@jango-blockchained/hoox-shared 1.0.8 → 1.1.0

package/dist/service-bindings.d.ts

@@ -1,32 +1,74 @@
+import type { InternalAuthKeyName } from "./middleware/auth";
+export interface ServiceBinding {
+    fetch(request: Request | string, init?: RequestInit): Promise<Response>;
+}
+/** Env binding names for scoped internal auth keys. */
+export declare const InternalAuthKeyFields: {
+    readonly DEFAULT: "INTERNAL_KEY_BINDING";
+    readonly D1_READ: "D1_READ_KEY_BINDING";
+    readonly D1_WRITE: "D1_WRITE_KEY_BINDING";
+    readonly TRADE_EXECUTE: "TRADE_EXECUTE_KEY_BINDING";
+    readonly TRADE_READ: "TRADE_READ_KEY_BINDING";
+    readonly TELEGRAM_ALERT: "TELEGRAM_INTERNAL_KEY_BINDING";
+    readonly WALLET_EXECUTE: "WALLET_EXECUTE_KEY_BINDING";
+    readonly AGENT: "AGENT_INTERNAL_KEY";
+    /** Dashboard Pages secret aliases (legacy naming). */
+    readonly D1_INTERNAL_ALIAS: "D1_INTERNAL_KEY";
+    readonly TRADE_INTERNAL_ALIAS: "TRADE_INTERNAL_KEY";
+    readonly TELEGRAM_INTERNAL_ALIAS: "TELEGRAM_INTERNAL_KEY";
+};
+/** d1-worker read routes: prefer read-only key, fall back to legacy full key. */
+export declare const D1_READ_AUTH_KEY_FIELDS: readonly ["D1_READ_KEY_BINDING", "INTERNAL_KEY_BINDING"];
+/** d1-worker write/RPC routes: prefer write key, fall back to legacy full key. */
+export declare const D1_WRITE_AUTH_KEY_FIELDS: readonly ["D1_WRITE_KEY_BINDING", "INTERNAL_KEY_BINDING"];
+/** trade-worker execute routes (/webhook, /process, POST /api/signals). */
+export declare const TRADE_EXECUTE_AUTH_KEY_FIELDS: readonly ["TRADE_EXECUTE_KEY_BINDING", "INTERNAL_KEY_BINDING", "AGENT_INTERNAL_KEY"];
+/** trade-worker read routes (GET /api/signals, GET /report). */
+export declare const TRADE_READ_AUTH_KEY_FIELDS: readonly ["TRADE_READ_KEY_BINDING", "INTERNAL_KEY_BINDING"];
+/** telegram-worker /alert notification endpoint. */
+export declare const TELEGRAM_ALERT_AUTH_KEY_FIELDS: readonly ["TELEGRAM_INTERNAL_KEY_BINDING", "INTERNAL_KEY_BINDING"];
+/** web3-wallet-worker privileged routes. */
+export declare const WALLET_EXECUTE_AUTH_KEY_FIELDS: readonly ["WALLET_EXECUTE_KEY_BINDING", "INTERNAL_KEY_BINDING"];
+/** Dashboard → d1-worker read calls (includes Pages secret aliases). */
+export declare const DASHBOARD_D1_READ_AUTH_KEY_FIELDS: readonly ["D1_READ_KEY_BINDING", "D1_INTERNAL_KEY", "INTERNAL_KEY_BINDING"];
+/** Dashboard → trade-worker execute calls. */
+export declare const DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS: readonly ["TRADE_EXECUTE_KEY_BINDING", "TRADE_INTERNAL_KEY", "INTERNAL_KEY_BINDING"];
+/** Dashboard → telegram-worker /alert calls. */
+export declare const DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS: readonly ["TELEGRAM_INTERNAL_KEY_BINDING", "TELEGRAM_INTERNAL_KEY", "INTERNAL_KEY_BINDING"];
+/** First configured key from an ordered fallback list. */
+export declare function resolveInternalAuthKey(env: object, keyFields: InternalAuthKeyName): string | undefined;
+export interface AuthenticatedServiceEnv {
+    INTERNAL_KEY_BINDING?: string;
+    D1_READ_KEY_BINDING?: string;
+    D1_WRITE_KEY_BINDING?: string;
+    TRADE_EXECUTE_KEY_BINDING?: string;
+    TRADE_READ_KEY_BINDING?: string;
+    TELEGRAM_INTERNAL_KEY_BINDING?: string;
+    WALLET_EXECUTE_KEY_BINDING?: string;
+    AGENT_INTERNAL_KEY?: string;
+    D1_INTERNAL_KEY?: string;
+    TRADE_INTERNAL_KEY?: string;
+    TELEGRAM_INTERNAL_KEY?: string;
+}
+export declare class ServiceAuthError extends Error {
+    constructor(message: string);
+}
 /**
- * Standardized helper for inter-worker service binding calls.
- *
- * Uses `Fetcher.fetch(url, init)` directly — avoids the `as unknown as Request`
- * anti-pattern and inconsistent URL schemes used across workers
- * (http://trade-service/webhook, http://localhost/query, https://internal/webhook, etc.).
- *
- * Convention: URL path matches the route the target worker serves.
- * Defaults to POST with JSON Content-Type body.
- *
- * Note: Uses `any` for the binding parameter to avoid `@cloudflare/workers-types`
- * `Fetcher` type incompatibilities that can arise when different workspace
- * packages resolve distinct instances of the types package. At runtime, service
- * bindings from the Workers runtime always have a compatible `fetch` method.
- *
- * @example
- *   // POST with JSON body (default)
- *   const response = await serviceFetch(env.TRADE_SERVICE, "/webhook", payload);
- *
- *   // POST with extra headers
- *   const response = await serviceFetch(env.D1_SERVICE, "/query", { query, params }, {
- *     headers: { "X-Request-ID": requestId },
- *   });
- *
- *   // GET request (no body)
- *   const response = await serviceFetch(env.D1_SERVICE, "/health", undefined, { method: "GET" });
+ * serviceFetch with fail-closed internal auth.
+ * Injects X-Internal-Auth-Key from env.INTERNAL_KEY_BINDING.
  */
-export declare function serviceFetch(binding: any, path: string, body?: unknown, options?: {
+export declare function authenticatedServiceFetch<E extends AuthenticatedServiceEnv>(binding: ServiceBinding, env: E, path: string, body?: unknown, options?: {
     method?: string;
     headers?: Record<string, string>;
+    timeout?: number;
+    /** Override env key (e.g. TELEGRAM_INTERNAL_KEY_BINDING, AGENT_INTERNAL_KEY) */
+    internalKey?: string;
+    /** Ordered env fields to try when internalKey is not set */
+    internalKeyFields?: InternalAuthKeyName;
+}): Promise<Response>;
+export declare function serviceFetch(binding: ServiceBinding, path: string, body?: unknown, options?: {
+    method?: string;
+    headers?: Record<string, string>;
+    timeout?: number;
 }): Promise<Response>;
 //# sourceMappingURL=service-bindings.d.ts.map

package/dist/service-bindings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-bindings.d.ts","sourceRoot":"","sources":["../src/service-bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC9D,OAAO,CAAC,QAAQ,CAAC,CASnB"}
+{"version":3,"file":"service-bindings.d.ts","sourceRoot":"","sources":["../src/service-bindings.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACzE;AAED,uDAAuD;AACvD,eAAO,MAAM,qBAAqB;;;;;;;;;IAShC,sDAAsD;;;;CAI9C,CAAC;AAEX,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,0DAG1B,CAAC;AAEX,kFAAkF;AAClF,eAAO,MAAM,wBAAwB,2DAG3B,CAAC;AAEX,2EAA2E;AAC3E,eAAO,MAAM,6BAA6B,sFAIhC,CAAC;AAEX,gEAAgE;AAChE,eAAO,MAAM,0BAA0B,6DAG7B,CAAC;AAEX,oDAAoD;AACpD,eAAO,MAAM,8BAA8B,oEAGjC,CAAC;AAEX,4CAA4C;AAC5C,eAAO,MAAM,8BAA8B,iEAGjC,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,iCAAiC,6EAIpC,CAAC;AAEX,8CAA8C;AAC9C,eAAO,MAAM,uCAAuC,sFAI1C,CAAC;AAEX,gDAAgD;AAChD,eAAO,MAAM,wCAAwC,6FAI3C,CAAC;AAEX,0DAA0D;AAC1D,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,mBAAmB,GAC7B,MAAM,GAAG,SAAS,CAEpB;AAED,MAAM,WAAW,uBAAuB;IACtC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,uBAAuB,EACzE,OAAO,EAAE,cAAc,EACvB,GAAG,EAAE,CAAC,EACN,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;IACR,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;CACzC,GACA,OAAO,CAAC,QAAQ,CAAC,CAsBnB;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;IACR,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,QAAQ,CAAC,CAWnB"}

package/dist/service-bindings.js

@@ -15,17 +15,234 @@ var __export = (target, all) => {
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
+// src/middleware/auth.ts
+function timingSafeEqual(a, b) {
+  const encoder = new TextEncoder;
+  const aBuf = encoder.encode(a);
+  const bBuf = encoder.encode(b);
+  const len = Math.max(aBuf.length, bBuf.length);
+  let result = aBuf.length === bBuf.length ? 0 : 1;
+  for (let i = 0;i < len; i++) {
+    const av = i < aBuf.length ? aBuf[i] : 0;
+    const bv = i < bBuf.length ? bBuf[i] : 0;
+    result |= av ^ bv;
+  }
+  return result === 0;
+}
+function resolveOperatorApiKey(env) {
+  const preferred = env.OPERATOR_API_KEY;
+  if (typeof preferred === "string" && preferred.length > 0) {
+    return preferred;
+  }
+  const legacy = env.INTERNAL_API_KEY;
+  if (typeof legacy === "string" && legacy.length > 0) {
+    return legacy;
+  }
+  return;
+}
+async function requireAuth(request, env) {
+  return requireOperatorAuth(request, env);
+}
+async function requireOperatorAuth(request, env) {
+  const apiKey = resolveOperatorApiKey(env);
+  if (!apiKey) {
+    return new Response(JSON.stringify({
+      error: "Operator API key not configured",
+      hint: "Set OPERATOR_API_KEY (preferred) or INTERNAL_API_KEY on the Worker"
+    }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  const authHeader = request.headers.get("Authorization");
+  const expectedHeader = `Bearer ${apiKey}`;
+  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return null;
+}
+function createOperatorAuthMiddleware() {
+  return async (request, env, _ctx) => {
+    const denied = await requireOperatorAuth(request, env);
+    if (denied)
+      return denied;
+    return;
+  };
+}
+function normalizeKeyNames(keyName) {
+  if (typeof keyName === "string") {
+    return [keyName];
+  }
+  return [...keyName];
+}
+function collectInternalAuthKeys(env, keyNames) {
+  const keys = [];
+  for (const name of normalizeKeyNames(keyNames)) {
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0) {
+      keys.push(value);
+    }
+  }
+  return keys;
+}
+function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
+  for (const expected of expectedKeys) {
+    if (timingSafeEqual(providedKey, expected)) {
+      return true;
+    }
+  }
+  return false;
+}
+function internalAuthNotConfiguredResponse(keyNames) {
+  const label = normalizeKeyNames(keyNames).join(" | ");
+  return new Response(JSON.stringify({
+    success: false,
+    error: `Internal auth key(s) not configured: ${label}`
+  }), { status: 401, headers: { "Content-Type": "application/json" } });
+}
+function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return internalAuthNotConfiguredResponse(keyName);
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  return null;
+}
+function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
+  return async (request, env, _ctx) => {
+    const expectedKeys = collectInternalAuthKeys(env, keyName);
+    if (expectedKeys.length === 0) {
+      return internalAuthNotConfiguredResponse(keyName);
+    }
+    const providedKey = request.headers.get("X-Internal-Auth-Key");
+    if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    return;
+  };
+}
+function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return {
+      authorized: false,
+      error: `${normalizeKeyNames(keyName).join(" | ")} not configured`
+    };
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return { authorized: false, error: "Unauthorized" };
+  }
+  return { authorized: true };
+}
+
 // src/service-bindings.ts
+var InternalAuthKeyFields = {
+  DEFAULT: "INTERNAL_KEY_BINDING",
+  D1_READ: "D1_READ_KEY_BINDING",
+  D1_WRITE: "D1_WRITE_KEY_BINDING",
+  TRADE_EXECUTE: "TRADE_EXECUTE_KEY_BINDING",
+  TRADE_READ: "TRADE_READ_KEY_BINDING",
+  TELEGRAM_ALERT: "TELEGRAM_INTERNAL_KEY_BINDING",
+  WALLET_EXECUTE: "WALLET_EXECUTE_KEY_BINDING",
+  AGENT: "AGENT_INTERNAL_KEY",
+  D1_INTERNAL_ALIAS: "D1_INTERNAL_KEY",
+  TRADE_INTERNAL_ALIAS: "TRADE_INTERNAL_KEY",
+  TELEGRAM_INTERNAL_ALIAS: "TELEGRAM_INTERNAL_KEY"
+};
+var D1_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_READ,
+  InternalAuthKeyFields.DEFAULT
+];
+var D1_WRITE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_WRITE,
+  InternalAuthKeyFields.DEFAULT
+];
+var TRADE_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_EXECUTE,
+  InternalAuthKeyFields.DEFAULT,
+  InternalAuthKeyFields.AGENT
+];
+var TRADE_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_READ,
+  InternalAuthKeyFields.DEFAULT
+];
+var TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TELEGRAM_ALERT,
+  InternalAuthKeyFields.DEFAULT
+];
+var WALLET_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.WALLET_EXECUTE,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_D1_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_READ,
+  InternalAuthKeyFields.D1_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_EXECUTE,
+  InternalAuthKeyFields.TRADE_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TELEGRAM_ALERT,
+  InternalAuthKeyFields.TELEGRAM_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+function resolveInternalAuthKey(env, keyFields) {
+  return collectInternalAuthKeys(env, keyFields)[0];
+}
+
+class ServiceAuthError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ServiceAuthError";
+  }
+}
+function authenticatedServiceFetch(binding, env, path, body, options) {
+  const key = options?.internalKey ?? (options?.internalKeyFields ? resolveInternalAuthKey(env, options.internalKeyFields) : env.INTERNAL_KEY_BINDING);
+  if (!key) {
+    const label = options?.internalKeyFields ? Array.isArray(options.internalKeyFields) ? options.internalKeyFields.join(" | ") : options.internalKeyFields : "INTERNAL_KEY_BINDING";
+    return Promise.reject(new ServiceAuthError(`${label} not configured`));
+  }
+  return serviceFetch(binding, path, body, {
+    method: options?.method,
+    timeout: options?.timeout,
+    headers: {
+      ...options?.headers,
+      "X-Internal-Auth-Key": key
+    }
+  });
+}
 function serviceFetch(binding, path, body, options) {
+  const timeout = options?.timeout ?? 30000;
   return binding.fetch(`http://internal${path}`, {
     method: options?.method ?? "POST",
     headers: {
       "Content-Type": "application/json",
       ...options?.headers
     },
-    body: body != null ? JSON.stringify(body) : undefined
+    body: body != null ? JSON.stringify(body) : undefined,
+    signal: AbortSignal.timeout(timeout)
   });
 }
 export {
-  serviceFetch
+  serviceFetch,
+  resolveInternalAuthKey,
+  authenticatedServiceFetch,
+  WALLET_EXECUTE_AUTH_KEY_FIELDS,
+  TRADE_READ_AUTH_KEY_FIELDS,
+  TRADE_EXECUTE_AUTH_KEY_FIELDS,
+  TELEGRAM_ALERT_AUTH_KEY_FIELDS,
+  ServiceAuthError,
+  InternalAuthKeyFields,
+  DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS,
+  DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS,
+  DASHBOARD_D1_READ_AUTH_KEY_FIELDS,
+  D1_WRITE_AUTH_KEY_FIELDS,
+  D1_READ_AUTH_KEY_FIELDS
 };

package/dist/session.d.ts

@@ -1,5 +1,5 @@
 /**
- * Session persistence — saves/restores TUI state to ~/.hoox/session.json.
+ * Session persistence — saves/restores TUI state to $HOME/.hoox/.tui-state/session.json.
  *
  * On destroy (app exit): serializes { activeView, sidebarExpanded, windowSize,
  * lastData } so the user returns to the same state on next launch.
@@ -7,6 +7,10 @@
  * On startup: restores previous activeView and sidebarExpanded state.
  * Window size and lastData are saved for reference but re-detected/fetched fresh.
  *
+ * Uses the shared getHooxHome() utility for cross-OS home directory resolution,
+ * and stores session data in the .tui-state subdirectory. Falls back to
+ * current working directory if $HOME is not available.
+ *
  * Uses Bun's native file API for async read/write.
  */
 import type { ViewId } from "./types";
@@ -26,18 +30,18 @@ export interface SessionState {
     savedAt: string;
 }
 /**
- * Persist the current UI state to ~/.hoox/session.json.
+ * Persist the current UI state to $HOME/.hoox/.tui-state/session.json.
  * Call this on app destroy / clean shutdown.
  *
- * The ~/.hoox directory is created automatically by Bun.write if needed,
- * but we attempt to verify existence first for clarity.
+ * The $HOME/.hoox/.tui-state directory is created automatically by
+ * Bun.write if needed (Bun creates parent directories).
  */
 export declare function saveSession(activeView: ViewId, sidebarExpanded: boolean, windowSize: {
     cols: number;
     rows: number;
 }, lastData: number): Promise<void>;
 /**
- * Restore the previous session state from ~/.hoox/session.json.
+ * Restore the previous session state from $HOME/.hoox/.tui-state/session.json.
  * Returns defaults if the file doesn't exist or can't be parsed.
  *
  * @returns The saved session state, or defaults

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAItC,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,eAAe,EAAE,OAAO,CAAC;IACzB,+CAA+C;IAC/C,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;CACjB;AAkBD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,OAAO,EACxB,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAC1C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAkBf;AAID;;;;;GAKG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC,CA6B5D"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAKtC,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,eAAe,EAAE,OAAO,CAAC;IACzB,+CAA+C;IAC/C,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;CACjB;AA+CD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,OAAO,EACxB,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAC1C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAkBf;AAID;;;;;GAKG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC,CA8B5D"}

package/dist/session.js

@@ -15,10 +15,184 @@ var __export = (target, all) => {
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
-// src/session.ts
+// src/path-utils.ts
+import { existsSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
-var SESSION_FILE = join(homedir(), ".hoox", "session.json");
+import { dirname, join, resolve } from "path";
+function createHooxPath(path) {
+  return path;
+}
+function getHooxHome() {
+  try {
+    const override = process.env.HOOX_HOME?.trim();
+    if (override) {
+      return createHooxPath(resolve(override));
+    }
+    const home = homedir();
+    if (!home || home.length === 0) {
+      return createHooxPath(resolve(process.cwd(), ".hoox"));
+    }
+    return createHooxPath(join(home, ".hoox"));
+  } catch {
+    return createHooxPath(resolve(process.cwd(), ".hoox"));
+  }
+}
+function isHooxSetupRoot(dir) {
+  if (!dir)
+    return false;
+  try {
+    const root = resolve(dir);
+    return existsSync(join(root, "wrangler.jsonc")) && existsSync(join(root, "packages", "cli", "package.json"));
+  } catch {
+    return false;
+  }
+}
+function findHooxSetupRoot(startDir = process.cwd()) {
+  let dir = resolve(startDir);
+  for (;; ) {
+    if (isHooxSetupRoot(dir))
+      return dir;
+    const parent = dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function resolveHooxRuntimeRoot(options) {
+  const env = options?.env ?? process.env;
+  const cwd = resolve(options?.cwd ?? process.cwd());
+  const globalRepo = getHooxRepoPath();
+  const envRepo = env.HOOX_REPO?.trim();
+  if (envRepo) {
+    const resolved = resolve(envRepo);
+    if (isHooxSetupRoot(resolved)) {
+      return {
+        root: resolved,
+        source: "env",
+        checked: {
+          env: resolved,
+          cwd: findHooxSetupRoot(cwd),
+          global: globalRepo
+        }
+      };
+    }
+    return {
+      root: null,
+      source: "env",
+      checked: {
+        env: resolved,
+        cwd: findHooxSetupRoot(cwd),
+        global: globalRepo
+      }
+    };
+  }
+  const local = findHooxSetupRoot(cwd);
+  if (local) {
+    return {
+      root: local,
+      source: "cwd",
+      checked: { cwd: local, global: globalRepo }
+    };
+  }
+  if (isHooxSetupRoot(globalRepo)) {
+    return {
+      root: globalRepo,
+      source: "global",
+      checked: { cwd: null, global: globalRepo }
+    };
+  }
+  return {
+    root: null,
+    source: "none",
+    checked: { cwd: null, global: globalRepo }
+  };
+}
+function getTuiEntryCandidates(runtimeRoot) {
+  const root = resolve(runtimeRoot);
+  return [
+    join(root, "packages", "tui", "src", "main.tsx"),
+    join(root, "packages", "tui", "dist", "main.js"),
+    join(root, "packages", "tui", "src", "main.ts")
+  ];
+}
+function resolveHooxPath(relativePath) {
+  if (!relativePath || typeof relativePath !== "string") {
+    throw new Error("relativePath must be a non-empty string");
+  }
+  if (relativePath.includes("..")) {
+    throw new Error(`Path traversal detected in relativePath: "${relativePath}"`);
+  }
+  const normalizedPath = relativePath.replace(/\\/g, "/");
+  const hooxHome = getHooxHome();
+  const fullPath = join(hooxHome, normalizedPath);
+  const resolvedPath = resolve(fullPath);
+  const resolvedHome = resolve(hooxHome);
+  if (!resolvedPath.startsWith(resolvedHome)) {
+    throw new Error(`Resolved path "${resolvedPath}" is outside Hoox home directory`);
+  }
+  return createHooxPath(resolvedPath);
+}
+function isWithinHooxHome(path) {
+  try {
+    const hooxHome = getHooxHome();
+    const resolvedPath = resolve(path);
+    const resolvedHome = resolve(hooxHome);
+    return resolvedPath.startsWith(resolvedHome);
+  } catch {
+    return false;
+  }
+}
+function getRelativeHooxPath(absolutePath) {
+  try {
+    if (!isWithinHooxHome(absolutePath)) {
+      return null;
+    }
+    const hooxHome = getHooxHome();
+    const resolvedPath = resolve(absolutePath);
+    const resolvedHome = resolve(hooxHome);
+    const relativePath = resolvedPath.slice(resolvedHome.length);
+    return relativePath.startsWith("/") || relativePath.startsWith("\\") ? relativePath.slice(1) : relativePath;
+  } catch {
+    return null;
+  }
+}
+function getHooxRepoPath() {
+  return resolveHooxPath("repo");
+}
+function getHooxConfigDir() {
+  return resolveHooxPath("config");
+}
+function getHooxDataDir() {
+  return resolveHooxPath("data");
+}
+function getHooxWranglerPath() {
+  return resolveHooxPath("config/wrangler.jsonc");
+}
+function getHooxStatePath() {
+  return resolveHooxPath("data/state.json");
+}
+
+// src/session.ts
+import { z } from "zod";
+var SessionStateFileSchema = z.object({
+  activeView: z.string().optional(),
+  sidebarExpanded: z.boolean().optional(),
+  windowSize: z.object({
+    cols: z.number().int().positive(),
+    rows: z.number().int().positive()
+  }).optional(),
+  lastData: z.number().nonnegative().optional(),
+  savedAt: z.string().optional()
+}).strict();
+var TUI_STATE_DIR = ".tui-state";
+var SESSION_FILE = (() => {
+  try {
+    const hooxHome = getHooxHome();
+    return `${hooxHome}/${TUI_STATE_DIR}/session.json`;
+  } catch {
+    return `${process.cwd()}/${TUI_STATE_DIR}/session.json`;
+  }
+})();
 var DEFAULT_SESSION = {
   activeView: "dashboard",
   sidebarExpanded: true,
@@ -47,7 +221,8 @@ async function restoreSession() {
     if (!exists)
       return { ...DEFAULT_SESSION };
     const raw = await file.text();
-    const parsed = JSON.parse(raw);
+    const result = SessionStateFileSchema.safeParse(JSON.parse(raw));
+    const parsed = result.success ? result.data : {};
     return {
       activeView: validateViewId(parsed.activeView) ? parsed.activeView : DEFAULT_SESSION.activeView,
       sidebarExpanded: typeof parsed.sidebarExpanded === "boolean" ? parsed.sidebarExpanded : DEFAULT_SESSION.sidebarExpanded,

package/dist/sse.d.ts

@@ -1,26 +1,35 @@
 /**
- * SSE Streaming Client — subscribes to Server-Sent Events from hoox-setup API.
+ * SSE Streaming Client — subscribes to Server-Sent Events from the Hoox
+ * operator management API.
  *
  * Uses Bun's native fetch with ReadableStream reader for SSE parsing.
  * Supports reconnection with exponential backoff.
  * Events must be JSON-encoded in the "data:" field.
+ *
+ * Auth: operator transport profile (Bearer + optional Access service token).
  */
+import { type OperatorTransportEnv, type OperatorTransportProfile } from "./operator-transport";
 export type SSECallback<T> = (event: T) => void;
 export type SSEStatusCallback = (status: "connected" | "reconnecting" | "disconnected") => void;
 interface SSESubscription {
     abort: () => void;
 }
+export interface SubscribeSSEOptions {
+    transport?: OperatorTransportProfile;
+    transportEnv?: OperatorTransportEnv;
+}
 /**
  * Subscribe to an SSE endpoint and invoke the callback for each parsed event.
  *
  * Automatically reconnects on connection loss with exponential backoff.
  * Returns an object with an `abort()` method to cancel the subscription.
  *
- * @param path     API path (e.g. "/trades/stream")
+ * @param path     API path (e.g. "/v1/trades/stream")
  * @param callback Called with each parsed event of type T
  * @param onStatus Optional callback for connection status updates
+ * @param options  Optional transport profile override
  * @returns        Subscription controller with abort method
  */
-export declare function subscribeSSE<T>(path: string, callback: SSECallback<T>, onStatus?: SSEStatusCallback): SSESubscription;
+export declare function subscribeSSE<T>(path: string, callback: SSECallback<T>, onStatus?: SSEStatusCallback, options?: SubscribeSSEOptions): SSESubscription;
 export {};
 //# sourceMappingURL=sse.d.ts.map

package/dist/sse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../src/sse.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC;AAChD,MAAM,MAAM,iBAAiB,GAAG,CAC9B,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,cAAc,KAClD,IAAI,CAAC;AAEV,UAAU,eAAe;IACvB,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,EACxB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,eAAe,CAgFjB"}
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../src/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC9B,MAAM,sBAAsB,CAAC;AAS9B,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC;AAChD,MAAM,MAAM,iBAAiB,GAAG,CAC9B,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,cAAc,KAClD,IAAI,CAAC;AAEV,UAAU,eAAe;IACvB,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,EACxB,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,OAAO,CAAC,EAAE,mBAAmB,GAC5B,eAAe,CAsFjB"}