@hoox-sh/hoox-shared 1.2.0

package/dist/index.js

@@ -0,0 +1,4198 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/operator-transport.ts
+function stripTrailingSlashes(url) {
+  return url.replace(/\/+$/, "");
+}
+function parseTransport(raw) {
+  if (!raw)
+    return null;
+  const v = raw.trim().toLowerCase();
+  if (VALID_TRANSPORTS.has(v)) {
+    return v;
+  }
+  return null;
+}
+function resolveOperatorTransportProfile(env = process.env, options = {}) {
+  const accessClientId = env.CF_ACCESS_CLIENT_ID?.trim() ?? "";
+  const accessClientSecret = env.CF_ACCESS_CLIENT_SECRET?.trim() ?? "";
+  const hasAccess = Boolean(accessClientId && accessClientSecret);
+  const explicit = parseTransport(env.HOOX_TRANSPORT) ?? parseTransport(options.configTransport);
+  const transport = explicit ?? (hasAccess ? "access" : "public");
+  const apiFromEnv = env.HOOX_API_URL?.trim();
+  const apiFromConfig = options.configApiUrl?.trim();
+  const tokenFromEnv = env.HOOX_API_TOKEN?.trim();
+  const tokenFromConfig = options.configApiToken?.trim();
+  return {
+    transport,
+    apiBase: stripTrailingSlashes(apiFromEnv || apiFromConfig || DEFAULT_API_BASE),
+    bearerToken: tokenFromEnv || tokenFromConfig || "",
+    accessClientId,
+    accessClientSecret
+  };
+}
+function buildOperatorAuthHeaders(profile) {
+  const headers = {};
+  if (profile.bearerToken) {
+    headers.Authorization = `Bearer ${profile.bearerToken}`;
+  }
+  const useAccessHeaders = profile.transport === "access" || Boolean(profile.accessClientId) && Boolean(profile.accessClientSecret);
+  if (useAccessHeaders && profile.accessClientId && profile.accessClientSecret) {
+    headers["CF-Access-Client-Id"] = profile.accessClientId;
+    headers["CF-Access-Client-Secret"] = profile.accessClientSecret;
+  }
+  return headers;
+}
+function hasOperatorClientCredentials(profile) {
+  if (profile.bearerToken)
+    return true;
+  return Boolean(profile.accessClientId && profile.accessClientSecret);
+}
+function operatorUrl(profile, path) {
+  const base = profile.apiBase.replace(/\/+$/, "");
+  const p = path.startsWith("/") ? path : `/${path}`;
+  return `${base}${p}`;
+}
+var DEFAULT_API_BASE = "http://localhost:8787", VALID_TRANSPORTS;
+var init_operator_transport = __esm(() => {
+  VALID_TRANSPORTS = new Set([
+    "public",
+    "access",
+    "mtls",
+    "tunnel"
+  ]);
+});
+
+// src/api-client.ts
+var exports_api_client = {};
+__export(exports_api_client, {
+  hooxFetch: () => hooxFetch,
+  WorkerAPIError: () => WorkerAPIError
+});
+function isRetryableStatus(status) {
+  if (status === 401 || status === 403 || status === 429)
+    return false;
+  if (status >= 500)
+    return true;
+  if (status === 408)
+    return true;
+  return false;
+}
+function isNetworkError(error) {
+  if (error instanceof Error) {
+    const msg = error.message.toLowerCase();
+    return error.name === "AbortError" || error.name === "TimeoutError" || msg.includes("fetch") || msg.includes("network") || msg.includes("econnrefused") || msg.includes("enotfound") || msg.includes("dns") || msg.includes("timeout");
+  }
+  return false;
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function activeProfile(override) {
+  return override ?? resolveOperatorTransportProfile();
+}
+async function hooxFetch(path, options) {
+  const profile = options?.transport ?? (options?.transportEnv ? resolveOperatorTransportProfile(options.transportEnv) : activeProfile());
+  const { transport: _t, transportEnv: _e, ...fetchInit } = options ?? {};
+  let lastError;
+  for (let attempt = 0;attempt <= MAX_RETRIES; attempt++) {
+    const controller = new AbortController;
+    const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    try {
+      const url = operatorUrl(profile, path);
+      const headers = {
+        "Content-Type": "application/json",
+        ...buildOperatorAuthHeaders(profile),
+        ...fetchInit.headers
+      };
+      const response = await fetch(url, {
+        ...fetchInit,
+        headers,
+        signal: controller.signal
+      });
+      if (response.status === 429) {
+        throw new WorkerAPIError("API rate limited \u2014 backing off", {
+          status: 429,
+          retryable: false
+        });
+      }
+      if (response.status === 401 || response.status === 403) {
+        throw new WorkerAPIError(`Authentication failed (HTTP ${response.status})`, { status: response.status, retryable: false });
+      }
+      if (!response.ok) {
+        if (attempt < MAX_RETRIES && isRetryableStatus(response.status)) {
+          const delay = Math.min(BASE_RETRY_DELAY_MS * Math.pow(2, attempt), MAX_RETRY_DELAY_MS);
+          await sleep(delay);
+          continue;
+        }
+        throw new WorkerAPIError(`HTTP ${response.status}: ${response.statusText}`, {
+          status: response.status,
+          retryable: isRetryableStatus(response.status)
+        });
+      }
+      return await response.json();
+    } catch (error) {
+      lastError = error;
+      if (error instanceof WorkerAPIError && !error.retryable) {
+        throw error;
+      }
+      if (attempt < MAX_RETRIES && isNetworkError(error)) {
+        const delay = Math.min(BASE_RETRY_DELAY_MS * Math.pow(2, attempt), MAX_RETRY_DELAY_MS);
+        await sleep(delay);
+        continue;
+      }
+      if (!(error instanceof WorkerAPIError)) {
+        throw new WorkerAPIError(`Network request failed: ${error.message}`, { cause: error, retryable: false, status: 0 });
+      }
+      throw error;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  throw new WorkerAPIError("Max retries exhausted", {
+    cause: lastError,
+    retryable: false
+  });
+}
+var FETCH_TIMEOUT_MS = 5000, MAX_RETRIES = 3, BASE_RETRY_DELAY_MS = 1000, MAX_RETRY_DELAY_MS = 16000, WorkerAPIError;
+var init_api_client = __esm(() => {
+  init_operator_transport();
+  WorkerAPIError = class WorkerAPIError extends Error {
+    status;
+    retryable;
+    constructor(message, options) {
+      super(message, { cause: options?.cause });
+      this.name = "WorkerAPIError";
+      this.status = options?.status ?? 0;
+      this.retryable = options?.retryable ?? false;
+    }
+  };
+});
+
+// src/sse.ts
+var exports_sse = {};
+__export(exports_sse, {
+  subscribeSSE: () => subscribeSSE
+});
+function subscribeSSE(path, callback, onStatus, options) {
+  let aborted = false;
+  const profile = options?.transport ?? (options?.transportEnv ? resolveOperatorTransportProfile(options.transportEnv) : resolveOperatorTransportProfile());
+  const run = async () => {
+    let attempt = 0;
+    while (!aborted && attempt < MAX_RECONNECT_ATTEMPTS) {
+      try {
+        const url = operatorUrl(profile, path);
+        const response = await fetch(url, {
+          headers: {
+            Accept: "text/event-stream",
+            ...buildOperatorAuthHeaders(profile)
+          }
+        });
+        if (!response.ok || !response.body) {
+          throw new Error(`SSE connection failed: HTTP ${response.status}`);
+        }
+        attempt = 0;
+        onStatus?.("connected");
+        const reader = response.body.getReader();
+        const decoder = new TextDecoder;
+        let buffer = "";
+        while (!aborted) {
+          const { done, value } = await reader.read();
+          if (done)
+            break;
+          buffer += decoder.decode(value, { stream: true });
+          const lines = buffer.split(`
+`);
+          buffer = lines.pop() || "";
+          for (const line of lines) {
+            const trimmed = line.trim();
+            if (trimmed.startsWith("data: ")) {
+              try {
+                const parsed = JSON.parse(trimmed.slice(6));
+                callback(parsed);
+              } catch {}
+            }
+          }
+        }
+      } catch {
+        if (aborted)
+          break;
+        onStatus?.("reconnecting");
+        const delay = Math.min(RECONNECT_BASE_MS * Math.pow(2, attempt), RECONNECT_MAX_MS);
+        attempt++;
+        await new Promise((resolve) => setTimeout(resolve, delay));
+      }
+    }
+    if (!aborted) {
+      onStatus?.("disconnected");
+    }
+  };
+  run();
+  return {
+    abort: () => {
+      aborted = true;
+    }
+  };
+}
+var RECONNECT_BASE_MS = 1000, RECONNECT_MAX_MS = 16000, MAX_RECONNECT_ATTEMPTS = 10;
+var init_sse = __esm(() => {
+  init_operator_transport();
+});
+
+// src/kvKeys.ts
+var KV_TRADE_DEFAULT_LEVERAGE = "trade:default_leverage";
+var KV_TRADE_MAX_POSITION_SIZE = "trade:max_position_size";
+var KV_TRADE_MAX_DAILY_DRAWDOWN_PERCENT = "trade:max_daily_drawdown_percent";
+var KV_TRADE_TRAILING_STOP_PERCENT = "trade:trailing_stop_percent";
+var KV_TRADE_KILL_SWITCH = "trade:kill_switch";
+var KV_TRADE_ROUTING = "trade:routing";
+var KV_BOT_ENABLED = "bot:enabled";
+var KV_BOT_DEFAULT_CHAT_ID = "bot:default_chat_id";
+var KV_BOT_NOTIFY_ON_EXECUTION = "bot:notify_on_execution";
+var KV_BOT_NOTIFY_ON_ERROR = "bot:notify_on_error";
+var KV_WEBHOOK_IP_CHECK_ENABLED = "webhook:tradingview:ip_check_enabled";
+var KV_WEBHOOK_ALLOWED_IPS = "webhook:tradingview:allowed_ips";
+var KV_WEBHOOK_QUEUE_MODE = "webhook:queue_mode";
+var KV_EMAIL_SCAN_SUBJECT = "email:scan_subject";
+var KV_EMAIL_USE_IMAP = "email:use_imap";
+var KV_EMAIL_COIN_PATTERN = "email:coin_pattern";
+var KV_EMAIL_ACTION_PATTERN = "email:action_pattern";
+var KV_EMAIL_QUANTITY_MULTIPLIER = "email:quantity_multiplier";
+var KV_AGENT_CONFIG = "agent:config";
+var KV_AGENT_OPENAI_KEY = "agent:openai_key";
+var KV_AGENT_ANTHROPIC_KEY = "agent:anthropic_key";
+var KV_AGENT_GOOGLE_KEY = "agent:google_key";
+var KV_DASHBOARD_AI_HEALTH_SUMMARY = "dashboard:ai_health_summary";
+var KV_HEALTH_CHECK = "health_check";
+var KV_HOUSEKEEPING_LAST_CHECK = "housekeeping:last_check";
+var QUEUE_MODE_FAILOVER = "queue_failover";
+var QUEUE_MODE_EVERYWHERE = "queue_everywhere";
+var QUEUE_MODE_DISABLED = "queue_disabled";
+var KVKeys = {
+  KV_TRADE_DEFAULT_LEVERAGE,
+  KV_TRADE_MAX_POSITION_SIZE,
+  KV_TRADE_MAX_DAILY_DRAWDOWN_PERCENT,
+  KV_TRADE_TRAILING_STOP_PERCENT,
+  KV_TRADE_KILL_SWITCH,
+  KV_TRADE_ROUTING,
+  KV_BOT_ENABLED,
+  KV_BOT_DEFAULT_CHAT_ID,
+  KV_BOT_NOTIFY_ON_EXECUTION,
+  KV_BOT_NOTIFY_ON_ERROR,
+  KV_WEBHOOK_IP_CHECK_ENABLED,
+  KV_WEBHOOK_ALLOWED_IPS,
+  KV_WEBHOOK_QUEUE_MODE,
+  KV_EMAIL_SCAN_SUBJECT,
+  KV_EMAIL_USE_IMAP,
+  KV_EMAIL_COIN_PATTERN,
+  KV_EMAIL_ACTION_PATTERN,
+  KV_EMAIL_QUANTITY_MULTIPLIER,
+  KV_AGENT_CONFIG,
+  KV_AGENT_OPENAI_KEY,
+  KV_AGENT_ANTHROPIC_KEY,
+  KV_AGENT_GOOGLE_KEY,
+  KV_DASHBOARD_AI_HEALTH_SUMMARY,
+  KV_HEALTH_CHECK,
+  KV_HOUSEKEEPING_LAST_CHECK,
+  QUEUE_MODE_FAILOVER,
+  QUEUE_MODE_EVERYWHERE,
+  QUEUE_MODE_DISABLED
+};
+
+// src/agent-config-fields.ts
+var AGENT_CONFIG_KV_KEY = KV_AGENT_CONFIG;
+var AGENT_CONFIG_EMBEDDED_FIELDS = {
+  "providers:default_provider": { kind: "top", key: "defaultProvider" },
+  "providers:fallback_chain": { kind: "top", key: "fallbackChain" },
+  "providers:timeout_ms": { kind: "top", key: "timeoutMs" },
+  "providers:retry_count": { kind: "top", key: "retryCount" },
+  "models:workers_ai_model": { kind: "model", provider: "workers-ai" },
+  "models:openai_model": { kind: "model", provider: "openai" },
+  "models:anthropic_model": { kind: "model", provider: "anthropic" },
+  "models:google_model": { kind: "model", provider: "google" },
+  "risk:max_daily_drawdown_percent": {
+    kind: "top",
+    key: "maxDailyDrawdownPercent"
+  },
+  "risk:trailing_stop_percent": { kind: "top", key: "trailingStopPercent" },
+  "risk:take_profit_percent": { kind: "top", key: "takeProfitPercent" }
+};
+var DASHBOARD_SECTIONS_AGENT_CONFIG = new Set([
+  "providers",
+  "models"
+]);
+function isAgentConfigEmbeddedField(fieldKey) {
+  return Object.prototype.hasOwnProperty.call(AGENT_CONFIG_EMBEDDED_FIELDS, fieldKey);
+}
+function isAgentConfigSection(sectionId) {
+  return DASHBOARD_SECTIONS_AGENT_CONFIG.has(sectionId);
+}
+function parseAgentConfigJson(raw) {
+  if (raw === null || raw === undefined || raw === "")
+    return {};
+  try {
+    let v = JSON.parse(raw);
+    if (typeof v === "string") {
+      try {
+        v = JSON.parse(v);
+      } catch {
+        return {};
+      }
+    }
+    if (v && typeof v === "object" && !Array.isArray(v)) {
+      return { ...v };
+    }
+  } catch {}
+  return {};
+}
+function serializeAgentConfigForKv(config) {
+  return JSON.stringify(config);
+}
+var NUMBER_TOP_KEYS = new Set([
+  "timeoutMs",
+  "retryCount",
+  "maxDailyDrawdownPercent",
+  "trailingStopPercent",
+  "takeProfitPercent"
+]);
+function getAgentConfigEmbeddedValue(config, fieldKey) {
+  const spec = AGENT_CONFIG_EMBEDDED_FIELDS[fieldKey];
+  if (!spec)
+    return;
+  if (spec.kind === "model") {
+    const map = config.modelMap;
+    if (!map || typeof map !== "object" || Array.isArray(map))
+      return;
+    const v2 = map[spec.provider];
+    if (typeof v2 === "string" || typeof v2 === "number" || typeof v2 === "boolean")
+      return v2;
+    return;
+  }
+  const v = config[spec.key];
+  if (spec.key === "fallbackChain") {
+    if (Array.isArray(v))
+      return JSON.stringify(v);
+    if (typeof v === "string")
+      return v;
+    return;
+  }
+  if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
+    return v;
+  }
+  return;
+}
+function setAgentConfigEmbeddedValue(config, fieldKey, value) {
+  const spec = AGENT_CONFIG_EMBEDDED_FIELDS[fieldKey];
+  if (!spec)
+    return { ...config };
+  const next = { ...config };
+  if (spec.kind === "model") {
+    const prev = next.modelMap && typeof next.modelMap === "object" && !Array.isArray(next.modelMap) ? next.modelMap : {};
+    next.modelMap = { ...prev, [spec.provider]: String(value) };
+    return next;
+  }
+  if (spec.key === "fallbackChain") {
+    if (typeof value === "string") {
+      try {
+        next.fallbackChain = JSON.parse(value);
+      } catch {
+        next.fallbackChain = value;
+      }
+    } else {
+      next.fallbackChain = value;
+    }
+    return next;
+  }
+  if (NUMBER_TOP_KEYS.has(spec.key)) {
+    const n = typeof value === "number" ? value : Number(value);
+    next[spec.key] = Number.isFinite(n) ? n : value;
+    return next;
+  }
+  next[spec.key] = value;
+  return next;
+}
+function expandAgentConfigToFieldMap(config) {
+  const out = {};
+  for (const fieldKey of Object.keys(AGENT_CONFIG_EMBEDDED_FIELDS)) {
+    const v = getAgentConfigEmbeddedValue(config, fieldKey);
+    if (v !== undefined)
+      out[fieldKey] = v;
+  }
+  return out;
+}
+function applyAgentConfigFieldUpdates(config, updates) {
+  let next = { ...config };
+  for (const [fieldKey, value] of Object.entries(updates)) {
+    if (isAgentConfigEmbeddedField(fieldKey)) {
+      next = setAgentConfigEmbeddedValue(next, fieldKey, value);
+    }
+  }
+  return next;
+}
+
+// src/analytics.ts
+async function trackAnalytics(env, endpoint, body, options) {
+  if (!env.ANALYTICS_SERVICE)
+    return;
+  try {
+    const payload = {
+      ...body,
+      ...options?.indexes ? { indexes: [...options.indexes] } : {}
+    };
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    const internalKey = env.INTERNAL_KEY_BINDING;
+    if (internalKey) {
+      headers["X-Internal-Auth-Key"] = internalKey;
+    }
+    await env.ANALYTICS_SERVICE.fetch(new Request(`http://localhost${endpoint}`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(payload)
+    }));
+  } catch (e) {
+    console.error("Analytics tracking failed:", e);
+  }
+}
+
+// src/colors.ts
+var Colors = {
+  background: "#050508",
+  foreground: "#E8E8F0",
+  card: "#0A0A0F",
+  border: "#232330",
+  muted: "#8B8B9E",
+  "muted-foreground": "#6E6E84",
+  dim: "#3C3C50",
+  accent: "#818CF8",
+  "accent-dim": "#6366F1",
+  success: "#34D399",
+  warning: "#FBBF24",
+  error: "#FB7185",
+  info: "#38BDF8",
+  text: "#E8E8F0",
+  "text-muted": "#8B8B9E",
+  panel: "#0A0A0F",
+  divider: "#232330",
+  highlight: "#22D3EE",
+  backdrop: "#000000"
+};
+var CoolBracketPalette = [
+  "#22D3EE",
+  "#38BDF8",
+  "#60A5FA",
+  "#818CF8",
+  "#A78BFA",
+  "#C084FC",
+  "#E879F9",
+  "#A78BFA",
+  "#818CF8",
+  "#38BDF8"
+];
+var ConnectionStatusColor = {
+  connected: Colors.success,
+  polling: Colors.highlight,
+  reconnecting: Colors.warning,
+  offline: Colors.error
+};
+var WorkerStatusColor = {
+  operational: Colors.success,
+  degraded: Colors.warning,
+  down: Colors.error
+};
+var LogLevelColor = {
+  error: Colors.error,
+  warn: Colors.warning,
+  info: Colors.foreground,
+  debug: Colors.muted
+};
+var AlertSeverityColor = {
+  info: Colors.info,
+  warning: Colors.warning,
+  error: Colors.error,
+  critical: Colors.error
+};
+
+// src/config.ts
+import {
+  readFileSync,
+  writeFileSync,
+  existsSync,
+  mkdirSync,
+  chmodSync,
+  statSync
+} from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var HOX_DIR = join(homedir(), ".hoox");
+var CONFIG_PATH = join(HOX_DIR, "config.json");
+var HOOX_DIR_MODE = 448;
+var HOOX_CONFIG_FILE_MODE = 384;
+var DEFAULT_CONFIG = {
+  apiUrl: "http://localhost:8787",
+  apiToken: "",
+  transport: "public",
+  refreshIntervalMs: 500,
+  theme: "dark",
+  activeExchanges: ["binance", "bybit", "mexc"],
+  notifications: {
+    alerts: true,
+    trades: true,
+    debug: false,
+    system: true
+  },
+  soundEnabled: true,
+  defaultView: "dashboard"
+};
+function readConfigSync() {
+  const envConfig = {
+    apiUrl: process.env.HOOX_API_URL,
+    apiToken: process.env.HOOX_API_TOKEN
+  };
+  let fileConfig = {};
+  try {
+    if (existsSync(CONFIG_PATH)) {
+      fileConfig = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    }
+  } catch {}
+  return {
+    ...DEFAULT_CONFIG,
+    ...fileConfig,
+    ...Object.fromEntries(Object.entries(envConfig).filter(([_, v]) => v !== undefined))
+  };
+}
+async function readConfig() {
+  return readConfigSync();
+}
+function ensureHooxDirSecure(dir = HOX_DIR) {
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: HOOX_DIR_MODE });
+  }
+  try {
+    chmodSync(dir, HOOX_DIR_MODE);
+  } catch {}
+}
+function writeSecureFileSync(filePath, contents, mode = HOOX_CONFIG_FILE_MODE) {
+  writeFileSync(filePath, contents, { encoding: "utf-8", mode });
+  try {
+    chmodSync(filePath, mode);
+  } catch {}
+}
+function isUnixModeGroupOrWorldAccessible(mode) {
+  return (mode & 63) !== 0;
+}
+function isConfigWorldOrGroupReadable(filePath = CONFIG_PATH) {
+  try {
+    if (!existsSync(filePath))
+      return false;
+    return isUnixModeGroupOrWorldAccessible(statSync(filePath).mode & 511);
+  } catch {
+    return false;
+  }
+}
+function formatConfigPermissionWarning(filePath = CONFIG_PATH) {
+  if (!isConfigWorldOrGroupReadable(filePath))
+    return null;
+  return `Warning: ${filePath} is group/world-accessible. ` + `Run: chmod 600 ${filePath}  (and chmod 700 on the parent dir). ` + `This file may contain apiToken / operator secrets.`;
+}
+function writeConfigSync(config) {
+  try {
+    ensureHooxDirSecure(HOX_DIR);
+    writeSecureFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), HOOX_CONFIG_FILE_MODE);
+  } catch (err) {
+    console.error("Failed to write config:", err);
+  }
+}
+async function writeConfig(config) {
+  writeConfigSync(config);
+}
+var VALID_TRANSPORTS2 = new Set([
+  "public",
+  "access",
+  "mtls",
+  "tunnel"
+]);
+function validateConfig(config) {
+  const errors = [];
+  if (config.apiUrl && !config.apiUrl.startsWith("http")) {
+    errors.push("apiUrl must start with http:// or https://");
+  }
+  if (config.refreshIntervalMs !== undefined && config.refreshIntervalMs < 100) {
+    errors.push("refreshIntervalMs must be >= 100ms");
+  }
+  if (config.theme && !["dark", "light"].includes(config.theme)) {
+    errors.push('theme must be "dark" or "light"');
+  }
+  if (config.transport !== undefined && !VALID_TRANSPORTS2.has(config.transport)) {
+    errors.push('transport must be "public" | "access" | "mtls" | "tunnel"');
+  }
+  return errors;
+}
+
+// src/cron-handler.ts
+function createCronHandler(options) {
+  const { name, handler, logger } = options;
+  return async (event, env, ctx) => {
+    const startTime = Date.now();
+    logger?.info(`${name} cron triggered`, {
+      cron: event.cron,
+      scheduledTime: event.scheduledTime
+    });
+    try {
+      await handler(event, env, ctx);
+      const durationMs = Date.now() - startTime;
+      logger?.info(`${name} cron handler completed successfully`, {
+        cron: event.cron,
+        durationMs
+      });
+    } catch (error) {
+      const durationMs = Date.now() - startTime;
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      logger?.error(`${name} cron handler failed`, {
+        cron: event.cron,
+        durationMs,
+        error: errorMsg
+      });
+      throw error;
+    }
+  };
+}
+
+// src/errors.ts
+function toError(err, fallback = "Unknown error") {
+  if (err instanceof Error)
+    return err.message;
+  if (typeof err === "string")
+    return err;
+  if (err && typeof err === "object" && "message" in err && typeof err.message === "string") {
+    return err.message;
+  }
+  if (err === null || err === undefined)
+    return fallback;
+  try {
+    return JSON.stringify(err) || fallback;
+  } catch {
+    return fallback;
+  }
+}
+var SENSITIVE_FIELDS = new Set([
+  "password",
+  "token",
+  "secret",
+  "api_key",
+  "apiKey",
+  "authorization"
+]);
+function hasSensitiveFields(obj) {
+  for (const key of Object.keys(obj)) {
+    if (SENSITIVE_FIELDS.has(key))
+      return true;
+  }
+  return false;
+}
+function hasErrorValues(obj) {
+  for (const v of Object.values(obj)) {
+    if (v instanceof Error)
+      return true;
+  }
+  return false;
+}
+function sanitizeOutput(data) {
+  if (data === null || data === undefined)
+    return data;
+  const t = typeof data;
+  if (t === "string" || t === "number" || t === "boolean")
+    return data;
+  if (data instanceof Error) {
+    return { name: data.name, message: data.message };
+  }
+  if (Array.isArray(data)) {
+    return data.map(sanitizeOutput);
+  }
+  if (t === "object") {
+    const obj = data;
+    const keys = Object.keys(obj);
+    if (keys.length < 10) {
+      const sanitized2 = {};
+      for (const k of keys) {
+        if (k === "stack" || k === "cause")
+          continue;
+        const v = obj[k];
+        sanitized2[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
+      }
+      return sanitized2;
+    }
+    if (!hasSensitiveFields(obj) && !hasErrorValues(obj)) {
+      return obj;
+    }
+    const sanitized = {};
+    for (const k of keys) {
+      if (k === "stack" || k === "cause")
+        continue;
+      const v = obj[k];
+      sanitized[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
+    }
+    return sanitized;
+  }
+  return data;
+}
+function createJsonResponse(data, status = 200) {
+  return new Response(JSON.stringify(sanitizeOutput(data)), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function createSuccessResponse(result) {
+  return createJsonResponse({ success: true, result }, 200);
+}
+function createErrorResponse(error, status) {
+  const message = typeof error === "string" ? error : error.message;
+  const statusCode = typeof error === "string" ? status ?? 500 : error.status ?? 500;
+  const body = { success: false, error: message };
+  if (typeof error !== "string" && error.code)
+    body.code = error.code;
+  if (typeof error !== "string" && error.details !== undefined)
+    body.details = error.details;
+  return new Response(JSON.stringify(body), {
+    status: statusCode,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+var Errors = {
+  badRequest: (message) => createErrorResponse({ message, status: 400, code: "BAD_REQUEST" }),
+  unauthorized: (message = "Unauthorized") => createErrorResponse({ message, status: 401, code: "UNAUTHORIZED" }),
+  forbidden: (message = "Forbidden") => createErrorResponse({ message, status: 403, code: "FORBIDDEN" }),
+  notFound: (message = "Not found") => createErrorResponse({ message, status: 404, code: "NOT_FOUND" }),
+  methodNotAllowed: (message = "Method not allowed") => createErrorResponse({ message, status: 405, code: "METHOD_NOT_ALLOWED" }),
+  rateLimited: (retryAfter) => {
+    const res = createErrorResponse({
+      message: "Rate limit exceeded",
+      status: 429,
+      code: "RATE_LIMITED"
+    });
+    if (retryAfter)
+      res.headers.set("Retry-After", String(retryAfter));
+    return res;
+  },
+  internal: (err) => {
+    const message = err ? toError(err, "Internal server error") : "Internal server error";
+    return createErrorResponse({
+      message,
+      status: 500,
+      code: "INTERNAL_ERROR"
+    });
+  }
+};
+
+// src/d1/repository.ts
+class D1Repository {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async query(sql, params = []) {
+    try {
+      const stmt = this.db.prepare(sql).bind(...params);
+      const result = await stmt.all();
+      return {
+        success: result.success,
+        results: result.results,
+        error: result.error
+      };
+    } catch (error) {
+      return {
+        success: false,
+        error: toError(error)
+      };
+    }
+  }
+  async execute(sql, params = []) {
+    try {
+      const stmt = this.db.prepare(sql).bind(...params);
+      const result = await stmt.run();
+      return {
+        success: result.success,
+        meta: {
+          last_row_id: result.meta?.last_row_id,
+          changes: result.meta?.changes,
+          duration: result.meta?.duration
+        },
+        error: result.error
+      };
+    } catch (error) {
+      return {
+        success: false,
+        error: toError(error)
+      };
+    }
+  }
+  async batch(statements) {
+    try {
+      const prepared = statements.map((s) => s.params && s.params.length > 0 ? this.db.prepare(s.query).bind(...s.params) : this.db.prepare(s.query));
+      const results = await this.db.batch(prepared);
+      return results.map((r) => ({
+        success: r.success,
+        meta: r.meta ? { last_row_id: r.meta.last_row_id, changes: r.meta.changes } : undefined,
+        error: r.error
+      }));
+    } catch (error) {
+      return statements.map(() => ({
+        success: false,
+        error: toError(error)
+      }));
+    }
+  }
+  prepare(sql) {
+    return this.db.prepare(sql);
+  }
+  async getTrades(limit = 50, offset = 0) {
+    return this.query("SELECT * FROM trades ORDER BY timestamp DESC LIMIT ? OFFSET ?", [limit, offset]);
+  }
+  async insertTrade(trade) {
+    return this.execute(`INSERT INTO trades (id, timestamp, exchange, symbol, action, quantity, price, leverage, status, raw_response) 
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+      trade.id || crypto.randomUUID(),
+      trade.timestamp,
+      trade.exchange,
+      trade.symbol,
+      trade.action,
+      trade.quantity ?? null,
+      trade.price ?? null,
+      trade.leverage ?? null,
+      trade.status,
+      trade.raw_response ?? null
+    ]);
+  }
+  async getPositions(status) {
+    if (status) {
+      return this.query("SELECT * FROM positions WHERE status = ? ORDER BY updated_at DESC", [status]);
+    }
+    return this.query("SELECT * FROM positions ORDER BY updated_at DESC");
+  }
+  async upsertPosition(position) {
+    return this.execute(`REPLACE INTO positions (id, exchange, symbol, side, entry_price, mark_price, liquidation_price, leverage, size, unrealized_pnl, status, updated_at) 
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+      position.id,
+      position.exchange,
+      position.symbol,
+      position.side,
+      position.entry_price ?? null,
+      position.mark_price ?? null,
+      position.liquidation_price ?? null,
+      position.leverage ?? null,
+      position.size,
+      position.unrealized_pnl ?? null,
+      position.status,
+      position.updated_at
+    ]);
+  }
+  async getTradeSignals(limit = 10) {
+    return this.query(`SELECT signal_id, timestamp, symbol, signal_type, source, processed_at 
+       FROM trade_signals 
+       ORDER BY processed_at DESC 
+       LIMIT ?`, [limit]);
+  }
+  async insertTradeSignal(signal) {
+    return this.execute(`INSERT INTO trade_signals (signal_id, timestamp, symbol, signal_type, source, raw_data) 
+       VALUES (?, ?, ?, ?, ?, ?)`, [
+      signal.signal_id,
+      signal.timestamp,
+      signal.symbol,
+      signal.signal_type,
+      signal.source ?? null,
+      signal.raw_data ?? null
+    ]);
+  }
+  async getSystemLogs(limit = 50) {
+    return this.query("SELECT * FROM system_logs ORDER BY timestamp DESC LIMIT ?", [limit]);
+  }
+  async insertSystemLog(log) {
+    return this.execute(`INSERT INTO system_logs (id, level, service, message, details) VALUES (?, ?, ?, ?, ?)`, [
+      log.id || crypto.randomUUID(),
+      log.level,
+      log.service,
+      log.message,
+      log.details ?? null
+    ]);
+  }
+  async getLatestBalances() {
+    return this.query(`
+      SELECT b.id, b.exchange, b.asset, b.total, b.free, b.used, b.timestamp
+      FROM balances b
+      INNER JOIN (
+        SELECT exchange, asset, MAX(timestamp) as max_time
+        FROM balances
+        GROUP BY exchange, asset
+      ) latest ON b.exchange = latest.exchange AND b.asset = latest.asset AND b.timestamp = latest.max_time
+    `);
+  }
+  async healthCheck() {
+    try {
+      await this.db.prepare("SELECT 1").first();
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+// src/d1/schemas.ts
+import { z } from "zod";
+var TradeRecordSchema = z.object({
+  id: z.string(),
+  signal_id: z.string().nullable().optional(),
+  timestamp: z.number().int().positive(),
+  exchange: z.string().min(1),
+  symbol: z.string().min(1),
+  action: z.string().min(1),
+  quantity: z.number().nullable(),
+  price: z.number().nullable(),
+  leverage: z.number().nullable(),
+  status: z.string().min(1),
+  error_message: z.string().nullable().optional(),
+  raw_response: z.string().nullable().optional(),
+  created_at: z.number().int().optional()
+}).strict();
+var PositionRecordSchema = z.object({
+  id: z.string(),
+  exchange: z.string().min(1),
+  symbol: z.string().min(1),
+  side: z.enum(["LONG", "SHORT"]),
+  entry_price: z.number().nullable().optional(),
+  mark_price: z.number().nullable().optional(),
+  liquidation_price: z.number().nullable().optional(),
+  leverage: z.number().nullable().optional(),
+  size: z.number().nullable(),
+  unrealized_pnl: z.number().nullable().optional(),
+  status: z.enum(["OPEN", "CLOSED"]),
+  updated_at: z.number().int()
+}).strict();
+var BalanceRecordSchema = z.object({
+  id: z.string(),
+  exchange: z.string().min(1),
+  asset: z.string().min(1),
+  free: z.number().nullable(),
+  used: z.number().nullable(),
+  total: z.number().nullable(),
+  timestamp: z.number().int().positive()
+}).strict();
+var SystemLogRecordSchema = z.object({
+  id: z.string(),
+  timestamp: z.number().int().optional(),
+  level: z.string().min(1),
+  service: z.string().min(1),
+  message: z.string().min(1),
+  details: z.string().nullable().optional()
+}).strict();
+var TradeSignalRecordSchema = z.object({
+  signal_id: z.string(),
+  timestamp: z.number().int().positive(),
+  symbol: z.string().min(1),
+  signal_type: z.string().min(1),
+  source: z.string().nullable().optional(),
+  raw_data: z.string().nullable().optional(),
+  processed_at: z.number().int().optional()
+}).strict();
+// src/dashboard-manifest.ts
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+var DASHBOARD_WORKER_PREFIX = {
+  hoox: "global:",
+  "trade-worker": "trade:",
+  "agent-worker": "agent:",
+  "telegram-worker": "bot:",
+  "d1-worker": "database:",
+  "email-worker": "email:",
+  "web3-wallet-worker": "wallet:",
+  "analytics-worker": "ai:",
+  "report-worker": "report:",
+  "pyne-worker": "pyne:"
+};
+var DASHBOARD_SECTION_PREFIX = {
+  global: "global:",
+  webhook: "webhook:",
+  routing: "routing:",
+  security: "webhook:",
+  trade: "trade:",
+  agent: "agent:",
+  bot: "bot:",
+  email: "email:",
+  signal: "email:",
+  database: "database:",
+  retention: "retention:",
+  cron: "cron:",
+  behavior: "behavior:",
+  risk: "trade:",
+  exchanges: "trade:",
+  fees: "trade:",
+  providers: "agent:",
+  models: "agent:",
+  ai: "ai:",
+  report: "report:",
+  pyne: "pyne:",
+  pyne_alerts: "pyne:"
+};
+var DASHBOARD_FIELD_KV_OVERRIDES = {
+  "webhook:tradingview_ip_check_enabled": "webhook:tradingview:ip_check_enabled",
+  "webhook:tradingview_allowed_ips": "webhook:tradingview:allowed_ips",
+  "exchanges:binance_enabled": "exchange:binance:enabled",
+  "exchanges:mexc_enabled": "exchange:mexc:enabled",
+  "exchanges:bybit_enabled": "exchange:bybit:enabled"
+};
+var DASHBOARD_SECTIONS_NOT_FLAT_KV = new Set([
+  "providers",
+  "models",
+  "cron",
+  "behavior"
+]);
+var DASHBOARD_SECTIONS_UI_SKIP = new Set([
+  "cron",
+  "behavior"
+]);
+function isDashboardSectionFlatKv(sectionId) {
+  return !DASHBOARD_SECTIONS_NOT_FLAT_KV.has(sectionId);
+}
+function isDashboardSectionEditable(sectionId) {
+  return !DASHBOARD_SECTIONS_UI_SKIP.has(sectionId);
+}
+function buildDashboardKvKey(worker, fieldKey) {
+  const override = DASHBOARD_FIELD_KV_OVERRIDES[fieldKey];
+  if (override)
+    return override;
+  if (fieldKey.includes(":")) {
+    const [section, ...rest] = fieldKey.split(":");
+    const fieldName = rest.join(":");
+    if (section === "exchanges" && fieldName.endsWith("_enabled")) {
+      const exchange = fieldName.slice(0, -"_enabled".length);
+      if (exchange)
+        return `exchange:${exchange}:enabled`;
+    }
+    const mapped = DASHBOARD_SECTION_PREFIX[section ?? ""];
+    if (mapped)
+      return `${mapped}${fieldName}`;
+    return `${section}:${fieldName}`;
+  }
+  const workerPrefix = DASHBOARD_WORKER_PREFIX[worker] ?? "";
+  return `${workerPrefix}${fieldKey}`;
+}
+function stripJsonc(input) {
+  let out = "";
+  let i = 0;
+  let inString = false;
+  let stringChar = "";
+  while (i < input.length) {
+    const c = input[i];
+    const next = input[i + 1];
+    if (inString) {
+      out += c;
+      if (c === "\\" && i + 1 < input.length) {
+        out += next;
+        i += 2;
+        continue;
+      }
+      if (c === stringChar)
+        inString = false;
+      i++;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      inString = true;
+      stringChar = c;
+      out += c;
+      i++;
+      continue;
+    }
+    if (c === "/" && next === "/") {
+      while (i < input.length && input[i] !== `
+`)
+        i++;
+      continue;
+    }
+    if (c === "/" && next === "*") {
+      i += 2;
+      while (i < input.length && !(input[i] === "*" && input[i + 1] === "/"))
+        i++;
+      i += 2;
+      continue;
+    }
+    if (c === ",") {
+      let j = i + 1;
+      while (j < input.length && /\s/.test(input[j]))
+        j++;
+      if (j < input.length && (input[j] === "}" || input[j] === "]")) {
+        i++;
+        continue;
+      }
+    }
+    out += c;
+    i++;
+  }
+  return out;
+}
+function parseFieldType(value) {
+  if (typeof value === "boolean")
+    return "boolean";
+  if (typeof value === "number")
+    return "number";
+  if (value === "true" || value === "false")
+    return "boolean";
+  if (value.trim().startsWith("{") || value.trim().startsWith("["))
+    return "json";
+  if (!Number.isNaN(Number(value)) && value.trim() !== "")
+    return "number";
+  return "text";
+}
+function labelFromKey(key) {
+  return key.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+}
+function parseDashboardManifest(content, workerName, onError) {
+  try {
+    const raw = JSON.parse(stripJsonc(content));
+    const displayName = raw.display_name || raw.displayName || workerName;
+    const description = raw.description || "";
+    const sections = [];
+    if (raw.sections) {
+      for (const [sectionId, sectionData] of Object.entries(raw.sections)) {
+        const fields = [];
+        const sectionFields = sectionData.fields || {};
+        const sectionOptions = sectionData.options || {};
+        const sectionDescriptions = sectionData.descriptions || {};
+        const sectionValidation = sectionData.validation || {};
+        const sectionSecrets = sectionData.secrets || {};
+        const sectionSecretCommands = sectionData.secret_commands || {};
+        for (const [key, value] of Object.entries(sectionFields)) {
+          const field = {
+            key: `${sectionId}:${key}`,
+            label: labelFromKey(key),
+            type: parseFieldType(value),
+            default: value
+          };
+          if (sectionOptions[key]) {
+            field.type = "select";
+            field.options = sectionOptions[key].map((opt) => ({
+              value: String(opt),
+              label: String(opt)
+            }));
+          }
+          if (sectionDescriptions[key]) {
+            field.description = String(sectionDescriptions[key]);
+          }
+          if (sectionValidation[key]) {
+            field.validation = sectionValidation[key];
+          }
+          if (sectionSecrets[key]) {
+            field.kind = "secret";
+            field.cliCommand = sectionSecretCommands[key];
+          }
+          if (key.includes("kill_switch") || key.includes("drawdown") || key === "enabled" && sectionId === "global") {
+            if (field.kind !== "secret")
+              field.kind = "dangerous";
+          }
+          fields.push(field);
+        }
+        sections.push({
+          id: sectionId,
+          title: sectionData.title || labelFromKey(sectionId),
+          description: sectionData.description || `Configure ${sectionId} settings`,
+          icon: sectionData.icon,
+          priority: sectionData.priority !== undefined ? sectionData.priority : sections.length * 10,
+          fields
+        });
+      }
+    }
+    return {
+      worker: workerName,
+      displayName,
+      description,
+      sections: sections.sort((a, b) => a.priority - b.priority)
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : `parse failed: ${String(err)}`;
+    onError?.(`dashboard.jsonc for ${workerName}: ${message}`);
+    return {
+      worker: workerName,
+      displayName: workerName,
+      description: "Failed to load configuration",
+      sections: []
+    };
+  }
+}
+var DASHBOARD_WORKER_IDS = [
+  "hoox",
+  "trade-worker",
+  "agent-worker",
+  "telegram-worker",
+  "d1-worker",
+  "email-worker",
+  "web3-wallet-worker",
+  "analytics-worker",
+  "report-worker",
+  "pyne-worker"
+];
+function dashboardWorkerDir(workerId) {
+  if (workerId === "hoox")
+    return "hoox-worker";
+  return workerId;
+}
+function fieldTypeToKv(t) {
+  if (t === "boolean")
+    return "boolean";
+  if (t === "number")
+    return "number";
+  return "string";
+}
+function defaultToString(value) {
+  if (typeof value === "string")
+    return value;
+  return JSON.stringify(value);
+}
+function isDocumentationField(fieldKey) {
+  const name = fieldKey.includes(":") ? fieldKey.slice(fieldKey.indexOf(":") + 1) : fieldKey;
+  return /^(GET|POST|PUT|PATCH|DELETE)\s+\//i.test(name);
+}
+function kvManifestFromDashboardManifests(manifests) {
+  const byKey = new Map;
+  for (const manifest of manifests) {
+    for (const section of manifest.sections) {
+      if (!isDashboardSectionFlatKv(section.id))
+        continue;
+      for (const field of section.fields) {
+        if (isDocumentationField(field.key))
+          continue;
+        const key = buildDashboardKvKey(manifest.worker, field.key);
+        if (!key || key.endsWith(":"))
+          continue;
+        const next = {
+          key,
+          type: fieldTypeToKv(field.type),
+          default: defaultToString(field.default),
+          description: field.description || `${manifest.displayName}: ${field.label}`,
+          secret: field.kind === "secret" ? true : undefined,
+          worker: manifest.worker
+        };
+        const prev = byKey.get(key);
+        if (!prev) {
+          byKey.set(key, next);
+          continue;
+        }
+        if (!prev.secret && next.secret)
+          prev.secret = true;
+        if ((!prev.description || prev.description.length < 8) && next.description) {
+          prev.description = next.description;
+        }
+      }
+    }
+  }
+  const keys = [...byKey.values()].sort((a, b) => a.key.localeCompare(b.key));
+  return { namespace: "CONFIG_KV", keys };
+}
+function loadDashboardKvManifestFromRoot(root, onError) {
+  return kvManifestFromDashboardManifests(loadDashboardManifestsFromRoot(root, onError));
+}
+function tryReadFile(path) {
+  try {
+    if (!existsSync2(path))
+      return null;
+    return readFileSync2(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function loadDashboardManifestsFromRoot(root, onError) {
+  const manifests = [];
+  const seen = new Set;
+  const workersDir = join2(root, "workers");
+  if (!existsSync2(workersDir))
+    return manifests;
+  const warn = onError ?? ((message) => {
+    console.warn(`[dashboard-manifest] ${message}`);
+  });
+  for (const workerId of DASHBOARD_WORKER_IDS) {
+    const dir = dashboardWorkerDir(workerId);
+    const path = join2(workersDir, dir, "dashboard.jsonc");
+    const content = tryReadFile(path);
+    if (!content)
+      continue;
+    const m = parseDashboardManifest(content, workerId, warn);
+    if (m.sections.length > 0) {
+      manifests.push(m);
+      seen.add(workerId);
+    } else if (m.description === "Failed to load configuration") {}
+  }
+  try {
+    for (const entry of readdirSync(workersDir)) {
+      if (entry === "dashboard")
+        continue;
+      const workerId = entry === "hoox-worker" || entry === "hoox" ? "hoox" : entry;
+      if (seen.has(workerId))
+        continue;
+      const path = join2(workersDir, entry, "dashboard.jsonc");
+      const content = tryReadFile(path);
+      if (!content)
+        continue;
+      const m = parseDashboardManifest(content, workerId, warn);
+      if (m.sections.length > 0) {
+        manifests.push(m);
+        seen.add(workerId);
+      }
+    }
+  } catch {}
+  const publicDir = join2(workersDir, "dashboard", "public", "workers");
+  if (existsSync2(publicDir)) {
+    try {
+      for (const file of readdirSync(publicDir)) {
+        if (!file.endsWith(".jsonc") && !file.endsWith(".json"))
+          continue;
+        const base = file.replace(/\.jsonc?$/, "");
+        const workerId = base === "hoox-worker" || base === "hoox" ? "hoox" : base;
+        if (seen.has(workerId))
+          continue;
+        const content = tryReadFile(join2(publicDir, file));
+        if (!content)
+          continue;
+        const m = parseDashboardManifest(content, workerId, warn);
+        if (m.sections.length > 0) {
+          manifests.push(m);
+          seen.add(workerId);
+        }
+      }
+    } catch {}
+  }
+  return manifests;
+}
+
+// src/exchange-client.ts
+class ExchangeRouter {
+  providers = new Map;
+  registerProvider(provider) {
+    this.providers.set(provider.name.toLowerCase(), provider);
+  }
+  route(exchange, env, options) {
+    const key = exchange.toLowerCase();
+    const provider = this.providers.get(key);
+    if (!provider) {
+      throw new Error(`Unsupported exchange: ${exchange}`);
+    }
+    if (options?.testnet && provider.supportsTestTrading === false) {
+      throw new Error(`TEST_TRADING_UNSUPPORTED: ${exchange} does not support test/sandbox trading via API`);
+    }
+    if (!provider.hasCredentials(env)) {
+      throw new Error(`API secret bindings not configured or accessible for ${exchange}`);
+    }
+    return { exchange: key, client: provider.createClient(env, options) };
+  }
+}
+
+class BaseExchangeClient {
+  apiKey;
+  apiSecret;
+  baseUrl;
+  isTestnet;
+  constructor(config) {
+    if (!config.apiKey || !config.apiSecret) {
+      throw new Error("API key and secret are required.");
+    }
+    this.apiKey = config.apiKey;
+    this.apiSecret = config.apiSecret;
+    this.baseUrl = config.baseUrl || this.getDefaultBaseUrl();
+    this.isTestnet = config.testnet || false;
+  }
+  async fetch(method, path, params) {
+    const url = `${this.baseUrl}${path}`;
+    const headers = this.buildHeaders(method, path, params);
+    const body = params ? new URLSearchParams(params).toString() : undefined;
+    const response = await fetch(url, {
+      method,
+      headers,
+      body: method !== "GET" ? body : undefined
+    });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Exchange API error: ${response.status} - ${error}`);
+    }
+    return response.json();
+  }
+  async openLong(symbol, quantity, price, orderType = "MARKET") {
+    return this.executeTrade({
+      symbol,
+      side: "long",
+      orderType,
+      quantity,
+      price
+    });
+  }
+  async openShort(symbol, quantity, price, orderType = "MARKET") {
+    return this.executeTrade({
+      symbol,
+      side: "short",
+      orderType,
+      quantity,
+      price
+    });
+  }
+  async closeLong(symbol, quantity) {
+    return this.executeTrade({
+      symbol,
+      side: "long",
+      quantity,
+      reduceOnly: true
+    });
+  }
+  async closeShort(symbol, quantity) {
+    return this.executeTrade({
+      symbol,
+      side: "short",
+      quantity,
+      reduceOnly: true
+    });
+  }
+}
+
+// src/exchanges/base-exchange-client.ts
+class BaseExchangeClient2 {
+  apiKey;
+  apiSecret;
+  baseUrl;
+  isTestnet;
+  importedKeyPromise;
+  constructor(apiKey, apiSecret, options) {
+    if (!apiKey || !apiSecret) {
+      throw new Error(this.getErrorMessagePrefix() + "API key and secret are required.");
+    }
+    this.apiKey = apiKey;
+    this.apiSecret = apiSecret;
+    this.isTestnet = options?.testnet ?? false;
+    this.baseUrl = options?.baseUrl ?? this.getDefaultBaseUrl();
+    this.importedKeyPromise = this.importKey();
+  }
+  get testnet() {
+    return this.isTestnet;
+  }
+  getErrorMessagePrefix() {
+    return "";
+  }
+  generateSignature(_params) {
+    throw new Error("generateSignature must be implemented by subclass");
+  }
+  buildHeaders(_method, _path, _params) {
+    return new Headers;
+  }
+  async importKey() {
+    const encoder = new TextEncoder;
+    return crypto.subtle.importKey("raw", encoder.encode(this.apiSecret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  }
+  async cryptoSign(data) {
+    const encoder = new TextEncoder;
+    const key = await this.importedKeyPromise;
+    const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+    return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  async fetch(method, path, params) {
+    const url = `${this.baseUrl}${path}`;
+    const headers = this.buildHeaders(method, path, params);
+    const body = params ? new URLSearchParams(params).toString() : undefined;
+    const response = await fetch(url, {
+      method,
+      headers,
+      body: method !== "GET" ? body : undefined
+    });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Exchange API error: ${response.status} - ${error}`);
+    }
+    return response.json();
+  }
+  setLeverage(_symbol, _leverage) {
+    throw new Error("setLeverage must be implemented by subclass");
+  }
+  executeTrade(_params) {
+    throw new Error("executeTrade must be implemented by subclass");
+  }
+  getAccountInfo() {
+    throw new Error("getAccountInfo must be implemented by subclass");
+  }
+  getPositions(_symbol) {
+    throw new Error("getPositions must be implemented by subclass");
+  }
+  async openLong(symbol, quantity, price, orderType = "MARKET") {
+    return this.executeTrade({
+      symbol,
+      side: "BUY",
+      orderType,
+      quantity,
+      price
+    });
+  }
+  async openShort(symbol, quantity, price, orderType = "MARKET") {
+    return this.executeTrade({
+      symbol,
+      side: "SELL",
+      orderType,
+      quantity,
+      price
+    });
+  }
+  async closeLong(symbol, quantity) {
+    return this.executeTrade({
+      symbol,
+      side: "SELL",
+      orderType: "MARKET",
+      quantity,
+      reduceOnly: true
+    });
+  }
+  async closeShort(symbol, quantity) {
+    return this.executeTrade({
+      symbol,
+      side: "BUY",
+      orderType: "MARKET",
+      quantity,
+      reduceOnly: true
+    });
+  }
+}
+// src/format-time.ts
+function formatRelativeTime(timestampMs, nowMs) {
+  const now = nowMs ?? Date.now();
+  const diffMs = now - timestampMs;
+  if (diffMs < 0)
+    return "just now";
+  if (timestampMs === 0)
+    return "\u2014";
+  const seconds = Math.floor(diffMs / 1000);
+  const minutes = Math.floor(seconds / 60);
+  const hours = Math.floor(minutes / 60);
+  const days = Math.floor(hours / 24);
+  if (seconds < 60)
+    return "< 1m ago";
+  if (minutes < 60)
+    return `${minutes}m ago`;
+  if (hours < 24)
+    return `${hours}h ago`;
+  if (days < 30)
+    return `${days}d ago`;
+  return `> 30d ago`;
+}
+function formatDuration(durationMs) {
+  const seconds = Math.floor(durationMs / 1000);
+  const minutes = Math.floor(seconds / 60);
+  const hours = Math.floor(minutes / 60);
+  if (hours > 0) {
+    const remainMin = minutes % 60;
+    return remainMin > 0 ? `${hours}h ${remainMin}m` : `${hours}h`;
+  }
+  if (minutes > 0) {
+    const remainSec = seconds % 60;
+    return remainSec > 0 ? `${minutes}m ${remainSec}s` : `${minutes}m`;
+  }
+  return `${seconds}s`;
+}
+
+// src/formatters.ts
+function formatNumber(n) {
+  if (!isFinite(n))
+    return "\u2014";
+  if (Math.abs(n) >= 1e9)
+    return `${(n / 1e9).toFixed(1)}B`;
+  if (Math.abs(n) >= 1e6)
+    return `${(n / 1e6).toFixed(1)}M`;
+  if (Math.abs(n) >= 1000)
+    return `${(n / 1000).toFixed(1)}K`;
+  return n.toLocaleString();
+}
+function formatCurrency(n) {
+  if (!isFinite(n))
+    return "\u2014";
+  const sign = n >= 0 ? "+" : "-";
+  const abs = Math.abs(n);
+  if (abs >= 1e6)
+    return `${sign}$${(abs / 1e6).toFixed(2)}M`;
+  if (abs >= 1000)
+    return `${sign}$${(abs / 1000).toFixed(2)}K`;
+  return `${sign}$${abs.toFixed(2)}`;
+}
+function formatCompactCurrency(n) {
+  if (!isFinite(n))
+    return "\u2014";
+  const abs = Math.abs(n);
+  const sign = n < 0 ? "-" : "";
+  if (abs >= 1e6)
+    return `${sign}$${(abs / 1e6).toFixed(2)}M`;
+  if (abs >= 1000)
+    return `${sign}$${(abs / 1000).toFixed(2)}K`;
+  return `${sign}$${abs.toFixed(2)}`;
+}
+function formatDuration2(seconds) {
+  if (!isFinite(seconds) || seconds < 0)
+    return "\u2014";
+  const d = Math.floor(seconds / 86400);
+  const h = Math.floor(seconds % 86400 / 3600);
+  const m = Math.floor(seconds % 3600 / 60);
+  const s = Math.floor(seconds % 60);
+  const parts = [];
+  if (d > 0)
+    parts.push(`${d}d`);
+  if (h > 0 || d > 0)
+    parts.push(`${h}h`);
+  if (m > 0 || h > 0 || d > 0)
+    parts.push(`${m}m`);
+  parts.push(`${s}s`);
+  return parts.join(" ");
+}
+function formatDurationCompact(seconds) {
+  if (!isFinite(seconds) || seconds < 0)
+    return "\u2014";
+  const d = Math.floor(seconds / 86400);
+  const h = Math.floor(seconds % 86400 / 3600);
+  const m = Math.floor(seconds % 3600 / 60);
+  if (d > 0)
+    return `${d}d ${h}h`;
+  if (h > 0)
+    return `${h}h ${m}m`;
+  if (m > 0)
+    return `${m}m`;
+  return `${Math.floor(seconds)}s`;
+}
+function formatTimestamp(iso) {
+  try {
+    const d = new Date(iso);
+    if (isNaN(d.getTime()))
+      return iso;
+    return d.toLocaleTimeString("en-US", { hour12: false });
+  } catch {
+    return iso;
+  }
+}
+function formatRelativeTime2(timestamp) {
+  const now = Date.now();
+  const diff = now - timestamp;
+  if (diff < 0)
+    return "just now";
+  const seconds = Math.floor(diff / 1000);
+  if (seconds < 60)
+    return `${seconds}s ago`;
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60)
+    return `${minutes}m ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24)
+    return `${hours}h ago`;
+  const days = Math.floor(hours / 24);
+  return `${days}d ago`;
+}
+function formatPercent(n, decimals = 2) {
+  if (!isFinite(n))
+    return "\u2014";
+  const sign = n >= 0 ? "+" : "";
+  return `${sign}${n.toFixed(decimals)}%`;
+}
+function formatUptime(seconds) {
+  return formatDuration2(seconds);
+}
+function formatLatency(ms) {
+  if (!isFinite(ms))
+    return "\u2014";
+  if (ms < 1)
+    return "<1ms";
+  if (ms < 1000)
+    return `${Math.round(ms)}ms`;
+  return `${(ms / 1000).toFixed(1)}s`;
+}
+function formatRequests(n) {
+  return formatNumber(n);
+}
+function formatMemory(usedMB, limitMB) {
+  const u = usedMB.toFixed(0);
+  const l = limitMB.toFixed(0);
+  return `${u}/${l} MB`;
+}
+function formatCpu(ms) {
+  if (!isFinite(ms))
+    return "\u2014";
+  return `${ms.toFixed(1)}ms`;
+}
+
+// src/health.ts
+function healthCheck(options) {
+  const result = {
+    status: "ok",
+    timestamp: new Date().toISOString()
+  };
+  if (options?.worker !== undefined && options?.worker !== null)
+    result.service = options.worker;
+  if (options?.version !== undefined && options?.version !== null)
+    result.version = options.version;
+  if (options?.details)
+    result.details = options.details;
+  return createSuccessResponse(result);
+}
+
+// src/legal.ts
+var COPYRIGHT = `Copyright (C) ${new Date().getFullYear()} Hoox Team. All rights reserved.`;
+var TRADEMARKS = [
+  "TradingView\xAE is a registered trademark of TradingView, Inc.",
+  "Cloudflare\xAE is a registered trademark of Cloudflare, Inc."
+];
+var TRADEMARK_NOTICE = TRADEMARKS.join(`
+`);
+var DISCLAIMER = "DISCLAIMER: This software is provided for educational and informational purposes only. " + "Trading cryptocurrencies and other financial instruments involves substantial risk of loss. " + "No guarantee of profits or protection against losses is made or implied. " + "Past performance does not indicate future results. Use at your own risk.";
+var FULL_LEGAL_NOTICE = `${COPYRIGHT}
+
+${TRADEMARK_NOTICE}
+
+${DISCLAIMER}`;
+var DISCLAIMER_HEADER = "X-Disclaimer";
+
+// src/types.ts
+import { z as z2 } from "zod";
+var TradeActionSchema = z2.enum([
+  "LONG",
+  "SHORT",
+  "CLOSE_LONG",
+  "CLOSE_SHORT"
+]);
+var WebhookPayloadSchema = z2.object({
+  exchange: z2.string().min(1),
+  action: TradeActionSchema,
+  symbol: z2.string().min(1).max(20),
+  quantity: z2.number().positive().finite(),
+  price: z2.number().positive().finite().optional(),
+  orderType: z2.string().optional(),
+  leverage: z2.number().int().positive().optional(),
+  test: z2.boolean().optional()
+}).strict();
+var TradeQueueMessageSchema = z2.object({
+  requestId: z2.string().min(1).max(128),
+  exchange: z2.string().min(1).max(64),
+  action: TradeActionSchema,
+  symbol: z2.string().min(1).max(32),
+  quantity: z2.number().positive().finite(),
+  price: z2.number().positive().finite().optional(),
+  leverage: z2.number().int().positive().max(125).optional(),
+  test: z2.boolean().optional(),
+  queuedAt: z2.string().min(1).max(64)
+}).strict();
+var TradeSignalSchema = z2.object({
+  id: z2.number().int().positive().optional(),
+  source: z2.string().min(1),
+  symbol: z2.string().min(1),
+  action: TradeActionSchema,
+  price: z2.number().positive().finite().optional(),
+  quantity: z2.number().positive().finite(),
+  leverage: z2.number().int().positive().optional(),
+  status: z2.enum(["pending", "executed", "failed", "skipped"]).optional(),
+  createdAt: z2.string().optional(),
+  executedAt: z2.string().optional(),
+  error: z2.string().optional()
+}).strict();
+var PositionSchema = z2.object({
+  id: z2.string(),
+  symbol: z2.string().min(1),
+  side: TradeActionSchema,
+  quantity: z2.number().positive(),
+  entry_price: z2.number().positive(),
+  current_price: z2.number().positive(),
+  unrealized_pnl: z2.number(),
+  timestamp: z2.number().int().positive()
+}).strict();
+var BalanceSchema = z2.object({
+  asset: z2.string().min(1),
+  free: z2.number().min(0),
+  locked: z2.number().min(0),
+  timestamp: z2.number().int().positive()
+}).strict();
+
+// src/kvUtils.ts
+async function logKvTimestamp(env, prefix = "timestamp") {
+  const timestamp = new Date().toISOString();
+  const key = `${prefix}_${timestamp}`;
+  try {
+    await env.REPORT_KV.put(key, timestamp);
+  } catch (error) {
+    console.error(`Failed to log timestamp to KV: ${toError(error, "Unknown error")}`);
+  }
+}
+function headersToObject(headers) {
+  const result = {};
+  if (!headers)
+    return result;
+  try {
+    headers.forEach((value, key) => {
+      result[key] = value;
+    });
+  } catch (error) {
+    console.error(`Error converting headers to object: ${toError(error, "Unknown error")}`);
+  }
+  return result;
+}
+
+// src/queue-handler.ts
+function createQueueHandler(options) {
+  const { maxRetries, backoffDelays, onMessage, onRetry, onDLQ, logger } = options;
+  return async (batch) => {
+    for (const msg of batch.messages) {
+      const attemptNumber = msg.attempts || 0;
+      const logId = `[${msg.id}]`;
+      try {
+        logger?.info(`${logId} Processing message (attempt ${attemptNumber + 1})`);
+        await onMessage(msg.body, attemptNumber);
+        logger?.info(`${logId} Message processed successfully`);
+      } catch (error) {
+        const errorMsg = error instanceof Error ? error.message : String(error);
+        if (attemptNumber < maxRetries) {
+          const delaySeconds = backoffDelays[attemptNumber] ?? backoffDelays[backoffDelays.length - 1];
+          logger?.info(`${logId} Retrying in ${delaySeconds}s (attempt ${attemptNumber + 2}/${maxRetries + 1})`);
+          await onRetry?.(msg.body, attemptNumber, errorMsg, delaySeconds);
+          msg.retry({ delaySeconds });
+        } else {
+          logger?.error(`${logId} Max retries exceeded (${maxRetries + 1} attempts), moving to DLQ`);
+          await onDLQ?.(msg.body, attemptNumber, errorMsg);
+        }
+      }
+    }
+  };
+}
+
+// src/middleware/auth.ts
+function timingSafeEqual(a, b) {
+  const encoder = new TextEncoder;
+  const aBuf = encoder.encode(a);
+  const bBuf = encoder.encode(b);
+  const len = Math.max(aBuf.length, bBuf.length);
+  let result = aBuf.length === bBuf.length ? 0 : 1;
+  for (let i = 0;i < len; i++) {
+    const av = i < aBuf.length ? aBuf[i] : 0;
+    const bv = i < bBuf.length ? bBuf[i] : 0;
+    result |= av ^ bv;
+  }
+  return result === 0;
+}
+function resolveOperatorApiKey(env) {
+  const preferred = env.OPERATOR_API_KEY;
+  if (typeof preferred === "string" && preferred.length > 0) {
+    return preferred;
+  }
+  const legacy = env.INTERNAL_API_KEY;
+  if (typeof legacy === "string" && legacy.length > 0) {
+    return legacy;
+  }
+  return;
+}
+async function requireAuth(request, env) {
+  return requireOperatorAuth(request, env);
+}
+async function requireOperatorAuth(request, env) {
+  const apiKey = resolveOperatorApiKey(env);
+  if (!apiKey) {
+    return new Response(JSON.stringify({
+      error: "Operator API key not configured",
+      hint: "Set OPERATOR_API_KEY (preferred) or INTERNAL_API_KEY on the Worker"
+    }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  const authHeader = request.headers.get("Authorization");
+  const expectedHeader = `Bearer ${apiKey}`;
+  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return null;
+}
+function createOperatorAuthMiddleware() {
+  return async (request, env, _ctx) => {
+    const denied = await requireOperatorAuth(request, env);
+    if (denied)
+      return denied;
+    return;
+  };
+}
+function normalizeKeyNames(keyName) {
+  if (typeof keyName === "string") {
+    return [keyName];
+  }
+  return [...keyName];
+}
+function collectInternalAuthKeys(env, keyNames) {
+  const keys = [];
+  for (const name of normalizeKeyNames(keyNames)) {
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0) {
+      keys.push(value);
+    }
+  }
+  return keys;
+}
+function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
+  for (const expected of expectedKeys) {
+    if (timingSafeEqual(providedKey, expected)) {
+      return true;
+    }
+  }
+  return false;
+}
+function internalAuthNotConfiguredResponse(keyNames) {
+  const label = normalizeKeyNames(keyNames).join(" | ");
+  return new Response(JSON.stringify({
+    success: false,
+    error: `Internal auth key(s) not configured: ${label}`
+  }), { status: 401, headers: { "Content-Type": "application/json" } });
+}
+function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return internalAuthNotConfiguredResponse(keyName);
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  return null;
+}
+function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
+  return async (request, env, _ctx) => {
+    const expectedKeys = collectInternalAuthKeys(env, keyName);
+    if (expectedKeys.length === 0) {
+      return internalAuthNotConfiguredResponse(keyName);
+    }
+    const providedKey = request.headers.get("X-Internal-Auth-Key");
+    if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    return;
+  };
+}
+function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return {
+      authorized: false,
+      error: `${normalizeKeyNames(keyName).join(" | ")} not configured`
+    };
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return { authorized: false, error: "Unauthorized" };
+  }
+  return { authorized: true };
+}
+
+// src/service-bindings.ts
+var InternalAuthKeyFields = {
+  DEFAULT: "INTERNAL_KEY_BINDING",
+  D1_READ: "D1_READ_KEY_BINDING",
+  D1_WRITE: "D1_WRITE_KEY_BINDING",
+  TRADE_EXECUTE: "TRADE_EXECUTE_KEY_BINDING",
+  TRADE_READ: "TRADE_READ_KEY_BINDING",
+  TELEGRAM_ALERT: "TELEGRAM_INTERNAL_KEY_BINDING",
+  WALLET_EXECUTE: "WALLET_EXECUTE_KEY_BINDING",
+  AGENT: "AGENT_INTERNAL_KEY",
+  D1_INTERNAL_ALIAS: "D1_INTERNAL_KEY",
+  TRADE_INTERNAL_ALIAS: "TRADE_INTERNAL_KEY",
+  TELEGRAM_INTERNAL_ALIAS: "TELEGRAM_INTERNAL_KEY"
+};
+var D1_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_READ,
+  InternalAuthKeyFields.DEFAULT
+];
+var D1_WRITE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_WRITE,
+  InternalAuthKeyFields.DEFAULT
+];
+var TRADE_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_EXECUTE,
+  InternalAuthKeyFields.DEFAULT,
+  InternalAuthKeyFields.AGENT
+];
+var TRADE_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_READ,
+  InternalAuthKeyFields.DEFAULT
+];
+var TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TELEGRAM_ALERT,
+  InternalAuthKeyFields.DEFAULT
+];
+var WALLET_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.WALLET_EXECUTE,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_D1_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_READ,
+  InternalAuthKeyFields.D1_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_EXECUTE,
+  InternalAuthKeyFields.TRADE_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TELEGRAM_ALERT,
+  InternalAuthKeyFields.TELEGRAM_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+function resolveInternalAuthKey(env, keyFields) {
+  return collectInternalAuthKeys(env, keyFields)[0];
+}
+
+class ServiceAuthError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ServiceAuthError";
+  }
+}
+function authenticatedServiceFetch(binding, env, path, body, options) {
+  const key = options?.internalKey ?? (options?.internalKeyFields ? resolveInternalAuthKey(env, options.internalKeyFields) : env.INTERNAL_KEY_BINDING);
+  if (!key) {
+    const label = options?.internalKeyFields ? Array.isArray(options.internalKeyFields) ? options.internalKeyFields.join(" | ") : options.internalKeyFields : "INTERNAL_KEY_BINDING";
+    return Promise.reject(new ServiceAuthError(`${label} not configured`));
+  }
+  return serviceFetch(binding, path, body, {
+    method: options?.method,
+    timeout: options?.timeout,
+    headers: {
+      ...options?.headers,
+      "X-Internal-Auth-Key": key
+    }
+  });
+}
+function serviceFetch(binding, path, body, options) {
+  const timeout = options?.timeout ?? 30000;
+  return binding.fetch(`http://internal${path}`, {
+    method: options?.method ?? "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers
+    },
+    body: body != null ? JSON.stringify(body) : undefined,
+    signal: AbortSignal.timeout(timeout)
+  });
+}
+
+// src/test-utils.ts
+function createMockKV(overrides) {
+  return {
+    get: async (_key) => null,
+    put: async (_key, _value, _options) => {},
+    delete: async (_key) => {},
+    list: async (_options) => ({
+      keys: []
+    }),
+    ...overrides
+  };
+}
+function createMockR2(overrides) {
+  return {
+    put: async (key, _value, _options) => ({
+      key
+    }),
+    get: async (_key) => null,
+    delete: async (_key) => {},
+    list: async (_options) => ({
+      objects: []
+    }),
+    ...overrides
+  };
+}
+function createMockPreparedStatement() {
+  return {
+    bind: (..._params) => createMockPreparedStatement(),
+    run: async () => ({ success: true }),
+    all: async () => ({ success: true, results: [] }),
+    first: async () => null
+  };
+}
+function createMockD1(overrides) {
+  return {
+    prepare: (_sql) => createMockPreparedStatement(),
+    dump: async () => new ArrayBuffer(0),
+    batch: async (_statements) => [],
+    exec: async (_sql) => ({ success: true }),
+    ...overrides
+  };
+}
+function createMockFetcher(response) {
+  const defaultResponse = response ?? new Response("OK", { status: 200 });
+  return {
+    fetch: async (_request, _init) => defaultResponse
+  };
+}
+function createMockAnalyticsEngine() {
+  return {
+    writeDataPoint: (_data) => {}
+  };
+}
+function createMockAnalyticsEngineDataset() {
+  return createMockAnalyticsEngine();
+}
+function createMockQueue() {
+  return {
+    send: async (_body, _options) => {},
+    sendBatch: async (_messages) => {}
+  };
+}
+function createMockVectorizeIndex(overrides) {
+  return {
+    query: async (_vector, _options) => ({
+      matches: []
+    }),
+    upsert: async (_vectors) => {},
+    deleteByIds: async (_ids) => {},
+    describe: async () => ({ dimension: 384, totalVectors: 0 }),
+    ...overrides
+  };
+}
+function createMockAi(overrides) {
+  return {
+    run: async (_model, _input) => ({}),
+    ...overrides
+  };
+}
+function createMockExecutionContext(overrides) {
+  return {
+    waitUntil: (_promise) => {},
+    passThroughOnException: () => {},
+    ...overrides
+  };
+}
+function createMockSecretsStore(overrides) {
+  return {
+    get: async (_key) => null,
+    put: async (_key, _value) => {},
+    delete: async (_key) => {},
+    ...overrides
+  };
+}
+function createMockEnv(overrides) {
+  return overrides;
+}
+
+// src/path-utils.ts
+import { existsSync as existsSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname, join as join3, resolve } from "path";
+function createHooxPath(path) {
+  return path;
+}
+function getHooxHome() {
+  try {
+    const override = process.env.HOOX_HOME?.trim();
+    if (override) {
+      return createHooxPath(resolve(override));
+    }
+    const home = homedir2();
+    if (!home || home.length === 0) {
+      return createHooxPath(resolve(process.cwd(), ".hoox"));
+    }
+    return createHooxPath(join3(home, ".hoox"));
+  } catch {
+    return createHooxPath(resolve(process.cwd(), ".hoox"));
+  }
+}
+function isHooxSetupRoot(dir) {
+  if (!dir)
+    return false;
+  try {
+    const root = resolve(dir);
+    return existsSync3(join3(root, "wrangler.jsonc")) && existsSync3(join3(root, "packages", "cli", "package.json"));
+  } catch {
+    return false;
+  }
+}
+function findHooxSetupRoot(startDir = process.cwd()) {
+  let dir = resolve(startDir);
+  for (;; ) {
+    if (isHooxSetupRoot(dir))
+      return dir;
+    const parent = dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function resolveHooxRuntimeRoot(options) {
+  const env = options?.env ?? process.env;
+  const cwd = resolve(options?.cwd ?? process.cwd());
+  const globalRepo = getHooxRepoPath();
+  const envRepo = env.HOOX_REPO?.trim();
+  if (envRepo) {
+    const resolved = resolve(envRepo);
+    if (isHooxSetupRoot(resolved)) {
+      return {
+        root: resolved,
+        source: "env",
+        checked: {
+          env: resolved,
+          cwd: findHooxSetupRoot(cwd),
+          global: globalRepo
+        }
+      };
+    }
+    return {
+      root: null,
+      source: "env",
+      checked: {
+        env: resolved,
+        cwd: findHooxSetupRoot(cwd),
+        global: globalRepo
+      }
+    };
+  }
+  const local = findHooxSetupRoot(cwd);
+  if (local) {
+    return {
+      root: local,
+      source: "cwd",
+      checked: { cwd: local, global: globalRepo }
+    };
+  }
+  if (isHooxSetupRoot(globalRepo)) {
+    return {
+      root: globalRepo,
+      source: "global",
+      checked: { cwd: null, global: globalRepo }
+    };
+  }
+  return {
+    root: null,
+    source: "none",
+    checked: { cwd: null, global: globalRepo }
+  };
+}
+function getTuiEntryCandidates(runtimeRoot) {
+  const root = resolve(runtimeRoot);
+  return [
+    join3(root, "packages", "tui", "src", "main.tsx"),
+    join3(root, "packages", "tui", "dist", "main.js"),
+    join3(root, "packages", "tui", "src", "main.ts")
+  ];
+}
+function resolveHooxPath(relativePath) {
+  if (!relativePath || typeof relativePath !== "string") {
+    throw new Error("relativePath must be a non-empty string");
+  }
+  if (relativePath.includes("..")) {
+    throw new Error(`Path traversal detected in relativePath: "${relativePath}"`);
+  }
+  const normalizedPath = relativePath.replace(/\\/g, "/");
+  const hooxHome = getHooxHome();
+  const fullPath = join3(hooxHome, normalizedPath);
+  const resolvedPath = resolve(fullPath);
+  const resolvedHome = resolve(hooxHome);
+  if (!resolvedPath.startsWith(resolvedHome)) {
+    throw new Error(`Resolved path "${resolvedPath}" is outside Hoox home directory`);
+  }
+  return createHooxPath(resolvedPath);
+}
+function isWithinHooxHome(path) {
+  try {
+    const hooxHome = getHooxHome();
+    const resolvedPath = resolve(path);
+    const resolvedHome = resolve(hooxHome);
+    return resolvedPath.startsWith(resolvedHome);
+  } catch {
+    return false;
+  }
+}
+function getRelativeHooxPath(absolutePath) {
+  try {
+    if (!isWithinHooxHome(absolutePath)) {
+      return null;
+    }
+    const hooxHome = getHooxHome();
+    const resolvedPath = resolve(absolutePath);
+    const resolvedHome = resolve(hooxHome);
+    const relativePath = resolvedPath.slice(resolvedHome.length);
+    return relativePath.startsWith("/") || relativePath.startsWith("\\") ? relativePath.slice(1) : relativePath;
+  } catch {
+    return null;
+  }
+}
+function getHooxRepoPath() {
+  return resolveHooxPath("repo");
+}
+function getHooxConfigDir() {
+  return resolveHooxPath("config");
+}
+function getHooxDataDir() {
+  return resolveHooxPath("data");
+}
+function getHooxWranglerPath() {
+  return resolveHooxPath("config/wrangler.jsonc");
+}
+function getHooxStatePath() {
+  return resolveHooxPath("data/state.json");
+}
+
+// src/session.ts
+import { z as z3 } from "zod";
+var SessionStateFileSchema = z3.object({
+  activeView: z3.string().optional(),
+  sidebarExpanded: z3.boolean().optional(),
+  windowSize: z3.object({
+    cols: z3.number().int().positive(),
+    rows: z3.number().int().positive()
+  }).optional(),
+  lastData: z3.number().nonnegative().optional(),
+  savedAt: z3.string().optional()
+}).strict();
+var TUI_STATE_DIR = ".tui-state";
+function getSessionFilePath() {
+  try {
+    const hooxHome = getHooxHome();
+    return `${hooxHome}/${TUI_STATE_DIR}/session.json`;
+  } catch {
+    return `${process.cwd()}/${TUI_STATE_DIR}/session.json`;
+  }
+}
+var DEFAULT_SESSION = {
+  activeView: "dashboard",
+  sidebarExpanded: true,
+  windowSize: { cols: 80, rows: 24 },
+  lastData: 0,
+  savedAt: new Date().toISOString()
+};
+async function saveSession(activeView, sidebarExpanded, windowSize, lastData) {
+  try {
+    const session = {
+      activeView,
+      sidebarExpanded,
+      windowSize,
+      lastData,
+      savedAt: new Date().toISOString()
+    };
+    await Bun.write(getSessionFilePath(), JSON.stringify(session, null, 2));
+  } catch (error) {
+    console.error("[session] Failed to save session:", error.message);
+  }
+}
+async function restoreSession() {
+  try {
+    const file = Bun.file(getSessionFilePath());
+    const exists = await file.exists();
+    if (!exists)
+      return { ...DEFAULT_SESSION };
+    const raw = await file.text();
+    const result = SessionStateFileSchema.safeParse(JSON.parse(raw));
+    const parsed = result.success ? result.data : {};
+    return {
+      activeView: validateViewId(parsed.activeView) ? parsed.activeView : DEFAULT_SESSION.activeView,
+      sidebarExpanded: typeof parsed.sidebarExpanded === "boolean" ? parsed.sidebarExpanded : DEFAULT_SESSION.sidebarExpanded,
+      windowSize: parsed.windowSize ?? DEFAULT_SESSION.windowSize,
+      lastData: typeof parsed.lastData === "number" ? parsed.lastData : DEFAULT_SESSION.lastData,
+      savedAt: parsed.savedAt ?? DEFAULT_SESSION.savedAt
+    };
+  } catch {
+    return { ...DEFAULT_SESSION };
+  }
+}
+var VALID_VIEW_IDS = new Set([
+  "dashboard",
+  "workers",
+  "worker-detail",
+  "trade-monitor",
+  "logs-viewer",
+  "service-manager",
+  "config-editor",
+  "setup-wizard",
+  "settings",
+  "queue-depth",
+  "kv-viewer",
+  "secrets-viewer",
+  "db-query",
+  "ai-chat",
+  "edge-topology",
+  "worker-settings"
+]);
+function validateViewId(id) {
+  return typeof id === "string" && VALID_VIEW_IDS.has(id);
+}
+
+// src/wizard/presets.ts
+var PRESETS = [
+  {
+    name: "minimal",
+    label: "Minimal",
+    description: "Gateway + D1 database \u2014 webhook processing only",
+    workers: ["hoox", "d1-worker", "analytics-worker"],
+    integrations: []
+  },
+  {
+    name: "standard",
+    label: "Standard",
+    description: "Trading + analytics + Telegram notifications",
+    workers: [
+      "hoox",
+      "d1-worker",
+      "trade-worker",
+      "analytics-worker",
+      "telegram-worker"
+    ],
+    integrations: ["binance", "telegram"]
+  },
+  {
+    name: "full",
+    label: "Full",
+    description: "All workers + AI agent + DeFi + email + PYNE",
+    workers: [
+      "hoox",
+      "d1-worker",
+      "trade-worker",
+      "agent-worker",
+      "telegram-worker",
+      "analytics-worker",
+      "email-worker",
+      "web3-wallet-worker",
+      "pyne-worker"
+    ],
+    integrations: [
+      "binance",
+      "bybit",
+      "mexc",
+      "telegram",
+      "openai",
+      "wallet",
+      "pyne"
+    ]
+  }
+];
+var WORKER_DEPENDENCIES = {
+  "trade-worker": ["d1-worker"],
+  "agent-worker": ["d1-worker"],
+  "email-worker": ["d1-worker"],
+  "analytics-worker": ["d1-worker"],
+  "web3-wallet-worker": ["d1-worker", "hoox"],
+  "pyne-worker": ["trade-worker"]
+};
+function resolveDependencies(selected) {
+  const result = new Set(selected);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const worker of [...result]) {
+      const deps = WORKER_DEPENDENCIES[worker];
+      if (deps) {
+        for (const dep of deps) {
+          if (!result.has(dep)) {
+            result.add(dep);
+            changed = true;
+          }
+        }
+      }
+    }
+  }
+  return [...result];
+}
+var INTEGRATIONS = [
+  {
+    key: "binance",
+    label: "Binance Exchange",
+    workerName: "trade-worker",
+    secrets: {
+      BINANCE_KEY_BINDING: "Binance API Key",
+      BINANCE_SECRET_BINDING: "Binance API Secret"
+    }
+  },
+  {
+    key: "mexc",
+    label: "MEXC Exchange",
+    workerName: "trade-worker",
+    secrets: {
+      MEXC_KEY_BINDING: "MEXC API Key",
+      MEXC_SECRET_BINDING: "MEXC API Secret"
+    }
+  },
+  {
+    key: "bybit",
+    label: "Bybit Exchange",
+    workerName: "trade-worker",
+    secrets: {
+      BYBIT_KEY_BINDING: "Bybit API Key",
+      BYBIT_SECRET_BINDING: "Bybit API Secret"
+    }
+  },
+  {
+    key: "wallet",
+    label: "Web3 Wallet (on-chain execution)",
+    workerName: "web3-wallet-worker",
+    secrets: {
+      WALLET_MNEMONIC_SECRET: "Wallet Mnemonic Phrase",
+      WALLET_PK_SECRET: "Wallet Private Key"
+    }
+  },
+  {
+    key: "email",
+    label: "Email Signal Parsing",
+    workerName: "email-worker",
+    secrets: {
+      INTERNAL_KEY_BINDING: "Internal Auth Key",
+      EMAIL_HOST_BINDING: "Email Host (IMAP server)",
+      EMAIL_USER_BINDING: "Email Username",
+      EMAIL_PASS_BINDING: "Email Password"
+    },
+    vars: { USE_IMAP: "false" }
+  },
+  {
+    key: "telegram",
+    label: "Telegram Notifications",
+    workerName: "telegram-worker",
+    secrets: {
+      TG_BOT_TOKEN_BINDING: "Telegram Bot Token"
+    }
+  },
+  {
+    key: "openai",
+    label: "OpenAI (AI Agent)",
+    workerName: "agent-worker",
+    secrets: {
+      AGENT_INTERNAL_KEY: "OpenAI API Key"
+    }
+  },
+  {
+    key: "anthropic",
+    label: "Anthropic (AI Agent)",
+    workerName: "agent-worker",
+    secrets: {
+      AGENT_INTERNAL_KEY: "Anthropic API Key"
+    }
+  },
+  {
+    key: "google-ai",
+    label: "Google AI (AI Agent)",
+    workerName: "agent-worker",
+    secrets: {
+      AGENT_INTERNAL_KEY: "Google AI API Key"
+    }
+  },
+  {
+    key: "home-assistant",
+    label: "Home Assistant (Smart Home)",
+    workerName: "hoox",
+    secrets: {
+      HA_TOKEN_BINDING: "Home Assistant Token"
+    }
+  },
+  {
+    key: "pyne",
+    label: "PYNE (Pine Script edge evaluate)",
+    workerName: "pyne-worker",
+    secrets: {
+      API_KEY: "PYNE evaluate API key (X-API-Key)",
+      ALERT_WEBHOOK_URL: "Default alert() webhook URL (optional)"
+    }
+  }
+];
+var BASE_WORKERS = {
+  "d1-worker": {
+    enabled: true,
+    path: "workers/d1-worker",
+    vars: { database_name: "hoox-db" }
+  },
+  hoox: { enabled: true, path: "workers/hoox-worker", vars: {} },
+  "agent-worker": { enabled: true, path: "workers/agent-worker", vars: {} },
+  "analytics-worker": {
+    enabled: true,
+    path: "workers/analytics-worker",
+    vars: {}
+  },
+  "pyne-worker": {
+    enabled: true,
+    path: "workers/pyne-worker",
+    vars: {}
+  }
+};
+var BASE_SECRETS = {
+  hoox: ["WEBHOOK_API_KEY_BINDING"],
+  "agent-worker": ["AGENT_INTERNAL_KEY", "INTERNAL_KEY_BINDING"],
+  "analytics-worker": ["CLOUDFLARE_API_TOKEN"]
+};
+
+// src/wizard/engine.ts
+var STEPS = [
+  {
+    id: "PREREQUISITES",
+    label: "System Prerequisites",
+    canGoBack: false,
+    optional: false,
+    validate: validatePrerequisites
+  },
+  {
+    id: "CLOUDFLARE_CONFIG",
+    label: "Cloudflare Configuration",
+    canGoBack: true,
+    optional: false,
+    validate: validateCloudflareConfig
+  },
+  {
+    id: "WORKER_SELECTION",
+    label: "Worker Selection",
+    canGoBack: true,
+    optional: false,
+    validate: validateWorkerSelection
+  },
+  {
+    id: "PROVISIONING",
+    label: "Infrastructure Provisioning",
+    canGoBack: true,
+    optional: true,
+    validate: () => []
+  },
+  {
+    id: "SECRETS",
+    label: "Secrets Configuration",
+    canGoBack: true,
+    optional: false,
+    validate: validateSecrets
+  },
+  {
+    id: "CONFIG_WRITE",
+    label: "Configuration Write",
+    canGoBack: true,
+    optional: false,
+    validate: () => []
+  },
+  {
+    id: "DEPLOY",
+    label: "Deploy",
+    canGoBack: false,
+    optional: true,
+    validate: () => []
+  },
+  {
+    id: "DONE",
+    label: "Complete",
+    canGoBack: false,
+    optional: false,
+    validate: () => []
+  }
+];
+var STEP_ORDER = STEPS.map((s) => s.id);
+function createInitialState() {
+  return {
+    step: "PREREQUISITES",
+    completedSteps: [],
+    selectedWorkers: [],
+    selectedIntegrations: [],
+    secrets: {},
+    startedAt: Date.now(),
+    updatedAt: Date.now()
+  };
+}
+function validatePrerequisites(_state, input) {
+  const errors = [];
+  if (!input.checksPassed) {
+    errors.push("System prerequisite checks must pass before continuing");
+  }
+  return errors;
+}
+function validateCloudflareConfig(_state, input) {
+  const errors = [];
+  const token = input.apiToken;
+  const accountId = input.accountId;
+  if (!token || String(token).trim().length === 0) {
+    errors.push("Cloudflare API token is required");
+  }
+  if (!accountId || String(accountId).trim().length === 0) {
+    errors.push("Cloudflare Account ID is required");
+  }
+  return errors;
+}
+function validateWorkerSelection(_state, input) {
+  const errors = [];
+  const preset = input.preset;
+  const customWorkers = input.workers;
+  if (preset === "custom" && (!customWorkers || customWorkers.length === 0)) {
+    errors.push("At least one worker must be selected");
+  }
+  return errors;
+}
+function validateSecrets(state, input) {
+  const errors = [];
+  const secrets = input.secrets;
+  if (!secrets || Object.keys(secrets).length === 0) {
+    return [];
+  }
+  for (const integrationKey of state.selectedIntegrations) {
+    const integration = INTEGRATIONS.find((i) => i.key === integrationKey);
+    if (!integration)
+      continue;
+    const integrationSecrets = secrets[integrationKey];
+    if (integrationSecrets) {
+      for (const secretName of Object.keys(integration.secrets)) {
+        const val = integrationSecrets[secretName];
+        if (!val || String(val).trim().length === 0) {
+          errors.push(`Secret "${integration.secrets[secretName]}" is required for ${integration.label}`);
+        }
+      }
+    }
+  }
+  return errors;
+}
+
+class WizardEngine {
+  state;
+  constructor(initialState) {
+    this.state = { ...createInitialState(), ...initialState };
+  }
+  getState() {
+    return { ...this.state };
+  }
+  getCurrentStep() {
+    return STEPS.find((s) => s.id === this.state.step) ?? STEPS[0];
+  }
+  getCompletedSteps() {
+    return [...this.state.completedSteps];
+  }
+  canProceed() {
+    const step = this.getCurrentStep();
+    return step.optional || this.state.completedSteps.includes(step.id);
+  }
+  canGoBack() {
+    return this.getCurrentStep().canGoBack;
+  }
+  execute(input) {
+    const currentStep = this.getCurrentStep();
+    const errors = currentStep.validate(this.state, input);
+    if (errors.length > 0) {
+      return errors;
+    }
+    this.applyInput(input);
+    if (!this.state.completedSteps.includes(this.state.step)) {
+      this.state.completedSteps.push(this.state.step);
+    }
+    const currentIdx = STEP_ORDER.indexOf(this.state.step);
+    if (currentIdx < STEP_ORDER.length - 1) {
+      this.state.step = STEP_ORDER[currentIdx + 1];
+    }
+    this.state.updatedAt = Date.now();
+    return [];
+  }
+  goBack() {
+    if (!this.canGoBack())
+      return;
+    const currentIdx = STEP_ORDER.indexOf(this.state.step);
+    if (currentIdx > 0) {
+      const previousStep = STEP_ORDER[currentIdx - 1];
+      this.state.step = previousStep;
+      this.state.completedSteps = this.state.completedSteps.filter((s) => s !== this.state.step || STEP_ORDER.indexOf(s) <= STEP_ORDER.indexOf(previousStep));
+    }
+    this.state.updatedAt = Date.now();
+  }
+  reset() {
+    this.state = createInitialState();
+  }
+  buildConfig() {
+    const cf = this.state.cloudflareConfig;
+    const workers = {};
+    for (const [name, baseCfg] of Object.entries(BASE_WORKERS)) {
+      workers[name] = {
+        enabled: true,
+        path: baseCfg.path,
+        vars: { ...baseCfg.vars },
+        secrets: [...BASE_SECRETS[name] ?? []]
+      };
+    }
+    for (const key of this.state.selectedIntegrations) {
+      const integration = INTEGRATIONS.find((i) => i.key === key);
+      if (!integration)
+        continue;
+      const workerName = integration.workerName;
+      if (!workers[workerName]) {
+        workers[workerName] = {
+          enabled: true,
+          path: `workers/${workerName}`,
+          vars: {},
+          secrets: []
+        };
+      }
+      if (integration.vars) {
+        Object.assign(workers[workerName].vars, integration.vars);
+      }
+      for (const secretName of Object.keys(integration.secrets)) {
+        if (!workers[workerName].secrets.includes(secretName)) {
+          workers[workerName].secrets.push(secretName);
+        }
+      }
+    }
+    for (const workerName of this.state.selectedWorkers) {
+      if (!workers[workerName]) {
+        workers[workerName] = {
+          enabled: true,
+          path: `workers/${workerName}`,
+          vars: {},
+          secrets: []
+        };
+      }
+    }
+    return {
+      global: {
+        cloudflare_api_token: cf?.apiToken ?? "",
+        cloudflare_account_id: cf?.accountId ?? "",
+        cloudflare_secret_store_id: cf?.secretStoreId ?? "",
+        subdomain_prefix: cf?.subdomain ?? ""
+      },
+      workers
+    };
+  }
+  getProvisioningPlan() {
+    const plan = {
+      d1Databases: [],
+      kvNamespaces: [],
+      r2Buckets: [],
+      queues: []
+    };
+    const allWorkers = [
+      ...Object.keys(BASE_WORKERS),
+      ...this.state.selectedWorkers,
+      ...this.state.selectedIntegrations.map((k) => {
+        const i = INTEGRATIONS.find((i2) => i2.key === k);
+        return i?.workerName ?? "";
+      }).filter(Boolean)
+    ];
+    const workerSet = new Set(allWorkers);
+    if (workerSet.has("d1-worker")) {
+      plan.d1Databases.push("hoox-db");
+    }
+    if (workerSet.has("hoox") || workerSet.has("analytics-worker")) {
+      plan.kvNamespaces.push("CONFIG_KV");
+    }
+    if (workerSet.has("web3-wallet-worker")) {
+      plan.kvNamespaces.push("WEB3_CACHE_KV");
+    }
+    plan.d1Databases = [...new Set(plan.d1Databases)];
+    plan.kvNamespaces = [...new Set(plan.kvNamespaces)];
+    return plan;
+  }
+  applyInput(input) {
+    const step = this.state.step;
+    switch (step) {
+      case "PREREQUISITES":
+        break;
+      case "CLOUDFLARE_CONFIG":
+        this.state.cloudflareConfig = {
+          apiToken: String(input.apiToken ?? ""),
+          accountId: String(input.accountId ?? ""),
+          secretStoreId: String(input.secretStoreId ?? ""),
+          subdomain: String(input.subdomain ?? "cryptolinx")
+        };
+        break;
+      case "WORKER_SELECTION": {
+        const preset = input.preset;
+        this.state.preset = preset;
+        if (preset && preset !== "custom") {
+          const presetDef = PRESETS.find((p) => p.name === preset);
+          if (presetDef) {
+            const resolved = resolveDependencies(presetDef.workers);
+            this.state.selectedWorkers = resolved;
+            this.state.selectedIntegrations = presetDef.integrations;
+          }
+        } else {
+          const workers = input.workers;
+          const integrations = input.integrations;
+          if (workers) {
+            this.state.selectedWorkers = resolveDependencies(workers);
+          }
+          if (integrations) {
+            this.state.selectedIntegrations = integrations;
+          }
+        }
+        break;
+      }
+      case "SECRETS":
+        this.state.secrets = input.secrets ?? {};
+        break;
+      case "PROVISIONING":
+        if (input.provisioningResults) {
+          this.state.provisioningResults = input.provisioningResults;
+        }
+        break;
+      case "CONFIG_WRITE":
+      case "DEPLOY":
+      case "DONE":
+        break;
+    }
+  }
+}
+
+// src/wizard/persistence.ts
+function serializeState(state) {
+  return JSON.stringify(state, null, 2);
+}
+function deserializeState(json) {
+  const parsed = JSON.parse(json);
+  return parsed;
+}
+var WIZARD_STATE_PATH = ".wizard-state.json";
+// src/schemas/registry.ts
+function deriveCalledBy(manifests) {
+  const calledBy = {};
+  for (const [workerName, manifest] of Object.entries(manifests)) {
+    if (!calledBy[workerName])
+      calledBy[workerName] = new Set;
+    for (const svc of manifest.services) {
+      if (!calledBy[svc.service])
+        calledBy[svc.service] = new Set;
+      calledBy[svc.service].add(workerName);
+    }
+  }
+  const result = {};
+  for (const [worker, callers] of Object.entries(calledBy)) {
+    result[worker] = [...callers].sort();
+  }
+  return result;
+}
+var manifests = {
+  hoox: {
+    name: "hoox",
+    path: "workers/hoox-worker",
+    vars: {
+      WEBHOOK_API_KEY_BINDING: {
+        type: "secret",
+        description: "External webhook auth key"
+      },
+      INTERNAL_KEY_BINDING: {
+        type: "secret",
+        description: "Inter-worker auth key"
+      },
+      HA_TOKEN_BINDING: { type: "secret", description: "Home Assistant token" }
+    },
+    services: [
+      {
+        binding: "TRADE_SERVICE",
+        service: "trade-worker",
+        description: "Trading functionality"
+      },
+      {
+        binding: "TELEGRAM_SERVICE",
+        service: "telegram-worker",
+        description: "Notifications"
+      }
+    ],
+    infrastructure: {
+      kv: [
+        { binding: "SESSIONS_KV", description: "Webhook session storage" },
+        {
+          binding: "CONFIG_KV",
+          description: "Configuration + rate limiter state"
+        }
+      ],
+      vectorize: [{ binding: "VECTORIZE_INDEX", index: "my-rag-index" }],
+      ai: true,
+      queues: { producer: ["trade-execution"] },
+      durableObjects: [
+        { name: "IDEMPOTENCY_STORE", className: "IdempotencyStore" }
+      ]
+    },
+    middleware: [
+      "requireAuth",
+      "requireInternalAuth",
+      "cors",
+      "rateLimit",
+      "logger",
+      "validate"
+    ]
+  },
+  "trade-worker": {
+    name: "trade-worker",
+    path: "workers/trade-worker",
+    vars: {
+      INTERNAL_KEY_BINDING: {
+        type: "secret",
+        description: "Inter-worker auth key"
+      },
+      TELEGRAM_INTERNAL_KEY_BINDING: {
+        type: "secret",
+        description: "Telegram outbound auth"
+      },
+      BINANCE_KEY_BINDING: { type: "secret", description: "Binance API key" },
+      BINANCE_SECRET_BINDING: {
+        type: "secret",
+        description: "Binance API secret"
+      },
+      MEXC_KEY_BINDING: { type: "secret", description: "MEXC API key" },
+      MEXC_SECRET_BINDING: { type: "secret", description: "MEXC API secret" },
+      BYBIT_KEY_BINDING: { type: "secret", description: "Bybit API key" },
+      BYBIT_SECRET_BINDING: { type: "secret", description: "Bybit API secret" }
+    },
+    services: [
+      {
+        binding: "D1_SERVICE",
+        service: "d1-worker",
+        description: "Database operations"
+      },
+      {
+        binding: "TELEGRAM_SERVICE",
+        service: "telegram-worker",
+        description: "Notifications"
+      }
+    ],
+    infrastructure: {
+      kv: [{ binding: "CONFIG_KV", description: "Configuration" }],
+      d1: [
+        {
+          binding: "DB",
+          database: "trade-data-db",
+          description: "Trade operations"
+        }
+      ],
+      r2: [
+        {
+          binding: "REPORTS_BUCKET",
+          bucket: "trade-reports",
+          description: "Trade reports"
+        },
+        {
+          binding: "SYSTEM_LOGS_BUCKET",
+          bucket: "hoox-system-logs",
+          description: "Verbose exchange logs"
+        }
+      ],
+      queues: { consumer: ["trade-execution"] }
+    },
+    middleware: ["requireInternalAuth"]
+  },
+  "telegram-worker": {
+    name: "telegram-worker",
+    path: "workers/telegram-worker",
+    vars: {
+      INTERNAL_KEY_BINDING: {
+        type: "secret",
+        description: "Inter-worker auth key"
+      },
+      TG_BOT_TOKEN_BINDING: {
+        type: "secret",
+        description: "Telegram bot token"
+      },
+      TG_CHAT_ID_BINDING: { type: "secret", description: "Default chat ID" },
+      TELEGRAM_SECRET_TOKEN: {
+        type: "secret",
+        description: "Webhook verification token"
+      }
+    },
+    services: [],
+    infrastructure: {
+      kv: [{ binding: "CONFIG_KV", description: "Configuration" }],
+      r2: [
+        {
+          binding: "UPLOADS_BUCKET",
+          bucket: "user-uploads",
+          description: "User uploaded files"
+        }
+      ],
+      vectorize: [{ binding: "VECTORIZE_INDEX", index: "my-rag-index" }],
+      ai: true
+    },
+    middleware: ["requireInternalAuth"]
+  },
+  "d1-worker": {
+    name: "d1-worker",
+    path: "workers/d1-worker",
+    vars: {
+      INTERNAL_KEY_BINDING: {
+        type: "secret",
+        description: "Inter-worker auth key"
+      }
+    },
+    services: [],
+    infrastructure: {
+      kv: [{ binding: "CONFIG_KV", description: "Configuration" }],
+      d1: [
+        {
+          binding: "DB",
+          database: "trade-data-db",
+          description: "Main database"
+        }
+      ]
+    },
+    middleware: ["requireInternalAuth"]
+  },
+  "web3-wallet-worker": {
+    name: "web3-wallet-worker",
+    path: "workers/web3-wallet-worker",
+    vars: {
+      WALLET_PK_SECRET: { type: "secret", description: "Wallet private key" },
+      WALLET_MNEMONIC_SECRET: {
+        type: "secret",
+        description: "Wallet mnemonic phrase"
+      }
+    },
+    services: [
+      {
+        binding: "TELEGRAM_SERVICE",
+        service: "telegram-worker",
+        description: "Notifications"
+      }
+    ],
+    infrastructure: {},
+    middleware: ["requireInternalAuth"]
+  },
+  "agent-worker": {
+    name: "agent-worker",
+    path: "workers/agent-worker",
+    vars: {
+      AGENT_INTERNAL_KEY: { type: "secret", description: "Agent worker auth" },
+      INTERNAL_KEY_BINDING: {
+        type: "secret",
+        description: "Inter-worker auth key"
+      }
+    },
+    services: [
+      {
+        binding: "TRADE_SERVICE",
+        service: "trade-worker",
+        description: "Trading functionality"
+      },
+      {
+        binding: "TELEGRAM_SERVICE",
+        service: "telegram-worker",
+        description: "Notifications"
+      }
+    ],
+    infrastructure: {
+      kv: [{ binding: "CONFIG_KV", description: "Configuration" }],
+      d1: [
+        {
+          binding: "DB",
+          database: "trade-data-db",
+          description: "Portfolio queries"
+        }
+      ],
+      ai: true
+    },
+    middleware: ["requireInternalAuth"],
+    cron: ["*/15 * * * *"]
+  },
+  "email-worker": {
+    name: "email-worker",
+    path: "workers/email-worker",
+    vars: {
+      INTERNAL_KEY_BINDING: {
+        type: "secret",
+        description: "Inter-worker auth key"
+      },
+      EMAIL_HOST_BINDING: { type: "secret", description: "Email IMAP host" },
+      EMAIL_USER_BINDING: { type: "secret", description: "Email username" },
+      EMAIL_PASS_BINDING: { type: "secret", description: "Email password" },
+      TRADE_WORKER_NAME: {
+        type: "plaintext",
+        description: "Trade worker service name",
+        default: "trade-worker"
+      },
+      USE_IMAP: {
+        type: "plaintext",
+        description: "Use IMAP for email",
+        default: "false"
+      },
+      MAILGUN_API_KEY: { type: "secret", description: "Mailgun API key" },
+      EMAIL_SCAN_SUBJECT: { type: "secret", description: "Email scan subject" }
+    },
+    services: [
+      {
+        binding: "TRADE_SERVICE",
+        service: "trade-worker",
+        description: "Trading functionality"
+      }
+    ],
+    infrastructure: {
+      kv: [{ binding: "CONFIG_KV", description: "Configuration" }]
+    },
+    middleware: ["requireInternalAuth"],
+    cron: ["*/5 * * * *"]
+  },
+  "analytics-worker": {
+    name: "analytics-worker",
+    path: "workers/analytics-worker",
+    vars: {
+      CLOUDFLARE_API_TOKEN: {
+        type: "secret",
+        description: "CF API token for Analytics SQL"
+      },
+      CLOUDFLARE_ACCOUNT_ID: {
+        type: "plaintext",
+        description: "CF Account ID"
+      }
+    },
+    services: [],
+    infrastructure: {
+      analyticsEngine: true
+    },
+    middleware: []
+  },
+  "report-worker": {
+    name: "report-worker",
+    path: "workers/report-worker",
+    vars: {
+      CF_API_TOKEN_BINDING: {
+        type: "secret",
+        description: "CF API token for Browser Rendering"
+      },
+      ACCOUNT_ID: { type: "plaintext", description: "CF Account ID" }
+    },
+    services: [
+      {
+        binding: "D1_SERVICE",
+        service: "d1-worker",
+        description: "Database queries"
+      },
+      {
+        binding: "TELEGRAM_SERVICE",
+        service: "telegram-worker",
+        description: "Notifications"
+      }
+    ],
+    infrastructure: {
+      r2: [
+        {
+          binding: "REPORTS_BUCKET",
+          bucket: "trade-reports",
+          description: "PDF reports"
+        }
+      ]
+    },
+    middleware: ["requireInternalAuth"],
+    cron: ["0 8 * * *", "0 18 * * *"]
+  },
+  "pyne-worker": {
+    name: "pyne-worker",
+    path: "workers/pyne-worker",
+    vars: {
+      API_KEY: {
+        type: "secret",
+        description: "X-API-Key for /run and management endpoints"
+      },
+      ALERT_WEBHOOK_URL: {
+        type: "secret",
+        description: "Default HTTPS webhook for alert()/alertcondition()"
+      },
+      TRADE_WORKER_NAME: {
+        type: "plaintext",
+        description: "Trade worker service name",
+        default: "trade-worker"
+      }
+    },
+    services: [
+      {
+        binding: "TRADE_SERVICE",
+        service: "trade-worker",
+        description: "Forward strategy trade events"
+      }
+    ],
+    infrastructure: {
+      r2: [
+        {
+          binding: "OHLCV_DATA",
+          bucket: "pyne-worker-ohlcv",
+          description: "OHLCV klines + script registry"
+        }
+      ]
+    },
+    middleware: [],
+    cron: ["* * * * *"]
+  },
+  dashboard: {
+    name: "dashboard",
+    path: "workers/dashboard",
+    vars: {
+      DASHBOARD_USER: {
+        type: "secret",
+        description: "Dashboard admin username"
+      },
+      DASHBOARD_PASS: {
+        type: "secret",
+        description: "Dashboard admin password"
+      },
+      SESSION_SECRET: { type: "secret", description: "Session encryption key" },
+      PYNE_API_KEY: {
+        type: "secret",
+        description: "Dashboard \u2192 pyne-worker X-API-Key (match API_KEY)"
+      }
+    },
+    services: [
+      {
+        binding: "D1_SERVICE",
+        service: "d1-worker",
+        description: "Database queries"
+      },
+      {
+        binding: "AGENT_SERVICE",
+        service: "agent-worker",
+        description: "AI risk data"
+      },
+      {
+        binding: "PYNE_SERVICE",
+        service: "pyne-worker",
+        description: "PYNE edge evaluate"
+      }
+    ],
+    infrastructure: {
+      kv: [{ binding: "CONFIG_KV", description: "Configuration" }],
+      ai: true
+    },
+    middleware: []
+  }
+};
+var CALLED_BY = deriveCalledBy(manifests);
+var WORKER_MANIFESTS = manifests;
+var WORKER_NAMES = Object.keys(manifests).sort();
+
+// src/schemas/validators.ts
+import { parse } from "jsonc-parser";
+function validateWranglerJsonc(workerName, manifest, jsoncContent) {
+  const errors = [];
+  let parsed;
+  try {
+    parsed = parse(jsoncContent);
+  } catch {
+    errors.push({
+      worker: workerName,
+      severity: "error",
+      message: "Failed to parse wrangler.jsonc",
+      file: "wrangler.jsonc"
+    });
+    return errors;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    errors.push({
+      worker: workerName,
+      severity: "error",
+      message: "Failed to parse wrangler.jsonc \u2014 result is not a valid object",
+      file: "wrangler.jsonc"
+    });
+    return errors;
+  }
+  const wrangler = parsed;
+  const declaredVars = wrangler.vars ?? {};
+  for (const [name, def] of Object.entries(manifest.vars)) {
+    if (!(name in declaredVars)) {
+      errors.push({
+        worker: workerName,
+        severity: "error",
+        message: `Missing var: ${name} (${def.description})`,
+        file: "wrangler.jsonc"
+      });
+    }
+  }
+  for (const [name, def] of Object.entries(manifest.vars)) {
+    if (def.type === "secret" && !name.endsWith("_BINDING") && !name.endsWith("_SECRET") && !name.startsWith("CLOUDFLARE_") && name !== "TELEGRAM_SECRET_TOKEN" && name !== "MAILGUN_API_KEY" && name !== "EMAIL_SCAN_SUBJECT" && name !== "DASHBOARD_USER" && name !== "DASHBOARD_PASS" && name !== "SESSION_SECRET" && name !== "AGENT_INTERNAL_KEY") {
+      errors.push({
+        worker: workerName,
+        severity: "warning",
+        message: `Secret var "${name}" does not end with _BINDING or _SECRET suffix`,
+        file: "wrangler.jsonc"
+      });
+    }
+  }
+  const declaredServices = wrangler.services ?? [];
+  for (const expected of manifest.services) {
+    const match = declaredServices.find((s) => s.binding === expected.binding && s.service === expected.service);
+    if (!match) {
+      const declared = declaredServices.find((s) => s.binding === expected.binding);
+      if (declared) {
+        errors.push({
+          worker: workerName,
+          severity: "error",
+          message: `Service "${expected.binding}" points to "${declared.service}" but manifest expects "${expected.service}"`,
+          file: "wrangler.jsonc"
+        });
+      } else {
+        errors.push({
+          worker: workerName,
+          severity: "error",
+          message: `Missing service binding: ${expected.binding} -> ${expected.service}`,
+          file: "wrangler.jsonc"
+        });
+      }
+    }
+  }
+  for (const declared of declaredServices) {
+    const expected = manifest.services.find((s) => s.binding === declared.binding);
+    if (!expected) {
+      errors.push({
+        worker: workerName,
+        severity: "warning",
+        message: `Unexpected service binding: ${declared.binding}`,
+        file: "wrangler.jsonc"
+      });
+    }
+  }
+  return errors;
+}
+function validateRootSecrets(workerName, manifest, rootJsoncContent) {
+  const errors = [];
+  let parsed;
+  try {
+    parsed = parse(rootJsoncContent);
+  } catch {
+    errors.push({
+      worker: workerName,
+      severity: "error",
+      message: "Failed to parse root wrangler.jsonc"
+    });
+    return errors;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    errors.push({
+      worker: workerName,
+      severity: "error",
+      message: "Failed to parse root wrangler.jsonc \u2014 result is not a valid object"
+    });
+    return errors;
+  }
+  const rootWrangler = parsed;
+  const rootSecrets = rootWrangler.workers?.[workerName]?.secrets ?? [];
+  const expectedSecrets = Object.entries(manifest.vars).filter(([_, def]) => def.type === "secret").map(([name]) => name);
+  for (const expected of expectedSecrets) {
+    if (!rootSecrets.includes(expected)) {
+      errors.push({
+        worker: workerName,
+        severity: "error",
+        message: `Secret "${expected}" missing from root wrangler.jsonc workers.${workerName}.secrets`,
+        file: "wrangler.jsonc (root)"
+      });
+    }
+  }
+  return errors;
+}
+function validateDevVars(workerName, manifest, devVarsContent) {
+  const errors = [];
+  const vars = new Map;
+  for (const line of devVarsContent.split(`
+`)) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#"))
+      continue;
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx < 1)
+      continue;
+    vars.set(trimmed.substring(0, eqIdx).trim(), trimmed.substring(eqIdx + 1).trim());
+  }
+  for (const [name, def] of Object.entries(manifest.vars)) {
+    if (def.type !== "secret")
+      continue;
+    if (!vars.has(name)) {
+      errors.push({
+        worker: workerName,
+        severity: "error",
+        message: `Missing "${name}" in .dev.vars`,
+        file: ".dev.vars"
+      });
+    }
+  }
+  return errors;
+}
+function generateWranglerJsonc(manifest) {
+  const parts = [];
+  parts.push(`{`);
+  parts.push(`  "name": "${manifest.name}",`);
+  parts.push(`  "main": "src/index.ts",`);
+  const varKeys = Object.keys(manifest.vars);
+  if (varKeys.length > 0) {
+    parts.push(`  "vars": {`);
+    for (const [i, name] of varKeys.entries()) {
+      const def = manifest.vars[name];
+      const comma = i < varKeys.length - 1 ? "," : "";
+      const val = def.type === "secret" ? "__SECRET__" : JSON.stringify(def.default ?? "");
+      parts.push(`    "${name}": ${val}${comma}`);
+    }
+    parts.push(`  },`);
+  }
+  if (manifest.services.length > 0) {
+    parts.push(`  "services": [`);
+    for (const [i, svc] of manifest.services.entries()) {
+      const comma = i < manifest.services.length - 1 ? "," : "";
+      parts.push(`    { "binding": "${svc.binding}", "service": "${svc.service}" }${comma}`);
+    }
+    parts.push(`  ],`);
+  }
+  const infra = manifest.infrastructure;
+  if (infra.kv && infra.kv.length > 0) {
+    parts.push(`  "kv_namespaces": [`);
+    for (const [i, binding] of infra.kv.entries()) {
+      const comma = i < infra.kv.length - 1 ? "," : "";
+      parts.push(`    { "binding": "${binding.binding}", "id": "" }${comma}`);
+    }
+    parts.push(`  ],`);
+  }
+  if (infra.d1 && infra.d1.length > 0) {
+    parts.push(`  "d1_databases": [`);
+    for (const [i, binding] of infra.d1.entries()) {
+      const comma = i < infra.d1.length - 1 ? "," : "";
+      parts.push(`    { "binding": "${binding.binding}", "database_name": "${binding.database}", "database_id": "" }${comma}`);
+    }
+    parts.push(`  ],`);
+  }
+  if (infra.r2 && infra.r2.length > 0) {
+    parts.push(`  "r2_buckets": [`);
+    for (const [i, binding] of infra.r2.entries()) {
+      const comma = i < infra.r2.length - 1 ? "," : "";
+      parts.push(`    { "binding": "${binding.binding}", "bucket_name": "${binding.bucket}" }${comma}`);
+    }
+    parts.push(`  ],`);
+  }
+  if (infra.ai) {
+    parts.push(`  "ai": { "binding": "AI" },`);
+  }
+  if (infra.analyticsEngine) {
+    parts.push(`  "analytics_engine_datasets": [{ "binding": "ANALYTICS_ENGINE", "dataset": "hoox-analytics" }],`);
+  }
+  if (infra.vectorize && infra.vectorize.length > 0) {
+    parts.push(`  "vectorize": [`);
+    for (const [i, binding] of infra.vectorize.entries()) {
+      const comma = i < infra.vectorize.length - 1 ? "," : "";
+      parts.push(`    { "binding": "${binding.binding}", "index_name": "${binding.index}" }${comma}`);
+    }
+    parts.push(`  ],`);
+  }
+  if (infra.queues) {
+    if (infra.queues.producer && infra.queues.producer.length > 0) {
+      parts.push(`  "queues": { "producers": [`);
+      for (const [i, q] of infra.queues.producer.entries()) {
+        const comma = i < infra.queues.producer.length - 1 ? "," : "";
+        parts.push(`    { "queue": "${q}", "binding": "" }${comma}`);
+      }
+      parts.push(`  ] },`);
+    }
+    if (infra.queues.consumer && infra.queues.consumer.length > 0) {
+      parts.push(`  "queues": { "consumers": [`);
+      for (const [i, q] of infra.queues.consumer.entries()) {
+        const comma = i < infra.queues.consumer.length - 1 ? "," : "";
+        parts.push(`    { "queue": "${q}" }${comma}`);
+      }
+      parts.push(`  ] },`);
+    }
+  }
+  if (infra.durableObjects && infra.durableObjects.length > 0) {
+    parts.push(`  "durable_objects": { "bindings": [`);
+    for (const [i, doBinding] of infra.durableObjects.entries()) {
+      const comma = i < infra.durableObjects.length - 1 ? "," : "";
+      parts.push(`    { "name": "${doBinding.name}", "class_name": "${doBinding.className}" }${comma}`);
+    }
+    parts.push(`  ] },`);
+  }
+  parts.push(`}`);
+  return parts.join(`
+`) + `
+`;
+}
+function generateDevVars(manifest) {
+  const lines = [];
+  lines.push(`# ${manifest.name} \u2014 Environment Variables`);
+  lines.push(`# Auto-generated from worker manifest schema`);
+  lines.push(``);
+  for (const [name, def] of Object.entries(manifest.vars)) {
+    if (def.type === "secret") {
+      lines.push(`${name}=placeholder_${name.toLowerCase()}`);
+    }
+  }
+  lines.push(``);
+  return lines.join(`
+`);
+}
+function validateAll(workerName, manifest, files) {
+  const errors = [
+    ...validateWranglerJsonc(workerName, manifest, files.wranglerJsonc),
+    ...validateRootSecrets(workerName, manifest, files.rootWranglerJsonc),
+    ...validateDevVars(workerName, manifest, files.devVars)
+  ];
+  return {
+    worker: workerName,
+    passed: errors.filter((e) => e.severity === "error").length === 0,
+    errors
+  };
+}
+// src/stores/ui-store.ts
+import { create } from "zustand";
+import { immer } from "zustand/middleware/immer";
+var DEFAULT_VIEW = "dashboard";
+var initialState = {
+  activeView: DEFAULT_VIEW,
+  sidebarExpanded: true,
+  modal: null,
+  commandPaletteOpen: false,
+  previousView: null
+};
+var useUIStore = create()(immer((set) => ({
+  ...initialState,
+  setView: (view) => set((state) => {
+    if (state.activeView !== view) {
+      state.previousView = state.activeView;
+    }
+    state.activeView = view;
+    state.commandPaletteOpen = false;
+  }),
+  toggleSidebar: () => set((state) => {
+    state.sidebarExpanded = !state.sidebarExpanded;
+  }),
+  openPalette: () => set((state) => {
+    state.commandPaletteOpen = true;
+  }),
+  closePalette: () => set((state) => {
+    state.commandPaletteOpen = false;
+  }),
+  showModal: (modal) => set((state) => {
+    state.modal = modal;
+  }),
+  dismissModal: () => set((state) => {
+    state.modal = null;
+  }),
+  goBack: () => set((state) => {
+    if (state.previousView) {
+      state.activeView = state.previousView;
+      state.previousView = null;
+    }
+  })
+})));
+
+// src/stores/service-store.ts
+import { create as create2 } from "zustand";
+import { immer as immer2 } from "zustand/middleware/immer";
+function summarizeCliError(details) {
+  const raw = details.stderr.trim() || details.stdout.trim() || details.command || "Unknown CLI error";
+  const firstLine = raw.split(`
+`, 1)[0] ?? "";
+  const trimmed = firstLine.slice(0, 120).trimEnd();
+  return trimmed.length > 0 ? trimmed : details.command;
+}
+var BACKOFF_SEQUENCE = [1000, 2000, 4000, 8000, 16000];
+var MAX_RETRIES2 = 5;
+function ringPush(arr, item, max) {
+  const next = [...arr, item];
+  return next.length > max ? next.slice(next.length - max) : next;
+}
+var tradeStreamAbort = null;
+var logStreamAbort = null;
+var fetchWorkersGeneration = 0;
+var MAX_TRADES = 500;
+var MAX_ALERTS = 100;
+var MAX_LOGS = 1000;
+var initialState2 = {
+  workers: [],
+  tradeStream: [],
+  alerts: [],
+  logs: [],
+  metrics: null,
+  connectionStatus: "offline",
+  lastUpdated: 0,
+  selectedWorkerId: null,
+  retryCount: 0,
+  lastError: null,
+  lastErrorDetails: null,
+  lastSuccessfulFetch: 0,
+  reconnectDelay: 0,
+  disconnectedAt: null
+};
+function getBackoffDelay(retryCount) {
+  if (retryCount <= 0)
+    return 0;
+  const index = Math.min(retryCount - 1, BACKOFF_SEQUENCE.length - 1);
+  return BACKOFF_SEQUENCE[index];
+}
+var useServiceStore = create2()(immer2((set, get) => ({
+  ...initialState2,
+  fetchWorkers: async () => {
+    const gen = ++fetchWorkersGeneration;
+    const { hooxFetch: hooxFetch2 } = await Promise.resolve().then(() => (init_api_client(), exports_api_client));
+    try {
+      const data = await hooxFetch2("/v1/workers");
+      if (gen !== fetchWorkersGeneration)
+        return;
+      set((state) => {
+        state.workers = data;
+        state.lastUpdated = Date.now();
+        state.lastSuccessfulFetch = Date.now();
+        if (state.connectionStatus === "polling" || state.connectionStatus === "reconnecting" || state.connectionStatus === "offline") {
+          state.connectionStatus = "connected";
+          state.retryCount = 0;
+          state.lastError = null;
+          state.lastErrorDetails = null;
+          state.reconnectDelay = 0;
+          state.disconnectedAt = null;
+        }
+      });
+    } catch (error) {
+      if (gen !== fetchWorkersGeneration)
+        return;
+      const msg = error instanceof Error ? error.message : "Unknown fetch error";
+      get().addAlert({
+        id: crypto.randomUUID(),
+        type: "connection",
+        severity: "error",
+        message: msg,
+        timestamp: Date.now(),
+        acknowledged: false
+      });
+      set((state) => {
+        state.lastError = msg;
+        state.disconnectedAt = state.disconnectedAt ?? Date.now();
+        if (state.connectionStatus === "connected" || state.connectionStatus === "polling") {
+          state.connectionStatus = "reconnecting";
+          state.retryCount = state.retryCount + 1;
+          if (state.retryCount >= MAX_RETRIES2) {
+            state.connectionStatus = "offline";
+            state.lastError = `Connection lost after ${MAX_RETRIES2} retries`;
+          } else {
+            state.reconnectDelay = getBackoffDelay(state.retryCount);
+          }
+        } else if (state.connectionStatus === "reconnecting") {
+          state.retryCount = state.retryCount + 1;
+          if (state.retryCount >= MAX_RETRIES2) {
+            state.connectionStatus = "offline";
+            state.lastError = `Connection lost after ${MAX_RETRIES2} retries`;
+            state.reconnectDelay = 0;
+          } else {
+            state.reconnectDelay = getBackoffDelay(state.retryCount);
+          }
+        }
+      });
+    }
+  },
+  streamTrades: async () => {
+    const { subscribeSSE: subscribeSSE2 } = await Promise.resolve().then(() => (init_sse(), exports_sse));
+    tradeStreamAbort?.();
+    tradeStreamAbort = null;
+    try {
+      const sub = subscribeSSE2("/v1/trades/stream", (trade) => {
+        get().pushTrade(trade);
+      });
+      const resolved = await Promise.resolve(sub);
+      tradeStreamAbort = resolved.abort.bind(resolved);
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : "SSE trade stream failed";
+      get().addAlert({
+        id: crypto.randomUUID(),
+        type: "connection",
+        severity: "error",
+        message: msg,
+        timestamp: Date.now(),
+        acknowledged: false
+      });
+      get().handleConnectionFailure(msg);
+    }
+  },
+  streamLogs: async () => {
+    const { subscribeSSE: subscribeSSE2 } = await Promise.resolve().then(() => (init_sse(), exports_sse));
+    logStreamAbort?.();
+    logStreamAbort = null;
+    try {
+      const sub = subscribeSSE2("/v1/logs/stream", (log) => {
+        get().pushLog(log);
+      });
+      const resolved = await Promise.resolve(sub);
+      logStreamAbort = resolved.abort.bind(resolved);
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : "SSE log stream failed";
+      get().addAlert({
+        id: crypto.randomUUID(),
+        type: "connection",
+        severity: "error",
+        message: msg,
+        timestamp: Date.now(),
+        acknowledged: false
+      });
+      get().handleConnectionFailure(msg);
+    }
+  },
+  stopStreams: () => {
+    tradeStreamAbort?.();
+    logStreamAbort?.();
+    tradeStreamAbort = null;
+    logStreamAbort = null;
+  },
+  addAlert: (alert) => set((state) => {
+    state.alerts = ringPush(state.alerts, alert, MAX_ALERTS);
+  }),
+  addAlerts: (alerts) => set((state) => {
+    const merged = [...state.alerts, ...alerts];
+    state.alerts = merged.length > MAX_ALERTS ? merged.slice(merged.length - MAX_ALERTS) : merged;
+  }),
+  setConnectionStatus: (status) => set((state) => {
+    if (status === "connected") {
+      state.retryCount = 0;
+      state.lastError = null;
+      state.lastErrorDetails = null;
+      state.reconnectDelay = 0;
+      state.disconnectedAt = null;
+    }
+    if (status === "offline" || status === "reconnecting") {
+      state.disconnectedAt = state.disconnectedAt ?? Date.now();
+    }
+    state.connectionStatus = status;
+  }),
+  selectWorker: (id) => set((state) => {
+    state.selectedWorkerId = id;
+  }),
+  setWorkers: (workers) => set((state) => {
+    state.workers = workers;
+    state.lastUpdated = Date.now();
+  }),
+  pushTrade: (trade) => set((state) => {
+    state.tradeStream = ringPush(state.tradeStream, trade, MAX_TRADES);
+  }),
+  pushLog: (log) => set((state) => {
+    state.logs = ringPush(state.logs, log, MAX_LOGS);
+  }),
+  setMetrics: (metrics) => set((state) => {
+    state.metrics = metrics;
+    state.lastUpdated = metrics.lastUpdated;
+  }),
+  handleConnectionSuccess: () => set((state) => {
+    state.lastSuccessfulFetch = Date.now();
+    state.retryCount = 0;
+    state.lastError = null;
+    state.lastErrorDetails = null;
+    state.reconnectDelay = 0;
+    state.disconnectedAt = null;
+    state.connectionStatus = "connected";
+  }),
+  handleConnectionFailure: (errorMessage) => set((state) => {
+    state.lastError = errorMessage;
+    state.disconnectedAt = state.disconnectedAt ?? Date.now();
+    if (state.connectionStatus === "connected" || state.connectionStatus === "polling") {
+      state.connectionStatus = "reconnecting";
+      state.retryCount = 1;
+      state.reconnectDelay = getBackoffDelay(1);
+    } else if (state.connectionStatus === "reconnecting") {
+      state.retryCount = state.retryCount + 1;
+      if (state.retryCount >= MAX_RETRIES2) {
+        state.connectionStatus = "offline";
+        state.lastError = `Connection lost after ${MAX_RETRIES2} retries`;
+        state.reconnectDelay = 0;
+      } else {
+        state.reconnectDelay = getBackoffDelay(state.retryCount);
+      }
+    }
+  }),
+  resetRetries: () => set((state) => {
+    state.retryCount = 0;
+    state.lastError = null;
+    state.lastErrorDetails = null;
+    state.reconnectDelay = 0;
+    state.disconnectedAt = null;
+  }),
+  forceRetry: () => set((state) => {
+    if (state.connectionStatus === "offline") {
+      state.connectionStatus = "polling";
+      state.retryCount = 0;
+      state.lastError = null;
+      state.lastErrorDetails = null;
+      state.reconnectDelay = 0;
+    }
+  }),
+  setLastErrorDetails: (details) => set((state) => {
+    state.lastErrorDetails = details;
+    state.lastError = details === null ? null : summarizeCliError(details);
+  }),
+  clearError: () => set((state) => {
+    state.lastError = null;
+    state.lastErrorDetails = null;
+  }),
+  addCliErrorAlert: (details) => set((state) => {
+    state.lastErrorDetails = details;
+    state.lastError = summarizeCliError(details);
+    const summary = summarizeCliError(details);
+    state.alerts = ringPush(state.alerts, {
+      id: crypto.randomUUID(),
+      type: "connection",
+      severity: "error",
+      message: `CLI failure: ${summary}`,
+      timestamp: Date.now(),
+      acknowledged: false
+    }, MAX_ALERTS);
+  })
+})));
+
+// src/stores/config-store.ts
+import { create as create3 } from "zustand";
+import { immer as immer3 } from "zustand/middleware/immer";
+import { persist, createJSONStorage } from "zustand/middleware";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, existsSync as existsSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join4 } from "path";
+var bunConfigStorage = {
+  getItem: async (_name) => {
+    try {
+      const file = Bun.file(join4(homedir3(), ".hoox", "config.json"));
+      const exists = await file.exists();
+      if (!exists)
+        return null;
+      return await file.text();
+    } catch {
+      return null;
+    }
+  },
+  setItem: async (_name, value) => {
+    const dir = join4(homedir3(), ".hoox");
+    if (!existsSync4(dir)) {
+      mkdirSync2(dir, { recursive: true, mode: HOOX_DIR_MODE });
+    }
+    try {
+      chmodSync2(dir, HOOX_DIR_MODE);
+    } catch {}
+    const filePath = join4(dir, "config.json");
+    await Bun.write(filePath, value);
+    try {
+      chmodSync2(filePath, HOOX_CONFIG_FILE_MODE);
+    } catch {}
+  },
+  removeItem: async (_name) => {}
+};
+var DEFAULT_SHORTCUTS = {
+  "command-palette": "Ctrl+P",
+  "toggle-sidebar": "Ctrl+B",
+  "force-refresh": "Ctrl+R",
+  quit: "Ctrl+Q",
+  "view-1": "Ctrl+1",
+  "view-2": "Ctrl+2",
+  "view-3": "Ctrl+3",
+  "view-4": "Ctrl+4",
+  "view-5": "Ctrl+5",
+  "view-6": "Ctrl+6",
+  "view-7": "Ctrl+7",
+  "view-8": "Ctrl+8",
+  "view-9": "Ctrl+9",
+  "view-10": "Ctrl+0"
+};
+var DEFAULT_LOG_FILTER = {
+  levels: ["info", "warn", "error"],
+  workers: [],
+  searchText: ""
+};
+var DEFAULT_NOTIFICATIONS = {
+  alerts: true,
+  trades: false,
+  debug: false,
+  system: true
+};
+var defaults = {
+  theme: "dark",
+  refreshIntervalMs: 500,
+  defaultView: "dashboard",
+  activeExchanges: [],
+  keyboardShortcuts: { ...DEFAULT_SHORTCUTS },
+  logFilters: { ...DEFAULT_LOG_FILTER },
+  notifications: { ...DEFAULT_NOTIFICATIONS },
+  soundEnabled: false
+};
+var useConfigStore = create3()(persist(immer3((set) => ({
+  ...defaults,
+  updateConfig: (partial) => set((state) => {
+    if (partial.theme !== undefined)
+      state.theme = partial.theme;
+    if (partial.refreshIntervalMs !== undefined)
+      state.refreshIntervalMs = partial.refreshIntervalMs;
+    if (partial.defaultView !== undefined)
+      state.defaultView = partial.defaultView;
+    if (partial.activeExchanges !== undefined)
+      state.activeExchanges = partial.activeExchanges;
+    if (partial.keyboardShortcuts !== undefined)
+      state.keyboardShortcuts = partial.keyboardShortcuts;
+    if (partial.logFilters !== undefined)
+      state.logFilters = partial.logFilters;
+    if (partial.notifications !== undefined)
+      state.notifications = partial.notifications;
+    if (partial.soundEnabled !== undefined)
+      state.soundEnabled = partial.soundEnabled;
+  }),
+  resetDefaults: () => set((state) => {
+    Object.assign(state, defaults);
+  }),
+  setShortcut: (action, key) => set((state) => {
+    state.keyboardShortcuts[action] = key;
+  }),
+  toggleNotification: (channel) => set((state) => {
+    state.notifications[channel] = !state.notifications[channel];
+  })
+})), {
+  name: "hoox-config",
+  storage: createJSONStorage(() => bunConfigStorage),
+  partialize: (state) => ({
+    theme: state.theme,
+    refreshIntervalMs: state.refreshIntervalMs,
+    defaultView: state.defaultView,
+    activeExchanges: state.activeExchanges,
+    keyboardShortcuts: state.keyboardShortcuts,
+    logFilters: state.logFilters,
+    notifications: state.notifications,
+    soundEnabled: state.soundEnabled
+  }),
+  merge: (persisted, current) => ({
+    ...current,
+    ...persisted
+  })
+}));
+
+// src/index.ts
+init_api_client();
+init_sse();
+init_operator_transport();
+export {
+  writeSecureFileSync,
+  writeConfigSync,
+  writeConfig,
+  validateWranglerJsonc,
+  validateRootSecrets,
+  validateDevVars,
+  validateConfig,
+  validateAll,
+  useUIStore,
+  useServiceStore,
+  useConfigStore,
+  trackAnalytics,
+  toError,
+  subscribeSSE,
+  stripJsonc,
+  setAgentConfigEmbeddedValue,
+  serviceFetch,
+  serializeState,
+  serializeAgentConfigForKv,
+  saveSession,
+  restoreSession,
+  resolveOperatorTransportProfile,
+  resolveInternalAuthKey,
+  resolveHooxRuntimeRoot,
+  resolveHooxPath,
+  resolveDependencies,
+  readConfigSync,
+  readConfig,
+  parseDashboardManifest,
+  parseAgentConfigJson,
+  operatorUrl,
+  logKvTimestamp,
+  loadDashboardManifestsFromRoot,
+  loadDashboardKvManifestFromRoot,
+  kvManifestFromDashboardManifests,
+  isWithinHooxHome,
+  isUnixModeGroupOrWorldAccessible,
+  isHooxSetupRoot,
+  isDashboardSectionFlatKv,
+  isDashboardSectionEditable,
+  isConfigWorldOrGroupReadable,
+  isAgentConfigSection,
+  isAgentConfigEmbeddedField,
+  hooxFetch,
+  healthCheck,
+  headersToObject,
+  hasOperatorClientCredentials,
+  getTuiEntryCandidates,
+  getRelativeHooxPath,
+  getHooxWranglerPath,
+  getHooxStatePath,
+  getHooxRepoPath,
+  getHooxHome,
+  getHooxDataDir,
+  getHooxConfigDir,
+  getAgentConfigEmbeddedValue,
+  generateWranglerJsonc,
+  generateDevVars,
+  formatUptime,
+  formatTimestamp,
+  formatRequests,
+  formatRelativeTime as formatRelativeTimeFromTime,
+  formatRelativeTime2 as formatRelativeTime,
+  formatPercent,
+  formatNumber,
+  formatMemory,
+  formatLatency,
+  formatDurationCompact,
+  formatDuration2 as formatDuration,
+  formatCurrency,
+  formatCpu,
+  formatConfigPermissionWarning,
+  formatCompactCurrency,
+  findHooxSetupRoot,
+  expandAgentConfigToFieldMap,
+  ensureHooxDirSecure,
+  deserializeState,
+  dashboardWorkerDir,
+  createSuccessResponse,
+  createQueueHandler,
+  createMockVectorizeIndex,
+  createMockSecretsStore,
+  createMockR2,
+  createMockQueue,
+  createMockKV,
+  createMockFetcher,
+  createMockExecutionContext,
+  createMockEnv,
+  createMockD1,
+  createMockAnalyticsEngineDataset,
+  createMockAnalyticsEngine,
+  createMockAi,
+  createJsonResponse,
+  createErrorResponse,
+  createCronHandler,
+  buildOperatorAuthHeaders,
+  buildDashboardKvKey,
+  authenticatedServiceFetch,
+  applyAgentConfigFieldUpdates,
+  WorkerStatusColor,
+  WorkerAPIError,
+  WizardEngine,
+  WebhookPayloadSchema,
+  WORKER_NAMES,
+  WORKER_MANIFESTS,
+  WORKER_DEPENDENCIES,
+  WIZARD_STATE_PATH,
+  WALLET_EXECUTE_AUTH_KEY_FIELDS,
+  TradeSignalSchema,
+  TradeQueueMessageSchema,
+  TradeActionSchema,
+  TRADE_READ_AUTH_KEY_FIELDS,
+  TRADE_EXECUTE_AUTH_KEY_FIELDS,
+  TRADEMARK_NOTICE,
+  TRADEMARKS,
+  TELEGRAM_ALERT_AUTH_KEY_FIELDS,
+  ServiceAuthError,
+  PositionSchema,
+  PRESETS,
+  LogLevelColor,
+  KVKeys,
+  InternalAuthKeyFields,
+  INTEGRATIONS,
+  HOOX_DIR_MODE,
+  HOOX_CONFIG_FILE_MODE,
+  FULL_LEGAL_NOTICE,
+  ExchangeRouter,
+  Errors,
+  DISCLAIMER_HEADER,
+  DISCLAIMER,
+  DASHBOARD_WORKER_PREFIX,
+  DASHBOARD_WORKER_IDS,
+  DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS,
+  DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS,
+  DASHBOARD_SECTION_PREFIX,
+  DASHBOARD_SECTIONS_UI_SKIP,
+  DASHBOARD_SECTIONS_NOT_FLAT_KV,
+  DASHBOARD_SECTIONS_AGENT_CONFIG,
+  DASHBOARD_FIELD_KV_OVERRIDES,
+  DASHBOARD_D1_READ_AUTH_KEY_FIELDS,
+  D1_WRITE_AUTH_KEY_FIELDS,
+  D1_READ_AUTH_KEY_FIELDS,
+  D1Repository,
+  CoolBracketPalette,
+  ConnectionStatusColor,
+  Colors,
+  COPYRIGHT,
+  CALLED_BY,
+  BaseExchangeClient2 as BaseExchangeClient,
+  BalanceSchema,
+  AlertSeverityColor,
+  AGENT_CONFIG_KV_KEY,
+  AGENT_CONFIG_EMBEDDED_FIELDS
+};