+    return command._finish_live(
+        outcome,
+        source="stdin",
+        model="nova-3",
+        language="en",
+        diarize=False,
+        transcript_acc=kw.get("acc", ["hello", "world"]),
+        caption_writer=None,
+        caption_format=None,
+        save_to=kw.get("save_to"),
+        v2_state=kw.get("v2_state"),
+    )
+
+
+def test_output_outcome_is_output_unwritable_with_the_kept_finals(command, capsys):
+    outcome = live.LiveOutcome(
+        status="error",
+        kind="output",
+        error="Couldn't write the output to stdout: No space left on device.",
+        os_error="No space left on device",
+    )
+    result = _finish(command, outcome)
+    assert isinstance(result, ListenCodedError)
+    assert result.code == "output_unwritable"
+    assert (
+        result.error == "Couldn't write the output to stdout: No space left on device."
+    )
+    assert result.hint == (
+        "If you chose this destination, choose another one. Otherwise tell the "
+        "user dg couldn't write its output (No space left on device), and don't "
+        "retry until it's fixed."
+    )
+    assert result.next_step is None
+    assert result.details == {
+        "path": "-",
+        "reason": "No space left on device",
+        "transcript": "hello world",
+        "transcript_chars": 11,
+    }
+    assert command.exit_code_for(result) == 1
+    err = capsys.readouterr().err
+    assert "network" not in err.lower()
+
+
+def test_person_gets_the_human_hint(command, monkeypatch):
+    monkeypatch.setattr(listen_cmd, "is_ai_agent", lambda: False)
+    monkeypatch.setattr(listen_cmd, "_agentic", False)
+    outcome = live.LiveOutcome(
+        status="error", kind="output", os_error="Input/output error"
+    )
+    result = _finish(command, outcome)
+    assert result.hint == (
+        "Choose another destination, or fix this one (free space, permissions), "
+        "then try again."
+    )
+
+
+def test_stdin_catch_all_takes_read_errors_only(command):
+    read = _finish(
+        command,
+        live.LiveOutcome(
+            status="error", kind="read", error="Couldn't read audio from stdin: x."
+        ),
+    )
+    assert read.code == "invalid_argument"
+    assert read.next_step == "dg listen --help"
+    other = _finish(
+        command, live.LiveOutcome(status="error", kind="mystery", error="boom")
+    )
+    assert other.code == "network_unavailable"
+    assert other.next_step is None
+
+
+def test_flux_flush_failure_is_output_unwritable(command, monkeypatch):
+    silenced = []
+    monkeypatch.setattr(live, "silence_stdout", lambda: silenced.append(True))
+
+    def flush(*a, **kw):
+        raise OSError(errno.ENOSPC, "No space left on device")
+
+    monkeypatch.setattr(command, "_flush_v2", flush)
+    result = _finish(command, live.LiveOutcome(), v2_state={"order": [], "turns": {}})
+    assert result.code == "output_unwritable"
+    assert silenced == [True]
+
+
+def test_final_result_write_failure_is_reported_and_exits_1(
+    command, monkeypatch, capsys
+):
+    silenced = []
+    monkeypatch.setattr(live, "silence_stdout", lambda: silenced.append(True))
+    monkeypatch.setattr(listen_cmd, "get_output_format", lambda: "json")
+    stdout = Mock()
+    stdout.write.side_effect = OSError(errno.ENOSPC, "No space left on device")
+    monkeypatch.setattr(listen_cmd.sys, "stdout", stdout)
+    result = ListenResult(status="success", mode="live", transcript="hi there")
+
+    command.output_result(result, Mock(spec=Config))
+
+    assert silenced == [True]
+    assert command.exit_code_for(result) == 1
+    err = capsys.readouterr().err
+    assert "Couldn't write the output to stdout: No space left on device." in err
+
+
+def test_final_result_epipe_stays_quiet(command, monkeypatch, capsys):
+    monkeypatch.setattr(live, "silence_stdout", lambda: None)
+    monkeypatch.setattr(listen_cmd, "get_output_format", lambda: "json")
+    stdout = Mock()
+    stdout.write.side_effect = BrokenPipeError(errno.EPIPE, "Broken pipe")
+    monkeypatch.setattr(listen_cmd.sys, "stdout", stdout)
+    result = ListenResult(status="success", mode="live", transcript="hi")
+
+    command.output_result(result, Mock(spec=Config))
+
+    assert command.exit_code_for(result) == 0
+    assert capsys.readouterr().err == ""
+
+
+def test_coded_error_write_failure_silences_stdout(command, monkeypatch):
+    silenced = []
+    monkeypatch.setattr(live, "silence_stdout", lambda: silenced.append(True))
+    monkeypatch.setattr(
+        listen_cmd.BaseCommand,
+        "output_result",
+        Mock(side_effect=OSError(errno.ENOSPC, "No space left on device")),
+    )
+    result = ListenCodedError(error="x", code="server_error", hint="h")
+    command.output_result(result, Mock(spec=Config))
+    assert silenced == [True]
+
+
+@pytest.mark.parametrize("exc", [OSError(errno.ENOSPC, "full"), BrokenPipeError()])
+def test_verbose_stderr_failure_is_not_a_stdout_failure(command, monkeypatch, exc):
+    """An INFO line that can't reach stderr leaves stdout and the
+    session alone."""
+    command._echo = False
+    command._verbose = True
+    monkeypatch.setattr(listen_cmd, "print_info", Mock(side_effect=exc))
+    command._print_final("hello")  # does not raise
+
+
+@pytest.mark.skipif(
+    not os.environ.get("DG_ERROR_CODES_JSON"),
+    reason="DG_ERROR_CODES_JSON names no error catalogue file",
+)
+def test_strings_match_catalogue():
+    """Listen's messages, the output_unwritable texts shared with speak
+    included, match the error catalogue."""
+    import json
+    import re
+    from pathlib import Path
+
+    from deepctl_cmd_listen import messages as msg
+
+    catalogue = json.loads(Path(os.environ["DG_ERROR_CODES_JSON"]).read_text())
+    for name, text in vars(msg).items():
+        if re.fullmatch(r"[EHAD]_[A-Z0-9_]+", name):
+            assert catalogue["strings"][name.replace("_", "-")] == text, name
+    message = catalogue["codes"]["output_unwritable"]["messages"][0]
+    assert (message["id"], message["hint_human"], message["hint_agent"]) == (
+        "E-OUTPUT-UNWRITABLE",
+        "H-OUTPUT-UNWRITABLE",
+        "A-OUTPUT-UNWRITABLE",
+    )
diff --git a/packages/deepctl-cmd-listen/tests/unit/test_live.py b/packages/deepctl-cmd-listen/tests/unit/test_live.py
new file mode 100644
index 00000000..e11603b4
--- /dev/null
+++ b/packages/deepctl-cmd-listen/tests/unit/test_live.py
@@ -0,0 +1,968 @@
+"""Tests for the live streaming engine (deepctl_cmd_listen.live)."""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import signal
+import subprocess
+import sys
+import textwrap
+import threading
+import time
+import types
+
+import pytest
+from deepctl_cmd_listen import live
+
+
+class FakeWS:
+    """A stand-in server socket. Replays ``frames`` at once and
+    ``after_close`` once CloseStream arrives, then ends the stream if
+    ``close_on_closestream`` (like the real API), or when ``finish()`` is
+    called."""
+
+    def __init__(
+        self, frames=(), *, after_close=(), close_on_closestream=True, frame_gap=0.0
+    ):
+        self.sent: list = []
+        self.frames = list(frames)
+        self.after_close = list(after_close)
+        self.close_on_closestream = close_on_closestream
+        self.frame_gap = frame_gap
+        self.got_close = False
+        self.done = False
+        self.wake = asyncio.Event()
+        self.closed = False
+        self.transport = None
+
+    def finish(self):
+        self.done = True
+        self.wake.set()
+
+    async def send(self, data):
+        self.sent.append(data)
+        if data == live.CLOSE_STREAM:
+            self.got_close = True
+            self.wake.set()
+
+    def __aiter__(self):
+        return self
+
+    async def __anext__(self):
+        while True:
+            pending = self.frames or (self.after_close if self.got_close else [])
+            if pending:
+                if self.frame_gap:
+                    await asyncio.sleep(self.frame_gap)
+                return pending.pop(0)
+            if self.done or (self.got_close and self.close_on_closestream):
+                raise StopAsyncIteration
+            self.wake.clear()
+            await self.wake.wait()
+
+    async def close(self):
+        self.closed = True
+        self.finish()
+
+
+def install_fake_websockets(monkeypatch, ws):
+    """Make ``websockets.connect(...)`` resolve to ``ws`` (awaitable form)."""
+
+    calls = []
+
+    class _Connect:
+        def __await__(self):
+            async def _open():
+                return ws
+
+            return _open().__await__()
+
+    def connect(*args, **kwargs):
+        calls.append((args, kwargs))
+        return _Connect()
+
+    mod = types.ModuleType("websockets")
+    mod.connect = connect
+    monkeypatch.setitem(sys.modules, "websockets", mod)
+    monkeypatch.setattr(live, "_open", connect)
+    return calls
+
+
+def run(coro):
+    loop = asyncio.new_event_loop()
+    try:
+        return loop.run_until_complete(coro)
+    finally:
+        loop.close()
+
+
+async def session(ws_messages, *, audio=(), eof=True, stop_after=None, **kw):
+    """Run run_session with an in-memory source; returns (outcome, messages)."""
+    loop = asyncio.get_running_loop()
+    q: asyncio.Queue = asyncio.Queue(maxsize=live.QUEUE_MAX)
+    closing = threading.Event()
+    got: list = []
+
+    def start():
+        async def feed():
+            for chunk in audio:
+                await q.put(chunk)
+            if eof:
+                await q.put(b"")
+
+        tasks.append(loop.create_task(feed()))
+
+    tasks: list = []
+    stop = asyncio.Event()
+    if stop_after is not None:
+        loop.call_later(stop_after, stop.set)
+    outcome = await live.run_session(
+        "wss://api.deepgram.com/v1/listen",
+        {"Authorization": "Token k"},
+        on_message=got.append,
+        queue=q,
+        closing=closing,
+        start_source=start,
+        keepalive=kw.pop("keepalive", True),
+        byte_rate=kw.pop("byte_rate", 32000),
+        stop=stop,
+    )
+    assert closing.is_set(), "shutdown must always set closing"
+    return outcome, got
+
+
+# ── Frame sizing ────────────────────────────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    ("encoding", "rate", "channels", "expected"),
+    [
+        ("linear16", 16000, 1, 1600),  # 50 ms
+        ("linear16", 8000, 1, 800),
+        ("linear16", 48000, 2, 9600),
+        ("mulaw", 8000, 1, 400),
+        ("alaw", 8000, 1, 400),
+        ("linear32", 16000, 1, 3200),
+        ("LINEAR16", 16000, 1, 1600),
+        ("opus", 48000, 1, live.DEFAULT_READ_BYTES),
+        ("flac", 16000, 1, live.DEFAULT_READ_BYTES),
+        (None, 16000, 1, live.DEFAULT_READ_BYTES),
+    ],
+)
+def test_frame_bytes(encoding, rate, channels, expected):
+    assert live.frame_bytes(encoding, rate, channels) == expected
+
+
+@pytest.mark.parametrize(
+    ("encoding", "rate", "channels"),
+    [
+        ("linear16", 16000, 1),
+        ("linear16", 11025, 3),
+        ("mulaw", 8000, 1),
+        ("linear32", 22050, 2),
+    ],
+)
+def test_frame_bytes_is_20_to_100_ms_of_whole_samples(encoding, rate, channels):
+    size = live.frame_bytes(encoding, rate, channels)
+    bps = live.bytes_per_second(encoding, rate, channels)
+    assert 0.020 <= size / bps <= 0.100
+    width = {"linear16": 2, "linear32": 4, "mulaw": 1}[encoding] * channels
+    assert size % width == 0
+
+
+def test_bytes_per_second_unknown_is_zero():
+    assert live.bytes_per_second("opus", 48000, 1) == 0
+    assert live.bytes_per_second("linear16", 0, 1) == 0
+
+
+# ── Drop-oldest (microphone) ───────────────────────────────────────────────
+
+
+def test_drop_oldest_keeps_newest_and_counts():
+    async def main():
+        q: asyncio.Queue = asyncio.Queue(maxsize=3)
+        buf = live.DropOldestBuffer(asyncio.get_running_loop(), q, threading.Event())
+        for i in range(5):
+            buf.offer(bytes([i]) * 10)
+        kept = [q.get_nowait() for _ in range(q.qsize())]
+        return buf, kept
+
+    buf, kept = run(main())
+    assert kept == [b"\x02" * 10, b"\x03" * 10, b"\x04" * 10]
+    assert buf.dropped_buffers == 2
+    assert buf.dropped_bytes == 20
+
+
+def test_drop_oldest_threadsafe_never_raises_after_close():
+    loop = asyncio.new_event_loop()
+    q: asyncio.Queue = asyncio.Queue(maxsize=2)
+    buf = live.DropOldestBuffer(loop, q, threading.Event())
+    loop.close()
+    buf.offer_threadsafe(b"x")  # loop closed: silently ignored
+
+
+def test_drop_oldest_ignores_audio_once_closing():
+    async def main():
+        q: asyncio.Queue = asyncio.Queue(maxsize=2)
+        closing = threading.Event()
+        closing.set()
+        buf = live.DropOldestBuffer(asyncio.get_running_loop(), q, closing)
+        buf.offer_threadsafe(b"x")
+        await asyncio.sleep(0.01)
+        return q.qsize()
+
+    assert run(main()) == 0
+
+
+# ── Stdin reader ───────────────────────────────────────────────────────────
+
+
+def test_reader_reads_capped_frames_then_eof():
+    r, w = os.pipe()
+    os.write(w, b"a" * 5000)
+    os.close(w)
+
+    async def main():
+        q: asyncio.Queue = asyncio.Queue(maxsize=32)
+        live.StdinReader(
+            asyncio.get_running_loop(), q, threading.Event(), read_size=1600, fd=r
+        ).start()
+        items = []
+        while True:
+            item = await asyncio.wait_for(q.get(), 5)
+            items.append(item)
+            if not item:
+                return items
+
+    items = run(main())
+    os.close(r)
+    assert all(len(i) <= 1600 for i in items)
+    assert b"".join(items) == b"a" * 5000
+    assert items[-1] == b""
+
+
+def test_reader_blocks_on_full_queue_instead_of_buffering():
+    """Backpressure: with nobody consuming, the reader holds at most
+    maxsize buffers plus the one it is handing over."""
+    r, w = os.pipe()
+    os.set_blocking(w, False)
+    written = 0
+
+    async def main():
+        nonlocal written
+        q: asyncio.Queue = asyncio.Queue(maxsize=4)
+        live.StdinReader(
+            asyncio.get_running_loop(), q, threading.Event(), read_size=100, fd=r
+        ).start()
+        for _ in range(200):
+            try:
+                written += os.write(w, b"z" * 100)
+            except BlockingIOError:
+                break
+            await asyncio.sleep(0.001)
+        await asyncio.sleep(0.2)
+        return q.qsize()
+
+    assert run(main()) == 4
+    os.close(w)
+    os.close(r)
+
+
+def test_reader_stops_without_put_when_closing():
+    r, w = os.pipe()
+    os.write(w, b"x" * 10)
+
+    async def main():
+        q: asyncio.Queue = asyncio.Queue(maxsize=4)
+        closing = threading.Event()
+        closing.set()
+        live.StdinReader(
+            asyncio.get_running_loop(), q, closing, read_size=100, fd=r
+        ).start()
+        await asyncio.sleep(0.1)
+        return q.qsize()
+
+    assert run(main()) == 0
+    os.close(w)
+    os.close(r)
+
+
+def test_reader_put_after_loop_closed_is_quiet(recwarn):
+    loop = asyncio.new_event_loop()
+    q: asyncio.Queue = asyncio.Queue(maxsize=4)
+    reader = live.StdinReader(loop, q, threading.Event(), read_size=10, fd=0)
+    loop.close()
+    assert reader._put(b"x") is False
+    assert not [w for w in recwarn if "never awaited" in str(w.message)]
+
+
+def test_reader_reports_read_errors():
+    r, w = os.pipe()
+    os.close(w)
+    os.close(r)  # reading a closed descriptor: EBADF
+
+    async def main():
+        q: asyncio.Queue = asyncio.Queue(maxsize=4)
+        live.StdinReader(
+            asyncio.get_running_loop(), q, threading.Event(), read_size=10, fd=r
+        ).start()
+        return await asyncio.wait_for(q.get(), 5)
+
+    assert isinstance(run(main()), OSError)
+
+
+# Regression: a reader blocked
+# handing audio to a slow consumer while Ctrl-C shuts the loop down used to
+# abort the interpreter (exit 134, "Fatal Python error") on 3.11/3.12.
+_SHUTDOWN_SCRIPT = textwrap.dedent(
+    """
+    import asyncio, sys, threading
+    from deepctl_cmd_listen import live
+
+    async def main():
+        loop = asyncio.get_running_loop()
+        q = asyncio.Queue(maxsize=live.QUEUE_MAX)
+        closing = threading.Event()
+        stop = asyncio.Event()
+        guard = live._SignalGuard(loop, stop)
+        guard.install()
+        live.StdinReader(loop, q, closing, read_size=3200).start()
+
+        async def consume():
+            while True:
+                b = await q.get()
+                if not b:
+                    stop.set()
+                    return
+                await asyncio.sleep(0.01)  # slow: the reader waits on the put
+
+        t = asyncio.create_task(consume())
+        print("ready", flush=True)
+        await stop.wait()
+        closing.set()  # before cancelling, as run_session does
+        t.cancel()
+        guard.restore()
+
+    asyncio.run(main())
+    print("exited main", file=sys.stderr)
+    """
+)
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX signals")
+@pytest.mark.parametrize("attempt", range(5))
+def test_sigint_with_reader_blocked_on_put_exits_cleanly(attempt):
+    feeder = subprocess.Popen(
+        [
+            sys.executable,
+            "-c",
+            "import sys\nwhile True: sys.stdout.buffer.write(b'x'*65536)",
+        ],
+        stdout=subprocess.PIPE,
+    )
+    try:
+        proc = subprocess.Popen(
+            [sys.executable, "-c", _SHUTDOWN_SCRIPT],
+            stdin=feeder.stdout,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        assert proc.stdout.readline().strip() == b"ready"
+        time.sleep(0.3)
+        proc.send_signal(signal.SIGINT)
+        _, err = proc.communicate(timeout=10)
+    finally:
+        feeder.kill()
+        feeder.wait()
+    assert proc.returncode == 0, err.decode()
+    assert b"Fatal Python error" not in err
+    assert b"Traceback" not in err
+    assert b"exited main" in err
+
+
+# ── Session: ends and ordering ─────────────────────────────────────────────
+
+
+def _result(text, start=0.0, duration=1.0):
+    return json.dumps(
+        {
+            "type": "Results",
+            "is_final": True,
+            "start": start,
+            "duration": duration,
+            "channel": {"alternatives": [{"transcript": text}]},
+        }
+    )
+
+
+def test_eof_sends_closestream_and_keeps_late_finals(monkeypatch):
+    # Finals arrive only after CloseStream, like a slow finalize.
+    ws = FakeWS(after_close=[_result("one"), _result("two")], frame_gap=0.2)
+    install_fake_websockets(monkeypatch, ws)
+    outcome, got = run(session([], audio=[b"a" * 100, b"b" * 100]))
+    assert outcome.status == "success"
+    assert got == [_result("one"), _result("two")]
+    assert ws.sent[:2] == [b"a" * 100, b"b" * 100]
+    assert ws.sent[-1] == live.CLOSE_STREAM
+
+
+def test_connect_uses_no_compression(monkeypatch):
+    ws = FakeWS()
+    calls = install_fake_websockets(monkeypatch, ws)
+    run(session([]))
+    ((args, kwargs),) = calls
+    assert kwargs["compression"] is None
+    assert args[1] == {"Authorization": "Token k"}
+
+
+def test_server_close_ends_session_cleanly(monkeypatch):
+    ws = FakeWS([_result("hi")])
+    install_fake_websockets(monkeypatch, ws)
+
+    async def main():
+        asyncio.get_running_loop().call_later(0.05, ws.finish)
+        return await session([], eof=False)
+
+    outcome, got = run(main())
+    assert outcome.status == "success"
+    assert got == [_result("hi")]
+
+
+def test_server_error_frame_is_an_error(monkeypatch):
+    import click
+
+    ws = FakeWS([json.dumps({"type": "Error"})])
+    install_fake_websockets(monkeypatch, ws)
+
+    async def main():
+        q: asyncio.Queue = asyncio.Queue(maxsize=4)
+
+        def on_message(raw):
+            raise click.ClickException("Flux STT error (X): bad")
+
+        return await live.run_session(
+            "wss://x/v2/listen",
+            {},
+            on_message=on_message,
+            queue=q,
+            closing=threading.Event(),
+            start_source=lambda: None,
+            keepalive=False,
+            byte_rate=0,
+        )
+
+    outcome = run(main())
+    assert outcome.status == "error"
+    assert "Flux STT error (X): bad" in outcome.error
+
+
+def test_stop_sends_closestream_and_waits_for_server(monkeypatch):
+    # A 5 s drain cap, so a stop that waited it out is far from the bound.
+    monkeypatch.setattr(live, "STOP_DRAIN_S", 5.0)
+    ws = FakeWS([_result("kept")], frame_gap=0.0)
+    install_fake_websockets(monkeypatch, ws)
+    t0 = time.monotonic()
+    outcome, got = run(session([], audio=[b"a" * 10], eof=False, stop_after=0.1))
+    elapsed = time.monotonic() - t0
+    assert outcome.status == "cancelled"
+    assert not outcome.incomplete
+    assert live.CLOSE_STREAM in ws.sent
+    assert got == [_result("kept")]
+    assert elapsed < 3.0
+
+
+def test_stop_gives_up_after_one_second(monkeypatch):
+    ws = FakeWS(close_on_closestream=False)  # never finishes
+    install_fake_websockets(monkeypatch, ws)
+    t0 = time.monotonic()
+    outcome, _ = run(session([], eof=False, stop_after=0.1))
+    elapsed = time.monotonic() - t0
+    assert outcome.status == "cancelled"
+    assert outcome.incomplete
+    assert live.CLOSE_STREAM in ws.sent
+    assert 1.0 <= elapsed < 1.9
+
+
+def test_stop_during_eof_drain_waits_the_stop_cap_once(monkeypatch):
+    # A 3 s stop cap: one wait ends near 3.3 s and two near 6.3 s, so the
+    # bound is 1.5 s from each and a slow host can't blur them.
+    monkeypatch.setattr(live, "STOP_DRAIN_S", 3.0)
+    ws = FakeWS(close_on_closestream=False)
+    install_fake_websockets(monkeypatch, ws)
+    t0 = time.monotonic()
+    outcome, _ = run(session([], audio=[b"a"], eof=True, stop_after=0.3))
+    elapsed = time.monotonic() - t0
+    assert outcome.status == "cancelled"
+    assert outcome.incomplete
+    assert ws.sent.count(live.CLOSE_STREAM) == 1  # not sent twice
+    assert 3.2 <= elapsed < 4.8  # the stop cap waited once, not twice
+
+
+def test_eof_idle_deadline(monkeypatch):
+    monkeypatch.setattr(live, "EOF_IDLE_S", 0.3)
+    ws = FakeWS(close_on_closestream=False)
+    install_fake_websockets(monkeypatch, ws)
+    t0 = time.monotonic()
+    outcome, _ = run(session([], audio=[b"a"]))
+    elapsed = time.monotonic() - t0
+    assert outcome.status == "drain_timeout"
+    assert outcome.drain_reason == "idle"
+    assert 0.3 <= elapsed < 1.5
+
+
+def test_eof_idle_deadline_refreshed_by_server_messages(monkeypatch):
+    monkeypatch.setattr(live, "EOF_IDLE_S", 0.3)
+    ws = FakeWS(
+        after_close=[_result(str(i)) for i in range(6)],
+        close_on_closestream=False,
+        frame_gap=0.15,
+    )
+    install_fake_websockets(monkeypatch, ws)
+    t0 = time.monotonic()
+    outcome, got = run(session([], audio=[b"a"]))
+    elapsed = time.monotonic() - t0
+    assert len(got) == 6
+    assert outcome.status == "drain_timeout"
+    # 6 x 0.15 s of messages, then 0.3 s idle.
+    assert 1.1 <= elapsed < 2.6
+
+
+def test_eof_absolute_cap(monkeypatch):
+    monkeypatch.setattr(live, "EOF_IDLE_S", 5.0)
+    monkeypatch.setattr(live, "EOF_CAP_MIN_S", 0.4)
+    ws = FakeWS(
+        after_close=[_result(str(i)) for i in range(100)],
+        close_on_closestream=False,
+        frame_gap=0.05,
+    )
+    install_fake_websockets(monkeypatch, ws)
+    t0 = time.monotonic()
+    outcome, _ = run(session([], audio=[b"a"]))
+    elapsed = time.monotonic() - t0
+    assert outcome.status == "drain_timeout"
+    assert outcome.drain_reason == "cap"
+    assert 0.4 <= elapsed < 2.0
+
+
+def test_eof_cap_uses_audio_behind_for_pcm(monkeypatch):
+    # 128 000 B at 320 000 B/s = 0.4 s sent; finals cover 0.1 s; 0.3 s behind
+    # -> cap = 2 x 0.3 = 0.6 s (with the 30 s floor lowered for the test).
+    monkeypatch.setattr(live, "EOF_CAP_MIN_S", 0.0)
+    monkeypatch.setattr(live, "EOF_IDLE_S", 5.0)
+    ws = FakeWS(after_close=[_result("x", 0.0, 0.1)], close_on_closestream=False)
+    install_fake_websockets(monkeypatch, ws)
+    t0 = time.monotonic()
+    outcome, _ = run(session([], audio=[b"a" * 32000] * 4, byte_rate=320000))
+    elapsed = time.monotonic() - t0
+    assert outcome.status == "drain_timeout"
+    assert outcome.drain_reason == "cap"
+    assert outcome.drain_limit_s == pytest.approx(0.6)
+    assert 0.6 <= elapsed < 2.0
+
+
+def test_eof_cap_uses_send_time_without_byte_rate(monkeypatch):
+    monkeypatch.setattr(live, "EOF_CAP_MIN_S", 0.0)
+    monkeypatch.setattr(live, "EOF_IDLE_S", 5.0)
+    ws = FakeWS(close_on_closestream=False)
+    install_fake_websockets(monkeypatch, ws)
+
+    async def main():
+        loop = asyncio.get_running_loop()
+        q: asyncio.Queue = asyncio.Queue(maxsize=4)
+
+        def start():
+            async def feed():
+                for _ in range(3):
+                    await q.put(b"o" * 10)
+                    await asyncio.sleep(0.1)
+                await q.put(b"")
+
+            tasks.append(loop.create_task(feed()))
+
+        tasks: list = []
+        return await live.run_session(
+            "wss://x",
+            {},
+            on_message=lambda m: None,
+            queue=q,
+            closing=threading.Event(),
+            start_source=start,
+            keepalive=False,
+            byte_rate=0,
+        )
+
+    outcome = run(main())
+    assert outcome.drain_reason == "cap"
+    # about 0.2 s between the first and last send -> cap about 0.4 s
+    assert 0.4 <= outcome.drain_limit_s <= 2.0
+
+
+def test_keepalive_after_silence(monkeypatch):
+    monkeypatch.setattr(live, "KEEPALIVE_AFTER_S", 0.2)
+    ws = FakeWS()
+    install_fake_websockets(monkeypatch, ws)
+
+    async def main():
+        asyncio.get_running_loop().call_later(1.3, ws.finish)
+        return await session([], eof=False)
+
+    run(main())
+    assert ws.sent.count(live.KEEP_ALIVE) >= 2
+
+
+def test_no_keepalive_when_disabled(monkeypatch):
+    monkeypatch.setattr(live, "KEEPALIVE_AFTER_S", 0.1)
+    ws = FakeWS()
+    install_fake_websockets(monkeypatch, ws)
+
+    async def main():
+        asyncio.get_running_loop().call_later(0.5, ws.finish)
+        return await session([], eof=False, keepalive=False)
+
+    run(main())
+    assert live.KEEP_ALIVE not in ws.sent
+
+
+def test_shutdown_sets_closing_before_cancelling(monkeypatch):
+    """The producer must see ``closing`` before any task is cancelled: the
+    sender, cancelled while it waits on the queue, records what it saw."""
+    ws = FakeWS(close_on_closestream=False)
+    install_fake_websockets(monkeypatch, ws)
+    closing = threading.Event()
+    seen: list = []
+
+    class SpyQueue(asyncio.Queue):
+        async def get(self):
+            try:
+                return await super().get()
+            except asyncio.CancelledError:
+                seen.append(closing.is_set())
+                raise
+
+    async def main():
+        stop = asyncio.Event()
+        asyncio.get_running_loop().call_later(0.05, stop.set)
+        return await live.run_session(
+            "wss://x",
+            {},
+            on_message=lambda m: None,
+            queue=SpyQueue(maxsize=4),
+            closing=closing,
+            start_source=lambda: None,
+            keepalive=True,
+            byte_rate=0,
+            stop=stop,
+        )
+
+    run(main())
+    assert seen == [True]
+
+
+def test_signal_guard_first_stops_second_exits(monkeypatch):
+    exits = []
+    monkeypatch.setattr(live.os, "_exit", lambda code: exits.append(code))
+
+    async def main():
+        stop = asyncio.Event()
+        guard = live._SignalGuard(asyncio.get_running_loop(), stop)
+        guard._handler(signal.SIGINT, None)
+        await asyncio.sleep(0)
+        first = stop.is_set()
+        guard._handler(signal.SIGINT, None)
+        return first
+
+    assert run(main()) is True
+    assert exits == [2]
+
+
+def test_signal_guard_restores_previous_handler():
+    before = signal.getsignal(signal.SIGINT)
+
+    async def main():
+        guard = live._SignalGuard(asyncio.get_running_loop(), asyncio.Event())
+        guard.install()
+        installed = signal.getsignal(signal.SIGINT)
+        guard.restore()
+        return installed
+
+    installed = run(main())
+    assert installed != before
+    assert signal.getsignal(signal.SIGINT) == before
+
+
+def test_closed_outcomes():
+    from websockets.exceptions import ConnectionClosedError, ConnectionClosedOK
+    from websockets.frames import Close
+
+    ok = ConnectionClosedOK(Close(1000, ""), Close(1000, ""), True)
+    assert live._closed_outcome(ok, ()) is None
+    bad = ConnectionClosedError(Close(1011, "fake\x1b[31m error"), None)
+    out = live._closed_outcome(bad, ())
+    assert out.kind == "server" and out.close_code == 1011
+    assert "1011" in out.error and "\x1b" not in out.error
+    lost = live._closed_outcome(ConnectionClosedError(None, None), ())
+    assert lost.kind == "network"
+    assert lost.error == "The connection to the server was lost."
+
+
+# ── Secrets never echoed ────────────────────────────
+
+SENTINEL = "fake_SENTINEL_0123456789abcdef"
+
+
+@pytest.mark.parametrize(
+    "text",
+    [
+        f"rejected Token {SENTINEL}",
+        f"rejected bearer {SENTINEL}",
+        f"key {SENTINEL} is bad",
+        f"{'x' * 190}Token {SENTINEL}",  # the cut must not leave a prefix
+    ],
+)
+def test_clean_scrubs_credentials_before_truncating(text):
+    out = live._clean(text, 200, (SENTINEL,))
+    assert SENTINEL not in out
+    assert SENTINEL[:8] not in out
+    assert len(out) <= 200
+
+
+def test_server_close_reason_echoing_the_key_is_scrubbed(monkeypatch):
+    from websockets.exceptions import ConnectionClosedError
+    from websockets.frames import Close
+
+    class Echo(FakeWS):
+        async def __anext__(self):
+            raise ConnectionClosedError(
+                Close(1011, f"rejected Token {SENTINEL} and {SENTINEL}"), None
+            )
+
+    install_fake_websockets(monkeypatch, Echo())
+
+    async def main():
+        return await live.run_session(
+            "wss://x",
+            {"Authorization": f"Token {SENTINEL}"},
+            on_message=lambda m: None,
+            queue=asyncio.Queue(),
+            closing=threading.Event(),
+            start_source=lambda: None,
+            keepalive=False,
+            byte_rate=0,
+        )
+
+    outcome = run(main())
+    assert outcome.kind == "server"
+    assert SENTINEL not in outcome.error
+
+
+def test_flux_error_description_echoing_the_key_is_scrubbed(monkeypatch):
+    import click
+
+    install_fake_websockets(monkeypatch, FakeWS([json.dumps({"type": "Error"})]))
+
+    def on_message(raw):
+        raise click.ClickException(f"Flux STT error (AUTH): Token {SENTINEL}")
+
+    async def main():
+        return await live.run_session(
+            "wss://x",
+            {"Authorization": f"Token {SENTINEL}"},
+            on_message=on_message,
+            queue=asyncio.Queue(),
+            closing=threading.Event(),
+            start_source=lambda: None,
+            keepalive=False,
+            byte_rate=0,
+        )
+
+    outcome = run(main())
+    assert outcome.kind == "server"
+    assert SENTINEL not in outcome.error
+    assert "Flux STT error (AUTH)" in outcome.error
+
+
+# ── stdout closed by its reader ──────────────────────────────────────
+
+
+def test_broken_pipe_on_stdout_ends_quietly(monkeypatch):
+    silenced = []
+    monkeypatch.setattr(live, "silence_stdout", lambda: silenced.append(True))
+    install_fake_websockets(monkeypatch, FakeWS([_result("a")]))
+
+    def on_message(raw):
+        raise BrokenPipeError(32, "Broken pipe")
+
+    async def main():
+        return await live.run_session(
+            "wss://x",
+            {},
+            on_message=on_message,
+            queue=asyncio.Queue(),
+            closing=threading.Event(),
+            start_source=lambda: None,
+            keepalive=False,
+            byte_rate=0,
+        )
+
+    outcome = run(main())
+    assert outcome.status == "success"
+    assert outcome.stdout_closed
+    assert silenced == [True]
+
+
+@pytest.mark.parametrize(
+    ("err", "text"),
+    [
+        (28, "No space left on device"),
+        (5, "Input/output error"),
+        (27, "File too large"),
+    ],
+)
+def test_other_stdout_write_errors_are_output_failures(monkeypatch, err, text):
+    """ENOSPC/EIO/EFBIG on stdout is not a network failure."""
+    silenced = []
+    monkeypatch.setattr(live, "silence_stdout", lambda: silenced.append(True))
+    install_fake_websockets(monkeypatch, FakeWS([_result("a"), _result("b")]))
+    seen = []
+
+    def on_message(raw):
+        seen.append(raw)
+        raise OSError(err, text)
+
+    async def main():
+        return await live.run_session(
+            "wss://x",
+            {},
+            on_message=on_message,
+            queue=asyncio.Queue(),
+            closing=threading.Event(),
+            start_source=lambda: None,
+            keepalive=False,
+            byte_rate=0,
+        )
+
+    outcome = run(main())
+    assert outcome.status == "error"
+    assert outcome.kind == "output"
+    assert outcome.os_error == text
+    assert outcome.error == f"Couldn't write the output to stdout: {text}."
+    assert silenced == [True]
+    assert len(seen) == 1  # stopped at the first failed write
+
+
+# ── SIGTERM and non-blocking stdin ─────────────────────────────────────────
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX signals")
+def test_signal_guard_sigterm_drains_then_second_signal_dies_by_sigterm(monkeypatch):
+    died = []
+    monkeypatch.setattr(live, "die_by_signal", lambda s: died.append(s))
+    monkeypatch.setattr(live.os, "_exit", lambda code: died.append(("exit", code)))
+
+    async def main():
+        stop = asyncio.Event()
+        guard = live._SignalGuard(asyncio.get_running_loop(), stop)
+        guard._handler(signal.SIGTERM, None)
+        await asyncio.sleep(0)
+        first = (stop.is_set(), guard.signum)
+        guard._handler(signal.SIGINT, None)
+        return first
+
+    assert run(main()) == (True, signal.SIGTERM)
+    assert died[0] == signal.SIGTERM
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX signals")
+def test_signal_guard_installs_sigterm_only_during_a_session():
+    assert signal.getsignal(signal.SIGTERM) == signal.SIG_DFL
+
+    async def main():
+        guard = live._SignalGuard(asyncio.get_running_loop(), asyncio.Event())
+        guard.install()
+        during = signal.getsignal(signal.SIGTERM)
+        guard.restore()
+        return during
+
+    assert run(main()) != signal.SIG_DFL
+    assert signal.getsignal(signal.SIGTERM) == signal.SIG_DFL
+
+
+def test_session_outcome_records_sigterm(monkeypatch):
+    ws = FakeWS([_result("kept")])
+    install_fake_websockets(monkeypatch, ws)
+
+    async def main():
+        loop = asyncio.get_running_loop()
+        loop.call_later(0.1, signal.raise_signal, signal.SIGTERM)
+        return await live.run_session(
+            "wss://x",
+            {},
+            on_message=lambda m: None,
+            queue=asyncio.Queue(),
+            closing=threading.Event(),
+            start_source=lambda: None,
+            keepalive=False,
+            byte_rate=0,
+        )
+
+    if sys.platform == "win32":
+        pytest.skip("POSIX signals")
+    outcome = run(main())
+    assert outcome.status == "cancelled"
+    assert outcome.signal == signal.SIGTERM
+    assert live.CLOSE_STREAM in ws.sent
+    assert signal.getsignal(signal.SIGTERM) == signal.SIG_DFL
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX signals")
+def test_signal_while_server_closes_still_cancels(monkeypatch):
+    """A SIGTERM that lands while the server is closing isn't dropped: the
+    clean close becomes a SIGTERM stop, so the command still re-raises it."""
+
+    class _SignalOnClose(FakeWS):
+        async def close(self):
+            signal.raise_signal(signal.SIGTERM)
+            await super().close()
+
+    ws = _SignalOnClose([_result("kept")])
+    install_fake_websockets(monkeypatch, ws)
+
+    async def main():
+        asyncio.get_running_loop().call_later(0.05, ws.finish)
+        return await session([], eof=False)
+
+    outcome, got = run(main())
+    assert got == [_result("kept")]
+    assert outcome.status == "cancelled"
+    assert outcome.signal == signal.SIGTERM
+    assert signal.getsignal(signal.SIGTERM) == signal.SIG_DFL
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX pipes")
+def test_reader_waits_on_a_nonblocking_descriptor():
+    """A parent may leave O_NONBLOCK on the shared stdin; the reader waits
+    for data instead of failing with EAGAIN, and leaves the flag alone."""
+    r, w = os.pipe()
+    os.set_blocking(r, False)
+
+    async def main():
+        q: asyncio.Queue = asyncio.Queue()
+        live.StdinReader(
+            asyncio.get_running_loop(), q, threading.Event(), read_size=100, fd=r
+        ).start()
+        await asyncio.sleep(0.3)  # nothing to read yet: EAGAIN
+        os.write(w, b"late")
+        os.close(w)
+        items = []
+        while True:
+            item = await asyncio.wait_for(q.get(), 5)
+            items.append(item)
+            if not isinstance(item, bytes) or not item:
+                return items
+
+    items = run(main())
+    assert items == [b"late", b""]
+    assert os.get_blocking(r) is False
+    os.close(r)
diff --git a/packages/deepctl-cmd-listen/tests/unit/test_live_command.py b/packages/deepctl-cmd-listen/tests/unit/test_live_command.py
new file mode 100644
index 00000000..f7ec239f
--- /dev/null
+++ b/packages/deepctl-cmd-listen/tests/unit/test_live_command.py
@@ -0,0 +1,494 @@
+"""ListenCommand's live surface: no-source refusal, machine output, drain timeout."""
+
+from __future__ import annotations
+
+import json
+from unittest.mock import MagicMock, Mock, patch
+
+import pytest
+from click.testing import CliRunner
+from deepctl_cmd_listen import live
+from deepctl_cmd_listen import messages as msg
+from deepctl_cmd_listen.captions import StreamingCaptionWriter
+from deepctl_cmd_listen.command import ListenCommand
+from deepctl_cmd_listen.models import ListenCodedError, ListenResult
+from deepctl_core import Config, PluginManager
+
+from .test_listen_command import _EndOnCloseStream, _install_websockets, _stdin_pipe
+
+
+@pytest.fixture
+def command():
+    return ListenCommand()
+
+
+@pytest.fixture
+def no_agent(monkeypatch):
+    for name in (
+        "AI_AGENT",
+        "CLAUDECODE",
+        "CLAUDE_CODE_ENTRYPOINT",
+        "CODEX_SANDBOX",
+        "CODEX_SANDBOX_NETWORK_DISABLED",
+        "CURSOR_AGENT",
+        "GEMINI_CLI",
+        "OR_APP_NAME",
+        "OR_SITE_URL",
+    ):
+        monkeypatch.delenv(name, raising=False)
+
+
+def _client():
+    client = MagicMock()
+    client.config.get_profile.return_value.base_url = "https://api.deepgram.com"
+    client.auth_manager.get_api_key.return_value = "k"
+    return client
+
+
+def _invoke(command, args, *, env=None):
+    config = Mock(spec=Config)
+    config.get.side_effect = lambda key, default=None: (
+        True if key == "output.quiet" else default
+    )
+    click_command = PluginManager()._create_click_command(command)
+    with (
+        patch("deepctl_core.base_command.AuthManager.guard") as guard,
+        patch(
+            "deepctl_core.base_command.AuthManager.check_base_url",
+            return_value="https://api.deepgram.com",
+        ),
+    ):
+        result = CliRunner().invoke(
+            click_command, args, obj={"config": config}, env=env, catch_exceptions=False
+        )
+    return result, guard
+
+
+# ── No source under a hard agent signal ────────────────────────────────────
+
+
+def test_agent_without_source_is_refused_before_auth(command, monkeypatch, no_agent):
+    monkeypatch.setenv("AI_AGENT", "x")
+    connect = MagicMock()
+    _install_websockets(monkeypatch, connect)
+    result, guard = _invoke(command, [])
+    assert result.exit_code == 1
+    guard.assert_not_called()  # nothing authenticated, nothing sent
+    assert (
+        "listen needs a file, a URL, --mic, or - to read audio from stdin."
+        in result.stderr
+    )
+    assert msg.H_LISTEN_NO_SOURCE in result.stderr
+
+
+def test_agent_no_source_payload(command, monkeypatch, no_agent):
+    monkeypatch.setenv("AI_AGENT", "x")
+    early = command.pre_auth_check(Mock(spec=Config), source=None, mic=False)
+    assert isinstance(early, ListenCodedError)
+    data = early.model_dump()
+    assert list(data) == [
+        "error",
+        "status",
+        "code",
+        "hint",
+        "next_step",
+        "schema_version",
+    ]
+    assert data["status"] == "error"
+    assert data["code"] == "invalid_argument"
+    assert data["next_step"].endswith(" listen --help")
+    assert data["schema_version"] == 1
+    assert command.exit_code_for(early) == 1
+
+
+@pytest.mark.parametrize(
+    "kwargs", [{"source": "-"}, {"source": "a.wav"}, {"mic": True}]
+)
+def test_agent_with_a_source_is_not_refused(command, monkeypatch, no_agent, kwargs):
+    monkeypatch.setenv("AI_AGENT", "x")
+    assert command.pre_auth_check(Mock(spec=Config), **kwargs) is None
+
+
+def test_no_agent_keeps_auto_detection(command, no_agent):
+    assert command.pre_auth_check(Mock(spec=Config), source=None, mic=False) is None
+
+
+def test_ci_alone_is_not_a_hard_signal(command, monkeypatch, no_agent):
+    monkeypatch.setenv("CI", "true")
+    assert command.pre_auth_check(Mock(spec=Config), source=None, mic=False) is None
+
+
+# ── A machine format keeps transcript lines off stdout ─────────────────────
+
+
+def _results(*texts):
+    return [
+        json.dumps(
+            {
+                "type": "Results",
+                "is_final": True,
+                "start": 0,
+                "duration": 1,
+                "channel": {"alternatives": [{"transcript": t}]},
+            }
+        )
+        for t in texts
+    ]
+
+
+class _Replay(_EndOnCloseStream):
+    def __init__(self, frames):
+        super().__init__()
+        self.frames = list(frames)
+
+    async def __anext__(self):
+        if self.frames:
+            return self.frames.pop(0)
+        return await super().__anext__()
+
+
+def _fmt(monkeypatch, fmt, source="explicit"):
+    monkeypatch.setattr("deepctl_cmd_listen.command.get_output_format", lambda: fmt)
+    monkeypatch.setattr("deepctl_core.output.get_output_format", lambda: fmt)
+    monkeypatch.setattr("deepctl_cmd_listen.command.format_source", lambda: source)
+
+
+def _stream(command, **over):
+    kw = {
+        "model": "nova-3",
+        "language": "en-US",
+        "api_version": 1,
+        "diarize": False,
+        "smart_format": True,
+        "punctuate": True,
+        "interim": True,
+        "redact": (),
+        "numerals": False,
+        "encoding": "linear16",
+        "sample_rate": 16000,
+        "channels": 1,
+        "save_to": None,
+        "caption_format": None,
+    }
+    kw.update(over)
+    return command._stream_stdin(_client(), **kw)
+
+
+def test_machine_format_prints_only_the_result(command, monkeypatch, capsys):
+    _fmt(monkeypatch, "json")
+    _stdin_pipe(monkeypatch, b"\0" * 3200)
+    _install_websockets(monkeypatch, _Replay(_results("hello", "world")))
+    result = _stream(command)
+    assert result.status == "success"
+    assert capsys.readouterr().out == ""  # nothing streamed
+    command.output_result(result, Mock(spec=Config))
+    out = capsys.readouterr().out
+    payload = json.loads(out)  # exactly one document
+    assert payload["transcript"] == "hello world"
+    assert payload["status"] == "success"
+    assert payload["mode"] == "live"
+
+
+def test_human_format_streams_lines(command, monkeypatch, capsys):
+    _fmt(monkeypatch, "default", "default")
+    _stdin_pipe(monkeypatch, b"\0" * 3200)
+    _install_websockets(monkeypatch, _Replay(_results("hello", "world")))
+    result = _stream(command)
+    command.output_result(result, Mock(spec=Config))
+    assert capsys.readouterr().out == "hello\nworld\n"
+
+
+def test_machine_format_result_on_empty_stdin(command, monkeypatch, capsys):
+    """/dev/null on stdin: still exactly one Result document."""
+    _fmt(monkeypatch, "json")
+    _stdin_pipe(monkeypatch, b"")
+    _install_websockets(monkeypatch, _Replay([]))
+    result = _stream(command)
+    command.output_result(result, Mock(spec=Config))
+    payload = json.loads(capsys.readouterr().out)
+    assert payload["transcript"] == ""
+
+
+def test_machine_format_captions_not_streamed(command, monkeypatch, capsys, tmp_path):
+    _fmt(monkeypatch, "json")
+    _stdin_pipe(monkeypatch, b"\0" * 3200)
+    frame = json.dumps(
+        {
+            "type": "Results",
+            "is_final": True,
+            "start": 0,
+            "duration": 1,
+            "channel": {
+                "alternatives": [
+                    {
+                        "transcript": "hi",
+                        "words": [{"word": "hi", "start": 0.0, "end": 0.5}],
+                    }
+                ]
+            },
+        }
+    )
+    _install_websockets(monkeypatch, _Replay([frame]))
+    save = tmp_path / "c.vtt"
+    result = _stream(command, caption_format="webvtt", save_to=str(save))
+    assert capsys.readouterr().out == ""
+    assert "WEBVTT" in save.read_text()
+    assert result.caption_format == "webvtt"
+
+
+def test_caption_writer_echo_false_collects_silently(capsys):
+    w = StreamingCaptionWriter("srt", echo=False)
+    w.print_header()
+    w.write_entry([{"word": "a", "start": 0.0, "end": 1.0}], 0.0, 1.0)
+    assert capsys.readouterr().out == ""
+    assert w.accumulated_words == [{"word": "a", "start": 0.0, "end": 1.0}]
+
+
+# ── Drain timeout and server errors ────────────────────────────────────────
+
+
+class _Silent(_EndOnCloseStream):
+    """Never answers CloseStream."""
+
+    async def send(self, data):
+        self.sent.append(data)
+
+
+def test_drain_timeout_is_coded_and_keeps_save_to(
+    command, monkeypatch, capsys, tmp_path
+):
+    monkeypatch.setattr(live, "EOF_IDLE_S", 0.2)
+
+    class _OneThenSilent(_Silent):
+        def __init__(self):
+            super().__init__()
+            self.frames = _results("kept")
+
+        async def __anext__(self):
+            if self.frames:
+                return self.frames.pop(0)
+            return await super().__anext__()
+
+    _stdin_pipe(monkeypatch, b"\0" * 3200)
+    _install_websockets(monkeypatch, _OneThenSilent())
+    save = tmp_path / "t.txt"
+    result = _stream(command, save_to=str(save))
+    assert isinstance(result, ListenCodedError)
+    assert result.code == "stream_drain_timeout"
+    assert result.next_step is None
+    assert result.details == {
+        "reason": "idle",
+        "limit_s": 0.2,
+        "transcript": "kept",
+        "transcript_chars": 4,
+        "saved_to": str(save),
+    }
+    assert list(result.model_dump()) == [
+        "error",
+        "status",
+        "code",
+        "hint",
+        "next_step",
+        "schema_version",
+        "details",
+    ]
+    assert command.exit_code_for(result) == 1
+    assert save.read_text() == "kept"
+    err = capsys.readouterr().err
+    assert "after the audio ended, so results may be incomplete" in err
+    assert msg.H_DRAIN_TIMEOUT in err
+
+
+def test_server_error_result_exits_one(command, monkeypatch, capsys):
+    import asyncio
+
+    class _Boom(_EndOnCloseStream):
+        async def __anext__(self):
+            await asyncio.sleep(0.01)
+            raise RuntimeError("socket exploded")
+
+    _stdin_pipe(monkeypatch, b"", close=False)
+    _install_websockets(monkeypatch, _Boom())
+    result = _stream(command)
+    assert isinstance(result, ListenCodedError)
+    assert result.code == "network_unavailable"
+    assert result.details["transcript"] == ""
+    assert result.details["reason"] == "connection lost"
+    assert command.exit_code_for(result) == 1
+    assert "socket exploded" in capsys.readouterr().err
+
+
+def test_untrusted_host_never_connects(command, monkeypatch):
+    """The WebSocket URL comes only from the checked base URL; a refused
+    host raises before any connection is attempted."""
+    from deepctl_core.hosts import CredentialHostError
+
+    connect = MagicMock()
+    import sys
+    import types
+
+    fake = types.ModuleType("websockets")
+    fake.connect = connect
+    monkeypatch.setitem(sys.modules, "websockets", fake)
+    client = _client()
+    client.auth_manager.check_base_url.side_effect = CredentialHostError(
+        "E-FH-FLAG", "foreign_host", "no", "hint"
+    )
+    _stdin_pipe(monkeypatch, b"")
+    with pytest.raises(CredentialHostError):
+        command._stream_stdin(
+            client,
+            model="nova-3",
+            language="en-US",
+            api_version=1,
+            diarize=False,
+            smart_format=True,
+            punctuate=True,
+            interim=False,
+            redact=(),
+            numerals=False,
+            encoding="linear16",
+            sample_rate=16000,
+            channels=1,
+            save_to=None,
+            caption_format=None,
+        )
+    connect.assert_not_called()
+
+
+def test_cancelled_live_result_is_payload_under_json(command, monkeypatch, capsys):
+    _fmt(monkeypatch, "json")
+    r = ListenResult(status="cancelled", source="stdin", mode="live", transcript="x")
+    command.output_result(r, Mock(spec=Config))
+    payload = json.loads(capsys.readouterr().out)
+    assert payload["status"] == "cancelled"
+    assert payload["transcript"] == "x"
+
+
+# ── A server error close keeps the transcript in details ────────────────────
+
+
+def test_server_error_close_is_coded_with_transcript(command, monkeypatch, capsys):
+    from websockets.exceptions import ConnectionClosedError
+    from websockets.frames import Close
+
+    class _CloseAfter(_EndOnCloseStream):
+        def __init__(self):
+            super().__init__()
+            self.frames = _results("one", "two")
+
+        async def __anext__(self):
+            if self.frames:
+                return self.frames.pop(0)
+            raise ConnectionClosedError(Close(1011, "boom Token k"), None)
+
+    _stdin_pipe(monkeypatch, b"", close=False)
+    _install_websockets(monkeypatch, _CloseAfter())
+    result = _stream(command)
+    assert result.code == "server_error"
+    assert result.details["close_code"] == 1011
+    assert result.details["transcript"] == "one two"
+    assert result.details["transcript_chars"] == 7
+    assert "saved_to" not in result.details
+    err = capsys.readouterr().err
+    assert "(1011)" in err and "Token k" not in err
+
+
+# ── Implicit JSON from soft signals only keeps live lines ──────────────────
+
+
+@pytest.mark.parametrize(
+    ("source", "lines"),
+    [("soft", True), ("explicit", False), ("hard_agent", False)],
+)
+def test_live_lines_follow_format_source(command, monkeypatch, capsys, source, lines):
+    _fmt(monkeypatch, "json", source)
+    _stdin_pipe(monkeypatch, b"\0" * 3200)
+    _install_websockets(monkeypatch, _Replay(_results("hello", "world")))
+    result = _stream(command)
+    streamed = capsys.readouterr().out
+    assert (streamed == "hello\nworld\n") is lines
+    command.output_result(result, Mock(spec=Config))
+    payload = json.loads(capsys.readouterr().out)  # then one Result document
+    assert payload["transcript"] == "hello world"
+
+
+def test_format_source_values(monkeypatch):
+    from deepctl_core import output
+
+    monkeypatch.setitem(output._output_config, "agentic", False)
+    output.setup_output("default")
+    assert output.format_source() == "default"
+    output.setup_output("json")
+    assert output.format_source() == "explicit"
+    monkeypatch.setitem(output._output_config, "agentic", True)
+    monkeypatch.delenv("AI_AGENT", raising=False)
+    for name in output.AI_AGENT_ENV_MARKERS:
+        monkeypatch.delenv(name, raising=False)
+    monkeypatch.delenv("OR_APP_NAME", raising=False)
+    monkeypatch.delenv("OR_SITE_URL", raising=False)
+    output.setup_output("default")
+    assert output.format_source() == "soft"
+    monkeypatch.setenv("AI_AGENT", "x")
+    output.setup_output("default")
+    assert output.format_source() == "hard_agent"
+    assert output.get_output_format() == "json"
+    output.setup_output("default")
+    monkeypatch.setitem(output._output_config, "agentic", False)
+    output.setup_output("default")
+
+
+# ── A SIGTERM drain ends the process by SIGTERM ────────────────────────────
+
+
+def test_exit_code_for_reraises_sigterm_after_drain(command, monkeypatch):
+    import signal
+
+    died = []
+    monkeypatch.setattr(live, "die_by_signal", lambda s: died.append(s))
+    command._reraise_signal = signal.SIGTERM
+    r = ListenResult(status="cancelled", source="stdin", mode="live")
+    command.exit_code_for(r)
+    assert died == [signal.SIGTERM]
+    assert command._reraise_signal is None
+
+
+# ── Round 2: stdin that can't be read is invalid_argument ──────────────────
+
+
+def test_unreadable_stdin_is_invalid_argument(command, monkeypatch, capsys):
+    import os
+
+    r, w = os.pipe()
+    os.close(w)
+    os.close(r)  # reading a closed descriptor: EBADF
+    monkeypatch.setattr("deepctl_cmd_listen.command._stdin_fd", lambda: r)
+    _install_websockets(monkeypatch, _EndOnCloseStream())
+    result = _stream(command)
+    assert isinstance(result, ListenCodedError)
+    assert result.code == "invalid_argument"
+    assert result.error.startswith("Couldn't read audio from stdin: ")
+    assert result.error.endswith(".")
+    assert result.next_step.endswith(" listen --help")
+    assert result.hint in (msg.H_LISTEN_STDIN_UNREADABLE, msg.A_LISTEN_STDIN_UNREADABLE)
+    assert result.details == {"transcript": "", "transcript_chars": 0}
+    assert command.exit_code_for(result) == 1
+    assert "Couldn't read audio from stdin" in capsys.readouterr().err
+
+
+def test_live_result_into_a_closed_stdout_is_quiet(command, monkeypatch):
+    """`dg -o json listen - | true`: the reader is gone before the final
+    Result; dg points stdout at /dev/null and carries on."""
+    import sys as _sys
+
+    silenced = []
+    monkeypatch.setattr(live, "silence_stdout", lambda: silenced.append(True))
+    _fmt(monkeypatch, "json")
+
+    def boom(_text):
+        raise BrokenPipeError(32, "Broken pipe")
+
+    monkeypatch.setattr(_sys.stdout, "write", boom)
+    r = ListenResult(status="success", source="stdin", mode="live", transcript="x")
+    command.output_result(r, Mock(spec=Config))
+    assert silenced == [True]
diff --git a/packages/deepctl-cmd-listen/tests/unit/test_live_exit.py b/packages/deepctl-cmd-listen/tests/unit/test_live_exit.py
new file mode 100644
index 00000000..4573f565
--- /dev/null
+++ b/packages/deepctl-cmd-listen/tests/unit/test_live_exit.py
@@ -0,0 +1,152 @@
+"""How a live stream's stop maps to its result and exit code, and the
+listen command's lazy imports."""
+
+from __future__ import annotations
+
+import sys
+from unittest.mock import MagicMock
+
+import pytest
+from deepctl_cmd_listen import live
+from deepctl_cmd_listen.command import ListenCommand
+
+from .test_listen_command import _EndOnCloseStream, _install_websockets
+
+
+@pytest.fixture
+def command():
+    return ListenCommand()
+
+
+def _client():
+    client = MagicMock()
+    client.config.get_profile.return_value.base_url = "https://api.deepgram.com"
+    client.auth_manager.get_api_key.return_value = "k"
+    return client
+
+
+# ── Mic Ctrl-C ends the session (exit 0); other stops stay cancelled ───────
+
+
+def _finish(command, source, signum):
+    import signal
+
+    outcome = live.LiveOutcome(status="cancelled", signal=getattr(signal, signum))
+    return command._finish_live(
+        outcome,
+        source=source,
+        model="nova-3",
+        language="en",
+        diarize=False,
+        transcript_acc=["hello", "world"],
+        caption_writer=None,
+        caption_format=None,
+        save_to=None,
+        v2_state=None,
+    )
+
+
+@pytest.mark.parametrize(
+    ("source", "signum", "status", "code"),
+    [("mic", "SIGINT", "success", 0), ("stdin", "SIGINT", "cancelled", 2)],
+)
+def test_live_sigint_outcome_by_source(command, source, signum, status, code):
+    result = _finish(command, source, signum)
+    assert result.status == status
+    assert result.transcript == "hello world"
+    assert command.exit_code_for(result) == code
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="SIGTERM drain is POSIX only")
+@pytest.mark.parametrize("source", ["mic", "stdin"])
+def test_live_sigterm_is_cancelled_for_every_source(command, monkeypatch, source):
+    import signal
+
+    died = []
+    monkeypatch.setattr(live, "die_by_signal", lambda s: died.append(s))
+    result = _finish(command, source, "SIGTERM")
+    assert result.status == "cancelled"
+    assert result.transcript == "hello world"
+    command.exit_code_for(result)
+    assert died == [signal.SIGTERM]
+
+
+def test_mic_sigterm_drains_and_stays_cancelled(command, monkeypatch):
+    """A real SIGTERM during a mic stream drains like Ctrl-C, but the result
+    stays "cancelled" and the process then ends by SIGTERM."""
+    import asyncio
+    import signal
+    import types
+
+    if sys.platform == "win32":
+        pytest.skip("SIGTERM drain is POSIX only")
+
+    class _FakeInputStream:
+        def __init__(self, **_kwargs):
+            pass
+
+        def start(self):
+            pass
+
+        def stop(self):
+            pass
+
+        def close(self):
+            pass
+
+    fake_sd = types.ModuleType("sounddevice")
+    fake_sd.RawInputStream = _FakeInputStream
+    fake_np = types.ModuleType("numpy")
+    fake_np.int16 = "int16"
+    monkeypatch.setitem(sys.modules, "sounddevice", fake_sd)
+    monkeypatch.setitem(sys.modules, "numpy", fake_np)
+    ws = _EndOnCloseStream()
+    _install_websockets(monkeypatch, ws)
+    died = []
+    monkeypatch.setattr(live, "die_by_signal", lambda s: died.append(s))
+
+    loop = asyncio.new_event_loop()
+    loop.call_later(0.1, signal.raise_signal, signal.SIGTERM)
+    try:
+        result = loop.run_until_complete(
+            command._ws_mic(
+                _client(),
+                model="nova-3",
+                language="en",
+                api_version=1,
+                diarize=False,
+                smart_format=True,
+                punctuate=True,
+                interim=False,
+                redact=(),
+                numerals=False,
+                sample_rate=16000,
+                channels=1,
+            )
+        )
+    finally:
+        loop.close()
+
+    assert result.status == "cancelled"
+    assert '{"type": "CloseStream"}' in ws.sent
+    command.exit_code_for(result)
+    assert died == [signal.SIGTERM]
+
+
+# ── Importing the listen command doesn't import asyncio ────────────────────
+
+
+def test_listen_command_import_is_lazy():
+    import subprocess
+
+    code = (
+        "import sys\n"
+        "from deepctl_cmd_listen.command import ListenCommand\n"
+        "ListenCommand().get_arguments()\n"
+        "bad = [m for m in ('asyncio', 'deepctl_cmd_listen.live') if m in sys.modules]\n"
+        "print(','.join(bad))\n"
+    )
+    out = subprocess.run(
+        [sys.executable, "-c", code], capture_output=True, text=True, check=True
+    )
+    assert out.stdout.strip() == ""
diff --git a/packages/deepctl-cmd-listen/tests/unit/test_live_signals.py b/packages/deepctl-cmd-listen/tests/unit/test_live_signals.py
new file mode 100644
index 00000000..f5dde92c
--- /dev/null
+++ b/packages/deepctl-cmd-listen/tests/unit/test_live_signals.py
@@ -0,0 +1,281 @@
+"""Real exit codes for Ctrl-C on live ``dg listen``, in a subprocess.
+
+A loopback WebSocket server in this process stands in for the API (fake key,
+no network), and a fake ``sounddevice`` on ``PYTHONPATH`` stands in for the
+microphone. ``dg listen -`` stops with exit 2 on Ctrl-C; ``dg listen --mic``
+ends with exit 0, including a Ctrl-C that lands before the session's own
+handler is in place.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import signal
+import subprocess
+import sys
+import threading
+import time
+from pathlib import Path
+
+import pytest
+
+pytestmark = pytest.mark.skipif(sys.platform == "win32", reason="POSIX signals")
+
+ENTRY = "import sys; from deepctl.main import main; sys.exit(main())"
+FAKE_KEY = "fa1ce0000000000000000000000000000000000d"
+# Generous bound for a cold interpreter start on a loaded runner; a normal
+# run of each test takes about a second.
+STARTUP_S = 20.0
+
+FAKE_SOUNDDEVICE = '''
+import threading, time
+
+class RawInputStream:
+    """Calls the callback with 50 ms of silence until stopped."""
+
+    def __init__(self, samplerate, channels, dtype, callback, blocksize, **kw):
+        self._cb = callback
+        self._n = blocksize * channels
+        self._stop = threading.Event()
+
+    def start(self):
+        def run():
+            while not self._stop.is_set():
+                self._cb(b"\\x10\\x00" * self._n, self._n, None, None)
+                time.sleep(0.05)
+
+        threading.Thread(target=run, daemon=True).start()
+
+    def stop(self):
+        self._stop.set()
+
+    def close(self):
+        pass
+'''
+
+
+def _final(text: str) -> str:
+    return json.dumps(
+        {
+            "type": "Results",
+            "is_final": True,
+            "start": 0.0,
+            "duration": 1.0,
+            "channel": {"alternatives": [{"transcript": text, "words": []}]},
+        }
+    )
+
+
+class _FakeServer:
+    """Sends one final after the first audio frame, and one more on
+    CloseStream, then closes. ``audio`` is set once audio has arrived."""
+
+    def __init__(self) -> None:
+        from websockets.sync.server import serve
+
+        self.audio = threading.Event()
+        self.closestream = threading.Event()
+        self._server = serve(self._handle, "127.0.0.1", 0, process_request=self._http)
+        self.port = self._server.socket.getsockname()[1]
+        threading.Thread(target=self._server.serve_forever, daemon=True).start()
+
+    @staticmethod
+    def _http(connection, request):
+        """Plain HTTP (the auth pre-flight): one fake project, as JSON."""
+        if request.headers.get("Upgrade", "").lower() == "websocket":
+            return None
+        from websockets.datastructures import Headers
+        from websockets.http11 import Response
+
+        body = json.dumps(
+            {"projects": [{"project_id": "00000000-0000-0000-0000-000000000000"}]}
+        ).encode()
+        headers = Headers(
+            [
+                ("Content-Type", "application/json"),
+                ("Content-Length", str(len(body))),
+                ("Connection", "close"),
+            ]
+        )
+        return Response(200, "OK", headers, body)
+
+    def _handle(self, ws) -> None:
+        sent = False
+        try:
+            for message in ws:
+                if isinstance(message, bytes):
+                    if not sent:
+                        ws.send(_final("hello"))
+                        sent = True
+                        self.audio.set()
+                elif "CloseStream" in message:
+                    self.closestream.set()
+                    ws.send(_final("bye"))
+                    ws.close()
+                    return
+        except Exception:
+            pass
+
+    def shutdown(self) -> None:
+        self._server.shutdown()
+
+
+@pytest.fixture
+def server():
+    srv = _FakeServer()
+    yield srv
+    srv.shutdown()
+
+
+@pytest.fixture
+def env(tmp_path, server):
+    fakes = tmp_path / "fakes"
+    fakes.mkdir()
+    (fakes / "sounddevice.py").write_text(FAKE_SOUNDDEVICE)
+    home = tmp_path / "home"
+    home.mkdir()
+    e = {
+        k: v
+        for k, v in os.environ.items()
+        if not k.startswith(("DEEPGRAM_", "DEEPCTL_", "DG_"))
+        and k
+        not in (
+            "AI_AGENT",
+            "AGENT",
+            "CI",
+            "CLAUDECODE",
+            "CLAUDE_CODE_ENTRYPOINT",
+            "CODEX_SANDBOX",
+            "CODEX_SANDBOX_NETWORK_DISABLED",
+            "CURSOR_AGENT",
+            "GEMINI_CLI",
+            "GOOSE_TERMINAL",
+            "OR_APP_NAME",
+            "OR_SITE_URL",
+        )
+    }
+    e.update(
+        HOME=str(home),
+        XDG_CONFIG_HOME=str(home / ".config"),
+        TERM="xterm",
+        DEEPGRAM_API_KEY=FAKE_KEY,
+        DEEPGRAM_BASE_URL=f"http://127.0.0.1:{server.port}",
+        DEEPCTL_TELEMETRY_DISABLED="1",
+        DEEPCTL_TELEMETRY_DSN="http://k@127.0.0.1:9/1",
+        CI="true",  # no background update check (it can hold exit for 2 s)
+        PYTHONPATH=os.pathsep.join(
+            [str(fakes), *filter(None, [os.environ.get("PYTHONPATH")])]
+        ),
+    )
+    return e
+
+
+def _start(args, env, *, stdin=subprocess.DEVNULL):
+    return subprocess.Popen(
+        [sys.executable, "-c", ENTRY, "-o", "json", "listen", *args],
+        stdin=stdin,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        env=env,
+    )
+
+
+def _wait_for_stderr(proc, text: str, timeout: float = STARTUP_S) -> None:
+    """Read stderr until ``text`` appears (the banner), byte by byte."""
+    assert proc.stderr is not None
+    seen = b""
+    deadline = time.monotonic() + timeout
+    while text.encode() not in seen:
+        if time.monotonic() > deadline or proc.poll() is not None:
+            raise AssertionError(f"never saw {text!r}: {seen.decode(errors='replace')}")
+        b = proc.stderr.read(1)
+        if not b:
+            continue
+        seen += b
+
+
+def _why(proc) -> str:
+    proc.kill()
+    _out, err = proc.communicate(timeout=STARTUP_S)
+    return f"no audio reached the server; stderr: {err.decode(errors='replace')}"
+
+
+def _finish(proc):
+    # A stop drains for at most 1 s; this only bounds a hang.
+    out, err = proc.communicate(timeout=STARTUP_S)
+    return proc.returncode, out.decode(), err.decode()
+
+
+def test_stdin_ctrl_c_exits_2(env, server):
+    proc = _start(
+        ["-", "--encoding", "linear16", "--sample-rate", "16000"],
+        env,
+        stdin=subprocess.PIPE,
+    )
+    assert proc.stdin is not None
+    try:
+        proc.stdin.write(b"\x10\x00" * 3200)
+        proc.stdin.flush()
+        assert server.audio.wait(STARTUP_S), _why(proc)
+        proc.send_signal(signal.SIGINT)
+        rc, out, err = _finish(proc)
+    finally:
+        proc.kill()
+    assert rc == 2, err
+    assert server.closestream.is_set()
+    payload = json.loads(out)
+    assert payload["status"] == "cancelled"
+    assert "hello" in payload["transcript"]
+    assert "Traceback" not in err
+
+
+def test_mic_ctrl_c_exits_0(env, server):
+    proc = _start(["--mic"], env)
+    try:
+        assert server.audio.wait(STARTUP_S), _why(proc)
+        proc.send_signal(signal.SIGINT)
+        rc, out, err = _finish(proc)
+    finally:
+        proc.kill()
+    assert rc == 0, err
+    assert server.closestream.is_set()
+    payload = json.loads(out)
+    assert payload["status"] == "success"
+    assert "hello" in payload["transcript"]
+    assert "Traceback" not in err
+
+
+def test_mic_ctrl_c_right_after_start_exits_0(env, server):
+    """Ctrl-C as soon as the banner shows, before the session's handler is
+    installed (imports and connect still running), is still a mic stop.
+    --verbose keeps the status line that -o json drops in this mode."""
+    proc = subprocess.Popen(
+        [sys.executable, "-c", ENTRY, "--verbose", "-o", "json", "listen", "--mic"],
+        stdin=subprocess.DEVNULL,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        env=env,
+    )
+    try:
+        _wait_for_stderr(proc, "Listening on microphone")
+        proc.send_signal(signal.SIGINT)
+        rc, out, err = _finish(proc)
+    finally:
+        proc.kill()
+    assert rc == 0, err
+    payload = json.loads(out)
+    assert payload["status"] == "success"
+    assert "Traceback" not in err
+
+
+def test_fake_sounddevice_is_on_path(env):
+    """Guard against the real PortAudio module sneaking in."""
+    out = subprocess.run(
+        [sys.executable, "-c", "import sounddevice; print(sounddevice.__file__)"],
+        env=env,
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    assert Path(out.stdout.strip()).parent.name == "fakes"
diff --git a/packages/deepctl-cmd-listen/tests/unit/test_prerecorded_upload.py b/packages/deepctl-cmd-listen/tests/unit/test_prerecorded_upload.py
new file mode 100644
index 00000000..086ddedd
--- /dev/null
+++ b/packages/deepctl-cmd-listen/tests/unit/test_prerecorded_upload.py
@@ -0,0 +1,466 @@
+"""``dg listen`` prerecorded sources: streamed files, --timeout, URLs."""
+
+from __future__ import annotations
+
+import os
+from typing import Any
+from unittest.mock import Mock, patch
+
+import click
+import pytest
+from click.testing import CliRunner
+from deepctl_cmd_listen.command import ListenCommand
+from deepctl_cmd_listen.models import ListenResult
+from deepctl_core import Config, PluginManager, output, transport, upload
+from deepctl_core.upload import UploadFileError
+
+
+@pytest.fixture(autouse=True)
+def _plain_output(monkeypatch):
+    monkeypatch.setitem(output._output_config, "agentic", False)
+    monkeypatch.setattr(transport, "prog", lambda: "dg")
+
+
+def _prerecorded(client, source="audio.wav", **overrides):
+    kwargs: dict[str, Any] = {
+        "is_url": False,
+        "model": "nova-3",
+        "language": "en-US",
+        "api_version": 1,
+        "diarize": False,
+        "smart_format": True,
+        "punctuate": True,
+        "summarize": False,
+        "topics": False,
+        "sentiment": False,
+        "redact": (),
+        "numerals": False,
+        "save_to": None,
+        "probe": False,
+        "no_validate": True,
+        "caption_format": None,
+        "config": Mock(spec=Config),
+    }
+    kwargs.update(overrides)
+    return ListenCommand()._prerecorded(client, source, **kwargs)
+
+
+def test_file_changed_returns_coded_error(capsys):
+    client = Mock()
+    client.transcribe_file.side_effect = UploadFileError(
+        upload.FILE_CHANGED, "audio.wav"
+    )
+    result = _prerecorded(client)
+    payload = result.model_dump()
+    assert payload["status"] == "error"
+    assert payload["code"] == "invalid_argument"
+    assert payload["error"] == "audio.wav changed while dg was uploading it."
+    assert payload["next_step"] is None
+    assert payload["details"] == {"path": "audio.wav"}
+    assert ListenCommand().exit_code_for(result) == 1
+    assert "changed while dg was uploading it" in capsys.readouterr().err
+
+
+def test_validated_file_identity_reaches_the_upload(tmp_path):
+    audio = tmp_path / "a.wav"
+    audio.write_bytes(b"RIFF" + b"\0" * 64)
+    st = audio.stat()
+    client = Mock()
+    client.transcribe_file.return_value = {"results": {"channels": []}}
+    _prerecorded(client, str(audio), no_validate=False)
+    assert client.transcribe_file.call_args.kwargs["file_id"] == (st.st_dev, st.st_ino)
+
+
+def test_path_swapped_during_validation_uploads_nothing(tmp_path, monkeypatch):
+    """The file validated is the file uploaded."""
+    import deepctl_shared_utils
+    from deepctl_core.client import DeepgramClient
+
+    audio = tmp_path / "a.wav"
+    audio.write_bytes(b"RIFF" + b"\0" * 64)
+    other = tmp_path / "other.wav"
+    other.write_bytes(b"RIFF" + b"\1" * 64)
+
+    def validate_then_swap(path):
+        os.replace(other, audio)  # someone swaps the path mid-validation
+        return None, []
+
+    monkeypatch.setattr(
+        deepctl_shared_utils.validation, "audio_file_problem", validate_then_swap
+    )
+    client = Mock(spec=DeepgramClient)
+    client.transcribe_file.side_effect = lambda path, options, **kw: (
+        DeepgramClient.transcribe_file(client, path, options, **kw)
+    )
+    client._secrets = ()
+    result = _prerecorded(client, str(audio), no_validate=False)
+    payload = result.model_dump()
+    assert payload["code"] == "invalid_argument"
+    assert payload["error"] == f"{audio} changed while dg was uploading it."
+    client.client.listen.v1.media.transcribe_file.assert_not_called()
+
+
+# ── --timeout ────────────────────────────────────────────────────────
+
+
+def _invoke(args: list[str], prerecorded: Mock | None = None, **streams: Mock):
+    config = Mock(spec=Config)
+    config.get.side_effect = lambda key, default=None: (
+        True if key == "output.quiet" else default
+    )
+    config.get_profile.return_value.base_url = "https://api.deepgram.com"
+    command = ListenCommand()
+    done = ListenResult(status="success", source="file", mode="prerecorded")
+    with (
+        patch.object(command, "_prerecorded", prerecorded or Mock(return_value=done)),
+        patch.object(command, "_stream_mic", streams.get("mic", Mock())),
+        patch.object(command, "_stream_stdin", streams.get("stdin", Mock())),
+        patch("deepctl_core.base_command.AuthManager.guard"),
+        patch(
+            "deepctl_core.base_command.AuthManager.check_base_url",
+            return_value="https://api.deepgram.com",
+        ),
+    ):
+        click_command = PluginManager()._create_click_command(command)
+        return CliRunner().invoke(click_command, args, obj={"config": config})
+
+
+@pytest.mark.parametrize(
+    ("args", "expected"),
+    [
+        (["a.wav"], 300.0),
+        (["a.wav", "--timeout", "120"], 120.0),
+        (["https://example.com/a.wav", "--timeout", "2.5"], 2.5),
+    ],
+)
+def test_timeout_reaches_the_request(args, expected):
+    done = ListenResult(status="success", source="file", mode="prerecorded")
+    prerecorded = Mock(return_value=done)
+    result = _invoke(args, prerecorded)
+    assert result.exit_code == 0, result.output
+    assert prerecorded.call_args.kwargs["timeout_s"] == expected
+
+
+@pytest.mark.parametrize("value", ["0.5", "0", "-1", "soon"])
+def test_timeout_below_one_second_is_a_usage_error(value):
+    result = _invoke(["a.wav", "--timeout", value])
+    assert result.exit_code == 2
+    assert "--timeout" in result.output
+
+
+@pytest.mark.parametrize("args", [["--mic"], ["-"]])
+def test_timeout_with_a_live_source_is_a_usage_error(args):
+    mic, stdin = Mock(), Mock()
+    result = _invoke([*args, "--timeout", "30"], mic=mic, stdin=stdin)
+    assert result.exit_code == 2
+    assert "--timeout applies only to a file or URL source" in result.output
+    mic.assert_not_called()
+    stdin.assert_not_called()
+
+
+def test_prerecorded_passes_timeout_to_the_client():
+    client = Mock()
+    client.transcribe_file.return_value = {"results": {"channels": []}}
+    _prerecorded(client, timeout_s=42.0)
+    assert client.transcribe_file.call_args.kwargs == {
+        "timeout_s": 42.0,
+        "file_id": None,
+    }
+
+
+def test_help_shows_timeout():
+    result = _invoke(["--help"])
+    assert "--timeout" in result.output
+    # The approved text, whatever the wrap width.
+    assert (
+        "Seconds to wait at each step (connecting, sending, the response) "
+        "before giving up. Not a limit on the whole run. Default: 300. "
+        "Files and URLs only."
+    ) in " ".join(result.output.split())
+
+
+# ── URL sources ──────────────────────────────────────────────────────
+
+SIGNED = "https://bucket.example/call.wav?X-Amz-Signature=URLSENTINELTOKEN"
+
+
+@pytest.mark.parametrize(("check_url", "probed"), [(False, False), (True, True)])
+def test_url_is_checked_by_format_unless_check_url(check_url, probed):
+    client = Mock()
+    client.transcribe_url.return_value = {"results": {"channels": []}}
+    with patch(
+        "deepctl_shared_utils.validation.url_problem", return_value=(None, [])
+    ) as validate:
+        _prerecorded(
+            client, SIGNED, is_url=True, no_validate=False, check_url=check_url
+        )
+    validate.assert_called_once_with(SIGNED, check_accessibility=probed)
+    # The API still gets the whole URL, token included.
+    assert client.transcribe_url.call_args.args[0] == SIGNED
+
+
+def test_no_validate_skips_both_checks():
+    client = Mock()
+    client.transcribe_url.return_value = {"results": {"channels": []}}
+    with patch("deepctl_shared_utils.validation.url_problem") as validate:
+        _prerecorded(client, SIGNED, is_url=True, no_validate=True, check_url=True)
+    validate.assert_not_called()
+
+
+def test_url_query_never_reaches_stderr_or_the_result(capsys):
+    client = Mock()
+    client.transcribe_url.return_value = {"results": {"channels": []}}
+    result = _prerecorded(client, SIGNED, is_url=True, no_validate=False)
+    err = capsys.readouterr().err
+    assert "Transcribing https://bucket.example/call.wav" in err
+    assert "URLSENTINELTOKEN" not in err
+    assert result.source_path == "https://bucket.example/call.wav"
+    assert "URLSENTINELTOKEN" not in result.model_dump_json()
+
+
+def _unreachable(monkeypatch):
+    """--check-url's request fails to connect; nothing leaves the test."""
+    import httpx
+
+    def refuse(self, method, url, **kwargs):
+        raise httpx.ConnectError("connection refused")
+
+    monkeypatch.setattr(httpx.Client, "request", refuse)
+    monkeypatch.setattr(httpx.Client, "send", refuse)
+
+
+@pytest.mark.parametrize(
+    ("url", "check_url", "message"),
+    [
+        (
+            SIGNED.replace("https:", "ftp:"),
+            False,
+            "URLs must start with http:// or https://: ftp://bucket.example/call.wav",
+        ),
+        (
+            SIGNED,
+            True,
+            "--check-url couldn't reach https://bucket.example/call.wav "
+            "(connection refused)",
+        ),
+    ],
+)
+def test_failed_url_check_message_drops_the_query(
+    url, check_url, message, monkeypatch, capsys
+):
+    _unreachable(monkeypatch)
+    result = _prerecorded(
+        Mock(), url, is_url=True, no_validate=False, check_url=check_url
+    )
+    assert result.status == "error"
+    assert result.message == message
+    # One report of the failure: the result, nothing extra on stderr.
+    out = capsys.readouterr()
+    assert "reach" not in out.err and "http://" not in out.err
+    assert "URLSENTINELTOKEN" not in out.err + out.out
+
+
+@pytest.mark.parametrize(("args", "expected"), [([], False), (["--check-url"], True)])
+def test_check_url_flag_reaches_prerecorded(args, expected):
+    done = ListenResult(status="success", source="url", mode="prerecorded")
+    prerecorded = Mock(return_value=done)
+    result = _invoke([SIGNED, *args], prerecorded)
+    assert result.exit_code == 0, result.output
+    assert prerecorded.call_args.kwargs["check_url"] is expected
+
+
+def test_help_shows_check_url():
+    output = _invoke(["--help"]).output
+    assert "--check-url" in output
+    # The approved text, whatever the wrap width.
+    assert (
+        "Check that the URL responds before transcribing: a HEAD request, "
+        "then a 1-byte GET if needed. Sends no Deepgram API key."
+    ) in " ".join(output.split())
+
+
+# ── Scheme case, URL-looking paths, and --check-url ──
+
+UPPER = "HTTPS://u:URLPASS@bucket.example/call.wav?X-Amz-Signature=URLSENTINELTOKEN"
+
+
+@pytest.mark.parametrize("url", [UPPER, "Http://h.example/a.wav", "hTtPs://h/a"])
+def test_scheme_is_case_insensitive(url):
+    from deepctl_cmd_listen.command import _is_url
+
+    assert _is_url(url)
+
+
+def test_uppercase_scheme_routes_to_the_url_path():
+    done = ListenResult(status="success", source="url", mode="prerecorded")
+    prerecorded = Mock(return_value=done)
+    result = _invoke([UPPER], prerecorded)
+    assert result.exit_code == 0, result.output
+    assert prerecorded.call_args.kwargs["is_url"] is True
+
+
+def test_uppercase_url_never_shows_the_token(capsys):
+    client = Mock()
+    client.transcribe_url.return_value = {"results": {"channels": []}}
+    result = _prerecorded(client, UPPER, is_url=True, no_validate=False)
+    err = capsys.readouterr().err
+    assert "URLSENTINELTOKEN" not in err and "URLPASS" not in err
+    assert result.source_path == "https://bucket.example/call.wav"
+
+
+URL_AS_PATH = "ftp://u:URLPASS@h.example/a.wav?X-Amz-Signature=URLSENTINELTOKEN"
+
+
+def test_url_looking_path_not_found_hides_the_token(capsys):
+    result = _prerecorded(Mock(), URL_AS_PATH, no_validate=False)
+    assert result.status == "error"
+    assert result.message == "File not found: ftp://h.example/a.wav"
+    assert "URLSENTINELTOKEN" not in capsys.readouterr().err
+
+
+def test_url_looking_path_not_found_without_validation_hides_the_token(capsys):
+    from deepctl_core.client import DeepgramClient
+
+    client = Mock(spec=DeepgramClient)
+    client.transcribe_file.side_effect = lambda path, options, **kw: (
+        DeepgramClient.transcribe_file(client, path, options, **kw)
+    )
+    with pytest.raises(click.ClickException) as err:
+        _prerecorded(client, URL_AS_PATH, no_validate=True)
+    assert err.value.message == (
+        "File not found: ftp://h.example/a.wav"
+    )
+    assert "URLSENTINELTOKEN" not in capsys.readouterr().err
+
+
+@pytest.mark.parametrize(
+    ("args", "message"),
+    [
+        (["a.wav", "--check-url"], "--check-url works only with a URL source."),
+        (
+            [SIGNED, "--check-url", "--no-validate"],
+            "--check-url can't be used with --no-validate.",
+        ),
+        (
+            ["a.wav", "--check-url", "--no-validate"],
+            "--check-url works only with a URL source.",
+        ),
+        (["--mic", "--check-url"], "--check-url works only with a URL source."),
+        (["-", "--check-url"], "--check-url works only with a URL source."),
+    ],
+)
+def test_check_url_without_a_checked_url_is_a_usage_error(args, message):
+    prerecorded, mic, stdin = Mock(), Mock(), Mock()
+    result = _invoke(args, prerecorded, mic=mic, stdin=stdin)
+    assert result.exit_code == 2
+    assert message in result.output
+    prerecorded.assert_not_called()
+    mic.assert_not_called()
+    stdin.assert_not_called()
+    assert "URLSENTINELTOKEN" not in result.output
+
+
+# ── A token in the URL path ──
+
+DEEP = (
+    "https://u:URLPASS@cdn.example/s/URLPATHTOKEN/calls/call.wav?sig=URLSENTINELTOKEN"
+)
+
+
+def test_deep_url_path_is_cut_in_status_lines_but_kept_in_the_result(capsys):
+    client = Mock()
+    client.transcribe_url.return_value = {"results": {"channels": []}}
+    result = _prerecorded(client, DEEP, is_url=True, no_validate=False)
+    err = capsys.readouterr().err
+    assert "Transcribing https://cdn.example/…/call.wav" in err
+    assert "URLPATHTOKEN" not in err and "URLSENTINELTOKEN" not in err
+    assert "URLPASS" not in err
+    # Machine output keeps the path, never the user info or query string.
+    assert result.source_path == "https://cdn.example/s/URLPATHTOKEN/calls/call.wav"
+    assert "URLSENTINELTOKEN" not in result.model_dump_json()
+    # The request to Deepgram still gets the full URL.
+    assert client.transcribe_url.call_args.args[0] == DEEP
+
+
+@pytest.mark.parametrize("check_url", [False, True])
+def test_deep_url_error_text_shows_only_the_last_segment(check_url, monkeypatch):
+    _unreachable(monkeypatch)
+    url = DEEP if check_url else DEEP.replace("https:", "ftp:")
+    result = _prerecorded(
+        Mock(), url, is_url=True, no_validate=False, check_url=check_url
+    )
+    assert "://cdn.example/…/call.wav" in result.message
+    assert "URLPATHTOKEN" not in result.message
+
+
+def test_deep_url_table_shows_only_the_last_segment(capsys):
+    result = ListenResult(
+        status="success",
+        source="url",
+        source_path="https://cdn.example/s/URLPATHTOKEN/calls/call.wav",
+        mode="prerecorded",
+        model="nova-3",
+    )
+    ListenCommand()._print_prerecorded_result(result)
+    out = capsys.readouterr().out
+    assert "https://cdn.example/…/call.wav" in out
+    assert "URLPATHTOKEN" not in out
+
+
+# ── User info that urlparse can't see ──
+
+MALFORMED = [
+    "https://u:pa#URLPW@cdn.example/a.wav",
+    "https://u:pa?URLPW@cdn.example/a.wav",
+    "https://u:pa/URLPW@cdn.example/a/b.wav",
+    "https:///URLPW@cdn.example/y/a.wav",
+    "https://u/URLPW@cdn.example/a.wav",
+]
+
+
+@pytest.mark.parametrize("url", MALFORMED)
+@pytest.mark.parametrize("check_url", [False, True])
+def test_malformed_user_info_never_reaches_messages(url, check_url, capsys):
+    client = Mock()
+    client.transcribe_url.return_value = {"results": {"channels": []}}
+    # No request leaves the test: the HEAD check itself reports failure.
+    with patch(
+        "deepctl_shared_utils.validation._url_reach_problem",
+        return_value=("--check-url couldn't reach https://<redacted>/… (HTTP 404)", []),
+    ):
+        result = _prerecorded(
+            client, url, is_url=True, no_validate=False, check_url=check_url
+        )
+    err = capsys.readouterr().err
+    assert "URLPW" not in err and "u:pa" not in err
+    if result.status == "error":
+        assert result.message in (
+            "Not a valid URL: https://<redacted>/…",
+            "--check-url couldn't reach https://<redacted>/… (HTTP 404)",
+        )
+        assert "Error" not in err  # reported once, by the result
+    else:
+        assert result.source_path == "https://<redacted>/…"
+        assert "URLPW" not in result.model_dump_json()
+        # The request to Deepgram still gets the full URL.
+        assert client.transcribe_url.call_args.args[0] == url
+
+
+@pytest.mark.parametrize("url", MALFORMED)
+def test_malformed_user_info_without_validation(url, capsys):
+    client = Mock()
+    client.transcribe_url.return_value = {"results": {"channels": []}}
+    result = _prerecorded(client, url, is_url=True, no_validate=True)
+    assert "URLPW" not in capsys.readouterr().err
+    assert result.source_path == "https://<redacted>/…"
+    assert client.transcribe_url.call_args.args[0] == url
+
+
+def test_transcription_error_text_drops_user_info(capsys):
+    url = "https://u:URLPW@cdn.example/a.wav?sig=URLSENTINELTOKEN"
+    client = Mock()
+    client.transcribe_url.side_effect = RuntimeError(f"rejected {url}")
+    with pytest.raises(click.ClickException) as err:
+        _prerecorded(client, url, is_url=True, no_validate=True)
+    assert "URLPW" not in err.value.message
+    assert "URLSENTINELTOKEN" not in err.value.message
diff --git a/packages/deepctl-cmd-login/src/deepctl_cmd_login/command.py b/packages/deepctl-cmd-login/src/deepctl_cmd_login/command.py
index bf6d937f..32a369e5 100644
--- a/packages/deepctl-cmd-login/src/deepctl_cmd_login/command.py
+++ b/packages/deepctl-cmd-login/src/deepctl_cmd_login/command.py
@@ -1,7 +1,16 @@
 """Login command for deepctl."""
 
+import dataclasses
+import os
+import shlex
+import shutil
 import sys
-from typing import Any
+import time
+from collections.abc import Iterator
+from contextlib import contextmanager
+from pathlib import Path
+from typing import TYPE_CHECKING, Any, TextIO
+from urllib.parse import urlsplit
 
 import click
 from deepctl_core import (
@@ -19,6 +28,8 @@
     is_ai_agent,
 )
 from deepctl_core import messages as msg
+from deepctl_core.auth import DeviceCodeUnreadable
+from deepctl_core.config import ConfigSaveRefused
 from deepctl_core.hosts import (
     SOURCE_ENV,
     SOURCE_FLAG,
@@ -33,21 +44,49 @@
     report,
     user_config_display,
 )
+from deepctl_core.login_state import (
+    MIN_POLL_INTERVAL,
+    LoadedPending,
+    PendingLogin,
+    load_pending,
+    remove_pending,
+    save_pending,
+    state_dir,
+    unwritable_dir,
+)
 from deepctl_core.output import (
     _output_config,
     print_error,
     print_error_hint,
     print_hint,
     print_info,
+    print_security_warning,
     print_warning,
+    stderr_console,
 )
 from rich.console import Console
 from rich.markup import escape
 from rich.prompt import Prompt
 
-from .models import LoginResult, LogoutResult, WhoamiResult
+if TYPE_CHECKING:
+    from deepctl_core.auth import DeviceCodeResponse
+
+from .models import (
+    LoginCodedError,
+    LoginPendingResult,
+    LoginResult,
+    LogoutResult,
+    WhoamiResult,
+)
 
 console = Console()
+# Status chrome of the login flows: stderr, never the payload's stdout.
+status = stderr_console
+
+_PROG_NAMES = ("dg", "deepgram", "deepctl")
+_YES_FLAG = "--yes"
+# Options whose value is a key.
+_SECRET_OPTIONS = ("--api-key", "-k")
 
 
 def _interactive_terminal() -> bool:
@@ -55,6 +94,258 @@ def _interactive_terminal() -> bool:
     return sys.stdin.isatty() and sys.stderr.isatty()
 
 
+def _prog() -> str | None:
+    """``{prog}``: the running executable, as a command.
+
+    The bare name when ``which(name)`` is this same file; else the console
+    script's absolute path, quoted. ``None`` when neither applies (``python
+    -m``, an unknown launcher), which makes ``next_step`` null.
+    """
+    argv0 = sys.argv[0] if sys.argv else ""
+    name = os.path.basename(argv0)
+    if os.name == "nt" and name.lower().endswith(".exe"):
+        name = name[:-4]
+    if name not in _PROG_NAMES:
+        return None
+    found = shutil.which(name)
+    running = shutil.which(argv0) or argv0
+    try:
+        if found and os.path.samefile(found, running):
+            return name
+    except OSError:
+        pass
+    if not os.path.isfile(running):
+        return None
+    path = os.path.abspath(running)
+    if os.name == "nt":
+        return None if shlex.quote(path) != path else path
+    return shlex.quote(path)
+
+
+def _secret_in(argv: list[str]) -> bool:
+    """True when ``argv`` holds a key or a URL with userinfo or a query."""
+    after_option = False
+    for token in argv:
+        if after_option:
+            return True
+        if token in _SECRET_OPTIONS:
+            after_option = True
+            continue
+        if token.startswith("--api-key=") or (
+            token.startswith("-k") and not token.startswith("--") and len(token) > 2
+        ):
+            return True
+        if "://" in token:
+            try:
+                parts = urlsplit(token)
+            except ValueError:
+                return True
+            if "@" in parts.netloc or parts.query:
+                return True
+    return False
+
+
+def _rerun_with_yes(prog: str | None) -> str | None:
+    """``{prog} {argv} --yes`` as a runnable command, or None."""
+    argv = sys.argv[1:]
+    if prog is None or _secret_in(argv):
+        return None
+    tokens = [*argv, _YES_FLAG]
+    if any(token.startswith("=") for token in tokens):
+        return None  # zsh's EQUALS option would expand it
+    if os.name == "nt" and any(shlex.quote(token) != token for token in tokens):
+        return None
+    step = f"{prog} {shlex.join(tokens)}"
+    return step if shlex.join(shlex.split(step)) == step else None
+
+
+def _hard_signal() -> bool:
+    """An AI agent marked the environment, or ``DG_AGENT=1`` says one runs dg."""
+    return is_ai_agent() or os.environ.get("DG_AGENT") == "1"
+
+
+def _hint_for(
+    human: str,
+    agent: str,
+    next_step: str | None,
+    *,
+    agent_null: str | None = None,
+    automation_null: str | None = None,
+) -> str:
+    """The hint for this run's mode, null-aware."""
+    if _hard_signal():
+        return agent_null if next_step is None and agent_null else agent
+    if _output_config["agentic"]:
+        if next_step is None:
+            return automation_null or agent_null or agent
+        return agent
+    return human
+
+
+def _coded_error(
+    error: str,
+    code: str,
+    hint: str,
+    next_step: str | None,
+    details: dict[str, Any] | None = None,
+) -> LoginCodedError:
+    """Report a coded error on stderr and return its payload."""
+    print_error(escape(error))
+    print_hint(escape(hint))
+    return LoginCodedError(
+        error=error, code=code, hint=hint, next_step=next_step, details=details
+    )
+
+
+# Mode A stderr grammar: every line a caller reads starts with
+# one of these. Anything else a login flow prints is status chrome.
+_MODE_A_PREFIXES = (
+    "ERROR: ",
+    "WARN: ",
+    "INFO: ",
+    "HINT: ",
+    "OK: ",
+    "DEPRECATED: ",
+)
+
+
+class _ModeAStderr:
+    """``sys.stderr`` in mode A: each write that starts a line is kept or
+    dropped as a whole. With ``verbose``, chrome is kept as ``INFO:`` lines
+    instead of dropped."""
+
+    def __init__(self, stream: TextIO, verbose: bool = False) -> None:
+        self._stream = stream
+        self._verbose = verbose
+        self._keep = True
+        self._line_start = True
+
+    def write(self, text: str) -> int:
+        if not text:
+            return 0
+        if self._line_start:
+            first = text.lstrip("\n").split("\n", 1)[0]
+            prefixed = first.startswith(_MODE_A_PREFIXES)
+            self._keep = bool(first.strip()) and (prefixed or self._verbose)
+            if self._keep and not prefixed:
+                lines = [line for line in text.strip("\n").split("\n") if line.strip()]
+                text = "".join(f"INFO: {line.strip()}\n" for line in lines)
+        if self._keep:
+            self._stream.write(text)
+        self._line_start = text.endswith("\n")
+        return len(text)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._stream, name)
+
+
+@contextmanager
+def _without_chrome() -> Iterator[None]:
+    """In mode A, drop status chrome from stderr (``INFO:`` lines with
+    --verbose)."""
+    if not _output_config["agentic"]:
+        yield
+        return
+    real = sys.stderr
+    sys.stderr = _ModeAStderr(real, verbose=bool(_output_config["verbose"]))
+    try:
+        yield
+    finally:
+        sys.stderr = real
+
+
+def _shown_prog(prog: str | None) -> str:
+    return prog or _PROG_NAMES[0]
+
+
+def _state_unwritable(directory: Path) -> LoginCodedError:
+    shown = _shown_prog(_prog())
+    return _coded_error(
+        msg.E_STATE_UNWRITABLE.format(prog=shown, dir=msg.display_path(directory)),
+        msg.CODE_STATE_UNWRITABLE,
+        _hint_for(
+            msg.H_STATE_UNWRITABLE.format(prog=shown),
+            msg.A_STATE_UNWRITABLE.format(prog=shown),
+            None,
+        ),
+        None,
+        {"dir": str(directory)},
+    )
+
+
+def _preflight(config: Config) -> Any | None:
+    """Stop before any request when the login couldn't be saved.
+
+    In order: the state or credential directory isn't writable
+    (``E-STATE-UNWRITABLE``); then, in an AI agent session, the user config
+    is one dg won't save over (``E-CFG-SAVE-UNTRUSTED``). Both
+    come before the confirmations, so an agent is never told to pass --yes
+    for a save that would fail.
+    """
+    config_path = Path(config.config_path)
+    for directory, file in (
+        (state_dir(), None),
+        (config_path.parent, config_path),
+    ):
+        bad = unwritable_dir(directory, file)
+        if bad is not None:
+            return _state_unwritable(bad)
+    try:
+        config.check_saveable()
+    except ConfigSaveRefused as e:
+        shown = _shown_prog(_prog())
+        return _coded_error(
+            msg.E_CFG_SAVE_UNTRUSTED.format(
+                prog=shown,
+                path=msg.display_path(config_path),
+                why=msg.W_CFG_UNTRUSTED_WHY[e.why],
+            ),
+            msg.CODE_STATE_UNWRITABLE,
+            msg.W_CFG_UNTRUSTED_FILE_HINT,
+            None,
+            {"reason": "untrusted_config", "path": str(config_path)},
+        )
+    except OSError as e:
+        # A save that can't happen for another reason (not a regular file,
+        # content that wouldn't load back): stop before sending anything.
+        print_error(escape(f"Login failed: {e}"))
+        print_error_hint(e)
+        return LoginResult(
+            status="error",
+            message=str(e),
+            profile=config.profile or "default",
+            api_key_masked=None,
+        )
+    return None
+
+
+def _device_code_unreadable(host: str) -> LoginCodedError:
+    """The identity provider's device-code answer couldn't be read."""
+    shown = _shown_prog(_prog())
+    values = {"host": msg.display(host), "prog": shown}
+    return _coded_error(
+        msg.E_NETWORK_UNREADABLE.format(**values),
+        msg.CODE_NETWORK_UNAVAILABLE,
+        _hint_for(
+            msg.H_NETWORK_UNREADABLE.format(**values),
+            msg.A_NETWORK_UNREADABLE,
+            None,
+        ),
+        None,
+        {"host": msg.display(host), "reason": "unreadable response"},
+    )
+
+
+def _confirmation_required(error: str, next_step: str | None, hint: str) -> Any:
+    return _coded_error(
+        error,
+        msg.CODE_CONFIRMATION_REQUIRED,
+        hint,
+        next_step,
+        {"flag": _YES_FLAG},
+    )
+
+
 class LoginCommand(BaseCommand):
     """Login command for authenticating with Deepgram."""
 
@@ -73,16 +364,18 @@ class LoginCommand(BaseCommand):
 
     examples = [
         "dg login",
+        "dg login --no-browser",
+        "dg login --complete",
         "dg login --api-key YOUR_API_KEY",
         "dg login --api-key YOUR_KEY --project-id YOUR_PROJECT",
         "dg login --profile staging --api-key YOUR_KEY",
         "dg --base-url https://api.eu.deepgram.com login --save-base-url",
     ]
     agent_help = (
-        "Authenticate with Deepgram. Can accept an API key directly via "
-        "--api-key flag, or prompt interactively. Credentials are stored "
-        "securely in the system keyring. Supports named profiles for "
-        "managing multiple environments."
+        "Log in to Deepgram. In an AI agent session, dg login prints a link "
+        "and code and exits: give both to the user, then run dg login "
+        "--complete (add --wait to keep checking). Never put an API key on "
+        "the command line. Profiles keep separate API keys and project IDs."
     )
 
     def get_arguments(self) -> list[dict[str, Any]]:
@@ -102,9 +395,18 @@ def get_arguments(self) -> list[dict[str, Any]]:
                 "required": False,
                 "is_option": True,
             },
+            {
+                "names": ["--yes", "-y"],
+                "help": (
+                    "Save without asking, even if DEEPGRAM_API_KEY is set or the "
+                    "profile already has a saved login (--save-base-url still asks)"
+                ),
+                "is_flag": True,
+                "is_option": True,
+            },
             {
                 "names": ["--force-write", "-f"],
-                "help": ("Don't prompt for confirmation when providing credentials"),
+                "help": "Same as --yes",
                 "is_flag": True,
                 "is_option": True,
             },
@@ -115,6 +417,35 @@ def get_arguments(self) -> list[dict[str, Any]]:
                 "required": False,
                 "is_option": True,
             },
+            {
+                "names": ["--no-browser"],
+                "help": (
+                    "Print the login link and code instead of opening a browser, "
+                    "then exit; finish with --complete, or add --wait to wait here"
+                ),
+                "is_flag": True,
+                "is_option": True,
+            },
+            {
+                "names": ["--complete"],
+                "help": (
+                    "Finish a pending browser login: check once whether it was "
+                    "approved, and save the key if it was (add --wait to keep "
+                    "checking)"
+                ),
+                "is_flag": True,
+                "is_option": True,
+            },
+            {
+                "names": ["--wait"],
+                "help": (
+                    "Wait until the browser login is approved (the default in a "
+                    "terminal), instead of exiting with the link and code; with "
+                    "--complete, keep checking"
+                ),
+                "is_flag": True,
+                "is_option": True,
+            },
             {
                 "names": ["--save-base-url"],
                 "help": (
@@ -134,11 +465,18 @@ def handle(
         **kwargs: Any,
     ) -> Any:
         """Handle login command."""
+        with _without_chrome():
+            return self._login(config, auth_manager, **kwargs)
+
+    def _login(self, config: Config, auth_manager: AuthManager, **kwargs: Any) -> Any:
         api_key = kwargs.get("api_key")
         project_id = kwargs.get("project_id")
-        force_write = kwargs.get("force_write", False)
+        force_write = bool(kwargs.get("yes") or kwargs.get("force_write"))
         profile = kwargs.get("profile")
         save_base_url = kwargs.get("save_base_url", False)
+        complete = bool(kwargs.get("complete"))
+        wait = bool(kwargs.get("wait"))
+        no_browser = bool(kwargs.get("no_browser"))
 
         # Set profile if provided
         if profile:
@@ -146,6 +484,18 @@ def handle(
 
         current_profile = config.profile or "default"
 
+        if complete:
+            if api_key:
+                raise click.UsageError("--complete can't be used with --api-key.")
+            if save_base_url:
+                raise click.UsageError("--complete can't be used with --save-base-url.")
+            return self._complete(config, auth_manager, wait=wait)
+
+        # Nothing is asked or sent when the login couldn't be saved.
+        stop = _preflight(config)
+        if stop is not None:
+            return stop
+
         # Decide where the key may go before doing anything else. A base URL
         # from --base-url or DEEPGRAM_BASE_URL is used for this login only;
         # --save-base-url, confirmed by a person, is the one way to save it.
@@ -170,21 +520,38 @@ def handle(
         has_env_key, has_env_project = auth_manager.has_env_credentials()
 
         if has_env_key and not force_write:
-            console.print(
+            if not self._can_ask():
+                # Nobody can answer: say which flag does.
+                prog = _prog()
+                next_step = None if api_key else _rerun_with_yes(prog)
+                return _confirmation_required(
+                    msg.E_CONFIRM_ENVKEY.format(prog=prog or _PROG_NAMES[0]),
+                    next_step,
+                    _hint_for(
+                        msg.H_CONFIRM_YES,
+                        msg.A_CONFIRM_ENVKEY,
+                        next_step,
+                        agent_null=msg.A_CONFIRM_ENVKEY_NULL.format(
+                            prog=prog or _PROG_NAMES[0]
+                        ),
+                        automation_null=msg.C_CONFIRM_ENVKEY_NULL,
+                    ),
+                )
+            status.print(
                 "[yellow]Environment variable DEEPGRAM_API_KEY is set.[/yellow]"
             )
             if has_env_project:
-                console.print(
+                status.print(
                     "[yellow]Environment variable DEEPGRAM_PROJECT_ID is also set.[/yellow]\n"
                     "[green]Commands will work using these environment variables.[/green]"
                 )
             else:
-                console.print(
+                status.print(
                     "[yellow]Note: DEEPGRAM_PROJECT_ID is not set. "
                     "You'll need to set it or provide it via --project-id flag.[/yellow]"
                 )
 
-            console.print(
+            status.print(
                 "\n[dim]Logging in will create a profile that takes precedence "
                 "over environment variables.[/dim]"
             )
@@ -205,7 +572,20 @@ def handle(
         )
 
         if has_profile_key and not force_write:
-            console.print(
+            if not self._can_ask():
+                next_step = _rerun_with_yes(_prog())
+                return _confirmation_required(
+                    msg.E_CONFIRM_RELOGIN.format(profile=msg.display(current_profile)),
+                    next_step,
+                    _hint_for(
+                        msg.H_CONFIRM_YES,
+                        msg.A_CONFIRM_YES,
+                        next_step,
+                        agent_null=msg.A_CONFIRM_YES_NULL,
+                        automation_null=msg.C_CONFIRM_YES_NULL,
+                    ),
+                )
+            status.print(
                 f"[yellow]Already logged in to profile:[/yellow] {current_profile}"
             )
 
@@ -242,7 +622,9 @@ def handle(
                 config, auth_manager, str(api_key), project_id, force_write
             )
         else:
-            result = self._web_auth(config, auth_manager, force_write)
+            result = self._web_auth(
+                config, auth_manager, wait=wait, no_browser=no_browser
+            )
 
         if result.status == "success":
             self._report_base_url(config, current_profile)
@@ -253,6 +635,20 @@ def handle(
 
         return result
 
+    def _pending_mode(self, *, wait: bool, no_browser: bool) -> bool:
+        """Return the link and code at once instead of waiting:
+        under a hard agent signal, with --no-browser, or when neither stdin
+        nor stdout is a terminal. --wait always waits."""
+        if wait:
+            return False
+        if no_browser or _hard_signal():
+            return True
+        return not sys.stdin.isatty() and not sys.stdout.isatty()
+
+    def _can_ask(self) -> bool:
+        """A person can answer login's confirmations here."""
+        return self.can_prompt() and _interactive_terminal() and not is_ai_agent()
+
     def _confirm_save_base_url(self, config: Config, profile: str) -> Any | None:
         """Ask a person to approve saving the base URL.
 
@@ -488,29 +884,19 @@ def _cli_auth(
         force_write: bool,
     ) -> LoginResult:
         """Handle CLI authentication with API key."""
-        console.print("[blue]Configuring CLI with API key...[/blue]")
+        status.print("[blue]Configuring CLI with API key...[/blue]")
 
-        # Validate API key format
-        if not api_key.startswith(("sk-", "pk-")):
-            console.print(
-                "[yellow]Warning:[/yellow] API key format doesn't match "
-                "expected pattern"
-            )
-            if not force_write and not self.confirm("Continue anyway?", default=False):
-                return LoginResult(
-                    status="cancelled",
-                    message="Login cancelled by user",
-                    profile=config.profile or "default",
-                    api_key_masked=None,
-                )
+        # The key's format isn't checked: Deepgram keys have no fixed prefix,
+        # and login_with_api_key verifies the key with the API.
 
         # Validate project ID is provided with API key
         if not project_id:
-            console.print("[yellow]Warning:[/yellow] Project ID not provided")
-            console.print(
-                "You can set it later with: deepctl login --project-id <project_id>"
+            status.print("[yellow]Warning:[/yellow] Project ID not provided")
+            status.print(
+                "You can set it later with: "
+                f"{_shown_prog(_prog())} login --project-id <project_id>"
             )
-            console.print("Or use environment variable: DEEPGRAM_PROJECT_ID")
+            status.print("Or use environment variable: DEEPGRAM_PROJECT_ID")
 
         # No need to check for existing config - we handle that in the main flow
 
@@ -535,7 +921,7 @@ def _cli_auth(
             )
 
         except AuthenticationError as e:
-            console.print(f"[red]Login failed:[/red] {e}")
+            print_error(escape(f"Login failed: {e}"))
             return LoginResult(
                 status="error",
                 message=str(e),
@@ -544,7 +930,7 @@ def _cli_auth(
             )
 
         except Exception as e:
-            console.print(f"[red]Error:[/red] {e}")
+            print_error(escape(f"Login failed: {e}"))
             print_error_hint(e)
             return LoginResult(
                 status="error",
@@ -554,23 +940,38 @@ def _cli_auth(
             )
 
     def _web_auth(
-        self, config: Config, auth_manager: AuthManager, force_write: bool
-    ) -> LoginResult | CodedErrorResult:
+        self,
+        config: Config,
+        auth_manager: AuthManager,
+        *,
+        wait: bool = False,
+        no_browser: bool = False,
+    ) -> Any:
         """Handle web authentication with device flow."""
         # The identity host mints the key: check it before anything else, and
         # keep a refusal off stdout apart from the structured result.
         try:
-            check_identity_host(config)
+            identity_url = check_identity_host(config)
         except CredentialHostError as e:
             return CodedErrorResult(error=e.error, code=e.code, hint=e.hint)
 
-        console.print("[blue]Starting web authentication...[/blue]")
+        if self._pending_mode(wait=wait, no_browser=no_browser):
+            return self._start_pending(config, auth_manager, identity_url)
 
-        # No need to check for existing config - we handle that in the main flow
+        status.print("[blue]Starting web authentication...[/blue]")
 
         try:
-            # Start device flow
-            auth_manager.login_with_device_flow()
+            open_browser = not (no_browser or _hard_signal())
+            if _output_config["agentic"]:
+                # Mode A: the link and code as an INFO line; chrome is dropped.
+                device = auth_manager._request_device_code(identity_url)
+                self._announce(device)
+                if open_browser:
+                    _open_browser(device)
+                token = auth_manager._poll_for_token(device, identity_url)
+                auth_manager._store_token(token)
+            else:
+                auth_manager.login_with_device_flow(open_browser=open_browser)
 
             profile_name = config.profile or "default"
 
@@ -596,8 +997,11 @@ def _web_auth(
                 config_path=str(config.config_path),
             )
 
+        except DeviceCodeUnreadable as e:
+            return _device_code_unreadable(e.host)
+
         except AuthenticationError as e:
-            console.print(f"[red]Authentication failed:[/red] {e}")
+            print_error(escape(f"Login failed: {e}"))
             return LoginResult(
                 status="error",
                 message=str(e),
@@ -606,7 +1010,7 @@ def _web_auth(
             )
 
         except KeyboardInterrupt:
-            console.print("\n[yellow]Authentication cancelled by user[/yellow]")
+            status.print("\n[yellow]Authentication cancelled by user[/yellow]")
             return LoginResult(
                 status="cancelled",
                 message="Login cancelled by user",
@@ -615,7 +1019,7 @@ def _web_auth(
             )
 
         except Exception as e:
-            console.print(f"[red]Error during web authentication:[/red] {e}")
+            print_error(escape(f"Error during web authentication: {e}"))
             print_error_hint(e)
             return LoginResult(
                 status="error",
@@ -624,6 +1028,274 @@ def _web_auth(
                 api_key_masked=None,
             )
 
+    def _announce(self, device: "DeviceCodeResponse") -> None:
+        """Print the link and code as an INFO line (stderr)."""
+        print_info(
+            escape(
+                msg.I_LOGIN_PENDING.format(
+                    verification_uri=msg.display(device.verification_uri),
+                    user_code=msg.display(device.user_code or ""),
+                )
+            ),
+            stderr=True,
+        )
+
+    def _start_pending(
+        self, config: Config, auth_manager: AuthManager, identity_url: str
+    ) -> Any:
+        """Get a device code, save it for --complete, and return the link and
+        code at once (exit 0; OQ-16)."""
+        profile_name = config.profile or "default"
+        try:
+            device = auth_manager._request_device_code(identity_url)
+            if not device.user_code:
+                raise AuthenticationError(
+                    "the login service didn't return a code. Try again in a moment."
+                )
+        except DeviceCodeUnreadable as e:
+            return _device_code_unreadable(e.host)
+        except AuthenticationError as e:
+            print_error(escape(f"Login failed: {e}"))
+            return LoginResult(
+                status="error",
+                message=str(e),
+                profile=profile_name,
+                api_key_masked=None,
+            )
+        pending = PendingLogin(
+            device_code=device.device_code,
+            user_code=device.user_code,
+            verification_uri=device.verification_uri,
+            interval=max(MIN_POLL_INTERVAL, device.interval),
+            expires_at=time.time() + device.expires_in,
+            host=identity_url,
+            profile=profile_name,
+        )
+        try:
+            save_pending(pending)
+        except OSError:
+            return _state_unwritable(state_dir())
+
+        prog = _prog()
+        shown = _shown_prog(prog)
+        next_step = f"{prog} login --complete" if prog else None
+        self._announce(device)
+        hint = (
+            msg.A_LOGIN_PENDING
+            if _hard_signal() or _output_config["agentic"]
+            else msg.H_LOGIN_PENDING
+        )
+        print_hint(escape(hint.format(prog=shown)))
+        return LoginPendingResult(
+            message=msg.M_LOGIN_PENDING,
+            verification_uri=device.verification_uri,
+            user_code=device.user_code,
+            expires_in=device.expires_in,
+            next_step=next_step,
+        )
+
+    def _complete(
+        self, config: Config, auth_manager: AuthManager, *, wait: bool
+    ) -> Any:
+        """``dg login --complete``: poll once (or, with --wait, until done)
+        for the saved device code, and save the key once it is approved."""
+        import httpx
+        from deepctl_core import transport
+
+        stop = _preflight(config)
+        if stop is not None:
+            return stop
+        prog = _prog()
+        shown = _shown_prog(prog)
+        loaded = load_pending(agent=is_ai_agent())
+        if loaded.ignored_why is not None:
+            print_security_warning(
+                escape(
+                    msg.W_LOGIN_PENDING_UNTRUSTED.format(
+                        path=msg.display_path(loaded.path),
+                        prog=shown,
+                        why=msg.W_CFG_UNTRUSTED_WHY[loaded.ignored_why],
+                    )
+                )
+            )
+        pending = loaded.pending
+        if pending is None:
+            return self._auth_expired(prog)
+        try:
+            identity_url = check_identity_host(config)
+        except CredentialHostError as e:
+            return CodedErrorResult(error=e.error, code=e.code, hint=e.hint)
+        if canonical_url(pending.host) != identity_url:
+            # Issued by another login host: never send its code elsewhere.
+            return self._auth_expired(prog)
+
+        explicit = getattr(config, "_explicit_profile", None)
+        if explicit and explicit != pending.profile:
+            # The pending login was confirmed for its own profile.
+            raise click.UsageError(
+                f'The pending login is for profile "{msg.display(pending.profile)}". '
+                "Run --complete without --profile, or start a new login for "
+                f'"{msg.display(explicit)}" with dg login --profile.'
+            )
+        config.profile = pending.profile
+        interval = pending.interval
+        while True:
+            if pending.expired():
+                remove_pending(loaded)
+                return self._auth_expired(prog)
+            try:
+                poll = auth_manager.poll_device_token(pending.device_code, identity_url)
+            except httpx.RequestError as e:
+                # The coded network error every other request gets.
+                mapped = transport.map_exception(e, (pending.device_code,))
+                if mapped is not None:
+                    raise mapped from e
+                text = f"Network error while completing the login: {e}"
+                print_error(escape(text))
+                return LoginResult(
+                    status="error",
+                    message=text,
+                    profile=pending.profile,
+                    api_key_masked=None,
+                )
+            if poll.state == "token" and poll.token is not None:
+                return self._finish(config, auth_manager, loaded, poll.token)
+            if poll.state == "unavailable" and not wait:
+                text = (
+                    f"Couldn't complete the login: {poll.detail}. "
+                    f"Run {shown} login to start again."
+                )
+                print_error(escape(text))
+                return LoginResult(
+                    status="error",
+                    message=text,
+                    profile=pending.profile,
+                    api_key_masked=None,
+                )
+            if poll.state in ("pending", "slow_down", "unavailable"):
+                if poll.state in ("slow_down", "unavailable"):
+                    interval = max(interval + 5, poll.retry_after or 0)
+                    pending = dataclasses.replace(pending, interval=interval)
+                    try:
+                        save_pending(pending)
+                        loaded = load_pending(agent=is_ai_agent())
+                    except OSError:
+                        pass  # the next --complete waits the old interval
+                if wait:
+                    time.sleep(
+                        max(0.0, min(interval, pending.expires_at - time.time()))
+                    )
+                    continue
+                return self._auth_pending(prog, pending)
+            if poll.state == "denied":
+                remove_pending(loaded)
+                return _coded_error(
+                    msg.E_AUTH_DENIED,
+                    msg.CODE_AUTH_DENIED,
+                    _hint_for(
+                        msg.H_AUTH_DENIED.format(prog=shown),
+                        msg.A_AUTH_DENIED,
+                        None,
+                    ),
+                    None,
+                )
+            if poll.state == "expired":
+                remove_pending(loaded)
+                return self._auth_expired(prog)
+            text = (
+                f"Couldn't complete the login: {poll.detail}. "
+                f"Run {shown} login to start again."
+            )
+            print_error(escape(text))
+            return LoginResult(
+                status="error",
+                message=text,
+                profile=pending.profile,
+                api_key_masked=None,
+            )
+
+    def _finish(
+        self,
+        config: Config,
+        auth_manager: AuthManager,
+        loaded: LoadedPending,
+        token: Any,
+    ) -> Any:
+        """Save the approved key (keyring only once the save can happen)."""
+        profile_name = config.profile or "default"
+        try:
+            auth_manager._store_token(token)
+            config._config.active_profile = profile_name
+            config.save()
+        except Exception as e:
+            print_error(escape(f"Login failed: {e}"))
+            print_error_hint(e)
+            return LoginResult(
+                status="error",
+                message=str(e),
+                profile=profile_name,
+                api_key_masked=None,
+            )
+        finally:
+            # The code is used up either way.
+            remove_pending(loaded)
+        key = token.dg_token or ""
+        return LoginResult(
+            status="success",
+            message="Successfully logged in via web authentication",
+            profile=profile_name,
+            api_key_masked=f"****{key[-4:]}" if key else None,
+            project_id=token.project_id or token.pid,
+            config_path=str(config.config_path),
+        )
+
+    def _auth_expired(self, prog: str | None) -> LoginCodedError:
+        shown = _shown_prog(prog)
+        return _coded_error(
+            msg.E_AUTH_EXPIRED,
+            msg.CODE_AUTH_EXPIRED,
+            _hint_for(
+                msg.H_AUTH_EXPIRED.format(prog=shown),
+                msg.A_AUTH_EXPIRED.format(prog=shown),
+                f"{prog} login" if prog else None,
+            ),
+            f"{prog} login" if prog else None,
+        )
+
+    def _auth_pending(self, prog: str | None, pending: PendingLogin) -> LoginCodedError:
+        shown = _shown_prog(prog)
+        values = {
+            "prog": shown,
+            "retry_after": pending.interval,
+            "verification_uri": msg.display(pending.verification_uri),
+            "user_code": msg.display(pending.user_code),
+        }
+        next_step = f"{prog} login --complete" if prog else None
+        return _coded_error(
+            msg.E_AUTH_PENDING,
+            msg.CODE_AUTH_PENDING,
+            _hint_for(
+                msg.H_AUTH_PENDING.format(**values),
+                msg.A_AUTH_PENDING.format(**values),
+                next_step,
+            ),
+            next_step,
+            {
+                "retry_after": pending.interval,
+                "verification_uri": pending.verification_uri,
+                "user_code": pending.user_code,
+            },
+        )
+
+
+def _open_browser(device: "DeviceCodeResponse") -> None:
+    import webbrowser
+
+    try:
+        webbrowser.open(device.verification_uri_complete or device.verification_uri)
+    except Exception as e:
+        print_warning(escape(f"Could not open a browser: {e}"), stderr=True)
+
 
 class LogoutCommand(BaseCommand):
     """Logout command for clearing authentication."""
diff --git a/packages/deepctl-cmd-login/src/deepctl_cmd_login/models.py b/packages/deepctl-cmd-login/src/deepctl_cmd_login/models.py
index 1363f330..1a7b4aeb 100644
--- a/packages/deepctl-cmd-login/src/deepctl_cmd_login/models.py
+++ b/packages/deepctl-cmd-login/src/deepctl_cmd_login/models.py
@@ -1,9 +1,31 @@
 """Models for login command."""
 
+from typing import Any
+
 from deepctl_core import BaseResult
+from deepctl_core.models import CodedErrorResult
 from pydantic import Field
 
 
+class LoginCodedError(CodedErrorResult):
+    """A 0.5.0 coded error from ``dg login``, keys in the catalogue's order.
+
+    ``next_step`` is always present (null when no command fixes it);
+    ``details`` is left out when there are none. The 0.4.1 coded
+    errors login also returns keep their keys.
+    """
+
+    next_step: str | None = None
+    schema_version: int = 1
+    details: dict[str, Any] | None = None
+
+    def model_dump(self, **kwargs: Any) -> dict[str, Any]:
+        data = super().model_dump(**kwargs)
+        if not data.get("details"):
+            data.pop("details", None)
+        return data
+
+
 class LoginResult(BaseResult):
     """Return structure for `deepctl login` command."""
 
@@ -15,6 +37,17 @@ class LoginResult(BaseResult):
     config_path: str | None = None
 
 
+class LoginPendingResult(BaseResult):
+    """``dg login`` handed the device login to a person; exit 0."""
+
+    status: str = "pending"
+    verification_uri: str
+    user_code: str
+    expires_in: int
+    next_step: str | None = None
+    schema_version: int = 1
+
+
 class LogoutResult(BaseResult):
     """Return structure for logout command."""
 
diff --git a/packages/deepctl-cmd-login/tests/unit/test_login_base_url.py b/packages/deepctl-cmd-login/tests/unit/test_login_base_url.py
index 175518c8..c8b9dcf7 100644
--- a/packages/deepctl-cmd-login/tests/unit/test_login_base_url.py
+++ b/packages/deepctl-cmd-login/tests/unit/test_login_base_url.py
@@ -68,6 +68,7 @@ def login(tmp_path, *, user=None, flag=None, **kwargs):
     path = tmp_path / "user" / "config.yaml"
     path.parent.mkdir(exist_ok=True)
     path.write_text(yaml.safe_dump(user or {}))
+    path.chmod(0o600)  # as dg writes it; any umask
     config = Config(config_path=str(path), base_url=flag)
     auth = AuthManager(config)
     kwargs.setdefault("api_key", "sk-LOGINKEY")
diff --git a/packages/deepctl-cmd-login/tests/unit/test_login_command.py b/packages/deepctl-cmd-login/tests/unit/test_login_command.py
index 71019c7b..e63fa16d 100644
--- a/packages/deepctl-cmd-login/tests/unit/test_login_command.py
+++ b/packages/deepctl-cmd-login/tests/unit/test_login_command.py
@@ -51,6 +51,8 @@ def home(tmp_path, monkeypatch):
         monkeypatch.setattr(con, "_width", 400)
     saved = dict(output._output_config)
     output._output_config.update(agentic=True, format="default", quiet=False)
+    # The mock config has no real file: nothing for login's pre-flight to check.
+    monkeypatch.setattr(login_module, "_preflight", lambda config: None)
     yield use_home(monkeypatch, tmp_path / "home")
     output._output_config.clear()
     output._output_config.update(saved)
@@ -182,9 +184,15 @@ def mock_client():
 
 
 @pytest.fixture
-def login_command():
-    """Create a login command instance."""
-    return LoginCommand()
+def login_command(monkeypatch):
+    """A login command run by a person in a terminal (its prompts can show,
+    and the browser login waits), with nothing on disk to check."""
+    cmd = LoginCommand()
+    cmd._can_ask = lambda: True  # type: ignore[method-assign]
+    cmd._pending_mode = lambda **kw: False  # type: ignore[method-assign]
+    monkeypatch.setattr(login_module, "_preflight", lambda config: None)
+    monkeypatch.setitem(output._output_config, "agentic", False)
+    return cmd
 
 
 class TestLoginCommand:
diff --git a/packages/deepctl-cmd-login/tests/unit/test_login_confirm.py b/packages/deepctl-cmd-login/tests/unit/test_login_confirm.py
new file mode 100644
index 00000000..4dc72000
--- /dev/null
+++ b/packages/deepctl-cmd-login/tests/unit/test_login_confirm.py
@@ -0,0 +1,307 @@
+"""`dg login` takes any key the API accepts, and a confirmation nobody can
+answer is `confirmation_required` naming --yes, never a silent cancel."""
+
+from __future__ import annotations
+
+import json
+import sys
+
+import pytest
+import yaml
+from deepctl_cmd_login import command as login_module
+from deepctl_cmd_login.command import LoginCommand
+from deepctl_cmd_login.models import LoginCodedError
+from deepctl_core import AuthManager, Config, DeepgramClient, hosts, output
+from deepctl_core import auth as auth_module
+
+HEX_KEY = "0123456789abcdef0123456789abcdef01234567"  # 40 hex, no prefix
+SK_KEY = "sk-LGNFAKEKEY0000000000000000"
+
+
+@pytest.fixture(autouse=True)
+def _isolated(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setenv("HOME", str(tmp_path / "home"))
+    monkeypatch.setattr(
+        "deepctl_core.config._default_config_file",
+        lambda: tmp_path / "user" / "config.yaml",
+    )
+    monkeypatch.setattr(
+        "deepctl_core.config._trust_root_location",
+        lambda: (tmp_path, tmp_path / "user" / "config.yaml"),
+    )
+    monkeypatch.setattr(hosts, "_reported", set())
+    monkeypatch.setattr(output, "_hints_shown", set())
+    for name in ("is_agentic", "is_ai_agent"):
+        monkeypatch.setattr(output, name, lambda: False)
+        monkeypatch.setattr(login_module, name, lambda: False)
+    monkeypatch.setattr(login_module, "_interactive_terminal", lambda: False)
+    monkeypatch.setattr(login_module, "_prog", lambda: "dg")
+    monkeypatch.setattr(sys, "argv", ["dg", "login"])
+    monkeypatch.delenv("DEEPGRAM_API_KEY", raising=False)
+    monkeypatch.delenv("DEEPGRAM_PROJECT_ID", raising=False)
+    saved = dict(output._output_config)
+    output._output_config.update(agentic=True, quiet=False, format="json")
+    monkeypatch.setattr(output.stderr_console, "_width", 400)
+    stored: dict[str, str] = {}
+    monkeypatch.setattr(
+        auth_module.keyring,
+        "set_password",
+        lambda service, name, value: stored.__setitem__(name, value),
+    )
+    monkeypatch.setattr(
+        auth_module.keyring, "get_password", lambda service, name: stored.get(name)
+    )
+    monkeypatch.setattr(
+        auth_module.keyring, "delete_password", lambda service, name: stored.pop(name)
+    )
+    monkeypatch.setattr(LoginCommand, "_maybe_prompt_skills_setup", lambda self: None)
+    monkeypatch.setattr(
+        LoginCommand, "confirm", lambda *a, **k: pytest.fail("prompted")
+    )
+    yield stored
+    output._output_config.clear()
+    output._output_config.update(saved)
+
+
+@pytest.fixture
+def keyring_store(_isolated):
+    return _isolated
+
+
+@pytest.fixture
+def verified(monkeypatch):
+    """The key check succeeds without a network call; records each key."""
+    keys: list[str] = []
+
+    def verify(self, api_key=None, project_id=None):
+        keys.append(api_key)
+        return True, "ok", None
+
+    monkeypatch.setattr(AuthManager, "verify_credentials", verify)
+    return keys
+
+
+def run(tmp_path, *, user=None, **kwargs):
+    path = tmp_path / "user" / "config.yaml"
+    path.parent.mkdir(exist_ok=True)
+    if user is not None or not path.exists():
+        path.write_text(yaml.safe_dump(user or {}))
+    config = Config(config_path=str(path))
+    auth = AuthManager(config)
+    cmd = LoginCommand()
+    result = cmd.handle(config, auth, DeepgramClient(config, auth), **kwargs)
+    return cmd, result, path
+
+
+def payload(result):
+    """The JSON a run writes to stdout for ``result``."""
+    return json.loads(json.dumps(result.model_dump()))
+
+
+# ── No key-prefix heuristic ──────────────────────────────────────
+
+
+@pytest.mark.parametrize("key", [HEX_KEY, SK_KEY])
+def test_any_key_the_api_accepts_logs_in(
+    tmp_path, verified, keyring_store, key, capsys
+):
+    _, result, _ = run(tmp_path, api_key=key)
+    assert result.status == "success"
+    assert verified == [key]
+    assert keyring_store == {"api-key.default": key}
+    captured = capsys.readouterr()
+    assert "format" not in captured.out + captured.err
+    assert key not in captured.out + captured.err
+
+
+def test_auth_manager_has_no_prefix_warning(tmp_path, verified, capsys):
+    config = Config(config_path=str(tmp_path / "c.yaml"))
+    AuthManager(config).login_with_api_key(HEX_KEY)
+    captured = capsys.readouterr()
+    assert "pattern" not in captured.out + captured.err
+
+
+# ── The env-key and re-login traps ───────────────────────────────
+
+
+def test_env_key_with_api_key_flag_is_confirmation_required(
+    tmp_path, verified, keyring_store, monkeypatch, capsys
+):
+    monkeypatch.setenv("DEEPGRAM_API_KEY", "envkey")
+    monkeypatch.setattr(sys, "argv", ["dg", "login", "--api-key", HEX_KEY])
+    cmd, result, path = run(tmp_path, api_key=HEX_KEY)
+    assert isinstance(result, LoginCodedError)
+    assert payload(result) == {
+        "error": (
+            "DEEPGRAM_API_KEY is set, and logging in saves a profile that dg will "
+            "use instead of it."
+        ),
+        "status": "error",
+        "code": "confirmation_required",
+        # The key is on argv, so no runnable command can be given.
+        "hint": (
+            "This job's DEEPGRAM_API_KEY is used without a login. Drop the login "
+            "step, or add --yes if a saved profile is intended."
+        ),
+        "next_step": None,
+        "schema_version": 1,
+        "details": {"flag": "--yes"},
+    }
+    assert list(payload(result)) == [
+        "error",
+        "status",
+        "code",
+        "hint",
+        "next_step",
+        "schema_version",
+        "details",
+    ]
+    assert cmd.exit_code_for(result) == 1
+    assert verified == [] and keyring_store == {}
+    assert yaml.safe_load(path.read_text()) == {}
+    err = capsys.readouterr().err
+    assert err.startswith("ERROR: DEEPGRAM_API_KEY is set")
+    assert "HINT: This job's DEEPGRAM_API_KEY" in err
+    assert HEX_KEY not in err
+
+
+def test_env_key_bare_login_names_login_yes(tmp_path, monkeypatch):
+    monkeypatch.setenv("DEEPGRAM_API_KEY", "envkey")
+    monkeypatch.setattr(login_module, "is_ai_agent", lambda: True)
+    _, result, _ = run(tmp_path)
+    assert result.code == "confirmation_required"
+    assert result.next_step == "dg login --yes"
+    assert result.details == {"flag": "--yes"}
+    assert result.hint == (
+        "Run next_step only if the user agrees: the saved login will then take "
+        "precedence over DEEPGRAM_API_KEY."
+    )
+
+
+def saved_login(tmp_path):
+    return {"profiles": {"default": {"api_key": "saved-key-0000"}}}
+
+
+def test_relogin_is_confirmation_required(tmp_path, verified, monkeypatch):
+    monkeypatch.setattr(
+        sys, "argv", ["dg", "-o", "json", "login", "--profile", "default"]
+    )
+    _, result, path = run(tmp_path, user=saved_login(tmp_path), profile="default")
+    assert result.code == "confirmation_required"
+    assert result.error == 'Profile "default" already has a saved login.'
+    assert result.next_step == "dg -o json login --profile default --yes"
+    assert result.details == {"flag": "--yes"}
+    assert result.hint == "Run the command in next_step only if the user agrees."
+    assert verified == []
+    assert yaml.safe_load(path.read_text()) == saved_login(tmp_path)
+
+
+def test_relogin_with_key_on_argv_has_no_next_step(tmp_path, verified, monkeypatch):
+    monkeypatch.setattr(login_module, "is_ai_agent", lambda: True)
+    monkeypatch.setattr(sys, "argv", ["dg", "login", "-k", HEX_KEY])
+    _, result, _ = run(tmp_path, user=saved_login(tmp_path), api_key=HEX_KEY)
+    assert result.next_step is None
+    assert result.hint == (
+        "Ask the user to rerun the command with --yes in their own terminal if "
+        "they agree."
+    )
+    assert HEX_KEY not in json.dumps(payload(result))
+
+
+def test_human_without_a_terminal_is_told_to_add_yes(tmp_path, monkeypatch, capsys):
+    output._output_config.update(agentic=False, format="default")
+    _, result, _ = run(tmp_path, user=saved_login(tmp_path))
+    assert result.code == "confirmation_required"
+    assert result.hint == "To go ahead, run the command again with --yes."
+    err = capsys.readouterr().err
+    assert "already has a saved login" in err
+
+
+@pytest.mark.parametrize("flag", ["yes", "force_write"])
+def test_yes_and_force_write_answer_both_traps(
+    tmp_path, verified, keyring_store, monkeypatch, flag
+):
+    monkeypatch.setenv("DEEPGRAM_API_KEY", "envkey")
+    _, result, _ = run(
+        tmp_path, user=saved_login(tmp_path), api_key=HEX_KEY, **{flag: True}
+    )
+    assert result.status == "success"
+    assert keyring_store == {"api-key.default": HEX_KEY}
+
+
+def test_no_trap_ever_returns_cancelled(tmp_path, monkeypatch):
+    """Ledger 18: without a person saying No, nothing is `cancelled`."""
+    monkeypatch.setenv("DEEPGRAM_API_KEY", "envkey")
+    for user in ({}, saved_login(tmp_path)):
+        _, result, _ = run(tmp_path, user=user, api_key=HEX_KEY)
+        assert result.status == "error" and result.code == "confirmation_required"
+
+
+def test_a_person_still_gets_the_prompt(tmp_path, monkeypatch):
+    monkeypatch.setenv("DEEPGRAM_API_KEY", "envkey")
+    asked: list[str] = []
+
+    def confirm(self, message, default=False):
+        asked.append(message)
+        return False
+
+    monkeypatch.setattr(LoginCommand, "confirm", confirm)
+    monkeypatch.setattr(LoginCommand, "_can_ask", lambda self: True)
+    _, result, _ = run(tmp_path, api_key=HEX_KEY)
+    assert asked == ["Do you still want to login with a profile?"]
+    assert result.status == "cancelled"  # the person said No
+
+
+def test_can_ask_needs_a_person_at_a_terminal(monkeypatch):
+    cmd = LoginCommand()
+    monkeypatch.setattr(login_module, "_interactive_terminal", lambda: True)
+    monkeypatch.setattr(LoginCommand, "can_prompt", lambda self: True)
+    assert cmd._can_ask() is True
+    monkeypatch.setattr(login_module, "is_ai_agent", lambda: True)
+    assert cmd._can_ask() is False
+    monkeypatch.setattr(login_module, "is_ai_agent", lambda: False)
+    monkeypatch.setattr(login_module, "_interactive_terminal", lambda: False)
+    assert cmd._can_ask() is False
+
+
+# ── next_step construction ───────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    "argv",
+    [
+        ["login", "--api-key", "K"],
+        ["login", "--api-key=K"],
+        ["login", "-k", "K"],
+        ["login", "-kK"],
+        ["--api-key", "K", "login"],
+        ["--base-url", "https://user:pw@example.com", "login"],
+        ["--base-url", "https://example.com/?token=1", "login"],
+    ],
+)
+def test_secret_bearing_argv_has_no_next_step(monkeypatch, argv):
+    monkeypatch.setattr(sys, "argv", ["dg", *argv])
+    assert login_module._secret_in(argv) is True
+    assert login_module._rerun_with_yes("dg") is None
+
+
+def test_rerun_quotes_and_refuses_unsafe_tokens(monkeypatch):
+    monkeypatch.setattr(sys, "argv", ["dg", "login", "--profile", "my work"])
+    assert login_module._rerun_with_yes("dg") == "dg login --profile 'my work' --yes"
+    monkeypatch.setattr(sys, "argv", ["dg", "login", "--profile", "=x"])
+    assert login_module._rerun_with_yes("dg") is None
+    monkeypatch.setattr(sys, "argv", ["dg", "login"])
+    assert login_module._rerun_with_yes(None) is None
+
+
+def test_details_is_left_out_when_empty():
+    err = LoginCodedError(error="e", code="c", hint="h", next_step=None)
+    assert list(err.model_dump()) == [
+        "error",
+        "status",
+        "code",
+        "hint",
+        "next_step",
+        "schema_version",
+    ]
diff --git a/packages/deepctl-cmd-login/tests/unit/test_login_device_agent.py b/packages/deepctl-cmd-login/tests/unit/test_login_device_agent.py
new file mode 100644
index 00000000..df0f3341
--- /dev/null
+++ b/packages/deepctl-cmd-login/tests/unit/test_login_device_agent.py
@@ -0,0 +1,734 @@
+"""Device login for agents: `dg login` returns the link and code at once,
+`dg login --complete` finishes it, and nothing is requested when the login
+couldn't be saved."""
+
+from __future__ import annotations
+
+import json
+import os
+import stat
+import sys
+import time
+
+import pytest
+import yaml
+from deepctl_cmd_login import command as login_module
+from deepctl_cmd_login.command import LoginCommand
+from deepctl_cmd_login.models import LoginCodedError, LoginPendingResult
+from deepctl_core import AuthManager, Config, DeepgramClient, hosts, login_state, output
+from deepctl_core import auth as auth_module
+from deepctl_core.auth import DeviceCodeResponse, DevicePoll, TokenResponse
+
+# The real request method, before the fixture swaps in the fake.
+_REAL_REQUEST = AuthManager._request_device_code
+
+IDENTITY = "https://id.dx.deepgram.com"
+LINK = "https://id.dx.deepgram.com/auth/cli"
+CODE = "WDJB-MJHT"
+KEY = "dgfinite0000000000000000000000000004567"
+
+
+class FakeIdentity:
+    """Stands in for the login server: records every request; answers polls in turn."""
+
+    def __init__(self) -> None:
+        self.requests: list[str] = []
+        self.answers: list[DevicePoll] = []
+        self.interval = 5
+
+    def device_code(self, identity_url=None):
+        self.requests.append(f"code {identity_url}")
+        return DeviceCodeResponse(
+            device_code="device-secret-1",
+            user_code=CODE,
+            verification_uri=LINK,
+            expires_in=900,
+            interval=self.interval,
+        )
+
+    def poll(self, device_code, identity_url=None):
+        self.requests.append(f"poll {device_code} {identity_url}")
+        return self.answers.pop(0) if self.answers else DevicePoll("pending")
+
+
+def approved() -> DevicePoll:
+    return DevicePoll(
+        "token",
+        token=TokenResponse(
+            access_token="jwt", dg_token=KEY, dg_expires_in=3600, pid="proj-1"
+        ),
+    )
+
+
+@pytest.fixture
+def agent(monkeypatch):
+    def set_agent(on: bool) -> None:
+        for mod in (output, login_module):
+            monkeypatch.setattr(mod, "is_ai_agent", lambda: on)
+        output._output_config["agentic"] = on
+
+    return set_agent
+
+
+@pytest.fixture(autouse=True)
+def env(tmp_path, monkeypatch, agent):
+    home = tmp_path / "home"
+    home.mkdir()
+    monkeypatch.setenv("HOME", str(home))
+    monkeypatch.setattr(login_state, "state_dir", lambda: home / ".deepctl")
+    monkeypatch.setattr(login_module, "state_dir", lambda: home / ".deepctl")
+    user = home / ".config" / "deepctl" / "config.yaml"
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr("deepctl_core.config._default_config_file", lambda: user)
+    monkeypatch.setattr(
+        "deepctl_core.config._trust_root_location", lambda: (home, user)
+    )
+    monkeypatch.setattr(hosts, "_reported", set())
+    monkeypatch.setattr(output, "_hints_shown", set())
+    monkeypatch.setattr(login_module, "is_agentic", lambda: False)
+    monkeypatch.setattr(login_module, "_interactive_terminal", lambda: False)
+    monkeypatch.setattr(login_module, "_prog", lambda: "dg")
+    monkeypatch.setattr(sys, "argv", ["dg", "login"])
+    for name in ("DEEPGRAM_API_KEY", "DEEPGRAM_PROJECT_ID", "DG_AGENT"):
+        monkeypatch.delenv(name, raising=False)
+    monkeypatch.delenv("DEEPGRAM_CLI_BASE_URL", raising=False)
+    saved = dict(output._output_config)
+    output._output_config.update(quiet=False, verbose=False, format="json")
+    agent(True)
+    monkeypatch.setattr(output.stderr_console, "_width", 400)
+    keyring: dict[str, str] = {}
+    monkeypatch.setattr(
+        auth_module.keyring,
+        "set_password",
+        lambda service, name, value: keyring.__setitem__(name, value),
+    )
+    monkeypatch.setattr(
+        auth_module.keyring, "get_password", lambda service, name: keyring.get(name)
+    )
+
+    def delete(service, name):
+        keyring.pop(name, None)
+
+    monkeypatch.setattr(auth_module.keyring, "delete_password", delete)
+    fake = FakeIdentity()
+    monkeypatch.setattr(AuthManager, "_request_device_code", fake.device_code)
+    monkeypatch.setattr(AuthManager, "poll_device_token", fake.poll)
+    monkeypatch.setattr(LoginCommand, "_maybe_prompt_skills_setup", lambda self: None)
+    import webbrowser
+
+    monkeypatch.setattr(webbrowser, "open", lambda *a: pytest.fail("browser"))
+    yield {"home": home, "user": user, "keyring": keyring, "fake": fake}
+    output._output_config.clear()
+    output._output_config.update(saved)
+
+
+def write_user(env, data=None, mode=0o600):
+    env["user"].parent.mkdir(parents=True, exist_ok=True)
+    env["user"].write_text(yaml.safe_dump(data or {"output": {"format": "json"}}))
+    os.chmod(env["user"], mode)
+
+
+def run(env, **kwargs):
+    config = Config(config_path=str(env["user"])) if env["user"].exists() else Config()
+    auth = AuthManager(config)
+    cmd = LoginCommand()
+    result = cmd.handle(config, auth, DeepgramClient(config, auth), **kwargs)
+    return cmd, result
+
+
+def pending_path(env):
+    return env["home"] / ".deepctl" / "login-pending.json"
+
+
+def dumped(result):
+    return json.loads(json.dumps(result.model_dump()))
+
+
+# ── Bare login returns at once ───────────────────────────────────
+
+
+def test_agent_login_returns_pending_at_once(env, capsys):
+    start = time.monotonic()
+    cmd, result = run(env)
+    assert time.monotonic() - start < 5
+    assert isinstance(result, LoginPendingResult)
+    assert cmd.exit_code_for(result) == 0
+    assert dumped(result) == {
+        "status": "pending",
+        "message": "Open the link and enter the code to finish logging in.",
+        "verification_uri": LINK,
+        "user_code": CODE,
+        "expires_in": 900,
+        "next_step": "dg login --complete",
+        "schema_version": 1,
+    }
+    assert list(dumped(result)) == [
+        "status",
+        "message",
+        "verification_uri",
+        "user_code",
+        "expires_in",
+        "next_step",
+        "schema_version",
+    ]
+    assert capsys.readouterr().err.splitlines() == [
+        f"INFO: To finish logging in, open {LINK} and enter the code {CODE}.",
+        "HINT: Give the user the link and code, then run dg login --complete after "
+        "they approve.",
+    ]
+    path = pending_path(env)
+    if sys.platform != "win32":
+        assert stat.S_IMODE(path.stat().st_mode) == 0o600
+        assert stat.S_IMODE(path.parent.stat().st_mode) == 0o700
+    saved = json.loads(path.read_text())
+    assert saved["device_code"] == "device-secret-1"
+    assert saved["host"] == IDENTITY and saved["profile"] == "default"
+    assert env["fake"].requests == [f"code {IDENTITY}"]
+
+
+def test_existing_state_dir_is_made_private(env):
+    (env["home"] / ".deepctl").mkdir(mode=0o755)
+    os.chmod(env["home"] / ".deepctl", 0o755)
+    run(env)
+    if sys.platform != "win32":
+        assert stat.S_IMODE((env["home"] / ".deepctl").stat().st_mode) == 0o700
+
+
+@pytest.mark.parametrize("why", ["no_tty", "no_browser", "dg_agent"])
+def test_pending_without_an_agent_marker(env, agent, monkeypatch, why):
+    agent(False)
+    kwargs = {}
+    if why == "no_tty":
+        monkeypatch.setattr(sys.stdin, "isatty", lambda: False, raising=False)
+        monkeypatch.setattr(sys.stdout, "isatty", lambda: False, raising=False)
+    elif why == "no_browser":
+        kwargs["no_browser"] = True
+    else:
+        monkeypatch.setenv("DG_AGENT", "1")
+    _, result = run(env, **kwargs)
+    assert isinstance(result, LoginPendingResult)
+
+
+def test_person_at_a_terminal_still_waits(env, agent, monkeypatch):
+    agent(False)
+    output._output_config["format"] = "default"
+    monkeypatch.setattr(sys.stdin, "isatty", lambda: True, raising=False)
+    monkeypatch.setattr(sys.stdout, "isatty", lambda: True, raising=False)
+    calls = []
+    monkeypatch.setattr(
+        AuthManager,
+        "login_with_device_flow",
+        lambda self, open_browser=True: calls.append(open_browser),
+    )
+    run(env)
+    assert calls == [True]
+    assert not pending_path(env).exists()
+
+
+def test_wait_polls_until_approved(env, monkeypatch):
+    monkeypatch.setattr(auth_module.time, "sleep", lambda s: None)
+    env["fake"].answers = [DevicePoll("pending"), approved()]
+    cmd, result = run(env, wait=True)
+    assert result.status == "success"
+    assert env["keyring"] == {"api-key.default": KEY}
+    assert not pending_path(env).exists()
+    assert [r.split()[0] for r in env["fake"].requests] == ["code", "poll", "poll"]
+
+
+# ── --complete ───────────────────────────────────────────────────
+
+
+def test_complete_before_approval_is_auth_pending(env, capsys):
+    run(env)
+    capsys.readouterr()
+    cmd, result = run(env, complete=True)
+    assert cmd.exit_code_for(result) == 1
+    assert dumped(result) == {
+        "error": "Login is waiting for approval in the browser.",
+        "status": "error",
+        "code": "auth_pending",
+        "hint": (
+            f"Wait 6 s for the user to approve the login at {LINK} with the code "
+            f"{CODE}, then run dg login --complete."
+        ),
+        "next_step": "dg login --complete",
+        "schema_version": 1,
+        # The server's interval of 5 s is raised to dg's 6 s floor.
+        "details": {"retry_after": 6, "verification_uri": LINK, "user_code": CODE},
+    }
+    assert pending_path(env).exists()
+
+
+def test_complete_after_approval_saves_the_key(env, capsys):
+    write_user(env)
+    run(env)
+    env["fake"].answers = [approved()]
+    capsys.readouterr()
+    cmd, result = run(env, complete=True)
+    assert dumped(result) == {
+        "status": "success",
+        "message": "Successfully logged in via web authentication",
+        "profile": "default",
+        "api_key_masked": "****4567",
+        "project_id": "proj-1",
+        "config_path": str(env["user"]),
+    }
+    captured = capsys.readouterr()
+    assert captured.err == ""  # mode A: no chrome (J1.4)
+    assert env["keyring"] == {"api-key.default": KEY}
+    saved = yaml.safe_load(env["user"].read_text())
+    assert saved["profiles"]["default"]["project_id"] == "proj-1"
+    assert saved["profiles"]["default"].get("api_key") is None
+    assert not pending_path(env).exists()
+    assert KEY not in captured.out + captured.err
+
+
+def test_complete_saves_to_the_profile_login_started_with(env):
+    write_user(env)
+    run(env, profile="work")
+    env["fake"].answers = [approved()]
+    _, result = run(env, complete=True)
+    assert result.profile == "work"
+    assert env["keyring"] == {"api-key.work": KEY}
+
+
+@pytest.mark.parametrize(
+    ("answer", "code"),
+    [("denied", "auth_denied"), ("expired", "auth_expired")],
+)
+def test_complete_denied_or_expired(env, answer, code):
+    run(env)
+    env["fake"].answers = [DevicePoll(answer)]
+    _, result = run(env, complete=True)
+    assert result.code == code
+    assert result.next_step == (None if answer == "denied" else "dg login")
+    assert not pending_path(env).exists()
+
+
+def test_complete_after_local_expiry(env, monkeypatch):
+    run(env)
+    later = time.time() + 1000
+    monkeypatch.setattr(login_state.time, "time", lambda: later)
+    _, result = run(env, complete=True)
+    assert result.code == "auth_expired"
+    assert [r.split()[0] for r in env["fake"].requests] == ["code"]
+
+
+def test_complete_without_a_pending_login(env, capsys):
+    cmd, result = run(env, complete=True)
+    assert dumped(result) == {
+        "error": "No login is waiting to be completed, or it expired.",
+        "status": "error",
+        "code": "auth_expired",
+        "hint": "Run dg login again and give the user the new link and code.",
+        "next_step": "dg login",
+        "schema_version": 1,
+    }
+    assert env["fake"].requests == []
+
+
+def test_complete_never_sends_the_code_to_another_login_host(env, monkeypatch):
+    run(env)
+    monkeypatch.setenv("DEEPGRAM_CLI_BASE_URL", "https://id.other.example")
+    output._output_config["agentic"] = False
+    monkeypatch.setattr(output, "is_ai_agent", lambda: False)
+    monkeypatch.setattr(login_module, "is_ai_agent", lambda: False)
+    _, result = run(env, complete=True)
+    assert result.code == "auth_expired"
+    assert [r.split()[0] for r in env["fake"].requests] == ["code"]
+
+
+def test_complete_with_api_key_is_a_usage_error(env):
+    import click
+
+    with pytest.raises(click.UsageError):
+        run(env, complete=True, api_key="k")
+
+
+# ── The pending file under an agent ──────────────────────────────
+
+
+def plant_pending(env, mode=0o600):
+    run(env)
+    path = pending_path(env)
+    os.chmod(path, mode)
+    return path, path.read_bytes()
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX modes")
+def test_writable_pending_file_is_ignored_and_kept(env, capsys):
+    path, before = plant_pending(env, 0o666)
+    capsys.readouterr()
+    _, result = run(env, complete=True)
+    assert result.code == "auth_expired"
+    assert path.read_bytes() == before
+    assert stat.S_IMODE(path.stat().st_mode) == 0o666
+    warns = [
+        line
+        for line in capsys.readouterr().err.splitlines()
+        if line.startswith("WARN:")
+    ]
+    assert warns == [
+        "WARN: Ignored the pending login in ~/.deepctl/login-pending.json: in an AI "
+        "agent session, dg doesn't use a file that can be changed by other users."
+    ]
+    assert [r.split()[0] for r in env["fake"].requests] == ["code"]
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX owners")
+def test_foreign_pending_file_is_ignored(env, monkeypatch, capsys):
+    path, before = plant_pending(env)
+    other = os.geteuid() + 1
+    monkeypatch.setattr(login_state.os, "geteuid", lambda: other)
+    # The pre-flight's own owner checks use the real uid.
+    monkeypatch.setattr(login_module, "_preflight", lambda config: None)
+    capsys.readouterr()
+    _, result = run(env, complete=True)
+    assert result.code == "auth_expired"
+    assert path.read_bytes() == before
+    assert "is owned by another user" in capsys.readouterr().err
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="symlinks")
+def test_symlinked_pending_file_is_ignored(env, tmp_path, capsys):
+    run(env)
+    path = pending_path(env)
+    elsewhere = tmp_path / "planted.json"
+    elsewhere.write_bytes(path.read_bytes())
+    path.unlink()
+    path.symlink_to(elsewhere)
+    capsys.readouterr()
+    _, result = run(env, complete=True)
+    assert result.code == "auth_expired"
+    assert path.is_symlink() and elsewhere.exists()
+    assert "WARN:" in capsys.readouterr().err
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX modes")
+def test_writable_pending_file_is_used_without_an_agent(env, agent, capsys):
+    path, _ = plant_pending(env, 0o666)
+    agent(False)
+    _, result = run(env, complete=True)
+    assert result.code == "auth_pending"
+    assert "WARN:" not in capsys.readouterr().err
+
+
+def test_pending_file_never_holds_the_key(env):
+    write_user(env)
+    run(env)
+    env["fake"].answers = [DevicePoll("pending")]
+    run(env, complete=True)
+    assert KEY not in pending_path(env).read_text()
+
+
+# ── Unwritable state ─────────────────────────────────────────────
+
+
+@pytest.mark.skipif(
+    sys.platform == "win32" or os.geteuid() == 0, reason="root ignores modes"
+)
+@pytest.mark.parametrize(
+    "kwargs", [{}, {"api_key": "k", "yes": True}, {"complete": True}]
+)
+def test_unwritable_home_stops_before_any_request(env, monkeypatch, kwargs, capsys):
+    verified = []
+    monkeypatch.setattr(
+        AuthManager, "verify_credentials", lambda self, *a, **k: verified.append(1)
+    )
+    os.chmod(env["home"], 0o500)
+    try:
+        cmd, result = run(env, **kwargs)
+    finally:
+        os.chmod(env["home"], 0o700)
+    assert isinstance(result, LoginCodedError)
+    assert result.code == "state_unwritable"
+    assert result.next_step is None
+    assert result.details == {"dir": str(env["home"] / ".deepctl")}
+    assert result.hint == (
+        "This environment can't store credentials. Ask the user to run dg login "
+        "in their own terminal."
+    )
+    assert env["fake"].requests == [] and verified == []
+
+
+def test_save_failure_after_the_request_is_state_unwritable(env, monkeypatch):
+    def refuse(pending):
+        raise PermissionError(13, "denied")
+
+    monkeypatch.setattr(login_module, "save_pending", refuse)
+    _, result = run(env)
+    assert result.code == "state_unwritable"
+
+
+# ── An untrusted user config under an agent ──────────────────────
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX modes")
+@pytest.mark.parametrize(
+    "kwargs", [{}, {"api_key": "k", "yes": True}, {"complete": True}]
+)
+@pytest.mark.parametrize("case", ["writable", "foreign"])
+def test_untrusted_config_stops_before_any_request(
+    env, monkeypatch, kwargs, case, capsys
+):
+    if kwargs.get("complete"):
+        write_user(env)
+        run(env)  # a valid pending login
+        env["fake"].requests.clear()
+    write_user(env, mode=0o666 if case == "writable" else 0o600)
+    if case == "foreign":
+        from deepctl_core import config as config_module
+
+        other = os.getuid() + 1
+        monkeypatch.setattr(config_module.os, "geteuid", lambda: other)
+    before = env["user"].read_bytes()
+    verified = []
+    monkeypatch.setattr(
+        AuthManager, "verify_credentials", lambda self, *a, **k: verified.append(1)
+    )
+    capsys.readouterr()
+    cmd, result = run(env, **kwargs)
+    why = (
+        "can be changed by other users"
+        if case == "writable"
+        else "is owned by another user"
+    )
+    assert dumped(result) == {
+        "error": (
+            "In an AI agent session, dg can't save a login to "
+            "~/.config/deepctl/config.yaml "
+            f"because the file {why}. Nothing was sent or saved."
+        ),
+        "status": "error",
+        "code": "state_unwritable",
+        "hint": "A person must fix this file. If you are an AI agent, ask the user.",
+        "next_step": None,
+        "schema_version": 1,
+        "details": {"reason": "untrusted_config", "path": str(env["user"])},
+    }
+    assert cmd.exit_code_for(result) == 1
+    err = capsys.readouterr().err
+    assert "HINT: A person must fix this file." in err
+    assert env["user"].read_bytes() == before
+    if case == "writable":
+        assert stat.S_IMODE(env["user"].stat().st_mode) == 0o666
+    assert env["fake"].requests == [] and verified == []
+    assert env["keyring"] == {}
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX modes")
+def test_untrusted_config_comes_before_the_env_key_trap(env, monkeypatch):
+    write_user(env, mode=0o666)
+    monkeypatch.setenv("DEEPGRAM_API_KEY", "envkey")
+    _, result = run(env)
+    assert result.code == "state_unwritable"
+    assert result.details["reason"] == "untrusted_config"
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX modes")
+def test_writable_config_without_an_agent_still_logs_in(env, agent):
+    agent(False)
+    write_user(env, mode=0o666)
+    _, result = run(env, no_browser=True)
+    assert isinstance(result, LoginPendingResult)
+
+
+# ── mode A stderr ────────────────────────────────────────────────
+
+
+def test_mode_a_stderr_keeps_only_prefixed_lines():
+    import io
+
+    real = io.StringIO()
+    filtered = login_module._ModeAStderr(real)
+    for text in (
+        "Starting web authentication...\n",
+        "INFO: link\n",
+        "✓ API key stored\n",
+        "Warning: Project ID not provided\n",
+        "Error: something only chrome says\n",
+        "HINT: h\n",
+    ):
+        filtered.write(text)
+    assert real.getvalue() == "INFO: link\nHINT: h\n"
+
+
+def test_mode_a_stderr_verbose_keeps_chrome_as_info_lines():
+    import io
+
+    real = io.StringIO()
+    filtered = login_module._ModeAStderr(real, verbose=True)
+    filtered.write("Starting web authentication...\n")
+    filtered.write("\nYou are now\nlogged in\n")
+    filtered.write("WARN: w\n")
+    assert real.getvalue() == (
+        "INFO: Starting web authentication...\nINFO: You are now\nINFO: logged in\n"
+        "WARN: w\n"
+    )
+
+
+def test_api_key_login_in_agent_mode_has_empty_stderr(env, monkeypatch, capsys):
+    """J4.3: no project ID is chrome, not a warning, in mode A."""
+    monkeypatch.setattr(
+        AuthManager, "verify_credentials", lambda self, *a, **k: (True, "ok", None)
+    )
+    write_user(env)
+    capsys.readouterr()
+    _, result = run(env, api_key="0123456789abcdef0123456789abcdef01234567")
+    assert result.status == "success"
+    assert capsys.readouterr().err == ""
+
+
+# ── Edge cases ───────────────────────────────────────────────────
+
+
+@pytest.mark.parametrize("server_interval", [1, 0, 5])
+def test_poll_interval_has_a_6_s_floor(env, server_interval):
+    env["fake"].interval = server_interval
+    run(env)
+    assert json.loads(pending_path(env).read_text())["interval"] == 6
+    _, result = run(env, complete=True)
+    assert result.details["retry_after"] >= 6
+
+
+def test_slow_down_honours_retry_after(env):
+    run(env)
+    env["fake"].answers = [DevicePoll("slow_down", retry_after=30)]
+    _, result = run(env, complete=True)
+    assert result.details["retry_after"] == 30
+    assert json.loads(pending_path(env).read_text())["interval"] == 30
+
+
+def test_slow_down_adds_5_s(env):
+    run(env)
+    env["fake"].answers = [DevicePoll("slow_down")]
+    _, result = run(env, complete=True)
+    assert result.details["retry_after"] == 11
+
+
+def test_wait_backs_off_on_server_errors(env, monkeypatch):
+    slept: list[float] = []
+    monkeypatch.setattr(login_module.time, "sleep", slept.append)
+    run(env)
+    env["fake"].answers = [
+        DevicePoll("unavailable", detail="HTTP 503", retry_after=60),
+        DevicePoll("unavailable", detail="HTTP 502"),
+        approved(),
+    ]
+    write_user(env)
+    _, result = run(env, complete=True, wait=True)
+    assert result.status == "success"
+    assert slept[0] == 60 and slept[1] == 65
+
+
+def test_server_error_without_wait_keeps_the_pending_login(env):
+    run(env)
+    env["fake"].answers = [DevicePoll("unavailable", detail="HTTP 503")]
+    _, result = run(env, complete=True)
+    assert result.status == "error"
+    assert pending_path(env).exists()
+
+
+def test_wait_stops_at_local_expiry(env, monkeypatch):
+    clock = {"now": time.time()}
+    monkeypatch.setattr(
+        login_module.time, "sleep", lambda s: clock.__setitem__("now", clock["now"] + s)
+    )
+    monkeypatch.setattr(login_state.time, "time", lambda: clock["now"])
+    monkeypatch.setattr(login_module.time, "time", lambda: clock["now"])
+    run(env)
+    env["fake"].answers = [DevicePoll("unavailable", retry_after=3600)] * 3
+    _, result = run(env, complete=True, wait=True)
+    assert result.code == "auth_expired"
+
+
+@pytest.mark.parametrize("body", [[], None, "text", 7])
+def test_unreadable_device_code_answer_is_coded(env, monkeypatch, capsys, body):
+    from unittest.mock import Mock
+
+    def device_code(self, identity_url=None):
+        response = Mock(status_code=201)
+        response.json.return_value = body
+        self.client.post = Mock(return_value=response)
+        return _REAL_REQUEST(self, identity_url)
+
+    monkeypatch.setattr(AuthManager, "_request_device_code", device_code)
+    for kwargs in ({}, {"wait": True}):
+        capsys.readouterr()
+        cmd, result = run(env, **kwargs)
+        assert dumped(result) == {
+            "error": "Got a response from id.dx.deepgram.com that dg couldn't read.",
+            "status": "error",
+            "code": "network_unavailable",
+            "hint": (
+                "Retry once. If it fails again, tell the user that something on this "
+                "network (a proxy, captive portal or firewall) is answering in "
+                "Deepgram's place."
+            ),
+            "next_step": None,
+            "schema_version": 1,
+            "details": {"host": "id.dx.deepgram.com", "reason": "unreadable response"},
+        }
+        assert cmd.exit_code_for(result) == 1
+        assert "TypeError" not in capsys.readouterr().err
+    assert not pending_path(env).exists()
+
+
+@pytest.mark.parametrize("interval", [-3, "6", None, True, float("nan")])
+def test_unusable_pending_interval_is_no_pending_login(env, interval):
+    run(env)
+    data = json.loads(pending_path(env).read_text())
+    data["interval"] = interval
+    pending_path(env).write_text(json.dumps(data))
+    os.chmod(pending_path(env), 0o600)
+    _, result = run(env, complete=True)
+    assert result.code == "auth_expired"
+    assert [r.split()[0] for r in env["fake"].requests] == ["code"]
+
+
+def test_small_pending_interval_is_raised_to_the_floor(env):
+    run(env)
+    data = json.loads(pending_path(env).read_text())
+    data["interval"] = 0
+    pending_path(env).write_text(json.dumps(data))
+    os.chmod(pending_path(env), 0o600)
+    _, result = run(env, complete=True)
+    assert result.details["retry_after"] == 6
+
+
+def test_network_error_on_complete_is_coded(env, monkeypatch):
+    import httpx
+    from deepctl_core.transport import TransportError
+
+    run(env)
+
+    def unreachable(self, device_code, identity_url=None):
+        request = httpx.Request("POST", f"{IDENTITY}/oauth/token")
+        raise httpx.ConnectError("[Errno 111] Connection refused", request=request)
+
+    monkeypatch.setattr(AuthManager, "poll_device_token", unreachable)
+    with pytest.raises(TransportError) as err:
+        run(env, complete=True)
+    assert err.value.code == "network_unavailable"
+    assert err.value.error == "Couldn't reach id.dx.deepgram.com: connection refused."
+    assert "device-secret-1" not in err.value.error
+    assert pending_path(env).exists()
+
+
+def test_complete_with_another_profile_is_a_usage_error(env):
+    import click
+
+    run(env, profile="work")
+    with pytest.raises(click.UsageError, match='pending login is for profile "work"'):
+        run(env, complete=True, profile="other")
+    assert [r.split()[0] for r in env["fake"].requests] == ["code"]
+    env["fake"].answers = [DevicePoll("pending")]
+    _, result = run(env, complete=True, profile="work")
+    assert result.code == "auth_pending"
+
+
+def test_complete_with_save_base_url_is_a_usage_error(env):
+    import click
+
+    with pytest.raises(click.UsageError):
+        run(env, complete=True, save_base_url=True)
diff --git a/packages/deepctl-cmd-login/tests/unit/test_login_strings.py b/packages/deepctl-cmd-login/tests/unit/test_login_strings.py
new file mode 100644
index 00000000..a5550789
--- /dev/null
+++ b/packages/deepctl-cmd-login/tests/unit/test_login_strings.py
@@ -0,0 +1,79 @@
+"""Login's user-facing strings equal the error catalogue's.
+
+Runs when DG_ERROR_CODES_JSON names the catalogue file; skipped otherwise.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+
+import pytest
+from deepctl_core import messages as msg
+
+CATALOGUE = os.environ.get("DG_ERROR_CODES_JSON")
+pytestmark = pytest.mark.skipif(not CATALOGUE, reason="DG_ERROR_CODES_JSON not set")
+
+# catalogue id -> messages.py constant
+IDS = {
+    "E-CONFIRM-ENVKEY": "E_CONFIRM_ENVKEY",
+    "A-CONFIRM-ENVKEY": "A_CONFIRM_ENVKEY",
+    "A-CONFIRM-ENVKEY-NULL": "A_CONFIRM_ENVKEY_NULL",
+    "C-CONFIRM-ENVKEY-NULL": "C_CONFIRM_ENVKEY_NULL",
+    "E-CONFIRM-RELOGIN": "E_CONFIRM_RELOGIN",
+    "H-CONFIRM-YES": "H_CONFIRM_YES",
+    "A-CONFIRM-YES": "A_CONFIRM_YES",
+    "A-CONFIRM-YES-NULL": "A_CONFIRM_YES_NULL",
+    "C-CONFIRM-YES-NULL": "C_CONFIRM_YES_NULL",
+    "M-LOGIN-PENDING": "M_LOGIN_PENDING",
+    "I-LOGIN-PENDING": "I_LOGIN_PENDING",
+    "A-LOGIN-PENDING": "A_LOGIN_PENDING",
+    "H-LOGIN-PENDING": "H_LOGIN_PENDING",
+    "E-AUTH-PENDING": "E_AUTH_PENDING",
+    "H-AUTH-PENDING": "H_AUTH_PENDING",
+    "A-AUTH-PENDING": "A_AUTH_PENDING",
+    "E-AUTH-EXPIRED": "E_AUTH_EXPIRED",
+    "H-AUTH-EXPIRED": "H_AUTH_EXPIRED",
+    "A-AUTH-EXPIRED": "A_AUTH_EXPIRED",
+    "E-AUTH-DENIED": "E_AUTH_DENIED",
+    "H-AUTH-DENIED": "H_AUTH_DENIED",
+    "A-AUTH-DENIED": "A_AUTH_DENIED",
+    "E-STATE-UNWRITABLE": "E_STATE_UNWRITABLE",
+    "H-STATE-UNWRITABLE": "H_STATE_UNWRITABLE",
+    "A-STATE-UNWRITABLE": "A_STATE_UNWRITABLE",
+    "E-CFG-SAVE-UNTRUSTED": "E_CFG_SAVE_UNTRUSTED",
+    "W-LOGIN-PENDING-UNTRUSTED": "W_LOGIN_PENDING_UNTRUSTED",
+    "E-NETWORK-UNREADABLE": "E_NETWORK_UNREADABLE",
+    "H-NETWORK-UNREADABLE": "H_NETWORK_UNREADABLE",
+    "A-NETWORK-UNREADABLE": "A_NETWORK_UNREADABLE",
+}
+
+
+@pytest.fixture(scope="module")
+def catalogue():
+    with open(CATALOGUE, encoding="utf-8") as f:
+        return json.load(f)
+
+
+@pytest.mark.parametrize(("cid", "const"), sorted(IDS.items()))
+def test_string_matches_the_catalogue(catalogue, cid, const):
+    assert getattr(msg, const) == catalogue["strings"][cid]
+
+
+def test_codes_and_details_keys(catalogue):
+    codes = catalogue["codes"]
+    used = {
+        msg.CODE_CONFIRMATION_REQUIRED: {"flag"},
+        msg.CODE_AUTH_PENDING: {"retry_after", "verification_uri", "user_code"},
+        msg.CODE_AUTH_EXPIRED: set(),
+        msg.CODE_AUTH_DENIED: set(),
+        msg.CODE_STATE_UNWRITABLE: {"dir", "reason", "path"},
+        msg.CODE_NETWORK_UNAVAILABLE: {"host", "reason"},
+    }
+    for code, keys in used.items():
+        assert code in codes
+        assert keys <= set(codes[code].get("details") or [])
+    reasons = codes["state_unwritable"]["details_values"]["E-CFG-SAVE-UNTRUSTED"]
+    assert reasons["reason"] == ["untrusted_config"]
+    unreadable = codes["network_unavailable"]["details_values"]["E-NETWORK-UNREADABLE"]
+    assert unreadable["reason"] == ["unreadable response"]
diff --git a/packages/deepctl-cmd-projects/src/deepctl_cmd_projects/command.py b/packages/deepctl-cmd-projects/src/deepctl_cmd_projects/command.py
index 5ee065d3..cd2a6896 100644
--- a/packages/deepctl-cmd-projects/src/deepctl_cmd_projects/command.py
+++ b/packages/deepctl-cmd-projects/src/deepctl_cmd_projects/command.py
@@ -11,7 +11,10 @@
     get_output_format,
     get_status_console,
 )
+from deepctl_core.output import print_error, print_warning
+from deepctl_core.transport import TransportError
 from rich.console import Console
+from rich.markup import escape
 
 from .models import ProjectInfo, ProjectsResult
 
@@ -183,13 +186,15 @@ def _list_projects(self, client: DeepgramClient) -> ProjectsResult | BaseResult:
             )
 
         except Exception as e:
-            status_console.print(f"[red]Failed to list projects:[/red] {e}")
+            print_error(f"Failed to list projects: {escape(str(e))}")
             return BaseResult(status="error", message=str(e))
 
     def _create_project(
         self, client: DeepgramClient, name: str, company: str | None
     ) -> ProjectsResult | BaseResult:
         """Create a new project."""
+        from deepctl_core.transport import prog
+
         status_console.print(f"[blue]Creating project:[/blue] {name}")
 
         if company:
@@ -220,8 +225,12 @@ def _create_project(
                     count=1,
                 )
             else:
-                status_console.print(
-                    "[yellow]Project creation response missing project_id[/yellow]"
+                print_warning(
+                    escape(
+                        "Deepgram created the project but didn't return its "
+                        f"ID. Run {prog() or 'dg'} projects --list to find it."
+                    ),
+                    stderr=True,
                 )
                 return ProjectsResult(
                     status="warning",
@@ -231,7 +240,7 @@ def _create_project(
                 )
 
         except Exception as e:
-            status_console.print(f"[red]Failed to create project:[/red] {e}")
+            print_error(f"Failed to create project: {escape(str(e))}")
             return BaseResult(status="error", message=str(e))
 
     def _show_project(
@@ -286,7 +295,7 @@ def _show_project(
                 )
 
         except Exception as e:
-            status_console.print(f"[red]Failed to get project details:[/red] {e}")
+            print_error(f"Failed to get project details: {escape(str(e))}")
             return BaseResult(status="error", message=str(e))
 
     def _show_current_project(
@@ -321,7 +330,14 @@ def _set_default_project(
             try:
                 client.get_project(project_id)
                 status_console.print("[green]✓[/green] Project ID validated")
-            except Exception as e:
+            except (Exception, TransportError) as e:
+                # A project the key can't see (404/403) can still be set,
+                # after a warning; any other failure stops here.
+                if isinstance(e, TransportError) and e.code not in (
+                    "not_found",
+                    "auth_forbidden",
+                ):
+                    raise
                 status_console.print(
                     f"[yellow]Warning:[/yellow] Could not validate project: {e}"
                 )
@@ -341,7 +357,7 @@ def _set_default_project(
             )
 
         except Exception as e:
-            status_console.print(f"[red]Failed to set default project:[/red] {e}")
+            print_error(f"Failed to set default project: {escape(str(e))}")
             from deepctl_core.output import print_error_hint
 
             print_error_hint(e)
diff --git a/packages/deepctl-cmd-projects/tests/unit/test_projects_command.py b/packages/deepctl-cmd-projects/tests/unit/test_projects_command.py
index 6e6e539a..7041e02f 100644
--- a/packages/deepctl-cmd-projects/tests/unit/test_projects_command.py
+++ b/packages/deepctl-cmd-projects/tests/unit/test_projects_command.py
@@ -71,3 +71,60 @@ def test_list_default_mode_prints_list(self, mock_console, _fmt, command):
         )
 
         assert mock_console.print.called
+
+
+class TestSetDefaultValidation:
+    """--set-default warns and asks when the key can't see the project, as
+    in 0.4.x; any other request failure stops the command."""
+
+    @staticmethod
+    def _run(code):
+        from deepctl_core.transport import TransportError
+
+        command = ProjectsCommand()
+        config = Mock(spec=Config)
+        config.profile = "default"
+        client = Mock()
+        client.get_project.side_effect = TransportError(
+            code, {"path": "/v1/projects/p9", "http_status": 503}, {}
+        )
+        with patch(
+            "deepctl_cmd_projects.command.DeepgramClient", return_value=client
+        ), patch.object(command, "confirm", return_value=False) as confirm:
+            result = command._set_default_project(config, Mock(), "p9")
+        return result, confirm, config
+
+    @pytest.mark.parametrize("code", ["not_found", "auth_forbidden"])
+    def test_unseen_project_warns_and_confirms(self, code):
+        result, confirm, config = self._run(code)
+        confirm.assert_called_once()
+        assert result.status == "cancelled"
+        config.update_profile.assert_not_called()
+
+    def test_other_failures_stop(self):
+        from deepctl_core.transport import TransportError
+
+        with pytest.raises(TransportError):
+            self._run("server_error")
+
+
+def test_create_without_an_id_says_how_to_find_it(monkeypatch):
+    monkeypatch.setattr("deepctl_core.transport.prog", lambda: "dg")
+    warnings: list[str] = []
+    monkeypatch.setattr(
+        "deepctl_cmd_projects.command.print_warning",
+        lambda text, **kwargs: warnings.append(text),
+    )
+    client = Mock(spec=DeepgramClient)
+    client.create_project.return_value = {"name": "Acme"}
+    result = ProjectsCommand().handle(
+        config=Mock(spec=Config),
+        auth_manager=Mock(spec=AuthManager),
+        client=client,
+        create="Acme",
+    )
+    assert result.status == "warning"
+    assert warnings == [
+        "Deepgram created the project but didn't return its ID. Run dg projects "
+        "--list to find it."
+    ]
diff --git a/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/command.py b/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/command.py
index c1d696a4..be8da794 100644
--- a/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/command.py
+++ b/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/command.py
@@ -1,18 +1,31 @@
-"""Speak (text-to-speech) command for deepctl."""
+"""Speak (text-to-speech) command for deepctl.
+
+Signal handling (SIGINT/SIGTERM/SIGHUP during a request) is written for
+the dg process; running this command in-process inside another program
+isn't supported for signal semantics.
+"""
 
 from __future__ import annotations
 
 import io
+import os
+import secrets
+import shlex
 import shutil
+import signal
 import struct
 import subprocess
 import sys
 import tempfile
+import threading
 import time
 import wave
 from contextlib import contextmanager, suppress
+from dataclasses import dataclass
+from datetime import datetime, timezone
 from pathlib import Path
 from typing import IO, TYPE_CHECKING, Any
+from urllib.parse import urlsplit
 
 import click
 from deepctl_core import (
@@ -24,14 +37,29 @@
     get_output_format,
     get_status_console,
 )
+from deepctl_core.output import (
+    _agentic,
+    format_source,
+    is_ai_agent,
+    print_error,
+    print_hint,
+    print_warning,
+    stderr_console,
+)
+from deepctl_core.signals import coalescing as _coalescing
+from deepctl_core.signals import defer_in_importlib as _defer_in_importlib
+from deepctl_core.signals import die_by_signal as _die_by_signal
+from deepctl_core.signals import send_to_main as _send_to_main
 from rich.console import Console
 from rich.markup import escape
 from rich.table import Table
 
-from .models import SpeakResult, SpeakVoicesResult, VoiceInfo
+from . import messages as msg
+from . import sinks
+from .models import SpeakCodedError, SpeakResult, SpeakVoicesResult, VoiceInfo
 
 if TYPE_CHECKING:
-    from collections.abc import Iterator
+    from collections.abc import Callable, Iterator
 
 console = get_status_console()
 # Tables and other stdout-bound rendering (only used when no audio goes to
@@ -147,9 +175,9 @@ def _check_playable(
     )
     if raw:
         return (
-            f"--play cannot play raw {eff_encoding} audio: it has no container "
-            "for the player to detect. Use the default linear16 audio, add "
-            "--container wav (Aura), or save it with -o."
+            f"--play can't play raw {eff_encoding} audio because the player "
+            "can't tell its format. Use linear16 (the default), add "
+            "--container wav (Aura only), or save it with --out-file FILE."
         )
 
     unplayable = _UNPLAYABLE_BY_PLAYER.get(player, ())
@@ -160,9 +188,9 @@ def _check_playable(
             if e not in unplayable
         )
         return (
-            f"'{player}' cannot decode {eff_encoding}; it plays {playable}. "
-            "Pick one of those with --encoding, install ffmpeg (ffplay) to play "
-            f"{eff_encoding}, or save it with -o."
+            f"'{player}' can't decode {eff_encoding}; it plays {playable}. "
+            "Pick one of those with --encoding, install ffmpeg (for ffplay) to "
+            f"play {eff_encoding}, or save it with --out-file FILE."
         )
     return None
 
@@ -225,6 +253,412 @@ def _play_audio(player: str, audio: bytes, *, suffix: str) -> None:
         sink.write(audio)
 
 
+def _prog() -> str:
+    """The program name to show in messages and ``next_step``.
+
+    The bare name when it resolves on PATH to the running executable;
+    otherwise ``dg``.
+    """
+    try:
+        argv0 = sys.argv[0]
+        name = os.path.basename(argv0)
+        if name in ("dg", "deepgram", "deepctl"):
+            found = shutil.which(name)
+            if found and os.path.realpath(found) == os.path.realpath(argv0):
+                return name
+    except Exception:
+        pass
+    return "dg"
+
+
+def _silence_stdout() -> None:
+    """Point fd 1 at the null device, so buffered output and later writes,
+    including the flush at exit, succeed quietly. Used once the reader of
+    stdout went away (EPIPE) or stdout can't be written (ENOSPC, EIO)."""
+    try:
+        devnull = os.open(os.devnull, os.O_WRONLY)
+        os.dup2(devnull, 1)
+        os.close(devnull)
+    except OSError:
+        pass
+
+
+def _os_error_text(exc: OSError) -> str:
+    """The OS error text for a message: printable, one line, bounded."""
+    text = exc.strerror or str(exc) or exc.__class__.__name__
+    return "".join(ch if ch.isprintable() else " " for ch in text).strip()[:200]
+
+
+#: Longest wait for an audio stream to close: a WebSocket closing handshake
+#: the server doesn't answer (Ctrl-C mid-stream) must not hold up the exit.
+_CLOSE_TIMEOUT_S = 2.0
+
+
+def _close(*streams: object, timeout: float = _CLOSE_TIMEOUT_S) -> None:
+    """Close audio iterators (and the responses behind them), quietly and in
+    order, and wait at most ``timeout`` seconds for all of them together."""
+    closes = [c for c in (getattr(s, "close", None) for s in streams) if c]
+    if not closes:
+        return
+
+    def run() -> None:
+        for close in closes:
+            with suppress(BaseException):
+                close()
+
+    closer = threading.Thread(target=run, name="deepctl-speak-close", daemon=True)
+    closer.start()
+    closer.join(timeout)
+
+
+def _coded(
+    text: str,
+    *,
+    code: str,
+    hint_human: str,
+    hint_agent: str,
+    next_step: str | None = None,
+    details: dict[str, Any] | None = None,
+) -> SpeakCodedError:
+    """Report a coded failure on stderr (two lines) and return its envelope."""
+    hint = hint_agent if (_agentic or is_ai_agent()) else hint_human
+    print_error(escape(text))
+    print_hint(escape(hint))
+    return SpeakCodedError(
+        error=text, code=code, hint=hint, next_step=next_step, details=details
+    )
+
+
+def _output_unwritable(exc: OSError, *, path: str) -> SpeakCodedError:
+    """``output_unwritable`` for a failed write to ``path`` (``-`` = stdout)."""
+    reason = _os_error_text(exc)
+    return _coded(
+        msg.E_OUTPUT_UNWRITABLE.format(
+            output="stdout" if path == "-" else path, reason=reason
+        ),
+        code=msg.CODE_OUTPUT_UNWRITABLE,
+        hint_human=msg.H_OUTPUT_UNWRITABLE,
+        hint_agent=msg.A_OUTPUT_UNWRITABLE.format(prog=_prog(), reason=reason),
+        details={"path": path, "reason": reason},
+    )
+
+
+def _stdout_unwritable(exc: OSError) -> SpeakCodedError:
+    """stdout failed (not EPIPE): silence fd 1 first, so the envelope goes
+    to stderr only and the flush at exit can't fail again."""
+    _silence_stdout()
+    return _output_unwritable(exc, path="-")
+
+
+class _NoAudio(Exception):
+    """The stream ended without a single audio byte."""
+
+
+# Raised by an AudioFile; they pass through the "request failed" handlers.
+_SINK_ERRORS = (sinks.Exists, sinks.WriteFailed, sinks.ReaderGone)
+
+# Values of `speak -o` that are output formats, not file names.
+_FORMAT_WORDS = ("json", "yaml", "text", "table", "csv")
+
+# Root -o values: the formats a corrected command line can actually use.
+_ROOT_FORMATS = ("json", "yaml", "table", "csv")
+
+# Root options that take a value, used when no Click context is available.
+_ROOT_VALUE_OPTS = frozenset(
+    {"--config", "-c", "--profile", "-p", "--base-url", "--api-key", "--output", "-o"}
+)
+
+_deprecation_shown = False
+
+
+def _argv() -> list[str]:
+    """The user's arguments after the program name (a seam for tests)."""
+    return list(sys.argv[1:])
+
+
+def _root_value_opts() -> frozenset[str]:
+    """Root options that take a value, from the running root command."""
+    ctx = click.get_current_context(silent=True)
+    if ctx is None:
+        return _ROOT_VALUE_OPTS
+    opts: set[str] = set()
+    for param in ctx.find_root().command.params:
+        if isinstance(param, click.Option) and (param.is_flag or param.count):
+            continue
+        opts.update(param.opts)
+        opts.update(param.secondary_opts)
+    return frozenset(opts)
+
+
+def _split_argv(argv: list[str], command: str) -> tuple[list[str], list[str]] | None:
+    """Split argv into (root options, command arguments), or ``None``."""
+    value_opts = _root_value_opts()
+    i = 0
+    while i < len(argv):
+        token = argv[i]
+        if token == command:
+            return argv[:i], argv[i + 1 :]
+        if token == "--" or not token.startswith("-"):
+            return None
+        if token in value_opts:
+            i += 2
+            continue
+        if not token.startswith("--"):
+            # A cluster such as -qo: a value letter takes the rest of the
+            # token, or the next one when it is last.
+            for j, letter in enumerate(token[1:]):
+                if f"-{letter}" in value_opts:
+                    if j == len(token) - 2:
+                        i += 1
+                    break
+        i += 1
+    return None
+
+
+def _drop_output(args: list[str]) -> list[str]:
+    """``args`` without -o/--output and its value."""
+    kept: list[str] = []
+    i = 0
+    while i < len(args):
+        token = args[i]
+        if token == "--":
+            kept.extend(args[i:])
+            break
+        if token in ("-o", "--output"):
+            i += 2
+            continue
+        if token.startswith("--output=") or (
+            token.startswith("-o") and not token.startswith("--")
+        ):
+            i += 1
+            continue
+        kept.append(token)
+        i += 1
+    return kept
+
+
+def _secret_bearing(tokens: list[str]) -> bool:
+    """True when argv holds a key or a URL with userinfo or a query."""
+    for token in tokens:
+        if token in ("--api-key", "-k") or token.startswith("--api-key="):
+            return True
+        if token.startswith("-k") and not token.startswith("--"):
+            return True
+        if "://" in token:
+            try:
+                parts = urlsplit(token)
+            except ValueError:
+                return True
+            if parts.username or parts.password or parts.query:
+                return True
+    return False
+
+
+def _next_step(tokens: list[str]) -> str | None:
+    """A command line runnable verbatim, or ``None``."""
+    if _secret_bearing(tokens):
+        return None
+    for token in tokens:
+        if token.startswith("=") or (
+            token.startswith("<") and token.endswith(">") and token[1:-1].isupper()
+        ):
+            return None
+    line = shlex.join(tokens)
+    if os.name == "nt" and line != " ".join(tokens):
+        return None
+    if shlex.join(shlex.split(line)) != line or tokens[:1] == ["sudo"]:
+        return None
+    return line
+
+
+def _proposed_out_file(
+    *, is_flux: bool, encoding: str | None, container: str | None
+) -> str:
+    """A new file name in the cwd for next_step: never an existing file."""
+    ext = _play_suffix(is_flux=is_flux, encoding=encoding, container=container)
+    while True:
+        stamp = datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%SZ")
+        name = f"speech-{stamp}-{secrets.token_hex(2)}{ext}"
+        if not os.path.lexists(name):
+            return name
+
+
+def _deprecate_output() -> None:
+    """The one DEPRECATED line for speak -o/--output FILE, even under -q."""
+    global _deprecation_shown
+    if _deprecation_shown:
+        return
+    _deprecation_shown = True
+    text = msg.D_SPEAK_OUTPUT.format(prog=_prog())
+    if _agentic:
+        stderr_console.print(f"DEPRECATED: {escape(text)}", soft_wrap=True)
+    else:
+        stderr_console.print(
+            f"[yellow]⚠[/yellow] Deprecated: {escape(text)}", soft_wrap=True
+        )
+
+
+class _Terminated(BaseException):
+    """SIGTERM or SIGHUP arrived mid-stream: unwind so a partial file
+    or temp file is removed, then end by that signal."""
+
+    def __init__(self, signum: int) -> None:
+        super().__init__(signum)
+        self.signum = signum
+
+
+#: How long a signalled run may take to unwind before the signal is
+#: delivered again and ends it. This timer is how a Flux run ends after a
+#: signal when the server doesn't answer the closing handshake: the SDK
+#: waits up to 10 s for it in the main thread. A close still waiting in
+#: ``finally`` is cut short the same way. SIGTERM and SIGHUP then end at
+#: once; Ctrl-C runs the usual cancel path, so it ends a little later.
+#: Both stay well inside the 2.6 s a signalled run may take to exit.
+_SIGNAL_GRACE_S = 1.5
+
+
+def _end_by_signal(signum: int) -> None:
+    """End the process by ``signum`` (POSIX); on Windows, exit 128+N."""
+    if os.name == "nt":
+        raise SystemExit(128 + signum)
+    _die_by_signal(signum)
+
+
+@contextmanager
+def _terminate_cleanly(cleanup: Callable[[], None]) -> Iterator[None]:
+    """For the duration of a request and stream:
+
+    - SIGTERM and SIGHUP raise :class:`_Terminated` in the main thread
+      instead of killing the process before ``cleanup`` can run;
+    - SIGINT raises ``KeyboardInterrupt`` as before.
+
+    Unwinding can stall in a WebSocket closing handshake the server doesn't
+    answer. So the first signal also arms a timer: if the run is still here
+    after ``_SIGNAL_GRACE_S``, the signal is delivered again, and a second
+    signal runs ``cleanup`` and ends the run: SIGINT by ``KeyboardInterrupt``
+    again (the usual cancel message, exit 2, exit handlers run; a hard exit
+    follows only if that unwind stalls too), SIGTERM and SIGHUP by the signal
+    itself. A double Ctrl-C after the guard has exited is the default
+    handler's: exit by SIGINT (130), as before.
+
+    Signals that arrive during a file critical section are deferred (see
+    ``sinks.critical_section``); the most severe is delivered after it.
+
+    A signal is left exactly as it was when its handler isn't ours to
+    replace:
+
+    - ``SIG_IGN`` (nohup ignores SIGHUP, a background job in a script starts
+      with SIGINT ignored, ``trap '' TERM``): the run keeps going, as 0.4.0
+      did, and the file is completed;
+    - a handler not installed from Python (``signal.getsignal`` returns
+      ``None``): ``signal.signal`` can't put it back afterwards, so it is
+      not replaced at all.
+
+    On exit the guard is closed first (its handler then only records a
+    signal, and the timer sends nothing more), the signals are blocked where
+    ``pthread_sigmask`` exists, the previous handlers are restored and the
+    timers cancelled, the mask is restored, and a signal recorded meanwhile
+    is raised again through the restored handler. The guard is closed before
+    the mask call because that call itself runs pending handlers.
+    """
+    if threading.current_thread() is not threading.main_thread():
+        yield
+        return
+    first: list[int] = []
+    timers: list[threading.Timer] = []
+    closed: list[bool] = []
+    late: list[int] = []
+    sent: list[int] = []  # re-deliveries the timer made
+    lock = threading.Lock()
+
+    def redeliver(signum: int) -> None:
+        # Under the lock, so nothing is sent once the guard is closing.
+        with lock:
+            if closed:
+                return
+            sent.append(signum)
+            _send_to_main(signum)
+
+    def arm(delay: float, action: Callable[..., None], *args: Any) -> None:
+        timer = threading.Timer(delay, action, args)
+        timer.daemon = True
+        timer.start()
+        timers.append(timer)
+
+    @_coalescing  # a signal while this runs is coalesced (core, as for main)
+    def handler(signum: int, _frame: Any) -> None:
+        if signum in sent:
+            sent.remove(signum)
+            if closed:
+                return  # our own re-delivery, arriving late: drop it
+        elif closed:
+            late.append(signum)
+            return
+        if _defer_in_importlib(signum, _frame):
+            return  # raising inside importlib could leave its lock held
+        if sinks.defer_signal(signum):
+            return  # creating, committing or removing the file
+        if first:
+            # Second signal, or the timer: stop waiting for the stream.
+            cleanup()
+            decisive = sinks.most_severe([first[0], signum]) or signum
+            if decisive == signal.SIGINT:
+                # Unwind again from wherever the stall is; if that stalls
+                # too, end without waiting any longer.
+                arm(_SIGNAL_GRACE_S, os._exit, 2)
+                raise KeyboardInterrupt
+            _end_by_signal(decisive)
+        first.append(signum)
+        arm(_SIGNAL_GRACE_S, redeliver, signum)
+        if signum == signal.SIGINT:
+            raise KeyboardInterrupt
+        raise _Terminated(signum)
+
+    handler._deepctl_defers = True  # type: ignore[attr-defined]
+
+    previous: dict[int, Any] = {}
+    for name in ("SIGINT", "SIGTERM", "SIGHUP"):
+        sig = getattr(signal, name, None)
+        if sig is None:
+            continue
+        current = signal.getsignal(sig)
+        if current is signal.SIG_IGN or current is None:
+            continue
+        try:
+            signal.signal(sig, handler)
+        except (OSError, ValueError):
+            continue
+        previous[sig] = current
+    try:
+        yield
+    finally:
+        with lock:
+            closed.append(True)
+        blocked = None
+        if hasattr(signal, "pthread_sigmask"):
+            with suppress(OSError, ValueError):
+                blocked = signal.pthread_sigmask(signal.SIG_BLOCK, set(previous))
+        try:
+            sinks.restore_handlers(previous)
+        finally:
+            for timer in timers:
+                timer.cancel()
+            if blocked is not None:
+                signal.pthread_sigmask(signal.SIG_SETMASK, blocked)
+            if late:
+                again = sinks.most_severe(late)
+                late.clear()
+                if again is not None:
+                    signal.raise_signal(again)
+
+
+@dataclass
+class _Plan:
+    """What the pre-request checks decided."""
+
+    target: sinks.Target | None = None
+
+
 def _fail(message: str) -> BaseResult:
     """An error result whose message the user actually sees.
 
@@ -361,6 +795,25 @@ def timing(self) -> str:
         return f"first audio {fa}, {time.monotonic() - self._start:.1f}s total"
 
 
+def _speak_result(
+    audio_file: sinks.AudioFile | None,
+    *,
+    model: str,
+    bytes_written: int,
+    played: bool = False,
+) -> SpeakResult:
+    """The 0.4.0 ``SpeakResult`` (unchanged keys, including ``played``)."""
+    path = audio_file.path if audio_file is not None else ""
+    return SpeakResult(
+        status="success",
+        message=f"Audio saved to {path}" if path else f"Played {bytes_written:,} bytes",
+        output_path=path,
+        model=model,
+        bytes_written=bytes_written,
+        played=played,
+    )
+
+
 class SpeakCommand(BaseCommand):
     """Command for generating speech from text using Deepgram TTS."""
 
@@ -380,26 +833,30 @@ class SpeakCommand(BaseCommand):
         'dg speak "Hello from Deepgram" --play',
         "dg speak --list-voices",
         'dg speak "Hello world"',
-        'dg speak "Hello world" -o hello.wav',
-        'dg speak "Hello world" -o hello.wav --play',
-        "dg speak --file message.txt -o output.wav",
+        'dg speak "Hello world" --out-file hello.wav',
+        'dg speak "Hello world" --out-file hello.wav --play',
+        "dg speak --file message.txt --out-file output.wav",
         'dg speak "Hello" | ffplay -loglevel error -nodisp -autoexit -',
         # Flux TTS streaming controls: --speed (0.85-1.15) and beta
         # --expressivity (-2..2, default 0).
-        'dg speak "A little slower, please" --speed 0.9 -o slow.wav',
-        'dg speak "So exciting!" --expressivity 2 -o lively.wav  # beta; default: 0',
+        'dg speak "A little slower, please" --speed 0.9 --out-file slow.wav',
+        'dg speak "So exciting!" --expressivity 2 --out-file lively.wav  # beta; default: 0',
         # Aura (Speak v1, batch REST) — opt in with -m aura-*; needed for
         # containerized formats like mp3.
-        'dg speak "Hello" -m aura-2-asteria-en -o hello.mp3',
-        'dg speak "Hello" -m aura-2-luna-en -o hello.wav --encoding linear16 --container wav',
-        'echo "Hello" | dg speak -o hello.mp3 -m aura-2-asteria-en',
+        'dg speak "Hello" -m aura-2-asteria-en --out-file hello.mp3',
+        'dg speak "Hello" -m aura-2-luna-en --out-file hello.wav --encoding linear16 --container wav',
+        'echo "Hello" | dg speak - --out-file hello.mp3 -m aura-2-asteria-en',
         # Aura-2 Spanish voice (run `dg models` for the full list).
-        'dg speak "Hola, mundo" -m aura-2-selena-es -o hola.mp3',
+        'dg speak "Hola, mundo" -m aura-2-selena-es --out-file hola.mp3',
     ]
     agent_help = (
         "Convert text to speech using Deepgram's TTS API. "
-        "Text can be provided as an argument, from a file, or piped via stdin. "
-        "Audio is written to a file (--output) or stdout for piping. "
+        "Text can be provided as an argument, from a file (--file), or from "
+        "stdin with - as the text (in agent mode, - is the only way to read "
+        "stdin). In agent mode, audio isn't written into a pipe: use "
+        "--out-file, --play, or redirect stdout to a file. "
+        "Audio is written to a file (--out-file; add --force to overwrite an "
+        "existing file) or stdout for piping. -o/--output FILE is deprecated. "
         "By default (flux-* models, e.g. flux-alexis-en) uses Flux TTS / Speak "
         "v2, streaming over WebSocket and emitting raw audio; linear16 output is "
         "wrapped in a WAV container so it is directly playable. Pass an aura-* "
@@ -416,14 +873,34 @@ def get_arguments(self) -> list[dict[str, Any]]:
         return [
             {
                 "name": "text",
-                "help": "Text to convert to speech",
+                "help": "Text to convert to speech, or - to read it from stdin",
                 "required": False,
                 "default": None,
             },
+            {
+                "names": ["--out-file"],
+                "help": (
+                    "Save the audio to FILE. An existing file isn't "
+                    "overwritten unless you add --force."
+                ),
+                "type": str,
+                "metavar": "FILE",
+                "is_option": True,
+            },
+            {
+                "names": ["--force"],
+                "help": "With --out-file, overwrite FILE if it already exists.",
+                "is_flag": True,
+                "is_option": True,
+            },
             {
                 "names": ["--output", "-o"],
-                "help": "Output file path (required if stdout is a terminal)",
+                "help": (
+                    "Deprecated: use --out-file. Saves the audio to FILE and "
+                    "overwrites it. In 1.0, -o will set the output format."
+                ),
                 "type": str,
+                "metavar": "FILE",
                 "is_option": True,
             },
             {
@@ -492,7 +969,8 @@ def get_arguments(self) -> list[dict[str, Any]]:
                 "names": ["--play"],
                 "help": (
                     "Play the audio through your system player (ffplay, afplay, "
-                    "paplay, or aplay). Can be combined with -o to save and play."
+                    "paplay, or aplay). Can be combined with --out-file to save "
+                    "and play."
                 ),
                 "is_flag": True,
                 "is_option": True,
@@ -505,15 +983,178 @@ def get_arguments(self) -> list[dict[str, Any]]:
             },
         ]
 
+    # ── Checks before the request ─────────────────────────────────────
+
+    _plan: _Plan | None = None
+
+    def pre_auth_check(self, config: Config, **kwargs: Any) -> Any | None:
+        """Refusals that need no request: they run
+        before authentication, so nothing is sent or billed."""
+        self._plan = None
+        planned = self._preflight(kwargs)
+        if isinstance(planned, SpeakCodedError):
+            return planned
+        self._plan = planned
+        return None
+
+    def _preflight(self, kwargs: dict[str, Any]) -> _Plan | SpeakCodedError:
+        if kwargs.get("list_voices"):
+            return _Plan()
+        out_file = kwargs.get("out_file") or None
+        legacy = kwargs.get("output") or None
+        prog = _prog()
+
+        if out_file and legacy:
+            return _coded(
+                msg.E_SPEAK_OUT_CONFLICT,
+                code=msg.CODE_INVALID_ARGUMENT,
+                hint_human=msg.H_SPEAK_OUT_CONFLICT,
+                hint_agent=msg.H_SPEAK_OUT_CONFLICT,
+                next_step=_next_step([prog, self.name, "--help"]),
+            )
+        if legacy and legacy.lower() == "text":
+            # Not a root format either: point at --out-file instead.
+            return _coded(
+                msg.E_SPEAK_O_TEXT.format(prog=prog),
+                code=msg.CODE_INVALID_ARGUMENT,
+                hint_human=msg.H_SPEAK_O_TEXT,
+                hint_agent=msg.H_SPEAK_O_TEXT,
+                next_step=self._o_format_next_step(prog, legacy, kwargs),
+            )
+        if legacy and legacy.lower() in _FORMAT_WORDS:
+            return _coded(
+                msg.E_SPEAK_O_FORMAT.format(prog=prog, value=legacy),
+                code=msg.CODE_INVALID_ARGUMENT,
+                hint_human=msg.H_SPEAK_O_FORMAT.format(prog=prog, value=legacy),
+                hint_agent=msg.H_SPEAK_O_FORMAT.format(prog=prog, value=legacy),
+                next_step=self._o_format_next_step(prog, legacy, kwargs),
+            )
+        agent = is_ai_agent()
+        text = kwargs.get("text")
+        if agent and not text and not kwargs.get("file"):
+            # Never block on a stdin that may never close; "-" opts in.
+            return _coded(
+                msg.E_SPEAK_NO_TEXT.format(prog=prog),
+                code=msg.CODE_INVALID_ARGUMENT,
+                hint_human=msg.H_SPEAK_NO_TEXT,
+                hint_agent=msg.H_SPEAK_NO_TEXT,
+                next_step=_next_step([prog, self.name, "--help"]),
+            )
+        if legacy:
+            _deprecate_output()
+
+        path = out_file or legacy
+        if not path:
+            if agent and not kwargs.get("play") and not sinks.stdout_takes_audio():
+                return self._no_output(prog, kwargs)
+            return _Plan()
+        planned = sinks.plan_target(
+            path, overwrite=bool(legacy) or bool(kwargs.get("force"))
+        )
+        if isinstance(planned, sinks.Refusal):
+            if planned.reason == "exists":
+                return _coded(
+                    msg.E_OUT_FILE_EXISTS.format(out_file=path, prog=prog),
+                    code=msg.CODE_INVALID_ARGUMENT,
+                    hint_human=msg.H_OUT_FILE_EXISTS,
+                    hint_agent=msg.H_OUT_FILE_EXISTS,
+                )
+            assert planned.error is not None
+            return _output_unwritable(planned.error, path=path)
+        if (
+            planned.kind == "stdout"
+            and get_output_format() in ("json", "yaml")
+            and format_source() == "explicit"
+        ):
+            # The audio is stdout's payload; there's no room for JSON.
+            fmt = get_output_format().upper()
+            return _coded(
+                msg.E_STDOUT_BYTES.format(
+                    prog=prog, command_path=self.name, format=fmt
+                ),
+                code=msg.CODE_INVALID_ARGUMENT,
+                hint_human=msg.H_STDOUT_BYTES.format(format=fmt),
+                hint_agent=msg.H_STDOUT_BYTES.format(format=fmt),
+                next_step=_next_step([prog, self.name, "--help"]),
+            )
+        return _Plan(target=planned)
+
+    def _no_output(self, prog: str, kwargs: dict[str, Any]) -> SpeakCodedError:
+        """Under a hard agent signal, audio bound for a pipe is refused;
+        ``next_step`` reruns the command with a new ``--out-file``."""
+        model = kwargs.get("model") or _DEFAULT_MODEL
+        out_file = _proposed_out_file(
+            is_flux=model.lower().startswith("flux-"),
+            encoding=kwargs.get("encoding"),
+            container=kwargs.get("container"),
+        )
+        # Text read from stdin can't be sent again by a rerun.
+        next_step = (
+            None
+            if kwargs.get("text") == "-"
+            else _next_step([prog, *_argv(), "--out-file", out_file])
+        )
+        hint = (
+            msg.A_SPEAK_NO_OUTPUT.format(out_file=out_file)
+            if next_step is not None
+            else msg.A_SPEAK_NO_OUTPUT_NULL.format(out_file=out_file)
+        )
+        return _coded(
+            msg.E_SPEAK_NO_OUTPUT.format(prog=prog),
+            code=msg.CODE_INVALID_ARGUMENT,
+            hint_human=msg.H_SPEAK_NO_OUTPUT,
+            hint_agent=hint,
+            next_step=next_step,
+        )
+
+    def _o_format_next_step(
+        self, prog: str, value: str, kwargs: dict[str, Any]
+    ) -> str | None:
+        """``{prog} {root_options} -o {value} speak {speak_args} --out-file
+        {out_file}``, or ``None`` when it can't be built safely. For
+        ``-o text``, which no command takes, the ``-o`` is dropped."""
+        text = value.lower() == "text"
+        if not text and value.lower() not in _ROOT_FORMATS:
+            return None
+        ctx = click.get_current_context(silent=True)
+        name = (ctx.info_name if ctx is not None else None) or self.name
+        split = _split_argv(_argv(), name)
+        if split is None:
+            return None
+        root, args = split
+        model = kwargs.get("model") or _DEFAULT_MODEL
+        out_file = _proposed_out_file(
+            is_flux=model.lower().startswith("flux-"),
+            encoding=kwargs.get("encoding"),
+            container=kwargs.get("container"),
+        )
+        return _next_step(
+            [
+                prog,
+                *_drop_output(root),
+                *(() if text else ("-o", value)),
+                name,
+                *_drop_output(args),
+                "--out-file",
+                out_file,
+            ]
+        )
+
+    # ── Run ───────────────────────────────────────────────────────────
+
     def handle(
         self,
         config: Config,
         auth_manager: AuthManager,
         client: DeepgramClient,
         **kwargs: Any,
-    ) -> BaseResult | None:
+    ) -> BaseResult | SpeakCodedError | None:
+        planned = self._plan if self._plan is not None else self._preflight(kwargs)
+        self._plan = None
+        if isinstance(planned, SpeakCodedError):
+            return planned
+
         text = kwargs.get("text")
-        output_path = kwargs.get("output")
         model = kwargs.get("model") or _DEFAULT_MODEL
         encoding = kwargs.get("encoding")
         container = kwargs.get("container")
@@ -523,13 +1164,17 @@ def handle(
         file_path = kwargs.get("file")
         play = kwargs.get("play", False)
         list_voices = kwargs.get("list_voices", False)
+        output_path = planned.target.path if planned.target else None
 
         # --list-voices: discover voices and exit before any TTS generation.
         if list_voices:
             return self._list_voices(client)
 
-        # Resolve text input: arg > --file > stdin
-        if not text and file_path:
+        # Resolve text input: arg > --file > stdin. "-" reads stdin in every
+        # mode (and is the only way to under a hard agent signal).
+        if text == "-":
+            text = sys.stdin.read().strip()
+        elif not text and file_path:
             path = Path(file_path)
             if not path.exists():
                 return _fail(f"File not found: {file_path}")
@@ -550,17 +1195,15 @@ def handle(
             player = _find_audio_player()
             if player is None:
                 return _fail(
-                    "No audio player found — install ffmpeg, or use -o to save a file."
+                    "No audio player found. Install ffmpeg, or save the audio "
+                    "with --out-file FILE."
                 )
 
         # If stdout is a TTY and there's nowhere for the audio to go, require an
         # explicit destination. --play satisfies that requirement.
         stdout_is_tty = sys.stdout.isatty()
         if not output_path and not play and stdout_is_tty:
-            return _fail(
-                "No output specified. Use -o/--output to save to a file, "
-                "--play to hear it, or pipe stdout."
-            )
+            return _fail(msg.NO_OUTPUT_TTY)
 
         # Only the documented flux-* namespace uses speak.v2. Aura and unknown
         # model names pass through to the REST API so the service can resolve them.
@@ -600,229 +1243,364 @@ def handle(
             # Playing sends the audio to the player, not to stdout, so a
             # redirect or pipe would otherwise collect nothing and give no
             # hint why.
-            console.print(
-                "[yellow]Note:[/yellow] --play sends the audio to your player, "
-                "so stdout stays empty. Add -o to save a file too."
+            print_warning(msg.PLAY_STDOUT_EMPTY, stderr=True, ignore_quiet=True)
+
+        audio_file = sinks.AudioFile(planned.target) if planned.target else None
+        if audio_file is not None and audio_file.is_stdout:
+            # stdout carries audio, so a failure is reported on stderr
+            # only, never as JSON after the audio.
+            self.stdout_is_protocol = True
+        try:
+            with _terminate_cleanly(
+                audio_file.abort if audio_file is not None else lambda: None
+            ):
+                try:
+                    result = self._speak(
+                        client,
+                        is_flux=is_flux,
+                        text=text,
+                        model=model,
+                        encoding=encoding,
+                        container=container,
+                        sample_rate=sample_rate,
+                        speed=speed,
+                        expressivity=expressivity,
+                        player=player,
+                        audio_file=audio_file,
+                    )
+                except BaseException:
+                    # Clean up while the guard is still installed, so a
+                    # second signal can't cut the removal short.
+                    if audio_file is not None:
+                        audio_file.abort()
+                    raise
+        except _Terminated as exc:
+            # The partial file or temp file is gone (an old file is kept);
+            # end by the signal itself.
+            _end_by_signal(exc.signum)
+            raise
+        except sinks.Exists:
+            # O_EXCL lost a race with another writer: nothing of ours exists.
+            return _coded(
+                msg.E_OUT_FILE_EXISTS.format(out_file=output_path, prog=_prog()),
+                code=msg.CODE_INVALID_ARGUMENT,
+                hint_human=msg.H_OUT_FILE_EXISTS,
+                hint_agent=msg.H_OUT_FILE_EXISTS,
             )
+        except sinks.WriteFailed as exc:
+            if audio_file is not None:
+                audio_file.abort()
+            if exc.stdout:
+                return _stdout_unwritable(exc.error)
+            assert audio_file is not None
+            return _output_unwritable(exc.error, path=audio_file.path)
+        except sinks.ReaderGone:
+            # Whoever read the pipe went away: stop quietly, like stdout.
+            if audio_file is not None and audio_file.is_stdout:
+                _silence_stdout()
+            return None
+        finally:
+            if audio_file is not None:
+                audio_file.abort()  # a no-op once the file was committed
+
+        if (
+            audio_file is not None
+            and audio_file.is_stdout
+            and isinstance(result, SpeakResult)
+            and result.status == "success"
+        ):
+            # The audio was stdout's payload, so the summary goes to
+            # stderr and no document follows it.
+            n = audio_file.bytes_written
+            if _agentic:
+                console.print(f"OK: Wrote {n:,} bytes to stdout", markup=False)
+            else:
+                console.print(f"[green]✓ Wrote {n:,} bytes to stdout[/green]")
+            return None
+        return result
 
+    def _speak(
+        self,
+        client: DeepgramClient,
+        *,
+        is_flux: bool,
+        text: str,
+        model: str,
+        encoding: str | None,
+        container: str | None,
+        sample_rate: float | None,
+        speed: float | None,
+        expressivity: int | None,
+        player: str | None,
+        audio_file: sinks.AudioFile | None,
+    ) -> BaseResult | SpeakCodedError | None:
         if is_flux:
-            # WebSocket streaming path. Streaming output is raw audio, so
-            # default to linear16 @ 24kHz and wrap it in WAV for playback.
-            # These paths raise (rather than returning an error result) so a
-            # failure exits non-zero and is visible in every output format —
-            # a returned error is only printed in structured output and still
-            # exits 0.
-            eff_encoding = encoding or "linear16"
-            if eff_encoding not in ("linear16", "mulaw", "alaw"):
-                raise click.ClickException(
-                    f"Encoding '{eff_encoding}' is not supported for Flux "
-                    "(Speak v2) streaming, which emits raw audio. Use "
-                    "linear16 (default), mulaw, or alaw."
-                )
-            eff_sample_rate = sample_rate or 24000.0
-
-            # A live spinner + byte counter + time-to-first-audio on stderr, so
-            # the stream is visibly arriving rather than a single static line.
-            prog = _StreamProgress(model)
-            stream = prog.track(
-                client.speak_text_stream(
-                    text=text,
+            return self._speak_flux(
+                client,
+                text=text,
+                model=model,
+                encoding=encoding,
+                sample_rate=sample_rate,
+                speed=speed,
+                expressivity=expressivity,
+                player=player,
+                audio_file=audio_file,
+            )
+        return self._speak_v1(
+            client,
+            text=text,
+            model=model,
+            encoding=encoding,
+            container=container,
+            sample_rate=sample_rate,
+            player=player,
+            audio_file=audio_file,
+        )
+
+    # ── Flux (Speak v2, WebSocket streaming) ──────────────────────────
+
+    def _speak_flux(
+        self,
+        client: DeepgramClient,
+        *,
+        text: str,
+        model: str,
+        encoding: str | None,
+        sample_rate: float | None,
+        speed: float | None,
+        expressivity: int | None,
+        player: str | None,
+        audio_file: sinks.AudioFile | None,
+    ) -> BaseResult | SpeakCodedError | None:
+        # Streaming output is raw audio, so default to linear16 @ 24kHz and
+        # wrap it in WAV for playback. These paths raise (rather than
+        # returning an error result) so a failure exits non-zero and is
+        # visible in every output format.
+        eff_encoding = encoding or "linear16"
+        if eff_encoding not in ("linear16", "mulaw", "alaw"):
+            raise click.ClickException(
+                f"Flux voices stream raw audio, so --encoding {eff_encoding} "
+                "isn't available. Use linear16 (the default), mulaw or alaw."
+            )
+        rate = int(sample_rate or 24000.0)
+
+        # A live byte counter + time-to-first-audio on stderr, so the stream
+        # is visibly arriving rather than a single static line.
+        prog = _StreamProgress(model)
+        raw = client.speak_text_stream(
+            text=text,
+            model=model,
+            encoding=eff_encoding,
+            sample_rate=float(rate),
+            speed=speed,
+            expressivity=expressivity,
+        )
+        stream = prog.track(raw)
+        try:
+            if player in _STDIN_PLAYER_ARGV and eff_encoding == "linear16":
+                assert player is not None
+                return self._flux_play_streaming(
+                    stream,
+                    prog,
+                    player=player,
+                    rate=rate,
+                    audio_file=audio_file,
                     model=model,
+                )
+            if audio_file is not None or player:
+                return self._flux_buffered(
+                    stream,
+                    prog,
+                    player=player,
+                    rate=rate,
                     encoding=eff_encoding,
-                    sample_rate=eff_sample_rate,
-                    speed=speed,
-                    expressivity=expressivity,
+                    audio_file=audio_file,
+                    model=model,
                 )
+            return self._flux_to_stdout(
+                stream,
+                prog,
+                header=(
+                    _streaming_wav_header(sample_rate=rate)
+                    if eff_encoding == "linear16"
+                    else b""
+                ),
             )
+        except click.ClickException:
+            raise
+        except _SINK_ERRORS:
+            raise
+        except Exception as e:
+            raise click.ClickException(f"Flux streaming failed: {e}")
+        finally:
+            _close(stream, raw)
 
-            # Flux linear16 into a stdin-reading player: stream it. The
-            # player gets the streaming WAV header before the first frame and
-            # then every frame as Flux emits it, so sound starts at
-            # first-audio latency instead of after the whole utterance — the
-            # same framing `dg speak | ffplay -` relies on.
-            if (
-                player is not None
-                and player in _STDIN_PLAYER_ARGV
-                and eff_encoding == "linear16"
-            ):
-                console.print(f"[blue]Playing audio ({player})...[/blue]")
-                pcm = bytearray()
-                saved_bytes = 0
-                player_gone = False
+    def _flux_play_streaming(
+        self,
+        stream: Iterator[bytes],
+        prog: _StreamProgress,
+        *,
+        player: str,
+        rate: int,
+        audio_file: sinks.AudioFile | None,
+        model: str,
+    ) -> BaseResult:
+        """Flux linear16 into a stdin-reading player, frame by frame.
+
+        The player gets the streaming WAV header before the first frame and
+        then every frame as Flux emits it, so sound starts at first-audio
+        latency — the same framing `dg speak | ffplay -` relies on. A file
+        gets the exact-length WAV once the stream ends; it is created on
+        the first frame.
+        """
+        console.print(f"[blue]Playing audio ({player})...[/blue]")
+        pcm = bytearray()
+        header = _streaming_wav_header(sample_rate=rate)
+        player_gone = False
+        with _player_stdin(player) as sink:
+            for chunk in stream:
+                if not chunk:
+                    continue
+                if audio_file is not None:
+                    audio_file.open()
+                    pcm.extend(chunk)
+                if player_gone:
+                    continue
                 try:
-                    with _player_stdin(player) as sink:
-                        wrote_header = False
-                        for chunk in stream:
-                            if not chunk:
-                                continue
-                            if output_path:
-                                pcm.extend(chunk)
-                            if player_gone:
-                                continue
-                            try:
-                                if not wrote_header:
-                                    sink.write(
-                                        _streaming_wav_header(
-                                            sample_rate=int(eff_sample_rate)
-                                        )
-                                    )
-                                    wrote_header = True
-                                sink.write(chunk)
-                                sink.flush()
-                            except BrokenPipeError:
-                                # The player exited first (ffplay's "q", for
-                                # instance). That is the user stopping
-                                # playback, not a failure — but keep draining
-                                # the stream so a -o file is still complete.
-                                player_gone = True
-
-                        if output_path and pcm:
-                            # Save before waiting on the player (that wait
-                            # happens on leaving this block), so stopping
-                            # playback still leaves the file behind. The file
-                            # gets a real, exact-length header rather than the
-                            # streaming placeholder the player was handed.
-                            audio_bytes = _pcm_to_wav(
-                                bytes(pcm), sample_rate=int(eff_sample_rate)
-                            )
-                            Path(output_path).write_bytes(audio_bytes)
-                            saved_bytes = len(audio_bytes)
-                except click.ClickException:
-                    raise
-                except Exception as e:
-                    raise click.ClickException(f"Flux streaming failed: {e}")
+                    if header:
+                        sink.write(header)
+                        header = b""
+                    sink.write(chunk)
+                    sink.flush()
+                except BrokenPipeError:
+                    # The player exited first (ffplay's "q"): the user
+                    # stopped playback, not a failure. With a file, keep
+                    # draining so it is complete; otherwise stop.
+                    player_gone = True
+                    if audio_file is None:
+                        break
+
+            if audio_file is not None and pcm:
+                # Save before waiting on the player (on leaving this block),
+                # so stopping playback still leaves the file behind.
+                audio_file.write(_pcm_to_wav(bytes(pcm), sample_rate=rate))
+                audio_file.commit()
+
+        if prog.total == 0:
+            raise click.ClickException(
+                "Deepgram returned no audio. Try again, or try another --model."
+            )
 
-                if prog.total == 0:
-                    raise click.ClickException(
-                        "Flux (Speak v2) streaming returned no audio."
-                    )
+        if audio_file is not None:
+            self._saved(audio_file, f"{prog.timing()}")
+        else:
+            console.print(
+                f"[green]✓ Played {prog.total:,} bytes[/green] ({prog.timing()})"
+            )
+        return _speak_result(
+            audio_file,
+            model=model,
+            bytes_written=(audio_file.bytes_written if audio_file else 0) or prog.total,
+            played=True,
+        )
 
-                if output_path:
-                    console.print(
-                        f"[green]Audio saved to {output_path}[/green] "
-                        f"({saved_bytes:,} bytes — {prog.timing()})"
-                    )
-                else:
-                    console.print(
-                        f"[green]✓ Played {prog.total:,} bytes[/green] "
-                        f"({prog.timing()})"
-                    )
-                return SpeakResult(
-                    status="success",
-                    message=(
-                        f"Audio saved to {output_path}"
-                        if output_path
-                        else f"Played {prog.total:,} bytes"
-                    ),
-                    output_path=output_path or "",
-                    model=model,
-                    bytes_written=saved_bytes or prog.total,
-                    played=True,
-                )
+    def _flux_buffered(
+        self,
+        stream: Iterator[bytes],
+        prog: _StreamProgress,
+        *,
+        player: str | None,
+        rate: int,
+        encoding: str,
+        audio_file: sinks.AudioFile | None,
+        model: str,
+    ) -> BaseResult:
+        """Flux into a file and/or afplay: both need the whole utterance.
+
+        A WAV file declares its data length in the header, known only once
+        the stream ends, and afplay is handed a complete file. The file is
+        still created when the first frame arrives.
+        """
+        pcm = bytearray()
+        for chunk in stream:
+            if chunk and audio_file is not None:
+                audio_file.open()
+            pcm.extend(chunk)
 
-            if output_path or player:
-                # Saving, or playing through afplay (which has no stdin mode),
-                # needs the full utterance: a WAV file must declare its data
-                # length in the header (known only once the stream ends), and
-                # afplay is handed a complete file. So buffer, then wrap once
-                # and reuse for both sinks.
-                pcm = bytearray()
-                try:
-                    for chunk in stream:
-                        pcm.extend(chunk)
-                except click.ClickException:
-                    raise
-                except Exception as e:
-                    raise click.ClickException(f"Flux streaming failed: {e}")
-
-                if not pcm:
-                    # No audio means the stream errored upstream or returned
-                    # nothing. Wrapping empty PCM yields a valid header-only
-                    # WAV, so guard rather than report success on a silent file.
-                    raise click.ClickException(
-                        "Flux (Speak v2) streaming returned no audio."
-                    )
+        if not pcm:
+            # Wrapping empty PCM yields a valid header-only WAV, so guard
+            # rather than report success on a silent file.
+            raise click.ClickException(
+                "Deepgram returned no audio. Try again, or try another --model."
+            )
 
-                if eff_encoding == "linear16":
-                    audio_bytes = _pcm_to_wav(
-                        bytes(pcm), sample_rate=int(eff_sample_rate)
-                    )
-                else:
-                    audio_bytes = bytes(pcm)
-
-                total_bytes = len(audio_bytes)
-                if output_path:
-                    Path(output_path).write_bytes(audio_bytes)
-                    console.print(
-                        f"[green]Audio saved to {output_path}[/green] "
-                        f"({total_bytes:,} bytes — {prog.timing()})"
-                    )
+        if encoding == "linear16":
+            audio_bytes = _pcm_to_wav(bytes(pcm), sample_rate=rate)
+        else:
+            audio_bytes = bytes(pcm)
 
-                if player:
-                    suffix = _play_suffix(
-                        is_flux=True, encoding=eff_encoding, container=None
-                    )
-                    console.print(f"[blue]Playing audio ({player})...[/blue]")
-                    _play_audio(player, audio_bytes, suffix=suffix)
-
-                return SpeakResult(
-                    status="success",
-                    message=(
-                        f"Audio saved to {output_path}"
-                        if output_path
-                        else f"Played {total_bytes:,} bytes"
-                    ),
-                    output_path=output_path or "",
-                    model=model,
-                    bytes_written=total_bytes,
-                    played=bool(player),
-                )
+        if audio_file is not None:
+            audio_file.write(audio_bytes)
+            audio_file.commit()
+            self._saved(audio_file, prog.timing())
 
-            # Pipe path — write each chunk to stdout as it arrives so a
-            # downstream player starts on the first frame (the point of
-            # "streaming by default"). For linear16 we emit a streaming WAV
-            # header before the first frame so `| ffplay -` plays with no
-            # extra flags; raw mulaw/alaw stream as-is.
-            out = sys.stdout.buffer
-            wrote_header = False
-            try:
-                for chunk in stream:
-                    if not chunk:
-                        continue
-                    if eff_encoding == "linear16" and not wrote_header:
-                        out.write(
-                            _streaming_wav_header(sample_rate=int(eff_sample_rate))
-                        )
-                        wrote_header = True
-                    out.write(chunk)
-                    out.flush()
-            except click.ClickException:
-                raise
-            except Exception as e:
-                raise click.ClickException(f"Flux streaming failed: {e}")
-
-            if prog.total == 0:
-                # Guard before anything is written: the header is only emitted
-                # on the first frame, so a no-audio stream writes nothing.
-                raise click.ClickException(
-                    "Flux (Speak v2) streaming returned no audio."
-                )
+        if player:
+            suffix = _play_suffix(is_flux=True, encoding=encoding, container=None)
+            console.print(f"[blue]Playing audio ({player})...[/blue]")
+            _play_audio(player, audio_bytes, suffix=suffix)
 
-            console.print(
-                f"[green]✓ Streamed {prog.total:,} bytes to stdout[/green] "
-                f"({prog.timing()})"
+        return _speak_result(
+            audio_file, model=model, bytes_written=len(audio_bytes), played=bool(player)
+        )
+
+    def _flux_to_stdout(
+        self, stream: Iterator[bytes], prog: _StreamProgress, *, header: bytes
+    ) -> SpeakCodedError | None:
+        """Pipe path: each frame goes to stdout as it arrives, after the
+        streaming WAV header for linear16 (so `| ffplay -` plays with no
+        extra flags); raw mulaw/alaw stream as-is."""
+        _, outcome = self._stream_to_stdout(stream, header=header)
+        if outcome is not True:
+            # The reader went away (quiet, exit 0) or stdout failed.
+            return outcome or None
+
+        if prog.total == 0:
+            # The header is only emitted on the first frame, so a no-audio
+            # stream wrote nothing.
+            raise click.ClickException(
+                "Deepgram returned no audio. Try again, or try another --model."
             )
-            # Return None so the framework skips output_result: in agentic/CI
-            # (or --output json) mode it would serialize the result to the
-            # stdout console — i.e. append JSON to the audio we just streamed,
-            # corrupting a `> out.wav` redirect. The summary above already went
-            # to the stderr console.
-            return None
 
-        # REST path (Speak v1, including Aura and unknown-model pass-through).
-        try:
-            console.print(f"[blue]Generating speech with {model}...[/blue]")
+        console.print(
+            f"[green]✓ Streamed {prog.total:,} bytes to stdout[/green] "
+            f"({prog.timing()})"
+        )
+        # Return None so the framework skips output_result: in agentic/CI
+        # (or --output json) mode it would serialize the result to the
+        # stdout console — i.e. append JSON to the audio we just streamed,
+        # corrupting a `> out.wav` redirect.
+        return None
+
+    # ── Speak v1 (REST) ───────────────────────────────────────────────
 
+    def _speak_v1(
+        self,
+        client: DeepgramClient,
+        *,
+        text: str,
+        model: str,
+        encoding: str | None,
+        container: str | None,
+        sample_rate: float | None,
+        player: str | None,
+        audio_file: sinks.AudioFile | None,
+    ) -> BaseResult | SpeakCodedError | None:
+        """Speak v1, including Aura and unknown-model pass-through. Each
+        chunk goes on as the SDK yields it: to stdout (flushed), to a
+        stdin-reading player, and to the file, so none of them waits for
+        the whole utterance."""
+        console.print(f"[blue]Generating speech with {model}...[/blue]")
+        try:
             audio_iter = client.speak_text(
                 text=text,
                 model=model,
@@ -830,89 +1608,229 @@ def handle(
                 container=container,
                 sample_rate=sample_rate,
             )
+        except Exception as e:
+            raise click.ClickException(f"Error generating speech: {e}")
 
-            total_bytes = 0
-
-            if player:
-                # Playback needs the full utterance, so buffer it. When -o is
-                # also given, save the same bytes to the file too.
-                audio = bytearray()
-                for chunk in audio_iter:
-                    audio.extend(chunk)
-                audio_bytes = bytes(audio)
-                total_bytes = len(audio_bytes)
-
-                if not audio_bytes:
-                    return _fail("TTS returned no audio.")
-
-                if output_path:
-                    Path(output_path).write_bytes(audio_bytes)
-                    console.print(
-                        f"[green]Audio saved to {output_path}[/green] "
-                        f"({total_bytes:,} bytes)"
-                    )
-
-                suffix = _play_suffix(
-                    is_flux=False, encoding=encoding, container=container
-                )
-                console.print(f"[blue]Playing audio ({player})...[/blue]")
-                _play_audio(player, audio_bytes, suffix=suffix)
-
-                message = (
-                    f"Audio saved to {output_path}"
-                    if output_path
-                    else f"Played {total_bytes:,} bytes"
-                )
-                return SpeakResult(
-                    status="success",
-                    message=message,
-                    output_path=output_path or "",
-                    model=model,
-                    bytes_written=total_bytes,
-                    played=True,
-                )
-            elif output_path:
-                # Write to file
-                out = Path(output_path)
-                with open(out, "wb") as f:
-                    for chunk in audio_iter:
-                        f.write(chunk)
-                        total_bytes += len(chunk)
-
-                console.print(
-                    f"[green]Audio saved to {output_path}[/green] ({total_bytes:,} bytes)"
+        try:
+            if player in _STDIN_PLAYER_ARGV:
+                assert player is not None
+                return self._v1_play_streaming(
+                    audio_iter, player=player, audio_file=audio_file, model=model
                 )
-
-                return SpeakResult(
-                    status="success",
-                    message=f"Audio saved to {output_path}",
-                    output_path=output_path,
+            if player:
+                return self._v1_play_buffered(
+                    audio_iter,
+                    player=player,
+                    audio_file=audio_file,
                     model=model,
-                    bytes_written=total_bytes,
+                    encoding=encoding,
+                    container=container,
                 )
-            else:
-                # Write to stdout (piping)
-                stdout_buffer = sys.stdout.buffer
+            if audio_file is not None:
                 for chunk in audio_iter:
-                    stdout_buffer.write(chunk)
-                    total_bytes += len(chunk)
-                stdout_buffer.flush()
+                    audio_file.write(chunk)
+                if not audio_file.bytes_written:
+                    return _fail(
+                        "Deepgram returned no audio. Try again, or try another --model."
+                    )
+                audio_file.commit()
+                self._saved(audio_file)
+                return _speak_result(
+                    audio_file, model=model, bytes_written=audio_file.bytes_written
+                )
 
-                console.print(f"[green]✓ Wrote {total_bytes:,} bytes to stdout[/green]")
-                # Return None so the framework skips output_result — otherwise
-                # agentic/CI (or --output json) mode serializes JSON onto the
-                # same stdout as the audio, corrupting a `> out` redirect. The
-                # summary above went to the stderr console.
-                return None
+            total_bytes, outcome = self._stream_to_stdout(audio_iter)
+            if outcome is not True:
+                # The reader went away (quiet, exit 0) or stdout failed.
+                return outcome or None
+            console.print(f"[green]✓ Wrote {total_bytes:,} bytes to stdout[/green]")
+            # Return None so the framework skips output_result — otherwise
+            # agentic/CI (or --output json) mode serializes JSON onto the
+            # same stdout as the audio, corrupting a `> out` redirect.
+            return None
 
         except click.ClickException:
             raise
+        except _SINK_ERRORS:
+            raise
         except Exception as e:
             # Raise (not return an error result) so the failure exits non-zero
             # in every output mode — a returned BaseResult is only printed and
             # still exits 0. Reachable now that unknown models (e.g. a bare
             # "flux" typo) route here instead of the raising v2 path.
             raise click.ClickException(f"Error generating speech: {e}")
+        finally:
+            _close(audio_iter)
+
+    def _stream_to_stdout(
+        self, stream: Iterator[bytes], *, header: bytes = b""
+    ) -> tuple[int, SpeakCodedError | bool]:
+        """Write each chunk to stdout and flush it as it arrives.
+
+        ``header`` goes out just before the first chunk, so a stream with no
+        audio writes nothing. Returns the audio bytes written and ``True``
+        when the stream ran to its end; ``False`` when the reader of stdout
+        went away (EPIPE: fd 1 now points at the null device and the caller
+        ends quietly); or the ``output_unwritable`` envelope when the write
+        failed (ENOSPC, EIO, ...). Errors from the stream itself propagate.
+        """
+        out = sys.stdout.buffer
+        total = 0
+        for chunk in stream:
+            if not chunk:
+                continue
+            # stdout now carries audio: a later failure is reported on
+            # stderr only, never as JSON after the audio.
+            self.stdout_is_protocol = True
+            try:
+                if header:
+                    out.write(header)
+                    header = b""
+                out.write(chunk)
+                out.flush()
+            except BrokenPipeError:
+                _silence_stdout()
+                return total, False
+            except OSError as exc:
+                return total, _stdout_unwritable(exc)
+            total += len(chunk)
+        return total, True
+
+    def _v1_play_streaming(
+        self,
+        audio_iter: Iterator[bytes],
+        *,
+        player: str,
+        audio_file: sinks.AudioFile | None,
+        model: str,
+    ) -> BaseResult:
+        """Speak v1 into a stdin-reading player, chunk by chunk.
+
+        The player is started before the request, so sound starts as the
+        first chunk arrives. With a file, every chunk also goes there.
+        """
+        console.print(f"[blue]Playing audio ({player})...[/blue]")
+        total = 0
+        player_gone = False
+        try:
+            with _player_stdin(player) as sink:
+                for chunk in audio_iter:
+                    if not chunk:
+                        continue
+                    total += len(chunk)
+                    if audio_file is not None:
+                        audio_file.write(chunk)
+                    if player_gone:
+                        continue
+                    try:
+                        sink.write(chunk)
+                        sink.flush()
+                    except BrokenPipeError:
+                        # The user stopped playback (ffplay's "q"). With a
+                        # file, keep draining so it is complete; otherwise
+                        # stop and close the response.
+                        player_gone = True
+                        if audio_file is None:
+                            break
+                if not total:
+                    # Kill the player rather than hand it an empty stream.
+                    raise _NoAudio
+                if audio_file is not None:
+                    # Before waiting on the player, so stopping playback
+                    # still leaves the file behind.
+                    audio_file.commit()
+        except _NoAudio:
+            return _fail(
+                "Deepgram returned no audio. Try again, or try another --model."
+            )
+
+        if audio_file is not None:
+            self._saved(audio_file)
+        return _speak_result(audio_file, model=model, bytes_written=total, played=True)
+
+    def _v1_play_buffered(
+        self,
+        audio_iter: Iterator[bytes],
+        *,
+        player: str,
+        audio_file: sinks.AudioFile | None,
+        model: str,
+        encoding: str | None,
+        container: str | None,
+    ) -> BaseResult:
+        """Speak v1 into a player that has no stdin mode (afplay).
+
+        It is handed a complete temp file, so the utterance is buffered; a
+        file still gets each chunk as it arrives.
+        """
+        audio = bytearray()
+        for chunk in audio_iter:
+            if audio_file is not None:
+                audio_file.write(chunk)
+            audio.extend(chunk)
+        audio_bytes = bytes(audio)
+
+        if not audio_bytes:
+            return _fail(
+                "Deepgram returned no audio. Try again, or try another --model."
+            )
+
+        if audio_file is not None:
+            audio_file.commit()
+            self._saved(audio_file)
+
+        suffix = _play_suffix(is_flux=False, encoding=encoding, container=container)
+        console.print(f"[blue]Playing audio ({player})...[/blue]")
+        _play_audio(player, audio_bytes, suffix=suffix)
+
+        return _speak_result(
+            audio_file, model=model, bytes_written=len(audio_bytes), played=True
+        )
+
+    @staticmethod
+    def _saved(audio_file: sinks.AudioFile, timing: str = "") -> None:
+        """The stderr summary for a saved file (none for stdout)."""
+        if audio_file.is_stdout:
+            return
+        extra = f" — {timing}" if timing else ""
+        console.print(
+            f"[green]Audio saved to {escape(audio_file.path)}[/green] "
+            f"({audio_file.bytes_written:,} bytes{extra})"
+        )
+
+    # ── Result on stdout ──────────────────────────────────────────────
+
+    #: Writing the result to stdout failed; the run exits 1.
+    _output_failed: bool = False
+
+    def output_result(self, result: Any, config: Config) -> None:
+        """Write the result; a stdout that can't take it is
+        ``output_unwritable`` (exit 1), never an exit-time "Exception
+        ignored"."""
+        try:
+            super().output_result(result, config)
+            if result is not None:
+                sys.stdout.flush()
+        except BrokenPipeError:
+            _silence_stdout()
+        except SystemExit as exc:
+            # rich handles EPIPE itself: it points stdout at the null device
+            # and raises SystemExit(1). The reader went away, which ends the
+            # run quietly with 0, as the streaming paths do.
+            if not isinstance(exc.__context__, BrokenPipeError):
+                raise
+            _silence_stdout()
+        except OSError as exc:
+            _silence_stdout()
+            if isinstance(result, SpeakCodedError):
+                return  # already reported on stderr; it exits 1 anyway
+            _output_unwritable(exc, path="-")
+            self._output_failed = True
+
+    def exit_code_for(self, result: Any) -> int:
+        if self._output_failed:
+            return 1
+        return super().exit_code_for(result)
 
     def _list_voices(self, client: DeepgramClient) -> BaseResult:
         """List available TTS voices as a table (mirrors `dg models`)."""
diff --git a/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/messages.py b/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/messages.py
new file mode 100644
index 00000000..0e0313fa
--- /dev/null
+++ b/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/messages.py
@@ -0,0 +1,96 @@
+"""User-facing strings for ``dg speak``, keyed by message ID.
+
+Every ID and string matches the error catalogue (``error_codes.json``)
+exactly; the attribute name is the ID with ``-`` as ``_``.
+"""
+
+from __future__ import annotations
+
+# ── Catalogue ──────────────────────────────────────────────────────────────
+
+CODE_INVALID_ARGUMENT = "invalid_argument"
+CODE_OUTPUT_UNWRITABLE = "output_unwritable"
+
+# output_unwritable: a write to stdout or the audio file failed.
+# {reason} is details.reason: an OS error text or one of dg's own (sinks.py).
+E_OUTPUT_UNWRITABLE = "Couldn't write the output to {output}: {reason}."
+H_OUTPUT_UNWRITABLE = (
+    "Choose another destination, or fix this one (free space, permissions), "
+    "then try again."
+)
+A_OUTPUT_UNWRITABLE = (
+    "If you chose this destination, choose another one. Otherwise tell the "
+    "user {prog} couldn't write its output ({reason}), and don't retry until "
+    "it's fixed."
+)
+
+# invalid_argument: --out-file is stdout and -o json/yaml was asked for.
+# {format} is JSON or YAML.
+E_STDOUT_BYTES = (
+    "{prog} {command_path} would write the audio to stdout, so there's no room "
+    "for the {format} result."
+)
+H_STDOUT_BYTES = (
+    "Give --out-file a different file from stdout, or don't ask for {format} output."
+)
+
+# invalid_argument: a hard agent signal and audio bound for a pipe.
+E_SPEAK_NO_OUTPUT = "{prog} speak won't write audio into this pipe in agent mode."
+H_SPEAK_NO_OUTPUT = "Pass --out-file FILE to save the audio."
+A_SPEAK_NO_OUTPUT = "next_step saves the audio to {out_file}. Give the user that path."
+# next_step is null: the text came from stdin, or the command line can't be
+# repeated (it holds a key or a URL with credentials, or can't be quoted).
+A_SPEAK_NO_OUTPUT_NULL = (
+    "Run the same command again with --out-file {out_file} added. If the text "
+    "came from stdin, send it again the same way."
+)
+
+# invalid_argument: a hard agent signal and no text argument.
+E_SPEAK_NO_TEXT = (
+    "{prog} speak needs the text as an argument, or - to read it from stdin."
+)
+H_SPEAK_NO_TEXT = "Pass the text in quotes. To read it from stdin, pass - explicitly."
+
+# invalid_argument: --out-file names an existing file and --force is absent.
+E_OUT_FILE_EXISTS = "{out_file} already exists; {prog} won't overwrite it."
+H_OUT_FILE_EXISTS = "Choose a new file name, or pass --force to overwrite."
+
+# invalid_argument: speak -o given a bare output format.
+E_SPEAK_O_FORMAT = (
+    "{prog} speak -o is the audio file name, so -o {value} would write a file "
+    "named {value}."
+)
+H_SPEAK_O_FORMAT = (
+    "To choose the output format, put -o before the command: "
+    "{prog} -o {value} speak TEXT --out-file FILE."
+)
+
+# invalid_argument: speak -o text, which isn't a root format either.
+E_SPEAK_O_TEXT = "{prog} speak -o text would write the audio to a file named text."
+H_SPEAK_O_TEXT = (
+    "Pass --out-file FILE to save the audio. There's no text output format."
+)
+
+# invalid_argument: both -o/--output and --out-file.
+E_SPEAK_OUT_CONFLICT = (
+    "Use either --out-file or -o/--output for the audio file, not both."
+)
+H_SPEAK_OUT_CONFLICT = "Keep --out-file FILE and drop -o."
+
+# Deprecation notice for speak -o/--output FILE. Printed once per
+# process, on stderr, even under --quiet.
+D_SPEAK_OUTPUT = (
+    "{prog} speak -o/--output FILE will set the output format in 1.0. "
+    "Use --out-file FILE instead (add --force to overwrite, as -o does)."
+)
+
+# ── Legacy texts (0.4.x), now naming --out-file ────────────────────────────
+
+NO_OUTPUT_TTY = (
+    "No output specified. Use --out-file to save to a file, "
+    "--play to hear it, or pipe stdout."
+)
+PLAY_STDOUT_EMPTY = (
+    "--play sends the audio to your player, so stdout stays empty. "
+    "Add --out-file to save a file too."
+)
diff --git a/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/models.py b/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/models.py
index 45dcad25..c865da4d 100644
--- a/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/models.py
+++ b/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/models.py
@@ -2,7 +2,9 @@
 
 from __future__ import annotations
 
-from deepctl_core import BaseResult
+from typing import Any
+
+from deepctl_core import BaseResult, CodedErrorResult
 from pydantic import BaseModel, Field
 
 
@@ -23,3 +25,20 @@ class VoiceInfo(BaseModel):
 class SpeakVoicesResult(BaseResult):
     voices: list[VoiceInfo] = Field(default_factory=list)
     count: int = 0
+
+
+class SpeakCodedError(CodedErrorResult):
+    """A coded error from ``dg speak``, keys in the catalogue's order.
+
+    ``details`` is left out of the payload when there are none.
+    """
+
+    next_step: str | None = None
+    schema_version: int = 1
+    details: dict[str, Any] | None = None
+
+    def model_dump(self, **kwargs: Any) -> dict[str, Any]:
+        data = super().model_dump(**kwargs)
+        if data.get("details") is None:
+            data.pop("details", None)
+        return data
diff --git a/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/sinks.py b/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/sinks.py
new file mode 100644
index 00000000..a3f7ac41
--- /dev/null
+++ b/packages/deepctl-cmd-speak/src/deepctl_cmd_speak/sinks.py
@@ -0,0 +1,554 @@
+"""Where ``dg speak`` writes an audio file (``--out-file``, or the deprecated
+``-o/--output``).
+
+Two halves:
+
+- :func:`plan_target` runs **before the request**. It ``lstat``s the path
+  and decides how the file will be written, or why it can't be: an
+  existing regular file or symlink without ``--force`` (``exists``); a
+  directory, or a parent that is missing or unwritable (``unwritable``).
+- :class:`AudioFile` opens the file **when the first chunk arrives**, so a
+  failed request or an empty stream leaves nothing behind, and removes
+  whatever it created when the run fails.
+
+How a target is written (``Target.kind``):
+
+``new``      ``O_CREAT | O_EXCL``, mode 0666 & ~umask. ``O_EXCL`` is the
+             race guard behind the ``lstat`` check.
+``replace``  ``--force`` (or ``-o``) over an existing file or symlink: a
+             0600 temp file in the same directory, given the old file's
+             permission bits (never setuid, setgid or sticky; 0666 & ~umask
+             in place of a symlink) and ``os.replace``d
+             over the path at the end. A symlink is replaced, never written
+             through; a failed run leaves the old file. The result is a new
+             inode, so hard links to the old file keep the old bytes.
+``special``  a character device or FIFO (``/dev/null``, a named pipe):
+             no ``O_EXCL``, no ``--force``. It is opened **before** the
+             request, non-blocking (a FIFO with no reader is refused, not
+             waited on), and the opened file must be the one that was
+             checked, so a path swapped for a regular file is never
+             written. Block devices and sockets are refused.
+``stdout``   the same file as stdout (``--out-file /dev/stdout``, final
+             check): the audio goes to fd 1 and nothing else does. On
+             the first chunk fd 1 must still be the file that was checked;
+             the path is not opened again.
+
+Also refused before the request: the same file as stderr, where dg's own
+messages go, and ``--force`` over a /dev/fd or /proc/<pid>/fd entry.
+"""
+
+from __future__ import annotations
+
+import errno
+import os
+import re
+import signal
+import stat
+import sys
+import threading
+from contextlib import contextmanager
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+
+@dataclass(frozen=True)
+class Target:
+    path: str
+    kind: str  # "new" | "replace" | "special" | "stdout"
+    #: ``replace`` over a regular file: its permission bits, kept.
+    mode: int | None = None
+    #: ``special``: the descriptor opened and checked before the request.
+    fd: int | None = None
+    #: ``stdout``: (st_dev, st_ino) of the file that was checked.
+    ident: tuple[int, int] | None = None
+
+
+@dataclass(frozen=True)
+class Refusal:
+    """Why a target can't be written, decided before the request."""
+
+    reason: str  # "exists" | "unwritable"
+    error: OSError | None = None
+
+
+class Exists(Exception):
+    """The file appeared between the check and the open (``O_EXCL``)."""
+
+
+class WriteFailed(Exception):
+    """Writing the file (or stdout) failed; ``.error`` says why."""
+
+    def __init__(self, error: OSError, *, stdout: bool) -> None:
+        super().__init__(error)
+        self.error = error
+        self.stdout = stdout
+
+
+class ReaderGone(Exception):
+    """The reader of a pipe went away (EPIPE)."""
+
+
+def _stderr_stat() -> os.stat_result | None:
+    try:
+        return os.fstat(sys.stderr.fileno())
+    except Exception:
+        return None
+
+
+def stdout_stat() -> os.stat_result | None:
+    """``fstat`` of stdout, or ``None`` when it can't be read."""
+    try:
+        return os.fstat(sys.stdout.fileno())
+    except Exception:
+        return None
+
+
+def stdout_takes_audio() -> bool:
+    """True when stdout is a terminal, a regular file or the null device:
+    the destinations where agent mode still writes audio."""
+    out = stdout_stat()
+    if out is None:
+        return False
+    if stat.S_ISREG(out.st_mode):
+        return True
+    try:
+        if os.path.samestat(out, os.stat(os.devnull)):
+            return True
+        return os.isatty(sys.stdout.fileno())
+    except Exception:
+        return False
+
+
+def _oserror(code: int, path: str) -> OSError:
+    return OSError(code, os.strerror(code), path)
+
+
+def _read_umask() -> int:
+    """The process umask, read once when this module is imported.
+
+    Linux publishes it in /proc. Elsewhere (macOS) the only call that reads
+    it also sets it, so ``os.umask`` is used only while this is the sole
+    thread, which it is when the command module loads. If another thread
+    exists, the umask is measured instead: a throwaway file is created
+    with mode 0o777 and the bits the kernel removed are the umask.
+    """
+    try:
+        with open("/proc/self/status") as f:
+            for line in f:
+                if line.startswith("Umask:"):
+                    return int(line.split()[1], 8)
+    except (OSError, ValueError, IndexError):
+        pass
+    if threading.active_count() == 1:
+        mask = os.umask(0o022)
+        os.umask(mask)
+        return mask
+    import tempfile
+
+    probe = os.path.join(tempfile.gettempdir(), f".deepctl-umask-{os.getpid()}")
+    try:
+        fd = os.open(probe, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o777)
+        try:
+            return 0o777 & ~stat.S_IMODE(os.fstat(fd).st_mode)
+        finally:
+            os.close(fd)
+            os.unlink(probe)
+    except OSError:
+        return 0o022
+
+
+_UMASK = _read_umask()
+
+# The file types written as they are: character devices and FIFOs.
+# These follow "Couldn't write the output to FILE: " (details.reason).
+_NOT_SPECIAL = "it isn't a file, a pipe or a device like /dev/null"
+_CHANGED = "something replaced it before writing started"
+_STDERR = "it's stderr, which carries this command's messages"
+_FD_PATH = "--force can't replace a file descriptor path"
+_NO_READER = "no program is reading from that pipe"
+
+# Directories whose entries are open file descriptors: /dev/fd and
+# /proc/<pid>/fd. A temp file can't be created there, so --force can't
+# replace what they name.
+_FD_DIR = re.compile(r"/proc/(?:self|thread-self|\d+)(?:/task/\d+)?/fd")
+
+# ── Critical sections ───────────────────────────────────────────────────
+# Creating, committing and removing the file must not be cut short by a
+# signal, or a temp file or a 0-byte file could be left behind. Inside a
+# critical section (main thread only):
+#
+# - SIGINT, SIGTERM and SIGHUP are blocked for this thread with
+#   pthread_sigmask where it exists;
+# - a handler that knows about sections (marked ``_deepctl_defers``, like
+#   speak's signal guard) defers them through ``defer_signal``; any other
+#   handler, including the default action, is swapped for a recorder for
+#   the duration, since another thread can take the signal and Python then
+#   runs the handler on the main thread;
+# - when the outermost section ends, the most severe signal that arrived
+#   (SIGTERM, then SIGHUP, then SIGINT; the rest are dropped) is raised
+#   again with ``signal.raise_signal``, which never kills the process the
+#   way ``os.kill`` on our own pid does on Windows.
+#
+# A signal ignored with SIG_IGN, or held by a handler Python can't put
+# back (``getsignal`` returns None), is left alone.
+
+_PRIORITY = tuple(
+    sig
+    for sig in (
+        getattr(signal, "SIGTERM", None),
+        getattr(signal, "SIGHUP", None),
+        getattr(signal, "SIGINT", None),
+    )
+    if sig is not None
+)
+_critical = 0
+_deferred: list[int] = []
+
+
+def _record(signum: int, _frame: object) -> None:
+    _deferred.append(signum)
+
+
+_record._deepctl_defers = True  # type: ignore[attr-defined]
+
+
+def most_severe(signals: list[int]) -> int | None:
+    """The signal to act on from several: SIGTERM > SIGHUP > SIGINT."""
+    for sig in _PRIORITY:
+        if sig in signals:
+            return int(sig)
+    return signals[0] if signals else None
+
+
+def _set_mask(how: int) -> set[int] | None:
+    if not hasattr(signal, "pthread_sigmask"):
+        return None
+    try:
+        return set(signal.pthread_sigmask(how, _PRIORITY))
+    except (OSError, ValueError):
+        return None
+
+
+@contextmanager
+def critical_section() -> Iterator[None]:
+    global _critical
+    main = threading.current_thread() is threading.main_thread()
+    # Count first: a pending handler that runs inside the calls below then
+    # defers instead of raising, so the cleanup in ``finally`` always runs.
+    _critical += 1
+    blocked: set[int] | None = None
+    swapped: dict[int, Any] = {}
+    try:
+        if main and _critical == 1:
+            blocked = _set_mask(signal.SIG_BLOCK)
+            for sig in _PRIORITY:
+                current = signal.getsignal(sig)
+                if current is signal.SIG_IGN or current is None:
+                    continue
+                if getattr(current, "_deepctl_defers", False):
+                    continue
+                signal.signal(sig, _record)
+                swapped[sig] = current
+        yield
+    finally:
+        try:
+            restore_handlers(swapped)
+        finally:
+            try:
+                if blocked is not None:
+                    # Restored while still inside the section, so a handler
+                    # that knows about sections defers rather than raising
+                    # past this. The call sets the mask, then runs pending
+                    # handlers; one that raises still leaves the mask set.
+                    signal.pthread_sigmask(signal.SIG_SETMASK, blocked)
+            finally:
+                _critical -= 1
+                if not _critical and _deferred:
+                    signum = most_severe(_deferred)
+                    _deferred.clear()
+                    if signum is not None and main:
+                        signal.raise_signal(signum)
+
+
+def restore_handlers(saved: dict[int, Any]) -> None:
+    """Put every saved handler back. ``signal.signal`` runs a pending
+    handler before it switches; if that handler raises, the switch didn't
+    happen, so it is retried, and the exception (that signal, delivered)
+    is raised once every handler is back."""
+    caught: BaseException | None = None
+    for sig, previous in saved.items():
+        for _ in range(3):
+            try:
+                signal.signal(sig, previous)
+                break
+            except BaseException as exc:
+                caught = caught or exc
+    if caught is not None:
+        raise caught
+
+
+def defer_signal(signum: int) -> bool:
+    """For a signal handler: inside a critical section, remember the signal
+    (the most severe one is raised again when the section ends) and return
+    True."""
+    if not _critical:
+        return False
+    _deferred.append(signum)
+    return True
+
+
+def _is_special(mode: int) -> bool:
+    return stat.S_ISCHR(mode) or stat.S_ISFIFO(mode)
+
+
+def _open_special(path: str, checked: os.stat_result) -> Target | Refusal:
+    """Open a device or FIFO now, before the request, and make sure the
+    opened file is the one that was checked.
+
+    Non-blocking, so a FIFO with no reader fails with ENXIO instead of
+    hanging; blocking mode is restored for the writes.
+    """
+    flags = (
+        os.O_WRONLY
+        | getattr(os, "O_NONBLOCK", 0)
+        | getattr(os, "O_NOCTTY", 0)
+        | getattr(os, "O_CLOEXEC", 0)
+    )
+    try:
+        fd = os.open(path, flags)
+    except OSError as exc:
+        if exc.errno == errno.ENXIO and stat.S_ISFIFO(checked.st_mode):
+            # The OS text ("No such device or address") is misleading here.
+            exc = OSError(errno.ENXIO, _NO_READER, path)
+        return Refusal("unwritable", exc)
+    try:
+        opened = os.fstat(fd)
+        if not os.path.samestat(opened, checked) or not _is_special(opened.st_mode):
+            raise OSError(errno.EEXIST, _CHANGED, path)
+        os.set_blocking(fd, True)
+    except OSError as exc:
+        os.close(fd)
+        return Refusal("unwritable", exc)
+    return Target(path, "special", fd=fd)
+
+
+def _parent_refusal(path: str) -> Refusal | None:
+    """A missing, non-directory or unwritable parent directory."""
+    parent = os.path.dirname(os.path.abspath(path))
+    try:
+        st = os.stat(parent)
+    except OSError as exc:
+        return Refusal("unwritable", exc)
+    if not stat.S_ISDIR(st.st_mode):
+        return Refusal("unwritable", _oserror(errno.ENOTDIR, parent))
+    if not os.access(parent, os.W_OK | os.X_OK):
+        return Refusal("unwritable", _oserror(errno.EACCES, parent))
+    return None
+
+
+def plan_target(path: str, *, overwrite: bool) -> Target | Refusal:
+    """Decide, before the request, how ``path`` will be written.
+
+    ``overwrite`` is ``--force`` for ``--out-file`` and always true for the
+    deprecated ``-o``, which keeps 0.4.0's overwrite.
+    """
+    try:
+        followed: os.stat_result | None = os.stat(path)
+    except OSError:
+        followed = None
+    if followed is not None:
+        err = _stderr_stat()
+        if err is not None and os.path.samestat(followed, err):
+            # Audio would be mixed with dg's own messages.
+            return Refusal("unwritable", OSError(errno.EINVAL, _STDERR, path))
+        out = stdout_stat()
+        if out is not None and os.path.samestat(followed, out):
+            return Target(path, "stdout", ident=(followed.st_dev, followed.st_ino))
+
+    try:
+        st = os.lstat(path)
+    except FileNotFoundError:
+        refusal = _parent_refusal(path)
+        return refusal or Target(path, "new")
+    except OSError as exc:
+        return Refusal("unwritable", exc)
+
+    # What the path names: the link's target for a symlink.
+    named = followed if stat.S_ISLNK(st.st_mode) else st
+    if named is not None and stat.S_ISDIR(named.st_mode):
+        return Refusal("unwritable", _oserror(errno.EISDIR, path))
+    if named is not None and _is_special(named.st_mode):
+        # /dev/null, a named pipe, or a link to one (/dev/stdout).
+        return _open_special(path, named)
+    if named is not None and not stat.S_ISREG(named.st_mode):
+        # A block device or a socket.
+        return Refusal("unwritable", OSError(errno.EINVAL, _NOT_SPECIAL, path))
+
+    # An existing regular file, or a symlink to one (or to nothing).
+    if not overwrite:
+        return Refusal("exists")
+    parent = os.path.dirname(os.path.abspath(path))
+    if parent == "/dev/fd" or _FD_DIR.fullmatch(os.path.realpath(parent)):
+        return Refusal("unwritable", OSError(errno.EINVAL, _FD_PATH, path))
+    # Permission bits only: never setuid, setgid or sticky.
+    keep = None if stat.S_ISLNK(st.st_mode) else stat.S_IMODE(st.st_mode) & 0o777
+    return _parent_refusal(path) or Target(path, "replace", mode=keep)
+
+
+class AudioFile:
+    """An audio file opened on the first chunk and removed on failure.
+
+    ``write`` raises :class:`WriteFailed` (or :class:`ReaderGone` for EPIPE)
+    so a failed write can't be mistaken for a failed request.
+    """
+
+    def __init__(self, target: Target) -> None:
+        self.target = target
+        self.bytes_written = 0
+        # A device or FIFO was opened (and checked) before the request.
+        self._fd: int | None = target.fd
+        self._tmp: str | None = None
+        self._created = False
+        self._done = False
+
+    @property
+    def path(self) -> str:
+        return self.target.path
+
+    @property
+    def is_stdout(self) -> bool:
+        return self.target.kind == "stdout"
+
+    @property
+    def opened(self) -> bool:
+        return self._fd is not None or (self.is_stdout and self._created)
+
+    def open(self) -> None:
+        """Create or open the file. Idempotent."""
+        if self.opened:
+            return
+        kind, path = self.target.kind, self.target.path
+        try:
+            if kind == "new":
+                with critical_section():
+                    try:
+                        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o666)
+                    except FileExistsError as exc:
+                        raise Exists(path) from exc
+                    self._fd, self._created = fd, True
+            elif kind == "replace":
+                import tempfile
+
+                directory, name = os.path.split(os.path.abspath(path))
+                with critical_section():
+                    self._fd, self._tmp = tempfile.mkstemp(
+                        dir=directory, prefix=f".{name}.", suffix=".part"
+                    )
+            elif kind == "special":
+                raise OSError(errno.EBADF, _CHANGED, path)  # opened in plan
+            else:
+                self._check_stdout()
+        except (Exists, WriteFailed):
+            raise
+        except OSError as exc:
+            raise WriteFailed(exc, stdout=False) from exc
+
+    def _check_stdout(self) -> None:
+        """stdout must still be the file that was checked. The audio
+        goes to fd 1 itself; the path is never opened again."""
+        out = stdout_stat()
+        if out is None or (out.st_dev, out.st_ino) != self.target.ident:
+            # It changed since the check; don't write into it unasked.
+            raise Exists(self.target.path)
+        self._created = True
+
+    def write(self, data: bytes) -> None:
+        """Write ``data`` in full (opening the file first if needed)."""
+        if not data:
+            return
+        self.open()
+        if self.is_stdout:
+            out = sys.stdout.buffer
+            try:
+                out.write(data)
+                out.flush()
+            except BrokenPipeError as exc:
+                raise ReaderGone from exc
+            except OSError as exc:
+                raise WriteFailed(exc, stdout=True) from exc
+            self.bytes_written += len(data)
+            return
+        assert self._fd is not None
+        view = memoryview(data)
+        try:
+            while view:
+                n = os.write(self._fd, view)
+                view = view[n:]
+        except BrokenPipeError as exc:
+            raise ReaderGone from exc
+        except OSError as exc:
+            raise WriteFailed(exc, stdout=False) from exc
+        self.bytes_written += len(data)
+
+    def commit(self) -> None:
+        """Finish the file: close it, and put a temp file in place. Not
+        done until the rename succeeds; a failure removes what we made."""
+        if self._done:
+            return
+        with critical_section():
+            fd, self._fd = self._fd, None
+            try:
+                if fd is not None:
+                    try:
+                        if self._tmp is not None:
+                            # An existing file keeps its permission bits
+                            # ; a new file or a replaced symlink gets
+                            # 0666 & ~umask, as open() would.
+                            mode = self.target.mode
+                            os.fchmod(fd, 0o666 & ~_UMASK if mode is None else mode)
+                    finally:
+                        os.close(fd)
+                if self._tmp is not None:
+                    os.replace(self._tmp, self.target.path)
+                    self._tmp = None
+            except OSError as exc:
+                self.abort()
+                raise WriteFailed(exc, stdout=False) from exc
+            self._done = True
+
+    def abort(self) -> None:
+        """Close and remove whatever this run created. Never raises; safe
+        to call again, and a temp file is always removed."""
+        if self._done:
+            return
+        with critical_section():
+            fd, self._fd = self._fd, None
+            ours: os.stat_result | None = None
+            if fd is not None:
+                try:
+                    ours = os.fstat(fd)
+                except OSError:
+                    pass
+                try:
+                    os.close(fd)
+                except OSError:
+                    pass
+            if self._tmp is not None:
+                try:
+                    os.unlink(self._tmp)
+                except OSError:
+                    pass
+                self._tmp = None
+            elif self._created and self.target.kind == "new" and ours is not None:
+                # Only the file this run created: if the path now names
+                # another file (renamed or replaced meanwhile), leave it
+                # alone.
+                try:
+                    if os.path.samestat(os.lstat(self.target.path), ours):
+                        os.unlink(self.target.path)
+                except OSError:
+                    pass
+            self._done = True
diff --git a/packages/deepctl-cmd-speak/tests/unit/test_speak_agent.py b/packages/deepctl-cmd-speak/tests/unit/test_speak_agent.py
new file mode 100644
index 00000000..ea1e7eb8
--- /dev/null
+++ b/packages/deepctl-cmd-speak/tests/unit/test_speak_agent.py
@@ -0,0 +1,301 @@
+"""Agent rules for ``dg speak`` under a hard signal, and
+the ``next_step`` rows for every speak coded error (``test_next_step``).
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import shlex
+from typing import Any
+from unittest.mock import Mock, patch
+
+import pytest
+from deepctl_cmd_speak import command as speak
+from deepctl_cmd_speak import sinks
+from deepctl_cmd_speak.command import SpeakCommand
+from deepctl_cmd_speak.models import SpeakCodedError
+from deepctl_core import AuthManager, Config, DeepgramClient
+
+# The strict surface-0.5.0 schema's next_step grammar.
+NEXT_STEP = re.compile(
+    r"^(?!sudo )(?:[A-Za-z0-9_@%+:,./-][A-Za-z0-9_@%+=:,./-]*|'[^']*'(?:\"'\"'[^']*')*)"
+    r"(?: (?:[A-Za-z0-9_@%+:,./-][A-Za-z0-9_@%+=:,./-]*|'[^']*'(?:\"'\"'[^']*')*))*$"
+)
+_REAL_TAKES_AUDIO = sinks.stdout_takes_audio
+OUT_FILE = re.compile(r"^speech-\d{8}T\d{6}Z-[0-9a-f]{4}\.(mp3|wav|ogg|flac|aac|raw)$")
+
+
+def _kwargs(**kw: Any) -> dict[str, Any]:
+    base: dict[str, Any] = {
+        "text": "hi",
+        "output": None,
+        "out_file": None,
+        "force": False,
+        "model": "aura-2-asteria-en",
+        "encoding": None,
+        "container": None,
+        "sample_rate": None,
+        "file": None,
+        "play": False,
+        "list_voices": False,
+    }
+    base.update(kw)
+    return base
+
+
+def _pre(argv: list[str], monkeypatch, **kw: Any):
+    monkeypatch.setattr(speak, "_argv", lambda: list(argv))
+    return SpeakCommand().pre_auth_check(Mock(spec=Config), **_kwargs(**kw))
+
+
+def assert_e10(ns: str | None) -> None:
+    if ns is None:
+        return
+    assert shlex.join(shlex.split(ns)) == ns
+    assert NEXT_STEP.match(ns), ns
+    tokens = shlex.split(ns)
+    assert tokens[0] == "dg"
+    assert not any(re.fullmatch(r"<[A-Z_]+>", t) for t in tokens)
+
+
+@pytest.fixture(autouse=True)
+def _env(monkeypatch, tmp_path):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr(speak, "_deprecation_shown", False)
+    monkeypatch.setattr(speak, "_agentic", True)
+    monkeypatch.setattr(speak, "is_ai_agent", lambda: True)
+    monkeypatch.setattr(sinks, "stdout_stat", lambda: None)  # a pipe
+    monkeypatch.setattr(sinks, "stdout_takes_audio", lambda: False)
+
+
+# ── No text → never read stdin ─────────────────────────────────────────
+
+
+class TestNoText:
+    @pytest.mark.parametrize("extra", [{}, {"out_file": "a.wav"}, {"text": ""}])
+    def test_refused_without_reading_stdin(self, monkeypatch, extra):
+        with patch("deepctl_cmd_speak.command.sys") as mock_sys:
+            kw = {"text": None, **extra}
+            result = _pre(["speak"], monkeypatch, **kw)
+            mock_sys.stdin.read.assert_not_called()
+        assert isinstance(result, SpeakCodedError)
+        assert result.code == "invalid_argument"
+        assert result.error == (
+            "dg speak needs the text as an argument, or - to read it from stdin."
+        )
+        assert result.hint == (
+            "Pass the text in quotes. To read it from stdin, pass - explicitly."
+        )
+        assert result.next_step == "dg speak --help"
+
+    def test_file_is_text(self, monkeypatch, tmp_path):
+        assert (
+            _pre(["speak"], monkeypatch, text=None, file="t.txt", out_file="a.wav")
+            is None
+        )
+
+    def test_dash_reads_stdin_in_agent_mode(self, monkeypatch):
+        monkeypatch.setattr(sinks, "stdout_takes_audio", lambda: True)
+        assert _pre(["speak", "-"], monkeypatch, text="-") is None
+        cmd = SpeakCommand()
+        client = Mock(spec=DeepgramClient)
+        client.speak_text.return_value = iter([b"a"])
+        with patch("deepctl_cmd_speak.command.sys") as mock_sys:
+            mock_sys.stdin.read.return_value = "from stdin\n"
+            mock_sys.stdout.isatty.return_value = False
+            cmd.handle(
+                Mock(spec=Config), Mock(spec=AuthManager), client, **_kwargs(text="-")
+            )
+        assert client.speak_text.call_args.kwargs["text"] == "from stdin"
+
+    def test_dash_reads_stdin_for_a_person_too(self, monkeypatch):
+        monkeypatch.setattr(speak, "is_ai_agent", lambda: False)
+        cmd = SpeakCommand()
+        client = Mock(spec=DeepgramClient)
+        client.speak_text.return_value = iter([b"a"])
+        with patch("deepctl_cmd_speak.command.sys") as mock_sys:
+            mock_sys.stdin.isatty.return_value = True
+            mock_sys.stdin.read.return_value = "typed"
+            mock_sys.stdout.isatty.return_value = False
+            cmd.handle(
+                Mock(spec=Config), Mock(spec=AuthManager), client, **_kwargs(text="-")
+            )
+        assert client.speak_text.call_args.kwargs["text"] == "typed"
+
+    def test_ci_only_keeps_reading_piped_stdin(self, monkeypatch):
+        monkeypatch.setattr(speak, "is_ai_agent", lambda: False)
+        assert _pre(["speak"], monkeypatch, text=None) is None
+
+
+# ── Audio into a pipe ───────────────────────────────────────────────────
+
+
+class TestNoOutput:
+    def test_refused_with_a_rerun_that_saves_the_file(self, monkeypatch):
+        result = _pre(["speak", "hi", "-m", "aura-2-asteria-en"], monkeypatch)
+        assert isinstance(result, SpeakCodedError)
+        assert result.code == "invalid_argument"
+        assert (
+            result.error == "dg speak won't write audio into this pipe in agent mode."
+        )
+        tokens = shlex.split(result.next_step)
+        assert tokens[:6] == [
+            "dg",
+            "speak",
+            "hi",
+            "-m",
+            "aura-2-asteria-en",
+            "--out-file",
+        ]
+        out_file = tokens[6]
+        assert OUT_FILE.match(out_file) and out_file.endswith(".mp3")
+        assert result.hint == (
+            f"next_step saves the audio to {out_file}. Give the user that path."
+        )
+        assert not os.path.exists(out_file)
+        assert_e10(result.next_step)
+
+    def test_flux_default_proposes_a_wav(self, monkeypatch):
+        result = _pre(["speak", "hi"], monkeypatch, model=None)
+        assert shlex.split(result.next_step)[-1].endswith(".wav")
+
+    def test_root_options_are_kept_verbatim(self, monkeypatch):
+        result = _pre(["--profile", "work", "speak", "hi"], monkeypatch)
+        assert shlex.split(result.next_step)[:4] == ["dg", "--profile", "work", "speak"]
+
+    def test_text_from_stdin_has_no_next_step(self, monkeypatch):
+        result = _pre(["speak", "-"], monkeypatch, text="-")
+        assert result.next_step is None
+        out_file = result.hint.split("--out-file ")[1].split(" ")[0]
+        assert OUT_FILE.match(out_file)
+        assert result.hint == (
+            f"Run the same command again with --out-file {out_file} added. If "
+            "the text came from stdin, send it again the same way."
+        )
+
+    def test_secret_on_argv_nulls_next_step(self, monkeypatch):
+        result = _pre(["--api-key", "sk_sentinel_123", "speak", "hi"], monkeypatch)
+        assert result.next_step is None
+        # The text was an argument: never ask for the key to be put back.
+        out_file = result.hint.split("--out-file ")[1].split(" ")[0]
+        assert OUT_FILE.match(out_file)
+        assert result.hint == (
+            f"Run the same command again with --out-file {out_file} added. If "
+            "the text came from stdin, send it again the same way."
+        )
+        assert "sk_sentinel_123" not in result.model_dump_json()
+
+    @pytest.mark.parametrize(
+        "argv",
+        [
+            ["--api-key=sk_x", "speak", "hi"],
+            ["--base-url", "https://user:pw@example.com", "speak", "hi"],
+            ["--base-url", "https://example.com/?token=x", "speak", "hi"],
+        ],
+    )
+    def test_every_secret_form_nulls_next_step(self, monkeypatch, argv):
+        result = _pre(argv, monkeypatch)
+        assert result.next_step is None
+        assert result.hint.startswith("Run the same command again")
+
+    @pytest.mark.parametrize(
+        "text",
+        ["Q&A starts now", "a < b; echo $HOME | x", "It's Q & A time", "I'll sudo it"],
+    )
+    def test_shell_metacharacters_stay_inside_one_quoted_argument(
+        self, monkeypatch, text
+    ):
+        result = _pre(["speak", text], monkeypatch, text=text)
+        assert_e10(result.next_step)
+        assert shlex.split(result.next_step)[2] == text
+
+    def test_a_token_starting_with_equals_nulls_next_step(self, monkeypatch):
+        result = _pre(["speak", "=cmd"], monkeypatch, text="=cmd")
+        assert result.next_step is None
+        assert result.hint.startswith("Run the same command again")
+
+    @pytest.mark.parametrize(
+        "kw", [{"play": True}, {"list_voices": True}, {"out_file": "a.wav"}]
+    )
+    def test_exempt(self, monkeypatch, kw):
+        assert _pre(["speak", "hi"], monkeypatch, **kw) is None
+
+    def test_regular_file_tty_or_dev_null_is_allowed(self, monkeypatch):
+        monkeypatch.setattr(sinks, "stdout_takes_audio", lambda: True)
+        assert _pre(["speak", "hi"], monkeypatch) is None
+
+    def test_people_and_ci_may_pipe_audio(self, monkeypatch):
+        monkeypatch.setattr(speak, "is_ai_agent", lambda: False)
+        assert _pre(["speak", "hi"], monkeypatch) is None
+
+
+class TestStdoutTakesAudio:
+    def test_classification(self, monkeypatch, tmp_path):
+        monkeypatch.setattr(sinks, "stdout_takes_audio", _REAL_TAKES_AUDIO)
+        f = tmp_path / "out.wav"
+        f.write_bytes(b"")
+        monkeypatch.setattr(sinks, "stdout_stat", lambda: os.stat(f))
+        assert _REAL_TAKES_AUDIO() is True
+        monkeypatch.setattr(sinks, "stdout_stat", lambda: os.stat(os.devnull))
+        assert _REAL_TAKES_AUDIO() is True
+        r, w = os.pipe()
+        try:
+            monkeypatch.setattr(sinks, "stdout_stat", lambda: os.fstat(w))
+            monkeypatch.setattr(sinks.os, "isatty", lambda fd: False)
+            assert _REAL_TAKES_AUDIO() is False
+            monkeypatch.setattr(sinks.os, "isatty", lambda fd: True)
+            assert _REAL_TAKES_AUDIO() is True
+        finally:
+            os.close(r)
+            os.close(w)
+        monkeypatch.setattr(sinks, "stdout_stat", lambda: None)
+        assert _REAL_TAKES_AUDIO() is False
+
+
+# ── Every speak coded error's next_step ─────────────────────────────────
+
+
+class TestNextStepRows:
+    @pytest.mark.parametrize(
+        ("argv", "kw", "expected"),
+        [
+            (
+                ["speak", "hi", "-o", "a", "--out-file", "b"],
+                {"output": "a", "out_file": "b"},
+                "dg speak --help",
+            ),
+            (["speak"], {"text": None}, "dg speak --help"),
+            (["speak", "hi"], {}, "rerun"),
+            (["speak", "-"], {"text": "-"}, None),
+            (["speak", "hi", "-o", "json"], {"output": "json"}, "rerun"),
+            (["speak", "hi", "-o", "text"], {"output": "text"}, "rerun"),
+            (
+                ["speak", "hi", "--out-file", "nope/a.wav"],
+                {"out_file": "nope/a.wav"},
+                None,
+            ),
+        ],
+    )
+    def test_next_step_is_runnable_or_null(self, monkeypatch, argv, kw, expected):
+        result = _pre(argv, monkeypatch, **kw)
+        assert isinstance(result, SpeakCodedError)
+        assert_e10(result.next_step)
+        if expected is None:
+            assert result.next_step is None
+        elif expected == "rerun":
+            assert "--out-file" in shlex.split(result.next_step)
+        else:
+            assert result.next_step == expected
+        # hint, code and schema_version are never null; details omitted
+        # when empty.
+        dump = result.model_dump()
+        assert dump["hint"] and dump["code"] and dump["schema_version"] == 1
+        assert list(dump)[:6] == [
+            "error",
+            "status",
+            "code",
+            "hint",
+            "next_step",
+            "schema_version",
+        ]
diff --git a/packages/deepctl-cmd-speak/tests/unit/test_speak_command.py b/packages/deepctl-cmd-speak/tests/unit/test_speak_command.py
index df476f88..bc03c6e9 100644
--- a/packages/deepctl-cmd-speak/tests/unit/test_speak_command.py
+++ b/packages/deepctl-cmd-speak/tests/unit/test_speak_command.py
@@ -6,7 +6,7 @@
 import wave
 from contextlib import contextmanager
 from pathlib import Path
-from unittest.mock import Mock, patch
+from unittest.mock import Mock, call, patch
 
 import click
 import pytest
@@ -588,7 +588,7 @@ def test_handle_flux_rejects_non_raw_encoding(
         mock_sys.stdin.isatty.return_value = True
         mock_sys.stdout.isatty.return_value = True
 
-        with pytest.raises(click.ClickException, match="not supported for Flux"):
+        with pytest.raises(click.ClickException, match="Flux voices stream raw audio"):
             command.handle(
                 config=mock_config,
                 auth_manager=mock_auth_manager,
@@ -905,9 +905,13 @@ def test_handle_write_to_stdout(
 
         assert result is None
 
-        mock_stdout_buffer.write.assert_any_call(b"chunk1")
-        mock_stdout_buffer.write.assert_any_call(b"chunk2")
-        mock_stdout_buffer.flush.assert_called_once()
+        # Each chunk is flushed as it arrives, not once at the end.
+        assert mock_stdout_buffer.mock_calls == [
+            call.write(b"chunk1"),
+            call.flush(),
+            call.write(b"chunk2"),
+            call.flush(),
+        ]
 
     # ── --list-voices ────────────────────────────────────────────────
 
@@ -1730,7 +1734,8 @@ def test_handle_play_rejects_mp3_on_pcm_only_player(
 
         assert result is not None
         assert result.status == "error"
-        assert "cannot decode mp3" in result.message
+        assert "can't decode mp3" in result.message
+        assert "--out-file FILE" in result.message
         mock_client.speak_text.assert_not_called()
 
 
@@ -1815,7 +1820,8 @@ def test_check_playable_rejects_raw_audio(self):
             "ffplay", is_flux=False, encoding="linear16", container="none"
         )
         assert aura_raw is not None
-        assert "no container" in aura_raw
+        assert "can't tell its format" in aura_raw
+        assert "--out-file FILE" in aura_raw
 
     def test_check_playable_aplay_rejects_every_compressed_encoding(self):
         for encoding in ("mp3", "aac", "opus", "flac"):
@@ -1823,7 +1829,7 @@ def test_check_playable_aplay_rejects_every_compressed_encoding(self):
                 "aplay", is_flux=False, encoding=encoding, container=None
             )
             assert problem is not None
-            assert f"cannot decode {encoding}" in problem
+            assert f"can't decode {encoding}" in problem
             assert "linear16 (WAV)" in problem
 
     def test_check_playable_paplay_decodes_flac_and_ogg_but_not_mp3_or_aac(self):
@@ -1844,7 +1850,7 @@ def test_check_playable_paplay_decodes_flac_and_ogg_but_not_mp3_or_aac(self):
                 "paplay", is_flux=False, encoding=encoding, container=None
             )
             assert problem is not None
-            assert f"'paplay' cannot decode {encoding}" in problem
+            assert f"'paplay' can't decode {encoding}" in problem
             assert "flac" in problem and "opus" in problem
 
     def test_check_playable_ffplay_and_afplay_accept_every_compressed_encoding(self):
@@ -1932,3 +1938,15 @@ def test_speak_result_defaults(self):
         assert result.output_path == ""
         assert result.model == ""
         assert result.bytes_written == 0
+
+
+def test_help_names_the_file_options_value_file():
+    """--out-file and -o/--output take a FILE, and --help says so."""
+    from deepctl_cmd_speak.command import SpeakCommand
+    from deepctl_core import PluginManager
+
+    cmd = PluginManager()._create_click_command(SpeakCommand())
+    help_text = " ".join(cmd.get_help(click.Context(cmd)).split())
+    assert "--out-file FILE Save the audio to FILE." in help_text
+    assert "-o, --output FILE Deprecated: use --out-file." in help_text
+    assert "--out-file TEXT" not in help_text
diff --git a/packages/deepctl-cmd-speak/tests/unit/test_speak_imports.py b/packages/deepctl-cmd-speak/tests/unit/test_speak_imports.py
new file mode 100644
index 00000000..a02c5ac9
--- /dev/null
+++ b/packages/deepctl-cmd-speak/tests/unit/test_speak_imports.py
@@ -0,0 +1,60 @@
+"""The speak modules import no network stack at module level.
+
+The speak package's copy of ``tests/unit/test_command_imports.py``, which
+runs the same check for every built-in command. ``dg speak --help`` imports these modules, so
+a module-level ``asyncio``, ``ssl``, ``httpx``, ``websockets`` or SDK
+import would be paid by every help and every run.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+from typing import TYPE_CHECKING
+
+import pytest
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+FORBIDDEN = ("asyncio", "ssl", "httpx", "websockets", "deepgram")
+
+CHECK = (
+    "import importlib, sys; importlib.import_module(sys.argv[1]); "
+    "bad = sorted({m for m in sys.modules for f in sys.argv[2:] "
+    "if m == f or m.startswith(f + '.')}); "
+    "print(' '.join(bad)); sys.exit(1 if bad else 0)"
+)
+
+
+def _env(tmp_path: Path) -> dict[str, str]:
+    env = {
+        k: v for k, v in os.environ.items() if not k.startswith(("DEEPGRAM_", "PYTHON"))
+    }
+    env.update(
+        HOME=str(tmp_path),
+        DEEPCTL_TELEMETRY_DISABLED="1",
+        DEEPCTL_TELEMETRY_DSN="http://k@127.0.0.1:9/1",
+    )
+    return env
+
+
+@pytest.mark.parametrize(
+    "module",
+    [
+        "deepctl_cmd_speak.command",
+        "deepctl_cmd_speak.sinks",
+        "deepctl_cmd_speak.messages",
+        "deepctl_cmd_speak.models",
+    ],
+)
+def test_speak_module_imports_no_network_stack(module: str, tmp_path: Path) -> None:
+    proc = subprocess.run(
+        [sys.executable, "-c", CHECK, module, *FORBIDDEN],
+        capture_output=True,
+        text=True,
+        env=_env(tmp_path),
+        timeout=120,
+    )
+    assert proc.returncode == 0, f"{module} imports: {proc.stdout}{proc.stderr[-1500:]}"
diff --git a/packages/deepctl-cmd-speak/tests/unit/test_speak_output.py b/packages/deepctl-cmd-speak/tests/unit/test_speak_output.py
new file mode 100644
index 00000000..53e85044
--- /dev/null
+++ b/packages/deepctl-cmd-speak/tests/unit/test_speak_output.py
@@ -0,0 +1,1227 @@
+"""``--out-file``, ``--force`` and the deprecated ``-o``.
+
+The process-level checks (fake API request counts, a real ``/dev/stdout``)
+run in a Docker harness; these cover the logic.
+"""
+
+from __future__ import annotations
+
+import errno
+import os
+import shlex
+import stat
+import threading
+import time
+from pathlib import Path
+from typing import Any
+from unittest.mock import Mock, patch
+
+import pytest
+from deepctl_cmd_speak import command as speak
+from deepctl_cmd_speak import sinks
+from deepctl_cmd_speak.command import SpeakCommand
+from deepctl_cmd_speak.models import SpeakCodedError, SpeakResult
+from deepctl_core import AuthManager, Config, DeepgramClient
+
+
+class _Cut(Exception):
+    """Stands in for the SDK error a dropped connection raises."""
+
+
+def _stream(chunks: list[bytes], *, fail_after: bool = False, check=None):
+    for i, chunk in enumerate(chunks):
+        if check is not None:
+            check(i)
+        yield chunk
+    if fail_after:
+        raise _Cut("connection reset")
+
+
+def _run(cmd: SpeakCommand, client: Mock, **kwargs: Any):
+    base: dict[str, Any] = {
+        "text": "Hello",
+        "output": None,
+        "out_file": None,
+        "force": False,
+        "model": "aura-2-asteria-en",
+        "encoding": None,
+        "container": None,
+        "sample_rate": None,
+        "file": None,
+    }
+    base.update(kwargs)
+    planned = cmd.pre_auth_check(Mock(spec=Config), **base)
+    if planned is not None:
+        return planned
+    return cmd.handle(
+        config=Mock(spec=Config),
+        auth_manager=Mock(spec=AuthManager),
+        client=client,
+        **base,
+    )
+
+
+@pytest.fixture(autouse=True)
+def _env(monkeypatch, tmp_path):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr(speak, "_deprecation_shown", False)
+    monkeypatch.setattr(speak, "_agentic", False)
+    monkeypatch.setattr(speak, "is_ai_agent", lambda: False)
+    # stdout is "a pipe" unless a test says otherwise.
+    monkeypatch.setattr(sinks, "stdout_stat", lambda: None)
+    # The signal guard re-delivers a signal after _CLOSE_TIMEOUT_S if the
+    # run is still unwinding. A loaded test host must never get there by
+    # accident: a timer that fired after the guard restored SIG_DFL would
+    # end pytest itself. The one test of the timer sets its own value.
+    monkeypatch.setattr(speak, "_SIGNAL_GRACE_S", 600.0)
+    import signal
+
+    getsignal = signal.getsignal  # the real one, even if a test patches it
+    watched = [getattr(signal, n) for n in ("SIGINT", "SIGTERM", "SIGHUP")]
+    handlers = {sig: getsignal(sig) for sig in watched}
+    old = os.umask(0o022)
+    yield
+    os.umask(old)
+    # No test may leave a signal handler, a section or a deferred signal.
+    assert {sig: getsignal(sig) for sig in watched} == handlers
+    assert sinks._critical == 0
+    assert not sinks._deferred
+
+
+@pytest.fixture
+def fake_sys():
+    with patch("deepctl_cmd_speak.command.sys") as mock_sys:
+        mock_sys.stdin.isatty.return_value = True
+        mock_sys.stdout.isatty.return_value = False
+        mock_sys.argv = ["dg", "speak", "Hello"]
+        yield mock_sys
+
+
+@pytest.fixture
+def client():
+    return Mock(spec=DeepgramClient)
+
+
+# ── plan_target (before the request) ────────────────────────────────────
+
+
+class TestPlanTarget:
+    def test_missing_file_in_existing_dir_is_new(self, tmp_path):
+        assert sinks.plan_target(str(tmp_path / "a.wav"), overwrite=False) == (
+            sinks.Target(str(tmp_path / "a.wav"), "new")
+        )
+
+    def test_existing_regular_file_is_refused_without_overwrite(self, tmp_path):
+        f = tmp_path / "a.wav"
+        f.write_bytes(b"old")
+        assert sinks.plan_target(str(f), overwrite=False) == sinks.Refusal("exists")
+        assert sinks.plan_target(str(f), overwrite=True).kind == "replace"
+
+    @pytest.mark.parametrize("dangling", [False, True])
+    def test_symlink_is_refused_without_overwrite(self, tmp_path, dangling):
+        link = tmp_path / "a.wav"
+        target = tmp_path / "elsewhere.wav"
+        if not dangling:
+            target.write_bytes(b"precious")
+        link.symlink_to(target)
+        assert sinks.plan_target(str(link), overwrite=False) == sinks.Refusal("exists")
+        assert sinks.plan_target(str(link), overwrite=True).kind == "replace"
+
+    def test_directory_is_unwritable(self, tmp_path):
+        refusal = sinks.plan_target(str(tmp_path), overwrite=True)
+        assert isinstance(refusal, sinks.Refusal)
+        assert refusal.reason == "unwritable"
+        assert refusal.error.errno == errno.EISDIR
+
+    def test_missing_parent_is_unwritable(self, tmp_path):
+        refusal = sinks.plan_target(str(tmp_path / "nope" / "a.wav"), overwrite=False)
+        assert refusal.reason == "unwritable"
+        assert refusal.error.errno == errno.ENOENT
+
+    def test_parent_that_is_a_file_is_unwritable(self, tmp_path):
+        (tmp_path / "f").write_text("x")
+        refusal = sinks.plan_target(str(tmp_path / "f" / "a.wav"), overwrite=False)
+        assert refusal.reason == "unwritable"
+
+    @pytest.mark.skipif(os.geteuid() == 0, reason="root ignores permissions")
+    def test_unwritable_parent_is_unwritable(self, tmp_path):
+        d = tmp_path / "ro"
+        d.mkdir()
+        d.chmod(0o555)
+        try:
+            refusal = sinks.plan_target(str(d / "a.wav"), overwrite=False)
+            assert refusal.reason == "unwritable"
+            assert refusal.error.errno == errno.EACCES
+        finally:
+            d.chmod(0o755)
+
+    def test_character_device_is_special_and_opened_now(self):
+        target = sinks.plan_target(os.devnull, overwrite=False)
+        assert target.kind == "special"
+        assert target.fd is not None
+        assert os.get_blocking(target.fd)  # O_NONBLOCK cleared for the writes
+        os.close(target.fd)
+
+    def test_fifo_with_a_reader_is_special(self, tmp_path):
+        fifo = tmp_path / "f"
+        os.mkfifo(fifo)
+        reader = os.open(fifo, os.O_RDONLY | os.O_NONBLOCK)
+        try:
+            target = sinks.plan_target(str(fifo), overwrite=False)
+            assert target.kind == "special"
+            os.close(target.fd)
+        finally:
+            os.close(reader)
+
+    def test_fifo_with_no_reader_is_refused_not_waited_on(self, tmp_path):
+        """An open() that would block until a reader comes is ENXIO."""
+        fifo = tmp_path / "f"
+        os.mkfifo(fifo)
+        refusal = sinks.plan_target(str(fifo), overwrite=False)
+        assert refusal.reason == "unwritable"
+        assert refusal.error.errno == errno.ENXIO
+        assert refusal.error.strerror == "no program is reading from that pipe"
+
+    def test_socket_is_refused(self, tmp_path):
+        """Only character devices and FIFOs are written as they are."""
+        import socket
+
+        path = tmp_path / "s"
+        sock = socket.socket(socket.AF_UNIX)
+        sock.bind(str(path))
+        try:
+            refusal = sinks.plan_target(str(path), overwrite=True)
+            assert refusal.reason == "unwritable"
+            assert refusal.error.strerror == (
+                "it isn't a file, a pipe or a device like /dev/null"
+            )
+        finally:
+            sock.close()
+
+    def test_symlink_to_a_device_is_special(self, tmp_path):
+        link = tmp_path / "a.wav"
+        link.symlink_to(os.devnull)
+        target = sinks.plan_target(str(link), overwrite=False)
+        assert target.kind == "special"
+        os.close(target.fd)
+
+    def test_special_path_swapped_before_the_open_is_refused(
+        self, tmp_path, monkeypatch
+    ):
+        """The opened file must be the device that was checked."""
+        victim = tmp_path / "victim"
+        victim.write_bytes(b"VICTIM")
+        link = tmp_path / "a.wav"
+        link.symlink_to(os.devnull)
+        real_open = os.open
+
+        def swap_then_open(path, flags, *a):
+            if str(path) == str(link):
+                link.unlink()
+                link.symlink_to(victim)
+            return real_open(path, flags, *a)
+
+        monkeypatch.setattr(sinks.os, "open", swap_then_open)
+        refusal = sinks.plan_target(str(link), overwrite=False)
+        assert refusal.reason == "unwritable"
+        assert refusal.error.strerror == "something replaced it before writing started"
+        assert victim.read_bytes() == b"VICTIM"
+
+    def test_replace_keeps_the_old_mode(self, tmp_path):
+        f = tmp_path / "a.wav"
+        f.write_bytes(b"old")
+        f.chmod(0o600)
+        assert sinks.plan_target(str(f), overwrite=True).mode == 0o600
+
+    def test_replace_of_a_symlink_has_no_mode_to_keep(self, tmp_path):
+        (tmp_path / "t").write_bytes(b"x")
+        (tmp_path / "a.wav").symlink_to("t")
+        assert sinks.plan_target(str(tmp_path / "a.wav"), overwrite=True).mode is None
+
+    def test_same_file_as_stdout_is_stdout(self, tmp_path, monkeypatch):
+        f = tmp_path / "out.wav"
+        f.write_bytes(b"")
+        monkeypatch.setattr(sinks, "stdout_stat", lambda: os.stat(f))
+        # Even an existing regular file: it's stdout, not an overwrite.
+        assert sinks.plan_target(str(f), overwrite=False).kind == "stdout"
+
+
+# ── AudioFile (at and after the first chunk) ────────────────────────────
+
+
+class TestAudioFile:
+    def test_new_file_appears_on_first_write_with_umask_mode(self, tmp_path):
+        path = tmp_path / "a.wav"
+        out = sinks.AudioFile(sinks.Target(str(path), "new"))
+        assert not path.exists()
+        out.write(b"abc")
+        assert path.exists()
+        out.commit()
+        assert path.read_bytes() == b"abc"
+        assert stat.S_IMODE(path.stat().st_mode) == 0o644
+
+    def test_abort_removes_the_partial_file(self, tmp_path):
+        path = tmp_path / "a.wav"
+        out = sinks.AudioFile(sinks.Target(str(path), "new"))
+        out.write(b"abc")
+        out.abort()
+        assert not path.exists()
+
+    def test_o_excl_race_raises_exists_and_leaves_their_file(self, tmp_path):
+        path = tmp_path / "a.wav"
+        out = sinks.AudioFile(sinks.Target(str(path), "new"))
+        path.write_bytes(b"theirs")  # created between the check and the open
+        with pytest.raises(sinks.Exists):
+            out.write(b"abc")
+        out.abort()
+        assert path.read_bytes() == b"theirs"
+
+    def test_replace_writes_a_0600_temp_then_replaces(self, tmp_path):
+        path = tmp_path / "a.wav"
+        path.write_bytes(b"old")
+        out = sinks.AudioFile(sinks.Target(str(path), "replace"))
+        out.write(b"new")
+        temps = [p for p in tmp_path.iterdir() if p.name.endswith(".part")]
+        assert len(temps) == 1
+        assert stat.S_IMODE(temps[0].stat().st_mode) == 0o600
+        assert path.read_bytes() == b"old"  # untouched until commit
+        out.commit()
+        assert path.read_bytes() == b"new"
+        assert stat.S_IMODE(path.stat().st_mode) == 0o666 & ~sinks._UMASK
+        assert [p.name for p in tmp_path.iterdir()] == ["a.wav"]
+
+    def test_replace_swaps_a_symlink_and_leaves_its_target(self, tmp_path):
+        target = tmp_path / "precious.txt"
+        target.write_bytes(b"precious")
+        link = tmp_path / "a.wav"
+        link.symlink_to(target)
+        out = sinks.AudioFile(sinks.Target(str(link), "replace"))
+        out.write(b"audio")
+        out.commit()
+        assert not link.is_symlink()
+        assert link.read_bytes() == b"audio"
+        assert target.read_bytes() == b"precious"
+
+    def test_replace_keeps_a_0600_file_0600(self, tmp_path):
+        """Replacing doesn't widen an existing file's mode."""
+        path = tmp_path / "a.wav"
+        path.write_bytes(b"old")
+        path.chmod(0o600)
+        out = sinks.AudioFile(sinks.plan_target(str(path), overwrite=True))
+        out.write(b"new")
+        out.commit()
+        assert path.read_bytes() == b"new"
+        assert stat.S_IMODE(path.stat().st_mode) == 0o600
+
+    def test_abort_leaves_a_file_that_replaced_ours(self, tmp_path):
+        """Only the file this run created is removed."""
+        path = tmp_path / "a.wav"
+        out = sinks.AudioFile(sinks.Target(str(path), "new"))
+        out.write(b"partial")
+        path.unlink()
+        path.write_bytes(b"theirs")
+        out.abort()
+        assert path.read_bytes() == b"theirs"
+
+    def test_failed_replace_keeps_the_old_file(self, tmp_path):
+        path = tmp_path / "a.wav"
+        path.write_bytes(b"old")
+        out = sinks.AudioFile(sinks.Target(str(path), "replace"))
+        out.write(b"partial")
+        out.abort()
+        assert path.read_bytes() == b"old"
+        assert [p.name for p in tmp_path.iterdir()] == ["a.wav"]
+
+    def test_write_error_is_write_failed(self, tmp_path, monkeypatch):
+        path = tmp_path / "a.wav"
+        out = sinks.AudioFile(sinks.Target(str(path), "new"))
+
+        def full(fd, data):
+            raise OSError(errno.ENOSPC, "No space left on device")
+
+        monkeypatch.setattr(sinks.os, "write", full)
+        with pytest.raises(sinks.WriteFailed) as info:
+            out.write(b"abc")
+        assert info.value.error.errno == errno.ENOSPC
+        assert info.value.stdout is False
+
+    def test_special_file_is_not_removed(self, tmp_path):
+        fifo_like = sinks.AudioFile(sinks.plan_target(os.devnull, overwrite=False))
+        fifo_like.write(b"abc")
+        fifo_like.abort()
+        assert os.path.exists(os.devnull)
+
+    def test_nothing_written_means_nothing_created(self, tmp_path):
+        path = tmp_path / "a.wav"
+        out = sinks.AudioFile(sinks.Target(str(path), "new"))
+        out.write(b"")
+        out.abort()
+        assert not path.exists()
+
+
+# ── The command: checks before the request ──────────────────────────────
+
+
+class TestPreRequest:
+    def test_existing_out_file_is_refused_with_no_request(self, fake_sys, client):
+        Path("a.wav").write_bytes(b"old")
+        cmd = SpeakCommand()
+        result = _run(cmd, client, out_file="a.wav")
+        assert isinstance(result, SpeakCodedError)
+        assert result.code == "invalid_argument"
+        assert result.error == "a.wav already exists; dg won't overwrite it."
+        assert result.hint == "Choose a new file name, or pass --force to overwrite."
+        assert result.next_step is None
+        client.speak_text.assert_not_called()
+        client.speak_text_stream.assert_not_called()
+        assert Path("a.wav").read_bytes() == b"old"
+
+    def test_existing_symlink_is_refused(self, fake_sys, client):
+        Path("t").write_bytes(b"precious")
+        Path("a.wav").symlink_to("t")
+        result = _run(SpeakCommand(), client, out_file="a.wav")
+        assert result.code == "invalid_argument"
+        client.speak_text.assert_not_called()
+
+    def test_force_replaces_the_file(self, fake_sys, client):
+        Path("a.wav").write_bytes(b"old")
+        client.speak_text.return_value = _stream([b"ne", b"w"])
+        result = _run(SpeakCommand(), client, out_file="a.wav", force=True)
+        assert isinstance(result, SpeakResult)
+        assert result.output_path == "a.wav"
+        assert result.bytes_written == 3
+        assert Path("a.wav").read_bytes() == b"new"
+
+    def test_force_replaces_a_symlink_not_its_target(self, fake_sys, client):
+        Path("t").write_bytes(b"precious")
+        Path("a.wav").symlink_to("t")
+        client.speak_text.return_value = _stream([b"audio"])
+        _run(SpeakCommand(), client, out_file="a.wav", force=True)
+        assert not Path("a.wav").is_symlink()
+        assert Path("a.wav").read_bytes() == b"audio"
+        assert Path("t").read_bytes() == b"precious"
+
+    def test_missing_parent_is_output_unwritable_with_no_request(
+        self, fake_sys, client
+    ):
+        result = _run(SpeakCommand(), client, out_file="nope/a.wav")
+        assert isinstance(result, SpeakCodedError)
+        assert result.code == "output_unwritable"
+        assert result.next_step is None
+        assert result.details["path"] == "nope/a.wav"
+        assert result.details["reason"] == os.strerror(errno.ENOENT)
+        client.speak_text.assert_not_called()
+
+    def test_directory_target_is_output_unwritable(self, fake_sys, client):
+        Path("d").mkdir()
+        result = _run(SpeakCommand(), client, out_file="d")
+        assert result.code == "output_unwritable"
+        assert result.details["reason"] == os.strerror(errno.EISDIR)
+
+    def test_out_file_and_o_conflict(self, fake_sys, client, capsys):
+        cmd = SpeakCommand()
+        result = _run(cmd, client, out_file="a.wav", output="b.wav")
+        assert result.code == "invalid_argument"
+        assert result.error == (
+            "Use either --out-file or -o/--output for the audio file, not both."
+        )
+        assert result.next_step == "dg speak --help"
+        assert "DEPRECATED" not in capsys.readouterr().err
+        client.speak_text.assert_not_called()
+
+    @pytest.mark.parametrize("value", ["json", "yaml", "table", "csv", "JSON"])
+    def test_o_format_value_is_refused_with_a_runnable_next_step(
+        self, fake_sys, client, monkeypatch, value
+    ):
+        monkeypatch.setattr(
+            speak,
+            "_argv",
+            lambda: ["--profile", "work", "speak", "Q&A at 5", "-o", value],
+        )
+        result = _run(SpeakCommand(), client, output=value, text="Q&A at 5")
+        assert result.code == "invalid_argument"
+        assert result.error == (
+            f"dg speak -o is the audio file name, so -o {value} would write a "
+            f"file named {value}."
+        )
+        ns = result.next_step
+        assert ns is not None
+        assert shlex.join(shlex.split(ns)) == ns
+        tokens = shlex.split(ns)
+        assert tokens[:6] == ["dg", "--profile", "work", "-o", value, "speak"]
+        assert tokens[6:8] == ["Q&A at 5", "--out-file"]
+        assert tokens[8].startswith("speech-") and tokens[8].endswith(".mp3")
+        assert len(tokens) == 9
+        client.speak_text.assert_not_called()
+
+    def test_o_text_points_at_out_file(self, fake_sys, client, monkeypatch):
+        """There's no root text format: the fix drops -o and adds --out-file."""
+        monkeypatch.setattr(speak, "_argv", lambda: ["-q", "speak", "hi", "-o", "text"])
+        result = _run(SpeakCommand(), client, output="text", text="hi")
+        assert result.code == "invalid_argument"
+        assert result.error == (
+            "dg speak -o text would write the audio to a file named text."
+        )
+        assert result.hint == (
+            "Pass --out-file FILE to save the audio. There's no text output format."
+        )
+        tokens = shlex.split(result.next_step)
+        assert tokens[:5] == ["dg", "-q", "speak", "hi", "--out-file"]
+        assert tokens[5].startswith("speech-") and len(tokens) == 6
+        client.speak_text.assert_not_called()
+
+    def test_o_text_next_step_is_null_with_a_key_on_argv(
+        self, fake_sys, client, monkeypatch
+    ):
+        monkeypatch.setattr(
+            speak, "_argv", lambda: ["-k", "sk_sentinel", "speak", "hi", "-o", "text"]
+        )
+        result = _run(SpeakCommand(), client, output="text", text="hi")
+        assert result.error.startswith("dg speak -o text")
+        assert result.next_step is None
+
+    def test_o_format_next_step_is_null_with_a_key_on_argv(
+        self, fake_sys, client, monkeypatch
+    ):
+        monkeypatch.setattr(
+            speak,
+            "_argv",
+            lambda: ["--api-key", "sk_sentinel", "speak", "hi", "-o", "json"],
+        )
+        result = _run(SpeakCommand(), client, output="json", text="hi")
+        assert result.next_step is None
+        assert "sk_sentinel" not in result.model_dump_json()
+
+    def test_o_file_is_deprecated_once_and_overwrites(
+        self, fake_sys, client, capsys, monkeypatch
+    ):
+        Path("a.wav").write_bytes(b"old")
+        client.speak_text.side_effect = lambda **_: _stream([b"new"])
+        cmd = SpeakCommand()
+        _run(cmd, client, output="a.wav")
+        _run(cmd, client, output="a.wav")
+        err = capsys.readouterr().err
+        assert err.count("Deprecated:") == 1
+        assert (
+            "dg speak -o/--output FILE will set the output format in 1.0. Use "
+            "--out-file FILE instead (add --force to overwrite, as -o does)." in err
+        )
+        assert Path("a.wav").read_bytes() == b"new"
+
+    def test_deprecation_prints_under_quiet_in_agent_grammar(
+        self, fake_sys, client, capsys, monkeypatch
+    ):
+        from deepctl_core import output
+
+        monkeypatch.setattr(speak, "_agentic", True)
+        monkeypatch.setitem(output._output_config, "quiet", True)
+        client.speak_text.return_value = _stream([b"new"])
+        _run(SpeakCommand(), client, output="a.wav")
+        lines = [
+            ln for ln in capsys.readouterr().err.splitlines() if "DEPRECATED" in ln
+        ]
+        assert lines == [
+            "DEPRECATED: dg speak -o/--output FILE will set the output format "
+            "in 1.0. Use --out-file FILE instead (add --force to overwrite, as "
+            "-o does)."
+        ]
+
+    @pytest.mark.parametrize("fmt", ["json", "yaml"])
+    def test_f1_with_explicit_json_is_refused(self, fake_sys, client, monkeypatch, fmt):
+        f = Path("out.wav")
+        f.write_bytes(b"")
+        monkeypatch.setattr(sinks, "stdout_stat", lambda: os.stat(f))
+        monkeypatch.setattr(speak, "get_output_format", lambda: fmt)
+        monkeypatch.setattr(speak, "format_source", lambda: "explicit")
+        result = _run(SpeakCommand(), client, out_file="out.wav")
+        assert result.code == "invalid_argument"
+        name = fmt.upper()
+        assert result.error == (
+            "dg speak would write the audio to stdout, so there's no room for "
+            f"the {name} result."
+        )
+        assert result.hint == (
+            f"Give --out-file a different file from stdout, or don't ask for "
+            f"{name} output."
+        )
+        assert result.next_step == "dg speak --help"
+        client.speak_text.assert_not_called()
+
+    def test_f1_with_implicit_json_writes_audio_only(
+        self, fake_sys, client, monkeypatch, capsys
+    ):
+        f = Path("out.wav")
+        f.write_bytes(b"")
+        monkeypatch.setattr(sinks, "stdout_stat", lambda: os.stat(f))
+        monkeypatch.setattr(speak, "get_output_format", lambda: "json")
+        monkeypatch.setattr(speak, "format_source", lambda: "hard_agent")
+        monkeypatch.setattr(speak, "_agentic", True)
+        written: list[bytes] = []
+        stdout = Mock()
+        stdout.write.side_effect = written.append
+        monkeypatch.setattr(sinks.sys, "stdout", Mock(buffer=stdout))
+        client.speak_text.return_value = _stream([b"RIFF", b"data"])
+
+        cmd = SpeakCommand()
+        result = _run(cmd, client, out_file="out.wav")
+
+        assert result is None  # no document after the audio
+        assert cmd.stdout_is_protocol is True
+        assert written == [b"RIFF", b"data"]
+        assert "OK: Wrote 8 bytes to stdout" in capsys.readouterr().err
+
+
+# ── The command: no file on any error ───────────────────────────────────
+
+
+class TestNoPartialFile:
+    def test_request_error_leaves_no_file(self, fake_sys, client):
+        def unauthorized(**_):
+            raise RuntimeError("status_code: 401")
+            yield b""  # pragma: no cover
+
+        client.speak_text.side_effect = lambda **kw: unauthorized(**kw)
+        with pytest.raises(Exception, match="401"):
+            _run(SpeakCommand(), client, out_file="a.wav")
+        assert not Path("a.wav").exists()
+
+    def test_cut_stream_leaves_no_partial_file(self, fake_sys, client):
+        client.speak_text.return_value = _stream([b"a", b"b"], fail_after=True)
+        with pytest.raises(Exception, match="connection reset"):
+            _run(SpeakCommand(), client, out_file="a.wav")
+        assert list(Path().iterdir()) == []
+
+    def test_cut_stream_keeps_the_old_o_file(self, fake_sys, client):
+        Path("a.wav").write_bytes(b"old bytes")
+        client.speak_text.return_value = _stream([b"a"], fail_after=True)
+        with pytest.raises(Exception, match="connection reset"):
+            _run(SpeakCommand(), client, output="a.wav")
+        assert Path("a.wav").read_bytes() == b"old bytes"
+        assert [p.name for p in Path().iterdir()] == ["a.wav"]
+
+    def test_zero_chunks_leave_no_file(self, fake_sys, client):
+        client.speak_text.return_value = _stream([])
+        result = _run(SpeakCommand(), client, out_file="a.wav")
+        assert result.status == "error"
+        assert not Path("a.wav").exists()
+
+    def test_file_write_error_is_output_unwritable_with_no_partial_file(
+        self, fake_sys, client, monkeypatch
+    ):
+        real_write = os.write
+        calls = {"n": 0}
+
+        def fills_up(fd, data):
+            calls["n"] += 1
+            if calls["n"] > 1:
+                raise OSError(errno.ENOSPC, "No space left on device")
+            return real_write(fd, data)
+
+        monkeypatch.setattr(sinks.os, "write", fills_up)
+        client.speak_text.return_value = _stream([b"a", b"b", b"c"])
+        cmd = SpeakCommand()
+
+        result = _run(cmd, client, out_file="a.wav")
+
+        assert isinstance(result, SpeakCodedError)
+        assert result.code == "output_unwritable"
+        assert result.error == (
+            "Couldn't write the output to a.wav: No space left on device."
+        )
+        assert result.details == {"path": "a.wav", "reason": "No space left on device"}
+        assert cmd.exit_code_for(result) == 1
+        assert not Path("a.wav").exists()
+
+    def test_flux_file_is_created_on_the_first_frame(self, fake_sys, client):
+        seen: list[bool] = []
+
+        def check(i):
+            if i == 1:
+                seen.append(Path("a.wav").exists())
+
+        client.speak_text_stream.return_value = _stream(
+            [b"\x01\x00", b"\x02\x00"], check=check
+        )
+        result = _run(SpeakCommand(), client, out_file="a.wav", model="flux-alexis-en")
+        assert seen == [True]
+        assert isinstance(result, SpeakResult)
+        assert Path("a.wav").read_bytes()[:4] == b"RIFF"
+
+    def test_flux_cut_stream_leaves_no_file(self, fake_sys, client):
+        client.speak_text_stream.return_value = _stream([b"\x01\x00"], fail_after=True)
+        with pytest.raises(Exception, match="connection reset"):
+            _run(SpeakCommand(), client, out_file="a.wav", model="flux-alexis-en")
+        assert list(Path().iterdir()) == []
+
+    def test_machine_format_result_keeps_the_040_keys(self, fake_sys, client):
+        client.speak_text.return_value = _stream([b"abc"])
+        result = _run(SpeakCommand(), client, out_file="a.wav")
+        assert list(result.model_dump()) == [
+            "status",
+            "message",
+            "output_path",
+            "model",
+            "bytes_written",
+            "played",
+        ]
+
+
+# ── SIGTERM / SIGHUP mid-stream ─────────────────────────────────────────
+
+
+class TestTerminateMidStream:
+    @pytest.fixture
+    def died(self, monkeypatch):
+        calls: list[int] = []
+
+        def fake_die(signum):
+            calls.append(signum)
+            raise SystemExit(128 + signum)
+
+        monkeypatch.setattr(speak, "_die_by_signal", fake_die)
+        return calls
+
+    def _signalling_stream(self, sig, chunks):
+        import signal as _signal
+
+        def gen():
+            for i, chunk in enumerate(chunks):
+                yield chunk
+                if i == 0:
+                    os.kill(os.getpid(), sig)
+            raise AssertionError("the signal should have stopped the stream")
+
+        return gen(), _signal
+
+    @pytest.mark.parametrize("signame", ["SIGTERM", "SIGHUP"])
+    @pytest.mark.parametrize("model", ["aura-2-asteria-en", "flux-alexis-en"])
+    @pytest.mark.parametrize("force", [False, True])
+    def test_cleanup_runs_then_the_signal_ends_the_process(
+        self, fake_sys, client, died, signame, model, force
+    ):
+        import signal
+
+        sig = getattr(signal, signame)
+        if force:
+            Path("a.wav").write_bytes(b"OLD")
+        stream, _ = self._signalling_stream(
+            sig, [b"\x01\x00", b"\x02\x00", b"\x03\x00"]
+        )
+        if model.startswith("flux"):
+            client.speak_text_stream.return_value = stream
+        else:
+            client.speak_text.return_value = stream
+        before = signal.getsignal(sig)
+
+        with pytest.raises(SystemExit) as info:
+            _run(SpeakCommand(), client, out_file="a.wav", force=force, model=model)
+
+        assert info.value.code == 128 + sig
+        assert died == [sig]
+        if force:
+            assert Path("a.wav").read_bytes() == b"OLD"
+            assert [p.name for p in Path().iterdir()] == ["a.wav"]
+        else:
+            assert list(Path().iterdir()) == []
+        assert signal.getsignal(sig) == before  # handler restored
+
+    def test_a_stalled_unwind_is_cut_short_by_the_second_signal(
+        self, died, monkeypatch
+    ):
+        """If unwinding hangs (an unanswered close handshake), the
+        re-delivered signal runs the cleanup and ends the process."""
+        import signal
+
+        monkeypatch.setattr(speak, "_SIGNAL_GRACE_S", 0.05)
+        cleaned: list[bool] = []
+        with (
+            pytest.raises(SystemExit),
+            speak._terminate_cleanly(lambda: cleaned.append(True)),
+        ):
+            try:
+                os.kill(os.getpid(), signal.SIGTERM)
+                time.sleep(1)  # unreachable: the handler raises
+            except speak._Terminated:
+                # "Stuck" unwinding: wait until the re-delivered signal ends
+                # it (the handler raises SystemExit through this wait).
+                threading.Event().wait(60)
+        assert cleaned == [True]
+        assert died == [signal.SIGTERM]
+
+    def test_second_ctrl_c_cleans_up_and_cancels_like_the_first(self, monkeypatch):
+        """N-3: the second Ctrl-C (or the timer) unwinds by KeyboardInterrupt
+        again, so the usual cancel path, exit 2 and exit handlers follow;
+        the hard-exit backstop is cancelled with the guard."""
+        import signal
+
+        exits: list[int] = []
+        monkeypatch.setattr(speak.os, "_exit", exits.append)
+        cleaned: list[bool] = []
+        with (
+            pytest.raises(KeyboardInterrupt),
+            speak._terminate_cleanly(lambda: cleaned.append(True)),
+        ):
+            try:
+                os.kill(os.getpid(), signal.SIGINT)
+            except KeyboardInterrupt:
+                os.kill(os.getpid(), signal.SIGINT)
+        assert cleaned == [True]
+        assert exits == []
+        timers = [t for t in threading.enumerate() if isinstance(t, threading.Timer)]
+        assert all(t.finished.is_set() for t in timers)  # cancelled
+        assert signal.getsignal(signal.SIGINT) is signal.default_int_handler
+
+
+# ── Round 3: ignored signals, special bits, critical sections, fd paths ──
+
+
+class TestIgnoredSignalsStayIgnored:
+    """nohup, background jobs and `trap ''` keep their dispositions."""
+
+    @pytest.mark.parametrize("signame", ["SIGHUP", "SIGTERM", "SIGINT"])
+    def test_sig_ign_is_left_alone(self, signame):
+        import signal
+
+        sig = getattr(signal, signame)
+        before = signal.signal(sig, signal.SIG_IGN)
+        try:
+            with speak._terminate_cleanly(lambda: None):
+                assert signal.getsignal(sig) is signal.SIG_IGN
+                os.kill(os.getpid(), sig)  # ignored: nothing raises
+            assert signal.getsignal(sig) is signal.SIG_IGN
+        finally:
+            signal.signal(sig, before)
+
+    def test_a_handler_python_cant_restore_is_not_replaced(self, monkeypatch):
+        import signal
+
+        installed: list[int] = []
+        real_signal = signal.signal
+        real_getsignal = signal.getsignal
+        monkeypatch.setattr(
+            speak.signal,
+            "getsignal",
+            lambda sig: None if sig == signal.SIGHUP else real_getsignal(sig),
+        )
+
+        def recording(sig, handler):
+            installed.append(sig)
+            return real_signal(sig, handler)
+
+        monkeypatch.setattr(speak.signal, "signal", recording)
+        with speak._terminate_cleanly(lambda: None):
+            pass
+        assert signal.SIGHUP not in installed
+
+    @pytest.mark.parametrize("model", ["aura-2-asteria-en", "flux-alexis-en"])
+    @pytest.mark.parametrize("out_file", [True, False])
+    def test_the_stream_completes_through_an_ignored_sighup(
+        self, fake_sys, client, monkeypatch, model, out_file
+    ):
+        import signal
+
+        written: list[bytes] = []
+        fake_sys.stdout.buffer = Mock(write=written.append)
+
+        def gen():
+            yield b"\x01\x00"
+            os.kill(os.getpid(), signal.SIGHUP)
+            yield b"\x02\x00"
+
+        if model.startswith("flux"):
+            client.speak_text_stream.return_value = gen()
+        else:
+            client.speak_text.return_value = gen()
+        before = signal.signal(signal.SIGHUP, signal.SIG_IGN)
+        try:
+            kw = {"out_file": "a.wav"} if out_file else {}
+            result = _run(SpeakCommand(), client, model=model, **kw)
+        finally:
+            signal.signal(signal.SIGHUP, before)
+        if out_file:
+            assert isinstance(result, SpeakResult)
+            assert Path("a.wav").exists()
+        else:
+            assert result is None
+            assert b"\x02\x00" in written
+
+
+class TestRound3Sinks:
+    def test_replace_drops_setuid_setgid_and_sticky(self, tmp_path):
+        path = tmp_path / "a.wav"
+        path.write_bytes(b"old")
+        path.chmod(0o4755)
+        out = sinks.AudioFile(sinks.plan_target(str(path), overwrite=True))
+        out.write(b"new")
+        out.commit()
+        assert stat.S_IMODE(path.stat().st_mode) == 0o755
+
+    def test_a_signal_inside_the_rename_leaves_no_temp_file(
+        self, tmp_path, monkeypatch
+    ):
+        """N-1 (the reviewer's repro): os.replace interrupted; abort still
+        removes the temp file."""
+        path = tmp_path / "a.wav"
+        path.write_bytes(b"old")
+        out = sinks.AudioFile(sinks.plan_target(str(path), overwrite=True))
+        out.write(b"new")
+
+        def boom(*a):
+            raise speak._Terminated(15)
+
+        monkeypatch.setattr(sinks.os, "replace", boom)
+        with pytest.raises(speak._Terminated):
+            out.commit()
+        out.abort()
+        assert [p.name for p in tmp_path.iterdir()] == ["a.wav"]
+        assert path.read_bytes() == b"old"
+
+    def test_signals_wait_for_the_end_of_a_critical_section(self):
+        import signal
+
+        seen: list[str] = []
+
+        with (
+            pytest.raises(speak._Terminated),
+            speak._terminate_cleanly(lambda: None),
+        ):
+            with sinks.critical_section():
+                os.kill(os.getpid(), signal.SIGTERM)
+                seen.append("still inside")
+            seen.append("unreachable")
+        assert seen == ["still inside"]
+
+    def test_stdout_target_is_checked_on_fd_1_without_reopening(
+        self, tmp_path, monkeypatch
+    ):
+        f = tmp_path / "out.wav"
+        f.write_bytes(b"")
+        monkeypatch.setattr(sinks, "stdout_stat", lambda: os.stat(f))
+        target = sinks.plan_target(str(f), overwrite=False)
+        assert target.kind == "stdout"
+        opened: list[str] = []
+        real_open = os.open
+        monkeypatch.setattr(
+            sinks.os, "open", lambda p, *a: opened.append(p) or real_open(p, *a)
+        )
+        other = tmp_path / "other"
+        other.write_bytes(b"")
+        monkeypatch.setattr(sinks, "stdout_stat", lambda: os.stat(other))
+        with pytest.raises(sinks.Exists):
+            sinks.AudioFile(target).open()
+        assert opened == []
+
+    @pytest.mark.skipif(not os.path.isdir("/dev/fd"), reason="no /dev/fd")
+    def test_fd_path_with_force_is_refused_before_the_request(self, tmp_path):
+        victim = tmp_path / "v"
+        victim.write_bytes(b"VICTIM")
+        fd = os.open(victim, os.O_WRONLY | os.O_APPEND)
+        try:
+            path = f"/dev/fd/{fd}"
+            refusal = sinks.plan_target(path, overwrite=True)
+            assert refusal.reason == "unwritable"
+            assert refusal.error.strerror == (
+                "--force can't replace a file descriptor path"
+            )
+            assert sinks.plan_target(path, overwrite=False) == sinks.Refusal("exists")
+        finally:
+            os.close(fd)
+        assert victim.read_bytes() == b"VICTIM"
+
+    def test_stderr_is_refused(self, tmp_path, monkeypatch):
+        f = tmp_path / "err.log"
+        f.write_bytes(b"")
+        monkeypatch.setattr(sinks, "_stderr_stat", lambda: os.stat(f))
+        refusal = sinks.plan_target(str(f), overwrite=False)
+        assert refusal.reason == "unwritable"
+        assert refusal.error.strerror == (
+            "it's stderr, which carries this command's messages"
+        )
+
+
+class TestSignalGuardEdges:
+    """Windows re-delivery, the restore window, masks left blocked, bursts, and
+    cleanup outside the guard."""
+
+    def test_signal_inside_importlib_comes_again_later(self, monkeypatch):
+        """A raise inside importlib's lock bookkeeping can leave the import
+        lock held (a hang), so the guard lets the signal come again."""
+        import signal
+
+        from deepctl_core import signals
+
+        later: list[int] = []
+        inside = [True]
+        monkeypatch.setattr(signals, "in_importlib", lambda frame: inside[0])
+        monkeypatch.setattr(signals, "deliver_later", later.append)
+        signals._deferred_since.clear()
+        cleaned: list[bool] = []
+        with (
+            pytest.raises(speak._Terminated),
+            speak._terminate_cleanly(lambda: cleaned.append(True)),
+        ):
+            os.kill(os.getpid(), signal.SIGTERM)
+            time.sleep(0.05)  # handled, deferred: no raise
+            assert later == [signal.SIGTERM]
+            inside[0] = False
+            os.kill(os.getpid(), signal.SIGTERM)
+            time.sleep(1)  # unreachable: the handler raises
+        assert cleaned == []  # first signal: unwinding, no forced cleanup
+        signals._deferred_since.clear()
+
+    @staticmethod
+    def _importlib_frame():
+        import importlib
+        import sys
+
+        seen = []
+
+        class Finder:
+            def find_spec(self, name, path=None, target=None):
+                if name == "deepctl_speak_probe_xyz":
+                    seen.append(sys._getframe(1))
+
+        finder = Finder()
+        sys.meta_path.insert(0, finder)
+        try:
+            with pytest.raises(ModuleNotFoundError):
+                importlib.import_module("deepctl_speak_probe_xyz")
+        finally:
+            sys.meta_path.remove(finder)
+        return seen[0]
+
+    def test_guard_handler_defers_over_an_importlib_frame(self, monkeypatch):
+        """The guard's own handler holds a signal back inside importlib."""
+        import signal
+
+        from deepctl_core import signals
+
+        later: list[int] = []
+        monkeypatch.setattr(signals, "deliver_later", later.append)
+        signals._deferred_since.clear()
+        frame = self._importlib_frame()
+        with speak._terminate_cleanly(lambda: None):
+            installed = signal.getsignal(signal.SIGTERM)
+            installed(signal.SIGTERM, frame)  # no raise: deferred
+        assert later == [signal.SIGTERM]
+        signals._deferred_since.clear()
+
+    def test_guard_handler_coalesces_a_nested_signal(self, monkeypatch):
+        """The guard's handler uses core's coalescing, so a signal that
+        lands while it runs isn't judged by the handler's own frame."""
+        import signal
+        import sys
+
+        from deepctl_core import signals
+
+        calls: list[int] = []
+
+        def nested_then_defer(signum, frame):
+            calls.append(signum)
+            if len(calls) == 1:
+                signal.getsignal(signal.SIGTERM)(signum, sys._getframe())
+            return True
+
+        monkeypatch.setattr(speak, "_defer_in_importlib", nested_then_defer)
+        with speak._terminate_cleanly(lambda: None):
+            signal.getsignal(signal.SIGTERM)(signal.SIGTERM, None)
+        assert calls == [signal.SIGTERM]  # the nested call didn't run the body
+        assert signals._in_handler == []
+
+    def test_windows_never_kills_its_own_process(self, monkeypatch):
+        import signal
+
+        own = os.getpid()
+        killed: list[tuple[int, int]] = []
+        monkeypatch.setattr(sinks.os, "kill", lambda p, s: killed.append((p, s)))
+        interrupted: list[object] = []
+        import _thread
+
+        monkeypatch.setattr(_thread, "interrupt_main", lambda *a: interrupted.append(a))
+        monkeypatch.setattr(speak.os, "name", "nt")
+        speak._send_to_main(signal.SIGTERM)
+        assert interrupted == [(signal.SIGTERM,)]
+        with pytest.raises(SystemExit) as info:
+            speak._end_by_signal(signal.SIGTERM)
+        assert info.value.code == 128 + signal.SIGTERM
+        assert not [k for k in killed if k[0] == own]
+
+    def test_deferred_signal_is_raised_not_killed(self, monkeypatch):
+        import signal
+
+        def no_kill(pid, sig):
+            raise AssertionError("os.kill on our own pid")
+
+        monkeypatch.setattr(sinks.os, "kill", no_kill)
+        seen: list[int] = []
+
+        def h(signum, frame):
+            if sinks.defer_signal(signum):
+                return
+            seen.append(signum)
+
+        h._deepctl_defers = True
+        before = signal.signal(signal.SIGHUP, h)
+        try:
+            with sinks.critical_section():
+                sinks.defer_signal(signal.SIGHUP)
+            assert seen == [signal.SIGHUP]
+        finally:
+            signal.signal(signal.SIGHUP, before)
+
+    def test_most_severe_deferred_signal_wins(self):
+        """N-1: TERM then INT during a section ends by TERM."""
+        import signal
+
+        seen: list[int] = []
+
+        def h(signum, frame):
+            if sinks.defer_signal(signum):
+                return
+            seen.append(signum)
+
+        h._deepctl_defers = True
+        saved = {s: signal.signal(s, h) for s in (signal.SIGINT, signal.SIGTERM)}
+        try:
+            with sinks.critical_section():
+                sinks.defer_signal(signal.SIGTERM)
+                sinks.defer_signal(signal.SIGINT)
+            assert seen == [signal.SIGTERM]
+        finally:
+            for s, old in saved.items():
+                signal.signal(s, old)
+
+    @pytest.mark.parametrize("signame", ["SIGINT", "SIGTERM"])
+    def test_a_signal_during_the_restore_reaches_the_restored_handler(
+        self, monkeypatch, signame
+    ):
+        """S-2: closed guard, original handlers back, no live timer, no
+        cleanup; the signal goes to the handler that was there before."""
+        import signal
+
+        sig = getattr(signal, signame)
+        outer: list[int] = []
+        saved = {
+            s: signal.signal(s, lambda n, f: outer.append(n))
+            for s in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP)
+        }
+        mine = {s: signal.getsignal(s) for s in saved}
+        real = signal.signal
+        armed = [True]
+
+        def wrapped(s, h):
+            if armed[0] and getattr(h, "__name__", "") != "handler":
+                armed[0] = False
+                os.kill(os.getpid(), sig)  # arrives during the restore
+            return real(s, h)
+
+        cleaned: list[bool] = []
+        try:
+            monkeypatch.setattr(speak.signal, "signal", wrapped)
+            with speak._terminate_cleanly(lambda: cleaned.append(True)):
+                pass
+            monkeypatch.setattr(speak.signal, "signal", real)
+
+            def settled() -> bool:
+                timers = [
+                    t for t in threading.enumerate() if isinstance(t, threading.Timer)
+                ]
+                return bool(outer) and all(t.finished.is_set() for t in timers)
+
+            # Wait for the signal and any timer, up to a generous deadline.
+            deadline = time.monotonic() + 5.0
+            while not settled() and time.monotonic() < deadline:
+                time.sleep(0.01)
+            assert outer == [sig]
+            assert cleaned == []
+            assert {s: signal.getsignal(s) for s in saved} == mine
+            live = [t for t in threading.enumerate() if isinstance(t, threading.Timer)]
+            assert all(t.finished.is_set() for t in live)
+        finally:
+            for s, old in saved.items():
+                real(s, old)
+
+    @pytest.mark.skipif(
+        not hasattr(__import__("signal"), "pthread_sigmask"), reason="POSIX"
+    )
+    def test_mask_is_restored_under_a_signal_flood(self):
+        """S-3: the mask is always restored, even when a pending handler
+        raises inside the section's own setup. Run in a child process: the
+        flood can land on any bytecode."""
+        import subprocess
+        import sys as _sys
+
+        code = """
+import os, signal, threading, time
+from deepctl_cmd_speak import sinks
+class Boom(BaseException): pass
+stop = threading.Event()
+def h(signum, frame):
+    if sinks.defer_signal(signum) or stop.is_set():
+        return
+    raise Boom
+h._deepctl_defers = True
+signal.signal(signal.SIGTERM, h)
+go = threading.Event()
+def flood():
+    go.wait()
+    while not stop.is_set():
+        os.kill(os.getpid(), signal.SIGTERM); time.sleep(0.0002)
+threading.Thread(target=flood, daemon=True).start()
+stuck = raises = 0
+go.set()
+end = time.monotonic() + 1.5
+while True:
+    try:
+        while time.monotonic() < end:
+            try:
+                with sinks.critical_section():
+                    pass
+            except Boom:
+                raises += 1
+                if signal.SIGTERM in signal.pthread_sigmask(signal.SIG_BLOCK, set()):
+                    stuck += 1
+                    signal.pthread_sigmask(signal.SIG_SETMASK, set())
+        stop.set()
+        break
+    except Boom:
+        raises += 1
+time.sleep(0.05)
+print(f"raises={raises} masks_left_blocked={stuck} critical={sinks._critical}")
+"""
+        p = subprocess.run(
+            [_sys.executable, "-c", code], capture_output=True, text=True, timeout=60
+        )
+        assert p.returncode == 0, p.stderr[-2000:]
+        assert "masks_left_blocked=0 critical=0" in p.stdout, p.stdout
+        assert "raises=0" not in p.stdout
+
+    def test_abort_outside_the_guard_still_removes_the_temp_file(self, tmp_path):
+        """N-2: a Ctrl-C taken by another thread while abort() runs with no
+        guard installed is held until the removal is done."""
+        import signal
+
+        path = tmp_path / "a.wav"
+        path.write_bytes(b"OLD")
+        out = sinks.AudioFile(sinks.plan_target(str(path), overwrite=True))
+        out.write(b"x" * 100)
+        real_close = os.close
+        fd = out._fd
+
+        def close_then_signal(n):
+            real_close(n)
+            if n == fd:
+                t = threading.Thread(target=os.kill, args=(os.getpid(), signal.SIGINT))
+                t.start()
+                t.join()
+                time.sleep(0.05)
+
+        sinks.os.close = close_then_signal
+        try:
+            with pytest.raises(KeyboardInterrupt):
+                out.abort()  # delivered after the section, not inside it
+        finally:
+            sinks.os.close = real_close
+        assert [p.name for p in tmp_path.iterdir()] == ["a.wav"]
+        assert path.read_bytes() == b"OLD"
+        assert signal.getsignal(signal.SIGINT) is signal.default_int_handler
diff --git a/packages/deepctl-cmd-speak/tests/unit/test_speak_streaming.py b/packages/deepctl-cmd-speak/tests/unit/test_speak_streaming.py
new file mode 100644
index 00000000..e122c93e
--- /dev/null
+++ b/packages/deepctl-cmd-speak/tests/unit/test_speak_streaming.py
@@ -0,0 +1,406 @@
+"""Streaming audio to stdout and players as it arrives.
+
+Also the stdout failure modes: EPIPE ends quietly, any other write error
+is ``output_unwritable`` with fd 1 silenced.
+"""
+
+from __future__ import annotations
+
+import errno
+from contextlib import contextmanager
+from typing import Any
+from unittest.mock import Mock, patch
+
+import pytest
+from deepctl_cmd_speak import command as speak
+from deepctl_cmd_speak.command import SpeakCommand
+from deepctl_cmd_speak.models import SpeakCodedError, SpeakResult
+from deepctl_core import AuthManager, Config, DeepgramClient
+
+
+class _Recorder:
+    """An event log shared by a fake stream, a fake stdout and a fake player."""
+
+    def __init__(self) -> None:
+        self.events: list[tuple[str, Any]] = []
+        self.closed = False
+
+
+class _Stream:
+    """An SDK-like audio iterator that logs each hand-out and its close()."""
+
+    def __init__(self, rec: _Recorder, chunks: list[bytes]) -> None:
+        self._rec = rec
+        self._chunks = list(chunks)
+
+    def __iter__(self) -> _Stream:
+        return self
+
+    def __next__(self) -> bytes:
+        if not self._chunks:
+            raise StopIteration
+        chunk = self._chunks.pop(0)
+        self._rec.events.append(("yield", chunk))
+        return chunk
+
+    def close(self) -> None:
+        self._rec.closed = True
+
+
+class _Sink:
+    """A file-like stdout/player stdin that logs writes and flushes."""
+
+    def __init__(self, rec: _Recorder, fail_on: int | None = None, exc=None) -> None:
+        self._rec = rec
+        self._fail_on = fail_on
+        self._exc = exc
+        self._writes = 0
+
+    def write(self, data: bytes) -> int:
+        self._writes += 1
+        if self._fail_on is not None and self._writes >= self._fail_on:
+            raise self._exc
+        self._rec.events.append(("write", data))
+        return len(data)
+
+    def flush(self) -> None:
+        self._rec.events.append(("flush", None))
+
+
+def _run(cmd: SpeakCommand, client: Mock, **kwargs: Any):
+    base = {
+        "text": "Hello",
+        "output": None,
+        "model": "aura-2-asteria-en",
+        "encoding": None,
+        "container": None,
+        "sample_rate": None,
+        "file": None,
+    }
+    base.update(kwargs)
+    return cmd.handle(
+        config=Mock(spec=Config),
+        auth_manager=Mock(spec=AuthManager),
+        client=client,
+        **base,
+    )
+
+
+@pytest.fixture
+def fake_sys():
+    with patch("deepctl_cmd_speak.command.sys") as mock_sys:
+        mock_sys.stdin.isatty.return_value = True
+        mock_sys.stdout.isatty.return_value = False
+        mock_sys.argv = ["dg", "speak", "Hello"]
+        yield mock_sys
+
+
+@pytest.fixture
+def silenced():
+    with patch("deepctl_cmd_speak.command._silence_stdout") as fn:
+        yield fn
+
+
+class TestV1ToStdout:
+    def test_each_chunk_is_written_and_flushed_before_the_next(self, fake_sys):
+        rec = _Recorder()
+        fake_sys.stdout.buffer = _Sink(rec)
+        client = Mock(spec=DeepgramClient)
+        client.speak_text.return_value = _Stream(rec, [b"a", b"b", b"c"])
+
+        assert _run(SpeakCommand(), client) is None
+        assert rec.events == [
+            ("yield", b"a"),
+            ("write", b"a"),
+            ("flush", None),
+            ("yield", b"b"),
+            ("write", b"b"),
+            ("flush", None),
+            ("yield", b"c"),
+            ("write", b"c"),
+            ("flush", None),
+        ]
+        assert rec.closed
+
+    def test_epipe_stops_closes_the_response_and_ends_quietly(
+        self, fake_sys, silenced, capsys
+    ):
+        rec = _Recorder()
+        fake_sys.stdout.buffer = _Sink(rec, fail_on=2, exc=BrokenPipeError())
+        client = Mock(spec=DeepgramClient)
+        client.speak_text.return_value = _Stream(rec, [b"a", b"b", b"c", b"d"])
+        cmd = SpeakCommand()
+
+        result = _run(cmd, client)
+
+        assert result is None
+        assert cmd.exit_code_for(result) == 0
+        # Stopped at the failed write: "c" and "d" were never requested.
+        assert [e for e in rec.events if e[0] == "yield"] == [
+            ("yield", b"a"),
+            ("yield", b"b"),
+        ]
+        assert rec.closed
+        silenced.assert_called_once()
+        assert "Error" not in capsys.readouterr().err
+
+    @pytest.mark.parametrize("err", [errno.ENOSPC, errno.EIO, errno.EFBIG])
+    def test_other_write_errors_are_output_unwritable(
+        self, fake_sys, silenced, capsys, err
+    ):
+        rec = _Recorder()
+        exc = OSError(err, __import__("os").strerror(err))
+        fake_sys.stdout.buffer = _Sink(rec, fail_on=1, exc=exc)
+        client = Mock(spec=DeepgramClient)
+        client.speak_text.return_value = _Stream(rec, [b"a", b"b"])
+        cmd = SpeakCommand()
+
+        result = _run(cmd, client)
+
+        assert isinstance(result, SpeakCodedError)
+        assert cmd.exit_code_for(result) == 1
+        assert result.code == "output_unwritable"
+        assert result.next_step is None
+        assert result.details == {"path": "-", "reason": exc.strerror}
+        assert result.error == (f"Couldn't write the output to stdout: {exc.strerror}.")
+        assert rec.closed
+        # fd 1 is pointed at the null device before anything else is said,
+        # so the envelope can't land on stdout and the exit flush can't fail.
+        silenced.assert_called_once()
+        err_lines = [
+            line for line in capsys.readouterr().err.splitlines() if line.strip()
+        ]
+        assert any(result.error in line for line in err_lines)
+        assert any(result.hint in line for line in err_lines)
+        assert cmd.stdout_is_protocol is True
+
+    def test_error_text_is_sanitized(self, fake_sys, silenced):
+        rec = _Recorder()
+        exc = OSError(errno.EIO, "bad\x1b[31m\nthing" + "x" * 300)
+        fake_sys.stdout.buffer = _Sink(rec, fail_on=1, exc=exc)
+        client = Mock(spec=DeepgramClient)
+        client.speak_text.return_value = _Stream(rec, [b"a"])
+
+        result = _run(SpeakCommand(), client)
+
+        reason = result.details["reason"]
+        assert "\x1b" not in reason and "\n" not in reason
+        assert len(reason) <= 200
+
+
+class TestFluxToStdout:
+    def test_header_then_each_frame_flushed(self, fake_sys):
+        rec = _Recorder()
+        fake_sys.stdout.buffer = _Sink(rec)
+        client = Mock(spec=DeepgramClient)
+        client.speak_text_stream.return_value = _Stream(rec, [b"\x01\x00", b"\x02\x00"])
+
+        assert _run(SpeakCommand(), client, model="flux-alexis-en") is None
+        writes = [e for e in rec.events if e[0] != "yield"]
+        assert writes[0][0] == "write" and writes[0][1][:4] == b"RIFF"
+        assert writes[1:] == [
+            ("write", b"\x01\x00"),
+            ("flush", None),
+            ("write", b"\x02\x00"),
+            ("flush", None),
+        ]
+
+    def test_enospc_is_output_unwritable(self, fake_sys, silenced):
+        rec = _Recorder()
+        exc = OSError(errno.ENOSPC, "No space left on device")
+        fake_sys.stdout.buffer = _Sink(rec, fail_on=1, exc=exc)
+        client = Mock(spec=DeepgramClient)
+        client.speak_text_stream.return_value = _Stream(rec, [b"\x01\x00"])
+        cmd = SpeakCommand()
+
+        result = _run(cmd, client, model="flux-alexis-en")
+
+        assert isinstance(result, SpeakCodedError)
+        assert result.code == "output_unwritable"
+        assert cmd.exit_code_for(result) == 1
+        silenced.assert_called_once()
+
+    def test_epipe_ends_quietly(self, fake_sys, silenced):
+        rec = _Recorder()
+        fake_sys.stdout.buffer = _Sink(rec, fail_on=1, exc=BrokenPipeError())
+        client = Mock(spec=DeepgramClient)
+        client.speak_text_stream.return_value = _Stream(rec, [b"\x01\x00", b"\x02"])
+        cmd = SpeakCommand()
+
+        result = _run(cmd, client, model="flux-alexis-en")
+
+        assert result is None
+        assert cmd.exit_code_for(result) == 0
+        silenced.assert_called_once()
+
+
+class TestV1Play:
+    @pytest.fixture
+    def player(self, monkeypatch):
+        """A stdin player that logs its start and every write."""
+        rec = _Recorder()
+        state: dict[str, Any] = {"fail_on": None}
+
+        @contextmanager
+        def fake_player_stdin(name):
+            rec.events.append(("spawn", name))
+            yield _Sink(rec, fail_on=state["fail_on"], exc=BrokenPipeError())
+            rec.events.append(("waited", name))
+
+        monkeypatch.setattr(speak, "_player_stdin", fake_player_stdin)
+        monkeypatch.setattr(speak, "_find_audio_player", lambda: "ffplay")
+        return rec, state
+
+    def test_player_starts_first_and_gets_each_chunk_as_it_arrives(
+        self, fake_sys, player
+    ):
+        rec, _ = player
+        client = Mock(spec=DeepgramClient)
+        client.speak_text.return_value = _Stream(rec, [b"a", b"b"])
+
+        result = _run(SpeakCommand(), client, play=True, encoding="linear16")
+
+        assert isinstance(result, SpeakResult)
+        assert result.played is True
+        assert result.bytes_written == 2
+        assert rec.events == [
+            ("spawn", "ffplay"),
+            ("yield", b"a"),
+            ("write", b"a"),
+            ("flush", None),
+            ("yield", b"b"),
+            ("write", b"b"),
+            ("flush", None),
+            ("waited", "ffplay"),
+        ]
+        assert rec.closed
+
+    def test_player_quit_stops_and_closes_the_response(self, fake_sys, player):
+        rec, state = player
+        state["fail_on"] = 1
+        client = Mock(spec=DeepgramClient)
+        client.speak_text.return_value = _Stream(rec, [b"a", b"b", b"c"])
+
+        result = _run(SpeakCommand(), client, play=True, encoding="linear16")
+
+        assert isinstance(result, SpeakResult)
+        assert [e for e in rec.events if e[0] == "yield"] == [("yield", b"a")]
+        assert rec.closed
+
+    def test_no_audio_fails(self, fake_sys, player):
+        rec, _ = player
+        client = Mock(spec=DeepgramClient)
+        client.speak_text.return_value = _Stream(rec, [])
+        cmd = SpeakCommand()
+
+        result = _run(cmd, client, play=True, encoding="linear16")
+
+        assert result.status == "error"
+        assert "no audio" in result.message
+
+
+class TestResultOnStdout:
+    """The SpeakResult itself can't be written to stdout."""
+
+    def _result(self):
+        return SpeakResult(status="success", output_path="a.wav", bytes_written=3)
+
+    def test_full_stdout_is_output_unwritable_and_exits_1(self, silenced, capsys):
+        cmd = SpeakCommand()
+        with patch.object(
+            speak.BaseCommand,
+            "output_result",
+            side_effect=OSError(errno.ENOSPC, "No space left on device"),
+        ):
+            cmd.output_result(self._result(), Mock(spec=Config))
+        silenced.assert_called_once()
+        assert cmd.exit_code_for(self._result()) == 1
+        err = capsys.readouterr().err
+        assert "Couldn't write the output to stdout: No space left on device." in err
+
+    def test_epipe_on_the_result_is_quiet_and_exits_0(self):
+        """The real path: rich's own EPIPE handling under -o json, with the
+        reader of stdout already gone."""
+        import subprocess
+        import sys as _sys
+
+        code = (
+            "import sys\n"
+            "from deepctl_core.output import setup_output\n"
+            "setup_output('json')\n"
+            "from deepctl_cmd_speak.command import SpeakCommand\n"
+            "from deepctl_cmd_speak.models import SpeakResult\n"
+            "cmd = SpeakCommand()\n"
+            "r = SpeakResult(status='success', output_path='a.wav', message='x' * 70000)\n"
+            "cmd.output_result(r, None)\n"
+            "sys.stderr.write(f'RC={cmd.exit_code_for(r)}\\n')\n"
+        )
+        p = subprocess.Popen(
+            [_sys.executable, "-c", code],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            env={**__import__("os").environ, "DEEPCTL_TELEMETRY_DISABLED": "1"},
+        )
+        p.stdout.close()  # the reader is gone before the result is written
+        err = p.stderr.read().decode()
+        assert p.wait(60) == 0, err
+        assert "RC=0" in err
+        assert "Traceback" not in err and "Exception ignored" not in err
+
+    def test_a_coded_error_is_not_reported_twice(self, silenced, capsys):
+        cmd = SpeakCommand()
+        coded = SpeakCodedError(error="x", code="output_unwritable", hint="h")
+        with patch.object(
+            speak.BaseCommand, "output_result", side_effect=OSError(errno.EIO, "I/O")
+        ):
+            cmd.output_result(coded, Mock(spec=Config))
+        silenced.assert_called_once()
+        assert capsys.readouterr().err == ""
+
+
+class TestCloseIsBounded:
+    def test_a_hanging_close_is_abandoned_after_the_timeout(self):
+        import threading
+        import time
+
+        release = threading.Event()
+
+        class Hangs:
+            def close(self):
+                release.wait(5)
+
+        t0 = time.monotonic()
+        speak._close(Hangs(), timeout=0.2)
+        assert time.monotonic() - t0 < 3.0  # the close itself hangs 5 s
+        release.set()
+
+    def test_several_closes_share_one_timeout(self):
+        """Closing the stream and the response behind it waits once, not
+        once per close."""
+        import threading
+        import time
+
+        release = threading.Event()
+        closed: list[str] = []
+
+        class Hangs:
+            def __init__(self, name):
+                self.name = name
+
+            def close(self):
+                closed.append(self.name)
+                release.wait(10)
+
+        # One 2 s wait; one per close would be 4 s.
+        t0 = time.monotonic()
+        speak._close(Hangs("a"), Hangs("b"), timeout=2.0)
+        assert time.monotonic() - t0 < 3.5
+        assert closed == ["a"]  # in order; b waits behind the stalled a
+        release.set()
+
+    def test_close_errors_are_quiet(self):
+        class Fails:
+            def close(self):
+                raise RuntimeError("boom")
+
+        speak._close(Fails())
diff --git a/packages/deepctl-cmd-speak/tests/unit/test_speak_strings.py b/packages/deepctl-cmd-speak/tests/unit/test_speak_strings.py
new file mode 100644
index 00000000..433db9ee
--- /dev/null
+++ b/packages/deepctl-cmd-speak/tests/unit/test_speak_strings.py
@@ -0,0 +1,62 @@
+"""Speak's messages match the error catalogue (``error_codes.json``)."""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+from pathlib import Path
+
+import pytest
+from deepctl_cmd_speak import messages as msg
+
+# (code, error ID, hint_human, hint_agent, hint_agent_if_next_step_null)
+_WIRING = [
+    ("output_unwritable", "E-OUTPUT-UNWRITABLE", "H-OUTPUT-UNWRITABLE",
+     "A-OUTPUT-UNWRITABLE", None),
+    ("invalid_argument", "E-STDOUT-BYTES", "H-STDOUT-BYTES", "H-STDOUT-BYTES", None),
+    ("invalid_argument", "E-SPEAK-NO-OUTPUT", "H-SPEAK-NO-OUTPUT",
+     "A-SPEAK-NO-OUTPUT", "A-SPEAK-NO-OUTPUT-NULL"),
+    ("invalid_argument", "E-SPEAK-NO-TEXT", "H-SPEAK-NO-TEXT", "H-SPEAK-NO-TEXT", None),
+    ("invalid_argument", "E-OUT-FILE-EXISTS", "H-OUT-FILE-EXISTS",
+     "H-OUT-FILE-EXISTS", None),
+    ("invalid_argument", "E-SPEAK-O-FORMAT", "H-SPEAK-O-FORMAT",
+     "H-SPEAK-O-FORMAT", None),
+    ("invalid_argument", "E-SPEAK-O-TEXT", "H-SPEAK-O-TEXT", "H-SPEAK-O-TEXT", None),
+    ("invalid_argument", "E-SPEAK-OUT-CONFLICT", "H-SPEAK-OUT-CONFLICT",
+     "H-SPEAK-OUT-CONFLICT", None),
+]  # fmt: skip
+
+
+def _ids() -> dict[str, str]:
+    return {
+        name.replace("_", "-"): value
+        for name, value in vars(msg).items()
+        if re.fullmatch(r"[EHAD]_[A-Z0-9_]+", name)
+    }
+
+
+def test_every_wired_id_has_a_string():
+    ids = _ids()
+    assert "A-SPEAK-NO-OUTPUT-ARGV" not in ids  # folded into the NULL variant
+    for _code, *message_ids in _WIRING:
+        for message_id in message_ids:
+            assert message_id is None or message_id in ids, message_id
+
+
+@pytest.mark.skipif(
+    not os.environ.get("DG_ERROR_CODES_JSON"),
+    reason="DG_ERROR_CODES_JSON names no error catalogue file",
+)
+def test_strings_match_catalogue():
+    catalogue = json.loads(Path(os.environ["DG_ERROR_CODES_JSON"]).read_text())
+    for message_id, text in _ids().items():
+        assert catalogue["strings"][message_id] == text, message_id
+    for code, error_id, human, agent, agent_null in _WIRING:
+        entry = catalogue["codes"][code]
+        message = next(m for m in entry["messages"] if m["id"] == error_id)
+        assert message["hint_human"] == human, error_id
+        assert message["hint_agent"] == agent, error_id
+        assert message.get("hint_agent_if_next_step_null") == agent_null, error_id
+    assert msg.CODE_INVALID_ARGUMENT in catalogue["codes"]
+    assert msg.CODE_OUTPUT_UNWRITABLE in catalogue["codes"]
diff --git a/packages/deepctl-core/pyproject.toml b/packages/deepctl-core/pyproject.toml
index 84dc1bdd..0b64e905 100644
--- a/packages/deepctl-core/pyproject.toml
+++ b/packages/deepctl-core/pyproject.toml
@@ -33,6 +33,7 @@ dependencies = [
     "pyyaml>=6.0.0",
     "platformdirs>=3.0.0,<5",
     "packaging>=21.0",
+    "websockets>=13.1,<18",
 ]
 
 [project.optional-dependencies]
diff --git a/packages/deepctl-core/src/deepctl_core/auth.py b/packages/deepctl-core/src/deepctl_core/auth.py
index f9d3c7ff..03044105 100644
--- a/packages/deepctl-core/src/deepctl_core/auth.py
+++ b/packages/deepctl-core/src/deepctl_core/auth.py
@@ -3,17 +3,19 @@
 import os
 import time
 import webbrowser
+from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from typing import TYPE_CHECKING, Any
-from urllib.parse import urlencode
+from urllib.parse import urlsplit
 
-from pydantic import BaseModel
+from pydantic import BaseModel, field_validator
 
 from . import hosts, output
 from . import messages as msg
 from .client import _split_base_url
 from .config import Config
 from .hosts import check_credential_host, check_identity_host
+from .login_state import MIN_POLL_INTERVAL
 from .models import ProfileInfo, ProfilesResult
 from .output import stderr_console
 
@@ -66,6 +68,21 @@ def _load_modules() -> None:
 # Keyring service identifier using reverse domain notation
 KEYRING_SERVICE = "com.deepgram.dx.deepctl"
 
+# Sent where the identity provider asks for a device name: a fixed value,
+# never this machine's hostname.
+DEVICE_NAME = "deepctl"
+DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code"
+
+
+def _https_or_loopback(url: str | None) -> str | None:
+    """``url`` when it is https, or http to a loopback host; else ValueError."""
+    if url is None:
+        return None
+    origin = hosts.parse_origin(url)
+    if origin is None or not (origin.secure or hosts.is_loopback(origin.host)):
+        raise ValueError("the login link must use https")
+    return url
+
 
 class DeviceCodeResponse(BaseModel):
     """Response from device code request."""
@@ -75,18 +92,47 @@ class DeviceCodeResponse(BaseModel):
     verification_uri: str
     verification_uri_complete: str | None = None
     expires_in: int
-    interval: int
+    interval: int = 5
+
+    _check_uris = field_validator("verification_uri", "verification_uri_complete")(
+        _https_or_loopback
+    )
 
 
 class TokenResponse(BaseModel):
-    """Response from token request."""
+    """Response from token request (``pid`` is the RFC 8628 path's name for
+    the project ID)."""
 
     access_token: str
-    project_id: str
+    project_id: str | None = None
+    pid: str | None = None
     dg_token: str | None = None
     dg_expires_in: int | None = None
 
 
+@dataclass(frozen=True)
+class DevicePoll:
+    """One answer from the token endpoint.
+
+    ``state`` is ``token`` (``token`` is set), ``pending``, ``slow_down``,
+    ``denied``, ``expired`` or ``error`` (``detail`` says why).
+    """
+
+    state: str
+    token: TokenResponse | None = None
+    detail: str = ""
+    retry_after: int | None = None
+
+
+def _retry_after(response: "httpx.Response") -> int | None:
+    """The server's Retry-After in whole seconds (delta form only), or None."""
+    value = response.headers.get("Retry-After")
+    if not isinstance(value, str) or not value.strip().isdigit():
+        return None
+    value = value.strip()
+    return min(int(value), 3600)
+
+
 def _insecure_allowed() -> bool:
     """Whether DEEPGRAM_CLI_INSECURE may turn off TLS verification.
 
@@ -137,12 +183,28 @@ def _warn_if_verified(request: "httpx.Request") -> None:
         output.print_hint(escape(msg.W_INSECURE_REMOTE_HINT))
 
 
+def escape(text: str) -> str:
+    """rich.markup.escape, imported on first use (no rich at import)."""
+    from rich.markup import escape as rich_escape
+
+    return rich_escape(text)
+
+
 class AuthenticationError(Exception):
     """Authentication related errors."""
 
     pass
 
 
+class DeviceCodeUnreadable(AuthenticationError):
+    """The device-code answer from ``host`` couldn't be read (not a JSON
+    object with the expected fields): ``network_unavailable``."""
+
+    def __init__(self, host: str) -> None:
+        super().__init__(f"unreadable device code response from {host}")
+        self.host = host
+
+
 class AuthManager:
     """Cross-platform authentication manager."""
 
@@ -517,12 +579,13 @@ def verify_credentials(
             )
 
     def guard(self) -> None:
-        """Guard function to ensure a valid API key is available.
+        """Check that an API key is available, without sending it anywhere.
 
-        Only validates that the API key works. Project ID validation
-        is handled separately by requires_project on BaseCommand.
-        Refuses first, before reading or sending any key, when the base URL
-        isn't trusted with credentials.
+        Refuses first, before reading any key, when the base URL isn't
+        trusted with credentials. The key itself is checked by the command's
+        own request: a 401 or 403 there becomes ``auth_invalid`` or
+        ``auth_forbidden`` (see ``deepctl_core.transport``). Project ID
+        validation is handled separately by requires_project on BaseCommand.
         """
         self.check_base_url()
         api_key = self.get_api_key()
@@ -551,20 +614,6 @@ def guard(self) -> None:
             )
             raise AuthenticationError("DEEPGRAM_API_KEY is not set")
 
-        # Verify the API key is valid (does NOT require project_id)
-        success, message, error_type = self.verify_api_key(api_key)
-        if not success:
-            console.print(f"[red]Error:[/red] {message}")
-
-            if error_type == "auth":
-                console.print(
-                    "[yellow]Your API key may have expired or been "
-                    "revoked.[/yellow]\n"
-                    "[yellow]Run[/yellow] [bold]deepctl login[/bold] "
-                    "[yellow]to re-authenticate.[/yellow]"
-                )
-            raise AuthenticationError(message)
-
     def login_with_api_key(
         self, api_key: str, project_id: str | None = None, _force_write: bool = False
     ) -> None:
@@ -575,12 +624,6 @@ def login_with_api_key(
             project_id: Deepgram project ID (optional — can be set later)
             force_write: Skip confirmation prompts
         """
-        # Validate API key format (basic check)
-        if not api_key.startswith(("sk-", "pk-")):
-            console.print(
-                "[red]Warning:[/red] API key format doesn't match expected pattern"
-            )
-
         # Verify API key (and project if provided)
         console.print("[dim]Verifying credentials...[/dim]")
         success, message, error_type = self.verify_credentials(
@@ -593,13 +636,12 @@ def login_with_api_key(
             elif error_type == "project":
                 # Project ID is invalid, but the key might be fine — warn but
                 # still store the key so the user isn't locked out.
-                console.print(
-                    f"[yellow]Warning:[/yellow] {message}. "
-                    "API key will still be stored."
+                output.print_warning(
+                    escape(f"{message}. API key will still be stored."), stderr=True
                 )
                 console.print(
-                    "[dim]You can update the project ID later with: "
-                    "deepctl login --project-id <id>[/dim]"
+                    "[dim]You can set the project ID later with: "
+                    f"{transport.prog() or 'dg'} login --project-id <id>[/dim]"
                 )
                 # Clear the bad project_id so we don't store it
                 project_id = None
@@ -620,8 +662,13 @@ def login_with_api_key(
             console.print("[green]✓[/green] API key stored securely in system keyring")
             keyring_available = True
         except Exception as e:
-            console.print(f"[yellow]Warning:[/yellow] Could not store in keyring: {e}")
-            console.print("API key will be stored in config file instead")
+            output.print_warning(
+                escape(
+                    f"Could not store in keyring: {e}. "
+                    "The API key will be stored in the config file instead."
+                ),
+                stderr=True,
+            )
 
         # Update config with non-sensitive data
         # Only store API key in config if keyring is not available
@@ -637,7 +684,7 @@ def login_with_api_key(
         if project_id:
             console.print(f"[dim]Project ID:[/dim] {project_id}")
 
-    def login_with_device_flow(self) -> None:
+    def login_with_device_flow(self, open_browser: bool = True) -> None:
         """Login using device flow (interactive method)."""
         console.print("[blue]Starting device flow authentication...[/blue]")
 
@@ -645,9 +692,6 @@ def login_with_device_flow(self) -> None:
         identity_url = check_identity_host(self.config)
 
         try:
-            # Get hostname for device identification
-            hostname = os.uname().nodename if hasattr(os, "uname") else "unknown"
-
             # Request device code from dx-id auth provider
             device_response = self._request_device_code(identity_url)
 
@@ -657,28 +701,37 @@ def login_with_device_flow(self) -> None:
             )
 
             # Open browser immediately and start polling
-            console.print(
-                "\n[bold]Hello from Deepgram![/bold] Opening browser to "
-                "complete login..."
+            if open_browser:
+                console.print(
+                    "\n[bold]Hello from Deepgram![/bold] Opening browser to "
+                    "complete login..."
+                )
+            else:
+                console.print(
+                    "\n[bold]Hello from Deepgram![/bold] Open the link below to "
+                    "complete login."
+                )
+            output.print_info(
+                escape(
+                    msg.I_LOGIN_PENDING.format(
+                        verification_uri=msg.display(device_response.verification_uri),
+                        user_code=msg.display(device_response.user_code or ""),
+                    )
+                ),
+                stderr=True,
             )
-            if device_response.user_code:
-                console.print(f"[bold]Enter code:[/bold] {device_response.user_code}")
 
-            try:
-                webbrowser.open(verification_uri)
-                console.print("[green]✓[/green] Opened browser for authentication")
-            except Exception as e:
-                console.print(f"[yellow]Warning:[/yellow] Could not open browser: {e}")
-
-            console.print(
-                f"[dim]If the browser didn't open, visit:[/dim] "
-                f"[dim]{verification_uri}[/dim]\n"
-            )
+            if open_browser:
+                try:
+                    webbrowser.open(verification_uri)
+                    console.print("[green]✓[/green] Opened browser for authentication")
+                except Exception as e:
+                    console.print(
+                        f"[yellow]Warning:[/yellow] Could not open browser: {e}"
+                    )
 
             # Poll for token (starts immediately — user may have clicked the link)
-            token_response = self._poll_for_token(
-                device_response, hostname, identity_url
-            )
+            token_response = self._poll_for_token(device_response, identity_url)
 
             # Store token and get user info
             self._store_token(token_response)
@@ -686,6 +739,8 @@ def login_with_device_flow(self) -> None:
             console.print("\n[green]Key created and stored successfully.[/green]")
             console.print("\nYou are now logged in. Happy coding!")
 
+        except DeviceCodeUnreadable:
+            raise
         except Exception as e:
             console.print(f"[red]Error during device flow:[/red] {e}")
             raise AuthenticationError(f"Device flow failed: {e}")
@@ -698,11 +753,9 @@ def _request_device_code(
         Returns:
             DeviceCodeResponse with device code and verification URI
         """
-        hostname = os.uname().nodename if hasattr(os, "uname") else "unknown"
-
         payload = {
             "client_id": CLIENT_ID,
-            "hostname": hostname,
+            "hostname": DEVICE_NAME,
             "scopes": "openid profile email",
         }
 
@@ -714,8 +767,18 @@ def _request_device_code(
                 headers={"Content-Type": "application/json"},
             )
 
-            if response.status_code == 201:
-                return DeviceCodeResponse(**response.json())
+            if response.status_code in (200, 201):
+                host = urlsplit(base).hostname or base
+                try:
+                    body = response.json()
+                except ValueError:
+                    raise DeviceCodeUnreadable(host) from None
+                if not isinstance(body, dict):
+                    raise DeviceCodeUnreadable(host)
+                try:
+                    return DeviceCodeResponse(**body)
+                except (ValueError, TypeError):  # incl. pydantic ValidationError
+                    raise DeviceCodeUnreadable(host) from None
             else:
                 raise AuthenticationError(
                     f"Device code request failed: {response.status_code}"
@@ -724,25 +787,69 @@ def _request_device_code(
         except httpx.RequestError as e:
             raise AuthenticationError(f"Network error during device code request: {e}")
 
+    def poll_device_token(
+        self, device_code: str, identity_url: str | None = None
+    ) -> DevicePoll:
+        """Ask the token endpoint once whether ``device_code`` was approved.
+
+        A POST (RFC 8628 §3.4), so the device code never lands in a URL,
+        and no device name is sent. Network errors are raised
+        (``httpx.RequestError``).
+        """
+        base = identity_url or check_identity_host(self.config)
+        response = self.client.post(
+            f"{base}/token",
+            data={
+                "grant_type": DEVICE_CODE_GRANT,
+                "device_code": device_code,
+                "client_id": CLIENT_ID,
+            },
+        )
+        try:
+            body = response.json()
+        except ValueError:
+            body = None
+        if not isinstance(body, dict):
+            body = {}
+        if response.status_code in (200, 201):
+            try:
+                return DevicePoll("token", token=TokenResponse(**body))
+            except ValueError:
+                return DevicePoll("error", detail="unusable token response")
+        if response.status_code == 429:
+            return DevicePoll("slow_down", retry_after=_retry_after(response))
+        error = body.get("error")
+        if response.status_code >= 500 or error == "temporarily_unavailable":
+            # A transient server problem: back off and ask again.
+            return DevicePoll(
+                "unavailable",
+                detail=f"HTTP {response.status_code}",
+                retry_after=_retry_after(response),
+            )
+        state = {
+            "authorization_pending": "pending",
+            "slow_down": "slow_down",
+            "access_denied": "denied",
+            "expired_token": "expired",
+        }.get(error if isinstance(error, str) else "")
+        if state is not None:
+            return DevicePoll(state)
+        reason = error if isinstance(error, str) else "unknown error"
+        return DevicePoll(
+            "error", detail=f"HTTP {response.status_code}: {msg.display(reason)[:80]}"
+        )
+
     def _poll_for_token(
         self,
         device_response: DeviceCodeResponse,
-        hostname: str,
         identity_url: str | None = None,
     ) -> TokenResponse:
-        """Poll for token using device code."""
+        """Poll for token using device code until approved, denied or expired."""
         console.print("\n[blue]Waiting for authentication...[/blue]")
 
         start_time = time.time()
-
-        query_params = {
-            "device_code": device_response.device_code,
-            "client_id": CLIENT_ID,
-            "hostname": hostname,
-        }
-
+        interval = max(MIN_POLL_INTERVAL, device_response.interval)
         base = identity_url or check_identity_host(self.config)
-        poll_url = f"{base}/device/token?{urlencode(query_params)}"
 
         from rich.progress import Progress, SpinnerColumn, TextColumn
 
@@ -756,28 +863,26 @@ def _poll_for_token(
 
             while time.time() - start_time < device_response.expires_in:
                 try:
-                    # Use GET request like Go implementation
-                    response = self.client.get(poll_url)
-
-                    if response.status_code == 201:
-                        response_data = response.json()
-                        return TokenResponse(**response_data)
-                    elif response.status_code == 404:
-                        # Still pending - this is the expected status code from
-                        # Go implementation
-                        time.sleep(device_response.interval)
-                        continue
-                    else:
-                        error_data = response.json()
-                        raise AuthenticationError(
-                            f"Token request failed: "
-                            f"{error_data.get('error', 'Unknown error')}"
-                        )
-
+                    poll = self.poll_device_token(device_response.device_code, base)
                 except httpx.RequestError as e:
                     console.print(f"[red]Network error:[/red] {e}")
-                    time.sleep(device_response.interval)
+                    time.sleep(interval)
+                    continue
+                if poll.state == "token" and poll.token is not None:
+                    return poll.token
+                if poll.state == "pending":
+                    time.sleep(interval)
+                    continue
+                if poll.state in ("slow_down", "unavailable"):
+                    interval = max(interval + 5, poll.retry_after or 0)
+                    left = device_response.expires_in - (time.time() - start_time)
+                    time.sleep(max(0.0, min(interval, left)))
                     continue
+                if poll.state == "denied":
+                    raise AuthenticationError(msg.E_AUTH_DENIED)
+                if poll.state == "expired":
+                    break
+                raise AuthenticationError(str(poll.detail))
 
         raise AuthenticationError("Authentication timed out")
 
@@ -810,10 +915,13 @@ def _store_token(self, token_response: TokenResponse) -> None:
                 )
                 keyring_available = True
             except Exception as e:
-                console.print(
-                    f"[yellow]Warning:[/yellow] Could not store in keyring: {e}"
+                output.print_warning(
+                    escape(
+                        f"Could not store in keyring: {e}. "
+                        "The API key will be stored in the config file instead."
+                    ),
+                    stderr=True,
                 )
-                console.print("API key will be stored in config file instead")
 
             for keyring_key in (f"jwt.{profile_name}", f"refresh-token.{profile_name}"):
                 self._delete_keyring_credential(keyring_key)
@@ -821,7 +929,7 @@ def _store_token(self, token_response: TokenResponse) -> None:
             self.config.create_profile(
                 profile_name,
                 api_key=api_key if not keyring_available else None,
-                project_id=token_response.project_id,
+                project_id=token_response.project_id or token_response.pid,
             )
             profile = self.config.get_profile(profile_name)
             profile.dg_token_expires_at = expires_at
@@ -830,10 +938,6 @@ def _store_token(self, token_response: TokenResponse) -> None:
                 console.print(
                     "[green]✓[/green] API key stored securely in system keyring"
                 )
-            else:
-                console.print(
-                    "[yellow]Warning:[/yellow] API key stored in the config file fallback"
-                )
             return
 
         raise AuthenticationError(
diff --git a/packages/deepctl-core/src/deepctl_core/base_command.py b/packages/deepctl-core/src/deepctl_core/base_command.py
index ca6af5b9..1b930b31 100644
--- a/packages/deepctl-core/src/deepctl_core/base_command.py
+++ b/packages/deepctl-core/src/deepctl_core/base_command.py
@@ -1,7 +1,8 @@
 """Base command class for deepctl commands."""
 
+import sys
 from abc import ABC, abstractmethod
-from typing import Any, ClassVar
+from typing import Any, ClassVar, TextIO
 
 import click
 
@@ -10,9 +11,17 @@
 from .config import Config, flush_config_notices
 from .hosts import CredentialHostError
 from .models import CodedErrorResult, ErrorResult
-from .output import _agentic, print_error, print_error_hint, stderr_console
+from .output import (
+    _agentic,
+    _output_config,
+    print_error,
+    print_error_hint,
+    print_hint,
+    stderr_console,
+)
 from .output import console as stdout_console
 from .timing import TimingContext
+from .transport import TransportError
 
 # The PAYLOAD console -- stdout, deliberately. Tables, JSON and raw text
 # written by _output_* are the machine-readable result and belong there.
@@ -21,6 +30,69 @@
 console = stdout_console
 
 
+# Mode A stderr grammar: every line starts with one of
+# these. Lines that start with "Error"/"Warning" are 0.4.0 error text a
+# command printed itself, kept until a later release codes them.
+_MODE_A_PREFIXES = (
+    "ERROR: ",
+    "WARN: ",
+    "INFO: ",
+    "HINT: ",
+    "OK: ",
+    "DEPRECATED: ",
+    "Error",
+    "Warning",
+)
+
+# Built-in commands whose requests go through DeepgramClient and the shared
+# Transport. In mode A their handlers run without status chrome on
+# stderr. Other commands print things the caller needs there (login's device
+# code, dg api's response errors, debug-probe's proxy address), so they keep
+# it. Built-in names can't be taken by plugins.
+_CHROME_FREE_COMMANDS = frozenset(
+    {
+        "billing",
+        "keys",
+        "listen",
+        "members",
+        "models",
+        "projects",
+        "read",
+        "requests",
+        "speak",
+        "transcribe",
+        "usage",
+    }
+)
+
+
+class _ModeAStderr:
+    """``sys.stderr`` for a command's handler in mode A: drops status chrome.
+
+    Each write that starts a line is kept or dropped as a whole, so one
+    ``print`` that wraps over several lines stays together.
+    """
+
+    def __init__(self, stream: TextIO) -> None:
+        self._stream = stream
+        self._keep = True
+        self._line_start = True
+
+    def write(self, text: str) -> int:
+        if not text:
+            return 0
+        if self._line_start:
+            first = text.lstrip("\n").split("\n", 1)[0]
+            self._keep = bool(first.strip()) and first.startswith(_MODE_A_PREFIXES)
+        if self._keep:
+            self._stream.write(text)
+        self._line_start = text.endswith("\n")
+        return len(text)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._stream, name)
+
+
 class UnexpectedCommandError(click.ClickException):
     """A command failed with an error it didn't raise on purpose.
 
@@ -189,7 +261,7 @@ def execute(self, ctx: click.Context, **kwargs: Any) -> None:
             # Execute the command
             try:
                 with TimingContext(f"command_{self.name}_handler"):
-                    result = self.handle(config, auth_manager, client, **kwargs)
+                    result = self._run_handler(config, auth_manager, client, **kwargs)
 
                 # Handle command result
                 if result is not None:
@@ -210,6 +282,10 @@ def execute(self, ctx: click.Context, **kwargs: Any) -> None:
                 stderr_console.print("\n[yellow]Command cancelled by user[/yellow]")
                 raise click.Abort()
 
+            except TransportError as e:
+                self._report_transport_error(e, ctx, config, auth_manager)
+                raise SystemExit(1) from None
+
             except CredentialHostError as e:
                 # Already reported on stderr; nothing was sent.
                 try:
@@ -234,6 +310,52 @@ def execute(self, ctx: click.Context, **kwargs: Any) -> None:
             if exit_code:
                 raise SystemExit(exit_code)
 
+    def _run_handler(
+        self,
+        config: Config,
+        auth_manager: AuthManager,
+        client: DeepgramClient,
+        **kwargs: Any,
+    ) -> Any:
+        """Run ``handle``; in mode A, without status chrome on stderr."""
+        if (
+            not _output_config["agentic"]
+            or _output_config["verbose"]
+            or self.name not in _CHROME_FREE_COMMANDS
+        ):
+            return self.handle(config, auth_manager, client, **kwargs)
+        real = sys.stderr
+        sys.stderr = _ModeAStderr(real)
+        try:
+            return self.handle(config, auth_manager, client, **kwargs)
+        finally:
+            sys.stderr = real
+
+    def _report_transport_error(
+        self,
+        error: TransportError,
+        ctx: click.Context,
+        config: Config,
+        auth_manager: AuthManager,
+    ) -> None:
+        """Two stderr lines, and the coded result on stdout."""
+        from rich.markup import escape
+
+        from . import transport
+
+        command_path = " ".join(ctx.command_path.split()[1:])
+        result = transport.render(
+            error, command_path=command_path, auth_manager=auth_manager
+        )
+        print_error(escape(result.error))
+        print_hint(escape(result.hint))
+        if self.stdout_is_protocol:
+            return
+        try:
+            self.output_result(result, config)
+        except (OSError, ValueError):
+            pass
+
     def pre_auth_check(self, config: Config, **kwargs: Any) -> Any | None:
         """Return a result to stop with before authentication, or ``None``.
 
@@ -479,6 +601,18 @@ def _output_csv(self, result: Any) -> None:
             # Fallback to JSON
             self._output_json(result)
 
+    def can_prompt(self) -> bool:
+        """Whether this run may ask a question at all.
+
+        False in an agentic or non-interactive context, for a command that
+        isn't CI-friendly, and when the command was given any input (see
+        ``is_guided``). A command that must not fall back to a default
+        answers an unanswerable prompt itself (``confirmation_required``).
+        """
+        return not (
+            _agentic or not self.ci_friendly or not getattr(self, "_guided", True)
+        )
+
     def confirm(self, message: str, default: bool = False) -> bool:
         """Ask for user confirmation.
 
@@ -487,9 +621,10 @@ def confirm(self, message: str, default: bool = False) -> bool:
             default: Default value if user just presses Enter
 
         Returns:
-            True if confirmed, False otherwise
+            True if confirmed, False otherwise; ``default`` when
+            ``can_prompt()`` is False
         """
-        if _agentic or not self.ci_friendly or not getattr(self, "_guided", True):
+        if not self.can_prompt():
             return default
 
         try:
diff --git a/packages/deepctl-core/src/deepctl_core/base_group_command.py b/packages/deepctl-core/src/deepctl_core/base_group_command.py
index 43a5d197..1c64e565 100644
--- a/packages/deepctl-core/src/deepctl_core/base_group_command.py
+++ b/packages/deepctl-core/src/deepctl_core/base_group_command.py
@@ -166,6 +166,7 @@ def get_click_group(self) -> click.Group:
                         required=arg.get("required", False),
                         is_flag=arg.get("is_flag", False),
                         multiple=arg.get("multiple", False),
+                        **({"metavar": arg["metavar"]} if "metavar" in arg else {}),
                     )(group)
                 else:
                     group = click.argument(
diff --git a/packages/deepctl-core/src/deepctl_core/client.py b/packages/deepctl-core/src/deepctl_core/client.py
index aeec1f37..ba86112e 100644
--- a/packages/deepctl-core/src/deepctl_core/client.py
+++ b/packages/deepctl-core/src/deepctl_core/client.py
@@ -7,6 +7,7 @@
 from typing import TYPE_CHECKING, Any, cast
 from urllib.parse import urlencode
 
+from . import transport
 from .hosts import DEFAULT_BASE_URL
 from .output import stderr_console
 
@@ -91,6 +92,8 @@ def __init__(self, config: Config, auth_manager: AuthManager):
         self._project_id: str | None = None
         # The REST base the SDK client was given (for redirect errors).
         self._rest_base: str = DEFAULT_BASE_URL
+        # Kept out of error text.
+        self._secrets: tuple[str, ...] = ()
 
     @property
     def client(self) -> DGClient:
@@ -124,7 +127,11 @@ def _create_client(self) -> DGClient:
         base_url = self.auth_manager.check_base_url()
 
         try:
-            kwargs: dict[str, Any] = {"api_key": api_key}
+            # One connection pool per process; requests reuse its connection.
+            kwargs: dict[str, Any] = {
+                "api_key": api_key,
+                "httpx_client": transport.shared_client(),
+            }
 
             if base_url and base_url != DEFAULT_BASE_URL:
                 # Derive both the REST and WebSocket endpoints from the
@@ -149,6 +156,7 @@ def _create_client(self) -> DGClient:
 
             client = DGClient(**kwargs)
             self._project_id = project_id
+            self._secrets = (api_key,)
             return client
 
         except Exception as e:
@@ -174,13 +182,15 @@ def _failed(self, what: str, e: Exception) -> Exception:
             )
         return ApiError(body=f"{what}: {e}")
 
-    def _refuse_redirects_in(self, chunks: Iterator[bytes]) -> Iterator[bytes]:
-        """Iterate ``chunks``, turning a 3xx answer into the refusal."""
+    def _mapped(self, chunks: Iterator[bytes]) -> Iterator[bytes]:
+        """Yield ``chunks``; a request failure while reading them is mapped,
+        and a 3xx answer becomes the redirect refusal."""
         from .websocket import RedirectRefused
 
         try:
             yield from chunks
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             refused = self._failed("", e)
             if isinstance(refused, RedirectRefused):
                 raise refused from e
@@ -192,8 +202,16 @@ def transcribe_file(
         self,
         file_path: str | Path,
         options: dict[str, Any] | None = None,
+        *,
+        timeout_s: float | None = None,
+        file_id: tuple[int, int] | None = None,
     ) -> dict[str, Any]:
-        """Transcribe an audio file."""
+        """Transcribe an audio file.
+
+        ``timeout_s`` replaces the client's 60 s timeout for this request.
+        ``file_id`` is ``(st_dev, st_ino)`` of the file the caller validated;
+        the upload stops if the path now names another file.
+        """
         file_path = Path(file_path)
         if not file_path.exists():
             raise FileNotFoundError(f"Audio file not found: {file_path}")
@@ -206,22 +224,41 @@ def transcribe_file(
         if options:
             default_options.update(options)
 
-        try:
-            with open(file_path, "rb") as audio_file:
-                audio_data = audio_file.read()
+        if TYPE_CHECKING:
+            from deepgram.core.request_options import RequestOptions
 
-            response = self.client.listen.v1.media.transcribe_file(
-                request=audio_data, **default_options
-            )
+        from .upload import FileBody, UploadFileError
+
+        try:
+            # Streamed from disk; the SDK resends the same body on a retry.
+            with FileBody(file_path, file_id=file_id) as body:
+                request_options: RequestOptions = {
+                    "additional_headers": {"Content-Length": str(len(body))}
+                }
+                if timeout_s is not None:
+                    request_options["timeout"] = timeout_s
+                response = self.client.listen.v1.media.transcribe_file(
+                    request=body, request_options=request_options, **default_options
+                )
             return cast("dict[str, Any]", response.model_dump())
 
+        except UploadFileError:
+            raise
         except Exception as e:
+            transport.raise_for(e, self._secrets, timeout_s=timeout_s)
             raise self._failed("Transcription failed", e)
 
     def transcribe_url(
-        self, url: str, options: dict[str, Any] | None = None
+        self,
+        url: str,
+        options: dict[str, Any] | None = None,
+        *,
+        timeout_s: float | None = None,
     ) -> dict[str, Any]:
-        """Transcribe audio from URL."""
+        """Transcribe audio from URL.
+
+        ``timeout_s`` replaces the client's 60 s timeout for this request.
+        """
         default_options: dict[str, Any] = {
             "model": "nova-3",
             "smart_format": True,
@@ -230,13 +267,20 @@ def transcribe_url(
         if options:
             default_options.update(options)
 
+        if TYPE_CHECKING:
+            from deepgram.core.request_options import RequestOptions
+
+        request_options: RequestOptions = {}
+        if timeout_s is not None:
+            request_options["timeout"] = timeout_s
         try:
             response = self.client.listen.v1.media.transcribe_url(
-                url=url, **default_options
+                url=url, request_options=request_options, **default_options
             )
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets, timeout_s=timeout_s)
             raise self._failed("Transcription failed", e)
 
     # ── Text-to-Speech ─────────────────────────────────────────────
@@ -263,9 +307,10 @@ def speak_text(
                 "Iterator[bytes]", self.client.speak.v1.audio.generate(**kwargs)
             )
             # The request runs when the caller starts iterating.
-            return self._refuse_redirects_in(audio)
+            return self._mapped(audio)
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Text-to-speech failed", e)
 
     def speak_text_stream(
@@ -326,6 +371,7 @@ def speak_text_stream(
                     if isinstance(message, bytes):
                         yield message
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Text-to-speech streaming failed", e)
 
     def ws_base_url(self) -> str:
@@ -368,6 +414,7 @@ def analyze_text(
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Text analysis failed", e)
 
     # ── Models ─────────────────────────────────────────────────────
@@ -383,6 +430,7 @@ def list_models(self, include_outdated: bool = False) -> dict[str, Any]:
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to list models", e)
 
     def get_model(self, model_id: str) -> dict[str, Any]:
@@ -392,6 +440,7 @@ def get_model(self, model_id: str) -> dict[str, Any]:
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to get model", e)
 
     # ── Projects ───────────────────────────────────────────────────
@@ -403,6 +452,7 @@ def get_projects(self) -> dict[str, Any]:
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to get projects", e)
 
     def get_project(self, project_id: str | None = None) -> dict[str, Any]:
@@ -413,6 +463,7 @@ def get_project(self, project_id: str | None = None) -> dict[str, Any]:
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to get project", e)
 
     def create_project(self, name: str, company: str | None = None) -> dict[str, Any]:
@@ -426,6 +477,7 @@ def create_project(self, name: str, company: str | None = None) -> dict[str, Any
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to create project", e)
 
     # ── Usage ──────────────────────────────────────────────────────
@@ -451,6 +503,7 @@ def get_usage(
             return result
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to get usage", e)
 
     # ── API Keys ───────────────────────────────────────────────────
@@ -471,6 +524,7 @@ def list_keys(
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to list keys", e)
 
     def create_key(
@@ -502,6 +556,7 @@ def create_key(
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to create key", e)
 
     def get_key(self, key_id: str, project_id: str | None = None) -> dict[str, Any]:
@@ -512,6 +567,7 @@ def get_key(self, key_id: str, project_id: str | None = None) -> dict[str, Any]:
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to get key", e)
 
     def delete_key(self, key_id: str, project_id: str | None = None) -> dict[str, Any]:
@@ -522,6 +578,7 @@ def delete_key(self, key_id: str, project_id: str | None = None) -> dict[str, An
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to delete key", e)
 
     # ── Requests ───────────────────────────────────────────────────
@@ -560,6 +617,7 @@ def list_requests(
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to list requests", e)
 
     def get_request(
@@ -572,6 +630,7 @@ def get_request(
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to get request", e)
 
     # ── Billing ────────────────────────────────────────────────────
@@ -600,6 +659,7 @@ def get_billing_breakdown(
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to get billing breakdown", e)
 
     def get_balances(self, project_id: str | None = None) -> dict[str, Any]:
@@ -610,6 +670,7 @@ def get_balances(self, project_id: str | None = None) -> dict[str, Any]:
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to get balances", e)
 
     # ── Members ────────────────────────────────────────────────────
@@ -622,6 +683,7 @@ def list_members(self, project_id: str | None = None) -> dict[str, Any]:
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to list members", e)
 
     def remove_member(
@@ -634,6 +696,7 @@ def remove_member(
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to remove member", e)
 
     def list_member_scopes(
@@ -648,6 +711,7 @@ def list_member_scopes(
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to list member scopes", e)
 
     def update_member_scopes(
@@ -662,6 +726,7 @@ def update_member_scopes(
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to update member scopes", e)
 
     # ── Invites ────────────────────────────────────────────────────
@@ -674,6 +739,7 @@ def list_invites(self, project_id: str | None = None) -> dict[str, Any]:
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to list invites", e)
 
     def create_invite(
@@ -688,6 +754,7 @@ def create_invite(
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to create invite", e)
 
     def delete_invite(
@@ -700,6 +767,7 @@ def delete_invite(
             return cast("dict[str, Any]", response.model_dump())
 
         except Exception as e:
+            transport.raise_for(e, self._secrets)
             raise self._failed("Failed to delete invite", e)
 
     # ── Utilities ──────────────────────────────────────────────────
diff --git a/packages/deepctl-core/src/deepctl_core/config.py b/packages/deepctl-core/src/deepctl_core/config.py
index 9befabfe..b4d12e6f 100644
--- a/packages/deepctl-core/src/deepctl_core/config.py
+++ b/packages/deepctl-core/src/deepctl_core/config.py
@@ -1000,17 +1000,20 @@ def _save_refusal(st: os.stat_result | None) -> str | None:
 
 class ConfigSaveRefused(OSError):
     """An explicit save refused in an AI agent session; ``hint`` says who
-    fixes it."""
+    fixes it, ``why`` is the cause (a W_CFG_UNTRUSTED_WHY key)."""
 
     hint = msg.W_CFG_UNTRUSTED_FILE_HINT
+    why: str = ""
 
 
 def _save_refused(why: str, config_path: Path) -> ConfigSaveRefused:
-    return ConfigSaveRefused(
+    exc = ConfigSaveRefused(
         errno.EPERM,
         msg.W_CFG_SAVE_UNTRUSTED.format(why=msg.W_CFG_UNTRUSTED_WHY[why]),
         str(config_path),
     )
+    exc.why = why
+    return exc
 
 
 @contextmanager
@@ -1308,7 +1311,10 @@ def _get_default_config_path(self) -> Path:
         """Get the default configuration path for the current platform."""
         # Use platformdirs for cross-platform config directory
         config_dir = Path(platformdirs.user_config_dir("deepctl", "deepgram"))
-        _private_mkdir(config_dir)
+        # A home dg can't write (a read-only mount) still runs every command;
+        # a save reports the error, and dg login stops with state_unwritable.
+        with suppress(OSError):
+            _private_mkdir(config_dir)
 
         # Migrate from old location if needed
         self._migrate_config_if_needed(config_dir)
@@ -1332,14 +1338,17 @@ def _migrate_config_if_needed(self, new_config_dir: Path) -> None:
         # If old config exists and new doesn't, migrate it
         if old_config_path.exists() and not new_config_path.exists():
             try:
-                print(f"Migrating config from {old_config_path} to {new_config_path}")
+                print(
+                    f"Migrating config from {old_config_path} to {new_config_path}",
+                    file=sys.stderr,
+                )
                 text = old_config_path.read_text(encoding="utf-8")
                 # Written like any save: 0600, atomic, never via the source's mode.
                 with _directory_lock(new_config_dir):
                     self._replace_or_rewrite(new_config_path, text)
-                print("✓ Config migrated successfully")
+                print("✓ Config migrated successfully", file=sys.stderr)
             except Exception as e:
-                print(f"Warning: Could not migrate config: {e}")
+                print(f"Warning: Could not migrate config: {e}", file=sys.stderr)
 
     def _get_project_config_path(self) -> Path:
         """Get the project-specific configuration path."""
diff --git a/packages/deepctl-core/src/deepctl_core/login_state.py b/packages/deepctl-core/src/deepctl_core/login_state.py
new file mode 100644
index 00000000..2a5eeb58
--- /dev/null
+++ b/packages/deepctl-core/src/deepctl_core/login_state.py
@@ -0,0 +1,307 @@
+"""dg's state directory and the pending device-login store.
+
+``state_dir()`` is the one helper every state file goes through:
+``~/.deepctl`` in 0.5.0; a later release repoints it.
+
+``dg login`` in an agent session asks for a device code, saves it here and
+returns at once; ``dg login --complete`` polls once with it. The file holds
+the device code, its user code, link, poll interval, expiry, the identity
+host and the profile. Never a key.
+"""
+
+from __future__ import annotations
+
+import dataclasses
+import errno
+import json
+import math
+import os
+import secrets
+import stat
+import sys
+import time
+from dataclasses import asdict, dataclass
+from pathlib import Path
+
+PENDING_NAME = "login-pending.json"
+# The shortest poll interval dg uses, whatever the server says: the server allows
+# 60 token requests per 5 minutes per address, and 6 s leaves headroom.
+MIN_POLL_INTERVAL = 6
+_MAX_PENDING_BYTES = 8192
+_O_NOFOLLOW = getattr(os, "O_NOFOLLOW", 0)
+_O_DIRECTORY = getattr(os, "O_DIRECTORY", 0)
+_O_NONBLOCK = getattr(os, "O_NONBLOCK", 0)
+_O_BINARY = getattr(os, "O_BINARY", 0)
+
+# Why a pending file fails the agent-session trust test; the
+# values are msg.W_CFG_UNTRUSTED_WHY keys.
+WHY_SYMLINK = "symlink"
+WHY_OWNER = "owner"
+WHY_WRITABLE = "writable"
+WHY_NOT_REGULAR = "not_regular"
+WHY_LINKS = "links"
+
+
+def state_dir() -> Path:
+    """dg's state directory (``~/.deepctl`` in 0.5.0)."""
+    return Path.home() / ".deepctl"
+
+
+class StateDirError(OSError):
+    """The state directory can't hold a pending login (``state_unwritable``)."""
+
+
+def unwritable_dir(directory: Path, file: Path | None = None) -> Path | None:
+    """``directory`` when dg couldn't create or write a file in it, else None.
+
+    Checks without creating anything: the nearest existing ancestor must be
+    a directory this process may write and search. ``file`` (an existing
+    file in ``directory`` that dg would rewrite in place) also counts as
+    writable.
+    """
+    if file is not None:
+        try:
+            if os.path.isfile(file) and os.access(file, os.W_OK):
+                return None
+        except OSError:
+            pass
+    probe = directory
+    while True:
+        try:
+            st = os.stat(probe)
+        except FileNotFoundError:
+            parent = probe.parent
+            if parent == probe:
+                return directory
+            probe = parent
+            continue
+        except OSError:
+            return directory
+        if not stat.S_ISDIR(st.st_mode):
+            return directory
+        return None if os.access(probe, os.W_OK | os.X_OK) else directory
+
+
+@dataclass(frozen=True)
+class PendingLogin:
+    """A device code waiting for approval."""
+
+    device_code: str
+    user_code: str
+    verification_uri: str
+    interval: int
+    expires_at: float
+    host: str
+    profile: str
+
+    def expired(self, now: float | None = None) -> bool:
+        return (time.time() if now is None else now) >= self.expires_at
+
+    def expires_in(self, now: float | None = None) -> int:
+        left = self.expires_at - (time.time() if now is None else now)
+        return max(0, int(left))
+
+
+def _from_json(data: object) -> PendingLogin | None:
+    if not isinstance(data, dict):
+        return None
+    try:
+        pending = PendingLogin(
+            device_code=data["device_code"],
+            user_code=data["user_code"],
+            verification_uri=data["verification_uri"],
+            interval=data["interval"],
+            expires_at=data["expires_at"],
+            host=data["host"],
+            profile=data["profile"],
+        )
+    except (KeyError, TypeError):
+        return None
+    strings = (
+        pending.device_code,
+        pending.user_code,
+        pending.verification_uri,
+        pending.host,
+        pending.profile,
+    )
+    if not all(isinstance(value, str) and value for value in strings):
+        return None
+    interval = pending.interval
+    if (
+        not isinstance(interval, (int, float))
+        or isinstance(interval, bool)
+        or interval != interval  # NaN
+        or interval < 0
+        or interval == float("inf")
+    ):
+        return None  # not a usable interval: no pending login
+    pending = dataclasses.replace(
+        pending, interval=max(MIN_POLL_INTERVAL, math.ceil(interval))
+    )
+    if not isinstance(pending.expires_at, (int, float)) or isinstance(
+        pending.expires_at, bool
+    ):
+        return None
+    return pending
+
+
+def _open_dir(directory: Path, *, create: bool) -> int:
+    """Open ``directory`` (made 0700 when ``create``) and check it.
+
+    It must be a directory owned by this user; one the user can't keep
+    private is refused. Group or other bits on the user's own directory are
+    removed, so the pending file is in a 0700 directory.
+    """
+    if create:
+        try:
+            os.makedirs(directory.parent, exist_ok=True)
+            os.mkdir(directory, 0o700)
+        except FileExistsError:
+            pass
+    fd = os.open(directory, os.O_RDONLY | _O_DIRECTORY)
+    try:
+        st = os.fstat(fd)
+        if not stat.S_ISDIR(st.st_mode):
+            raise StateDirError(errno.ENOTDIR, "not a directory", str(directory))
+        if sys.platform != "win32":
+            if st.st_uid != os.geteuid():
+                raise StateDirError(
+                    errno.EPERM, "owned by another user", str(directory)
+                )
+            if create and stat.S_IMODE(st.st_mode) & 0o077:
+                os.fchmod(fd, 0o700)
+    except BaseException:
+        os.close(fd)
+        raise
+    return fd
+
+
+def save_pending(pending: PendingLogin) -> Path:
+    """Write ``pending`` to ``{state_dir}/login-pending.json`` at 0600.
+
+    The state directory is created 0700. The new content goes to a fresh
+    0600 file (``O_CREAT|O_EXCL|O_NOFOLLOW``) next to the target and
+    replaces it atomically, so a reader never sees half a file and a
+    planted symlink is never followed. Raises OSError (StateDirError for a
+    directory dg can't use).
+    """
+    directory = state_dir()
+    target = directory / PENDING_NAME
+    data = (json.dumps(asdict(pending), indent=2) + "\n").encode("utf-8")
+    tmp_name = f".{PENDING_NAME}.{secrets.token_hex(8)}.tmp"
+    dir_fd = _open_dir(directory, create=True)
+    use_dir_fd = sys.platform != "win32" and os.open in os.supports_dir_fd
+    try:
+        flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | _O_NOFOLLOW | _O_BINARY
+        if use_dir_fd:
+            fd = os.open(tmp_name, flags, 0o600, dir_fd=dir_fd)
+        else:
+            fd = os.open(directory / tmp_name, flags, 0o600)
+        try:
+            try:
+                if hasattr(os, "fchmod"):
+                    os.fchmod(fd, 0o600)
+                view = memoryview(data)
+                while view:
+                    view = view[os.write(fd, view) :]
+                os.fsync(fd)
+            finally:
+                os.close(fd)
+            if use_dir_fd:
+                os.replace(tmp_name, PENDING_NAME, src_dir_fd=dir_fd, dst_dir_fd=dir_fd)
+            else:
+                os.replace(directory / tmp_name, target)
+        except BaseException:
+            try:
+                if use_dir_fd:
+                    os.unlink(tmp_name, dir_fd=dir_fd)
+                else:
+                    os.unlink(directory / tmp_name)
+            except OSError:
+                pass
+            raise
+    finally:
+        os.close(dir_fd)
+    return target
+
+
+@dataclass(frozen=True)
+class LoadedPending:
+    """What ``load_pending`` found: the login, or why the file was ignored."""
+
+    pending: PendingLogin | None
+    path: Path
+    ignored_why: str | None = None
+    identity: tuple[int, int] | None = None
+
+
+def load_pending(*, agent: bool) -> LoadedPending:
+    """Read the pending login, if there is a usable one.
+
+    The file is opened without following a symlink and must be a regular
+    file. In an AI agent session (``agent``) it must also be owned by this
+    user, with one link and no group or other write bit;
+    otherwise it is ignored (``ignored_why`` says why) and left in place.
+    A missing or malformed file is simply absent.
+    """
+    path = state_dir() / PENDING_NAME
+    try:
+        fd = os.open(path, os.O_RDONLY | _O_NOFOLLOW | _O_NONBLOCK | _O_BINARY)
+    except FileNotFoundError:
+        return LoadedPending(None, path)
+    except OSError as exc:
+        if exc.errno in (errno.ELOOP, errno.EMLINK):
+            return LoadedPending(None, path, WHY_SYMLINK if agent else None)
+        if agent and sys.platform != "win32":
+            # e.g. EACCES: say so when the file belongs to someone else.
+            try:
+                if os.lstat(path).st_uid != os.geteuid():
+                    return LoadedPending(None, path, WHY_OWNER)
+            except OSError:
+                pass
+        return LoadedPending(None, path)
+    try:
+        st = os.fstat(fd)
+        if not stat.S_ISREG(st.st_mode):
+            return LoadedPending(None, path, WHY_NOT_REGULAR if agent else None)
+        if agent and sys.platform != "win32":
+            why = None
+            if st.st_uid != os.geteuid():
+                why = WHY_OWNER
+            elif stat.S_IMODE(st.st_mode) & 0o022:
+                why = WHY_WRITABLE
+            elif st.st_nlink != 1:
+                why = WHY_LINKS
+            if why is not None:
+                return LoadedPending(None, path, why)
+        raw = os.read(fd, _MAX_PENDING_BYTES + 1)
+    finally:
+        os.close(fd)
+    identity = (st.st_dev, st.st_ino)
+    if len(raw) > _MAX_PENDING_BYTES:
+        return LoadedPending(None, path, identity=identity)
+    try:
+        data = json.loads(raw.decode("utf-8"))
+    except ValueError:
+        return LoadedPending(None, path, identity=identity)
+    return LoadedPending(_from_json(data), path, identity=identity)
+
+
+def remove_pending(loaded: LoadedPending) -> None:
+    """Delete the pending file ``loaded`` came from, if it is still that file.
+
+    A ``dg login`` replacing the file between the check and the unlink loses
+    its new code; the cost is one more ``dg login``.
+    """
+    if loaded.identity is None:
+        return
+    try:
+        st = os.lstat(loaded.path)
+    except OSError:
+        return
+    if (st.st_dev, st.st_ino) != loaded.identity:
+        return  # replaced by a newer dg login meanwhile: keep it
+    try:
+        os.unlink(loaded.path)
+    except FileNotFoundError:
+        pass
diff --git a/packages/deepctl-core/src/deepctl_core/messages.py b/packages/deepctl-core/src/deepctl_core/messages.py
index 73a60597..870b51c6 100644
--- a/packages/deepctl-core/src/deepctl_core/messages.py
+++ b/packages/deepctl-core/src/deepctl_core/messages.py
@@ -134,6 +134,101 @@
 E_PERSON_ONLY_AGENT_HINT = (
     "A person must run this command. If you are an AI agent, ask the user."
 )
+# A login prompt that can't be shown (catalogue strings). Hints:
+# H = person, A = AI agent, C = automation (CI, cron); *_NULL when next_step
+# is null. {prog} is the running executable.
+E_CONFIRM_ENVKEY = (
+    "DEEPGRAM_API_KEY is set, and logging in saves a profile that {prog} will "
+    "use instead of it."
+)
+A_CONFIRM_ENVKEY = (
+    "Run next_step only if the user agrees: the saved login will then take "
+    "precedence over DEEPGRAM_API_KEY."
+)
+A_CONFIRM_ENVKEY_NULL = (
+    "Ask the user whether to save a login profile; {prog} will then use it "
+    "instead of DEEPGRAM_API_KEY. Never put a key on the command line."
+)
+C_CONFIRM_ENVKEY_NULL = (
+    "This job's DEEPGRAM_API_KEY is used without a login. Drop the login step, "
+    "or add --yes if a saved profile is intended."
+)
+E_CONFIRM_RELOGIN = 'Profile "{profile}" already has a saved login.'
+H_CONFIRM_YES = "To go ahead, run the command again with --yes."
+A_CONFIRM_YES = "Run the command in next_step only if the user agrees."
+A_CONFIRM_YES_NULL = (
+    "Ask the user to rerun the command with --yes in their own terminal if they agree."
+)
+C_CONFIRM_YES_NULL = (
+    "Add --yes to this command in the job if replacing the saved login is intended."
+)
+
+# Device login for agents (catalogue strings).
+CODE_AUTH_PENDING = "auth_pending"
+CODE_AUTH_EXPIRED = "auth_expired"
+CODE_AUTH_DENIED = "auth_denied"
+CODE_STATE_UNWRITABLE = "state_unwritable"
+M_LOGIN_PENDING = "Open the link and enter the code to finish logging in."
+I_LOGIN_PENDING = (
+    "To finish logging in, open {verification_uri} and enter the code {user_code}."
+)
+A_LOGIN_PENDING = (
+    "Give the user the link and code, then run {prog} login --complete after "
+    "they approve."
+)
+# The person's variant of the line above (mode H/P).
+H_LOGIN_PENDING = (
+    "After you approve the login in your browser, run {prog} login --complete."
+)
+E_AUTH_PENDING = "Login is waiting for approval in the browser."
+H_AUTH_PENDING = (
+    "Open {verification_uri}, enter the code {user_code}, then run {prog} login "
+    "--complete."
+)
+A_AUTH_PENDING = (
+    "Wait {retry_after} s for the user to approve the login at "
+    "{verification_uri} with the code {user_code}, then run {prog} login --complete."
+)
+E_AUTH_EXPIRED = "No login is waiting to be completed, or it expired."
+H_AUTH_EXPIRED = "Run {prog} login to start again."
+A_AUTH_EXPIRED = "Run {prog} login again and give the user the new link and code."
+E_AUTH_DENIED = "The login request was denied in the browser."
+H_AUTH_DENIED = "Run {prog} login to try again."
+A_AUTH_DENIED = "The user denied the login. Ask them before trying again."
+E_STATE_UNWRITABLE = "{prog} can't save a login here: {dir} isn't writable."
+H_STATE_UNWRITABLE = (
+    "Run {prog} login in a terminal where your home directory is writable."
+)
+A_STATE_UNWRITABLE = (
+    "This environment can't store credentials. Ask the user to run {prog} login "
+    "in their own terminal."
+)
+# Login and an untrusted user config: the config file (``{path}``, shown with
+# ``~``) can't be saved in this AI agent session, so login stops before
+# anything is sent. Code state_unwritable; hint W_CFG_UNTRUSTED_FILE_HINT.
+# {why} is a W_CFG_UNTRUSTED_WHY value.
+E_CFG_SAVE_UNTRUSTED = (
+    "In an AI agent session, {prog} can't save a login to {path} because the "
+    "file {why}. Nothing was sent or saved."
+)
+# A pending device-login file that fails the agent-session test;
+# it is ignored and left in place.
+W_LOGIN_PENDING_UNTRUSTED = (
+    "Ignored the pending login in {path}: in an AI agent session, {prog} "
+    "doesn't use a file that {why}."
+)
+# The identity provider's device-code answer couldn't be read (code
+# network_unavailable, details.reason "unreadable response").
+CODE_NETWORK_UNAVAILABLE = "network_unavailable"
+E_NETWORK_UNREADABLE = "Got a response from {host} that {prog} couldn't read."
+H_NETWORK_UNREADABLE = (
+    "A proxy, captive portal or firewall may be answering in Deepgram's place. "
+    "Check that this network lets {prog} reach {host}, then try again."
+)
+A_NETWORK_UNREADABLE = (
+    "Retry once. If it fails again, tell the user that something on this network "
+    "(a proxy, captive portal or firewall) is answering in Deepgram's place."
+)
 E_SAVE_CUSTOM_CONFIG = (
     "--save-base-url can't be used with --config: only the default user "
     "config ({user_config}) can approve API hosts. Run the command without "
diff --git a/packages/deepctl-core/src/deepctl_core/output.py b/packages/deepctl-core/src/deepctl_core/output.py
index f05d231a..c9269bc8 100644
--- a/packages/deepctl-core/src/deepctl_core/output.py
+++ b/packages/deepctl-core/src/deepctl_core/output.py
@@ -163,9 +163,19 @@ def __repr__(self) -> str:
     "verbose": False,
     "color": not _agentic,
     "agentic": _agentic,
+    "format_source": "default",
 }
 
 
+def _format_source(requested: str) -> str:
+    """Why the output format is what it is; see format_source()."""
+    if requested != "default":
+        return "explicit"
+    if not _output_config["agentic"]:
+        return "default"
+    return "hard_agent" if is_ai_agent() else "soft"
+
+
 def setup_output(
     format_type: str = "json", quiet: bool = False, verbose: bool = False
 ) -> None:
@@ -175,6 +185,7 @@ def setup_output(
     requested (format_type == "default"), auto-switch to JSON for
     machine-friendly output.
     """
+    _output_config["format_source"] = _format_source(format_type)
     # Auto-default to JSON in agentic mode when user didn't pick a format
     if format_type == "default" and _output_config["agentic"]:
         format_type = "json"
@@ -199,6 +210,7 @@ def update_output(
     verbose state the root group already applied.
     """
     if format_type is not None:
+        _output_config["format_source"] = _format_source(format_type)
         if format_type == "default" and _output_config["agentic"]:
             format_type = "json"
         _output_config["format"] = format_type
@@ -502,9 +514,16 @@ def print_error_hint(error: BaseException) -> None:
         print_hint(str(hint))
 
 
-def print_warning(message: str, *, stderr: bool = False) -> None:
-    """Print a warning; ``stderr=True`` keeps it off stdout outside agentic mode too."""
-    if not _output_config["quiet"]:
+def print_warning(
+    message: str, *, stderr: bool = False, ignore_quiet: bool = False
+) -> None:
+    """Print a warning; ``stderr=True`` keeps it off stdout outside agentic mode too.
+
+    ``ignore_quiet=True`` prints it under ``--quiet`` as well, for warnings
+    the caller needs to read the result (``--quiet`` hides only
+    INFO and OK lines).
+    """
+    if ignore_quiet or not _output_config["quiet"]:
         if _output_config["agentic"]:
             stderr_console.print(f"WARN: {message}", soft_wrap=True)
         else:
@@ -671,6 +690,17 @@ def get_output_format() -> str:
     return str(_output_config["format"])
 
 
+def format_source() -> str:
+    """Why the output format is what it is.
+
+    ``"explicit"``: asked for with ``-o``. ``"hard_agent"``: JSON chosen
+    implicitly while an AI-agent marker (``is_ai_agent()``) is set.
+    ``"soft"``: JSON chosen implicitly by the TTY/CI heuristics alone.
+    ``"default"``: no format was chosen.
+    """
+    return str(_output_config.get("format_source", "default"))
+
+
 def get_console() -> Console:
     """Get the global console instance.
 
diff --git a/packages/deepctl-core/src/deepctl_core/plugin_manager.py b/packages/deepctl-core/src/deepctl_core/plugin_manager.py
index 894ac79a..59b4da93 100644
--- a/packages/deepctl-core/src/deepctl_core/plugin_manager.py
+++ b/packages/deepctl-core/src/deepctl_core/plugin_manager.py
@@ -1212,6 +1212,8 @@ def _add_command_arguments(
                     }
                     if not is_flag:
                         option_kwargs["type"] = arg.get("type", str)
+                    if "metavar" in arg:
+                        option_kwargs["metavar"] = arg["metavar"]
                     cmd = click.option(*arg.get("names", []), **option_kwargs)(cmd)
                 else:
                     # Add as argument
diff --git a/packages/deepctl-core/src/deepctl_core/signals.py b/packages/deepctl-core/src/deepctl_core/signals.py
new file mode 100644
index 00000000..3716d07f
--- /dev/null
+++ b/packages/deepctl-core/src/deepctl_core/signals.py
@@ -0,0 +1,207 @@
+"""Ending the process by a signal, for commands that catch one to clean up.
+
+Stdlib only and cheap to import: command modules use it at import time.
+"""
+
+from __future__ import annotations
+
+import _imp
+import _thread
+import os
+import signal
+import sys
+import threading
+import time
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+    from types import FrameType
+
+    Handler = Callable[[int, FrameType | None], None]
+
+__all__ = [
+    "coalescing",
+    "defer_in_importlib",
+    "deliver_later",
+    "die_by_signal",
+    "in_importlib",
+    "install_interrupt_handler",
+    "send_to_main",
+]
+
+
+def die_by_signal(signum: int) -> None:
+    """End the process by ``signum`` with its default action, so the wait
+    status is "killed by signal N" (shells report 128+N).
+
+    stdout and stderr are flushed first. PID 1 in a container ignores a
+    default-action signal, so if the process is still here afterwards it
+    exits with the shell's 128+N. POSIX only: on Windows ``os.kill`` of our
+    own pid is TerminateProcess, so callers there exit instead.
+    """
+    for stream in (sys.stdout, sys.stderr):
+        try:
+            stream.flush()
+        except Exception:
+            pass
+    try:
+        signal.signal(signum, signal.SIG_DFL)
+        if hasattr(signal, "pthread_sigmask"):
+            # A signal left blocked would stay pending and never kill.
+            signal.pthread_sigmask(signal.SIG_UNBLOCK, {signum})
+        os.kill(os.getpid(), signum)
+        time.sleep(0.05)
+    except Exception:
+        pass
+    os._exit(128 + signum)
+
+
+#: Where importlib's own lock bookkeeping runs. A KeyboardInterrupt raised
+#: in one of these frames can land between acquiring the global import lock
+#: and the ``try`` that releases it (and in the module-lock weakref callback
+#: it is swallowed outright), so every later import, and the run, hangs.
+_IMPORTLIB_FILES = frozenset(
+    {"<frozen importlib._bootstrap>", "<frozen importlib._bootstrap_external>"}
+)
+
+#: The longest a SIGINT is postponed, from its first deferral.
+_MAX_DEFER_S = 0.2
+
+#: A deferral older than this was never delivered (the handler changed, or
+#: the re-send was lost): the next signal starts a fresh window.
+_STALE_DEFER_S = 1.0
+
+_deferred_since: list[float] = []
+_in_handler: list[bool] = []
+
+
+def _own_file() -> str:
+    return _own_file.__code__.co_filename
+
+
+def in_importlib(frame: FrameType | None) -> bool:
+    """True when the interrupted ``frame`` is importlib's own code. Frames of
+    this module are skipped: a second signal can arrive while a handler here
+    runs, and what matters is where the first one interrupted."""
+    while frame is not None and frame.f_code.co_filename == _own_file():
+        frame = frame.f_back
+    return frame is not None and frame.f_code.co_filename in _IMPORTLIB_FILES
+
+
+def send_to_main(signum: int) -> None:
+    """Deliver ``signum`` to the main thread (from any thread).
+
+    POSIX: ``signal.pthread_kill`` to the main thread, a real signal, so it
+    also interrupts a blocking wait there. ``_thread.interrupt_main`` would
+    only set a flag that is checked once that wait returns.
+    Windows: ``_thread.interrupt_main``; ``os.kill`` on our own pid there is
+    TerminateProcess, which would skip the cleanup.
+    """
+    if os.name != "nt" and hasattr(signal, "pthread_kill"):
+        main = threading.main_thread().ident
+        if main is not None:
+            signal.pthread_kill(main, signum)
+            return
+    try:
+        _thread.interrupt_main(signal.Signals(signum))
+    except (ValueError, TypeError):
+        _thread.interrupt_main()  # a signal it can't simulate: Ctrl-C
+
+
+def _resend(signum: int) -> None:
+    # Under load, starting this timer can take longer than its delay. Wait
+    # for the handler that started it to return, or the signal would arrive
+    # inside that handler and be taken for a second Ctrl-C.
+    deadline = time.monotonic() + 1.0
+    while _in_handler and time.monotonic() < deadline:
+        time.sleep(0.001)
+    send_to_main(signum)
+
+
+def deliver_later(signum: int, delay: float = 0.01) -> None:
+    """Send ``signum`` to the main thread again after ``delay`` seconds."""
+    timer = threading.Timer(delay, _resend, (signum,))
+    timer.daemon = True
+    timer.start()
+
+
+def defer_in_importlib(signum: int, frame: FrameType | None) -> bool:
+    """For a signal handler about to raise: if ``frame`` is importlib's own
+    code, send the signal again a moment later and return True (the handler
+    returns without raising). After ``_MAX_DEFER_S`` of deferrals (unless
+    the import lock is held right now), or outside importlib, return False
+    so the handler raises as usual."""
+    now = time.monotonic()
+    if _deferred_since and now - _deferred_since[0] > _STALE_DEFER_S:
+        _deferred_since.clear()
+    if in_importlib(frame) and (
+        not _deferred_since
+        or now - _deferred_since[0] < _MAX_DEFER_S
+        or _import_lock_held()
+    ):
+        try:
+            deliver_later(signum)
+        except RuntimeError:
+            # No new thread at interpreter shutdown: deliver it now instead.
+            _deferred_since.clear()
+            return False
+        if not _deferred_since:
+            _deferred_since.append(now)
+        return True
+    _deferred_since.clear()
+    return False
+
+
+def _import_lock_held() -> bool:
+    """Past the cap, a signal is still held back while the import lock is
+    held: in importlib's frames that means inside its locked bookkeeping, the
+    one place a raise is unsafe. (A main thread waiting for another thread's
+    lock is blocked in C, where no handler runs.)"""
+    try:
+        return bool(_imp.lock_held())
+    except Exception:
+        return False
+
+
+def coalescing(handler: Handler) -> Handler:
+    """Wrap a signal handler that uses :func:`defer_in_importlib`.
+
+    A signal that arrives while the handler runs is coalesced into the one
+    being handled (its frame would be the handler's, not where the first
+    signal landed), and a re-send waits for the handler to return.
+    """
+
+    def wrapped(signum: int, frame: FrameType | None) -> None:
+        if _in_handler:
+            return  # a second signal while the first is handled
+        _in_handler.append(True)
+        try:
+            handler(signum, frame)
+        finally:
+            _in_handler.clear()
+
+    wrapped.__wrapped__ = handler  # type: ignore[attr-defined]
+    return wrapped
+
+
+def _interrupt(signum: int, frame: FrameType | None) -> None:
+    if defer_in_importlib(signum, frame):
+        return
+    raise KeyboardInterrupt
+
+
+_on_interrupt = coalescing(_interrupt)
+
+
+def install_interrupt_handler() -> None:
+    """Replace Python's default SIGINT handler with one that raises
+    ``KeyboardInterrupt`` the same way, except inside importlib's own code
+    (see :func:`defer_in_importlib`), where the signal comes again a moment
+    later. A SIGINT that is ignored or handled elsewhere is left alone.
+    """
+    try:
+        if signal.getsignal(signal.SIGINT) is signal.default_int_handler:
+            signal.signal(signal.SIGINT, _on_interrupt)
+    except (OSError, ValueError):
+        pass  # not the main thread, or no SIGINT here
diff --git a/packages/deepctl-core/src/deepctl_core/transport.py b/packages/deepctl-core/src/deepctl_core/transport.py
new file mode 100644
index 00000000..bb1030c5
--- /dev/null
+++ b/packages/deepctl-core/src/deepctl_core/transport.py
@@ -0,0 +1,636 @@
+"""One HTTP client per process, and the map from transport failures to codes.
+
+Every REST call the SDK facade makes goes through :func:`shared_client`: one
+``httpx.Client`` (one connection pool) per process, created on first use so
+``--version`` and ``--help`` never import httpx. The client carries no
+credentials and no base URL. The key and the host still come from
+``DeepgramClient``, which takes the base URL from
+:func:`deepctl_core.hosts.check_credential_host` before any request carries
+the key; this module never decides where a credential may go.
+
+:func:`raise_for` turns a failed request into a :class:`TransportError` with a
+catalogue code (``transport_mapping`` in ``error_codes.json``, in
+order): DNS, connect, TLS, reset or a truncated 2xx body ->
+``network_unavailable``; timeout -> ``timeout``; 401 -> ``auth_invalid``;
+403 -> ``auth_forbidden``; 404 -> ``not_found``; 429 -> ``rate_limited``;
+400, 422 and any other 4xx -> ``invalid_argument``; 5xx -> ``server_error``.
+``BaseCommand.execute`` renders it: a coded result on stdout under a machine
+format, and two stderr lines.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import shlex
+import shutil
+import sys
+import threading
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    import httpx
+
+    from .auth import AuthManager
+
+# The SDK's own default for a client it builds itself.
+DEFAULT_TIMEOUT_S = 60.0
+
+_lock = threading.Lock()
+_client: httpx.Client | None = None
+# Where the most recent request went, for the error text: method, host and
+# path only (never the query string, which can carry values from argv).
+_last_request: dict[str, str] = {}
+
+
+def _record_request(request: httpx.Request) -> None:
+    _last_request.clear()
+    _last_request.update(
+        method=request.method, host=request.url.host, path=request.url.path
+    )
+
+
+def _install(client: httpx.Client) -> httpx.Client:
+    _no_cookies(client)
+    hooks = client.event_hooks
+    hooks.setdefault("request", [])
+    if _record_request not in hooks["request"]:
+        hooks["request"] = [*hooks["request"], _record_request]
+        client.event_hooks = hooks
+    return client
+
+
+def shared_client() -> httpx.Client:
+    """The process's one ``httpx.Client``, created on first use.
+
+    It follows no redirects: a 3xx could take the key, or a request body,
+    to another host (see ``DeepgramClient._failed``).
+    """
+    global _client
+    with _lock:
+        if _client is None:
+            import httpx
+
+            _client = _install(
+                httpx.Client(timeout=DEFAULT_TIMEOUT_S, follow_redirects=False)
+            )
+        return _client
+
+
+def _no_cookies(client: httpx.Client) -> None:
+    """Keep no cookies: one process can serve several profiles and hosts."""
+    from http.cookiejar import DefaultCookiePolicy
+
+    client.cookies.jar.set_policy(DefaultCookiePolicy(allowed_domains=[]))
+
+
+def _set_client(client: httpx.Client | None) -> None:
+    """Replace the shared client (tests pass one with an ``httpx.MockTransport``)."""
+    global _client
+    with _lock:
+        _client = _install(client) if client is not None else None
+        _last_request.clear()
+
+
+# ── Catalogue text (error_codes.json "strings") ──────────────────────
+
+STRINGS: dict[str, str] = {
+    "E-AUTH-INVALID": "Deepgram rejected the API key (HTTP 401).",
+    "H-AUTH-INVALID": (
+        "The API key may have expired or been revoked. Run {prog} login to log "
+        "in again."
+    ),
+    "A-AUTH-INVALID": (
+        "The API key was rejected. Run {prog} login and give the user the "
+        "verification link and code it prints."
+    ),
+    "A-AUTH-INVALID-ENV": (
+        "The DEEPGRAM_API_KEY in this environment was rejected. next_step starts "
+        "a login whose saved key will take precedence over it; give the user the "
+        "link and code it prints."
+    ),
+    "A-AUTH-INVALID-ENV-NULL": (
+        "The DEEPGRAM_API_KEY in this environment was rejected. Ask the user to "
+        "fix the key, or to run {prog} login --yes in their terminal."
+    ),
+    "C-AUTH-INVALID": (
+        "The API key was rejected. Set a valid DEEPGRAM_API_KEY in this job's "
+        "environment."
+    ),
+    "E-AUTH-FORBIDDEN": ("This API key isn't allowed to make this request (HTTP 403)."),
+    "H-AUTH-FORBIDDEN": (
+        "Use an API key with the needed permissions, or run {prog} login with "
+        "an account that has access."
+    ),
+    "A-AUTH-FORBIDDEN": (
+        "The API key lacks a permission this request needs. Tell the user; "
+        "they can run {prog} login with an account that has access."
+    ),
+    "E-NETWORK": "Couldn't reach {host}: {reason}.",
+    "H-NETWORK": "Check your network connection and proxy settings, then try again.",
+    "A-NETWORK": (
+        "{prog} can't reach Deepgram from this environment. If you run in a "
+        "sandbox, ask the user to allow network access for {prog}."
+    ),
+    "E-NETWORK-CUT": "The connection to {host} dropped before the response finished.",
+    "H-NETWORK-CUT": (
+        "Try again. If it keeps happening, a proxy or firewall may be cutting off "
+        "responses."
+    ),
+    "A-NETWORK-CUT": (
+        "Retry once. If it fails again, tell the user the connection to Deepgram "
+        "keeps dropping."
+    ),
+    "E-NETWORK-UNREADABLE": "Got a response from {host} that {prog} couldn't read.",
+    "H-NETWORK-UNREADABLE": (
+        "A proxy, captive portal or firewall may be answering in Deepgram's "
+        "place. Check that this network lets {prog} reach {host}, then try again."
+    ),
+    "A-NETWORK-UNREADABLE": (
+        "Retry once. If it fails again, tell the user that something on this "
+        "network (a proxy, captive portal or firewall) is answering in "
+        "Deepgram's place."
+    ),
+    "E-TIMEOUT": "{host} didn't respond within {timeout_s} s.",
+    "H-TIMEOUT": "Try again. Large files take longer to upload on slow connections.",
+    "A-TIMEOUT": (
+        "Try again once. If it times out again, tell the user the network is "
+        "slow or blocked."
+    ),
+    "E-RATE-LIMITED": "Deepgram is rate limiting requests (HTTP 429).",
+    "H-RATE-LIMITED": "Wait a moment and try again.",
+    "A-RATE-LIMITED": (
+        "Wait the number of seconds in details.retry_after (or 10 s if absent) "
+        "before retrying."
+    ),
+    "E-NOT-FOUND": "Deepgram returned 404 Not Found for {path}.",
+    "H-NOT-FOUND": "Check the ID, and that it belongs to the selected project.",
+    "A-NOT-FOUND": (
+        "Check the ID. List the available items first instead of guessing IDs."
+    ),
+    "E-INVALID-REQUEST": (
+        "Deepgram rejected the request (HTTP {http_status}): {api_message}"
+    ),
+    "H-INVALID-REQUEST": (
+        "Check the options you passed. Run {prog} {command_path} --help to see "
+        "valid values."
+    ),
+    "A-INVALID-REQUEST": (
+        "Fix the option named in the message and retry. Run {prog} "
+        "{command_path} --help for valid values."
+    ),
+    "E-SERVER": "Deepgram returned an error (HTTP {http_status}).",
+    "H-SERVER": (
+        "Try again in a moment. If it keeps failing, contact Deepgram support "
+        "with the request ID in details."
+    ),
+    "A-SERVER": (
+        "Retry once after a few seconds. If it fails again, tell the user and "
+        "include details.request_id."
+    ),
+}
+
+# code -> (error message ID, human hint, agent hint, automation hint or None)
+Messages = tuple[str, str, str, "str | None"]
+CODES: dict[str, Messages] = {
+    "auth_invalid": (
+        "E-AUTH-INVALID",
+        "H-AUTH-INVALID",
+        "A-AUTH-INVALID",
+        "C-AUTH-INVALID",
+    ),
+    "auth_forbidden": (
+        "E-AUTH-FORBIDDEN",
+        "H-AUTH-FORBIDDEN",
+        "A-AUTH-FORBIDDEN",
+        None,
+    ),
+    "network_unavailable": ("E-NETWORK", "H-NETWORK", "A-NETWORK", None),
+    "timeout": ("E-TIMEOUT", "H-TIMEOUT", "A-TIMEOUT", None),
+    "rate_limited": ("E-RATE-LIMITED", "H-RATE-LIMITED", "A-RATE-LIMITED", None),
+    "not_found": ("E-NOT-FOUND", "H-NOT-FOUND", "A-NOT-FOUND", None),
+    "invalid_argument": (
+        "E-INVALID-REQUEST",
+        "H-INVALID-REQUEST",
+        "A-INVALID-REQUEST",
+        None,
+    ),
+    "server_error": ("E-SERVER", "H-SERVER", "A-SERVER", None),
+}
+
+# network_unavailable's other messages: the response was cut off, or it
+# arrived complete but isn't Deepgram's (a proxy or captive portal page).
+NETWORK_CUT: Messages = ("E-NETWORK-CUT", "H-NETWORK-CUT", "A-NETWORK-CUT", None)
+NETWORK_UNREADABLE: Messages = (
+    "E-NETWORK-UNREADABLE",
+    "H-NETWORK-UNREADABLE",
+    "A-NETWORK-UNREADABLE",
+    None,
+)
+
+# Network failure reasons for E-NETWORK's {reason}.
+REASON_DNS = "name resolution failed"
+REASON_REFUSED = "connection refused"
+REASON_TLS = "TLS handshake failed"
+REASON_RESET = "connection reset"
+REASON_CLOSED = "connection closed"
+REASON_TRUNCATED = "response cut off"
+REASON_UNREADABLE = "unreadable response"
+REASON_PROXY = "the proxy refused the connection"
+REASON_OTHER = "connection failed"
+
+KEY_SOURCE_ENV = "DEEPGRAM_API_KEY (env)"
+KEY_SOURCE_FLAG = "--api-key"
+KEY_SOURCE_KEYRING = "system keyring"
+KEY_SOURCE_FILE = "config file"
+
+
+class TransportError(BaseException):
+    """A request failed at the transport or with an HTTP error status.
+
+    A ``BaseException`` on purpose: command handlers wrap their work in
+    ``except Exception`` and turn anything into a legacy error result. This
+    one has to reach ``BaseCommand.execute``, which prints the coded error.
+    Anything else that catches it should re-raise it.
+    """
+
+    def __init__(
+        self,
+        code: str,
+        values: dict[str, Any],
+        details: dict[str, Any],
+        messages: Messages | None = None,
+    ) -> None:
+        self.code = code
+        self.values = values
+        self.details = details
+        self.messages = messages or CODES[code]
+        super().__init__(self.error)
+
+    @property
+    def error(self) -> str:
+        return STRINGS[self.messages[0]].format(**self.values)
+
+
+# ── Mapping ──────────────────────────────────────────────────────────
+
+_SECRET_URL = re.compile(r"(?i)\b([a-z][a-z0-9+.-]*://)[^/\s@]*@")
+_QUERY = re.compile(r"\?\S*")
+
+
+def _clean(text: object, secrets: tuple[str, ...] = ()) -> str:
+    """Untrusted text for ``error``."""
+    from . import messages
+
+    value = str(text)
+    for secret in secrets:
+        if secret:
+            value = value.replace(secret, "****")
+    value = _SECRET_URL.sub(r"\1", value)
+    value = _QUERY.sub("", value)
+    return messages.display(" ".join(value.split()))
+
+
+def _chain(exc: BaseException) -> list[BaseException]:
+    seen: list[BaseException] = []
+    current: BaseException | None = exc
+    while current is not None and current not in seen:
+        seen.append(current)
+        current = current.__cause__ or current.__context__
+    return seen
+
+
+def _network_reason(exc: BaseException) -> str:
+    import socket
+    import ssl
+
+    import httpx
+
+    chain = _chain(exc)
+    for item in chain:
+        if isinstance(item, socket.gaierror):
+            return REASON_DNS
+        if isinstance(item, ssl.SSLError):
+            return REASON_TLS
+        if isinstance(item, ConnectionRefusedError):
+            return REASON_REFUSED
+        if isinstance(item, ConnectionResetError):
+            return REASON_RESET
+    text = " ".join(str(item) for item in chain).lower()
+    if "name or service not known" in text or "nodename nor servname" in text:
+        return REASON_DNS
+    if "temporary failure in name resolution" in text or "getaddrinfo" in text:
+        return REASON_DNS
+    if "ssl" in text or "certificate" in text or "tls" in text:
+        return REASON_TLS
+    if "connection refused" in text:
+        return REASON_REFUSED
+    if isinstance(exc, httpx.RemoteProtocolError):
+        if "incomplete" in text or "message body" in text:
+            return REASON_TRUNCATED
+        return REASON_CLOSED
+    if isinstance(exc, (httpx.ReadError, httpx.WriteError)) or "reset" in text:
+        return REASON_RESET
+    return REASON_OTHER
+
+
+def _host(exc: BaseException | None = None) -> str:
+    host = None
+    try:
+        host = exc.request.url.host  # type: ignore[union-attr]
+    except (AttributeError, RuntimeError):
+        host = _last_request.get("host")
+    return _clean(host or "the Deepgram API")
+
+
+def _header(headers: object, name: str) -> str | None:
+    if not isinstance(headers, dict):
+        return None
+    for key, value in headers.items():
+        if str(key).lower() == name:
+            return str(value)
+    return None
+
+
+def _api_message(body: object, status: int, secrets: tuple[str, ...]) -> str:
+    text: object = None
+    if isinstance(body, dict):
+        for key in ("err_msg", "message", "error", "detail"):
+            if body.get(key):
+                text = body[key]
+                break
+    elif isinstance(body, str) and body.strip():
+        text = body
+    if text is None:
+        from http import HTTPStatus
+
+        try:
+            text = HTTPStatus(status).phrase
+        except ValueError:
+            text = "no details"
+    return _clean(text, secrets)
+
+
+def map_exception(
+    exc: BaseException,
+    secrets: tuple[str, ...] = (),
+    *,
+    timeout_s: float | None = None,
+) -> TransportError | None:
+    """The coded error for a failed request, or ``None`` when ``exc`` isn't one.
+
+    ``timeout_s`` is the request's timeout when it isn't the default.
+    """
+    if isinstance(exc, TransportError):
+        return exc
+    if "httpx" in sys.modules:
+        import httpx
+
+        if isinstance(exc, httpx.TimeoutException):
+            host = _host(exc)
+            seconds = _seconds(timeout_s or DEFAULT_TIMEOUT_S)
+            return TransportError(
+                "timeout",
+                {"host": host, "timeout_s": seconds},
+                {"host": host, "timeout_s": seconds},
+            )
+        if isinstance(exc, httpx.ProxyError):
+            host = _host(exc)
+            return TransportError(
+                "network_unavailable",
+                {"host": host, "reason": REASON_PROXY},
+                {"host": host, "reason": REASON_PROXY},
+            )
+        if isinstance(exc, (httpx.NetworkError, httpx.RemoteProtocolError)):
+            host = _host(exc)
+            reason = _network_reason(exc)
+            cut = reason == REASON_TRUNCATED
+            return TransportError(
+                "network_unavailable",
+                {"host": host, "reason": reason},
+                {"host": host, "reason": reason},
+                NETWORK_CUT if cut else None,
+            )
+
+    status = getattr(exc, "status_code", None)
+    if not isinstance(status, int) or "deepgram" not in sys.modules:
+        return None
+    from deepgram.core.api_error import ApiError
+
+    if not isinstance(exc, ApiError):
+        return None
+    headers = exc.headers
+    if 200 <= status < 300:
+        # The SDK got a complete success response it couldn't parse: most
+        # often not Deepgram's at all (a proxy's or captive portal's page).
+        # A body cut short raises RemoteProtocolError above instead.
+        host = _host()
+        return TransportError(
+            "network_unavailable",
+            {"host": host, "reason": REASON_UNREADABLE, "prog": prog() or "dg"},
+            {"host": host, "reason": REASON_UNREADABLE},
+            NETWORK_UNREADABLE,
+        )
+    if status == 401:
+        return TransportError("auth_invalid", {}, {"http_status": 401})
+    if status == 403:
+        return TransportError("auth_forbidden", {}, {"http_status": 403})
+    if status == 404:
+        path = _clean(_last_request.get("path") or "this request")
+        return TransportError(
+            "not_found", {"path": path}, {"http_status": 404, "path": path}
+        )
+    if status == 429:
+        details: dict[str, Any] = {"http_status": 429}
+        retry_after = _header(headers, "retry-after")
+        if retry_after and retry_after.strip().isdigit():
+            details["retry_after"] = int(retry_after.strip())
+        return TransportError("rate_limited", {}, details)
+    if 400 <= status < 500:
+        return TransportError(
+            "invalid_argument",
+            {
+                "http_status": status,
+                "api_message": _api_message(exc.body, status, secrets),
+            },
+            {"http_status": status},
+        )
+    if 500 <= status < 600:
+        details = {"http_status": status}
+        request_id = _header(headers, "dg-request-id")
+        if request_id:
+            details["request_id"] = _clean(request_id)
+        return TransportError("server_error", {"http_status": status}, details)
+    return None
+
+
+def _seconds(value: float) -> int | float:
+    return int(value) if float(value).is_integer() else value
+
+
+def raise_for(
+    exc: BaseException,
+    secrets: tuple[str, ...] = (),
+    *,
+    timeout_s: float | None = None,
+) -> None:
+    """Raise the coded :class:`TransportError` for ``exc``, if it maps to one."""
+    mapped = map_exception(exc, secrets, timeout_s=timeout_s)
+    if mapped is not None and mapped is not exc:
+        raise mapped from exc
+    if mapped is not None:
+        raise mapped
+
+
+# ── Rendering ────────────────────────────────────────────────────────
+
+_PROG_NAMES = ("dg", "deepgram", "deepctl")
+
+
+def prog() -> str | None:
+    """``{prog}``: the running executable, as a command.
+
+    The bare name when ``which(name)`` is this same file; else the console
+    script's absolute path, quoted. ``None`` when neither applies (``python
+    -m``, an unknown launcher), which makes ``next_step`` null.
+    A stable command name replaces the fallback in a later release.
+    """
+    argv0 = sys.argv[0] if sys.argv else ""
+    name = os.path.basename(argv0)
+    if os.name == "nt" and name.lower().endswith(".exe"):
+        name = name[:-4]
+    if name not in _PROG_NAMES:
+        return None
+    found = shutil.which(name)
+    running = shutil.which(argv0) or argv0
+    try:
+        if found and os.path.samefile(found, running):
+            return name
+    except OSError:
+        pass
+    if not os.path.isfile(running):
+        return None
+    path = os.path.abspath(running)
+    if os.name == "nt":
+        return None if shlex.quote(path) != path else path
+    return shlex.quote(path)
+
+
+def _key_source(auth_manager: AuthManager | None) -> str | None:
+    if auth_manager is None:
+        return None
+    if auth_manager.explicit_api_key:
+        return KEY_SOURCE_FLAG
+    try:
+        key = auth_manager.get_api_key()
+    except Exception:
+        return None
+    if not key:
+        return None
+    # The order `dg whoami` uses: keyring, then the config file (a profile key
+    # equal to the env value came from the env), then the env.
+    import keyring
+
+    from .auth import KEYRING_SERVICE
+
+    env_key = os.environ.get("DEEPGRAM_API_KEY")
+    profile = auth_manager.config.profile or "default"
+    try:
+        stored = keyring.get_password(KEYRING_SERVICE, f"api-key.{profile}")
+    except Exception:
+        stored = None
+    if stored and stored == key:
+        return KEY_SOURCE_KEYRING
+    # Config merges the env key into the profile, so a file key equal to the
+    # env value came from the env.
+    return KEY_SOURCE_ENV if env_key == key else KEY_SOURCE_FILE
+
+
+def render(
+    err: TransportError,
+    *,
+    command_path: str,
+    auth_manager: AuthManager | None = None,
+) -> Any:
+    """The coded result for ``err``."""
+    from . import output
+
+    agentic = bool(output._output_config["agentic"])
+    hard = output.is_ai_agent()
+    soft_only = agentic and not hard
+    _, human, agent, automation = err.messages
+    program = prog()
+    details = dict(err.details)
+
+    next_step: str | None = None
+    hint_id = human if not agentic else (automation or agent) if soft_only else agent
+    if err.code == "auth_invalid":
+        source = _key_source(auth_manager)
+        if source:
+            details["key_source"] = source
+        if not soft_only and program:
+            next_step = f"{program} login"
+        if hard and source == KEY_SOURCE_ENV:
+            if program:
+                next_step = f"{program} login --yes"
+                hint_id = "A-AUTH-INVALID-ENV"
+            else:
+                hint_id = "A-AUTH-INVALID-ENV-NULL"
+    elif err.code == "invalid_argument" and program and command_path:
+        candidate = f"{program} {command_path} --help"
+        if shlex.join(shlex.split(candidate)) == candidate:
+            next_step = candidate
+
+    values = {
+        **err.values,
+        "prog": program or _PROG_NAMES[0],
+        "command_path": command_path,
+    }
+    hint = STRINGS[hint_id].format(**values)
+    return result_class()(
+        error=err.error,
+        code=err.code,
+        hint=hint,
+        next_step=next_step,
+        details=details or None,
+    )
+
+
+def _result_class() -> Any:
+    from pydantic import model_serializer
+
+    from .models import CodedErrorResult
+
+    class _TransportErrorResult(CodedErrorResult):
+        """A 0.5.0 coded error: ``error``, ``status``, ``code``, ``hint``,
+        ``next_step``, ``schema_version`` and, when set, ``details``.
+
+        Only transport errors use it: the 0.4.1 coded errors keep their keys.
+        """
+
+        next_step: str | None = None
+        schema_version: int = 1
+        details: dict[str, Any] | None = None
+
+        @model_serializer(mode="wrap")
+        def _drop_empty_details(self, handler: Any) -> dict[str, Any]:
+            data: dict[str, Any] = handler(self)
+            if not data.get("details"):
+                data.pop("details", None)
+            return data
+
+    _TransportErrorResult.__name__ = "TransportErrorResult"
+    _TransportErrorResult.__qualname__ = "TransportErrorResult"
+    return _TransportErrorResult
+
+
+_RESULT_CLASS: Any = None
+
+
+def result_class() -> Any:
+    """``TransportErrorResult``, built on first use so pydantic loads only
+    when a transport error is rendered."""
+    global _RESULT_CLASS
+    if _RESULT_CLASS is None:
+        _RESULT_CLASS = _result_class()
+    return _RESULT_CLASS
diff --git a/packages/deepctl-core/src/deepctl_core/upload.py b/packages/deepctl-core/src/deepctl_core/upload.py
new file mode 100644
index 00000000..7ad3e2e0
--- /dev/null
+++ b/packages/deepctl-core/src/deepctl_core/upload.py
@@ -0,0 +1,210 @@
+"""Request bodies read from disk while they are sent.
+
+:class:`FileBody` streams a local file to the SDK in 1 MiB chunks instead of
+reading it into memory. It opens the file once and keeps the descriptor:
+every pass over the body reads from offset 0 of that descriptor, so the
+SDK's retries (it sends the same content object again) resend the same
+file, and a file swapped in at the path between retries is never sent.
+
+Before each chunk the descriptor's size and mtime are compared with the
+values at open. A change raises :class:`UploadFileError`
+(``E-UPLOAD-FILE-CHANGED``); a failed read raises it with
+``E-UPLOAD-FILE-UNREADABLE``. Both are ``invalid_argument``: the user fixes
+the input. :func:`coded_result` reports one the way a transport error is
+reported.
+"""
+
+from __future__ import annotations
+
+import os
+import stat
+from typing import TYPE_CHECKING, cast
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+    from pathlib import Path
+
+    from .models import CodedErrorResult
+
+CHUNK_SIZE = 1 << 20
+
+# ── Catalogue text (error_codes.json "strings") ──────────────────────
+
+STRINGS: dict[str, str] = {
+    "E-UPLOAD-FILE-CHANGED": "{path} changed while {prog} was uploading it.",
+    "H-UPLOAD-FILE-CHANGED": (
+        "Wait until the file is completely written, then try again."
+    ),
+    "A-UPLOAD-FILE-CHANGED": (
+        "The file was still being written. Wait for it to finish, then retry once."
+    ),
+    "E-UPLOAD-FILE-UNREADABLE": "Couldn't read {path}: {os_error}.",
+    "H-UPLOAD-FILE-UNREADABLE": (
+        "Check that the file still exists and is readable, then try again."
+    ),
+}
+
+# (error message ID, human hint, agent hint)
+Messages = tuple[str, str, str]
+FILE_CHANGED: Messages = (
+    "E-UPLOAD-FILE-CHANGED",
+    "H-UPLOAD-FILE-CHANGED",
+    "A-UPLOAD-FILE-CHANGED",
+)
+FILE_UNREADABLE: Messages = (
+    "E-UPLOAD-FILE-UNREADABLE",
+    "H-UPLOAD-FILE-UNREADABLE",
+    "H-UPLOAD-FILE-UNREADABLE",
+)
+
+
+class UploadFileError(Exception):
+    """The file being uploaded changed, or couldn't be read."""
+
+    code = "invalid_argument"
+
+    def __init__(
+        self, messages: Messages, path: str, os_error: OSError | None = None
+    ) -> None:
+        from .transport import _clean
+
+        self.messages = messages
+        self.path = _clean(path)
+        self.values: dict[str, str] = {"path": self.path}
+        if os_error is not None:
+            reason = os_error.strerror or type(os_error).__name__
+            self.values["os_error"] = _clean(reason)
+        super().__init__(STRINGS[messages[0]].format(prog="dg", **self.values))
+
+
+class FileBody:
+    """A local file as a re-iterable request body with a known length.
+
+    Give it to the SDK as ``request=`` with a ``Content-Length`` header of
+    ``len(body)``; httpx then sends no ``Transfer-Encoding: chunked``. Use
+    it as a context manager, or call :meth:`close`, to close the descriptor.
+    It has no ``read`` method on purpose: httpx would read it once, as a
+    file, and a retry would send nothing.
+    """
+
+    def __init__(
+        self, path: str | Path, *, file_id: tuple[int, int] | None = None
+    ) -> None:
+        """Open ``path``.
+
+        ``file_id`` is ``(st_dev, st_ino)`` from a stat taken when the path
+        was validated: if the path now names another file, the upload stops
+        with ``E-UPLOAD-FILE-CHANGED`` before anything is sent.
+        """
+        self.path = os.fspath(path)
+        self._data: bytes | None = None
+        try:
+            self._fd: int | None = os.open(
+                self.path, os.O_RDONLY | getattr(os, "O_BINARY", 0)
+            )
+        except OSError as e:
+            raise UploadFileError(FILE_UNREADABLE, self.path, e) from e
+        try:
+            st = os.fstat(self._fd)
+            if file_id is not None and (st.st_dev, st.st_ino) != file_id:
+                self.close()
+                raise UploadFileError(FILE_CHANGED, self.path)
+            if not stat.S_ISREG(st.st_mode):
+                # A pipe or device (``<(...)``) can be read only once: keep
+                # its bytes, as 0.4 did, so a retry can resend them.
+                self._data = self._read_all()
+                self._size = len(self._data)
+                self.close()
+                return
+        except OSError as e:
+            self.close()
+            raise UploadFileError(FILE_UNREADABLE, self.path, e) from e
+        self._size = st.st_size
+        self._stamp = (st.st_size, st.st_mtime_ns)
+
+    def __len__(self) -> int:
+        return self._size
+
+    def __iter__(self) -> Iterator[bytes]:
+        if self._data is not None:
+            return iter((self._data,))
+        return self._chunks()
+
+    def __enter__(self) -> FileBody:
+        return self
+
+    def __exit__(self, *exc: object) -> None:
+        self.close()
+
+    def close(self) -> None:
+        fd, self._fd = self._fd, None
+        if fd is not None:
+            os.close(fd)
+
+    def _chunks(self) -> Iterator[bytes]:
+        offset = 0
+        while offset < self._size:
+            self._check()
+            data = self._pread(min(CHUNK_SIZE, self._size - offset), offset)
+            if not data:  # shorter than at open
+                raise UploadFileError(FILE_CHANGED, self.path)
+            yield data
+            offset += len(data)
+        self._check()
+
+    def _check(self) -> None:
+        if self._fd is None:
+            raise UploadFileError(
+                FILE_UNREADABLE, self.path, OSError(9, os.strerror(9))
+            )
+        try:
+            st = os.fstat(self._fd)
+        except OSError as e:
+            raise UploadFileError(FILE_UNREADABLE, self.path, e) from e
+        if (st.st_size, st.st_mtime_ns) != self._stamp:
+            raise UploadFileError(FILE_CHANGED, self.path)
+
+    def _pread(self, size: int, offset: int) -> bytes:
+        assert self._fd is not None
+        try:
+            if hasattr(os, "pread"):
+                return os.pread(self._fd, size, offset)
+            # Windows has no pread; one pass reads at a time.
+            os.lseek(self._fd, offset, os.SEEK_SET)
+            return os.read(self._fd, size)
+        except OSError as e:
+            raise UploadFileError(FILE_UNREADABLE, self.path, e) from e
+
+    def _read_all(self) -> bytes:
+        assert self._fd is not None
+        parts = []
+        while chunk := os.read(self._fd, CHUNK_SIZE):
+            parts.append(chunk)
+        return b"".join(parts)
+
+
+def coded_result(err: UploadFileError) -> CodedErrorResult:
+    """Report ``err`` on stderr (two lines) and return its coded result.
+
+    The same shape as a transport error, with ``next_step`` null: no
+    command fixes a file that is still being written.
+    """
+    from rich.markup import escape
+
+    from . import output, transport
+
+    program = transport.prog()
+    values = {**err.values, "prog": program or "dg"}
+    agentic = bool(output._output_config["agentic"])
+    error = STRINGS[err.messages[0]].format(**values)
+    hint = STRINGS[err.messages[2 if agentic else 1]].format(**values)
+    output.print_error(escape(error))
+    output.print_hint(escape(hint))
+    result = transport.result_class()(
+        error=error,
+        code=err.code,
+        hint=hint,
+        next_step=None,
+        details={"path": err.path},
+    )
+    return cast("CodedErrorResult", result)
diff --git a/packages/deepctl-core/src/deepctl_core/websocket.py b/packages/deepctl-core/src/deepctl_core/websocket.py
index 78a4c59b..cd4bf4b7 100644
--- a/packages/deepctl-core/src/deepctl_core/websocket.py
+++ b/packages/deepctl-core/src/deepctl_core/websocket.py
@@ -83,40 +83,61 @@ def _as_refusal(
     return exc
 
 
-class _AsyncOpen:
-    """``async with`` wrapper around websockets' asyncio ``connect``."""
+async def open_async(
+    url: str,
+    headers: dict[str, str],
+    *,
+    command: str,
+    payload: str,
+    **options: Any,
+) -> Any:
+    """Open ``url`` and return the connection, refusing any redirect.
 
-    def __init__(
-        self, url: str, headers: dict[str, str], command: str, payload: str
-    ) -> None:
-        from websockets.asyncio.client import connect
+    Needs websockets 13.0 or later (its asyncio client); the sync variant
+    works with anything the Deepgram SDK accepts. ``options`` go to
+    websockets' ``connect`` (``close_timeout``, ``compression`` and so on).
 
-        self._url = url
-        self._command = command
-        self._payload = payload
-        refuse = self._refuse
+    ``command`` and ``payload`` name the command and what it would have
+    sent, for the error: "dg listen" and "audio", for example.
+    """
+    from websockets.asyncio.client import connect
 
-        class _NoRedirect(connect):
-            # websockets 13.1 and later call this on a failed handshake and
-            # follow whatever URI it returns; 13.0 never follows.
-            def process_redirect(self, exc: Exception) -> Exception | str:
-                result = refuse(exc)
-                return result if isinstance(result, Exception) else exc
+    def refuse(exc: BaseException) -> BaseException:
+        return _as_refusal(url, exc, command=command, payload=payload)
 
-        self._connect = _NoRedirect(url, additional_headers=headers)
-        self._ws: Any = None
+    class _NoRedirect(connect):
+        # websockets 13.1 and later call this on a failed handshake and
+        # follow whatever URI it returns; 13.0 never follows.
+        def process_redirect(self, exc: Exception) -> Exception | str:
+            result = refuse(exc)
+            return result if isinstance(result, Exception) else exc
 
-    def _refuse(self, exc: BaseException) -> BaseException:
-        return _as_refusal(self._url, exc, command=self._command, payload=self._payload)
+    try:
+        return await _NoRedirect(url, additional_headers=headers, **options)
+    except Exception as exc:
+        refused = refuse(exc)
+        if refused is exc:
+            raise
+        raise refused from exc
+
+
+class _AsyncOpen:
+    """``async with`` wrapper around :func:`open_async`."""
+
+    def __init__(
+        self,
+        url: str,
+        headers: dict[str, str],
+        command: str,
+        payload: str,
+        options: dict[str, Any],
+    ) -> None:
+        self._args = (url, headers)
+        self._kwargs = dict(options, command=command, payload=payload)
+        self._ws: Any = None
 
     async def __aenter__(self) -> Any:
-        try:
-            self._ws = await self._connect
-        except Exception as exc:
-            refused = self._refuse(exc)
-            if refused is exc:
-                raise
-            raise refused from exc
+        self._ws = await open_async(*self._args, **self._kwargs)
         return self._ws
 
     async def __aexit__(self, *exc_info: Any) -> None:
@@ -124,17 +145,15 @@ async def __aexit__(self, *exc_info: Any) -> None:
 
 
 def connect_async(
-    url: str, headers: dict[str, str], *, command: str, payload: str
+    url: str,
+    headers: dict[str, str],
+    *,
+    command: str,
+    payload: str,
+    **options: Any,
 ) -> _AsyncOpen:
-    """Open ``url`` for ``async with``, refusing any redirect.
-
-    Needs websockets 13.0 or later (its asyncio client); the sync variant
-    works with anything the Deepgram SDK accepts.
-
-    ``command`` and ``payload`` name the command and what it would have
-    sent, for the error: "dg listen" and "audio", for example.
-    """
-    return _AsyncOpen(url, headers, command, payload)
+    """Open ``url`` for ``async with``, refusing any redirect (see open_async)."""
+    return _AsyncOpen(url, headers, command, payload, options)
 
 
 class _SyncOpen:
diff --git a/packages/deepctl-core/tests/unit/test_auth.py b/packages/deepctl-core/tests/unit/test_auth.py
index 74959b68..946f1e11 100644
--- a/packages/deepctl-core/tests/unit/test_auth.py
+++ b/packages/deepctl-core/tests/unit/test_auth.py
@@ -1,8 +1,8 @@
 """Tests for the authentication module."""
 
+import json
 from datetime import datetime, timedelta, timezone
 from unittest.mock import MagicMock, Mock, patch
-from urllib.parse import parse_qs, urlparse
 
 import httpx
 import keyring.errors
@@ -266,22 +266,19 @@ def test_guard_with_no_api_key(self, auth_manager):
             ):
                 auth_manager.guard()
 
-    def test_guard_with_invalid_credentials(self, auth_manager):
-        """Test guard method with invalid credentials."""
-        # Set up API key
+    def test_guard_sends_nothing(self, auth_manager):
+        """guard() only checks that a key is there: no pre-flight request.
+
+        An invalid key is reported by the command's own request (401 ->
+        auth_invalid, deepctl_core.transport)."""
         with patch.object(
             auth_manager, "get_api_key", return_value="sk-test-key"
-        ):
-            # Mock failed key verification
-            with patch.object(
-                auth_manager,
-                "verify_api_key",
-                return_value=(False, "Invalid API key", "auth"),
-            ):
-                with pytest.raises(
-                    AuthenticationError, match="Invalid API key"
-                ):
-                    auth_manager.guard()
+        ), patch.object(auth_manager, "verify_api_key") as verify, patch.object(
+            auth_manager, "client"
+        ) as http:
+            auth_manager.guard()
+        verify.assert_not_called()
+        assert http.method_calls == []
 
     def test_guard_does_not_require_project_id(self, auth_manager):
         """Test that guard() only checks API key, not project_id."""
@@ -820,19 +817,21 @@ def test_get_api_key_uses_explicit_key(self, mock_config):
 
         assert auth.get_api_key() == "sk-explicit"
 
-    def test_poll_for_token_encodes_device_flow_parameters(self, mock_config):
+    def test_poll_for_token_posts_without_a_hostname(self, mock_config):
+        """RFC 8628 §3.4: the device code goes in a POST body, never a URL, and
+        no machine name is sent."""
         from deepctl_core.auth import DeviceCodeResponse
 
         auth = self._make_auth(mock_config)
         response = Mock()
-        response.status_code = 201
+        response.status_code = 200
         response.json.return_value = {
             "access_token": "jwt",
             "dg_token": "dg-finite-key",
             "dg_expires_in": 3600,
-            "project_id": "project",
+            "pid": "project",
         }
-        auth.client.get.return_value = response
+        auth.client.post.return_value = response
 
         token = auth._poll_for_token(
             DeviceCodeResponse(
@@ -841,16 +840,164 @@ def test_poll_for_token_encodes_device_flow_parameters(self, mock_config):
                 expires_in=600,
                 interval=1,
             ),
-            "test-host",
+            "https://id.example.test",
         )
 
-        poll_url = auth.client.get.call_args.args[0]
-        assert parse_qs(urlparse(poll_url).query) == {
-            "device_code": ["device-code"],
-            "client_id": ["deepgram-cli"],
-            "hostname": ["test-host"],
+        auth.client.get.assert_not_called()
+        url = auth.client.post.call_args.args[0]
+        assert url == "https://id.example.test/token"
+        assert auth.client.post.call_args.kwargs["data"] == {
+            "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
+            "device_code": "device-code",
+            "client_id": "deepgram-cli",
         }
         assert token.dg_token == "dg-finite-key"
+        assert token.pid == "project"
+
+    @pytest.mark.parametrize(
+        ("status", "body", "state"),
+        [
+            (400, {"error": "authorization_pending"}, "pending"),
+            (400, {"error": "slow_down"}, "slow_down"),
+            (429, {}, "slow_down"),
+            (400, {"error": "access_denied"}, "denied"),
+            (400, {"error": "expired_token"}, "expired"),
+            (400, {"error": "invalid_grant"}, "error"),
+            (500, None, "unavailable"),
+            (503, {"error": "temporarily_unavailable"}, "unavailable"),
+            (400, {"error": "temporarily_unavailable"}, "unavailable"),
+        ],
+    )
+    def test_poll_device_token_maps_rfc8628_answers(
+        self, mock_config, status, body, state
+    ):
+        auth = self._make_auth(mock_config)
+        response = Mock()
+        response.status_code = status
+        if body is None:
+            response.json.side_effect = ValueError("not json")
+        else:
+            response.json.return_value = body
+        auth.client.post.return_value = response
+        assert auth.poll_device_token("dc", "https://id.example.test").state == state
+
+    @pytest.mark.parametrize(("status", "header", "want"), [(429, "30", 30), (503, "60", 60), (429, "Wed, 21 Oct 2026 07:28:00 GMT", None)])
+    def test_poll_reads_retry_after(self, mock_config, status, header, want):
+        auth = self._make_auth(mock_config)
+        response = Mock(status_code=status, headers={"Retry-After": header})
+        response.json.return_value = {}
+        auth.client.post.return_value = response
+        assert auth.poll_device_token("dc", "https://id.example.test").retry_after == want
+
+    def test_wait_polls_no_faster_than_6_s_and_backs_off(self, mock_config, monkeypatch):
+        from deepctl_core import auth as auth_module
+        from deepctl_core.auth import DeviceCodeResponse, DevicePoll, TokenResponse
+
+        auth = self._make_auth(mock_config)
+        slept = []
+        monkeypatch.setattr(auth_module.time, "sleep", slept.append)
+        answers = [
+            DevicePoll("pending"),
+            DevicePoll("unavailable", retry_after=20),
+            DevicePoll("slow_down"),
+            DevicePoll("token", token=TokenResponse(access_token="j", dg_token="k")),
+        ]
+        monkeypatch.setattr(auth, "poll_device_token", lambda *a: answers.pop(0))
+        auth._poll_for_token(
+            DeviceCodeResponse(
+                device_code="dc",
+                verification_uri="https://id.example.test/auth/cli",
+                expires_in=600,
+                interval=1,
+            ),
+            "https://id.example.test",
+        )
+        assert slept == [6, 20, 25]
+
+    def test_terminal_flow_prints_the_link_and_code_line(self, mock_config, monkeypatch, capsys):
+        """J2.3: the person's flow shows I-LOGIN-PENDING on stderr."""
+        from deepctl_core import auth as auth_module
+        from deepctl_core import output
+        from deepctl_core.auth import DeviceCodeResponse, TokenResponse
+
+        auth = self._make_auth(mock_config)
+        monkeypatch.setattr(auth_module, "check_identity_host", lambda c: "https://id.example.test")
+        monkeypatch.setattr(
+            auth,
+            "_request_device_code",
+            lambda url: DeviceCodeResponse(
+                device_code="dc",
+                user_code="WDJB-MJHT",
+                verification_uri="https://id.example.test/auth/cli",
+                expires_in=600,
+            ),
+        )
+        monkeypatch.setattr(auth, "_poll_for_token", lambda *a: TokenResponse(access_token="j"))
+        monkeypatch.setattr(auth, "_store_token", lambda t: None)
+        monkeypatch.setattr(auth_module.webbrowser, "open", lambda url: True)
+        monkeypatch.setitem(output._output_config, "agentic", False)
+        monkeypatch.setitem(output._output_config, "quiet", False)
+        monkeypatch.setattr(output.stderr_console, "_width", 400)
+        for open_browser in (True, False):
+            auth.login_with_device_flow(open_browser=open_browser)
+            err = capsys.readouterr().err
+            assert (
+                "To finish logging in, open https://id.example.test/auth/cli and "
+                "enter the code WDJB-MJHT." in err
+            )
+            assert "Enter code" not in err and "didn't open" not in err
+            assert ("Opening browser" in err) is open_browser
+            assert ("Open the link below" in err) is (not open_browser)
+
+    def test_device_code_request_sends_no_hostname(self, mock_config):
+        auth = self._make_auth(mock_config)
+        response = Mock()
+        response.status_code = 201
+        response.json.return_value = {
+            "device_code": "dc",
+            "user_code": "ABCD-EFGH",
+            "verification_uri": "https://id.example.test/auth/cli",
+            "expires_in": 300,
+            "interval": 5,
+        }
+        auth.client.post.return_value = response
+        auth._request_device_code("https://id.example.test")
+        sent = auth.client.post.call_args.kwargs["json"]
+        assert sent["hostname"] == "deepctl"
+        import os as _os
+
+        if hasattr(_os, "uname"):
+            assert _os.uname().nodename not in json.dumps(sent)
+
+    @pytest.mark.parametrize(
+        "uri",
+        ["http://id.example.test/auth/cli", "ftp://x/y", "javascript:alert(1)"],
+    )
+    def test_device_code_link_must_be_https(self, mock_config, uri):
+        from deepctl_core.auth import AuthenticationError
+
+        auth = self._make_auth(mock_config)
+        response = Mock()
+        response.status_code = 201
+        response.json.return_value = {
+            "device_code": "dc",
+            "user_code": "ABCD-EFGH",
+            "verification_uri": uri,
+            "expires_in": 300,
+        }
+        auth.client.post.return_value = response
+        with pytest.raises(AuthenticationError):
+            auth._request_device_code("https://id.example.test")
+
+    def test_device_code_link_may_be_loopback_http(self, mock_config):
+        from deepctl_core.auth import DeviceCodeResponse
+
+        d = DeviceCodeResponse(
+            device_code="dc",
+            verification_uri="http://127.0.0.1:8080/auth/cli",
+            expires_in=300,
+        )
+        assert d.interval == 5
 
     # ------------------------------------------------------------------
     # logout — clears JWT entries
diff --git a/packages/deepctl-core/tests/unit/test_base_group.py b/packages/deepctl-core/tests/unit/test_base_group.py
index 93529724..eed79d2e 100644
--- a/packages/deepctl-core/tests/unit/test_base_group.py
+++ b/packages/deepctl-core/tests/unit/test_base_group.py
@@ -239,6 +239,23 @@ def handle_group(
         assert len(click_group.params) == 1
         assert click_group.params[0].name == "verbose"
 
+    @pytest.mark.unit
+    def test_group_option_metavar_is_passed_through(self):
+        class GroupWithFile(BaseGroupCommand):
+            name = "testgroup"
+            help = "Test group"
+
+            def get_arguments(self) -> list[dict[str, Any]]:
+                return [
+                    {"names": ["--out-file"], "is_option": True, "metavar": "FILE"}
+                ]
+
+            def handle_group(self, *args: Any, **kwargs: Any) -> Any:
+                return None
+
+        click_group = GroupWithFile().get_click_group()
+        assert "--out-file FILE" in click_group.get_help(click.Context(click_group))
+
     @pytest.mark.unit
     def test_group_callback_execution(self, mock_group_command_class):
         """Test that the group callback properly executes."""
diff --git a/packages/deepctl-core/tests/unit/test_base_url_paths.py b/packages/deepctl-core/tests/unit/test_base_url_paths.py
index 5375e4a2..ef999a4b 100644
--- a/packages/deepctl-core/tests/unit/test_base_url_paths.py
+++ b/packages/deepctl-core/tests/unit/test_base_url_paths.py
@@ -8,7 +8,7 @@
 import httpx
 import pytest
 import yaml
-from deepctl_core import hosts, output
+from deepctl_core import hosts, output, transport
 from deepctl_core.auth import AuthManager
 from deepctl_core.client import DeepgramClient
 from deepctl_core.config import Config
@@ -24,6 +24,7 @@ def _isolated(tmp_path, monkeypatch):
         lambda: tmp_path / "user" / "config.yaml",
     )
     monkeypatch.setattr(hosts, "_reported", set())
+    monkeypatch.setattr(transport, "_client", None)
     monkeypatch.setattr(output, "is_ai_agent", lambda: False)
     monkeypatch.setattr(output, "is_agentic", lambda: False)
     monkeypatch.setattr(output.stderr_console, "_width", 400)
@@ -38,12 +39,14 @@ def user(tmp_path, data) -> str:
 
 def recording(config):
     seen: list[httpx.Request] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen.append(request)
+        return httpx.Response(200, json={"projects": []})
+
     auth = AuthManager(config)
-    auth.client = httpx.Client(
-        transport=httpx.MockTransport(
-            lambda r: seen.append(r) or httpx.Response(200, json={"projects": []})
-        )
-    )
+    auth.client = httpx.Client(transport=httpx.MockTransport(handler))
+    transport._set_client(httpx.Client(transport=httpx.MockTransport(handler)))
     return auth, seen
 
 
@@ -61,6 +64,8 @@ def test_env_source(tmp_path, monkeypatch):
     auth, seen = recording(config)
     assert auth.check_base_url() == PROXY
     auth.guard()
+    assert seen == []  # guard() checks the host and the key, and sends nothing
+    DeepgramClient(config, auth).get_projects()
     assert str(seen[0].url) == PROXY + "/v1/projects"
 
 
diff --git a/packages/deepctl-core/tests/unit/test_base_url_provenance.py b/packages/deepctl-core/tests/unit/test_base_url_provenance.py
index cc18cab8..ac720b2a 100644
--- a/packages/deepctl-core/tests/unit/test_base_url_provenance.py
+++ b/packages/deepctl-core/tests/unit/test_base_url_provenance.py
@@ -13,7 +13,7 @@
 import httpx
 import pytest
 import yaml
-from deepctl_core import hosts, output
+from deepctl_core import hosts, output, transport
 from deepctl_core.auth import AuthManager
 from deepctl_core.base_command import BaseCommand
 from deepctl_core.client import DeepgramClient
@@ -48,6 +48,7 @@ def _isolated(tmp_path, monkeypatch):
         "deepctl_core.config._trust_root_location", lambda: (tmp_path, tmp_path / "user" / "config.yaml")
     )
     monkeypatch.setattr(hosts, "_reported", set())
+    monkeypatch.setattr(transport, "_client", None)
     monkeypatch.setattr(output, "is_agentic", lambda: False)
     monkeypatch.setattr(output, "is_ai_agent", lambda: False)
     output._output_config.update(agentic=False, quiet=False, format="default")
@@ -79,7 +80,8 @@ def write_user(tmp_path, data) -> str:
 
 
 def recording_auth(config: Config) -> tuple[AuthManager, list[httpx.Request]]:
-    """AuthManager whose HTTP client records requests instead of sending."""
+    """AuthManager whose HTTP clients (its own, and the shared one the SDK
+    uses) record requests instead of sending."""
     seen: list[httpx.Request] = []
 
     def handler(request: httpx.Request) -> httpx.Response:
@@ -88,9 +90,17 @@ def handler(request: httpx.Request) -> httpx.Response:
 
     auth = AuthManager(config)
     auth.client = httpx.Client(transport=httpx.MockTransport(handler))
+    transport._set_client(httpx.Client(transport=httpx.MockTransport(handler)))
     return auth, seen
 
 
+def send(auth: AuthManager) -> None:
+    """What an authed command does: guard(), then its own request through
+    the SDK. There is no separate key check."""
+    auth.guard()
+    DeepgramClient(auth.config, auth).get_projects()
+
+
 KEYED = {"profiles": {"default": {"api_key": "sk-USERKEY"}}}
 
 
@@ -250,7 +260,7 @@ def test_agent_rendering_gets_agent_hint(signal, monkeypatch, tmp_path, capsys):
     monkeypatch.setenv("DEEPGRAM_BASE_URL", "https://proxy.example")
     config = Config(config_path=write_user(tmp_path, data))
     auth, seen = recording_auth(config)
-    auth.guard()  # sent: CI is not an AI-agent marker
+    send(auth)  # sent: CI is not an AI-agent marker
     assert seen
     captured = capsys.readouterr()
     for text in (captured.err, captured.out):
@@ -268,11 +278,11 @@ def test_untrusted_text_is_sanitized():
 
 
 class TestCredentialPaths:
-    def test_preflight_check_refuses_flag_host(self, tmp_path, capsys):
+    def test_command_path_refuses_flag_host(self, tmp_path, capsys):
         config = Config(config_path=write_user(tmp_path, KEYED), base_url=FOREIGN)
         auth, seen = recording_auth(config)
         with pytest.raises(CredentialHostError):
-            auth.guard()
+            send(auth)
         assert seen == []
         err = capsys.readouterr().err
         assert err.count("Not sending your API key to evil.example") == 1
@@ -293,11 +303,11 @@ def test_project_check_uses_the_checked_base_url(self, tmp_path, monkeypatch):
         auth.verify_credentials("sk-USERKEY", "P1")
         assert [str(r.url) for r in seen] == ["http://127.0.0.1:8080/v1/projects/P1"]
 
-    def test_preflight_sends_to_trusted_flag_host(self, tmp_path):
+    def test_command_path_sends_to_trusted_flag_host(self, tmp_path):
         data = {**KEYED, "api": {"allowed_hosts": ["evil.example"]}}
         config = Config(config_path=write_user(tmp_path, data), base_url=FOREIGN)
         auth, seen = recording_auth(config)
-        auth.guard()
+        send(auth)
         assert [r.url.host for r in seen] == ["evil.example"]
         assert seen[0].headers["Authorization"] == "Token sk-USERKEY"
 
@@ -360,7 +370,7 @@ def test_project_file_allowlist_does_not_trust_flag_host(self, tmp_path):
         config = Config(config_path=write_user(tmp_path, KEYED), base_url=FOREIGN)
         auth, seen = recording_auth(config)
         with pytest.raises(CredentialHostError) as err:
-            auth.guard()
+            send(auth)
         assert err.value.code == "foreign_host"
         assert seen == []
 
@@ -370,7 +380,7 @@ def test_saved_profile_base_url_refused(self, tmp_path):
         config = Config(config_path=write_user(tmp_path, data))
         auth, seen = recording_auth(config)
         with pytest.raises(CredentialHostError) as err:
-            auth.guard()
+            send(auth)
         assert err.value.message_id == "E-FH-PROFILE"
         assert seen == []
 
@@ -381,7 +391,7 @@ def test_saved_profile_base_url_allowlisted(self, tmp_path):
         }
         config = Config(config_path=write_user(tmp_path, data))
         auth, seen = recording_auth(config)
-        auth.guard()
+        send(auth)
         assert len(seen) == 1
 
     def test_agent_env_host_refused(self, tmp_path, monkeypatch, agentic):
@@ -390,7 +400,7 @@ def test_agent_env_host_refused(self, tmp_path, monkeypatch, agentic):
         config = Config(config_path=write_user(tmp_path, KEYED))
         auth, seen = recording_auth(config)
         with pytest.raises(CredentialHostError) as err:
-            auth.guard()
+            send(auth)
         assert err.value.code == "foreign_host"
         assert seen == []
 
@@ -399,14 +409,14 @@ def test_agent_env_host_allowlisted(self, tmp_path, monkeypatch, agentic):
         data = {**KEYED, "api": {"allowed_hosts": ["evil.example"]}}
         config = Config(config_path=write_user(tmp_path, data))
         auth, seen = recording_auth(config)
-        auth.guard()
+        send(auth)
         assert seen[0].headers["Authorization"] == "Token sk-USERKEY"
 
     def test_non_agent_loopback_env_allowed(self, tmp_path, monkeypatch):
         monkeypatch.setenv("DEEPGRAM_BASE_URL", "http://127.0.0.1:8080")
         config = Config(config_path=write_user(tmp_path, KEYED))
         auth, seen = recording_auth(config)
-        auth.guard()
+        send(auth)
         assert seen[0].url.host == "127.0.0.1"
         assert seen[0].headers["Authorization"] == "Token sk-USERKEY"
 
@@ -501,8 +511,8 @@ def test_ci_proxy_env_host_sent_with_one_warning(
         monkeypatch.setenv("DEEPGRAM_BASE_URL", "https://proxy.example")
         config = Config(config_path=write_user(tmp_path, KEYED))
         auth, seen = recording_auth(config)
-        auth.guard()
-        auth.guard()
+        send(auth)
+        send(auth)
         assert [r.url.host for r in seen] == ["proxy.example", "proxy.example"]
         assert seen[0].headers["Authorization"] == "Token sk-USERKEY"
         err = capsys.readouterr().err
@@ -523,7 +533,7 @@ def test_ci_proxy_env_host_refused_for_agent(
         config = Config(config_path=write_user(tmp_path, KEYED))
         auth, seen = recording_auth(config)
         with pytest.raises(CredentialHostError) as err:
-            auth.guard()
+            send(auth)
         assert err.value.code == "foreign_host"
         assert seen == []
 
@@ -533,7 +543,7 @@ def test_cron_like_env_host_allowed_with_warning(
         monkeypatch.setenv("DEEPGRAM_BASE_URL", "https://selfhosted.example")
         config = Config(config_path=write_user(tmp_path, KEYED))
         auth, seen = recording_auth(config)
-        auth.guard()
+        send(auth)
         assert seen[0].headers["Authorization"] == "Token sk-USERKEY"
         assert capsys.readouterr().err.count("(from DEEPGRAM_BASE_URL)") == 1
 
@@ -544,7 +554,7 @@ def test_regional_or_allowlisted_env_host_no_warning(
         data = {**KEYED, "api": {"allowed_hosts": ["proxy.example"]}}
         config = Config(config_path=write_user(tmp_path, data))
         auth, _ = recording_auth(config)
-        auth.guard()
+        send(auth)
         assert "(from DEEPGRAM_BASE_URL)" not in capsys.readouterr().err
 
 
@@ -577,7 +587,7 @@ def test_default_path_widens_trust(self, tmp_path):
         assert config.get_profile().base_url == "http://127.0.0.1:8000"
         assert config.get("tools.ffprobe_path") == "/repo/ffprobe"
         auth, seen = recording_auth(config)
-        auth.guard()
+        send(auth)
         assert seen[0].url.host == "127.0.0.1"
 
     def test_other_path_cannot_widen_trust(self, tmp_path, agentic, monkeypatch):
@@ -610,7 +620,7 @@ def test_other_path_cannot_widen_trust(self, tmp_path, agentic, monkeypatch):
         ) in texts
         assert not any(str(repo_file) in (h or "") for h in hints)
         auth, seen = recording_auth(config)
-        auth.guard()
+        send(auth)
         assert [r.url.host for r in seen] == ["api.deepgram.com"]
 
     def test_other_path_keeps_credentials_and_regional_url(self, tmp_path):
@@ -633,7 +643,7 @@ def test_other_path_flag_host_still_foreign(self, tmp_path):
         )
         auth, seen = recording_auth(config)
         with pytest.raises(CredentialHostError):
-            auth.guard()
+            send(auth)
         assert seen == []
 
 
@@ -717,7 +727,7 @@ def test_checked_url_is_the_url_used(self, tmp_path, flag):
         assert base == base.lower()
         assert base.startswith("https://api.")
         assert not base.endswith(".")
-        auth.guard()
+        send(auth)
         assert seen[0].url.host.startswith("api.")
         with (
             patch.object(AuthManager, "guard"),
@@ -764,7 +774,7 @@ def test_entry_forms(self, tmp_path, entry, recwarn):
         )
         assert config.allowed_hosts() == ["proxy.example"]
         auth, seen = recording_auth(config)
-        auth.guard()
+        send(auth)
         assert seen
         assert not [w for w in recwarn if "serializer" in str(w.message).lower()]
 
@@ -773,7 +783,7 @@ def test_entry_with_scheme_and_port(self, tmp_path):
         config = Config(config_path=write_user(tmp_path, data), base_url=LOOPBACK)
         assert config.allowed_hosts() == ["127.0.0.1:8000"]
         auth, seen = recording_auth(config)
-        auth.guard()
+        send(auth)
         assert seen
 
     def test_scheme_entry_does_not_match_host_named_https(self):
@@ -791,7 +801,7 @@ def test_custom_config_reads_allowlist_from_default_file(tmp_path):
     config = Config(config_path=str(other), base_url="https://h.example")
     assert config.allowed_hosts() == ["h.example"]
     auth, seen = recording_auth(config)
-    auth.guard()
+    send(auth)
     assert seen[0].url.host == "h.example"
 
 
@@ -802,6 +812,6 @@ def test_custom_config_hint_names_default_file(tmp_path, capsys):
     config = Config(config_path=str(other), base_url=FOREIGN)
     auth, _ = recording_auth(config)
     with pytest.raises(CredentialHostError) as err:
-        auth.guard()
+        send(auth)
     assert str(tmp_path / "user" / "config.yaml") in err.value.hint
     assert str(other) not in err.value.hint
diff --git a/packages/deepctl-core/tests/unit/test_client.py b/packages/deepctl-core/tests/unit/test_client.py
index 9b5d9174..c6bfeb68 100644
--- a/packages/deepctl-core/tests/unit/test_client.py
+++ b/packages/deepctl-core/tests/unit/test_client.py
@@ -1,9 +1,10 @@
 """Tests for the DeepgramClient class."""
 
 from pathlib import Path
-from unittest.mock import MagicMock, Mock, mock_open, patch
+from unittest.mock import MagicMock, Mock, patch
 
 import pytest
+from deepctl_core import transport
 from deepctl_core.auth import AuthManager
 from deepctl_core.client import DeepgramClient
 from deepctl_core.config import Config
@@ -128,6 +129,7 @@ def test_create_client_with_custom_base_url(
         # Verify DGClient was created with environment kwarg
         mock_dg_client.assert_called_once_with(
             api_key="sk-test",
+            httpx_client=transport.shared_client(),
             environment=mock_env.return_value,
             follow_redirects=False,
         )
@@ -174,12 +176,10 @@ def test_create_client_error_handling(
             client._create_client()
 
     @patch("deepctl_core.client.DGClient")
-    @patch("deepctl_core.client.Path.exists")
-    @patch("builtins.open", new_callable=mock_open, read_data=b"audio data")
-    def test_transcribe_file(self, mock_file, mock_exists, mock_dg_client, client):
+    def test_transcribe_file(self, mock_dg_client, client, tmp_path):
         """Test transcribing a file."""
-        # Setup mocks
-        mock_exists.return_value = True
+        audio = tmp_path / "test.mp3"
+        audio.write_bytes(b"audio data")
         mock_instance = Mock()
         mock_media = Mock()
         mock_data = {"transcript": "Hello world"}
@@ -189,13 +189,18 @@ def test_transcribe_file(self, mock_file, mock_exists, mock_dg_client, client):
 
         # Test transcription
         result = client.transcribe_file(
-            "/audio/test.mp3", options={"model": "nova-2", "language": "en"}
+            audio, options={"model": "nova-2", "language": "en"}
         )
 
         assert result == {"transcript": "Hello world"}
 
-        # Verify transcribe_file was called
+        # Verify transcribe_file was called with a streamed body
         mock_media.transcribe_file.assert_called_once()
+        kwargs = mock_media.transcribe_file.call_args.kwargs
+        assert kwargs["request_options"] == {
+            "additional_headers": {"Content-Length": "10"}
+        }
+        assert kwargs["model"] == "nova-2"
 
     @patch("deepctl_core.client.DGClient")
     def test_transcribe_url(self, mock_dg_client, client):
diff --git a/packages/deepctl-core/tests/unit/test_config_login.py b/packages/deepctl-core/tests/unit/test_config_login.py
new file mode 100644
index 00000000..1528f122
--- /dev/null
+++ b/packages/deepctl-core/tests/unit/test_config_login.py
@@ -0,0 +1,36 @@
+"""Config details login relies on: the refusal carries its cause, and the
+legacy-config migration never writes to stdout."""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+import pytest
+from deepctl_core import config as config_module
+from deepctl_core.config import Config, ConfigSaveRefused
+
+
+def test_save_refusal_carries_its_cause(tmp_path):
+    exc = config_module._save_refused("writable", tmp_path / "c.yaml")
+    assert isinstance(exc, ConfigSaveRefused)
+    assert exc.why == "writable"
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX homes")
+def test_legacy_migration_prints_to_stderr_only(tmp_path, monkeypatch, capsys):
+    home = tmp_path / "home"
+    old = home / ".config" / "deepgram"
+    old.mkdir(parents=True)
+    (old / "config.yaml").write_text("output:\n  format: json\n")
+    monkeypatch.setenv("HOME", str(home))
+    monkeypatch.delenv("XDG_CONFIG_HOME", raising=False)
+    monkeypatch.setattr(Path, "home", staticmethod(lambda: home))
+    monkeypatch.setattr("deepctl_core.output.is_ai_agent", lambda: False)
+    monkeypatch.chdir(tmp_path)
+    Config()
+    captured = capsys.readouterr()
+    assert captured.out == ""
+    assert "Migrating config" in captured.err
+    assert os.path.exists(home / ".config" / "deepctl" / "config.yaml")
diff --git a/packages/deepctl-core/tests/unit/test_login_state.py b/packages/deepctl-core/tests/unit/test_login_state.py
new file mode 100644
index 00000000..c8f84dbd
--- /dev/null
+++ b/packages/deepctl-core/tests/unit/test_login_state.py
@@ -0,0 +1,186 @@
+"""The state dir helper and the pending device-login store."""
+
+from __future__ import annotations
+
+import json
+import os
+import stat
+import sys
+from pathlib import Path
+
+import pytest
+from deepctl_core import login_state
+from deepctl_core.login_state import (
+    PendingLogin,
+    load_pending,
+    remove_pending,
+    save_pending,
+    unwritable_dir,
+)
+
+posix = pytest.mark.skipif(sys.platform == "win32", reason="POSIX modes")
+
+
+@pytest.fixture
+def state(tmp_path, monkeypatch):
+    home = tmp_path / "home"
+    home.mkdir()
+    monkeypatch.setattr(Path, "home", staticmethod(lambda: home))
+    return home / ".deepctl"
+
+
+def pending(**over):
+    values = dict(
+        device_code="dc",
+        user_code="ABCD-EFGH",
+        verification_uri="https://id.example/auth/cli",
+        interval=6,
+        expires_at=2_000_000_000.0,
+        host="https://id.example",
+        profile="default",
+    )
+    values.update(over)
+    return PendingLogin(**values)
+
+
+def test_state_dir_is_dot_deepctl_in_home(state):
+    assert login_state.state_dir() == state
+
+
+@posix
+@pytest.mark.parametrize("umask", [0o022, 0o002, 0o077, 0])
+def test_saved_file_is_0600_in_a_0700_dir(state, umask):
+    old = os.umask(umask)
+    try:
+        path = save_pending(pending())
+    finally:
+        os.umask(old)
+    assert stat.S_IMODE(path.stat().st_mode) == 0o600
+    assert stat.S_IMODE(state.stat().st_mode) == 0o700
+    assert json.loads(path.read_text())["device_code"] == "dc"
+    assert [p.name for p in state.iterdir()] == ["login-pending.json"]
+
+
+def test_save_replaces_atomically(state):
+    save_pending(pending(device_code="one"))
+    save_pending(pending(device_code="two"))
+    assert load_pending(agent=True).pending.device_code == "two"
+    assert [p.name for p in state.iterdir()] == ["login-pending.json"]
+
+
+@posix
+def test_save_never_follows_a_planted_link(state, tmp_path):
+    state.mkdir(mode=0o700)
+    target = tmp_path / "victim"
+    target.write_text("keep")
+    (state / "login-pending.json").symlink_to(target)
+    save_pending(pending())
+    assert target.read_text() == "keep"
+    assert not (state / "login-pending.json").is_symlink()
+
+
+@posix
+def test_state_dir_owned_by_someone_else_is_refused(state, monkeypatch):
+    state.mkdir(mode=0o700)
+    other = os.geteuid() + 1
+    monkeypatch.setattr(login_state.os, "geteuid", lambda: other)
+    with pytest.raises(login_state.StateDirError):
+        save_pending(pending())
+
+
+def test_round_trip_and_remove(state):
+    save_pending(pending())
+    loaded = load_pending(agent=True)
+    assert loaded.pending == pending() and loaded.ignored_why is None
+    remove_pending(loaded)
+    assert not loaded.path.exists()
+
+
+def test_remove_keeps_a_newer_file(state):
+    save_pending(pending(device_code="old"))
+    loaded = load_pending(agent=True)
+    save_pending(pending(device_code="new"))
+    remove_pending(loaded)
+    assert load_pending(agent=True).pending.device_code == "new"
+
+
+@pytest.mark.parametrize(
+    "text",
+    ["", "not json", "[]", '{"device_code": "dc"}', json.dumps({"interval": True})],
+)
+def test_malformed_file_is_absent(state, text):
+    state.mkdir()
+    (state / "login-pending.json").write_text(text)
+    (state / "login-pending.json").chmod(0o600)  # any umask
+    loaded = load_pending(agent=True)
+    assert loaded.pending is None and loaded.ignored_why is None
+
+
+@posix
+@pytest.mark.parametrize(("mode", "why"), [(0o666, "writable"), (0o620, "writable")])
+def test_agent_ignores_a_file_others_can_change(state, mode, why):
+    path = save_pending(pending())
+    os.chmod(path, mode)
+    assert load_pending(agent=True).ignored_why == why
+    assert load_pending(agent=False).pending == pending()
+
+
+@posix
+def test_agent_ignores_a_hard_linked_file(state, tmp_path):
+    path = save_pending(pending())
+    os.link(path, tmp_path / "other")
+    assert load_pending(agent=True).ignored_why == "links"
+
+
+def test_expiry(state):
+    p = pending(expires_at=100.0)
+    assert p.expired(now=100.0) and not p.expired(now=99.0)
+    assert p.expires_in(now=40.0) == 60
+
+
+@posix
+def test_unwritable_dir_checks_the_nearest_existing_parent(tmp_path):
+    ro = tmp_path / "ro"
+    ro.mkdir()
+    os.chmod(ro, 0o500)
+    try:
+        if os.access(ro, os.W_OK):
+            pytest.skip("root ignores directory modes")
+        assert unwritable_dir(ro / "a" / "b") == ro / "a" / "b"
+        assert unwritable_dir(tmp_path / "new" / "dir") is None
+        f = ro / "config.yaml"
+        assert unwritable_dir(ro, f) == ro
+    finally:
+        os.chmod(ro, 0o700)
+    f.write_text("x")
+    os.chmod(ro, 0o500)
+    try:
+        assert unwritable_dir(ro, f) is None  # rewritten in place
+    finally:
+        os.chmod(ro, 0o700)
+
+
+def test_a_file_in_the_way_is_unwritable(tmp_path):
+    (tmp_path / "file").write_text("x")
+    assert unwritable_dir(tmp_path / "file" / "sub") == tmp_path / "file" / "sub"
+
+
+@posix
+def test_unreadable_file_of_someone_else_is_reported(state, monkeypatch):
+    path = save_pending(pending())
+    os.chmod(path, 0)
+    try:
+        if os.access(path, os.R_OK):
+            pytest.skip("root reads any file")
+        assert load_pending(agent=True).ignored_why is None  # our own file
+        other = os.geteuid() + 1
+        monkeypatch.setattr(login_state.os, "geteuid", lambda: other)
+        assert load_pending(agent=True).ignored_why == "owner"
+        assert load_pending(agent=False).ignored_why is None
+    finally:
+        os.chmod(path, 0o600)
+
+
+def test_interval_below_the_floor_is_raised_on_read(state):
+    save_pending(pending(interval=1))
+    assert load_pending(agent=True).pending.interval == login_state.MIN_POLL_INTERVAL
diff --git a/packages/deepctl-core/tests/unit/test_plugin_manager.py b/packages/deepctl-core/tests/unit/test_plugin_manager.py
index 180979b4..d18b3511 100644
--- a/packages/deepctl-core/tests/unit/test_plugin_manager.py
+++ b/packages/deepctl-core/tests/unit/test_plugin_manager.py
@@ -154,6 +154,28 @@ def test_function_name_conversion_for_hyphens(
         # Check that function name has underscores
         assert click_command.callback.__name__ == "test_hyphenated_command"
 
+    @pytest.mark.unit
+    def test_option_metavar_is_passed_through(self, plugin_manager):
+        """An argument dict's "metavar" names the value in --help."""
+
+        class Saves(BaseCommand):
+            name = "saves"
+            help = "Saves"
+
+            def get_arguments(self) -> List[Dict[str, Any]]:
+                return [
+                    {"names": ["--out-file"], "is_option": True, "metavar": "FILE"},
+                    {"names": ["--note"], "is_option": True},
+                ]
+
+            def handle(self, *args: Any, **kwargs: Any) -> Any:
+                return None
+
+        cmd = plugin_manager._create_click_command(Saves())
+        help_text = cmd.get_help(click.Context(cmd))
+        assert "--out-file FILE" in help_text
+        assert "--note TEXT" in help_text
+
     @pytest.mark.unit
     def test_group_function_name_conversion_for_hyphens(
         self, plugin_manager, mock_group_command_class
diff --git a/packages/deepctl-core/tests/unit/test_signals.py b/packages/deepctl-core/tests/unit/test_signals.py
new file mode 100644
index 00000000..51ef7a5d
--- /dev/null
+++ b/packages/deepctl-core/tests/unit/test_signals.py
@@ -0,0 +1,255 @@
+"""deepctl_core.signals: the SIGINT handler that waits out importlib's own
+lock bookkeeping, and the helpers behind it."""
+
+from __future__ import annotations
+
+import _imp
+import importlib
+import os
+import signal
+import sys
+import threading
+import time
+
+import pytest
+from deepctl_core import signals
+
+
+@pytest.fixture(autouse=True)
+def _restore_sigint():
+    before = signal.getsignal(signal.SIGINT)
+    for state in (signals._deferred_since, signals._in_handler):
+        state.clear()
+    yield
+    signal.signal(signal.SIGINT, before)
+    for state in (signals._deferred_since, signals._in_handler):
+        state.clear()
+
+
+def _importlib_frame():
+    """A real frame of importlib's own code: the caller of a finder."""
+    seen = []
+
+    class Finder:
+        def find_spec(self, name, path=None, target=None):
+            if name == "deepctl_signals_probe_xyz":
+                seen.append(sys._getframe(1))
+            return None
+
+    finder = Finder()
+    sys.meta_path.insert(0, finder)
+    try:
+        with pytest.raises(ModuleNotFoundError):
+            importlib.import_module("deepctl_signals_probe_xyz")
+    finally:
+        sys.meta_path.remove(finder)
+    return seen[0]
+
+
+def test_replaces_only_the_default_handler():
+    signal.signal(signal.SIGINT, signal.default_int_handler)
+    signals.install_interrupt_handler()
+    assert signal.getsignal(signal.SIGINT) is signals._on_interrupt
+
+    signal.signal(signal.SIGINT, signal.SIG_IGN)
+    signals.install_interrupt_handler()
+    assert signal.getsignal(signal.SIGINT) is signal.SIG_IGN
+
+
+def test_in_importlib_knows_importlibs_frames():
+    assert signals.in_importlib(_importlib_frame()) is True
+    assert signals.in_importlib(sys._getframe()) is False
+    assert signals.in_importlib(None) is False
+
+
+def test_a_signal_inside_this_modules_frames_is_judged_by_their_caller():
+    """A second signal that lands in a handler's frames here counts as
+    landing where the first one interrupted: importlib, in this case."""
+    ns: dict = {}
+    src = (
+        "import sys\n"
+        "def find_spec(name, path=None, target=None):\n"
+        "    if name == 'deepctl_signals_probe_own':\n"
+        "        seen.append(sys._getframe(0))\n"
+    )
+    ns["seen"] = seen = []
+    exec(compile(src, signals._own_file(), "exec"), ns)
+
+    class Finder:
+        find_spec = staticmethod(ns["find_spec"])
+
+    finder = Finder()
+    sys.meta_path.insert(0, finder)
+    try:
+        with pytest.raises(ModuleNotFoundError):
+            importlib.import_module("deepctl_signals_probe_own")
+    finally:
+        sys.meta_path.remove(finder)
+    own = seen[0]
+    assert own.f_code.co_filename == signals._own_file()
+    assert signals.in_importlib(own) is True
+    assert signals.in_importlib(sys._getframe()) is False
+
+
+def test_a_second_ctrl_c_while_the_handler_runs_is_coalesced(monkeypatch):
+    later: list[int] = []
+    monkeypatch.setattr(signals, "deliver_later", later.append)
+
+    def nested_then_raise(signum, frame):
+        signals._on_interrupt(signum, frame)  # nested: no raise, nothing sent
+        return False
+
+    monkeypatch.setattr(signals, "defer_in_importlib", nested_then_raise)
+    with pytest.raises(KeyboardInterrupt):
+        signals._on_interrupt(signal.SIGINT, sys._getframe())
+    assert later == []
+
+
+def test_the_resend_waits_for_the_handler_to_return(monkeypatch):
+    """Under load the re-send timer can fire before the handler that
+    started it returns; it waits, so the signal isn't taken as nested."""
+    sent: list[int] = []
+    monkeypatch.setattr(signals, "send_to_main", sent.append)
+    signals._in_handler.append(True)
+    t = threading.Thread(target=signals._resend, args=(signal.SIGINT,))
+    t.start()
+    time.sleep(0.1)
+    assert sent == []
+    signals._in_handler.clear()
+    t.join(2)
+    assert sent == [signal.SIGINT]
+
+
+def test_raises_outside_importlib():
+    with pytest.raises(KeyboardInterrupt):
+        signals._on_interrupt(signal.SIGINT, sys._getframe())
+
+
+def test_defers_inside_importlib(monkeypatch):
+    later: list[int] = []
+    monkeypatch.setattr(signals, "deliver_later", later.append)
+    signals._on_interrupt(signal.SIGINT, _importlib_frame())  # no raise
+    assert later == [signal.SIGINT]
+
+
+def test_deferral_is_capped(monkeypatch):
+    """After _MAX_DEFER_S of deferrals the handler raises anyway."""
+    later: list[int] = []
+    clock = [100.0]
+    monkeypatch.setattr(signals, "deliver_later", later.append)
+    monkeypatch.setattr(signals.time, "monotonic", lambda: clock[0])
+    frame = _importlib_frame()
+    signals._on_interrupt(signal.SIGINT, frame)
+    clock[0] += signals._MAX_DEFER_S / 2
+    signals._on_interrupt(signal.SIGINT, frame)
+    clock[0] += signals._MAX_DEFER_S
+    with pytest.raises(KeyboardInterrupt):
+        signals._on_interrupt(signal.SIGINT, frame)
+    assert len(later) == 2
+    # The next Ctrl-C starts a fresh window.
+    signals._on_interrupt(signal.SIGINT, frame)
+    assert len(later) == 3
+
+
+def test_past_the_cap_a_held_import_lock_still_defers(monkeypatch):
+    later: list[int] = []
+    clock = [100.0]
+    monkeypatch.setattr(signals, "deliver_later", later.append)
+    monkeypatch.setattr(signals.time, "monotonic", lambda: clock[0])
+    frame = _importlib_frame()
+    signals._on_interrupt(signal.SIGINT, frame)
+    clock[0] += signals._MAX_DEFER_S + 0.05  # past the cap, not stale
+    _imp.acquire_lock()
+    try:
+        signals._on_interrupt(signal.SIGINT, frame)  # lock held: no raise
+    finally:
+        _imp.release_lock()
+    assert len(later) == 2
+    with pytest.raises(KeyboardInterrupt):
+        signals._on_interrupt(signal.SIGINT, frame)  # lock free: raise
+
+
+def test_a_stale_deferral_starts_a_fresh_window(monkeypatch):
+    """A deferral whose re-send never came (the handler changed meanwhile)
+    must not make a later Ctrl-C in importlib skip the deferral."""
+    later: list[int] = []
+    clock = [100.0]
+    monkeypatch.setattr(signals, "deliver_later", later.append)
+    monkeypatch.setattr(signals.time, "monotonic", lambda: clock[0])
+    frame = _importlib_frame()
+    signals._on_interrupt(signal.SIGINT, frame)  # deferred; re-send "lost"
+    clock[0] += signals._STALE_DEFER_S + 1
+    signals._on_interrupt(signal.SIGINT, frame)  # deferred again, no raise
+    assert later == [signal.SIGINT, signal.SIGINT]
+
+
+def test_no_thread_for_the_resend_delivers_now(monkeypatch):
+    """At interpreter shutdown no thread can start: raise KeyboardInterrupt
+    rather than that RuntimeError."""
+
+    def no_thread(signum):
+        raise RuntimeError("can't create new thread at interpreter shutdown")
+
+    monkeypatch.setattr(signals, "deliver_later", no_thread)
+    with pytest.raises(KeyboardInterrupt):
+        signals._on_interrupt(signal.SIGINT, _importlib_frame())
+    assert signals._deferred_since == []
+
+
+def test_coalescing_releases_after_the_handler_raises():
+    calls: list[int] = []
+
+    @signals.coalescing
+    def handler(signum, frame):
+        calls.append(signum)
+        handler(signum, frame)  # nested: coalesced, inner body not run
+        raise KeyboardInterrupt
+
+    with pytest.raises(KeyboardInterrupt):
+        handler(signal.SIGINT, None)
+    assert calls == [signal.SIGINT]
+    assert signals._in_handler == []
+
+
+@pytest.mark.skipif(not hasattr(signal, "pthread_kill"), reason="POSIX only")
+def test_deliver_later_reaches_the_main_thread():
+    got: list[int] = []
+    before = signal.signal(signal.SIGUSR1, lambda s, f: got.append(s))
+    try:
+        signals.deliver_later(signal.SIGUSR1, 0)
+        deadline = time.monotonic() + 2
+        while not got and time.monotonic() < deadline:
+            time.sleep(0.005)
+    finally:
+        signal.signal(signal.SIGUSR1, before)
+    assert got == [signal.SIGUSR1]
+
+
+@pytest.mark.skipif(not hasattr(signal, "pthread_kill"), reason="POSIX only")
+def test_another_thread_holding_the_import_lock_doesnt_hold_up_ctrl_c():
+    """Only the main thread's own importlib frames defer."""
+    signal.signal(signal.SIGINT, signal.default_int_handler)
+    signals.install_interrupt_handler()
+    held, release = threading.Event(), threading.Event()
+
+    def holder():
+        _imp.acquire_lock()
+        try:
+            held.set()
+            release.wait(10)
+        finally:
+            _imp.release_lock()
+
+    t = threading.Thread(target=holder, daemon=True)
+    t.start()
+    held.wait(5)
+    try:
+        t0 = time.monotonic()
+        with pytest.raises(KeyboardInterrupt):
+            os.kill(os.getpid(), signal.SIGINT)
+            while time.monotonic() - t0 < 2:
+                time.sleep(0.001)
+        assert time.monotonic() - t0 < 1.5
+    finally:
+        release.set()
+        t.join(5)
diff --git a/packages/deepctl-core/tests/unit/test_transport.py b/packages/deepctl-core/tests/unit/test_transport.py
new file mode 100644
index 00000000..3b980e6c
--- /dev/null
+++ b/packages/deepctl-core/tests/unit/test_transport.py
@@ -0,0 +1,760 @@
+"""The shared HTTP client and the catalogue's transport_mapping.
+
+Every row of the mapping goes through the real SDK facade
+(``DeepgramClient``) on an ``httpx.MockTransport``, so the test sees what a
+command sees. A loopback fake server checks the request and connection count.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import socket
+import ssl
+import subprocess
+import sys
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+from typing import Any, ClassVar
+
+import click
+import httpx
+import pytest
+import yaml
+from click.testing import CliRunner
+from deepctl_core import hosts, output, transport
+from deepctl_core.auth import AuthManager
+from deepctl_core.base_command import BaseCommand
+from deepctl_core.client import DeepgramClient
+from deepctl_core.config import Config
+from deepctl_core.models import BaseResult
+from deepctl_core.transport import TransportError
+from deepctl_core.websocket import RedirectRefused
+
+KEY = "sk-W22SENTINELKEY"
+_REAL_PROG = transport.prog
+
+
+@pytest.fixture(autouse=True)
+def _isolated(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr(
+        "deepctl_core.config._default_config_file",
+        lambda: tmp_path / "user" / "config.yaml",
+    )
+    monkeypatch.setattr(
+        "deepctl_core.config._trust_root_location",
+        lambda: (tmp_path, tmp_path / "user" / "config.yaml"),
+    )
+    monkeypatch.setattr(hosts, "_reported", set())
+    monkeypatch.setattr(transport, "_client", None)
+    monkeypatch.setattr(output, "is_agentic", lambda: False)
+    monkeypatch.setattr(output, "is_ai_agent", lambda: False)
+    monkeypatch.setitem(output._output_config, "agentic", False)
+    monkeypatch.setitem(output._output_config, "verbose", False)
+    monkeypatch.setitem(output._output_config, "quiet", False)
+    monkeypatch.setitem(output._output_config, "format", "default")
+    monkeypatch.setattr(output.stderr_console, "_width", 400)
+    monkeypatch.setattr(transport, "prog", lambda: "dg")
+    from deepctl_core import auth as auth_module
+
+    monkeypatch.setattr(auth_module.keyring, "get_password", lambda *a: None)
+    # The SDK retries 429/5xx and connect errors with a back-off sleep.
+    import deepgram.core.http_client as sdk_http
+
+    monkeypatch.setattr(sdk_http.time, "sleep", lambda s: None)
+    monkeypatch.setenv("DEEPGRAM_API_KEY", KEY)
+
+
+def facade(handler) -> tuple[DeepgramClient, list[httpx.Request]]:
+    seen: list[httpx.Request] = []
+
+    def record(request: httpx.Request) -> httpx.Response:
+        seen.append(request)
+        return handler(request)
+
+    # Same redirect setting as transport.shared_client().
+    transport._set_client(
+        httpx.Client(transport=httpx.MockTransport(record), follow_redirects=False)
+    )
+    config = Config(config_path=str(Path.cwd() / "none.yaml"))
+    auth = AuthManager(config)
+    return DeepgramClient(config, auth), seen
+
+
+def raising(exc_factory):
+    def handler(request: httpx.Request) -> httpx.Response:
+        raise exc_factory(request)
+
+    return handler
+
+
+def status(code: int, body: Any = None, headers: dict | None = None):
+    def handler(request: httpx.Request) -> httpx.Response:
+        if isinstance(body, (bytes, str)):
+            return httpx.Response(code, content=body, headers=headers)
+        return httpx.Response(code, json=body or {"err_msg": "x"}, headers=headers)
+
+    return handler
+
+
+def mapped(handler, call=lambda c: c.list_models()) -> TransportError:
+    client, _ = facade(handler)
+    with pytest.raises(TransportError) as err:
+        call(client)
+    return err.value
+
+
+def _chained(outer, inner):
+    def make(request):
+        try:
+            raise inner
+        except BaseException as cause:
+            raise outer(str(cause), request=request) from cause
+
+    return make
+
+
+# ── transport_mapping, row by row ─────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    ("code", "expected", "message"),
+    [
+        (401, "auth_invalid", "Deepgram rejected the API key (HTTP 401)."),
+        (
+            403,
+            "auth_forbidden",
+            "This API key isn't allowed to make this request (HTTP 403).",
+        ),
+        (404, "not_found", "Deepgram returned 404 Not Found for /v1/models."),
+        (429, "rate_limited", "Deepgram is rate limiting requests (HTTP 429)."),
+        (400, "invalid_argument", "Deepgram rejected the request (HTTP 400): x"),
+        (422, "invalid_argument", "Deepgram rejected the request (HTTP 422): x"),
+        (418, "invalid_argument", "Deepgram rejected the request (HTTP 418): x"),
+        (500, "server_error", "Deepgram returned an error (HTTP 500)."),
+        (503, "server_error", "Deepgram returned an error (HTTP 503)."),
+    ],
+)
+def test_http_status_rows(code, expected, message):
+    err = mapped(status(code))
+    assert err.code == expected
+    assert err.error == message
+    assert err.details["http_status"] == code
+
+
+def test_429_retry_after_and_500_request_id():
+    err = mapped(status(429, headers={"Retry-After": "7"}))
+    assert err.details == {"http_status": 429, "retry_after": 7}
+    err = mapped(status(503, headers={"dg-request-id": "req-123"}))
+    assert err.details == {"http_status": 503, "request_id": "req-123"}
+
+
+def test_sdk_retries_before_mapping_5xx():
+    """The SDK's own retries still run; the code comes from the last answer."""
+    client, seen = facade(status(500))
+    with pytest.raises(TransportError):
+        client.list_models()
+    assert len(seen) == 3
+
+
+def test_invalid_request_message_is_sanitized():
+    body = {
+        "err_msg": f"bad \x1b[31mvalue {KEY} https://u:p@h.example/x?token=1 "
+        + "y" * 300
+    }
+    err = mapped(status(400, body))
+    assert KEY not in err.error and "\x1b" not in err.error
+    assert "u:p@" not in err.error and "token=1" not in err.error
+    api_message = err.values["api_message"]
+    assert len(api_message) <= 200
+
+
+def test_invalid_request_without_body_uses_reason_phrase():
+    err = mapped(status(400, b""))
+    assert err.error == "Deepgram rejected the request (HTTP 400): Bad Request"
+
+
+@pytest.mark.parametrize(
+    ("factory", "reason"),
+    [
+        (
+            _chained(
+                httpx.ConnectError, socket.gaierror(-2, "Name or service not known")
+            ),
+            "name resolution failed",
+        ),
+        (
+            _chained(
+                httpx.ConnectError, ConnectionRefusedError(111, "Connection refused")
+            ),
+            "connection refused",
+        ),
+        (
+            _chained(
+                httpx.ConnectError,
+                ssl.SSLError(1, "[SSL: WRONG_VERSION_NUMBER] wrong version number"),
+            ),
+            "TLS handshake failed",
+        ),
+        (
+            _chained(
+                httpx.ReadError, ConnectionResetError(104, "Connection reset by peer")
+            ),
+            "connection reset",
+        ),
+        (
+            lambda r: httpx.RemoteProtocolError(
+                "peer closed connection without sending complete message body: incomplete chunked read",
+                request=r,
+            ),
+            "response cut off",
+        ),
+        (
+            lambda r: httpx.RemoteProtocolError(
+                "Server disconnected without sending a response.", request=r
+            ),
+            "connection closed",
+        ),
+    ],
+)
+def test_network_rows(factory, reason):
+    err = mapped(raising(factory))
+    assert err.code == "network_unavailable"
+    assert err.details == {"host": "api.deepgram.com", "reason": reason}
+    if reason == "response cut off":
+        assert err.messages == transport.NETWORK_CUT
+        assert err.error == (
+            "The connection to api.deepgram.com dropped before the response finished."
+        )
+    else:
+        assert err.messages == transport.CODES["network_unavailable"]
+        assert err.error == f"Couldn't reach api.deepgram.com: {reason}."
+
+
+def test_unreadable_2xx_hint_names_host_and_prog(monkeypatch):
+    err = mapped(status(200, b"<html>sign in</html>"))
+    payload = _render(err, monkeypatch, agentic=False, hard=False)
+    assert payload["hint"] == transport.STRINGS["H-NETWORK-UNREADABLE"].format(
+        prog="dg", host="api.deepgram.com"
+    )
+
+
+def test_proxy_refusal_row():
+    err = mapped(raising(lambda r: httpx.ProxyError("407 Proxy Auth", request=r)))
+    assert err.code == "network_unavailable"
+    assert err.details["reason"] == "the proxy refused the connection"
+
+
+@pytest.mark.parametrize(
+    "exc",
+    [httpx.ReadTimeout, httpx.ConnectTimeout, httpx.WriteTimeout, httpx.PoolTimeout],
+)
+def test_timeout_row(exc):
+    err = mapped(raising(lambda r: exc("timed out", request=r)))
+    assert err.code == "timeout"
+    assert err.details == {"host": "api.deepgram.com", "timeout_s": 60}
+    assert err.error == "api.deepgram.com didn't respond within 60 s."
+
+
+@pytest.mark.parametrize(
+    "body", [b'{"models": [{"name": "nov', b"<html>captive portal</html>"]
+)
+def test_unreadable_2xx_body_row(body):
+    """A 2xx whose body can't be read is a network failure, not success."""
+    err = mapped(status(200, body))
+    assert err.code == "network_unavailable"
+    assert err.details == {"host": "api.deepgram.com", "reason": "unreadable response"}
+    assert err.messages == transport.NETWORK_UNREADABLE
+    assert err.error == "Got a response from api.deepgram.com that dg couldn't read."
+
+
+def test_speak_rest_maps_while_reading():
+    """The speak request happens while the command iterates the audio."""
+    client, _ = facade(status(401))
+    chunks = client.speak_text("hi")
+    with pytest.raises(TransportError) as err:
+        list(chunks)
+    assert err.value.code == "auth_invalid"
+
+
+def test_prerecorded_listen_maps(tmp_path):
+    audio = tmp_path / "a.wav"
+    audio.write_bytes(b"RIFF" + b"\0" * 64)
+    err = mapped(status(401), call=lambda c: c.transcribe_file(audio))
+    assert err.code == "auth_invalid"
+
+
+def test_non_transport_errors_keep_legacy_text():
+    """A failure that isn't a request failure keeps its 0.4.0 wording."""
+    from deepgram.core.api_error import ApiError
+
+    client, seen = facade(status(200, {"projects": []}))
+    with pytest.raises(FileNotFoundError, match="Audio file not found"):
+        client.transcribe_file("/does/not/exist.wav")
+    client._resolve_project_id = lambda project_id=None: "p1"
+
+    def broken(*args, **kwargs):
+        raise LookupError("sdk bug")
+
+    client.client.manage.v1.models.list = broken
+    with pytest.raises(ApiError) as err:
+        client.list_models()
+    assert err.value.body == "Failed to list models: sdk bug"
+    assert seen == []
+
+
+def test_every_code_is_catalogued():
+    for code, ids in [
+        *transport.CODES.items(),
+        ("cut", transport.NETWORK_CUT),
+        ("unreadable", transport.NETWORK_UNREADABLE),
+    ]:
+        for message_id in ids:
+            if message_id:
+                assert message_id in transport.STRINGS, (code, message_id)
+
+
+@pytest.mark.skipif(
+    not os.environ.get("DG_ERROR_CODES_JSON"),
+    reason="DG_ERROR_CODES_JSON names no error catalogue file",
+)
+def test_strings_match_catalogue():
+    catalogue = json.loads(Path(os.environ["DG_ERROR_CODES_JSON"]).read_text())
+    assert [row[1] for row in catalogue["transport_mapping"]] == [
+        "network_unavailable",
+        "timeout",
+        "auth_invalid",
+        "auth_forbidden",
+        "not_found",
+        "rate_limited",
+        "invalid_argument",
+        "server_error",
+    ]
+    for message_id, text in transport.STRINGS.items():
+        assert catalogue["strings"][message_id] == text, message_id
+    for code, (error_id, human, agent, automation) in transport.CODES.items():
+        entry = catalogue["codes"][code]
+        assert entry["exit"] == 1
+        message = next(m for m in entry["messages"] if m["id"] == error_id)
+        assert message["hint_human"] == human
+        assert message["hint_agent"] == agent
+        assert message.get("hint_automation") == automation
+    entry = catalogue["codes"]["network_unavailable"]
+    for extra, reason in (
+        (transport.NETWORK_CUT, "response cut off"),
+        (transport.NETWORK_UNREADABLE, "unreadable response"),
+    ):
+        message = next(m for m in entry["messages"] if m["id"] == extra[0])
+        assert (message["hint_human"], message["hint_agent"]) == extra[1:3]
+        assert "hint_automation" not in message
+        assert entry["details_values"][extra[0]] == {"reason": [reason]}
+    env = catalogue["codes"]["auth_invalid"]["env_key_variant"]
+    assert env == {
+        "hint_agent": "A-AUTH-INVALID-ENV",
+        "hint_agent_if_next_step_null": "A-AUTH-INVALID-ENV-NULL",
+    }
+
+
+# ── Rendering: hint variant, next_step, key order ────────────────────
+
+
+def _render(err, monkeypatch, *, agentic, hard, command_path="models", key_env=True):
+    monkeypatch.setitem(output._output_config, "agentic", agentic)
+    monkeypatch.setattr(output, "is_ai_agent", lambda: hard)
+    if not key_env:
+        monkeypatch.delenv("DEEPGRAM_API_KEY")
+    config = Config(config_path=str(Path.cwd() / "none.yaml"))
+    auth = AuthManager(config, explicit_api_key=None if key_env else KEY)
+    return transport.render(
+        err, command_path=command_path, auth_manager=auth
+    ).model_dump()
+
+
+def _401():
+    return TransportError("auth_invalid", {}, {"http_status": 401})
+
+
+def test_auth_invalid_hard_agent_env_key(monkeypatch):
+    payload = _render(_401(), monkeypatch, agentic=True, hard=True)
+    assert list(payload) == [
+        "error",
+        "status",
+        "code",
+        "hint",
+        "next_step",
+        "schema_version",
+        "details",
+    ]
+    assert payload == {
+        "error": "Deepgram rejected the API key (HTTP 401).",
+        "status": "error",
+        "code": "auth_invalid",
+        "hint": transport.STRINGS["A-AUTH-INVALID-ENV"],
+        "next_step": "dg login --yes",
+        "schema_version": 1,
+        "details": {"http_status": 401, "key_source": "DEEPGRAM_API_KEY (env)"},
+    }
+
+
+def test_auth_invalid_hard_agent_env_key_without_prog(monkeypatch):
+    monkeypatch.setattr(transport, "prog", lambda: None)
+    payload = _render(_401(), monkeypatch, agentic=True, hard=True)
+    assert payload["next_step"] is None
+    assert payload["hint"] == transport.STRINGS["A-AUTH-INVALID-ENV-NULL"].format(
+        prog="dg"
+    )
+
+
+def test_auth_invalid_soft_only_ci(monkeypatch):
+    payload = _render(_401(), monkeypatch, agentic=True, hard=False)
+    assert payload["next_step"] is None
+    assert payload["hint"] == transport.STRINGS["C-AUTH-INVALID"]
+
+
+def test_auth_invalid_hard_agent_flag_key(monkeypatch):
+    payload = _render(_401(), monkeypatch, agentic=True, hard=True, key_env=False)
+    assert payload["next_step"] == "dg login"
+    assert payload["hint"] == transport.STRINGS["A-AUTH-INVALID"].format(prog="dg")
+    assert payload["details"]["key_source"] == "--api-key"
+
+
+def test_auth_invalid_human(monkeypatch):
+    payload = _render(_401(), monkeypatch, agentic=False, hard=False)
+    assert payload["next_step"] == "dg login"
+    assert payload["hint"] == transport.STRINGS["H-AUTH-INVALID"].format(prog="dg")
+
+
+def test_key_source_follows_whoami_order(monkeypatch):
+    """A keyring key equal to the env value is the keyring's, as whoami says."""
+    from deepctl_core import auth as auth_module
+
+    monkeypatch.setattr(auth_module.keyring, "get_password", lambda *a: KEY)
+    payload = _render(_401(), monkeypatch, agentic=True, hard=True)
+    assert payload["details"]["key_source"] == "system keyring"
+    assert payload["next_step"] == "dg login"
+
+
+def test_invalid_argument_next_step_is_command_help(monkeypatch):
+    err = TransportError(
+        "invalid_argument",
+        {"http_status": 400, "api_message": "x"},
+        {"http_status": 400},
+    )
+    payload = _render(err, monkeypatch, agentic=True, hard=True, command_path="keys")
+    assert payload["next_step"] == "dg keys --help"
+    assert payload["hint"] == transport.STRINGS["A-INVALID-REQUEST"].format(
+        prog="dg", command_path="keys"
+    )
+
+
+@pytest.mark.parametrize(
+    "code",
+    [
+        "auth_forbidden",
+        "not_found",
+        "rate_limited",
+        "server_error",
+        "timeout",
+        "network_unavailable",
+    ],
+)
+def test_other_codes_have_null_next_step(code, monkeypatch):
+    values = {
+        "host": "h",
+        "reason": "r",
+        "timeout_s": 60,
+        "path": "/p",
+        "http_status": 500,
+    }
+    err = TransportError(code, values, {"http_status": 1})
+    payload = _render(err, monkeypatch, agentic=True, hard=True)
+    assert payload["next_step"] is None and payload["schema_version"] == 1
+
+
+def test_details_omitted_when_empty():
+    cls = transport.result_class()
+    payload = cls(error="e", code="c", hint="h").model_dump()
+    assert list(payload) == [
+        "error",
+        "status",
+        "code",
+        "hint",
+        "next_step",
+        "schema_version",
+    ]
+
+
+def test_prog_bare_name_only_when_which_matches(monkeypatch, tmp_path):
+    script = tmp_path / "bin" / "dg"
+    script.parent.mkdir()
+    script.write_text("#!/bin/sh\n")
+    script.chmod(0o755)
+    monkeypatch.setattr(sys, "argv", [str(script)])
+    monkeypatch.setenv("PATH", str(script.parent))
+    assert _REAL_PROG() == "dg"
+    monkeypatch.setenv("PATH", "/nonexistent")
+    assert _REAL_PROG() == str(script)
+    monkeypatch.setattr(sys, "argv", ["/x/__main__.py"])
+    assert _REAL_PROG() is None
+
+
+# ── Through BaseCommand: stdout payload, two stderr lines, exit 1 ─────
+
+
+class _Models(BaseCommand):
+    name = "models"
+    help = "List models"
+    requires_auth = True
+
+    def handle(self, config, auth_manager, client, **kwargs):
+        from deepctl_core.output import get_status_console
+
+        get_status_console().print("[blue]Fetching models...[/blue]")
+        try:
+            client.list_models()
+        except Exception as e:  # what every command does today
+            get_status_console().print(f"[red]Error:[/red] {e}")
+            return BaseResult(status="error", message=str(e))
+        return BaseResult(status="success")
+
+
+def _run(
+    monkeypatch,
+    handler,
+    *,
+    agentic,
+    hard,
+    fmt="json",
+    config_path="none.yaml",
+    name="models",
+):
+    facade(handler)
+    monkeypatch.setitem(output._output_config, "agentic", agentic)
+    monkeypatch.setitem(output._output_config, "format", fmt)
+    monkeypatch.setattr(output, "is_ai_agent", lambda: hard)
+    cmd = type("_Cmd", (_Models,), {"name": name})()
+
+    @click.command(name)
+    @click.pass_context
+    def models(ctx):
+        cmd.execute(ctx)
+
+    @click.group("dg")
+    @click.pass_context
+    def root(ctx):
+        ctx.obj = {"config": Config(config_path=str(Path.cwd() / config_path))}
+
+    root.add_command(models)
+    return CliRunner().invoke(root, [name])
+
+
+def _split(result):
+    return result.stdout, result.stderr
+
+
+def test_mode_a_two_stderr_lines_and_coded_stdout(monkeypatch):
+    monkeypatch.delenv("DEEPGRAM_API_KEY")
+    Path("user").mkdir()
+    Path("user/config.yaml").write_text(
+        yaml.safe_dump({"profiles": {"default": {"api_key": KEY}}})
+    )
+    Path("user/config.yaml").chmod(0o600)
+    result = _run(
+        monkeypatch,
+        status(401),
+        agentic=True,
+        hard=True,
+        config_path="user/config.yaml",
+    )
+    stdout, stderr = _split(result)
+    assert result.exit_code == 1
+    payload = json.loads(stdout)
+    assert payload["code"] == "auth_invalid"
+    assert payload["next_step"] == "dg login"
+    assert payload["details"] == {"http_status": 401, "key_source": "config file"}
+    assert stderr.splitlines() == [
+        "ERROR: Deepgram rejected the API key (HTTP 401).",
+        "HINT: " + transport.STRINGS["A-AUTH-INVALID"].format(prog="dg"),
+    ]
+    assert KEY not in stdout + stderr
+
+
+def test_human_mode_renders_cross_and_hint(monkeypatch):
+    result = _run(monkeypatch, status(403), agentic=False, hard=False, fmt="default")
+    stdout, stderr = _split(result)
+    assert result.exit_code == 1
+    assert stdout == ""
+    lines = [line for line in stderr.splitlines() if line.strip()]
+    assert lines[-2:] == [
+        "✗ This API key isn't allowed to make this request (HTTP 403).",
+        "  " + transport.STRINGS["H-AUTH-FORBIDDEN"].format(prog="dg"),
+    ]
+
+
+def test_success_in_mode_a_drops_chrome_only(monkeypatch):
+    result = _run(monkeypatch, status(200, {"models": []}), agentic=True, hard=False)
+    stdout, stderr = _split(result)
+    assert result.exit_code == 0
+    assert "Fetching models" not in stderr
+    assert json.loads(stdout)["status"] == "success"
+
+
+def test_other_commands_keep_chrome_in_mode_a(monkeypatch):
+    """Only commands that go through the Transport drop chrome: login's
+    device code, dg api's errors and the like stay on stderr."""
+    result = _run(
+        monkeypatch, status(200, {"models": []}), agentic=True, hard=True, name="login"
+    )
+    assert "Fetching models" in result.stderr
+
+
+def test_verbose_keeps_chrome(monkeypatch):
+    monkeypatch.setitem(output._output_config, "verbose", True)
+    result = _run(monkeypatch, status(200, {"models": []}), agentic=True, hard=False)
+    assert "Fetching models" in result.stderr
+
+
+def test_failure_after_stdout_payload_keeps_json_off_stdout(monkeypatch):
+    """Once a command has written payload bytes to stdout (speak audio), a
+    failure goes to stderr only."""
+
+    class _Audio(_Models):
+        def handle(self, config, auth_manager, client, **kwargs):
+            import sys
+
+            self.stdout_is_protocol = True
+            sys.stdout.write("AUDIOBYTES")
+            client.list_models()
+
+    monkeypatch.setattr(sys.modules[__name__], "_Models", _Audio)
+    result = _run(monkeypatch, status(200, b"cut"), agentic=True, hard=True)
+    assert result.exit_code == 1
+    assert result.stdout == "AUDIOBYTES"
+    assert result.stderr.splitlines()[-2].startswith("ERROR: Got a response from")
+
+
+def test_unmapped_failure_keeps_legacy_handling(monkeypatch):
+    """Errors that aren't request failures still go through the command's
+    own handler, prefixed lines intact."""
+
+    def boom(request):
+        raise ValueError("not a transport problem")
+
+    result = _run(monkeypatch, boom, agentic=True, hard=False)
+    assert result.exit_code == 1
+    assert "Error:" in result.stderr
+    assert json.loads(result.stdout)["status"] == "error"
+
+
+# ── One connection, no pre-flight: a real loopback server ─────────────
+
+
+class _Fake(BaseHTTPRequestHandler):
+    protocol_version = "HTTP/1.1"
+    log: ClassVar[list[tuple[str, str, int]]] = []
+
+    def do_GET(self):
+        _Fake.log.append(
+            (self.command, self.path.split("?")[0], self.client_address[1])
+        )
+        body = json.dumps({"api_keys": [], "projects": [], "models": []}).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, *args):
+        pass
+
+
+@pytest.fixture
+def fake_server():
+    _Fake.log = []
+    server = ThreadingHTTPServer(("127.0.0.1", 0), _Fake)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    yield f"http://127.0.0.1:{server.server_address[1]}"
+    server.shutdown()
+    server.server_close()
+
+
+def test_one_request_one_connection_no_preflight(fake_server, monkeypatch):
+    monkeypatch.setenv("DEEPGRAM_BASE_URL", fake_server)
+    monkeypatch.setenv("DEEPGRAM_PROJECT_ID", "p1")
+    config = Config(config_path=str(Path.cwd() / "none.yaml"))
+    auth = AuthManager(config)
+    auth.guard()
+    client = DeepgramClient(config, auth)
+    client.list_keys()
+    client.list_models()
+    paths = [p for _, p, _ in _Fake.log]
+    assert paths == ["/v1/projects/p1/keys", "/v1/models"]
+    assert "/v1/projects" not in paths
+    assert len({port for *_, port in _Fake.log}) == 1
+
+
+def test_shared_client_keeps_no_cookies():
+    seen: list[httpx.Request] = []
+
+    def handler(request):
+        seen.append(request)
+        return httpx.Response(
+            200, json={"models": []}, headers={"Set-Cookie": "sid=abc; Path=/"}
+        )
+
+    client, _ = facade(handler)
+    client.list_models()
+    client.list_models()
+    assert "cookie" not in seen[1].headers
+    assert not list(transport._client.cookies.jar)
+
+
+def test_shared_client_settings():
+    client = transport.shared_client()
+    assert client.follow_redirects is False
+    assert client.timeout.read == transport.DEFAULT_TIMEOUT_S
+    assert "Authorization" not in client.headers
+    assert str(client.base_url) == ""
+
+
+def test_redirect_to_another_origin_is_not_followed():
+    """The shared client follows no redirect, so neither the key nor a
+    request body can reach another origin."""
+    seen: list[httpx.Request] = []
+
+    def handler(request):
+        seen.append(request)
+        if request.url.host == "api.deepgram.com":
+            return httpx.Response(
+                302, headers={"Location": "https://evil.example/v1/models"}
+            )
+        return httpx.Response(200, json={"models": []})
+
+    client, _ = facade(handler)
+    with pytest.raises(RedirectRefused):
+        client.list_models()
+    assert [r.url.host for r in seen] == ["api.deepgram.com"]
+    assert seen[0].headers["Authorization"] == f"Token {KEY}"
+
+
+def test_shared_client_is_lazy_and_single():
+    code = (
+        "import sys, deepctl_core.transport as t\n"
+        "print('httpx' in sys.modules, 'ssl' in sys.modules)\n"
+        "assert t.shared_client() is t.shared_client()\n"
+    )
+    out = subprocess.run(
+        [sys.executable, "-c", code], capture_output=True, text=True, check=True
+    )
+    assert out.stdout.strip() == "False False"
+
+
+@pytest.mark.parametrize("ignore_quiet", [False, True])
+def test_print_warning_ignore_quiet(ignore_quiet, monkeypatch, capsys):
+    monkeypatch.setitem(output._output_config, "quiet", True)
+    monkeypatch.setitem(output._output_config, "agentic", True)
+    output.print_warning("needed", stderr=True, ignore_quiet=ignore_quiet)
+    assert ("WARN: needed" in capsys.readouterr().err) is ignore_quiet
diff --git a/packages/deepctl-core/tests/unit/test_upload.py b/packages/deepctl-core/tests/unit/test_upload.py
new file mode 100644
index 00000000..9c401701
--- /dev/null
+++ b/packages/deepctl-core/tests/unit/test_upload.py
@@ -0,0 +1,408 @@
+"""Prerecorded uploads streamed from disk.
+
+``FileBody`` on its own, then through the real SDK facade on an
+``httpx.MockTransport``: the request carries ``Content-Length`` and no
+chunked encoding, the SDK's retries resend the whole file, and a file that
+changes or can't be read mid-upload maps to the ``E-UPLOAD-*`` messages.
+"""
+
+from __future__ import annotations
+
+import errno
+import json
+import os
+import sys
+import threading
+from pathlib import Path
+
+import httpx
+import pytest
+from deepctl_core import hosts, output, transport, upload
+from deepctl_core.auth import AuthManager
+from deepctl_core.client import DeepgramClient
+from deepctl_core.config import Config
+from deepctl_core.upload import FileBody, UploadFileError
+
+KEY = "sk-URLSENTINELKEY"
+MIB = 1 << 20
+
+
+@pytest.fixture(autouse=True)
+def _isolated(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr(
+        "deepctl_core.config._default_config_file",
+        lambda: tmp_path / "user" / "config.yaml",
+    )
+    monkeypatch.setattr(
+        "deepctl_core.config._trust_root_location",
+        lambda: (tmp_path, tmp_path / "user" / "config.yaml"),
+    )
+    monkeypatch.setattr(hosts, "_reported", set())
+    monkeypatch.setattr(transport, "_client", None)
+    monkeypatch.setattr(transport, "prog", lambda: "dg")
+    monkeypatch.setitem(output._output_config, "agentic", False)
+    monkeypatch.setattr(output.stderr_console, "_width", 400)
+    from deepctl_core import auth as auth_module
+
+    monkeypatch.setattr(auth_module.keyring, "get_password", lambda *a: None)
+    import deepgram.core.http_client as sdk_http
+
+    monkeypatch.setattr(sdk_http.time, "sleep", lambda s: None)
+    monkeypatch.setenv("DEEPGRAM_API_KEY", KEY)
+
+
+def _audio(tmp_path: Path, size: int, name: str = "a.wav") -> Path:
+    path = tmp_path / name
+    path.write_bytes(bytes(i % 251 for i in range(size)))
+    return path
+
+
+def facade(handler) -> tuple[DeepgramClient, list[tuple[httpx.Request, bytes]]]:
+    seen: list[tuple[httpx.Request, bytes]] = []
+
+    def record(request: httpx.Request) -> httpx.Response:
+        seen.append((request, request.read()))
+        return handler(request)
+
+    # The same timeout and redirect settings as transport.shared_client().
+    transport._set_client(
+        httpx.Client(
+            transport=httpx.MockTransport(record),
+            timeout=transport.DEFAULT_TIMEOUT_S,
+            follow_redirects=True,
+        )
+    )
+    config = Config(config_path=str(Path.cwd() / "none.yaml"))
+    return DeepgramClient(config, AuthManager(config)), seen
+
+
+def ok(request: httpx.Request) -> httpx.Response:
+    return httpx.Response(200, json={"metadata": {}, "results": {}})
+
+
+# ── FileBody ─────────────────────────────────────────────────────────
+
+
+def test_reads_in_1_mib_chunks_and_reiterates(tmp_path):
+    path = _audio(tmp_path, 2 * MIB + 5)
+    with FileBody(path) as body:
+        assert len(body) == 2 * MIB + 5
+        first = list(body)
+        assert [len(c) for c in first] == [MIB, MIB, 5]
+        assert b"".join(body) == path.read_bytes()
+
+
+def test_a_retry_sends_the_file_opened_not_the_one_at_the_path(tmp_path):
+    path = _audio(tmp_path, 3000)
+    original = path.read_bytes()
+    with FileBody(path) as body:
+        assert b"".join(body) == original
+        swap = tmp_path / "swap.wav"
+        swap.write_bytes(b"x" * 3000)
+        os.replace(swap, path)  # a new file at the same path
+        assert b"".join(body) == original
+
+
+def test_file_changed_mid_read(tmp_path):
+    path = _audio(tmp_path, 2 * MIB)
+    with FileBody(path) as body:
+        chunks = iter(body)
+        next(chunks)
+        os.truncate(path, MIB // 2)
+        with pytest.raises(UploadFileError) as err:
+            next(chunks)
+    assert err.value.messages == upload.FILE_CHANGED
+    assert err.value.values == {"path": str(path)}
+
+
+def test_file_grown_after_the_last_chunk(tmp_path):
+    path = _audio(tmp_path, 10)
+    with FileBody(path) as body:
+        chunks = iter(body)
+        next(chunks)
+        with path.open("ab") as f:
+            f.write(b"more")
+        with pytest.raises(UploadFileError) as err:
+            next(chunks)
+    assert err.value.messages == upload.FILE_CHANGED
+
+
+def test_read_error_is_unreadable(tmp_path, monkeypatch):
+    path = _audio(tmp_path, 10)
+
+    def eio(*args):
+        raise OSError(errno.EIO, os.strerror(errno.EIO))
+
+    with FileBody(path) as body:
+        monkeypatch.setattr(os, "pread", eio, raising=False)
+        with pytest.raises(UploadFileError) as err:
+            list(body)
+    assert err.value.messages == upload.FILE_UNREADABLE
+    assert err.value.values["os_error"] == os.strerror(errno.EIO)
+
+
+def test_missing_file_is_unreadable(tmp_path):
+    with pytest.raises(UploadFileError) as err:
+        FileBody(tmp_path / "gone.wav")
+    assert err.value.messages == upload.FILE_UNREADABLE
+    assert err.value.values["os_error"] == os.strerror(errno.ENOENT)
+
+
+@pytest.mark.skipif(not hasattr(os, "mkfifo"), reason="needs a FIFO")
+def test_a_pipe_is_read_once_and_kept(tmp_path):
+    fifo = tmp_path / "audio.fifo"
+    os.mkfifo(fifo)
+    writer = threading.Thread(target=lambda: fifo.write_bytes(b"piped audio"))
+    writer.start()
+    with FileBody(fifo) as body:
+        writer.join()
+        assert len(body) == 11
+        assert b"".join(body) == b"piped audio"
+        assert b"".join(body) == b"piped audio"
+
+
+def _file_id(path: Path) -> tuple[int, int]:
+    st = os.stat(path)
+    return (st.st_dev, st.st_ino)
+
+
+def test_same_file_as_validated_is_uploaded(tmp_path):
+    path = _audio(tmp_path, 10)
+    with FileBody(path, file_id=_file_id(path)) as body:
+        assert b"".join(body) == path.read_bytes()
+
+
+def test_path_swapped_after_validation_is_changed(tmp_path):
+    validated = _audio(tmp_path, 10, "validated.wav")
+    other = _audio(tmp_path, 10, "other.wav")
+    link = tmp_path / "x.wav"
+    try:
+        link.symlink_to(validated)
+    except OSError:
+        pytest.skip("symlinks not available")
+    file_id = _file_id(link)
+    link.unlink()
+    link.symlink_to(other)  # swapped between validation and upload
+    with pytest.raises(UploadFileError) as err:
+        FileBody(link, file_id=file_id)
+    assert err.value.messages == upload.FILE_CHANGED
+
+
+def test_close_releases_the_descriptor(tmp_path):
+    body = FileBody(_audio(tmp_path, 10))
+    fd = body._fd
+    body.close()
+    body.close()
+    with pytest.raises(OSError):
+        os.fstat(fd)
+
+
+def test_path_in_the_message_is_cleaned(tmp_path):
+    err = UploadFileError(upload.FILE_CHANGED, "/tmp/a\x1b[31m.wav")
+    assert "\x1b" not in err.values["path"]
+
+
+# ── Through the SDK ──────────────────────────────────────────────────
+
+
+def test_upload_has_content_length_and_no_chunked_encoding(tmp_path):
+    path = _audio(tmp_path, MIB + 7)
+    client, seen = facade(ok)
+    client.transcribe_file(path)
+    ((request, body),) = seen
+    assert request.headers["Content-Length"] == str(MIB + 7)
+    assert "Transfer-Encoding" not in request.headers
+    assert body == path.read_bytes()
+
+
+def refused(request: httpx.Request) -> httpx.Response:
+    raise httpx.ConnectError("refused", request=request)
+
+
+def busy(request: httpx.Request) -> httpx.Response:
+    return httpx.Response(503, json={"err_msg": "busy"})
+
+
+@pytest.mark.parametrize("first", [refused, busy], ids=["connect", "503"])
+def test_sdk_retry_resends_the_whole_file(tmp_path, first):
+    path = _audio(tmp_path, 2 * MIB + 3)
+    calls = []
+
+    def handler(request):
+        calls.append(1)
+        return first(request) if len(calls) == 1 else ok(request)
+
+    client, seen = facade(handler)
+    client.transcribe_file(path)
+    assert len(seen) == 2
+    assert [len(body) for _, body in seen] == [2 * MIB + 3] * 2
+    assert seen[1][1] == path.read_bytes()
+
+
+def test_swapped_path_sends_nothing(tmp_path):
+    validated = _audio(tmp_path, 10, "validated.wav")
+    file_id = _file_id(validated)
+    os.replace(_audio(tmp_path, 10, "other.wav"), validated)
+    client, seen = facade(ok)
+    with pytest.raises(UploadFileError) as err:
+        client.transcribe_file(validated, file_id=file_id)
+    assert err.value.messages == upload.FILE_CHANGED
+    assert seen == []
+
+
+def _changing_pread(path: Path, monkeypatch, action):
+    real = os.pread if hasattr(os, "pread") else None
+    calls = []
+
+    def pread(fd, size, offset):
+        calls.append(offset)
+        if len(calls) == 2:
+            action(path)
+        if real is not None:
+            return real(fd, size, offset)
+        os.lseek(fd, offset, os.SEEK_SET)
+        return os.read(fd, size)
+
+    monkeypatch.setattr(os, "pread", pread, raising=False)
+
+
+def test_file_changed_during_upload_maps_to_upload_changed(tmp_path, monkeypatch):
+    path = _audio(tmp_path, 3 * MIB)
+    client, seen = facade(ok)
+    _changing_pread(path, monkeypatch, lambda p: os.truncate(p, MIB))
+    with pytest.raises(UploadFileError) as err:
+        client.transcribe_file(path)
+    assert err.value.messages == upload.FILE_CHANGED
+    assert str(err.value) == f"{path} changed while dg was uploading it."
+    assert seen == []  # the request never completed
+
+
+def test_read_error_during_upload_maps_to_upload_unreadable(tmp_path, monkeypatch):
+    path = _audio(tmp_path, 3 * MIB)
+    client, _ = facade(ok)
+    real = getattr(os, "pread", None)
+    calls = []
+
+    def pread(fd, size, offset):
+        calls.append(offset)
+        if len(calls) == 2:
+            raise OSError(errno.EIO, os.strerror(errno.EIO))
+        return real(fd, size, offset) if real else os.read(fd, size)
+
+    monkeypatch.setattr(os, "pread", pread, raising=False)
+    with pytest.raises(UploadFileError) as err:
+        client.transcribe_file(path)
+    assert err.value.messages == upload.FILE_UNREADABLE
+    assert str(err.value) == f"Couldn't read {path}: {os.strerror(errno.EIO)}."
+
+
+# ── The coded result ─────────────────────────────────────────────────
+
+
+@pytest.mark.parametrize("agentic", [False, True])
+def test_coded_result(agentic, monkeypatch, capsys):
+    monkeypatch.setitem(output._output_config, "agentic", agentic)
+    err = UploadFileError(upload.FILE_CHANGED, "/data/call.wav")
+    payload = upload.coded_result(err).model_dump()
+    hint = upload.STRINGS[
+        "A-UPLOAD-FILE-CHANGED" if agentic else "H-UPLOAD-FILE-CHANGED"
+    ]
+    assert payload == {
+        "error": "/data/call.wav changed while dg was uploading it.",
+        "status": "error",
+        "code": "invalid_argument",
+        "hint": hint,
+        "next_step": None,
+        "schema_version": 1,
+        "details": {"path": "/data/call.wav"},
+    }
+    err_lines = capsys.readouterr().err
+    assert "/data/call.wav changed while dg was uploading it." in err_lines
+    assert hint in err_lines
+
+
+def test_unreadable_uses_the_human_hint_for_agents(monkeypatch, capsys):
+    monkeypatch.setitem(output._output_config, "agentic", True)
+    err = UploadFileError(
+        upload.FILE_UNREADABLE, "/x.wav", OSError(errno.EACCES, "Permission denied")
+    )
+    payload = upload.coded_result(err).model_dump()
+    assert payload["error"] == "Couldn't read /x.wav: Permission denied."
+    assert payload["hint"] == upload.STRINGS["H-UPLOAD-FILE-UNREADABLE"]
+    assert payload["next_step"] is None
+
+
+@pytest.mark.skipif(
+    not os.environ.get("DG_ERROR_CODES_JSON"),
+    reason="DG_ERROR_CODES_JSON names no error catalogue file",
+)
+def test_strings_match_catalogue():
+    catalogue = json.loads(Path(os.environ["DG_ERROR_CODES_JSON"]).read_text())
+    for message_id, text in upload.STRINGS.items():
+        assert catalogue["strings"][message_id] == text, message_id
+    entry = catalogue["codes"]["invalid_argument"]
+    assert "path" in entry["details"]
+    for error_id, human, agent in (upload.FILE_CHANGED, upload.FILE_UNREADABLE):
+        message = next(m for m in entry["messages"] if m["id"] == error_id)
+        assert (message["hint_human"], message["hint_agent"]) == (human, agent)
+        assert entry["next_step_overrides"][error_id] is None
+
+
+def test_no_module_level_import_cost():
+    """``deepctl_core.upload`` loads nothing heavier than ``os``."""
+    code = (
+        "import sys, deepctl_core.upload; "
+        "print(sorted(m for m in ('httpx', 'pydantic', 'rich', 'deepgram') "
+        "if m in sys.modules))"
+    )
+    import subprocess
+
+    out = subprocess.run(
+        [sys.executable, "-c", code], capture_output=True, text=True, check=True
+    )
+    assert out.stdout.strip() == "[]"
+
+
+# ── --timeout ────────────────────────────────────────────────────────
+
+
+def _timed_out(request: httpx.Request) -> httpx.Response:
+    raise httpx.ReadTimeout("timed out", request=request)
+
+
+@pytest.mark.parametrize(
+    ("timeout_s", "reported"), [(None, 60), (2.0, 2), (2.5, 2.5), (300.0, 300)]
+)
+def test_timeout_reports_the_effective_value(tmp_path, timeout_s, reported):
+    path = _audio(tmp_path, 10)
+    client, seen = facade(_timed_out)
+    with pytest.raises(transport.TransportError) as err:
+        client.transcribe_file(path, timeout_s=timeout_s)
+    assert err.value.code == "timeout"
+    assert err.value.details == {"host": "api.deepgram.com", "timeout_s": reported}
+    assert err.value.error == f"api.deepgram.com didn't respond within {reported} s."
+    ((request, _),) = seen
+    assert request.extensions["timeout"]["read"] == (timeout_s or 60)
+
+
+def test_url_timeout_reports_the_effective_value():
+    client, seen = facade(_timed_out)
+    with pytest.raises(transport.TransportError) as err:
+        client.transcribe_url("https://example.com/a.wav", timeout_s=120)
+    assert err.value.details["timeout_s"] == 120
+    ((request, _),) = seen
+    assert request.extensions["timeout"] == {
+        "connect": 120,
+        "read": 120,
+        "write": 120,
+        "pool": 120,
+    }
+
+
+def test_other_requests_keep_the_60_s_timeout():
+    client, seen = facade(_timed_out)
+    with pytest.raises(transport.TransportError) as err:
+        client.list_models()
+    assert err.value.details["timeout_s"] == 60
+    assert seen[0][0].extensions["timeout"]["read"] == 60
diff --git a/packages/deepctl-shared-utils/src/deepctl_shared_utils/validation.py b/packages/deepctl-shared-utils/src/deepctl_shared_utils/validation.py
index e0284f99..932c5e93 100644
--- a/packages/deepctl-shared-utils/src/deepctl_shared_utils/validation.py
+++ b/packages/deepctl-shared-utils/src/deepctl_shared_utils/validation.py
@@ -3,7 +3,8 @@
 import os
 import re
 from pathlib import Path
-from urllib.parse import urlparse
+from typing import TypeAlias
+from urllib.parse import ParseResult, urlparse
 
 from .diagnostics import create_diagnostic_console
 from .models import FileInfo
@@ -54,177 +55,287 @@
 }
 
 
-def validate_audio_file(file_path: str | Path) -> bool:
-    """Validate that a file exists and appears to be an audio file.
+# A problem (the error to show, or None) and the warnings to show with it.
+Problems: TypeAlias = "tuple[str | None, list[str]]"
 
-    Args:
-        file_path: Path to the file
 
-    Returns:
-        True if file is valid audio file, False otherwise
-    """
+def _supported() -> str:
+    return ", ".join(sorted(SUPPORTED_AUDIO_EXTENSIONS))
+
+
+def audio_file_problem(file_path: str | Path) -> Problems:
+    """Why ``file_path`` can't be sent as audio (None when it can), and any
+    warnings. Prints nothing: the caller reports both, once."""
+    # A URL passed as a path may carry a token: show it without one.
+    shown = display_url(str(file_path)) if "://" in str(file_path) else file_path
+    warnings: list[str] = []
     try:
         path = Path(file_path)
-
-        # Check if file exists
         if not path.exists():
-            console.print(f"[red]Error:[/red] File not found: {file_path}")
-            return False
-
-        # Check if it's a file (not directory)
+            return f"File not found: {shown}", warnings
         if not path.is_file():
-            console.print(f"[red]Error:[/red] Path is not a file: {file_path}")
-            return False
-
-        # Check file extension
+            return f"Not a file: {shown}", warnings
         extension = path.suffix.lower()
         if extension not in SUPPORTED_AUDIO_EXTENSIONS:
-            console.print(
-                f"[yellow]Warning:[/yellow] File extension '{extension}' "
-                f"is not in supported list"
+            return (
+                f"{shown} doesn't look like an audio file "
+                f"({extension or 'no extension'}). Supported: {_supported()}. "
+                "Pass --no-validate to send it anyway.",
+                warnings,
             )
-            console.print(
-                f"[dim]Supported extensions: "
-                f"{', '.join(sorted(SUPPORTED_AUDIO_EXTENSIONS))}[/dim]"
-            )
-            return False
-
-        # Check if file is readable
         if not os.access(path, os.R_OK):
-            console.print(f"[red]Error:[/red] File is not readable: {file_path}")
-            return False
-
-        # Check file size (warn if very large)
+            return f"File is not readable: {shown}", warnings
         size_mb = path.stat().st_size / (1024 * 1024)
         if size_mb > 500:  # 500 MB
-            console.print(
-                f"[yellow]Warning:[/yellow] Large file detected ({size_mb:.1f} MB)"
+            warnings.append(
+                f"Large file ({size_mb:.1f} MB): it may take longer to process."
             )
-            console.print("[dim]Large files may take longer to process[/dim]")
+        return None, warnings
+    except Exception as e:
+        return (
+            f"Couldn't check {shown}: {scrub_url_text(e, str(file_path))}",
+            warnings,
+        )
 
-        return True
 
-    except Exception as e:
-        console.print(f"[red]Error validating file:[/red] {e}")
-        return False
+def _print(problems: Problems) -> bool:
+    problem, warnings = problems
+    for warning in warnings:
+        console.print(f"[yellow]Warning:[/yellow] {warning}")
+    if problem is not None:
+        console.print(f"[red]Error:[/red] {problem}")
+    return problem is None
 
 
-def validate_url(url: str, check_accessibility: bool = True) -> bool:
-    """Validate URL format and optionally check accessibility.
+def validate_audio_file(file_path: str | Path) -> bool:
+    """Validate that a file exists and appears to be an audio file.
+
+    Prints the problem and warnings (see :func:`audio_file_problem`).
 
     Args:
-        url: URL to validate
-        check_accessibility: Whether to check if URL is accessible
+        file_path: Path to the file
 
     Returns:
-        True if URL is valid, False otherwise
+        True if file is valid audio file, False otherwise
+    """
+    return _print(audio_file_problem(file_path))
+
+
+_SCHEME_RE = re.compile(r"\s*([A-Za-z][A-Za-z0-9+.\-]*)://(.*)", re.S)
+
+
+def _parsed(url: str) -> ParseResult | None:
+    """``urlparse(url)`` when it has a scheme, a host and a valid port.
+
+    ``None`` otherwise: a password holding an unescaped ``/``, ``?`` or
+    ``#`` ends the authority early and shows up as a bad port or host.
     """
+    if not _SCHEME_RE.match(url):
+        return None
     try:
-        # Parse URL
-        parsed = urlparse(url)
+        parts = urlparse(url)
+        parts.port  # noqa: B018 (raises ValueError on a bad port)
+    except ValueError:
+        return None
+    if not parts.scheme or not parts.hostname:
+        return None
+    return parts
 
-        # Check basic URL structure
-        if not parsed.scheme or not parsed.netloc:
-            console.print(f"[red]Error:[/red] Invalid URL format: {url}")
-            return False
 
-        # Check scheme
-        if parsed.scheme not in ("http", "https"):
-            console.print(
-                f"[red]Error:[/red] Only HTTP/HTTPS URLs are supported: {url}"
-            )
-            return False
+def _url_parts(url: str) -> tuple[str, str, str] | None:
+    """``(scheme, host[:port], path)`` when no user info can show.
+
+    ``None`` when the URL doesn't parse, or when an ``@`` appears outside the
+    parsed authority: that may be user info whose password holds ``/``, ``?``
+    or ``#``, so no part of it is shown.
+    """
+    parts = _parsed(url)
+    if parts is None:
+        return None
+    match = _SCHEME_RE.match(url)
+    rest = match.group(2) if match else ""
+    if rest.count("@") != parts.netloc.count("@"):
+        return None
+    return parts.scheme, parts.netloc.rpartition("@")[2], parts.path
+
+
+def _redacted(url: str) -> str:
+    """The shown form of a URL that can't be parsed safely."""
+    match = _SCHEME_RE.match(url)
+    if match:
+        return f"{match.group(1).lower()}://<redacted>/…"
+    if "@" in url:
+        return "<redacted>"
+    return re.split(r"[?#]", url, maxsplit=1)[0]
+
+
+def output_url(url: str) -> str:
+    """``url`` for machine output: no user info, query string or fragment.
+
+    Presigned URLs carry their token in the query string, so a URL is never
+    shown, logged or echoed whole. The path is kept: automation needs it to
+    identify the file. A URL that can't be parsed safely is shown as
+    ``scheme://<redacted>/…``.
+    """
+    parts = _url_parts(url)
+    if parts is None:
+        return _redacted(url)
+    scheme, host, path = parts
+    return f"{scheme}://{host}{path}"
+
+
+def display_url(url: str) -> str:
+    """``url`` for status lines and errors: ``scheme://host/…/<last segment>``.
 
-        # Check if URL looks like an audio file
+    As :func:`output_url`, and the path is cut to its last segment, since some
+    hosts put a token in the path. A path of one segment is shown whole.
+    """
+    parts = _url_parts(url)
+    if parts is None:
+        return _redacted(url)
+    scheme, host, path = parts
+    segments = [s for s in path.split("/") if s]
+    if len(segments) <= 1:
+        return f"{scheme}://{host}{path}"
+    tail = "/" if path.endswith("/") else ""
+    return f"{scheme}://{host}/…/{segments[-1]}{tail}"
+
+
+def scrub_url_text(text: object, url: str) -> str:
+    """``text`` (an error message) with ``url``'s query and user info removed.
+
+    Every piece of the raw text before the URL's last ``@`` is replaced, so a
+    message that quotes part of a password shows ``<redacted>`` instead.
+    """
+    out = str(text)
+    match = _SCHEME_RE.match(url)
+    rest = match.group(2) if match else url
+    if "@" in rest:
+        secret = rest.rpartition("@")[0]
+        pieces = [secret, *re.split(r"[:/?#@]", secret)]
+        for piece in sorted(pieces, key=len, reverse=True):
+            if len(piece) >= 2:
+                out = out.replace(piece, "<redacted>")
+    return _no_query(out)
+
+
+def url_problem(url: str, check_accessibility: bool = False) -> Problems:
+    """Why ``url`` can't be sent (None when it can), and any warnings.
+
+    By default only the format is checked (an http or https scheme and a
+    host), with no network access. ``check_accessibility`` also sends a
+    HEAD request (no credentials, no cookies). Prints nothing: the caller
+    reports both, once.
+    """
+    shown = display_url(url)
+    warnings: list[str] = []
+    try:
+        parsed = _parsed(url)
+        if parsed is None:
+            return f"Not a valid URL: {shown}", warnings
+        if parsed.scheme not in ("http", "https"):
+            return f"URLs must start with http:// or https://: {shown}", warnings
         path = parsed.path.lower()
         if path:
             extension = Path(path).suffix
             if extension and extension not in SUPPORTED_AUDIO_EXTENSIONS:
-                console.print(
-                    f"[yellow]Warning:[/yellow] URL doesn't appear to be an "
-                    f"audio file: {url}"
+                warnings.append(
+                    f"{shown} doesn't look like an audio file ({extension}). "
+                    f"Supported: {_supported()}."
                 )
-                console.print(
-                    f"[dim]Expected extensions: "
-                    f"{', '.join(sorted(SUPPORTED_AUDIO_EXTENSIONS))}[/dim]"
-                )
-
-        # Check accessibility if requested
         if check_accessibility:
-            return _check_url_accessibility(url)
-
-        return True
-
+            problem, more = _url_reach_problem(url)
+            return problem, warnings + more
+        return None, warnings
     except Exception as e:
-        console.print(f"[red]Error validating URL:[/red] {e}")
-        return False
+        return f"Not a valid URL: {shown} ({scrub_url_text(e, url)})", warnings
 
 
-def _check_url_accessibility(url: str) -> bool:
-    """Check if URL is accessible.
+def validate_url(url: str, check_accessibility: bool = False) -> bool:
+    """Validate URL format and optionally check accessibility.
+
+    Prints the problem and warnings (see :func:`url_problem`).
 
     Args:
-        url: URL to check
+        url: URL to validate
+        check_accessibility: Also send a HEAD request (no credentials, no
+            cookies) to check the URL is reachable
 
     Returns:
-        True if accessible, False otherwise
+        True if URL is valid, False otherwise
+    """
+    return _print(url_problem(url, check_accessibility))
+
+
+def _no_query(text: object) -> str:
+    """``text`` with any URL query string removed."""
+    return re.sub(r"\?\S*", "", str(text))
+
+
+_CHECK_TIMEOUT_S = 10.0
+
+
+def _url_reach_problem(url: str) -> Problems:
+    """``--check-url``: why ``url`` can't be reached (None when it can),
+    and warnings about what it serves.
+
+    The request carries no API key and keeps no cookies: it goes to a host
+    the user named, not to Deepgram.
     """
     import httpx
 
+    shown = display_url(url)
+    warnings: list[str] = []
+
+    def unreachable(why: str) -> Problems:
+        return f"--check-url couldn't reach {shown} ({why})", warnings
+
     try:
-        console.print("[dim]Checking URL accessibility...[/dim]")
+        with httpx.Client(timeout=_CHECK_TIMEOUT_S) as client:
+            from http.cookiejar import DefaultCookiePolicy
 
-        with httpx.Client(timeout=10.0) as client:
+            client.cookies.jar.set_policy(DefaultCookiePolicy(allowed_domains=[]))
             # Try HEAD first; fall back to a ranged GET if the server
             # doesn't support HEAD (some CDNs/redirect services return
             # 404 or 405 for HEAD but serve GET fine).
             response = client.head(url, follow_redirects=True)
 
             if response.status_code not in range(200, 400):
-                response = client.get(
-                    url,
-                    follow_redirects=True,
-                    headers={"Range": "bytes=0-0"},
+                # Streamed, and the body is never read: a server that
+                # ignores Range can't make this load the whole file.
+                with client.stream(
+                    "GET", url, follow_redirects=True, headers={"Range": "bytes=0-0"}
+                ) as response:
+                    pass
+
+            if response.status_code not in (200, 206):
+                return unreachable(f"HTTP {response.status_code}")
+            content_type = response.headers.get("content-type", "").lower()
+            if content_type and not any(
+                mime in content_type for mime in AUDIO_MIME_TYPES
+            ):
+                warnings.append(
+                    f"{shown} is served as {content_type}, which may not be audio."
                 )
-
-            if response.status_code in (200, 206):
-                # Check content type if available
-                content_type = response.headers.get("content-type", "").lower()
-                if content_type and not any(
-                    mime in content_type for mime in AUDIO_MIME_TYPES
-                ):
-                    console.print(
-                        f"[yellow]Warning:[/yellow] Content type may not be "
-                        f"audio: {content_type}"
+            content_length = response.headers.get("content-length")
+            if content_length and content_length.isdigit():
+                size_mb = int(content_length) / (1024 * 1024)
+                if size_mb > 500:  # 500 MB
+                    warnings.append(
+                        f"Large file ({size_mb:.1f} MB): it may take longer to process."
                     )
-
-                # Check content length if available
-                content_length = response.headers.get("content-length")
-                if content_length:
-                    size_mb = int(content_length) / (1024 * 1024)
-                    if size_mb > 500:  # 500 MB
-                        console.print(
-                            f"[yellow]Warning:[/yellow] Large file detected "
-                            f"({size_mb:.1f} MB)"
-                        )
-
-                return True
-            else:
-                console.print(
-                    f"[red]Error:[/red] URL not accessible "
-                    f"(HTTP {response.status_code}): {url}"
-                )
-                return False
+            return None, warnings
 
     except httpx.TimeoutException:
-        console.print(f"[red]Error:[/red] URL request timed out: {url}")
-        return False
-    except httpx.RequestError as e:
-        console.print(f"[red]Error:[/red] Failed to access URL: {e}")
-        return False
+        return unreachable(f"no answer within {_CHECK_TIMEOUT_S:g} s")
     except Exception as e:
-        console.print(f"[red]Error checking URL accessibility:[/red] {e}")
-        return False
+        return unreachable(scrub_url_text(e, url) or type(e).__name__)
+
+
+def _check_url_accessibility(url: str) -> bool:
+    """Check if URL is accessible (see :func:`_url_reach_problem`); prints
+    the problem and warnings."""
+    return _print(_url_reach_problem(url))
 
 
 def validate_api_key(api_key: str) -> bool:
diff --git a/packages/deepctl-shared-utils/tests/unit/test_validation_url.py b/packages/deepctl-shared-utils/tests/unit/test_validation_url.py
new file mode 100644
index 00000000..9c0e0fee
--- /dev/null
+++ b/packages/deepctl-shared-utils/tests/unit/test_validation_url.py
@@ -0,0 +1,367 @@
+"""URL source checks: format only by default, an opt-in HEAD request."""
+
+from __future__ import annotations
+
+import threading
+import time
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from io import StringIO
+from typing import ClassVar
+
+import httpx
+import pytest
+from deepctl_shared_utils import validation
+from deepctl_shared_utils.validation import (
+    display_url,
+    output_url,
+    scrub_url_text,
+    validate_url,
+)
+from rich.console import Console
+
+TOKEN = "X-Amz-Signature=URLSENTINELTOKEN"
+
+
+@pytest.fixture
+def printed(monkeypatch) -> StringIO:
+    buffer = StringIO()
+    monkeypatch.setattr(
+        validation, "console", Console(file=buffer, width=400, no_color=True)
+    )
+    return buffer
+
+
+@pytest.mark.parametrize(
+    ("url", "shown"),
+    [
+        ("https://h.example/a.wav", "https://h.example/a.wav"),
+        (f"https://h.example/a.wav?{TOKEN}&b=1", "https://h.example/a.wav"),
+        ("https://u:p@h.example:8443/x/a.wav#t", "https://h.example:8443/x/a.wav"),
+        (f"http://[::1]:8080/a.wav?{TOKEN}", "http://[::1]:8080/a.wav"),
+        (f"not a url?{TOKEN}", "not a url"),
+    ],
+)
+def test_output_url(url, shown):
+    assert output_url(url) == shown
+    # One path segment or none: status lines show the same thing.
+    if shown.count("/") <= 3:
+        assert display_url(url) == shown
+
+
+@pytest.mark.parametrize(
+    ("url", "full", "shown"),
+    [
+        (
+            f"https://u:p@cdn.example/s/URLPATHTOKEN/a.wav?{TOKEN}",
+            "https://cdn.example/s/URLPATHTOKEN/a.wav",
+            "https://cdn.example/…/a.wav",
+        ),
+        (
+            "https://h.example:8443/x/y/",
+            "https://h.example:8443/x/y/",
+            "https://h.example:8443/…/y/",
+        ),
+        (
+            "https://u:p@h.example:8443/x/a.wav#t",
+            "https://h.example:8443/x/a.wav",
+            "https://h.example:8443/…/a.wav",
+        ),
+        ("https://h.example/a/", "https://h.example/a/", "https://h.example/a/"),
+        ("https://h.example", "https://h.example", "https://h.example"),
+        ("https://h.example/", "https://h.example/", "https://h.example/"),
+    ],
+)
+def test_display_url_keeps_only_the_last_path_segment(url, full, shown):
+    assert output_url(url) == full
+    assert display_url(url) == shown
+
+
+def test_format_check_makes_no_request(monkeypatch, printed):
+    def no_client(*args, **kwargs):
+        raise AssertionError("validate_url opened an HTTP client")
+
+    monkeypatch.setattr(httpx, "Client", no_client)
+    assert validate_url(f"https://h.example/a.wav?{TOKEN}") is True
+    assert printed.getvalue() == ""
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        f"https:///a.wav?{TOKEN}",
+        f"https://user@/a.wav?{TOKEN}",
+        f"ftp://h.example/a.wav?{TOKEN}",
+        f"h.example/a.wav?{TOKEN}",
+    ],
+)
+def test_bad_format_is_rejected_without_the_query(url, printed):
+    assert validate_url(url) is False
+    assert "Error:" in printed.getvalue()
+    assert "URLSENTINELTOKEN" not in printed.getvalue()
+
+
+def test_non_audio_warning_drops_the_query(printed):
+    assert validate_url(f"https://h.example/page.html?{TOKEN}") is True
+    assert "https://h.example/page.html" in printed.getvalue()
+    assert "URLSENTINELTOKEN" not in printed.getvalue()
+
+
+class _Origin(BaseHTTPRequestHandler):
+    """Sets a cookie and redirects once, then answers 200 or ``status``."""
+
+    seen: ClassVar[list[dict[str, str | None]]] = []
+    status = 200
+
+    def do_HEAD(self):
+        _Origin.seen.append(
+            {
+                "path": self.path,
+                "authorization": self.headers.get("Authorization"),
+                "cookie": self.headers.get("Cookie"),
+            }
+        )
+        if self.path.startswith("/start"):
+            self.send_response(302)
+            self.send_header("Set-Cookie", "session=URLCOOKIE; Path=/")
+            self.send_header("Location", "/audio.wav?" + TOKEN)
+        else:
+            self.send_response(_Origin.status)
+            self.send_header("Content-Type", "audio/wav")
+        self.send_header("Content-Length", "0")
+        self.end_headers()
+
+    do_GET = do_HEAD
+
+    def log_message(self, *args):
+        pass
+
+
+@pytest.fixture
+def origin():
+    _Origin.seen = []
+    _Origin.status = 200
+    server = ThreadingHTTPServer(("127.0.0.1", 0), _Origin)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    yield f"http://127.0.0.1:{server.server_address[1]}"
+    server.shutdown()
+    server.server_close()
+
+
+def test_check_url_sends_head_without_credentials_or_cookies(origin, printed):
+    assert validate_url(f"{origin}/start/a.wav?{TOKEN}", check_accessibility=True)
+    assert [r["path"].split("?")[0] for r in _Origin.seen] == [
+        "/start/a.wav",
+        "/audio.wav",
+    ]
+    assert all(r["authorization"] is None for r in _Origin.seen)
+    assert all(r["cookie"] is None for r in _Origin.seen)
+    assert "URLSENTINELTOKEN" not in printed.getvalue()
+
+
+def test_check_url_failure_drops_the_query(origin, printed):
+    _Origin.status = 403
+    assert not validate_url(f"{origin}/a.wav?{TOKEN}", check_accessibility=True)
+    assert "HTTP 403" in printed.getvalue()
+    assert f"{origin}/a.wav" in printed.getvalue()
+    assert "URLSENTINELTOKEN" not in printed.getvalue()
+
+
+def test_check_url_connection_error_drops_the_query(printed):
+    url = f"http://127.0.0.1:9/a.wav?{TOKEN}"
+    assert not validate_url(url, check_accessibility=True)
+    assert "--check-url couldn't reach http://127.0.0.1:9/a.wav (" in printed.getvalue()
+    assert "URLSENTINELTOKEN" not in printed.getvalue()
+
+
+def test_httpx_loads_only_for_the_check():
+    import subprocess
+    import sys
+
+    code = (
+        "import sys; from deepctl_shared_utils import validation; "
+        "validation.validate_url('https://h.example/a.wav'); "
+        "print('httpx' in sys.modules)"
+    )
+    out = subprocess.run(
+        [sys.executable, "-c", code], capture_output=True, text=True, check=True
+    )
+    assert out.stdout.strip() == "False"
+
+
+# ── The GET fallback never reads the body ────────────────────────────
+
+BIG = 100 * 1024 * 1024
+
+
+class _IgnoresRange(BaseHTTPRequestHandler):
+    """HEAD -> 405; GET ignores Range and sends 100 MB."""
+
+    protocol_version = "HTTP/1.1"
+    sent: ClassVar[list[int]] = []
+
+    def do_HEAD(self):
+        self.send_response(405)
+        self.send_header("Content-Length", "0")
+        self.end_headers()
+
+    def do_GET(self):
+        self.send_response(200)
+        self.send_header("Content-Type", "audio/wav")
+        self.send_header("Content-Length", str(BIG))
+        self.end_headers()
+        chunk = b"\0" * (1 << 16)
+        sent = 0
+        try:
+            while sent < BIG:
+                self.wfile.write(chunk)
+                sent += len(chunk)
+        except OSError:
+            pass
+        _IgnoresRange.sent.append(sent)
+
+    def log_message(self, *args):
+        pass
+
+
+def test_get_fallback_reads_headers_only(printed):
+    _IgnoresRange.sent = []
+    server = ThreadingHTTPServer(("127.0.0.1", 0), _IgnoresRange)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        url = f"http://127.0.0.1:{server.server_address[1]}/big.wav?{TOKEN}"
+        assert validate_url(url, check_accessibility=True) is True
+        deadline = time.monotonic() + 10
+        while not _IgnoresRange.sent and time.monotonic() < deadline:
+            time.sleep(0.05)
+        server.shutdown()
+    finally:
+        server.server_close()
+    # The client closed the connection after the headers: the server could
+    # write only what fits in the socket buffers, far short of 100 MB.
+    assert _IgnoresRange.sent and _IgnoresRange.sent[0] < BIG // 4
+    assert "URLSENTINELTOKEN" not in printed.getvalue()
+
+
+# ── User info that urlparse can't see ──
+
+REDACTED = "https://<redacted>/…"
+
+
+@pytest.mark.parametrize(
+    ("url", "valid_format"),
+    [
+        # A password with an unescaped #, ? or / ends the authority early.
+        ("https://u:pa#URLPW@cdn.example/a.wav", False),
+        ("https://u:pa?URLPW@cdn.example/a.wav", False),
+        ("https://u:pa/URLPW@cdn.example/a/b.wav", False),
+        (f"https://u:pa/URLPW@cdn.example/a/b.wav?{TOKEN}", False),
+        # An empty authority: a WHATWG parser reads this as user info.
+        ("https:///URLPW@cdn.example/y/a.wav", False),
+        ("https://user@/a.wav", False),
+        # Parses, but an @ sits outside the authority: never shown.
+        ("https://u/URLPW@cdn.example/a.wav", True),
+        ("https://user?URLPW@cdn.example/a.wav", True),
+        ("HTTPS://u/URLPW@cdn.example/x/a.wav", True),
+    ],
+)
+def test_malformed_user_info_is_redacted(url, valid_format, printed):
+    assert output_url(url) == REDACTED
+    assert display_url(url) == REDACTED
+    assert validate_url(url) is valid_format
+    shown = printed.getvalue()
+    assert "URLPW" not in shown and "u:pa" not in shown
+    if not valid_format:
+        assert f"Not a valid URL: {REDACTED}" in shown
+
+
+@pytest.mark.parametrize(
+    ("url", "full", "shown"),
+    [
+        (
+            "https://u%40x:URLPW%40y@h.example/a/b.wav",
+            "https://h.example/a/b.wav",
+            "https://h.example/…/b.wav",
+        ),
+        (
+            f"https://u:URLPW@[::1]:8443/x/a.wav?{TOKEN}",
+            "https://[::1]:8443/x/a.wav",
+            "https://[::1]:8443/…/a.wav",
+        ),
+        (
+            "https://u:URLPW@h.example:8443/a.wav",
+            "https://h.example:8443/a.wav",
+            "https://h.example:8443/a.wav",
+        ),
+        (
+            "https://u:URLPW@[2001:db8::1]/s/a.wav",
+            "https://[2001:db8::1]/s/a.wav",
+            "https://[2001:db8::1]/…/a.wav",
+        ),
+    ],
+)
+def test_well_formed_user_info_is_dropped(url, full, shown, printed):
+    assert output_url(url) == full
+    assert display_url(url) == shown
+    assert validate_url(url) is True
+    assert "URLPW" not in printed.getvalue()
+
+
+@pytest.mark.parametrize(
+    "url", ["https://h.example:99999/a.wav", "https://[::1/a.wav", "https://h:x/a"]
+)
+def test_unparseable_url_is_redacted(url, printed):
+    assert display_url(url) == REDACTED
+    assert validate_url(url) is False
+    assert f"Not a valid URL: {REDACTED}" in printed.getvalue()
+
+
+def test_scrub_url_text_hides_quoted_password_pieces():
+    url = f"https://u:pa#URLPW@cdn.example/a.wav?{TOKEN}"
+    text = scrub_url_text(f"Invalid port: 'pa' in {url}", url)
+    assert "URLPW" not in text and "'pa'" not in text
+    assert "URLSENTINELTOKEN" not in text
+
+
+def test_check_url_errors_never_quote_user_info(monkeypatch, printed):
+    url = "https://u/URLPW@cdn.example/a.wav"
+
+    class _Boom:
+        def __init__(self, *args, **kwargs):
+            raise httpx.ConnectError(f"cannot connect to {url}")
+
+    monkeypatch.setattr(httpx, "Client", _Boom)
+    assert validate_url(url, check_accessibility=True) is False
+    assert "URLPW" not in printed.getvalue()
+
+
+def test_url_problem_prints_nothing(printed):
+    from deepctl_shared_utils.validation import url_problem
+
+    assert url_problem("https://h.example:99999/a.wav") == (
+        f"Not a valid URL: {REDACTED}",
+        [],
+    )
+    assert url_problem("ftp://h.example/a.wav")[0] == (
+        "URLs must start with http:// or https://: ftp://h.example/a.wav"
+    )
+    problem, warnings = url_problem("https://h.example/a.txt")
+    assert problem is None
+    assert warnings and "doesn't look like an audio file (.txt)" in warnings[0]
+    assert printed.getvalue() == ""
+
+
+def test_audio_file_problem_names_the_way_out(tmp_path, printed):
+    from deepctl_shared_utils.validation import audio_file_problem
+
+    doc = tmp_path / "notes.xyz"
+    doc.write_text("x")
+    problem, _ = audio_file_problem(doc)
+    assert problem is not None
+    assert problem.startswith(f"{doc} doesn't look like an audio file (.xyz).")
+    assert problem.endswith("Pass --no-validate to send it anyway.")
+    assert audio_file_problem(tmp_path / "gone.wav")[0] == (
+        f"File not found: {tmp_path / 'gone.wav'}"
+    )
+    assert printed.getvalue() == ""
diff --git a/pyproject.toml b/pyproject.toml
index 08d77a05..41774642 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -155,15 +155,10 @@ disable_error_code = ["call-arg", "no-untyped-call", "no-untyped-def", "untyped-
 module = [
     "sounddevice",
     "sounddevice.*",
-    "numpy",
-    "numpy.*",
 ]
-# Optional microphone dependencies (sounddevice, numpy) ship without type
-# stubs.
+# The microphone dependency (sounddevice) ships without type stubs. Skip
+# analyzing it; usages fall back to Any.
 ignore_missing_imports = true
-# numpy>=2.2 ships PEP 695 `type` aliases in its stubs, which mypy rejects
-# under python_version = "3.10" (aborting before our code is checked). Skip
-# analyzing these third-party stubs entirely; usages fall back to Any.
 follow_imports = "skip"
 follow_imports_for_stubs = true
 
diff --git a/src/deepctl/_manifest.d/listen.json b/src/deepctl/_manifest.d/listen.json
index 53dd5120..fce76bd2 100644
--- a/src/deepctl/_manifest.d/listen.json
+++ b/src/deepctl/_manifest.d/listen.json
@@ -58,6 +58,53 @@
         "hidden": false,
         "help": "Output WebVTT captions instead of plain transcript. In live mode, entries are printed as they arrive. Mutually exclusive with --srt."
       },
+      {
+        "class": "option",
+        "name": "timeout",
+        "opts": [
+          "--timeout"
+        ],
+        "secondary_opts": [],
+        "type": {
+          "name": "float range",
+          "min": 1,
+          "max": null,
+          "min_open": false,
+          "max_open": false,
+          "clamp": false
+        },
+        "required": false,
+        "nargs": 1,
+        "metavar": null,
+        "eager": false,
+        "expose": true,
+        "multiple": false,
+        "is_flag": false,
+        "count": false,
+        "hidden": false,
+        "help": "Seconds to wait at each step (connecting, sending, the response) before giving up. Not a limit on the whole run. Default: 300. Files and URLs only."
+      },
+      {
+        "class": "option",
+        "name": "check_url",
+        "opts": [
+          "--check-url"
+        ],
+        "secondary_opts": [],
+        "type": {
+          "name": "boolean"
+        },
+        "required": false,
+        "nargs": 1,
+        "metavar": null,
+        "eager": false,
+        "expose": true,
+        "multiple": false,
+        "is_flag": true,
+        "count": false,
+        "hidden": false,
+        "help": "Check that the URL responds before transcribing: a HEAD request, then a 1-byte GET if needed. Sends no Deepgram API key."
+      },
       {
         "class": "option",
         "name": "no_validate",
diff --git a/src/deepctl/_manifest.d/login.json b/src/deepctl/_manifest.d/login.json
index 4f01b621..4060433f 100644
--- a/src/deepctl/_manifest.d/login.json
+++ b/src/deepctl/_manifest.d/login.json
@@ -8,7 +8,7 @@
   "requires_auth": false,
   "help": {
     "name": "login",
-    "help": "Log in to Deepgram with browser-based authentication or API key\n\nExamples:\n  dg login\n  dg login --api-key YOUR_API_KEY\n  dg login --api-key YOUR_KEY --project-id YOUR_PROJECT\n  dg login --profile staging --api-key YOUR_KEY\n  dg --base-url https://api.eu.deepgram.com login --save-base-url\n\n\nFor agents, use --agent-friendly.",
+    "help": "Log in to Deepgram with browser-based authentication or API key\n\nExamples:\n  dg login\n  dg login --no-browser\n  dg login --complete\n  dg login --api-key YOUR_API_KEY\n  dg login --api-key YOUR_KEY --project-id YOUR_PROJECT\n  dg login --profile staging --api-key YOUR_KEY\n  dg --base-url https://api.eu.deepgram.com login --save-base-url\n\n\nFor agents, use --agent-friendly.",
     "short_help": "Log in to Deepgram",
     "epilog": null,
     "hidden": false,
@@ -37,6 +37,69 @@
         "hidden": false,
         "help": "Save the --base-url URL as this profile's API URL (asks for confirmation in a terminal)"
       },
+      {
+        "class": "option",
+        "name": "wait",
+        "opts": [
+          "--wait"
+        ],
+        "secondary_opts": [],
+        "type": {
+          "name": "boolean"
+        },
+        "required": false,
+        "nargs": 1,
+        "metavar": null,
+        "eager": false,
+        "expose": true,
+        "multiple": false,
+        "is_flag": true,
+        "count": false,
+        "hidden": false,
+        "help": "Wait until the browser login is approved (the default in a terminal), instead of exiting with the link and code; with --complete, keep checking"
+      },
+      {
+        "class": "option",
+        "name": "complete",
+        "opts": [
+          "--complete"
+        ],
+        "secondary_opts": [],
+        "type": {
+          "name": "boolean"
+        },
+        "required": false,
+        "nargs": 1,
+        "metavar": null,
+        "eager": false,
+        "expose": true,
+        "multiple": false,
+        "is_flag": true,
+        "count": false,
+        "hidden": false,
+        "help": "Finish a pending browser login: check once whether it was approved, and save the key if it was (add --wait to keep checking)"
+      },
+      {
+        "class": "option",
+        "name": "no_browser",
+        "opts": [
+          "--no-browser"
+        ],
+        "secondary_opts": [],
+        "type": {
+          "name": "boolean"
+        },
+        "required": false,
+        "nargs": 1,
+        "metavar": null,
+        "eager": false,
+        "expose": true,
+        "multiple": false,
+        "is_flag": true,
+        "count": false,
+        "hidden": false,
+        "help": "Print the login link and code instead of opening a browser, then exit; finish with --complete, or add --wait to wait here"
+      },
       {
         "class": "option",
         "name": "profile",
@@ -78,7 +141,29 @@
         "is_flag": true,
         "count": false,
         "hidden": false,
-        "help": "Don't prompt for confirmation when providing credentials"
+        "help": "Same as --yes"
+      },
+      {
+        "class": "option",
+        "name": "yes",
+        "opts": [
+          "--yes",
+          "-y"
+        ],
+        "secondary_opts": [],
+        "type": {
+          "name": "boolean"
+        },
+        "required": false,
+        "nargs": 1,
+        "metavar": null,
+        "eager": false,
+        "expose": true,
+        "multiple": false,
+        "is_flag": true,
+        "count": false,
+        "hidden": false,
+        "help": "Save without asking, even if DEEPGRAM_API_KEY is set or the profile already has a saved login (--save-base-url still asks)"
       },
       {
         "class": "option",
diff --git a/src/deepctl/_manifest.d/speak.json b/src/deepctl/_manifest.d/speak.json
index ee9b0e99..b91768e1 100644
--- a/src/deepctl/_manifest.d/speak.json
+++ b/src/deepctl/_manifest.d/speak.json
@@ -8,7 +8,7 @@
   "requires_auth": true,
   "help": {
     "name": "speak",
-    "help": "Convert text to speech using Deepgram TTS\n\nExamples:\n  dg speak \"Hello from Deepgram\" --play\n  dg speak --list-voices\n  dg speak \"Hello world\"\n  dg speak \"Hello world\" -o hello.wav\n  dg speak \"Hello world\" -o hello.wav --play\n  dg speak --file message.txt -o output.wav\n  dg speak \"Hello\" | ffplay -loglevel error -nodisp -autoexit -\n  dg speak \"A little slower, please\" --speed 0.9 -o slow.wav\n  dg speak \"So exciting!\" --expressivity 2 -o lively.wav  # beta; default: 0\n  dg speak \"Hello\" -m aura-2-asteria-en -o hello.mp3\n  dg speak \"Hello\" -m aura-2-luna-en -o hello.wav --encoding linear16 --container wav\n  echo \"Hello\" | dg speak -o hello.mp3 -m aura-2-asteria-en\n  dg speak \"Hola, mundo\" -m aura-2-selena-es -o hola.mp3\n\n\nFor agents, use --agent-friendly.",
+    "help": "Convert text to speech using Deepgram TTS\n\nExamples:\n  dg speak \"Hello from Deepgram\" --play\n  dg speak --list-voices\n  dg speak \"Hello world\"\n  dg speak \"Hello world\" --out-file hello.wav\n  dg speak \"Hello world\" --out-file hello.wav --play\n  dg speak --file message.txt --out-file output.wav\n  dg speak \"Hello\" | ffplay -loglevel error -nodisp -autoexit -\n  dg speak \"A little slower, please\" --speed 0.9 --out-file slow.wav\n  dg speak \"So exciting!\" --expressivity 2 --out-file lively.wav  # beta; default: 0\n  dg speak \"Hello\" -m aura-2-asteria-en --out-file hello.mp3\n  dg speak \"Hello\" -m aura-2-luna-en --out-file hello.wav --encoding linear16 --container wav\n  echo \"Hello\" | dg speak - --out-file hello.mp3 -m aura-2-asteria-en\n  dg speak \"Hola, mundo\" -m aura-2-selena-es --out-file hola.mp3\n\n\nFor agents, use --agent-friendly.",
     "short_help": "Text-to-speech",
     "epilog": null,
     "hidden": false,
@@ -56,7 +56,7 @@
         "is_flag": true,
         "count": false,
         "hidden": false,
-        "help": "Play the audio through your system player (ffplay, afplay, paplay, or aplay). Can be combined with -o to save and play."
+        "help": "Play the audio through your system player (ffplay, afplay, paplay, or aplay). Can be combined with --out-file to save and play."
       },
       {
         "class": "option",
@@ -220,14 +220,56 @@
         },
         "required": false,
         "nargs": 1,
+        "metavar": "FILE",
+        "eager": false,
+        "expose": true,
+        "multiple": false,
+        "is_flag": false,
+        "count": false,
+        "hidden": false,
+        "help": "Deprecated: use --out-file. Saves the audio to FILE and overwrites it. In 1.0, -o will set the output format."
+      },
+      {
+        "class": "option",
+        "name": "force",
+        "opts": [
+          "--force"
+        ],
+        "secondary_opts": [],
+        "type": {
+          "name": "boolean"
+        },
+        "required": false,
+        "nargs": 1,
         "metavar": null,
         "eager": false,
         "expose": true,
         "multiple": false,
+        "is_flag": true,
+        "count": false,
+        "hidden": false,
+        "help": "With --out-file, overwrite FILE if it already exists."
+      },
+      {
+        "class": "option",
+        "name": "out_file",
+        "opts": [
+          "--out-file"
+        ],
+        "secondary_opts": [],
+        "type": {
+          "name": "text"
+        },
+        "required": false,
+        "nargs": 1,
+        "metavar": "FILE",
+        "eager": false,
+        "expose": true,
+        "multiple": false,
         "is_flag": false,
         "count": false,
         "hidden": false,
-        "help": "Output file path (required if stdout is a terminal)"
+        "help": "Save the audio to FILE. An existing file isn't overwritten unless you add --force."
       },
       {
         "class": "argument",
diff --git a/src/deepctl/_manifest.d/transcribe.json b/src/deepctl/_manifest.d/transcribe.json
index 04fc32a6..5a7f1b6d 100644
--- a/src/deepctl/_manifest.d/transcribe.json
+++ b/src/deepctl/_manifest.d/transcribe.json
@@ -58,6 +58,53 @@
         "hidden": false,
         "help": "Output WebVTT captions instead of plain transcript. In live mode, entries are printed as they arrive. Mutually exclusive with --srt."
       },
+      {
+        "class": "option",
+        "name": "timeout",
+        "opts": [
+          "--timeout"
+        ],
+        "secondary_opts": [],
+        "type": {
+          "name": "float range",
+          "min": 1,
+          "max": null,
+          "min_open": false,
+          "max_open": false,
+          "clamp": false
+        },
+        "required": false,
+        "nargs": 1,
+        "metavar": null,
+        "eager": false,
+        "expose": true,
+        "multiple": false,
+        "is_flag": false,
+        "count": false,
+        "hidden": false,
+        "help": "Seconds to wait at each step (connecting, sending, the response) before giving up. Not a limit on the whole run. Default: 300. Files and URLs only."
+      },
+      {
+        "class": "option",
+        "name": "check_url",
+        "opts": [
+          "--check-url"
+        ],
+        "secondary_opts": [],
+        "type": {
+          "name": "boolean"
+        },
+        "required": false,
+        "nargs": 1,
+        "metavar": null,
+        "eager": false,
+        "expose": true,
+        "multiple": false,
+        "is_flag": true,
+        "count": false,
+        "hidden": false,
+        "help": "Check that the URL responds before transcribing: a HEAD request, then a 1-byte GET if needed. Sends no Deepgram API key."
+      },
       {
         "class": "option",
         "name": "no_validate",
diff --git a/src/deepctl/main.py b/src/deepctl/main.py
index f7695013..5e97e670 100644
--- a/src/deepctl/main.py
+++ b/src/deepctl/main.py
@@ -150,7 +150,20 @@ def main(prog: "str | None" = None) -> None:
         sys.exit(serve())
 
     sys.excepthook = _rich_excepthook
-    from deepctl._cli import run
+    try:
+        from deepctl_core.signals import install_interrupt_handler
+
+        install_interrupt_handler()
+        from deepctl._cli import run
+    except KeyboardInterrupt:
+        # Ctrl-C while the CLI is still loading: cancelled, exit 2, the same
+        # line run() prints (rich may not be loaded yet), and no traceback.
+        try:
+            sys.stderr.write("\nOperation cancelled by user\n")
+            sys.stderr.flush()
+        except (AttributeError, OSError, ValueError):
+            pass
+        sys.exit(2)
 
     run(args, started_at, prog)
 
diff --git a/tests/e2e/conftest.py b/tests/e2e/conftest.py
index c91c1b67..4db30f83 100644
--- a/tests/e2e/conftest.py
+++ b/tests/e2e/conftest.py
@@ -87,15 +87,21 @@ def live_client(monkeypatch):
 
 
 @pytest.fixture
-def feed_stdin(monkeypatch):
+def feed_stdin(monkeypatch, tmp_path, request):
     """Return a helper that pipes raw bytes into the listen command's stdin.
 
-    The stdin streaming path reads ``sys.stdin.buffer`` (via the listen
-    module's ``sys``); swap in a BytesIO-backed fake so an in-process run
-    behaves like ``… | dg listen -``.
+    The live stdin path reads a file descriptor (``_stdin_fd()``, fd 0 in
+    production); point it at a file holding the audio so an in-process run
+    behaves like ``dg listen - < audio.raw``. ``sys.stdin`` is swapped too,
+    so source auto-detection sees a non-TTY.
     """
 
     def _feed(pcm: bytes) -> None:
+        path = tmp_path / "stdin.raw"
+        path.write_bytes(pcm)
+        fd = os.open(path, os.O_RDONLY)
+        request.addfinalizer(lambda: os.close(fd))
+        monkeypatch.setattr("deepctl_cmd_listen.command._stdin_fd", lambda: fd)
         fake_stdin = types.SimpleNamespace(
             buffer=io.BytesIO(pcm),
             isatty=lambda: False,
diff --git a/tests/unit/dependency_allowlist.txt b/tests/unit/dependency_allowlist.txt
new file mode 100644
index 00000000..e8a441c7
--- /dev/null
+++ b/tests/unit/dependency_allowlist.txt
@@ -0,0 +1,71 @@
+# Third-party distributions the 30 lockstep packages may pull in at runtime,
+# on any platform or Python version uv.lock covers (PEP 503 names, sorted).
+# Checked by tests/unit/test_dependency_allowlist.py. Adding a runtime
+# dependency, direct or transitive, means adding it here in the same PR.
+# numpy, ffmpeg-python, future and aiohttp were dropped in 0.5.0 and are
+# refused even if listed.
+# Format: one name per line, optionally followed by flags. The only flag is
+# `floors-only`: the name is reached only when a dependency sits at its
+# declared floor (the lowest-direct CI job), not through uv.lock, and that
+# job checks it is really installed there. Text after "#" is a comment.
+annotated-types
+anyio
+attrs
+backports-tarfile
+certifi
+cffi
+charset-normalizer
+click
+colorama
+cryptography
+deepgram-captions
+deepgram-sdk
+exceptiongroup
+h11
+httpcore
+httpx
+httpx-sse
+idna
+importlib-metadata
+jaraco-classes
+jaraco-context
+jaraco-functools
+jeepney
+jsonschema
+jsonschema-specifications
+keyring
+markdown-it-py
+mcp
+mdurl
+more-itertools
+packaging
+platformdirs
+pycparser
+pydantic
+pydantic-core
+pydantic-settings
+pygments
+pyjwt
+pyparsing floors-only  # via packaging 21.x
+python-dotenv
+python-multipart
+pywin32
+pywin32-ctypes
+pyyaml
+referencing
+requests
+rich
+rpds-py
+secretstorage
+sentry-sdk
+sniffio floors-only  # via older anyio/httpx
+sounddevice
+sse-starlette
+starlette
+toml
+typing-extensions
+typing-inspection
+urllib3
+uvicorn
+websockets
+zipp
diff --git a/tests/unit/test_dependency_allowlist.py b/tests/unit/test_dependency_allowlist.py
new file mode 100644
index 00000000..a479da4c
--- /dev/null
+++ b/tests/unit/test_dependency_allowlist.py
@@ -0,0 +1,282 @@
+"""The third-party closure of the 30 lockstep packages is allowlisted.
+
+Every distribution a plain `pip install deepctl` can pull in, on any
+platform or Python the lock covers, must be named in
+`dependency_allowlist.txt`. A new runtime dependency, direct or transitive,
+fails here until someone adds it on purpose. numpy, ffmpeg-python, future
+and aiohttp were dropped in 0.5.0 (the install diet) and must not come back,
+allowlisted or not.
+
+Two views of the closure are checked:
+
+* the lock: `uv.lock`'s runtime `dependencies` for every lockstep package,
+  across all markers, followed transitively (extras included). This is the
+  same graph the Requires-Dist metadata describes, read without installing.
+* the installed environment: Requires-Dist of the installed lockstep
+  distributions, evaluated for this interpreter and followed transitively.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import sys
+from importlib import metadata
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+if sys.version_info >= (3, 11):
+    import tomllib
+else:  # pragma: no cover - only taken on Python 3.10
+    import tomli as tomllib
+
+REPO = Path(__file__).resolve().parents[2]
+ALLOWLIST = Path(__file__).with_name("dependency_allowlist.txt")
+ROOT_NAME = "deepctl"
+# Versioned on its own, the way an outside plugin would be.
+NOT_LOCKSTEP = {"deepctl-plugin-example"}
+FORBIDDEN = {"numpy", "ffmpeg-python", "future", "aiohttp"}
+
+
+def normalize(name: str) -> str:
+    """PEP 503 normalized distribution name."""
+    return re.sub(r"[-_.]+", "-", name).lower()
+
+
+def lockstep_names(repo: Path = REPO) -> set[str]:
+    """The root and every first-party sibling that versions with it."""
+    names = {ROOT_NAME}
+    for pyproject in sorted((repo / "packages").glob("*/pyproject.toml")):
+        with pyproject.open("rb") as fh:
+            name = normalize(tomllib.load(fh)["project"]["name"])
+        if name not in NOT_LOCKSTEP:
+            names.add(name)
+    return names
+
+
+FLAGS = {"floors-only"}
+#: Set by tests/upgrade/lowest_direct.sh: this process runs in the
+#: environment resolved at the declared floors.
+LOWEST_DIRECT_ENV = "DEEPCTL_LOWEST_DIRECT"
+
+
+def parse_allowlist(path: Path = ALLOWLIST) -> list[tuple[str, frozenset[str]]]:
+    """(name, flags) per entry, in file order, without comments or blanks."""
+    entries = []
+    for number, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
+        fields = line.split("#", 1)[0].split()
+        if not fields:
+            continue
+        name, flags = fields[0], frozenset(fields[1:])
+        unknown = flags - FLAGS
+        if unknown:
+            raise ValueError(f"{path.name}:{number}: unknown flag(s) {sorted(unknown)}")
+        entries.append((name, flags))
+    return entries
+
+
+def read_allowlist(path: Path = ALLOWLIST) -> list[str]:
+    """Allowlisted names, in file order."""
+    return [name for name, _ in parse_allowlist(path)]
+
+
+def floors_only(path: Path = ALLOWLIST) -> set[str]:
+    """Entries reached only at declared floors, not through uv.lock."""
+    return {name for name, flags in parse_allowlist(path) if "floors-only" in flags}
+
+
+def lock_closure(lock: dict[str, Any], roots: set[str]) -> set[str]:
+    """Third-party names reachable from `roots` through runtime deps."""
+    by_name: dict[str, list[dict[str, Any]]] = {}
+    for package in lock["package"]:
+        by_name.setdefault(normalize(package["name"]), []).append(package)
+
+    seen: set[tuple[str, str | None]] = set()
+    todo: list[tuple[str, str | None]] = [(root, None) for root in roots]
+    reached: set[str] = set()
+    while todo:
+        name, extra = todo.pop()
+        if (name, extra) in seen:
+            continue
+        seen.add((name, extra))
+        reached.add(name)
+        for package in by_name.get(name, []):
+            if extra is None:
+                deps = package.get("dependencies", [])
+            else:
+                deps = package.get("optional-dependencies", {}).get(extra, [])
+            for dep in deps:
+                dep_name = normalize(dep["name"])
+                todo.append((dep_name, None))
+                todo.extend((dep_name, e) for e in dep.get("extra", []))
+    return reached - roots
+
+
+def installed_closure(roots: set[str]) -> set[str]:
+    """Third-party names reachable from the installed `roots` through
+    Requires-Dist, with markers evaluated for this interpreter."""
+    from packaging.requirements import Requirement
+
+    seen: set[tuple[str, str]] = set()
+    todo: list[tuple[str, str]] = [(root, "") for root in roots]
+    reached: set[str] = set()
+    while todo:
+        name, extra = todo.pop()
+        if (name, extra) in seen:
+            continue
+        seen.add((name, extra))
+        try:
+            requires = metadata.requires(name) or []
+        except metadata.PackageNotFoundError:
+            # A marker can name a dist this platform never installs.
+            continue
+        reached.add(name)
+        for raw in requires:
+            req = Requirement(raw)
+            if req.marker is not None and not req.marker.evaluate({"extra": extra}):
+                continue
+            dep = normalize(req.name)
+            todo.append((dep, ""))
+            todo.extend((dep, e) for e in req.extras)
+    return reached - roots
+
+
+def violations(closure: set[str], allowlist: set[str]) -> list[str]:
+    """Why the closure fails: unlisted names, then forbidden ones."""
+    problems = [
+        f"{name} is a runtime dependency but is not in {ALLOWLIST.name}"
+        for name in sorted(closure - allowlist)
+    ]
+    problems += [
+        f"{name} was dropped in 0.5.0 and must not come back"
+        for name in sorted(closure & FORBIDDEN)
+    ]
+    return problems
+
+
+@pytest.fixture(scope="module")
+def lock() -> dict[str, Any]:
+    with (REPO / "uv.lock").open("rb") as fh:
+        return tomllib.load(fh)
+
+
+@pytest.fixture(scope="module")
+def roots() -> set[str]:
+    names = lockstep_names()
+    assert len(names) == 30, sorted(names)
+    return names
+
+
+def test_allowlist_is_sorted_unique_and_normalized() -> None:
+    entries = read_allowlist()
+    assert entries == sorted(set(entries)), "keep the allowlist sorted, no repeats"
+    assert all(entry == normalize(entry) for entry in entries)
+    assert not FORBIDDEN & set(entries)
+
+
+def test_locked_closure_is_allowlisted(lock: dict[str, Any], roots: set[str]) -> None:
+    closure = lock_closure(lock, roots)
+    assert violations(closure, set(read_allowlist())) == []
+
+
+def test_allowlist_has_no_stale_entries(lock: dict[str, Any], roots: set[str]) -> None:
+    """An entry nothing depends on any more is removed, so the list stays a
+    true picture of what installs."""
+    stale = set(read_allowlist()) - lock_closure(lock, roots) - floors_only()
+    assert not stale, f"no longer a runtime dependency: {sorted(stale)}"
+
+
+def test_installed_closure_is_allowlisted(roots: set[str]) -> None:
+    missing = sorted(r for r in roots if not _installed(r))
+    if missing:
+        pytest.skip(f"lockstep packages not installed here: {missing}")
+    closure = installed_closure(roots)
+    assert violations(closure, set(read_allowlist())) == []
+
+
+def test_floors_only_entries_are_installed_at_the_floors(roots: set[str]) -> None:
+    """In the lowest-direct environment, every floors-only entry must really
+    be pulled in; one that is not is stale and comes off the list."""
+    if os.environ.get(LOWEST_DIRECT_ENV) != "1":
+        pytest.skip(f"only in the lowest-direct job ({LOWEST_DIRECT_ENV}=1)")
+    missing = sorted(floors_only() - installed_closure(roots))
+    assert not missing, f"floors-only but not reached at the floors: {missing}"
+
+
+def test_unknown_flags_are_refused(tmp_path: Path) -> None:
+    listing = tmp_path / "allow.txt"
+    listing.write_text("idna\nsix floors-onyl  # typo\n", encoding="utf-8")
+    with pytest.raises(ValueError, match="unknown flag"):
+        parse_allowlist(listing)
+
+
+def test_flags_and_comments_parse(tmp_path: Path) -> None:
+    listing = tmp_path / "allow.txt"
+    listing.write_text("# header\nidna\nsix floors-only  # why\n\n", encoding="utf-8")
+    assert parse_allowlist(listing) == [
+        ("idna", frozenset()),
+        ("six", frozenset({"floors-only"})),
+    ]
+
+
+def _installed(name: str) -> bool:
+    try:
+        metadata.distribution(name)
+    except metadata.PackageNotFoundError:
+        return False
+    return True
+
+
+# -- negative fixtures: the check catches what it is for -------------------
+
+
+def _planted(lock: dict[str, Any], extra_dep: str) -> dict[str, Any]:
+    """A copy of the lock where deepctl-core gains `extra_dep`, which in turn
+    depends on six (a transitive addition)."""
+    packages = []
+    for package in lock["package"]:
+        package = dict(package)
+        if package["name"] == "deepctl-core":
+            package["dependencies"] = [
+                *package.get("dependencies", []),
+                {"name": extra_dep},
+            ]
+        packages.append(package)
+    packages.append(
+        {"name": extra_dep, "version": "1.0", "dependencies": [{"name": "six"}]}
+    )
+    packages.append({"name": "six", "version": "1.17.0"})
+    return {**lock, "package": packages}
+
+
+def test_a_planted_dependency_fails(lock: dict[str, Any], roots: set[str]) -> None:
+    allowlist = set(read_allowlist())
+    closure = lock_closure(_planted(lock, "left-pad-py"), roots)
+    problems = violations(closure, allowlist)
+    assert any(p.startswith("left-pad-py ") for p in problems)
+    if "six" not in allowlist:
+        assert any(p.startswith("six ") for p in problems)
+
+
+@pytest.mark.parametrize("dropped", sorted(FORBIDDEN))
+def test_a_dropped_dependency_fails_even_if_allowlisted(
+    lock: dict[str, Any], roots: set[str], dropped: str
+) -> None:
+    allowlist = set(read_allowlist()) | {dropped}
+    closure = lock_closure(_planted(lock, dropped), roots)
+    assert violations(closure, allowlist | {"six"}) == [
+        f"{dropped} was dropped in 0.5.0 and must not come back"
+    ]
+
+
+def test_extras_are_followed(lock: dict[str, Any], roots: set[str]) -> None:
+    """A dependency requested with an extra pulls in that extra's deps."""
+    planted = _planted(lock, "pkg-with-extra")
+    for package in planted["package"]:
+        if package["name"] == "deepctl-core":
+            package["dependencies"][-1] = {"name": "pkg-with-extra", "extra": ["x"]}
+        if package["name"] == "pkg-with-extra":
+            package["optional-dependencies"] = {"x": [{"name": "only-via-extra"}]}
+    assert "only-via-extra" in lock_closure(planted, roots)
diff --git a/tests/unit/test_entry_point.py b/tests/unit/test_entry_point.py
index 7490c51b..52d8cca2 100644
--- a/tests/unit/test_entry_point.py
+++ b/tests/unit/test_entry_point.py
@@ -253,3 +253,30 @@ def test_import_httpx_skips_its_cli(self, tmp_path: Path) -> None:
         proc = _run([sys.executable, "-c", code], tmp_path)
         assert proc.returncode == 0, proc.stderr
         assert proc.stderr.split()[-3:] == ["False", "True", "True"], proc.stderr
+
+
+class TestInterruptWhileLoading:
+    def test_ctrl_c_while_the_cli_loads_is_cancelled_quietly(
+        self, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+    ) -> None:
+        """A Ctrl-C before run() is entered is cancelled: exit 2, run()'s
+        cancel line, no traceback."""
+        from deepctl import main as entry
+
+        class Interrupts:
+            def find_spec(self, name: str, *args: object) -> None:
+                if name == "deepctl._cli":
+                    raise KeyboardInterrupt
+                return None
+
+        monkeypatch.delitem(sys.modules, "deepctl._cli", raising=False)
+        monkeypatch.setattr(sys, "meta_path", [Interrupts(), *sys.meta_path])
+        monkeypatch.setattr(sys, "argv", ["dg", "speak", "hi"])
+        monkeypatch.setattr(sys, "excepthook", sys.excepthook)
+        with pytest.raises(SystemExit) as exc:
+            entry.main()
+        assert exc.value.code == 2
+        captured = capsys.readouterr()
+        assert "Traceback" not in captured.err
+        assert captured.err == "\nOperation cancelled by user\n"
+        assert captured.out == ""
diff --git a/tests/upgrade/lowest_direct.sh b/tests/upgrade/lowest_direct.sh
index 3b4ddd9f..a5b0edb3 100755
--- a/tests/upgrade/lowest_direct.sh
+++ b/tests/upgrade/lowest_direct.sh
@@ -20,6 +20,8 @@ DIST=$(cd "$1" && pwd); PY=${2:-python3}; PHASE=${3:-all}
 HERE=$(cd "$(dirname "$0")" && pwd)
 ENV=${LOWEST_ENV:-${TMPDIR:-/tmp}/lowest-direct}
 export DEEPCTL_TELEMETRY_DISABLED=1 DEEPCTL_TELEMETRY_DSN=http://k@127.0.0.1:9/1
+# tests/unit/test_dependency_allowlist.py checks its floors-only entries here.
+export DEEPCTL_LOWEST_DIRECT=1
 TEST_TOOLS="pytest pytest-asyncio pytest-mock pytest-timeout responses"
 
 if [ "$PHASE" != test ]; then
diff --git a/uv.lock b/uv.lock
index 18f6c53c..a786edc3 100644
--- a/uv.lock
+++ b/uv.lock
@@ -44,207 +44,6 @@ members = [
     "deepctl-telemetry",
 ]
 
-[[package]]
-name = "aiohappyeyeballs"
-version = "2.7.1"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/ce/f4/eec0465c2f67b2664688d0240b3212d5196fd89e741df67ddb81f8d35658/aiohappyeyeballs-2.7.1.tar.gz", hash = "sha256:065665c041c42a5938ed220bdcd7230f22527fbec085e1853d2402c8a3615d9d", size = 24757, upload-time = "2026-07-01T17:11:55.501Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/71/43/1947f06babed6b3f1d7f38b0c767f52df66bfb2bc10b468c4a7de9eceff2/aiohappyeyeballs-2.7.1-py3-none-any.whl", hash = "sha256:9243213661e29250eb41368e5daa826fc017156c3b8a11440826b2e3ed376472", size = 15038, upload-time = "2026-07-01T17:11:54.055Z" },
-]
-
-[[package]]
-name = "aiohttp"
-version = "3.14.4"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "aiohappyeyeballs" },
-    { name = "aiosignal" },
-    { name = "async-timeout", marker = "python_full_version < '3.11'" },
-    { name = "attrs" },
-    { name = "frozenlist" },
-    { name = "multidict" },
-    { name = "propcache" },
-    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
-    { name = "yarl" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/93/2f/6a91adaa2dc26877d6ed2f54c0370c8910f019db7d77c5c6a194611e93ea/aiohttp-3.14.4.tar.gz", hash = "sha256:831fc5bd39ec2517851e348f613ddb5447a47cf4b71cb09845af7ad7ed45d8f9", size = 8077839, upload-time = "2026-10-05T17:43:48.309Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/b3/08/290e4be6e3ed239751c446505c324406a4ae8a82a15009a12a3c550f18d9/aiohttp-3.14.4-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:dea3b3653c1d0d6babd8ce09cb9e5a7776864315d9cfb1c569f926389874a261", size = 834853, upload-time = "2026-10-05T17:37:45.079Z" },
-    { url = "https://files.pythonhosted.org/packages/81/81/ed5e04508ba1fcf9a34e0449c78009956e8256f62ebef708e2948594cf94/aiohttp-3.14.4-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:3099a389e5b5900fc79c6f613015ff3f8fa06a519744e6001cc68a31ba418cac", size = 560957, upload-time = "2026-10-05T17:37:47.497Z" },
-    { url = "https://files.pythonhosted.org/packages/90/28/1a91411c53704db0481cc64b0f0c9465aa9d738856abdcaa3a5bbbe18180/aiohttp-3.14.4-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:70247156fc76e92919f9aacb820556cb30289a54784299a31714d030bb604d84", size = 553475, upload-time = "2026-10-05T17:37:49.099Z" },
-    { url = "https://files.pythonhosted.org/packages/cf/2e/1038f3fa8832f9f4bed0f9f751f70dbc52bc4a09c66788f97bbfb0ce3d88/aiohttp-3.14.4-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:fdf2d2a6ad402797422949f4a200a60d43e3a021695c8a7804aa1d5bbef22652", size = 1845211, upload-time = "2026-10-05T17:37:50.728Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/54/e2253f17604c5c1c69a05e3c12400b51cd6a5fb32d7175592114d8c7a470/aiohttp-3.14.4-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:ba835fad8d4b5eaea0d34f9461cf499737a720a5f8bc6768d2f6d98a1d3ba8b5", size = 1814629, upload-time = "2026-10-05T17:37:52.481Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/ef/7bd1e45db925376720555d7268c2d642b113105263d37a522e41e1ba3a6c/aiohttp-3.14.4-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:0d4415ca5c9c8b24bc2f5733f870d4eab4929e680203559ba60131dd1a27852a", size = 1898528, upload-time = "2026-10-05T17:37:54.078Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/40/26d09668e7e0cadc16027566765aa4ce26e8a41276bad6764848c8b04d11/aiohttp-3.14.4-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f6757e02c2c2b0d7985f57be87cf4a7c5b35708f849e1feaea3f77656ddb9dff", size = 2024385, upload-time = "2026-10-05T17:37:55.626Z" },
-    { url = "https://files.pythonhosted.org/packages/73/38/0f1c4aab1cc9518e1bf874e2481e59e541b3e32330b9542e52bb2712f86f/aiohttp-3.14.4-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2a950bd8418ef54eccf5f9f517f08e37c1adab4bc50a470a0422ee1cc1032e29", size = 1859130, upload-time = "2026-10-05T17:37:57.342Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/98/09d5998ba4b5fe9f0cb97d794fab9d1b3d8245c5ec6a5fb84e41a8cec142/aiohttp-3.14.4-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:34cf6f2fe4fc1d7183e8cc0d8c48bbdda828a740bc372d8278126149714d343c", size = 1714768, upload-time = "2026-10-05T17:37:58.831Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/63/39d01a74d525d6443084d47ad4aa8c719f44a030149d03566f3761527465/aiohttp-3.14.4-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:bc0fbe4f79c3b156d754dd062718ffe404c3b31ca878d9d2b88ecdbc72ef8369", size = 1813228, upload-time = "2026-10-05T17:38:00.611Z" },
-    { url = "https://files.pythonhosted.org/packages/39/6b/183d7b969bdb7892e86af74147b4afedbb4e03b8cad5006e41aa2034c288/aiohttp-3.14.4-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:d3d50a5a07a2b31a4369b86dd4a3acf3c2577c45091dbd5e884b198dec56480b", size = 1831844, upload-time = "2026-10-05T17:38:02.272Z" },
-    { url = "https://files.pythonhosted.org/packages/2c/be/4c6df02b62083efd3f008974cf9016a4afd2023f5a9d2c3fd55499fcbac6/aiohttp-3.14.4-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:de15c46a63f46da881d219e44a04778c40114c756e5575b5ea38143b20eb3713", size = 1868738, upload-time = "2026-10-05T17:38:03.831Z" },
-    { url = "https://files.pythonhosted.org/packages/86/21/406be8b0cf1105a35a6a6da16a95796be39b354e29bfca0d1626d822835f/aiohttp-3.14.4-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:caa4c0fc9b25e8c679baac68337e9c00deb6baf6601fe6f07e8511469cc1ceba", size = 1700006, upload-time = "2026-10-05T17:38:05.631Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/e6/beac98020ea0885ea1ee3b2ef59ec952405590fe2ccef2fa4ef7614c3c2b/aiohttp-3.14.4-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:3647f8c090632c70abb1e80826e4ee24faea3f895f0283b60e91a0b17aea5e34", size = 1889997, upload-time = "2026-10-05T17:38:07.578Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/89/d608dd9571988a529c7fead5bc79ad36b56fd52bad7941f40774acbc87e9/aiohttp-3.14.4-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:3f3e8030169843fb652a60a3d32c206e03f260198aa398985a48b41cd7e42f0a", size = 1844619, upload-time = "2026-10-05T17:38:10.003Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/7d/7f51e6338d2c74b75173ee66fcb50d778d5407c32f34e76ef1c4b25d0d75/aiohttp-3.14.4-cp310-cp310-win32.whl", hash = "sha256:a1205cbdddfca1428129bb6d23e0b292b09e681df951fa828145d83a63ffc0ca", size = 489598, upload-time = "2026-10-05T17:38:11.795Z" },
-    { url = "https://files.pythonhosted.org/packages/33/2a/3434e450a4395fc07f3070d6ac24553f0b170b173e949216b1723395028c/aiohttp-3.14.4-cp310-cp310-win_amd64.whl", hash = "sha256:e90980e0454a043f81b435309a089ac5deab883779557eb58d004f33990f61e4", size = 512204, upload-time = "2026-10-05T17:38:13.309Z" },
-    { url = "https://files.pythonhosted.org/packages/53/c0/1d89303cf1bea5418268c1cb82b872661bad027e5fd785c2d30d0a31ee6f/aiohttp-3.14.4-cp310-cp310-win_arm64.whl", hash = "sha256:e63eecf9a4b670a24055d5c0486128af16f83b02d9817abd685d3238940f8752", size = 492725, upload-time = "2026-10-05T17:38:14.825Z" },
-    { url = "https://files.pythonhosted.org/packages/81/e3/998dc75634ecd2a24f33bab480b57313059d55bcadff8825a46b7c80a8af/aiohttp-3.14.4-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:eb0093ca0817019d539f0d27bdf98e823944e05bb7efd9d2337a45b92e4d1b06", size = 832892, upload-time = "2026-10-05T17:38:16.373Z" },
-    { url = "https://files.pythonhosted.org/packages/58/c9/9bacc26397854440d169f70ae00ea51721f504611d3a64cf043643792c32/aiohttp-3.14.4-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:f482dc9c8309801b4259dd218609d3dae0a7bcdedeac56d90500eabaa0c23465", size = 559893, upload-time = "2026-10-05T17:38:18.74Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/f3/90c5856014328a8b1e9a753de794edea282182b776ff65f0602ad4ffa520/aiohttp-3.14.4-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:aa800bb7c1d00e166493931f2ddacb982db913292503dc2f4884db1f2bc5f105", size = 552850, upload-time = "2026-10-05T17:38:20.385Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/88/e71c29ce6daa78fcee0feb1992f0fdc408f09f42c3311b1f1c68c36f16ea/aiohttp-3.14.4-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d90e4dae71b26597f6d1fd12af7d092ae67551edf0e524b73e0687214b79ee33", size = 1928941, upload-time = "2026-10-05T17:38:22.218Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/4f/f0f3bebfa521a2ce5fd4302c937701cbc50cd6d908beaa597388639b0b98/aiohttp-3.14.4-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:5b681054b8c3b86aa6a0384b6ad7f5cb78dccbabab1f4a3a6793f98ad1378959", size = 1882092, upload-time = "2026-10-05T17:38:24.016Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/0d/5df041fd25dceb4f4cafbbee49bb2c1e2d54a91aedecaf03b77cbb404c44/aiohttp-3.14.4-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:6dfe80b41bcf8d80d2125fb99a171adeb86db2fcb35c1a68e0226acba0ba7f03", size = 1986051, upload-time = "2026-10-05T17:38:26.022Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/07/e95eddafffef7c3a74446f67ac4e477a49cec2c78f2ab6c86d1acfd90d2d/aiohttp-3.14.4-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:71e4a59c6a8c5a6ae8b0b696c32635913e8f526cc01448762eaf5a3c59df8a4f", size = 2107840, upload-time = "2026-10-05T17:38:28.112Z" },
-    { url = "https://files.pythonhosted.org/packages/da/6c/1f83990fea249dcb10f48086726953546efc9199c96b6be7114532ac361f/aiohttp-3.14.4-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f887c3b7fb3058fc1ccd917f52078540c18d938d12018cb9edd64b6811d20c57", size = 1930721, upload-time = "2026-10-05T17:38:30.046Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/d1/48184a186ea26df4f81dd466144dcab7f9cdd1e131bfee0f0e41278c6f0d/aiohttp-3.14.4-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0da4525e9ba145a11617d2cd7e44fe1acaf471f9c72a0cad28e72879c1020fbb", size = 1774508, upload-time = "2026-10-05T17:38:31.8Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/ef/a9ec758c6d3850453838c31b56d1e4499eb47c80883753a12dcb203f9afa/aiohttp-3.14.4-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:f7e8d3c5caa44fdbee3eba1aa1417aa58c74c95d4089fe3c451911117fcbb2f3", size = 1902311, upload-time = "2026-10-05T17:38:33.791Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/49/9a2be54900f2dea6e63bbf9628fced604686a2e301130ccde0b1aa2e7e53/aiohttp-3.14.4-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:09092cf906c18c824b6b16881da5a89cc9cfa9b15344e496bcf880e9045bee33", size = 1912107, upload-time = "2026-10-05T17:38:35.614Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/2b/151254abfc0fe5cbb8e6c41ad04d52122db0af176fb31dbf3bc44e081bda/aiohttp-3.14.4-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:dfd144837e92264878bba6d3a7ffa8206668b21e87748740afd45d193e48c87e", size = 1960207, upload-time = "2026-10-05T17:38:37.322Z" },
-    { url = "https://files.pythonhosted.org/packages/23/99/92c8dce336ac5784755a3144623528516f2e3b6b4871d02cad5a0642ae66/aiohttp-3.14.4-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:9413cffe4e0d654b9b524f9c99dde8cbdb37e0ed9a2c4edd2e63adbac6b374e8", size = 1760168, upload-time = "2026-10-05T17:38:39.214Z" },
-    { url = "https://files.pythonhosted.org/packages/66/3e/f05fd8d1a9595730db8d522882eea76429b9be2ed5337609f7c6e3d9d49c/aiohttp-3.14.4-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:f50d719f97ba488dfb8e306cf8c8cc172ff0683ec0af53917b288229aa555ba5", size = 1979946, upload-time = "2026-10-05T17:38:40.927Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/14/8941aa73ffceabc2a0eb26878b4f1b2958fb7b5358f97cc49b1c00ed9258/aiohttp-3.14.4-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:68ed4824d96b7afec1f3a8d7fba190fe282718041c5772e20298003e1e3e5d66", size = 1923375, upload-time = "2026-10-05T17:38:43.184Z" },
-    { url = "https://files.pythonhosted.org/packages/18/b5/ef275b63c8bfe0a21e7e8d3ef0e67c4745ed403f1894fe5205057cedd3b9/aiohttp-3.14.4-cp311-cp311-win32.whl", hash = "sha256:d7a41d1427136828e6b11d3f3fd194d4357d5205a5b610be7ae07b1ba52ab974", size = 488414, upload-time = "2026-10-05T17:38:44.978Z" },
-    { url = "https://files.pythonhosted.org/packages/e7/0b/21bdd70a1e072222d9dbd96bed4fbed26f7c46c5a20af11b78d32fd049d6/aiohttp-3.14.4-cp311-cp311-win_amd64.whl", hash = "sha256:2efbdb87e79d596325c4eefaef0f4495d701145e882351310ebc538e854dc7a3", size = 512755, upload-time = "2026-10-05T17:38:47.036Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/4c/bb324a7d20a9598187bb028ca8d6bcf66c63589c8632420919dd576964ed/aiohttp-3.14.4-cp311-cp311-win_arm64.whl", hash = "sha256:ac6e6f90d9360e460c873f945f11dc8698db0a71fec6612823f1aaaab2c11faa", size = 492960, upload-time = "2026-10-05T17:38:49.006Z" },
-    { url = "https://files.pythonhosted.org/packages/22/02/db5935d45347fa8ede56b777930740fb0e72bbb4473ddb6ff8541f6f2afa/aiohttp-3.14.4-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:55b0b335982b0db7117dff7f6a8e3aad43c4105f9e392ca04f9fc8d958a95cce", size = 817689, upload-time = "2026-10-05T17:38:50.69Z" },
-    { url = "https://files.pythonhosted.org/packages/e6/56/f00aa46127e6342f019d567853eeeb932e04fb9b9424b5fb981ad68f4178/aiohttp-3.14.4-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:2d0d8e435582b0d53009dac99e26a3d2be932ed7c9dbfcfc70f3fce1cf943bd5", size = 549599, upload-time = "2026-10-05T17:38:52.525Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/bc/825c09b09962253a2103e4a88c04374ee939c0c8ea31c270daa0308efb07/aiohttp-3.14.4-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:bf734016932d68e1324cfb638cac7a0866a83933a33badf15e836a7e24efb8c0", size = 548132, upload-time = "2026-10-05T17:38:54.629Z" },
-    { url = "https://files.pythonhosted.org/packages/40/80/8a1bc8036540fe7cb38219cc5c0aa67d32e9068165725e8199ea8200b08b/aiohttp-3.14.4-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:322e3d741b3133bcbb981a41d4f9b8ac3545c18de49c662c2b1f4e1c770b98ad", size = 1898485, upload-time = "2026-10-05T17:38:56.439Z" },
-    { url = "https://files.pythonhosted.org/packages/3c/fe/65b464d8520ace0d65b4ca69bc9abe175f842c8ce8d1522d363d9669903f/aiohttp-3.14.4-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:15a3bb5f90a4e515071f3617a45dfe26560beb834a6b6e108cdf4bc9e9719ec3", size = 1875334, upload-time = "2026-10-05T17:38:58.536Z" },
-    { url = "https://files.pythonhosted.org/packages/be/51/9c583be502720e927560a8414f4dfb7c7de41945e1a30ccf7003b93c6f85/aiohttp-3.14.4-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:6c044e52df1a466af82cad3518c92ea80cc4ddcfea86966ff083bb34bab29bf4", size = 1937772, upload-time = "2026-10-05T17:39:00.376Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/3d/b56512df7ea9cbb5f59099a6b375088dd578356a5a3fb27198ab82e19832/aiohttp-3.14.4-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d613d7d51bf06fe9a5e3aab86ce06d835bb0ceb1a31ea9e8766df4a403ae62a6", size = 2066220, upload-time = "2026-10-05T17:39:02.54Z" },
-    { url = "https://files.pythonhosted.org/packages/11/6c/a7a42701d9ea319140a3d44a24ec72a00b0b46d1b899b26d8a705e65bdd8/aiohttp-3.14.4-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c5e93ab6e6330dce40f5b43996f1fc5f2543296d263a5e4b59ff09e73870b7d8", size = 1922895, upload-time = "2026-10-05T17:39:04.638Z" },
-    { url = "https://files.pythonhosted.org/packages/77/04/f8337bd824ca3fe3968d34dc5037ace1c4872551c4621f8266239311d301/aiohttp-3.14.4-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:20134dc8e68c67e7478124d516449428684c0545b2d3faa575691c8bcbd56678", size = 1712589, upload-time = "2026-10-05T17:39:06.671Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/a6/d20e2c940b592d7c4a21690889dbff64fe0ca3facd9190696368694e1488/aiohttp-3.14.4-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:f0daef5ef012369dddc391c61f604111424aa9a96313a69fb899018b09d1b01e", size = 1862251, upload-time = "2026-10-05T17:39:08.523Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/e4/d50edd5ae5d024b380a8e892e333840bb22967a9eb9c8492108a403f678a/aiohttp-3.14.4-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:19290a108de0718b73bc69b86e788975c6a59855c671ebe2a98a07a6f968328f", size = 1895155, upload-time = "2026-10-05T17:39:10.305Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/d3/f36f2931f807ccf8437ec15e8f8bfaa4748d4792639401cc767a866abaa0/aiohttp-3.14.4-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:1494877625baeffab669f4a25a09ec4eea721b49e35363081a2a8e4231fe141f", size = 1906623, upload-time = "2026-10-05T17:39:12.411Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/0a/94821b711493142bf5e11c27b0d7502776778f7792c77ecc6647357d20c1/aiohttp-3.14.4-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:a779ce4bf099ce4ad2cdfed62f1ca536d435f53237c54ff40172fddada24d1b5", size = 1698932, upload-time = "2026-10-05T17:39:14.446Z" },
-    { url = "https://files.pythonhosted.org/packages/d9/76/3d5a0d28362f0053c1c457024749911932481e8fd105fddf8305b1f93c81/aiohttp-3.14.4-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:0b4cec9fca876e2d4f4c6cb32b177390132d04618867689f43fefabf3f5c3980", size = 1934528, upload-time = "2026-10-05T17:39:16.354Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/51/9784a21dc05d2e0f6acaf864f16db53dab0fbd7b0753cef168601eacb012/aiohttp-3.14.4-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:217707313e23aedde9bea67cf8365c7b138b549ae179121ef3f476cf67e3173a", size = 1901984, upload-time = "2026-10-05T17:39:18.299Z" },
-    { url = "https://files.pythonhosted.org/packages/44/4f/f98c88703e6d620243aa08473a946ca4e3756b6288690e38f0d9f9c1d007/aiohttp-3.14.4-cp312-cp312-win32.whl", hash = "sha256:18a9fb9a3f6e6e63f4d27f9adeef313a2d3c69a84d31170a844623824e722534", size = 480278, upload-time = "2026-10-05T17:39:20.206Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/bc/8555013f84b53e4fdde423131b641af50e822c6d7d9118b24c52b31f6900/aiohttp-3.14.4-cp312-cp312-win_amd64.whl", hash = "sha256:69dcb02d33dfe415d5ee342cc63b7d320efcaf4b761701c7bd7bfb91c715481a", size = 506317, upload-time = "2026-10-05T17:39:22.706Z" },
-    { url = "https://files.pythonhosted.org/packages/21/3f/ca5bad7bfdaa7ddca053a044a1c7c0d4f3ad9d1f12f96dcab10bfb9c50e7/aiohttp-3.14.4-cp312-cp312-win_arm64.whl", hash = "sha256:d36b0263e7c2fbf1750b9f35d4e7e48b0442d8c45e4a89e3e74168821fb014bb", size = 487683, upload-time = "2026-10-05T17:39:24.482Z" },
-    { url = "https://files.pythonhosted.org/packages/23/ec/7fee140da700ec3f5aa5e0fd2319f67be5e86de197e2384d27e5e6209e0e/aiohttp-3.14.4-cp313-cp313-android_24_arm64_v8a.whl", hash = "sha256:264b5a7568306590c44ae4a0237ad1715e35d447ea44ebf324e4c8fd9f78f67a", size = 539114, upload-time = "2026-10-05T17:39:26.322Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/04/930c01ce9e186e787046433d7dc5b45b188885f8406c14b58435b4431974/aiohttp-3.14.4-cp313-cp313-android_24_x86_64.whl", hash = "sha256:17e5d7c7775d8dd8e894c7ef6ebfa26509de36868a9a6c7c4fcfaf6a1bf43d60", size = 553514, upload-time = "2026-10-05T17:39:28.104Z" },
-    { url = "https://files.pythonhosted.org/packages/2c/d7/983e3cea81c07e95f35d34da4d1e182b5c05489c49b7560b198a83f0da79/aiohttp-3.14.4-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:e91dc8fe9cbd052d16f7f1267e285cf8bbac4d2194bd5741f05ef201c77ed09e", size = 521381, upload-time = "2026-10-05T17:39:30.419Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/2d/80baed11659093883f51245755105557d3253e45bd0b693d70df0059d68b/aiohttp-3.14.4-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:8df6157d31703972aec9e3b93963f039ff06318301e30b007c3e941ff8a7ac42", size = 528347, upload-time = "2026-10-05T17:39:32.344Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/18/bfda255c311096c08dab26dc65f3d219f090df37dc5f5f6345f8c3aefc1f/aiohttp-3.14.4-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:220912b351549dc736c59d104dc443fa615753102bb778a4e98f86e4d94bff6a", size = 539914, upload-time = "2026-10-05T17:39:34.265Z" },
-    { url = "https://files.pythonhosted.org/packages/51/fc/3b6ca6117c0c42481d719411fff7b5d3970ebd906543d3dc1ba40fe2462f/aiohttp-3.14.4-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:2efa42b39bb3f524d5eca3760639b584afdd1143a6b047fda29910ffb75e4993", size = 813997, upload-time = "2026-10-05T17:39:36.061Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/f6/86e3e02a9712aadc1ae0a1076bb2d1adf3d9addfe5542a28190c8f9b6d9b/aiohttp-3.14.4-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:7e7356059c8262d2c1fd95242e2b7b70fbc6eee3135bf470049cbec3e968b5b0", size = 548058, upload-time = "2026-10-05T17:39:38.109Z" },
-    { url = "https://files.pythonhosted.org/packages/85/7e/6b9c2e271419d40ca76589613b3c7ab185fd3050a407bd2565b6aa46f695/aiohttp-3.14.4-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:fac247d0cc956d732df1211ac2d8a9999ec8dc1a92a90401de9d52e4ead546f7", size = 545933, upload-time = "2026-10-05T17:39:40.193Z" },
-    { url = "https://files.pythonhosted.org/packages/14/fc/33d6e24a5f8ac32423230088c415e2a1c6efee23d902b62f20506631e40b/aiohttp-3.14.4-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6e2eb0f8b03b4f2bd154ed8cf7c1a119a1ad04808c258bf58f90138c83b8c6d5", size = 1888265, upload-time = "2026-10-05T17:39:42.182Z" },
-    { url = "https://files.pythonhosted.org/packages/8d/e8/2eca1d468d83a514621d1280f9992d08649191db2028c9236b4edfa7c723/aiohttp-3.14.4-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:7fbe827d27e0e369fd7bb88ceeaa5b46ea006e73e015b9dd77e3723a53162293", size = 1872300, upload-time = "2026-10-05T17:39:44.195Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/f6/5872983de71b0214acdfb86822f5cca295b39be4832ec589fa224aee0f6c/aiohttp-3.14.4-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a70387146d03af9f047c629b71aa27d9594b3b31ec4c9c91e1a73d0d8bf38e0e", size = 1926213, upload-time = "2026-10-05T17:39:46.199Z" },
-    { url = "https://files.pythonhosted.org/packages/ee/65/ebfefa11a546c33c717af63c67868408ecf0b33b23a9d75669af95485407/aiohttp-3.14.4-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:0d0934926fc65744e2fdd44ce68b2d79d5ee608a1e23f0596b35dd696519bb7c", size = 2056609, upload-time = "2026-10-05T17:39:48.221Z" },
-    { url = "https://files.pythonhosted.org/packages/69/c0/70667e82ec041f4122a17afce711bbcf94a71bec5888b69a49aed8817be2/aiohttp-3.14.4-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ff4b366510c733974adb7a4102c094e4a6308e6f369315a4cf14d2d0a619cf82", size = 1914740, upload-time = "2026-10-05T17:39:50.304Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/86/559e9dfea676206b20737d7ccb5b3716bff5e58d2a8d53682e5301724cd1/aiohttp-3.14.4-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:85fac7c99e0ac3dcbd6ae1c33774e0603bfc732ddb967a6fce4a731103c1888e", size = 1703390, upload-time = "2026-10-05T17:39:52.385Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/91/c98897d4cf23e120b2f3980042835cb34c86bbe3c653f3eaacf4bf986349/aiohttp-3.14.4-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ef1e9c3b4a2300023a5dc865889ce532cfaf6798ba4ef78fbbefe738a9d23efa", size = 1852642, upload-time = "2026-10-05T17:39:54.391Z" },
-    { url = "https://files.pythonhosted.org/packages/14/13/0258f352cb2c236f358a5b57d138e15fa2566e17accc0758d968dbf2ceb6/aiohttp-3.14.4-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:97e65916588be0f952b3307aaa8460c0771fa98dbea2dd27dabc9f5d84d53c3b", size = 1890616, upload-time = "2026-10-05T17:39:56.466Z" },
-    { url = "https://files.pythonhosted.org/packages/64/3c/f43e294ce1a06d1234a97bd862c1aa31acfa1a0eea3786c22fd0dc1ea731/aiohttp-3.14.4-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:840775cb39a9424f9edf142133a1192263ac5bd79117ad2a16602cef6a0c1e9d", size = 1896638, upload-time = "2026-10-05T17:39:58.585Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/f7/ce1e3a85b73d05037d729d3d32da7d6959b9e433435e9abd46c2fb38410f/aiohttp-3.14.4-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:54f9256430ca040d58affbd551513de13a5cff7d065204fc52b9a1b0af09a049", size = 1693003, upload-time = "2026-10-05T17:40:00.698Z" },
-    { url = "https://files.pythonhosted.org/packages/1d/72/45eb900d6a9ee046728f5589f3d07f5d78f049b5fb84f48881fa4174d5df/aiohttp-3.14.4-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:6112d5931bf12c776188cab81b82bbb17d86e2e1381f2ade6edc43e6b240f0cb", size = 1927730, upload-time = "2026-10-05T17:40:02.943Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/43/a83ff79dc8375953a1f00b808a21c82590f4e68304fecccdcc42a25fb7d8/aiohttp-3.14.4-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:facc6df39047c4732cbd885bb62e40df20885fcd709fc399e11f81b45ce0fff9", size = 1891177, upload-time = "2026-10-05T17:40:04.989Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/ba/fbdc41608d4e2fb6084d960a41b392fa82beb5b126c2466de549b5c67fc8/aiohttp-3.14.4-cp313-cp313-win32.whl", hash = "sha256:7968634fa3a967a2bc0b9aeba1d5a1955501dcd7d0de44b96f7ebfb662797735", size = 479943, upload-time = "2026-10-05T17:40:07.402Z" },
-    { url = "https://files.pythonhosted.org/packages/35/51/d75629750e705832fd5cd52516a82943ed58b6e09c30e14830f5d87452fa/aiohttp-3.14.4-cp313-cp313-win_amd64.whl", hash = "sha256:c0a894b0265d139cd4c2c8bd4643822cc289a4a5331e21e810881bd000ffb2dc", size = 506209, upload-time = "2026-10-05T17:40:09.49Z" },
-    { url = "https://files.pythonhosted.org/packages/02/64/66452d2ffcc13e5e5ee4ba4a968656fa4a98c29ed5ff0205d4fde02b2943/aiohttp-3.14.4-cp313-cp313-win_arm64.whl", hash = "sha256:da16c3037178e72589d91de59536d271dffc92c2be2b47c38a45538cba54fd29", size = 487163, upload-time = "2026-10-05T17:40:11.526Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/fd/b653b1f969e2e949fe4726af7a8043e8ef117f202bed7757ac8564e077a1/aiohttp-3.14.4-cp314-cp314-android_24_arm64_v8a.whl", hash = "sha256:749bfc43bb1df71bbe6ed215044d5412d786698fc5771d2037436ca49622f3c9", size = 540738, upload-time = "2026-10-05T17:40:14.109Z" },
-    { url = "https://files.pythonhosted.org/packages/90/b5/eea49a0bb697deffac5165d707ec53a24748d6720b3af77a544107b49573/aiohttp-3.14.4-cp314-cp314-android_24_x86_64.whl", hash = "sha256:c113e4b489d711f606ca278cd8dc89179746244ea841aa0638b1b134600afad0", size = 554494, upload-time = "2026-10-05T17:40:16.231Z" },
-    { url = "https://files.pythonhosted.org/packages/11/ea/cf8f4efbbfa8572d9965cd43b3c6c84c581aa006772e5ce3ab4020027e9b/aiohttp-3.14.4-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:50969522bc7022026a2c7968e67da5c789f6b716b988edac55dc630390efd5df", size = 522653, upload-time = "2026-10-05T17:40:18.879Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/24/9f6721f0b52323789cb1041ffc3afa729462d9925607e733a065b6fc5e17/aiohttp-3.14.4-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:cbf92cd7a1c800cee244558dd5630abb45c1c1093ef7b0d546a99f526ff7a9eb", size = 529697, upload-time = "2026-10-05T17:40:21.296Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/a4/399debc3c2ca0ab88a08e3082b4c4f62d0f66978af60243c63f2345ef337/aiohttp-3.14.4-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:fc76be08ff407fba717a769aff04ca1b4bf9ecfdcb5caadef84a563fdbbd146d", size = 540526, upload-time = "2026-10-05T17:40:23.548Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/97/90379813b18b795bccdeb3a5a85e9b93ac2c69f9c2a5d0faba59da3ad6d1/aiohttp-3.14.4-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:9b416f995b68a921069e6ec61fa07f2ac3ff033d92e97a69f673af89f5bb954d", size = 818866, upload-time = "2026-10-05T17:40:25.842Z" },
-    { url = "https://files.pythonhosted.org/packages/78/70/824fd0dac819652f1df895b3f621a75bf0a3050c30e38d8d2316e34ab821/aiohttp-3.14.4-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:2c9585101cfca10e74a07cc0ef2bdc6d90616e6750926b20456f429d0608f740", size = 549666, upload-time = "2026-10-05T17:40:28.523Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/45/eafb2dd200dd2b770ed25a2dc5731c4ba5d58ab3fa8e2e82494bb946808e/aiohttp-3.14.4-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:3c4dcf611b095e7983421f49d01ffbed7ed574891533d606ea115fc23e7c4e90", size = 548961, upload-time = "2026-10-05T17:40:30.613Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/bc/6c733a1c71300293471ac7ef1dffd12b5b4dc9a43c53461224b2b8a7f667/aiohttp-3.14.4-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f8f61a9b5fa56c58e3441f9dc64137f786232d40fb89127190d0e0f84e1e5865", size = 1883165, upload-time = "2026-10-05T17:40:33.062Z" },
-    { url = "https://files.pythonhosted.org/packages/37/34/885ddbd351679a31141b25e0d1a5e4f67738806e564c858b399709b61239/aiohttp-3.14.4-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:d43e538dfc85b705fd832620d050970ef5613b3869a7169b44a554b9dab9eee9", size = 1844119, upload-time = "2026-10-05T17:40:35.266Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/ef/0a64dac53c11d569851efb3e7eddb43551df72b2c172ebb34cccc93bcd3f/aiohttp-3.14.4-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:4135c4bb4b7682a7633fadc7170ea969d843f83aa7224e70111a20675105c985", size = 1930222, upload-time = "2026-10-05T17:40:37.527Z" },
-    { url = "https://files.pythonhosted.org/packages/69/5f/774792ed8f973e0d234fcb06b0f0bc9f29e9a0a0dd847f6418c2904be7d9/aiohttp-3.14.4-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:9055324f156a94fdf6dc9a825ae60f9a2947b88f591ea81ee80826633de62ae7", size = 2038842, upload-time = "2026-10-05T17:40:39.815Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/05/e00f35581c97656d9e864edaa03292382c620dd1d9c836a4f73a2279acc4/aiohttp-3.14.4-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fb22c8e4b60385a9b414c70c6e8b2d0f4b23ff7fc4bb572ceb58297b228169f1", size = 1887845, upload-time = "2026-10-05T17:40:42.359Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/2e/07e3eff5b4c1b082a2eaf0ffb508b409b21ea1ddc9fdc57f3eabb51469a1/aiohttp-3.14.4-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:3b6945559a260112742ed58cde2165488d2fc51aeea34afbaa99d9371b43e1b5", size = 1702533, upload-time = "2026-10-05T17:40:44.569Z" },
-    { url = "https://files.pythonhosted.org/packages/75/44/816844b7f876e6f8fee4ecb088269fcd92241da712e4814a4d624eda13a9/aiohttp-3.14.4-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:8f4078a90b174f15efb2c8725e8720c40dbd3b2cf6350dbc085c964a938d9de7", size = 1849058, upload-time = "2026-10-05T17:40:47.818Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/bd/163242e12464a1f3e58a77e28beca949652ddce84abdd5500a91c70a1e0d/aiohttp-3.14.4-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:f433c5654e32f72de3ef074d715eb5c7604eb6d28a5c2f3c9e5056f20fe6b306", size = 1854600, upload-time = "2026-10-05T17:40:50.401Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/59/5c1ae708a89524eddfd9c727b87cae26b5c50c3c76683b910ac06151ead0/aiohttp-3.14.4-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:871035fe79c636b6bc126ed78df37d72b830dfc751612cb4b1040360edf2719f", size = 1896565, upload-time = "2026-10-05T17:40:52.625Z" },
-    { url = "https://files.pythonhosted.org/packages/37/45/95300a7de69241fe47d3f838f3fb582c712782e172d447ff650a013ea673/aiohttp-3.14.4-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:2617132524f66338f6c1d218cd16081576aefc40df4f2bcba338a99fbf67fec1", size = 1693092, upload-time = "2026-10-05T17:40:54.862Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/33/01a8e61d48d0094121092c74125df14c0f8f10ee3149bfe68b6f869409a9/aiohttp-3.14.4-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:d8bc326133272deee8ef337581550450e4bb735c0520be893b950a1f5baaf41a", size = 1917073, upload-time = "2026-10-05T17:40:57.656Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/d6/1a4f24624cda6686d5b927e26d5d1ae3ebb692faf88e93017fab4b391fd0/aiohttp-3.14.4-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:3ec57223e261b7fa9979c12dbce009ca53439be76cac3af27f860d3e4b1d6f7a", size = 1872656, upload-time = "2026-10-05T17:41:00.123Z" },
-    { url = "https://files.pythonhosted.org/packages/be/be/ed286fcfa2d22061ae021b568c790123505cd482df35e23023339ecaed96/aiohttp-3.14.4-cp314-cp314-win32.whl", hash = "sha256:7242043e71fc449a19a47d92f4e9fd1e0ae8d3f88488982381f422bf6d651218", size = 485461, upload-time = "2026-10-05T17:41:02.686Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/74/e040e6f65f4da305777f1adb3023d47401693489e4a337c983b52d2a0a6b/aiohttp-3.14.4-cp314-cp314-win_amd64.whl", hash = "sha256:019587c7b3a44917dd61bcb312fd5c034f341dc9851b83e7b41b65e08b68ca0f", size = 512147, upload-time = "2026-10-05T17:41:04.98Z" },
-    { url = "https://files.pythonhosted.org/packages/2e/5e/bddb33ae15fdd5a68a10a986587aa9916c418a712fdd110d3b3ae9b51407/aiohttp-3.14.4-cp314-cp314-win_arm64.whl", hash = "sha256:60dc71d38db0988f37e78f6ad4a010a2f6355cfac3fff5f130cf5ef2231f3f0d", size = 494685, upload-time = "2026-10-05T17:41:07.366Z" },
-    { url = "https://files.pythonhosted.org/packages/22/2e/7b884014b40573f919fc3a528e5028bc37b249e31a93928ba61bdd25c960/aiohttp-3.14.4-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:674f53ab9d2794e2dd767619a3384bf1006f8d075e43c19d449a645f8ff641c2", size = 855696, upload-time = "2026-10-05T17:41:09.514Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/e6/b6e2b4f580ab6ae39241bb9182aca60e6e1915cdad0148faaa04db3f366b/aiohttp-3.14.4-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:6d243221f73e5ac546c2ed9255100423e4bc092b08b944f23498e8cf3096c26c", size = 567931, upload-time = "2026-10-05T17:41:11.685Z" },
-    { url = "https://files.pythonhosted.org/packages/63/99/ae8e3a1a18adcbf636839d18b3cccc51007836ccdae5209381c5cf82d1ae/aiohttp-3.14.4-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:0daa016eb74e7888ed5f9ceec6eea3158999c1c4a115ef5cbe88baa8d924f94c", size = 567421, upload-time = "2026-10-05T17:41:13.836Z" },
-    { url = "https://files.pythonhosted.org/packages/63/38/c5d4bb58be72b967a4090d2deeb38571f8c992852936c51dbbbeae49db1c/aiohttp-3.14.4-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:70c031a622aa20add05ebd234b90adaf6bf51c1c88cc305ec760721af83308c3", size = 2054173, upload-time = "2026-10-05T17:41:16.098Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/87/3c8a9c7670f56d478a75c5bb84b336fb61a67b908e36c30a4a96ed8c8e86/aiohttp-3.14.4-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:7df363fa7c38945a896e12c69af4a1a56cbd4152791d9e41fd0bac396b72de38", size = 1918296, upload-time = "2026-10-05T17:41:18.478Z" },
-    { url = "https://files.pythonhosted.org/packages/49/97/bd00e499c0a1505b44f5e23b9739034ea9be792ad42537f2894211ba1c07/aiohttp-3.14.4-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:02a508ba5ad91c4d730523584c0adc65882274bba5e37c33bc2f475e37577256", size = 2027513, upload-time = "2026-10-05T17:41:20.874Z" },
-    { url = "https://files.pythonhosted.org/packages/23/1d/a3666a7c224f86a881f18d673a8ffdc92fa4c35274fb4361822f8f0dc566/aiohttp-3.14.4-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:0cb3edece6fe6a944eaf97d803b88f606da6bc1600b1894c2969e78ffdc1fc29", size = 2152686, upload-time = "2026-10-05T17:41:23.181Z" },
-    { url = "https://files.pythonhosted.org/packages/46/7e/f4204b8c4959c46f6367c182afbbacef08a1b53874281912c52fbd80151c/aiohttp-3.14.4-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:21ce1223b461bcc5fb389a7204001578f1c0b85c2da60a84d915ebb021294245", size = 2006431, upload-time = "2026-10-05T17:41:25.776Z" },
-    { url = "https://files.pythonhosted.org/packages/33/43/091e69d42967cbea833ceb355c5457f8f70748fe08b88c9d91491b3fafb8/aiohttp-3.14.4-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:35d5432f0dc1c8b71307e9112461b52f336da225e344283eec4779222c0a1dff", size = 1789101, upload-time = "2026-10-05T17:41:28.095Z" },
-    { url = "https://files.pythonhosted.org/packages/47/7b/b57cbe533c01098c5d30471f057e7c3c19f281122f756acc9c716b636e2c/aiohttp-3.14.4-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:d6ec364493057c118d08292f7cd60865965c209167d8657b45643a26aef77495", size = 1974472, upload-time = "2026-10-05T17:41:30.499Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/44/79acce03611450e4ed8594f96f1cea40d70bc84fb4e918f94d7d9454a4af/aiohttp-3.14.4-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:70492983b7aed9e61bda82fe1ce80bcba9199610886443133783a288638923c0", size = 1956340, upload-time = "2026-10-05T17:41:33.009Z" },
-    { url = "https://files.pythonhosted.org/packages/da/bb/36e6cbd6720e3377a02f8709aec6fe80de729ef41e78ba01f13d50363c73/aiohttp-3.14.4-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:a77776673331577147e9d25cd7833a72e8891b47556336cff06ba1569e488b99", size = 1965771, upload-time = "2026-10-05T17:41:35.506Z" },
-    { url = "https://files.pythonhosted.org/packages/69/0f/879735ac70ce5e6852916eed51c706a517b205150a8d384f9fa60933a3fc/aiohttp-3.14.4-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:73799000dd6fd5247094fd8e6d3e1eb871e41aab5cc35dff9d9f654cd230bc24", size = 1780297, upload-time = "2026-10-05T17:41:38.284Z" },
-    { url = "https://files.pythonhosted.org/packages/01/5d/7c030ca5b6baf3b02eccd11afc3d58f0b35e407031d5cc78cae9c24921c0/aiohttp-3.14.4-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:27b370fb532e707e8c96d04fa0c96301fb7dba2d50aaca57f6c456cdfffec5bd", size = 2001374, upload-time = "2026-10-05T17:41:40.888Z" },
-    { url = "https://files.pythonhosted.org/packages/80/1e/ddacbb8141d727034c51dd192d17749521d5b30b03f84aa034325396089e/aiohttp-3.14.4-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:884e0d1c707b6217fee3080b9b4029eee7551af788ee761010df19be158414b7", size = 1968531, upload-time = "2026-10-05T17:41:43.62Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/08/2214f823701eebc3e57db141faeae76df7bfd415f254cc7c1692258f228d/aiohttp-3.14.4-cp314-cp314t-win32.whl", hash = "sha256:f2e3d34edb151d3e27f93a8338e2da33e2c7261cd4c879ce5f5fe280cc190ea5", size = 504126, upload-time = "2026-10-05T17:41:46.321Z" },
-    { url = "https://files.pythonhosted.org/packages/91/a1/90e9b6fd23310b4e82d0c0a37b5ecc2944053350473c57533c1da9647235/aiohttp-3.14.4-cp314-cp314t-win_amd64.whl", hash = "sha256:88cf889e51092537fe44adfbff96c2a22d6479d6f92b97b3d413fbfd0a4decf4", size = 531494, upload-time = "2026-10-05T17:41:48.849Z" },
-    { url = "https://files.pythonhosted.org/packages/97/ab/5b501472c92b9b1dc53742591d6210dccb262962f4721299300d3a9f664b/aiohttp-3.14.4-cp314-cp314t-win_arm64.whl", hash = "sha256:ca450c6d42fda7c0bfaf0e200f32f77c5f2c960a33be1e14d197c84588b7f5f6", size = 510544, upload-time = "2026-10-05T17:41:51.358Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/77/ef165a197850573ea07c8d77bf5f4854a1db12fdb20e1cf0b218abf025fc/aiohttp-3.14.4-cp315-cp315-android_24_arm64_v8a.whl", hash = "sha256:3b10799df72f66c30935bc661cb89e5ac2918debfc575e350e226fbaa846cbb7", size = 540737, upload-time = "2026-10-05T17:41:53.761Z" },
-    { url = "https://files.pythonhosted.org/packages/e6/aa/1663f64d1316b3be9d3f6fafa02b8d888070171a6544cba515e82f3af595/aiohttp-3.14.4-cp315-cp315-android_24_x86_64.whl", hash = "sha256:7ffd7f9dd39caccc6b2f68ec0339435ecad2b20f6ea2e2b3de91bbe464ac7137", size = 554600, upload-time = "2026-10-05T17:41:56.183Z" },
-    { url = "https://files.pythonhosted.org/packages/98/f7/d4d535855123c1a774a798643e75fdfbac62c047b0c0729d6505d09df444/aiohttp-3.14.4-cp315-cp315-ios_13_0_arm64_iphoneos.whl", hash = "sha256:a0a7a227353f7693f73878ad14cd2623cafadd656ababcd20e2adfb7225172ea", size = 523184, upload-time = "2026-10-05T17:41:58.624Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/5f/18a8d1cd2958a0b6164b047c18ccb192f2123bb70f1c0a145f6f01f858ad/aiohttp-3.14.4-cp315-cp315-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:1c43b6af8e4708e8b3812a9ee4f79895207e12d555b7f6d70deb838e0011e12d", size = 530342, upload-time = "2026-10-05T17:42:00.96Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/c4/d1dd2b1fcf8a3192a431375b287a8762ebfd22195ab5b201d3fac30e3a7a/aiohttp-3.14.4-cp315-cp315-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:97416b2b997e5e9b817e322b2f0a89b76c54cde22471f51ac17ac15e10901ba0", size = 540629, upload-time = "2026-10-05T17:42:03.324Z" },
-    { url = "https://files.pythonhosted.org/packages/37/51/d1868f3459f618f6b68a6ef549d8b3f76aa616fa083298911fd3ae65d6b9/aiohttp-3.14.4-cp315-cp315-macosx_10_15_universal2.whl", hash = "sha256:ee2a5aa31e507c17841d592364f2148393b17f83bc2766e9211e1eb31ea72a70", size = 819347, upload-time = "2026-10-05T17:42:05.713Z" },
-    { url = "https://files.pythonhosted.org/packages/84/e6/53179b721b67e0bd20974d02eca97b5691559e8ce666ba23a65aecda6b7f/aiohttp-3.14.4-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:5d5d9843c34866e986dd24eef713452609e304550c471320ce7b54b3cfb1391e", size = 549825, upload-time = "2026-10-05T17:42:08.093Z" },
-    { url = "https://files.pythonhosted.org/packages/00/0f/d67ddf7a43d4899176954511b6c048328abec1a5df4901f811a3b408a4fc/aiohttp-3.14.4-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:efcbf93e31b52c21665b6ebc489eb6fdb0dfd86b592edc677b5cffdfa7b11677", size = 549315, upload-time = "2026-10-05T17:42:10.766Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/db/42f372c7f8e259505f239cb49db75f23548deaec56d22c68b4866f1c3fe2/aiohttp-3.14.4-cp315-cp315-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2f1a79977794592dcf6485ed964ec2448db527a1bc0c72ec89663658dad3a739", size = 1892181, upload-time = "2026-10-05T17:42:13.194Z" },
-    { url = "https://files.pythonhosted.org/packages/23/0d/8b1900216302a94f69b41bf0786bb992a6e67d703f4698e335c2442db615/aiohttp-3.14.4-cp315-cp315-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:515e7ac6d27509dc3ba2c35fb88970b00b9e7b07ee7cc947c8733dcd54ef5def", size = 1883513, upload-time = "2026-10-05T17:42:15.704Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/5e/15c014313e567fff931ec4a5f81683cc40251257791fbd607ec37c0dad80/aiohttp-3.14.4-cp315-cp315-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:185154ffa3b54765b5de96f464f41cfa476f8815a03854ae5e0fe4d48fb06e9c", size = 1933283, upload-time = "2026-10-05T17:42:18.241Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/b3/bf7dc39a450218efb1d5c692bac7dc85ef56da282e889bee594f3267211e/aiohttp-3.14.4-cp315-cp315-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:6aece59f77959628a22cd2ffe48b102cda9611d680e090f204385b3998a1190f", size = 2041054, upload-time = "2026-10-05T17:42:20.728Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/03/ffba18d7aaedb5eafac3f41f0c26621ebb0a740bb0115ea2fae1911d902b/aiohttp-3.14.4-cp315-cp315-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d7205aa6589f1ad1306c6994ff2e1ab5efabacf938f9ffd7682fb225c197b06a", size = 1895494, upload-time = "2026-10-05T17:42:23.518Z" },
-    { url = "https://files.pythonhosted.org/packages/45/f4/68123365b86826eee82bdceb7fb4c429204cb3a104d6b7ae44bc6a543fcb/aiohttp-3.14.4-cp315-cp315-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f38c7b3ce60d55ac0f2a9fd2edc194789d043fefea15cfb7dcb40b7d5f561146", size = 1714098, upload-time = "2026-10-05T17:42:26.471Z" },
-    { url = "https://files.pythonhosted.org/packages/b1/db/b13c0b214afc571782e8667f3b9e0bbed6843397be90fa35acf2f3ecfbb0/aiohttp-3.14.4-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:b0a1274ee4ee6203c15a341cce87f9f3df8151d5496047b3608bb62bd969cffc", size = 1857111, upload-time = "2026-10-05T17:42:29.169Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/7f/4f5d3cee3c23b57119aebba5174962fed0bc493f37f38edab2f5730411b6/aiohttp-3.14.4-cp315-cp315-musllinux_1_2_armv7l.whl", hash = "sha256:69ce2407951516f413adf3132b88451eababd710ce631f83c81a9603a3640253", size = 1892123, upload-time = "2026-10-05T17:42:31.786Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/2e/5a6a1f014c4e17d58d4e935d0dd64e612f4eaa2f33cca2475b48ca5e3fb5/aiohttp-3.14.4-cp315-cp315-musllinux_1_2_ppc64le.whl", hash = "sha256:b84d3d057c60eb8e0c2b457a1203e868d82709d3f0c272a4975dfd88c2414939", size = 1898809, upload-time = "2026-10-05T17:42:34.34Z" },
-    { url = "https://files.pythonhosted.org/packages/de/f3/d1cca5311a70fcc1c7c2082e02044578a69bcb10686db33a322df9fb849e/aiohttp-3.14.4-cp315-cp315-musllinux_1_2_riscv64.whl", hash = "sha256:4ecc84f69c9e217984f6877e832e4786a74567432c0bf2b7512919fbdfe18ade", size = 1704814, upload-time = "2026-10-05T17:42:37.047Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/cb/cd58eae366148a5b9b1baa233542151154f2b72cd32daa39fd9db97d0c0d/aiohttp-3.14.4-cp315-cp315-musllinux_1_2_s390x.whl", hash = "sha256:878f2d7950238b2b0a8cbb88054444a125f0cfbc77f54c811aca0483132a9be3", size = 1918390, upload-time = "2026-10-05T17:42:39.674Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/d8/f5e6c4939432734033048ba631503edf4a1e693ee5e261773e169803bbe4/aiohttp-3.14.4-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:6ff9d3a0e6935f1cb0a6685f9f4b3f0d3e406456d7a434a03cf309b8cd5d7a2e", size = 1878321, upload-time = "2026-10-05T17:42:42.528Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/71/462957d6b5d4eb208f78e67745c41480bad2e738aa7caf1d9b07536920c1/aiohttp-3.14.4-cp315-cp315-win32.whl", hash = "sha256:e07dfd7cd360f20be26dc2487ad4c7f21b0b39fdd593e9ebf37d2424ad52defb", size = 485536, upload-time = "2026-10-05T17:42:45.223Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/6e/48f59266a8b8c6420894ff59b8e74175252da67df85967b96997e96b7092/aiohttp-3.14.4-cp315-cp315-win_amd64.whl", hash = "sha256:921fc4f1ad549091bfc39cb5e93925b04f307f83517756a3111843851130efce", size = 512087, upload-time = "2026-10-05T17:42:47.717Z" },
-    { url = "https://files.pythonhosted.org/packages/25/f5/46263b23cee4f312e28aaabbdec2e074c807700a12c9dfa18beff461f035/aiohttp-3.14.4-cp315-cp315-win_arm64.whl", hash = "sha256:5be8af106f96fd625f6c264fa9faaaa9e0104089684d9015d2fa5b6eba6407c7", size = 494709, upload-time = "2026-10-05T17:42:50.615Z" },
-    { url = "https://files.pythonhosted.org/packages/77/8d/e3b1d406c95a8fe436ae2e5f01ee9591196c6c22c44c645b24f20d73eaea/aiohttp-3.14.4-cp315-cp315t-macosx_10_15_universal2.whl", hash = "sha256:e69727ec04a4608200ff32ec29478299df7657e2eb78c416ae338d0ca6662596", size = 856014, upload-time = "2026-10-05T17:42:53.425Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/fc/e9e78d1097830040bc0a4b8af073379f964064bfa7f0a852d774f96f3168/aiohttp-3.14.4-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:f8b658dd3ef2ebd7708b311ed96ff7cb5edaca001a30018a091504ef492bcb1c", size = 567724, upload-time = "2026-10-05T17:42:56.416Z" },
-    { url = "https://files.pythonhosted.org/packages/e6/ad/c813a705a1da1c111c30723b52e1efb67763e9f0b3b54a418cb419616e7a/aiohttp-3.14.4-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:3749e018123df1205161a73ba96d336e17e9cf6b947295e53a43571de420e7b1", size = 567888, upload-time = "2026-10-05T17:42:59.048Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/1f/7676f46aa24554a45686853c61552d02d67ade2b4c51adfe8b2ec4fdecd2/aiohttp-3.14.4-cp315-cp315t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8f28a3c4fca436b2e594090e7cd22558f5e93a30ca18516c436de982da6fc25a", size = 2054356, upload-time = "2026-10-05T17:43:01.781Z" },
-    { url = "https://files.pythonhosted.org/packages/44/79/b9ef7d7442061e0a3125990d6021230b30361a972f7b8ebfb011042877ce/aiohttp-3.14.4-cp315-cp315t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e099aae21246992a1d84303ff262262d054c474e46cace33b0d5a69810c71877", size = 1937678, upload-time = "2026-10-05T17:43:04.492Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/98/5927a31540c8e6d0542effead5bd5c56e749a9d99d84e902fb80ae906ef8/aiohttp-3.14.4-cp315-cp315t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:fafb521891e646d9cf5da89f01c75e7159d08be7254a024149630a698be28251", size = 2026705, upload-time = "2026-10-05T17:43:07.353Z" },
-    { url = "https://files.pythonhosted.org/packages/62/bd/1be001ed97dcfa57a292188c38979fb78be795b960b50f02660587bffa06/aiohttp-3.14.4-cp315-cp315t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:1d385db2cd154bce0b3dd451cf2a52bec91ebb7be2c3a5d06b14b4391631d807", size = 2147075, upload-time = "2026-10-05T17:43:10.141Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/f7/d59628ccedd7c86db4c1f904467d1c80fed6cc10a1831ed5d75ff12e5a71/aiohttp-3.14.4-cp315-cp315t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ae8a244889d8a53549851bf595b9f382f64acca57e8762da1ecb26ba786828f7", size = 2005016, upload-time = "2026-10-05T17:43:12.848Z" },
-    { url = "https://files.pythonhosted.org/packages/3c/dc/472db3ab1daafa12a61d7f83314f85f502b99c143c78d66554a5e24361fd/aiohttp-3.14.4-cp315-cp315t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:681dde68ff8d8d5e7d5abcad4feb45bfb457a218310c919825e21fc36cac3d0b", size = 1796363, upload-time = "2026-10-05T17:43:15.562Z" },
-    { url = "https://files.pythonhosted.org/packages/08/61/6f9834b131b9a42e30d68c469c196033d3cae2d8fe340d4668f362c4fd1f/aiohttp-3.14.4-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:b91a6441fcaed88ca7bca67726b189332df3ceb6ac0dfc98dcb9654bb723288c", size = 1974240, upload-time = "2026-10-05T17:43:18.884Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/2f/b8eb2a276685ef1da7f7bc15348404b8b9ee12b8f32f2cd8895385cd1589/aiohttp-3.14.4-cp315-cp315t-musllinux_1_2_armv7l.whl", hash = "sha256:f15dbbac49bc15eaff95c0b8166525c4050996af578c7be141e145f40ee2cf24", size = 1973387, upload-time = "2026-10-05T17:43:21.661Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/32/ad559b2d6817e85f7cb294d8641e975e64b526f4da98ffe941c9af67a047/aiohttp-3.14.4-cp315-cp315t-musllinux_1_2_ppc64le.whl", hash = "sha256:7abae043e87692d1c2adda1fab501bb0612d28c4a23eb082005c1e684f792dac", size = 1968766, upload-time = "2026-10-05T17:43:24.544Z" },
-    { url = "https://files.pythonhosted.org/packages/60/67/4a16e398140bdabb363428b9f439af3f77706a6df8bea6e626bbde53c2ab/aiohttp-3.14.4-cp315-cp315t-musllinux_1_2_riscv64.whl", hash = "sha256:21f4624fb1051fc1aa10d57a636a80e829f7d0417462d6f1ce380b08fe1a904c", size = 1788193, upload-time = "2026-10-05T17:43:27.467Z" },
-    { url = "https://files.pythonhosted.org/packages/a9/38/17b326da7f52e530a675d789ade3e727a1b3db9959722f6049b9c392321a/aiohttp-3.14.4-cp315-cp315t-musllinux_1_2_s390x.whl", hash = "sha256:2e8dc3a0fdaf9d12b954d3d06cc4c355d91b17fb6c671715b593624ca4c379f8", size = 1999645, upload-time = "2026-10-05T17:43:30.32Z" },
-    { url = "https://files.pythonhosted.org/packages/53/dc/91b87961250010e05eb3adabaf0d98e4229ee7543147c265e834922e1b0b/aiohttp-3.14.4-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:1410b6f6e3d52ea7c02c950496522ce6e85d5543bf154bc80a6141e505251cfa", size = 1970998, upload-time = "2026-10-05T17:43:33.364Z" },
-    { url = "https://files.pythonhosted.org/packages/72/66/9bcf2c2db7b75a3b51c11470ceb67941d028727d674276ff5d5120adc87e/aiohttp-3.14.4-cp315-cp315t-win32.whl", hash = "sha256:a65189a89f3e621f7c27a968b5131bbca29126e2b8517dc72b205747a39d4c96", size = 504036, upload-time = "2026-10-05T17:43:36.212Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/20/349db4af12dbc16070d32028d30c2067123b4520f3dcb2d9013524efeb4f/aiohttp-3.14.4-cp315-cp315t-win_amd64.whl", hash = "sha256:2b2c95f5f769eec92b552969db1f79ea0282058ce5131ed0f2fa540b4af3f14e", size = 531284, upload-time = "2026-10-05T17:43:39.362Z" },
-    { url = "https://files.pythonhosted.org/packages/26/21/544c711bc5fad611278ebd153bdcab1bffce8b8581f8ec9096b275948a3c/aiohttp-3.14.4-cp315-cp315t-win_arm64.whl", hash = "sha256:54209fff79346ee1ef0d5cbf92fa80a5bb37396406bb4d932e5107f9c29b2d3f", size = 510623, upload-time = "2026-10-05T17:43:42.15Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/27/5e1f8446545be98e9416af59c396b1ed1f9f3294afb0a40ee3a709889273/aiohttp-3.14.4-py3-none-any.whl", hash = "sha256:5c6758ba62aea282c537179cfc8474a90f2b5f7b089cc5ff66d8920d86a9bfdd", size = 279487, upload-time = "2026-10-05T17:43:44.905Z" },
-]
-
-[[package]]
-name = "aiosignal"
-version = "1.4.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "frozenlist" },
-    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/61/62/06741b579156360248d1ec624842ad0edf697050bbaf7c3e46394e106ad1/aiosignal-1.4.0.tar.gz", hash = "sha256:f47eecd9468083c2029cc99945502cb7708b082c232f9aca65da147157b251c7", size = 25007, upload-time = "2025-07-03T22:54:43.528Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/fb/76/641ae371508676492379f16e2fa48f4e2c11741bd63c48be4b12a6b09cba/aiosignal-1.4.0-py3-none-any.whl", hash = "sha256:053243f8b92b990551949e63930a839ff0cf0b0ebbe0597b0f3fb19e1a0fe82e", size = 7490, upload-time = "2025-07-03T22:54:42.156Z" },
-]
-
 [[package]]
 name = "annotated-types"
 version = "0.8.0"
@@ -332,15 +131,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/25/6c/b400476d3ceba681ab929787edc9554f6d88fcc69435eb681b00fc0457a5/ast_serialize-0.8.0-cp39-abi3-win_arm64.whl", hash = "sha256:b2a5978662fd4db463dfb4b974d2b10ac6430b98f5333aabc7051909df3561d0", size = 1083655, upload-time = "2026-08-07T11:29:00.349Z" },
 ]
 
-[[package]]
-name = "async-timeout"
-version = "5.0.1"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a5/ae/136395dfbfe00dfc94da3f3e136d0b13f394cba8f4841120e34226265780/async_timeout-5.0.1.tar.gz", hash = "sha256:d9321a7a3d5a6a5e187e824d2fa0793ce379a202935782d555d6e9d2735677d3", size = 9274, upload-time = "2024-11-06T16:41:39.6Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/fe/ba/e2081de779ca30d473f21f5b30e0e737c438205440784c7dfc81efc2b029/async_timeout-5.0.1-py3-none-any.whl", hash = "sha256:39e3809566ff85354557ec2398b55e096c8364bacac9405a7a1fa429e77fe76c", size = 6233, upload-time = "2024-11-06T16:41:37.9Z" },
-]
-
 [[package]]
 name = "attrs"
 version = "26.1.0"
@@ -1168,7 +958,6 @@ dependencies = [
     { name = "click" },
     { name = "deepctl" },
     { name = "deepctl-core" },
-    { name = "ffmpeg-python" },
     { name = "httpx" },
     { name = "pydantic" },
     { name = "rich" },
@@ -1179,7 +968,6 @@ requires-dist = [
     { name = "click", specifier = ">=8.2.0,<9" },
     { name = "deepctl", editable = "." },
     { name = "deepctl-core", editable = "packages/deepctl-core" },
-    { name = "ffmpeg-python", specifier = ">=0.2.0" },
     { name = "httpx", specifier = ">=0.24.0,<1" },
     { name = "pydantic", specifier = ">=2.0.0,<3" },
     { name = "rich", specifier = ">=13.0.0,<16" },
@@ -1190,13 +978,14 @@ name = "deepctl-cmd-debug-browser"
 version = "0.4.1"
 source = { editable = "packages/deepctl-cmd-debug-browser" }
 dependencies = [
-    { name = "aiohttp" },
     { name = "click" },
     { name = "deepctl" },
     { name = "deepctl-core" },
     { name = "httpx" },
     { name = "pydantic" },
     { name = "rich" },
+    { name = "websockets", version = "16.1.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
+    { name = "websockets", version = "17.0.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
 ]
 
 [package.optional-dependencies]
@@ -1207,7 +996,6 @@ dev = [
 
 [package.metadata]
 requires-dist = [
-    { name = "aiohttp", specifier = ">=3.9.0" },
     { name = "click", specifier = ">=8.2.0,<9" },
     { name = "deepctl", editable = "." },
     { name = "deepctl-core", editable = "packages/deepctl-core" },
@@ -1216,6 +1004,7 @@ requires-dist = [
     { name = "pytest", marker = "extra == 'dev'", specifier = ">=7.0.0" },
     { name = "pytest-asyncio", marker = "extra == 'dev'", specifier = ">=0.21.0" },
     { name = "rich", specifier = ">=13.0.0,<16" },
+    { name = "websockets", specifier = ">=13.1,<18" },
 ]
 provides-extras = ["dev"]
 
@@ -1229,7 +1018,6 @@ dependencies = [
     { name = "deepctl-core" },
     { name = "httpx" },
     { name = "pydantic" },
-    { name = "requests" },
     { name = "rich" },
 ]
 
@@ -1240,7 +1028,6 @@ requires-dist = [
     { name = "deepctl-core", editable = "packages/deepctl-core" },
     { name = "httpx", specifier = ">=0.24.0,<1" },
     { name = "pydantic", specifier = ">=2.0.0,<3" },
-    { name = "requests", specifier = ">=2.31,<3.0" },
     { name = "rich", specifier = ">=13.0.0,<16" },
 ]
 
@@ -1249,24 +1036,25 @@ name = "deepctl-cmd-debug-probe"
 version = "0.4.1"
 source = { editable = "packages/deepctl-cmd-debug-probe" }
 dependencies = [
-    { name = "aiohttp" },
     { name = "click" },
     { name = "deepctl" },
     { name = "deepctl-core" },
     { name = "deepctl-shared-utils" },
     { name = "pydantic" },
     { name = "rich" },
+    { name = "websockets", version = "16.1.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
+    { name = "websockets", version = "17.0.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
 ]
 
 [package.metadata]
 requires-dist = [
-    { name = "aiohttp", specifier = ">=3.11.0" },
     { name = "click", specifier = ">=8.2.0,<9" },
     { name = "deepctl", editable = "." },
     { name = "deepctl-core", editable = "packages/deepctl-core" },
     { name = "deepctl-shared-utils", editable = "packages/deepctl-shared-utils" },
     { name = "pydantic", specifier = ">=2.0.0,<3" },
     { name = "rich", specifier = ">=13.0.0,<16" },
+    { name = "websockets", specifier = ">=13.1,<18" },
 ]
 
 [[package]]
@@ -1384,9 +1172,6 @@ dependencies = [
     { name = "deepctl-core" },
     { name = "deepctl-shared-utils" },
     { name = "deepgram-captions" },
-    { name = "numpy", version = "2.2.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
-    { name = "numpy", version = "2.4.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" },
-    { name = "numpy", version = "2.5.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" },
     { name = "pydantic" },
     { name = "rich" },
     { name = "sounddevice" },
@@ -1401,7 +1186,6 @@ requires-dist = [
     { name = "deepctl-core", editable = "packages/deepctl-core" },
     { name = "deepctl-shared-utils", editable = "packages/deepctl-shared-utils" },
     { name = "deepgram-captions", specifier = ">=2.0.0" },
-    { name = "numpy", specifier = ">=1.24.0" },
     { name = "pydantic", specifier = ">=2.0.0,<3" },
     { name = "rich", specifier = ">=13.0.0,<16" },
     { name = "sounddevice", specifier = ">=0.4.6" },
@@ -1735,6 +1519,8 @@ dependencies = [
     { name = "pyjwt" },
     { name = "pyyaml" },
     { name = "rich" },
+    { name = "websockets", version = "16.1.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
+    { name = "websockets", version = "17.0.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
 ]
 
 [package.optional-dependencies]
@@ -1762,6 +1548,7 @@ requires-dist = [
     { name = "pytest-mock", marker = "extra == 'dev'", specifier = ">=3.10.0" },
     { name = "pyyaml", specifier = ">=6.0.0" },
     { name = "rich", specifier = ">=13.0.0,<16" },
+    { name = "websockets", specifier = ">=13.1,<18" },
 ]
 provides-extras = ["dev"]
 
@@ -1880,18 +1667,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/8a/0e/97c33bf5009bdbac74fd2beace167cab3f978feb69cc36f1ef79360d6c4e/exceptiongroup-1.3.1-py3-none-any.whl", hash = "sha256:a7a39a3bd276781e98394987d3a5701d0c4edffb633bb7a5144577f82c773598", size = 16740, upload-time = "2025-11-21T23:01:53.443Z" },
 ]
 
-[[package]]
-name = "ffmpeg-python"
-version = "0.2.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "future" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/dd/5e/d5f9105d59c1325759d838af4e973695081fbbc97182baf73afc78dec266/ffmpeg-python-0.2.0.tar.gz", hash = "sha256:65225db34627c578ef0e11c8b1eb528bb35e024752f6f10b78c011f6f64c4127", size = 21543, upload-time = "2019-07-06T00:19:08.989Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/d7/0c/56be52741f75bad4dc6555991fabd2e07b432d333da82c11ad701123888a/ffmpeg_python-0.2.0-py3-none-any.whl", hash = "sha256:ac441a0404e053f8b6a1113a77c0f452f1cfc62f6344a769475ffdc0f56c23c5", size = 25024, upload-time = "2019-07-06T00:19:07.215Z" },
-]
-
 [[package]]
 name = "filelock"
 version = "3.32.3"
@@ -1901,136 +1676,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/a7/8e/50f46a9c0ce8d2861a394c1347caae037ea0431d2f67d7feb151cbc4649a/filelock-3.32.3-py3-none-any.whl", hash = "sha256:7f0ca4bcc0e181c60dbbd8aa9ab5b120ebb99e4e064e83636340056f833a1f09", size = 98901, upload-time = "2026-08-13T16:00:03.974Z" },
 ]
 
-[[package]]
-name = "frozenlist"
-version = "1.8.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/2d/f5/c831fac6cc817d26fd54c7eaccd04ef7e0288806943f7cc5bbf69f3ac1f0/frozenlist-1.8.0.tar.gz", hash = "sha256:3ede829ed8d842f6cd48fc7081d7a41001a56f1f38603f9d49bf3020d59a31ad", size = 45875, upload-time = "2025-10-06T05:38:17.865Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/83/4a/557715d5047da48d54e659203b9335be7bfaafda2c3f627b7c47e0b3aaf3/frozenlist-1.8.0-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:b37f6d31b3dcea7deb5e9696e529a6aa4a898adc33db82da12e4c60a7c4d2011", size = 86230, upload-time = "2025-10-06T05:35:23.699Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/fb/c85f9fed3ea8fe8740e5b46a59cc141c23b842eca617da8876cfce5f760e/frozenlist-1.8.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:ef2b7b394f208233e471abc541cc6991f907ffd47dc72584acee3147899d6565", size = 49621, upload-time = "2025-10-06T05:35:25.341Z" },
-    { url = "https://files.pythonhosted.org/packages/63/70/26ca3f06aace16f2352796b08704338d74b6d1a24ca38f2771afbb7ed915/frozenlist-1.8.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:a88f062f072d1589b7b46e951698950e7da00442fc1cacbe17e19e025dc327ad", size = 49889, upload-time = "2025-10-06T05:35:26.797Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/ed/c7895fd2fde7f3ee70d248175f9b6cdf792fb741ab92dc59cd9ef3bd241b/frozenlist-1.8.0-cp310-cp310-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:f57fb59d9f385710aa7060e89410aeb5058b99e62f4d16b08b91986b9a2140c2", size = 219464, upload-time = "2025-10-06T05:35:28.254Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/83/4d587dccbfca74cb8b810472392ad62bfa100bf8108c7223eb4c4fa2f7b3/frozenlist-1.8.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:799345ab092bee59f01a915620b5d014698547afd011e691a208637312db9186", size = 221649, upload-time = "2025-10-06T05:35:29.454Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/c6/fd3b9cd046ec5fff9dab66831083bc2077006a874a2d3d9247dea93ddf7e/frozenlist-1.8.0-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:c23c3ff005322a6e16f71bf8692fcf4d5a304aaafe1e262c98c6d4adc7be863e", size = 219188, upload-time = "2025-10-06T05:35:30.951Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/80/6693f55eb2e085fc8afb28cf611448fb5b90e98e068fa1d1b8d8e66e5c7d/frozenlist-1.8.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8a76ea0f0b9dfa06f254ee06053d93a600865b3274358ca48a352ce4f0798450", size = 231748, upload-time = "2025-10-06T05:35:32.101Z" },
-    { url = "https://files.pythonhosted.org/packages/97/d6/e9459f7c5183854abd989ba384fe0cc1a0fb795a83c033f0571ec5933ca4/frozenlist-1.8.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c7366fe1418a6133d5aa824ee53d406550110984de7637d65a178010f759c6ef", size = 236351, upload-time = "2025-10-06T05:35:33.834Z" },
-    { url = "https://files.pythonhosted.org/packages/97/92/24e97474b65c0262e9ecd076e826bfd1d3074adcc165a256e42e7b8a7249/frozenlist-1.8.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:13d23a45c4cebade99340c4165bd90eeb4a56c6d8a9d8aa49568cac19a6d0dc4", size = 218767, upload-time = "2025-10-06T05:35:35.205Z" },
-    { url = "https://files.pythonhosted.org/packages/ee/bf/dc394a097508f15abff383c5108cb8ad880d1f64a725ed3b90d5c2fbf0bb/frozenlist-1.8.0-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:e4a3408834f65da56c83528fb52ce7911484f0d1eaf7b761fc66001db1646eff", size = 235887, upload-time = "2025-10-06T05:35:36.354Z" },
-    { url = "https://files.pythonhosted.org/packages/40/90/25b201b9c015dbc999a5baf475a257010471a1fa8c200c843fd4abbee725/frozenlist-1.8.0-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:42145cd2748ca39f32801dad54aeea10039da6f86e303659db90db1c4b614c8c", size = 228785, upload-time = "2025-10-06T05:35:37.949Z" },
-    { url = "https://files.pythonhosted.org/packages/84/f4/b5bc148df03082f05d2dd30c089e269acdbe251ac9a9cf4e727b2dbb8a3d/frozenlist-1.8.0-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:e2de870d16a7a53901e41b64ffdf26f2fbb8917b3e6ebf398098d72c5b20bd7f", size = 230312, upload-time = "2025-10-06T05:35:39.178Z" },
-    { url = "https://files.pythonhosted.org/packages/db/4b/87e95b5d15097c302430e647136b7d7ab2398a702390cf4c8601975709e7/frozenlist-1.8.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:20e63c9493d33ee48536600d1a5c95eefc870cd71e7ab037763d1fbb89cc51e7", size = 217650, upload-time = "2025-10-06T05:35:40.377Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/70/78a0315d1fea97120591a83e0acd644da638c872f142fd72a6cebee825f3/frozenlist-1.8.0-cp310-cp310-win32.whl", hash = "sha256:adbeebaebae3526afc3c96fad434367cafbfd1b25d72369a9e5858453b1bb71a", size = 39659, upload-time = "2025-10-06T05:35:41.863Z" },
-    { url = "https://files.pythonhosted.org/packages/66/aa/3f04523fb189a00e147e60c5b2205126118f216b0aa908035c45336e27e4/frozenlist-1.8.0-cp310-cp310-win_amd64.whl", hash = "sha256:667c3777ca571e5dbeb76f331562ff98b957431df140b54c85fd4d52eea8d8f6", size = 43837, upload-time = "2025-10-06T05:35:43.205Z" },
-    { url = "https://files.pythonhosted.org/packages/39/75/1135feecdd7c336938bd55b4dc3b0dfc46d85b9be12ef2628574b28de776/frozenlist-1.8.0-cp310-cp310-win_arm64.whl", hash = "sha256:80f85f0a7cc86e7a54c46d99c9e1318ff01f4687c172ede30fd52d19d1da1c8e", size = 39989, upload-time = "2025-10-06T05:35:44.596Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/03/077f869d540370db12165c0aa51640a873fb661d8b315d1d4d67b284d7ac/frozenlist-1.8.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:09474e9831bc2b2199fad6da3c14c7b0fbdd377cce9d3d77131be28906cb7d84", size = 86912, upload-time = "2025-10-06T05:35:45.98Z" },
-    { url = "https://files.pythonhosted.org/packages/df/b5/7610b6bd13e4ae77b96ba85abea1c8cb249683217ef09ac9e0ae93f25a91/frozenlist-1.8.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:17c883ab0ab67200b5f964d2b9ed6b00971917d5d8a92df149dc2c9779208ee9", size = 50046, upload-time = "2025-10-06T05:35:47.009Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/ef/0e8f1fe32f8a53dd26bdd1f9347efe0778b0fddf62789ea683f4cc7d787d/frozenlist-1.8.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:fa47e444b8ba08fffd1c18e8cdb9a75db1b6a27f17507522834ad13ed5922b93", size = 50119, upload-time = "2025-10-06T05:35:48.38Z" },
-    { url = "https://files.pythonhosted.org/packages/11/b1/71a477adc7c36e5fb628245dfbdea2166feae310757dea848d02bd0689fd/frozenlist-1.8.0-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:2552f44204b744fba866e573be4c1f9048d6a324dfe14475103fd51613eb1d1f", size = 231067, upload-time = "2025-10-06T05:35:49.97Z" },
-    { url = "https://files.pythonhosted.org/packages/45/7e/afe40eca3a2dc19b9904c0f5d7edfe82b5304cb831391edec0ac04af94c2/frozenlist-1.8.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:957e7c38f250991e48a9a73e6423db1bb9dd14e722a10f6b8bb8e16a0f55f695", size = 233160, upload-time = "2025-10-06T05:35:51.729Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/aa/7416eac95603ce428679d273255ffc7c998d4132cfae200103f164b108aa/frozenlist-1.8.0-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:8585e3bb2cdea02fc88ffa245069c36555557ad3609e83be0ec71f54fd4abb52", size = 228544, upload-time = "2025-10-06T05:35:53.246Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/3d/2a2d1f683d55ac7e3875e4263d28410063e738384d3adc294f5ff3d7105e/frozenlist-1.8.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:edee74874ce20a373d62dc28b0b18b93f645633c2943fd90ee9d898550770581", size = 243797, upload-time = "2025-10-06T05:35:54.497Z" },
-    { url = "https://files.pythonhosted.org/packages/78/1e/2d5565b589e580c296d3bb54da08d206e797d941a83a6fdea42af23be79c/frozenlist-1.8.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c9a63152fe95756b85f31186bddf42e4c02c6321207fd6601a1c89ebac4fe567", size = 247923, upload-time = "2025-10-06T05:35:55.861Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/c3/65872fcf1d326a7f101ad4d86285c403c87be7d832b7470b77f6d2ed5ddc/frozenlist-1.8.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:b6db2185db9be0a04fecf2f241c70b63b1a242e2805be291855078f2b404dd6b", size = 230886, upload-time = "2025-10-06T05:35:57.399Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/76/ac9ced601d62f6956f03cc794f9e04c81719509f85255abf96e2510f4265/frozenlist-1.8.0-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:f4be2e3d8bc8aabd566f8d5b8ba7ecc09249d74ba3c9ed52e54dc23a293f0b92", size = 245731, upload-time = "2025-10-06T05:35:58.563Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/49/ecccb5f2598daf0b4a1415497eba4c33c1e8ce07495eb07d2860c731b8d5/frozenlist-1.8.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:c8d1634419f39ea6f5c427ea2f90ca85126b54b50837f31497f3bf38266e853d", size = 241544, upload-time = "2025-10-06T05:35:59.719Z" },
-    { url = "https://files.pythonhosted.org/packages/53/4b/ddf24113323c0bbcc54cb38c8b8916f1da7165e07b8e24a717b4a12cbf10/frozenlist-1.8.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:1a7fa382a4a223773ed64242dbe1c9c326ec09457e6b8428efb4118c685c3dfd", size = 241806, upload-time = "2025-10-06T05:36:00.959Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/fb/9b9a084d73c67175484ba2789a59f8eebebd0827d186a8102005ce41e1ba/frozenlist-1.8.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:11847b53d722050808926e785df837353bd4d75f1d494377e59b23594d834967", size = 229382, upload-time = "2025-10-06T05:36:02.22Z" },
-    { url = "https://files.pythonhosted.org/packages/95/a3/c8fb25aac55bf5e12dae5c5aa6a98f85d436c1dc658f21c3ac73f9fa95e5/frozenlist-1.8.0-cp311-cp311-win32.whl", hash = "sha256:27c6e8077956cf73eadd514be8fb04d77fc946a7fe9f7fe167648b0b9085cc25", size = 39647, upload-time = "2025-10-06T05:36:03.409Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/f5/603d0d6a02cfd4c8f2a095a54672b3cf967ad688a60fb9faf04fc4887f65/frozenlist-1.8.0-cp311-cp311-win_amd64.whl", hash = "sha256:ac913f8403b36a2c8610bbfd25b8013488533e71e62b4b4adce9c86c8cea905b", size = 44064, upload-time = "2025-10-06T05:36:04.368Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/16/c2c9ab44e181f043a86f9a8f84d5124b62dbcb3a02c0977ec72b9ac1d3e0/frozenlist-1.8.0-cp311-cp311-win_arm64.whl", hash = "sha256:d4d3214a0f8394edfa3e303136d0575eece0745ff2b47bd2cb2e66dd92d4351a", size = 39937, upload-time = "2025-10-06T05:36:05.669Z" },
-    { url = "https://files.pythonhosted.org/packages/69/29/948b9aa87e75820a38650af445d2ef2b6b8a6fab1a23b6bb9e4ef0be2d59/frozenlist-1.8.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:78f7b9e5d6f2fdb88cdde9440dc147259b62b9d3b019924def9f6478be254ac1", size = 87782, upload-time = "2025-10-06T05:36:06.649Z" },
-    { url = "https://files.pythonhosted.org/packages/64/80/4f6e318ee2a7c0750ed724fa33a4bdf1eacdc5a39a7a24e818a773cd91af/frozenlist-1.8.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:229bf37d2e4acdaf808fd3f06e854a4a7a3661e871b10dc1f8f1896a3b05f18b", size = 50594, upload-time = "2025-10-06T05:36:07.69Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/94/5c8a2b50a496b11dd519f4a24cb5496cf125681dd99e94c604ccdea9419a/frozenlist-1.8.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:f833670942247a14eafbb675458b4e61c82e002a148f49e68257b79296e865c4", size = 50448, upload-time = "2025-10-06T05:36:08.78Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/bd/d91c5e39f490a49df14320f4e8c80161cfcce09f1e2cde1edd16a551abb3/frozenlist-1.8.0-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:494a5952b1c597ba44e0e78113a7266e656b9794eec897b19ead706bd7074383", size = 242411, upload-time = "2025-10-06T05:36:09.801Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/83/f61505a05109ef3293dfb1ff594d13d64a2324ac3482be2cedc2be818256/frozenlist-1.8.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:96f423a119f4777a4a056b66ce11527366a8bb92f54e541ade21f2374433f6d4", size = 243014, upload-time = "2025-10-06T05:36:11.394Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/cb/cb6c7b0f7d4023ddda30cf56b8b17494eb3a79e3fda666bf735f63118b35/frozenlist-1.8.0-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3462dd9475af2025c31cc61be6652dfa25cbfb56cbbf52f4ccfe029f38decaf8", size = 234909, upload-time = "2025-10-06T05:36:12.598Z" },
-    { url = "https://files.pythonhosted.org/packages/31/c5/cd7a1f3b8b34af009fb17d4123c5a778b44ae2804e3ad6b86204255f9ec5/frozenlist-1.8.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c4c800524c9cd9bac5166cd6f55285957fcfc907db323e193f2afcd4d9abd69b", size = 250049, upload-time = "2025-10-06T05:36:14.065Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/01/2f95d3b416c584a1e7f0e1d6d31998c4a795f7544069ee2e0962a4b60740/frozenlist-1.8.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d6a5df73acd3399d893dafc71663ad22534b5aa4f94e8a2fabfe856c3c1b6a52", size = 256485, upload-time = "2025-10-06T05:36:15.39Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/03/024bf7720b3abaebcff6d0793d73c154237b85bdf67b7ed55e5e9596dc9a/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:405e8fe955c2280ce66428b3ca55e12b3c4e9c336fb2103a4937e891c69a4a29", size = 237619, upload-time = "2025-10-06T05:36:16.558Z" },
-    { url = "https://files.pythonhosted.org/packages/69/fa/f8abdfe7d76b731f5d8bd217827cf6764d4f1d9763407e42717b4bed50a0/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:908bd3f6439f2fef9e85031b59fd4f1297af54415fb60e4254a95f75b3cab3f3", size = 250320, upload-time = "2025-10-06T05:36:17.821Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/3c/b051329f718b463b22613e269ad72138cc256c540f78a6de89452803a47d/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:294e487f9ec720bd8ffcebc99d575f7eff3568a08a253d1ee1a0378754b74143", size = 246820, upload-time = "2025-10-06T05:36:19.046Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/ae/58282e8f98e444b3f4dd42448ff36fa38bef29e40d40f330b22e7108f565/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:74c51543498289c0c43656701be6b077f4b265868fa7f8a8859c197006efb608", size = 250518, upload-time = "2025-10-06T05:36:20.763Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/96/007e5944694d66123183845a106547a15944fbbb7154788cbf7272789536/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:776f352e8329135506a1d6bf16ac3f87bc25b28e765949282dcc627af36123aa", size = 239096, upload-time = "2025-10-06T05:36:22.129Z" },
-    { url = "https://files.pythonhosted.org/packages/66/bb/852b9d6db2fa40be96f29c0d1205c306288f0684df8fd26ca1951d461a56/frozenlist-1.8.0-cp312-cp312-win32.whl", hash = "sha256:433403ae80709741ce34038da08511d4a77062aa924baf411ef73d1146e74faf", size = 39985, upload-time = "2025-10-06T05:36:23.661Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/af/38e51a553dd66eb064cdf193841f16f077585d4d28394c2fa6235cb41765/frozenlist-1.8.0-cp312-cp312-win_amd64.whl", hash = "sha256:34187385b08f866104f0c0617404c8eb08165ab1272e884abc89c112e9c00746", size = 44591, upload-time = "2025-10-06T05:36:24.958Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/06/1dc65480ab147339fecc70797e9c2f69d9cea9cf38934ce08df070fdb9cb/frozenlist-1.8.0-cp312-cp312-win_arm64.whl", hash = "sha256:fe3c58d2f5db5fbd18c2987cba06d51b0529f52bc3a6cdc33d3f4eab725104bd", size = 40102, upload-time = "2025-10-06T05:36:26.333Z" },
-    { url = "https://files.pythonhosted.org/packages/2d/40/0832c31a37d60f60ed79e9dfb5a92e1e2af4f40a16a29abcc7992af9edff/frozenlist-1.8.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:8d92f1a84bb12d9e56f818b3a746f3efba93c1b63c8387a73dde655e1e42282a", size = 85717, upload-time = "2025-10-06T05:36:27.341Z" },
-    { url = "https://files.pythonhosted.org/packages/30/ba/b0b3de23f40bc55a7057bd38434e25c34fa48e17f20ee273bbde5e0650f3/frozenlist-1.8.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:96153e77a591c8adc2ee805756c61f59fef4cf4073a9275ee86fe8cba41241f7", size = 49651, upload-time = "2025-10-06T05:36:28.855Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/ab/6e5080ee374f875296c4243c381bbdef97a9ac39c6e3ce1d5f7d42cb78d6/frozenlist-1.8.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f21f00a91358803399890ab167098c131ec2ddd5f8f5fd5fe9c9f2c6fcd91e40", size = 49417, upload-time = "2025-10-06T05:36:29.877Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/4e/e4691508f9477ce67da2015d8c00acd751e6287739123113a9fca6f1604e/frozenlist-1.8.0-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:fb30f9626572a76dfe4293c7194a09fb1fe93ba94c7d4f720dfae3b646b45027", size = 234391, upload-time = "2025-10-06T05:36:31.301Z" },
-    { url = "https://files.pythonhosted.org/packages/40/76/c202df58e3acdf12969a7895fd6f3bc016c642e6726aa63bd3025e0fc71c/frozenlist-1.8.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:eaa352d7047a31d87dafcacbabe89df0aa506abb5b1b85a2fb91bc3faa02d822", size = 233048, upload-time = "2025-10-06T05:36:32.531Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/c0/8746afb90f17b73ca5979c7a3958116e105ff796e718575175319b5bb4ce/frozenlist-1.8.0-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:03ae967b4e297f58f8c774c7eabcce57fe3c2434817d4385c50661845a058121", size = 226549, upload-time = "2025-10-06T05:36:33.706Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/eb/4c7eefc718ff72f9b6c4893291abaae5fbc0c82226a32dcd8ef4f7a5dbef/frozenlist-1.8.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f6292f1de555ffcc675941d65fffffb0a5bcd992905015f85d0592201793e0e5", size = 239833, upload-time = "2025-10-06T05:36:34.947Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/4e/e5c02187cf704224f8b21bee886f3d713ca379535f16893233b9d672ea71/frozenlist-1.8.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:29548f9b5b5e3460ce7378144c3010363d8035cea44bc0bf02d57f5a685e084e", size = 245363, upload-time = "2025-10-06T05:36:36.534Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/96/cb85ec608464472e82ad37a17f844889c36100eed57bea094518bf270692/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ec3cc8c5d4084591b4237c0a272cc4f50a5b03396a47d9caaf76f5d7b38a4f11", size = 229314, upload-time = "2025-10-06T05:36:38.582Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/6f/4ae69c550e4cee66b57887daeebe006fe985917c01d0fff9caab9883f6d0/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:517279f58009d0b1f2e7c1b130b377a349405da3f7621ed6bfae50b10adf20c1", size = 243365, upload-time = "2025-10-06T05:36:40.152Z" },
-    { url = "https://files.pythonhosted.org/packages/7a/58/afd56de246cf11780a40a2c28dc7cbabbf06337cc8ddb1c780a2d97e88d8/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:db1e72ede2d0d7ccb213f218df6a078a9c09a7de257c2fe8fcef16d5925230b1", size = 237763, upload-time = "2025-10-06T05:36:41.355Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/36/cdfaf6ed42e2644740d4a10452d8e97fa1c062e2a8006e4b09f1b5fd7d63/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:b4dec9482a65c54a5044486847b8a66bf10c9cb4926d42927ec4e8fd5db7fed8", size = 240110, upload-time = "2025-10-06T05:36:42.716Z" },
-    { url = "https://files.pythonhosted.org/packages/03/a8/9ea226fbefad669f11b52e864c55f0bd57d3c8d7eb07e9f2e9a0b39502e1/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:21900c48ae04d13d416f0e1e0c4d81f7931f73a9dfa0b7a8746fb2fe7dd970ed", size = 233717, upload-time = "2025-10-06T05:36:44.251Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/0b/1b5531611e83ba7d13ccc9988967ea1b51186af64c42b7a7af465dcc9568/frozenlist-1.8.0-cp313-cp313-win32.whl", hash = "sha256:8b7b94a067d1c504ee0b16def57ad5738701e4ba10cec90529f13fa03c833496", size = 39628, upload-time = "2025-10-06T05:36:45.423Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/cf/174c91dbc9cc49bc7b7aab74d8b734e974d1faa8f191c74af9b7e80848e6/frozenlist-1.8.0-cp313-cp313-win_amd64.whl", hash = "sha256:878be833caa6a3821caf85eb39c5ba92d28e85df26d57afb06b35b2efd937231", size = 43882, upload-time = "2025-10-06T05:36:46.796Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/17/502cd212cbfa96eb1388614fe39a3fc9ab87dbbe042b66f97acb57474834/frozenlist-1.8.0-cp313-cp313-win_arm64.whl", hash = "sha256:44389d135b3ff43ba8cc89ff7f51f5a0bb6b63d829c8300f79a2fe4fe61bcc62", size = 39676, upload-time = "2025-10-06T05:36:47.8Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/5c/3bbfaa920dfab09e76946a5d2833a7cbdf7b9b4a91c714666ac4855b88b4/frozenlist-1.8.0-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:e25ac20a2ef37e91c1b39938b591457666a0fa835c7783c3a8f33ea42870db94", size = 89235, upload-time = "2025-10-06T05:36:48.78Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/d6/f03961ef72166cec1687e84e8925838442b615bd0b8854b54923ce5b7b8a/frozenlist-1.8.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:07cdca25a91a4386d2e76ad992916a85038a9b97561bf7a3fd12d5d9ce31870c", size = 50742, upload-time = "2025-10-06T05:36:49.837Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/bb/a6d12b7ba4c3337667d0e421f7181c82dda448ce4e7ad7ecd249a16fa806/frozenlist-1.8.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:4e0c11f2cc6717e0a741f84a527c52616140741cd812a50422f83dc31749fb52", size = 51725, upload-time = "2025-10-06T05:36:50.851Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/71/d1fed0ffe2c2ccd70b43714c6cab0f4188f09f8a67a7914a6b46ee30f274/frozenlist-1.8.0-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:b3210649ee28062ea6099cfda39e147fa1bc039583c8ee4481cb7811e2448c51", size = 284533, upload-time = "2025-10-06T05:36:51.898Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/1f/fb1685a7b009d89f9bf78a42d94461bc06581f6e718c39344754a5d9bada/frozenlist-1.8.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:581ef5194c48035a7de2aefc72ac6539823bb71508189e5de01d60c9dcd5fa65", size = 292506, upload-time = "2025-10-06T05:36:53.101Z" },
-    { url = "https://files.pythonhosted.org/packages/e6/3b/b991fe1612703f7e0d05c0cf734c1b77aaf7c7d321df4572e8d36e7048c8/frozenlist-1.8.0-cp313-cp313t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3ef2d026f16a2b1866e1d86fc4e1291e1ed8a387b2c333809419a2f8b3a77b82", size = 274161, upload-time = "2025-10-06T05:36:54.309Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/ec/c5c618767bcdf66e88945ec0157d7f6c4a1322f1473392319b7a2501ded7/frozenlist-1.8.0-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:5500ef82073f599ac84d888e3a8c1f77ac831183244bfd7f11eaa0289fb30714", size = 294676, upload-time = "2025-10-06T05:36:55.566Z" },
-    { url = "https://files.pythonhosted.org/packages/7c/ce/3934758637d8f8a88d11f0585d6495ef54b2044ed6ec84492a91fa3b27aa/frozenlist-1.8.0-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:50066c3997d0091c411a66e710f4e11752251e6d2d73d70d8d5d4c76442a199d", size = 300638, upload-time = "2025-10-06T05:36:56.758Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/4f/a7e4d0d467298f42de4b41cbc7ddaf19d3cfeabaf9ff97c20c6c7ee409f9/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:5c1c8e78426e59b3f8005e9b19f6ff46e5845895adbde20ece9218319eca6506", size = 283067, upload-time = "2025-10-06T05:36:57.965Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/48/c7b163063d55a83772b268e6d1affb960771b0e203b632cfe09522d67ea5/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:eefdba20de0d938cec6a89bd4d70f346a03108a19b9df4248d3cf0d88f1b0f51", size = 292101, upload-time = "2025-10-06T05:36:59.237Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/d0/2366d3c4ecdc2fd391e0afa6e11500bfba0ea772764d631bbf82f0136c9d/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:cf253e0e1c3ceb4aaff6df637ce033ff6535fb8c70a764a8f46aafd3d6ab798e", size = 289901, upload-time = "2025-10-06T05:37:00.811Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/94/daff920e82c1b70e3618a2ac39fbc01ae3e2ff6124e80739ce5d71c9b920/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:032efa2674356903cd0261c4317a561a6850f3ac864a63fc1583147fb05a79b0", size = 289395, upload-time = "2025-10-06T05:37:02.115Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/20/bba307ab4235a09fdcd3cc5508dbabd17c4634a1af4b96e0f69bfe551ebd/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:6da155091429aeba16851ecb10a9104a108bcd32f6c1642867eadaee401c1c41", size = 283659, upload-time = "2025-10-06T05:37:03.711Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/00/04ca1c3a7a124b6de4f8a9a17cc2fcad138b4608e7a3fc5877804b8715d7/frozenlist-1.8.0-cp313-cp313t-win32.whl", hash = "sha256:0f96534f8bfebc1a394209427d0f8a63d343c9779cda6fc25e8e121b5fd8555b", size = 43492, upload-time = "2025-10-06T05:37:04.915Z" },
-    { url = "https://files.pythonhosted.org/packages/59/5e/c69f733a86a94ab10f68e496dc6b7e8bc078ebb415281d5698313e3af3a1/frozenlist-1.8.0-cp313-cp313t-win_amd64.whl", hash = "sha256:5d63a068f978fc69421fb0e6eb91a9603187527c86b7cd3f534a5b77a592b888", size = 48034, upload-time = "2025-10-06T05:37:06.343Z" },
-    { url = "https://files.pythonhosted.org/packages/16/6c/be9d79775d8abe79b05fa6d23da99ad6e7763a1d080fbae7290b286093fd/frozenlist-1.8.0-cp313-cp313t-win_arm64.whl", hash = "sha256:bf0a7e10b077bf5fb9380ad3ae8ce20ef919a6ad93b4552896419ac7e1d8e042", size = 41749, upload-time = "2025-10-06T05:37:07.431Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/c8/85da824b7e7b9b6e7f7705b2ecaf9591ba6f79c1177f324c2735e41d36a2/frozenlist-1.8.0-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:cee686f1f4cadeb2136007ddedd0aaf928ab95216e7691c63e50a8ec066336d0", size = 86127, upload-time = "2025-10-06T05:37:08.438Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/e8/a1185e236ec66c20afd72399522f142c3724c785789255202d27ae992818/frozenlist-1.8.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:119fb2a1bd47307e899c2fac7f28e85b9a543864df47aa7ec9d3c1b4545f096f", size = 49698, upload-time = "2025-10-06T05:37:09.48Z" },
-    { url = "https://files.pythonhosted.org/packages/a1/93/72b1736d68f03fda5fdf0f2180fb6caaae3894f1b854d006ac61ecc727ee/frozenlist-1.8.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:4970ece02dbc8c3a92fcc5228e36a3e933a01a999f7094ff7c23fbd2beeaa67c", size = 49749, upload-time = "2025-10-06T05:37:10.569Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/b2/fabede9fafd976b991e9f1b9c8c873ed86f202889b864756f240ce6dd855/frozenlist-1.8.0-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:cba69cb73723c3f329622e34bdbf5ce1f80c21c290ff04256cff1cd3c2036ed2", size = 231298, upload-time = "2025-10-06T05:37:11.993Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/3b/d9b1e0b0eed36e70477ffb8360c49c85c8ca8ef9700a4e6711f39a6e8b45/frozenlist-1.8.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:778a11b15673f6f1df23d9586f83c4846c471a8af693a22e066508b77d201ec8", size = 232015, upload-time = "2025-10-06T05:37:13.194Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/94/be719d2766c1138148564a3960fc2c06eb688da592bdc25adcf856101be7/frozenlist-1.8.0-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:0325024fe97f94c41c08872db482cf8ac4800d80e79222c6b0b7b162d5b13686", size = 225038, upload-time = "2025-10-06T05:37:14.577Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/09/6712b6c5465f083f52f50cf74167b92d4ea2f50e46a9eea0523d658454ae/frozenlist-1.8.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:97260ff46b207a82a7567b581ab4190bd4dfa09f4db8a8b49d1a958f6aa4940e", size = 240130, upload-time = "2025-10-06T05:37:15.781Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/d4/cd065cdcf21550b54f3ce6a22e143ac9e4836ca42a0de1022da8498eac89/frozenlist-1.8.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:54b2077180eb7f83dd52c40b2750d0a9f175e06a42e3213ce047219de902717a", size = 242845, upload-time = "2025-10-06T05:37:17.037Z" },
-    { url = "https://files.pythonhosted.org/packages/62/c3/f57a5c8c70cd1ead3d5d5f776f89d33110b1addae0ab010ad774d9a44fb9/frozenlist-1.8.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:2f05983daecab868a31e1da44462873306d3cbfd76d1f0b5b69c473d21dbb128", size = 229131, upload-time = "2025-10-06T05:37:18.221Z" },
-    { url = "https://files.pythonhosted.org/packages/6c/52/232476fe9cb64f0742f3fde2b7d26c1dac18b6d62071c74d4ded55e0ef94/frozenlist-1.8.0-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:33f48f51a446114bc5d251fb2954ab0164d5be02ad3382abcbfe07e2531d650f", size = 240542, upload-time = "2025-10-06T05:37:19.771Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/85/07bf3f5d0fb5414aee5f47d33c6f5c77bfe49aac680bfece33d4fdf6a246/frozenlist-1.8.0-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:154e55ec0655291b5dd1b8731c637ecdb50975a2ae70c606d100750a540082f7", size = 237308, upload-time = "2025-10-06T05:37:20.969Z" },
-    { url = "https://files.pythonhosted.org/packages/11/99/ae3a33d5befd41ac0ca2cc7fd3aa707c9c324de2e89db0e0f45db9a64c26/frozenlist-1.8.0-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:4314debad13beb564b708b4a496020e5306c7333fa9a3ab90374169a20ffab30", size = 238210, upload-time = "2025-10-06T05:37:22.252Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/60/b1d2da22f4970e7a155f0adde9b1435712ece01b3cd45ba63702aea33938/frozenlist-1.8.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:073f8bf8becba60aa931eb3bc420b217bb7d5b8f4750e6f8b3be7f3da85d38b7", size = 231972, upload-time = "2025-10-06T05:37:23.5Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/ab/945b2f32de889993b9c9133216c068b7fcf257d8595a0ac420ac8677cab0/frozenlist-1.8.0-cp314-cp314-win32.whl", hash = "sha256:bac9c42ba2ac65ddc115d930c78d24ab8d4f465fd3fc473cdedfccadb9429806", size = 40536, upload-time = "2025-10-06T05:37:25.581Z" },
-    { url = "https://files.pythonhosted.org/packages/59/ad/9caa9b9c836d9ad6f067157a531ac48b7d36499f5036d4141ce78c230b1b/frozenlist-1.8.0-cp314-cp314-win_amd64.whl", hash = "sha256:3e0761f4d1a44f1d1a47996511752cf3dcec5bbdd9cc2b4fe595caf97754b7a0", size = 44330, upload-time = "2025-10-06T05:37:26.928Z" },
-    { url = "https://files.pythonhosted.org/packages/82/13/e6950121764f2676f43534c555249f57030150260aee9dcf7d64efda11dd/frozenlist-1.8.0-cp314-cp314-win_arm64.whl", hash = "sha256:d1eaff1d00c7751b7c6662e9c5ba6eb2c17a2306ba5e2a37f24ddf3cc953402b", size = 40627, upload-time = "2025-10-06T05:37:28.075Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/c7/43200656ecc4e02d3f8bc248df68256cd9572b3f0017f0a0c4e93440ae23/frozenlist-1.8.0-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:d3bb933317c52d7ea5004a1c442eef86f426886fba134ef8cf4226ea6ee1821d", size = 89238, upload-time = "2025-10-06T05:37:29.373Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/29/55c5f0689b9c0fb765055629f472c0de484dcaf0acee2f7707266ae3583c/frozenlist-1.8.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:8009897cdef112072f93a0efdce29cd819e717fd2f649ee3016efd3cd885a7ed", size = 50738, upload-time = "2025-10-06T05:37:30.792Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/7d/b7282a445956506fa11da8c2db7d276adcbf2b17d8bb8407a47685263f90/frozenlist-1.8.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:2c5dcbbc55383e5883246d11fd179782a9d07a986c40f49abe89ddf865913930", size = 51739, upload-time = "2025-10-06T05:37:32.127Z" },
-    { url = "https://files.pythonhosted.org/packages/62/1c/3d8622e60d0b767a5510d1d3cf21065b9db874696a51ea6d7a43180a259c/frozenlist-1.8.0-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:39ecbc32f1390387d2aa4f5a995e465e9e2f79ba3adcac92d68e3e0afae6657c", size = 284186, upload-time = "2025-10-06T05:37:33.21Z" },
-    { url = "https://files.pythonhosted.org/packages/2d/14/aa36d5f85a89679a85a1d44cd7a6657e0b1c75f61e7cad987b203d2daca8/frozenlist-1.8.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:92db2bf818d5cc8d9c1f1fc56b897662e24ea5adb36ad1f1d82875bd64e03c24", size = 292196, upload-time = "2025-10-06T05:37:36.107Z" },
-    { url = "https://files.pythonhosted.org/packages/05/23/6bde59eb55abd407d34f77d39a5126fb7b4f109a3f611d3929f14b700c66/frozenlist-1.8.0-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:2dc43a022e555de94c3b68a4ef0b11c4f747d12c024a520c7101709a2144fb37", size = 273830, upload-time = "2025-10-06T05:37:37.663Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/3f/22cff331bfad7a8afa616289000ba793347fcd7bc275f3b28ecea2a27909/frozenlist-1.8.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:cb89a7f2de3602cfed448095bab3f178399646ab7c61454315089787df07733a", size = 294289, upload-time = "2025-10-06T05:37:39.261Z" },
-    { url = "https://files.pythonhosted.org/packages/a4/89/5b057c799de4838b6c69aa82b79705f2027615e01be996d2486a69ca99c4/frozenlist-1.8.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:33139dc858c580ea50e7e60a1b0ea003efa1fd42e6ec7fdbad78fff65fad2fd2", size = 300318, upload-time = "2025-10-06T05:37:43.213Z" },
-    { url = "https://files.pythonhosted.org/packages/30/de/2c22ab3eb2a8af6d69dc799e48455813bab3690c760de58e1bf43b36da3e/frozenlist-1.8.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:168c0969a329b416119507ba30b9ea13688fafffac1b7822802537569a1cb0ef", size = 282814, upload-time = "2025-10-06T05:37:45.337Z" },
-    { url = "https://files.pythonhosted.org/packages/59/f7/970141a6a8dbd7f556d94977858cfb36fa9b66e0892c6dd780d2219d8cd8/frozenlist-1.8.0-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:28bd570e8e189d7f7b001966435f9dac6718324b5be2990ac496cf1ea9ddb7fe", size = 291762, upload-time = "2025-10-06T05:37:46.657Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/15/ca1adae83a719f82df9116d66f5bb28bb95557b3951903d39135620ef157/frozenlist-1.8.0-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:b2a095d45c5d46e5e79ba1e5b9cb787f541a8dee0433836cea4b96a2c439dcd8", size = 289470, upload-time = "2025-10-06T05:37:47.946Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/83/dca6dc53bf657d371fbc88ddeb21b79891e747189c5de990b9dfff2ccba1/frozenlist-1.8.0-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:eab8145831a0d56ec9c4139b6c3e594c7a83c2c8be25d5bcf2d86136a532287a", size = 289042, upload-time = "2025-10-06T05:37:49.499Z" },
-    { url = "https://files.pythonhosted.org/packages/96/52/abddd34ca99be142f354398700536c5bd315880ed0a213812bc491cff5e4/frozenlist-1.8.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:974b28cf63cc99dfb2188d8d222bc6843656188164848c4f679e63dae4b0708e", size = 283148, upload-time = "2025-10-06T05:37:50.745Z" },
-    { url = "https://files.pythonhosted.org/packages/af/d3/76bd4ed4317e7119c2b7f57c3f6934aba26d277acc6309f873341640e21f/frozenlist-1.8.0-cp314-cp314t-win32.whl", hash = "sha256:342c97bf697ac5480c0a7ec73cd700ecfa5a8a40ac923bd035484616efecc2df", size = 44676, upload-time = "2025-10-06T05:37:52.222Z" },
-    { url = "https://files.pythonhosted.org/packages/89/76/c615883b7b521ead2944bb3480398cbb07e12b7b4e4d073d3752eb721558/frozenlist-1.8.0-cp314-cp314t-win_amd64.whl", hash = "sha256:06be8f67f39c8b1dc671f5d83aaefd3358ae5cdcf8314552c57e7ed3e6475bdd", size = 49451, upload-time = "2025-10-06T05:37:53.425Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/a3/5982da14e113d07b325230f95060e2169f5311b1017ea8af2a29b374c289/frozenlist-1.8.0-cp314-cp314t-win_arm64.whl", hash = "sha256:102e6314ca4da683dca92e3b1355490fed5f313b768500084fbe6371fddfdb79", size = 42507, upload-time = "2025-10-06T05:37:54.513Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/9a/e35b4a917281c0b8419d4207f4334c8e8c5dbf4f3f5f9ada73958d937dcc/frozenlist-1.8.0-py3-none-any.whl", hash = "sha256:0c18a16eab41e82c295618a77502e17b195883241c563b00f0aa5106fc4eaa0d", size = 13409, upload-time = "2025-10-06T05:38:16.721Z" },
-]
-
-[[package]]
-name = "future"
-version = "1.0.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a7/b2/4140c69c6a66432916b26158687e821ba631a4c9273c474343badf84d3ba/future-1.0.0.tar.gz", hash = "sha256:bd2968309307861edae1458a4f8a4f3598c03be43b97521076aebf5d94c07b05", size = 1228490, upload-time = "2024-02-21T11:52:38.461Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/da/71/ae30dadffc90b9006d77af76b393cb9dfbfc9629f339fc1574a1c52e6806/future-1.0.0-py3-none-any.whl", hash = "sha256:929292d34f5872e70396626ef385ec22355a1fae8ad29e1a734c3e43f9fbc216", size = 491326, upload-time = "2024-02-21T11:52:35.956Z" },
-]
-
 [[package]]
 name = "h11"
 version = "0.16.0"
@@ -2404,187 +2049,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/e8/3d/1087453384dbde46a8c7f9356eead2c58be8a7bf156bca40243377c85715/more_itertools-11.1.0-py3-none-any.whl", hash = "sha256:4b65538ae22f6fed0ce4874efd317463a7489796a0939fa66824dd542125a192", size = 72226, upload-time = "2026-05-22T14:14:28.824Z" },
 ]
 
-[[package]]
-name = "multidict"
-version = "6.9.1"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/d6/99/1d4d69c3512d0ddbfa3a1b69cfd9a151012ab2eb4eabbb096201b1f0b7d8/multidict-6.9.1.tar.gz", hash = "sha256:0f06e60fa190aa7abd0914c2a766736fdc8e9f34878c4346338534b73d1b20e2", size = 182404, upload-time = "2026-09-21T17:59:05.362Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/eb/1c/fb2114207afc7f00ab9897ae5beeee27de5ec58ea8b9623e879f2c56f003/multidict-6.9.1-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:aef74e9beabbd6c4aafc091dabff86d046ccf013ce1e4396c0fbb01b4cad9de8", size = 97307, upload-time = "2026-09-21T17:54:14.957Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/23/1ab8c7349adbb30c8cf41b88b0794740df8ea9f7de2e382da040a2f5bd8e/multidict-6.9.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:1ca5ebe6d454f1e5496cf052386a559f1080bf2de75bf327ebca0a6003b79f19", size = 58830, upload-time = "2026-09-21T17:54:16.261Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/89/b845535014a9ad50537ca50204aaf6351c5368822a3acd9da854fb2a5a34/multidict-6.9.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:02f6d0c4b70f783305e73f9944d8efe6be1022550f0974ba0ae9d8893c0350fa", size = 57645, upload-time = "2026-09-21T17:54:17.491Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/4f/28ebb40a6f8e8aa7be78bcbe4bf9a1ac9518c40ef88accf2d4cd6ed7a7e0/multidict-6.9.1-cp310-cp310-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:8050e75af7e4c6e2d5260b84eeedb618f3e452e66473432e085b5d1b81429299", size = 301535, upload-time = "2026-09-21T17:54:18.946Z" },
-    { url = "https://files.pythonhosted.org/packages/33/51/0de5fc980df34d1ffed9ef68f60ce86c2d4baa3d422598a53f8730c56757/multidict-6.9.1-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4736d350371337825cac1793c9f7c40701c32a03912548c2a7608e51679cbb96", size = 298796, upload-time = "2026-09-21T17:54:20.52Z" },
-    { url = "https://files.pythonhosted.org/packages/55/58/dd86067bdd2e961fdee8ec659fabc50f4e76403616b508714ec2686b0a49/multidict-6.9.1-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:02fe09dc197b8ae7e355371e51e5dce2f39060cd5a8badf94904527e23a3f188", size = 282392, upload-time = "2026-09-21T17:54:21.86Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/52/5464a2675579e3adb48b7cd4707a59da499660f0e22c024bc7281d2d9bdf/multidict-6.9.1-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:ad4528cdce058b684f75fad1faf4a6a6c992fe2f08376370ca66e4ce5916a84a", size = 314538, upload-time = "2026-09-21T17:54:23.366Z" },
-    { url = "https://files.pythonhosted.org/packages/d3/69/7f2b3fafe064181669157ce872a097b08a0546fb6fd2481e8c5604b47ec3/multidict-6.9.1-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:8885e3808aedbd6725b921fb67dacaae0678933561ddd47c2b01315198c70e2e", size = 315675, upload-time = "2026-09-21T17:54:24.808Z" },
-    { url = "https://files.pythonhosted.org/packages/bd/53/f65ed68b96eea2b4f6fa4f9031bdfccd8f3097c429e3d371c545d1c40ca4/multidict-6.9.1-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d3b6e6840421c83ccb60398e333b44f910b0907bb409597685ab2eedd1e22eab", size = 303685, upload-time = "2026-09-21T17:54:26.236Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/5f/ade05795c6fb9adfccd61695a0f0509bc793583f589c4b1b87f27215a139/multidict-6.9.1-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c9648ed33dc8179e4ec04bbc73bd7f0038e1e81217a69467f61f02a78bf07e88", size = 280306, upload-time = "2026-09-21T17:54:27.685Z" },
-    { url = "https://files.pythonhosted.org/packages/60/b2/c996349a61e0f43c7c95877943a67476261bf906ff993670afbd33ff5bf4/multidict-6.9.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:d9d6544790ba50438a9c1a903c3c4afb1ec8a7832db5518549275b40ef0dd4b1", size = 291691, upload-time = "2026-09-21T17:54:29.004Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/87/8b7016d1084854729c80acfae71c5a51ea7e7c9411d66c3e2729772f5723/multidict-6.9.1-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:1c9f3c25df6c9d3bbae4f6fd3f514b1c5c740a2110f56ccf36069c85417e289c", size = 290357, upload-time = "2026-09-21T17:54:30.491Z" },
-    { url = "https://files.pythonhosted.org/packages/7a/3d/801653b6aa9343a7430cecdefa1bf71ff24432224c02f15cc15e47837652/multidict-6.9.1-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:cf22b43f35b7dbb9f71e8ee2041b5c00029cdfc28ede3a2f31cf8906f9a6c126", size = 305831, upload-time = "2026-09-21T17:54:32.132Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/f3/9fc997861920bdbf70db82bdce5c802ec6477754c4bd78cff2898e3c63f9/multidict-6.9.1-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:8ed78ccad4c7b421804f5d524b7740946a7ef75d89dc0dac52e9d7c24c472410", size = 308995, upload-time = "2026-09-21T17:54:33.571Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/5f/278b5a2c99d6de27914b49158dd6f2a6481e53359142cc366dff04821a2f/multidict-6.9.1-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:e3b1aa25f01238886a6baed9e13b9a9240ed344346c79ae280ae65e8603b21d5", size = 279240, upload-time = "2026-09-21T17:54:35.025Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/db/0922594c601a691eb4365a83f4f92104ef87a9728d8066fa25c99349e754/multidict-6.9.1-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:bc94a68ea5e18f8e85dc6b522bcb53093f692c8eb62b4837ac047da73956cbe4", size = 305487, upload-time = "2026-09-21T17:54:36.555Z" },
-    { url = "https://files.pythonhosted.org/packages/64/cb/07bca86d4a361a87128f3019540d7689800fdcad44e3b3ad08f1f035ed74/multidict-6.9.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:73533644e1f69ea1164d56cc6505f564c6c44072b646b66d67df2d31fed0348c", size = 301997, upload-time = "2026-09-21T17:54:37.903Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/e3/99591bf626613ea35779d2460949b45e59e589dc9058d6693c923eccd4e5/multidict-6.9.1-cp310-cp310-win32.whl", hash = "sha256:66987aa68b0f7c2a1cc5f388ca962b8ed92b10f79de38d6d0d8c716154f519d9", size = 51205, upload-time = "2026-09-21T17:54:39.152Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/18/10c008aac77297aa618631e8726ece31668f9dc9d9c848e4b5d2e68eb3d3/multidict-6.9.1-cp310-cp310-win_amd64.whl", hash = "sha256:a32b78c1e52ebd8e247bb68300b90b233300d8816faa008ed0713bc539fb6af0", size = 59049, upload-time = "2026-09-21T17:54:40.465Z" },
-    { url = "https://files.pythonhosted.org/packages/b1/b1/da73a58bef2613571902a824f1e11185207ba756215c99038f6d220bc167/multidict-6.9.1-cp310-cp310-win_arm64.whl", hash = "sha256:ab64ace1a68682d191d9bedd9d4c939406ad86b1d9f628180410644249ad46c2", size = 54610, upload-time = "2026-09-21T17:54:41.605Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/24/3823efc330630a1f132bcd0a9b182ddec3c53f452f551c8e8d3aaf5a2d20/multidict-6.9.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:910d4260512660484c0dc1588a316fbb35a40c081c36fc51d1225351af17cfe4", size = 96739, upload-time = "2026-09-21T17:54:42.815Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/69/36331fe1d3aeb0c525a9972d6cf82791075a395aa96f026f060009d691ae/multidict-6.9.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:33fa55b990f81c2927e01399ace0d18926c69d69baa8cdaa819424132fb97987", size = 58514, upload-time = "2026-09-21T17:54:44.064Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/ca/5860651f782078ef13f2761c2593f4ba066d76f626b2f30f23a7f838b775/multidict-6.9.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:369b5aa01b241cd3fea6890bdbb11a1425d87bf1515831500d518f4223e9d72c", size = 57303, upload-time = "2026-09-21T17:54:45.304Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/9f/c56e2fa223cb5d182660e1a09eec38880f96b7cd22769582f74447c60418/multidict-6.9.1-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:803f8b575a71b1b299d677c28db0653459c79b5308874efec813f17b7457c7f1", size = 320076, upload-time = "2026-09-21T17:54:46.826Z" },
-    { url = "https://files.pythonhosted.org/packages/59/97/eda4fe0cad51f96096363ed32d3e0f8df28dab00beff4d92adc9db517726/multidict-6.9.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b8a65621b98984a62e59403009591b8a5a7736273aefe1cab64cfb85b365cc07", size = 315489, upload-time = "2026-09-21T17:54:48.25Z" },
-    { url = "https://files.pythonhosted.org/packages/24/14/10b1ded0a4085a51c3054125f854da4f47ce4fec724a2d2503231b83f3db/multidict-6.9.1-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:13849a1d4f54c3809ae721e9e83ab28f5ea602f33660cb84eb6ef261eac706c1", size = 296716, upload-time = "2026-09-21T17:54:49.749Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/14/04d155dd18528443cb9009f3a9f35f7417773797d072c95104ff17b8b9b7/multidict-6.9.1-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:dd9a137a4a9becda3094f3831cd026380f75f6855e051eefe4c73ade524f1cc3", size = 330244, upload-time = "2026-09-21T17:54:51.26Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/90/284d10b3a9e5b312a8ec5b7a175fc7d560eefdc99886320449891a197992/multidict-6.9.1-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:9ae9614c317c50836689ce2dfde07c05fe0b16378562e2221746c3913ede3c80", size = 331288, upload-time = "2026-09-21T17:54:52.595Z" },
-    { url = "https://files.pythonhosted.org/packages/27/50/f420de3683f9b047fc5588064d84043ef57a7152ef451b8373dfc7068d22/multidict-6.9.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e8f1e362c9352b50ed120f001046fdbb80810c9d56580f4c3fc13bbe30823387", size = 320663, upload-time = "2026-09-21T17:54:53.91Z" },
-    { url = "https://files.pythonhosted.org/packages/01/ab/0120a650d7ce4fe167299c13a13cc4ee2dc72458a9c0e9e9330b824b73c9/multidict-6.9.1-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0dd655518f136febd96c05131a76a863e32fc2a1d7acd4e3c959e3ceb77d8345", size = 291139, upload-time = "2026-09-21T17:54:55.313Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/3f/c66342f73ee5cd2c9b1dda6cfce89b5f348c48921b8c8b6e59aafbbfe31a/multidict-6.9.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:2c5d675da8f1cb5650271c8ad5e95c0a3e5a183c105e72d953b12877b1c8d0fd", size = 310044, upload-time = "2026-09-21T17:54:56.745Z" },
-    { url = "https://files.pythonhosted.org/packages/05/0d/e44b90d9e77e44ec3473c4c7ac7ea95764d7e8fbf6d5a085ef9bff7ce0c2/multidict-6.9.1-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:658f90f49cf5af2441cad0a2b801c3ef520471989a1ec55bcb25b255b2ca8d2f", size = 303279, upload-time = "2026-09-21T17:54:58.178Z" },
-    { url = "https://files.pythonhosted.org/packages/97/8a/7741f7c23c211fae31ab546f0ba41569dae7671cf7ca30d5afb59e9d92aa/multidict-6.9.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:43124fe172ada86d03ac3c8dc8179091341f6724d5e5d5b160e1587e4cd3761b", size = 326177, upload-time = "2026-09-21T17:54:59.825Z" },
-    { url = "https://files.pythonhosted.org/packages/e8/63/0cdbfbbe36316b2ef4b8e011afaca2cf291a73fe4fabf34dd0b22e3ee48a/multidict-6.9.1-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:b2f0adc22a4eb31e545221d93fc73a0f6a8cc2379d0f4309f71d1d17ba938b82", size = 323526, upload-time = "2026-09-21T17:55:01.43Z" },
-    { url = "https://files.pythonhosted.org/packages/98/05/0c86e9678e78f4596df0ed7f59d2aa755107da3f2a92f1b7fa150e94cbb8/multidict-6.9.1-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:7fc59e9ba821b220944ccfe0f89c9dc4745f6d097569992356eb03869f21e953", size = 290278, upload-time = "2026-09-21T17:55:02.993Z" },
-    { url = "https://files.pythonhosted.org/packages/95/8e/71bd7f43c4883cba6c5f96db88bd2311d52e74ad7680be5915938490d56f/multidict-6.9.1-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:87cc632c88ee5dc80e12681047839304d98ee5c9a708d686505767001c9b8b9a", size = 321142, upload-time = "2026-09-21T17:55:04.48Z" },
-    { url = "https://files.pythonhosted.org/packages/2d/00/bf59d6bb22a4c152e4039574c29490caf3c65107715121807b4bd7cde244/multidict-6.9.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b828cf64d62dc09ac183f03c1aeedd164ade96a2ce4934109452edf29de1dd13", size = 319045, upload-time = "2026-09-21T17:55:06.119Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/3c/f27f4f045198bf1c4bcd6eb3b6cf06be2dceaceb6e67222b903fce7a6749/multidict-6.9.1-cp311-cp311-win32.whl", hash = "sha256:2c1aeb92eea59d824f004341b26d5e4b47a8a441cf9726769b9a90abf9d0e08f", size = 51309, upload-time = "2026-09-21T17:55:07.531Z" },
-    { url = "https://files.pythonhosted.org/packages/91/17/c2064aef64efc007bc89a571f843e5772f27946eb9bc018731bf8016e319/multidict-6.9.1-cp311-cp311-win_amd64.whl", hash = "sha256:5f89dad732280e7a10b74d40b91364f88e13c3f2c08c2ef83a8cd42f7a61af2e", size = 59148, upload-time = "2026-09-21T17:55:08.936Z" },
-    { url = "https://files.pythonhosted.org/packages/45/a1/3bab1827edd813dfb90712af5cbb7fc1473ed4d9c871d103df4f4bb950c2/multidict-6.9.1-cp311-cp311-win_arm64.whl", hash = "sha256:5800368526647146978389dfaa46da3356291e9f0fff9a4ef12e8c2bef964a0d", size = 54258, upload-time = "2026-09-21T17:55:10.191Z" },
-    { url = "https://files.pythonhosted.org/packages/d9/0d/4b5afb6d3e545c9af0cdfe2db8f6f4c6664568c23d863d888674e447e6a4/multidict-6.9.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:29138fef49828542e859828107e42e50d0e587c513b7eb4b2d92bade2b0860fe", size = 98360, upload-time = "2026-09-21T17:55:11.508Z" },
-    { url = "https://files.pythonhosted.org/packages/89/ab/1b9ca66251899981b21138b87da9d5a9c2c81af12b1ea7d19466972f7fe2/multidict-6.9.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:19e31815d41cefc365489e591d105d2baceb2f65aa75d29471fbdbda8651e006", size = 59979, upload-time = "2026-09-21T17:55:12.866Z" },
-    { url = "https://files.pythonhosted.org/packages/36/eb/6ae44062466c26c8469ef43f2481a6a48d8cea0587b2d54514ec92e2adfd/multidict-6.9.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:6ed30be8918e18c8bed0a2e8b70639ecf02feb61ed00ca2e41cfcb2a50fa3f42", size = 57736, upload-time = "2026-09-21T17:55:14.223Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/5c/a67817593019257a4ac8b0d1b4c426030e637c047b0692ef405439ecea7a/multidict-6.9.1-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:637f4ae36264bd7b8d9a60193acddc1d735ad52e8ed53a19931ea6d921fea8e5", size = 333097, upload-time = "2026-09-21T17:55:15.591Z" },
-    { url = "https://files.pythonhosted.org/packages/90/bf/599ae2e6222822d88a247a8a7ae82fe6fd25d5700757b79603d5edafe6a0/multidict-6.9.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:35fc236507fb1b3138f0af5ecd5f94ed752d4d6d826248eae425f86204013eea", size = 334196, upload-time = "2026-09-21T17:55:17.015Z" },
-    { url = "https://files.pythonhosted.org/packages/15/10/d8aac5acacbe7f5c117866c776ec26d5f15a868759b6f37ad8e7ed3b5b02/multidict-6.9.1-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e58952f04772f59f11c6e007471449809a30165188669bca8fdb19dde40a8f24", size = 317465, upload-time = "2026-09-21T17:55:18.412Z" },
-    { url = "https://files.pythonhosted.org/packages/19/0a/714f796f7293a8b1c5c3f465a26996231d5450c54e85d64ef1258c091134/multidict-6.9.1-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:d35a4f1c63f07fbb8c8f9946dea98b21eddf6c57421585f71d91864be3ba2a24", size = 345914, upload-time = "2026-09-21T17:55:20.306Z" },
-    { url = "https://files.pythonhosted.org/packages/da/b1/e37fbf769c567be277bcf32df6234035a4384677fcc1bd852752be3d6b93/multidict-6.9.1-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b5f8771aaaed7f80e84a4e471d2f29ab6721e4595075e54d03ae1ed951b2000a", size = 351163, upload-time = "2026-09-21T17:55:22.21Z" },
-    { url = "https://files.pythonhosted.org/packages/ed/5b/db08419c1e1f7c9d60cfd2787b2b517d7ae4ebbda8281b48a33eb5141467/multidict-6.9.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:976fd7689d69ec78d67d31d38d396d8adb562f7e8368279f76aed4aa451fa06d", size = 336881, upload-time = "2026-09-21T17:55:23.699Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/07/cc9bc8a62651d2d53ab93ee4993b3a71b7cb78eb8ebfc9c757a5b6698617/multidict-6.9.1-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:95052e8777a86bae87c0bd0b5ab22d809e3d1d02bf69e3e66ddda5ba75a05805", size = 303405, upload-time = "2026-09-21T17:55:25.305Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/0c/8e912afafa70e944dbb8bec4b66ca6e008511395278c0d3dd0e89567536a/multidict-6.9.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:1a8adfcaf96f587ab138476eaddef95f29b8a2a8a9afbfea8d2fd62180995d02", size = 324265, upload-time = "2026-09-21T17:55:26.989Z" },
-    { url = "https://files.pythonhosted.org/packages/66/6a/62c2af80fb085e6234805017af857b8e913dfac7a55e9c1349c27768c58a/multidict-6.9.1-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:1a53de2772cfb74559df2eb4456ec4eeb908435ec55a84b69370d9d745d62aa8", size = 322085, upload-time = "2026-09-21T17:55:28.732Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/6b/35bf801b336fd960811207203ffdcdc24acc3558b3e7ff2e1c914b141e70/multidict-6.9.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:0f2ce963299d42fa3f22a90adc0fdf174792ffef5ff4c7ffb68260548fb05580", size = 338107, upload-time = "2026-09-21T17:55:30.303Z" },
-    { url = "https://files.pythonhosted.org/packages/80/41/495ef65bf5bba29d142d81b3fe1b8154b919bed70e96491b1e93c3c26f0f/multidict-6.9.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:5b30ddf7234e611ca877575b62840e6af5977f92f1f9d532eedbb05a44ff8004", size = 339631, upload-time = "2026-09-21T17:55:32.012Z" },
-    { url = "https://files.pythonhosted.org/packages/19/bd/057fdff5f4e04dcd40a960e38f77d19d3c4b67dd243ffa5f43718edb29fc/multidict-6.9.1-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:63ada7ee2e9345695f9e9bc4c65d72222253f07b1ac94fd0e37555cc6f3c7f60", size = 302080, upload-time = "2026-09-21T17:55:33.817Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/de/9ace933ee8dad808632523726f42255b09600087219e3d4ead7369820910/multidict-6.9.1-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:3c95601ed98fad3f6e2f8fe809c3b526b0fab31ef525e00a155e227f3d17f58a", size = 341107, upload-time = "2026-09-21T17:55:35.471Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/ac/7c1204406097bfc5c283d4a3287d61166807d189917567df4c1318484fc4/multidict-6.9.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:c148e8b596000dd3e4bfe206e70f3e666be18d72032e0012555f2373c52e35d6", size = 333482, upload-time = "2026-09-21T17:55:37.002Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/c0/a70c32ea3299ebe00f44533740cb46905717c51faf29bbd3ce8bb5886d9d/multidict-6.9.1-cp312-cp312-win32.whl", hash = "sha256:f9dad513626a33670f17cddc6078e30e311f444c957e8dbfc5b2b4603c8b4edb", size = 52548, upload-time = "2026-09-21T17:55:38.529Z" },
-    { url = "https://files.pythonhosted.org/packages/d7/2e/8c9c2591df01e5692ad1bf92febb082a17b1c6c3a19aa8b7ff49988fd989/multidict-6.9.1-cp312-cp312-win_amd64.whl", hash = "sha256:a16a1dc8529f9e734a41c3b856f3eae7ebacdc061dde3f8a844e0c7889c97203", size = 59622, upload-time = "2026-09-21T17:55:39.86Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/95/59f4472ec512bc180fd207899594c7803ece96262ff9aaa3a4b6d7da6940/multidict-6.9.1-cp312-cp312-win_arm64.whl", hash = "sha256:361f7206cf341ba94fb015688f5c8b480f8e63bd58a4c14a48aeca7851a241cc", size = 54930, upload-time = "2026-09-21T17:55:41.155Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/45/ddf7c76860f5f553a23ad3ca38463ccf5247081618977742c8dc4625355e/multidict-6.9.1-cp313-cp313-android_24_x86_64.whl", hash = "sha256:d7bf9e43282d69561618e8a0ea33368d532ebef42f15c096f427090521dd74f3", size = 63266, upload-time = "2026-09-21T17:55:42.676Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/d3/f4ae5945ea2de597eaeb4eca3a74c59783ace54482c9b49435442b63efa8/multidict-6.9.1-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:03d47df72f084f757c1cb771188d5f4e3a805e4abc4d67e32509272343ae9382", size = 55771, upload-time = "2026-09-21T17:55:44.016Z" },
-    { url = "https://files.pythonhosted.org/packages/93/7d/15468239920040d01c686e5ae669e6382f7bf31fc3e5e0a6b8f1c3b32d3b/multidict-6.9.1-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:6bc94fe17c3c56e5418f79515b786b101845f70609b0d19d0c1ba13448e5633a", size = 57116, upload-time = "2026-09-21T17:55:45.315Z" },
-    { url = "https://files.pythonhosted.org/packages/17/1b/b958f06aac2d8b1e485eb1c105b1b159cbf3868249e5142142451577dad2/multidict-6.9.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:8f2973bbd2bebd9d2e0cd6394c1292a1a19ccd56bdcbe1e174059f1a39be5b40", size = 97692, upload-time = "2026-09-21T17:55:46.674Z" },
-    { url = "https://files.pythonhosted.org/packages/93/6c/d6cfe18e61010166d7237d7527c775eb9843e7078feadea45b7628751b60/multidict-6.9.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:de7738b8c0bb74c4cc16bbd7fb49fc2bcf6430dba11b3432cd52768ae40933e8", size = 59556, upload-time = "2026-09-21T17:55:48.22Z" },
-    { url = "https://files.pythonhosted.org/packages/46/46/9b4c1127cece0289fb207d04aae5116382ddfcb2a4dc8e0cb49a33f3c7b3/multidict-6.9.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:e5ccad4b7bac125722f48d6f862bed3b514d8526deea06316bb72f152cd30a7c", size = 57357, upload-time = "2026-09-21T17:55:49.998Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/fc/c18b07100a6064573e49e538d13d47eb2b5221f48080512df78aef54ab04/multidict-6.9.1-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:a49ff5cdb33654cb7d6a3c377aa2a83ddefaa1db31eb10bcf3c180aa84f9af8a", size = 330433, upload-time = "2026-09-21T17:55:51.435Z" },
-    { url = "https://files.pythonhosted.org/packages/62/ff/52a0082adeb69656b634609d4fb0ae65456deaae4cca3d5a12656626dc50/multidict-6.9.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b22ff30006a2f28f8bff878fb93413cbe3a4d1fd517c28081d848c90e9cfd2c8", size = 332487, upload-time = "2026-09-21T17:55:52.937Z" },
-    { url = "https://files.pythonhosted.org/packages/39/3e/80bd4729635a7af371ff4dcc312594cf96e73f98854491be8740792de430/multidict-6.9.1-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3adf06c66041aa21eeb8a71e82379b74773298c8e6d3d839b151aae441a99b94", size = 316911, upload-time = "2026-09-21T17:55:54.751Z" },
-    { url = "https://files.pythonhosted.org/packages/15/f4/7ea4a907e053e924e2e1694d90560f79f72056504bfd5e8483695f9527d2/multidict-6.9.1-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:963a8d8f97057082679523d0fd4c53a38f86bc58cabe4556faef682ae53fa2fa", size = 344950, upload-time = "2026-09-21T17:55:56.5Z" },
-    { url = "https://files.pythonhosted.org/packages/0d/16/9642ae41fbfbdc546aa481c2b07ae1bc087a94ab5f5020b4d9ab77da401f/multidict-6.9.1-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b66ccc5c2cdd26e74fa5d4c29ffae424cc6148bf93ce574821783fb3b6d452c5", size = 350264, upload-time = "2026-09-21T17:55:58.073Z" },
-    { url = "https://files.pythonhosted.org/packages/93/f2/e06c8e42074d0a4b8419bfe92afbd1d262190b69549ecbcd2dffa4f103c2/multidict-6.9.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7fd79c521f6290c69125fa2b85fa65d9e657e6a8ffaf722dc881b926bef4aa5c", size = 336213, upload-time = "2026-09-21T17:55:59.723Z" },
-    { url = "https://files.pythonhosted.org/packages/98/43/d7cf9ef4700e7c25244590d1b4f20cf12cbed86beba6c17be4d9e48c1099/multidict-6.9.1-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:1d804e4caf5d5da37d6dac1325da5629ebef1e27a294c2b568b295814aa36c7b", size = 302555, upload-time = "2026-09-21T17:56:01.666Z" },
-    { url = "https://files.pythonhosted.org/packages/7d/3a/54209920324bc3928f5f2ba28b01a6dd957a9d48c3aaff77e38faaf5668d/multidict-6.9.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:bb0d664505f4b112f384cffeee82e91e3f6448d8e574989479db4439b68cba05", size = 322247, upload-time = "2026-09-21T17:56:03.265Z" },
-    { url = "https://files.pythonhosted.org/packages/33/50/df96f961b178b621ab0adbf9221d4fd21534e1064fd9f5e85c1fa27fea55/multidict-6.9.1-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:9e14d17773b1b3c758ff153659a1824608a0cb562c45f484b5ed8a433428444a", size = 321787, upload-time = "2026-09-21T17:56:04.894Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/9b/37f354562a8f82f9c1f63d3a94300fc82126d50320175f0702bbd544f87c/multidict-6.9.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:083735b7f395894e43adb278d5dae901448883a835ff8f1977e285fefdb10418", size = 335498, upload-time = "2026-09-21T17:56:06.783Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/44/78e366efc6c004185295cc9eb9711c10f13eadf3b547603b9c5526329976/multidict-6.9.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:b65121091567847a8cb520d364ab22ba90e00d3cc55fa9eb34bb439f0684bcd1", size = 338244, upload-time = "2026-09-21T17:56:09.162Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/2b/ab5bd3964691abe4d14b43bdbdb8a621b77cea2ca352dc93159ec0a4575b/multidict-6.9.1-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:ea999ae6e80e66ad5eea287860951b033d0104ca34d6d87c7b5125ebe0e12721", size = 301641, upload-time = "2026-09-21T17:56:11.227Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/a8/f6bc899f5aafaba755edc8e4bb934bc00b1e405f8d3fbc1dd10283738074/multidict-6.9.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:095d900c242e00fbe5f321ee072e7278b4153e78c5ce9c1efde167d62c1e4771", size = 340162, upload-time = "2026-09-21T17:56:13.076Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/03/a8fc809ef364b8c231c065ea2ea2f97ae86d4f9a0e36b5721759fd606778/multidict-6.9.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6441cc837aea58be7d9baef1b2383eb8311ab9303f500f99ac90b584cd78bb14", size = 332826, upload-time = "2026-09-21T17:56:15.175Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/27/32dde80245e2024e9bb7a6ca3c2fb7c695dc74014cba557cc35be6f91e24/multidict-6.9.1-cp313-cp313-win32.whl", hash = "sha256:9c4880d017555d70dea367dd49271830842d48e3891c2da97da7ce8c4abcee40", size = 52378, upload-time = "2026-09-21T17:56:16.959Z" },
-    { url = "https://files.pythonhosted.org/packages/be/78/1bac2987edac273a6b27fa50e9204bc3466c94a7b4f6a44828d730f8810f/multidict-6.9.1-cp313-cp313-win_amd64.whl", hash = "sha256:ac51cd64bae51c462ea58ad2492c9b8209667a4ef60c45c4a304518b67598d5d", size = 59449, upload-time = "2026-09-21T17:56:18.336Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/32/2a77ce19eea48cb9b3521a202b513ba3349aafa702c8317be0b645ffb74b/multidict-6.9.1-cp313-cp313-win_arm64.whl", hash = "sha256:37a9ebe00c698279213d56e6c64e1962ab1e092918270649b397cac3dc196ca4", size = 54713, upload-time = "2026-09-21T17:56:19.774Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/0f/c6041015aa2cdc11e1dff0cae58898ae5525d19e35efd65a4ecf3c6ea235/multidict-6.9.1-cp314-cp314-android_24_x86_64.whl", hash = "sha256:fc0dcb22fa9aeabfe3fa4e0430099acff985ec5d77a851382f76cc6146e780e5", size = 62336, upload-time = "2026-09-21T17:56:21.181Z" },
-    { url = "https://files.pythonhosted.org/packages/23/db/95bd0afb130a0149c955f1f066143528d60864e64f41ff5a1e1313609361/multidict-6.9.1-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:024123f0ab402ab33828e24eb80fa8f25167d0d3783ba5f287e39ed741e6abf9", size = 54892, upload-time = "2026-09-21T17:56:22.63Z" },
-    { url = "https://files.pythonhosted.org/packages/94/cc/8aa34ae8d09498e8da003f485c03371b55cf1bc6d56cff861b3a7de61251/multidict-6.9.1-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:af1b5a92315048c3e36bbebfa7d4760a9c3e910bc4166f11b20d77d20d6bcfca", size = 56251, upload-time = "2026-09-21T17:56:24.36Z" },
-    { url = "https://files.pythonhosted.org/packages/52/48/22baa3b95375096369b04c4348af14139570f302f951773d2c68bf0ccf2e/multidict-6.9.1-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:b2483da477932ad1983d1d33c18bc3771c6fb00cfbaaed70a875fd547ef8e840", size = 96345, upload-time = "2026-09-21T17:56:25.777Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/3e/b96779dcac28ec6d491fd821112a0156b519b6701bba186cdf6f6df737f4/multidict-6.9.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:db4d697b18b6ef5528b1f36bfa25072cd2a421869f5963bc0e92c8a34b9e2800", size = 58901, upload-time = "2026-09-21T17:56:27.364Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/b4/8e6d950f02ca6ecc00ecf671f2ddb5dab7017671a8d197326f75621f5786/multidict-6.9.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:854fd2f1bc6e8a56b89910b5cd7261a8b40f13ebb31572da985ce59c7da0886d", size = 56491, upload-time = "2026-09-21T17:56:28.901Z" },
-    { url = "https://files.pythonhosted.org/packages/ed/8f/212ed7e03282c7bc271e3796bf985b53d5727c2827361e3dd9c5ee6b093f/multidict-6.9.1-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:03731f6fc036180700c9dc2308205a48e5ca6f3ff03087739ab746f294022201", size = 332297, upload-time = "2026-09-21T17:56:30.495Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/97/555aab000e03ecba85c0a1837fd5674d8bf10949490df7800da3a40660ce/multidict-6.9.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:989261c5f1735a165f2e4e87cf6d5f17ab734fa18f9ad0383d5adfcdaefce701", size = 329197, upload-time = "2026-09-21T17:56:32.652Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/25/f3539b5bdc147beba66015795dfe589eedcc580348fb1a8c69b1df4196b5/multidict-6.9.1-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:b4c9e5d05b126b267ac048a89a0e2d9b48b1b648add62d4872906304a8590610", size = 308456, upload-time = "2026-09-21T17:56:34.657Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/7d/4665cad8fc326787d218879be879d86dfe32f006c1f88ae47b04d3b52fd5/multidict-6.9.1-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:9d0a21cf76153de8f2d96a877991d6bc59b9ab5180b949e50db73cc193b4a694", size = 343382, upload-time = "2026-09-21T17:56:36.606Z" },
-    { url = "https://files.pythonhosted.org/packages/41/01/e1e9abe27f492b22dede492bc423015597412b14ce074f7475f4ecd80185/multidict-6.9.1-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:e7386aa18d98d6b8af44b92173654ec469237fda35f8e8523e43b581a86f476a", size = 346848, upload-time = "2026-09-21T17:56:38.344Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/e5/8d54118bc228e64e1087f1729647b93bbea225eda4a3f914663a6f410bca/multidict-6.9.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b69651732c64afb691e50cdc3387cae305e0eeff8804fe3e3ce203876494932a", size = 333612, upload-time = "2026-09-21T17:56:40.041Z" },
-    { url = "https://files.pythonhosted.org/packages/76/e1/9509dafc1fc68948e75842a74533ddfa64af57f2b17810e9cacfa68a829b/multidict-6.9.1-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:1fee9a16d88a1c4865610de31ef5c666671020d7a81d1f510eaf3c97d00ebeba", size = 304246, upload-time = "2026-09-21T17:56:42.313Z" },
-    { url = "https://files.pythonhosted.org/packages/1d/b6/96b93808e1bec0b51d49d89859e49b82a94f7b2e58eca0fc44ffcafd3ae5/multidict-6.9.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7814bbee202acd3bd240204c17d8b87a4c48c81064fd8674dbe527d94d5a4290", size = 321983, upload-time = "2026-09-21T17:56:44.399Z" },
-    { url = "https://files.pythonhosted.org/packages/d9/1c/08e5184df026b9d8e05a6dce5da22628e46bc4a7c7f03b8bf3c6939a8c46/multidict-6.9.1-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:95f273bea318a194f656527ee2ed19494327bc500b8e87d9358e3222579aa28d", size = 315927, upload-time = "2026-09-21T17:56:46.208Z" },
-    { url = "https://files.pythonhosted.org/packages/d7/5d/9ff39e7387f6fcc9a81af5dbf055fde08149849a04f8df10ca5b086b0d39/multidict-6.9.1-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:73bcafa21a78d0776b3ee7cd2a63c66f968eb7db8e8d594e32d7329950f6e828", size = 336827, upload-time = "2026-09-21T17:56:48.021Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/be/30fbb2cab22203128928066de94be247dc9a3230bf2bfc54437ac3b5f9f7/multidict-6.9.1-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:1a938761c77e0e6edb0c93d02f4e988d44a69e5195e5a3b893e5553311347132", size = 336317, upload-time = "2026-09-21T17:56:49.778Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/f0/2480aef6b7d8e7ab89b064ae14f12ec069570dab3a5c13e0155912293247/multidict-6.9.1-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:37245ca4105386194dd1d292a6f2aae09bfe1bd7ac6f9ec25093e3cf8e9b143b", size = 303258, upload-time = "2026-09-21T17:56:51.829Z" },
-    { url = "https://files.pythonhosted.org/packages/4c/04/dbe59cf4ea3778600e8e70e30b31aa9118ad6da2844bc9f717804cbaa000/multidict-6.9.1-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:f0700527dd5bfa8b7204b08330542f4f388899d3c14d885d8a368992e0eb562d", size = 337232, upload-time = "2026-09-21T17:56:53.537Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/8c/abe55548f06f12878588f08eb803c5a391283f01243f784cb00adac79231/multidict-6.9.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:6b7e54fd883671d1a8810704851c044b7173287c552b9f5c3d9e0eb9f00ae194", size = 330261, upload-time = "2026-09-21T17:56:55.335Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/f1/ba67f668478f152bdfa18abe72e7588bd078bf8b42c172fcf542fcf45826/multidict-6.9.1-cp314-cp314-win32.whl", hash = "sha256:e81ae656b9935ac4528a71f96bb7a14d949778ed1897c573d3e7ebb9187f8841", size = 51715, upload-time = "2026-09-21T17:56:57.048Z" },
-    { url = "https://files.pythonhosted.org/packages/33/81/014bb2128aedc8157d2848f0ec8a0209c6b822fb88deea012834e1c4a4e8/multidict-6.9.1-cp314-cp314-win_amd64.whl", hash = "sha256:acddcac38adc8342ba48aba98896faa7928854bebb62542362138655b5367ee3", size = 58621, upload-time = "2026-09-21T17:56:58.531Z" },
-    { url = "https://files.pythonhosted.org/packages/66/34/8f43c03c2d8821a2320b8c560d8a49d0be2920627edfac3f546922f91969/multidict-6.9.1-cp314-cp314-win_arm64.whl", hash = "sha256:32217133dddc58c927805cf6c0731d8144584176b768042ee886d51e71860bc9", size = 53959, upload-time = "2026-09-21T17:57:00.15Z" },
-    { url = "https://files.pythonhosted.org/packages/08/64/4f2a5eeea10b6d42634ba168ec6efc732ef218772e57b8239cd485c202f6/multidict-6.9.1-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:0b2fb8c349d1103863750b5d8cb5ace766917f4b35f3d883c8f778853eaa9f76", size = 107694, upload-time = "2026-09-21T17:57:01.785Z" },
-    { url = "https://files.pythonhosted.org/packages/32/ce/c68d08ac2096c1528ff20d77fd10f7e401db3e534ac5a1c7726e36a77c2f/multidict-6.9.1-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:56d834b74c993a7d7cb2b8ab33a0d55c3e0d4a3d2f2da2808a4ad3d79189711b", size = 64766, upload-time = "2026-09-21T17:57:03.52Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/9a/9f5c270c88fe289b4876fe28f9932a70e015a7916aff1e5b0325f7597b11/multidict-6.9.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:783ba7d845d79ce976afd9c1e91a4e5714671defa198ee789e8b23316083a485", size = 62723, upload-time = "2026-09-21T17:57:05.104Z" },
-    { url = "https://files.pythonhosted.org/packages/7c/63/c9a0b131354dd949426166cef712d708f436a8cf261114f8d5d2aec440ca/multidict-6.9.1-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:4d718fa1b5f0d0dd75e86fbbc5b0c93ea3a5d65216c85c61cd5d7cdddfe08455", size = 290445, upload-time = "2026-09-21T17:57:06.687Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/41/ed27d1d20ba91f4e13e8f7dcfaa592614ae0e1d5f45e03171d23c3b098ac/multidict-6.9.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a313bad717dde740959d50850c315b75fd4eb0c5e6b4dc8535db0f1c369be125", size = 304375, upload-time = "2026-09-21T17:57:08.717Z" },
-    { url = "https://files.pythonhosted.org/packages/66/6f/a7b26167173c3b73d6e5ebb0856c5154ad005156c3a2fa4062329921819c/multidict-6.9.1-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:ef01d29fca550ab871fd99154f82c6472aacf8e7def272dfb07b460123850390", size = 281746, upload-time = "2026-09-21T17:57:10.713Z" },
-    { url = "https://files.pythonhosted.org/packages/34/1d/da27bdd49b0cb84263288f5f48dbd915f2d17fd228fee2078ca607e80277/multidict-6.9.1-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:0f3bd290711c6e9486173a6ee7cd4e7f00c3971c7908c1ec1b6e5437c5e4c6f9", size = 311499, upload-time = "2026-09-21T17:57:12.467Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/36/ab0299a7abf53e38ff75d96c64480f1e2ff8edde985f93f7a1ad5e08bd94/multidict-6.9.1-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:81cdc537e0a42e3c0170752fcadbe450246d5c3b4b7231d6eb9672456605ac94", size = 313553, upload-time = "2026-09-21T17:57:14.548Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/44/e21be702efc9c9ba097c8be874c68860b1cb6cf9c85611263039bf95b37e/multidict-6.9.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8b193bf7a443c97d81c47052f60c486071a4bdef4a573fa2514f920089414d45", size = 299898, upload-time = "2026-09-21T17:57:16.192Z" },
-    { url = "https://files.pythonhosted.org/packages/00/8d/e93bc0dc947c7f872e502cfaa7ad9d98f001e1c93cfa6f4940457a6e187a/multidict-6.9.1-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:7a0c98f6a636adf0d7edd60c61589eaf52d149239af754d0bfeb0effedba53a8", size = 273054, upload-time = "2026-09-21T17:57:17.793Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/c9/945b44493fbe7af26ffe1e43c506b376daeab070fc1a0923bef9bbf572eb/multidict-6.9.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:6e6b7e3a1520c39a2772f414cd9ddf5995f77e4e823dfa1522af383addd465a3", size = 294751, upload-time = "2026-09-21T17:57:19.631Z" },
-    { url = "https://files.pythonhosted.org/packages/24/79/0969a9b38b814e5fa3af1b0a57708c49b3d9b3d55c208bac6e98b87bb028/multidict-6.9.1-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:ca65cced0d67a9039e93bcd98a369920e499bf98296844ff56ead01c9085321f", size = 284523, upload-time = "2026-09-21T17:57:21.313Z" },
-    { url = "https://files.pythonhosted.org/packages/1d/1e/c32ddf53234c228b1a374ddabca19f542ac7f32752f5155982abe2304833/multidict-6.9.1-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:372c063f37480f62c1ae32dc3a1a0a5942b180c883f99789075a8a8ec3c4e709", size = 290275, upload-time = "2026-09-21T17:57:23.206Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/09/7a99a3daafd987330abb865a2d36e432fd8bf18e790ddda55c5de15eb98f/multidict-6.9.1-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:827c92145b3b976b39430129c89d213b250dacbe5fce678e9a03940e6e848983", size = 303350, upload-time = "2026-09-21T17:57:25.086Z" },
-    { url = "https://files.pythonhosted.org/packages/2e/09/7e6ebaecc4e226d7fe27973c271d58b75c14c24e84c23736d21dc39997dd/multidict-6.9.1-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:9b0124b9c17e9890f0819b2e7a5f65ec9a2f5aabd6c8e7ad090c1675cf70dee6", size = 272232, upload-time = "2026-09-21T17:57:27.193Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/6e/420e9e879b21cbdb5036214ee238efabcfab7bf262d3fc124132050f79ff/multidict-6.9.1-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:23136f5a564654eb61061ec6d5620a4c1ea32c8f552b65e9982a12b72bff601b", size = 300525, upload-time = "2026-09-21T17:57:29.004Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/7f/c6b0896850b3ceb190ca302760d63148843371f027c5dde3d1d732343a08/multidict-6.9.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:f2524ec55b3e65cbe235a8b3c36e2af3b635be02ed05e20c94e70c5c943c009e", size = 295933, upload-time = "2026-09-21T17:57:30.837Z" },
-    { url = "https://files.pythonhosted.org/packages/29/f2/f0ff3384a756227741c72f4ee94cadf1f9900df0ae961e48639f96115b1c/multidict-6.9.1-cp314-cp314t-win32.whl", hash = "sha256:35ba0263bae5dd3ad5aad767cc9afc01a8598c7dae30f1b3b2de98b1b32c28bd", size = 57776, upload-time = "2026-09-21T17:57:32.835Z" },
-    { url = "https://files.pythonhosted.org/packages/8d/87/013e1eed30ad46bec1eb68947bc9caf55ba2fd0d6aed04fe964e3b44c23b/multidict-6.9.1-cp314-cp314t-win_amd64.whl", hash = "sha256:7c8d5882ba25ac0282258be435d8a05aa0cbcacfce15799154a338f847f159b9", size = 64881, upload-time = "2026-09-21T17:57:34.489Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/95/64dd049bb4c53426e2fee7afb874daaa8b4426c41878785883a94511ecf8/multidict-6.9.1-cp314-cp314t-win_arm64.whl", hash = "sha256:ac348379cf4de5538a0a213be1532d289aa801ec5d267c5909446b9ea2f8e2c3", size = 58582, upload-time = "2026-09-21T17:57:36.19Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/2c/26bc1723592cfe965b575652a7749026474b0625b04b04564e1fba265dc5/multidict-6.9.1-cp315-cp315-android_24_x86_64.whl", hash = "sha256:f04551dce5a7db8c9659f2e4245494c182d0663b83661803e08d46bfcae5eda1", size = 62339, upload-time = "2026-09-21T17:57:37.967Z" },
-    { url = "https://files.pythonhosted.org/packages/bd/c5/614d2eb9995232d066aae7f17d1d454060b6b5d882b22fbaf6150b05ef1d/multidict-6.9.1-cp315-cp315-ios_13_0_arm64_iphoneos.whl", hash = "sha256:c0c88085affd35c33e124e36930c5ad96aff9294ce195eaa0fd9cec962b64a82", size = 55009, upload-time = "2026-09-21T17:57:39.746Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/24/f7179ecdf9cdd3581ace3292c3b883a1a500a374aa4e619bf6eb521c62e5/multidict-6.9.1-cp315-cp315-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:a8b75dd3d3638d9a19f23e84af4ffab3b8940422c0df2da2a77005ef5aa3d7ea", size = 56273, upload-time = "2026-09-21T17:57:41.544Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/72/c9dffcecccd1f8b9a58f960ec4eaecab62c4edb08d5bb984d4de67fe3fdb/multidict-6.9.1-cp315-cp315-macosx_10_15_universal2.whl", hash = "sha256:006c4478de0a1876f4834e14255776286f09b9846b505fe63f67f9d173a9487c", size = 96390, upload-time = "2026-09-21T17:57:43.385Z" },
-    { url = "https://files.pythonhosted.org/packages/e9/3f/76542360e655cecdb7c158c7af88c69c4db0d2aac3421659d41214927229/multidict-6.9.1-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:2784090c30a586d5b45197bd9c32f87fb927216cde302f6cfd76d76577e90f08", size = 58900, upload-time = "2026-09-21T17:57:45.105Z" },
-    { url = "https://files.pythonhosted.org/packages/04/15/f28c71af461dd4ff15653a165cfd8ddaf01f3387ff80d2dd0de057d527d0/multidict-6.9.1-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:7c708566da8014b120a64b1eb6d200c6c0c8cb36296383723cdb6fc82038270b", size = 56540, upload-time = "2026-09-21T17:57:46.913Z" },
-    { url = "https://files.pythonhosted.org/packages/19/de/5ee4050c3ddad88c605a89fc1cd18e89abd40a64f183e6fb5276b6eb7f52/multidict-6.9.1-cp315-cp315-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:042fb0196047e786936a730bd302de83143950da45f2c16078da8f35e1cf7919", size = 331818, upload-time = "2026-09-21T17:57:48.825Z" },
-    { url = "https://files.pythonhosted.org/packages/70/e2/2d4e3c3ee70f583334ff236fe6a3babf7a05ce56169a15df65453af647c0/multidict-6.9.1-cp315-cp315-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a2212a0c842c723d919ea4a22a9296cb6b244b386e4e6ea92adfc7fbf3095519", size = 329800, upload-time = "2026-09-21T17:57:50.91Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/14/f64bd05667343a7250cdd99f81bda2270e3959f00832441f10c7f904e1c1/multidict-6.9.1-cp315-cp315-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:fd882aa29bf402b62bf1fd7c19fd5df4b6528cf468a908864b39368572b662a9", size = 312048, upload-time = "2026-09-21T17:57:53.053Z" },
-    { url = "https://files.pythonhosted.org/packages/64/bf/a91256ce00199e7544e3eda79c4e9544eb7388c38fa22f11638c2e357ccb/multidict-6.9.1-cp315-cp315-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c57541034d12b215ab0a2bfa371d1a8a198da18176d0426c27105b9161a6862d", size = 343676, upload-time = "2026-09-21T17:57:55.069Z" },
-    { url = "https://files.pythonhosted.org/packages/14/48/628b978413518159228c2b2ec38645362ceb6427e935d83d716e26490a49/multidict-6.9.1-cp315-cp315-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d73fed4e37158ff00cd271871170b79e40138db51e625fd352fa17c6acb34f67", size = 347028, upload-time = "2026-09-21T17:57:57.157Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/73/5f9dc2b5ac7dd7a82458ae9cd283b99c185834f23442ace295362dcc5e45/multidict-6.9.1-cp315-cp315-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:79da2491348b30810728050b4a8ec0416f85884125c2fd44655b3d01150d9c3e", size = 335670, upload-time = "2026-09-21T17:57:59.126Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/84/6f319ee000f5ab3fa0055b194ad706fddd552c60c76a21d581c87db1d46c/multidict-6.9.1-cp315-cp315-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b4da208a63434d21a3df64d29758e650fc4aa8cb05848554b76949c296539cca", size = 307804, upload-time = "2026-09-21T17:58:01.2Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/24/61be5fe1616d033532e8d63dc789c0f35b9793917834713eefe050589ba9/multidict-6.9.1-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:877ca17fdcfdf5c397493a71e5ff97a87bb181417fe717fdadc77c08c09301ac", size = 323409, upload-time = "2026-09-21T17:58:03.383Z" },
-    { url = "https://files.pythonhosted.org/packages/22/a6/eab8aaf59892169a0f4e8e78a5516a6caa6abd8e96e6410111258f4ef0ef/multidict-6.9.1-cp315-cp315-musllinux_1_2_armv7l.whl", hash = "sha256:40aec5299e1ed71fbb988389059da381c3c1a60e0c649acceb2a35d9b128848e", size = 315746, upload-time = "2026-09-21T17:58:05.372Z" },
-    { url = "https://files.pythonhosted.org/packages/42/b1/d1e14bab80a74babf6e2ac971a878b84fdcf3a972f3ec3400ca12260fac5/multidict-6.9.1-cp315-cp315-musllinux_1_2_i686.whl", hash = "sha256:4a409ccc42aefec904038695d5d7fd6d8f3af2721b7b6401d55135ec7d6d298e", size = 334529, upload-time = "2026-09-21T17:58:07.35Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/50/a05b1d36f6d3363a5a334cebbf11624c9c7a69d66fd23345eb53b1d43b7e/multidict-6.9.1-cp315-cp315-musllinux_1_2_ppc64le.whl", hash = "sha256:0a5769559e3312dd96731fbe15b4abb6033368ac1cad5a98dadd21946a4c7d6c", size = 336455, upload-time = "2026-09-21T17:58:09.112Z" },
-    { url = "https://files.pythonhosted.org/packages/cd/0d/bf33cb097380252b08e1177b5ae0cab822c47ce80d236f3f724953c76721/multidict-6.9.1-cp315-cp315-musllinux_1_2_riscv64.whl", hash = "sha256:03fac50ddfd8302175b77863a015eccfae76767cda5506eef86df559ba861e1f", size = 305865, upload-time = "2026-09-21T17:58:10.921Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/ee/a2bd133391204b1cec5a5caf327dc9a06710439b7403220860a8fb164560/multidict-6.9.1-cp315-cp315-musllinux_1_2_s390x.whl", hash = "sha256:5ecace251ccfa705bf3d7d35c5032cf750f5c629809740405697bce5c118c4a4", size = 337531, upload-time = "2026-09-21T17:58:12.846Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/32/c0972486f81a06c3bbb23063c85afaac53c51608f7e35bcb101a1006408b/multidict-6.9.1-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:ecc89dbd4155b2f8a47f4bbd89242a35ed15e8e0ec581cab5ac65fa38407329d", size = 332464, upload-time = "2026-09-21T17:58:14.673Z" },
-    { url = "https://files.pythonhosted.org/packages/69/4f/5cbbe852b45d8a7f0ab3ed042386e4894e463010eb230603596cb15d0fee/multidict-6.9.1-cp315-cp315-win32.whl", hash = "sha256:a3ffe881246d28a862f1985824f484cb7361f44d6b99c4c620436ef56462f38d", size = 51714, upload-time = "2026-09-21T17:58:16.409Z" },
-    { url = "https://files.pythonhosted.org/packages/d4/77/1fa118386deeae4e7a48870fa5cb073e748b0ac5265a6990651cefc48068/multidict-6.9.1-cp315-cp315-win_amd64.whl", hash = "sha256:59c123d0e948d760a5f930f316cfefa07e8d632ab84327c0693ee6a88171154f", size = 58619, upload-time = "2026-09-21T17:58:18.369Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/ee/51c45748acfce9cb69d89dcfcd09c874b385407fd6993e885d6905659865/multidict-6.9.1-cp315-cp315-win_arm64.whl", hash = "sha256:31199204b3ced121ff5407a2c342326a5d27e3870abbf94bd80dbd2451b7bc8f", size = 53969, upload-time = "2026-09-21T17:58:20.102Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/57/89d2d3dedfae2558853c1770c7cbcdfd5211eb4c4090b1e8cb570544a490/multidict-6.9.1-cp315-cp315t-macosx_10_15_universal2.whl", hash = "sha256:8879510a76940670517ea1cb589978da44b86e286ec3e50d664ef330817afce7", size = 107679, upload-time = "2026-09-21T17:58:21.98Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/df/0c2a28870181c1762f90952b897f6db46c934ce073efe0442604cbc276db/multidict-6.9.1-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:aec65b53a07f580606593f877eefbb29a45939bfc0d3fe6e6d9f42b41b749f68", size = 64753, upload-time = "2026-09-21T17:58:23.622Z" },
-    { url = "https://files.pythonhosted.org/packages/43/7e/9c6a3e7619459407d8958f7e56ab3dda7f0738f5aed9bb4ad48076e8de83/multidict-6.9.1-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:14c56f73e78faa1f68bbb826197cd5871994e70e841b8590829c35912ece5c64", size = 62732, upload-time = "2026-09-21T17:58:25.46Z" },
-    { url = "https://files.pythonhosted.org/packages/38/eb/fd56c9d83ba0cdc3cf66f9acb278b24ef1f043b620b96d145685a3b57338/multidict-6.9.1-cp315-cp315t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:38c9986f9ce50c459b10de216a05f4bd7ed5ac63887d56e500a52bb464b861ce", size = 288648, upload-time = "2026-09-21T17:58:27.115Z" },
-    { url = "https://files.pythonhosted.org/packages/df/ef/51e79c2442b0f56ac4ac580108d713078b31297e028d468fc220971a305d/multidict-6.9.1-cp315-cp315t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:15db6a102cbaf1949cf028ecf080aac76d20bcd29ad4e092574db6c6b7af78a5", size = 304919, upload-time = "2026-09-21T17:58:29.143Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/e4/774700cc5739353fe88a7204ed30e78a9403d98d4bb2496cc91f096d2e71/multidict-6.9.1-cp315-cp315t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:bd82c4977196681a499bb6ca9e462afbc5c91c1c15b6a991dfbd72733fea4dd2", size = 289094, upload-time = "2026-09-21T17:58:30.938Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/41/0bec327bc3a8271825376b6d8a469d1f80e3ba1e2e730e019836e29663c3/multidict-6.9.1-cp315-cp315t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:bb58ba73a3f96f9a3e46b1fab69929d7edbbddb3133ee74b5c3c54074a53c4f1", size = 312007, upload-time = "2026-09-21T17:58:32.964Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/7a/9906bf5f1fe20e8e755affccc1a69ecd8aebb079ac65386e5ffc8eefbe75/multidict-6.9.1-cp315-cp315t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:7c6eecfab7ce4cd9487ff8ba936fe38cdfd68c04faf3d5c710363c6a8e695659", size = 314657, upload-time = "2026-09-21T17:58:35.285Z" },
-    { url = "https://files.pythonhosted.org/packages/33/92/cf6d665a45663bbe216420fe632da10e9f4f842b07ce02bc3ddf8eb882b8/multidict-6.9.1-cp315-cp315t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9c62e71e6289d78c0108d8aeb495f8bd3cad4bc1632fedddc9297ddf287ecc20", size = 301563, upload-time = "2026-09-21T17:58:37.472Z" },
-    { url = "https://files.pythonhosted.org/packages/97/4c/9f1b7945526905d58b4b2d422e2ea81326dda71f9bdc9c32c8002639234a/multidict-6.9.1-cp315-cp315t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:539c2cd5fed0947c135cd7eabaaac55f48300dfa1de0f3ca4edb5efa6606f471", size = 278540, upload-time = "2026-09-21T17:58:39.551Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/d9/133aa472fc1be181de29a0c2e1c4cd778280882f532b404395f646742e46/multidict-6.9.1-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:3100d169ceb7bc8f05f89a6db11d1b21f119975fc26f29dc45a472e3569f0879", size = 294858, upload-time = "2026-09-21T17:58:41.791Z" },
-    { url = "https://files.pythonhosted.org/packages/bd/38/21f2305dd20ac5038fa581b5d7e0d8dbbd70dc6b50231c22ec173dacddda/multidict-6.9.1-cp315-cp315t-musllinux_1_2_armv7l.whl", hash = "sha256:696477ad71385c4795e3b8e4cf10b0d2c28c2a1ca6a955e031cb1e62993e9ee3", size = 285461, upload-time = "2026-09-21T17:58:43.844Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/21/465a43c214d1d7e2d0c974e727d4b5935f8a0868838b5df9d0984c83c1dc/multidict-6.9.1-cp315-cp315t-musllinux_1_2_i686.whl", hash = "sha256:f5844e7befc707367807586f550fa97e23dcfef0728f02b98c7bc498a961a5df", size = 288964, upload-time = "2026-09-21T17:58:46.16Z" },
-    { url = "https://files.pythonhosted.org/packages/2d/58/72a3e8d56c1e05146d2d1841dbaacf8986375eded1e5a58d30eef191a580/multidict-6.9.1-cp315-cp315t-musllinux_1_2_ppc64le.whl", hash = "sha256:abc7c2e4b47bfe6a9aea434d3fdebb9597ee636e914e92ba352f2068b9142f4c", size = 303924, upload-time = "2026-09-21T17:58:48.395Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/b9/911084c04530a682a54536b4f738d3992a593b5ff6fea1d6a1f02f3acc6b/multidict-6.9.1-cp315-cp315t-musllinux_1_2_riscv64.whl", hash = "sha256:7ab379f95caee071a37cbd8be86d4c65accc651d391f9f97748fef006f38769c", size = 278479, upload-time = "2026-09-21T17:58:50.494Z" },
-    { url = "https://files.pythonhosted.org/packages/45/eb/9a333346c02c928a9e82534638bce85697c10c46b4901fcd70af19357356/multidict-6.9.1-cp315-cp315t-musllinux_1_2_s390x.whl", hash = "sha256:557a4e1708df428ebe6c3081c83a273d275dad2446ce0d81fc648ac71afdb18d", size = 301650, upload-time = "2026-09-21T17:58:52.554Z" },
-    { url = "https://files.pythonhosted.org/packages/67/2f/1d936c4e45c8199db6082b6836e9182e31aa393de0de652637790831ca4b/multidict-6.9.1-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:475d04d5192eba487a3e2f935976340baa24529046e9c1c9c7a3b7bf80445ae1", size = 298024, upload-time = "2026-09-21T17:58:55.03Z" },
-    { url = "https://files.pythonhosted.org/packages/a4/0c/ca62ae2882b89a4cfeb0bbca873a4afdb5fc32994c4f8a37a7cb52ede7a0/multidict-6.9.1-cp315-cp315t-win32.whl", hash = "sha256:10083a8a0f4e1b26b599889e90b9802504ce5d3f7722f925bbb7ca47dd22a7c1", size = 57810, upload-time = "2026-09-21T17:58:57.141Z" },
-    { url = "https://files.pythonhosted.org/packages/02/8b/b2c2805c3eb6fa4cdf5512fb95ac6174dde71e34dd601c5be52f4df5dc82/multidict-6.9.1-cp315-cp315t-win_amd64.whl", hash = "sha256:e96ca64383efa107262ee3949f047af5ee4f1845ba09463466c04d35a83bd3ec", size = 64984, upload-time = "2026-09-21T17:58:59.446Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/34/03f1d204d698c408f4754c969882609b6b7a902c0e3d16a7033f219cdeda/multidict-6.9.1-cp315-cp315t-win_arm64.whl", hash = "sha256:501ed8b02a5990c67a91c732843609d43a6be1f7576fcdfc867331239f37fbd3", size = 58742, upload-time = "2026-09-21T17:59:01.726Z" },
-    { url = "https://files.pythonhosted.org/packages/be/59/e26cb779be4c591d1a910f59d29aca9fba4de70349840a833beba2652371/multidict-6.9.1-py3-none-any.whl", hash = "sha256:7bf6478188f4e47bf5686e8a33da4ae28bf43b1b2528d9ee144d28492bfac60b", size = 19176, upload-time = "2026-09-21T17:59:03.501Z" },
-]
-
 [[package]]
 name = "mypy"
 version = "2.3.1"
@@ -2704,231 +2168,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/88/b2/d0896bdcdc8d28a7fc5717c305f1a861c26e18c05047949fb371034d98bd/nodeenv-1.10.0-py2.py3-none-any.whl", hash = "sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827", size = 23438, upload-time = "2025-12-20T14:08:52.782Z" },
 ]
 
-[[package]]
-name = "numpy"
-version = "2.2.6"
-source = { registry = "https://pypi.org/simple" }
-resolution-markers = [
-    "python_full_version < '3.11'",
-]
-sdist = { url = "https://files.pythonhosted.org/packages/76/21/7d2a95e4bba9dc13d043ee156a356c0a8f0c6309dff6b21b4d71a073b8a8/numpy-2.2.6.tar.gz", hash = "sha256:e29554e2bef54a90aa5cc07da6ce955accb83f21ab5de01a62c8478897b264fd", size = 20276440, upload-time = "2025-05-17T22:38:04.611Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/9a/3e/ed6db5be21ce87955c0cbd3009f2803f59fa08df21b5df06862e2d8e2bdd/numpy-2.2.6-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:b412caa66f72040e6d268491a59f2c43bf03eb6c96dd8f0307829feb7fa2b6fb", size = 21165245, upload-time = "2025-05-17T21:27:58.555Z" },
-    { url = "https://files.pythonhosted.org/packages/22/c2/4b9221495b2a132cc9d2eb862e21d42a009f5a60e45fc44b00118c174bff/numpy-2.2.6-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8e41fd67c52b86603a91c1a505ebaef50b3314de0213461c7a6e99c9a3beff90", size = 14360048, upload-time = "2025-05-17T21:28:21.406Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/77/dc2fcfc66943c6410e2bf598062f5959372735ffda175b39906d54f02349/numpy-2.2.6-cp310-cp310-macosx_14_0_arm64.whl", hash = "sha256:37e990a01ae6ec7fe7fa1c26c55ecb672dd98b19c3d0e1d1f326fa13cb38d163", size = 5340542, upload-time = "2025-05-17T21:28:30.931Z" },
-    { url = "https://files.pythonhosted.org/packages/7a/4f/1cb5fdc353a5f5cc7feb692db9b8ec2c3d6405453f982435efc52561df58/numpy-2.2.6-cp310-cp310-macosx_14_0_x86_64.whl", hash = "sha256:5a6429d4be8ca66d889b7cf70f536a397dc45ba6faeb5f8c5427935d9592e9cf", size = 6878301, upload-time = "2025-05-17T21:28:41.613Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/17/96a3acd228cec142fcb8723bd3cc39c2a474f7dcf0a5d16731980bcafa95/numpy-2.2.6-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:efd28d4e9cd7d7a8d39074a4d44c63eda73401580c5c76acda2ce969e0a38e83", size = 14297320, upload-time = "2025-05-17T21:29:02.78Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/63/3de6a34ad7ad6646ac7d2f55ebc6ad439dbbf9c4370017c50cf403fb19b5/numpy-2.2.6-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fc7b73d02efb0e18c000e9ad8b83480dfcd5dfd11065997ed4c6747470ae8915", size = 16801050, upload-time = "2025-05-17T21:29:27.675Z" },
-    { url = "https://files.pythonhosted.org/packages/07/b6/89d837eddef52b3d0cec5c6ba0456c1bf1b9ef6a6672fc2b7873c3ec4e2e/numpy-2.2.6-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:74d4531beb257d2c3f4b261bfb0fc09e0f9ebb8842d82a7b4209415896adc680", size = 15807034, upload-time = "2025-05-17T21:29:51.102Z" },
-    { url = "https://files.pythonhosted.org/packages/01/c8/dc6ae86e3c61cfec1f178e5c9f7858584049b6093f843bca541f94120920/numpy-2.2.6-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:8fc377d995680230e83241d8a96def29f204b5782f371c532579b4f20607a289", size = 18614185, upload-time = "2025-05-17T21:30:18.703Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/c5/0064b1b7e7c89137b471ccec1fd2282fceaae0ab3a9550f2568782d80357/numpy-2.2.6-cp310-cp310-win32.whl", hash = "sha256:b093dd74e50a8cba3e873868d9e93a85b78e0daf2e98c6797566ad8044e8363d", size = 6527149, upload-time = "2025-05-17T21:30:29.788Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/dd/4b822569d6b96c39d1215dbae0582fd99954dcbcf0c1a13c61783feaca3f/numpy-2.2.6-cp310-cp310-win_amd64.whl", hash = "sha256:f0fd6321b839904e15c46e0d257fdd101dd7f530fe03fd6359c1ea63738703f3", size = 12904620, upload-time = "2025-05-17T21:30:48.994Z" },
-    { url = "https://files.pythonhosted.org/packages/da/a8/4f83e2aa666a9fbf56d6118faaaf5f1974d456b1823fda0a176eff722839/numpy-2.2.6-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:f9f1adb22318e121c5c69a09142811a201ef17ab257a1e66ca3025065b7f53ae", size = 21176963, upload-time = "2025-05-17T21:31:19.36Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/2b/64e1affc7972decb74c9e29e5649fac940514910960ba25cd9af4488b66c/numpy-2.2.6-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:c820a93b0255bc360f53eca31a0e676fd1101f673dda8da93454a12e23fc5f7a", size = 14406743, upload-time = "2025-05-17T21:31:41.087Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/9f/0121e375000b5e50ffdd8b25bf78d8e1a5aa4cca3f185d41265198c7b834/numpy-2.2.6-cp311-cp311-macosx_14_0_arm64.whl", hash = "sha256:3d70692235e759f260c3d837193090014aebdf026dfd167834bcba43e30c2a42", size = 5352616, upload-time = "2025-05-17T21:31:50.072Z" },
-    { url = "https://files.pythonhosted.org/packages/31/0d/b48c405c91693635fbe2dcd7bc84a33a602add5f63286e024d3b6741411c/numpy-2.2.6-cp311-cp311-macosx_14_0_x86_64.whl", hash = "sha256:481b49095335f8eed42e39e8041327c05b0f6f4780488f61286ed3c01368d491", size = 6889579, upload-time = "2025-05-17T21:32:01.712Z" },
-    { url = "https://files.pythonhosted.org/packages/52/b8/7f0554d49b565d0171eab6e99001846882000883998e7b7d9f0d98b1f934/numpy-2.2.6-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b64d8d4d17135e00c8e346e0a738deb17e754230d7e0810ac5012750bbd85a5a", size = 14312005, upload-time = "2025-05-17T21:32:23.332Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/dd/2238b898e51bd6d389b7389ffb20d7f4c10066d80351187ec8e303a5a475/numpy-2.2.6-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ba10f8411898fc418a521833e014a77d3ca01c15b0c6cdcce6a0d2897e6dbbdf", size = 16821570, upload-time = "2025-05-17T21:32:47.991Z" },
-    { url = "https://files.pythonhosted.org/packages/83/6c/44d0325722cf644f191042bf47eedad61c1e6df2432ed65cbe28509d404e/numpy-2.2.6-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:bd48227a919f1bafbdda0583705e547892342c26fb127219d60a5c36882609d1", size = 15818548, upload-time = "2025-05-17T21:33:11.728Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/9d/81e8216030ce66be25279098789b665d49ff19eef08bfa8cb96d4957f422/numpy-2.2.6-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:9551a499bf125c1d4f9e250377c1ee2eddd02e01eac6644c080162c0c51778ab", size = 18620521, upload-time = "2025-05-17T21:33:39.139Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/fd/e19617b9530b031db51b0926eed5345ce8ddc669bb3bc0044b23e275ebe8/numpy-2.2.6-cp311-cp311-win32.whl", hash = "sha256:0678000bb9ac1475cd454c6b8c799206af8107e310843532b04d49649c717a47", size = 6525866, upload-time = "2025-05-17T21:33:50.273Z" },
-    { url = "https://files.pythonhosted.org/packages/31/0a/f354fb7176b81747d870f7991dc763e157a934c717b67b58456bc63da3df/numpy-2.2.6-cp311-cp311-win_amd64.whl", hash = "sha256:e8213002e427c69c45a52bbd94163084025f533a55a59d6f9c5b820774ef3303", size = 12907455, upload-time = "2025-05-17T21:34:09.135Z" },
-    { url = "https://files.pythonhosted.org/packages/82/5d/c00588b6cf18e1da539b45d3598d3557084990dcc4331960c15ee776ee41/numpy-2.2.6-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:41c5a21f4a04fa86436124d388f6ed60a9343a6f767fced1a8a71c3fbca038ff", size = 20875348, upload-time = "2025-05-17T21:34:39.648Z" },
-    { url = "https://files.pythonhosted.org/packages/66/ee/560deadcdde6c2f90200450d5938f63a34b37e27ebff162810f716f6a230/numpy-2.2.6-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:de749064336d37e340f640b05f24e9e3dd678c57318c7289d222a8a2f543e90c", size = 14119362, upload-time = "2025-05-17T21:35:01.241Z" },
-    { url = "https://files.pythonhosted.org/packages/3c/65/4baa99f1c53b30adf0acd9a5519078871ddde8d2339dc5a7fde80d9d87da/numpy-2.2.6-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:894b3a42502226a1cac872f840030665f33326fc3dac8e57c607905773cdcde3", size = 5084103, upload-time = "2025-05-17T21:35:10.622Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/89/e5a34c071a0570cc40c9a54eb472d113eea6d002e9ae12bb3a8407fb912e/numpy-2.2.6-cp312-cp312-macosx_14_0_x86_64.whl", hash = "sha256:71594f7c51a18e728451bb50cc60a3ce4e6538822731b2933209a1f3614e9282", size = 6625382, upload-time = "2025-05-17T21:35:21.414Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/35/8c80729f1ff76b3921d5c9487c7ac3de9b2a103b1cd05e905b3090513510/numpy-2.2.6-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f2618db89be1b4e05f7a1a847a9c1c0abd63e63a1607d892dd54668dd92faf87", size = 14018462, upload-time = "2025-05-17T21:35:42.174Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/3d/1e1db36cfd41f895d266b103df00ca5b3cbe965184df824dec5c08c6b803/numpy-2.2.6-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fd83c01228a688733f1ded5201c678f0c53ecc1006ffbc404db9f7a899ac6249", size = 16527618, upload-time = "2025-05-17T21:36:06.711Z" },
-    { url = "https://files.pythonhosted.org/packages/61/c6/03ed30992602c85aa3cd95b9070a514f8b3c33e31124694438d88809ae36/numpy-2.2.6-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:37c0ca431f82cd5fa716eca9506aefcabc247fb27ba69c5062a6d3ade8cf8f49", size = 15505511, upload-time = "2025-05-17T21:36:29.965Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/25/5761d832a81df431e260719ec45de696414266613c9ee268394dd5ad8236/numpy-2.2.6-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:fe27749d33bb772c80dcd84ae7e8df2adc920ae8297400dabec45f0dedb3f6de", size = 18313783, upload-time = "2025-05-17T21:36:56.883Z" },
-    { url = "https://files.pythonhosted.org/packages/57/0a/72d5a3527c5ebffcd47bde9162c39fae1f90138c961e5296491ce778e682/numpy-2.2.6-cp312-cp312-win32.whl", hash = "sha256:4eeaae00d789f66c7a25ac5f34b71a7035bb474e679f410e5e1a94deb24cf2d4", size = 6246506, upload-time = "2025-05-17T21:37:07.368Z" },
-    { url = "https://files.pythonhosted.org/packages/36/fa/8c9210162ca1b88529ab76b41ba02d433fd54fecaf6feb70ef9f124683f1/numpy-2.2.6-cp312-cp312-win_amd64.whl", hash = "sha256:c1f9540be57940698ed329904db803cf7a402f3fc200bfe599334c9bd84a40b2", size = 12614190, upload-time = "2025-05-17T21:37:26.213Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/5c/6657823f4f594f72b5471f1db1ab12e26e890bb2e41897522d134d2a3e81/numpy-2.2.6-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:0811bb762109d9708cca4d0b13c4f67146e3c3b7cf8d34018c722adb2d957c84", size = 20867828, upload-time = "2025-05-17T21:37:56.699Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/9e/14520dc3dadf3c803473bd07e9b2bd1b69bc583cb2497b47000fed2fa92f/numpy-2.2.6-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:287cc3162b6f01463ccd86be154f284d0893d2b3ed7292439ea97eafa8170e0b", size = 14143006, upload-time = "2025-05-17T21:38:18.291Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/06/7e96c57d90bebdce9918412087fc22ca9851cceaf5567a45c1f404480e9e/numpy-2.2.6-cp313-cp313-macosx_14_0_arm64.whl", hash = "sha256:f1372f041402e37e5e633e586f62aa53de2eac8d98cbfb822806ce4bbefcb74d", size = 5076765, upload-time = "2025-05-17T21:38:27.319Z" },
-    { url = "https://files.pythonhosted.org/packages/73/ed/63d920c23b4289fdac96ddbdd6132e9427790977d5457cd132f18e76eae0/numpy-2.2.6-cp313-cp313-macosx_14_0_x86_64.whl", hash = "sha256:55a4d33fa519660d69614a9fad433be87e5252f4b03850642f88993f7b2ca566", size = 6617736, upload-time = "2025-05-17T21:38:38.141Z" },
-    { url = "https://files.pythonhosted.org/packages/85/c5/e19c8f99d83fd377ec8c7e0cf627a8049746da54afc24ef0a0cb73d5dfb5/numpy-2.2.6-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f92729c95468a2f4f15e9bb94c432a9229d0d50de67304399627a943201baa2f", size = 14010719, upload-time = "2025-05-17T21:38:58.433Z" },
-    { url = "https://files.pythonhosted.org/packages/19/49/4df9123aafa7b539317bf6d342cb6d227e49f7a35b99c287a6109b13dd93/numpy-2.2.6-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1bc23a79bfabc5d056d106f9befb8d50c31ced2fbc70eedb8155aec74a45798f", size = 16526072, upload-time = "2025-05-17T21:39:22.638Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/6c/04b5f47f4f32f7c2b0e7260442a8cbcf8168b0e1a41ff1495da42f42a14f/numpy-2.2.6-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:e3143e4451880bed956e706a3220b4e5cf6172ef05fcc397f6f36a550b1dd868", size = 15503213, upload-time = "2025-05-17T21:39:45.865Z" },
-    { url = "https://files.pythonhosted.org/packages/17/0a/5cd92e352c1307640d5b6fec1b2ffb06cd0dabe7d7b8227f97933d378422/numpy-2.2.6-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:b4f13750ce79751586ae2eb824ba7e1e8dba64784086c98cdbbcc6a42112ce0d", size = 18316632, upload-time = "2025-05-17T21:40:13.331Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/3b/5cba2b1d88760ef86596ad0f3d484b1cbff7c115ae2429678465057c5155/numpy-2.2.6-cp313-cp313-win32.whl", hash = "sha256:5beb72339d9d4fa36522fc63802f469b13cdbe4fdab4a288f0c441b74272ebfd", size = 6244532, upload-time = "2025-05-17T21:43:46.099Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/3b/d58c12eafcb298d4e6d0d40216866ab15f59e55d148a5658bb3132311fcf/numpy-2.2.6-cp313-cp313-win_amd64.whl", hash = "sha256:b0544343a702fa80c95ad5d3d608ea3599dd54d4632df855e4c8d24eb6ecfa1c", size = 12610885, upload-time = "2025-05-17T21:44:05.145Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/9e/4bf918b818e516322db999ac25d00c75788ddfd2d2ade4fa66f1f38097e1/numpy-2.2.6-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:0bca768cd85ae743b2affdc762d617eddf3bcf8724435498a1e80132d04879e6", size = 20963467, upload-time = "2025-05-17T21:40:44Z" },
-    { url = "https://files.pythonhosted.org/packages/61/66/d2de6b291507517ff2e438e13ff7b1e2cdbdb7cb40b3ed475377aece69f9/numpy-2.2.6-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:fc0c5673685c508a142ca65209b4e79ed6740a4ed6b2267dbba90f34b0b3cfda", size = 14225144, upload-time = "2025-05-17T21:41:05.695Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/25/480387655407ead912e28ba3a820bc69af9adf13bcbe40b299d454ec011f/numpy-2.2.6-cp313-cp313t-macosx_14_0_arm64.whl", hash = "sha256:5bd4fc3ac8926b3819797a7c0e2631eb889b4118a9898c84f585a54d475b7e40", size = 5200217, upload-time = "2025-05-17T21:41:15.903Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/4a/6e313b5108f53dcbf3aca0c0f3e9c92f4c10ce57a0a721851f9785872895/numpy-2.2.6-cp313-cp313t-macosx_14_0_x86_64.whl", hash = "sha256:fee4236c876c4e8369388054d02d0e9bb84821feb1a64dd59e137e6511a551f8", size = 6712014, upload-time = "2025-05-17T21:41:27.321Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/30/172c2d5c4be71fdf476e9de553443cf8e25feddbe185e0bd88b096915bcc/numpy-2.2.6-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e1dda9c7e08dc141e0247a5b8f49cf05984955246a327d4c48bda16821947b2f", size = 14077935, upload-time = "2025-05-17T21:41:49.738Z" },
-    { url = "https://files.pythonhosted.org/packages/12/fb/9e743f8d4e4d3c710902cf87af3512082ae3d43b945d5d16563f26ec251d/numpy-2.2.6-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f447e6acb680fd307f40d3da4852208af94afdfab89cf850986c3ca00562f4fa", size = 16600122, upload-time = "2025-05-17T21:42:14.046Z" },
-    { url = "https://files.pythonhosted.org/packages/12/75/ee20da0e58d3a66f204f38916757e01e33a9737d0b22373b3eb5a27358f9/numpy-2.2.6-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:389d771b1623ec92636b0786bc4ae56abafad4a4c513d36a55dce14bd9ce8571", size = 15586143, upload-time = "2025-05-17T21:42:37.464Z" },
-    { url = "https://files.pythonhosted.org/packages/76/95/bef5b37f29fc5e739947e9ce5179ad402875633308504a52d188302319c8/numpy-2.2.6-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:8e9ace4a37db23421249ed236fdcdd457d671e25146786dfc96835cd951aa7c1", size = 18385260, upload-time = "2025-05-17T21:43:05.189Z" },
-    { url = "https://files.pythonhosted.org/packages/09/04/f2f83279d287407cf36a7a8053a5abe7be3622a4363337338f2585e4afda/numpy-2.2.6-cp313-cp313t-win32.whl", hash = "sha256:038613e9fb8c72b0a41f025a7e4c3f0b7a1b5d768ece4796b674c8f3fe13efff", size = 6377225, upload-time = "2025-05-17T21:43:16.254Z" },
-    { url = "https://files.pythonhosted.org/packages/67/0e/35082d13c09c02c011cf21570543d202ad929d961c02a147493cb0c2bdf5/numpy-2.2.6-cp313-cp313t-win_amd64.whl", hash = "sha256:6031dd6dfecc0cf9f668681a37648373bddd6421fff6c66ec1624eed0180ee06", size = 12771374, upload-time = "2025-05-17T21:43:35.479Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/3b/d94a75f4dbf1ef5d321523ecac21ef23a3cd2ac8b78ae2aac40873590229/numpy-2.2.6-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:0b605b275d7bd0c640cad4e5d30fa701a8d59302e127e5f79138ad62762c3e3d", size = 21040391, upload-time = "2025-05-17T21:44:35.948Z" },
-    { url = "https://files.pythonhosted.org/packages/17/f4/09b2fa1b58f0fb4f7c7963a1649c64c4d315752240377ed74d9cd878f7b5/numpy-2.2.6-pp310-pypy310_pp73-macosx_14_0_x86_64.whl", hash = "sha256:7befc596a7dc9da8a337f79802ee8adb30a552a94f792b9c9d18c840055907db", size = 6786754, upload-time = "2025-05-17T21:44:47.446Z" },
-    { url = "https://files.pythonhosted.org/packages/af/30/feba75f143bdc868a1cc3f44ccfa6c4b9ec522b36458e738cd00f67b573f/numpy-2.2.6-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ce47521a4754c8f4593837384bd3424880629f718d87c5d44f8ed763edd63543", size = 16643476, upload-time = "2025-05-17T21:45:11.871Z" },
-    { url = "https://files.pythonhosted.org/packages/37/48/ac2a9584402fb6c0cd5b5d1a91dcf176b15760130dd386bbafdbfe3640bf/numpy-2.2.6-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:d042d24c90c41b54fd506da306759e06e568864df8ec17ccc17e9e884634fd00", size = 12812666, upload-time = "2025-05-17T21:45:31.426Z" },
-]
-
-[[package]]
-name = "numpy"
-version = "2.4.6"
-source = { registry = "https://pypi.org/simple" }
-resolution-markers = [
-    "python_full_version == '3.11.*'",
-]
-sdist = { url = "https://files.pythonhosted.org/packages/d0/ad/fed0499ce6a338d2a03ebae59cd15093910c8875328855781952abf6c2fe/numpy-2.4.6.tar.gz", hash = "sha256:f3a3570c4a2a16746ac2c31a7c7c7b0c186b95ce902e33db6f28094ed7387dda", size = 20735807, upload-time = "2026-05-18T23:37:14.07Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/b3/49/ec46835a70be8fa6446c495126ac84fdb28cb2558e1620ffb87a10c8b64c/numpy-2.4.6-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:0280e0356c0829a18d9de1cb7eee50ec22ca639878d7240307ca0943d73cd2c4", size = 16969194, upload-time = "2026-05-18T23:33:13.503Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/0d/f5957185c0ee2f3e12f78715aa9e3b353fd83633316c8532b38faa37e3f6/numpy-2.4.6-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:110f8b71aacb688ec69062bb7f6938a0f8acb01b7c1c4beb453c65b6d234584d", size = 14964111, upload-time = "2026-05-18T23:33:17.795Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/40/40a40ee0ddf7ceb782c49af278894b686e586d65d8c1889c8b5da01a3d7d/numpy-2.4.6-cp311-cp311-macosx_14_0_arm64.whl", hash = "sha256:4cfe66903cc32a9921a6733d96b19bb6abf310397581bbad89c228f5abaf0ee8", size = 5469159, upload-time = "2026-05-18T23:33:20.654Z" },
-    { url = "https://files.pythonhosted.org/packages/63/13/f9a8046535cb21deae82f8d03de9617e08882d274fad2539630761888228/numpy-2.4.6-cp311-cp311-macosx_14_0_x86_64.whl", hash = "sha256:8155154c7c691289fe18f510b5d4657c68c67989f293f0535a91360392ff6538", size = 6798936, upload-time = "2026-05-18T23:33:22.987Z" },
-    { url = "https://files.pythonhosted.org/packages/33/a8/6fa8c1a345a8c85dbb21932c447bee07c30a2c2a3f31e369c0a84b300147/numpy-2.4.6-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0ab0a9c4ffb1a6d95ef519fe4247dba8eb6b18ad93999f76b7f657039acabd47", size = 15966692, upload-time = "2026-05-18T23:33:26.62Z" },
-    { url = "https://files.pythonhosted.org/packages/02/03/74fe2a4cb3817d94d86402f2506554130a2f01414e299b5a843e5a8a957f/numpy-2.4.6-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:89cd468399cfd2504718f0ba50e410dca55a170b61a02ad92bb18c8a65186e93", size = 16918164, upload-time = "2026-05-18T23:33:29.955Z" },
-    { url = "https://files.pythonhosted.org/packages/c5/80/3615be3313f7e7696609bc194b9f0101da809df79e859bdb84e0cd043f46/numpy-2.4.6-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c2d37ab77531417474168eb79d6d80b14f821a966818505d03013d0833edb7a8", size = 17322877, upload-time = "2026-05-18T23:33:34.724Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/ac/a691e0fe2675e370d0e08ff905adc49a1c8830e8cae03efe4477e92cd55d/numpy-2.4.6-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f407cb6b8e9d6d8c626bc73c945db1706035af8fd632295547bf1c9e46d092d6", size = 18651487, upload-time = "2026-05-18T23:33:38.217Z" },
-    { url = "https://files.pythonhosted.org/packages/15/a7/9bc1cd626d7bf6869bfedf27b91b6ab5dd607758bf8e959d6fa80c6a59cb/numpy-2.4.6-cp311-cp311-win32.whl", hash = "sha256:ddea102b48f9e339f3948bf22040944184627a30fdf7f858667673b9c5f033c8", size = 6233945, upload-time = "2026-05-18T23:33:41.331Z" },
-    { url = "https://files.pythonhosted.org/packages/c5/31/7fc6239c12bce7e931463251cca4426c465e1876ba3cc785402ef4dd8f4e/numpy-2.4.6-cp311-cp311-win_amd64.whl", hash = "sha256:1e254a00cdf42b1e4d5b3d68d33af63268d41340d8885df2ab6470f2e1500147", size = 12608406, upload-time = "2026-05-18T23:33:44.131Z" },
-    { url = "https://files.pythonhosted.org/packages/27/83/140f85a466595a16382996a1bf06b2b54bcd597488921b0c9daaeeda72af/numpy-2.4.6-cp311-cp311-win_arm64.whl", hash = "sha256:ed9749eef4cbd126da3dc1d6bcb3a57f5eb7ac6a6484146bdbf743f552dfc577", size = 10479528, upload-time = "2026-05-18T23:33:50.725Z" },
-    { url = "https://files.pythonhosted.org/packages/95/2a/3d7b5ac8aac24feaf9ad7ed58f45b0bbc06d37e4338ae84c9f2298b570f9/numpy-2.4.6-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:001fbb8e08d942dd57599e781f2472269ee7f2755fae407b4f67b2f0b17da3f1", size = 16689119, upload-time = "2026-05-18T23:33:54.065Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/12/92c4c131527599e8288d6918e888d88726f84d805d784b771f32408aeaef/numpy-2.4.6-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ebfb099f8dcf083deef3ac1ca4c1503f387cf76296fcb3816b66f5ecb5f54fdb", size = 14699246, upload-time = "2026-05-18T23:33:57.621Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/fe/c0a6b7b2ca128a8fb228575147073b660656734b8ebe4d76c8fd748dcc79/numpy-2.4.6-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:3213d622a0283a39a93d188f3cf72b26862df52fbb4ca3697f51705016523d41", size = 5204410, upload-time = "2026-05-18T23:34:00.302Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/d4/9770d14ba719432bb90a421bfd443872ed0f70f7264b64bec12ea363d5fd/numpy-2.4.6-cp312-cp312-macosx_14_0_x86_64.whl", hash = "sha256:357cc07a6d7b0b182ff02249616a03742827ebb1277546b5c7cd7f7620a45698", size = 6551240, upload-time = "2026-05-18T23:34:02.852Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/c6/50a46a6205feba2343f1d6d17438107c5dc491ed1c736e6ea68689fd906b/numpy-2.4.6-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5f9fb9157b4ce2971008323afe46053787b526ef624fea915b261468a8421a0f", size = 15671012, upload-time = "2026-05-18T23:34:05.485Z" },
-    { url = "https://files.pythonhosted.org/packages/99/60/14115e6364fa676c5397c2ad3004e527e9aa487abf5d0706ec81bbd08529/numpy-2.4.6-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:90f9849678c75fe7afa2d348ac842c168b0a4d3d61919687216dfc547976d853", size = 16645538, upload-time = "2026-05-18T23:34:09.265Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/c5/693cbe59e57db94d2231fa519ca3978dc9e19da5a8f088588f5c6e947ff2/numpy-2.4.6-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:c1a2af6c6ef86344a6b0db6b97834208bf598db514f2b155042439b62605601a", size = 17020706, upload-time = "2026-05-18T23:34:13.053Z" },
-    { url = "https://files.pythonhosted.org/packages/ef/fc/85b7c4eff9b4966ade25c2273cf7e7012e92366c032058653934b37de044/numpy-2.4.6-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:e5805d5a22fd19c8ccff10a9561f9df94436b0545619ea579db2d3c35294bce2", size = 18368541, upload-time = "2026-05-18T23:34:17.024Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/81/e1b27545deedce7f4a0b348618c6b62d74e36a4dc9ccd42f3eb2f85eee32/numpy-2.4.6-cp312-cp312-win32.whl", hash = "sha256:e3eeb0aabd6bd5ce64faae67e9935203a6991b4bc2a485a767fbafb2c5125f45", size = 5962825, upload-time = "2026-05-18T23:34:20.3Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/ca/feab00bd44aa5fe1ad2c18f08b4d3bb92e26484b0b1d1443897809ed528c/numpy-2.4.6-cp312-cp312-win_amd64.whl", hash = "sha256:d8e8286dd7cea7895157318d1b91cdacac64c479f3cbc8dce548331728484751", size = 12321687, upload-time = "2026-05-18T23:34:23.095Z" },
-    { url = "https://files.pythonhosted.org/packages/63/cf/5a6d34850a39d1093558564f77ee8e8e0bee5061151b8f05a55711001ec7/numpy-2.4.6-cp312-cp312-win_arm64.whl", hash = "sha256:4081eb135ac24158bd51cdfbef16f1c64df7063b1143f24731387137c092bec8", size = 10221482, upload-time = "2026-05-18T23:34:25.876Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/82/bdab26d7438c6791ca31b7c024ca37c1eab8b726ba236129005cd4a06e45/numpy-2.4.6-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:511dbaf848decaaaf4b4ca48032619fb3138710c4bf7da7617765edad1ef96b0", size = 16684648, upload-time = "2026-05-18T23:34:29.41Z" },
-    { url = "https://files.pythonhosted.org/packages/1b/30/a80189bcc7f5e4258b3fbc3968d909d1756f54d023299ecc39ad6fdb9ef8/numpy-2.4.6-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:bf162abab1c1a736333192707cef898e735a5ca00f38f27eeedf44b39d9e85eb", size = 14693902, upload-time = "2026-05-18T23:34:33.013Z" },
-    { url = "https://files.pythonhosted.org/packages/97/12/70b5d0d7c15e1ebb8a6a84a8caa1d19e181d84fb58bb6d70aca29099dec1/numpy-2.4.6-cp313-cp313-macosx_14_0_arm64.whl", hash = "sha256:043191bfa8eab18c776647b62723ac9dddece59743b13f49b2016094129c2b3f", size = 5198992, upload-time = "2026-05-18T23:34:36.132Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/8c/ebd2a8f8a83541f8d38cc5667e8c2b69cecfd30da6e45693e8158857d44b/numpy-2.4.6-cp313-cp313-macosx_14_0_x86_64.whl", hash = "sha256:6180d8b35af935aed8ece3a85e0a43f87393ae0ac87c8d2c8bd2c993f7270ef3", size = 6546944, upload-time = "2026-05-18T23:34:38.484Z" },
-    { url = "https://files.pythonhosted.org/packages/bb/c5/7b863a97a91671a0338f4253bd3b5a3d3852f0692dae91711c9f4a10e787/numpy-2.4.6-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:72fbe16c6fac95aedf5937fa873445cec2110be35d8a4e9433d7501fd98dae6b", size = 15669392, upload-time = "2026-05-18T23:34:41.257Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/9d/3584b9984ca4c047aea75214ce1a4c4c73d849bd71b604264b7f5653f8a8/numpy-2.4.6-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a7830bab239b79cda9c08c2da014761cafb48da6150e1da17ac06283f43b6089", size = 16633220, upload-time = "2026-05-18T23:34:45.075Z" },
-    { url = "https://files.pythonhosted.org/packages/05/ae/7c67fba23bd98caec7c99261f3a16072ade14813486b0282cb29846de832/numpy-2.4.6-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ef4aea96ce4d3b074422cb4f2f64e216bf9e213004bb58ecfdf50ea02ea8eb9a", size = 17020800, upload-time = "2026-05-18T23:34:49.065Z" },
-    { url = "https://files.pythonhosted.org/packages/d9/5d/3b6725cb31d983c5e66916f5d36f6d7e5521129e4c4404d64f918292a5b6/numpy-2.4.6-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:dfa20cc6ca228e6b155b11da03825975ce66aea520985dbbddf0f2a5a495c605", size = 18357600, upload-time = "2026-05-18T23:34:52.709Z" },
-    { url = "https://files.pythonhosted.org/packages/f7/da/2ccc6c2fe8898dee01d90c75c5f5f914a23daf99e3e0f59516a08760c8b5/numpy-2.4.6-cp313-cp313-win32.whl", hash = "sha256:56b39e5e0622a09a25bf5baf62f4bcf0cb8a41ae6e2819cf49bbc5a74c083f91", size = 5961134, upload-time = "2026-05-18T23:34:55.618Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/cd/9cc4dc876fb065d5c220aae4d5e14826b2715331bb7618ce1fb07a679d99/numpy-2.4.6-cp313-cp313-win_amd64.whl", hash = "sha256:c4fc99836233ea196540b17ab0983aff60ed07941751930f5f4d05bc3b3b7359", size = 12318598, upload-time = "2026-05-18T23:34:58.928Z" },
-    { url = "https://files.pythonhosted.org/packages/39/1e/c0bcba1f8694116485fe28fd1be698c278fcda4141c5b0e53a2aed8b12a8/numpy-2.4.6-cp313-cp313-win_arm64.whl", hash = "sha256:a7c711e21628b52034bb5ab8d1bce291f752fcc5e92accc615778acee1ff4778", size = 10222272, upload-time = "2026-05-18T23:35:02.167Z" },
-    { url = "https://files.pythonhosted.org/packages/63/6d/cc5619247c8f4204e507f5883528372e4ac4bb189e579fb859a12e480b1f/numpy-2.4.6-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:112b06a867b235ef466ed3508ddf0238050df9c727cafb5301ac385b899189a1", size = 14821197, upload-time = "2026-05-18T23:35:05.468Z" },
-    { url = "https://files.pythonhosted.org/packages/00/58/f1c39161c87d9e9bed660f1ed4bafc0e403d5ec9650b6dd77aead07d489b/numpy-2.4.6-cp313-cp313t-macosx_14_0_arm64.whl", hash = "sha256:eaf7fa2de5c0be8ae6ff8e9bea2ccd725e980541244521d8d4b5f3354a27babe", size = 5326287, upload-time = "2026-05-18T23:35:08.693Z" },
-    { url = "https://files.pythonhosted.org/packages/af/57/3917ab0fd97f271a8694513581b8a36c655f111c446852c302f04ccdb6fc/numpy-2.4.6-cp313-cp313t-macosx_14_0_x86_64.whl", hash = "sha256:7265a2f3d436e54ef9f2b52b5c937e6be778781bd97a590319d7348f1c1ca997", size = 6646763, upload-time = "2026-05-18T23:35:11.459Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/0f/037e64c494b67581ae18193d770adef354c41f3f2c8ebf865602d949bf8f/numpy-2.4.6-cp313-cp313t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f74a575920ab21fe304421a3fc28793d82e299cae9eccb37084e9fc7f3617c20", size = 15728070, upload-time = "2026-05-18T23:35:14.79Z" },
-    { url = "https://files.pythonhosted.org/packages/21/a6/5d2bae9c9542eb4df16dc9c46dc79c186e9bad53805dfa5399a6023c6db0/numpy-2.4.6-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ede83e07a75dd06bc501566c1eca2afc0d61677c1472ac9ad93fdee6e638a48d", size = 16681752, upload-time = "2026-05-18T23:35:18.836Z" },
-    { url = "https://files.pythonhosted.org/packages/92/14/23d1dfb410ae362cd59ce53e936b1513d545eb40db3949ced632e19a459e/numpy-2.4.6-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:68bb27509ac1b9a3443094260f6326150663b06abe40b73a2f81160623da5b67", size = 17086024, upload-time = "2026-05-18T23:35:22.52Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/6e/23595a2c642cdf3bc567877064bdd7f91c8b0038a4453cf2daf7248eafe9/numpy-2.4.6-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:a0df0043bdb289bde1f62da130d20df23d58b45429f752bc7a8fc5325a225ecd", size = 18403398, upload-time = "2026-05-18T23:35:26.398Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/90/0ac3bc947217e66dec77e7cbc6a1979d1af70b6461b82f620d3bccd5e4c8/numpy-2.4.6-cp313-cp313t-win32.whl", hash = "sha256:29a287e0cf63ff528da061de6b9f64a4618da591ca1046aafc54062e40ca7eab", size = 6084971, upload-time = "2026-05-18T23:35:29.387Z" },
-    { url = "https://files.pythonhosted.org/packages/77/71/5673e351671a1d2bd6063b91b44f70c0affea7d1516fa7a6572941ba4aa1/numpy-2.4.6-cp313-cp313t-win_amd64.whl", hash = "sha256:25c692919ac5a01f170a3bfcd62d745b24fd095c353d50812637d6fcab442e75", size = 12458532, upload-time = "2026-05-18T23:35:32.175Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/88/19d3503c5046e688f049274b27a3ef3d771152fa80d3ba3d01a3dff61abe/numpy-2.4.6-cp313-cp313t-win_arm64.whl", hash = "sha256:1e978ec1e8bd0e0e4de6bb75de9d30cbb74db6b6a2bb727618613703ca0167dd", size = 10291881, upload-time = "2026-05-18T23:35:35.465Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/91/3ab2044d05fd16d343c5ac2e69b127f1b2854040dd20b193257c78028bd3/numpy-2.4.6-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:06ca2f61ec4385a07a6977c55ba998a4466c123642b4a32694d3128fce18c079", size = 16683458, upload-time = "2026-05-18T23:35:38.353Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/62/764ce66fa4147ae6d73071a3abf804ffe606f174618697c571acdf26a7c9/numpy-2.4.6-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:38efbc8de75c7a0fc1ac190162d892787f3f47b57cc291231aafee36b80982b7", size = 14704559, upload-time = "2026-05-18T23:35:42.14Z" },
-    { url = "https://files.pythonhosted.org/packages/60/61/23f27c172f022e04025b7dc2367f4d63c1a398120607ec896228649a6f48/numpy-2.4.6-cp314-cp314-macosx_14_0_arm64.whl", hash = "sha256:d581b735e177fdcdce6fed8e7e8880a3fb6ee4e3653a3ac6af01c6f4c03effc5", size = 5209716, upload-time = "2026-05-18T23:35:45.377Z" },
-    { url = "https://files.pythonhosted.org/packages/03/71/21cf70dc6ea3e3acb95fc53a265b2fc248b981f0194ceb5b475271b8809d/numpy-2.4.6-cp314-cp314-macosx_14_0_x86_64.whl", hash = "sha256:0a041d3d761dc3c35cc56ce0351506a02bcbc25f7b169f652435141a17db9096", size = 6543947, upload-time = "2026-05-18T23:35:47.926Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/91/64288395ee1799bd2e0b04a305dce9666da90c961e1f3fe982a05ee1c036/numpy-2.4.6-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:40fdc1ae7125e518ea98e53e69a4ebc27e1fd50510c47b7ea130cf21e5e1d42b", size = 15685197, upload-time = "2026-05-18T23:35:50.863Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/eb/ebffaa97dc55502df69584a8f0dcf07f69a3e0b3e2323670a2722db9aa39/numpy-2.4.6-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a2c306dea656c12c68f51f4cea133cbe78ca7435eb28c735eac1d3ebe73be6e8", size = 16638245, upload-time = "2026-05-18T23:35:54.752Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/0b/54f9da33128d7e350fab89c7455902eeae70349ee52bddb448dc4a576f45/numpy-2.4.6-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:33111801a01c12a8a1e3721f0a9232f8cfc8ae2c6b7098167e6f623c6073f402", size = 17036587, upload-time = "2026-05-18T23:35:58.355Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/f0/fdebc1052db1cc37c64beb22072d67cd6d1c71adca1299f53dec2b5e20d3/numpy-2.4.6-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:ae506e6902902557576a26ff33eda8695e7ecb3cb36c3b573a0765dee114ebdb", size = 18363226, upload-time = "2026-05-18T23:36:02.845Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/b4/298628d98c72b57e57f7165ae6a481a1deaf6f3c28262a6e4c739c275930/numpy-2.4.6-cp314-cp314-win32.whl", hash = "sha256:aaf159caa35993cb1f56fb9b8e4610d35758e7ca005412eb1daa856a78c9c4b1", size = 6010196, upload-time = "2026-05-18T23:36:05.92Z" },
-    { url = "https://files.pythonhosted.org/packages/df/ac/46de6dda46478f7942f839e094970be2d4a861e005c4b3bf07c92e291a09/numpy-2.4.6-cp314-cp314-win_amd64.whl", hash = "sha256:b507f5c4c1d508876d1819b6bf9a49d365b96320b5d4993426b33a23ca4b8261", size = 12450334, upload-time = "2026-05-18T23:36:09.107Z" },
-    { url = "https://files.pythonhosted.org/packages/78/92/b8b798ac784102c0da830d2257d59358e3d3d90d1e2b3f2575dad976c5cf/numpy-2.4.6-cp314-cp314-win_arm64.whl", hash = "sha256:6f41ae150c4e32db4f3310cdaf64b1593a03dbabe29eec77fc9b50fe64061df6", size = 10495678, upload-time = "2026-05-18T23:36:12.766Z" },
-    { url = "https://files.pythonhosted.org/packages/30/34/ec28d1aa8115971537c01469ab2011ee96827930f0a124de1000cc2a7ed7/numpy-2.4.6-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:ece3d2cfe132e7d51f44a832b303895e6f2d499c5e74dfbdb06ee246147a304a", size = 14823672, upload-time = "2026-05-18T23:36:16.473Z" },
-    { url = "https://files.pythonhosted.org/packages/16/bd/f6d1fede4e54e8042a7ff97bb495510f3c220f94bcd9e8b228e87c92cc0d/numpy-2.4.6-cp314-cp314t-macosx_14_0_arm64.whl", hash = "sha256:e3e5193ef5a3dc73bceee50f7fdc2c90dbb76c42df8d8fae3d1067a583df579e", size = 5328731, upload-time = "2026-05-18T23:36:19.767Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/f0/e105b9e2fd728a9910103884decd6951d9dd73896b914a98d9a231de02ee/numpy-2.4.6-cp314-cp314t-macosx_14_0_x86_64.whl", hash = "sha256:17f9ade344e7d9b464a084d69bcf18fc691cb1db67c62ed80820bf4926d78f0e", size = 6649805, upload-time = "2026-05-18T23:36:22.266Z" },
-    { url = "https://files.pythonhosted.org/packages/82/dd/1206a7ca6ab15e3f02069707ca96222e202af681bb73756da7527f3cb837/numpy-2.4.6-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9cd5ffd25db4e7ba6a375693b3fc0fc1791ec636c17db3720da19bde7180ec43", size = 15730496, upload-time = "2026-05-18T23:36:25.713Z" },
-    { url = "https://files.pythonhosted.org/packages/51/e7/38d3ea825dcab85a591734decb2f6c67caa7c8367d374df1a1c3842f9b07/numpy-2.4.6-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7d92c3819208a60205a12a245c91ad70cb0a85336659b19b834205573ac8456e", size = 16679616, upload-time = "2026-05-18T23:36:29.652Z" },
-    { url = "https://files.pythonhosted.org/packages/93/b7/caabfdf53edf663e0b4eb74d7d405d83baef09eb5e83bcd32d601d72b93e/numpy-2.4.6-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e85b752a1e912b70eaad4fafbd4d1238007ab221de2009b9a2f5ae7461239895", size = 17085145, upload-time = "2026-05-18T23:36:33.449Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/45/68d7c33a6bcf3e5aa3bdbd57a367e6f615286dfd6482f97e8ffeb734306e/numpy-2.4.6-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:29cb7f67d10b479ff07c17d33e39f78c07f71c40ef30d63c153d340e96cd3fb4", size = 18403813, upload-time = "2026-05-18T23:36:37.369Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/50/0753655aa844c99cd9e018aacf76f130f1bd81d881bb74bc0aef5d73a8ba/numpy-2.4.6-cp314-cp314t-win32.whl", hash = "sha256:260a5d70215b61ab4fadf5c7baacd64821842975eea312125ed3c39a6391b063", size = 6156982, upload-time = "2026-05-18T23:36:40.817Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/d4/7c67becf668f973cb490cec3e98dfd799d866f9c989a54d355672cfa0db6/numpy-2.4.6-cp314-cp314t-win_amd64.whl", hash = "sha256:81a1cca95ed5bb92aa8b10dd2cdc9a0d3853a50fad926c28b5d7e8ea54389627", size = 12638908, upload-time = "2026-05-18T23:36:43.996Z" },
-    { url = "https://files.pythonhosted.org/packages/43/bb/e1c71a4295b1b1d1393d50dbb4f2a36283c6859d9d3892e84f00ec5a91d5/numpy-2.4.6-cp314-cp314t-win_arm64.whl", hash = "sha256:0c9136e14ed34a9e343a31c533d78a9813a69a3148332bce5e9821cb2f996e66", size = 10565867, upload-time = "2026-05-18T23:36:47.114Z" },
-    { url = "https://files.pythonhosted.org/packages/de/12/b422cc84439adc0d00de605bf4a308890ae5c26f2c71fbd73e5d08fbb0dd/numpy-2.4.6-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:55cced7c52e981362f708ad635198e97a752dfba412cc03c23bbf3bd8d5cd662", size = 16847511, upload-time = "2026-05-18T23:36:50.673Z" },
-    { url = "https://files.pythonhosted.org/packages/44/53/f481bef68011740f8849418d82db07230e825013f31f4eef5ba5b805316a/numpy-2.4.6-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:d6da64deb6b8ed903e7560180a92f2d804ee1ba5eeb849ac2748b8c1aba1f6d7", size = 14889064, upload-time = "2026-05-18T23:36:53.879Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/57/42ed575c10ced8af951d426bc4e1f8aff16fd851db33f067036215a7f860/numpy-2.4.6-pp311-pypy311_pp73-macosx_14_0_arm64.whl", hash = "sha256:68a5124b13fa6cc2086764a20005d30bc0548146f7f5322f02fce212ca14317f", size = 5394157, upload-time = "2026-05-18T23:36:57.194Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/ef/f66cc724fcc36c1e364c67f51ae9146090b8b584f27d58b97fdae3edd737/numpy-2.4.6-pp311-pypy311_pp73-macosx_14_0_x86_64.whl", hash = "sha256:948424b06129ce883307e8cff868c31396d8dc7630a59c61d70d98dbe70f222c", size = 6708728, upload-time = "2026-05-18T23:36:59.575Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/9c/c531f2293b91265d8b48e9b329f54fdd7ffae73cb4134ea10cca4237e9cc/numpy-2.4.6-pp311-pypy311_pp73-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5dbbdb29840ca3d91ee0fece42fc29278886d908280bfec0a5846c6f901a3eb0", size = 15798374, upload-time = "2026-05-18T23:37:02.674Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/b0/413077f6b1153ed3cba361401c6783bbad6114804a000cc22eb71c13e190/numpy-2.4.6-pp311-pypy311_pp73-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8ad03c0965fb3c692200e74d458ca28c1dbb4ce96f9a479a8aa041ad5fabca02", size = 16747286, upload-time = "2026-05-18T23:37:06.327Z" },
-    { url = "https://files.pythonhosted.org/packages/15/ce/e5ec180bc41812edcd8daeb8639d205622c0e8c02259d8ab25a0201b3c2a/numpy-2.4.6-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:2803abfebfc990042cd494d8ce2d5f82e9d847af6d35ec486923aa19dbad5e73", size = 12504263, upload-time = "2026-05-18T23:37:09.715Z" },
-]
-
-[[package]]
-name = "numpy"
-version = "2.5.2"
-source = { registry = "https://pypi.org/simple" }
-resolution-markers = [
-    "python_full_version >= '3.15'",
-    "python_full_version == '3.14.*'",
-    "python_full_version >= '3.12' and python_full_version < '3.14'",
-]
-sdist = { url = "https://files.pythonhosted.org/packages/9a/80/db0b4559e57ec36362bedbb05530a87fafbcb6067708c946967a41d449e7/numpy-2.5.2.tar.gz", hash = "sha256:d482d171c406ae88c5b19cad3b6a1c4c5209f886ab74bc44c2c865c23f52d860", size = 20773161, upload-time = "2026-08-09T13:48:27.962Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/69/72/dccb0aaf40972777283303919f613964227266d0c13adebb79ac124f1c3e/numpy-2.5.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:14e373cfc6387177e8409dac3c7159be8eb05cd77096cd7c950268b86f62831c", size = 16891693, upload-time = "2026-08-09T13:44:51.702Z" },
-    { url = "https://files.pythonhosted.org/packages/60/2e/b5aee50a1f74ac815cf8331812cb8251e29024025de462e0c047641c614c/numpy-2.5.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:4bbd96c833ecc8cc069ce518078fc8c60cb9cbfb0fea5b7a803ad65035596d03", size = 11903109, upload-time = "2026-08-09T13:44:55.501Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/f4/29e78102a80601cf034d4e9767022cffeca2c3b4c926e1754572ca95593d/numpy-2.5.2-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:6e8172ddfcf5cf74b811d372b570b83c60bd2de87a6fbfbebdadb4a9bd9c6cbb", size = 5350202, upload-time = "2026-08-09T13:44:58.401Z" },
-    { url = "https://files.pythonhosted.org/packages/11/4b/dcd3b7eadaf4035d2c7a4289d232523a6964f602598ef7674e4bd7291f93/numpy-2.5.2-cp312-cp312-macosx_14_0_x86_64.whl", hash = "sha256:65f188481f1669e26f62b701e8205d19e460fa4a9b52a1414ba382330e4a3414", size = 6687736, upload-time = "2026-08-09T13:45:00.813Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/21/4947e0e9d6c9fc2e2ff15b8949049ee44f63adb9cacc729ab8793f97e712/numpy-2.5.2-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8ee9c4eeb8454b3660a8b53493563c3e121c2fc94fbd72b848ef814ed7b676a9", size = 15612696, upload-time = "2026-08-09T13:45:04.151Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/5f/62d28cf019460c7f1394105b4d49d9911a9c444cb77ab0bd95a204c5a6de/numpy-2.5.2-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3cdec01fa790a186d430433fdd4d4ffb70eed6f0eeb4bf05c8dbe2dce0a9bcb8", size = 16722264, upload-time = "2026-08-09T13:45:07.714Z" },
-    { url = "https://files.pythonhosted.org/packages/14/25/3f0be4c1b9fdf5dd5e708a6806978564d7c46a055c000496309ff2a2f8af/numpy-2.5.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:7999d4ddb0c4025018373fd787510d46e04c769467af22869707b3c1cfd459ab", size = 16974396, upload-time = "2026-08-09T13:45:11.316Z" },
-    { url = "https://files.pythonhosted.org/packages/22/72/6262cbdeeb45da9d971e40715f579d791603ba8ec0b5e2db1ac55454421d/numpy-2.5.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:c1f017dc0875c9209d219f97feceb7d54c2661bb243deb4114478e1295808af7", size = 18476044, upload-time = "2026-08-09T13:45:14.869Z" },
-    { url = "https://files.pythonhosted.org/packages/36/33/29208b8b075bde62d26a81d14b358c42b0f69b6cabd98d4ff97f37f22b05/numpy-2.5.2-cp312-cp312-win32.whl", hash = "sha256:d6a48072864e3324e194a8fbb3c657bcc5b5c869dbc64c9537b1d5c862572c0a", size = 6072817, upload-time = "2026-08-09T13:45:17.867Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/b9/87fea2769fe1c47c1b5b01d8310772c9d1a85d485de7cf386ef7a3332b02/numpy-2.5.2-cp312-cp312-win_amd64.whl", hash = "sha256:28ac63476ec7651484215ee7fa15a1f78b57c14621f01e392afe17b9a1390ce4", size = 12464674, upload-time = "2026-08-09T13:45:20.734Z" },
-    { url = "https://files.pythonhosted.org/packages/14/52/032b97e00461ab0809bbe4c588b035620e5a14b8cdee47ecddefc7b17d33/numpy-2.5.2-cp312-cp312-win_arm64.whl", hash = "sha256:27650bb0e7140fa3d37b9923b4803645e0b125d190f326eecfd3f4dad8e8ade1", size = 10397131, upload-time = "2026-08-09T13:45:23.73Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/d2/6b24738a0ef4557d189b150046cd07823c50e4273e8aebd651222e24306f/numpy-2.5.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8e4cb9a754c8a0c62eaa88273a5fba3391f4a610d1dee893c0755da31c083f15", size = 16886595, upload-time = "2026-08-09T13:45:27.323Z" },
-    { url = "https://files.pythonhosted.org/packages/65/60/f2d208d366f263f39c6e69ed309290717aab41078b6d04c9be2a84fa2a07/numpy-2.5.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:52c808f96484f5571a5cc863775ce50247c17dfb3b0361f8ed6b4b0456f80080", size = 11896845, upload-time = "2026-08-09T13:45:31.638Z" },
-    { url = "https://files.pythonhosted.org/packages/3c/79/81e0bf24f4d020a2b1d5cd297a9f60c3f24eeb116f9bba5870443f7b6a4a/numpy-2.5.2-cp313-cp313-macosx_14_0_arm64.whl", hash = "sha256:29d81e97f668489cba8ebfd796b9bdd453525d35dd9e162e2daec94bf3fc7740", size = 5343880, upload-time = "2026-08-09T13:45:34.373Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/cc/e3141cf06d1a8a2c7e107543fe1269c1d1af760d4d683c0794a4ee1127c2/numpy-2.5.2-cp313-cp313-macosx_14_0_x86_64.whl", hash = "sha256:afb3f0632d6b2e3ba04dbce8d1e48d321b369138b73830b5ca371a0e8d479d56", size = 6682264, upload-time = "2026-08-09T13:45:36.7Z" },
-    { url = "https://files.pythonhosted.org/packages/29/f1/2a64a307d92c5d98f5255a4014eb43bb6103ee477087b61ecae44a3aa9b9/numpy-2.5.2-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0aadf13b60048d501e05fa699efaf7734e2494f3498a4c2a5521d822640324f3", size = 15609566, upload-time = "2026-08-09T13:45:39.518Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/44/59a1eb68e773c4098d107ef34a0dbdeca501d72ffcfbff9a7707343921ce/numpy-2.5.2-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:29b86ff8a6cc556b47ec6b64b194815cc80e6bf5eedcc6cddfd65318cb0b4eee", size = 16709995, upload-time = "2026-08-09T13:45:43.661Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/4c/3e54d4ddbc359a1295f8b633e8106bcd4d7d4a206e82df051bdfb3058755/numpy-2.5.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:6950c4b7dd562453090548ba7f5da7e59f57f85663f15d5dcc60e249192f7e59", size = 16972511, upload-time = "2026-08-09T13:45:47.094Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/9f/02e371638ebf19b66d46231e4be52999e87f32d1961b113bc45656608b22/numpy-2.5.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:b9727f472d2f3888053b8a75ab0cb94745a9de224bb5846dbadc0092101bc71d", size = 18465609, upload-time = "2026-08-09T13:45:50.808Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/ae/ad6645abc7a3510fe48e8ea1ab4598166f500057ef4ebf38bfad4f1577de/numpy-2.5.2-cp313-cp313-win32.whl", hash = "sha256:4f9744f9fbdcea0bc552e8f19e1f141f811a3f9bc2be2cc6e86d982cab23e3f4", size = 6070204, upload-time = "2026-08-09T13:45:54.111Z" },
-    { url = "https://files.pythonhosted.org/packages/15/20/f3489f86d81ea460b2bcdceaed094142ca6579f6be0ec527b781d39afe68/numpy-2.5.2-cp313-cp313-win_amd64.whl", hash = "sha256:85aaccb24182c25df891ad0ec333585967e115269d5f1b17f2c9ae005bc96657", size = 12460532, upload-time = "2026-08-09T13:45:57.167Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/21/35b31dde1b283b79de828b80f876afd8c94e28fe1e9c375f89e261cc4c0d/numpy-2.5.2-cp313-cp313-win_arm64.whl", hash = "sha256:bd68ece1553d2023c09a4226d9e41c586ad2d20594d1a456186c33513d2cb3f2", size = 10396725, upload-time = "2026-08-09T13:46:00.478Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/f8/c3b222bf075b50afd8e949a07a15c4b312a4a84bd8102a332bcd953cbbb4/numpy-2.5.2-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:d787cf769c3baeb5f6235e778edb52c08dfa923789b5958f28e6450f96107cb1", size = 16885180, upload-time = "2026-08-09T13:46:03.939Z" },
-    { url = "https://files.pythonhosted.org/packages/17/e1/2c1d4b1987795a92b5bbf7c24fe249ab96aa2573ab0d7604802c189d7b86/numpy-2.5.2-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:24b9dc2e3d84aa58523798805194e23e736f3f6ce2d1a5b92583ae734e6dbda8", size = 11907878, upload-time = "2026-08-09T13:46:07.045Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/ee/d08226fc858044355983a6e5b94f08ff6f3969e0a2b160a4a89f0ddb3445/numpy-2.5.2-cp314-cp314-macosx_14_0_arm64.whl", hash = "sha256:9e9413326d726c2545bfa65d2c0876871e8d8386e77f992c1d426e180bbd4323", size = 5354922, upload-time = "2026-08-09T13:46:10.04Z" },
-    { url = "https://files.pythonhosted.org/packages/94/f0/6d3d933056440ebbc5e6bad92065fc6c26a48a84a36b1208580e94eea76c/numpy-2.5.2-cp314-cp314-macosx_14_0_x86_64.whl", hash = "sha256:60e902ac295855348a5ca2ea4c89108989a9f5fddfad3dfc0a8f36b10358567e", size = 6679168, upload-time = "2026-08-09T13:46:12.275Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/3b/ecd49dd90033cceb2704d88ca905d4d7d89b0e8c739608754ffd325fa820/numpy-2.5.2-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:50e500dc868e9313530ce12ba470fe50ff3afe3d62993ed6eff652dacd555b65", size = 15624501, upload-time = "2026-08-09T13:46:15.322Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/99/461bd36dbdfac6c1c53efa370bd55a83227542d0d118f1677dbf1a3dacd5/numpy-2.5.2-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:318b9a4c845dbea06708a29c84ee429cc3065048db34cdb799047643492050ee", size = 16713701, upload-time = "2026-08-09T13:46:18.949Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/9c/2b251df9e8a5d647b62b0cbc1b90a91850c1cf4859ecb532fd0b4eacff6c/numpy-2.5.2-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:34c319e2963be042673fb46570501b2f06c41924e17e3563d58646b4380dfb68", size = 16986065, upload-time = "2026-08-09T13:46:23.006Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/25/20de43f53ff1390534a124475055a19f01fe10c920a0fd11b8e18d6d6052/numpy-2.5.2-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:f06571a052127dc1b4e8b83029b4d1b20daa2b64a31cdd181fc6bc774e9000eb", size = 18470031, upload-time = "2026-08-09T13:46:27.102Z" },
-    { url = "https://files.pythonhosted.org/packages/56/5e/0c577ca308d6da5eb79b546ba10bbe5b60148192194e2da060913b1de4f1/numpy-2.5.2-cp314-cp314-win32.whl", hash = "sha256:2cc779226e476d1e1f08c74068c419e60f41a9e0e069c92f6671d31d5c985e98", size = 6121028, upload-time = "2026-08-09T13:46:30.046Z" },
-    { url = "https://files.pythonhosted.org/packages/15/5c/7bcbd5b11f94199073320410cddcbb80cee62415bfeb540874b265c2d922/numpy-2.5.2-cp314-cp314-win_amd64.whl", hash = "sha256:7587f53dfbd5edc0f7b87c6217b4c6d2d1f2ef9c3da70bc1315e7db5f8d7ec9d", size = 12597627, upload-time = "2026-08-09T13:46:32.886Z" },
-    { url = "https://files.pythonhosted.org/packages/87/bc/4d0b06fba0da90ccc75af62823cb9dcedb6c9ea0cffa058cb2c9ee773a77/numpy-2.5.2-cp314-cp314-win_arm64.whl", hash = "sha256:3e4c367352d3747784248a227fbec218e193b56f7e6692e3b64fc805478ecfdf", size = 10680414, upload-time = "2026-08-09T13:46:36.036Z" },
-    { url = "https://files.pythonhosted.org/packages/cd/17/f429aac9dc08833a0d0f188eba38c532a751b1a1f2ca6018a37b455cb321/numpy-2.5.2-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:b879fb674276e331513fb136b78dbc6bd3c848309e0d841cfd63be3896c4cfc1", size = 12026967, upload-time = "2026-08-09T13:46:39.084Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/9f/d0849de96a2a4ceaa16662f18ee13eaa9c0aa418269fdc8c4857c56b11da/numpy-2.5.2-cp314-cp314t-macosx_14_0_arm64.whl", hash = "sha256:fd0d703772bba096843785bd38371e31bb4a0c1151497ad5739d182114a73f7f", size = 5473874, upload-time = "2026-08-09T13:46:42.075Z" },
-    { url = "https://files.pythonhosted.org/packages/89/3c/8df216d4a4a5422a3de045301cf7df8ea47286d76f5cb7160b0128ac26b7/numpy-2.5.2-cp314-cp314t-macosx_14_0_x86_64.whl", hash = "sha256:3a2f061cebd9e3d23bdcfaaded5e2293a4c6a5b60fa42df85d410a725ce621bf", size = 6789276, upload-time = "2026-08-09T13:46:44.387Z" },
-    { url = "https://files.pythonhosted.org/packages/e6/3a/20d7e9891c4ddfadd6ff8d95bf4b29f353d8e1770553de2099880551dfb9/numpy-2.5.2-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6df895598c0edcb41030126c89e0f353b07d93238116143b7405e937359736c4", size = 15659154, upload-time = "2026-08-09T13:46:47.538Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/d6/f3aa3d2688bf501b858835c6bd087ae9b51a56ae6fca8e2b0990abd177af/numpy-2.5.2-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1ab3d4a901f844ea836c3e80bf463c6a27d7f3c14e8e292fcf28d348b25b9bce", size = 16748909, upload-time = "2026-08-09T13:46:51.442Z" },
-    { url = "https://files.pythonhosted.org/packages/7d/8f/1c5cae8d2baf86ab802ae97a00be55bc7e21ebc11b12bbc33376c5f05342/numpy-2.5.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:cebc2d6dbb605a7703d59751dea4bd6b0ab127a5a4338a6f432df1936fef8b26", size = 17027685, upload-time = "2026-08-09T13:46:55.095Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/27/71d3467404aedc1c24ce79610f91b52b0b0f466c43a701aa56fc75c145ab/numpy-2.5.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:eaca7ff36f0f52e2111ec71f169d8fd3e889e7ddc0d2592e0d703fd8d3ce8fac", size = 18501181, upload-time = "2026-08-09T13:46:59.09Z" },
-    { url = "https://files.pythonhosted.org/packages/14/2f/42921d27c40aea7e077f4a423ae509fd9220b028cd787bafefd8ab2b3a5f/numpy-2.5.2-cp314-cp314t-win32.whl", hash = "sha256:ddf47472af2e4280d79bac82304f5e80150211f1b9e614b760061d5fdfbb6eba", size = 6271085, upload-time = "2026-08-09T13:47:01.903Z" },
-    { url = "https://files.pythonhosted.org/packages/75/e6/bad5f5d56de9b1971bac959963dda276d35c40f1854475005434bbe08692/numpy-2.5.2-cp314-cp314t-win_amd64.whl", hash = "sha256:44ef9675d908e65f9953063837c3277730f3f4437615a4cdab67b366cabaf884", size = 12787971, upload-time = "2026-08-09T13:47:04.963Z" },
-    { url = "https://files.pythonhosted.org/packages/df/05/f608795cb34391acd67e38d94a3c36abd8d8576293a3a80727d7595c372c/numpy-2.5.2-cp314-cp314t-win_arm64.whl", hash = "sha256:eaa088384c46f519dacb93b7ec483a6d6b19a4a2085ae4f25ab9b1c43d387d1e", size = 10750306, upload-time = "2026-08-09T13:47:07.976Z" },
-    { url = "https://files.pythonhosted.org/packages/33/c6/28de0191c5f82b7d42a0a51390ba98587048aa93a39fafb05bdbe6e8d00c/numpy-2.5.2-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:078f9b027b478c9379b9677babbf0f8b8f1ecfada27636d7b9a93990c638739f", size = 16885274, upload-time = "2026-08-09T13:47:11.439Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/d1/973ca116000d244897e468ea1aff30b589e5022e3c8744b71706fe33bd57/numpy-2.5.2-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:50a68f4bacd8a2b33d8da3d2269d0d78500f86ea582e4786dc10f5ef2c2c6842", size = 11907846, upload-time = "2026-08-09T13:47:15.128Z" },
-    { url = "https://files.pythonhosted.org/packages/78/d9/8c4b3937ef204cb2fd88d389ccd0f265a2ffb11f35a01d2064cf46714bd6/numpy-2.5.2-cp315-cp315-macosx_14_0_arm64.whl", hash = "sha256:e79aba74ffaf5f78a050d777c184cddf8fdffabab38acf5f3ef1fecbc17895d6", size = 5354892, upload-time = "2026-08-09T13:47:18.07Z" },
-    { url = "https://files.pythonhosted.org/packages/74/9b/b6ee65ea2999fdb7023935e108e6fb776ee4082aa15f159acfa857e578c8/numpy-2.5.2-cp315-cp315-macosx_14_0_x86_64.whl", hash = "sha256:9a0731745a72a184490a582fb4af2533512bd071ace67785b5fdffc0ae58dce8", size = 6679309, upload-time = "2026-08-09T13:47:20.456Z" },
-    { url = "https://files.pythonhosted.org/packages/43/f3/acb18d8b137a393c8e7803a8c994c9e64bde3930692a69d826993113a159/numpy-2.5.2-cp315-cp315-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4ec954036759bcee3aa484f8603bd9c14f3e776293b85578b8734c2d72777c69", size = 15625850, upload-time = "2026-08-09T13:47:24.365Z" },
-    { url = "https://files.pythonhosted.org/packages/a9/bf/a8e9bb0db815a0e265b5744ebedd3af0bd5faad8604e5b50a1cd012f3c91/numpy-2.5.2-cp315-cp315-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:dc649493697006bc90614a5f0bbc8cb3cb1866715c474e473694968d7e6b99ab", size = 16713664, upload-time = "2026-08-09T13:47:27.965Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/c3/6e913736b3dd6582344af32418b5fb9dab34282e8a8174ae1d54ceb0fc13/numpy-2.5.2-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:cf7de32f486e4ac9e2d93b810f9e9ac72a728dd46a32a0bb403222f27f653514", size = 16986749, upload-time = "2026-08-09T13:47:31.541Z" },
-    { url = "https://files.pythonhosted.org/packages/80/09/7d3b23eff5c7428ef6c01e6f7052bb60d504c4d33e317b36b8959c24ad97/numpy-2.5.2-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:2ffa7bacab3e2ee1b19ed31766bb60bb380b68c23f051e199c5cc598afd68710", size = 18470495, upload-time = "2026-08-09T13:47:35.364Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/a4/68a321d825374f6eb677ffe8ef8c6b9a328304e6fd2e39d9530822776607/numpy-2.5.2-cp315-cp315-win32.whl", hash = "sha256:6b588cc8f902d6bff201c19fd00c43ab8545671e3554d014e12e14139e5e8617", size = 6120696, upload-time = "2026-08-09T13:47:38.561Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/23/deafbb1700f79fae9cd1e91220f133d124cc267de1b584da3fbf6db2f6cd/numpy-2.5.2-cp315-cp315-win_amd64.whl", hash = "sha256:07d4e89f3a9ab0a9ba24264ccdb642b3dd951b2281e8883a5481a4aa79cc31a7", size = 12597324, upload-time = "2026-08-09T13:47:41.401Z" },
-    { url = "https://files.pythonhosted.org/packages/33/cd/3272ba105e3bbbdaeb11357eda31e7a6825ffe159e8171665660299a948f/numpy-2.5.2-cp315-cp315-win_arm64.whl", hash = "sha256:a610dc7e3c52edd39c2bc2375ff9c3fd59cb3ad00e4472d36f83bc1457145788", size = 10680466, upload-time = "2026-08-09T13:47:44.873Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/0e/58370637b1bb70a5c9ce2b43f4b521ccb224e36ccb76a6596b17ae4b447c/numpy-2.5.2-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:40f4d451aed46a8046a1aae41c4e55fb3612273df9c502480135e1501576a34b", size = 16993947, upload-time = "2026-08-09T13:47:48.97Z" },
-    { url = "https://files.pythonhosted.org/packages/10/93/2abcb807712b289d6d60fe4cf30532f98974a8396d885650f3ba5a13026e/numpy-2.5.2-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:c081cbe16ba1ab53078e5ff29013621e33c509eedab055775d956427712c236e", size = 12025331, upload-time = "2026-08-09T13:47:52.646Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/3a/2898e003a5fbaf87e76c039b4ee1f5eb390471b4ffe74887c1f34c4e791e/numpy-2.5.2-cp315-cp315t-macosx_14_0_arm64.whl", hash = "sha256:0090ccdd57ec2703e9b49d0bf554767370581c1dd0a6b2bb2b2d9def317d042a", size = 5472336, upload-time = "2026-08-09T13:47:55.403Z" },
-    { url = "https://files.pythonhosted.org/packages/61/a5/23f69d07c544597b29758b31b55c27dc9d541012a2c1496189fef702aec2/numpy-2.5.2-cp315-cp315t-macosx_14_0_x86_64.whl", hash = "sha256:6a9bb119fb8dd21ba30b3f0e555b7e2b081bd9883af21ec9c1c633d161cda3a8", size = 6788387, upload-time = "2026-08-09T13:47:58.192Z" },
-    { url = "https://files.pythonhosted.org/packages/15/ea/c0dbdbcf22f43782510a3e492dd3da73c6112b69cac8929d16d127536fc4/numpy-2.5.2-cp315-cp315t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a839318485284a6fb31be4f8f2c91c8f2cb22f4543c4a8903f12b0671ffe07cc", size = 15667096, upload-time = "2026-08-09T13:48:01.562Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/5e/29c73c31748cdb0f7566642125ba17fd5b56780cddf891b085dab27e4466/numpy-2.5.2-cp315-cp315t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ba0a474801b8dc67b66bf465548abc90e82b44d2611b5770f33008dcabffe8ec", size = 16751730, upload-time = "2026-08-09T13:48:05.706Z" },
-    { url = "https://files.pythonhosted.org/packages/47/95/02501e8454796bb58dadf7a99d3181e0b464bf264e1003039572f9779fac/numpy-2.5.2-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:0a4035ae1129ff8777f08bfbd44f1e5d8e9c049ce0c2dd78fc0d92c13e7251c0", size = 17038686, upload-time = "2026-08-09T13:48:09.627Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/b5/53a681d91b5c82687067d8ea5035e02d917b5509d6f334cb06484a954714/numpy-2.5.2-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:77843ca236b777e67f8d6b3660ea116e499612703a0ecd7093f316201eb9d8e2", size = 18507727, upload-time = "2026-08-09T13:48:13.744Z" },
-    { url = "https://files.pythonhosted.org/packages/42/06/6e11443f7b64ee376c860506091103bf68f92d2cab9e8d96d4501babf07c/numpy-2.5.2-cp315-cp315t-win32.whl", hash = "sha256:7354826bc6f8f69402e9b7fe28d15fcd34feebd74f856f111585c5b0c9fb0251", size = 6269775, upload-time = "2026-08-09T13:48:17.543Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/18/195d6b86cd72dbbc501edfa778005fa6b87afd34c153e46028cd3a0938f4/numpy-2.5.2-cp315-cp315t-win_amd64.whl", hash = "sha256:e5651f3f87add730ee6608d915009e19c911fba0cb000c7e3ea994b7d768eb12", size = 12782559, upload-time = "2026-08-09T13:48:21.023Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/07/458c344f0f0c178f4481dad5cca790626ffe4c34eabf9467069d06ee4999/numpy-2.5.2-cp315-cp315t-win_arm64.whl", hash = "sha256:5f8e00be2ec6f45f4e8a41a527f68d44a7d96fee92a650e4d8b1326f77f61e6e", size = 10748103, upload-time = "2026-08-09T13:48:24.21Z" },
-]
-
 [[package]]
 name = "packaging"
 version = "26.3"
@@ -2981,134 +2220,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/45/e2/bbb7129c9e7999a6b8ee9cca3b66486c25c423ab5a75f34071798b74ce94/pre_commit-4.6.2-py2.py3-none-any.whl", hash = "sha256:e2dde9a75d3bce11bd3831c26d134df00a2803c1d818be6a0383c3dcda25dc4e", size = 226202, upload-time = "2026-08-10T22:07:16.942Z" },
 ]
 
-[[package]]
-name = "propcache"
-version = "0.5.2"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/ec/44/c87281c333769159c50594f22610f77398a47ccbfbbf23074e744e86f87c/propcache-0.5.2.tar.gz", hash = "sha256:01c4fc7480cd0598bb4b57022df55b9ca296da7fc5a8760bd8451a7e63a7d427", size = 50208, upload-time = "2026-05-08T21:02:12.199Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/5b/56/030b7b4719d53085722893e0009dffb9236aa10bca1b12121bdc5626ef16/propcache-0.5.2-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:d5a81be28596d6559f6131ef33e10200de6e17643b3c74ce03f9eb103be6ae8b", size = 93417, upload-time = "2026-05-08T20:59:15.597Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/55/1140a8e067b8ec093a18a4ae7bb0045d9db65da38a08618ddc5e2f1994aa/propcache-0.5.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:29cbaac5ea0212663e6845e04b5e188d5a6ae6dd919810ac835bf1d3b42c3f4c", size = 53847, upload-time = "2026-05-08T20:59:17.096Z" },
-    { url = "https://files.pythonhosted.org/packages/20/42/0e7443c90310498561addf346e7d57fe3c6ba1914e1ba938b5464c7bbfd2/propcache-0.5.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:6bf3be92233808fcd338eba0fb4d0b59ec5772af4f4ecfcec450d1bfc0f8b5eb", size = 53512, upload-time = "2026-05-08T20:59:18.64Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/db/cf51a71bab2009517d1a7f0ee07657e3bd446c4d69f67e6966cf17bcf956/propcache-0.5.2-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2f8ea531c794b9d6274acd4e8d2c2ebcac590a4361d27482edd3010b79f1325e", size = 58068, upload-time = "2026-05-08T20:59:20.683Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/43/39b6bdee9699fa1e1641c519feeb64a67e2a9f93bb465c70776b37a7333f/propcache-0.5.2-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:decfca4c79dd53ebab484b00cc4b6717d8c369f86e74aa4ca395a64ac651495e", size = 61020, upload-time = "2026-05-08T20:59:22.112Z" },
-    { url = "https://files.pythonhosted.org/packages/26/0b/843726fbb0a29a8c5684fdb25971823638399f31e52e9d1f06a02dc9aa6b/propcache-0.5.2-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:4621064bbf28fa77ff64dd5d94367c04684c67d3a5bf1dff25f0cd0d98a38f3b", size = 62732, upload-time = "2026-05-08T20:59:23.805Z" },
-    { url = "https://files.pythonhosted.org/packages/39/6e/899fed76dc1942b8a64193a4f059d7f1a2c7ef65085e8a9366ed8ec0d199/propcache-0.5.2-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b96db7141a592cbc968daf1feea83a118e6ab378af4abbc72b248c895414c22d", size = 60140, upload-time = "2026-05-08T20:59:25.389Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/09/3da4be9b5b879219ad234aa535b3dd4a080ed1ad48d3a73ca07a9e798f22/propcache-0.5.2-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:1ca071adabaab6e9219924bbe00af821f1ee7de113a9eca1cdc292de3d120f4d", size = 60400, upload-time = "2026-05-08T20:59:27.238Z" },
-    { url = "https://files.pythonhosted.org/packages/60/2f/09b72b874a9aa0044faf52a69807a6ed618e267ceaa9ec4a63195fa5b504/propcache-0.5.2-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:e4294d04a94dcab1b3bccd8b66d962dcad411a1d19414b2a41d1445f1de32ad0", size = 58155, upload-time = "2026-05-08T20:59:28.48Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/37/97489848c54c95578045473954f10956d619ce6a09e7ac137b71cdcb698b/propcache-0.5.2-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:a0e399a2eccb91ed18721f86aa85757727400b6865c89e88934781deb9c8498b", size = 57037, upload-time = "2026-05-08T20:59:30.146Z" },
-    { url = "https://files.pythonhosted.org/packages/22/db/6c695285ccfc49012743ee9c98212b8c5dd0aed7b63cfd816d4a0f7a1601/propcache-0.5.2-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:823581fd5cb08b12a48bfa11fe962a7916766b6170c17b028fbdf762b85eb9bf", size = 61103, upload-time = "2026-05-08T20:59:31.626Z" },
-    { url = "https://files.pythonhosted.org/packages/98/a9/1e500401ca593b0bdb6bf75a70bc2d723835fd53360edff6af70692c7546/propcache-0.5.2-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:949c91d1a990cf3b2e8188dfcfb25005e0b834a06c63fa4ef9f360878ce21ecf", size = 60394, upload-time = "2026-05-08T20:59:32.829Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/87/f638b6e375eae0f30a1a2325d8b34fd85fdc785bb9960cf805f3bf1ec69a/propcache-0.5.2-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:cc1177027eda740fdb152706bd215a3f124e3eea15afc39f2cb9fe351b50619e", size = 63084, upload-time = "2026-05-08T20:59:35.964Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/18/884573f5d97b6d9eba68de759a82c901b7e39d7904d30f7b8d58d42d2a12/propcache-0.5.2-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:b05d643f944a8c3c4bd86d65ffd87bf3264b617f87791940302bc474d2ff5274", size = 60999, upload-time = "2026-05-08T20:59:38.481Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/1a/c3915eb059ceec9e758a56e4cfd955292bc0f201be2176a46b76d94b303a/propcache-0.5.2-cp310-cp310-win32.whl", hash = "sha256:8114f28879e0904748e831c3a7774261bd9e75f49be089f389a76f959dcd13fe", size = 39036, upload-time = "2026-05-08T20:59:40.323Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/02/1dfd5607501a602d19c1c449d2d193b7d1c611f9246b4059026a1189a80e/propcache-0.5.2-cp310-cp310-win_amd64.whl", hash = "sha256:5fcb98e7598b1ee0addab320d90f65b530297a867dbfe9de52ea838077e16e3d", size = 42190, upload-time = "2026-05-08T20:59:42.232Z" },
-    { url = "https://files.pythonhosted.org/packages/57/93/f71588ad08b3e6f4b555b5ef215808a3c02b042d0151ad82fa6f15be677a/propcache-0.5.2-cp310-cp310-win_arm64.whl", hash = "sha256:04dc2390d9edbbaef7461f33322555976ffddf0b650a038649d026358714e6c5", size = 38545, upload-time = "2026-05-08T20:59:44.087Z" },
-    { url = "https://files.pythonhosted.org/packages/e7/f1/8a8cc1c2c7e7934ab77e0163414f736fadbc0f5e8dd9673b952355ac175b/propcache-0.5.2-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:74b70780220e2dd89175ca24b81b68b67c83db499ae611e7f2313cb329801c78", size = 90744, upload-time = "2026-05-08T20:59:45.799Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/f4/651b1225e976bd1a2ba5cfba0c29d096581c2636b437e3a9a7ab6276270a/propcache-0.5.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:a4840ab0ae0216d952f4b53dc6d0b992bfc2bedbfe360bdd9b548bc184c08959", size = 52033, upload-time = "2026-05-08T20:59:47.408Z" },
-    { url = "https://files.pythonhosted.org/packages/15/a8/8ede85d6aa1f79fc7dc2f8fd2c8d65920b8272c3892903c8a1affde48cfb/propcache-0.5.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:c6844ba6364fb12f403928a82cfd295ab103a2b315c77c747b2dbe4a41894ea7", size = 52754, upload-time = "2026-05-08T20:59:49.202Z" },
-    { url = "https://files.pythonhosted.org/packages/7d/fe/b3551b41bbc2f5b5bb088fc6920567cd43101253e68fbaa261339eb96fe1/propcache-0.5.2-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2293949b855ce597f2826452d17c2d545fb5622379c4ea6fdf525e9b8e8a2511", size = 57573, upload-time = "2026-05-08T20:59:50.778Z" },
-    { url = "https://files.pythonhosted.org/packages/83/27/ab851ebd1b7172e3e161f5f8d39e315d54a91bea246f01f4d872d3376aef/propcache-0.5.2-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:0fd59b5af35f74da48d905dcbad55449ba13be91823cb05a9bd590bbf5b61660", size = 60645, upload-time = "2026-05-08T20:59:52.227Z" },
-    { url = "https://files.pythonhosted.org/packages/95/7d/466b3d18022e9897cbda9c735c493c5bd747d7a4c6f5ea1480b4cec434b6/propcache-0.5.2-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:29f9309a2e42b0d273be006fdb4be2d6c39a47f6f57d8fb1cf9f81481df81b66", size = 61563, upload-time = "2026-05-08T20:59:53.866Z" },
-    { url = "https://files.pythonhosted.org/packages/27/1b/16ab7f2cf2041da2f60d156ba64c2484eadf9168075b4ff43c3ef60045af/propcache-0.5.2-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5aaa2b923c1944ac8febd6609cb373540a5563e7cbcb0fd770f75dace2eb817b", size = 58888, upload-time = "2026-05-08T20:59:55.457Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/67/bb777ffd907633563bf35fd859c4ce97b0512c32f4633cf5d1eb7c33512b/propcache-0.5.2-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:66ea454f095ddf5b6b14f56c064c0941c4788be11e18d2464cf643bf7203ff67", size = 59253, upload-time = "2026-05-08T20:59:57.075Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/42/64f8d90b73fd9cdc1499b48057ff6d9cd2a98a25734c9bb62ecf07e87061/propcache-0.5.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:95f1e3f4760d404b13c9976c0229b2b49a3c8e2c62a9ce92efdd2b11ada75e3f", size = 57558, upload-time = "2026-05-08T20:59:58.602Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/02/dba5bc03c9041f2092ea55a449caf5dfe68352c6654511b29ba0654ddb69/propcache-0.5.2-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:85341b12b9d55bad0bded24cac341bb34289469e03a11f3f583ea1cc1db0326c", size = 55007, upload-time = "2026-05-08T20:59:59.837Z" },
-    { url = "https://files.pythonhosted.org/packages/14/c0/43f649c7aa2a77a3b100d84e9dea3a483120ecb608bfe36ce49eaff517fe/propcache-0.5.2-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:26a4dca084132874e639895c3135dfad5eb20bae209f62d1aeb31b03e601c3c0", size = 60355, upload-time = "2026-05-08T21:00:01.144Z" },
-    { url = "https://files.pythonhosted.org/packages/83/c0/435dafd27f1cb4a495381dae60e25883ccfe4020bb72818e8184c1678092/propcache-0.5.2-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:3b199b9b2b3d6a7edf3183ba8a9a137a22b97f7df525feb5ae1eccf026d2a9c6", size = 59057, upload-time = "2026-05-08T21:00:02.401Z" },
-    { url = "https://files.pythonhosted.org/packages/53/ae/6e292df9135d659944e96cb3389258e4a663e5b2b5f6c217ef0ddc8d2f73/propcache-0.5.2-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:e59bc9e66329185b93dab73f210f1a37f81cb40f321501db8017c9aea15dba27", size = 61938, upload-time = "2026-05-08T21:00:03.638Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/42/314ebc50d8159055411fd6b0bda322ff510e4b1f7d2e4927940ad0f6af20/propcache-0.5.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:552ffadf6ad409844bc5919c42a0a83d88314cedddaea0e41e80a8b8fffe881f", size = 59731, upload-time = "2026-05-08T21:00:04.881Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/9b/2da6dee38871c3c8772fabc2758325a5c9077d6d18c597737dc04dd884cd/propcache-0.5.2-cp311-cp311-win32.whl", hash = "sha256:cd416c1de191973c52ff1a12a57446bfc7642797b282d7caf2162d7d1b8aa9a0", size = 38966, upload-time = "2026-05-08T21:00:06.511Z" },
-    { url = "https://files.pythonhosted.org/packages/42/4e/f17363fb58c0afe05b067361cb6d86ed2d29de6506779a27547c4d183075/propcache-0.5.2-cp311-cp311-win_amd64.whl", hash = "sha256:44e488ef40dbb452700b2b1f8188934121f6648f52c295055662d2191959ff82", size = 42135, upload-time = "2026-05-08T21:00:08.088Z" },
-    { url = "https://files.pythonhosted.org/packages/c6/eb/6af6685077d22e8b33358d3c548e3282706a0b3cd85044ffba4e5dd08e3b/propcache-0.5.2-cp311-cp311-win_arm64.whl", hash = "sha256:54adaa85a22078d1e306304a40984dc5be99d599bf3dc0a24dc98f7daeab89ab", size = 38381, upload-time = "2026-05-08T21:00:09.692Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/cb/e27bc2b2737a0bb49962b275efa051e8f1c35a936df7d5139b6b658b7dc9/propcache-0.5.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:806719138ecd720339a12410fb9614ac9b2b2d3a5fdf8235d56981c36f4039ba", size = 95887, upload-time = "2026-05-08T21:00:11.277Z" },
-    { url = "https://files.pythonhosted.org/packages/e6/13/b8ae04c59392f8d11c6cd9fb4011d1dc7c86b81225c770280300e259ffe1/propcache-0.5.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:db2b80ea58eab4f86b2beec3cc8b39e8ff9276ac20e96b7cce43c8ae84cd6b5a", size = 54654, upload-time = "2026-05-08T21:00:12.604Z" },
-    { url = "https://files.pythonhosted.org/packages/2c/7d/49777a3e20b55863d4794384a38acd460c04157b0a00f8602b0d508b8431/propcache-0.5.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:e5cbfac9f61484f7e9f3597775500cd3ebe8274e9b050c38f9525c77c97520bf", size = 55190, upload-time = "2026-05-08T21:00:13.935Z" },
-    { url = "https://files.pythonhosted.org/packages/44/c7/085d0cd63062e84044e3f05797749c3f8e3938ff3aeb0eb2f69d43fafc91/propcache-0.5.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5dbc581d2814337da56222fab8dc5f161cd798a434e49bac27930aaef798e144", size = 59995, upload-time = "2026-05-08T21:00:15.526Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/42/32cf8e3009e92b2645cf1e944f701e8ea4e924dffde1ee26db860bcbf7e4/propcache-0.5.2-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:857187f381f88c8e2fa2fe56ab94879d011b883d5a2ee5a1b60a8cd2a06846d9", size = 63422, upload-time = "2026-05-08T21:00:16.824Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/1b/f112433f99fc979431b87a39ef169e3f8df070d99a72792c56d6937ac48b/propcache-0.5.2-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:178b4a2cdaac1818e2bf1c5a99b94383fa73ea5382e032a48dec07dc5668dc42", size = 64342, upload-time = "2026-05-08T21:00:18.362Z" },
-    { url = "https://files.pythonhosted.org/packages/14/15/5574111ae50dd6e879456888c0eadd4c5a869959775854e18e18a6b345f3/propcache-0.5.2-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6f328175a2cde1f0ff2c4ed8ce968b9dcfb55f3a7153f39e2957ed994da13476", size = 61639, upload-time = "2026-05-08T21:00:19.692Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/da/4d775080b1490c0ae604acda868bd71aabe3a89ed16f2aa4339eb8a283e7/propcache-0.5.2-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:5671d09a36b06d0fd4a3da0fccbcae360e9b1570924171a15e9e0997f0249fba", size = 61588, upload-time = "2026-05-08T21:00:21.155Z" },
-    { url = "https://files.pythonhosted.org/packages/04/ac/f076982cbe2195ee9cf32de5a1e46951d9fb399fc207f390562dd0fd8fb2/propcache-0.5.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:80168e2ebe4d3ec6599d10ad8f520304ae1cad9b6c5a95372aef1b66b7bfb53a", size = 60029, upload-time = "2026-05-08T21:00:22.713Z" },
-    { url = "https://files.pythonhosted.org/packages/70/60/189be62e0dd898dce3b331e1b8c7a543cd3a405ac0c81fe8ee8a9d5d77e1/propcache-0.5.2-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:45f11346f884bc47444f6e6647131055844134c3175b629f84952e2b5cd62b64", size = 56774, upload-time = "2026-05-08T21:00:24.001Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/9e/93377b9c7939c1ffae98f878dee955efadfd638078bc86dbc21f9d52f651/propcache-0.5.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:8e778ebd44ef4f66ed60a0416b06b489687db264a9c0b3620362f26489492913", size = 63532, upload-time = "2026-05-08T21:00:25.545Z" },
-    { url = "https://files.pythonhosted.org/packages/14/f9/590ef6cfb9b8028d516d287812ece32bb0bc5f11fbb9c8bf6b2e6313fec8/propcache-0.5.2-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:c0cb9ed24c8964e172768d455a38254c2dd8a552905729ce006cad3d3dda59b1", size = 61592, upload-time = "2026-05-08T21:00:27.186Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/5e/70958b3034c297a630bba2f17ca7abc2d5f39a803ad7e370ab79d1ecd022/propcache-0.5.2-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:1d1ad32d9d4355e2be65574fd0bfd3677e7066b009cd5b9b2dee8aa6a6393b33", size = 64788, upload-time = "2026-05-08T21:00:28.8Z" },
-    { url = "https://files.pythonhosted.org/packages/12/fd/77fe5936d8c3086ca9048f7f415f122ed82e53884a9ec193646b42deef06/propcache-0.5.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:c80f4ba3e8f00189165999a742ee526ebeccedf6c3f7beb0c7df821e9772435a", size = 62514, upload-time = "2026-05-08T21:00:30.098Z" },
-    { url = "https://files.pythonhosted.org/packages/cf/74/66bd798b5b3be70aa1b391f5cc9d6a0a5532d7fd3b19ec0b213e72e6ad9d/propcache-0.5.2-cp312-cp312-win32.whl", hash = "sha256:8c7972d8f193740d9175f0998ab38717e6cd322d5935c5b0fef8c0d323fd9031", size = 39018, upload-time = "2026-05-08T21:00:31.622Z" },
-    { url = "https://files.pythonhosted.org/packages/61/7c/5c0d34aa3024694d6dcb9271cdbdd08c4e47c1c0ad95ec7e7bc74cdea145/propcache-0.5.2-cp312-cp312-win_amd64.whl", hash = "sha256:d9ee8826a7d47863a08ac44e1a5f611a462eefc3a194b492da242128bec75b42", size = 42322, upload-time = "2026-05-08T21:00:32.918Z" },
-    { url = "https://files.pythonhosted.org/packages/4d/91/875812f1a3feb20ceba818ef39fbe4d92f1081e04ac815c822496d0d038b/propcache-0.5.2-cp312-cp312-win_arm64.whl", hash = "sha256:2800a4a8ead6b28cccd1ec54b59346f0def7922ee1c7598e8499c733cfbb7c84", size = 38172, upload-time = "2026-05-08T21:00:35.124Z" },
-    { url = "https://files.pythonhosted.org/packages/c5/09/f049e45385503fe67db75a6b6186a7b9f0c3930366dc960522c312a825b1/propcache-0.5.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:099aaf4b4d1a02265b92a977edf00b5c4f63b3b17ac6de39b0d637c9cac0188a", size = 94457, upload-time = "2026-05-08T21:00:36.355Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/65/83d1d05655baf63113731bd5a1008435e14f8d1e5a06cbe4ec5b23ad7a31/propcache-0.5.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:68ce1c44c7a813a7f71ea04315a8c7b330b63db99d059a797a4651bb6f69f117", size = 53835, upload-time = "2026-05-08T21:00:38.072Z" },
-    { url = "https://files.pythonhosted.org/packages/a9/12/a6ba6482bb5ea3260c000c9b20881c95fa11c6b30173715668259f844ed7/propcache-0.5.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:fc299c129490f55f254cd90be0deca4764e36e9a7c08b4aa588479a3bbed3098", size = 54545, upload-time = "2026-05-08T21:00:39.319Z" },
-    { url = "https://files.pythonhosted.org/packages/a9/19/7fa086f5764c59ec8a8e157cd93aa8497acc00aba9dcdec56bfffb32602d/propcache-0.5.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a6ae2198be502c10f09b2516e7b5d019816924bc3183a43ce792a7bd6625e6f4", size = 59886, upload-time = "2026-05-08T21:00:40.621Z" },
-    { url = "https://files.pythonhosted.org/packages/a1/e4/5d7663dc8235956c8f5281698a3af1d351d8820341ddd890f59d9a9127f2/propcache-0.5.2-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:6041d31504dc1779d700e1edcfb08eea334b357620b06681a4eabb57a74e574e", size = 63261, upload-time = "2026-05-08T21:00:41.775Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/4a/15a03adee24d6350da4292caeac44c34c033d2afe5e87eb370f38854560f/propcache-0.5.2-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f7eabc04151c78a9f4d5bbb5f1faf571e4defeb4b585e0fe95b60ff2dbe4d3d7", size = 64184, upload-time = "2026-05-08T21:00:43.018Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/c6/979176efdaa3d239e36d503d5af63a0a773b36662ed8f52e5b6a6d9fd40e/propcache-0.5.2-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4db0ba63d693afd40d249bd93f842b5f144f8fcbb83de05660373bcf30517b1d", size = 61534, upload-time = "2026-05-08T21:00:44.507Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/22/63e8cd1bae4c2d2be6493b6b7d10566ddafad88137cfbc99964a1119853c/propcache-0.5.2-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:1dbcf7675229b35d31abb6547d8ebc8c27a830ac3f9a794edff6254873ec7c0a", size = 61500, upload-time = "2026-05-08T21:00:45.796Z" },
-    { url = "https://files.pythonhosted.org/packages/60/5a/28e5d9acbac1cc9ccb67045e8c1b943aa8d79fdf39c93bd73cacd68008ea/propcache-0.5.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d310c013aad2c72f1c3f2f8dd3279d460a858c551f97aeb8c63e4693cca7b4d2", size = 59994, upload-time = "2026-05-08T21:00:47.093Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/40/db650677f554a95b9c01a7c9d93d629e93a15562f5deb4573c9ee136fed2/propcache-0.5.2-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:06187263ddad280d05b4d8a8b3bb7d164cbebd469236544a42e6d9b28ac6a4fa", size = 56884, upload-time = "2026-05-08T21:00:48.376Z" },
-    { url = "https://files.pythonhosted.org/packages/80/45/70b39b89516ff8b96bf732fa6fded8cef20f293cb1508690101c3c07ec51/propcache-0.5.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:3115559b8effafd63b142ea5ed53d63a16ea6469cbc63dce4ee194b42db5d853", size = 63464, upload-time = "2026-05-08T21:00:49.954Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/e2/fa59d3a89eac5534293124af4f1d0d0ada091ce4a0ab4610ce03fd2bdd8d/propcache-0.5.2-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:c60462af8e6dc30c35407c7237ea908d777b22862bbee27bc4699c0d8bcdc45a", size = 61588, upload-time = "2026-05-08T21:00:51.281Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/97/efb547a55c4bc7381cfb202d6a2239ac621045277bc1ea5dfd3a7f0516c0/propcache-0.5.2-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:40314bca9ac559716fe374094fc81c11dcc34b64fd6c585360f5775690505704", size = 64667, upload-time = "2026-05-08T21:00:52.602Z" },
-    { url = "https://files.pythonhosted.org/packages/92/56/f5c7d9b4b7595d5127da38974d791b2153f3d1eae6c674af3583ace92ad3/propcache-0.5.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:cfa21e036ce1e1db2be04ba3b85d2df1bb1702fa01932d984c5464c665228ff4", size = 62463, upload-time = "2026-05-08T21:00:54.303Z" },
-    { url = "https://files.pythonhosted.org/packages/bd/3b/484a3a65fc9f9f60c41dcd17b428bace5389544e2c680994534a20755066/propcache-0.5.2-cp313-cp313-win32.whl", hash = "sha256:f156a3529f38063b6dbaf356e15602a7f95f8055b1295a438433a6386f10463d", size = 38621, upload-time = "2026-05-08T21:00:55.808Z" },
-    { url = "https://files.pythonhosted.org/packages/1c/fd/3f0f10dba4dabad3bf53102be007abf55481067952bde0fdddff439e7c61/propcache-0.5.2-cp313-cp313-win_amd64.whl", hash = "sha256:dfed59d0a5aeb01e242e66ff0300bc4a265a7c05f612d30016f0b60b1017d757", size = 41649, upload-time = "2026-05-08T21:00:57.061Z" },
-    { url = "https://files.pythonhosted.org/packages/90/ec/6ce619cc32bb500a482f811f9cd509368b4e58e638d13f2c68f370d6b475/propcache-0.5.2-cp313-cp313-win_arm64.whl", hash = "sha256:ba338430e87ceb9c8f0cf754de38a9860560261e56c00376debd628698a7364f", size = 37636, upload-time = "2026-05-08T21:00:58.646Z" },
-    { url = "https://files.pythonhosted.org/packages/1b/82/c1d268bbbf2ef981c5bf0fbbe746db617c66e3bcefe431a1aa8943fbe23a/propcache-0.5.2-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:a592f5f3da71c8691c788c13cb6734b6d17663d2e1cb8caddf0673d01ef8847d", size = 98872, upload-time = "2026-05-08T21:00:59.889Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/d4/52c871e73e864e6b34c0e2d58ac1ec5ccd149497ddc7ad2137ae98323a35/propcache-0.5.2-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:6a997d0489e9668a384fcfd5061b857aa5361de73191cac204d04b889cfbbafa", size = 56257, upload-time = "2026-05-08T21:01:01.195Z" },
-    { url = "https://files.pythonhosted.org/packages/67/f0/9b90ca2a210b3d09bcfcd96ecd0f55545c091535abce2a45de2775cfd357/propcache-0.5.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:10734b5484ea113152ee25a91dccedf81631791805d2c9ccb054958e51842c94", size = 56696, upload-time = "2026-05-08T21:01:02.941Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/0e/6e9d4ba07c8e56e21ddec1e75f12148142b21ca83a51871babce095334f4/propcache-0.5.2-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:cafca7e56c12bb02ae16d283742bef25a61122e9dab2b5b3f2ccbe589ce32164", size = 62378, upload-time = "2026-05-08T21:01:04.475Z" },
-    { url = "https://files.pythonhosted.org/packages/65/19/c10badaa463dde8a27ce884f8ee2ec37e6035b7c9f5ff0c8f74f06f08dac/propcache-0.5.2-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f064f8d2b59177878b7615df1735cd8fe3462ed6be8c7b217d17a276489c2b7f", size = 65283, upload-time = "2026-05-08T21:01:05.959Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/b6/93bea99ca80e19cef6512a8580e5b7857bbe09422d9daa7fd4ef5723306c/propcache-0.5.2-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f78abfa8dfc32376fd1aacf597b2f2fbbe0ea751419aee718af5d4f82537ef8c", size = 66616, upload-time = "2026-05-08T21:01:07.228Z" },
-    { url = "https://files.pythonhosted.org/packages/83/e4/5c7462e50625f051f37fb38b8224f7639f667184bbd34424ec83819bb1b7/propcache-0.5.2-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f7467da8a9822bf1a55336f877340c5bcbd3c482afc43a99771169f74a26dedc", size = 63773, upload-time = "2026-05-08T21:01:08.514Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/b6/99238894047b13c823be25027e736626cd414a52a5e30d2c3347c2733529/propcache-0.5.2-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a6ddc6ac9e25de626c1f129c1b467d7ecd33ce2237d3fd0c4e429feef0a7ee1f", size = 63664, upload-time = "2026-05-08T21:01:09.874Z" },
-    { url = "https://files.pythonhosted.org/packages/85/1e/a3a1a63116a2b8edb415a8bb9a6f0c34bd03830b1e18e8ce2904e1dc1cf4/propcache-0.5.2-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:2f22cbbac9e26a8e864c0985ff1268d5d939d53d9d9411a9824279097e03a2cb", size = 62643, upload-time = "2026-05-08T21:01:11.132Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/03/893cf147de2fc6543c5eaa07ad833170e7e2a2385725bbebe8c0503723bb/propcache-0.5.2-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:fc76378c62a0f04d0cd82fbb1a2cd2d7e28fcb40d5873f28a6c44e388aaa2751", size = 59595, upload-time = "2026-05-08T21:01:12.387Z" },
-    { url = "https://files.pythonhosted.org/packages/86/3b/04c1a2e12c57766568ba75ba72b3bf2042818d4c1425fab6fc07155c7cff/propcache-0.5.2-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:acd2c8edba48e31e58a363b8cf4e5c7db3b04b3f9e371f601df30d9b0d244836", size = 65711, upload-time = "2026-05-08T21:01:13.676Z" },
-    { url = "https://files.pythonhosted.org/packages/1c/34/80f8d0099f8d6bacc4de1624c85672681c8cd1149ca2da0e38fd120b817f/propcache-0.5.2-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:452b5065457eb9991ec5eb38ff41d6cd4c991c9ac7c531c4d5849ae473a9a13f", size = 64247, upload-time = "2026-05-08T21:01:14.936Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/1a/8b08f3a5f1037e9e370c55883ceeeee0f6dd0416fb2d2d67b8bfc91f2a79/propcache-0.5.2-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:3430bb2bfe1331885c427745a751e774ee679fd4344f80b97bf879815fe8fa55", size = 67102, upload-time = "2026-05-08T21:01:16.281Z" },
-    { url = "https://files.pythonhosted.org/packages/34/68/8bdb7bb7756d76e005490649d10e4a8369e610c74d619f71e1aedf889e9c/propcache-0.5.2-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:cef6cea3922890dd6c9654971001fa797b526c16ab5e1e46c05fd6f877be7568", size = 64964, upload-time = "2026-05-08T21:01:17.57Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/aa/50fb0b5d3968b61a510926ff8b8465f1d6e976b3ab74496d7a4b9fc42515/propcache-0.5.2-cp313-cp313t-win32.whl", hash = "sha256:72d61e16dd78228b58c5d47be830ff3da7e5f139abdf0aef9d86cde1c5cf2191", size = 42546, upload-time = "2026-05-08T21:01:18.946Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/4c/0ddbae64321bd4a95bcbfc19307238016b5b1fee645c84626c8d539e5b74/propcache-0.5.2-cp313-cp313t-win_amd64.whl", hash = "sha256:0958834041a0166d343b8d2cedcd8bcbaeb4fdbe0cf08320c5379f143c3be6e7", size = 46330, upload-time = "2026-05-08T21:01:20.162Z" },
-    { url = "https://files.pythonhosted.org/packages/00/d9/9cddc8efb78d8af264c5ec9f6d10b62f57c515feda8d321595f56010fb23/propcache-0.5.2-cp313-cp313t-win_arm64.whl", hash = "sha256:6de8bd93ddde9b992cf2b2e0d796d501a19026b5b9fd87356d7d0779531a8d96", size = 40521, upload-time = "2026-05-08T21:01:21.399Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/ea/23ee535d90ce8bcc465a3028eb3cc0ce3bd1005f4bb27710b30587de798d/propcache-0.5.2-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:46088abff4cba581dea21ae0467a480526cb25aa5f3c269e909f800328bc3999", size = 94662, upload-time = "2026-05-08T21:01:22.683Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/06/c5a52f419b5d8972f8d46a7577476090d8e3263ff589ce40b5ca4968d5be/propcache-0.5.2-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:fc88b26f08d634f7bc819a7852e5214f5802641ab8d9fd5326892292eee1993e", size = 53928, upload-time = "2026-05-08T21:01:23.986Z" },
-    { url = "https://files.pythonhosted.org/packages/63/b1/4260d67d6bd85e58a66b72d54ce15d5de789b6f3870cc6bedf8ff9667401/propcache-0.5.2-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:97797ebb098e670a2f92dd66f32897e30d7615b14e7f59711de23e30a9072539", size = 54650, upload-time = "2026-05-08T21:01:25.305Z" },
-    { url = "https://files.pythonhosted.org/packages/70/06/2f46c318e3307cd7a6a7481def374ce838c0fe20084b39dd54b0879d0e99/propcache-0.5.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ba57fffe4ac99c5d30076161b5866336d97600769bad35cc68f7774b15298a4e", size = 59912, upload-time = "2026-05-08T21:01:26.545Z" },
-    { url = "https://files.pythonhosted.org/packages/4c/29/fe1aebec2ce57ab985a9c382bded1124431f85078113aa222c5d278430d4/propcache-0.5.2-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:583c19759d9eec1e5b69e2fbef36a7d9c326041be9746cb822d335c8cedc2979", size = 63300, upload-time = "2026-05-08T21:01:27.937Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/18/2334b26768b6c82be8c69e83671b767d5ef426aa09b0cba6c2ea47816774/propcache-0.5.2-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d0326e2e5e1f3163fa306c834e48e8d490e5fae607a097a40c0648109b47ba80", size = 64208, upload-time = "2026-05-08T21:01:29.484Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/76/7f1bfd6afff4c5e38e36a3c6d68eb5f4b7311ea80baf693db78d95b603c4/propcache-0.5.2-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e00820e192c8dbebcafb383ebbf99030895f09905e7a0eb2e0340a0bcc2bc825", size = 61633, upload-time = "2026-05-08T21:01:31.068Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/46/b3ff8aba2b4953a3e50de2cf72f1b5748b8eca93b15f3dc2c84339084c09/propcache-0.5.2-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c66afea89b1e43725731d2004732a046fe6fe955d51f952c3e95a7314a284a39", size = 61724, upload-time = "2026-05-08T21:01:32.374Z" },
-    { url = "https://files.pythonhosted.org/packages/c5/01/814cfcafbcff954f94c01cf30e097ddc88a076b5440fbcf4570753437d40/propcache-0.5.2-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:d4dc37dec6c6cdad0b57881a5658fd14fbf53e333b1a86cf86559f190e1d9ec4", size = 60069, upload-time = "2026-05-08T21:01:33.67Z" },
-    { url = "https://files.pythonhosted.org/packages/da/68/5c6f7622d510cc666a300687e06fd060c1a43361c0c9b20d284f06d8096a/propcache-0.5.2-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:5570dbcc97571c15f68068e529c92715a12f8d54030e272d264b377e22bd17a5", size = 57099, upload-time = "2026-05-08T21:01:34.915Z" },
-    { url = "https://files.pythonhosted.org/packages/55/27/9cb0b4c679124085327957d42521c99dba04c88c90c3e55a6f0b633ebccc/propcache-0.5.2-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:f814362777a9f841adddb200ecdf8f5cb1e5a3c4b7a86378edbd6ccb26edd702", size = 63391, upload-time = "2026-05-08T21:01:36.231Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/9d/7258aaa5bdf60fc6f27591eef6fe52768cb0beda7140be477c8b12c9794a/propcache-0.5.2-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:196913dea116aeb5a2ba95af4ddcb7ea85559ae07d8eee8751688310d09168c3", size = 61626, upload-time = "2026-05-08T21:01:37.545Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/0d/41c602003e8a9b16fe1e7eadf62c7bfba9d5474370b24200bf48b315f45f/propcache-0.5.2-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:6e7b8719005dd1175be4ab1cd25e9b98659a5e0347331506ec6760d2773a7fb5", size = 64781, upload-time = "2026-05-08T21:01:38.83Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/f3/38e66b1856e9bd079deea015bc4a55f7767c0e4db2f7dcf69e7e680ba4ce/propcache-0.5.2-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:51f96d685ab16e88cab128cd37a52c5da540809c8b879fa047731bfcb4ad35a4", size = 62570, upload-time = "2026-05-08T21:01:40.415Z" },
-    { url = "https://files.pythonhosted.org/packages/95/ca/bbfe9b910ce57dde8bb4876b4520fc02a4e89497c10de26be936758a3aaa/propcache-0.5.2-cp314-cp314-win32.whl", hash = "sha256:cc6fc3cc62e8501d3ed62894425040d2728ecddb1ed072737a5c70bd537aa9f0", size = 39436, upload-time = "2026-05-08T21:01:41.654Z" },
-    { url = "https://files.pythonhosted.org/packages/61/d2/45c9defbaa1ea297035d9d4cce9e8f80daafbf19319c6007f157c6256ea9/propcache-0.5.2-cp314-cp314-win_amd64.whl", hash = "sha256:81e3a30b0bb60caa22033dd0f8a3618d1d67356212514f62c57db75cb0ef410c", size = 42373, upload-time = "2026-05-08T21:01:43.041Z" },
-    { url = "https://files.pythonhosted.org/packages/44/68/9ea5103f41d5217d7d6ec24db90018e23aebec070c3f9a6e54d12b841fd8/propcache-0.5.2-cp314-cp314-win_arm64.whl", hash = "sha256:0d2c9bf8528f135dbb805ce027567e09164f7efa51a2be07458a2c0420f292d0", size = 38554, upload-time = "2026-05-08T21:01:44.336Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/81/fadf555f42d3b762eea8a53950b0489fdc0aa9da5f8ed9e10ce0a4e01b48/propcache-0.5.2-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:4bc8ff1feffc6a61c7002ffe84634c41b822e104990ae009f44a0834430070bb", size = 99395, upload-time = "2026-05-08T21:01:45.883Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/c9/c61e134a686949cf7971af3a390148b1156f7be81c73bc0cd12c873e2d48/propcache-0.5.2-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:79aa3ff0a9b566633b642fa9caf7e21ed1c13d6feca718187873f199e1514078", size = 56653, upload-time = "2026-05-08T21:01:47.307Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/73/daf935ea7048ddd7ec8eec5345b4a40b619d2d178b3c0a0900796bc3c794/propcache-0.5.2-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:1b31822f4474c4036bae62de9402710051d431a606d6a0f907fec79935a071aa", size = 56914, upload-time = "2026-05-08T21:01:48.573Z" },
-    { url = "https://files.pythonhosted.org/packages/79/9f/aba959b435ea18617edd7cf0a7ad0b9c574b8fc7e3d2cd55fb59cb255d33/propcache-0.5.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:13fef48778b5a2a756523fdb781326b028ca75e32858b04f2cdd19f394564917", size = 62567, upload-time = "2026-05-08T21:01:49.903Z" },
-    { url = "https://files.pythonhosted.org/packages/6c/a1/859942de9a791ff42f6141736f5b37749b8f53e65edfa49638c67dd67e6a/propcache-0.5.2-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8b73ab70f1a3351fbc71f663b3e645af6dd0329100c353081cf69c37433fc6fe", size = 65542, upload-time = "2026-05-08T21:01:51.204Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/61/315bc0fd6c0fc7f80a528b8afd209e5fc4a875ea79571b91b8f50f442907/propcache-0.5.2-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5538d2c13d93e4698af7e092b57bc7298fd35d1d58e656ae18f23ee0d0378e03", size = 66845, upload-time = "2026-05-08T21:01:52.539Z" },
-    { url = "https://files.pythonhosted.org/packages/47/f7/9f8122e3132e8e354ac41975ef8f1099be7d5a16bc7ae562734e993665c0/propcache-0.5.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:cd645f03898405cabe694fb8bc35241e3a9c332ec85627584fe3de201452b335", size = 63985, upload-time = "2026-05-08T21:01:53.847Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/54/c317819ec157cbf6f35df9df9657a6f82daf34d5faf15948b2f639c2192e/propcache-0.5.2-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a473b3440261e0c60706e732b2ed2f517857344fc21bf48fdfe211e2d98eb285", size = 63999, upload-time = "2026-05-08T21:01:55.179Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/56/387e3f7dfce0a9233df41fb888aa1c30222cb4bbbf09537c02dd9bd85fe2/propcache-0.5.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7afa37062e6650640e932e4cc9297d81f9f42d9944029cc386b8247dea4da837", size = 62779, upload-time = "2026-05-08T21:01:57.489Z" },
-    { url = "https://files.pythonhosted.org/packages/a1/9c/596784cb5824ed61ee960d3f8655a3f0993e107c6e98ab6c818b7fb92ccb/propcache-0.5.2-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:8a90efd5777e996e42d568db9ac740b944d691e565cbfd31b2f7832f9184b2b8", size = 59796, upload-time = "2026-05-08T21:01:58.736Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/3d/1a6cfa1726a48542c1e8784a0761421476a5b68e09b7f36bf95eb954aaba/propcache-0.5.2-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:f19bb891234d72535764d703bfed1153cc34f4214d5bd7150aee1eec9e8f4366", size = 66023, upload-time = "2026-05-08T21:02:00.228Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/0e/05fd6990369477076e4e280bcb970de760fddf0161a46e988bc95f7940ec/propcache-0.5.2-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:32775082acd2d807ee3db715c7770d38767b817870acfa08c29e057f3c4d5b56", size = 64448, upload-time = "2026-05-08T21:02:01.888Z" },
-    { url = "https://files.pythonhosted.org/packages/cd/86/5f8da315a4309c62c10c0b2516b17492d5d3bbe1bb862b96604db67e2a37/propcache-0.5.2-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:9282fb1a3bccd038da9f768b927b24a0c753e466c086b7c4f3c6982851eefb2d", size = 67329, upload-time = "2026-05-08T21:02:03.484Z" },
-    { url = "https://files.pythonhosted.org/packages/da/d3/3368efe79ab21f0cdf86ef49895811c9cc933131d4cde1f28a624e22e712/propcache-0.5.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:cc49723e2f60d6b32a0f0b08a3fd6d13203c07f1cd9566cfce0f12a917c967a2", size = 65172, upload-time = "2026-05-08T21:02:04.745Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/07/127e8b0bacfb325396196f9d976a22453049b89b9b2b08477cc3145faa44/propcache-0.5.2-cp314-cp314t-win32.whl", hash = "sha256:2d7aa89ebca5acc98cba9d1472d976e394782f587bad6661003602a619fd1821", size = 43813, upload-time = "2026-05-08T21:02:06.025Z" },
-    { url = "https://files.pythonhosted.org/packages/88/fb/46dad6c0ae49ed230ab1b16c890c2b6314e2403e6c412976f4a72d64a527/propcache-0.5.2-cp314-cp314t-win_amd64.whl", hash = "sha256:d447bb0b3054be5818458fbb171208b1d9ff11eba14e18ca18b90cbb45767370", size = 47764, upload-time = "2026-05-08T21:02:07.353Z" },
-    { url = "https://files.pythonhosted.org/packages/e7/c4/a47d0a63aa309d10d59ede6e9d4cff03a344a79d1f0f4cd0cd74997b53e0/propcache-0.5.2-cp314-cp314t-win_arm64.whl", hash = "sha256:fe67a3d11cd9b4efabfa45c3d00ffba2b26811442a73a581a94b67c2b5faccf6", size = 41140, upload-time = "2026-05-08T21:02:09.065Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/ed/1cdcab6ba3d6ab7feca11fc14f0eeea80755bb53ef4e892079f31b10a25f/propcache-0.5.2-py3-none-any.whl", hash = "sha256:be1ddfcbb376e3de5d2e2db1d58d6d67463e6b4f9f040c000de8e300295465fe", size = 14036, upload-time = "2026-05-08T21:02:10.673Z" },
-]
-
 [[package]]
 name = "pycparser"
 version = "3.0"
@@ -4340,156 +3451,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/09/ce/3929538b2b9918f5eee623fbf3346893973191f6df93f19bbda097bd7bb7/websockets-17.0.1-py3-none-any.whl", hash = "sha256:c6be9cba65c65cc76dfa3d4619e359ff02a4476c74e179b215236c11a0b32345", size = 206718, upload-time = "2026-07-31T11:31:26.037Z" },
 ]
 
-[[package]]
-name = "yarl"
-version = "1.25.1"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "idna" },
-    { name = "multidict" },
-    { name = "propcache" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/75/16/e8be8e2fb175bbf41a0680381a319f1199fae256588241a2ac8677eafb49/yarl-1.25.1.tar.gz", hash = "sha256:03dd38de09bc213e9a8b29761eec33ee1d5318dac0e49d8af36e4d27830e23a7", size = 246245, upload-time = "2026-09-15T19:35:02.264Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/85/92/55fa9ee84cb8ec9930a910b5753936a926f918d8cc8965bdac571479c095/yarl-1.25.1-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:142c06c4d6a35ee3ec5da08499805e879cb3ca7c1fbfbecb0140fe72403818d6", size = 144695, upload-time = "2026-09-15T19:29:53.114Z" },
-    { url = "https://files.pythonhosted.org/packages/16/b4/9edc8e605b16b2eb5bd0c2ccc73e2b15aab583862460767fb43f91f11839/yarl-1.25.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:24ce942011a61953e7d313438038f4d32ff21387b775f58a957f7a07dd55ef95", size = 104332, upload-time = "2026-09-15T19:29:55.443Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/de/4204e6646e278b1cd4a9cf73ebe8b7cfcf16693f1249b324eb273d67602a/yarl-1.25.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:9e23c82b63cd7652fc24d33ed6cc17099d607aa3b4fc4ddc75e95062f3d82df4", size = 104449, upload-time = "2026-09-15T19:29:57.239Z" },
-    { url = "https://files.pythonhosted.org/packages/1d/fc/21d74789198ad68a23a209ab0d73fe5a52d39ebbd9945041e72827acdd77/yarl-1.25.1-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8ee202350cf57abf0e9502a41601841019c25d3db7ff52d980aaf31446254059", size = 116828, upload-time = "2026-09-15T19:29:59.031Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/31/90891ddb61848c067ebd1fb505ab5902a6e7d4707c2f3823f67ff37883d3/yarl-1.25.1-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:5df89f769cc8ff94c3d7e7603386fba309d25ce5240132d26c15baa8d0e96c4c", size = 107150, upload-time = "2026-09-15T19:30:00.868Z" },
-    { url = "https://files.pythonhosted.org/packages/a1/15/f3d18743d3688b5f01aa83034b6c00665692ab20e1d0c89a29000d4979ea/yarl-1.25.1-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:83e9f4a25085bd4b7214701a0794ff1f50fc633ffb8bdfebf07abdd81c2db126", size = 124704, upload-time = "2026-09-15T19:30:03.128Z" },
-    { url = "https://files.pythonhosted.org/packages/99/37/718789d8004775d6a2db86b2afc72b1d156e0590b88a1b8634ddd4bdb8ee/yarl-1.25.1-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:e636b64d24fd9c38053c5e389a1174c66361fa49dcfd220f4dd35b4abde7cb89", size = 129246, upload-time = "2026-09-15T19:30:05.014Z" },
-    { url = "https://files.pythonhosted.org/packages/28/b9/7818ac6dec7fbcd16be2d19495807c01e2c38834e57d41c63356a75e786b/yarl-1.25.1-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e5637ca8d0bd7fb72648a6c7934af4baaccb697657f7438c9d264fc2abb8b0b1", size = 118071, upload-time = "2026-09-15T19:30:06.977Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/e3/8d098cafb30a64df7283b5a5dd0d32d22a71b18a1b9ec071d0776ffe5c2a/yarl-1.25.1-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:683e362b8ba453080f7489c66f4ea794e751c35b72e7eab3575ef784c2fbc7fb", size = 116180, upload-time = "2026-09-15T19:30:08.836Z" },
-    { url = "https://files.pythonhosted.org/packages/20/9c/fbe9432478d87e00eef80242e15179639df162cb3d5d8d978fc56dcb6c51/yarl-1.25.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:df23df54b5114a17c2d0ef192433e2e5a9f0c5178c32375e90b7cfc965f349d0", size = 116578, upload-time = "2026-09-15T19:30:10.782Z" },
-    { url = "https://files.pythonhosted.org/packages/b1/8e/b3dfd03732236b86b0bcf06a72a37de412ff6f82e719a947c3c651d4dece/yarl-1.25.1-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:f53dcd26694f148f738edc052b5a69234833e739f10f4c3287bdfd8ec0f7b326", size = 108886, upload-time = "2026-09-15T19:30:12.951Z" },
-    { url = "https://files.pythonhosted.org/packages/83/e1/94dacb650d4963d5f844bc3df7ba70288cb7b68ed5a4d070da71acb19b14/yarl-1.25.1-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:b8075fe90bc08e40b8b8a1874fab42ee4c7b56af05c5886e9cc841397f916908", size = 124098, upload-time = "2026-09-15T19:30:14.963Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/3f/c93f76a218258c7bfc60dd27fd56e9102bdbc625517f4a6ee673295fe4e4/yarl-1.25.1-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:a8c2b841478068440d8b733005d13a5ef535b9928cbc05f17182d410f32ba449", size = 115768, upload-time = "2026-09-15T19:30:16.736Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/79/4d93f13c3b05cda3c962805dec28cbc255c50239b3457808abc5633a00c2/yarl-1.25.1-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:ca32926d7d77bcc8838425c4c95e040a3ace1cb7dfdae599013458dcda2607ca", size = 122461, upload-time = "2026-09-15T19:30:18.901Z" },
-    { url = "https://files.pythonhosted.org/packages/c5/8e/e2ba83b3a9bfc1d3b882ad35fa8abc04a7af4d9356f2e329a23d0c8d889d/yarl-1.25.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:192a866877a49993949ef1975864ad8728bea28ee810f6abe1a0729c2b500426", size = 118295, upload-time = "2026-09-15T19:30:21.07Z" },
-    { url = "https://files.pythonhosted.org/packages/42/67/cb5ea1baa0c0ac60bda44ce59f601133154af2a2e67722d3517f8793855d/yarl-1.25.1-cp310-cp310-win_amd64.whl", hash = "sha256:3f4d48a6112712973e676bd792121fee470e432d749177162d9949d5c9460a1b", size = 102929, upload-time = "2026-09-15T19:30:23.122Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/85/9a1e98de10fc0e738d517efd2a9984c3e7db6cf35fa72b2b373988a9e9b7/yarl-1.25.1-cp310-cp310-win_arm64.whl", hash = "sha256:48796ea00a303961507dc6c8437c4b325a6fc3f95f7c36c71b91ea9a8150963c", size = 98854, upload-time = "2026-09-15T19:30:25.102Z" },
-    { url = "https://files.pythonhosted.org/packages/83/b3/2cea721d495ca57f8f414aa4867ee263f486b274e07463158cf52f02ba7f/yarl-1.25.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:9d693bf4bf534e9ba3ae2780cfd577f5135629f7b5ac653490859d0b77864865", size = 143794, upload-time = "2026-09-15T19:30:26.946Z" },
-    { url = "https://files.pythonhosted.org/packages/55/e6/cd145cff8e5cf60b8b3c41fbecfa2a45028a8dec3fbc52bec03595ff3d3b/yarl-1.25.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:ab2054c5531af2a9ba7b69b8ec91e4f884420e83a8c5e579b013084cb57e5e5d", size = 103993, upload-time = "2026-09-15T19:30:28.661Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/7c/fbb40fe2d53747c40aa36a9e2bd2178a202f942bda0b670f3306d4aefbce/yarl-1.25.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:564fdc7085d2245ab84f88882fdb1d6ac0723124bff6ded35bfb1c00f812630d", size = 104010, upload-time = "2026-09-15T19:30:31.069Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/0b/5a516f70641092283f57cf3670bdb75e7327bcc0dcb5038697e4dfbfd569/yarl-1.25.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:acae6b45d1ace09b6ba3876da43b88366ef368f73b988c7f57e14231753d4420", size = 116444, upload-time = "2026-09-15T19:30:32.894Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/8a/d1a627f827b0a404ae0f5647cab0534959081cde13b0756a783469fb3b5e/yarl-1.25.1-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:1fb2a01ba8cd9c5d2c5dc1ec35e0fc951d04b4f037541d4ac090c993ce58b3d7", size = 107565, upload-time = "2026-09-15T19:30:35.188Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/cf/c8e0aaec886840a6c4480fe44eaec7cd4319f79a563b79321473be79c56f/yarl-1.25.1-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:e92b6bcc741b86d67606c40d3cb9c7cc8e6c737f81e31f4a94efc204456c92e3", size = 125006, upload-time = "2026-09-15T19:30:37.1Z" },
-    { url = "https://files.pythonhosted.org/packages/50/26/0cce366d54a93cdc8342965dc7663385e4db161625cc1e8b18e786753d24/yarl-1.25.1-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:72c34ac7ad4314c19362d5ce27626dcc8429bd30bbf8c179f4234078851f9492", size = 128717, upload-time = "2026-09-15T19:30:38.904Z" },
-    { url = "https://files.pythonhosted.org/packages/95/0c/a71501bbc1a674ff72c4d6c2b75f4d9a5af819f5244c3a7558080a8802c5/yarl-1.25.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d5add7b4ca7afeea91d52e4d4e4db3b1fe9885b71f07054560d8c4296b7441a2", size = 117728, upload-time = "2026-09-15T19:30:40.809Z" },
-    { url = "https://files.pythonhosted.org/packages/e7/6f/c3267ca01defeed9ed9c4ff9b17bd54915432c405945233265b707475d1c/yarl-1.25.1-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:def538065f9e4d4cf1ae164bd59aba00dfa84f03923e0de4c3788f252d6bcd17", size = 116224, upload-time = "2026-09-15T19:30:42.818Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/69/fad57ee52d648431718ee0f1f68966a99c1352c3924688ffbdcc9d3fe51a/yarl-1.25.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:0a191bfdb30a79b98e5d175d75285f9fcb78bf0e46ba5efda042e1c72071a0de", size = 116299, upload-time = "2026-09-15T19:30:44.966Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/d4/6a8c1e29f33338687ca278cba0a8fbf6525a322c2c02a9a500ccbe041152/yarl-1.25.1-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:71f42c5b9a948c113bbdebfa544598321431d064ff959d32e99b1feb61d68345", size = 108625, upload-time = "2026-09-15T19:30:46.874Z" },
-    { url = "https://files.pythonhosted.org/packages/e8/d2/3a35ae791c9cb6522c106923ff25c3230d999091e5e65511bca23bbd9914/yarl-1.25.1-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:72849d892954be4d09e569b8b831ac39ce58417fedc767d4308a0fe542018a40", size = 124515, upload-time = "2026-09-15T19:30:49.082Z" },
-    { url = "https://files.pythonhosted.org/packages/be/fd/2b022109a6b4af0f7dc371cf7500af380b0d4f034010243e1b0ce218dc93/yarl-1.25.1-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:efb01a106f971cb3752856bca2318bbdf7f01bd8823779c461586cbe5ffd5258", size = 115711, upload-time = "2026-09-15T19:30:51.208Z" },
-    { url = "https://files.pythonhosted.org/packages/18/59/f7586271136c3ddb0126bbfe661844699369b76b555fe38c4efe86870b2e/yarl-1.25.1-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:a1daf47cd95a7c3a63456336bc5aaa8c86dd3a47d07ed3d0e76132ae4666a5a1", size = 122751, upload-time = "2026-09-15T19:30:53.535Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/0b/07f7a2d881f7e16c385b47fc1753382600847cad305dcc7fa0c25828acf8/yarl-1.25.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:9489e6abf47ba37f332075a91444c7cfedb03e6ce99fbb2f116bfe1ce810da3b", size = 117983, upload-time = "2026-09-15T19:30:55.277Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/9d/8cdceec66a9b940700cb45931741403f045b162afd79bcb93c41cadd0972/yarl-1.25.1-cp311-cp311-win_amd64.whl", hash = "sha256:d7306dee25b8a0e737363f347362b875094b4dc4e367311470656ae420fdbf8e", size = 102894, upload-time = "2026-09-15T19:30:57.606Z" },
-    { url = "https://files.pythonhosted.org/packages/17/f1/7ec357db1d3ad2863542d71e8fe64a126bbec17b134cd7d30951196809a5/yarl-1.25.1-cp311-cp311-win_arm64.whl", hash = "sha256:abb1384477f5901d436b5d2e5465954de46ea6098f59163d243660b5c4461d35", size = 98609, upload-time = "2026-09-15T19:30:59.705Z" },
-    { url = "https://files.pythonhosted.org/packages/75/b3/cd32ac66ae622b854c2df0ac52106dda220d361b65a64fde7d5b3684aa3f/yarl-1.25.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:94d7aa6debf92a1dd14cb5280b083a764169a13cfb23a452111160274ed989f4", size = 144798, upload-time = "2026-09-15T19:31:01.821Z" },
-    { url = "https://files.pythonhosted.org/packages/61/fb/a2c52a8007c2051ba74662afb112ecf3d00346af4c25e33df9d80fd14fb8/yarl-1.25.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:83d4a37e4b95da4d8bda930d6d35b75b4cdadbacbb4980cae290ea3100b5d51d", size = 104583, upload-time = "2026-09-15T19:31:04.05Z" },
-    { url = "https://files.pythonhosted.org/packages/be/dd/ee38aec8e09fdf957e50d4085453fbe202f56c6c3b4cf07b81cdb4f09ee9/yarl-1.25.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:e029648f9c951db30e98a7d7ec90835db88ec4b32820efe2a9bdc2287e032eb6", size = 104325, upload-time = "2026-09-15T19:31:06.338Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/b3/058dbfb1857b484c9cf9cc135659f50b85ce66e03c99e44dc2f7b6161f55/yarl-1.25.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4d781294bb815ecb5ea57ff6bbf8038e0a31a95fdf3e1788f66e0dc100d64b58", size = 115358, upload-time = "2026-09-15T19:31:08.593Z" },
-    { url = "https://files.pythonhosted.org/packages/db/39/29693446cf0cf6b15a0e2f75a5d40f93c56819b05b0622196f45e95b5cc0/yarl-1.25.1-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e12c538e00e7c1b286a07061046b90e8124e6a9793efae2c70db6a4aad07faad", size = 107658, upload-time = "2026-09-15T19:31:10.802Z" },
-    { url = "https://files.pythonhosted.org/packages/86/b3/3c4dd7e1af43b931fba95e0a722737f2ea94a6d199c802585282831d7abd/yarl-1.25.1-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:7e4de3ac4adbad3d0bc7c6f4360a7dbff5de2f15e3b723be3198074e17fd9c40", size = 122660, upload-time = "2026-09-15T19:31:12.84Z" },
-    { url = "https://files.pythonhosted.org/packages/bd/b5/1b60dbc3cfc9c5712b15148c206748f2bc93953ffdbe25ea75b63dfc89c9/yarl-1.25.1-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:419f392a1da624877975709e3864dfe833af6cc7671b39318086d456e288380c", size = 126506, upload-time = "2026-09-15T19:31:15.088Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/7b/ca212cbe170ac8b96e45317ecbcf9c3c3ecf0cdec98d5b088a9c4088929b/yarl-1.25.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c6f117789d22dce188e5754e8bc65b7e6ebf8cb73963b9fa761f672a5883769d", size = 117050, upload-time = "2026-09-15T19:31:17.241Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/c3/72b4938cdbe619ad71ac156182faef4908846b84dc3ca4dbb4c4e6f84014/yarl-1.25.1-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:80e47012e730da131c9f059c80936783f9659aae22dc31c03c0595590d11ed54", size = 114174, upload-time = "2026-09-15T19:31:19.294Z" },
-    { url = "https://files.pythonhosted.org/packages/e8/43/268717870f9ba0cc9701a95181587f6dc8c5f387aab4aeecc83158f38a79/yarl-1.25.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:e80f557716fd765439577131e526b8942ffc2c07bdbc5e39fa62f660ba1e963f", size = 114944, upload-time = "2026-09-15T19:31:21.414Z" },
-    { url = "https://files.pythonhosted.org/packages/da/84/baa5bf504d51fe062c4bcaf62936da97fffb43285978d0b39984824231fd/yarl-1.25.1-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:f61964f235a43738bfac50da46fc4254943a7eea3051aeb0b6fc7c992c29fadc", size = 108263, upload-time = "2026-09-15T19:31:23.388Z" },
-    { url = "https://files.pythonhosted.org/packages/a4/28/779a2ed9e0152a601a27039bed9aead3f0b79797a67e2c44bfa444622dd8/yarl-1.25.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:e546fe1d4a93ebc2910f0d768baff19faa09843ab3f2036a67ed6e69fae4419d", size = 122184, upload-time = "2026-09-15T19:31:25.343Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/1f/118e9e5b8f07694d63fd3222e801d7782270003f1a222aa798df3f8d5933/yarl-1.25.1-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:cce0727fd5ac04d372fa9bbfde9febc2bcf209aadfcf0468e45dec72719895d1", size = 114001, upload-time = "2026-09-15T19:31:27.465Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/ae/a4cf1cf372313734b17996d4007f9f73596e7a178b9485802e5494ecf484/yarl-1.25.1-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:af4ea5b37403ef4e30f3927eaed540db942bde01d8d3ff083527c0704d1c9c68", size = 120565, upload-time = "2026-09-15T19:31:29.47Z" },
-    { url = "https://files.pythonhosted.org/packages/05/79/ad94f93ca731bc9e44d321833ab96b82a4f9f5f63cf773f81a4aeea5ecc1/yarl-1.25.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:68782fdb4027b8d1eee25ec35e9a6db05e863b899eb0310b3a33b6c3fef55707", size = 117060, upload-time = "2026-09-15T19:31:31.367Z" },
-    { url = "https://files.pythonhosted.org/packages/bb/cc/51a7b4abf4ac593b8e7eb3794b28e5a35ae26eed8bc04787628d215af82f/yarl-1.25.1-cp312-cp312-win_amd64.whl", hash = "sha256:7d575b54cb3863ef9bc290ea4b009999d55dc237326131e4853cf33e888fee03", size = 102593, upload-time = "2026-09-15T19:31:33.329Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/21/0941a6b93a58b59a1ec75e5333bf06929b671309c43c0cd201c172d9c39f/yarl-1.25.1-cp312-cp312-win_arm64.whl", hash = "sha256:bc3ac7bf569f6b64dad04dd7808c7872dae8a97df657856eac05e9b7e3614a85", size = 97697, upload-time = "2026-09-15T19:31:35.855Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/ed/2f3129bbcc9a5c8ba12cc2b29d8060a3bab9c8043c456cfd4b5ca3188890/yarl-1.25.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:25868beca8b6765f8f7d0e11fe6dd7c66dd4b0793b9500286d20cc92352126a5", size = 143623, upload-time = "2026-09-15T19:31:37.966Z" },
-    { url = "https://files.pythonhosted.org/packages/17/e1/f1bc3390fdca352826676b531d0712736f156919090206700421d46b2c37/yarl-1.25.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:10b2fd95332f0d716d5eee3c9fb2ce8eada19082de7fee83d32e37992fd75c26", size = 104011, upload-time = "2026-09-15T19:31:40.25Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/aa/50acc5c3e5da04172ae3c281c75405af4d2ca911e16120ab0563f4dffb66/yarl-1.25.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:0f12afda4eea8c8994a76d4df1875c765194f5fbe8a9d197929ea303caee29ec", size = 103677, upload-time = "2026-09-15T19:31:42.46Z" },
-    { url = "https://files.pythonhosted.org/packages/30/d2/7d1e0ab9f8390e1fbcede5a6dbf70d23c96ad09b8c5567f3a514d1ddb0e2/yarl-1.25.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:14b79a30a93a3ce2e8832603fd0ab780ada281b0ba5110b519a634f2d7d7d1fc", size = 115392, upload-time = "2026-09-15T19:31:44.371Z" },
-    { url = "https://files.pythonhosted.org/packages/71/e1/5ba1e3a2a22139213655e760919038e8ed7e2d4a99826d0bbddb3beb96e5/yarl-1.25.1-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:4bd6340d20ae2c7ca719b87b426e808e90743b676d05d4c26c4fb5ca71f41184", size = 107493, upload-time = "2026-09-15T19:31:46.273Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/53/780653d5e0f73831f467cf13548912e5eec97f21dc49fc8daf21da027df4/yarl-1.25.1-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:126a2533570c554719ca40a1288fdee1700b6bc82e7131aa69fa85252d92e651", size = 122537, upload-time = "2026-09-15T19:31:48.654Z" },
-    { url = "https://files.pythonhosted.org/packages/03/92/d54fa70236c6036271c9c9c09fd978df5cbe3ef49ef6c46e9b833476d215/yarl-1.25.1-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a3faadac7d812ddac258feb57b9846b60c1b437c4f4b9ad42595c6f6fe4390df", size = 126170, upload-time = "2026-09-15T19:31:50.872Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/b7/a82a49bf88340b837ef6972b508a1604ae377b9e6904b46b10cf5f1cf925/yarl-1.25.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:be80550d9bfe83d9b62398a37081a90434e6df2d978ec345c3d2820de6beddab", size = 117012, upload-time = "2026-09-15T19:31:53.189Z" },
-    { url = "https://files.pythonhosted.org/packages/ef/78/5d684b411e3f3602464ee9b538db48205038f8605872985f61efb809ced0/yarl-1.25.1-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e07595c7d6f4db270ceede356a1bd1c07a34f1c26f958d1ed0cd7b48e0d2bba3", size = 114950, upload-time = "2026-09-15T19:31:55.694Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/11/51d82b852c64f7fad0fc7a7ff3031517204887e874c722bbca839c0b23ac/yarl-1.25.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:eb96ed1ae6c7d072d60840c0434aef07a2df611812810807fbc54263a6053e9a", size = 115428, upload-time = "2026-09-15T19:31:57.966Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/49/9d1978049bf646b9ea918313926453c6901b71c92f097467777d47d36a88/yarl-1.25.1-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:3feb99222553a8cbedfa52c2f59dd84c3f50d5b582c728d522caf8d72769a54b", size = 108428, upload-time = "2026-09-15T19:32:00.048Z" },
-    { url = "https://files.pythonhosted.org/packages/43/35/7b8f1ebb45d7ec3dda7d1909bf44f458de41ef91e2937f107733582a5166/yarl-1.25.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:a2ed0ba415ccdf08f14bf544cb78346d0f76086707ffee24921a2c84dbf1305a", size = 121961, upload-time = "2026-09-15T19:32:02.436Z" },
-    { url = "https://files.pythonhosted.org/packages/63/d6/d8b689ab7ca26edeb85f6ff28812aac7a25376eefc1780e303a7bfbaceff/yarl-1.25.1-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:2b49375d22299b0a834c2bca72f39aaecc270d96fb24c30424899676f487b22a", size = 114961, upload-time = "2026-09-15T19:32:04.456Z" },
-    { url = "https://files.pythonhosted.org/packages/cf/d5/1a1798ea4dc6b7ee3260010a27907ebc697c95dae99817d817ed446d24aa/yarl-1.25.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:ef74070ac553c59eb4f04258722066d6c6135b7baa03b2e9f2da65c096e96d98", size = 120036, upload-time = "2026-09-15T19:32:06.5Z" },
-    { url = "https://files.pythonhosted.org/packages/91/8d/b1b35ed7903da6669b1d367cb2c09436acd4ff508029b4f39a0c0c2058fc/yarl-1.25.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:0a66db89ea473abeac4b70523cafd94db3772380e565f9d28af7a179b7af71fa", size = 117276, upload-time = "2026-09-15T19:32:09.401Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/8f/4db01cef62caff0d7a4593ed694fb8a41a27a11158cab80d290221f13e57/yarl-1.25.1-cp313-cp313-win_amd64.whl", hash = "sha256:1f51020b2eb8a003c84925638ec63c21a750a4bddd3a22ec8eac6a742dadf1b9", size = 101945, upload-time = "2026-09-15T19:32:11.545Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/5e/3ce00497c5c0babb74d4130c10c3828ccd215b4819d12020c42429f991ac/yarl-1.25.1-cp313-cp313-win_arm64.whl", hash = "sha256:b10dd0557ba422715b5206b3743192135a6022acca8baec51aa127d0a75db8fe", size = 97270, upload-time = "2026-09-15T19:32:14.127Z" },
-    { url = "https://files.pythonhosted.org/packages/80/cf/54023edfab7aa773b860503db0c56e962ccab0922803ee97988c176ea090/yarl-1.25.1-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:a9ca696eb02e5c02a8afd872ada510eba9b7fe6e68b9572c2e9a9b1941e31e2e", size = 143975, upload-time = "2026-09-15T19:32:16.416Z" },
-    { url = "https://files.pythonhosted.org/packages/d7/a8/e6c1be0e6761d0f2d10bbf33a3e1e02b99dc83874d92945d7b461a72481e/yarl-1.25.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:a5877f2255aab518ebe528289037699201d5dc5f045f2396cb30aa02db22f57f", size = 104018, upload-time = "2026-09-15T19:32:18.364Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/bb/dda344765ffd3430afe1a1c66c866a57fae67786537d4f14607df6505ac1/yarl-1.25.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:7a5c3115595995779ee21f2567035793911c3802a43c74f3fbb0314929ec67ac", size = 104156, upload-time = "2026-09-15T19:32:20.459Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/5f/ed1538bcd06009fe990d6d283dd7667f639e62a81e35c6d8c6ef6c08fb3c/yarl-1.25.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:77e5099b99b37f3cf79c246998ca9f7313a78054cd1809ec46bc1afad47e1c4c", size = 116025, upload-time = "2026-09-15T19:32:22.766Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/af/2185daf56b99830d3356ecfada46faaa49945de6626e842b7728088d4980/yarl-1.25.1-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:6efaf45df6a849cef613a03a94c845647456662f85438c886bb67a9c027c8c2c", size = 106985, upload-time = "2026-09-15T19:32:24.749Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/65/bc1ae564fb4b04a30b6a8f250e787772581c57e4c3d5cf07ac3359de3103/yarl-1.25.1-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:d5f90e44653c4e0f78501ed9bb7d3fce835a8d62b7c6ed0cb16557534087e743", size = 123030, upload-time = "2026-09-15T19:32:27.084Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/3e/e2afcde10d74e53b3fa889960991efb3019beda2b1682a01de720a302056/yarl-1.25.1-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:632da579b2d879f6bad20f2cfa35ded1efe2f4f77f8abb26a6234a5b236acd2f", size = 126765, upload-time = "2026-09-15T19:32:29.332Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/be/415b00c0fe5a0615b062a456b26623d7ec91c2bee20faea1a14045aa0469/yarl-1.25.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:30eec96e8a91bd588ce897c9543f6d5d8d34b28fbcba28a4dedf20ebeae9fe57", size = 117199, upload-time = "2026-09-15T19:32:31.49Z" },
-    { url = "https://files.pythonhosted.org/packages/97/27/3d8c63ddd3e8bcfd033748ab93876678ce59bacd66e4cb1ed851c9c5b37e/yarl-1.25.1-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:12b6bc4906e11f5e1a1cdcb12296e7afbd366c783cc8073403cd2fb74334e453", size = 115187, upload-time = "2026-09-15T19:32:34.137Z" },
-    { url = "https://files.pythonhosted.org/packages/39/b7/7a81d0be1a502a26a0d4326c6f2ecb736c824f570ea1c6529f2b0b227b50/yarl-1.25.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:9d6ed3d17bccce4c05343e1ca8da13bc5c02c812a4e7282ddd05e8769322d3fc", size = 116085, upload-time = "2026-09-15T19:32:36.438Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/69/39fff459916aa0fab42215dc47b759586fd80f94aa56dfc4a7c15ba6e0dc/yarl-1.25.1-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:f38a70074041d3b7e138e452799f5174198bae5bd5ab2000917badf403908c5f", size = 107996, upload-time = "2026-09-15T19:32:38.959Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/39/80b9a55a3335590451d9ecf3eb593a8c635351f4c905ef056d7e8a8fd9e7/yarl-1.25.1-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:4ca89e4e21854ed27ec753297dde84b16c9f8e53b14a4866fb44457d643c19f8", size = 122549, upload-time = "2026-09-15T19:32:41.151Z" },
-    { url = "https://files.pythonhosted.org/packages/42/7d/a179c6757818bb59372a4adafd09f7f26a3b4a0f04c3ae404b544c0b0c82/yarl-1.25.1-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:1ab7618921a93767387a4b83776f751588f5b5ae9bb5bc96620e2e2e00bca868", size = 115107, upload-time = "2026-09-15T19:32:43.072Z" },
-    { url = "https://files.pythonhosted.org/packages/32/2b/a773ac867e4ab53a98ed98e5cefe3bae31e6f550252ca9d1de266f1a40c5/yarl-1.25.1-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:0ae12ff2b805fa02c4dab838005caef735e39986322698c48588d3beacb65c62", size = 120666, upload-time = "2026-09-15T19:32:45.061Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/41/52be6505e85b0f76b4f85b01b5de7e06a0512201abc2c95e14e099549174/yarl-1.25.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:90c30ed53546da833c700115c0064c22120d1b1560f474699fd31f22dd668233", size = 117505, upload-time = "2026-09-15T19:32:47.177Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/01/349c0386caedbbe488d519f252df54efac8a1459282d466c474bdd84a620/yarl-1.25.1-cp314-cp314-win_amd64.whl", hash = "sha256:acfa7e22aa6c6e7a5996a41d275bfa01efa7ea56ab890590280e9063e2cf5c1b", size = 103446, upload-time = "2026-09-15T19:32:49.615Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/f0/8ec63180f77912f0dc4e5a42760cb8c08d20da1d5ace3578a01b84d1f3d8/yarl-1.25.1-cp314-cp314-win_arm64.whl", hash = "sha256:8e7d98cdbb6d71e726f7d525952867096053d1f290dd4e3c50d7d313a136f414", size = 99159, upload-time = "2026-09-15T19:32:51.686Z" },
-    { url = "https://files.pythonhosted.org/packages/47/7d/92d2220d6886b70ab1ed8579533ac2af2dfac716d5d929001daff7986df9/yarl-1.25.1-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:d21f0fa80a02d05299207eeaafef345d812ace96d5306e4ef265e1d419a615fa", size = 150071, upload-time = "2026-09-15T19:32:53.911Z" },
-    { url = "https://files.pythonhosted.org/packages/64/fc/b245e448124bcda9340df38e3553fa222b50260fca027a84095e9bd8642d/yarl-1.25.1-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:17c9877a89fb6e2bca6f9087eb24cd7fb434653946ef5075e470d23d49b52287", size = 106780, upload-time = "2026-09-15T19:32:56.443Z" },
-    { url = "https://files.pythonhosted.org/packages/51/e2/9a6ce2e334ebf218a30335ae76fb1696459430d42f733b8cb0d7d65b84d3/yarl-1.25.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:29273edf1530e397bd07cb784db1fbe0d2590b77569f2e24679a9c0a2d763b94", size = 107361, upload-time = "2026-09-15T19:32:58.827Z" },
-    { url = "https://files.pythonhosted.org/packages/ed/70/66e8c76b569b450d16e190f15071c916c3df70b0e33927e415ac497cf0c2/yarl-1.25.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b7abffdf37af1cec6a2ad69b827aa84320db5894791bc8ed932dc93fb274b7e9", size = 114396, upload-time = "2026-09-15T19:33:02.24Z" },
-    { url = "https://files.pythonhosted.org/packages/73/23/0d82838a05c57fdc05bc8b66e8c92dcc0df15e27463a5f163142d521c682/yarl-1.25.1-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:2239a02249d9326655419e0168a28ca9008938eaab31dc29fc875c217927a6c0", size = 104882, upload-time = "2026-09-15T19:33:04.494Z" },
-    { url = "https://files.pythonhosted.org/packages/86/d4/ea08615c4edaa6049a13a2f1128944d068d1893abda7d708d4d7ea01599a/yarl-1.25.1-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:664ec6a520b74a1df2810666eb67695fcb77fa663e6ea0a25aaf2e529cb24dfa", size = 119485, upload-time = "2026-09-15T19:33:06.583Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/82/0898bdce9b1ae403b308b9c733d0d24af4a3464270c2c081f457b16c3e0d/yarl-1.25.1-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:4f1c91f5a5980a937ff8e238e98e6897e1ad74a4b1e2c0d68c73b5ffbb3f5c0b", size = 122490, upload-time = "2026-09-15T19:33:08.653Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/38/97d79b81c342b78246cfedb74809e68841f3198d21653e10d3232bd9c622/yarl-1.25.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7c88edaec8c349ad4c5ad4c486a3defcc4b80ceb2f074436ffa0a87caf5e76a6", size = 115336, upload-time = "2026-09-15T19:33:11.056Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/9d/2577896554cd310dc470adb6da0b7dd0b435cb63e2565204a7ac240e504c/yarl-1.25.1-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:35dcbea443fafb3eece757ad4e514560ddeb6c34cfae1582c620d7b293d7feee", size = 111825, upload-time = "2026-09-15T19:33:13.204Z" },
-    { url = "https://files.pythonhosted.org/packages/29/6b/7ac49d8ba84a5c4bd73415a4c949d22c749cb3762579b3d50e48019a78aa/yarl-1.25.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:882569ff613758cac762a457a5d72d6e211b28d4bcfea89d1d71ea942b02eac0", size = 114655, upload-time = "2026-09-15T19:33:15.553Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/18/e5942a16723f5b72f9b1297fd5a85a54f6300cd15c0dcb5005b90cd89156/yarl-1.25.1-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:d0f1489233a254bb3643d2f05de7d59019254d81daeca6b9162fe9edef57e0c7", size = 106395, upload-time = "2026-09-15T19:33:17.599Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/2d/549fa46240781513ebc47ae7eb418df428a163a2a3d644cc9cbb3ecb7846/yarl-1.25.1-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:f41753a76f4f63927d03a0d8ba8f5ce0f2083bec29a8cfaccc55371b1564b96b", size = 119277, upload-time = "2026-09-15T19:33:19.973Z" },
-    { url = "https://files.pythonhosted.org/packages/76/16/4763f78dcdc0b3b9fb3842b04afe72b9320857c6a69300c62a0eab03d119/yarl-1.25.1-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:8fb0eb4955adf0579001581f2f71a126e8781ba61bcd120f127b0401163c6c2d", size = 112504, upload-time = "2026-09-15T19:33:22.464Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/b4/974e3edfe0d188393ce1cb9de400111c63fe61f4eb3b772a500d84c970d1/yarl-1.25.1-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:a1e32763e641a1566507d90a8d3b19bfc3cc04a9d4e5ae3e32189874ed4b58a3", size = 116243, upload-time = "2026-09-15T19:33:24.788Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/aa/157b940428da80c104ca09666a740e51c94963df65d5b112e06b52e4d7a8/yarl-1.25.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:65b5b2066651b7432d389e9799d979c703bcc6ef44266bb8153ef54e91e4aab3", size = 115822, upload-time = "2026-09-15T19:33:26.886Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/af/19fbdce41412e1b96825544cc52cd7029d3724655d0988237972f078bd29/yarl-1.25.1-cp314-cp314t-win_amd64.whl", hash = "sha256:734f6e5400352ac4254456003d462866c684703570929cff7a7bde015d0cb371", size = 107386, upload-time = "2026-09-15T19:33:29.009Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/99/f6431c8968e89be608d74b28ae2d024521b2953f27dd44e0dece5e04f67a/yarl-1.25.1-cp314-cp314t-win_arm64.whl", hash = "sha256:287e99ff5aa4dc1c7630bfc683ded6f106d756c99dec432a2d7f197a784f51c6", size = 102094, upload-time = "2026-09-15T19:33:31.151Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/3b/4f51eab40c2eabea6c3d5b121dff4b8988dc35087732ffede12d2be8b8dd/yarl-1.25.1-cp315-cp315-macosx_10_15_universal2.whl", hash = "sha256:9b1bdaae98bc016825dd3c9d8ee1832f829b3341f9cc6ebd1a1b0a7fef7367cc", size = 143875, upload-time = "2026-09-15T19:33:33.52Z" },
-    { url = "https://files.pythonhosted.org/packages/41/05/bbd58fc063f5f299a883f810760b265ca26c8167c91cb9a494d0fe2387e1/yarl-1.25.1-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:e7011b8fb8c4054bf0c12e5edc6cd83778b0028e99ce59b18586ed036f92cfdc", size = 104028, upload-time = "2026-09-15T19:33:36.22Z" },
-    { url = "https://files.pythonhosted.org/packages/12/ee/2fba0aecb52e7020e189f684148783aa0b9cfa3b3bfb0b400646eef70ad4/yarl-1.25.1-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:f074e8d4aa0a5798920ddb6de3d08b228c614ff3724c3e8bd7577f4bafea867b", size = 104041, upload-time = "2026-09-15T19:33:38.86Z" },
-    { url = "https://files.pythonhosted.org/packages/38/35/884beab53ed88c7247d1671972b5ef116f7351fe0c7e6de8c3558372cb16/yarl-1.25.1-cp315-cp315-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7d42e7e3ca399555578b4d617e3a6ecf13371b3743a115995fa010c7bf341459", size = 116018, upload-time = "2026-09-15T19:33:44.265Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/cc/1a91b685afb55cc18608443ace95280e96e263a97565811732b6788d3269/yarl-1.25.1-cp315-cp315-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:aa4ed3dd308548f9e707d9caaf005d2d7f8c1e7868f858dfeb47fe76e16b391d", size = 107033, upload-time = "2026-09-15T19:33:46.45Z" },
-    { url = "https://files.pythonhosted.org/packages/c5/c1/58b379fcb1d68d907b7fcf75200c44321896509b2a6a74abbb4b19d864d2/yarl-1.25.1-cp315-cp315-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:42a66563d8cc056ee32e6191e05097a7b2b3bc302e0bc3133daf8710eb18bd26", size = 123257, upload-time = "2026-09-15T19:33:48.631Z" },
-    { url = "https://files.pythonhosted.org/packages/d7/2d/1fe96cf5c2aeab10095e48f38585cf5a8451fb7253234822398e52aa5336/yarl-1.25.1-cp315-cp315-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:98d370568f393215d605304cdb77b3d5539bd192c75b623c7304c42c8d6d8273", size = 126745, upload-time = "2026-09-15T19:33:50.999Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/60/8674394ce43f4dadae573a1d6f451716438e9eab7d7fe8d643c673a32d85/yarl-1.25.1-cp315-cp315-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:23bf5b403c879a54964e0feac7285688e04bb220074878d737d331522da0a5bf", size = 117255, upload-time = "2026-09-15T19:33:53.456Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/72/0faa30e02605d56127d42bb987dcc97da3863b7bf70b9bfbf5f739c05e30/yarl-1.25.1-cp315-cp315-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:d45673badd08456d0340e9364eddafe1c53a9d2896424294de4d7dd71ad3ee57", size = 115166, upload-time = "2026-09-15T19:33:55.669Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/90/9a46eac564c437e128285c5c1d7bb385d268394e9209d84f6bf4a14471ef/yarl-1.25.1-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:0136d640dfa9b0523853e411430a99f8a91eca85774c6420285a33b755bc6de3", size = 116082, upload-time = "2026-09-15T19:33:57.78Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/38/4b1a686a3758878f93d2f1ea943f5a165f3555769cd16e761cfd0efdca17/yarl-1.25.1-cp315-cp315-musllinux_1_2_armv7l.whl", hash = "sha256:59ba3a6e1aa8cfe5adf4bd270fd965db21955401b7ca6f1696010c55ed4daec2", size = 108048, upload-time = "2026-09-15T19:34:00.25Z" },
-    { url = "https://files.pythonhosted.org/packages/da/14/f348eb967f31a58348612a2b93bd8a2ab664548e2b5e879cac7f592f7201/yarl-1.25.1-cp315-cp315-musllinux_1_2_ppc64le.whl", hash = "sha256:87796fedc3ba97ec14fab55acb48584276e6c1e4c1e89c422bda62c838e754a9", size = 122775, upload-time = "2026-09-15T19:34:02.455Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/e9/4f7b79700f88cb9e8bb66f8b54f9bce1844c013a2c39fdc47112e9334c95/yarl-1.25.1-cp315-cp315-musllinux_1_2_riscv64.whl", hash = "sha256:bd0912757081f89b107d6c00b2ff8a194401b0b87eadcf4481de2b865a8fd44f", size = 115096, upload-time = "2026-09-15T19:34:05.283Z" },
-    { url = "https://files.pythonhosted.org/packages/cf/37/f9cb020331997d3eb887bd28d5410ecfd3d80bf163c23d7cec490d78dade/yarl-1.25.1-cp315-cp315-musllinux_1_2_s390x.whl", hash = "sha256:b51c159a9794633f5e0db7ecec7b2b6e3734eca1f5d17dc989ff3552a43ff78b", size = 120655, upload-time = "2026-09-15T19:34:07.382Z" },
-    { url = "https://files.pythonhosted.org/packages/12/83/52fceb22891a41f168db7ec22fd1d81e06b6a0b8d9f70921bd3e785defd0/yarl-1.25.1-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:319e070a01db9920fb63761843f96a104c8e2b9427266731810dc1e22595b17c", size = 117488, upload-time = "2026-09-15T19:34:09.988Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/5c/ce6c4ff1247fcbe4b33d462c23a097106d909b173fde7042bc52290466e2/yarl-1.25.1-cp315-cp315-win_amd64.whl", hash = "sha256:a2059a2d891bd156bc5184e7ab7a56e78a84dfcfdeac8c501b552533ad1c36ee", size = 103434, upload-time = "2026-09-15T19:34:12.56Z" },
-    { url = "https://files.pythonhosted.org/packages/3c/a1/766a906b0704fb26d52b19dc22bed48a8ba0544203b70dcf44da350e8194/yarl-1.25.1-cp315-cp315-win_arm64.whl", hash = "sha256:a78b50b4f7918a3de71105d5c0b93bbc57bb8339a4d03a9dfd449f9068e76f3d", size = 99155, upload-time = "2026-09-15T19:34:15.132Z" },
-    { url = "https://files.pythonhosted.org/packages/bd/d3/a1d09b32cb6ab14f66b44939f5b4255b8b9e747aef3974af1d5d80ccc2fd/yarl-1.25.1-cp315-cp315t-macosx_10_15_universal2.whl", hash = "sha256:b5402a340723fa7da00b5cff987ddab61276be6d11251ea71ae02bcac54890d8", size = 149284, upload-time = "2026-09-15T19:34:17.452Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/3b/fe554d879692650bca70bfbc0df124e82e4d2bb7456f698c7756f1279a96/yarl-1.25.1-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:eda19ea5ee88742f47a2340816e6f2d40b53bed3ab5b69794769f36af9f35bb4", size = 106399, upload-time = "2026-09-15T19:34:21.474Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/4b/e7af56177ac8d40094c82d7728224c0b8472157d50d362e5fb3b014b2bc8/yarl-1.25.1-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:75baa6cf9b6d1c52f3e111a130e202fd8cf0a5b3a066c3f73d615e885092e4ec", size = 106968, upload-time = "2026-09-15T19:34:23.619Z" },
-    { url = "https://files.pythonhosted.org/packages/da/4f/2df41fd738d46f23ef829ae8b4468d94bb6070038fc6dfab6165ed44fea8/yarl-1.25.1-cp315-cp315t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:dbcef5a9119ef653653132cccaf999b30a0af6f33bb0a4ba80bec30056868487", size = 114717, upload-time = "2026-09-15T19:34:25.879Z" },
-    { url = "https://files.pythonhosted.org/packages/69/ea/002b66df53bbd1aed1c23358ff99c9bdc744fe3f4d2740e1b2fdd7192885/yarl-1.25.1-cp315-cp315t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:7efc9f082dfed77c316edffa9deb52888e1bc6789171887cc1f68e06d65465c8", size = 105198, upload-time = "2026-09-15T19:34:28.204Z" },
-    { url = "https://files.pythonhosted.org/packages/b1/7c/95c8bc0c8f97d71e59c94525ad60d76f5c57d3f2820f08137ca8b9f0542a/yarl-1.25.1-cp315-cp315t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:fe01645169a2112aa1d4ebc3e4c5f029c5c8f97adfc32e5d37c993b39a994d75", size = 120271, upload-time = "2026-09-15T19:34:30.5Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/7a/6fe9da56ec77927baa669fd86c39c567ce6205bab53d581082c6744c8ae7/yarl-1.25.1-cp315-cp315t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d1c557dfd5e3db046053a0bdc72261ade790ebe8e2c7a41b36b0ca1f14cb95f3", size = 123572, upload-time = "2026-09-15T19:34:32.73Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/83/35f222d17fa70a14c7c74fdf112ccf5515e0c2a87082b1f9b99f7693bf57/yarl-1.25.1-cp315-cp315t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8ce4d6ccafb33d39bd78444612d14938ead674c25702ded2ee9c54a47735d225", size = 115228, upload-time = "2026-09-15T19:34:35.344Z" },
-    { url = "https://files.pythonhosted.org/packages/da/6f/fbaaf619423578a7d898d0f226ae47bc1906c293865c416d83c17b828b0e/yarl-1.25.1-cp315-cp315t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:80a063f8297fc796296f00f100be520f209b23dc98f93ce8eba6ee7122598209", size = 111618, upload-time = "2026-09-15T19:34:37.656Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/78/7383278f1b3cf8e0496bd95b3281a7b09b89217b6b428db24c6b99b3deca/yarl-1.25.1-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:7cb414a73e21a7ab58254926073f2930cb22f5b4314ea4260a687e2b3fd4dce3", size = 114839, upload-time = "2026-09-15T19:34:40.099Z" },
-    { url = "https://files.pythonhosted.org/packages/62/49/5506e5b6d29aab91bd845cc9016d88c3d3f81b81bc242b8100bdd5737825/yarl-1.25.1-cp315-cp315t-musllinux_1_2_armv7l.whl", hash = "sha256:85a18376073f8a39aa07be34f9fc77e2869aa72c55c441efdd2cf79a0407504d", size = 106212, upload-time = "2026-09-15T19:34:42.768Z" },
-    { url = "https://files.pythonhosted.org/packages/46/8a/19877c193b7c5929f4b07118c18bbe390f3fadd0f59dd98c0cd12b31fa5c/yarl-1.25.1-cp315-cp315t-musllinux_1_2_ppc64le.whl", hash = "sha256:77716e245c90f058466a05e6a465bb8600f767a8f4b18b4d40f3aff958e5f73c", size = 119985, upload-time = "2026-09-15T19:34:44.976Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/6c/0a46fbbf9ecbcbd0cc20d2193394254b9e19817f22c814aab60f99847400/yarl-1.25.1-cp315-cp315t-musllinux_1_2_riscv64.whl", hash = "sha256:1e80dcf1446e1b080b1932b0d103c464a04112f5bc31f0f983ad418172063cde", size = 112081, upload-time = "2026-09-15T19:34:47.45Z" },
-    { url = "https://files.pythonhosted.org/packages/ef/30/93f5d471230c74ccd06255d0842739f86551f937f9e63a5e947853c6244a/yarl-1.25.1-cp315-cp315t-musllinux_1_2_s390x.whl", hash = "sha256:bdc8d8b8c22e9e43ac68316b5e6cf083dec537f4ec213cb4aa967b583bc3fa64", size = 116995, upload-time = "2026-09-15T19:34:49.972Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/80/c386593035ee3f9c6c6af0847b5578f2830c674794a9d7701b744a3ebd42/yarl-1.25.1-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:dfbf531053a0935f2e871bcd4753f90313688772ff8c017f5ea402e315a78c1f", size = 115570, upload-time = "2026-09-15T19:34:52.628Z" },
-    { url = "https://files.pythonhosted.org/packages/38/02/eef443559563ef8f2e10469387b8b1e97cb5efee95b288a56da60801f7ee/yarl-1.25.1-cp315-cp315t-win_amd64.whl", hash = "sha256:b13b88747769537f3d32e89e3a735da10c0a9e35d7322928c701b5f93d3afffd", size = 106811, upload-time = "2026-09-15T19:34:54.935Z" },
-    { url = "https://files.pythonhosted.org/packages/88/91/41e284ca2cf5211e05dae031d126a3668aea88fa759df56e7e35c6ad25ba/yarl-1.25.1-cp315-cp315t-win_arm64.whl", hash = "sha256:783dd1467083f4d3f7722ad6a313f24c173e7571372738fcb7a6e6d1ba48df25", size = 101804, upload-time = "2026-09-15T19:34:57.231Z" },
-    { url = "https://files.pythonhosted.org/packages/54/22/318c7980066769c6bcd9221ed2248294f5698811da099013098c670565ed/yarl-1.25.1-py3-none-any.whl", hash = "sha256:681c758b0490f9e96b78e5fa8e8dc6e648e9185bb6eaebe73183c33ea0c445f3", size = 63617, upload-time = "2026-09-15T19:34:59.616Z" },
-]
-
 [[package]]
 name = "zipp"
 version = "4.1.0"