@hasna/hooks 0.11.5 → 0.11.7

package/bin/index.js

@@ -2520,7 +2520,7 @@ var init_codex_settings = __esm(() => {
   snapshots = new WeakMap;
 });
 
-// ../../node_modules/.bun/@hasna+skills@0.9.17+a00d3064559565bb/node_modules/@hasna/skills/dist/index.js
+// ../../../../validation/build/apps/hooks/node_modules/@hasna/skills/dist/index.js
 import { existsSync as existsSync10 } from "fs";
 import { homedir as homedir6 } from "os";
 import { join as join10, resolve as resolve4 } from "path";
@@ -35254,7 +35254,7 @@ var init_codex_safety_check = __esm(() => {
   init_native_readiness_command();
   init_native_safety2();
   init_native_readiness();
-  versions = new Set(["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.154.0-alpha.6.1", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1"]);
+  versions = new Set(["codex-cli 0.153.0", "codex-cli 0.154.0", "codex-cli 0.154.0-alpha.6.1", "codex-cli 0.155.0", "codex-cli 0.155.1", "codex-cli 0.156.1", "codex-cli 0.157.0", "codex-cli 0.157.1", "codex-cli 0.158.0", "codex-cli 0.159.0"]);
   CodexSafetyError = class CodexSafetyError extends Error {
     code;
     constructor(code2) {
@@ -35495,7 +35495,7 @@ var init_codex_safety_trust = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/error.js
+// ../../../../validation/build/apps/hooks/node_modules/commander/lib/error.js
 var require_error = __commonJS((exports) => {
   class CommanderError extends Error {
     constructor(exitCode, code2, message) {
@@ -35519,7 +35519,7 @@ var require_error = __commonJS((exports) => {
   exports.InvalidArgumentError = InvalidArgumentError;
 });
 
-// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/argument.js
+// ../../../../validation/build/apps/hooks/node_modules/commander/lib/argument.js
 var require_argument = __commonJS((exports) => {
   var { InvalidArgumentError } = require_error();
 
@@ -35598,7 +35598,7 @@ var require_argument = __commonJS((exports) => {
   exports.humanReadableArgName = humanReadableArgName;
 });
 
-// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/help.js
+// ../../../../validation/build/apps/hooks/node_modules/commander/lib/help.js
 var require_help = __commonJS((exports) => {
   var { humanReadableArgName } = require_argument();
 
@@ -35847,7 +35847,7 @@ var require_help = __commonJS((exports) => {
   exports.Help = Help;
 });
 
-// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/option.js
+// ../../../../validation/build/apps/hooks/node_modules/commander/lib/option.js
 var require_option = __commonJS((exports) => {
   var { InvalidArgumentError } = require_error();
 
@@ -35998,7 +35998,7 @@ var require_option = __commonJS((exports) => {
   exports.DualOptions = DualOptions;
 });
 
-// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/suggestSimilar.js
+// ../../../../validation/build/apps/hooks/node_modules/commander/lib/suggestSimilar.js
 var require_suggestSimilar = __commonJS((exports) => {
   var maxDistance = 3;
   function editDistance(a, b) {
@@ -36071,7 +36071,7 @@ var require_suggestSimilar = __commonJS((exports) => {
   exports.suggestSimilar = suggestSimilar;
 });
 
-// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/command.js
+// ../../../../validation/build/apps/hooks/node_modules/commander/lib/command.js
 var require_command = __commonJS((exports) => {
   var EventEmitter = __require("events").EventEmitter;
   var childProcess = __require("child_process");
@@ -37314,7 +37314,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
   exports.Command = Command;
 });
 
-// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/index.js
+// ../../../../validation/build/apps/hooks/node_modules/commander/index.js
 var require_commander = __commonJS((exports) => {
   var { Argument } = require_argument();
   var { Command } = require_command();
@@ -37334,7 +37334,7 @@ var require_commander = __commonJS((exports) => {
   exports.InvalidOptionArgumentError = InvalidArgumentError;
 });
 
-// ../../node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/spinners.json
+// ../../../../validation/build/apps/hooks/node_modules/cli-spinners/spinners.json
 var require_spinners = __commonJS((exports, module) => {
   module.exports = {
     dots: {
@@ -38960,7 +38960,7 @@ var require_spinners = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/.bun/cli-spinners@2.9.2/node_modules/cli-spinners/index.js
+// ../../../../validation/build/apps/hooks/node_modules/cli-spinners/index.js
 var require_cli_spinners = __commonJS((exports, module) => {
   var spinners = Object.assign({}, require_spinners());
   var spinnersList = Object.keys(spinners);
@@ -39041,10 +39041,10 @@ var init_redact = __esm(() => {
 
 // src/lib/profiles.ts
 import { existsSync as existsSync14, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync12, readdirSync as readdirSync8, rmSync, cpSync as cpSync2 } from "fs";
-import { join as join29 } from "path";
+import { join as join27 } from "path";
 function getProfilesDir() {
-  const newDir = join29(getEffectiveDataRoot(), "profiles");
-  const oldDir = join29(getHomeDir(), ".hooks", "profiles");
+  const newDir = join27(getEffectiveDataRoot(), "profiles");
+  const oldDir = join27(getHomeDir(), ".hooks", "profiles");
   if (!existsSync14(newDir) && existsSync14(oldDir)) {
     mkdirSync13(newDir, { recursive: true });
     cpSync2(oldDir, newDir, { recursive: true });
@@ -39058,7 +39058,7 @@ function ensureProfilesDir() {
   }
 }
 function profilePath(id) {
-  return join29(getProfilesDir(), `${id}.json`);
+  return join27(getProfilesDir(), `${id}.json`);
 }
 function shortUuid() {
   return crypto.randomUUID().slice(0, 8);
@@ -39100,7 +39100,7 @@ function listProfiles() {
     const profiles = [];
     for (const file2 of files) {
       try {
-        const content = readFileSync19(join29(dir, file2), "utf-8");
+        const content = readFileSync19(join27(dir, file2), "utf-8");
         profiles.push(JSON.parse(content));
       } catch {}
     }
@@ -39144,18 +39144,18 @@ var init_profiles = __esm(() => {
   init_app_home();
 });
 
-// ../../node_modules/.bun/@hasna+contracts@1.2.2+944b86d8024e79fa/node_modules/@hasna/contracts/dist/client/transport.js
-import { isIP as isIP2 } from "net";
+// ../../../../validation/build/apps/hooks/node_modules/@hasna/contracts/dist/client/transport.js
+import { isIP } from "net";
 import { spawnSync as spawnSync2 } from "child_process";
 import { closeSync as closeSync22, fstatSync as fstatSync22, openSync as openSync22, readFileSync as readFileSync22 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW2, O_NONBLOCK as O_NONBLOCK2, O_RDONLY as O_RDONLY2 } from "constants";
 import { hostname as osHostname } from "os";
 import { isAbsolute as isAbsolute21, join as join28 } from "path";
-import { createRequire as createRequire3 } from "module";
+import { createRequire as createRequire2 } from "module";
 import { fileURLToPath as fileURLToPath22 } from "url";
 import { closeSync as closeSync20, fstatSync as fstatSync19, lstatSync as lstatSync24, openSync as openSync20, readFileSync as readFileSync20, realpathSync as realpathSync12, statSync as statSync2 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
-import { basename as basename9, dirname as dirname22, join as join30, relative as relative5, sep as sep6 } from "path";
+import { basename as basename9, dirname as dirname22, join as join29, relative as relative5, sep as sep6 } from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
 function envToken2(name) {
   return name.toUpperCase().replace(/-/g, "_");
@@ -39230,11 +39230,11 @@ function o(e2, r2, t2) {
 }
 function entryPoint(directory2) {
   const root = realpathSync12(directory2);
-  const fd = openSync20(join30(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+  const fd = openSync20(join29(root, "package.json"), O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
   let pkg;
   try {
     const stat2 = fstatSync19(fd);
-    if (!stat2.isFile() || stat2.size > MAX_PACKAGE_BYTES3)
+    if (!stat2.isFile() || stat2.size > MAX_PACKAGE_BYTES2)
       throw new Error("Invalid Secrets package metadata");
     pkg = JSON.parse(readFileSync20(fd, "utf8"));
   } finally {
@@ -39250,7 +39250,7 @@ function entryPoint(directory2) {
   if (/[\\%?#\0]/.test(target) || parts.some((part) => !part || part === "." || part === ".." || part === "node_modules")) {
     throw new Error("Invalid Secrets import export");
   }
-  const file2 = realpathSync12(join30(root, ...parts));
+  const file2 = realpathSync12(join29(root, ...parts));
   const within = relative5(root, file2);
   if (!within || within === ".." || within.startsWith(`..${sep6}`) || !statSync2(file2).isFile()) {
     throw new Error("Secrets import export escapes its package or is not a file");
@@ -39261,7 +39261,7 @@ function resolveInstalledSecrets(parentUrl) {
   let directory2 = dirname22(fileURLToPath3(parentUrl));
   for (;; ) {
     if (basename9(directory2) !== "node_modules") {
-      const candidate = join30(directory2, "node_modules", PACKAGE);
+      const candidate = join29(directory2, "node_modules", PACKAGE);
       let absent = false;
       try {
         lstatSync24(candidate);
@@ -39381,7 +39381,7 @@ function readAppConfigFile(path) {
     const uid2 = process.getuid?.() ?? process.geteuid?.();
     if (uid2 !== undefined && before.uid !== uid2)
       unsafe("the file is not owned by the current user");
-    if (before.size > MAX_CREDENTIAL_FILE_BYTES3)
+    if (before.size > MAX_CREDENTIAL_FILE_BYTES2)
       unsafe("the file exceeds the size limit");
     const bytes = readFileSync22(fd);
     const after = fstatSync22(fd);
@@ -39473,13 +39473,13 @@ function sealCredential(fields) {
       configurable: false
     });
   }
-  Object.defineProperty(sealed, INSPECT_CUSTOM3, {
+  Object.defineProperty(sealed, INSPECT_CUSTOM2, {
     value: () => ({ ...visible, apiKey: "[redacted]" }),
     enumerable: false,
     writable: false,
     configurable: false
   });
-  Object.defineProperty(sealed, CREDENTIAL_SEAL3, {
+  Object.defineProperty(sealed, CREDENTIAL_SEAL2, {
     value: true,
     enumerable: false,
     writable: false,
@@ -39510,7 +39510,7 @@ function firstEnvValue(env, keys2) {
   return null;
 }
 function isAmbientEnvironment(env) {
-  return env === process.env || env[AMBIENT_ENVIRONMENT3] === true;
+  return env === process.env || env[AMBIENT_ENVIRONMENT2] === true;
 }
 function defaultKeychainRunner(argv) {
   const result = spawnSync2(KEYCHAIN_SECURITY_BIN, [...argv], {
@@ -39604,7 +39604,7 @@ function snapshotClientEnvironment(name, env) {
     snapshot2[key] = descriptor.value;
   }
   if (ambient) {
-    Object.defineProperty(snapshot2, AMBIENT_ENVIRONMENT3, {
+    Object.defineProperty(snapshot2, AMBIENT_ENVIRONMENT2, {
       value: true,
       enumerable: false,
       writable: false,
@@ -39777,7 +39777,7 @@ async function completePointerCredential(name, pointerResolution, env = process.
   let secretsSdk;
   try {
     const sdkUrl = resolveInstalledSecrets(import.meta.url);
-    secretsSdk = requireSecretsSdk3(fileURLToPath22(sdkUrl));
+    secretsSdk = requireSecretsSdk2(fileURLToPath22(sdkUrl));
   } catch {
     throw new CredentialResolutionError(name, `${pointerEnvKey} names vault item '${vaultKey}', but the secrets SDK (@hasna/secrets) is not installed ` + `in this process. A vault pointer is TERMINAL: install @hasna/secrets to resolve it, or unset ${pointerEnvKey}.`, [pointerEnvKey]);
   }
@@ -39861,7 +39861,7 @@ function canonicalAuthorityHostname(authority) {
       }
       assertCanonicalPort(portSuffix.slice(1));
     }
-    if (isIP2(rawHostname.slice(1, -1)) !== 6) {
+    if (isIP(rawHostname.slice(1, -1)) !== 6) {
       throw new Error("API URL authority must contain a canonical IPv6 literal.");
     }
   } else {
@@ -39877,7 +39877,7 @@ function canonicalAuthorityHostname(authority) {
     } else {
       rawHostname = authority;
     }
-    const ipVersion = isIP2(rawHostname);
+    const ipVersion = isIP(rawHostname);
     const numericAddressParts = rawHostname.split(".");
     const looksLikeNonCanonicalIpv4 = numericAddressParts.every((part) => /^(?:0x[0-9a-f]+|[0-9]+)$/i.test(part));
     if (ipVersion !== 4 && looksLikeNonCanonicalIpv4 || ipVersion !== 4 && !isValidDnsDomain(rawHostname.toLowerCase())) {
@@ -40013,9 +40013,9 @@ function credentialDiskSourcesForMessage(name, env) {
   const paths = credentialDiskSources(name, env);
   return paths.length > 0 ? paths.join(" or ") : "<no HOME or HASNA_HOME set in this environment, so no credential file was consulted>";
 }
-var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", PACKAGE = "@hasna/secrets", MAX_PACKAGE_BYTES3, CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES3, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM3, CREDENTIAL_SEAL3, AMBIENT_ENVIRONMENT3, requireSecretsSdk3, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS3, AUTHORITY_OVERRIDE_HEADERS3;
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", PACKAGE = "@hasna/secrets", MAX_PACKAGE_BYTES2, CredentialResolutionError, CredentialFileUnsafeError, HASNA_HOME_ENV_KEY = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY = "HASNA_STATION", HASNA_HOME_DIR = ".hasna", CONFIG_SUBDIR = "config", CREDENTIALS_FILE = "credentials", KEYCHAIN_SECURITY_BIN = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS = 44, KEYCHAIN_SPAWN_TIMEOUT_MS = 1e4, MAX_CREDENTIAL_FILE_BYTES2, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, VAULT_POINTER_SHAPE, CREDENTIAL_SHAPED_KEY, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, AMBIENT_ENVIRONMENT2, requireSecretsSdk2, DEFAULT_FLEET_GATEWAY_ORIGIN = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN, DNS_LABEL_PATTERN, ClientTransportConfigurationError, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2;
 var init_transport = __esm(() => {
-  MAX_PACKAGE_BYTES3 = 1024 * 1024;
+  MAX_PACKAGE_BYTES2 = 1024 * 1024;
   CredentialResolutionError = class CredentialResolutionError extends Error {
     appName;
     attempted;
@@ -40034,16 +40034,16 @@ var init_transport = __esm(() => {
       this.path = path;
     }
   };
-  MAX_CREDENTIAL_FILE_BYTES3 = 64 * 1024;
+  MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
   SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
   SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
   ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
   VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
   CREDENTIAL_SHAPED_KEY = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)(?:_|$)/;
-  INSPECT_CUSTOM3 = Symbol.for("nodejs.util.inspect.custom");
-  CREDENTIAL_SEAL3 = Symbol.for("hasna:contracts:sealedCredential");
-  AMBIENT_ENVIRONMENT3 = Symbol.for("hasna:contracts:ambientClientEnvironment");
-  requireSecretsSdk3 = createRequire3(import.meta.url);
+  INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
+  CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
+  AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
+  requireSecretsSdk2 = createRequire2(import.meta.url);
   ASCII_CONTROL_PATTERN = /[\u0000-\u001f\u007f]/;
   DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
   ClientTransportConfigurationError = class ClientTransportConfigurationError extends Error {
@@ -40056,8 +40056,8 @@ var init_transport = __esm(() => {
       this.sources = Object.freeze([...sources]);
     }
   };
-  IDEMPOTENT_METHODS3 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-  AUTHORITY_OVERRIDE_HEADERS3 = new Set([
+  IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+  AUTHORITY_OVERRIDE_HEADERS2 = new Set([
     "host",
     ":authority",
     "forwarded",
@@ -40568,7 +40568,7 @@ __export(exports_run, {
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync2, writeFileSync as writeFileSync13 } from "fs";
-import { basename as basename11, dirname as dirname24, isAbsolute as isAbsolute25, join as join31 } from "path";
+import { basename as basename11, dirname as dirname24, isAbsolute as isAbsolute25, join as join30 } from "path";
 function extensionOf(scriptPath) {
   const base = basename11(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -40639,7 +40639,7 @@ async function readPipeWithDeadline(stream, deadlineMs) {
 async function executeVerifiedScript(options) {
   const scriptDir = dirname24(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
-  const tempPath = join31(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
+  const tempPath = join30(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
   let timedOut = false;
   const timeoutTimer = options.timeout ? setTimeout(() => {
@@ -40731,10 +40731,10 @@ __export(exports_custom_install, {
   ensureCustomDir: () => ensureCustomDir
 });
 import { existsSync as existsSync16, mkdirSync as mkdirSync14, mkdtempSync, readFileSync as readFileSync21, rmSync as rmSync4 } from "fs";
-import { join as join32 } from "path";
+import { join as join31 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 function manifestAt(dir) {
-  const path = join32(dir, "manifest.json");
+  const path = join31(dir, "manifest.json");
   if (!existsSync16(path))
     return;
   try {
@@ -40757,8 +40757,8 @@ function writeFromManifest(manifest, srcDir, source, kind) {
   return { name, version: manifest.version, kind, source, dir, scriptPath };
 }
 async function cloneToTemp(gitUrl) {
-  const tmp = mkdtempSync(join32(tmpdir2(), "hooks-install-"));
-  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join32(tmp, "repo")], {
+  const tmp = mkdtempSync(join31(tmpdir2(), "hooks-install-"));
+  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join31(tmp, "repo")], {
     stdout: "pipe",
     stderr: "pipe"
   });
@@ -40771,7 +40771,7 @@ async function cloneToTemp(gitUrl) {
     rmSync4(tmp, { recursive: true, force: true });
     throw new Error(`git clone failed (${exitCode}): ${stderr.trim()}`);
   }
-  return join32(tmp, "repo");
+  return join31(tmp, "repo");
 }
 function isGitUrl(value) {
   return value.startsWith("git@") || value.startsWith("ssh://") || value.startsWith("file://") || value.endsWith(".git");
@@ -42010,11 +42010,11 @@ __export(exports_serve, {
   DEFAULT_SERVE_PORT: () => DEFAULT_SERVE_PORT
 });
 import { readFileSync as readFileSync25 } from "fs";
-import { dirname as dirname25, join as join33 } from "path";
+import { dirname as dirname25, join as join32 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function packageVersion() {
   try {
-    const pkgPath = join33(dirname25(fileURLToPath4(import.meta.url)), "..", "package.json");
+    const pkgPath = join32(dirname25(fileURLToPath4(import.meta.url)), "..", "package.json");
     return JSON.parse(readFileSync25(pkgPath, "utf-8")).version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -42316,7 +42316,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z as z3 } from "zod";
 import { createServer } from "http";
 import { existsSync as existsSync17, readFileSync as readFileSync26 } from "fs";
-import { join as join34, dirname as dirname26 } from "path";
+import { join as join33, dirname as dirname26 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 async function runVerifiedHook(name, stdin, timeoutMs) {
   const { resolveHook: resolveHook2, resolveScriptPath: resolveScriptPath2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
@@ -42550,7 +42550,7 @@ function createHooksServer() {
           continue;
         }
         const hookDir = getHookPath(name);
-        if (!existsSync17(join34(hookDir, "src", "hook.ts"))) {
+        if (!existsSync17(join33(hookDir, "src", "hook.ts"))) {
           issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
           hookHealthy = false;
         }
@@ -42594,7 +42594,7 @@ function createHooksServer() {
         return { content: [{ type: "text", text: JSON.stringify({ error: `Hook '${name}' not found` }) }] };
       }
       const hookPath = getHookPath(name);
-      const readmePath = join34(hookPath, "README.md");
+      const readmePath = join33(hookPath, "README.md");
       let readme = "";
       if (existsSync17(readmePath)) {
         readme = readFileSync26(readmePath, "utf-8");
@@ -43324,7 +43324,7 @@ var init_server = __esm(() => {
   pkg = { name: "@hasna/hooks", version: "0.0.0" };
   try {
     for (const rel of ["../../package.json", "../package.json", "../../../package.json"]) {
-      const p = join34(__dirname3, rel);
+      const p = join33(__dirname3, rel);
       if (existsSync17(p)) {
         pkg = JSON.parse(readFileSync26(p, "utf-8"));
         break;
@@ -43403,7 +43403,7 @@ __export(exports_native_readiness_binding, {
 import { createHash as createHash25, randomUUID as randomUUID8 } from "crypto";
 import { closeSync as closeSync21, constants as constants19, fsyncSync as fsyncSync8, lstatSync as lstatSync25, mkdirSync as mkdirSync15, openSync as openSync21, realpathSync as realpathSync14, writeFileSync as writeFileSync14 } from "fs";
 import { homedir as homedir15 } from "os";
-import { dirname as dirname27, join as join35 } from "path";
+import { dirname as dirname27, join as join34 } from "path";
 function need10(value, code2) {
   if (!value)
     throw new ReadinessBindingError(code2);
@@ -43461,7 +43461,7 @@ async function registerTrashReadinessBinding(input2, expectedSHA256) {
   const operationId = randomUUID8();
   let directory2 = home;
   for (const part of [".hasna", "hooks", "native", "trash-readiness"]) {
-    directory2 = join35(directory2, part);
+    directory2 = join34(directory2, part);
     try {
       mkdirSync15(directory2, { mode: 448 });
       syncDirectory4(dirname27(directory2));
@@ -43471,12 +43471,12 @@ async function registerTrashReadinessBinding(input2, expectedSHA256) {
     }
     safeDirectory4(directory2);
   }
-  const operation = join35(directory2, operationId);
+  const operation = join34(directory2, operationId);
   mkdirSync15(operation, { mode: 448 });
   syncDirectory4(directory2);
   if (before)
-    exclusive3(join35(operation, "binding.before"), before.raw);
-  exclusive3(join35(operation, "intent.json"), JSON.stringify({ operationId, target, expectedSHA256, desiredSHA256: digest4 }) + `
+    exclusive3(join34(operation, "binding.before"), before.raw);
+  exclusive3(join34(operation, "intent.json"), JSON.stringify({ operationId, target, expectedSHA256, desiredSHA256: digest4 }) + `
 `);
   try {
     need10((read4()?.sha256 ?? "absent") === expectedSHA256, "binding_changed");
@@ -43490,7 +43490,7 @@ async function registerTrashReadinessBinding(input2, expectedSHA256) {
     syncDirectory4(directory2);
     need10(read4()?.sha256 === digest4, "binding_changed");
     const receipt = { ok: true, changed: true, operationId, path: target, sha256: digest4, configurationReady: true, nativeAdoptionVerified: false };
-    exclusive3(join35(operation, "receipt.json"), JSON.stringify(receipt) + `
+    exclusive3(join34(operation, "receipt.json"), JSON.stringify(receipt) + `
 `);
     return receipt;
   } catch {
@@ -43514,7 +43514,7 @@ var init_native_readiness_binding = __esm(() => {
 
 // src/cli/index.tsx
 init_native_safety_registration();
-import { resolve as resolve23 } from "path";
+import { resolve as resolve21 } from "path";
 
 // src/lib/claude-safety-check.ts
 init_native_safety();
@@ -43633,25 +43633,16 @@ async function verifyClaudeSafetyConfiguration(options = {}, dependencies = {})
 // src/cli/index.tsx
 init_codex_safety_trust();
 
-// ../events/dist/commander.js
+// ../../../../validation/build/apps/hooks/node_modules/@hasna/events/dist/commander.js
 import { chmod, mkdir, readFile as readFile2, rename, writeFile } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
-import { existsSync as existsSync22 } from "fs";
-import { join as join22 } from "path";
 import { existsSync as existsSync13 } from "fs";
 import { homedir as homedir13 } from "os";
-import { join as join20, resolve as resolve20 } from "path";
-import { homedir as pathsResolverHomedir3 } from "os";
-import { join as pathsResolverJoin3 } from "path";
+import { join as join20 } from "path";
 import { createHmac, timingSafeEqual } from "crypto";
-import { lookup as dnsLookup } from "dns/promises";
-import { isIP } from "net";
 import { randomUUID as randomUUID7 } from "crypto";
 import { spawn as spawn3 } from "child_process";
-import { request as nodeHttpRequest } from "http";
-import { request as nodeHttpsRequest } from "https";
 import { randomUUID as randomUUID22 } from "crypto";
-import { createRequire as createRequire2 } from "module";
 function getPathValue(input2, path) {
   return path.split(".").reduce((value, part) => {
     if (value && typeof value === "object" && part in value) {
@@ -43747,103 +43738,13 @@ function channelMatchesEvent(channel, event) {
     return true;
   return channel.filters.some((filter) => eventMatchesFilter(event, filter));
 }
-var PATHS_RESOLVER_KIND_ENV2 = {
-  config: "HASNA_CONFIG_HOME",
-  data: "HASNA_DATA_HOME",
-  state: "HASNA_STATE_HOME",
-  cache: "HASNA_CACHE_HOME"
-};
-var PATHS_RESOLVER_APP_SLUG_RE3 = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-function pathsResolverAssertApp3(app) {
-  if (typeof app !== "string" || app.length === 0) {
-    throw new TypeError("paths: app must be a non-empty string");
-  }
-  if (!PATHS_RESOLVER_APP_SLUG_RE3.test(app)) {
-    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
-  }
-}
-function pathsResolverAssertKind2(kind) {
-  if (!Object.keys(PATHS_RESOLVER_KIND_ENV2).includes(kind)) {
-    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV2).join(", ")}`);
-  }
-}
-function pathsResolverBaseDir2(kind, options) {
-  pathsResolverAssertKind2(kind);
-  const env = options.env ?? process.env;
-  const override = env[PATHS_RESOLVER_KIND_ENV2[kind]];
-  if (typeof override === "string" && override.length > 0)
-    return override;
-  const home = options.home ?? pathsResolverHomedir3();
-  const platform = options.platform ?? process.platform;
-  if (platform === "darwin") {
-    switch (kind) {
-      case "config":
-      case "data":
-        return pathsResolverJoin3(home, "Library", "Application Support", "Hasna");
-      case "cache":
-        return pathsResolverJoin3(home, "Library", "Caches", "Hasna");
-      case "state":
-        return pathsResolverJoin3(home, "Library", "Logs", "Hasna");
-    }
-  }
-  switch (kind) {
-    case "config":
-      return pathsResolverJoin3(home, ".config", "hasna");
-    case "data":
-      return pathsResolverJoin3(home, ".local", "share", "hasna");
-    case "state":
-      return pathsResolverJoin3(home, ".local", "state", "hasna");
-    case "cache":
-      return pathsResolverJoin3(home, ".cache", "hasna");
-  }
-}
-function pathsResolverResolve2(kind, options) {
-  pathsResolverAssertApp3(options.app);
-  const appSegment = options.internal === true ? pathsResolverJoin3("internal", options.app) : options.app;
-  return pathsResolverJoin3(pathsResolverBaseDir2(kind, options), appSegment);
-}
-function dataDir3(options) {
-  return pathsResolverResolve2("data", options);
-}
 var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR";
 var HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME";
-var EVENTS_STORE_SENTINEL_FILE = "events.json";
-function effectiveHome2() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || homedir13();
-}
-function legacyHomeDir() {
-  return join20(effectiveHome2(), ".hasna", "events");
-}
-function resolverHome() {
-  return dataDir3({ app: "events", home: effectiveHome2() || undefined });
-}
-function adoptResolverHome(resolved, env = process.env) {
-  const dataOverride = env.HASNA_DATA_HOME;
-  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
-    return true;
-  return existsSync13(join20(resolved, EVENTS_STORE_SENTINEL_FILE));
-}
-function exactEventsHome() {
-  const dir = process.env[HASNA_EVENTS_DIR_ENV];
-  if (dir && dir.trim())
-    return dir.trim();
-  const home = process.env[HASNA_EVENTS_HOME_ENV];
-  if (home && home.trim())
-    return home.trim();
-  return;
-}
-function getEventsHome() {
-  const exact2 = exactEventsHome();
-  if (exact2)
-    return resolve20(exact2);
-  const resolved = resolverHome();
-  return adoptResolverHome(resolved) ? resolve20(resolved) : resolve20(legacyHomeDir());
-}
 var LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:";
 var DEFAULT_EVENT_PAGE_LIMIT = 100;
 var MAX_EVENT_PAGE_LIMIT = 1000;
 function getEventsDataDir(override) {
-  return override || getEventsHome();
+  return override || process.env[HASNA_EVENTS_DIR_ENV] || process.env[HASNA_EVENTS_HOME_ENV] || join20(homedir13(), ".hasna", "events");
 }
 function getActiveEventsDirEnv() {
   if (process.env[HASNA_EVENTS_DIR_ENV])
@@ -43859,12 +43760,12 @@ class JsonEventsStore {
   channelsPath;
   eventsPath;
   deliveriesPath;
-  constructor(dataDir22 = getEventsDataDir()) {
-    this.dataDir = dataDir22;
-    this.runtime = localJsonRuntime(dataDir22);
-    this.channelsPath = join22(dataDir22, "channels.json");
-    this.eventsPath = join22(dataDir22, "events.json");
-    this.deliveriesPath = join22(dataDir22, "deliveries.json");
+  constructor(dataDir3 = getEventsDataDir()) {
+    this.dataDir = dataDir3;
+    this.runtime = localJsonRuntime(dataDir3);
+    this.channelsPath = join20(dataDir3, "channels.json");
+    this.eventsPath = join20(dataDir3, "events.json");
+    this.deliveriesPath = join20(dataDir3, "deliveries.json");
   }
   async init() {
     await mkdir(this.dataDir, { recursive: true, mode: 448 });
@@ -43981,7 +43882,7 @@ class JsonEventsStore {
     };
   }
   async ensureArrayFile(path) {
-    if (!existsSync22(path)) {
+    if (!existsSync13(path)) {
       await writeFile(path, `[]
 `, { encoding: "utf-8", mode: 384 });
     }
@@ -44011,7 +43912,7 @@ class JsonEventsStore {
     });
   }
 }
-function localJsonRuntime(dataDir22 = getEventsDataDir()) {
+function localJsonRuntime(dataDir3 = getEventsDataDir()) {
   return {
     mode: "local-files",
     name: "json-events-store",
@@ -44024,7 +43925,7 @@ function localJsonRuntime(dataDir22 = getEventsDataDir()) {
     durable: true,
     idempotency: "best-effort-local",
     replayCursors: true,
-    description: `Local JSON files in ${dataDir22}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+    description: `Local JSON files in ${dataDir3}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
   };
 }
 function encodeLocalJsonEventCursor(offset, options = {}) {
@@ -44088,8 +43989,8 @@ function assertCursorFilter(name, cursorValue, optionValue) {
 function findEventByIdentity(events2, identity3) {
   return events2.find((event) => identity3.id !== undefined && event.id === identity3.id || identity3.dedupeKey !== undefined && event.dedupeKey === identity3.dedupeKey);
 }
-async function getEventsStatus(dataDir22) {
-  const store = new JsonEventsStore(dataDir22);
+async function getEventsStatus(dataDir3) {
+  const store = new JsonEventsStore(dataDir3);
   await store.init();
   const [channels, events2, deliveries] = await Promise.all([
     store.listChannels(),
@@ -44131,9 +44032,9 @@ async function getEventsStatus(dataDir22) {
     }
   };
 }
-function statusFile(dataDir22, fileName, records) {
-  const path = join22(dataDir22, fileName);
-  return { path, exists: existsSync22(path), records };
+function statusFile(dataDir3, fileName, records) {
+  const path = join20(dataDir3, fileName);
+  return { path, exists: existsSync13(path), records };
 }
 var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
 function buildSignatureBase(timestamp, body) {
@@ -44143,214 +44044,6 @@ function signPayload(secret, timestamp, body) {
   const digest4 = createHmac("sha256", secret).update(buildSignatureBase(timestamp, body)).digest("hex");
   return `sha256=${digest4}`;
 }
-var DEFAULT_MAX_REDIRECTS = 5;
-var IPV4_PRIVATE_RANGES = [
-  [0, 16777215],
-  [167772160, 184549375],
-  [1681915904, 1686110207],
-  [2130706432, 2147483647],
-  [2851995648, 2852061183],
-  [2886729728, 2887778303],
-  [3221225472, 3221225727],
-  [3221225984, 3221226239],
-  [3227017984, 3227018239],
-  [3232235520, 3232301055],
-  [3323068416, 3323199487],
-  [3325256704, 3325256959],
-  [3405803776, 3405804031],
-  [3758096384, 4294967295]
-];
-var IPV6_SPECIAL_PREFIXES = [
-  { groups: [0, 0, 0, 0, 0, 0, 0, 0], bits: 128 },
-  { groups: [0, 0, 0, 0, 0, 0, 0, 1], bits: 128 },
-  { groups: [0, 0, 0, 0, 0, 65535, 0, 0], bits: 96 },
-  { groups: [100, 65435, 0, 0, 0, 0, 0, 0], bits: 96 },
-  { groups: [256, 0, 0, 0, 0, 0, 0, 0], bits: 64 },
-  { groups: [8193, 0, 0, 0, 0, 0, 0, 0], bits: 32 },
-  { groups: [8193, 2, 0, 0, 0, 0, 0, 0], bits: 48 },
-  { groups: [8193, 16, 0, 0, 0, 0, 0, 0], bits: 28 },
-  { groups: [8193, 3512, 0, 0, 0, 0, 0, 0], bits: 32 },
-  { groups: [8194, 0, 0, 0, 0, 0, 0, 0], bits: 16 },
-  { groups: [16383, 0, 0, 0, 0, 0, 0, 0], bits: 20 },
-  { groups: [64512, 0, 0, 0, 0, 0, 0, 0], bits: 7 },
-  { groups: [65152, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
-  { groups: [65216, 0, 0, 0, 0, 0, 0, 0], bits: 10 },
-  { groups: [65280, 0, 0, 0, 0, 0, 0, 0], bits: 8 }
-];
-function isPrivateAddress(address) {
-  const normalized = stripZoneId(address);
-  const version2 = isIP(normalized);
-  if (version2 === 4) {
-    const integer3 = ipv4ToInt(normalized);
-    if (integer3 === undefined)
-      return true;
-    return IPV4_PRIVATE_RANGES.some(([low, high]) => integer3 >= low && integer3 <= high);
-  }
-  if (version2 === 6) {
-    const groups = ipv6Groups(normalized);
-    if (!groups)
-      return true;
-    for (const prefix3 of IPV6_SPECIAL_PREFIXES) {
-      if (!ipv6MatchesPrefix(groups, prefix3.groups, prefix3.bits))
-        continue;
-      if (prefix3.bits === 96 && groups[5] === 65535) {
-        return isPrivateAddress(ipv4IntToString(groups[6] << 16 | groups[7]));
-      }
-      if (prefix3.bits === 16 && groups[0] === 8194) {
-        return isPrivateAddress(ipv4IntToString(groups[1] << 16 | groups[2]));
-      }
-      return true;
-    }
-    return false;
-  }
-  return true;
-}
-async function resolveWebhookTarget(url2, policy = {}) {
-  const hostname3 = normalizeHostname(url2.hostname);
-  const allowlist = (policy.allowPrivateHosts ?? []).map((entry) => normalizeHostname(entry.toLowerCase()));
-  if (allowlist.includes(hostname3)) {
-    const version22 = isIP(hostname3);
-    if (version22 === 4 || version22 === 6) {
-      return { hostname: hostname3, addresses: [hostname3] };
-    }
-    const lookup2 = policy.lookup ?? defaultTargetLookup;
-    let resolved2;
-    try {
-      resolved2 = await lookup2(hostname3);
-    } catch {
-      throw new Error(`Webhook target ${hostname3} could not be resolved`);
-    }
-    if (!Array.isArray(resolved2) || resolved2.length === 0) {
-      throw new Error(`Webhook target ${hostname3} resolved to no addresses`);
-    }
-    const addresses = resolved2.map((entry) => normalizeHostname(entry.address));
-    return { hostname: hostname3, addresses };
-  }
-  const version2 = isIP(hostname3);
-  if (version2 === 4 || version2 === 6) {
-    if (isPrivateAddress(hostname3)) {
-      throw new Error(`Webhook target ${hostname3} is a private or special-use address`);
-    }
-    return { hostname: hostname3, addresses: [hostname3] };
-  }
-  const lookup = policy.lookup ?? defaultTargetLookup;
-  let resolved;
-  try {
-    resolved = await lookup(hostname3);
-  } catch {
-    throw new Error(`Webhook target ${hostname3} could not be resolved`);
-  }
-  if (!Array.isArray(resolved) || resolved.length === 0) {
-    throw new Error(`Webhook target ${hostname3} resolved to no addresses`);
-  }
-  const allowed = [];
-  for (const entry of resolved) {
-    const address = normalizeHostname(entry.address);
-    if (isPrivateAddress(address)) {
-      if (allowlist.includes(address)) {
-        allowed.push(address);
-        continue;
-      }
-      throw new Error(`Webhook target ${hostname3} resolves to private or special-use address ${address}`);
-    }
-    allowed.push(address);
-  }
-  if (allowed.length === 0) {
-    throw new Error(`Webhook target ${hostname3} resolved to no public addresses`);
-  }
-  return { hostname: hostname3, addresses: allowed };
-}
-function normalizeMaxRedirects(value) {
-  if (value === undefined)
-    return DEFAULT_MAX_REDIRECTS;
-  if (!Number.isInteger(value) || value < 0)
-    throw new Error("webhookTargetPolicy.maxRedirects must be a non-negative integer");
-  return value;
-}
-var defaultTargetLookup = async (hostname3) => {
-  return dnsLookup(hostname3, { all: true, verbatim: false });
-};
-function normalizeHostname(hostname3) {
-  const lower = hostname3.toLowerCase();
-  if (lower.startsWith("[") && lower.endsWith("]"))
-    return lower.slice(1, -1);
-  return lower;
-}
-function stripZoneId(address) {
-  const percent = address.indexOf("%");
-  return percent === -1 ? address : address.slice(0, percent);
-}
-function ipv4ToInt(address) {
-  const parts = address.split(".");
-  if (parts.length !== 4)
-    return;
-  let value = 0;
-  for (const part of parts) {
-    if (!/^\d{1,3}$/.test(part))
-      return;
-    const octet = Number(part);
-    if (octet > 255)
-      return;
-    value = value << 8 | octet;
-  }
-  return value >>> 0;
-}
-function ipv4IntToString(integer3) {
-  return [
-    integer3 >>> 24 & 255,
-    integer3 >>> 16 & 255,
-    integer3 >>> 8 & 255,
-    integer3 & 255
-  ].join(".");
-}
-function ipv6Groups(address) {
-  const raw = stripZoneId(address);
-  const doubleColon = raw.indexOf("::");
-  const headText = doubleColon === -1 ? raw : raw.slice(0, doubleColon);
-  const tailText = doubleColon === -1 ? "" : raw.slice(doubleColon + 2);
-  const parseGroups = (text3) => {
-    if (text3 === "")
-      return [];
-    const out = [];
-    for (const part of text3.split(":")) {
-      if (part.includes(".")) {
-        const v4 = ipv4ToInt(part);
-        if (v4 === undefined)
-          return;
-        out.push(v4 >>> 16 & 65535, v4 & 65535);
-      } else {
-        if (!/^[0-9a-fA-F]{1,4}$/.test(part))
-          return;
-        out.push(parseInt(part, 16));
-      }
-    }
-    return out;
-  };
-  const head = parseGroups(headText);
-  if (!head)
-    return;
-  const tail = parseGroups(tailText);
-  if (!tail)
-    return;
-  const total = head.length + tail.length;
-  if (doubleColon === -1) {
-    return total === 8 ? head : undefined;
-  }
-  if (total >= 8)
-    return;
-  return [...head, ...new Array(8 - total).fill(0), ...tail];
-}
-function ipv6MatchesPrefix(groups, prefixGroups, prefixBits) {
-  let remaining = prefixBits;
-  for (let index = 0;index < prefixGroups.length && remaining > 0; index += 1) {
-    const take = Math.min(16, remaining);
-    const mask = 65535 << 16 - take & 65535;
-    if ((groups[index] & mask) !== (prefixGroups[index] & mask))
-      return false;
-    remaining -= take;
-  }
-  return true;
-}
 function now() {
   return new Date().toISOString();
 }
@@ -44381,18 +44074,9 @@ function buildWebhookRequest(event, channel, options = {}) {
   }
   return { body, headers };
 }
-function normalizeWebhookUrl(raw) {
-  const url2 = new URL(raw);
-  if (url2.username !== "" || url2.password !== "") {
-    url2.username = "";
-    url2.password = "";
-  }
-  return url2.toString();
-}
 async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
-  const webhookUrl = normalizeWebhookUrl(channel.webhook.url);
   const startedAt = now();
   let secret = channel.webhook.secret;
   if (channel.webhook.secretRef) {
@@ -44409,14 +44093,10 @@ async function dispatchWebhook(event, channel, options = {}) {
   }
   const timestamp = (options.now?.() ?? new Date).toISOString();
   const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp });
-  const validateTargets = options.webhookTargetPolicy !== undefined || options.fetchImpl === undefined;
-  if (validateTargets) {
-    return dispatchValidatedWebhook(event, channel, { body, headers, startedAt, options });
-  }
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
-    const response = await (options.fetchImpl ?? fetch)(webhookUrl, {
+    const response = await (options.fetchImpl ?? fetch)(channel.webhook.url, {
       method: "POST",
       headers,
       body,
@@ -44444,130 +44124,6 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
-function isRedirectStatus(status) {
-  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
-}
-function redirectKeepsBody(status) {
-  return status === 307 || status === 308;
-}
-async function pinnedNativeRequest(target, addresses, method, headers, body, signal, tls) {
-  const isHttps = target.protocol === "https:";
-  if (!isHttps && target.protocol !== "http:") {
-    throw new Error(`Webhook target uses unsupported protocol ${target.protocol}`);
-  }
-  const defaultPort = isHttps ? 443 : 80;
-  const port = target.port ? Number(target.port) : defaultPort;
-  const requestOptions = {
-    hostname: target.hostname,
-    port,
-    path: `${target.pathname}${target.search}`,
-    method,
-    headers,
-    ...tls?.ca ? { ca: tls.ca } : {},
-    lookup: (hostname3, _options, callback) => {
-      const entries = addresses.map((address) => ({
-        address,
-        family: address.includes(":") ? 6 : 4
-      }));
-      callback(null, entries);
-    }
-  };
-  return new Promise((resolve23, reject) => {
-    const request = isHttps ? nodeHttpsRequest(requestOptions, onResponse) : nodeHttpRequest(requestOptions, onResponse);
-    const onAbort = () => {
-      const error61 = new Error("The operation was aborted.");
-      error61.name = "AbortError";
-      request.destroy(error61);
-    };
-    if (signal.aborted)
-      onAbort();
-    else
-      signal.addEventListener("abort", onAbort, { once: true });
-    request.on("error", reject);
-    if (body !== undefined)
-      request.write(body);
-    request.end();
-    function onResponse(response) {
-      const chunks = [];
-      response.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
-      response.on("error", reject);
-      response.on("end", () => {
-        const headersRecord = {};
-        for (const [name, value] of Object.entries(response.headers)) {
-          if (typeof value === "string")
-            headersRecord[name] = value;
-          else if (Array.isArray(value))
-            headersRecord[name] = value.join(", ");
-        }
-        resolve23(new Response(Buffer.concat(chunks), { status: response.statusCode ?? 200, headers: headersRecord }));
-      });
-    }
-  });
-}
-async function dispatchValidatedWebhook(event, channel, input2) {
-  const { body, headers, startedAt, options } = input2;
-  const webhook = channel.webhook;
-  if (!webhook)
-    throw new Error(`Channel ${channel.id} has no webhook config`);
-  const policy = options.webhookTargetPolicy ?? {};
-  const maxRedirects = normalizeMaxRedirects(policy.maxRedirects);
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), webhook.timeoutMs ?? 15000);
-  try {
-    let target = new URL(normalizeWebhookUrl(webhook.url));
-    let requestHeaders = headers;
-    let method = "POST";
-    let requestBody = body;
-    let redirectsFollowed = 0;
-    for (;; ) {
-      const resolved = await resolveWebhookTarget(target, policy).catch((error61) => {
-        throw new Error(`Webhook target rejected by SSRF guard: ${error61.message}`);
-      });
-      const response = options.fetchImpl ? await options.fetchImpl(target, {
-        method,
-        headers: requestHeaders,
-        body: requestBody,
-        signal: controller.signal,
-        redirect: "manual"
-      }) : await pinnedNativeRequest(target, resolved.addresses, method, requestHeaders, requestBody, controller.signal, options.tls);
-      const location = response.headers.get("location");
-      if (isRedirectStatus(response.status) && location) {
-        if (redirectsFollowed >= maxRedirects) {
-          return failedAttempt(startedAt, `Webhook target exceeded ${maxRedirects} redirects`);
-        }
-        redirectsFollowed += 1;
-        const next = new URL(location, target);
-        target = next;
-        if (!redirectKeepsBody(response.status)) {
-          method = "GET";
-          requestBody = undefined;
-          requestHeaders = Object.fromEntries(Object.entries(requestHeaders).filter(([name]) => name.toLowerCase() !== "content-type" && name.toLowerCase() !== "content-length"));
-        }
-        continue;
-      }
-      const responseBody = truncate(await response.text());
-      return {
-        attempt: 1,
-        status: response.ok ? "success" : "failed",
-        startedAt,
-        completedAt: now(),
-        responseStatus: response.status,
-        responseBody,
-        error: response.ok ? undefined : `Webhook returned HTTP ${response.status}`
-      };
-    }
-  } catch (error61) {
-    return {
-      attempt: 1,
-      status: "failed",
-      startedAt,
-      completedAt: now(),
-      error: error61 instanceof Error ? error61.message : String(error61)
-    };
-  } finally {
-    clearTimeout(timeout);
-  }
-}
 function failedAttempt(startedAt, error61) {
   return {
     attempt: 1,
@@ -44596,7 +44152,7 @@ async function dispatchCommand(event, channel) {
     HASNA_EVENT_SCHEMA_VERSION: event.schemaVersion,
     HASNA_EVENT_JSON: eventJson
   };
-  return new Promise((resolve23) => {
+  return new Promise((resolve16) => {
     const child = spawn3(channel.command.command, channel.command.args ?? [], {
       cwd: channel.command.cwd,
       env,
@@ -44614,7 +44170,7 @@ async function dispatchCommand(event, channel) {
     });
     child.on("error", (error61) => {
       clearTimeout(timeout);
-      resolve23({
+      resolve16({
         attempt: 1,
         status: "failed",
         startedAt,
@@ -44627,7 +44183,7 @@ async function dispatchCommand(event, channel) {
     child.on("close", (code2, signal) => {
       clearTimeout(timeout);
       const success2 = code2 === 0;
-      resolve23({
+      resolve16({
         attempt: 1,
         status: success2 ? "success" : "failed",
         startedAt,
@@ -44749,22 +44305,6 @@ function setPath(input2, path, replacement) {
   if (last && last in cursor)
     cursor[last] = replacement;
 }
-var MAX_PACKAGE_BYTES2 = 1024 * 1024;
-var MAX_CREDENTIAL_FILE_BYTES2 = 64 * 1024;
-var INSPECT_CUSTOM2 = Symbol.for("nodejs.util.inspect.custom");
-var CREDENTIAL_SEAL2 = Symbol.for("hasna:contracts:sealedCredential");
-var AMBIENT_ENVIRONMENT2 = Symbol.for("hasna:contracts:ambientClientEnvironment");
-var requireSecretsSdk2 = createRequire2(import.meta.url);
-var IDEMPOTENT_METHODS2 = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
-var AUTHORITY_OVERRIDE_HEADERS2 = new Set([
-  "host",
-  ":authority",
-  "forwarded",
-  "x-forwarded-host",
-  "x-original-host"
-]);
-var MAX_ENVELOPE_BYTES = 256 * 1024;
-var MAX_REQUEST_BYTES = MAX_ENVELOPE_BYTES * 2 + 8192;
 function createEvent(input2) {
   return {
     id: input2.id ?? randomUUID22(),
@@ -44793,9 +44333,7 @@ class EventsClient {
     this.transportOptions = {
       fetchImpl: options.fetchImpl,
       secretResolver: options.secretResolver,
-      now: options.now,
-      tls: options.tls,
-      webhookTargetPolicy: options.webhookTargetPolicy
+      now: options.now
     };
     this.catalog = options.catalog ?? defaultEventTypeCatalog;
     this.validateCatalogTypes = options.validateCatalogTypes ?? false;
@@ -45082,13 +44620,6 @@ function parseMatcherExpression(value, label) {
     negated: false
   };
 }
-function webhookTargetPolicyFromEnv() {
-  const value = process.env.HASNA_EVENTS_ALLOW_PRIVATE_WEBHOOK_TARGETS;
-  if (!value)
-    return;
-  const hosts = value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
-  return hosts.length > 0 ? { allowPrivateHosts: hosts } : undefined;
-}
 var DEFAULT_EVENT_LIST_LIMIT = 100;
 function parseJsonObject(value, fallback) {
   if (!value)
@@ -45114,7 +44645,7 @@ function parseHeaders(values) {
 function createClient(options) {
   if (options.createClient)
     return options.createClient();
-  return new EventsClient({ store: new JsonEventsStore(options.dataDir), webhookTargetPolicy: webhookTargetPolicyFromEnv() });
+  return new EventsClient({ store: new JsonEventsStore(options.dataDir) });
 }
 function print(value, json2, text3) {
   if (json2)
@@ -45195,8 +44726,6 @@ function registerChannelCommands(program2, options) {
         metadata: parseJsonObject(actionOptions.metadata, {})
       }, { honorFilters: actionOptions.honorFilters });
       print(result, json2, `${result.status}: ${result.channelId}`);
-      if (result.status === "failed")
-        process.exitCode = 1;
     } catch (error61) {
       fail(error61, json2);
     }
@@ -45289,7 +44818,7 @@ function replaySummary(events2, deliveries, nextCursor) {
 // src/cli/index.tsx
 import { render } from "ink";
 
-// ../../node_modules/.bun/commander@12.1.0/node_modules/commander/esm.mjs
+// ../../../../validation/build/apps/hooks/node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
   program: program2,
@@ -45308,18 +44837,18 @@ var {
 // src/cli/index.tsx
 import chalk2 from "chalk";
 import { existsSync as existsSync18, readFileSync as readFileSync27, rmSync as rmSync6 } from "fs";
-import { join as join36, dirname as dirname28 } from "path";
+import { join as join35, dirname as dirname28 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 
 // src/cli/components/App.tsx
 import { useState as useState7 } from "react";
 import { Box as Box8, Text as Text10, useApp, useInput as useInput5 } from "ink";
 
-// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Indicator.js
+// ../../../../validation/build/apps/hooks/node_modules/ink-select-input/build/Indicator.js
 import React from "react";
 import { Box, Text } from "ink";
 
-// ../../node_modules/.bun/is-unicode-supported@2.1.0/node_modules/is-unicode-supported/index.js
+// ../../../../validation/build/apps/hooks/node_modules/is-unicode-supported/index.js
 import process3 from "process";
 function isUnicodeSupported() {
   const { env } = process3;
@@ -45330,7 +44859,7 @@ function isUnicodeSupported() {
   return Boolean(env.WT_SESSION) || Boolean(env.TERMINUS_SUBLIME) || env.ConEmuTask === "{cmd::Cmder}" || TERM_PROGRAM === "Terminus-Sublime" || TERM_PROGRAM === "vscode" || TERM === "xterm-256color" || TERM === "alacritty" || TERM === "rxvt-unicode" || TERM === "rxvt-unicode-256color" || env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
 
-// ../../node_modules/.bun/figures@6.1.0/node_modules/figures/index.js
+// ../../../../validation/build/apps/hooks/node_modules/figures/index.js
 var common2 = {
   circleQuestionMark: "(?)",
   questionMarkPrefix: "(?)",
@@ -45606,23 +45135,23 @@ var figures = shouldUseMain ? mainSymbols : fallbackSymbols;
 var figures_default = figures;
 var replacements = Object.entries(specialMainSymbols);
 
-// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Indicator.js
+// ../../../../validation/build/apps/hooks/node_modules/ink-select-input/build/Indicator.js
 function Indicator({ isSelected = false }) {
   return React.createElement(Box, { marginRight: 1 }, isSelected ? React.createElement(Text, { color: "blue" }, figures_default.pointer) : React.createElement(Text, null, " "));
 }
 var Indicator_default = Indicator;
-// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/Item.js
+// ../../../../validation/build/apps/hooks/node_modules/ink-select-input/build/Item.js
 import * as React2 from "react";
 import { Text as Text2 } from "ink";
 function Item({ isSelected = false, label }) {
   return React2.createElement(Text2, { color: isSelected ? "blue" : undefined }, label);
 }
 var Item_default = Item;
-// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/SelectInput.js
+// ../../../../validation/build/apps/hooks/node_modules/ink-select-input/build/SelectInput.js
 import { isDeepStrictEqual } from "util";
 import React3, { useState, useEffect, useRef, useCallback } from "react";
 
-// ../../node_modules/.bun/to-rotated@1.0.0/node_modules/to-rotated/index.js
+// ../../../../validation/build/apps/hooks/node_modules/to-rotated/index.js
 function toRotated(array3, steps) {
   if (!Array.isArray(array3)) {
     throw new TypeError(`Expected an array, got \`${typeof array3}\`.`);
@@ -45644,7 +45173,7 @@ function toRotated(array3, steps) {
   ];
 }
 
-// ../../node_modules/.bun/ink-select-input@6.2.0+fa875fef9f949ebd/node_modules/ink-select-input/build/SelectInput.js
+// ../../../../validation/build/apps/hooks/node_modules/ink-select-input/build/SelectInput.js
 import { Box as Box2, useInput } from "ink";
 function SelectInput({ items = [], isFocused = true, initialIndex = 0, indicatorComponent = Indicator_default, itemComponent = Item_default, limit: customLimit, onSelect, onHighlight }) {
   const hasLimit = typeof customLimit === "number" && items.length > customLimit;
@@ -45940,7 +45469,7 @@ function HookSelect({
 import { useState as useState4, useEffect as useEffect3 } from "react";
 import { Box as Box6, Text as Text7, useInput as useInput4 } from "ink";
 
-// ../../node_modules/.bun/ink-text-input@6.0.0+fa875fef9f949ebd/node_modules/ink-text-input/build/index.js
+// ../../../../validation/build/apps/hooks/node_modules/ink-text-input/build/index.js
 import React5, { useState as useState3, useEffect as useEffect2 } from "react";
 import { Text as Text6, useInput as useInput3 } from "ink";
 import chalk from "chalk";
@@ -46118,7 +45647,7 @@ function SearchView({
 import { useState as useState6, useEffect as useEffect5 } from "react";
 import { Box as Box7, Text as Text9 } from "ink";
 
-// ../../node_modules/.bun/ink-spinner@5.0.0+fa875fef9f949ebd/node_modules/ink-spinner/build/index.js
+// ../../../../validation/build/apps/hooks/node_modules/ink-spinner/build/index.js
 var import_cli_spinners = __toESM(require_cli_spinners(), 1);
 import React7, { useState as useState5, useEffect as useEffect4 } from "react";
 import { Text as Text8 } from "ink";
@@ -46485,10 +46014,10 @@ init_native_safety();
 
 // src/lib/sumi-binding.ts
 import { homedir as homedir14 } from "os";
-import { join as join27, sep as sep3 } from "path";
+import { join as join24, sep as sep3 } from "path";
 
 // hooks/hook-trash-guard/src/binary.ts
-import { dirname as dirname21, isAbsolute as isAbsolute20, join as join24, resolve as resolve21 } from "path";
+import { dirname as dirname21, isAbsolute as isAbsolute20, join as join22, resolve as resolve20 } from "path";
 import { accessSync, closeSync as closeSync19, constants as constants18, fstatSync as fstatSync18, lstatSync as lstatSync23, openSync as openSync19, readFileSync as readFileSync17, readlinkSync as readlinkSync3, readSync as readSync3, realpathSync as realpathSync11, statSync } from "fs";
 import { spawnSync } from "child_process";
 function trustedOwner(uid2) {
@@ -46510,7 +46039,7 @@ function safeExecutableFile(path, systemBinAlias = false) {
         parent = dirname21(parent);
         continue;
       }
-      const next = join24(parent, part), info2 = lstatSync23(next);
+      const next = join22(parent, part), info2 = lstatSync23(next);
       if (systemBinAlias && next === "/bin" && info2.isSymbolicLink() && info2.uid === 0) {
         const target = realpathSync11(next);
         if (!safeBinaryDirectory(target))
@@ -46522,7 +46051,7 @@ function safeExecutableFile(path, systemBinAlias = false) {
         return false;
       parent = next;
     }
-    const candidate = join24(parent, name), info = lstatSync23(candidate);
+    const candidate = join22(parent, name), info = lstatSync23(candidate);
     if (!trustedOwner(info.uid))
       return false;
     if (info.isSymbolicLink()) {
@@ -46535,9 +46064,9 @@ function safeExecutableFile(path, systemBinAlias = false) {
   return false;
 }
 function safeInterpreterSearchDirectory(path) {
-  if (!isAbsolute20(path) || resolve21(path) !== (path.replace(/\/+$/, "") || "/"))
+  if (!isAbsolute20(path) || resolve20(path) !== (path.replace(/\/+$/, "") || "/"))
     return false;
-  for (let cursor = resolve21(path);; cursor = dirname21(cursor)) {
+  for (let cursor = resolve20(path);; cursor = dirname21(cursor)) {
     try {
       lstatSync23(cursor);
       return safeBinaryDirectory(cursor);
@@ -46569,7 +46098,7 @@ function safeScriptInterpreter(executable2, pathValue) {
   for (const dir of pathValue.split(":").slice(0, 64)) {
     if (!safeInterpreterSearchDirectory(dir))
       return false;
-    const interpreter = resolve21(dir, "bun");
+    const interpreter = resolve20(dir, "bun");
     try {
       if (!statSync(interpreter).isFile())
         continue;
@@ -46604,7 +46133,7 @@ function inspectTrashBinary(env = process.env) {
   for (const dir of pathValue.split(":").slice(0, 64)) {
     if (!isAbsolute20(dir) || Date.now() >= deadline)
       continue;
-    const candidate = resolve21(dir, "trash");
+    const candidate = resolve20(dir, "trash");
     try {
       const stat2 = statSync(candidate);
       if (!stat2.isFile() || !trustedOwner(stat2.uid) || (stat2.mode & 73) === 0 || (stat2.mode & 18) !== 0) {
@@ -46612,7 +46141,7 @@ function inspectTrashBinary(env = process.env) {
         continue;
       }
       const executable2 = realpathSync11(candidate);
-      if (!safeBinaryDirectory(resolve21(dir)) || !safeBinaryDirectory(dirname21(executable2))) {
+      if (!safeBinaryDirectory(resolve20(dir)) || !safeBinaryDirectory(dirname21(executable2))) {
         reject("unsafe_directory");
         continue;
       }
@@ -46620,15 +46149,15 @@ function inspectTrashBinary(env = process.env) {
         reject("unsafe_directory");
         continue;
       }
-      const packageRoot = resolve21(dirname21(executable2), "../..");
-      const manifestPath = join24(packageRoot, "package.json");
+      const packageRoot = resolve20(dirname21(executable2), "../..");
+      const manifestPath = join22(packageRoot, "package.json");
       const manifestStat = statSync(manifestPath);
       if (!manifestStat.isFile() || !trustedOwner(manifestStat.uid) || manifestStat.size > 16384 || (manifestStat.mode & 18) !== 0 || lstatSync23(manifestPath).isSymbolicLink()) {
         reject("unsafe_manifest");
         continue;
       }
       const manifest = JSON.parse(readFileSync17(manifestPath, "utf8"));
-      if (manifest.name !== "@hasna/trash" || typeof manifest.version !== "string" || typeof manifest.bin?.trash !== "string" || realpathSync11(resolve21(packageRoot, manifest.bin.trash)) !== executable2) {
+      if (manifest.name !== "@hasna/trash" || typeof manifest.version !== "string" || typeof manifest.bin?.trash !== "string" || realpathSync11(resolve20(packageRoot, manifest.bin.trash)) !== executable2) {
         reject("unrecognized_package");
         continue;
       }
@@ -46673,7 +46202,7 @@ function failure(code2, reason) {
   return { ok: false, target: "sumi", code: code2, ...reason ? { reason: reason.slice(0, 300) } : {} };
 }
 function nativeSafetyBindingDurable(worker, home) {
-  return !(worker.startsWith(join27(home, ".bun") + sep3) || worker.includes(`${sep3}node_modules${sep3}.bun${sep3}`));
+  return !(worker.startsWith(join24(home, ".bun") + sep3) || worker.includes(`${sep3}node_modules${sep3}.bun${sep3}`));
 }
 async function provisionSumiSafetyBinding(options = {}) {
   const home = options.home ?? homedir14();
@@ -46748,7 +46277,7 @@ init_transport2();
 init_db();
 import { jsxDEV as jsxDEV8 } from "react/jsx-dev-runtime";
 var __dirname4 = dirname28(fileURLToPath6(import.meta.url));
-var pkgPath = existsSync18(join36(__dirname4, "..", "package.json")) ? join36(__dirname4, "..", "package.json") : join36(__dirname4, "..", "..", "package.json");
+var pkgPath = existsSync18(join35(__dirname4, "..", "package.json")) ? join35(__dirname4, "..", "package.json") : join35(__dirname4, "..", "..", "package.json");
 var pkg2 = JSON.parse(readFileSync27(pkgPath, "utf-8"));
 var program3 = new Command;
 function resolveScope(options) {
@@ -46981,7 +46510,7 @@ program3.command("init").description("Register a new agent profile with a unique
   if (profile.name) {
     console.log(`  ${chalk2.dim("Name:")}       ${profile.name}`);
   }
-  console.log(`  ${chalk2.dim("Profile:")}    ${join36(getProfilesDir(), `${profile.agent_id}.json`)}`);
+  console.log(`  ${chalk2.dim("Profile:")}    ${join35(getProfilesDir(), `${profile.agent_id}.json`)}`);
   console.log();
   console.log(chalk2.dim("  Install hooks with this profile:"));
   console.log(`    hooks install gitguard --profile ${profile.agent_id}`);
@@ -47636,7 +47165,7 @@ program3.command("doctor").option("-g, --global", "Check global settings", false
         continue;
       }
       const hookDir = getHookPath(name);
-      const hookScript = join36(hookDir, "src", "hook.ts");
+      const hookScript = join35(hookDir, "src", "hook.ts");
       if (!existsSync18(hookScript)) {
         issues.push({ hook: name, issue: "Missing src/hook.ts in package", severity: "error" });
         hookHealthy = false;
@@ -47847,7 +47376,7 @@ program3.command("docs").argument("[hook]", "Hook name (shows general docs if om
       return;
     }
     const hookPath = getHookPath(hook);
-    const readmePath = join36(hookPath, "README.md");
+    const readmePath = join35(hookPath, "README.md");
     let readme = "";
     if (existsSync18(readmePath)) {
       readme = readFileSync27(readmePath, "utf-8");
@@ -48645,7 +48174,7 @@ safety.command("verify").requiredOption("--target <target>", "sumi, codex or cla
         throw new ClaudeSafetyError("settings_invalid");
       console.log(JSON.stringify(await verifyClaudeSafetyConfiguration({
         cwd: options.cwd,
-        ...process.env.CLAUDE_CONFIG_DIR ? { userSettingsPath: resolve23(process.env.CLAUDE_CONFIG_DIR, "settings.json") } : {}
+        ...process.env.CLAUDE_CONFIG_DIR ? { userSettingsPath: resolve21(process.env.CLAUDE_CONFIG_DIR, "settings.json") } : {}
       })));
     } catch (error61) {
       console.log(JSON.stringify({ ok: false, target: "claude", code: error61 instanceof ClaudeSafetyError ? error61.code : "settings_invalid", nativeAdoptionVerified: false }));