@hasna/hooks 0.7.9 → 0.8.0

package/dist/lib/app-home.d.ts

@@ -0,0 +1,74 @@
+/**
+ * App-home resolution for @hasna/hooks — routes the local data root through
+ * the @hasna/paths resolver (XDG / macOS home layout) with gated legacy
+ * adoption.
+ *
+ * The XDG home migration (hotfixes plan 0f49f56a, task P3.3) moves the store
+ * from `~/.hasna/hooks` toward `~/.local/share/hasna/hooks` on Linux and
+ * `~/Library/Application Support/Hasna/hooks` on macOS. Nothing moves on disk
+ * in this phase — the resolver root is adopted only when the operator has
+ * deliberately opted in (`HASNA_DATA_HOME`) or the store has already been
+ * physically migrated there, so a live store at the legacy home never becomes
+ * invisible on upgrade.
+ */
+export type PathKind = "config" | "data" | "state" | "cache";
+export interface PathsResolverOptions {
+    app: string;
+    internal?: boolean;
+    platform?: string;
+    home?: string;
+    env?: Record<string, string | undefined>;
+}
+export declare function dataDir(options: PathsResolverOptions): string;
+/** Resolve the user's home directory: $HOME, then $USERPROFILE, then the OS user database. */
+export declare function getHomeDir(env?: NodeJS.ProcessEnv): string;
+/**
+ * The @hasna/paths-resolved (XDG / macOS layout) data root for hooks: the
+ * forward-looking home the XDG migration moves the store toward. The home
+ * override mirrors the pre-existing $HOME-first resolution so the resolver
+ * follows the same home the legacy path does.
+ */
+export declare function getResolverDataRoot(env?: NodeJS.ProcessEnv): string;
+/** The legacy (pre-XDG) data root: ~/.hasna/hooks */
+export declare function getLegacyDataRoot(env?: NodeJS.ProcessEnv): string;
+/**
+ * Whether the resolver (XDG) data root should be adopted as the effective data
+ * root. The resolver root is adopted only when the operator has set
+ * `HASNA_DATA_HOME` (the data-kind override — a deliberate opt-in to the XDG
+ * layout) or the store has already been physically migrated there (`hooks.db`
+ * exists). A machine that only redirects another kind (e.g. cache to tmpfs)
+ * must NOT have its data home moved, and a live store at the legacy home must
+ * never become invisible on upgrade.
+ */
+export declare function adoptResolverDataRoot(resolved: string, env?: NodeJS.ProcessEnv): boolean;
+/**
+ * The granular data-dir override root, when set: `HASNA_HOOKS_DATA_DIR`, then
+ * `HOOKS_DATA_DIR`. This preserves the pre-existing exact-data-dir override
+ * behavior verbatim (first-nonblank; a set-but-empty value falls through).
+ */
+export declare function getExplicitDataDir(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * The exact-app override root, when set: `HASNA_HOOKS_HOME`, then `HOOKS_HOME`.
+ * First-nonblank selection: a set-but-whitespace override must not suppress a
+ * valid fallback (the same `?.trim() ||` semantics the emails lane settled as
+ * release-review P1).
+ */
+export declare function getExactDataRoot(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * The effective data root for hooks. Precedence: the granular data-dir
+ * override (`HASNA_HOOKS_DATA_DIR`/`HOOKS_DATA_DIR`) wins; then the exact-app
+ * override (`HASNA_HOOKS_HOME`/`HOOKS_HOME`); then the resolver (XDG) data
+ * root once adopted; then the legacy `~/.hasna/hooks` default — a live store
+ * never becomes invisible on upgrade. Store/lock/config paths are layered on
+ * top of this by their own overrides, so an explicit path always wins
+ * regardless.
+ */
+export declare function getEffectiveDataRoot(env?: NodeJS.ProcessEnv): string;
+/**
+ * The SQLite store path surfaced by help/status surfaces (e.g. `hooks log`,
+ * registry hook descriptions). The explicit `HASNA_HOOKS_DB_PATH` /
+ * `HOOKS_DB_PATH` override wins; otherwise `hooks.db` under the effective data
+ * root. A status surface must never hardcode the legacy literal — the store can
+ * live at the resolver home once adopted.
+ */
+export declare function getReportedDbPath(env?: NodeJS.ProcessEnv): string;

package/dist/lib/installer.d.ts

@@ -81,14 +81,5 @@ export declare function removeCodewithHookEntry(configText: string, name: string
     text: string;
     removed: boolean;
 };
-/**
- * Full uninstall — the settings registration, the store directory (custom
- * hooks), the lock pin and the DB record are all removed. Bundled hooks keep
- * their package files (they belong to the package, not the store).
- *
- * Resolves custom and registry-synced hooks, which live in the custom store
- * dir, as well as bundled ones (QA-1 BUG-A / QA-4: remove was bundled-only
- * and never cleaned the store/lock/DB).
- */
 export declare function uninstallHook(name: string, scope?: Scope, target?: Target): UninstallResult;
 export {};

package/dist/lib/local-opt-in.d.ts

@@ -0,0 +1,80 @@
+import type { HooksCredentialOptions, HooksLocalOptInEnv } from "./resolver-types.js";
+/** The deliberate unhosted opt-in, canonical name first. */
+export declare const HOOKS_LOCAL_OPT_IN_ENV_KEYS: readonly ["HASNA_HOOKS_LOCAL", "HOOKS_LOCAL"];
+/** True when the operator deliberately asked for the unhosted local store. */
+export declare function isHooksLocalOptIn(env?: HooksLocalOptInEnv): boolean;
+/** Every env name that can configure a hooks authority or credential, resolver-derived. */
+export declare function hooksAuthorityEnvKeys(): string[];
+/**
+ * Does the ENVIRONMENT itself configure a hooks authority or credential?
+ *
+ * Deliberately narrower than "does a credential resolve": answering it must not
+ * touch the Keychain or the filesystem, because doing so would defeat the
+ * isolation the opt-in short-circuit exists to provide. It reads the env
+ * dictionary and nothing else.
+ *
+ * A DECLARED-BUT-BLANK variable counts as absent HERE — a blank has always been
+ * this package's spelling for "not configured", and helpers in the wild blank
+ * rather than delete. It is NOT absent once we do go hosted: the resolver
+ * refuses a blank loudly rather than falling through to another identity, which
+ * is the behaviour that matters at that point.
+ */
+export declare function hasHooksEnvAuthorityIntent(env?: HooksLocalOptInEnv): boolean;
+/** True when this environment should be served by the on-box bundled store. */
+export declare function selectsHooksLocalStore(env?: HooksLocalOptInEnv): boolean;
+/**
+ * The environment as the resolver should see it: every authority/credential
+ * variable that is DECLARED BUT BLANK removed.
+ *
+ * A blank has always been this package's spelling for "not configured".
+ * @hasna/contracts takes the opposite and, for its purposes, correct view: a
+ * declared-but-blank credential is a misconfiguration it refuses loudly rather
+ * than resolving around, because a blank that fell through would authenticate
+ * as a different principal than the operator named.
+ *
+ * Both are right at their own layer, and the mismatch is not hypothetical: an
+ * environment carrying a real `HASNA_HOOKS_API_KEY` alongside a blank legacy
+ * alias — the exact shape a scrubbed-then-overridden fixture produces — is a
+ * complete, unambiguous configuration that would otherwise be refused for the
+ * alias nobody set. Normalising here keeps "blank means unset" true at the
+ * hooks seam while leaving the resolver's stricter rule intact for everything
+ * it does receive: a value that is present is still policed, and two aliases
+ * that actually disagree still refuse.
+ */
+export declare function hooksResolverEnv<T extends HooksLocalOptInEnv>(env: T): T;
+/** The env object and credential options a hooks surface hands @hasna/contracts. */
+export interface HooksResolverInputs<T extends HooksLocalOptInEnv> {
+    /** The environment with every declared-but-blank authority variable removed. */
+    env: T;
+    /** The chain options, with the Keychain tier's ambient gate already decided. */
+    credentials: HooksCredentialOptions;
+}
+/**
+ * Build the resolver's inputs: the normalised environment AND the credential
+ * options that keep the machine's Keychain tier reachable across it.
+ *
+ * WHY THIS IS NOT JUST {@link hooksResolverEnv}. Blanking a variable and
+ * deleting it are not the same operation to @hasna/contracts, because dropping
+ * a key forces us to hand the resolver a COPY, and the resolver gates its
+ * ambient tiers on OBJECT IDENTITY (`env === process.env`, or the registry
+ * symbol its own snapshot carries). A copy is, by that test, a caller-built
+ * world — the hermetic seam — so the Keychain is outside it and tier 3 turns
+ * itself off. Silently: there is no error, no warning and no diagnostic.
+ *
+ * The consequence is the one failure this whole ruling exists to prevent. On a
+ * station whose Keychain holds `hasna.credentials.hooks.api-key`, ONE
+ * declared-but-blank authority variable dropped the run from the Keychain
+ * identity to whatever came next: to `~/.hasna/hooks/config/credentials`, a
+ * DIFFERENT principal, with no notice; or, with nothing on disk, to a bare
+ * REMOTE_API_CONFIG_MISSING on a station that is in fact configured. A
+ * deliberate tier must never fall through to another identity, so the gate is
+ * decided HERE, on the original env, and carried across the copy as the
+ * documented `keychain.enabled` control rather than being left to an identity
+ * test the copy cannot pass.
+ *
+ * An explicit `enabled` from the caller still wins, and an injected `run`
+ * (which @hasna/contracts already treats as "enabled") is left alone, so the
+ * hermetic seam tests rely on is untouched. When there is no blank to remove
+ * the inputs pass through by identity, exactly as before.
+ */
+export declare function hooksResolverInputs<T extends HooksLocalOptInEnv>(env: T, credentials?: HooksCredentialOptions): HooksResolverInputs<T>;

package/dist/lib/profiles.d.ts

@@ -1,7 +1,10 @@
 /**
  * Agent profile management — identity system for hooks
  *
- * Each agent instance gets a unique 8-char UUID stored at ~/.hasna/hooks/profiles/<id>.json.
+ * Each agent instance gets a unique 8-char UUID stored at
+ * <effective-data-root>/profiles/<id>.json, where the effective data root is
+ * resolved through @hasna/paths (legacy ~/.hasna/hooks until adopted, then
+ * the XDG data home).
  * Profiles are injected into HookInput when hooks are run with --profile <id>,
  * allowing hooks to identify which agent is calling them.
  */
@@ -17,6 +20,16 @@ export interface CreateProfileInput {
     agent_type: "claude" | "gemini" | "custom";
     name?: string;
 }
+/**
+ * The profiles directory under the effective data root.
+ *
+ * Resolved on every call, never snapshotted at module load: the effective
+ * data root is env-driven (HASNA_HOOKS_DATA_DIR / HASNA_HOOKS_HOME / the XDG
+ * adoption in app-home), and bun test runs test files in one process with a
+ * SHARED process.env — a module-load snapshot froze the dir to whatever the
+ * env held at import time, so a concurrent file pinning a data-root override
+ * silently moved every profile operation of this module with it.
+ */
 export declare function getProfilesDir(): string;
 export declare function createProfile(input: CreateProfileInput): AgentProfile;
 export declare function getProfile(id: string): AgentProfile | null;

package/dist/lib/resolver-types.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The @hasna/contracts client types that @hasna/hooks PUBLISHES or hands back
+ * across its public seam, spelled locally.
+ *
+ * WHY THIS FILE EXISTS. `@hasna/contracts` is a BUILD-TIME dependency of this
+ * package (pinned 1.0.2, inlined by `bun build --target bun`), so the emitted
+ * `dist/**/*.d.ts` must never `import ... from "@hasna/contracts/client"` —
+ * a published declaration that references a package consumers do not have is
+ * a broken install (hasna/apps#1782). Every public signature therefore uses
+ * these local spellings, which are structurally identical to the resolver's
+ * own types (`CredentialChainOptions` / `KeychainCommandResult`). The
+ * `credential chain shape` test in `transport.test.ts` pins the local
+ * spellings against the real @hasna/contracts types so they cannot drift.
+ */
+export type HooksLocalOptInEnv = Record<string, string | undefined>;
+/** What an injected `security` runner returns: an exit status plus output. */
+export interface HooksKeychainCommandResult {
+    /** Exit status; null when the tool could not be started or was killed. */
+    status: number | null;
+    stdout: string;
+    stderr: string;
+}
+/** Tier 3 (Keychain) controls — structurally `KeychainTierOptions`. */
+export interface HooksKeychainTierOptions {
+    /** Whether the Keychain is consulted for a caller-built env object. */
+    enabled?: boolean;
+    /** Defaults to `process.platform`; the tier exists only on `"darwin"`. */
+    platform?: string;
+    /** The machine's host name when `HASNA_STATION` is unset. */
+    hostname?: () => string;
+    /** The `security` runner. Defaults to spawning `/usr/bin/security`. */
+    run?: (argv: readonly string[]) => HooksKeychainCommandResult;
+}
+/**
+ * Tier-1 credential inputs and Keychain-tier controls — structurally
+ * `CredentialChainOptions` from @hasna/contracts/client, spelled locally.
+ */
+export interface HooksCredentialOptions {
+    /** Tier 1: an explicit key, e.g. from `--api-key`. */
+    apiKey?: string;
+    /** Tier 1: an explicit profile name. Beats `HASNA_PROFILE`. */
+    profile?: string;
+    /** Tier 3: Keychain controls — a fake `security` runner in tests, an opt-out on CI. */
+    keychain?: HooksKeychainTierOptions;
+}

package/dist/lib/sync.d.ts

@@ -6,7 +6,16 @@
  * failure mid-sync leaves the local store untouched. Local-only hooks are
  * never deleted by a remote sync.
  */
+import type { HooksCredentialOptions } from "./resolver-types.js";
 import { parseManifest } from "./manifest.js";
+type Env = Record<string, string | undefined>;
+export interface HooksSyncOptions {
+    dryRun?: boolean;
+    /** Injectable environment (tests). Defaults to `process.env`. */
+    env?: Env;
+    /** Injectable credential-chain inputs (tests: fake `security` runner). */
+    credentials?: HooksCredentialOptions;
+}
 export interface SyncDiff {
     added: string[];
     updated: string[];
@@ -39,12 +48,8 @@ interface RemoteLock {
         versions?: string[];
     }>;
 }
-export declare function planSync(options?: {
-    dryRun?: boolean;
-}): Promise<SyncPlan>;
-export declare function syncHooks(options?: {
-    dryRun?: boolean;
-}): Promise<SyncPlan>;
+export declare function planSync(options?: HooksSyncOptions): Promise<SyncPlan>;
+export declare function syncHooks(options?: HooksSyncOptions): Promise<SyncPlan>;
 /**
  * One fully-validated artifact ready to be committed. Nothing has touched
  * the store at this point: every fetch, sha check and manifest parse has
@@ -64,7 +69,7 @@ export interface StagedSyncArtifact {
  * written. A failure here (network, sha mismatch, malformed manifest,
  * containment violation) throws with the store untouched.
  */
-export declare function stageSyncArtifacts(apiUrl: string, names: string[], remoteLock: RemoteLock): Promise<StagedSyncArtifact[]>;
+export declare function stageSyncArtifacts(apiUrl: string, apiKey: string, names: string[], remoteLock: RemoteLock): Promise<StagedSyncArtifact[]>;
 /**
  * P1-9 commit phase, ordered so a mid-commit failure cannot leave a partial
  * store that reads as trusted:
@@ -101,5 +106,5 @@ export interface PinnedHookInstall {
  * the user is fetched from the versioned registry — older-than-latest pins
  * are first-class, never rejected as "not the latest".
  */
-export declare function fetchPinnedHook(name: string, version: string, apiUrl: string): Promise<PinnedHookInstall>;
+export declare function fetchPinnedHook(name: string, version: string, apiUrl: string, apiKey: string): Promise<PinnedHookInstall>;
 export {};

package/dist/lib/transport.d.ts

@@ -0,0 +1,87 @@
+import type { HooksCredentialOptions, HooksLocalOptInEnv } from "./resolver-types.js";
+/** The unhosted mode: bundled registry + local SQLite store. Never a default. */
+export type HooksTransportMode = "remote" | "local";
+/** The resolved remote-registry authority pair. Never carries a value besides `apiKey`. */
+export interface HooksRemoteAuthority {
+    /**
+     * Registry origin WITHOUT the `/v1` suffix the resolver appends — the sync
+     * client composes `/api/v1/...` routes on top of it.
+     */
+    origin: string;
+    /** The credential, resolved together with the authority it will be sent to. */
+    apiKey: string;
+    /** WHERE the authority came from: an env key NAME, a Keychain item reference, a file PATH, or "default". */
+    apiUrlSource: string | null;
+    /** WHERE the credential came from: an env key NAME, a Keychain item reference, or a file PATH. Never a value. */
+    apiKeySource: string | null;
+    /** Which tier of the chain supplied the credential. */
+    apiKeyTier: string | null;
+    /** The resolver's `<origin>/v1` base, for diagnostics. */
+    v1BaseUrl: string;
+    /** Human-readable warning, or null. Never contains secret values. */
+    warning: string | null;
+}
+/**
+ * The transport decision every hosted surface makes: remote (resolver-backed)
+ * or local (explicit opt-in, resolver never consulted).
+ *
+ * Local mode returns `authority: null` and carries no key. Remote mode always
+ * carries a fully resolved pair — the seam throws before returning a
+ * half-configured one.
+ */
+export interface HooksTransportResolution {
+    mode: HooksTransportMode;
+    /** `"local-opt-in"` for the deliberate unhosted store, else `"<api key source>+<api url source>"`. */
+    source: string;
+    /** The resolved remote pair; null in local mode. */
+    authority: HooksRemoteAuthority | null;
+}
+/** Where the one-line local-mode notice goes. Defaults to `process.stderr`. */
+export type HooksTransportNotice = (line: string) => void;
+/** Reset the once-per-process local-mode notice. Test seam only. */
+export declare function __resetHooksLocalNotice(): void;
+/**
+ * Announce the unhosted mode on stderr, once per process. Surfaces that never
+ * resolve the transport (the CLI gate opening through the opt-in) still have
+ * to SAY the run is local — the "local on stderr" doctrine (2026-09-04).
+ */
+export declare function announceHooksLocalMode(reason?: string, notice?: HooksTransportNotice): void;
+/** Strip the `/v1` suffix the resolver normalised onto the authority. */
+export declare function hooksRegistryOrigin(v1BaseUrl: string): string;
+/**
+ * Re-throw a `@hasna/contracts` resolution failure as hooks' own fail-closed
+ * diagnostic, preserving the resolver's message (which names every tier it
+ * consulted) behind the stable `REMOTE_API_*` code callers match on. Nothing
+ * here ever returns a client or a local store: every arm throws.
+ */
+export declare function rethrowHooksAuthorityFailure(error: unknown): never;
+/** Tier-1 credential inputs and Keychain-tier controls, forwarded verbatim. */
+export type { HooksCredentialOptions } from "./resolver-types.js";
+export interface HooksTransportOptions {
+    /** Tier-1 credential inputs (`--api-key` / `--profile`) and the injectable `security` runner tests use. */
+    credentials?: HooksCredentialOptions;
+    /** Where the one-line local-mode notice goes. Defaults to `process.stderr`. */
+    notice?: HooksTransportNotice;
+}
+/**
+ * Resolve the hooks transport. The deliberate unhosted opt-in is answered
+ * first and WITHOUT consulting the resolver; otherwise `@hasna/contracts`
+ * resolves the credential AND the authority together as one strict pair, and
+ * any failure to do so is a throw — the client never defaults to the on-box
+ * store (owner ruling 2026-09-04). Resolved fresh on every call.
+ */
+export declare function resolveHooksTransport(env?: HooksLocalOptInEnv, options?: HooksTransportOptions): HooksTransportResolution;
+/**
+ * The registry keys the publish surface checks. Local-by-design commands
+ * (`hooks serve`) never pick a transport; they only need to know whether a
+ * credential exists to honour a PUT. Resolved fresh on every call, through the
+ * same chain as {@link resolveHooksTransport}, so a key rotation heals a
+ * long-lived server without a restart.
+ *
+ * Returns `undefined` when no credential resolves — reads stay open and
+ * publish refuses — and THROWS on a deliberate tier that exists but cannot be
+ * honoured (a locked Keychain, an unsafe credential file), because falling
+ * through to another identity is the one silent failure the chain exists to
+ * end.
+ */
+export declare function resolveHooksServePublishKey(env?: HooksLocalOptInEnv, options?: HooksTransportOptions): string | undefined;

package/dist/openapi.d.ts

@@ -209,7 +209,7 @@ export declare const openApiDocument: {
             readonly apiKey: {
                 readonly type: "http";
                 readonly scheme: "bearer";
-                readonly description: "The registry API key (HASNA_HOOKS_API_KEY / HOOKS_API_KEY).";
+                readonly description: "The registry API key — resolved by the client through the @hasna/contracts chain (HASNA_HOOKS_API_KEY, the Keychain item hasna.credentials.hooks.api-key, or ~/.hasna/hooks/config/credentials); the server compares the inbound bearer/x-api-key value.";
             };
         };
     };

package/dist/serve.d.ts

@@ -31,6 +31,13 @@ export interface ArtifactPayload {
     script: string;
 }
 export declare function handleServeRequest(req: Request, apiKey: string | undefined): Promise<Response>;
+export declare function resolveServeOptions(options: {
+    port?: number;
+    host?: string;
+}): {
+    port: number;
+    host: string;
+};
 export declare function startServeServer(options: {
     port?: number;
     host?: string;

package/dist/storage.js

@@ -15,6 +15,123 @@ var __export = (target, all) => {
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
+// src/lib/app-home.ts
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join, resolve } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+function pathsResolverAssertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return pathsResolverResolve("data", options);
+}
+function getHomeDir(env = process.env) {
+  return env.HOME || env.USERPROFILE || homedir();
+}
+function getResolverDataRoot(env = process.env) {
+  return dataDir({ app: "hooks", home: getHomeDir(env), env });
+}
+function getLegacyDataRoot(env = process.env) {
+  return join(getHomeDir(env), ".hasna", "hooks");
+}
+function adoptResolverDataRoot(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync(join(resolved, STORE_MARKER));
+}
+function getExplicitDataDir(env = process.env) {
+  const dir = env.HASNA_HOOKS_DATA_DIR ?? env.HOOKS_DATA_DIR;
+  if (typeof dir === "string" && dir.trim().length > 0)
+    return dir.trim();
+  return;
+}
+function getExactDataRoot(env = process.env) {
+  const dir = env.HASNA_HOOKS_HOME?.trim() || env.HOOKS_HOME?.trim();
+  if (dir)
+    return resolve(dir);
+  return;
+}
+function getEffectiveDataRoot(env = process.env) {
+  const explicit = getExplicitDataDir(env);
+  if (explicit)
+    return explicit;
+  const exact = getExactDataRoot(env);
+  if (exact)
+    return exact;
+  const resolved = getResolverDataRoot(env);
+  return adoptResolverDataRoot(resolved, env) ? resolve(resolved) : getLegacyDataRoot(env);
+}
+function getReportedDbPath(env = process.env) {
+  const explicit = getExplicitDbPath(env);
+  if (explicit)
+    return explicit;
+  return join(getEffectiveDataRoot(env), "hooks.db");
+}
+function getExplicitDbPath(env = process.env) {
+  const db = env.HASNA_HOOKS_DB_PATH ?? env.HOOKS_DB_PATH;
+  if (typeof db === "string" && db.trim().length > 0)
+    return db.trim();
+  return;
+}
+var PATHS_RESOLVER_KIND_ENV, PATHS_RESOLVER_APP_SLUG_RE, STORE_MARKER = "hooks.db";
+var init_app_home = __esm(() => {
+  PATHS_RESOLVER_KIND_ENV = {
+    config: "HASNA_CONFIG_HOME",
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+});
+
 // src/db/schema.ts
 var CREATE_HOOK_EVENTS_TABLE = `
   CREATE TABLE IF NOT EXISTS hook_events (
@@ -209,9 +326,9 @@ var init_migrations = __esm(() => {
 });
 
 // src/db/legacy-import.ts
-import { existsSync, readdirSync, readFileSync } from "fs";
-import { join } from "path";
-import { homedir } from "os";
+import { existsSync as existsSync2, readdirSync, readFileSync } from "fs";
+import { join as join2 } from "path";
+import { homedir as homedir2 } from "os";
 function ensureMetaTable(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS _meta (
@@ -285,25 +402,25 @@ function importErrorsLog(db, filePath) {
   } catch {}
   return count;
 }
-function runLegacyImport(db, homeDir = homedir()) {
+function runLegacyImport(db, homeDir = homedir2()) {
   try {
     if (isAlreadyDone(db))
       return;
     let total = 0;
-    const claudeProjectsDir = join(homeDir, ".claude", "projects");
-    if (existsSync(claudeProjectsDir)) {
+    const claudeProjectsDir = join2(homeDir, ".claude", "projects");
+    if (existsSync2(claudeProjectsDir)) {
       try {
         const projectDirs = readdirSync(claudeProjectsDir);
         for (const dir of projectDirs) {
-          const projectDir = join(claudeProjectsDir, dir);
+          const projectDir = join2(claudeProjectsDir, dir);
           try {
             const files = readdirSync(projectDir);
             for (const file of files) {
               if (file.match(/^session-log-\d{4}-\d{2}-\d{2}\.jsonl$/)) {
-                total += importJsonlFile(db, join(projectDir, file));
+                total += importJsonlFile(db, join2(projectDir, file));
               }
               if (file === "errors.log") {
-                total += importErrorsLog(db, join(projectDir, file));
+                total += importErrorsLog(db, join2(projectDir, file));
               }
             }
           } catch {}
@@ -339,31 +456,27 @@ function runRetention(db, days) {
 
 // src/db/index.ts
 import { Database } from "bun:sqlite";
-import { existsSync as existsSync2, mkdirSync, cpSync } from "fs";
-import { join as join2 } from "path";
-import { homedir as homedir2 } from "os";
+import { existsSync as existsSync3, mkdirSync, cpSync } from "fs";
+import { join as join3 } from "path";
 function resolveDataDir() {
-  const explicit = process.env.HASNA_HOOKS_DATA_DIR ?? process.env.HOOKS_DATA_DIR;
-  if (explicit)
-    return explicit;
-  const newDir = join2(homedir2(), ".hasna", "hooks");
-  const oldDir = join2(homedir2(), ".hooks");
-  if (!existsSync2(newDir) && existsSync2(oldDir)) {
-    mkdirSync(join2(homedir2(), ".hasna"), { recursive: true });
-    cpSync(oldDir, newDir, { recursive: true });
+  const effective = getEffectiveDataRoot();
+  const oldDir = join3(getHomeDir(), ".hooks");
+  if (!existsSync3(effective) && existsSync3(oldDir)) {
+    mkdirSync(effective, { recursive: true });
+    cpSync(oldDir, effective, { recursive: true });
   }
-  return newDir;
+  return effective;
 }
 function getDbPath() {
   const explicitDb = process.env.HASNA_HOOKS_DB_PATH ?? process.env.HOOKS_DB_PATH;
   if (explicitDb)
     return explicitDb;
-  const dataDir = resolveDataDir();
-  return join2(dataDir, "hooks.db");
+  const dataDir2 = resolveDataDir();
+  return join3(dataDir2, "hooks.db");
 }
 function ensureDir(dbPath) {
   const dir = dbPath.substring(0, dbPath.lastIndexOf("/"));
-  if (dir && !existsSync2(dir)) {
+  if (dir && !existsSync3(dir)) {
     mkdirSync(dir, { recursive: true });
   }
 }
@@ -371,7 +484,7 @@ function getDb() {
   if (instance)
     return instance;
   const dbPath = getDbPath();
-  const isNew = dbPath === ":memory:" || !existsSync2(dbPath);
+  const isNew = dbPath === ":memory:" || !existsSync3(dbPath);
   ensureDir(dbPath);
   instance = new Database(dbPath);
   instance.exec("PRAGMA busy_timeout=5000");
@@ -395,6 +508,7 @@ function getDb() {
 }
 var instance = null;
 var init_db = __esm(() => {
+  init_app_home();
   init_migrations();
   init_legacy_import();
 });
@@ -445,8 +559,8 @@ var init_redact = __esm(() => {
     /AKIA[0-9A-Z]{16}/g,
     /ASIA[0-9A-Z]{16}/g,
     /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
-    /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/g,
-    /-----BEGIN OPENSSH PRIVATE KEY-----/g,
+    /-----BEGIN [A-Z0-9 ]*PRIVAT[E] KEY-----/g,
+    /-----BEGIN OPENSSH PRIVAT[E] KEY-----/g,
     /\bBearer\s+[A-Za-z0-9._~+/=-]{6,}/g,
     /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:[^/\s@]+@/gi,
     /\b(?:password|passwd|pwd|token|api[_-]?key|secret|access[_-]?key|client[_-]?secret|authorization|auth|credential|database_url|db_url|connection_string|dsn)\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;"']{6,})/gi

package/hooks/hook-affected-tests/package.json

@@ -43,7 +43,7 @@
     "bun": ">=1.0"
   },
   "devDependencies": {
-    "@types/bun": "^1.3.8",
+    "@types/bun": "1.3.14",
     "@types/node": "^20",
     "typescript": "^5.0.0"
   }

package/hooks/hook-agent-rules-version-check/package.json

@@ -46,7 +46,7 @@
     "bun": ">=1.0"
   },
   "devDependencies": {
-    "@types/bun": "^1.3.8",
+    "@types/bun": "1.3.14",
     "@types/node": "^20",
     "typescript": "^5.0.0"
   }