@hoox-sh/hoox-shared 1.3.0 → 1.4.0

package/dist/queue-handler.js

@@ -16,29 +16,60 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // src/queue-handler.ts
+async function mapPool(items, concurrency, fn) {
+  if (items.length === 0)
+    return;
+  const limit = Math.min(Math.max(1, concurrency), items.length);
+  if (limit === 1) {
+    for (const item of items) {
+      await fn(item);
+    }
+    return;
+  }
+  let nextIndex = 0;
+  async function worker() {
+    while (true) {
+      const i = nextIndex++;
+      if (i >= items.length)
+        return;
+      await fn(items[i]);
+    }
+  }
+  await Promise.all(Array.from({ length: limit }, () => worker()));
+}
 function createQueueHandler(options) {
-  const { maxRetries, backoffDelays, onMessage, onRetry, onDLQ, logger } = options;
-  return async (batch) => {
-    for (const msg of batch.messages) {
-      const attemptNumber = msg.attempts || 0;
-      const logId = `[${msg.id}]`;
-      try {
-        logger?.info(`${logId} Processing message (attempt ${attemptNumber + 1})`);
-        await onMessage(msg.body, attemptNumber);
-        logger?.info(`${logId} Message processed successfully`);
-      } catch (error) {
-        const errorMsg = error instanceof Error ? error.message : String(error);
-        if (attemptNumber < maxRetries) {
-          const delaySeconds = backoffDelays[attemptNumber] ?? backoffDelays[backoffDelays.length - 1];
-          logger?.info(`${logId} Retrying in ${delaySeconds}s (attempt ${attemptNumber + 2}/${maxRetries + 1})`);
-          await onRetry?.(msg.body, attemptNumber, errorMsg, delaySeconds);
-          msg.retry({ delaySeconds });
-        } else {
-          logger?.error(`${logId} Max retries exceeded (${maxRetries + 1} attempts), moving to DLQ`);
-          await onDLQ?.(msg.body, attemptNumber, errorMsg);
-        }
+  const {
+    maxRetries,
+    backoffDelays,
+    onMessage,
+    onRetry,
+    onDLQ,
+    logger,
+    concurrency: concurrencyOpt
+  } = options;
+  const concurrency = typeof concurrencyOpt === "number" && Number.isFinite(concurrencyOpt) && concurrencyOpt >= 1 ? Math.floor(concurrencyOpt) : 1;
+  async function processMessage(msg) {
+    const attemptNumber = msg.attempts || 0;
+    const logId = `[${msg.id}]`;
+    try {
+      logger?.info(`${logId} Processing message (attempt ${attemptNumber + 1})`);
+      await onMessage(msg.body, attemptNumber);
+      logger?.info(`${logId} Message processed successfully`);
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      if (attemptNumber < maxRetries) {
+        const delaySeconds = backoffDelays[attemptNumber] ?? backoffDelays[backoffDelays.length - 1] ?? 0;
+        logger?.info(`${logId} Retrying in ${delaySeconds}s (attempt ${attemptNumber + 2}/${maxRetries + 1})`);
+        await onRetry?.(msg.body, attemptNumber, errorMsg, delaySeconds);
+        msg.retry({ delaySeconds });
+      } else {
+        logger?.error(`${logId} Max retries exceeded (${maxRetries + 1} attempts), moving to DLQ`);
+        await onDLQ?.(msg.body, attemptNumber, errorMsg);
       }
     }
+  }
+  return async (batch) => {
+    await mapPool(batch.messages, concurrency, processMessage);
   };
 }
 export {

package/dist/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;GAMG;AAEH,OAAO,KAAK,EAKV,MAAM,EACP,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE9E,wBAAgB,YAAY,CAAC,IAAI,GAAG,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,CAsM3D"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;GAMG;AAEH,OAAO,KAAK,EAKV,MAAM,EACP,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE9E,wBAAgB,YAAY,CAAC,IAAI,GAAG,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,CA6M3D"}

package/dist/router.js

@@ -23,7 +23,9 @@ function createRouter() {
     const regex = /:([a-zA-Z_][a-zA-Z0-9_]*)/g;
     let match;
     while ((match = regex.exec(pattern)) !== null) {
-      params.push(match[1]);
+      const name = match[1];
+      if (name !== undefined)
+        params.push(name);
     }
     return params;
   }
@@ -38,7 +40,11 @@ function createRouter() {
       return null;
     const params = {};
     for (let i = 0;i < paramNames.length; i++) {
-      params[paramNames[i]] = m[i + 1];
+      const key = paramNames[i];
+      const value = m[i + 1];
+      if (key !== undefined && value !== undefined) {
+        params[key] = value;
+      }
     }
     return params;
   }
@@ -57,6 +63,8 @@ function createRouter() {
       return { route: exact };
     for (let i = routes.length - 1;i >= 0; i--) {
       const route = routes[i];
+      if (!route)
+        continue;
       if (route.params && route.params.length > 0 && route.regex) {
         const matched = matchPattern(path, route.regex, route.params);
         if (matched && route.method === method) {
@@ -88,6 +96,8 @@ function createRouter() {
         let pathExists = false;
         for (let i = routes.length - 1;i >= 0; i--) {
           const r = routes[i];
+          if (!r)
+            continue;
           if (r.path === path) {
             pathExists = true;
             break;

package/dist/schemas/index.d.ts

@@ -3,6 +3,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 export type { WorkerManifest, VarDef, ServiceBindingDef, InfraBindings, KVBindingDef, D1BindingDef, R2BindingDef, QueueBindingDef, VectorizeBindingDef, DOBindingDef, ValidationError, ValidationReport, } from "./types.js";
-export { WORKER_MANIFESTS, WORKER_NAMES, CALLED_BY } from "./registry.js";
+export { WORKER_MANIFESTS, WORKER_NAMES, WORKER_CATALOG, CALLED_BY, getWorkerDefaultEnabled, } from "./registry.js";
+export type { WorkerCatalogEntry } from "./registry.js";
 export { validateWranglerJsonc, validateRootSecrets, validateDevVars, validateAll, generateWranglerJsonc, generateDevVars, } from "./validators.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/schemas/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,YAAY,EACV,cAAc,EACd,MAAM,EACN,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,YAAY,EACZ,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1E,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,eAAe,GAChB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,YAAY,EACV,cAAc,EACd,MAAM,EACN,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,YAAY,EACZ,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,SAAS,EACT,uBAAuB,GACxB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,qBAAqB,EACrB,eAAe,GAChB,MAAM,iBAAiB,CAAC"}

package/dist/schemas/index.js

@@ -22,9 +22,12 @@ function deriveCalledBy(manifests) {
     if (!calledBy[workerName])
       calledBy[workerName] = new Set;
     for (const svc of manifest.services) {
-      if (!calledBy[svc.service])
-        calledBy[svc.service] = new Set;
-      calledBy[svc.service].add(workerName);
+      let callers = calledBy[svc.service];
+      if (!callers) {
+        callers = new Set;
+        calledBy[svc.service] = callers;
+      }
+      callers.add(workerName);
     }
   }
   const result = {};
@@ -37,6 +40,7 @@ var manifests = {
   hoox: {
     name: "hoox",
     path: "workers/hoox-worker",
+    defaultEnabled: true,
     vars: {
       WEBHOOK_API_KEY_BINDING: {
         type: "secret",
@@ -46,7 +50,11 @@ var manifests = {
         type: "secret",
         description: "Inter-worker auth key"
       },
-      HA_TOKEN_BINDING: { type: "secret", description: "Home Assistant token" }
+      HA_TOKEN_BINDING: { type: "secret", description: "Home Assistant token" },
+      TELEGRAM_ALLOWED_CHAT_IDS: {
+        type: "secret",
+        description: "Comma-separated chat IDs for webhook notify (fail-closed when unset); alias AUTHORIZED_CHAT_IDS"
+      }
     },
     services: [
       {
@@ -72,7 +80,8 @@ var manifests = {
       ai: true,
       queues: { producer: ["trade-execution"] },
       durableObjects: [
-        { name: "IDEMPOTENCY_STORE", className: "IdempotencyStore" }
+        { name: "IDEMPOTENCY_STORE", className: "IdempotencyStore" },
+        { name: "RATE_LIMITER", className: "RateLimiterStore" }
       ]
     },
     middleware: [
@@ -87,6 +96,7 @@ var manifests = {
   "trade-worker": {
     name: "trade-worker",
     path: "workers/trade-worker",
+    defaultEnabled: true,
     vars: {
       INTERNAL_KEY_BINDING: {
         type: "secret",
@@ -96,15 +106,22 @@ var manifests = {
         type: "secret",
         description: "Telegram outbound auth"
       },
-      BINANCE_KEY_BINDING: { type: "secret", description: "Binance API key" },
-      BINANCE_SECRET_BINDING: {
+      EXCHANGE_KEY_BINDING: {
+        type: "secret",
+        description: "Unified exchange API key (Binance / Bybit / MEXC)"
+      },
+      EXCHANGE_SECRET_BINDING: {
+        type: "secret",
+        description: "Unified exchange API secret"
+      },
+      EXCHANGE_TESTNET_KEY_BINDING: {
         type: "secret",
-        description: "Binance API secret"
+        description: "Optional unified testnet API key"
       },
-      MEXC_KEY_BINDING: { type: "secret", description: "MEXC API key" },
-      MEXC_SECRET_BINDING: { type: "secret", description: "MEXC API secret" },
-      BYBIT_KEY_BINDING: { type: "secret", description: "Bybit API key" },
-      BYBIT_SECRET_BINDING: { type: "secret", description: "Bybit API secret" }
+      EXCHANGE_TESTNET_SECRET_BINDING: {
+        type: "secret",
+        description: "Optional unified testnet API secret"
+      }
     },
     services: [
       {
@@ -146,6 +163,7 @@ var manifests = {
   "telegram-worker": {
     name: "telegram-worker",
     path: "workers/telegram-worker",
+    defaultEnabled: true,
     vars: {
       INTERNAL_KEY_BINDING: {
         type: "secret",
@@ -159,6 +177,10 @@ var manifests = {
       TELEGRAM_SECRET_TOKEN: {
         type: "secret",
         description: "Webhook verification token"
+      },
+      AUTHORIZED_CHAT_IDS: {
+        type: "secret",
+        description: "Comma-separated chat IDs; inbound webhook fail-closed when unset; outbound /alert allowlist"
       }
     },
     services: [],
@@ -179,6 +201,7 @@ var manifests = {
   "d1-worker": {
     name: "d1-worker",
     path: "workers/d1-worker",
+    defaultEnabled: true,
     vars: {
       INTERNAL_KEY_BINDING: {
         type: "secret",
@@ -201,6 +224,7 @@ var manifests = {
   "web3-wallet-worker": {
     name: "web3-wallet-worker",
     path: "workers/web3-wallet-worker",
+    defaultEnabled: false,
     vars: {
       WALLET_PK_SECRET: { type: "secret", description: "Wallet private key" },
       WALLET_MNEMONIC_SECRET: {
@@ -221,6 +245,7 @@ var manifests = {
   "agent-worker": {
     name: "agent-worker",
     path: "workers/agent-worker",
+    defaultEnabled: true,
     vars: {
       AGENT_INTERNAL_KEY: { type: "secret", description: "Agent worker auth" },
       INTERNAL_KEY_BINDING: {
@@ -257,6 +282,7 @@ var manifests = {
   "email-worker": {
     name: "email-worker",
     path: "workers/email-worker",
+    defaultEnabled: false,
     vars: {
       INTERNAL_KEY_BINDING: {
         type: "secret",
@@ -294,6 +320,7 @@ var manifests = {
   "analytics-worker": {
     name: "analytics-worker",
     path: "workers/analytics-worker",
+    defaultEnabled: true,
     vars: {
       CLOUDFLARE_API_TOKEN: {
         type: "secret",
@@ -313,6 +340,7 @@ var manifests = {
   "report-worker": {
     name: "report-worker",
     path: "workers/report-worker",
+    defaultEnabled: false,
     vars: {
       CF_API_TOKEN_BINDING: {
         type: "secret",
@@ -347,6 +375,7 @@ var manifests = {
   "pyne-worker": {
     name: "pyne-worker",
     path: "workers/pyne-worker",
+    defaultEnabled: true,
     vars: {
       API_KEY: {
         type: "secret",
@@ -384,6 +413,7 @@ var manifests = {
   dashboard: {
     name: "dashboard",
     path: "workers/dashboard",
+    defaultEnabled: true,
     vars: {
       DASHBOARD_USER: {
         type: "secret",
@@ -426,6 +456,17 @@ var manifests = {
 var CALLED_BY = deriveCalledBy(manifests);
 var WORKER_MANIFESTS = manifests;
 var WORKER_NAMES = Object.keys(manifests).sort();
+var WORKER_CATALOG = WORKER_NAMES.map((name) => {
+  const m = manifests[name];
+  return {
+    name: m.name,
+    path: m.path,
+    defaultEnabled: m.defaultEnabled
+  };
+});
+function getWorkerDefaultEnabled(name) {
+  return manifests[name]?.defaultEnabled;
+}
 
 // src/schemas/validators.ts
 import { parse } from "jsonc-parser";
@@ -465,7 +506,7 @@ function validateWranglerJsonc(workerName, manifest, jsoncContent) {
     }
   }
   for (const [name, def] of Object.entries(manifest.vars)) {
-    if (def.type === "secret" && !name.endsWith("_BINDING") && !name.endsWith("_SECRET") && !name.startsWith("CLOUDFLARE_") && name !== "TELEGRAM_SECRET_TOKEN" && name !== "MAILGUN_API_KEY" && name !== "EMAIL_SCAN_SUBJECT" && name !== "DASHBOARD_USER" && name !== "DASHBOARD_PASS" && name !== "SESSION_SECRET" && name !== "AGENT_INTERNAL_KEY") {
+    if (def.type === "secret" && !name.endsWith("_BINDING") && !name.endsWith("_SECRET") && !name.startsWith("CLOUDFLARE_") && name !== "TELEGRAM_SECRET_TOKEN" && name !== "TELEGRAM_ALLOWED_CHAT_IDS" && name !== "AUTHORIZED_CHAT_IDS" && name !== "MAILGUN_API_KEY" && name !== "EMAIL_SCAN_SUBJECT" && name !== "DASHBOARD_USER" && name !== "DASHBOARD_PASS" && name !== "SESSION_SECRET" && name !== "AGENT_INTERNAL_KEY") {
       errors.push({
         worker: workerName,
         severity: "warning",
@@ -582,6 +623,8 @@ function generateWranglerJsonc(manifest) {
     parts.push(`  "vars": {`);
     for (const [i, name] of varKeys.entries()) {
       const def = manifest.vars[name];
+      if (!def)
+        continue;
       const comma = i < varKeys.length - 1 ? "," : "";
       const val = def.type === "secret" ? "__SECRET__" : JSON.stringify(def.default ?? "");
       parts.push(`    "${name}": ${val}${comma}`);
@@ -697,9 +740,11 @@ export {
   validateRootSecrets,
   validateDevVars,
   validateAll,
+  getWorkerDefaultEnabled,
   generateWranglerJsonc,
   generateDevVars,
   WORKER_NAMES,
   WORKER_MANIFESTS,
+  WORKER_CATALOG,
   CALLED_BY
 };

package/dist/schemas/registry.d.ts

@@ -9,4 +9,17 @@ export declare const CALLED_BY: Record<string, string[]>;
 export declare const WORKER_MANIFESTS: Record<string, WorkerManifest>;
 /** List of all worker names in the registry. */
 export declare const WORKER_NAMES: string[];
+/**
+ * Catalog entry for CLI worker enable/disable — one row per known worker.
+ * `defaultEnabled` is the seed value when the worker is first added to config.
+ */
+export interface WorkerCatalogEntry {
+    name: string;
+    path: string;
+    defaultEnabled: boolean;
+}
+/** Full catalog of known workers with default enable flags (sorted by name). */
+export declare const WORKER_CATALOG: WorkerCatalogEntry[];
+/** Lookup defaultEnabled for a known worker; undefined if not in catalog. */
+export declare function getWorkerDefaultEnabled(name: string): boolean | undefined;
 //# sourceMappingURL=registry.d.ts.map

package/dist/schemas/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/schemas/registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA2ajD,qEAAqE;AACrE,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAA6B,CAAC;AAE7E,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAa,CAAC;AAE1E,gDAAgD;AAChD,eAAO,MAAM,YAAY,EAAE,MAAM,EAAkC,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/schemas/registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA4cjD,qEAAqE;AACrE,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAA6B,CAAC;AAE7E,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAa,CAAC;AAE1E,gDAAgD;AAChD,eAAO,MAAM,YAAY,EAAE,MAAM,EAAkC,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,gFAAgF;AAChF,eAAO,MAAM,cAAc,EAAE,kBAAkB,EAO7C,CAAC;AAEH,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAEzE"}

package/dist/schemas/registry.js

@@ -22,9 +22,12 @@ function deriveCalledBy(manifests) {
     if (!calledBy[workerName])
       calledBy[workerName] = new Set;
     for (const svc of manifest.services) {
-      if (!calledBy[svc.service])
-        calledBy[svc.service] = new Set;
-      calledBy[svc.service].add(workerName);
+      let callers = calledBy[svc.service];
+      if (!callers) {
+        callers = new Set;
+        calledBy[svc.service] = callers;
+      }
+      callers.add(workerName);
     }
   }
   const result = {};
@@ -37,6 +40,7 @@ var manifests = {
   hoox: {
     name: "hoox",
     path: "workers/hoox-worker",
+    defaultEnabled: true,
     vars: {
       WEBHOOK_API_KEY_BINDING: {
         type: "secret",
@@ -46,7 +50,11 @@ var manifests = {
         type: "secret",
         description: "Inter-worker auth key"
       },
-      HA_TOKEN_BINDING: { type: "secret", description: "Home Assistant token" }
+      HA_TOKEN_BINDING: { type: "secret", description: "Home Assistant token" },
+      TELEGRAM_ALLOWED_CHAT_IDS: {
+        type: "secret",
+        description: "Comma-separated chat IDs for webhook notify (fail-closed when unset); alias AUTHORIZED_CHAT_IDS"
+      }
     },
     services: [
       {
@@ -72,7 +80,8 @@ var manifests = {
       ai: true,
       queues: { producer: ["trade-execution"] },
       durableObjects: [
-        { name: "IDEMPOTENCY_STORE", className: "IdempotencyStore" }
+        { name: "IDEMPOTENCY_STORE", className: "IdempotencyStore" },
+        { name: "RATE_LIMITER", className: "RateLimiterStore" }
       ]
     },
     middleware: [
@@ -87,6 +96,7 @@ var manifests = {
   "trade-worker": {
     name: "trade-worker",
     path: "workers/trade-worker",
+    defaultEnabled: true,
     vars: {
       INTERNAL_KEY_BINDING: {
         type: "secret",
@@ -96,15 +106,22 @@ var manifests = {
         type: "secret",
         description: "Telegram outbound auth"
       },
-      BINANCE_KEY_BINDING: { type: "secret", description: "Binance API key" },
-      BINANCE_SECRET_BINDING: {
+      EXCHANGE_KEY_BINDING: {
+        type: "secret",
+        description: "Unified exchange API key (Binance / Bybit / MEXC)"
+      },
+      EXCHANGE_SECRET_BINDING: {
+        type: "secret",
+        description: "Unified exchange API secret"
+      },
+      EXCHANGE_TESTNET_KEY_BINDING: {
         type: "secret",
-        description: "Binance API secret"
+        description: "Optional unified testnet API key"
       },
-      MEXC_KEY_BINDING: { type: "secret", description: "MEXC API key" },
-      MEXC_SECRET_BINDING: { type: "secret", description: "MEXC API secret" },
-      BYBIT_KEY_BINDING: { type: "secret", description: "Bybit API key" },
-      BYBIT_SECRET_BINDING: { type: "secret", description: "Bybit API secret" }
+      EXCHANGE_TESTNET_SECRET_BINDING: {
+        type: "secret",
+        description: "Optional unified testnet API secret"
+      }
     },
     services: [
       {
@@ -146,6 +163,7 @@ var manifests = {
   "telegram-worker": {
     name: "telegram-worker",
     path: "workers/telegram-worker",
+    defaultEnabled: true,
     vars: {
       INTERNAL_KEY_BINDING: {
         type: "secret",
@@ -159,6 +177,10 @@ var manifests = {
       TELEGRAM_SECRET_TOKEN: {
         type: "secret",
         description: "Webhook verification token"
+      },
+      AUTHORIZED_CHAT_IDS: {
+        type: "secret",
+        description: "Comma-separated chat IDs; inbound webhook fail-closed when unset; outbound /alert allowlist"
       }
     },
     services: [],
@@ -179,6 +201,7 @@ var manifests = {
   "d1-worker": {
     name: "d1-worker",
     path: "workers/d1-worker",
+    defaultEnabled: true,
     vars: {
       INTERNAL_KEY_BINDING: {
         type: "secret",
@@ -201,6 +224,7 @@ var manifests = {
   "web3-wallet-worker": {
     name: "web3-wallet-worker",
     path: "workers/web3-wallet-worker",
+    defaultEnabled: false,
     vars: {
       WALLET_PK_SECRET: { type: "secret", description: "Wallet private key" },
       WALLET_MNEMONIC_SECRET: {
@@ -221,6 +245,7 @@ var manifests = {
   "agent-worker": {
     name: "agent-worker",
     path: "workers/agent-worker",
+    defaultEnabled: true,
     vars: {
       AGENT_INTERNAL_KEY: { type: "secret", description: "Agent worker auth" },
       INTERNAL_KEY_BINDING: {
@@ -257,6 +282,7 @@ var manifests = {
   "email-worker": {
     name: "email-worker",
     path: "workers/email-worker",
+    defaultEnabled: false,
     vars: {
       INTERNAL_KEY_BINDING: {
         type: "secret",
@@ -294,6 +320,7 @@ var manifests = {
   "analytics-worker": {
     name: "analytics-worker",
     path: "workers/analytics-worker",
+    defaultEnabled: true,
     vars: {
       CLOUDFLARE_API_TOKEN: {
         type: "secret",
@@ -313,6 +340,7 @@ var manifests = {
   "report-worker": {
     name: "report-worker",
     path: "workers/report-worker",
+    defaultEnabled: false,
     vars: {
       CF_API_TOKEN_BINDING: {
         type: "secret",
@@ -347,6 +375,7 @@ var manifests = {
   "pyne-worker": {
     name: "pyne-worker",
     path: "workers/pyne-worker",
+    defaultEnabled: true,
     vars: {
       API_KEY: {
         type: "secret",
@@ -384,6 +413,7 @@ var manifests = {
   dashboard: {
     name: "dashboard",
     path: "workers/dashboard",
+    defaultEnabled: true,
     vars: {
       DASHBOARD_USER: {
         type: "secret",
@@ -426,8 +456,21 @@ var manifests = {
 var CALLED_BY = deriveCalledBy(manifests);
 var WORKER_MANIFESTS = manifests;
 var WORKER_NAMES = Object.keys(manifests).sort();
+var WORKER_CATALOG = WORKER_NAMES.map((name) => {
+  const m = manifests[name];
+  return {
+    name: m.name,
+    path: m.path,
+    defaultEnabled: m.defaultEnabled
+  };
+});
+function getWorkerDefaultEnabled(name) {
+  return manifests[name]?.defaultEnabled;
+}
 export {
+  getWorkerDefaultEnabled,
   WORKER_NAMES,
   WORKER_MANIFESTS,
+  WORKER_CATALOG,
   CALLED_BY
 };

package/dist/schemas/types.d.ts

@@ -10,6 +10,11 @@ export interface WorkerManifest {
     name: string;
     /** Path relative to project root (e.g. "workers/trade-worker") */
     path: string;
+    /**
+     * Default for `workers.<name>.enabled` in the root wrangler.jsonc catalog.
+     * Used by `hoox workers enable|disable` and when seeding missing workers.
+     */
+    defaultEnabled: boolean;
     /** Vars the worker declares in its wrangler.jsonc `vars` section */
     vars: Record<string, VarDef>;
     /** Service bindings this worker calls */

package/dist/schemas/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/schemas/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AAEH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,yCAAyC;IACzC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,gDAAgD;IAChD,cAAc,EAAE,aAAa,CAAC;IAC9B,+DAA+D;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAClC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/schemas/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AAEH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,yCAAyC;IACzC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,gDAAgD;IAChD,cAAc,EAAE,aAAa,CAAC;IAC9B,+DAA+D;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAClC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B"}

package/dist/schemas/validators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../src/schemas/validators.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAalE;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,MAAM,GACnB,eAAe,EAAE,CA4GnB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,gBAAgB,EAAE,MAAM,GACvB,eAAe,EAAE,CA2CnB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,cAAc,EAAE,MAAM,GACrB,eAAe,EAAE,CA6BnB;AAID;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAmItE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAYhE;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE;IACL,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,GACA;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CAWhE"}
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../src/schemas/validators.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAalE;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,MAAM,GACnB,eAAe,EAAE,CA8GnB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,gBAAgB,EAAE,MAAM,GACvB,eAAe,EAAE,CA2CnB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,cAAc,EAAE,MAAM,GACrB,eAAe,EAAE,CA6BnB;AAID;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAoItE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAYhE;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE;IACL,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,GACA;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,CAWhE"}

package/dist/schemas/validators.js

@@ -53,7 +53,7 @@ function validateWranglerJsonc(workerName, manifest, jsoncContent) {
     }
   }
   for (const [name, def] of Object.entries(manifest.vars)) {
-    if (def.type === "secret" && !name.endsWith("_BINDING") && !name.endsWith("_SECRET") && !name.startsWith("CLOUDFLARE_") && name !== "TELEGRAM_SECRET_TOKEN" && name !== "MAILGUN_API_KEY" && name !== "EMAIL_SCAN_SUBJECT" && name !== "DASHBOARD_USER" && name !== "DASHBOARD_PASS" && name !== "SESSION_SECRET" && name !== "AGENT_INTERNAL_KEY") {
+    if (def.type === "secret" && !name.endsWith("_BINDING") && !name.endsWith("_SECRET") && !name.startsWith("CLOUDFLARE_") && name !== "TELEGRAM_SECRET_TOKEN" && name !== "TELEGRAM_ALLOWED_CHAT_IDS" && name !== "AUTHORIZED_CHAT_IDS" && name !== "MAILGUN_API_KEY" && name !== "EMAIL_SCAN_SUBJECT" && name !== "DASHBOARD_USER" && name !== "DASHBOARD_PASS" && name !== "SESSION_SECRET" && name !== "AGENT_INTERNAL_KEY") {
       errors.push({
         worker: workerName,
         severity: "warning",
@@ -170,6 +170,8 @@ function generateWranglerJsonc(manifest) {
     parts.push(`  "vars": {`);
     for (const [i, name] of varKeys.entries()) {
       const def = manifest.vars[name];
+      if (!def)
+        continue;
       const comma = i < varKeys.length - 1 ? "," : "";
       const val = def.type === "secret" ? "__SECRET__" : JSON.stringify(def.default ?? "");
       parts.push(`    "${name}": ${val}${comma}`);

package/dist/service-bindings.js

@@ -23,12 +23,24 @@ function timingSafeEqual(a, b) {
   const len = Math.max(aBuf.length, bBuf.length);
   let result = aBuf.length === bBuf.length ? 0 : 1;
   for (let i = 0;i < len; i++) {
-    const av = i < aBuf.length ? aBuf[i] : 0;
-    const bv = i < bBuf.length ? bBuf[i] : 0;
+    const av = aBuf[i] ?? 0;
+    const bv = bBuf[i] ?? 0;
     result |= av ^ bv;
   }
   return result === 0;
 }
+async function timingSafeEqualAsync(a, b) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle || typeof subtle.digest !== "function" || typeof subtle.timingSafeEqual !== "function") {
+    return timingSafeEqual(a, b);
+  }
+  const encoder = new TextEncoder;
+  const [providedHash, expectedHash] = await Promise.all([
+    subtle.digest("SHA-256", encoder.encode(a)),
+    subtle.digest("SHA-256", encoder.encode(b))
+  ]);
+  return subtle.timingSafeEqual(providedHash, expectedHash);
+}
 function resolveOperatorApiKey(env) {
   const preferred = env.OPERATOR_API_KEY;
   if (typeof preferred === "string" && preferred.length > 0) {
@@ -53,7 +65,7 @@ async function requireOperatorAuth(request, env) {
   }
   const authHeader = request.headers.get("Authorization");
   const expectedHeader = `Bearer ${apiKey}`;
-  if (!authHeader || !timingSafeEqual(authHeader, expectedHeader)) {
+  if (!authHeader || !await timingSafeEqualAsync(authHeader, expectedHeader)) {
     return new Response(JSON.stringify({ error: "Unauthorized" }), {
       status: 401,
       headers: { "Content-Type": "application/json" }
@@ -86,12 +98,13 @@ function collectInternalAuthKeys(env, keyNames) {
   return keys;
 }
 function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
+  let matched = false;
   for (const expected of expectedKeys) {
     if (timingSafeEqual(providedKey, expected)) {
-      return true;
+      matched = true;
     }
   }
-  return false;
+  return matched;
 }
 function internalAuthNotConfiguredResponse(keyNames) {
   const label = normalizeKeyNames(keyNames).join(" | ");