@hoox-sh/hoox-shared 1.2.1 → 1.4.0

package/dist/schemas/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/schemas/registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA2ajD,qEAAqE;AACrE,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAA6B,CAAC;AAE7E,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAa,CAAC;AAE1E,gDAAgD;AAChD,eAAO,MAAM,YAAY,EAAE,MAAM,EAAkC,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/schemas/registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA4cjD,qEAAqE;AACrE,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAA6B,CAAC;AAE7E,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAa,CAAC;AAE1E,gDAAgD;AAChD,eAAO,MAAM,YAAY,EAAE,MAAM,EAAkC,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,gFAAgF;AAChF,eAAO,MAAM,cAAc,EAAE,kBAAkB,EAO7C,CAAC;AAEH,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAEzE"}

package/dist/schemas/registry.js

@@ -22,9 +22,12 @@ function deriveCalledBy(manifests) {
     if (!calledBy[workerName])
       calledBy[workerName] = new Set;
     for (const svc of manifest.services) {
-      if (!calledBy[svc.service])
-        calledBy[svc.service] = new Set;
-      calledBy[svc.service].add(workerName);
+      let callers = calledBy[svc.service];
+      if (!callers) {
+        callers = new Set;
+        calledBy[svc.service] = callers;
+      }
+      callers.add(workerName);
     }
   }
   const result = {};
@@ -37,6 +40,7 @@ var manifests = {
   hoox: {
     name: "hoox",
     path: "workers/hoox-worker",
+    defaultEnabled: true,
     vars: {
       WEBHOOK_API_KEY_BINDING: {
         type: "secret",
@@ -46,7 +50,11 @@ var manifests = {
         type: "secret",
         description: "Inter-worker auth key"
       },
-      HA_TOKEN_BINDING: { type: "secret", description: "Home Assistant token" }
+      HA_TOKEN_BINDING: { type: "secret", description: "Home Assistant token" },
+      TELEGRAM_ALLOWED_CHAT_IDS: {
+        type: "secret",
+        description: "Comma-separated chat IDs for webhook notify (fail-closed when unset); alias AUTHORIZED_CHAT_IDS"
+      }
     },
     services: [
       {
@@ -72,7 +80,8 @@ var manifests = {
       ai: true,
       queues: { producer: ["trade-execution"] },
       durableObjects: [
-        { name: "IDEMPOTENCY_STORE", className: "IdempotencyStore" }
+        { name: "IDEMPOTENCY_STORE", className: "IdempotencyStore" },
+        { name: "RATE_LIMITER", className: "RateLimiterStore" }
       ]
     },
     middleware: [
@@ -87,6 +96,7 @@ var manifests = {
   "trade-worker": {
     name: "trade-worker",
     path: "workers/trade-worker",
+    defaultEnabled: true,
     vars: {
       INTERNAL_KEY_BINDING: {
         type: "secret",
@@ -96,15 +106,22 @@ var manifests = {
         type: "secret",
         description: "Telegram outbound auth"
       },
-      BINANCE_KEY_BINDING: { type: "secret", description: "Binance API key" },
-      BINANCE_SECRET_BINDING: {
+      EXCHANGE_KEY_BINDING: {
+        type: "secret",
+        description: "Unified exchange API key (Binance / Bybit / MEXC)"
+      },
+      EXCHANGE_SECRET_BINDING: {
+        type: "secret",
+        description: "Unified exchange API secret"
+      },
+      EXCHANGE_TESTNET_KEY_BINDING: {
         type: "secret",
-        description: "Binance API secret"
+        description: "Optional unified testnet API key"
       },
-      MEXC_KEY_BINDING: { type: "secret", description: "MEXC API key" },
-      MEXC_SECRET_BINDING: { type: "secret", description: "MEXC API secret" },
-      BYBIT_KEY_BINDING: { type: "secret", description: "Bybit API key" },
-      BYBIT_SECRET_BINDING: { type: "secret", description: "Bybit API secret" }
+      EXCHANGE_TESTNET_SECRET_BINDING: {
+        type: "secret",
+        description: "Optional unified testnet API secret"
+      }
     },
     services: [
       {
@@ -146,6 +163,7 @@ var manifests = {
   "telegram-worker": {
     name: "telegram-worker",
     path: "workers/telegram-worker",
+    defaultEnabled: true,
     vars: {
       INTERNAL_KEY_BINDING: {
         type: "secret",
@@ -159,6 +177,10 @@ var manifests = {
       TELEGRAM_SECRET_TOKEN: {
         type: "secret",
         description: "Webhook verification token"
+      },
+      AUTHORIZED_CHAT_IDS: {
+        type: "secret",
+        description: "Comma-separated chat IDs; inbound webhook fail-closed when unset; outbound /alert allowlist"
       }
     },
     services: [],
@@ -179,6 +201,7 @@ var manifests = {
   "d1-worker": {
     name: "d1-worker",
     path: "workers/d1-worker",
+    defaultEnabled: true,
     vars: {
       INTERNAL_KEY_BINDING: {
         type: "secret",
@@ -201,6 +224,7 @@ var manifests = {
   "web3-wallet-worker": {
     name: "web3-wallet-worker",
     path: "workers/web3-wallet-worker",
+    defaultEnabled: false,
     vars: {
       WALLET_PK_SECRET: { type: "secret", description: "Wallet private key" },
       WALLET_MNEMONIC_SECRET: {
@@ -221,6 +245,7 @@ var manifests = {
   "agent-worker": {
     name: "agent-worker",
     path: "workers/agent-worker",
+    defaultEnabled: true,
     vars: {
       AGENT_INTERNAL_KEY: { type: "secret", description: "Agent worker auth" },
       INTERNAL_KEY_BINDING: {
@@ -257,6 +282,7 @@ var manifests = {
   "email-worker": {
     name: "email-worker",
     path: "workers/email-worker",
+    defaultEnabled: false,
     vars: {
       INTERNAL_KEY_BINDING: {
         type: "secret",
@@ -294,6 +320,7 @@ var manifests = {
   "analytics-worker": {
     name: "analytics-worker",
     path: "workers/analytics-worker",
+    defaultEnabled: true,
     vars: {
       CLOUDFLARE_API_TOKEN: {
         type: "secret",
@@ -313,6 +340,7 @@ var manifests = {
   "report-worker": {
     name: "report-worker",
     path: "workers/report-worker",
+    defaultEnabled: false,
     vars: {
       CF_API_TOKEN_BINDING: {
         type: "secret",
@@ -347,6 +375,7 @@ var manifests = {
   "pyne-worker": {
     name: "pyne-worker",
     path: "workers/pyne-worker",
+    defaultEnabled: true,
     vars: {
       API_KEY: {
         type: "secret",
@@ -384,6 +413,7 @@ var manifests = {
   dashboard: {
     name: "dashboard",
     path: "workers/dashboard",
+    defaultEnabled: true,
     vars: {
       DASHBOARD_USER: {
         type: "secret",
@@ -426,8 +456,21 @@ var manifests = {
 var CALLED_BY = deriveCalledBy(manifests);
 var WORKER_MANIFESTS = manifests;
 var WORKER_NAMES = Object.keys(manifests).sort();
+var WORKER_CATALOG = WORKER_NAMES.map((name) => {
+  const m = manifests[name];
+  return {
+    name: m.name,
+    path: m.path,
+    defaultEnabled: m.defaultEnabled
+  };
+});
+function getWorkerDefaultEnabled(name) {
+  return manifests[name]?.defaultEnabled;
+}
 export {
+  getWorkerDefaultEnabled,
   WORKER_NAMES,
   WORKER_MANIFESTS,
+  WORKER_CATALOG,
   CALLED_BY
 };

package/dist/schemas/types.d.ts

@@ -10,6 +10,11 @@ export interface WorkerManifest {
     name: string;
     /** Path relative to project root (e.g. "workers/trade-worker") */
     path: string;
+    /**
+     * Default for `workers.<name>.enabled` in the root wrangler.jsonc catalog.
+     * Used by `hoox workers enable|disable` and when seeding missing workers.
+     */
+    defaultEnabled: boolean;
     /** Vars the worker declares in its wrangler.jsonc `vars` section */
     vars: Record<string, VarDef>;
     /** Service bindings this worker calls */

package/dist/schemas/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/schemas/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AAEH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,yCAAyC;IACzC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,gDAAgD;IAChD,cAAc,EAAE,aAAa,CAAC;IAC9B,+DAA+D;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAClC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/schemas/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AAEH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,yCAAyC;IACzC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,gDAAgD;IAChD,cAAc,EAAE,aAAa,CAAC;IAC9B,+DAA+D;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAClC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B"}

package/dist/schemas/validators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../src/schemas/validators.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAalE;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,MAAM,GACnB,eAAe,EAAE,CA4GnB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,gBAAgB,EAAE,MAAM,GACvB,eAAe,EAAE,CA2CnB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,cAAc,EAAE,MAAM,GACrB,eAAe,EAAE,CA6BnB;AAID;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAmItE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAYhE;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE;IACL,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,GACA;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CAWhE"}
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../src/schemas/validators.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAalE;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,MAAM,GACnB,eAAe,EAAE,CA8GnB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,gBAAgB,EAAE,MAAM,GACvB,eAAe,EAAE,CA2CnB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,cAAc,EAAE,MAAM,GACrB,eAAe,EAAE,CA6BnB;AAID;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAoItE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAYhE;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE;IACL,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,GACA;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CAWhE"}

package/dist/schemas/validators.js

@@ -53,7 +53,7 @@ function validateWranglerJsonc(workerName, manifest, jsoncContent) {
     }
   }
   for (const [name, def] of Object.entries(manifest.vars)) {
-    if (def.type === "secret" && !name.endsWith("_BINDING") && !name.endsWith("_SECRET") && !name.startsWith("CLOUDFLARE_") && name !== "TELEGRAM_SECRET_TOKEN" && name !== "MAILGUN_API_KEY" && name !== "EMAIL_SCAN_SUBJECT" && name !== "DASHBOARD_USER" && name !== "DASHBOARD_PASS" && name !== "SESSION_SECRET" && name !== "AGENT_INTERNAL_KEY") {
+    if (def.type === "secret" && !name.endsWith("_BINDING") && !name.endsWith("_SECRET") && !name.startsWith("CLOUDFLARE_") && name !== "TELEGRAM_SECRET_TOKEN" && name !== "TELEGRAM_ALLOWED_CHAT_IDS" && name !== "AUTHORIZED_CHAT_IDS" && name !== "MAILGUN_API_KEY" && name !== "EMAIL_SCAN_SUBJECT" && name !== "DASHBOARD_USER" && name !== "DASHBOARD_PASS" && name !== "SESSION_SECRET" && name !== "AGENT_INTERNAL_KEY") {
       errors.push({
         worker: workerName,
         severity: "warning",
@@ -170,6 +170,8 @@ function generateWranglerJsonc(manifest) {
     parts.push(`  "vars": {`);
     for (const [i, name] of varKeys.entries()) {
       const def = manifest.vars[name];
+      if (!def)
+        continue;
       const comma = i < varKeys.length - 1 ? "," : "";
       const val = def.type === "secret" ? "__SECRET__" : JSON.stringify(def.default ?? "");
       parts.push(`    "${name}": ${val}${comma}`);

package/dist/service-bindings.js

@@ -23,12 +23,24 @@ function timingSafeEqual(a, b) {
   const len = Math.max(aBuf.length, bBuf.length);
   let result = aBuf.length === bBuf.length ? 0 : 1;
   for (let i = 0;i < len; i++) {
-    const av = i < aBuf.length ? aBuf[i] : 0;
-    const bv = i < bBuf.length ? bBuf[i] : 0;
+    const av = aBuf[i] ?? 0;
+    const bv = bBuf[i] ?? 0;
     result |= av ^ bv;
   }
   return result === 0;
 }
+async function timingSafeEqualAsync(a, b) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle || typeof subtle.digest !== "function" || typeof subtle.timingSafeEqual !== "function") {
+    return timingSafeEqual(a, b);
+  }
+  const encoder = new TextEncoder;
+  const [providedHash, expectedHash] = await Promise.all([
+    subtle.digest("SHA-256", encoder.encode(a)),
+    subtle.digest("SHA-256", encoder.encode(b))
+  ]);
+  return subtle.timingSafeEqual(providedHash, expectedHash);
+}
 function resolveOperatorApiKey(env) {
   const preferred = env.OPERATOR_API_KEY;
   if (typeof preferred === "string" && preferred.length > 0) {
@@ -53,7 +65,7 @@ async function requireOperatorAuth(request, env) {
   }
   const authHeader = request.headers.get("Authorization");
   const expectedHeader = `Bearer ${apiKey}`;
-  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
+  if (!authHeader || !await timingSafeEqualAsync(authHeader, expectedHeader)) {
     return new Response(JSON.stringify({ error: "Unauthorized" }), {
       status: 401,
       headers: { "Content-Type": "application/json" }
@@ -86,12 +98,13 @@ function collectInternalAuthKeys(env, keyNames) {
   return keys;
 }
 function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
+  let matched = false;
   for (const expected of expectedKeys) {
     if (timingSafeEqual(providedKey, expected)) {
-      return true;
+      matched = true;
     }
   }
-  return false;
+  return matched;
 }
 function internalAuthNotConfiguredResponse(keyNames) {
   const label = normalizeKeyNames(keyNames).join(" | ");

package/dist/session.js

@@ -16,7 +16,13 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // src/path-utils.ts
-import { existsSync } from "fs";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+  chmodSync
+} from "fs";
 import { homedir } from "os";
 import { dirname, join, resolve } from "path";
 function createHooxPath(path) {
@@ -42,7 +48,55 @@ function isHooxSetupRoot(dir) {
     return false;
   try {
     const root = resolve(dir);
-    return existsSync(join(root, "wrangler.jsonc")) && existsSync(join(root, "packages", "cli", "package.json"));
+    if (!existsSync(join(root, "packages", "cli", "package.json"))) {
+      return false;
+    }
+    return existsSync(join(root, "wrangler.jsonc")) || existsSync(join(root, "wrangler.jsonc.example")) || existsSync(join(root, "workers")) || existsSync(join(root, ".gitmodules"));
+  } catch {
+    return false;
+  }
+}
+function getRememberedMonorepoPath() {
+  return resolveHooxPath("config/monorepo.json");
+}
+function getRememberedMonorepoRoot() {
+  try {
+    const path = getRememberedMonorepoPath();
+    if (!existsSync(path))
+      return null;
+    const raw = readFileSync(path, "utf-8");
+    const data = JSON.parse(raw);
+    if (!data.root || typeof data.root !== "string")
+      return null;
+    const resolved = resolve(data.root);
+    return isHooxSetupRoot(resolved) ? resolved : null;
+  } catch {
+    return null;
+  }
+}
+function rememberMonorepoRoot(root) {
+  try {
+    const resolved = resolve(root);
+    if (!isHooxSetupRoot(resolved))
+      return false;
+    const configDir = getHooxConfigDir();
+    mkdirSync(configDir, { recursive: true, mode: 448 });
+    try {
+      chmodSync(configDir, 448);
+    } catch {}
+    const payload = {
+      root: resolved,
+      updatedAt: new Date().toISOString()
+    };
+    const path = getRememberedMonorepoPath();
+    writeFileSync(path, JSON.stringify(payload, null, 2) + `
+`, {
+      mode: 384
+    });
+    try {
+      chmodSync(path, 384);
+    } catch {}
+    return true;
   } catch {
     return false;
   }
@@ -62,6 +116,7 @@ function resolveHooxRuntimeRoot(options) {
   const env = options?.env ?? process.env;
   const cwd = resolve(options?.cwd ?? process.cwd());
   const globalRepo = getHooxRepoPath();
+  const remembered = options?.skipRemembered ? null : getRememberedMonorepoRoot();
   const envRepo = env.HOOX_REPO?.trim();
   if (envRepo) {
     const resolved = resolve(envRepo);
@@ -72,6 +127,7 @@ function resolveHooxRuntimeRoot(options) {
         checked: {
           env: resolved,
           cwd: findHooxSetupRoot(cwd),
+          remembered,
           global: globalRepo
         }
       };
@@ -82,6 +138,7 @@ function resolveHooxRuntimeRoot(options) {
       checked: {
         env: resolved,
         cwd: findHooxSetupRoot(cwd),
+        remembered,
         global: globalRepo
       }
     };
@@ -91,20 +148,27 @@ function resolveHooxRuntimeRoot(options) {
     return {
       root: local,
       source: "cwd",
-      checked: { cwd: local, global: globalRepo }
+      checked: { cwd: local, remembered, global: globalRepo }
+    };
+  }
+  if (remembered) {
+    return {
+      root: remembered,
+      source: "remembered",
+      checked: { cwd: null, remembered, global: globalRepo }
     };
   }
   if (isHooxSetupRoot(globalRepo)) {
     return {
       root: globalRepo,
       source: "global",
-      checked: { cwd: null, global: globalRepo }
+      checked: { cwd: null, remembered: null, global: globalRepo }
     };
   }
   return {
     root: null,
     source: "none",
-    checked: { cwd: null, global: globalRepo }
+    checked: { cwd: null, remembered: null, global: globalRepo }
   };
 }
 function getTuiEntryCandidates(runtimeRoot) {

package/dist/stores/config-store.d.ts

@@ -3,6 +3,8 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import type { ViewId, LogFilter, NotificationPreferences } from "../types";
+/** TUI prefs file — isolated from operator config.json (which may hold apiToken). */
+export declare function getTuiPreferencesPath(): string;
 export interface ConfigState {
     theme: "dark" | "light";
     refreshIntervalMs: number;

package/dist/stores/config-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../src/stores/config-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiBH,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAoF3E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,UAAU,EAAE,SAAS,CAAC;IACtB,aAAa,EAAE,uBAAuB,CAAC;IACvC,YAAY,EAAE,OAAO,CAAC;CACvB;AAID,UAAU,aAAa;IACrB,+DAA+D;IAC/D,YAAY,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;IACtD,8CAA8C;IAC9C,aAAa,EAAE,MAAM,IAAI,CAAC;IAC1B,yCAAyC;IACzC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,8CAA8C;IAC9C,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,uBAAuB,KAAK,IAAI,CAAC;CACtE;AAiBD,eAAO,MAAM,cAAc;;;;;;;;;;;;;;eAtClB,MAAM,GAAG,OAAO;2BACJ,MAAM;qBACZ,MAAM;;;;;;;;;;;;;;;;sBAKL,OAAO;sBAOP,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI;uBAEtC,MAAM,IAAI;qBAEZ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI;4BAE9B,CAAC,OAAO,EAAE,MAAM,uBAAuB,KAAK,IAAI;;;eApB7D,MAAM,GAAG,OAAO;2BACJ,MAAM;qBACZ,MAAM;;;;;;;;;;;;;;;;sBAKL,OAAO;sBAOP,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI;uBAEtC,MAAM,IAAI;qBAEZ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI;4BAE9B,CAAC,OAAO,EAAE,MAAM,uBAAuB,KAAK,IAAI;;EA+ErE,CAAC"}
+{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../src/stores/config-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAM3E,qFAAqF;AACrF,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AA0ID,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,UAAU,EAAE,SAAS,CAAC;IACtB,aAAa,EAAE,uBAAuB,CAAC;IACvC,YAAY,EAAE,OAAO,CAAC;CACvB;AAID,UAAU,aAAa;IACrB,+DAA+D;IAC/D,YAAY,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;IACtD,8CAA8C;IAC9C,aAAa,EAAE,MAAM,IAAI,CAAC;IAC1B,yCAAyC;IACzC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,8CAA8C;IAC9C,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,uBAAuB,KAAK,IAAI,CAAC;CACtE;AAiBD,eAAO,MAAM,cAAc;;;;;;;;;;;;;;eAtClB,MAAM,GAAG,OAAO;2BACJ,MAAM;qBACZ,MAAM;;;;;;;;;;;;;;;;sBAKL,OAAO;sBAOP,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI;uBAEtC,MAAM,IAAI;qBAEZ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI;4BAE9B,CAAC,OAAO,EAAE,MAAM,uBAAuB,KAAK,IAAI;;;eApB7D,MAAM,GAAG,OAAO;2BACJ,MAAM;qBACZ,MAAM;;;;;;;;;;;;;;;;sBAKL,OAAO;sBAOP,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI;uBAEtC,MAAM,IAAI;qBAEZ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI;4BAE9B,CAAC,OAAO,EAAE,MAAM,uBAAuB,KAAK,IAAI;;EA+ErE,CAAC"}