@jango-blockchained/hoox-shared 1.0.9 → 1.1.0

package/dist/middleware/rate-limit.js

@@ -0,0 +1,181 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/middleware/rate-limit.ts
+function createStorage(kv) {
+  if (!kv) {
+    const memory = new Map;
+    return {
+      async get(key) {
+        const entry = memory.get(key);
+        if (!entry)
+          return null;
+        if (Date.now() > entry.expiresAt) {
+          memory.delete(key);
+          return null;
+        }
+        return entry.value;
+      },
+      async put(key, value, opts) {
+        const ttl = opts?.expirationTtl ?? 0;
+        const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+        memory.set(key, { value, expiresAt });
+      },
+      async incr(key, opts) {
+        let entry = memory.get(key);
+        let newValue;
+        let attempts = 0;
+        const maxAttempts = 100;
+        while (true) {
+          const count = entry ? parseInt(entry.value, 10) : 0;
+          newValue = count + 1;
+          if (!entry) {
+            const ttl = opts?.expirationTtl ?? 0;
+            const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+            if (memory.get(key) === undefined) {
+              memory.set(key, { value: String(newValue), expiresAt });
+              return newValue;
+            }
+            entry = memory.get(key);
+          } else {
+            if (Date.now() > entry.expiresAt) {
+              memory.delete(key);
+              entry = undefined;
+              continue;
+            }
+            const currentEntry = memory.get(key);
+            if (currentEntry === entry) {
+              const ttl = opts?.expirationTtl ?? 0;
+              const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+              memory.set(key, { value: String(newValue), expiresAt });
+              return newValue;
+            }
+            entry = currentEntry;
+          }
+          attempts++;
+          if (attempts >= maxAttempts) {
+            const current = await this.get(key);
+            const count2 = current ? parseInt(current, 10) : 0;
+            newValue = count2 + 1;
+            const ttl = opts?.expirationTtl ?? 0;
+            const expiresAt = ttl > 0 ? Date.now() + ttl * 1000 : Infinity;
+            memory.set(key, { value: String(newValue), expiresAt });
+            return newValue;
+          }
+        }
+      }
+    };
+  }
+  return {
+    async get(key) {
+      return kv.get(key);
+    },
+    async put(key, value, opts) {
+      await kv.put(key, value, opts);
+    },
+    async incr(key, opts) {
+      const current = await kv.get(key);
+      const count = current ? parseInt(current, 10) : 0;
+      const next = count + 1;
+      await kv.put(key, String(next), opts);
+      return next;
+    }
+  };
+}
+function createRateLimiter(kv, config) {
+  const prefix = config.keyPrefix ?? "rate-limit";
+  const storage = createStorage(kv);
+  function getClientIp(request) {
+    return request.headers.get("CF-Connecting-IP") ?? "unknown";
+  }
+  function getWindowKey(ip) {
+    const windowStart = Math.floor(Date.now() / (config.windowSeconds * 1000));
+    return `${prefix}:${ip}:${windowStart}`;
+  }
+  async function checkWithKey(fullKey) {
+    const current = await storage.get(fullKey);
+    const count = current ? parseInt(current, 10) : 0;
+    if (count >= config.maxRequests) {
+      const retryAfter = Math.ceil(config.windowSeconds - Date.now() % (config.windowSeconds * 1000) / 1000);
+      return {
+        allowed: false,
+        remaining: 0,
+        retryAfter
+      };
+    }
+    const newCount = await storage.incr(fullKey, {
+      expirationTtl: config.windowSeconds
+    });
+    if (newCount > config.maxRequests) {
+      const retryAfter = Math.ceil(config.windowSeconds - Date.now() % (config.windowSeconds * 1000) / 1000);
+      return {
+        allowed: false,
+        remaining: 0,
+        retryAfter
+      };
+    }
+    return {
+      allowed: true,
+      remaining: config.maxRequests - newCount
+    };
+  }
+  async function check(request) {
+    const ip = getClientIp(request);
+    const key = getWindowKey(ip);
+    return checkWithKey(key);
+  }
+  async function enforce(request) {
+    const result = await check(request);
+    if (!result.allowed) {
+      return new Response(JSON.stringify({
+        error: "Rate limit exceeded",
+        retryAfter: result.retryAfter
+      }), {
+        status: 429,
+        headers: {
+          "Content-Type": "application/json",
+          "Retry-After": String(result.retryAfter ?? config.windowSeconds)
+        }
+      });
+    }
+    return null;
+  }
+  async function checkKey(key) {
+    const fullKey = `${prefix}:${key}`;
+    return checkWithKey(fullKey);
+  }
+  async function enforceKey(key) {
+    const result = await checkKey(key);
+    if (!result.allowed) {
+      return new Response(JSON.stringify({
+        error: "Rate limit exceeded",
+        retryAfter: result.retryAfter
+      }), {
+        status: 429,
+        headers: {
+          "Content-Type": "application/json",
+          "Retry-After": String(result.retryAfter ?? config.windowSeconds)
+        }
+      });
+    }
+    return null;
+  }
+  return { check, enforce, checkKey, enforceKey };
+}
+export {
+  createRateLimiter
+};

package/dist/middleware/security-headers.js

@@ -0,0 +1,58 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/middleware/security-headers.ts
+var SECURITY_HEADERS_DEFAULTS = {
+  xContentTypeOptions: "nosniff",
+  xFrameOptions: "DENY",
+  xXssProtection: "1; mode=block",
+  referrerPolicy: "strict-origin-when-cross-origin",
+  permissionsPolicy: "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()",
+  strictTransportSecurity: "max-age=31536000; includeSubDomains",
+  contentSecurityPolicy: "default-src 'self'"
+};
+function secureHeaders(options) {
+  const opts = { ...SECURITY_HEADERS_DEFAULTS, ...options };
+  const headers = {
+    "X-Content-Type-Options": opts.xContentTypeOptions,
+    "X-Frame-Options": opts.xFrameOptions,
+    "X-XSS-Protection": opts.xXssProtection,
+    "Referrer-Policy": opts.referrerPolicy,
+    "Permissions-Policy": opts.permissionsPolicy,
+    "Strict-Transport-Security": opts.strictTransportSecurity
+  };
+  if (opts.contentSecurityPolicy) {
+    headers["Content-Security-Policy"] = opts.contentSecurityPolicy;
+  }
+  return headers;
+}
+function wrapWithSecurityHeaders(response, options) {
+  const headers = new Headers(response.headers);
+  for (const [key, value] of Object.entries(secureHeaders(options))) {
+    headers.set(key, value);
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+export {
+  wrapWithSecurityHeaders,
+  secureHeaders,
+  SECURITY_HEADERS_DEFAULTS
+};

package/dist/middleware/validate.js

@@ -0,0 +1,56 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/middleware/validate.ts
+function validateJson(schema, data) {
+  const result = schema.safeParse(data);
+  if (!result.success) {
+    return {
+      ok: false,
+      error: result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
+    };
+  }
+  return { ok: true, value: result.data };
+}
+async function validateJsonLegacy(request) {
+  try {
+    const body = await request.json();
+    if (typeof body !== "object" || body === null || Array.isArray(body)) {
+      return { ok: false, error: "Request body must be a JSON object" };
+    }
+    return { ok: true, value: body };
+  } catch {
+    return { ok: false, error: "Invalid JSON in request body" };
+  }
+}
+function requireField(body, field) {
+  if (!(field in body)) {
+    return { ok: false, error: `Missing required field: ${field}` };
+  }
+  return { ok: true, value: body[field] };
+}
+function optionalField(body, field, defaultValue) {
+  if (!(field in body))
+    return defaultValue;
+  return body[field];
+}
+export {
+  validateJsonLegacy,
+  validateJson,
+  requireField,
+  optionalField
+};

package/dist/operator-transport.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Operator transport profile — how CLI/TUI clients reach the management plane.
+ *
+ * Transports:
+ *   public  — HTTPS + optional Bearer (default)
+ *   access  — Cloudflare Access service-token headers (+ optional Bearer)
+ *   mtls    — reserved (Enterprise); headers same as public until TLS certs land
+ *   tunnel  — reserved (private hostname); headers same as public
+ *
+ * Client maps HOOX_API_TOKEN → Authorization: Bearer …
+ * Server maps OPERATOR_API_KEY (preferred) or INTERNAL_API_KEY → requireOperatorAuth
+ */
+export type OperatorTransport = "public" | "access" | "mtls" | "tunnel";
+export interface OperatorTransportProfile {
+    transport: OperatorTransport;
+    /** API base URL without trailing slash */
+    apiBase: string;
+    /** Bearer token (HOOX_API_TOKEN); empty if unset */
+    bearerToken: string;
+    /** CF Access service token client id */
+    accessClientId: string;
+    /** CF Access service token client secret */
+    accessClientSecret: string;
+}
+export interface OperatorTransportEnv {
+    HOOX_API_URL?: string;
+    HOOX_API_TOKEN?: string;
+    HOOX_TRANSPORT?: string;
+    CF_ACCESS_CLIENT_ID?: string;
+    CF_ACCESS_CLIENT_SECRET?: string;
+    [key: string]: string | undefined;
+}
+export interface ResolveOperatorTransportOptions {
+    /**
+     * Fallback transport when HOOX_TRANSPORT is unset
+     * (e.g. from ~/.hoox/config.json).
+     */
+    configTransport?: string;
+    /** Fallback API base when HOOX_API_URL is unset. */
+    configApiUrl?: string;
+    /** Fallback bearer when HOOX_API_TOKEN is unset. */
+    configApiToken?: string;
+}
+/**
+ * Resolve operator transport from env (process.env by default).
+ * Pure + injectable for tests. Optional config fallbacks for file-backed prefs.
+ */
+export declare function resolveOperatorTransportProfile(env?: OperatorTransportEnv, options?: ResolveOperatorTransportOptions): OperatorTransportProfile;
+/**
+ * Build HTTP headers for operator management requests.
+ * Never logs secrets; callers must not print the result in debug without redaction.
+ */
+export declare function buildOperatorAuthHeaders(profile: OperatorTransportProfile): Record<string, string>;
+/** True when the profile has any client-side operator credential. */
+export declare function hasOperatorClientCredentials(profile: OperatorTransportProfile): boolean;
+/**
+ * Join base URL and path without double slashes.
+ * Paths should start with `/`.
+ */
+export declare function operatorUrl(profile: OperatorTransportProfile, path: string): string;
+//# sourceMappingURL=operator-transport.d.ts.map

package/dist/operator-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-transport.d.ts","sourceRoot":"","sources":["../src/operator-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAExE,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,iBAAiB,CAAC;IAC7B,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,cAAc,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAwBD,MAAM,WAAW,+BAA+B;IAC9C;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,oBAA0D,EAC/D,OAAO,GAAE,+BAAoC,GAC5C,wBAAwB,CAyB1B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,wBAAwB,GAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAuBxB;AAED,qEAAqE;AACrE,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAGT;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,wBAAwB,EACjC,IAAI,EAAE,MAAM,GACX,MAAM,CAIR"}

package/dist/operator-transport.js

@@ -0,0 +1,87 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/operator-transport.ts
+function stripTrailingSlashes(url) {
+  return url.replace(/\/+$/, "");
+}
+function parseTransport(raw) {
+  if (!raw)
+    return null;
+  const v = raw.trim().toLowerCase();
+  if (VALID_TRANSPORTS.has(v)) {
+    return v;
+  }
+  return null;
+}
+function resolveOperatorTransportProfile(env = process.env, options = {}) {
+  const accessClientId = env.CF_ACCESS_CLIENT_ID?.trim() ?? "";
+  const accessClientSecret = env.CF_ACCESS_CLIENT_SECRET?.trim() ?? "";
+  const hasAccess = Boolean(accessClientId && accessClientSecret);
+  const explicit = parseTransport(env.HOOX_TRANSPORT) ?? parseTransport(options.configTransport);
+  const transport = explicit ?? (hasAccess ? "access" : "public");
+  const apiFromEnv = env.HOOX_API_URL?.trim();
+  const apiFromConfig = options.configApiUrl?.trim();
+  const tokenFromEnv = env.HOOX_API_TOKEN?.trim();
+  const tokenFromConfig = options.configApiToken?.trim();
+  return {
+    transport,
+    apiBase: stripTrailingSlashes(apiFromEnv || apiFromConfig || DEFAULT_API_BASE),
+    bearerToken: tokenFromEnv || tokenFromConfig || "",
+    accessClientId,
+    accessClientSecret
+  };
+}
+function buildOperatorAuthHeaders(profile) {
+  const headers = {};
+  if (profile.bearerToken) {
+    headers.Authorization = `Bearer ${profile.bearerToken}`;
+  }
+  const useAccessHeaders = profile.transport === "access" || Boolean(profile.accessClientId) && Boolean(profile.accessClientSecret);
+  if (useAccessHeaders && profile.accessClientId && profile.accessClientSecret) {
+    headers["CF-Access-Client-Id"] = profile.accessClientId;
+    headers["CF-Access-Client-Secret"] = profile.accessClientSecret;
+  }
+  return headers;
+}
+function hasOperatorClientCredentials(profile) {
+  if (profile.bearerToken)
+    return true;
+  return Boolean(profile.accessClientId && profile.accessClientSecret);
+}
+function operatorUrl(profile, path) {
+  const base = profile.apiBase.replace(/\/+$/, "");
+  const p = path.startsWith("/") ? path : `/${path}`;
+  return `${base}${p}`;
+}
+var DEFAULT_API_BASE = "http://localhost:8787", VALID_TRANSPORTS;
+var init_operator_transport = __esm(() => {
+  VALID_TRANSPORTS = new Set([
+    "public",
+    "access",
+    "mtls",
+    "tunnel"
+  ]);
+});
+init_operator_transport();
+
+export {
+  resolveOperatorTransportProfile,
+  operatorUrl,
+  hasOperatorClientCredentials,
+  buildOperatorAuthHeaders
+};

package/dist/path-utils.d.ts

@@ -5,6 +5,17 @@
  * and constructing type-safe paths within it.
  *
  * Supports macOS, Linux, and Windows with proper fallback handling.
+ *
+ * Runtime layout:
+ *   $HOME/.hoox/              — getHooxHome() (override with HOOX_HOME)
+ *   $HOME/.hoox/repo/         — managed clone of hoox-setup (getHooxRepoPath)
+ *   $HOME/.hoox/config/       — user config
+ *   $HOME/.hoox/data/         — persistent state
+ *
+ * Tool/runtime resolution (resolveHooxRuntimeRoot):
+ *   1. HOOX_REPO env (explicit monorepo path)
+ *   2. Walk up from cwd for a local hoox-setup checkout
+ *   3. $HOME/.hoox/repo (global managed clone)
  */
 /**
  * Branded type for Hoox paths to prevent accidental string usage.
@@ -13,11 +24,27 @@
 export type HooxPath = string & {
     readonly __brand: "HooxPath";
 };
+/** Where resolveHooxRuntimeRoot found (or failed to find) a setup monorepo. */
+export type RuntimeRootSource = "env" | "cwd" | "global" | "none";
+/** Result of resolveHooxRuntimeRoot(). */
+export interface RuntimeRootResult {
+    /** Absolute monorepo root, or null if none found. */
+    root: string | null;
+    /** Which resolution step produced the result. */
+    source: RuntimeRootSource;
+    /** Paths inspected (for doctor / error messages). */
+    checked: {
+        env?: string;
+        cwd: string | null;
+        global: string;
+    };
+}
 /**
  * Gets the Hoox home directory location: $HOME/.hoox
  *
  * Behavior:
- * - Returns $HOME/.hoox on macOS, Linux, Windows
+ * - HOOX_HOME env wins when set (absolute or relative, then resolved)
+ * - Else $HOME/.hoox on macOS, Linux, Windows
  * - Falls back to current working directory if HOME is not available
  * - Resolves to absolute path
  *
@@ -33,6 +60,37 @@ export type HooxPath = string & {
  * ```
  */
 export declare function getHooxHome(): HooxPath;
+/**
+ * True when `dir` looks like a hoox-setup monorepo root.
+ *
+ * Markers match CLI verifyRepoRoot: root wrangler.jsonc + packages/cli package.
+ */
+export declare function isHooxSetupRoot(dir: string): boolean;
+/**
+ * Walk up from `startDir` looking for a hoox-setup monorepo root.
+ *
+ * @returns Absolute root path, or null if not found
+ */
+export declare function findHooxSetupRoot(startDir?: string): string | null;
+/**
+ * Resolve the Hoox tool/runtime monorepo root (local checkout or global clone).
+ *
+ * Order:
+ *   1. HOOX_REPO — must pass isHooxSetupRoot or result is source "env" with root null
+ *   2. Walk up from cwd
+ *   3. getHooxRepoPath() ($HOME/.hoox/repo or $HOOX_HOME/repo)
+ *
+ * Project cwd and tool root are intentionally separate: a random project
+ * directory can still use the global runtime for TUI / templates.
+ */
+export declare function resolveHooxRuntimeRoot(options?: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+}): RuntimeRootResult;
+/**
+ * Candidate TUI entry files under a monorepo root (source first, then dist).
+ */
+export declare function getTuiEntryCandidates(runtimeRoot: string): string[];
 /**
  * Resolves a relative path within the Hoox home directory.
  *

package/dist/path-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../src/path-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC;AAUjE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAYtC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,QAAQ,CAiC9D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAStD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,IAAI,QAAQ,CAE1C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAEzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,CAE9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C"}
+{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../src/path-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC;AAEjE,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElE,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,qDAAqD;IACrD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,iDAAiD;IACjD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,qDAAqD;IACrD,OAAO,EAAE;QACP,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAgBtC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWpD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,GAAE,MAAsB,GAC/B,MAAM,GAAG,IAAI,CAQf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,iBAAiB,CAoDpB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAOnE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,QAAQ,CAiC9D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAStD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,IAAI,QAAQ,CAE1C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAEzC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,CAE9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,CAE3C"}

package/dist/path-utils.js

@@ -16,13 +16,18 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // src/path-utils.ts
+import { existsSync } from "fs";
 import { homedir } from "os";
-import { join, resolve } from "path";
+import { dirname, join, resolve } from "path";
 function createHooxPath(path) {
   return path;
 }
 function getHooxHome() {
   try {
+    const override = process.env.HOOX_HOME?.trim();
+    if (override) {
+      return createHooxPath(resolve(override));
+    }
     const home = homedir();
     if (!home || home.length === 0) {
       return createHooxPath(resolve(process.cwd(), ".hoox"));
@@ -32,6 +37,84 @@ function getHooxHome() {
     return createHooxPath(resolve(process.cwd(), ".hoox"));
   }
 }
+function isHooxSetupRoot(dir) {
+  if (!dir)
+    return false;
+  try {
+    const root = resolve(dir);
+    return existsSync(join(root, "wrangler.jsonc")) && existsSync(join(root, "packages", "cli", "package.json"));
+  } catch {
+    return false;
+  }
+}
+function findHooxSetupRoot(startDir = process.cwd()) {
+  let dir = resolve(startDir);
+  for (;; ) {
+    if (isHooxSetupRoot(dir))
+      return dir;
+    const parent = dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function resolveHooxRuntimeRoot(options) {
+  const env = options?.env ?? process.env;
+  const cwd = resolve(options?.cwd ?? process.cwd());
+  const globalRepo = getHooxRepoPath();
+  const envRepo = env.HOOX_REPO?.trim();
+  if (envRepo) {
+    const resolved = resolve(envRepo);
+    if (isHooxSetupRoot(resolved)) {
+      return {
+        root: resolved,
+        source: "env",
+        checked: {
+          env: resolved,
+          cwd: findHooxSetupRoot(cwd),
+          global: globalRepo
+        }
+      };
+    }
+    return {
+      root: null,
+      source: "env",
+      checked: {
+        env: resolved,
+        cwd: findHooxSetupRoot(cwd),
+        global: globalRepo
+      }
+    };
+  }
+  const local = findHooxSetupRoot(cwd);
+  if (local) {
+    return {
+      root: local,
+      source: "cwd",
+      checked: { cwd: local, global: globalRepo }
+    };
+  }
+  if (isHooxSetupRoot(globalRepo)) {
+    return {
+      root: globalRepo,
+      source: "global",
+      checked: { cwd: null, global: globalRepo }
+    };
+  }
+  return {
+    root: null,
+    source: "none",
+    checked: { cwd: null, global: globalRepo }
+  };
+}
+function getTuiEntryCandidates(runtimeRoot) {
+  const root = resolve(runtimeRoot);
+  return [
+    join(root, "packages", "tui", "src", "main.tsx"),
+    join(root, "packages", "tui", "dist", "main.js"),
+    join(root, "packages", "tui", "src", "main.ts")
+  ];
+}
 function resolveHooxPath(relativePath) {
   if (!relativePath || typeof relativePath !== "string") {
     throw new Error("relativePath must be a non-empty string");
@@ -89,13 +172,17 @@ function getHooxStatePath() {
   return resolveHooxPath("data/state.json");
 }
 export {
+  resolveHooxRuntimeRoot,
   resolveHooxPath,
   isWithinHooxHome,
+  isHooxSetupRoot,
+  getTuiEntryCandidates,
   getRelativeHooxPath,
   getHooxWranglerPath,
   getHooxStatePath,
   getHooxRepoPath,
   getHooxHome,
   getHooxDataDir,
-  getHooxConfigDir
+  getHooxConfigDir,
+  findHooxSetupRoot
 };

package/dist/queue-handler.d.ts

@@ -5,15 +5,15 @@ export interface QueueHandlerOptions<T> {
     /** Array of delay times in seconds for exponential backoff */
     backoffDelays: number[];
     /** Handler function called for each message */
-    onMessage: (message: T, attemptNumber: number) => Promise<any> | any;
+    onMessage: (message: T, attemptNumber: number) => Promise<unknown> | unknown;
     /** Called when a message fails and will be retried */
     onRetry?: (message: T, attemptNumber: number, error: string, delaySeconds: number) => void | Promise<void>;
     /** Called when message is moved to DLQ (max retries exceeded) */
     onDLQ?: (message: T, attemptNumber: number, error: string) => void | Promise<void>;
     /** Logger function for debugging */
     logger?: {
-        info(msg: string, data?: any): void;
-        error(msg: string, data?: any): void;
+        info(msg: string, data?: unknown): void;
+        error(msg: string, data?: unknown): void;
     };
 }
 /**

package/dist/queue-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"queue-handler.d.ts","sourceRoot":"","sources":["../src/queue-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,WAAW,mBAAmB,CAAC,CAAC;IACpC,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,+CAA+C;IAC/C,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACrE,sDAAsD;IACtD,OAAO,CAAC,EAAE,CACR,OAAO,EAAE,CAAC,EACV,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,KACjB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,iEAAiE;IACjE,KAAK,CAAC,EAAE,CACN,OAAO,EAAE,CAAC,EACV,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,KACV,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,oCAAoC;IACpC,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC;QACpC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC;KACtC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAIrD,OAAO,YAAY,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC,CAmCrD"}
+{"version":3,"file":"queue-handler.d.ts","sourceRoot":"","sources":["../src/queue-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE9D,MAAM,WAAW,mBAAmB,CAAC,CAAC;IACpC,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,+CAA+C;IAC/C,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC7E,sDAAsD;IACtD,OAAO,CAAC,EAAE,CACR,OAAO,EAAE,CAAC,EACV,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,KACjB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,iEAAiE;IACjE,KAAK,CAAC,EAAE,CACN,OAAO,EAAE,CAAC,EACV,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,KACV,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,oCAAoC;IACpC,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;KAC1C,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAIrD,OAAO,YAAY,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC,CAmCrD"}