@hasna/hooks 0.6.8 → 0.7.0

package/dist/index.js

@@ -49,7 +49,7 @@ function up(db) {
     db.exec(idx);
   }
 }
-var init_001_initial = __esm(() => {
+var init__001_initial = __esm(() => {
   init_schema();
 });
 
@@ -78,7 +78,7 @@ function up2(db) {
     throw err;
   }
 }
-var init_002_session_events = __esm(() => {
+var init__002_session_events = __esm(() => {
   init_schema();
 });
 
@@ -107,7 +107,7 @@ function up3(db) {
     throw err;
   }
 }
-var init_003_user_prompt_submit_event = __esm(() => {
+var init__003_user_prompt_submit_event = __esm(() => {
   init_schema();
 });
 
@@ -131,7 +131,7 @@ var CREATE_HOOKS_TABLE = `
     last_verified_at TEXT
   )
 `, CREATE_HOOKS_INDEXES;
-var init_004_hooks_table = __esm(() => {
+var init__004_hooks_table = __esm(() => {
   CREATE_HOOKS_INDEXES = [
     `CREATE INDEX IF NOT EXISTS idx_hooks_name ON hooks (name)`
   ];
@@ -162,7 +162,7 @@ function up5(db) {
     throw err;
   }
 }
-var init_005_subagent_start_event = __esm(() => {
+var init__005_subagent_start_event = __esm(() => {
   init_schema();
 });
 
@@ -194,11 +194,11 @@ function runMigrations(db) {
 }
 var MIGRATIONS;
 var init_migrations = __esm(() => {
-  init_001_initial();
-  init_002_session_events();
-  init_003_user_prompt_submit_event();
-  init_004_hooks_table();
-  init_005_subagent_start_event();
+  init__001_initial();
+  init__002_session_events();
+  init__003_user_prompt_submit_event();
+  init__004_hooks_table();
+  init__005_subagent_start_event();
   MIGRATIONS = [
     { version: "001_initial", up },
     { version: "002_session_events", up: up2 },
@@ -4296,113 +4296,113 @@ var init_types = __esm(() => {
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
-  void: () => voidType,
-  util: () => util,
-  unknown: () => unknownType,
-  union: () => unionType,
-  undefined: () => undefinedType,
-  tuple: () => tupleType,
-  transformer: () => effectsType,
-  symbol: () => symbolType,
-  string: () => stringType,
-  strictObject: () => strictObjectType,
-  setErrorMap: () => setErrorMap,
-  set: () => setType,
-  record: () => recordType,
-  quotelessJson: () => quotelessJson,
-  promise: () => promiseType,
-  preprocess: () => preprocessType,
-  pipeline: () => pipelineType,
-  ostring: () => ostring,
-  optional: () => optionalType,
-  onumber: () => onumber,
-  oboolean: () => oboolean,
-  objectUtil: () => objectUtil,
-  object: () => objectType,
-  number: () => numberType,
-  nullable: () => nullableType,
-  null: () => nullType,
-  never: () => neverType,
-  nativeEnum: () => nativeEnumType,
-  nan: () => nanType,
-  map: () => mapType,
-  makeIssue: () => makeIssue,
-  literal: () => literalType,
-  lazy: () => lazyType,
-  late: () => late,
-  isValid: () => isValid,
-  isDirty: () => isDirty,
-  isAsync: () => isAsync,
-  isAborted: () => isAborted,
-  intersection: () => intersectionType,
-  instanceof: () => instanceOfType,
-  getParsedType: () => getParsedType,
-  getErrorMap: () => getErrorMap,
-  function: () => functionType,
-  enum: () => enumType,
-  effect: () => effectsType,
-  discriminatedUnion: () => discriminatedUnionType,
-  defaultErrorMap: () => en_default,
-  datetimeRegex: () => datetimeRegex,
-  date: () => dateType,
-  custom: () => custom,
-  coerce: () => coerce,
-  boolean: () => booleanType,
-  bigint: () => bigIntType,
-  array: () => arrayType,
-  any: () => anyType,
-  addIssueToContext: () => addIssueToContext,
-  ZodVoid: () => ZodVoid,
-  ZodUnknown: () => ZodUnknown,
-  ZodUnion: () => ZodUnion,
-  ZodUndefined: () => ZodUndefined,
-  ZodType: () => ZodType,
-  ZodTuple: () => ZodTuple,
-  ZodTransformer: () => ZodEffects,
-  ZodSymbol: () => ZodSymbol,
-  ZodString: () => ZodString,
-  ZodSet: () => ZodSet,
-  ZodSchema: () => ZodType,
-  ZodRecord: () => ZodRecord,
-  ZodReadonly: () => ZodReadonly,
-  ZodPromise: () => ZodPromise,
-  ZodPipeline: () => ZodPipeline,
-  ZodParsedType: () => ZodParsedType,
-  ZodOptional: () => ZodOptional,
-  ZodObject: () => ZodObject,
-  ZodNumber: () => ZodNumber,
-  ZodNullable: () => ZodNullable,
-  ZodNull: () => ZodNull,
-  ZodNever: () => ZodNever,
-  ZodNativeEnum: () => ZodNativeEnum,
-  ZodNaN: () => ZodNaN,
-  ZodMap: () => ZodMap,
-  ZodLiteral: () => ZodLiteral,
-  ZodLazy: () => ZodLazy,
-  ZodIssueCode: () => ZodIssueCode,
-  ZodIntersection: () => ZodIntersection,
-  ZodFunction: () => ZodFunction,
-  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
-  ZodError: () => ZodError,
-  ZodEnum: () => ZodEnum,
-  ZodEffects: () => ZodEffects,
-  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
-  ZodDefault: () => ZodDefault,
-  ZodDate: () => ZodDate,
-  ZodCatch: () => ZodCatch,
-  ZodBranded: () => ZodBranded,
-  ZodBoolean: () => ZodBoolean,
-  ZodBigInt: () => ZodBigInt,
-  ZodArray: () => ZodArray,
-  ZodAny: () => ZodAny,
-  Schema: () => ZodType,
-  ParseStatus: () => ParseStatus,
-  OK: () => OK,
-  NEVER: () => NEVER,
-  INVALID: () => INVALID,
-  EMPTY_PATH: () => EMPTY_PATH,
+  BRAND: () => BRAND,
   DIRTY: () => DIRTY,
-  BRAND: () => BRAND
+  EMPTY_PATH: () => EMPTY_PATH,
+  INVALID: () => INVALID,
+  NEVER: () => NEVER,
+  OK: () => OK,
+  ParseStatus: () => ParseStatus,
+  Schema: () => ZodType,
+  ZodAny: () => ZodAny,
+  ZodArray: () => ZodArray,
+  ZodBigInt: () => ZodBigInt,
+  ZodBoolean: () => ZodBoolean,
+  ZodBranded: () => ZodBranded,
+  ZodCatch: () => ZodCatch,
+  ZodDate: () => ZodDate,
+  ZodDefault: () => ZodDefault,
+  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
+  ZodEffects: () => ZodEffects,
+  ZodEnum: () => ZodEnum,
+  ZodError: () => ZodError,
+  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
+  ZodFunction: () => ZodFunction,
+  ZodIntersection: () => ZodIntersection,
+  ZodIssueCode: () => ZodIssueCode,
+  ZodLazy: () => ZodLazy,
+  ZodLiteral: () => ZodLiteral,
+  ZodMap: () => ZodMap,
+  ZodNaN: () => ZodNaN,
+  ZodNativeEnum: () => ZodNativeEnum,
+  ZodNever: () => ZodNever,
+  ZodNull: () => ZodNull,
+  ZodNullable: () => ZodNullable,
+  ZodNumber: () => ZodNumber,
+  ZodObject: () => ZodObject,
+  ZodOptional: () => ZodOptional,
+  ZodParsedType: () => ZodParsedType,
+  ZodPipeline: () => ZodPipeline,
+  ZodPromise: () => ZodPromise,
+  ZodReadonly: () => ZodReadonly,
+  ZodRecord: () => ZodRecord,
+  ZodSchema: () => ZodType,
+  ZodSet: () => ZodSet,
+  ZodString: () => ZodString,
+  ZodSymbol: () => ZodSymbol,
+  ZodTransformer: () => ZodEffects,
+  ZodTuple: () => ZodTuple,
+  ZodType: () => ZodType,
+  ZodUndefined: () => ZodUndefined,
+  ZodUnion: () => ZodUnion,
+  ZodUnknown: () => ZodUnknown,
+  ZodVoid: () => ZodVoid,
+  addIssueToContext: () => addIssueToContext,
+  any: () => anyType,
+  array: () => arrayType,
+  bigint: () => bigIntType,
+  boolean: () => booleanType,
+  coerce: () => coerce,
+  custom: () => custom,
+  date: () => dateType,
+  datetimeRegex: () => datetimeRegex,
+  defaultErrorMap: () => en_default,
+  discriminatedUnion: () => discriminatedUnionType,
+  effect: () => effectsType,
+  enum: () => enumType,
+  function: () => functionType,
+  getErrorMap: () => getErrorMap,
+  getParsedType: () => getParsedType,
+  instanceof: () => instanceOfType,
+  intersection: () => intersectionType,
+  isAborted: () => isAborted,
+  isAsync: () => isAsync,
+  isDirty: () => isDirty,
+  isValid: () => isValid,
+  late: () => late,
+  lazy: () => lazyType,
+  literal: () => literalType,
+  makeIssue: () => makeIssue,
+  map: () => mapType,
+  nan: () => nanType,
+  nativeEnum: () => nativeEnumType,
+  never: () => neverType,
+  null: () => nullType,
+  nullable: () => nullableType,
+  number: () => numberType,
+  object: () => objectType,
+  objectUtil: () => objectUtil,
+  oboolean: () => oboolean,
+  onumber: () => onumber,
+  optional: () => optionalType,
+  ostring: () => ostring,
+  pipeline: () => pipelineType,
+  preprocess: () => preprocessType,
+  promise: () => promiseType,
+  quotelessJson: () => quotelessJson,
+  record: () => recordType,
+  set: () => setType,
+  setErrorMap: () => setErrorMap,
+  strictObject: () => strictObjectType,
+  string: () => stringType,
+  symbol: () => symbolType,
+  transformer: () => effectsType,
+  tuple: () => tupleType,
+  undefined: () => undefinedType,
+  union: () => unionType,
+  unknown: () => unknownType,
+  util: () => util,
+  void: () => voidType
 });
 var init_external = __esm(() => {
   init_errors();
@@ -4419,44 +4419,318 @@ var init_zod = __esm(() => {
   init_external();
 });
 
-// src/config.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+// ../contracts/dist/client/transport.js
+import { readFileSync as readFileSync2, statSync } from "fs";
 import { join as join3 } from "path";
+function envToken(name) {
+  return name.toUpperCase().replace(/-/g, "_");
+}
+function clientTransportEnvKeys(name) {
+  const envSegment = envToken(name);
+  return {
+    apiUrlKeys: [`HASNA_${envSegment}_API_URL`, `${envSegment}_API_URL`],
+    apiKeyKeys: [`HASNA_${envSegment}_API_KEY`, `${envSegment}_API_KEY`]
+  };
+}
+function credentialOverrideEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
+}
+function homeDir(env) {
+  const home = env.HOME?.trim();
+  return home ? home : null;
+}
+function credentialDiskSources(name, env) {
+  return profileDiskSources(name, env, null);
+}
+function profileDiskSources(name, env, profile) {
+  const home = homeDir(env);
+  if (!home || !SAFE_APP_SLUG.test(name))
+    return [];
+  const stem = profile ? `${name}.${profile}` : name;
+  const configStem = profile ? `${name}-${profile}` : name;
+  return [
+    join3(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
+    join3(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`)
+  ];
+}
+function parseEnvFile(text) {
+  const values = new Map;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#"))
+      continue;
+    const withoutExport = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
+    const equals = withoutExport.indexOf("=");
+    if (equals <= 0)
+      continue;
+    const key = withoutExport.slice(0, equals).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    let value = withoutExport.slice(equals + 1).trim();
+    const quote = value[0];
+    if (quote === '"' || quote === "'") {
+      if (value.length < 2 || !value.endsWith(quote))
+        continue;
+      value = value.slice(1, -1);
+    }
+    if (value.length === 0)
+      continue;
+    values.set(key, value);
+  }
+  return values;
+}
+function readAppConfigFile(path) {
+  let text;
+  try {
+    const stats = statSync(path);
+    if (!stats.isFile() || stats.size > MAX_CREDENTIAL_FILE_BYTES)
+      return null;
+    text = readFileSync2(path, "utf8");
+  } catch {
+    return null;
+  }
+  return parseEnvFile(text);
+}
+function readCredentialFile(path, apiKeyKeys) {
+  const values = readAppConfigFile(path);
+  if (!values)
+    return null;
+  for (const key of apiKeyKeys) {
+    const value = values.get(key)?.trim();
+    if (value)
+      return value;
+  }
+  return null;
+}
+function assertUsableCredential(appName, source, value) {
+  if (!ILLEGAL_IN_HEADER_VALUE.test(value))
+    return;
+  throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
+}
+function sealCredential(fields) {
+  const { apiKey } = fields;
+  const visible = {
+    tier: fields.tier,
+    source: fields.source,
+    deliberate: fields.deliberate,
+    deprecated: fields.deprecated,
+    diskCandidates: Object.freeze([...fields.diskCandidates]),
+    warning: fields.warning
+  };
+  const sealed = { ...visible };
+  Object.defineProperty(sealed, "apiKey", {
+    value: apiKey,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, INSPECT_CUSTOM, {
+    value: () => ({ ...visible, apiKey: "[redacted]" }),
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(sealed, CREDENTIAL_SEAL, {
+    value: true,
+    enumerable: false,
+    writable: false,
+    configurable: false
+  });
+  return Object.freeze(sealed);
+}
+function firstEnvValue(env, keys) {
+  for (const key of keys) {
+    const value = env[key]?.trim();
+    if (value)
+      return { key, value };
+  }
+  return null;
+}
+function deprecationNotified() {
+  const host = globalThis;
+  const existing = host[DEPRECATION_REGISTRY];
+  if (existing instanceof Set)
+    return existing;
+  const created = new Set;
+  host[DEPRECATION_REGISTRY] = created;
+  return created;
+}
+function defaultDeprecationSink(message) {
+  if (typeof process !== "undefined" && process.stderr) {
+    process.stderr.write(`${message}
+`);
+  }
+}
+function resolveCredential(name, env, options = {}) {
+  const { apiKeyKeys } = clientTransportEnvKeys(name);
+  const diskPaths = credentialDiskSources(name, env);
+  const explicitKey = options.apiKey?.trim();
+  if (explicitKey) {
+    assertUsableCredential(name, "the explicit apiKey argument", explicitKey);
+    return sealCredential({
+      apiKey: explicitKey,
+      tier: "argument",
+      source: "explicit apiKey argument",
+      deliberate: true,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const overrideKeyName = credentialOverrideEnvKey(name);
+  const overrideRaw = env[overrideKeyName];
+  if (overrideRaw !== undefined) {
+    const override = overrideRaw.trim();
+    if (!override) {
+      throw new CredentialResolutionError(name, `${overrideKeyName} is set but empty. It is a deliberate override, so it is not resolved around: ` + `either give it a real key or unset it to fall back to the credential on disk.`, [overrideKeyName]);
+    }
+    assertUsableCredential(name, overrideKeyName, override);
+    return sealCredential({
+      apiKey: override,
+      tier: "override",
+      source: overrideKeyName,
+      deliberate: true,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
+  const profile = options.profile?.trim() || env[CREDENTIAL_PROFILE_ENV_KEY]?.trim();
+  if (profile) {
+    const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
+    if (!SAFE_PROFILE.test(profile)) {
+      throw new CredentialResolutionError(name, `Profile name from ${profileSource} is not usable in a path. ` + `Use letters, digits, dot, dash, or underscore.`, [profileSource]);
+    }
+    const paths = profileDiskSources(name, env, profile);
+    for (const path of paths) {
+      const value = readCredentialFile(path, apiKeyKeys);
+      if (value) {
+        assertUsableCredential(name, path, value);
+        return sealCredential({
+          apiKey: value,
+          tier: "profile",
+          source: path,
+          deliberate: true,
+          deprecated: false,
+          diskCandidates: paths,
+          warning: null
+        });
+      }
+    }
+    throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
+  }
+  const diskHits = diskPaths.map((path) => ({ path, value: readCredentialFile(path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  if (diskHits.length > 0) {
+    const winner = diskHits[0];
+    assertUsableCredential(name, winner.path, winner.value);
+    const divergentSources = [
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.path),
+      ...(() => {
+        const legacyHit = firstEnvValue(env, apiKeyKeys);
+        return legacyHit && legacyHit.value !== winner.value ? [legacyHit.key] : [];
+      })()
+    ];
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    return sealCredential({
+      apiKey: winner.value,
+      tier: "disk",
+      source: winner.path,
+      deliberate: false,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning
+    });
+  }
+  const legacy = firstEnvValue(env, apiKeyKeys);
+  if (legacy) {
+    assertUsableCredential(name, legacy.key, legacy.value);
+    const where = diskPaths.length > 0 ? `Put the current key in ${diskPaths[0]} \u2014 it is re-read on every call, so rotations take effect immediately.` : `This environment has no HOME, so no credential file could be consulted at all; the disk tier is ` + `unavailable here and this process will keep using the environment snapshot.`;
+    const message = `[${name}] DEPRECATED: the API key came from ${legacy.key} in this process's environment. ` + `Environment variables are a snapshot taken when this process started, so a shell that started ` + `before a key rotation keeps using the old key until it exits. ${where}`;
+    const sink = options.onDeprecation ?? defaultDeprecationSink;
+    const notified = deprecationNotified();
+    if (!notified.has(name)) {
+      notified.add(name);
+      sink(message);
+    }
+    return sealCredential({
+      apiKey: legacy.value,
+      tier: "legacy-env",
+      source: legacy.key,
+      deliberate: false,
+      deprecated: true,
+      diskCandidates: diskPaths,
+      warning: message
+    });
+  }
+  return null;
+}
+var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE", CredentialResolutionError, HASNA_STATE_DIR = ".hasna", FLEET_CREDENTIAL_DIR = "cloud", CONFIG_DIR = ".config", CONFIG_NAMESPACE = "hasna", MAX_CREDENTIAL_FILE_BYTES, SAFE_APP_SLUG, SAFE_PROFILE, ILLEGAL_IN_HEADER_VALUE, INSPECT_CUSTOM, CREDENTIAL_SEAL, DEPRECATION_REGISTRY, IDEMPOTENT_METHODS, AUTHORITY_OVERRIDE_HEADERS;
+var init_transport = __esm(() => {
+  CredentialResolutionError = class CredentialResolutionError extends Error {
+    appName;
+    attempted;
+    constructor(appName, message, attempted) {
+      super(message);
+      this.name = "CredentialResolutionError";
+      this.appName = appName;
+      this.attempted = attempted;
+    }
+  };
+  MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
+  SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+  SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+  ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+  INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+  CREDENTIAL_SEAL = Symbol.for("hasna:contracts:sealedCredential");
+  DEPRECATION_REGISTRY = Symbol.for("hasna:contracts:credentialDeprecationNotices");
+  IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+  AUTHORITY_OVERRIDE_HEADERS = new Set([
+    "host",
+    ":authority",
+    "forwarded",
+    "x-forwarded-host",
+    "x-original-host"
+  ]);
+});
+
+// src/config.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "fs";
+import { join as join4 } from "path";
 import { homedir as homedir3 } from "os";
 function getHooksDataDir() {
   const explicit = process.env.HASNA_HOOKS_DATA_DIR ?? process.env.HOOKS_DATA_DIR;
   if (explicit)
     return explicit;
-  return join3(homedir3(), ".hasna", "hooks");
+  return join4(homedir3(), ".hasna", "hooks");
 }
 function getCustomHooksDir() {
-  return join3(getHooksDataDir(), "hooks");
+  return join4(getHooksDataDir(), "hooks");
 }
 function getLockPath() {
   const explicit = process.env.HASNA_HOOKS_LOCK_PATH ?? process.env.HOOKS_LOCK_PATH;
   if (explicit)
     return explicit;
-  return join3(getHooksDataDir(), "hooks.lock");
+  return join4(getHooksDataDir(), "hooks.lock");
 }
 function getConfigPath() {
   const explicit = process.env.HASNA_HOOKS_CONFIG_PATH ?? process.env.HOOKS_CONFIG_PATH;
   if (explicit)
     return explicit;
-  return join3(getHooksDataDir(), "config.json");
+  return join4(getHooksDataDir(), "config.json");
 }
 function readConfig() {
   try {
     const path = getConfigPath();
     if (!existsSync3(path))
       return {};
-    return JSON.parse(readFileSync2(path, "utf-8"));
+    return JSON.parse(readFileSync3(path, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeConfig(config) {
   const path = getConfigPath();
-  mkdirSync2(join3(path, ".."), { recursive: true });
+  mkdirSync2(join4(path, ".."), { recursive: true });
   writeFileSync(path, JSON.stringify(config, null, 2) + `
 `, "utf-8");
   return path;
@@ -4469,9 +4743,11 @@ function resolveApiUrl() {
   return cfg.api_url ? cfg.api_url.replace(/\/+$/, "") : undefined;
 }
 function resolveApiKey() {
-  return process.env.HASNA_HOOKS_API_KEY ?? process.env.HOOKS_API_KEY;
+  return resolveCredential("hooks", process.env)?.apiKey;
 }
-var init_config = () => {};
+var init_config = __esm(() => {
+  init_transport();
+});
 
 // src/lib/semver.ts
 var NUMERIC_ID = "(0|[1-9]\\d{0,15})", ALNUM_ID = "\\d*[A-Za-z-][0-9A-Za-z-]*", SEMVER_PATTERN;
@@ -4482,23 +4758,23 @@ var init_semver = __esm(() => {
 // src/lib/manifest.ts
 var exports_manifest = {};
 __export(exports_manifest, {
-  writeCustomHook: () => writeCustomHook,
-  shortManifestName: () => shortManifestName,
-  scriptRelFor: () => scriptRelFor,
-  resolveScript: () => resolveScript,
-  readCustomManifest: () => readCustomManifest,
-  parseManifest: () => parseManifest,
-  normalizeManifestName: () => normalizeManifestName,
-  manifestSchema: () => manifestSchema,
-  listCustomHooks: () => listCustomHooks,
-  isInlineScript: () => isInlineScript,
-  customHookDir: () => customHookDir,
-  assertContained: () => assertContained,
+  HOOK_NAME_RE: () => HOOK_NAME_RE,
   ScriptContainmentError: () => ScriptContainmentError,
-  HOOK_NAME_RE: () => HOOK_NAME_RE
+  assertContained: () => assertContained,
+  customHookDir: () => customHookDir,
+  isInlineScript: () => isInlineScript,
+  listCustomHooks: () => listCustomHooks,
+  manifestSchema: () => manifestSchema,
+  normalizeManifestName: () => normalizeManifestName,
+  parseManifest: () => parseManifest,
+  readCustomManifest: () => readCustomManifest,
+  resolveScript: () => resolveScript,
+  scriptRelFor: () => scriptRelFor,
+  shortManifestName: () => shortManifestName,
+  writeCustomHook: () => writeCustomHook
 });
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync2, realpathSync, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname, isAbsolute, join as join4, normalize, resolve, sep } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4, readdirSync as readdirSync2, realpathSync, writeFileSync as writeFileSync2 } from "fs";
+import { basename, dirname, isAbsolute, join as join5, normalize, resolve, sep } from "path";
 function parseManifest(json) {
   const parsed = JSON.parse(json);
   return manifestSchema.parse(parsed);
@@ -4530,7 +4806,7 @@ function realpathNearest(path) {
     tail.unshift(basename(cur));
     cur = parent;
   }
-  return join4(realpathSync(cur), ...tail);
+  return join5(realpathSync(cur), ...tail);
 }
 function assertContainedReal(root, target, raw) {
   const rootReal = realpathSync(root);
@@ -4563,25 +4839,25 @@ function resolveScript(manifest, manifestDir) {
   if (isInlineScript(manifest))
     return { path: scriptRelFor(manifest), content: manifest.script };
   const rel = scriptRelFor(manifest);
-  const resolved = assertContained(join4(manifestDir, rel), manifestDir, manifest.script);
+  const resolved = assertContained(join5(manifestDir, rel), manifestDir, manifest.script);
   if (!existsSync4(resolved)) {
     throw new Error(`manifest script file not found: ${resolved}`);
   }
-  return { path: rel, content: readFileSync3(resolved, "utf-8") };
+  return { path: rel, content: readFileSync4(resolved, "utf-8") };
 }
 function customHookDir(name) {
-  return join4(getCustomHooksDir(), shortManifestName(name));
+  return join5(getCustomHooksDir(), shortManifestName(name));
 }
 function readCustomManifest(name) {
   const dir = customHookDir(name);
-  const manifestPath = join4(dir, "manifest.json");
+  const manifestPath = join5(dir, "manifest.json");
   if (!existsSync4(manifestPath))
     return;
   try {
-    const manifest = parseManifest(readFileSync3(manifestPath, "utf-8"));
+    const manifest = parseManifest(readFileSync4(manifestPath, "utf-8"));
     const script = resolveScript(manifest, dir);
     const scriptIsInline = isInlineScript(manifest);
-    return { manifest, scriptPath: join4(dir, script.path), scriptContent: script.content, scriptIsInline };
+    return { manifest, scriptPath: join5(dir, script.path), scriptContent: script.content, scriptIsInline };
   } catch (err) {
     if (err instanceof ScriptContainmentError)
       throw err;
@@ -4605,7 +4881,7 @@ function writeCustomHook(name, manifest, scriptContent, scriptRelPath) {
   if (isAbsolute(scriptRelPath)) {
     throw new ScriptContainmentError(scriptRelPath, dir);
   }
-  const scriptPath = scriptRelPath.includes("/") ? join4(dir, scriptRelPath) : join4(dir, scriptRelPath);
+  const scriptPath = scriptRelPath.includes("/") ? join5(dir, scriptRelPath) : join5(dir, scriptRelPath);
   assertContainedLexical(scriptPath, dir, scriptRelPath);
   mkdirSync3(dir, { recursive: true });
   assertContainedReal(dir, scriptPath, scriptRelPath);
@@ -4613,7 +4889,7 @@ function writeCustomHook(name, manifest, scriptContent, scriptRelPath) {
   if (scriptDir !== dir)
     mkdirSync3(scriptDir, { recursive: true });
   writeFileSync2(scriptPath, scriptContent, "utf-8");
-  writeFileSync2(join4(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + `
+  writeFileSync2(join5(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + `
 `, "utf-8");
   return { dir, scriptPath };
 }
@@ -4652,26 +4928,26 @@ var init_manifest = __esm(() => {
 // src/lib/store.ts
 var exports_store = {};
 __export(exports_store, {
-  writeLock: () => writeLock,
-  verifyScriptHash: () => verifyScriptHash,
-  upsertHookRecord: () => upsertHookRecord,
-  sha256Of: () => sha256Of,
-  sha256File: () => sha256File,
-  setPinnedHook: () => setPinnedHook,
-  retrustHook: () => retrustHook,
-  removePinnedHook: () => removePinnedHook,
-  removeHookRecord: () => removeHookRecord,
-  removeHookFromStore: () => removeHookFromStore,
-  readLock: () => readLock,
-  pinInstalledHook: () => pinInstalledHook,
-  listHookRecords: () => listHookRecords,
-  getPinnedHook: () => getPinnedHook,
-  getHookRecord: () => getHookRecord,
+  LockFileError: () => LockFileError,
   checkScriptHash: () => checkScriptHash,
-  LockFileError: () => LockFileError
+  getHookRecord: () => getHookRecord,
+  getPinnedHook: () => getPinnedHook,
+  listHookRecords: () => listHookRecords,
+  pinInstalledHook: () => pinInstalledHook,
+  readLock: () => readLock,
+  removeHookFromStore: () => removeHookFromStore,
+  removeHookRecord: () => removeHookRecord,
+  removePinnedHook: () => removePinnedHook,
+  retrustHook: () => retrustHook,
+  setPinnedHook: () => setPinnedHook,
+  sha256File: () => sha256File,
+  sha256Of: () => sha256Of,
+  upsertHookRecord: () => upsertHookRecord,
+  verifyScriptHash: () => verifyScriptHash,
+  writeLock: () => writeLock
 });
 import { createHash } from "crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3, renameSync } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3, renameSync } from "fs";
 import { readFile } from "fs/promises";
 import { randomBytes } from "crypto";
 function sha256Of(input) {
@@ -4737,7 +5013,7 @@ function readLock() {
     return { hooks: {} };
   let raw;
   try {
-    raw = readFileSync4(path, "utf-8");
+    raw = readFileSync5(path, "utf-8");
   } catch {
     throw new LockFileError(`hooks.lock (${path}) could not be read. Repair: fix permissions or move the file aside and run 'hooks sync'.`);
   }
@@ -4834,7 +5110,7 @@ async function verifyScriptHash(name, scriptPath) {
   return checkScriptHash(name, await sha256File(scriptPath));
 }
 function retrustHook(name, scriptPath, version, source) {
-  const actual = sha256Of(readFileSync4(scriptPath));
+  const actual = sha256Of(readFileSync5(scriptPath));
   const db = getDb();
   upsertHookRecord(db, {
     name,
@@ -4861,24 +5137,24 @@ var init_store = __esm(() => {
 // src/lib/profiles.ts
 var exports_profiles = {};
 __export(exports_profiles, {
-  updateProfile: () => updateProfile,
-  touchProfile: () => touchProfile,
-  listProfiles: () => listProfiles,
-  importProfiles: () => importProfiles,
-  getProfilesDir: () => getProfilesDir,
-  getProfile: () => getProfile,
-  exportProfiles: () => exportProfiles,
+  createProfile: () => createProfile,
   deleteProfile: () => deleteProfile,
-  createProfile: () => createProfile
+  exportProfiles: () => exportProfiles,
+  getProfile: () => getProfile,
+  getProfilesDir: () => getProfilesDir,
+  importProfiles: () => importProfiles,
+  listProfiles: () => listProfiles,
+  touchProfile: () => touchProfile,
+  updateProfile: () => updateProfile
 });
-import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5, readdirSync as readdirSync3, rmSync as rmSync2, cpSync as cpSync2 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync3, rmSync as rmSync2, cpSync as cpSync2 } from "fs";
+import { join as join8 } from "path";
 import { homedir as homedir5 } from "os";
 function resolveProfilesDir() {
-  const newDir = join7(homedir5(), ".hasna", "hooks", "profiles");
-  const oldDir = join7(homedir5(), ".hooks", "profiles");
+  const newDir = join8(homedir5(), ".hasna", "hooks", "profiles");
+  const oldDir = join8(homedir5(), ".hooks", "profiles");
   if (!existsSync8(newDir) && existsSync8(oldDir)) {
-    mkdirSync6(join7(homedir5(), ".hasna", "hooks"), { recursive: true });
+    mkdirSync6(join8(homedir5(), ".hasna", "hooks"), { recursive: true });
     cpSync2(oldDir, newDir, { recursive: true });
   }
   return newDir;
@@ -4889,7 +5165,7 @@ function ensureProfilesDir() {
   }
 }
 function profilePath(id) {
-  return join7(PROFILES_DIR, `${id}.json`);
+  return join8(PROFILES_DIR, `${id}.json`);
 }
 function shortUuid() {
   return crypto.randomUUID().slice(0, 8);
@@ -4920,7 +5196,7 @@ function getProfile(id) {
   try {
     if (!existsSync8(path))
       return null;
-    return JSON.parse(readFileSync6(path, "utf-8"));
+    return JSON.parse(readFileSync7(path, "utf-8"));
   } catch {
     return null;
   }
@@ -4933,7 +5209,7 @@ function listProfiles() {
     const profiles = [];
     for (const file of files) {
       try {
-        const content = readFileSync6(join7(PROFILES_DIR, file), "utf-8");
+        const content = readFileSync7(join8(PROFILES_DIR, file), "utf-8");
         profiles.push(JSON.parse(content));
       } catch {}
     }
@@ -5002,8 +5278,8 @@ var init_profiles = __esm(() => {
 });
 
 // src/lib/hook-env.ts
-import { dirname as dirname4, isAbsolute as isAbsolute2 } from "path";
-import { existsSync as existsSync10, statSync } from "fs";
+import { dirname as dirname5, isAbsolute as isAbsolute2 } from "path";
+import { existsSync as existsSync10, statSync as statSync2 } from "fs";
 function isDeniedEnvName(name) {
   const upper = name.toUpperCase();
   if (DENY_PREFIXES.some((prefix) => upper.startsWith(prefix)))
@@ -5030,7 +5306,7 @@ function isUnsafePathEntry(entry, home) {
   if (entry === "/var/tmp" || entry.startsWith("/var/tmp/"))
     return true;
   try {
-    if ((statSync(entry).mode & 2) !== 0)
+    if ((statSync2(entry).mode & 2) !== 0)
       return true;
   } catch {}
   return false;
@@ -5039,7 +5315,7 @@ function sanitizeHookPath(pathValue, home) {
   const baseline = PATH_BASELINE.slice();
   if (process.platform === "darwin" && existsSync10("/opt/homebrew/bin"))
     baseline.push("/opt/homebrew/bin");
-  const bunDir = dirname4(process.execPath);
+  const bunDir = dirname5(process.execPath);
   const seen = new Set;
   const out = [];
   for (const dir of baseline) {
@@ -5158,12 +5434,12 @@ var init_hook_env = __esm(() => {
 // src/lib/run.ts
 var exports_run = {};
 __export(exports_run, {
-  executeVerifiedScript: () => executeVerifiedScript,
-  HookTimeoutError: () => HookTimeoutError
+  HookTimeoutError: () => HookTimeoutError,
+  executeVerifiedScript: () => executeVerifiedScript
 });
 import { randomBytes as randomBytes2 } from "crypto";
 import { rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute3, join as join9 } from "path";
+import { basename as basename2, dirname as dirname6, isAbsolute as isAbsolute3, join as join11 } from "path";
 function extensionOf(scriptPath) {
   const base = basename2(scriptPath);
   const dot = base.lastIndexOf(".");
@@ -5232,9 +5508,9 @@ async function readPipeWithDeadline(stream, deadlineMs) {
   return chunks.join("");
 }
 async function executeVerifiedScript(options) {
-  const scriptDir = dirname5(options.scriptPath);
+  const scriptDir = dirname6(options.scriptPath);
   const interpreter = interpreterFor(options.name, options.scriptPath, options.content);
-  const tempPath = join9(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
+  const tempPath = join11(scriptDir, `.hooks-verified-${randomBytes2(12).toString("hex")}.${interpreter.tempExt}`);
   let proc = null;
   let timedOut = false;
   const timeoutTimer = options.timeout ? setTimeout(() => {
@@ -5321,10 +5597,10 @@ var init_run = __esm(() => {
 // src/lib/db-writer.ts
 var exports_db_writer = {};
 __export(exports_db_writer, {
-  writeHookEvent: () => writeHookEvent,
-  resolveEventType: () => resolveEventType,
+  normalizeEventType: () => normalizeEventType,
   recordHookRun: () => recordHookRun,
-  normalizeEventType: () => normalizeEventType
+  resolveEventType: () => resolveEventType,
+  writeHookEvent: () => writeHookEvent
 });
 function nanoid2() {
   return crypto.randomUUID().replace(/-/g, "").slice(0, 21);
@@ -6223,6 +6499,16 @@ var HOOKS = [
     matcher: "",
     tags: ["errors", "failures", "logging", "debugging"]
   },
+  {
+    name: "spiral-detector",
+    displayName: "Spiral Detector",
+    description: "Interrupts sessions after five consecutive identical command failures",
+    version: "0.1.0",
+    category: "Observability",
+    event: "PostToolUse",
+    matcher: "",
+    tags: ["spiral", "failures", "retries", "safety", "interrupt"]
+  },
   {
     name: "stylescheck",
     displayName: "Styles Check",
@@ -6388,21 +6674,21 @@ function getHook(name) {
   return HOOKS.find((h) => h.name === name);
 }
 // src/lib/installer.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6, dirname as dirname3 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7, dirname as dirname3 } from "path";
 import { homedir as homedir4 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/lib/resolve.ts
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join6 } from "path";
 import { existsSync as existsSync5 } from "fs";
 import { fileURLToPath } from "url";
 init_manifest();
 function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
-  const sourceLayout = join5(moduleDir, "..", "..", "hooks");
-  if (existsSync5(join5(sourceLayout, "hook-gitguard")))
+  const sourceLayout = join6(moduleDir, "..", "..", "hooks");
+  if (existsSync5(join6(sourceLayout, "hook-gitguard")))
     return sourceLayout;
-  return join5(moduleDir, "..", "hooks");
+  return join6(moduleDir, "..", "hooks");
 }
 function resolveHookDir(name) {
   const custom2 = readCustomManifest(name);
@@ -6413,10 +6699,10 @@ function resolveHookDir(name) {
     return;
   const short = shortManifestName(name);
   const bundledBase = resolveBundledHooksDir();
-  const direct = join5(bundledBase, short);
+  const direct = join6(bundledBase, short);
   if (existsSync5(direct))
     return direct;
-  const prefixed = join5(bundledBase, `hook-${short}`);
+  const prefixed = join6(bundledBase, `hook-${short}`);
   return existsSync5(prefixed) ? prefixed : undefined;
 }
 function resolveScriptPath(name) {
@@ -6426,7 +6712,7 @@ function resolveScriptPath(name) {
   const dir = resolveHookDir(name);
   if (!dir)
     return;
-  const script = join5(dir, "src", "hook.ts");
+  const script = join6(dir, "src", "hook.ts");
   return existsSync5(script) ? script : undefined;
 }
 function resolveHookMeta(name) {
@@ -6482,7 +6768,7 @@ function resolveHook(name) {
 init_manifest();
 init_store();
 var __dirname2 = dirname3(fileURLToPath2(import.meta.url));
-var HOOKS_DIR = existsSync7(join6(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join6(__dirname2, "..", "..", "hooks") : join6(__dirname2, "..", "hooks");
+var HOOKS_DIR = existsSync7(join7(__dirname2, "..", "..", "hooks", "hook-gitguard")) ? join7(__dirname2, "..", "..", "hooks") : join7(__dirname2, "..", "hooks");
 function normalizeHookName(name) {
   return name.startsWith("hook-") ? name : `hook-${name}`;
 }
@@ -6552,16 +6838,16 @@ function getSettingsPath(scope = "global", target = "claude", codewithConfigPath
     return globalOverride;
   const dir = getTargetSettingsDir(target);
   if (scope === "project") {
-    return target === "codewith" ? join6(process.cwd(), dir, "config.toml") : join6(process.cwd(), dir, "settings.json");
+    return target === "codewith" ? join7(process.cwd(), dir, "config.toml") : join7(process.cwd(), dir, "settings.json");
   }
-  return target === "codewith" ? join6(homedir4(), dir, "config.toml") : join6(homedir4(), dir, "settings.json");
+  return target === "codewith" ? join7(homedir4(), dir, "config.toml") : join7(homedir4(), dir, "settings.json");
 }
 function getHookPath(name) {
   const shortName = shortHookName(name);
   const resolved = resolveHookDir(shortName);
   if (resolved)
     return resolved;
-  return join6(HOOKS_DIR, normalizeHookName(shortName));
+  return join7(HOOKS_DIR, normalizeHookName(shortName));
 }
 function hookExists(name) {
   return existsSync7(getHookPath(name));
@@ -6570,7 +6856,7 @@ function readSettings(scope = "global", target = "claude") {
   const path = getSettingsPath(scope, target);
   try {
     if (existsSync7(path)) {
-      return JSON.parse(readFileSync5(path, "utf-8"));
+      return JSON.parse(readFileSync6(path, "utf-8"));
     }
   } catch (error) {
     console.warn(`[hooks] Failed to read settings at ${path}: ${error instanceof Error ? error.message : String(error)}`);
@@ -6669,7 +6955,7 @@ function buildCodewithTomlFragment(name, profile) {
 function readCodewithConfig(scope, configPath) {
   const path = getSettingsPath(scope, "codewith", configPath);
   try {
-    return existsSync7(path) ? readFileSync5(path, "utf-8") : "";
+    return existsSync7(path) ? readFileSync6(path, "utf-8") : "";
   } catch {
     return "";
   }
@@ -6679,7 +6965,7 @@ function appendCodewithFragment(fragment, scope, configPath) {
   const dir = dirname3(path);
   if (!existsSync7(dir))
     mkdirSync5(dir, { recursive: true });
-  const existing = existsSync7(path) ? readFileSync5(path, "utf-8") : "";
+  const existing = existsSync7(path) ? readFileSync6(path, "utf-8") : "";
   const sep2 = existing.trim() ? `
 
 ` : "";
@@ -6724,7 +7010,7 @@ function installForTarget(name, scope, overwrite, target, profile, codewithMode
           target,
           fragment,
           applied: false,
-          note: "Codewith install is fragment-only by default; open-configs should own applying this TOML."
+          note: "Codewith install is fragment-only by default; configs should own applying this TOML."
         };
       }
       if (!codewithConfigPath) {
@@ -6751,7 +7037,7 @@ function installForTarget(name, scope, overwrite, target, profile, codewithMode
         fragment,
         applied: true,
         configPath: path,
-        note: "Direct Codewith config write was explicitly requested; prefer open-configs for managed machines."
+        note: "Direct Codewith config write was explicitly requested; prefer configs for managed machines."
       };
     } catch (error) {
       return {
@@ -6983,7 +7269,7 @@ function codewithHasHookEntry(name, scope = "global") {
   if (!existsSync7(path))
     return false;
   try {
-    return codewithHasHookEntryInText(readFileSync5(path, "utf-8"), name);
+    return codewithHasHookEntryInText(readFileSync6(path, "utf-8"), name);
   } catch {
     return false;
   }
@@ -7015,7 +7301,7 @@ function uninstallHook(name, scope = "global", target = "claude") {
   if (target === "codewith" || target === "all") {
     const codewithPath = getSettingsPath(scope, "codewith");
     if (existsSync7(codewithPath)) {
-      const before = readFileSync5(codewithPath, "utf-8");
+      const before = readFileSync6(codewithPath, "utf-8");
       const after = removeCodewithHookEntry(before, shortName);
       if (after.removed) {
         writeFileSync4(codewithPath, after.text, "utf-8");
@@ -7059,20 +7345,20 @@ init_profiles();
 init_config();
 init_store();
 init_manifest();
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
 
 // src/lib/custom-install.ts
 init_config();
 init_manifest();
-import { existsSync as existsSync9, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync3 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync8, rmSync as rmSync3 } from "fs";
+import { join as join9 } from "path";
 import { tmpdir } from "os";
 function manifestAt(dir) {
-  const path = join8(dir, "manifest.json");
+  const path = join9(dir, "manifest.json");
   if (!existsSync9(path))
     return;
   try {
-    return parseManifest(readFileSync7(path, "utf-8"));
+    return parseManifest(readFileSync8(path, "utf-8"));
   } catch {
     return;
   }
@@ -7091,8 +7377,8 @@ function writeFromManifest(manifest, srcDir, source, kind) {
   return { name, version: manifest.version, kind, source, dir, scriptPath };
 }
 async function cloneToTemp(gitUrl) {
-  const tmp = mkdtempSync(join8(tmpdir(), "hooks-install-"));
-  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join8(tmp, "repo")], {
+  const tmp = mkdtempSync(join9(tmpdir(), "hooks-install-"));
+  const proc = Bun.spawn(["git", "clone", "--depth", "1", "--quiet", gitUrl, join9(tmp, "repo")], {
     stdout: "pipe",
     stderr: "pipe"
   });
@@ -7105,7 +7391,7 @@ async function cloneToTemp(gitUrl) {
     rmSync3(tmp, { recursive: true, force: true });
     throw new Error(`git clone failed (${exitCode}): ${stderr.trim()}`);
   }
-  return join8(tmp, "repo");
+  return join9(tmp, "repo");
 }
 function isGitUrl(value) {
   return value.startsWith("git@") || value.startsWith("ssh://") || value.startsWith("file://") || value.endsWith(".git");
@@ -7133,7 +7419,7 @@ async function installCustomSource(source) {
     throw new Error(`No such local path: ${source}`);
   }
   if (source.endsWith("manifest.json")) {
-    const manifest = parseManifest(readFileSync7(source, "utf-8"));
+    const manifest = parseManifest(readFileSync8(source, "utf-8"));
     return writeFromManifest(manifest, source.substring(0, source.lastIndexOf("/")), source, "local");
   }
   return copyManifestDir(source, source, "local");
@@ -7164,7 +7450,7 @@ async function installManifestUrl(url) {
 }
 // src/lib/sync.ts
 import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 init_config();
 init_db();
 init_store();
@@ -7173,7 +7459,7 @@ function sha256OfText(text) {
   return createHash2("sha256").update(text).digest("hex");
 }
 function sha256OfPath(path) {
-  return createHash2("sha256").update(readFileSync8(path)).digest("hex");
+  return createHash2("sha256").update(readFileSync9(path)).digest("hex");
 }
 function collectBundledCatalog() {
   const out = [];
@@ -7428,6 +7714,9 @@ async function fetchPinnedHook(name, version, apiUrl) {
 init_manifest();
 init_store();
 init_config();
+import { readFileSync as readFileSync10 } from "fs";
+import { dirname as dirname4, join as join10 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/lib/secure-compare.ts
 function secureEqual(a, b) {
@@ -7442,11 +7731,170 @@ function secureEqual(a, b) {
   return diff === 0;
 }
 
+// src/openapi.ts
+var openApiDocument = {
+  openapi: "3.1.0",
+  info: {
+    title: "Hooks Registry API",
+    version: "0.1.0",
+    description: "Local registry HTTP API for @hasna/hooks: catalog, lock, and artifact reads are open; publishing (PUT /api/v1/hooks) requires the API key (authorization: Bearer or x-api-key)."
+  },
+  servers: [{ url: "/" }],
+  paths: {
+    "/health": {
+      get: {
+        summary: "Liveness probe",
+        operationId: "getHealth",
+        responses: {
+          "200": {
+            description: "Service is alive",
+            content: {
+              "application/json": {
+                schema: { type: "object", additionalProperties: true }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/ready": {
+      get: {
+        summary: "Readiness probe \u2014 the hooks.lock store is readable",
+        operationId: "getReady",
+        responses: {
+          "200": { description: "Lock store is readable" },
+          "503": { description: "Lock store is not readable" }
+        }
+      }
+    },
+    "/version": {
+      get: {
+        summary: "Package version",
+        operationId: "getVersion",
+        responses: {
+          "200": {
+            description: "The installed @hasna/hooks version",
+            content: {
+              "application/json": {
+                schema: { type: "object", properties: { version: { type: "string" } } }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/openapi.json": {
+      get: {
+        summary: "This OpenAPI document",
+        operationId: "getOpenApi",
+        responses: { "200": { description: "OpenAPI 3.1 document" } }
+      }
+    },
+    "/api/v1/catalog": {
+      get: {
+        summary: "List the full hook catalog with versions and sha256",
+        operationId: "getCatalog",
+        responses: {
+          "200": {
+            description: "Catalog entries",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    hooks: {
+                      type: "array",
+                      items: {
+                        type: "object",
+                        properties: {
+                          name: { type: "string" },
+                          version: { type: "string" },
+                          sha256: { type: "string" },
+                          events: { type: "array", items: { type: "string" } }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/v1/lock": {
+      get: {
+        summary: "Read the published hooks.lock with per-hook versions",
+        operationId: "getLock",
+        responses: { "200": { description: "The lock file" } }
+      }
+    },
+    "/api/v1/hooks/{name}/{version}": {
+      get: {
+        summary: "Fetch one hook's manifest and script",
+        operationId: "getHookArtifact",
+        parameters: [
+          { name: "name", in: "path", required: true, schema: { type: "string" } },
+          { name: "version", in: "path", required: true, schema: { type: "string" } }
+        ],
+        responses: {
+          "200": {
+            description: "Hook artifact; x-hook-sha256 header carries the script hash"
+          },
+          "400": { description: "Invalid URL encoding or semver version" },
+          "404": { description: "Hook not found locally" }
+        }
+      }
+    },
+    "/api/v1/hooks": {
+      put: {
+        summary: "Publish/retrust a hook (requires the API key)",
+        operationId: "putHook",
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                properties: { name: { type: "string" }, version: { type: "string" } }
+              }
+            }
+          }
+        },
+        responses: {
+          "200": { description: "Hook retrusted and pin updated" },
+          "401": { description: "Missing or invalid API key" },
+          "404": { description: "Hook not found in local store" },
+          "409": { description: "Version mismatch with the local store" }
+        },
+        security: [{ apiKey: [] }]
+      }
+    }
+  },
+  components: {
+    securitySchemes: {
+      apiKey: {
+        type: "http",
+        scheme: "bearer",
+        description: "The registry API key (HASNA_HOOKS_API_KEY / HOOKS_API_KEY)."
+      }
+    }
+  }
+};
+
 // src/serve.ts
 init_semver();
 var DEFAULT_SERVE_PORT = 39428;
 var SERVE_HOST = "127.0.0.1";
 var SERVE_SERVICE_NAME = "hooks-registry";
+function packageVersion() {
+  try {
+    const pkgPath = join10(dirname4(fileURLToPath3(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync10(pkgPath, "utf-8")).version || "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
 async function buildCatalog() {
   const byName = new Map;
   for (const meta of HOOKS) {
@@ -7519,6 +7967,20 @@ function handleServeRequest(req, apiKey) {
   if (url.pathname === "/health" && req.method === "GET") {
     return Promise.resolve(json({ status: "ok", name: SERVE_SERVICE_NAME }));
   }
+  if (url.pathname === "/ready" && req.method === "GET") {
+    try {
+      readLock();
+      return Promise.resolve(json({ status: "ready", name: SERVE_SERVICE_NAME }));
+    } catch {
+      return Promise.resolve(json({ status: "not-ready", name: SERVE_SERVICE_NAME }, 503));
+    }
+  }
+  if (url.pathname === "/version" && req.method === "GET") {
+    return Promise.resolve(json({ version: packageVersion() }));
+  }
+  if (url.pathname === "/openapi.json" && req.method === "GET") {
+    return Promise.resolve(json(openApiDocument));
+  }
   if (url.pathname === "/api/v1/catalog" && req.method === "GET") {
     return buildCatalog().then((catalog) => json({ hooks: catalog }));
   }
@@ -7693,7 +8155,7 @@ async function runHook(name, input, options = {}) {
   if (!script)
     throw new Error(`Hook script not found: ${name}`);
   const { sha256Of: sha256Of2, checkScriptHash: checkScriptHash2 } = await Promise.resolve().then(() => (init_store(), exports_store));
-  const content = readFileSync9(script);
+  const content = readFileSync11(script);
   const check = checkScriptHash2(name, sha256Of2(content));
   if (!check.ok) {
     throw new Error(`Hook '${name}' script changed since it was trusted (sha256 ${check.expected} != ${check.actual}). Run 'hooks trust ${name}' to trust the new content.`);
@@ -7782,102 +8244,102 @@ async function runHook(name, input, options = {}) {
   return { output, stderr: stderrText, exitCode };
 }
 export {
-  writeLock,
-  writeCustomHook,
-  writeConfig,
-  verifyScriptHash,
-  upsertHookRecord,
-  updateProfile,
-  uninstallHook,
-  touchProfile,
-  syncHooks,
-  storageSync,
-  storagePush,
-  storagePull,
-  startServeServer,
-  sha256Of,
-  sha256File,
-  setPinnedHook,
-  searchHooks,
-  runStorageMigrations,
-  runHook,
-  retrustHook,
-  resolveTables,
-  resolveScriptPath,
-  resolveScript,
-  resolveHookMeta,
-  resolveHookDir,
-  resolveHook,
-  resolveApiUrl,
-  resolveApiKey,
-  removeProjectHook,
-  removePinnedHook,
-  removeHookRecord,
-  removeHookFromStore,
-  removeHook,
-  readLock,
-  readCustomManifest,
-  readConfig,
-  provisionCloudflareResources,
-  planSync,
-  pinInstalledHook,
-  parseStorageTables,
-  parseManifest,
-  listProjectHooks,
-  listProfiles,
-  listHookRecords,
-  listCustomHooks,
-  isEventSupported,
-  isCustomSource,
-  installHooksForProject,
-  installHooks,
-  installHookForProject,
-  installHook,
-  installCustomSource,
-  importProfiles,
-  hookExists,
-  handleServeRequest,
-  getSyncMetaAll,
-  getStorageStatus,
-  getStoragePg,
-  getStorageDatabaseUrl,
-  getStorageDatabaseEnvName,
-  getStorageDatabaseEnv,
-  getStorageBackend,
-  getSettingsPath,
-  getRegisteredHooksForTarget,
-  getRegisteredHooks,
-  getProfilesDir,
-  getProfile,
-  getPinnedHook,
-  getLockPath,
-  getInstalledHooks,
-  getHooksDataDir,
-  getHooksByCategory,
-  getHookRecord,
-  getHookPath,
-  getHookEvents,
-  getHook,
-  getCustomHooksDir,
-  getConfigPath,
-  fetchPinnedHook,
-  exportProfiles,
-  deleteProfile,
-  createProfile,
-  checkScriptHash,
-  buildCodewithTomlFragment,
-  STORAGE_TABLES,
-  STORAGE_DATABASE_ENV,
-  STORAGE_BACKEND_ENV,
-  STORAGE_BACKENDS,
-  RETIRED_STORAGE_MODE_ENV,
-  HOOK_EVENTS,
-  HOOKS_STORAGE_TABLES,
-  HOOKS_STORAGE_FALLBACK_ENV,
-  HOOKS_STORAGE_ENV,
-  HOOKS_STORAGE_BACKEND_FALLBACK_ENV,
-  HOOKS_STORAGE_BACKEND_ENV,
-  HOOKS,
+  CATEGORIES,
   DEFAULT_SERVE_PORT,
-  CATEGORIES
+  HOOKS,
+  HOOKS_STORAGE_BACKEND_ENV,
+  HOOKS_STORAGE_BACKEND_FALLBACK_ENV,
+  HOOKS_STORAGE_ENV,
+  HOOKS_STORAGE_FALLBACK_ENV,
+  HOOKS_STORAGE_TABLES,
+  HOOK_EVENTS,
+  RETIRED_STORAGE_MODE_ENV,
+  STORAGE_BACKENDS,
+  STORAGE_BACKEND_ENV,
+  STORAGE_DATABASE_ENV,
+  STORAGE_TABLES,
+  buildCodewithTomlFragment,
+  checkScriptHash,
+  createProfile,
+  deleteProfile,
+  exportProfiles,
+  fetchPinnedHook,
+  getConfigPath,
+  getCustomHooksDir,
+  getHook,
+  getHookEvents,
+  getHookPath,
+  getHookRecord,
+  getHooksByCategory,
+  getHooksDataDir,
+  getInstalledHooks,
+  getLockPath,
+  getPinnedHook,
+  getProfile,
+  getProfilesDir,
+  getRegisteredHooks,
+  getRegisteredHooksForTarget,
+  getSettingsPath,
+  getStorageBackend,
+  getStorageDatabaseEnv,
+  getStorageDatabaseEnvName,
+  getStorageDatabaseUrl,
+  getStoragePg,
+  getStorageStatus,
+  getSyncMetaAll,
+  handleServeRequest,
+  hookExists,
+  importProfiles,
+  installCustomSource,
+  installHook,
+  installHookForProject,
+  installHooks,
+  installHooksForProject,
+  isCustomSource,
+  isEventSupported,
+  listCustomHooks,
+  listHookRecords,
+  listProfiles,
+  listProjectHooks,
+  parseManifest,
+  parseStorageTables,
+  pinInstalledHook,
+  planSync,
+  provisionCloudflareResources,
+  readConfig,
+  readCustomManifest,
+  readLock,
+  removeHook,
+  removeHookFromStore,
+  removeHookRecord,
+  removePinnedHook,
+  removeProjectHook,
+  resolveApiKey,
+  resolveApiUrl,
+  resolveHook,
+  resolveHookDir,
+  resolveHookMeta,
+  resolveScript,
+  resolveScriptPath,
+  resolveTables,
+  retrustHook,
+  runHook,
+  runStorageMigrations,
+  searchHooks,
+  setPinnedHook,
+  sha256File,
+  sha256Of,
+  startServeServer,
+  storagePull,
+  storagePush,
+  storageSync,
+  syncHooks,
+  touchProfile,
+  uninstallHook,
+  updateProfile,
+  upsertHookRecord,
+  verifyScriptHash,
+  writeConfig,
+  writeCustomHook,
+  writeLock
 };