@jango-blockchained/hoox-shared 1.0.9 → 1.1.0

package/README.md

@@ -20,6 +20,23 @@ This package provides the shared foundation for all Hoox workers. It includes:
 
 → [Architecture Overview](../../docs/devops/architecture/overview.md)
 
+## Public API
+
+This package is published as `@jango-blockchained/hoox-shared` and exposes a layered import surface via the package `exports` map. All subpaths resolve to compiled `dist/*.js` and `dist/*.d.ts` files — the package tarball does **not** include TypeScript sources.
+
+| Import                                            | Resolves to               | Notes                                                               |
+| ------------------------------------------------- | ------------------------- | ------------------------------------------------------------------- |
+| `@jango-blockchained/hoox-shared`                 | `dist/index.js`           | Main barrel — everything in `src/index.ts`                          |
+| `@jango-blockchained/hoox-shared/<subdir>`        | `dist/<subdir>/index.js`  | Sub-barrel for the named subdirectory                               |
+| `@jango-blockchained/hoox-shared/<subdir>/<file>` | `dist/<subdir>/<file>.js` | Specific submodule file                                             |
+| `@jango-blockchained/hoox-shared/stores/<store>`  | `dist/stores/<store>.js`  | Zustand stores — deep-import only (no barrel)                       |
+| `@jango-blockchained/hoox-shared/types`           | `dist/types/index.d.ts`   | Type-only re-exports                                                |
+| `@jango-blockchained/hoox-shared/<anything-else>` | `dist/<anything-else>.js` | Catch-all for top-level modules (e.g. `errors`, `router`, `kvKeys`) |
+
+The named subdirectories with deep-import support are: `middleware`, `d1`, `schemas`, `wizard`, `exchanges`. Each one re-exports its submodules from its `index.ts` barrel, so the bare-subdir form (`<subdir>`) and the deep form (`<subdir>/<file>`) return the same symbols — the bare form is just the pre-bundled rollup.
+
+**Recommendation:** prefer the bare form for subdirectories (`hoox-shared/middleware`) unless you specifically need a single submodule to keep the import graph small. The bare form gives you a stable, curated surface; the deep form is for tree-shaking-conscious or very specific use cases.
+
 ## Development
 
 ```bash

package/dist/analytics.d.ts

@@ -5,10 +5,31 @@
 /**
  * Environment with optional analytics service binding.
  * Workers that support analytics tracking should extend this type.
+ *
+ * Note on auth: `trackAnalytics` reads `INTERNAL_KEY_BINDING` from the
+ * passed env to authenticate with the analytics worker (its `/track/*`
+ * routes are gated by `requireInternalAuth`). We don't declare the
+ * property here because Cloudflare's generated `Env` type already
+ * includes it as a required string, and declaring it again as
+ * `INTERNAL_KEY_BINDING?: string` would conflict with workers that
+ * `extends Cloudflare.Env, AnalyticsEnv` (TS2320). The property is
+ * accessed dynamically; production envs from wrangler always have it,
+ * and test mocks add it explicitly via spread.
  */
 export interface AnalyticsEnv {
     ANALYTICS_SERVICE?: Fetcher;
 }
+/**
+ * Optional configuration for trackAnalytics.
+ */
+export interface TrackAnalyticsOptions {
+    /**
+     * Custom indexes to attach to the Analytics Engine data point.
+     * Use this to tag rows with stable identifiers (e.g. probe_id)
+     * so they can be SQL-queried later.
+     */
+    indexes?: readonly string[];
+}
 /**
  * Track an analytics event by forwarding to the analytics worker.
  * Non-blocking: failures are logged but never throw.
@@ -16,6 +37,7 @@ export interface AnalyticsEnv {
  * @param env - Worker environment with optional ANALYTICS_SERVICE binding
  * @param endpoint - Analytics endpoint path (e.g., "/track/api-call")
  * @param body - JSON-serializable payload to send
+ * @param options - Optional config (currently supports `indexes`)
  */
-export declare function trackAnalytics(env: AnalyticsEnv, endpoint: string, body: Record<string, unknown>): Promise<void>;
+export declare function trackAnalytics(env: AnalyticsEnv, endpoint: string, body: Record<string, unknown>, options?: TrackAnalyticsOptions): Promise<void>;
 //# sourceMappingURL=analytics.d.ts.map

package/dist/analytics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../src/analytics.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,IAAI,CAAC,CAaf"}
+{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../src/analytics.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,YAAY;IAC3B,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,YAAY,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/dist/analytics.js

@@ -16,14 +16,25 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // src/analytics.ts
-async function trackAnalytics(env, endpoint, body) {
+async function trackAnalytics(env, endpoint, body, options) {
   if (!env.ANALYTICS_SERVICE)
     return;
   try {
+    const payload = {
+      ...body,
+      ...options?.indexes ? { indexes: [...options.indexes] } : {}
+    };
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    const internalKey = env.INTERNAL_KEY_BINDING;
+    if (internalKey) {
+      headers["X-Internal-Auth-Key"] = internalKey;
+    }
     await env.ANALYTICS_SERVICE.fetch(new Request(`http://localhost${endpoint}`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
+      headers,
+      body: JSON.stringify(payload)
     }));
   } catch (e) {
     console.error("Analytics tracking failed:", e);

package/dist/api-client.d.ts

@@ -2,11 +2,15 @@
  * API Client — Bun fetch wrapper with AbortController timeouts, retry logic,
  * and connection-aware error handling for the Hoox TUI dashboard.
  *
+ * Auth headers come from the operator transport profile (Bearer + optional
+ * Cloudflare Access service-token headers). See `operator-transport.ts`.
+ *
  * All fetch calls include a 5s timeout via AbortController.
  * Network errors (fetch failures, timeouts) are retried with exponential backoff.
  * HTTP 401/403 errors are NOT retried — they indicate auth/config issues.
  * HTTP 429 (rate limit) triggers a backing-off warning.
  */
+import { type OperatorTransportEnv, type OperatorTransportProfile } from "./operator-transport";
 export declare class WorkerAPIError extends Error {
     status: number;
     retryable: boolean;
@@ -16,6 +20,12 @@ export declare class WorkerAPIError extends Error {
         retryable?: boolean;
     });
 }
+export interface HooxFetchOptions extends RequestInit {
+    /** Injected transport profile (tests / multi-tenant callers). */
+    transport?: OperatorTransportProfile;
+    /** Env override when resolving transport (tests). */
+    transportEnv?: OperatorTransportEnv;
+}
 /**
  * Perform an API fetch with timeout, retry logic, and error handling.
  *
@@ -26,9 +36,9 @@ export declare class WorkerAPIError extends Error {
  * - HTTP 429 (rate limited): NO retry — fail with rate limit info.
  * - HTTP 5xx: retry once.
  *
- * @param path    API path (e.g. "/workers")
+ * @param path    API path (e.g. "/v1/workers")
  * @param options Fetch options (merged with auth header and timeout signal)
  * @returns       Parsed JSON response body
  */
-export declare function hooxFetch<T = unknown>(path: string, options?: RequestInit): Promise<T>;
+export declare function hooxFetch<T = unknown>(path: string, options?: HooxFetchOptions): Promise<T>;
 //# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmBH,qBAAa,cAAe,SAAQ,KAAK;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;gBAGjB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;CAOtE;AAyCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAAC,CAAC,GAAG,OAAO,EACzC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,CAAC,CAAC,CA8FZ"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC9B,MAAM,sBAAsB,CAAC;AAgB9B,qBAAa,cAAe,SAAQ,KAAK;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;gBAGjB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;CAOtE;AA+CD,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,iEAAiE;IACjE,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,qDAAqD;IACrD,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAAC,CAAC,GAAG,OAAO,EACzC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,CAAC,CAAC,CAsGZ"}

package/dist/api-client.js

@@ -15,6 +15,69 @@ var __export = (target, all) => {
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
+// src/operator-transport.ts
+function stripTrailingSlashes(url) {
+  return url.replace(/\/+$/, "");
+}
+function parseTransport(raw) {
+  if (!raw)
+    return null;
+  const v = raw.trim().toLowerCase();
+  if (VALID_TRANSPORTS.has(v)) {
+    return v;
+  }
+  return null;
+}
+function resolveOperatorTransportProfile(env = process.env, options = {}) {
+  const accessClientId = env.CF_ACCESS_CLIENT_ID?.trim() ?? "";
+  const accessClientSecret = env.CF_ACCESS_CLIENT_SECRET?.trim() ?? "";
+  const hasAccess = Boolean(accessClientId && accessClientSecret);
+  const explicit = parseTransport(env.HOOX_TRANSPORT) ?? parseTransport(options.configTransport);
+  const transport = explicit ?? (hasAccess ? "access" : "public");
+  const apiFromEnv = env.HOOX_API_URL?.trim();
+  const apiFromConfig = options.configApiUrl?.trim();
+  const tokenFromEnv = env.HOOX_API_TOKEN?.trim();
+  const tokenFromConfig = options.configApiToken?.trim();
+  return {
+    transport,
+    apiBase: stripTrailingSlashes(apiFromEnv || apiFromConfig || DEFAULT_API_BASE),
+    bearerToken: tokenFromEnv || tokenFromConfig || "",
+    accessClientId,
+    accessClientSecret
+  };
+}
+function buildOperatorAuthHeaders(profile) {
+  const headers = {};
+  if (profile.bearerToken) {
+    headers.Authorization = `Bearer ${profile.bearerToken}`;
+  }
+  const useAccessHeaders = profile.transport === "access" || Boolean(profile.accessClientId) && Boolean(profile.accessClientSecret);
+  if (useAccessHeaders && profile.accessClientId && profile.accessClientSecret) {
+    headers["CF-Access-Client-Id"] = profile.accessClientId;
+    headers["CF-Access-Client-Secret"] = profile.accessClientSecret;
+  }
+  return headers;
+}
+function hasOperatorClientCredentials(profile) {
+  if (profile.bearerToken)
+    return true;
+  return Boolean(profile.accessClientId && profile.accessClientSecret);
+}
+function operatorUrl(profile, path) {
+  const base = profile.apiBase.replace(/\/+$/, "");
+  const p = path.startsWith("/") ? path : `/${path}`;
+  return `${base}${p}`;
+}
+var DEFAULT_API_BASE = "http://localhost:8787", VALID_TRANSPORTS;
+var init_operator_transport = __esm(() => {
+  VALID_TRANSPORTS = new Set([
+    "public",
+    "access",
+    "mtls",
+    "tunnel"
+  ]);
+});
+
 // src/api-client.ts
 var exports_api_client = {};
 __export(exports_api_client, {
@@ -40,20 +103,25 @@ function isNetworkError(error) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function activeProfile(override) {
+  return override ?? resolveOperatorTransportProfile();
+}
 async function hooxFetch(path, options) {
+  const profile = options?.transport ?? (options?.transportEnv ? resolveOperatorTransportProfile(options.transportEnv) : activeProfile());
+  const { transport: _t, transportEnv: _e, ...fetchInit } = options ?? {};
   let lastError;
   for (let attempt = 0;attempt <= MAX_RETRIES; attempt++) {
     const controller = new AbortController;
     const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
     try {
-      const url = `${API_BASE}${path}`;
+      const url = operatorUrl(profile, path);
       const headers = {
         "Content-Type": "application/json",
-        ...API_TOKEN ? { Authorization: `Bearer ${API_TOKEN}` } : {},
-        ...options?.headers
+        ...buildOperatorAuthHeaders(profile),
+        ...fetchInit.headers
       };
       const response = await fetch(url, {
-        ...options,
+        ...fetchInit,
         headers,
         signal: controller.signal
       });
@@ -101,10 +169,9 @@ async function hooxFetch(path, options) {
     retryable: false
   });
 }
-var API_BASE, API_TOKEN, FETCH_TIMEOUT_MS = 5000, MAX_RETRIES = 3, BASE_RETRY_DELAY_MS = 1000, MAX_RETRY_DELAY_MS = 16000, WorkerAPIError;
+var FETCH_TIMEOUT_MS = 5000, MAX_RETRIES = 3, BASE_RETRY_DELAY_MS = 1000, MAX_RETRY_DELAY_MS = 16000, WorkerAPIError;
 var init_api_client = __esm(() => {
-  API_BASE = process.env.HOOX_API_URL || "http://localhost:8787";
-  API_TOKEN = process.env.HOOX_API_TOKEN || "";
+  init_operator_transport();
   WorkerAPIError = class WorkerAPIError extends Error {
     status;
     retryable;

package/dist/colors.d.ts

@@ -1,33 +1,72 @@
 /**
- * Color Tokens — Maps hoox landing page design system to terminal-safe RGBA hex values.
+ * Color Tokens — Hoox TUI / shared design system (terminal-safe hex).
  *
- * Design DNA:
- *   - Dark monochrome background: oklch(0.08 0 0) → #0D1117
- *   - Orange accent: oklch(0.7 0.2 45) → #E8780A
- *   - Squared edges (no rounding — editorial aesthetic)
+ * Design DNA (2026 polish):
+ *   - Near-black canvas (not warm grey)
+ *   - Cool indigo / cyan accent (Grok Build–adjacent; less orange)
+ *   - Squared edges (no rounding — editorial HUD aesthetic)
  *
- * Usage: import { Colors } from "@hoox/shared"
+ * Usage: import { Colors, ConnectionStatusColor } from "@jango-blockchained/hoox-shared"
  *        <text fg={Colors.accent}>Important</text>
  */
 export declare const Colors: {
-    readonly background: "#0D1117";
-    readonly foreground: "#EEEEEE";
-    readonly card: "#1C1C1F";
-    readonly border: "#484848";
-    readonly muted: "#A0A0A0";
-    readonly "muted-foreground": "#6E6E6E";
-    readonly dim: "#3B3B3D";
-    readonly accent: "#E8780A";
-    readonly "accent-dim": "#B85E08";
-    readonly success: "#00FF88";
-    readonly warning: "#FFAA00";
-    readonly error: "#FF4444";
-    readonly info: "#4488FF";
-    readonly text: "#EEEEEE";
-    readonly "text-muted": "#A0A0A0";
-    readonly panel: "#1C1C1F";
-    readonly divider: "#484848";
-    readonly highlight: "#E8780A";
+    readonly background: "#050508";
+    readonly foreground: "#E8E8F0";
+    readonly card: "#0A0A0F";
+    readonly border: "#232330";
+    readonly muted: "#8B8B9E";
+    readonly "muted-foreground": "#6E6E84";
+    readonly dim: "#3C3C50";
+    readonly accent: "#818CF8";
+    readonly "accent-dim": "#6366F1";
+    readonly success: "#34D399";
+    readonly warning: "#FBBF24";
+    readonly error: "#FB7185";
+    readonly info: "#38BDF8";
+    readonly text: "#E8E8F0";
+    readonly "text-muted": "#8B8B9E";
+    readonly panel: "#0A0A0F";
+    readonly divider: "#232330";
+    readonly highlight: "#22D3EE";
+    /** Dialog / overlay dim only — not a surface color */
+    readonly backdrop: "#000000";
 };
 export type ColorKey = keyof typeof Colors;
+/**
+ * Cool spectrum for animated brackets (cyan → indigo → violet → magenta → back).
+ * Used by TUI chrome (`CoolBrackets`) similar to Grok Build accent motion.
+ */
+export declare const CoolBracketPalette: readonly ["#22D3EE", "#38BDF8", "#60A5FA", "#818CF8", "#A78BFA", "#C084FC", "#E879F9", "#A78BFA", "#818CF8", "#38BDF8"];
+export type CoolBracketColor = (typeof CoolBracketPalette)[number];
+/** Connection pill colors (status bar). */
+export declare const ConnectionStatusColor: {
+    readonly connected: "#34D399";
+    readonly polling: "#22D3EE";
+    readonly reconnecting: "#FBBF24";
+    readonly offline: "#FB7185";
+};
+export type ConnectionStatusKey = keyof typeof ConnectionStatusColor;
+/** Worker / service health colors. */
+export declare const WorkerStatusColor: {
+    readonly operational: "#34D399";
+    readonly degraded: "#FBBF24";
+    readonly down: "#FB7185";
+};
+export type WorkerStatusKey = keyof typeof WorkerStatusColor;
+/** Log stream level colors. `debug` uses muted (readable), not dim. */
+export declare const LogLevelColor: {
+    readonly error: "#FB7185";
+    readonly warn: "#FBBF24";
+    readonly info: "#E8E8F0";
+    readonly debug: "#8B8B9E";
+};
+export type LogLevelColorKey = keyof typeof LogLevelColor;
+/** Alert severity colors. */
+export declare const AlertSeverityColor: {
+    readonly info: "#38BDF8";
+    readonly warning: "#FBBF24";
+    readonly error: "#FB7185";
+    readonly critical: "#FB7185";
+};
+export type AlertSeverityColorKey = keyof typeof AlertSeverityColor;
 //# sourceMappingURL=colors.d.ts.map

package/dist/colors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"colors.d.ts","sourceRoot":"","sources":["../src/colors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;CA0BT,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,MAAM,CAAC"}
+{"version":3,"file":"colors.d.ts","sourceRoot":"","sources":["../src/colors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;IA2BjB,sDAAsD;;CAE9C,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,MAAM,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,yHAWrB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,2CAA2C;AAC3C,eAAO,MAAM,qBAAqB;;;;;CAKxB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,qBAAqB,CAAC;AAErE,sCAAsC;AACtC,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE7D,uEAAuE;AACvE,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,aAAa,CAAC;AAE1D,6BAA6B;AAC7B,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,MAAM,OAAO,kBAAkB,CAAC"}

package/dist/colors.js

@@ -17,25 +17,66 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // src/colors.ts
 var Colors = {
-  background: "#0D1117",
-  foreground: "#EEEEEE",
-  card: "#1C1C1F",
-  border: "#484848",
-  muted: "#A0A0A0",
-  "muted-foreground": "#6E6E6E",
-  dim: "#3B3B3D",
-  accent: "#E8780A",
-  "accent-dim": "#B85E08",
-  success: "#00FF88",
-  warning: "#FFAA00",
-  error: "#FF4444",
-  info: "#4488FF",
-  text: "#EEEEEE",
-  "text-muted": "#A0A0A0",
-  panel: "#1C1C1F",
-  divider: "#484848",
-  highlight: "#E8780A"
+  background: "#050508",
+  foreground: "#E8E8F0",
+  card: "#0A0A0F",
+  border: "#232330",
+  muted: "#8B8B9E",
+  "muted-foreground": "#6E6E84",
+  dim: "#3C3C50",
+  accent: "#818CF8",
+  "accent-dim": "#6366F1",
+  success: "#34D399",
+  warning: "#FBBF24",
+  error: "#FB7185",
+  info: "#38BDF8",
+  text: "#E8E8F0",
+  "text-muted": "#8B8B9E",
+  panel: "#0A0A0F",
+  divider: "#232330",
+  highlight: "#22D3EE",
+  backdrop: "#000000"
+};
+var CoolBracketPalette = [
+  "#22D3EE",
+  "#38BDF8",
+  "#60A5FA",
+  "#818CF8",
+  "#A78BFA",
+  "#C084FC",
+  "#E879F9",
+  "#A78BFA",
+  "#818CF8",
+  "#38BDF8"
+];
+var ConnectionStatusColor = {
+  connected: Colors.success,
+  polling: Colors.highlight,
+  reconnecting: Colors.warning,
+  offline: Colors.error
+};
+var WorkerStatusColor = {
+  operational: Colors.success,
+  degraded: Colors.warning,
+  down: Colors.error
+};
+var LogLevelColor = {
+  error: Colors.error,
+  warn: Colors.warning,
+  info: Colors.foreground,
+  debug: Colors.muted
+};
+var AlertSeverityColor = {
+  info: Colors.info,
+  warning: Colors.warning,
+  error: Colors.error,
+  critical: Colors.error
 };
 export {
-  Colors
+  WorkerStatusColor,
+  LogLevelColor,
+  CoolBracketPalette,
+  ConnectionStatusColor,
+  Colors,
+  AlertSeverityColor
 };

package/dist/config.d.ts

@@ -1,6 +1,17 @@
+/** Owner rwx only — config dir may hold secrets and certs. */
+export declare const HOOX_DIR_MODE = 448;
+/** Owner rw only — config.json may contain apiToken. */
+export declare const HOOX_CONFIG_FILE_MODE = 384;
+/** Operator transport stored in config (mirrors HOOX_TRANSPORT). */
+export type HooxConfigTransport = "public" | "access" | "mtls" | "tunnel";
 export interface HooxConfig {
     apiUrl: string;
     apiToken: string;
+    /**
+     * Operator transport preference for TUI/CLI remote sessions.
+     * Env `HOOX_TRANSPORT` overrides this when set.
+     */
+    transport?: HooxConfigTransport;
     refreshIntervalMs: number;
     theme: "dark" | "light";
     activeExchanges: string[];
@@ -16,7 +27,29 @@ export interface HooxConfig {
 /** Read config from disk, merging with defaults and env vars */
 export declare function readConfigSync(): HooxConfig;
 export declare function readConfig(): Promise<HooxConfig>;
-/** Write config to disk */
+/**
+ * Ensure `~/.hoox` exists with owner-only permissions.
+ * Best-effort chmod on existing dirs (may fail on some FS / Windows).
+ */
+export declare function ensureHooxDirSecure(dir?: string): void;
+/**
+ * Write a path with owner-only file mode (0o600).
+ * Used by config writers and other secret-bearing files under ~/.hoox.
+ */
+export declare function writeSecureFileSync(filePath: string, contents: string, mode?: number): void;
+/**
+ * True when group or other have any access bits set (Unix permission triad).
+ * Pure helper so tests do not depend on real filesystem after mock.module.
+ */
+export declare function isUnixModeGroupOrWorldAccessible(mode: number): boolean;
+/**
+ * True when group or other have any access bits set (Unix).
+ * Always false when the file is missing or mode is unavailable.
+ */
+export declare function isConfigWorldOrGroupReadable(filePath?: string): boolean;
+/** Human-readable warning when config perms are too open. */
+export declare function formatConfigPermissionWarning(filePath?: string): string | null;
+/** Write config to disk with owner-only permissions. */
 export declare function writeConfigSync(config: HooxConfig): void;
 export declare function writeConfig(config: HooxConfig): Promise<void>;
 /** Validate config — returns array of error messages */

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,EAAE;QACb,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,EAAE,OAAO,CAAC;QAChB,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAkBD,gEAAgE;AAChE,wBAAgB,cAAc,IAAI,UAAU,CAsB3C;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,CAEtD;AAED,2BAA2B;AAC3B,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CASxD;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AAED,wDAAwD;AACxD,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAepE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAyBA,8DAA8D;AAC9D,eAAO,MAAM,aAAa,MAAQ,CAAC;AACnC,wDAAwD;AACxD,eAAO,MAAM,qBAAqB,MAAQ,CAAC;AAE3C,oEAAoE;AACpE,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,EAAE;QACb,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,EAAE,OAAO,CAAC;QAChB,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAmBD,gEAAgE;AAChE,wBAAgB,cAAc,IAAI,UAAU,CAsB3C;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,CAEtD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAgB,GAAG,IAAI,CAS/D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAA8B,GACnC,IAAI,CAON;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,GAAE,MAAoB,GAC7B,OAAO,CAOT;AAED,6DAA6D;AAC7D,wBAAgB,6BAA6B,CAC3C,QAAQ,GAAE,MAAoB,GAC7B,MAAM,GAAG,IAAI,CAOf;AAED,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAWxD;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AASD,wDAAwD;AACxD,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAqBpE"}

package/dist/config.js

@@ -16,14 +16,24 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // src/config.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import {
+  readFileSync,
+  writeFileSync,
+  existsSync,
+  mkdirSync,
+  chmodSync,
+  statSync
+} from "fs";
 import { join } from "path";
 import { homedir } from "os";
 var HOX_DIR = join(homedir(), ".hoox");
 var CONFIG_PATH = join(HOX_DIR, "config.json");
+var HOOX_DIR_MODE = 448;
+var HOOX_CONFIG_FILE_MODE = 384;
 var DEFAULT_CONFIG = {
   apiUrl: "http://localhost:8787",
   apiToken: "",
+  transport: "public",
   refreshIntervalMs: 500,
   theme: "dark",
   activeExchanges: ["binance", "bybit", "mexc"],
@@ -56,12 +66,41 @@ function readConfigSync() {
 async function readConfig() {
   return readConfigSync();
 }
+function ensureHooxDirSecure(dir = HOX_DIR) {
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: HOOX_DIR_MODE });
+  }
+  try {
+    chmodSync(dir, HOOX_DIR_MODE);
+  } catch {}
+}
+function writeSecureFileSync(filePath, contents, mode = HOOX_CONFIG_FILE_MODE) {
+  writeFileSync(filePath, contents, { encoding: "utf-8", mode });
+  try {
+    chmodSync(filePath, mode);
+  } catch {}
+}
+function isUnixModeGroupOrWorldAccessible(mode) {
+  return (mode & 63) !== 0;
+}
+function isConfigWorldOrGroupReadable(filePath = CONFIG_PATH) {
+  try {
+    if (!existsSync(filePath))
+      return false;
+    return isUnixModeGroupOrWorldAccessible(statSync(filePath).mode & 511);
+  } catch {
+    return false;
+  }
+}
+function formatConfigPermissionWarning(filePath = CONFIG_PATH) {
+  if (!isConfigWorldOrGroupReadable(filePath))
+    return null;
+  return `Warning: ${filePath} is group/world-accessible. ` + `Run: chmod 600 ${filePath}  (and chmod 700 on the parent dir). ` + `This file may contain apiToken / operator secrets.`;
+}
 function writeConfigSync(config) {
   try {
-    if (!existsSync(HOX_DIR)) {
-      mkdirSync(HOX_DIR, { recursive: true });
-    }
-    writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
+    ensureHooxDirSecure(HOX_DIR);
+    writeSecureFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), HOOX_CONFIG_FILE_MODE);
   } catch (err) {
     console.error("Failed to write config:", err);
   }
@@ -69,6 +108,12 @@ function writeConfigSync(config) {
 async function writeConfig(config) {
   writeConfigSync(config);
 }
+var VALID_TRANSPORTS = new Set([
+  "public",
+  "access",
+  "mtls",
+  "tunnel"
+]);
 function validateConfig(config) {
   const errors = [];
   if (config.apiUrl && !config.apiUrl.startsWith("http")) {
@@ -80,12 +125,22 @@ function validateConfig(config) {
   if (config.theme && !["dark", "light"].includes(config.theme)) {
     errors.push('theme must be "dark" or "light"');
   }
+  if (config.transport !== undefined && !VALID_TRANSPORTS.has(config.transport)) {
+    errors.push('transport must be "public" | "access" | "mtls" | "tunnel"');
+  }
   return errors;
 }
 export {
+  writeSecureFileSync,
   writeConfigSync,
   writeConfig,
   validateConfig,
   readConfigSync,
-  readConfig
+  readConfig,
+  isUnixModeGroupOrWorldAccessible,
+  isConfigWorldOrGroupReadable,
+  formatConfigPermissionWarning,
+  ensureHooxDirSecure,
+  HOOX_DIR_MODE,
+  HOOX_CONFIG_FILE_MODE
 };

package/dist/cron-handler.d.ts

@@ -6,8 +6,8 @@ export interface CronHandlerOptions<Env = unknown> {
     handler: (event: ScheduledEvent, env: Env, ctx: ExecutionContext) => Promise<void> | void;
     /** Optional logger instance */
     logger?: {
-        info(message: string, data?: Record<string, any>): void;
-        error(message: string, data?: Record<string, any>): void;
+        info(message: string, data?: Record<string, unknown>): void;
+        error(message: string, data?: Record<string, unknown>): void;
     };
 }
 /**

package/dist/cron-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cron-handler.d.ts","sourceRoot":"","sources":["../src/cron-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,MAAM,WAAW,kBAAkB,CAAC,GAAG,GAAG,OAAO;IAC/C,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,OAAO,EAAE,CACP,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,+BAA+B;IAC/B,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;QACxD,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;KAC1D,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAG,OAAO,EAC7C,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAK9B,OAAO,cAAc,EACrB,KAAK,GAAG,EACR,KAAK,gBAAgB,KACpB,OAAO,CAAC,IAAI,CAAC,CA6BjB"}
+{"version":3,"file":"cron-handler.d.ts","sourceRoot":"","sources":["../src/cron-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,MAAM,WAAW,kBAAkB,CAAC,GAAG,GAAG,OAAO;IAC/C,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,OAAO,EAAE,CACP,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,+BAA+B;IAC/B,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QAC5D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC9D,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAG,OAAO,EAC7C,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAK9B,OAAO,cAAc,EACrB,KAAK,GAAG,EACR,KAAK,gBAAgB,KACpB,OAAO,CAAC,IAAI,CAAC,CA6BjB"}

package/dist/d1/index.js

@@ -292,6 +292,7 @@ class D1Repository {
     }
   }
 }
+
 // src/d1/schemas.ts
 import { z } from "zod";
 var TradeRecordSchema = z.object({