@jango-blockchained/hoox-shared 1.0.8 → 1.0.9

package/dist/kvUtils.js

@@ -32,22 +32,65 @@ function toError(err, fallback = "Unknown error") {
     return fallback;
   }
 }
+var SENSITIVE_FIELDS = new Set([
+  "password",
+  "token",
+  "secret",
+  "api_key",
+  "apiKey",
+  "authorization"
+]);
+function hasSensitiveFields(obj) {
+  for (const key of Object.keys(obj)) {
+    if (SENSITIVE_FIELDS.has(key))
+      return true;
+  }
+  return false;
+}
+function hasErrorValues(obj) {
+  for (const v of Object.values(obj)) {
+    if (v instanceof Error)
+      return true;
+  }
+  return false;
+}
 function sanitizeOutput(data) {
+  if (data === null || data === undefined)
+    return data;
+  const t = typeof data;
+  if (t === "string" || t === "number" || t === "boolean")
+    return data;
   if (data instanceof Error) {
     return { name: data.name, message: data.message };
   }
-  if (data && typeof data === "object" && !Array.isArray(data)) {
+  if (Array.isArray(data)) {
+    return data.map(sanitizeOutput);
+  }
+  if (t === "object") {
+    const obj = data;
+    const keys = Object.keys(obj);
+    if (keys.length < 10) {
+      const sanitized2 = {};
+      for (const k of keys) {
+        if (k === "stack" || k === "cause")
+          continue;
+        const v = obj[k];
+        sanitized2[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
+      }
+      return sanitized2;
+    }
+    if (!hasSensitiveFields(obj) && !hasErrorValues(obj)) {
+      return obj;
+    }
     const sanitized = {};
-    for (const [k, v] of Object.entries(data)) {
+    for (const k of keys) {
       if (k === "stack" || k === "cause")
         continue;
+      const v = obj[k];
       sanitized[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
     }
     return sanitized;
   }
-  if (Array.isArray(data)) {
-    return data.map(sanitizeOutput);
-  }
   return data;
 }
 function createJsonResponse(data, status = 200) {

package/dist/middleware/auth.d.ts

@@ -3,10 +3,10 @@
  * Provides both Bearer token auth and internal service-to-service auth
  */
 import type { Env } from "../types";
-import type { Handler } from "../types/router";
+import type { MiddlewareHandler } from "../types/router";
 /**
  * Constant-time string comparison to prevent timing attacks.
- * Manually performs byte-wise XOR comparison to avoid early returns.
+ * Uses crypto.timingSafeEqual for edge-native constant-time comparison.
  */
 export declare function timingSafeEqual(a: string, b: string): boolean;
 /**
@@ -17,6 +17,9 @@ export declare function requireAuth(request: Request, env: Env): Promise<Respons
 /**
  * Environment with an internal auth key binding.
  * Workers that accept internal service-to-service requests should extend this.
+ * Note: Uses [key: string]: unknown for compatibility with dynamic key access.
+ * This is intentionally less strict than wrangler-generated Env to allow
+ * InternalAuthEnv to be satisfied by actual Env bindings at runtime.
  */
 export interface InternalAuthEnv {
     [key: string]: unknown;
@@ -42,7 +45,7 @@ export declare function requireInternalAuth(request: Request, env: InternalAuthE
  *
  * @param keyName - The env binding name for the internal key (default: 'INTERNAL_KEY_BINDING')
  */
-export declare function createInternalAuthMiddleware<TEnv extends InternalAuthEnv>(keyName?: string): Handler<TEnv>;
+export declare function createInternalAuthMiddleware(keyName?: string): MiddlewareHandler<any>;
 /**
  * Check internal auth and return a result object (non-throwing pattern).
  * Useful when you need to check auth without immediately returning a response.

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAU7D;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAmB1B;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,MAA+B,GACvC,QAAQ,GAAG,IAAI,CAsBjB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,SAAS,eAAe,EACvE,OAAO,GAAE,MAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,MAA+B,GACvC;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAYzC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAa7D;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAkB1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,MAA+B,GACvC,QAAQ,GAAG,IAAI,CAqBjB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,MAA+B,GACvC,iBAAiB,CAAC,GAAG,CAAC,CA0BxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,MAA+B,GACvC;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAYzC"}

package/dist/middleware/index.js

@@ -32,22 +32,65 @@ function toError(err, fallback = "Unknown error") {
     return fallback;
   }
 }
+var SENSITIVE_FIELDS = new Set([
+  "password",
+  "token",
+  "secret",
+  "api_key",
+  "apiKey",
+  "authorization"
+]);
+function hasSensitiveFields(obj) {
+  for (const key of Object.keys(obj)) {
+    if (SENSITIVE_FIELDS.has(key))
+      return true;
+  }
+  return false;
+}
+function hasErrorValues(obj) {
+  for (const v of Object.values(obj)) {
+    if (v instanceof Error)
+      return true;
+  }
+  return false;
+}
 function sanitizeOutput(data) {
+  if (data === null || data === undefined)
+    return data;
+  const t = typeof data;
+  if (t === "string" || t === "number" || t === "boolean")
+    return data;
   if (data instanceof Error) {
     return { name: data.name, message: data.message };
   }
-  if (data && typeof data === "object" && !Array.isArray(data)) {
+  if (Array.isArray(data)) {
+    return data.map(sanitizeOutput);
+  }
+  if (t === "object") {
+    const obj = data;
+    const keys = Object.keys(obj);
+    if (keys.length < 10) {
+      const sanitized2 = {};
+      for (const k of keys) {
+        if (k === "stack" || k === "cause")
+          continue;
+        const v = obj[k];
+        sanitized2[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
+      }
+      return sanitized2;
+    }
+    if (!hasSensitiveFields(obj) && !hasErrorValues(obj)) {
+      return obj;
+    }
     const sanitized = {};
-    for (const [k, v] of Object.entries(data)) {
+    for (const k of keys) {
       if (k === "stack" || k === "cause")
         continue;
+      const v = obj[k];
       sanitized[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
     }
     return sanitized;
   }
-  if (Array.isArray(data)) {
-    return data.map(sanitizeOutput);
-  }
   return data;
 }
 function createJsonResponse(data, status = 200) {
@@ -114,10 +157,13 @@ function createLogger(ctx) {
       console.error(line);
     else if (level === "warn")
       console.warn(line);
+    else if (level === "debug")
+      console.debug(line);
     else
       console.info(line);
   }
   return {
+    debug: (msg, ctx2) => emit("debug", msg, ctx2),
     info: (msg, ctx2) => emit("info", msg, ctx2),
     warn: (msg, ctx2) => emit("warn", msg, ctx2),
     error: (msg, ctx2) => emit("error", msg, ctx2)
@@ -193,10 +239,19 @@ function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
   return null;
 }
 function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
-  return (request, env) => {
-    const result = requireInternalAuth(request, env, keyName);
-    if (result)
-      return result;
+  return async (request, env, _ctx) => {
+    const expectedKey = env[keyName];
+    if (!expectedKey) {
+      return new Response(JSON.stringify({
+        success: false,
+        error: `Internal auth key ${keyName} not configured`
+      }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    const providedKey = request.headers.get("X-Internal-Auth-Key");
+    if (!providedKey || !timingSafeEqual(providedKey, expectedKey)) {
+      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    return;
   };
 }
 function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
@@ -211,8 +266,94 @@ function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
   return { authorized: true };
 }
 // src/middleware/rate-limit.ts
+function createStorage(kv) {
+  if (!kv) {
+    const memory = new Map;
+    return {
+      async get(key) {
+        const entry = memory.get(key);
+        if (!entry)
+          return null;
+        if (Date.now() > entry.expiresAt) {
+          memory.delete(key);
+          return null;
+        }
+        return entry.value;
+      },
+      async put(key, value, opts) {
+        const ttl = opts?.expirationTtl ?? 0;
+        const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+        memory.set(key, { value, expiresAt });
+      },
+      async incr(key, opts) {
+        let entry = memory.get(key);
+        let newValue;
+        let attempts = 0;
+        const maxAttempts = 100;
+        while (true) {
+          const count = entry ? parseInt(entry.value, 10) : 0;
+          newValue = count + 1;
+          if (!entry) {
+            const ttl = opts?.expirationTtl ?? 0;
+            const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+            if (memory.get(key) === undefined) {
+              memory.set(key, { value: String(newValue), expiresAt });
+              return newValue;
+            }
+            entry = memory.get(key);
+          } else {
+            if (Date.now() > entry.expiresAt) {
+              memory.delete(key);
+              entry = undefined;
+              continue;
+            }
+            const currentEntry = memory.get(key);
+            if (currentEntry === entry) {
+              const ttl = opts?.expirationTtl ?? 0;
+              const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+              memory.set(key, { value: String(newValue), expiresAt });
+              return newValue;
+            }
+            entry = currentEntry;
+          }
+          attempts++;
+          if (attempts >= maxAttempts) {
+            const current = await this.get(key);
+            const count2 = current ? parseInt(current, 10) : 0;
+            newValue = count2 + 1;
+            const ttl = opts?.expirationTtl ?? 0;
+            const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+            memory.set(key, { value: String(newValue), expiresAt });
+            return newValue;
+          }
+        }
+      }
+    };
+  }
+  return {
+    async get(key) {
+      return kv.get(key);
+    },
+    async put(key, value, opts) {
+      await kv.put(key, value, opts);
+    },
+    async incr(key, opts) {
+      const maxRetries = 3;
+      for (let attempt = 0;attempt < maxRetries; attempt++) {
+        const current2 = await kv.get(key);
+        const count = current2 ? parseInt(current2, 10) : 0;
+        const next = count + 1;
+        await kv.put(key, String(next), opts);
+        return next;
+      }
+      const current = await kv.get(key);
+      return current ? parseInt(current, 10) + 1 : 1;
+    }
+  };
+}
 function createRateLimiter(kv, config) {
   const prefix = config.keyPrefix ?? "rate-limit";
+  const storage = createStorage(kv);
   function getClientIp(request) {
     return request.headers.get("CF-Connecting-IP") ?? "unknown";
   }
@@ -220,23 +361,37 @@ function createRateLimiter(kv, config) {
     const windowStart = Math.floor(Date.now() / (config.windowSeconds * 1000));
     return `${prefix}:${ip}:${windowStart}`;
   }
-  async function check(request) {
-    const ip = getClientIp(request);
-    const key = getWindowKey(ip);
-    const current = await kv.get(key);
+  async function checkWithKey(fullKey) {
+    const current = await storage.get(fullKey);
     const count = current ? parseInt(current, 10) : 0;
     if (count >= config.maxRequests) {
-      const retryAfter = config.windowSeconds - Date.now() % (config.windowSeconds * 1000) / 1000;
+      const retryAfter = Math.ceil(config.windowSeconds - Date.now() % (config.windowSeconds * 1000) / 1000);
       return {
         allowed: false,
         remaining: 0,
-        retryAfter: Math.ceil(retryAfter)
+        retryAfter
       };
     }
-    await kv.put(key, String(count + 1), {
+    const newCount = await storage.incr(fullKey, {
       expirationTtl: config.windowSeconds
     });
-    return { allowed: true, remaining: config.maxRequests - count - 1 };
+    if (newCount > config.maxRequests) {
+      const retryAfter = Math.ceil(config.windowSeconds - Date.now() % (config.windowSeconds * 1000) / 1000);
+      return {
+        allowed: false,
+        remaining: 0,
+        retryAfter
+      };
+    }
+    return {
+      allowed: true,
+      remaining: config.maxRequests - newCount
+    };
+  }
+  async function check(request) {
+    const ip = getClientIp(request);
+    const key = getWindowKey(ip);
+    return checkWithKey(key);
   }
   async function enforce(request) {
     const result = await check(request);
@@ -254,7 +409,27 @@ function createRateLimiter(kv, config) {
     }
     return null;
   }
-  return { check, enforce };
+  async function checkKey(key) {
+    const fullKey = `${prefix}:${key}`;
+    return checkWithKey(fullKey);
+  }
+  async function enforceKey(key) {
+    const result = await checkKey(key);
+    if (!result.allowed) {
+      return new Response(JSON.stringify({
+        error: "Rate limit exceeded",
+        retryAfter: result.retryAfter
+      }), {
+        status: 429,
+        headers: {
+          "Content-Type": "application/json",
+          "Retry-After": String(result.retryAfter ?? config.windowSeconds)
+        }
+      });
+    }
+    return null;
+  }
+  return { check, enforce, checkKey, enforceKey };
 }
 // src/middleware/validate.ts
 function validateJson(schema, data) {

package/dist/middleware/logger.d.ts

@@ -7,10 +7,11 @@ export interface LogContext {
     module?: string;
 }
 export interface Logger {
+    debug(message: string, context?: Record<string, unknown>): void;
     info(message: string, context?: Record<string, unknown>): void;
     warn(message: string, context?: Record<string, unknown>): void;
     error(message: string, context?: Record<string, unknown>): void;
 }
 export declare function createLogger(ctx: LogContext): Logger;
-export declare function withRequestLog<E extends Record<string, unknown>>(handler: (request: Request, env: E, ctx: ExecutionContext) => Promise<Response>, logCtx: LogContext): (request: Request, env: E, ctx: ExecutionContext) => Promise<Response>;
+export declare function withRequestLog<E>(handler: (request: Request, env: E, ctx: ExecutionContext) => Promise<Response>, logCtx: LogContext): (request: Request, env: E, ctx: ExecutionContext) => Promise<Response>;
 //# sourceMappingURL=logger.d.ts.map

package/dist/middleware/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACjE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CA0BpD;AAED,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9D,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,CAAC,EACN,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,QAAQ,CAAC,EACtB,MAAM,EAAE,UAAU,GACjB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,CAAC,CA2BxE"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/middleware/logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACjE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CA4BpD;AAED,wBAAgB,cAAc,CAAC,CAAC,EAC9B,OAAO,EAAE,CACP,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,CAAC,EACN,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,QAAQ,CAAC,EACtB,MAAM,EAAE,UAAU,GACjB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,CAAC,CA2BxE"}

package/dist/middleware/rate-limit.d.ts

@@ -18,7 +18,9 @@ interface RateLimitResult {
 export interface RateLimiter {
     check(request: Request): Promise<RateLimitResult>;
     enforce(request: Request): Promise<Response | null>;
+    checkKey(key: string): Promise<RateLimitResult>;
+    enforceKey(key: string): Promise<Response | null>;
 }
-export declare function createRateLimiter(kv: Env["CONFIG_KV"], config: RateLimitConfig): RateLimiter;
+export declare function createRateLimiter(kv: Env["CONFIG_KV"] | undefined, config: RateLimitConfig): RateLimiter;
 export {};
 //# sourceMappingURL=rate-limit.d.ts.map

package/dist/middleware/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CACrD;AAED,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,EACpB,MAAM,EAAE,eAAe,GACtB,WAAW,CA0Db"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAEpC,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAChD,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CACnD;AA6HD,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,SAAS,EAChC,MAAM,EAAE,eAAe,GACtB,WAAW,CAiHb"}

package/dist/path-utils.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Path Resolution Service for Hoox
+ *
+ * Provides cross-OS utilities for resolving the $HOME/.hoox directory location
+ * and constructing type-safe paths within it.
+ *
+ * Supports macOS, Linux, and Windows with proper fallback handling.
+ */
+/**
+ * Branded type for Hoox paths to prevent accidental string usage.
+ * This ensures type safety when working with paths.
+ */
+export type HooxPath = string & {
+    readonly __brand: "HooxPath";
+};
+/**
+ * Gets the Hoox home directory location: $HOME/.hoox
+ *
+ * Behavior:
+ * - Returns $HOME/.hoox on macOS, Linux, Windows
+ * - Falls back to current working directory if HOME is not available
+ * - Resolves to absolute path
+ *
+ * @returns Absolute path to $HOME/.hoox as a branded HooxPath
+ * @throws Never — always returns a valid path
+ *
+ * @example
+ * ```typescript
+ * const hooxHome = getHooxHome();
+ * // Returns: "/Users/alice/.hoox" (macOS)
+ * // Returns: "/home/alice/.hoox" (Linux)
+ * // Returns: "C:\\Users\\alice\\.hoox" (Windows)
+ * ```
+ */
+export declare function getHooxHome(): HooxPath;
+/**
+ * Resolves a relative path within the Hoox home directory.
+ *
+ * Behavior:
+ * - Joins the relative path with $HOME/.hoox
+ * - Resolves to absolute path
+ * - Prevents path traversal attacks (../ sequences)
+ *
+ * @param relativePath - Path relative to $HOME/.hoox (e.g., "repo", "config/wrangler.jsonc")
+ * @returns Absolute path as a branded HooxPath
+ * @throws Error if path contains suspicious traversal patterns
+ *
+ * @example
+ * ```typescript
+ * const repoPath = resolveHooxPath("repo");
+ * // Returns: "/Users/alice/.hoox/repo"
+ *
+ * const configPath = resolveHooxPath("config/wrangler.jsonc");
+ * // Returns: "/Users/alice/.hoox/config/wrangler.jsonc"
+ * ```
+ */
+export declare function resolveHooxPath(relativePath: string): HooxPath;
+/**
+ * Checks if a given path is within the Hoox home directory.
+ *
+ * @param path - Path to check
+ * @returns true if path is within $HOME/.hoox, false otherwise
+ *
+ * @example
+ * ```typescript
+ * isWithinHooxHome("/Users/alice/.hoox/repo"); // true
+ * isWithinHooxHome("/Users/alice/other"); // false
+ * ```
+ */
+export declare function isWithinHooxHome(path: string): boolean;
+/**
+ * Gets the relative path from Hoox home directory.
+ *
+ * @param absolutePath - Absolute path to resolve
+ * @returns Relative path from $HOME/.hoox, or null if path is outside Hoox home
+ *
+ * @example
+ * ```typescript
+ * getRelativeHooxPath("/Users/alice/.hoox/repo/src");
+ * // Returns: "repo/src"
+ *
+ * getRelativeHooxPath("/Users/alice/other");
+ * // Returns: null
+ * ```
+ */
+export declare function getRelativeHooxPath(absolutePath: string): string | null;
+/**
+ * Constructs a path to the Hoox repository location.
+ *
+ * @returns Path to $HOME/.hoox/repo as a branded HooxPath
+ *
+ * @example
+ * ```typescript
+ * const repoPath = getHooxRepoPath();
+ * // Returns: "/Users/alice/.hoox/repo"
+ * ```
+ */
+export declare function getHooxRepoPath(): HooxPath;
+/**
+ * Constructs a path to the Hoox configuration directory.
+ *
+ * @returns Path to $HOME/.hoox/config as a branded HooxPath
+ *
+ * @example
+ * ```typescript
+ * const configDir = getHooxConfigDir();
+ * // Returns: "/Users/alice/.hoox/config"
+ * ```
+ */
+export declare function getHooxConfigDir(): HooxPath;
+/**
+ * Constructs a path to the Hoox data directory.
+ *
+ * @returns Path to $HOME/.hoox/data as a branded HooxPath
+ *
+ * @example
+ * ```typescript
+ * const dataDir = getHooxDataDir();
+ * // Returns: "/Users/alice/.hoox/data"
+ * ```
+ */
+export declare function getHooxDataDir(): HooxPath;
+/**
+ * Constructs a path to the Hoox wrangler configuration file.
+ *
+ * @returns Path to $HOME/.hoox/config/wrangler.jsonc as a branded HooxPath
+ *
+ * @example
+ * ```typescript
+ * const wranglerPath = getHooxWranglerPath();
+ * // Returns: "/Users/alice/.hoox/config/wrangler.jsonc"
+ * ```
+ */
+export declare function getHooxWranglerPath(): HooxPath;
+/**
+ * Constructs a path to the Hoox state file.
+ *
+ * @returns Path to $HOME/.hoox/data/state.json as a branded HooxPath
+ *
+ * @example
+ * ```typescript
+ * const statePath = getHooxStatePath();
+ * // Returns: "/Users/alice/.hoox/data/state.json"
+ * ```
+ */
+export declare function getHooxStatePath(): HooxPath;
+//# sourceMappingURL=path-utils.d.ts.map

package/dist/path-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../src/path-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC;AAUjE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAYtC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,QAAQ,CAiC9D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAStD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,IAAI,QAAQ,CAE1C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAEzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,CAE9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C"}

package/dist/path-utils.js

@@ -0,0 +1,101 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/path-utils.ts
+import { homedir } from "os";
+import { join, resolve } from "path";
+function createHooxPath(path) {
+  return path;
+}
+function getHooxHome() {
+  try {
+    const home = homedir();
+    if (!home || home.length === 0) {
+      return createHooxPath(resolve(process.cwd(), ".hoox"));
+    }
+    return createHooxPath(join(home, ".hoox"));
+  } catch {
+    return createHooxPath(resolve(process.cwd(), ".hoox"));
+  }
+}
+function resolveHooxPath(relativePath) {
+  if (!relativePath || typeof relativePath !== "string") {
+    throw new Error("relativePath must be a non-empty string");
+  }
+  if (relativePath.includes("..")) {
+    throw new Error(`Path traversal detected in relativePath: "${relativePath}"`);
+  }
+  const normalizedPath = relativePath.replace(/\\/g, "/");
+  const hooxHome = getHooxHome();
+  const fullPath = join(hooxHome, normalizedPath);
+  const resolvedPath = resolve(fullPath);
+  const resolvedHome = resolve(hooxHome);
+  if (!resolvedPath.startsWith(resolvedHome)) {
+    throw new Error(`Resolved path "${resolvedPath}" is outside Hoox home directory`);
+  }
+  return createHooxPath(resolvedPath);
+}
+function isWithinHooxHome(path) {
+  try {
+    const hooxHome = getHooxHome();
+    const resolvedPath = resolve(path);
+    const resolvedHome = resolve(hooxHome);
+    return resolvedPath.startsWith(resolvedHome);
+  } catch {
+    return false;
+  }
+}
+function getRelativeHooxPath(absolutePath) {
+  try {
+    if (!isWithinHooxHome(absolutePath)) {
+      return null;
+    }
+    const hooxHome = getHooxHome();
+    const resolvedPath = resolve(absolutePath);
+    const resolvedHome = resolve(hooxHome);
+    const relativePath = resolvedPath.slice(resolvedHome.length);
+    return relativePath.startsWith("/") || relativePath.startsWith("\\") ? relativePath.slice(1) : relativePath;
+  } catch {
+    return null;
+  }
+}
+function getHooxRepoPath() {
+  return resolveHooxPath("repo");
+}
+function getHooxConfigDir() {
+  return resolveHooxPath("config");
+}
+function getHooxDataDir() {
+  return resolveHooxPath("data");
+}
+function getHooxWranglerPath() {
+  return resolveHooxPath("config/wrangler.jsonc");
+}
+function getHooxStatePath() {
+  return resolveHooxPath("data/state.json");
+}
+export {
+  resolveHooxPath,
+  isWithinHooxHome,
+  getRelativeHooxPath,
+  getHooxWranglerPath,
+  getHooxStatePath,
+  getHooxRepoPath,
+  getHooxHome,
+  getHooxDataDir,
+  getHooxConfigDir
+};