@hasna/hooks 0.7.9 → 0.7.10

package/bin/serve.js

@@ -15,6 +15,128 @@ var __export = (target, all) => {
     });
 };
 
+// src/lib/app-home.ts
+import { existsSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2, resolve } from "path";
+
+// ../../node_modules/.bun/@hasna+paths@0.1.0/node_modules/@hasna/paths/dist/index.js
+import { homedir } from "os";
+import { join } from "path";
+var KIND_ENV = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function assertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function envOf(options) {
+  return options.env ?? process.env;
+}
+function envValue(options, kind) {
+  const value = envOf(options)[KIND_ENV[kind]];
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function isMacOS(platform) {
+  return platform === "darwin";
+}
+function baseDir(kind, options) {
+  const override = envValue(options, kind);
+  if (override)
+    return override;
+  const home = options.home ?? homedir();
+  const platform = options.platform ?? process.platform;
+  if (isMacOS(platform)) {
+    switch (kind) {
+      case "config":
+      case "data":
+        return join(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return join(home, "Library", "Caches", "Hasna");
+      case "state":
+        return join(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return join(home, ".config", "hasna");
+    case "data":
+      return join(home, ".local", "share", "hasna");
+    case "state":
+      return join(home, ".local", "state", "hasna");
+    case "cache":
+      return join(home, ".cache", "hasna");
+  }
+}
+function resolvePath(kind, options) {
+  assertApp(options.app);
+  const appSegment = options.internal === true ? join("internal", options.app) : options.app;
+  return join(baseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return resolvePath("data", options);
+}
+
+// src/lib/app-home.ts
+var STORE_MARKER = "hooks.db";
+function getHomeDir(env = process.env) {
+  return env.HOME || env.USERPROFILE || homedir2();
+}
+function getResolverDataRoot(env = process.env) {
+  return dataDir({ app: "hooks", home: getHomeDir(env), env });
+}
+function getLegacyDataRoot(env = process.env) {
+  return join2(getHomeDir(env), ".hasna", "hooks");
+}
+function adoptResolverDataRoot(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync(join2(resolved, STORE_MARKER));
+}
+function getExplicitDataDir(env = process.env) {
+  const dir = env.HASNA_HOOKS_DATA_DIR ?? env.HOOKS_DATA_DIR;
+  if (typeof dir === "string" && dir.trim().length > 0)
+    return dir.trim();
+  return;
+}
+function getExactDataRoot(env = process.env) {
+  const dir = env.HASNA_HOOKS_HOME?.trim() || env.HOOKS_HOME?.trim();
+  if (dir)
+    return resolve(dir);
+  return;
+}
+function getEffectiveDataRoot(env = process.env) {
+  const explicit = getExplicitDataDir(env);
+  if (explicit)
+    return explicit;
+  const exact = getExactDataRoot(env);
+  if (exact)
+    return exact;
+  const resolved = getResolverDataRoot(env);
+  return adoptResolverDataRoot(resolved, env) ? resolve(resolved) : getLegacyDataRoot(env);
+}
+function getReportedDbPath(env = process.env) {
+  const explicit = getExplicitDbPath(env);
+  if (explicit)
+    return explicit;
+  return join2(getEffectiveDataRoot(env), "hooks.db");
+}
+function getExplicitDbPath(env = process.env) {
+  const db = env.HASNA_HOOKS_DB_PATH ?? env.HOOKS_DB_PATH;
+  if (typeof db === "string" && db.trim().length > 0)
+    return db.trim();
+  return;
+}
+
 // src/lib/registry.ts
 var HOOKS = [
   {
@@ -331,7 +453,7 @@ var HOOKS = [
   {
     name: "sessionlog",
     displayName: "Session Log",
-    description: "Logs every tool call to SQLite (~/.hasna/hooks/hooks.db)",
+    description: `Logs every tool call to SQLite (${getReportedDbPath()})`,
     version: "0.1.0",
     category: "Observability",
     event: "PostToolUse",
@@ -341,7 +463,7 @@ var HOOKS = [
   {
     name: "commandlog",
     displayName: "Command Log",
-    description: "Logs every Bash command to SQLite (~/.hasna/hooks/hooks.db)",
+    description: `Logs every Bash command to SQLite (${getReportedDbPath()})`,
     version: "0.1.0",
     category: "Observability",
     event: "PostToolUse",
@@ -361,7 +483,7 @@ var HOOKS = [
   {
     name: "errornotify",
     displayName: "Error Notify",
-    description: "Detects tool failures and logs errors to SQLite (~/.hasna/hooks/hooks.db)",
+    description: `Detects tool failures and logs errors to SQLite (${getReportedDbPath()})`,
     version: "0.1.0",
     category: "Observability",
     event: "PostToolUse",
@@ -534,8 +656,8 @@ function getHook(name) {
 }
 
 // src/lib/manifest.ts
-import { existsSync, mkdirSync, readFileSync as readFileSync2, readdirSync, realpathSync, writeFileSync } from "fs";
-import { basename, dirname, isAbsolute, join as join3, normalize, resolve, sep } from "path";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, readdirSync, realpathSync, writeFileSync } from "fs";
+import { basename, dirname, isAbsolute, join as join5, normalize, resolve as resolve2, sep } from "path";
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
@@ -4512,7 +4634,8 @@ var coerce = {
 var NEVER = INVALID;
 // ../contracts/dist/client/transport.js
 import { readFileSync, statSync } from "fs";
-import { join } from "path";
+import { createRequire } from "module";
+import { join as join3 } from "path";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
@@ -4527,6 +4650,9 @@ function credentialOverrideEnvKey(name) {
   return `HASNA_${envToken(name)}_API_KEY_OVERRIDE`;
 }
 var CREDENTIAL_PROFILE_ENV_KEY = "HASNA_PROFILE";
+function credentialPointerEnvKey(name) {
+  return `HASNA_${envToken(name)}_API_KEY_REF`;
+}
 
 class CredentialResolutionError extends Error {
   appName;
@@ -4539,31 +4665,55 @@ class CredentialResolutionError extends Error {
   }
 }
 var HASNA_STATE_DIR = ".hasna";
-var FLEET_CREDENTIAL_DIR = "cloud";
+var FLEET_CREDENTIAL_DIR = "fleet-env";
+var LEGACY_CLOUD_DIR = "cloud";
 var CONFIG_DIR = ".config";
 var CONFIG_NAMESPACE = "hasna";
+var LEGACY_CLOUD_REMOVAL_DEADLINE = "2026-10-01";
 var MAX_CREDENTIAL_FILE_BYTES = 64 * 1024;
 var SAFE_APP_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 var SAFE_PROFILE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
 var ILLEGAL_IN_HEADER_VALUE = /[^\t\x20-\x7e]/;
+var VAULT_POINTER_SHAPE = /^[a-z0-9][a-z0-9-]*(?:\/[a-z0-9][a-z0-9-_.]*){2,}$/;
 function homeDir(env) {
   const home = env.HOME?.trim();
   return home ? home : null;
 }
-function credentialDiskSources(name, env) {
-  return profileDiskSources(name, env, null);
-}
-function profileDiskSources(name, env, profile) {
+function credentialDiskSourceList(name, env, profile = null) {
   const home = homeDir(env);
   if (!home || !SAFE_APP_SLUG.test(name))
     return [];
   const stem = profile ? `${name}.${profile}` : name;
   const configStem = profile ? `${name}-${profile}` : name;
   return [
-    join(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
-    join(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`)
+    {
+      path: join3(home, HASNA_STATE_DIR, FLEET_CREDENTIAL_DIR, `${stem}.env`),
+      tier: "fleet-env",
+      deprecated: false
+    },
+    {
+      path: join3(home, HASNA_STATE_DIR, LEGACY_CLOUD_DIR, `${stem}.env`),
+      tier: "legacy-cloud",
+      deprecated: true
+    },
+    {
+      path: join3(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}.env`),
+      tier: "config",
+      deprecated: false
+    },
+    {
+      path: join3(home, CONFIG_DIR, CONFIG_NAMESPACE, `${configStem}-cloud.env`),
+      tier: "config-legacy",
+      deprecated: true
+    }
   ];
 }
+function credentialDiskSources(name, env) {
+  return credentialDiskSourceList(name, env, null).map((s) => s.path);
+}
+function profileDiskSources(name, env, profile) {
+  return credentialDiskSourceList(name, env, profile).map((s) => s.path);
+}
 function parseEnvFile(text) {
   const values = new Map;
   for (const rawLine of text.split(/\r?\n/)) {
@@ -4614,6 +4764,9 @@ function readCredentialFile(path, apiKeyKeys) {
   return null;
 }
 function assertUsableCredential(appName, source, value) {
+  if (VAULT_POINTER_SHAPE.test(value)) {
+    throw new CredentialResolutionError(appName, `The credential from ${source} looks like a secrets-vault pointer (a path-shaped reference like ` + `'namespace/app/live/api_key'). A vault path is NEVER accepted as a literal API key. ` + `Use ${credentialPointerEnvKey(appName)} to resolve the key through the vault, or provide the actual key value.`, [source]);
+  }
   if (!ILLEGAL_IN_HEADER_VALUE.test(value))
     return;
   throw new CredentialResolutionError(appName, `The credential from ${source} contains characters that cannot be sent in an HTTP header ` + `(a control character or non-ASCII byte). A file written with CR-only line endings is the usual ` + `cause. Rewrite that credential file with one LF-terminated KEY=value line. ` + `The value is not shown here, and is deliberately never logged.`, [source]);
@@ -4637,6 +4790,14 @@ function sealCredential(fields) {
     writable: false,
     configurable: false
   });
+  if (fields.pointerVaultKey !== undefined) {
+    Object.defineProperty(sealed, "pointerVaultKey", {
+      value: fields.pointerVaultKey,
+      enumerable: false,
+      writable: false,
+      configurable: false
+    });
+  }
   Object.defineProperty(sealed, INSPECT_CUSTOM, {
     value: () => ({ ...visible, apiKey: "[redacted]" }),
     enumerable: false,
@@ -4709,6 +4870,27 @@ function resolveCredential(name, env, options = {}) {
       warning: null
     });
   }
+  const pointerKeyName = credentialPointerEnvKey(name);
+  const pointerRaw = env[pointerKeyName];
+  if (pointerRaw !== undefined) {
+    const pointer = pointerRaw.trim();
+    if (!pointer) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} is set but empty. It is a deliberate vault pointer, so it is not resolved around: ` + `either give it a vault item key or unset it to fall back to the credential on disk.`, [pointerKeyName]);
+    }
+    if (!VAULT_POINTER_SHAPE.test(pointer)) {
+      throw new CredentialResolutionError(name, `${pointerKeyName} must name a vault ITEM KEY (a path-shaped reference like ` + `'namespace/app/live/api_key'), not a credential value. A pointer that carries a literal is refused.`, [pointerKeyName]);
+    }
+    return sealCredential({
+      apiKey: "",
+      pointerVaultKey: pointer,
+      tier: "pointer",
+      source: pointerKeyName,
+      deliberate: true,
+      deprecated: false,
+      diskCandidates: diskPaths,
+      warning: null
+    });
+  }
   const profile = options.profile?.trim() || env[CREDENTIAL_PROFILE_ENV_KEY]?.trim();
   if (profile) {
     const profileSource = options.profile?.trim() ? "explicit profile argument" : CREDENTIAL_PROFILE_ENV_KEY;
@@ -4733,26 +4915,42 @@ function resolveCredential(name, env, options = {}) {
     }
     throw new CredentialResolutionError(name, `Profile '${profile}' (from ${profileSource}) has no ${apiKeyKeys[0]} for '${name}'. ` + `Looked in: ${paths.join(", ") || "<no HOME in this environment>"}. ` + `A profile names WHICH identity to use, so it is never resolved around \u2014 ` + `create the profile's credential file or unset ${CREDENTIAL_PROFILE_ENV_KEY}.`, paths);
   }
-  const diskHits = diskPaths.map((path) => ({ path, value: readCredentialFile(path, apiKeyKeys) })).filter((hit) => hit.value !== null);
+  const diskSourceList = credentialDiskSourceList(name, env, null);
+  const diskHits = diskSourceList.map((src) => ({ src, value: readCredentialFile(src.path, apiKeyKeys) })).filter((hit) => hit.value !== null);
   if (diskHits.length > 0) {
     const winner = diskHits[0];
-    assertUsableCredential(name, winner.path, winner.value);
+    assertUsableCredential(name, winner.src.path, winner.value);
     const divergentSources = [
-      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.path),
+      ...diskHits.slice(1).filter((hit) => hit.value !== winner.value).map((hit) => hit.src.path),
       ...(() => {
         const legacyHit = firstEnvValue(env, apiKeyKeys);
         return legacyHit && legacyHit.value !== winner.value ? [legacyHit.key] : [];
       })()
     ];
-    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    const warning = divergentSources.length > 0 ? `Credential sources disagree for '${name}': ${winner.src.path} and ` + `${divergentSources.join(", ")} hold different keys. ${winner.src.path} wins, because a file on ` + `disk is re-read on every call while an environment variable is a snapshot. Reconcile them \u2014 ` + `a rotation that updated only one leaves the other to fail 401 wherever it is loaded first.` : null;
+    let deprecated = winner.src.deprecated;
+    let finalWarning = warning;
+    if (winner.src.deprecated) {
+      deprecated = true;
+      const sink = options.onDeprecation ?? defaultDeprecationSink;
+      const notified = deprecationNotified();
+      const noticeKey = `${name}:${winner.src.path}`;
+      if (!notified.has(noticeKey)) {
+        notified.add(noticeKey);
+        const target = diskSourceList[0]?.path ?? "<none>";
+        const message = `[${name}] DEPRECATED: the API key came from ${winner.src.path} \u2014 a legacy credential location. ` + `The primary location is ${target} (~/.hasna/fleet-env/<app>.env). The legacy 'cloud' tiers are ` + `removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}. Migrate the key to the primary location.`;
+        sink(message);
+      }
+      finalWarning = [warning, `Legacy credential source: ${winner.src.path}. Removed after ${LEGACY_CLOUD_REMOVAL_DEADLINE}.`].filter(Boolean).join(" ") || null;
+    }
     return sealCredential({
       apiKey: winner.value,
-      tier: "disk",
-      source: winner.path,
+      tier: winner.src.tier,
+      source: winner.src.path,
       deliberate: false,
-      deprecated: false,
+      deprecated,
       diskCandidates: diskPaths,
-      warning
+      warning: finalWarning
     });
   }
   const legacy = firstEnvValue(env, apiKeyKeys);
@@ -4778,6 +4976,8 @@ function resolveCredential(name, env, options = {}) {
   }
   return null;
 }
+var SECRETS_PACKAGE_SPECIFIER = "@hasna/" + "secrets";
+var requireSecretsSdk = createRequire(import.meta.url);
 var IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
 var AUTHORITY_OVERRIDE_HEADERS = new Set([
   "host",
@@ -4788,22 +4988,18 @@ var AUTHORITY_OVERRIDE_HEADERS = new Set([
 ]);
 
 // src/config.ts
-import { join as join2 } from "path";
-import { homedir } from "os";
+import { join as join4 } from "path";
 function getHooksDataDir() {
-  const explicit = process.env.HASNA_HOOKS_DATA_DIR ?? process.env.HOOKS_DATA_DIR;
-  if (explicit)
-    return explicit;
-  return join2(homedir(), ".hasna", "hooks");
+  return getEffectiveDataRoot();
 }
 function getCustomHooksDir() {
-  return join2(getHooksDataDir(), "hooks");
+  return join4(getHooksDataDir(), "hooks");
 }
 function getLockPath() {
   const explicit = process.env.HASNA_HOOKS_LOCK_PATH ?? process.env.HOOKS_LOCK_PATH;
   if (explicit)
     return explicit;
-  return join2(getHooksDataDir(), "hooks.lock");
+  return join4(getHooksDataDir(), "hooks.lock");
 }
 function resolveApiKey() {
   return resolveCredential("hooks", process.env)?.apiKey;
@@ -4845,8 +5041,8 @@ function isWithin(child, parent) {
   return child === parent || child.startsWith(parent + sep);
 }
 function assertContainedLexical(target, root, raw) {
-  const lexical = resolve(target);
-  const rootLexical = resolve(root);
+  const lexical = resolve2(target);
+  const rootLexical = resolve2(root);
   if (!isWithin(lexical, rootLexical)) {
     throw new ScriptContainmentError(target, root, raw);
   }
@@ -4855,14 +5051,14 @@ function assertContainedLexical(target, root, raw) {
 function realpathNearest(path) {
   const tail = [];
   let cur = path;
-  while (!existsSync(cur)) {
+  while (!existsSync2(cur)) {
     const parent = dirname(cur);
     if (parent === cur)
       break;
     tail.unshift(basename(cur));
     cur = parent;
   }
-  return join3(realpathSync(cur), ...tail);
+  return join5(realpathSync(cur), ...tail);
 }
 function assertContainedReal(root, target, raw) {
   const rootReal = realpathSync(root);
@@ -4895,25 +5091,25 @@ function resolveScript(manifest, manifestDir) {
   if (isInlineScript(manifest))
     return { path: scriptRelFor(manifest), content: manifest.script };
   const rel = scriptRelFor(manifest);
-  const resolved = assertContained(join3(manifestDir, rel), manifestDir, manifest.script);
-  if (!existsSync(resolved)) {
+  const resolved = assertContained(join5(manifestDir, rel), manifestDir, manifest.script);
+  if (!existsSync2(resolved)) {
     throw new Error(`manifest script file not found: ${resolved}`);
   }
   return { path: rel, content: readFileSync2(resolved, "utf-8") };
 }
 function customHookDir(name) {
-  return join3(getCustomHooksDir(), shortManifestName(name));
+  return join5(getCustomHooksDir(), shortManifestName(name));
 }
 function readCustomManifest(name) {
   const dir = customHookDir(name);
-  const manifestPath = join3(dir, "manifest.json");
-  if (!existsSync(manifestPath))
+  const manifestPath = join5(dir, "manifest.json");
+  if (!existsSync2(manifestPath))
     return;
   try {
     const manifest = parseManifest(readFileSync2(manifestPath, "utf-8"));
     const script = resolveScript(manifest, dir);
     const scriptIsInline = isInlineScript(manifest);
-    return { manifest, scriptPath: join3(dir, script.path), scriptContent: script.content, scriptIsInline };
+    return { manifest, scriptPath: join5(dir, script.path), scriptContent: script.content, scriptIsInline };
   } catch (err) {
     if (err instanceof ScriptContainmentError)
       throw err;
@@ -4922,7 +5118,7 @@ function readCustomManifest(name) {
 }
 function listCustomHooks() {
   const dir = getCustomHooksDir();
-  if (!existsSync(dir))
+  if (!existsSync2(dir))
     return [];
   const results = [];
   for (const entry of readdirSafe(dir)) {
@@ -4942,14 +5138,13 @@ function readdirSafe(dir) {
 
 // src/lib/store.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2, renameSync } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2, renameSync } from "fs";
 import { readFile } from "fs/promises";
 
 // src/db/index.ts
 import { Database } from "bun:sqlite";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, cpSync } from "fs";
-import { join as join5 } from "path";
-import { homedir as homedir3 } from "os";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, cpSync } from "fs";
+import { join as join7 } from "path";
 
 // src/db/schema.ts
 var CREATE_HOOK_EVENTS_TABLE = `
@@ -5121,9 +5316,9 @@ function runMigrations(db) {
 }
 
 // src/db/legacy-import.ts
-import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
-import { join as join4 } from "path";
-import { homedir as homedir2 } from "os";
+import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join6 } from "path";
+import { homedir as homedir3 } from "os";
 var META_KEY = "legacy_import_done";
 function ensureMetaTable(db) {
   db.exec(`
@@ -5198,25 +5393,25 @@ function importErrorsLog(db, filePath) {
   } catch {}
   return count;
 }
-function runLegacyImport(db, homeDir2 = homedir2()) {
+function runLegacyImport(db, homeDir2 = homedir3()) {
   try {
     if (isAlreadyDone(db))
       return;
     let total = 0;
-    const claudeProjectsDir = join4(homeDir2, ".claude", "projects");
-    if (existsSync2(claudeProjectsDir)) {
+    const claudeProjectsDir = join6(homeDir2, ".claude", "projects");
+    if (existsSync3(claudeProjectsDir)) {
       try {
         const projectDirs = readdirSync2(claudeProjectsDir);
         for (const dir of projectDirs) {
-          const projectDir = join4(claudeProjectsDir, dir);
+          const projectDir = join6(claudeProjectsDir, dir);
           try {
             const files = readdirSync2(projectDir);
             for (const file of files) {
               if (file.match(/^session-log-\d{4}-\d{2}-\d{2}\.jsonl$/)) {
-                total += importJsonlFile(db, join4(projectDir, file));
+                total += importJsonlFile(db, join6(projectDir, file));
               }
               if (file === "errors.log") {
-                total += importErrorsLog(db, join4(projectDir, file));
+                total += importErrorsLog(db, join6(projectDir, file));
               }
             }
           } catch {}
@@ -5251,27 +5446,24 @@ function runRetention(db, days) {
 // src/db/index.ts
 var instance = null;
 function resolveDataDir() {
-  const explicit = process.env.HASNA_HOOKS_DATA_DIR ?? process.env.HOOKS_DATA_DIR;
-  if (explicit)
-    return explicit;
-  const newDir = join5(homedir3(), ".hasna", "hooks");
-  const oldDir = join5(homedir3(), ".hooks");
-  if (!existsSync3(newDir) && existsSync3(oldDir)) {
-    mkdirSync2(join5(homedir3(), ".hasna"), { recursive: true });
-    cpSync(oldDir, newDir, { recursive: true });
+  const effective = getEffectiveDataRoot();
+  const oldDir = join7(getHomeDir(), ".hooks");
+  if (!existsSync4(effective) && existsSync4(oldDir)) {
+    mkdirSync2(effective, { recursive: true });
+    cpSync(oldDir, effective, { recursive: true });
   }
-  return newDir;
+  return effective;
 }
 function getDbPath() {
   const explicitDb = process.env.HASNA_HOOKS_DB_PATH ?? process.env.HOOKS_DB_PATH;
   if (explicitDb)
     return explicitDb;
-  const dataDir = resolveDataDir();
-  return join5(dataDir, "hooks.db");
+  const dataDir2 = resolveDataDir();
+  return join7(dataDir2, "hooks.db");
 }
 function ensureDir(dbPath) {
   const dir = dbPath.substring(0, dbPath.lastIndexOf("/"));
-  if (dir && !existsSync3(dir)) {
+  if (dir && !existsSync4(dir)) {
     mkdirSync2(dir, { recursive: true });
   }
 }
@@ -5279,7 +5471,7 @@ function getDb() {
   if (instance)
     return instance;
   const dbPath = getDbPath();
-  const isNew = dbPath === ":memory:" || !existsSync3(dbPath);
+  const isNew = dbPath === ":memory:" || !existsSync4(dbPath);
   ensureDir(dbPath);
   instance = new Database(dbPath);
   instance.exec("PRAGMA busy_timeout=5000");
@@ -5362,7 +5554,7 @@ function assertLockShape(parsed, path) {
 }
 function readLock() {
   const path = getLockPath();
-  if (!existsSync4(path))
+  if (!existsSync5(path))
     return { hooks: {} };
   let raw;
   try {
@@ -5412,14 +5604,14 @@ function retrustHook(name, scriptPath, version, source) {
 }
 
 // src/lib/resolve.ts
-import { dirname as dirname2, join as join6 } from "path";
-import { existsSync as existsSync5 } from "fs";
+import { dirname as dirname2, join as join8 } from "path";
+import { existsSync as existsSync6 } from "fs";
 import { fileURLToPath } from "url";
 function resolveBundledHooksDir(moduleDir = dirname2(fileURLToPath(import.meta.url))) {
-  const sourceLayout = join6(moduleDir, "..", "..", "hooks");
-  if (existsSync5(join6(sourceLayout, "hook-gitguard")))
+  const sourceLayout = join8(moduleDir, "..", "..", "hooks");
+  if (existsSync6(join8(sourceLayout, "hook-gitguard")))
     return sourceLayout;
-  return join6(moduleDir, "..", "hooks");
+  return join8(moduleDir, "..", "hooks");
 }
 function resolveHookDir(name) {
   const custom2 = readCustomManifest(name);
@@ -5430,11 +5622,11 @@ function resolveHookDir(name) {
     return;
   const short = shortManifestName(name);
   const bundledBase = resolveBundledHooksDir();
-  const direct = join6(bundledBase, short);
-  if (existsSync5(direct))
+  const direct = join8(bundledBase, short);
+  if (existsSync6(direct))
     return direct;
-  const prefixed = join6(bundledBase, `hook-${short}`);
-  return existsSync5(prefixed) ? prefixed : undefined;
+  const prefixed = join8(bundledBase, `hook-${short}`);
+  return existsSync6(prefixed) ? prefixed : undefined;
 }
 function resolveScriptPath(name) {
   const custom2 = readCustomManifest(name);
@@ -5443,8 +5635,8 @@ function resolveScriptPath(name) {
   const dir = resolveHookDir(name);
   if (!dir)
     return;
-  const script = join6(dir, "src", "hook.ts");
-  return existsSync5(script) ? script : undefined;
+  const script = join8(dir, "src", "hook.ts");
+  return existsSync6(script) ? script : undefined;
 }
 function resolveHookMeta(name) {
   const custom2 = readCustomManifest(name);
@@ -5497,7 +5689,7 @@ function resolveHook(name) {
 
 // src/serve.ts
 import { readFileSync as readFileSync5 } from "fs";
-import { dirname as dirname3, join as join7 } from "path";
+import { dirname as dirname3, join as join9 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/lib/secure-compare.ts
@@ -5670,7 +5862,7 @@ var SERVE_HOST = "127.0.0.1";
 var SERVE_SERVICE_NAME = "hooks-registry";
 function packageVersion() {
   try {
-    const pkgPath = join7(dirname3(fileURLToPath2(import.meta.url)), "..", "package.json");
+    const pkgPath = join9(dirname3(fileURLToPath2(import.meta.url)), "..", "package.json");
     return JSON.parse(readFileSync5(pkgPath, "utf-8")).version || "0.0.0";
   } catch {
     return "0.0.0";
@@ -5819,9 +6011,15 @@ function handleServeRequest(req, apiKey) {
   }
   return Promise.resolve(json({ error: "Not Found" }, 404));
 }
+function resolveServeOptions(options) {
+  const envPort = process.env.PORT?.trim();
+  const envHost = process.env.HOST?.trim();
+  const port = options.port ?? (envPort && /^[0-9]+$/.test(envPort) ? parseInt(envPort, 10) : DEFAULT_SERVE_PORT);
+  const host = options.host ?? (envHost && envHost.length > 0 ? envHost : SERVE_HOST);
+  return { port, host };
+}
 function startServeServer(options) {
-  const port = options.port ?? DEFAULT_SERVE_PORT;
-  const host = options.host ?? SERVE_HOST;
+  const { port, host } = resolveServeOptions(options);
   const apiKey = resolveApiKey();
   const server = Bun.serve({
     hostname: host,
@@ -5862,6 +6060,7 @@ options:
 }
 export {
   startServeServer,
+  resolveServeOptions,
   handleServeRequest,
   SERVE_SERVICE_NAME,
   SERVE_HOST,

package/dist/db/index.d.ts

@@ -1,5 +1,7 @@
 /**
- * SQLite DB module for hooks — persistent storage at ~/.hasna/hooks/hooks.db
+ * SQLite DB module for hooks — persistent storage at the effective data
+ * root resolved through @hasna/paths (legacy ~/.hasna/hooks until adopted,
+ * then the XDG data home) at hooks.db.
  *
  * Uses bun:sqlite with WAL mode for concurrent reads.
  * Supports HASNA_HOOKS_DATA_DIR / HOOKS_DATA_DIR and HASNA_HOOKS_DB_PATH / HOOKS_DB_PATH env overrides.