@hasna/hooks 0.7.10 → 0.9.0

package/dist/config.d.ts

@@ -1,27 +1,33 @@
 /**
  * Runtime configuration for @hasna/hooks.
  *
- * Presence of an API URL selects the remote registry; absence means the local
- * store is authoritative. There is deliberately no mode concept.
+ * Transport policy (fleet fail-closed doctrine, 2026-09-04): the remote
+ * registry is selected and authenticated by the ONE resolver in
+ * `@hasna/contracts/client` (strict URL+key pair, resolved fresh per call —
+ * see `src/lib/transport.ts`). Without a resolved pair the CLI must FAIL
+ * CLOSED instead of silently serving the local store. Local mode (bundled
+ * registry + local SQLite at the effective data root) is an explicit opt-in
+ * via HASNA_HOOKS_LOCAL=1 / HOOKS_LOCAL=1 — never the default for a CLI run.
+ *
+ * The app's own credential chain is gone: no `~/.hasna/fleet-env`,
+ * `~/.hasna/cloud`, `~/.config/hasna` or `$XDG_CONFIG_HOME` read, no
+ * `~/.hasna/hooks/config.json` `api_url` / `api_key_ref` key store, no
+ * `HASNA_HOOKS_REGISTRY_URL` / `HOOKS_REGISTRY_URL` spellings, no `*_MODE`
+ * transport switches. The authority and the credential both come from
+ * @hasna/contracts, which resolves per call: Keychain `hasna.credentials.hooks.*`,
+ * disk `~/.hasna/hooks/config/credentials`, then `HASNA_HOOKS_API_URL` /
+ * `HASNA_HOOKS_API_KEY` (the unprefixed `HOOKS_*` spellings remain only as the
+ * resolver's silent alias fallback).
  */
 export declare function getHooksDataDir(): string;
 export declare function getCustomHooksDir(): string;
 export declare function getLockPath(): string;
-export declare function getConfigPath(): string;
-export interface HooksConfig {
-    api_url?: string;
-    api_key_ref?: string;
-}
-export declare function readConfig(): HooksConfig;
-export declare function writeConfig(config: HooksConfig): string;
-export declare function resolveApiUrl(): string | undefined;
 /**
- * P1-8: the registry API key resolves through the shared client seam, never
- * by hand — its chain (deliberate override, profile, disk, then the legacy
- * HASNA_HOOKS_API_KEY / HOOKS_API_KEY env variables) is the single path that
- * receives credential-resolution fixes. A secret-valued CLI flag stays
- * removed (a flag value is visible in process listings and shell history);
- * the vault-key-NAME reference (config api_key_ref) is a name, not a value,
- * and is untouched.
- */
-export declare function resolveApiKey(): string | undefined;
+ * The legacy `config.json` reader/writer and its `api_url` / `api_key_ref`
+ * fields were REMOVED (hasna/apps#1720): the file was this package's own
+ * configuration key store, outranked the canonical env names for operators who
+ * had both, and carried a secret-valued reference outside the resolver's
+ * chain. The registry authority and its credential now resolve exclusively
+ * through `@hasna/contracts` (env, Keychain item `hasna.credentials.hooks.api-url`
+ * / `.api-key`, and `~/.hasna/hooks/config/credentials`).
+ */ 

package/dist/index.d.ts

@@ -74,8 +74,9 @@ export declare function runHook(name: string, input: HookInput, options?: RunHoo
 export { createProfile, getProfile, listProfiles, updateProfile, deleteProfile, touchProfile, getProfilesDir, exportProfiles, importProfiles, type AgentProfile, type CreateProfileInput, } from "./lib/profiles.js";
 export { HOOKS_STORAGE_ENV, HOOKS_STORAGE_FALLBACK_ENV, HOOKS_STORAGE_BACKEND_ENV, HOOKS_STORAGE_BACKEND_FALLBACK_ENV, HOOKS_STORAGE_TABLES, RETIRED_STORAGE_MODE_ENV, STORAGE_BACKENDS, STORAGE_BACKEND_ENV, STORAGE_DATABASE_ENV, STORAGE_TABLES, getStorageBackend, getStorageDatabaseEnv, getStorageDatabaseEnvName, getStorageDatabaseUrl, getStoragePg, getStorageStatus, getSyncMetaAll, parseStorageTables, resolveTables, runStorageMigrations, storagePull, storagePush, storageSync, } from "./storage.js";
 export type { StorageBackend, StorageEnv, StorageStatus, SyncMeta, SyncResult } from "./storage.js";
-export { getHooksDataDir, getCustomHooksDir, getLockPath, getConfigPath, readConfig, writeConfig, resolveApiUrl, resolveApiKey, } from "./config.js";
-export type { HooksConfig } from "./config.js";
+export { getHooksDataDir, getCustomHooksDir, getLockPath, } from "./config.js";
+export { resolveHooksTransport, resolveHooksServePublishKey, hooksRegistryOrigin, type HooksRemoteAuthority, type HooksCredentialOptions, type HooksTransportMode, type HooksTransportNotice, type HooksTransportOptions, type HooksTransportResolution, } from "./lib/transport.js";
+export type { HooksLocalOptInEnv } from "./lib/resolver-types.js";
 export { getHookRecord, listHookRecords, upsertHookRecord, removeHookRecord, readLock, writeLock, setPinnedHook, getPinnedHook, removePinnedHook, pinInstalledHook, removeHookFromStore, verifyScriptHash, checkScriptHash, retrustHook, sha256Of, sha256File, } from "./lib/store.js";
 export type { HookRecord, LockEntry, LockFile, TrustCheck } from "./lib/store.js";
 export { parseManifest, readCustomManifest, listCustomHooks, writeCustomHook, resolveScript, } from "./lib/manifest.js";