@hoox-sh/hoox-cli 0.11.9 → 0.13.0

package/dist/index.js

@@ -14691,7 +14691,7 @@ var init_zod = __esm(() => {
 });
 
 // ../shared/src/types.ts
-var TradeActionSchema, WebhookPayloadSchema, TradeQueueMessageSchema, TradeSignalSchema, PositionSchema, BalanceSchema;
+var TradeActionSchema, MAX_WEBHOOK_LEVERAGE = 125, MAX_WEBHOOK_QUANTITY = 1e6, WebhookPayloadSchema, TradeQueueMessageSchema, TradeSignalSchema, PositionSchema, BalanceSchema;
 var init_types = __esm(() => {
   init_zod();
   TradeActionSchema = exports_external.enum([
@@ -14704,10 +14704,10 @@ var init_types = __esm(() => {
     exchange: exports_external.string().min(1),
     action: TradeActionSchema,
     symbol: exports_external.string().min(1).max(20),
-    quantity: exports_external.number().positive().finite(),
+    quantity: exports_external.number().positive().finite().max(MAX_WEBHOOK_QUANTITY),
     price: exports_external.number().positive().finite().optional(),
     orderType: exports_external.string().optional(),
-    leverage: exports_external.number().int().positive().optional(),
+    leverage: exports_external.number().int().positive().max(MAX_WEBHOOK_LEVERAGE).optional(),
     test: exports_external.boolean().optional()
   }).strict();
   TradeQueueMessageSchema = exports_external.object({
@@ -14715,9 +14715,9 @@ var init_types = __esm(() => {
     exchange: exports_external.string().min(1).max(64),
     action: TradeActionSchema,
     symbol: exports_external.string().min(1).max(32),
-    quantity: exports_external.number().positive().finite(),
+    quantity: exports_external.number().positive().finite().max(MAX_WEBHOOK_QUANTITY),
     price: exports_external.number().positive().finite().optional(),
-    leverage: exports_external.number().int().positive().max(125).optional(),
+    leverage: exports_external.number().int().positive().max(MAX_WEBHOOK_LEVERAGE).optional(),
     test: exports_external.boolean().optional(),
     idempotencyKey: exports_external.string().min(1).max(512).optional(),
     queuedAt: exports_external.string().min(1).max(64)
@@ -14754,7 +14754,7 @@ var init_types = __esm(() => {
 });
 
 // ../shared/src/kvKeys.ts
-var KV_TRADE_DEFAULT_LEVERAGE = "trade:default_leverage", KV_TRADE_MAX_POSITION_SIZE = "trade:max_position_size", KV_TRADE_MAX_DAILY_DRAWDOWN_PERCENT = "trade:max_daily_drawdown_percent", KV_TRADE_TRAILING_STOP_PERCENT = "trade:trailing_stop_percent", KV_TRADE_KILL_SWITCH = "trade:kill_switch", KV_TRADE_ROUTING = "trade:routing", KV_BOT_ENABLED = "bot:enabled", KV_BOT_DEFAULT_CHAT_ID = "bot:default_chat_id", KV_BOT_NOTIFY_ON_EXECUTION = "bot:notify_on_execution", KV_BOT_NOTIFY_ON_ERROR = "bot:notify_on_error", KV_WEBHOOK_IP_CHECK_ENABLED = "webhook:tradingview:ip_check_enabled", KV_WEBHOOK_ALLOWED_IPS = "webhook:tradingview:allowed_ips", KV_WEBHOOK_QUEUE_MODE = "webhook:queue_mode", KV_EMAIL_SCAN_SUBJECT = "email:scan_subject", KV_EMAIL_USE_IMAP = "email:use_imap", KV_EMAIL_COIN_PATTERN = "email:coin_pattern", KV_EMAIL_ACTION_PATTERN = "email:action_pattern", KV_EMAIL_QUANTITY_MULTIPLIER = "email:quantity_multiplier", KV_AGENT_CONFIG = "agent:config", KV_AGENT_OPENAI_KEY = "agent:openai_key", KV_AGENT_ANTHROPIC_KEY = "agent:anthropic_key", KV_AGENT_GOOGLE_KEY = "agent:google_key", KV_DASHBOARD_AI_HEALTH_SUMMARY = "dashboard:ai_health_summary", KV_GLOBAL_KILL_SWITCH = "global:kill_switch", KV_HEALTH_CHECK = "health_check", KV_HOUSEKEEPING_LAST_CHECK = "housekeeping:last_check", QUEUE_MODE_FAILOVER = "queue_failover", QUEUE_MODE_EVERYWHERE = "queue_everywhere", QUEUE_MODE_DISABLED = "queue_disabled", KVKeys;
+var KV_TRADE_DEFAULT_LEVERAGE = "trade:default_leverage", KV_TRADE_MAX_POSITION_SIZE = "trade:max_position_size", KV_TRADE_MAX_DAILY_DRAWDOWN_PERCENT = "trade:max_daily_drawdown_percent", KV_TRADE_TRAILING_STOP_PERCENT = "trade:trailing_stop_percent", KV_TRADE_KILL_SWITCH = "trade:kill_switch", KV_TRADE_ROUTING = "trade:routing", KV_BOT_ENABLED = "bot:enabled", KV_BOT_DEFAULT_CHAT_ID = "bot:default_chat_id", KV_BOT_NOTIFY_ON_EXECUTION = "bot:notify_on_execution", KV_BOT_NOTIFY_ON_ERROR = "bot:notify_on_error", KV_TELEGRAM_ALLOWED_CHAT_IDS = "telegram:allowed_chat_ids", KV_WEBHOOK_IP_CHECK_ENABLED = "webhook:tradingview:ip_check_enabled", KV_WEBHOOK_ALLOWED_IPS = "webhook:tradingview:allowed_ips", KV_WEBHOOK_QUEUE_MODE = "webhook:queue_mode", KV_EMAIL_SCAN_SUBJECT = "email:scan_subject", KV_EMAIL_USE_IMAP = "email:use_imap", KV_EMAIL_COIN_PATTERN = "email:coin_pattern", KV_EMAIL_ACTION_PATTERN = "email:action_pattern", KV_EMAIL_QUANTITY_MULTIPLIER = "email:quantity_multiplier", KV_AGENT_CONFIG = "agent:config", KV_AGENT_OPENAI_KEY = "agent:openai_key", KV_AGENT_ANTHROPIC_KEY = "agent:anthropic_key", KV_AGENT_GOOGLE_KEY = "agent:google_key", KV_DASHBOARD_AI_HEALTH_SUMMARY = "dashboard:ai_health_summary", KV_GLOBAL_KILL_SWITCH = "global:kill_switch", KV_HEALTH_CHECK = "health_check", KV_HOUSEKEEPING_LAST_CHECK = "housekeeping:last_check", QUEUE_MODE_FAILOVER = "queue_failover", QUEUE_MODE_EVERYWHERE = "queue_everywhere", QUEUE_MODE_DISABLED = "queue_disabled", KVKeys;
 var init_kvKeys = __esm(() => {
   KVKeys = {
     KV_TRADE_DEFAULT_LEVERAGE,
@@ -14767,6 +14767,7 @@ var init_kvKeys = __esm(() => {
     KV_BOT_DEFAULT_CHAT_ID,
     KV_BOT_NOTIFY_ON_EXECUTION,
     KV_BOT_NOTIFY_ON_ERROR,
+    KV_TELEGRAM_ALLOWED_CHAT_IDS,
     KV_WEBHOOK_IP_CHECK_ENABLED,
     KV_WEBHOOK_ALLOWED_IPS,
     KV_WEBHOOK_QUEUE_MODE,
@@ -14843,8 +14844,10 @@ function toError(err, fallback = "Unknown error") {
     return err.message;
   if (typeof err === "string")
     return err;
-  if (err && typeof err === "object" && "message" in err && typeof err.message === "string") {
-    return err.message;
+  if (err && typeof err === "object" && "message" in err) {
+    const message = err.message;
+    if (typeof message === "string")
+      return message;
   }
   if (err === null || err === undefined)
     return fallback;
@@ -15105,6 +15108,52 @@ async function logKvTimestamp(env, prefix = "timestamp") {
     console.error(`Failed to log timestamp to KV: ${toError(error51, "Unknown error")}`);
   }
 }
+async function tryBulkGetChunk(kv, chunk) {
+  try {
+    const result = await kv.get([...chunk]);
+    if (!(result instanceof Map)) {
+      return null;
+    }
+    return chunk.map((key) => result.get(key) ?? null);
+  } catch {
+    return null;
+  }
+}
+async function kvGetMany(kv, keys) {
+  if (keys.length === 0)
+    return [];
+  const out = new Array(keys.length);
+  let offset = 0;
+  while (offset < keys.length) {
+    const chunk = keys.slice(offset, offset + KV_BULK_GET_MAX_KEYS);
+    const bulk = await tryBulkGetChunk(kv, chunk);
+    if (bulk === null) {
+      const rest = await Promise.all(keys.slice(offset).map((key) => kv.get(key)));
+      for (let i = 0;i < rest.length; i++) {
+        out[offset + i] = rest[i] ?? null;
+      }
+      return out;
+    }
+    for (let i = 0;i < bulk.length; i++) {
+      out[offset + i] = bulk[i] ?? null;
+    }
+    offset += chunk.length;
+  }
+  return out;
+}
+async function kvGetManyAsRecord(kv, keys) {
+  const values = await kvGetMany(kv, keys);
+  const out = {};
+  for (let i = 0;i < keys.length; i++) {
+    out[keys[i]] = values[i] ?? null;
+  }
+  return out;
+}
+async function kvPutMany(kv, entries) {
+  if (entries.length === 0)
+    return;
+  await Promise.all(entries.map((entry) => kv.put(entry.key, entry.value, entry.options)));
+}
 function headersToObject(headers) {
   const result = {};
   if (!headers)
@@ -15118,6 +15167,7 @@ function headersToObject(headers) {
   }
   return result;
 }
+var KV_BULK_GET_MAX_KEYS = 100;
 var init_kvUtils = __esm(() => {
   init_errors3();
 });
@@ -15167,29 +15217,60 @@ var init_health = __esm(() => {
 });
 
 // ../shared/src/queue-handler.ts
+async function mapPool(items, concurrency, fn) {
+  if (items.length === 0)
+    return;
+  const limit = Math.min(Math.max(1, concurrency), items.length);
+  if (limit === 1) {
+    for (const item of items) {
+      await fn(item);
+    }
+    return;
+  }
+  let nextIndex = 0;
+  async function worker() {
+    while (true) {
+      const i = nextIndex++;
+      if (i >= items.length)
+        return;
+      await fn(items[i]);
+    }
+  }
+  await Promise.all(Array.from({ length: limit }, () => worker()));
+}
 function createQueueHandler(options) {
-  const { maxRetries, backoffDelays, onMessage, onRetry, onDLQ, logger } = options;
-  return async (batch) => {
-    for (const msg of batch.messages) {
-      const attemptNumber = msg.attempts || 0;
-      const logId = `[${msg.id}]`;
-      try {
-        logger?.info(`${logId} Processing message (attempt ${attemptNumber + 1})`);
-        await onMessage(msg.body, attemptNumber);
-        logger?.info(`${logId} Message processed successfully`);
-      } catch (error51) {
-        const errorMsg = error51 instanceof Error ? error51.message : String(error51);
-        if (attemptNumber < maxRetries) {
-          const delaySeconds = backoffDelays[attemptNumber] ?? backoffDelays[backoffDelays.length - 1];
-          logger?.info(`${logId} Retrying in ${delaySeconds}s (attempt ${attemptNumber + 2}/${maxRetries + 1})`);
-          await onRetry?.(msg.body, attemptNumber, errorMsg, delaySeconds);
-          msg.retry({ delaySeconds });
-        } else {
-          logger?.error(`${logId} Max retries exceeded (${maxRetries + 1} attempts), moving to DLQ`);
-          await onDLQ?.(msg.body, attemptNumber, errorMsg);
-        }
+  const {
+    maxRetries,
+    backoffDelays,
+    onMessage,
+    onRetry,
+    onDLQ,
+    logger,
+    concurrency: concurrencyOpt
+  } = options;
+  const concurrency = typeof concurrencyOpt === "number" && Number.isFinite(concurrencyOpt) && concurrencyOpt >= 1 ? Math.floor(concurrencyOpt) : 1;
+  async function processMessage(msg) {
+    const attemptNumber = msg.attempts || 0;
+    const logId = `[${msg.id}]`;
+    try {
+      logger?.info(`${logId} Processing message (attempt ${attemptNumber + 1})`);
+      await onMessage(msg.body, attemptNumber);
+      logger?.info(`${logId} Message processed successfully`);
+    } catch (error51) {
+      const errorMsg = error51 instanceof Error ? error51.message : String(error51);
+      if (attemptNumber < maxRetries) {
+        const delaySeconds = backoffDelays[attemptNumber] ?? backoffDelays[backoffDelays.length - 1] ?? 0;
+        logger?.info(`${logId} Retrying in ${delaySeconds}s (attempt ${attemptNumber + 2}/${maxRetries + 1})`);
+        await onRetry?.(msg.body, attemptNumber, errorMsg, delaySeconds);
+        msg.retry({ delaySeconds });
+      } else {
+        logger?.error(`${logId} Max retries exceeded (${maxRetries + 1} attempts), moving to DLQ`);
+        await onDLQ?.(msg.body, attemptNumber, errorMsg);
       }
     }
+  }
+  return async (batch) => {
+    await mapPool(batch.messages, concurrency, processMessage);
   };
 }
 
@@ -17078,7 +17159,7 @@ var init_presets = __esm(() => {
         "analytics-worker",
         "telegram-worker"
       ],
-      integrations: ["binance", "telegram"]
+      integrations: ["exchange", "telegram"]
     },
     {
       name: "full",
@@ -17095,15 +17176,7 @@ var init_presets = __esm(() => {
         "web3-wallet-worker",
         "pyne-worker"
       ],
-      integrations: [
-        "binance",
-        "bybit",
-        "mexc",
-        "telegram",
-        "openai",
-        "wallet",
-        "pyne"
-      ]
+      integrations: ["exchange", "telegram", "openai", "wallet", "pyne"]
     }
   ];
   WORKER_DEPENDENCIES = {
@@ -17116,30 +17189,12 @@ var init_presets = __esm(() => {
   };
   INTEGRATIONS = [
     {
-      key: "binance",
-      label: "Binance Exchange",
-      workerName: "trade-worker",
-      secrets: {
-        BINANCE_KEY_BINDING: "Binance API Key",
-        BINANCE_SECRET_BINDING: "Binance API Secret"
-      }
-    },
-    {
-      key: "mexc",
-      label: "MEXC Exchange",
-      workerName: "trade-worker",
-      secrets: {
-        MEXC_KEY_BINDING: "MEXC API Key",
-        MEXC_SECRET_BINDING: "MEXC API Secret"
-      }
-    },
-    {
-      key: "bybit",
-      label: "Bybit Exchange",
+      key: "exchange",
+      label: "Exchange API (Binance / Bybit / MEXC)",
       workerName: "trade-worker",
       secrets: {
-        BYBIT_KEY_BINDING: "Bybit API Key",
-        BYBIT_SECRET_BINDING: "Bybit API Secret"
+        EXCHANGE_KEY_BINDING: "Exchange API Key",
+        EXCHANGE_SECRET_BINDING: "Exchange API Secret"
       }
     },
     {
@@ -17311,7 +17366,11 @@ class WizardEngine {
     return { ...this.state };
   }
   getCurrentStep() {
-    return STEPS.find((s) => s.id === this.state.step) ?? STEPS[0];
+    const step = STEPS.find((s) => s.id === this.state.step) ?? STEPS[0];
+    if (!step) {
+      throw new Error("Wizard has no steps defined");
+    }
+    return step;
   }
   getCompletedSteps() {
     return [...this.state.completedSteps];
@@ -17334,8 +17393,11 @@ class WizardEngine {
       this.state.completedSteps.push(this.state.step);
     }
     const currentIdx = STEP_ORDER.indexOf(this.state.step);
-    if (currentIdx < STEP_ORDER.length - 1) {
-      this.state.step = STEP_ORDER[currentIdx + 1];
+    if (currentIdx >= 0 && currentIdx < STEP_ORDER.length - 1) {
+      const nextStep = STEP_ORDER[currentIdx + 1];
+      if (nextStep !== undefined) {
+        this.state.step = nextStep;
+      }
     }
     this.state.updatedAt = Date.now();
     return [];
@@ -17346,6 +17408,8 @@ class WizardEngine {
     const currentIdx = STEP_ORDER.indexOf(this.state.step);
     if (currentIdx > 0) {
       const previousStep = STEP_ORDER[currentIdx - 1];
+      if (previousStep === undefined)
+        return;
       this.state.step = previousStep;
       this.state.completedSteps = this.state.completedSteps.filter((s) => s !== this.state.step || STEP_ORDER.indexOf(s) <= STEP_ORDER.indexOf(previousStep));
     }
@@ -17573,9 +17637,12 @@ function deriveCalledBy(manifests) {
     if (!calledBy[workerName])
       calledBy[workerName] = new Set;
     for (const svc of manifest.services) {
-      if (!calledBy[svc.service])
-        calledBy[svc.service] = new Set;
-      calledBy[svc.service].add(workerName);
+      let callers = calledBy[svc.service];
+      if (!callers) {
+        callers = new Set;
+        calledBy[svc.service] = callers;
+      }
+      callers.add(workerName);
     }
   }
   const result = {};
@@ -17584,12 +17651,16 @@ function deriveCalledBy(manifests) {
   }
   return result;
 }
-var manifests, CALLED_BY, WORKER_MANIFESTS, WORKER_NAMES;
+function getWorkerDefaultEnabled(name) {
+  return manifests[name]?.defaultEnabled;
+}
+var manifests, CALLED_BY, WORKER_MANIFESTS, WORKER_NAMES, WORKER_CATALOG;
 var init_registry = __esm(() => {
   manifests = {
     hoox: {
       name: "hoox",
       path: "workers/hoox-worker",
+      defaultEnabled: true,
       vars: {
         WEBHOOK_API_KEY_BINDING: {
           type: "secret",
@@ -17599,7 +17670,11 @@ var init_registry = __esm(() => {
           type: "secret",
           description: "Inter-worker auth key"
         },
-        HA_TOKEN_BINDING: { type: "secret", description: "Home Assistant token" }
+        HA_TOKEN_BINDING: { type: "secret", description: "Home Assistant token" },
+        TELEGRAM_ALLOWED_CHAT_IDS: {
+          type: "secret",
+          description: "Comma-separated chat IDs for webhook notify (fail-closed when unset); alias AUTHORIZED_CHAT_IDS"
+        }
       },
       services: [
         {
@@ -17625,7 +17700,8 @@ var init_registry = __esm(() => {
         ai: true,
         queues: { producer: ["trade-execution"] },
         durableObjects: [
-          { name: "IDEMPOTENCY_STORE", className: "IdempotencyStore" }
+          { name: "IDEMPOTENCY_STORE", className: "IdempotencyStore" },
+          { name: "RATE_LIMITER", className: "RateLimiterStore" }
         ]
       },
       middleware: [
@@ -17640,6 +17716,7 @@ var init_registry = __esm(() => {
     "trade-worker": {
       name: "trade-worker",
       path: "workers/trade-worker",
+      defaultEnabled: true,
       vars: {
         INTERNAL_KEY_BINDING: {
           type: "secret",
@@ -17649,15 +17726,22 @@ var init_registry = __esm(() => {
           type: "secret",
           description: "Telegram outbound auth"
         },
-        BINANCE_KEY_BINDING: { type: "secret", description: "Binance API key" },
-        BINANCE_SECRET_BINDING: {
+        EXCHANGE_KEY_BINDING: {
           type: "secret",
-          description: "Binance API secret"
+          description: "Unified exchange API key (Binance / Bybit / MEXC)"
         },
-        MEXC_KEY_BINDING: { type: "secret", description: "MEXC API key" },
-        MEXC_SECRET_BINDING: { type: "secret", description: "MEXC API secret" },
-        BYBIT_KEY_BINDING: { type: "secret", description: "Bybit API key" },
-        BYBIT_SECRET_BINDING: { type: "secret", description: "Bybit API secret" }
+        EXCHANGE_SECRET_BINDING: {
+          type: "secret",
+          description: "Unified exchange API secret"
+        },
+        EXCHANGE_TESTNET_KEY_BINDING: {
+          type: "secret",
+          description: "Optional unified testnet API key"
+        },
+        EXCHANGE_TESTNET_SECRET_BINDING: {
+          type: "secret",
+          description: "Optional unified testnet API secret"
+        }
       },
       services: [
         {
@@ -17699,6 +17783,7 @@ var init_registry = __esm(() => {
     "telegram-worker": {
       name: "telegram-worker",
       path: "workers/telegram-worker",
+      defaultEnabled: true,
       vars: {
         INTERNAL_KEY_BINDING: {
           type: "secret",
@@ -17712,6 +17797,10 @@ var init_registry = __esm(() => {
         TELEGRAM_SECRET_TOKEN: {
           type: "secret",
           description: "Webhook verification token"
+        },
+        AUTHORIZED_CHAT_IDS: {
+          type: "secret",
+          description: "Comma-separated chat IDs; inbound webhook fail-closed when unset; outbound /alert allowlist"
         }
       },
       services: [],
@@ -17732,6 +17821,7 @@ var init_registry = __esm(() => {
     "d1-worker": {
       name: "d1-worker",
       path: "workers/d1-worker",
+      defaultEnabled: true,
       vars: {
         INTERNAL_KEY_BINDING: {
           type: "secret",
@@ -17754,6 +17844,7 @@ var init_registry = __esm(() => {
     "web3-wallet-worker": {
       name: "web3-wallet-worker",
       path: "workers/web3-wallet-worker",
+      defaultEnabled: false,
       vars: {
         WALLET_PK_SECRET: { type: "secret", description: "Wallet private key" },
         WALLET_MNEMONIC_SECRET: {
@@ -17774,6 +17865,7 @@ var init_registry = __esm(() => {
     "agent-worker": {
       name: "agent-worker",
       path: "workers/agent-worker",
+      defaultEnabled: true,
       vars: {
         AGENT_INTERNAL_KEY: { type: "secret", description: "Agent worker auth" },
         INTERNAL_KEY_BINDING: {
@@ -17810,6 +17902,7 @@ var init_registry = __esm(() => {
     "email-worker": {
       name: "email-worker",
       path: "workers/email-worker",
+      defaultEnabled: false,
       vars: {
         INTERNAL_KEY_BINDING: {
           type: "secret",
@@ -17847,6 +17940,7 @@ var init_registry = __esm(() => {
     "analytics-worker": {
       name: "analytics-worker",
       path: "workers/analytics-worker",
+      defaultEnabled: true,
       vars: {
         CLOUDFLARE_API_TOKEN: {
           type: "secret",
@@ -17866,6 +17960,7 @@ var init_registry = __esm(() => {
     "report-worker": {
       name: "report-worker",
       path: "workers/report-worker",
+      defaultEnabled: false,
       vars: {
         CF_API_TOKEN_BINDING: {
           type: "secret",
@@ -17900,6 +17995,7 @@ var init_registry = __esm(() => {
     "pyne-worker": {
       name: "pyne-worker",
       path: "workers/pyne-worker",
+      defaultEnabled: true,
       vars: {
         API_KEY: {
           type: "secret",
@@ -17937,6 +18033,7 @@ var init_registry = __esm(() => {
     dashboard: {
       name: "dashboard",
       path: "workers/dashboard",
+      defaultEnabled: true,
       vars: {
         DASHBOARD_USER: {
           type: "secret",
@@ -17979,6 +18076,14 @@ var init_registry = __esm(() => {
   CALLED_BY = deriveCalledBy(manifests);
   WORKER_MANIFESTS = manifests;
   WORKER_NAMES = Object.keys(manifests).sort();
+  WORKER_CATALOG = WORKER_NAMES.map((name) => {
+    const m = manifests[name];
+    return {
+      name: m.name,
+      path: m.path,
+      defaultEnabled: m.defaultEnabled
+    };
+  });
 });
 
 // ../../node_modules/.bun/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/scanner.js
@@ -19618,7 +19723,7 @@ function validateWranglerJsonc(workerName, manifest, jsoncContent) {
     }
   }
   for (const [name, def] of Object.entries(manifest.vars)) {
-    if (def.type === "secret" && !name.endsWith("_BINDING") && !name.endsWith("_SECRET") && !name.startsWith("CLOUDFLARE_") && name !== "TELEGRAM_SECRET_TOKEN" && name !== "MAILGUN_API_KEY" && name !== "EMAIL_SCAN_SUBJECT" && name !== "DASHBOARD_USER" && name !== "DASHBOARD_PASS" && name !== "SESSION_SECRET" && name !== "AGENT_INTERNAL_KEY") {
+    if (def.type === "secret" && !name.endsWith("_BINDING") && !name.endsWith("_SECRET") && !name.startsWith("CLOUDFLARE_") && name !== "TELEGRAM_SECRET_TOKEN" && name !== "TELEGRAM_ALLOWED_CHAT_IDS" && name !== "AUTHORIZED_CHAT_IDS" && name !== "MAILGUN_API_KEY" && name !== "EMAIL_SCAN_SUBJECT" && name !== "DASHBOARD_USER" && name !== "DASHBOARD_PASS" && name !== "SESSION_SECRET" && name !== "AGENT_INTERNAL_KEY") {
       errors3.push({
         worker: workerName,
         severity: "warning",
@@ -19735,6 +19840,8 @@ function generateWranglerJsonc(manifest) {
     parts.push(`  "vars": {`);
     for (const [i, name] of varKeys.entries()) {
       const def = manifest.vars[name];
+      if (!def)
+        continue;
       const comma = i < varKeys.length - 1 ? "," : "";
       const val = def.type === "secret" ? "__SECRET__" : JSON.stringify(def.default ?? "");
       parts.push(`    "${name}": ${val}${comma}`);
@@ -21561,7 +21668,7 @@ function getBackoffDelay(retryCount) {
   if (retryCount <= 0)
     return 0;
   const index = Math.min(retryCount - 1, BACKOFF_SEQUENCE.length - 1);
-  return BACKOFF_SEQUENCE[index];
+  return BACKOFF_SEQUENCE[index] ?? 0;
 }
 var BACKOFF_SEQUENCE, MAX_RETRIES2 = 5, tradeStreamAbort = null, logStreamAbort = null, fetchWorkersGeneration = 0, reconnectTimer = null, scheduledReconnectTick = async () => {}, MAX_TRADES = 500, MAX_ALERTS = 100, MAX_LOGS = 1000, initialState2, useServiceStore;
 var init_service_store = __esm(() => {
@@ -22218,7 +22325,10 @@ __export(exports_src, {
   logKvTimestamp: () => logKvTimestamp,
   loadDashboardManifestsFromRoot: () => loadDashboardManifestsFromRoot,
   loadDashboardKvManifestFromRoot: () => loadDashboardKvManifestFromRoot,
+  kvPutMany: () => kvPutMany,
   kvManifestFromDashboardManifests: () => kvManifestFromDashboardManifests,
+  kvGetManyAsRecord: () => kvGetManyAsRecord,
+  kvGetMany: () => kvGetMany,
   isWithinHooxHome: () => isWithinHooxHome,
   isUnixModeGroupOrWorldAccessible: () => isUnixModeGroupOrWorldAccessible,
   isTruthyKillSwitchFlag: () => isTruthyKillSwitchFlag,
@@ -22233,6 +22343,7 @@ __export(exports_src, {
   healthCheck: () => healthCheck,
   headersToObject: () => headersToObject,
   hasOperatorClientCredentials: () => hasOperatorClientCredentials,
+  getWorkerDefaultEnabled: () => getWorkerDefaultEnabled,
   getTuiEntryCandidates: () => getTuiEntryCandidates,
   getRememberedMonorepoRoot: () => getRememberedMonorepoRoot,
   getRememberedMonorepoPath: () => getRememberedMonorepoPath,
@@ -22295,6 +22406,7 @@ __export(exports_src, {
   WORKER_NAMES: () => WORKER_NAMES,
   WORKER_MANIFESTS: () => WORKER_MANIFESTS,
   WORKER_DEPENDENCIES: () => WORKER_DEPENDENCIES,
+  WORKER_CATALOG: () => WORKER_CATALOG,
   WIZARD_STATE_PATH: () => WIZARD_STATE_PATH,
   WALLET_EXECUTE_AUTH_KEY_FIELDS: () => WALLET_EXECUTE_AUTH_KEY_FIELDS,
   TradeSignalSchema: () => TradeSignalSchema,
@@ -22309,6 +22421,7 @@ __export(exports_src, {
   PositionSchema: () => PositionSchema,
   PRESETS: () => PRESETS,
   LogLevelColor: () => LogLevelColor,
+  KV_BULK_GET_MAX_KEYS: () => KV_BULK_GET_MAX_KEYS,
   KVKeys: () => KVKeys,
   KILL_SWITCH_KEYS: () => KILL_SWITCH_KEYS,
   KILL_SWITCH_ACTIVE_PREFIX: () => KILL_SWITCH_ACTIVE_PREFIX,
@@ -25257,6 +25370,76 @@ ${e.errors.map((m3) => `  - ${m3}`).join(`
     const config2 = this.ensureLoaded();
     return Object.entries(config2.workers).filter(([, w]) => w.enabled).map(([name]) => name);
   }
+  listWorkerStatuses() {
+    const config2 = this.ensureLoaded();
+    const names = new Set([
+      ...WORKER_CATALOG.map((w) => w.name),
+      ...Object.keys(config2.workers ?? {})
+    ]);
+    return [...names].sort().map((name) => {
+      const catalog = WORKER_MANIFESTS[name];
+      const cfg = config2.workers?.[name];
+      return {
+        name,
+        path: cfg?.path ?? catalog?.path ?? `workers/${name}`,
+        enabled: cfg?.enabled ?? catalog?.defaultEnabled ?? false,
+        defaultEnabled: catalog?.defaultEnabled,
+        inConfig: Boolean(cfg),
+        inCatalog: Boolean(catalog)
+      };
+    });
+  }
+  async setWorkersEnabled(names, enabled) {
+    this.ensureLoaded();
+    const filePath = this.configPath;
+    const file2 = Bun.file(filePath);
+    if (!await file2.exists()) {
+      throw new Error(`Config file not found: ${filePath}`);
+    }
+    let raw = await file2.text();
+    const results = [];
+    const unique = [...new Set(names.map((n3) => n3.trim()).filter(Boolean))];
+    for (const name of unique) {
+      const existing = this.config.workers?.[name];
+      const catalog = WORKER_MANIFESTS[name];
+      if (!existing && !catalog) {
+        throw new Error(`Unknown worker "${name}". Known workers: ${WORKER_CATALOG.map((w) => w.name).join(", ")}`);
+      }
+      let seeded = false;
+      if (!existing) {
+        const entry = {
+          enabled,
+          path: catalog.path,
+          vars: {},
+          secrets: []
+        };
+        const seedEdits = modify(raw, ["workers", name], entry, {
+          formattingOptions: JSONC_FORMAT,
+          isArrayInsertion: false
+        });
+        raw = applyEdits(raw, seedEdits);
+        seeded = true;
+      } else {
+        const edits = modify(raw, ["workers", name, "enabled"], enabled, {
+          formattingOptions: JSONC_FORMAT
+        });
+        raw = applyEdits(raw, edits);
+      }
+      results.push({ name, enabled, seeded });
+    }
+    await Bun.write(filePath, raw);
+    await this.load(filePath);
+    return results;
+  }
+  async enableWorker(name) {
+    await this.setWorkersEnabled([name], true);
+  }
+  async disableWorker(name) {
+    await this.setWorkersEnabled([name], false);
+  }
+  getWorkerDefaultEnabled(name) {
+    return getWorkerDefaultEnabled(name);
+  }
   validate() {
     const errors4 = [];
     if (!this.config) {
@@ -25309,9 +25492,16 @@ ${e.errors.map((m3) => `  - ${m3}`).join(`
     return this.config;
   }
 }
+var JSONC_FORMAT;
 var init_config_service = __esm(() => {
   init_main();
   init_src();
+  JSONC_FORMAT = {
+    tabSize: 2,
+    insertSpaces: true,
+    eol: `
+`
+  };
 });
 
 // src/services/config/index.ts
@@ -25758,6 +25948,9 @@ class PrerequisitesService {
         return { outdated: false };
       }
       const current2 = match[1];
+      if (!current2) {
+        return { outdated: false };
+      }
       const meetsMin = this.satisfies(current2, this.MINIMUM_WRANGLER);
       return {
         outdated: !meetsMin,
@@ -25814,7 +26007,7 @@ class PrerequisitesService {
       });
       const stdout2 = await new Response(proc.stdout).text();
       const match = stdout2.match(/(\d+\.\d+)/);
-      const version2 = match ? match[1] : "unknown";
+      const version2 = match?.[1] ?? "unknown";
       const [major, minor] = version2.split(".").map(Number);
       const passed = (major ?? 0) >= 2 && (minor ?? 0) >= 40;
       return {
@@ -26334,7 +26527,7 @@ var exports_schema_service = {};
 __export(exports_schema_service, {
   SchemaService: () => SchemaService
 });
-import { readFileSync as readFileSync7, existsSync as existsSync11 } from "fs";
+import { readFileSync as readFileSync8, existsSync as existsSync11 } from "fs";
 import { resolve as resolve4 } from "path";
 
 class SchemaService {
@@ -26370,7 +26563,7 @@ class SchemaService {
     const errors4 = [];
     const isHooxProject = existsSync11(resolve4(this.projectRoot, "wrangler.jsonc")) || existsSync11(resolve4(this.projectRoot, "workers"));
     try {
-      const wranglerContent = readFileSync7(workerWranglerPath, "utf-8");
+      const wranglerContent = readFileSync8(workerWranglerPath, "utf-8");
       errors4.push(...validateWranglerJsonc(name, manifest, wranglerContent));
     } catch (e) {
       const isErrnoException = e instanceof Error && "code" in e;
@@ -26384,7 +26577,7 @@ class SchemaService {
       });
     }
     try {
-      const rootContent = readFileSync7(rootWranglerPath, "utf-8");
+      const rootContent = readFileSync8(rootWranglerPath, "utf-8");
       errors4.push(...validateRootSecrets(name, manifest, rootContent));
     } catch (e) {
       const errMessage = e instanceof Error ? e.message : String(e);
@@ -26395,7 +26588,7 @@ class SchemaService {
       });
     }
     try {
-      const devVarsContent = readFileSync7(devVarsPath, "utf-8");
+      const devVarsContent = readFileSync8(devVarsPath, "utf-8");
       errors4.push(...validateDevVars(name, manifest, devVarsContent));
     } catch (e) {
       const errMessage = e instanceof Error ? e.message : String(e);
@@ -26654,7 +26847,7 @@ var init_trace_service = __esm(() => {
 });
 
 // src/index.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 
 // ../../node_modules/.bun/commander@15.0.0/node_modules/commander/lib/error.js
 class CommanderError extends Error {
@@ -28857,7 +29050,13 @@ function formatTable(rows, opts = {}) {
   const alignNumbers = opts.alignNumbers !== false;
   const colorizeStatus = opts.colorizeStatus !== false;
   const compact = opts.compact === true;
-  const keys = Object.keys(rows[0]);
+  const firstRow = rows[0];
+  if (!firstRow) {
+    process.stdout.write(`${theme.dim("(empty)")}
+`);
+    return;
+  }
+  const keys = Object.keys(firstRow);
   const processed = rows.map((row) => {
     const out = {};
     for (const k of keys) {
@@ -28894,17 +29093,18 @@ function formatTable(rows, opts = {}) {
       widths[key] = Math.max(widths[key], stripped);
     }
   }
-  const topParts = keys.map((k) => "\u2500".repeat(widths[k] + 2));
+  const topParts = keys.map((k) => "\u2500".repeat((widths[k] ?? 0) + 2));
   const topBorder = `\u250C${topParts.join("\u252C")}\u2510`;
   const sepBorder = `\u251C${topParts.join("\u253C")}\u2524`;
   const botBorder = `\u2514${topParts.join("\u2534")}\u2518`;
-  const headerCells = keys.map((k) => theme.bold(k.padEnd(widths[k])).toString());
+  const headerCells = keys.map((k) => theme.bold(k.padEnd(widths[k] ?? 0)).toString());
   const headerRow = `\u2502 ${headerCells.join(" \u2502 ")} \u2502`;
   const dataRows = processed.map((row, rowIdx) => {
     const isAlt = zebra && rowIdx % 2 === 0;
     const cells = keys.map((k) => {
       const value = row[k] ?? "";
-      const padded = numericColumns.has(k) ? value.padStart(widths[k]) : value.padEnd(widths[k]);
+      const width = widths[k] ?? 0;
+      const padded = numericColumns.has(k) ? value.padStart(width) : value.padEnd(width);
       if (isAlt && !value.includes("\x1B")) {
         return theme.textMuted(padded);
       }
@@ -29027,11 +29227,11 @@ function levenshtein(a2, b) {
     curr[0] = j;
     for (let i = 1;i <= m; i++) {
       const cost = s.charCodeAt(i - 1) === t.charCodeAt(j - 1) ? 0 : 1;
-      curr[i] = Math.min(curr[i - 1] + 1, prev[i] + 1, prev[i - 1] + cost);
+      curr[i] = Math.min((curr[i - 1] ?? 0) + 1, (prev[i] ?? 0) + 1, (prev[i - 1] ?? 0) + cost);
     }
     [prev, curr] = [curr, prev];
   }
-  return prev[m];
+  return prev[m] ?? 0;
 }
 
 // src/utils/error-handler.ts
@@ -30480,6 +30680,8 @@ class SetupService {
       if (!varsMatch)
         continue;
       const varsBlock = varsMatch[1];
+      if (varsBlock === undefined)
+        continue;
       const nullEntries = varsBlock.match(/"\w+"\s*:\s*null/g);
       if (!nullEntries)
         continue;
@@ -31614,46 +31816,32 @@ class EnvService {
         hint: "Telegram webhook secret token"
       },
       {
-        name: "BINANCE_KEY_BINDING",
-        required: false,
-        secret: true,
-        section: "Exchanges",
-        hint: "Binance API key"
-      },
-      {
-        name: "BINANCE_SECRET_BINDING",
-        required: false,
-        secret: true,
-        section: "Exchanges",
-        hint: "Binance API secret"
-      },
-      {
-        name: "MEXC_KEY_BINDING",
+        name: "EXCHANGE_KEY_BINDING",
         required: false,
         secret: true,
         section: "Exchanges",
-        hint: "MEXC API key"
+        hint: "Unified exchange API key (Binance / Bybit / MEXC \u2014 venue via routing)"
       },
       {
-        name: "MEXC_SECRET_BINDING",
+        name: "EXCHANGE_SECRET_BINDING",
         required: false,
         secret: true,
         section: "Exchanges",
-        hint: "MEXC API secret"
+        hint: "Unified exchange API secret"
       },
       {
-        name: "BYBIT_KEY_BINDING",
+        name: "EXCHANGE_TESTNET_KEY_BINDING",
         required: false,
         secret: true,
         section: "Exchanges",
-        hint: "Bybit API key"
+        hint: "Optional testnet API key (when signals use test: true)"
       },
       {
-        name: "BYBIT_SECRET_BINDING",
+        name: "EXCHANGE_TESTNET_SECRET_BINDING",
         required: false,
         secret: true,
         section: "Exchanges",
-        hint: "Bybit API secret"
+        hint: "Optional testnet API secret"
       },
       {
         name: "EMAIL_HOST_BINDING",
@@ -31824,12 +32012,8 @@ class EnvService {
       "workers/trade-worker": [
         "API_SERVICE_KEY_BINDING",
         "INTERNAL_KEY_BINDING",
-        "BINANCE_KEY_BINDING",
-        "BINANCE_SECRET_BINDING",
-        "MEXC_KEY_BINDING",
-        "MEXC_SECRET_BINDING",
-        "BYBIT_KEY_BINDING",
-        "BYBIT_SECRET_BINDING"
+        "EXCHANGE_KEY_BINDING",
+        "EXCHANGE_SECRET_BINDING"
       ],
       "workers/agent-worker": ["AGENT_INTERNAL_KEY"],
       "workers/d1-worker": ["INTERNAL_KEY_BINDING"],
@@ -33724,6 +33908,27 @@ var SYSTEM_SECRET_NAMES = [
   "API_SERVICE_KEY_BINDING"
 ];
 var SYSTEM_SECRET_SET = new Set(SYSTEM_SECRET_NAMES);
+var WORKER_SYSTEM_SECRETS = {
+  "d1-worker": ["INTERNAL_KEY_BINDING"],
+  "analytics-worker": ["INTERNAL_KEY_BINDING"],
+  "trade-worker": [
+    "INTERNAL_KEY_BINDING",
+    "TELEGRAM_INTERNAL_KEY_BINDING",
+    "API_SERVICE_KEY_BINDING"
+  ],
+  "report-worker": ["INTERNAL_KEY_BINDING"],
+  "email-worker": ["INTERNAL_KEY_BINDING"],
+  "agent-worker": ["INTERNAL_KEY_BINDING", "AGENT_INTERNAL_KEY"],
+  hoox: ["INTERNAL_KEY_BINDING", "WEBHOOK_API_KEY_BINDING"],
+  "web3-wallet-worker": ["INTERNAL_KEY_BINDING"],
+  "telegram-worker": ["INTERNAL_KEY_BINDING"],
+  dashboard: [
+    "AGENT_INTERNAL_KEY",
+    "SESSION_SECRET",
+    "TRADE_INTERNAL_KEY",
+    "API_SERVICE_KEY_BINDING"
+  ]
+};
 function isSystemSecret(name) {
   return SYSTEM_SECRET_SET.has(name);
 }
@@ -33844,11 +34049,19 @@ class SecretsService {
       const content = await devVarsFile.text();
       existingValues = this.parseDotEnv(content);
     }
+    let keysFallback = new Map;
+    if (options.systemOnly) {
+      const keysFile = Bun.file(".keys/setup.env");
+      if (await keysFile.exists()) {
+        keysFallback = this.parseDotEnv(await keysFile.text());
+      }
+    }
     let secrets;
     if (options.systemOnly) {
       const fromDeclared = declared.filter((s) => isSystemSecret(s));
       const fromDevVars = [...SYSTEM_SECRET_NAMES].filter((s) => existingValues.has(s));
-      secrets = [...new Set([...fromDeclared, ...fromDevVars])];
+      const fromMap = [...WORKER_SYSTEM_SECRETS[workerName] ?? []];
+      secrets = [...new Set([...fromDeclared, ...fromDevVars, ...fromMap])];
     } else {
       secrets = declared;
     }
@@ -33858,7 +34071,7 @@ class SecretsService {
     const items = [];
     for (const secret of secrets) {
       try {
-        const value = existingValues.get(secret);
+        const value = existingValues.get(secret) ?? keysFallback.get(secret);
         if (value !== undefined && !this.isPlaceholder(value)) {
           await this.execWranglerSecretPut(worker.path, secret, value, workerName);
           synced.push(secret);
@@ -34138,8 +34351,8 @@ The command will prompt for the secret value (hidden input).
 It writes to the worker's .dev.vars file and syncs to Cloudflare.
 
 EXAMPLES:
-  hoox secrets set trade-worker BINANCE_KEY_BINDING
-  hoox config secrets set trade-worker BINANCE_KEY_BINDING`).action(withErrorHandling(async (workerName, secretName, _2, cmd) => {
+  hoox secrets set trade-worker EXCHANGE_KEY_BINDING
+  hoox config secrets set trade-worker EXCHANGE_KEY_BINDING`).action(withErrorHandling(async (workerName, secretName, _2, cmd) => {
     const opts = getFormatOptions(cmd);
     const svc = await SecretsService.create();
     const declared = svc.listSecrets(workerName);
@@ -34184,8 +34397,8 @@ ARGUMENTS:
 This removes the secret from Cloudflare and from the worker's .dev.vars file.
 
 EXAMPLES:
-  hoox secrets delete trade-worker BINANCE_KEY_BINDING
-  hoox config secrets delete trade-worker BINANCE_KEY_BINDING`).action(withErrorHandling(async (workerName, secretName, _2, cmd) => {
+  hoox secrets delete trade-worker EXCHANGE_KEY_BINDING
+  hoox config secrets delete trade-worker EXCHANGE_KEY_BINDING`).action(withErrorHandling(async (workerName, secretName, _2, cmd) => {
     const opts = getFormatOptions(cmd);
     const svc = await SecretsService.create();
     const declared = svc.listSecrets(workerName);
@@ -34327,7 +34540,7 @@ EXAMPLES:
 }
 
 // src/commands/config/keys-subcommands.ts
-import { existsSync as existsSync9 } from "fs";
+import { chmodSync as chmodSync6, existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
 init_fs_secure();
 init_theme();
 function generateKey(bytes = 32) {
@@ -34335,6 +34548,82 @@ function generateKey(bytes = 32) {
   crypto.getRandomValues(buf);
   return Array.from(buf, (b3) => b3.toString(16).padStart(2, "0")).join("");
 }
+var DEV_VARS_WORKER_KEYS2 = {
+  "d1-worker": ["INTERNAL_KEY_BINDING"],
+  "analytics-worker": ["INTERNAL_KEY_BINDING"],
+  "trade-worker": [
+    "INTERNAL_KEY_BINDING",
+    "TELEGRAM_INTERNAL_KEY_BINDING",
+    "API_SERVICE_KEY_BINDING"
+  ],
+  "report-worker": ["INTERNAL_KEY_BINDING"],
+  "email-worker": ["INTERNAL_KEY_BINDING"],
+  "agent-worker": ["INTERNAL_KEY_BINDING", "AGENT_INTERNAL_KEY"],
+  hoox: ["INTERNAL_KEY_BINDING", "WEBHOOK_API_KEY_BINDING"],
+  "web3-wallet-worker": ["INTERNAL_KEY_BINDING"],
+  "telegram-worker": ["INTERNAL_KEY_BINDING"],
+  dashboard: [
+    "AGENT_INTERNAL_KEY",
+    "SESSION_SECRET",
+    "TRADE_INTERNAL_KEY",
+    "API_SERVICE_KEY_BINDING"
+  ]
+};
+var WORKER_FS_DIR2 = {
+  hoox: "hoox-worker"
+};
+function workerFsDir2(worker) {
+  return WORKER_FS_DIR2[worker] ?? worker;
+}
+function parseEnvFile2(text2) {
+  const map2 = new Map;
+  for (const line of text2.split(`
+`)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0)
+      continue;
+    map2.set(trimmed.slice(0, eq), trimmed.slice(eq + 1));
+  }
+  return map2;
+}
+async function writeDevVarsFromKeys(keys) {
+  let count = 0;
+  for (const [worker, secretNames] of Object.entries(DEV_VARS_WORKER_KEYS2)) {
+    const path5 = `workers/${workerFsDir2(worker)}/.dev.vars`;
+    const meshSet = new Set(secretNames);
+    const existing = existsSync9(path5) ? parseEnvFile2(readFileSync7(path5, "utf-8")) : new Map;
+    for (const secretName of secretNames) {
+      const value = keys[secretName];
+      if (value)
+        existing.set(secretName, value);
+    }
+    let content = `# .dev.vars \u2014 local secrets for ${worker}
+`;
+    content += `# Generated by \`hoox keys generate\`. NEVER commit this file.
+
+`;
+    for (const secretName of secretNames) {
+      const value = existing.get(secretName);
+      if (value !== undefined)
+        content += `${secretName}=${value}
+`;
+    }
+    for (const [k, v] of existing) {
+      if (!meshSet.has(k))
+        content += `${k}=${v}
+`;
+    }
+    await Bun.write(path5, content);
+    try {
+      chmodSync6(path5, 384);
+    } catch {}
+    count++;
+  }
+  return count;
+}
 function registerKeysSubcommands(keysCmd, service = "config") {
   keysCmd.command("generate").summary("Generate new internal auth keys").description(`Generate new internal auth keys and save to .keys/ directory.
 
@@ -34376,9 +34665,12 @@ EXAMPLES:
 `) + `
 `);
     secureSecretFile(`${keysDir}/setup.env`);
-    formatSuccess(`Generated ${Object.keys(keys).length} keys in ${keysDir}/`, opts);
+    const devVarsCount = await writeDevVarsFromKeys(keys);
+    formatSuccess(`Generated ${Object.keys(keys).length} keys in ${keysDir}/ + ${devVarsCount} .dev.vars`, opts);
     if (!opts.quiet && !opts.json) {
       process.stdout.write(`${theme.warning("!")}  Keep these keys secret. Add ${keysDir}/ to .gitignore.
+`);
+      process.stdout.write(`${theme.dim("\u2192")}  Next: hoox secrets sync --system
 `);
       formatKeyValue(keys, opts);
     }
@@ -34476,7 +34768,7 @@ EXAMPLES:
   hoox config show                    Display current configuration
   hoox config set workers.agent-worker.enabled false
   hoox config secrets list            List secrets for a worker
-  hoox config secrets set trade-worker BINANCE_KEY_BINDING
+  hoox config secrets set trade-worker EXCHANGE_KEY_BINDING
   hoox config keys generate           Generate new internal keys`);
   configCmd.command("show").summary("Display current wrangler.jsonc configuration").description(`Display the current wrangler.jsonc configuration in a formatted table.
 
@@ -34671,7 +34963,7 @@ COMMANDS:
 
 EXAMPLES:
   hoox secrets list trade-worker
-  hoox secrets set trade-worker BINANCE_KEY_BINDING
+  hoox secrets set trade-worker EXCHANGE_KEY_BINDING
   hoox secrets sync --system
   hoox secrets sync`);
   registerSecretsSubcommands(cmd, "secrets");
@@ -36223,11 +36515,19 @@ async function resolveZone(cf) {
   if (lines.length === 0) {
     throw new CLIError("No zones found. Set CLOUDFLARE_ZONE_ID environment variable.", 1 /* ERROR */);
   }
-  const match = lines[0].match(/^(.+?)\s+\((.+?)\)\s*$/);
+  const firstLine = lines[0];
+  if (!firstLine) {
+    throw new CLIError("No zones found. Set CLOUDFLARE_ZONE_ID environment variable.", 1 /* ERROR */);
+  }
+  const match = firstLine.match(/^(.+?)\s+\((.+?)\)\s*$/);
   if (match) {
-    return { name: match[1], id: match[2] };
+    const name = match[1];
+    const id = match[2];
+    if (name && id) {
+      return { name, id };
+    }
   }
-  return { name: lines[0], id: lines[0] };
+  return { name: firstLine, id: firstLine };
 }
 async function handleStatus(opts) {
   const cf = new CloudflareService;
@@ -36545,6 +36845,8 @@ EXAMPLES:
       const results = [];
       for (let i2 = 0;i2 < workers.length; i2++) {
         const name2 = workers[i2];
+        if (!name2)
+          continue;
         const workerConfig = configService.getWorker(name2);
         if (!workerConfig)
           continue;
@@ -36822,7 +37124,11 @@ class DbService {
     if (!match) {
       throw new Error(`Migration script "${path6}" was found but no \`d1 execute \u2026 --command="\u2026"\` line could be extracted. ` + `Refusing to fall back to a no-op migration \u2014 please check the script format.`);
     }
-    return match[1];
+    const command = match[1];
+    if (!command) {
+      throw new Error(`Migration script "${path6}" was found but no \`d1 execute \u2026 --command="\u2026"\` line could be extracted. ` + `Refusing to fall back to a no-op migration \u2014 please check the script format.`);
+    }
+    return command;
   }
 }
 // src/commands/db/db-command.ts
@@ -37129,15 +37435,19 @@ function parseWranglerQueuesTable(raw) {
     const cells = line.split("\u2502").map((c3) => c3.trim()).filter((c3) => c3.length > 0);
     if (cells.length < 2)
       continue;
-    if (cells[0] === "id" || cells[0] === "name")
+    const queueId = cells[0];
+    const queueName = cells[1];
+    if (!queueId || !queueName)
       continue;
-    if (!/^[0-9a-f-]{16,}$/i.test(cells[0]))
+    if (queueId === "id" || queueId === "name")
+      continue;
+    if (!/^[0-9a-f-]{16,}$/i.test(queueId))
       continue;
     const producers = cells[4] !== undefined && cells[4] !== "" ? Number(cells[4]) : undefined;
     const consumers = cells[5] !== undefined && cells[5] !== "" ? Number(cells[5]) : undefined;
     queues.push({
-      queue_id: cells[0],
-      queue_name: cells[1],
+      queue_id: queueId,
+      queue_name: queueName,
       created_on: cells[2],
       modified_on: cells[3],
       producers_total_count: Number.isFinite(producers) ? producers : undefined,
@@ -37322,57 +37632,151 @@ SUBCOMMANDS:
   }, { service: "monitor" }));
 }
 // src/commands/workers/workers-command.ts
+init_src();
 init_config2();
+init_errors4();
 async function doListWorkers(fmt) {
   const configService = new ConfigService;
   await configService.load();
-  const workers = configService.listWorkers();
-  const rows = workers.map((name) => {
-    const worker = configService.getWorker(name);
-    return {
-      Worker: name,
-      Status: worker?.enabled ? "enabled" : "disabled",
-      Path: worker?.path ?? "-",
-      Secrets: String(worker?.secrets?.length ?? 0)
-    };
-  });
+  const statuses = configService.listWorkerStatuses();
+  const rows = statuses.map((w) => ({
+    Worker: w.name,
+    Status: w.enabled ? "enabled" : "disabled",
+    Default: w.defaultEnabled === undefined ? "-" : w.defaultEnabled ? "enabled" : "disabled",
+    Path: w.path,
+    Config: w.inConfig ? "yes" : "no",
+    Catalog: w.inCatalog ? "yes" : "no"
+  }));
+  if (fmt.json) {
+    formatJson(statuses.map((w) => ({
+      name: w.name,
+      enabled: w.enabled,
+      defaultEnabled: w.defaultEnabled ?? null,
+      path: w.path,
+      inConfig: w.inConfig,
+      inCatalog: w.inCatalog
+    })), fmt);
+    return;
+  }
+  formatTable(rows, fmt);
+}
+function doCatalog(fmt) {
+  const rows = WORKER_CATALOG.map((w) => ({
+    Worker: w.name,
+    Default: w.defaultEnabled ? "enabled" : "disabled",
+    Path: w.path
+  }));
   if (fmt.json) {
-    formatJson(rows, fmt);
+    formatJson(WORKER_CATALOG.map((w) => ({
+      name: w.name,
+      defaultEnabled: w.defaultEnabled,
+      path: w.path
+    })), fmt);
     return;
   }
   formatTable(rows, fmt);
 }
+async function doSetEnabled(names, enabled, fmt) {
+  if (names.length === 0) {
+    throw new CLIError(`Specify at least one worker name (e.g. hoox workers ${enabled ? "enable" : "disable"} trade-worker)`, 2 /* INVALID_USAGE */, undefined, true, `Run \`hoox workers catalog\` to see known workers.`);
+  }
+  const configService = new ConfigService;
+  await configService.load();
+  let results;
+  try {
+    results = await configService.setWorkersEnabled(names, enabled);
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    throw new CLIError(msg, 2 /* INVALID_USAGE */, undefined, true);
+  }
+  if (fmt.json) {
+    formatJson({ action: enabled ? "enable" : "disable", results }, fmt);
+    return;
+  }
+  for (const r2 of results) {
+    const seedNote = r2.seeded ? " (seeded from catalog)" : "";
+    formatSuccess(`${r2.name} \u2192 ${r2.enabled ? "enabled" : "disabled"}${seedNote}`, fmt);
+  }
+}
 function registerWorkersCommand(program2) {
-  const workersCmd = program2.command("workers").summary("Manage Cloudflare Workers (list, dev, logs)").description(`Manage your Hoox Cloudflare Workers.
+  const workersCmd = program2.command("workers").summary("Manage Cloudflare Workers (list, enable, disable, dev, logs)").description(`Manage your Hoox Cloudflare Workers.
 
 SUBCOMMANDS:
-  list              List all workers with status, path, and secrets count
+  list              List all workers (catalog + config) with status
+  catalog           Show the canonical worker catalog and defaults
+  enable <name...>  Enable workers in wrangler.jsonc
+  disable <name...> Disable workers in wrangler.jsonc
   dev <name>        Start a worker for local development (delegates to dev worker)
   logs <name>       Tail logs for a specific worker (delegates to logs worker)
 
+The worker catalog (shared package) is the source of all known workers and
+their default enabled flags. Enable/disable updates workers.<name>.enabled
+in the root wrangler.jsonc. Missing catalog workers are seeded on enable.
+
 For health checks, use 'hoox check health'.
 For deployments, use 'hoox deploy workers' or 'hoox deploy worker <name>'.
 
 EXAMPLES:
-  hoox workers list                   List all workers
-  hoox workers list --json            List workers as JSON (respects global --json)
-  hoox workers dev trade-worker       Start dev server for trade-worker
-  hoox workers logs hoox              Tail logs for the hoox gateway`);
-  workersCmd.command("list").summary("List all workers with their enabled/disabled status").description(`List all workers defined in wrangler.jsonc.
-
-Displays each worker's:
-  - Name
-  - Status (enabled / disabled)
-  - Path (relative from project root)
-  - Secrets (count of Cloudflare secrets configured)
+  hoox workers list
+  hoox workers catalog
+  hoox workers enable trade-worker agent-worker
+  hoox workers disable web3-wallet-worker email-worker
+  hoox workers dev trade-worker
+  hoox workers logs hoox`);
+  workersCmd.command("list").summary("List workers with enabled status (catalog + config)").description(`List all workers from the shared catalog merged with wrangler.jsonc.
+
+Columns:
+  - Worker name
+  - Status (effective enabled/disabled)
+  - Default (catalog default)
+  - Path
+  - Config / Catalog membership
 
 EXAMPLES:
-  hoox workers list              Default table output
-  hoox workers list --json       JSON-formatted output
-  hoox workers list --quiet      Minimal output`).action(withErrorHandling(async (_opts, cmd) => {
+  hoox workers list
+  hoox workers list --json`).action(withErrorHandling(async (_opts, cmd) => {
     const fmt = getFormatOptions(cmd);
     await doListWorkers(fmt);
   }, { service: "workers" }));
+  workersCmd.command("catalog").summary("Show the canonical worker catalog with defaults").description(`Print the shared worker catalog \u2014 every known worker and its default
+enabled flag. This is the source of truth used when seeding missing workers
+on enable.
+
+EXAMPLES:
+  hoox workers catalog
+  hoox workers catalog --json`).action(withErrorHandling(async (_opts, cmd) => {
+    const fmt = getFormatOptions(cmd);
+    doCatalog(fmt);
+  }, { service: "workers" }));
+  workersCmd.command("enable").argument("<names...>", "Worker name(s) to enable").summary("Enable one or more workers in wrangler.jsonc").description(`Set workers.<name>.enabled = true in the root wrangler.jsonc.
+
+If a worker exists in the catalog but not in config, it is seeded with
+path/secrets from the catalog and enabled.
+
+ARGUMENTS:
+  names    One or more worker names (e.g. trade-worker email-worker)
+
+EXAMPLES:
+  hoox workers enable trade-worker
+  hoox workers enable report-worker web3-wallet-worker
+  hoox workers enable dashboard --json`).action(withErrorHandling(async (names, _opts, cmd) => {
+    const fmt = getFormatOptions(cmd);
+    await doSetEnabled(names, true, fmt);
+  }, { service: "workers" }));
+  workersCmd.command("disable").argument("<names...>", "Worker name(s) to disable").summary("Disable one or more workers in wrangler.jsonc").description(`Set workers.<name>.enabled = false in the root wrangler.jsonc.
+
+Disabled workers are skipped by deploy/logs/all flows that use
+ConfigService.listEnabledWorkers().
+
+ARGUMENTS:
+  names    One or more worker names
+
+EXAMPLES:
+  hoox workers disable email-worker
+  hoox workers disable web3-wallet-worker report-worker`).action(withErrorHandling(async (names, _opts, cmd) => {
+    const fmt = getFormatOptions(cmd);
+    await doSetEnabled(names, false, fmt);
+  }, { service: "workers" }));
   workersCmd.command("dev <name>").summary("Start a single worker for local development").description(`Start a specific worker for local development by running \`hoox dev worker <name>\` in-process.
 
 ARGUMENTS:
@@ -37918,10 +38322,10 @@ import { existsSync as existsSync12, realpathSync } from "fs";
 import { homedir as homedir4 } from "os";
 
 // src/services/perf/endpoint-resolver.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 function readSubdomainPrefix() {
   try {
-    const raw = readFileSync8("wrangler.jsonc", "utf8");
+    const raw = readFileSync9("wrangler.jsonc", "utf8");
     const stripped = raw.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
     const parsed = JSON.parse(stripped);
     const prefix = parsed.global?.subdomain_prefix;
@@ -38965,7 +39369,7 @@ function registerDisclaimerCommand(program2) {
   }));
 }
 // src/commands/agent/agent-command.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 init_errors4();
 var PROVIDERS = [
   {
@@ -38999,7 +39403,7 @@ function checkDevVars() {
   const candidates = ["workers/agent-worker/.dev.vars", ".dev.vars"];
   for (const filePath of candidates) {
     try {
-      const content = readFileSync9(filePath, "utf-8");
+      const content = readFileSync10(filePath, "utf-8");
       for (const line of content.split(`
 `)) {
         const trimmed = line.trim();
@@ -39530,7 +39934,7 @@ EXAMPLES:
 }
 // src/commands/pyne/pyne-command.ts
 init_config2();
-import { existsSync as existsSync14, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync11 } from "fs";
 import { resolve as resolve8 } from "path";
 init_errors4();
 var DEFAULT_TIMEOUT_MS = 30000;
@@ -39556,7 +39960,7 @@ function loadDevVars(workerDir) {
     try {
       if (!existsSync14(filePath))
         continue;
-      const content = readFileSync10(filePath, "utf-8");
+      const content = readFileSync11(filePath, "utf-8");
       for (const line of content.split(`
 `)) {
         const trimmed = line.trim();
@@ -39775,7 +40179,7 @@ EXAMPLES:
       if (!existsSync14(abs)) {
         throw new CLIError(`Script not found: ${abs}`, 1 /* ERROR */);
       }
-      body.script = readFileSync10(abs, "utf-8");
+      body.script = readFileSync11(abs, "utf-8");
     }
     const res = await pyneFetch(baseUrl, "/run", {
       method: "POST",
@@ -39826,7 +40230,7 @@ EXAMPLES:
     if (!existsSync14(abs)) {
       throw new CLIError(`Script not found: ${abs}`, 1 /* ERROR */);
     }
-    const script = readFileSync10(abs, "utf-8");
+    const script = readFileSync11(abs, "utf-8");
     const baseName = abs.split(/[/\\]/).pop() ?? "script.pine";
     const scriptId = opts.id ?? baseName.replace(/\.pine$/i, "").replace(/[^a-zA-Z0-9_-]/g, "_");
     const res = await pyneFetch(baseUrl, "/scripts", {
@@ -40189,15 +40593,21 @@ function parseTime(input) {
     return;
   const relativeMatch = input.match(/^(\d+)([smhd])$/);
   if (relativeMatch) {
-    const value = parseInt(relativeMatch[1], 10);
+    const rawValue = relativeMatch[1];
     const unit = relativeMatch[2];
+    if (!rawValue || !unit)
+      return;
+    const value = parseInt(rawValue, 10);
     const multipliers = {
       s: 1000,
       m: 60 * 1000,
       h: 60 * 60 * 1000,
       d: 24 * 60 * 60 * 1000
     };
-    return Date.now() - value * multipliers[unit];
+    const mult = multipliers[unit];
+    if (mult === undefined)
+      return;
+    return Date.now() - value * mult;
   }
   const ms = new Date(input).getTime();
   return Number.isFinite(ms) ? ms : undefined;
@@ -41489,7 +41899,7 @@ function registerCompletionCommand(program2) {
 // src/ui/banner.ts
 init_ansis();
 init_theme();
-import { existsSync as existsSync15, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname4, join as join13 } from "path";
 var ORANGE = ansis_default.hex("#ff7f2a");
@@ -41507,7 +41917,7 @@ function findCliVersion() {
     const pkgPath = join13(dir, "package.json");
     if (existsSync15(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
+        const pkg = JSON.parse(readFileSync12(pkgPath, "utf-8"));
         if (pkg.name === PKG_NAME)
           return pkg.version;
       } catch {}
@@ -42142,7 +42552,7 @@ if (typeof Bun === "undefined") {
 `);
   process.exit(1);
 }
-var pkgVersion = JSON.parse(readFileSync12(new URL("../package.json", import.meta.url), "utf-8")).version;
+var pkgVersion = JSON.parse(readFileSync13(new URL("../package.json", import.meta.url), "utf-8")).version;
 var program2 = new Command;
 program2.name("hoox").description("Hoox CLI \u2014 manage Cloudflare Workers, infrastructure, secrets, and deployments").version(`${pkgVersion}