@hoox-sh/hoox-shared 1.4.0 → 1.5.0

package/dist/index.js

@@ -1,19 +1,15 @@
 // @bun
-var __defProp = Object.defineProperty;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
 };
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // src/operator-transport.ts
 function stripTrailingSlashes(url) {
@@ -27,7 +23,7 @@ function parseTransport(raw) {
   if (!raw)
     return null;
   const v = raw.trim().toLowerCase();
-  if (VALID_TRANSPORTS.has(v)) {
+  if (VALID_TRANSPORTS2.has(v)) {
     return v;
   }
   return null;
@@ -72,9 +68,9 @@ function operatorUrl(profile, path) {
   const p = path.startsWith("/") ? path : `/${path}`;
   return `${base}${p}`;
 }
-var DEFAULT_API_BASE = "http://localhost:8787", VALID_TRANSPORTS;
+var DEFAULT_API_BASE = "http://localhost:8787", VALID_TRANSPORTS2;
 var init_operator_transport = __esm(() => {
-  VALID_TRANSPORTS = new Set([
+  VALID_TRANSPORTS2 = new Set([
     "public",
     "access",
     "mtls",
@@ -83,11 +79,6 @@ var init_operator_transport = __esm(() => {
 });
 
 // src/api-client.ts
-var exports_api_client = {};
-__export(exports_api_client, {
-  hooxFetch: () => hooxFetch,
-  WorkerAPIError: () => WorkerAPIError
-});
 function isRetryableStatus(status) {
   if (status === 401 || status === 403 || status === 429)
     return false;
@@ -189,10 +180,6 @@ var init_api_client = __esm(() => {
 });
 
 // src/sse.ts
-var exports_sse = {};
-__export(exports_sse, {
-  subscribeSSE: () => subscribeSSE
-});
 function subscribeSSE(path, callback, onStatus, options) {
   let aborted = false;
   const profile = options?.transport ?? (options?.transportEnv ? resolveOperatorTransportProfile(options.transportEnv) : resolveOperatorTransportProfile());
@@ -258,6 +245,84 @@ var init_sse = __esm(() => {
   init_operator_transport();
 });
 
+// src/legal.ts
+var COPYRIGHT = `Copyright (C) ${new Date().getFullYear()} Hoox Team. All rights reserved.`;
+var TRADEMARKS = [
+  "TradingView\xAE is a registered trademark of TradingView, Inc.",
+  "Cloudflare\xAE is a registered trademark of Cloudflare, Inc."
+];
+var TRADEMARK_NOTICE = TRADEMARKS.join(`
+`);
+var DISCLAIMER = "DISCLAIMER: This software is provided for educational and informational purposes only. " + "Trading cryptocurrencies and other financial instruments involves substantial risk of loss. " + "No guarantee of profits or protection against losses is made or implied. " + "Past performance does not indicate future results. Use at your own risk.";
+var FULL_LEGAL_NOTICE = `${COPYRIGHT}
+
+${TRADEMARK_NOTICE}
+
+${DISCLAIMER}`;
+var DISCLAIMER_HEADER = "X-Disclaimer";
+// src/types.ts
+import { z } from "zod";
+var TradeActionSchema = z.enum([
+  "LONG",
+  "SHORT",
+  "CLOSE_LONG",
+  "CLOSE_SHORT"
+]);
+var MAX_WEBHOOK_LEVERAGE = 125;
+var MAX_WEBHOOK_QUANTITY = 1e6;
+var WebhookPayloadSchema = z.object({
+  exchange: z.string().min(1),
+  action: TradeActionSchema,
+  symbol: z.string().min(1).max(20),
+  quantity: z.number().positive().finite().max(MAX_WEBHOOK_QUANTITY),
+  price: z.number().positive().finite().optional(),
+  orderType: z.string().optional(),
+  leverage: z.number().int().positive().max(MAX_WEBHOOK_LEVERAGE).optional(),
+  test: z.boolean().optional(),
+  tenantId: z.string().min(1).max(64).optional()
+}).strict();
+var TradeQueueMessageSchema = z.object({
+  requestId: z.string().min(1).max(128),
+  exchange: z.string().min(1).max(64),
+  action: TradeActionSchema,
+  symbol: z.string().min(1).max(32),
+  quantity: z.number().positive().finite().max(MAX_WEBHOOK_QUANTITY),
+  price: z.number().positive().finite().optional(),
+  leverage: z.number().int().positive().max(MAX_WEBHOOK_LEVERAGE).optional(),
+  test: z.boolean().optional(),
+  idempotencyKey: z.string().min(1).max(512).optional(),
+  tenantId: z.string().min(1).max(64).optional(),
+  queuedAt: z.string().min(1).max(64)
+}).strict();
+var TradeSignalSchema = z.object({
+  id: z.number().int().positive().optional(),
+  source: z.string().min(1),
+  symbol: z.string().min(1),
+  action: TradeActionSchema,
+  price: z.number().positive().finite().optional(),
+  quantity: z.number().positive().finite(),
+  leverage: z.number().int().positive().optional(),
+  status: z.enum(["pending", "executed", "failed", "skipped"]).optional(),
+  createdAt: z.string().optional(),
+  executedAt: z.string().optional(),
+  error: z.string().optional()
+}).strict();
+var PositionSchema = z.object({
+  id: z.string(),
+  symbol: z.string().min(1),
+  side: TradeActionSchema,
+  quantity: z.number().positive(),
+  entry_price: z.number().positive(),
+  current_price: z.number().positive(),
+  unrealized_pnl: z.number(),
+  timestamp: z.number().int().positive()
+}).strict();
+var BalanceSchema = z.object({
+  asset: z.string().min(1),
+  free: z.number().min(0),
+  locked: z.number().min(0),
+  timestamp: z.number().int().positive()
+}).strict();
 // src/kvKeys.ts
 var KV_TRADE_DEFAULT_LEVERAGE = "trade:default_leverage";
 var KV_TRADE_MAX_POSITION_SIZE = "trade:max_position_size";
@@ -269,6 +334,10 @@ var KV_BOT_ENABLED = "bot:enabled";
 var KV_BOT_DEFAULT_CHAT_ID = "bot:default_chat_id";
 var KV_BOT_NOTIFY_ON_EXECUTION = "bot:notify_on_execution";
 var KV_BOT_NOTIFY_ON_ERROR = "bot:notify_on_error";
+var KV_BOT_NOTIFY_ON_STARTUP = "bot:notify_on_startup";
+var KV_BOT_AI_SUMMARIES_ENABLED = "bot:ai_summaries_enabled";
+var KV_BOT_SUMMARY_STYLE = "bot:summary_style";
+var KV_BOT_INCLUDE_PNL = "bot:include_pnl";
 var KV_TELEGRAM_ALLOWED_CHAT_IDS = "telegram:allowed_chat_ids";
 var KV_WEBHOOK_IP_CHECK_ENABLED = "webhook:tradingview:ip_check_enabled";
 var KV_WEBHOOK_ALLOWED_IPS = "webhook:tradingview:allowed_ips";
@@ -300,6 +369,10 @@ var KVKeys = {
   KV_BOT_DEFAULT_CHAT_ID,
   KV_BOT_NOTIFY_ON_EXECUTION,
   KV_BOT_NOTIFY_ON_ERROR,
+  KV_BOT_NOTIFY_ON_STARTUP,
+  KV_BOT_AI_SUMMARIES_ENABLED,
+  KV_BOT_SUMMARY_STYLE,
+  KV_BOT_INCLUDE_PNL,
   KV_TELEGRAM_ALLOWED_CHAT_IDS,
   KV_WEBHOOK_IP_CHECK_ENABLED,
   KV_WEBHOOK_ALLOWED_IPS,
@@ -321,501 +394,621 @@ var KVKeys = {
   QUEUE_MODE_EVERYWHERE,
   QUEUE_MODE_DISABLED
 };
-
-// src/agent-config-fields.ts
-var AGENT_CONFIG_KV_KEY = KV_AGENT_CONFIG;
-var AGENT_CONFIG_EMBEDDED_FIELDS = {
-  "providers:default_provider": { kind: "top", key: "defaultProvider" },
-  "providers:fallback_chain": { kind: "top", key: "fallbackChain" },
-  "providers:timeout_ms": { kind: "top", key: "timeoutMs" },
-  "providers:retry_count": { kind: "top", key: "retryCount" },
-  "models:workers_ai_model": { kind: "model", provider: "workers-ai" },
-  "models:openai_model": { kind: "model", provider: "openai" },
-  "models:anthropic_model": { kind: "model", provider: "anthropic" },
-  "models:google_model": { kind: "model", provider: "google" },
-  "risk:max_daily_drawdown_percent": {
-    kind: "top",
-    key: "maxDailyDrawdownPercent"
-  },
-  "risk:trailing_stop_percent": { kind: "top", key: "trailingStopPercent" },
-  "risk:take_profit_percent": { kind: "top", key: "takeProfitPercent" }
-};
-var DASHBOARD_SECTIONS_AGENT_CONFIG = new Set([
-  "providers",
-  "models"
-]);
-function isAgentConfigEmbeddedField(fieldKey) {
-  return Object.prototype.hasOwnProperty.call(AGENT_CONFIG_EMBEDDED_FIELDS, fieldKey);
+// src/tenant.ts
+var TENANT_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+function isTenantFlagOn(env) {
+  const v = env?.TENANT_MODE;
+  return v === "true" || v === "1";
+}
+function tenantScope(env) {
+  if (!isTenantFlagOn(env))
+    return { enabled: false, tenantId: null };
+  const id = (env?.TENANT_ID ?? "").trim();
+  if (!id || !TENANT_ID_RE.test(id)) {
+    throw new Error("TENANT_MODE is enabled but TENANT_ID is missing or invalid (expected [A-Za-z0-9_-], 1-64 chars)");
+  }
+  return { enabled: true, tenantId: id };
+}
+function isTenantMode(env) {
+  try {
+    return tenantScope(env).enabled;
+  } catch {
+    return false;
+  }
 }
-function isAgentConfigSection(sectionId) {
-  return DASHBOARD_SECTIONS_AGENT_CONFIG.has(sectionId);
+function effectiveTenantId(env, msg) {
+  if (isTenantFlagOn(env)) {
+    return tenantScope(env).tenantId;
+  }
+  const m = typeof msg?.tenantId === "string" ? msg.tenantId.trim() : "";
+  return m && TENANT_ID_RE.test(m) ? m : null;
 }
-function parseAgentConfigJson(raw) {
-  if (raw === null || raw === undefined || raw === "")
-    return {};
+function scopeKey(env, key, msg) {
+  const id = effectiveTenantId(env, msg);
+  return id ? `t/${id}/${key}` : key;
+}
+function scopeR2Key(env, key, msg) {
+  const id = effectiveTenantId(env, msg);
+  return id ? `t-${id}/${key}` : key;
+}
+function withTenantId(env, obj) {
+  const ts = tenantScope(env);
+  return ts.enabled && ts.tenantId ? { ...obj, tenantId: ts.tenantId } : obj;
+}
+function tenantContextOf(env) {
+  const ts = tenantScope(env);
+  return ts.enabled && ts.tenantId ? { tenantId: ts.tenantId } : null;
+}
+// src/kill-switch.ts
+var KILL_SWITCH_ACTIVE_PREFIX = "KILL_SWITCH_ACTIVE";
+var KILL_SWITCH_KEYS = [
+  KV_TRADE_KILL_SWITCH,
+  KV_GLOBAL_KILL_SWITCH
+];
+function isTruthyKillSwitchFlag(value) {
+  if (value == null)
+    return false;
+  const v = value.trim().toLowerCase();
+  return v === "true" || v === "1" || v === "yes" || v === "on";
+}
+async function checkKillSwitch(kv, options) {
+  const onMissingKv = options?.onMissingKv ?? "open";
+  const onReadError = options?.onReadError ?? "closed";
+  if (!kv) {
+    if (onMissingKv === "closed") {
+      return { enabled: true, source: "missing_kv" };
+    }
+    return { enabled: false };
+  }
   try {
-    let v = JSON.parse(raw);
-    if (typeof v === "string") {
-      try {
-        v = JSON.parse(v);
-      } catch {
-        return {};
+    const values = await Promise.all(KILL_SWITCH_KEYS.map(async (key) => ({
+      key,
+      value: await kv.get(key)
+    })));
+    for (const { key, value } of values) {
+      if (isTruthyKillSwitchFlag(value)) {
+        return { enabled: true, source: key };
       }
     }
-    if (v && typeof v === "object" && !Array.isArray(v)) {
-      return { ...v };
+    return { enabled: false };
+  } catch (error) {
+    const errorStr = String(error);
+    if (onReadError === "closed") {
+      return { enabled: true, source: "read_error", error: errorStr };
     }
-  } catch {}
-  return {};
+    return { enabled: false, error: errorStr };
+  }
 }
-function serializeAgentConfigForKv(config) {
-  return JSON.stringify(config);
+async function isTradingPaused(kv, options) {
+  const result = await checkKillSwitch(kv, options);
+  return result.enabled;
 }
-var NUMBER_TOP_KEYS = new Set([
-  "timeoutMs",
-  "retryCount",
-  "maxDailyDrawdownPercent",
-  "trailingStopPercent",
-  "takeProfitPercent"
-]);
-function getAgentConfigEmbeddedValue(config, fieldKey) {
-  const spec = AGENT_CONFIG_EMBEDDED_FIELDS[fieldKey];
-  if (!spec)
-    return;
-  if (spec.kind === "model") {
-    const map = config.modelMap;
-    if (!map || typeof map !== "object" || Array.isArray(map))
-      return;
-    const v2 = map[spec.provider];
-    if (typeof v2 === "string" || typeof v2 === "number" || typeof v2 === "boolean")
-      return v2;
-    return;
+// src/errors.ts
+function toError(err, fallback = "Unknown error") {
+  if (err instanceof Error)
+    return err.message;
+  if (typeof err === "string")
+    return err;
+  if (err && typeof err === "object" && "message" in err) {
+    const message = err.message;
+    if (typeof message === "string")
+      return message;
   }
-  const v = config[spec.key];
-  if (spec.key === "fallbackChain") {
-    if (Array.isArray(v))
-      return JSON.stringify(v);
-    if (typeof v === "string")
-      return v;
-    return;
+  if (err === null || err === undefined)
+    return fallback;
+  try {
+    return JSON.stringify(err) || fallback;
+  } catch {
+    return fallback;
   }
-  if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
-    return v;
+}
+var SENSITIVE_FIELDS = new Set([
+  "password",
+  "token",
+  "secret",
+  "api_key",
+  "apiKey",
+  "authorization"
+]);
+function hasSensitiveFields(obj) {
+  for (const key of Object.keys(obj)) {
+    if (SENSITIVE_FIELDS.has(key))
+      return true;
   }
-  return;
+  return false;
 }
-function setAgentConfigEmbeddedValue(config, fieldKey, value) {
-  const spec = AGENT_CONFIG_EMBEDDED_FIELDS[fieldKey];
-  if (!spec)
-    return { ...config };
-  const next = { ...config };
-  if (spec.kind === "model") {
-    const prev = next.modelMap && typeof next.modelMap === "object" && !Array.isArray(next.modelMap) ? next.modelMap : {};
-    next.modelMap = { ...prev, [spec.provider]: String(value) };
-    return next;
+function hasErrorValues(obj) {
+  for (const v of Object.values(obj)) {
+    if (v instanceof Error)
+      return true;
   }
-  if (spec.key === "fallbackChain") {
-    if (typeof value === "string") {
-      try {
-        next.fallbackChain = JSON.parse(value);
-      } catch {
-        next.fallbackChain = value;
+  return false;
+}
+function sanitizeOutput(data) {
+  if (data === null || data === undefined)
+    return data;
+  const t = typeof data;
+  if (t === "string" || t === "number" || t === "boolean")
+    return data;
+  if (data instanceof Error) {
+    return { name: data.name, message: data.message };
+  }
+  if (Array.isArray(data)) {
+    return data.map(sanitizeOutput);
+  }
+  if (t === "object") {
+    const obj = data;
+    const keys = Object.keys(obj);
+    if (keys.length < 10) {
+      const sanitized = {};
+      for (const k of keys) {
+        if (k === "stack" || k === "cause")
+          continue;
+        const v = obj[k];
+        sanitized[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
       }
-    } else {
-      next.fallbackChain = value;
+      return sanitized;
     }
-    return next;
-  }
-  if (NUMBER_TOP_KEYS.has(spec.key)) {
-    const n = typeof value === "number" ? value : Number(value);
-    next[spec.key] = Number.isFinite(n) ? n : value;
-    return next;
+    if (!hasSensitiveFields(obj) && !hasErrorValues(obj)) {
+      return obj;
+    }
+    const sanitized = {};
+    for (const k of keys) {
+      if (k === "stack" || k === "cause")
+        continue;
+      const v = obj[k];
+      sanitized[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
+    }
+    return sanitized;
   }
-  next[spec.key] = value;
-  return next;
+  return data;
 }
-function expandAgentConfigToFieldMap(config) {
-  const out = {};
-  for (const fieldKey of Object.keys(AGENT_CONFIG_EMBEDDED_FIELDS)) {
-    const v = getAgentConfigEmbeddedValue(config, fieldKey);
-    if (v !== undefined)
-      out[fieldKey] = v;
-  }
-  return out;
+function createJsonResponse(data, status = 200) {
+  return new Response(JSON.stringify(sanitizeOutput(data)), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
 }
-function applyAgentConfigFieldUpdates(config, updates) {
-  let next = { ...config };
-  for (const [fieldKey, value] of Object.entries(updates)) {
-    if (isAgentConfigEmbeddedField(fieldKey)) {
-      next = setAgentConfigEmbeddedValue(next, fieldKey, value);
-    }
-  }
-  return next;
+function createSuccessResponse(result) {
+  return createJsonResponse({ success: true, result }, 200);
 }
-
-// src/analytics.ts
-async function trackAnalytics(env, endpoint, body, options) {
-  if (!env.ANALYTICS_SERVICE)
-    return;
-  try {
-    const payload = {
-      ...body,
-      ...options?.indexes ? { indexes: [...options.indexes] } : {}
-    };
-    const headers = {
-      "Content-Type": "application/json"
-    };
-    const internalKey = env.INTERNAL_KEY_BINDING;
-    if (internalKey) {
-      headers["X-Internal-Auth-Key"] = internalKey;
-    }
-    await env.ANALYTICS_SERVICE.fetch(new Request(`http://localhost${endpoint}`, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(payload)
-    }));
-  } catch (e) {
-    console.error("Analytics tracking failed:", e);
-  }
+function createErrorResponse(error, status) {
+  const message = typeof error === "string" ? error : error.message;
+  const statusCode = typeof error === "string" ? status ?? 500 : error.status ?? 500;
+  const body = { success: false, error: message };
+  if (typeof error !== "string" && error.code)
+    body.code = error.code;
+  if (typeof error !== "string" && error.details !== undefined)
+    body.details = error.details;
+  return new Response(JSON.stringify(body), {
+    status: statusCode,
+    headers: { "Content-Type": "application/json" }
+  });
 }
-
-// src/colors.ts
-var Colors = {
-  background: "#050508",
-  foreground: "#E8E8F0",
-  card: "#0A0A0F",
-  border: "#232330",
-  muted: "#8B8B9E",
-  "muted-foreground": "#6E6E84",
-  dim: "#3C3C50",
-  accent: "#818CF8",
-  "accent-dim": "#6366F1",
-  success: "#34D399",
-  warning: "#FBBF24",
-  error: "#FB7185",
-  info: "#38BDF8",
-  text: "#E8E8F0",
-  "text-muted": "#8B8B9E",
-  panel: "#0A0A0F",
-  divider: "#232330",
-  highlight: "#22D3EE",
-  backdrop: "#000000"
-};
-var CoolBracketPalette = [
-  "#22D3EE",
-  "#38BDF8",
-  "#60A5FA",
-  "#818CF8",
-  "#A78BFA",
-  "#C084FC",
-  "#E879F9",
-  "#A78BFA",
-  "#818CF8",
-  "#38BDF8"
-];
-var ConnectionStatusColor = {
-  connected: Colors.success,
-  polling: Colors.highlight,
-  reconnecting: Colors.warning,
-  offline: Colors.error
-};
-var WorkerStatusColor = {
-  operational: Colors.success,
-  degraded: Colors.warning,
-  down: Colors.error
-};
-var LogLevelColor = {
-  error: Colors.error,
-  warn: Colors.warning,
-  info: Colors.foreground,
-  debug: Colors.muted
-};
-var AlertSeverityColor = {
-  info: Colors.info,
-  warning: Colors.warning,
-  error: Colors.error,
-  critical: Colors.error
-};
-
-// src/config.ts
-import {
-  readFileSync,
-  writeFileSync,
-  existsSync,
-  mkdirSync,
-  chmodSync,
-  statSync
-} from "fs";
-import { join } from "path";
-import { homedir } from "os";
-var HOX_DIR = join(homedir(), ".hoox");
-var CONFIG_PATH = join(HOX_DIR, "config.json");
-var HOOX_DIR_MODE = 448;
-var HOOX_CONFIG_FILE_MODE = 384;
-var DEFAULT_CONFIG = {
-  apiUrl: "http://localhost:8787",
-  apiToken: "",
-  transport: "public",
-  refreshIntervalMs: 500,
-  theme: "dark",
-  activeExchanges: ["binance", "bybit", "mexc"],
-  notifications: {
-    alerts: true,
-    trades: true,
-    debug: false,
-    system: true
+var Errors = {
+  badRequest: (message) => createErrorResponse({ message, status: 400, code: "BAD_REQUEST" }),
+  unauthorized: (message = "Unauthorized") => createErrorResponse({ message, status: 401, code: "UNAUTHORIZED" }),
+  forbidden: (message = "Forbidden") => createErrorResponse({ message, status: 403, code: "FORBIDDEN" }),
+  notFound: (message = "Not found") => createErrorResponse({ message, status: 404, code: "NOT_FOUND" }),
+  methodNotAllowed: (message = "Method not allowed") => createErrorResponse({ message, status: 405, code: "METHOD_NOT_ALLOWED" }),
+  rateLimited: (retryAfter) => {
+    const res = createErrorResponse({
+      message: "Rate limit exceeded",
+      status: 429,
+      code: "RATE_LIMITED"
+    });
+    if (retryAfter)
+      res.headers.set("Retry-After", String(retryAfter));
+    return res;
   },
-  soundEnabled: true,
-  defaultView: "dashboard"
+  internal: (err) => {
+    const message = err ? toError(err, "Internal server error") : "Internal server error";
+    return createErrorResponse({
+      message,
+      status: 500,
+      code: "INTERNAL_ERROR"
+    });
+  }
 };
-function readConfigSync() {
-  const envConfig = {
-    apiUrl: process.env.HOOX_API_URL,
-    apiToken: process.env.HOOX_API_TOKEN
-  };
-  let fileConfig = {};
-  try {
-    if (existsSync(CONFIG_PATH)) {
-      fileConfig = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
-    }
-  } catch {}
-  return {
-    ...DEFAULT_CONFIG,
-    ...fileConfig,
-    ...Object.fromEntries(Object.entries(envConfig).filter(([_, v]) => v !== undefined))
-  };
-}
-async function readConfig() {
-  return readConfigSync();
-}
-function ensureHooxDirSecure(dir = HOX_DIR) {
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true, mode: HOOX_DIR_MODE });
+// src/exchange-client.ts
+class ExchangeRouter {
+  providers = new Map;
+  registerProvider(provider) {
+    this.providers.set(provider.name.toLowerCase(), provider);
   }
-  try {
-    chmodSync(dir, HOOX_DIR_MODE);
-  } catch {}
-}
-function writeSecureFileSync(filePath, contents, mode = HOOX_CONFIG_FILE_MODE) {
-  writeFileSync(filePath, contents, { encoding: "utf-8", mode });
-  try {
-    chmodSync(filePath, mode);
-  } catch {}
-}
-function isUnixModeGroupOrWorldAccessible(mode) {
-  return (mode & 63) !== 0;
-}
-function isConfigWorldOrGroupReadable(filePath = CONFIG_PATH) {
-  try {
-    if (!existsSync(filePath))
-      return false;
-    return isUnixModeGroupOrWorldAccessible(statSync(filePath).mode & 511);
-  } catch {
-    return false;
+  route(exchange, env, options) {
+    const key = exchange.toLowerCase();
+    const provider = this.providers.get(key);
+    if (!provider) {
+      throw new Error(`Unsupported exchange: ${exchange}`);
+    }
+    if (options?.testnet && provider.supportsTestTrading === false) {
+      throw new Error(`TEST_TRADING_UNSUPPORTED: ${exchange} does not support test/sandbox trading via API`);
+    }
+    if (!provider.hasCredentials(env)) {
+      throw new Error(`API secret bindings not configured or accessible for ${exchange}`);
+    }
+    return { exchange: key, client: provider.createClient(env, options) };
   }
 }
-function formatConfigPermissionWarning(filePath = CONFIG_PATH) {
-  if (!isConfigWorldOrGroupReadable(filePath))
-    return null;
-  return `Warning: ${filePath} is group/world-accessible. ` + `Run: chmod 600 ${filePath}  (and chmod 700 on the parent dir). ` + `This file may contain apiToken / operator secrets.`;
-}
-function writeConfigSync(config) {
-  try {
-    ensureHooxDirSecure(HOX_DIR);
-    writeSecureFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), HOOX_CONFIG_FILE_MODE);
-  } catch (err) {
-    console.error("Failed to write config:", err);
+
+class BaseExchangeClient {
+  apiKey;
+  apiSecret;
+  baseUrl;
+  isTestnet;
+  constructor(config) {
+    if (!config.apiKey || !config.apiSecret) {
+      throw new Error("API key and secret are required.");
+    }
+    this.apiKey = config.apiKey;
+    this.apiSecret = config.apiSecret;
+    this.baseUrl = config.baseUrl || this.getDefaultBaseUrl();
+    this.isTestnet = config.testnet || false;
   }
-}
-async function writeConfig(config) {
-  writeConfigSync(config);
-}
-var VALID_TRANSPORTS2 = new Set([
-  "public",
-  "access",
-  "mtls",
-  "tunnel"
-]);
-function validateConfig(config) {
-  const errors = [];
-  if (config.apiUrl && !config.apiUrl.startsWith("http")) {
-    errors.push("apiUrl must start with http:// or https://");
+  async fetch(method, path, params) {
+    const url = `${this.baseUrl}${path}`;
+    const headers = this.buildHeaders(method, path, params);
+    const body = params ? new URLSearchParams(params).toString() : undefined;
+    const response = await fetch(url, {
+      method,
+      headers,
+      body: method !== "GET" ? body : undefined
+    });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Exchange API error: ${response.status} - ${error}`);
+    }
+    return response.json();
   }
-  if (config.refreshIntervalMs !== undefined && config.refreshIntervalMs < 100) {
-    errors.push("refreshIntervalMs must be >= 100ms");
+  async openLong(symbol, quantity, price, orderType = "MARKET") {
+    return this.executeTrade({
+      symbol,
+      side: "long",
+      orderType,
+      quantity,
+      price
+    });
   }
-  if (config.theme && !["dark", "light"].includes(config.theme)) {
-    errors.push('theme must be "dark" or "light"');
+  async openShort(symbol, quantity, price, orderType = "MARKET") {
+    return this.executeTrade({
+      symbol,
+      side: "short",
+      orderType,
+      quantity,
+      price
+    });
   }
-  if (config.transport !== undefined && !VALID_TRANSPORTS2.has(config.transport)) {
-    errors.push('transport must be "public" | "access" | "mtls" | "tunnel"');
+  async closeLong(symbol, quantity) {
+    return this.executeTrade({
+      symbol,
+      side: "long",
+      quantity,
+      reduceOnly: true
+    });
   }
-  return errors;
-}
-
-// src/cron-handler.ts
-function createCronHandler(options) {
-  const { name, handler, logger } = options;
-  return async (event, env, ctx) => {
-    const startTime = Date.now();
-    logger?.info(`${name} cron triggered`, {
-      cron: event.cron,
-      scheduledTime: event.scheduledTime
+  async closeShort(symbol, quantity) {
+    return this.executeTrade({
+      symbol,
+      side: "short",
+      quantity,
+      reduceOnly: true
     });
-    try {
-      await handler(event, env, ctx);
-      const durationMs = Date.now() - startTime;
-      logger?.info(`${name} cron handler completed successfully`, {
-        cron: event.cron,
-        durationMs
-      });
-    } catch (error) {
-      const durationMs = Date.now() - startTime;
-      const errorMsg = error instanceof Error ? error.message : String(error);
-      logger?.error(`${name} cron handler failed`, {
-        cron: event.cron,
-        durationMs,
-        error: errorMsg
-      });
-      throw error;
-    }
-  };
+  }
 }
-
-// src/errors.ts
-function toError(err, fallback = "Unknown error") {
-  if (err instanceof Error)
-    return err.message;
-  if (typeof err === "string")
-    return err;
-  if (err && typeof err === "object" && "message" in err) {
-    const message = err.message;
-    if (typeof message === "string")
-      return message;
+// src/exchanges/base-exchange-client.ts
+class BaseExchangeClient2 {
+  apiKey;
+  apiSecret;
+  baseUrl;
+  isTestnet;
+  importedKeyPromise;
+  constructor(apiKey, apiSecret, options) {
+    if (!apiKey || !apiSecret) {
+      throw new Error(this.getErrorMessagePrefix() + "API key and secret are required.");
+    }
+    this.apiKey = apiKey;
+    this.apiSecret = apiSecret;
+    this.isTestnet = options?.testnet ?? false;
+    this.baseUrl = options?.baseUrl ?? this.getDefaultBaseUrl();
+    this.importedKeyPromise = this.importKey();
   }
-  if (err === null || err === undefined)
-    return fallback;
-  try {
-    return JSON.stringify(err) || fallback;
-  } catch {
-    return fallback;
+  get testnet() {
+    return this.isTestnet;
   }
-}
-var SENSITIVE_FIELDS = new Set([
-  "password",
-  "token",
-  "secret",
-  "api_key",
-  "apiKey",
-  "authorization"
-]);
-function hasSensitiveFields(obj) {
-  for (const key of Object.keys(obj)) {
-    if (SENSITIVE_FIELDS.has(key))
-      return true;
+  getErrorMessagePrefix() {
+    return "";
   }
-  return false;
-}
-function hasErrorValues(obj) {
-  for (const v of Object.values(obj)) {
-    if (v instanceof Error)
-      return true;
+  generateSignature(_params) {
+    throw new Error("generateSignature must be implemented by subclass");
   }
-  return false;
-}
-function sanitizeOutput(data) {
-  if (data === null || data === undefined)
-    return data;
-  const t = typeof data;
-  if (t === "string" || t === "number" || t === "boolean")
-    return data;
-  if (data instanceof Error) {
-    return { name: data.name, message: data.message };
+  buildHeaders(_method, _path, _params) {
+    return new Headers;
   }
-  if (Array.isArray(data)) {
-    return data.map(sanitizeOutput);
+  async importKey() {
+    const encoder = new TextEncoder;
+    return crypto.subtle.importKey("raw", encoder.encode(this.apiSecret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
   }
-  if (t === "object") {
-    const obj = data;
-    const keys = Object.keys(obj);
-    if (keys.length < 10) {
-      const sanitized2 = {};
-      for (const k of keys) {
-        if (k === "stack" || k === "cause")
-          continue;
-        const v = obj[k];
-        sanitized2[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
-      }
-      return sanitized2;
-    }
-    if (!hasSensitiveFields(obj) && !hasErrorValues(obj)) {
-      return obj;
-    }
-    const sanitized = {};
-    for (const k of keys) {
-      if (k === "stack" || k === "cause")
-        continue;
-      const v = obj[k];
-      sanitized[k] = v instanceof Error ? { name: v.name, message: v.message } : sanitizeOutput(v);
-    }
-    return sanitized;
+  async cryptoSign(data) {
+    const encoder = new TextEncoder;
+    const key = await this.importedKeyPromise;
+    const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+    return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
   }
-  return data;
-}
-function createJsonResponse(data, status = 200) {
-  return new Response(JSON.stringify(sanitizeOutput(data)), {
-    status,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-function createSuccessResponse(result) {
-  return createJsonResponse({ success: true, result }, 200);
-}
-function createErrorResponse(error, status) {
-  const message = typeof error === "string" ? error : error.message;
-  const statusCode = typeof error === "string" ? status ?? 500 : error.status ?? 500;
-  const body = { success: false, error: message };
-  if (typeof error !== "string" && error.code)
-    body.code = error.code;
-  if (typeof error !== "string" && error.details !== undefined)
-    body.details = error.details;
-  return new Response(JSON.stringify(body), {
-    status: statusCode,
-    headers: { "Content-Type": "application/json" }
-  });
-}
-var Errors = {
-  badRequest: (message) => createErrorResponse({ message, status: 400, code: "BAD_REQUEST" }),
-  unauthorized: (message = "Unauthorized") => createErrorResponse({ message, status: 401, code: "UNAUTHORIZED" }),
-  forbidden: (message = "Forbidden") => createErrorResponse({ message, status: 403, code: "FORBIDDEN" }),
-  notFound: (message = "Not found") => createErrorResponse({ message, status: 404, code: "NOT_FOUND" }),
-  methodNotAllowed: (message = "Method not allowed") => createErrorResponse({ message, status: 405, code: "METHOD_NOT_ALLOWED" }),
-  rateLimited: (retryAfter) => {
-    const res = createErrorResponse({
-      message: "Rate limit exceeded",
-      status: 429,
-      code: "RATE_LIMITED"
-    });
-    if (retryAfter)
-      res.headers.set("Retry-After", String(retryAfter));
-    return res;
-  },
-  internal: (err) => {
-    const message = err ? toError(err, "Internal server error") : "Internal server error";
-    return createErrorResponse({
-      message,
-      status: 500,
-      code: "INTERNAL_ERROR"
+  async fetch(method, path, params) {
+    const url = `${this.baseUrl}${path}`;
+    const headers = this.buildHeaders(method, path, params);
+    const body = params ? new URLSearchParams(params).toString() : undefined;
+    const response = await fetch(url, {
+      method,
+      headers,
+      body: method !== "GET" ? body : undefined
     });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Exchange API error: ${response.status} - ${error}`);
+    }
+    return response.json();
+  }
+  setLeverage(_symbol, _leverage) {
+    throw new Error("setLeverage must be implemented by subclass");
+  }
+  executeTrade(_params) {
+    throw new Error("executeTrade must be implemented by subclass");
+  }
+  getAccountInfo() {
+    throw new Error("getAccountInfo must be implemented by subclass");
+  }
+  getPositions(_symbol) {
+    throw new Error("getPositions must be implemented by subclass");
+  }
+  async openLong(symbol, quantity, price, orderType = "MARKET") {
+    return this.executeTrade({
+      symbol,
+      side: "BUY",
+      orderType,
+      quantity,
+      price
+    });
+  }
+  async openShort(symbol, quantity, price, orderType = "MARKET") {
+    return this.executeTrade({
+      symbol,
+      side: "SELL",
+      orderType,
+      quantity,
+      price
+    });
+  }
+  async closeLong(symbol, quantity) {
+    return this.executeTrade({
+      symbol,
+      side: "SELL",
+      orderType: "MARKET",
+      quantity,
+      reduceOnly: true
+    });
+  }
+  async closeShort(symbol, quantity) {
+    return this.executeTrade({
+      symbol,
+      side: "BUY",
+      orderType: "MARKET",
+      quantity,
+      reduceOnly: true
+    });
+  }
+}
+// src/kvUtils.ts
+async function logKvTimestamp(env, prefix = "timestamp") {
+  const timestamp = new Date().toISOString();
+  const key = `${prefix}_${timestamp}`;
+  try {
+    await env.REPORT_KV.put(key, timestamp);
+  } catch (error) {
+    console.error(`Failed to log timestamp to KV: ${toError(error, "Unknown error")}`);
+  }
+}
+var KV_BULK_GET_MAX_KEYS = 100;
+async function tryBulkGetChunk(kv, chunk) {
+  try {
+    const result = await kv.get([...chunk]);
+    if (!(result instanceof Map)) {
+      return null;
+    }
+    return chunk.map((key) => result.get(key) ?? null);
+  } catch {
+    return null;
+  }
+}
+async function kvGetMany(kv, keys) {
+  if (keys.length === 0)
+    return [];
+  const out = new Array(keys.length);
+  let offset = 0;
+  while (offset < keys.length) {
+    const chunk = keys.slice(offset, offset + KV_BULK_GET_MAX_KEYS);
+    const bulk = await tryBulkGetChunk(kv, chunk);
+    if (bulk === null) {
+      const rest = await Promise.all(keys.slice(offset).map((key) => kv.get(key)));
+      for (let i = 0;i < rest.length; i++) {
+        out[offset + i] = rest[i] ?? null;
+      }
+      return out;
+    }
+    for (let i = 0;i < bulk.length; i++) {
+      out[offset + i] = bulk[i] ?? null;
+    }
+    offset += chunk.length;
+  }
+  return out;
+}
+async function kvGetManyAsRecord(kv, keys) {
+  const values = await kvGetMany(kv, keys);
+  const out = {};
+  for (let i = 0;i < keys.length; i++) {
+    out[keys[i]] = values[i] ?? null;
+  }
+  return out;
+}
+async function kvPutMany(kv, entries) {
+  if (entries.length === 0)
+    return;
+  await Promise.all(entries.map((entry) => kv.put(entry.key, entry.value, entry.options)));
+}
+function headersToObject(headers) {
+  const result = {};
+  if (!headers)
+    return result;
+  try {
+    headers.forEach((value, key) => {
+      result[key] = value;
+    });
+  } catch (error) {
+    console.error(`Error converting headers to object: ${toError(error, "Unknown error")}`);
+  }
+  return result;
+}
+// src/analytics.ts
+async function trackAnalytics(env, endpoint, body, options) {
+  if (!env.ANALYTICS_SERVICE)
+    return;
+  try {
+    let tenantId = null;
+    try {
+      tenantId = effectiveTenantId(env);
+    } catch {
+      tenantId = null;
+    }
+    const rest = { ...body };
+    delete rest.tenant_id;
+    delete rest.tenantId;
+    const payload = {
+      ...rest,
+      ...tenantId ? { tenant_id: tenantId } : {},
+      ...options?.indexes ? { indexes: [...options.indexes] } : {}
+    };
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    const internalKey = env.INTERNAL_KEY_BINDING;
+    if (internalKey) {
+      headers["X-Internal-Auth-Key"] = internalKey;
+    }
+    await env.ANALYTICS_SERVICE.fetch(new Request(`http://localhost${endpoint}`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(payload)
+    }));
+  } catch (e) {
+    console.error("Analytics tracking failed:", e);
+  }
+}
+// src/health.ts
+function healthCheck(options) {
+  const result = {
+    status: "ok",
+    timestamp: new Date().toISOString()
+  };
+  if (options?.worker !== undefined && options?.worker !== null)
+    result.service = options.worker;
+  if (options?.version !== undefined && options?.version !== null)
+    result.version = options.version;
+  if (options?.details)
+    result.details = options.details;
+  return createSuccessResponse(result);
+}
+// src/queue-handler.ts
+async function mapPool(items, concurrency, fn) {
+  if (items.length === 0)
+    return;
+  const limit = Math.min(Math.max(1, concurrency), items.length);
+  if (limit === 1) {
+    for (const item of items) {
+      await fn(item);
+    }
+    return;
+  }
+  let nextIndex = 0;
+  async function worker() {
+    while (true) {
+      const i = nextIndex++;
+      if (i >= items.length)
+        return;
+      await fn(items[i]);
+    }
+  }
+  await Promise.all(Array.from({ length: limit }, () => worker()));
+}
+function createQueueHandler(options) {
+  const {
+    maxRetries,
+    backoffDelays,
+    onMessage,
+    onRetry,
+    onDLQ,
+    logger,
+    concurrency: concurrencyOpt
+  } = options;
+  const concurrency = typeof concurrencyOpt === "number" && Number.isFinite(concurrencyOpt) && concurrencyOpt >= 1 ? Math.floor(concurrencyOpt) : 1;
+  async function processMessage(msg) {
+    const attemptNumber = msg.attempts || 0;
+    const logId = `[${msg.id}]`;
+    try {
+      logger?.info(`${logId} Processing message (attempt ${attemptNumber + 1})`);
+      await onMessage(msg.body, attemptNumber);
+      logger?.info(`${logId} Message processed successfully`);
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      if (attemptNumber < maxRetries) {
+        const delaySeconds = backoffDelays[attemptNumber] ?? backoffDelays[backoffDelays.length - 1] ?? 0;
+        logger?.info(`${logId} Retrying in ${delaySeconds}s (attempt ${attemptNumber + 2}/${maxRetries + 1})`);
+        await onRetry?.(msg.body, attemptNumber, errorMsg, delaySeconds);
+        msg.retry({ delaySeconds });
+      } else {
+        logger?.error(`${logId} Max retries exceeded (${maxRetries + 1} attempts), moving to DLQ`);
+        await onDLQ?.(msg.body, attemptNumber, errorMsg);
+      }
+    }
+  }
+  return async (batch) => {
+    await mapPool(batch.messages, concurrency, processMessage);
+  };
+}
+// src/cron-handler.ts
+function createCronHandler(options) {
+  const { name, handler, logger } = options;
+  return async (event, env, ctx) => {
+    const startTime = Date.now();
+    logger?.info(`${name} cron triggered`, {
+      cron: event.cron,
+      scheduledTime: event.scheduledTime
+    });
+    try {
+      await handler(event, env, ctx);
+      const durationMs = Date.now() - startTime;
+      logger?.info(`${name} cron handler completed successfully`, {
+        cron: event.cron,
+        durationMs
+      });
+    } catch (error) {
+      const durationMs = Date.now() - startTime;
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      logger?.error(`${name} cron handler failed`, {
+        cron: event.cron,
+        durationMs,
+        error: errorMsg
+      });
+      throw error;
+    }
+  };
+}
+// src/d1/repository.ts
+class D1Repository {
+  db;
+  constructor(db) {
+    this.db = db;
   }
-};
-
-// src/d1/repository.ts
-class D1Repository {
-  db;
-  constructor(db) {
-    this.db = db;
-  }
   async query(sql, params = []) {
     try {
       const stmt = this.db.prepare(sql).bind(...params);
@@ -961,659 +1154,445 @@ class D1Repository {
     }
   }
 }
-
 // src/d1/schemas.ts
-import { z } from "zod";
-var TradeRecordSchema = z.object({
-  id: z.string(),
-  signal_id: z.string().nullable().optional(),
-  timestamp: z.number().int().positive(),
-  exchange: z.string().min(1),
-  symbol: z.string().min(1),
-  action: z.string().min(1),
-  quantity: z.number().nullable(),
-  price: z.number().nullable(),
-  leverage: z.number().nullable(),
-  status: z.string().min(1),
-  error_message: z.string().nullable().optional(),
-  raw_response: z.string().nullable().optional(),
-  created_at: z.number().int().optional()
+import { z as z2 } from "zod";
+var TradeRecordSchema = z2.object({
+  id: z2.string(),
+  signal_id: z2.string().nullable().optional(),
+  timestamp: z2.number().int().positive(),
+  exchange: z2.string().min(1),
+  symbol: z2.string().min(1),
+  action: z2.string().min(1),
+  quantity: z2.number().nullable(),
+  price: z2.number().nullable(),
+  leverage: z2.number().nullable(),
+  status: z2.string().min(1),
+  error_message: z2.string().nullable().optional(),
+  raw_response: z2.string().nullable().optional(),
+  created_at: z2.number().int().optional()
 }).strict();
-var PositionRecordSchema = z.object({
-  id: z.string(),
-  exchange: z.string().min(1),
-  symbol: z.string().min(1),
-  side: z.enum(["LONG", "SHORT"]),
-  entry_price: z.number().nullable().optional(),
-  mark_price: z.number().nullable().optional(),
-  liquidation_price: z.number().nullable().optional(),
-  leverage: z.number().nullable().optional(),
-  size: z.number().nullable(),
-  unrealized_pnl: z.number().nullable().optional(),
-  status: z.enum(["OPEN", "CLOSED"]),
-  updated_at: z.number().int()
+var PositionRecordSchema = z2.object({
+  id: z2.string(),
+  exchange: z2.string().min(1),
+  symbol: z2.string().min(1),
+  side: z2.enum(["LONG", "SHORT"]),
+  entry_price: z2.number().nullable().optional(),
+  mark_price: z2.number().nullable().optional(),
+  liquidation_price: z2.number().nullable().optional(),
+  leverage: z2.number().nullable().optional(),
+  size: z2.number().nullable(),
+  unrealized_pnl: z2.number().nullable().optional(),
+  status: z2.enum(["OPEN", "CLOSED"]),
+  updated_at: z2.number().int()
 }).strict();
-var BalanceRecordSchema = z.object({
-  id: z.string(),
-  exchange: z.string().min(1),
-  asset: z.string().min(1),
-  free: z.number().nullable(),
-  used: z.number().nullable(),
-  total: z.number().nullable(),
-  timestamp: z.number().int().positive()
+var BalanceRecordSchema = z2.object({
+  id: z2.string(),
+  exchange: z2.string().min(1),
+  asset: z2.string().min(1),
+  free: z2.number().nullable(),
+  used: z2.number().nullable(),
+  total: z2.number().nullable(),
+  timestamp: z2.number().int().positive()
 }).strict();
-var SystemLogRecordSchema = z.object({
-  id: z.string(),
-  timestamp: z.number().int().optional(),
-  level: z.string().min(1),
-  service: z.string().min(1),
-  message: z.string().min(1),
-  details: z.string().nullable().optional()
+var SystemLogRecordSchema = z2.object({
+  id: z2.string(),
+  timestamp: z2.number().int().optional(),
+  level: z2.string().min(1),
+  service: z2.string().min(1),
+  message: z2.string().min(1),
+  details: z2.string().nullable().optional()
 }).strict();
-var TradeSignalRecordSchema = z.object({
-  signal_id: z.string(),
-  timestamp: z.number().int().positive(),
-  symbol: z.string().min(1),
-  signal_type: z.string().min(1),
-  source: z.string().nullable().optional(),
-  raw_data: z.string().nullable().optional(),
-  processed_at: z.number().int().optional()
+var TradeSignalRecordSchema = z2.object({
+  signal_id: z2.string(),
+  timestamp: z2.number().int().positive(),
+  symbol: z2.string().min(1),
+  signal_type: z2.string().min(1),
+  source: z2.string().nullable().optional(),
+  raw_data: z2.string().nullable().optional(),
+  processed_at: z2.number().int().optional()
 }).strict();
-// src/dashboard-manifest.ts
-import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "fs";
-import { join as join2 } from "path";
-var DASHBOARD_WORKER_PREFIX = {
-  hoox: "global:",
-  "trade-worker": "trade:",
-  "agent-worker": "agent:",
-  "telegram-worker": "bot:",
-  "d1-worker": "database:",
-  "email-worker": "email:",
-  "web3-wallet-worker": "wallet:",
-  "analytics-worker": "ai:",
-  "report-worker": "report:",
-  "pyne-worker": "pyne:"
-};
-var DASHBOARD_SECTION_PREFIX = {
-  global: "global:",
-  webhook: "webhook:",
-  routing: "routing:",
-  security: "webhook:",
-  trade: "trade:",
-  agent: "agent:",
-  bot: "bot:",
-  email: "email:",
-  signal: "email:",
-  database: "database:",
-  retention: "retention:",
-  cron: "cron:",
-  behavior: "behavior:",
-  risk: "trade:",
-  exchanges: "trade:",
-  fees: "trade:",
-  providers: "agent:",
-  models: "agent:",
-  ai: "ai:",
-  report: "report:",
-  pyne: "pyne:",
-  pyne_alerts: "pyne:"
-};
-var DASHBOARD_FIELD_KV_OVERRIDES = {
-  "webhook:tradingview_ip_check_enabled": "webhook:tradingview:ip_check_enabled",
-  "webhook:tradingview_allowed_ips": "webhook:tradingview:allowed_ips",
-  "exchanges:binance_enabled": "exchange:binance:enabled",
-  "exchanges:mexc_enabled": "exchange:mexc:enabled",
-  "exchanges:bybit_enabled": "exchange:bybit:enabled"
-};
-var DASHBOARD_SECTIONS_NOT_FLAT_KV = new Set([
-  "providers",
-  "models",
-  "cron",
-  "behavior"
-]);
-var DASHBOARD_SECTIONS_UI_SKIP = new Set([
-  "cron",
-  "behavior"
-]);
-function isDashboardSectionFlatKv(sectionId) {
-  return !DASHBOARD_SECTIONS_NOT_FLAT_KV.has(sectionId);
+// src/middleware/auth.ts
+function timingSafeEqual(a, b) {
+  const encoder = new TextEncoder;
+  const aBuf = encoder.encode(a);
+  const bBuf = encoder.encode(b);
+  const len = Math.max(aBuf.length, bBuf.length);
+  let result = aBuf.length === bBuf.length ? 0 : 1;
+  for (let i = 0;i < len; i++) {
+    const av = aBuf[i] ?? 0;
+    const bv = bBuf[i] ?? 0;
+    result |= av ^ bv;
+  }
+  return result === 0;
 }
-function isDashboardSectionEditable(sectionId) {
-  return !DASHBOARD_SECTIONS_UI_SKIP.has(sectionId);
+async function timingSafeEqualAsync(a, b) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle || typeof subtle.digest !== "function" || typeof subtle.timingSafeEqual !== "function") {
+    return timingSafeEqual(a, b);
+  }
+  const encoder = new TextEncoder;
+  const [providedHash, expectedHash] = await Promise.all([
+    subtle.digest("SHA-256", encoder.encode(a)),
+    subtle.digest("SHA-256", encoder.encode(b))
+  ]);
+  return subtle.timingSafeEqual(providedHash, expectedHash);
 }
-function buildDashboardKvKey(worker, fieldKey) {
-  const override = DASHBOARD_FIELD_KV_OVERRIDES[fieldKey];
-  if (override)
-    return override;
-  if (fieldKey.includes(":")) {
-    const [section, ...rest] = fieldKey.split(":");
-    const fieldName = rest.join(":");
-    if (section === "exchanges" && fieldName.endsWith("_enabled")) {
-      const exchange = fieldName.slice(0, -"_enabled".length);
-      if (exchange)
-        return `exchange:${exchange}:enabled`;
-    }
-    const mapped = DASHBOARD_SECTION_PREFIX[section ?? ""];
-    if (mapped)
-      return `${mapped}${fieldName}`;
-    return `${section}:${fieldName}`;
+function resolveOperatorApiKey(env) {
+  const preferred = env.OPERATOR_API_KEY;
+  if (typeof preferred === "string" && preferred.length > 0) {
+    return preferred;
   }
-  const workerPrefix = DASHBOARD_WORKER_PREFIX[worker] ?? "";
-  return `${workerPrefix}${fieldKey}`;
+  const legacy = env.INTERNAL_API_KEY;
+  if (typeof legacy === "string" && legacy.length > 0) {
+    return legacy;
+  }
+  return;
 }
-function stripJsonc(input) {
-  let out = "";
-  let i = 0;
-  let inString = false;
-  let stringChar = "";
-  while (i < input.length) {
-    const c = input[i];
-    const next = input[i + 1];
-    if (inString) {
-      out += c;
-      if (c === "\\" && i + 1 < input.length) {
-        out += next;
-        i += 2;
-        continue;
-      }
-      if (c === stringChar)
-        inString = false;
-      i++;
-      continue;
-    }
-    if (c === '"' || c === "'") {
-      inString = true;
-      stringChar = c;
-      out += c;
-      i++;
-      continue;
-    }
-    if (c === "/" && next === "/") {
-      while (i < input.length && input[i] !== `
-`)
-        i++;
-      continue;
-    }
-    if (c === "/" && next === "*") {
-      i += 2;
-      while (i < input.length && !(input[i] === "*" && input[i + 1] === "/"))
-        i++;
-      i += 2;
-      continue;
-    }
-    if (c === ",") {
-      let j = i + 1;
-      while (j < input.length && /\s/.test(input[j]))
-        j++;
-      if (j < input.length && (input[j] === "}" || input[j] === "]")) {
-        i++;
-        continue;
-      }
+async function requireAuth(request, env) {
+  return requireOperatorAuth(request, env);
+}
+async function requireOperatorAuth(request, env) {
+  const apiKey = resolveOperatorApiKey(env);
+  if (!apiKey) {
+    return new Response(JSON.stringify({
+      error: "Operator API key not configured",
+      hint: "Set OPERATOR_API_KEY (preferred) or INTERNAL_API_KEY on the Worker"
+    }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  const authHeader = request.headers.get("Authorization");
+  const expectedHeader = `Bearer ${apiKey}`;
+  if (!authHeader || !await timingSafeEqualAsync(authHeader, expectedHeader)) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return null;
+}
+function createOperatorAuthMiddleware() {
+  return async (request, env, _ctx) => {
+    const denied = await requireOperatorAuth(request, env);
+    if (denied)
+      return denied;
+    return;
+  };
+}
+function normalizeKeyNames(keyName) {
+  if (typeof keyName === "string") {
+    return [keyName];
+  }
+  return [...keyName];
+}
+function collectInternalAuthKeys(env, keyNames) {
+  const keys = [];
+  for (const name of normalizeKeyNames(keyNames)) {
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0) {
+      keys.push(value);
     }
-    out += c;
-    i++;
   }
-  return out;
+  return keys;
 }
-function parseFieldType(value) {
-  if (typeof value === "boolean")
-    return "boolean";
-  if (typeof value === "number")
-    return "number";
-  if (value === "true" || value === "false")
-    return "boolean";
-  if (value.trim().startsWith("{") || value.trim().startsWith("["))
-    return "json";
-  if (!Number.isNaN(Number(value)) && value.trim() !== "")
-    return "number";
-  return "text";
+function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
+  let matched = false;
+  for (const expected of expectedKeys) {
+    if (timingSafeEqual(providedKey, expected)) {
+      matched = true;
+    }
+  }
+  return matched;
 }
-function labelFromKey(key) {
-  return key.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+function internalAuthNotConfiguredResponse(keyNames) {
+  const label = normalizeKeyNames(keyNames).join(" | ");
+  return new Response(JSON.stringify({
+    success: false,
+    error: `Internal auth key(s) not configured: ${label}`
+  }), { status: 401, headers: { "Content-Type": "application/json" } });
 }
-function parseDashboardManifest(content, workerName, onError) {
-  try {
-    const raw = JSON.parse(stripJsonc(content));
-    const displayName = raw.display_name || raw.displayName || workerName;
-    const description = raw.description || "";
-    const sections = [];
-    if (raw.sections) {
-      for (const [sectionId, sectionData] of Object.entries(raw.sections)) {
-        const fields = [];
-        const sectionFields = sectionData.fields || {};
-        const sectionOptions = sectionData.options || {};
-        const sectionDescriptions = sectionData.descriptions || {};
-        const sectionValidation = sectionData.validation || {};
-        const sectionSecrets = sectionData.secrets || {};
-        const sectionSecretCommands = sectionData.secret_commands || {};
-        for (const [key, value] of Object.entries(sectionFields)) {
-          const field = {
-            key: `${sectionId}:${key}`,
-            label: labelFromKey(key),
-            type: parseFieldType(value),
-            default: value
-          };
-          if (sectionOptions[key]) {
-            field.type = "select";
-            field.options = sectionOptions[key].map((opt) => ({
-              value: String(opt),
-              label: String(opt)
-            }));
-          }
-          if (sectionDescriptions[key]) {
-            field.description = String(sectionDescriptions[key]);
-          }
-          if (sectionValidation[key]) {
-            field.validation = sectionValidation[key];
-          }
-          if (sectionSecrets[key]) {
-            field.kind = "secret";
-            field.cliCommand = sectionSecretCommands[key];
-          }
-          if (key.includes("kill_switch") || key.includes("drawdown") || key === "enabled" && sectionId === "global") {
-            if (field.kind !== "secret")
-              field.kind = "dangerous";
-          }
-          fields.push(field);
-        }
-        sections.push({
-          id: sectionId,
-          title: sectionData.title || labelFromKey(sectionId),
-          description: sectionData.description || `Configure ${sectionId} settings`,
-          icon: sectionData.icon,
-          priority: sectionData.priority !== undefined ? sectionData.priority : sections.length * 10,
-          fields
-        });
-      }
+function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
+    return internalAuthNotConfiguredResponse(keyName);
+  }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+  }
+  return null;
+}
+function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
+  return async (request, env, _ctx) => {
+    const expectedKeys = collectInternalAuthKeys(env, keyName);
+    if (expectedKeys.length === 0) {
+      return internalAuthNotConfiguredResponse(keyName);
     }
+    const providedKey = request.headers.get("X-Internal-Auth-Key");
+    if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
+    }
+    return;
+  };
+}
+function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
+  const expectedKeys = collectInternalAuthKeys(env, keyName);
+  if (expectedKeys.length === 0) {
     return {
-      worker: workerName,
-      displayName,
-      description,
-      sections: sections.sort((a, b) => a.priority - b.priority)
-    };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : `parse failed: ${String(err)}`;
-    onError?.(`dashboard.jsonc for ${workerName}: ${message}`);
-    return {
-      worker: workerName,
-      displayName: workerName,
-      description: "Failed to load configuration",
-      sections: []
+      authorized: false,
+      error: `${normalizeKeyNames(keyName).join(" | ")} not configured`
     };
   }
+  const providedKey = request.headers.get("X-Internal-Auth-Key");
+  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
+    return { authorized: false, error: "Unauthorized" };
+  }
+  return { authorized: true };
 }
-var DASHBOARD_WORKER_IDS = [
-  "hoox",
-  "trade-worker",
-  "agent-worker",
-  "telegram-worker",
-  "d1-worker",
-  "email-worker",
-  "web3-wallet-worker",
-  "analytics-worker",
-  "report-worker",
-  "pyne-worker"
+
+// src/service-bindings.ts
+var InternalAuthKeyFields = {
+  DEFAULT: "INTERNAL_KEY_BINDING",
+  D1_READ: "D1_READ_KEY_BINDING",
+  D1_WRITE: "D1_WRITE_KEY_BINDING",
+  TRADE_EXECUTE: "TRADE_EXECUTE_KEY_BINDING",
+  TRADE_READ: "TRADE_READ_KEY_BINDING",
+  TELEGRAM_ALERT: "TELEGRAM_INTERNAL_KEY_BINDING",
+  WALLET_EXECUTE: "WALLET_EXECUTE_KEY_BINDING",
+  AGENT: "AGENT_INTERNAL_KEY",
+  D1_INTERNAL_ALIAS: "D1_INTERNAL_KEY",
+  TRADE_INTERNAL_ALIAS: "TRADE_INTERNAL_KEY",
+  TELEGRAM_INTERNAL_ALIAS: "TELEGRAM_INTERNAL_KEY"
+};
+var D1_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_READ,
+  InternalAuthKeyFields.DEFAULT
 ];
-function dashboardWorkerDir(workerId) {
-  if (workerId === "hoox")
-    return "hoox-worker";
-  return workerId;
-}
-function fieldTypeToKv(t) {
-  if (t === "boolean")
-    return "boolean";
-  if (t === "number")
-    return "number";
-  return "string";
-}
-function defaultToString(value) {
-  if (typeof value === "string")
-    return value;
-  return JSON.stringify(value);
-}
-function isDocumentationField(fieldKey) {
-  const name = fieldKey.includes(":") ? fieldKey.slice(fieldKey.indexOf(":") + 1) : fieldKey;
-  return /^(GET|POST|PUT|PATCH|DELETE)\s+\//i.test(name);
+var D1_WRITE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_WRITE,
+  InternalAuthKeyFields.DEFAULT
+];
+var TRADE_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_EXECUTE,
+  InternalAuthKeyFields.DEFAULT,
+  InternalAuthKeyFields.AGENT
+];
+var TRADE_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_READ,
+  InternalAuthKeyFields.DEFAULT
+];
+var TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TELEGRAM_ALERT,
+  InternalAuthKeyFields.DEFAULT
+];
+var WALLET_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.WALLET_EXECUTE,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_D1_READ_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.D1_READ,
+  InternalAuthKeyFields.D1_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TRADE_EXECUTE,
+  InternalAuthKeyFields.TRADE_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+var DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
+  InternalAuthKeyFields.TELEGRAM_ALERT,
+  InternalAuthKeyFields.TELEGRAM_INTERNAL_ALIAS,
+  InternalAuthKeyFields.DEFAULT
+];
+function resolveInternalAuthKey(env, keyFields) {
+  return collectInternalAuthKeys(env, keyFields)[0];
 }
-function kvManifestFromDashboardManifests(manifests) {
-  const byKey = new Map;
-  for (const manifest of manifests) {
-    for (const section of manifest.sections) {
-      if (!isDashboardSectionFlatKv(section.id))
-        continue;
-      for (const field of section.fields) {
-        if (isDocumentationField(field.key))
-          continue;
-        const key = buildDashboardKvKey(manifest.worker, field.key);
-        if (!key || key.endsWith(":"))
-          continue;
-        const next = {
-          key,
-          type: fieldTypeToKv(field.type),
-          default: defaultToString(field.default),
-          description: field.description || `${manifest.displayName}: ${field.label}`,
-          secret: field.kind === "secret" ? true : undefined,
-          worker: manifest.worker
-        };
-        const prev = byKey.get(key);
-        if (!prev) {
-          byKey.set(key, next);
-          continue;
-        }
-        if (!prev.secret && next.secret)
-          prev.secret = true;
-        if ((!prev.description || prev.description.length < 8) && next.description) {
-          prev.description = next.description;
-        }
-      }
-    }
+
+class ServiceAuthError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ServiceAuthError";
   }
-  const keys = [...byKey.values()].sort((a, b) => a.key.localeCompare(b.key));
-  return { namespace: "CONFIG_KV", keys };
-}
-function loadDashboardKvManifestFromRoot(root, onError) {
-  return kvManifestFromDashboardManifests(loadDashboardManifestsFromRoot(root, onError));
 }
-function tryReadFile(path) {
-  try {
-    if (!existsSync2(path))
-      return null;
-    return readFileSync2(path, "utf-8");
-  } catch {
-    return null;
+function authenticatedServiceFetch(binding, env, path, body, options) {
+  const key = options?.internalKey ?? (options?.internalKeyFields ? resolveInternalAuthKey(env, options.internalKeyFields) : env.INTERNAL_KEY_BINDING);
+  if (!key) {
+    const label = options?.internalKeyFields ? Array.isArray(options.internalKeyFields) ? options.internalKeyFields.join(" | ") : options.internalKeyFields : "INTERNAL_KEY_BINDING";
+    return Promise.reject(new ServiceAuthError(`${label} not configured`));
   }
-}
-function loadDashboardManifestsFromRoot(root, onError) {
-  const manifests = [];
-  const seen = new Set;
-  const workersDir = join2(root, "workers");
-  if (!existsSync2(workersDir))
-    return manifests;
-  const warn = onError ?? ((message) => {
-    console.warn(`[dashboard-manifest] ${message}`);
+  return serviceFetch(binding, path, body, {
+    method: options?.method,
+    timeout: options?.timeout,
+    headers: {
+      ...options?.headers,
+      "X-Internal-Auth-Key": key
+    }
   });
-  for (const workerId of DASHBOARD_WORKER_IDS) {
-    const dir = dashboardWorkerDir(workerId);
-    const path = join2(workersDir, dir, "dashboard.jsonc");
-    const content = tryReadFile(path);
-    if (!content)
-      continue;
-    const m = parseDashboardManifest(content, workerId, warn);
-    if (m.sections.length > 0) {
-      manifests.push(m);
-      seen.add(workerId);
-    } else if (m.description === "Failed to load configuration") {}
-  }
-  try {
-    for (const entry of readdirSync(workersDir)) {
-      if (entry === "dashboard")
-        continue;
-      const workerId = entry === "hoox-worker" || entry === "hoox" ? "hoox" : entry;
-      if (seen.has(workerId))
-        continue;
-      const path = join2(workersDir, entry, "dashboard.jsonc");
-      const content = tryReadFile(path);
-      if (!content)
-        continue;
-      const m = parseDashboardManifest(content, workerId, warn);
-      if (m.sections.length > 0) {
-        manifests.push(m);
-        seen.add(workerId);
-      }
-    }
-  } catch {}
-  const publicDir = join2(workersDir, "dashboard", "public", "workers");
-  if (existsSync2(publicDir)) {
-    try {
-      for (const file of readdirSync(publicDir)) {
-        if (!file.endsWith(".jsonc") && !file.endsWith(".json"))
-          continue;
-        const base = file.replace(/\.jsonc?$/, "");
-        const workerId = base === "hoox-worker" || base === "hoox" ? "hoox" : base;
-        if (seen.has(workerId))
-          continue;
-        const content = tryReadFile(join2(publicDir, file));
-        if (!content)
-          continue;
-        const m = parseDashboardManifest(content, workerId, warn);
-        if (m.sections.length > 0) {
-          manifests.push(m);
-          seen.add(workerId);
-        }
-      }
-    } catch {}
-  }
-  return manifests;
-}
-
-// src/exchange-client.ts
-class ExchangeRouter {
-  providers = new Map;
-  registerProvider(provider) {
-    this.providers.set(provider.name.toLowerCase(), provider);
-  }
-  route(exchange, env, options) {
-    const key = exchange.toLowerCase();
-    const provider = this.providers.get(key);
-    if (!provider) {
-      throw new Error(`Unsupported exchange: ${exchange}`);
-    }
-    if (options?.testnet && provider.supportsTestTrading === false) {
-      throw new Error(`TEST_TRADING_UNSUPPORTED: ${exchange} does not support test/sandbox trading via API`);
-    }
-    if (!provider.hasCredentials(env)) {
-      throw new Error(`API secret bindings not configured or accessible for ${exchange}`);
-    }
-    return { exchange: key, client: provider.createClient(env, options) };
-  }
 }
-
-class BaseExchangeClient {
-  apiKey;
-  apiSecret;
-  baseUrl;
-  isTestnet;
-  constructor(config) {
-    if (!config.apiKey || !config.apiSecret) {
-      throw new Error("API key and secret are required.");
-    }
-    this.apiKey = config.apiKey;
-    this.apiSecret = config.apiSecret;
-    this.baseUrl = config.baseUrl || this.getDefaultBaseUrl();
-    this.isTestnet = config.testnet || false;
-  }
-  async fetch(method, path, params) {
-    const url = `${this.baseUrl}${path}`;
-    const headers = this.buildHeaders(method, path, params);
-    const body = params ? new URLSearchParams(params).toString() : undefined;
-    const response = await fetch(url, {
-      method,
-      headers,
-      body: method !== "GET" ? body : undefined
-    });
-    if (!response.ok) {
-      const error = await response.text();
-      throw new Error(`Exchange API error: ${response.status} - ${error}`);
-    }
-    return response.json();
-  }
-  async openLong(symbol, quantity, price, orderType = "MARKET") {
-    return this.executeTrade({
-      symbol,
-      side: "long",
-      orderType,
-      quantity,
-      price
-    });
-  }
-  async openShort(symbol, quantity, price, orderType = "MARKET") {
-    return this.executeTrade({
-      symbol,
-      side: "short",
-      orderType,
-      quantity,
-      price
-    });
-  }
-  async closeLong(symbol, quantity) {
-    return this.executeTrade({
-      symbol,
-      side: "long",
-      quantity,
-      reduceOnly: true
-    });
-  }
-  async closeShort(symbol, quantity) {
-    return this.executeTrade({
-      symbol,
-      side: "short",
-      quantity,
-      reduceOnly: true
-    });
-  }
+function serviceFetch(binding, path, body, options) {
+  const timeout = options?.timeout ?? 30000;
+  return binding.fetch(`http://internal${path}`, {
+    method: options?.method ?? "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers
+    },
+    body: body != null ? JSON.stringify(body) : undefined,
+    signal: AbortSignal.timeout(timeout)
+  });
 }
-
-// src/exchanges/base-exchange-client.ts
-class BaseExchangeClient2 {
-  apiKey;
-  apiSecret;
-  baseUrl;
-  isTestnet;
-  importedKeyPromise;
-  constructor(apiKey, apiSecret, options) {
-    if (!apiKey || !apiSecret) {
-      throw new Error(this.getErrorMessagePrefix() + "API key and secret are required.");
-    }
-    this.apiKey = apiKey;
-    this.apiSecret = apiSecret;
-    this.isTestnet = options?.testnet ?? false;
-    this.baseUrl = options?.baseUrl ?? this.getDefaultBaseUrl();
-    this.importedKeyPromise = this.importKey();
-  }
-  get testnet() {
-    return this.isTestnet;
-  }
-  getErrorMessagePrefix() {
-    return "";
-  }
-  generateSignature(_params) {
-    throw new Error("generateSignature must be implemented by subclass");
-  }
-  buildHeaders(_method, _path, _params) {
-    return new Headers;
-  }
-  async importKey() {
-    const encoder = new TextEncoder;
-    return crypto.subtle.importKey("raw", encoder.encode(this.apiSecret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  }
-  async cryptoSign(data) {
-    const encoder = new TextEncoder;
-    const key = await this.importedKeyPromise;
-    const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
-    return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
-  }
-  async fetch(method, path, params) {
-    const url = `${this.baseUrl}${path}`;
-    const headers = this.buildHeaders(method, path, params);
-    const body = params ? new URLSearchParams(params).toString() : undefined;
-    const response = await fetch(url, {
-      method,
-      headers,
-      body: method !== "GET" ? body : undefined
-    });
-    if (!response.ok) {
-      const error = await response.text();
-      throw new Error(`Exchange API error: ${response.status} - ${error}`);
-    }
-    return response.json();
-  }
-  setLeverage(_symbol, _leverage) {
-    throw new Error("setLeverage must be implemented by subclass");
-  }
-  executeTrade(_params) {
-    throw new Error("executeTrade must be implemented by subclass");
-  }
-  getAccountInfo() {
-    throw new Error("getAccountInfo must be implemented by subclass");
-  }
-  getPositions(_symbol) {
-    throw new Error("getPositions must be implemented by subclass");
-  }
-  async openLong(symbol, quantity, price, orderType = "MARKET") {
-    return this.executeTrade({
-      symbol,
-      side: "BUY",
-      orderType,
-      quantity,
-      price
-    });
-  }
-  async openShort(symbol, quantity, price, orderType = "MARKET") {
-    return this.executeTrade({
-      symbol,
-      side: "SELL",
-      orderType,
-      quantity,
-      price
-    });
-  }
-  async closeLong(symbol, quantity) {
-    return this.executeTrade({
-      symbol,
-      side: "SELL",
-      orderType: "MARKET",
-      quantity,
-      reduceOnly: true
-    });
-  }
-  async closeShort(symbol, quantity) {
-    return this.executeTrade({
-      symbol,
-      side: "BUY",
-      orderType: "MARKET",
-      quantity,
-      reduceOnly: true
-    });
-  }
+// src/test-utils.ts
+function createMockKV(overrides) {
+  return {
+    get: async (_key) => null,
+    put: async (_key, _value, _options) => {},
+    delete: async (_key) => {},
+    list: async (_options) => ({
+      keys: []
+    }),
+    ...overrides
+  };
 }
-// src/format-time.ts
-function formatRelativeTime(timestampMs, nowMs) {
-  const now = nowMs ?? Date.now();
-  const diffMs = now - timestampMs;
-  if (diffMs < 0)
-    return "just now";
-  if (timestampMs === 0)
-    return "\u2014";
-  const seconds = Math.floor(diffMs / 1000);
-  const minutes = Math.floor(seconds / 60);
-  const hours = Math.floor(minutes / 60);
-  const days = Math.floor(hours / 24);
-  if (seconds < 60)
-    return "< 1m ago";
-  if (minutes < 60)
-    return `${minutes}m ago`;
-  if (hours < 24)
-    return `${hours}h ago`;
-  if (days < 30)
-    return `${days}d ago`;
-  return `> 30d ago`;
+function createMockR2(overrides) {
+  return {
+    put: async (key, _value, _options) => ({
+      key
+    }),
+    get: async (_key) => null,
+    delete: async (_key) => {},
+    list: async (_options) => ({
+      objects: []
+    }),
+    ...overrides
+  };
 }
-function formatDuration(durationMs) {
-  const seconds = Math.floor(durationMs / 1000);
-  const minutes = Math.floor(seconds / 60);
-  const hours = Math.floor(minutes / 60);
-  if (hours > 0) {
-    const remainMin = minutes % 60;
-    return remainMin > 0 ? `${hours}h ${remainMin}m` : `${hours}h`;
-  }
-  if (minutes > 0) {
-    const remainSec = seconds % 60;
-    return remainSec > 0 ? `${minutes}m ${remainSec}s` : `${minutes}m`;
-  }
-  return `${seconds}s`;
+function createMockPreparedStatement() {
+  return {
+    bind: (..._params) => createMockPreparedStatement(),
+    run: async () => ({ success: true }),
+    all: async () => ({ success: true, results: [] }),
+    first: async () => null
+  };
 }
-
+function createMockD1(overrides) {
+  return {
+    prepare: (_sql) => createMockPreparedStatement(),
+    dump: async () => new ArrayBuffer(0),
+    batch: async (_statements) => [],
+    exec: async (_sql) => ({ success: true }),
+    ...overrides
+  };
+}
+function createMockFetcher(response) {
+  const defaultResponse = response ?? new Response("OK", { status: 200 });
+  return {
+    fetch: async (_request, _init) => defaultResponse
+  };
+}
+function createMockAnalyticsEngine() {
+  return {
+    writeDataPoint: (_data) => {}
+  };
+}
+function createMockAnalyticsEngineDataset() {
+  return createMockAnalyticsEngine();
+}
+function createMockQueue() {
+  return {
+    send: async (_body, _options) => {},
+    sendBatch: async (_messages) => {}
+  };
+}
+function createMockVectorizeIndex(overrides) {
+  return {
+    query: async (_vector, _options) => ({
+      matches: []
+    }),
+    upsert: async (_vectors) => {},
+    deleteByIds: async (_ids) => {},
+    describe: async () => ({ dimension: 384, totalVectors: 0 }),
+    ...overrides
+  };
+}
+function createMockAi(overrides) {
+  return {
+    run: async (_model, _input) => ({}),
+    ...overrides
+  };
+}
+function createMockExecutionContext(overrides) {
+  return {
+    waitUntil: (_promise) => {},
+    passThroughOnException: () => {},
+    ...overrides
+  };
+}
+function createMockSecretsStore(overrides) {
+  return {
+    get: async (_key) => null,
+    put: async (_key, _value) => {},
+    delete: async (_key) => {},
+    ...overrides
+  };
+}
+function createMockEnv(overrides) {
+  return overrides;
+}
+// src/colors.ts
+var Colors = {
+  background: "#050508",
+  foreground: "#E8E8F0",
+  card: "#0A0A0F",
+  border: "#232330",
+  muted: "#8B8B9E",
+  "muted-foreground": "#6E6E84",
+  dim: "#3C3C50",
+  accent: "#818CF8",
+  "accent-dim": "#6366F1",
+  success: "#34D399",
+  warning: "#FBBF24",
+  error: "#FB7185",
+  info: "#38BDF8",
+  text: "#E8E8F0",
+  "text-muted": "#8B8B9E",
+  panel: "#0A0A0F",
+  divider: "#232330",
+  highlight: "#22D3EE",
+  backdrop: "#000000"
+};
+var CoolBracketPalette = [
+  "#22D3EE",
+  "#38BDF8",
+  "#60A5FA",
+  "#818CF8",
+  "#A78BFA",
+  "#C084FC",
+  "#E879F9",
+  "#A78BFA",
+  "#818CF8",
+  "#38BDF8"
+];
+var ConnectionStatusColor = {
+  connected: Colors.success,
+  polling: Colors.highlight,
+  reconnecting: Colors.warning,
+  offline: Colors.error
+};
+var WorkerStatusColor = {
+  operational: Colors.success,
+  degraded: Colors.warning,
+  down: Colors.error
+};
+var LogLevelColor = {
+  error: Colors.error,
+  warn: Colors.warning,
+  info: Colors.foreground,
+  debug: Colors.muted
+};
+var AlertSeverityColor = {
+  info: Colors.info,
+  warning: Colors.warning,
+  error: Colors.error,
+  critical: Colors.error
+};
 // src/formatters.ts
 function formatNumber(n) {
   if (!isFinite(n))
@@ -1648,7 +1627,7 @@ function formatCompactCurrency(n) {
     return `${sign}$${(abs / 1000).toFixed(2)}K`;
   return `${sign}$${abs.toFixed(2)}`;
 }
-function formatDuration2(seconds) {
+function formatDuration(seconds) {
   if (!isFinite(seconds) || seconds < 0)
     return "\u2014";
   const d = Math.floor(seconds / 86400);
@@ -1689,7 +1668,7 @@ function formatTimestamp(iso) {
     return iso;
   }
 }
-function formatRelativeTime2(timestamp) {
+function formatRelativeTime(timestamp) {
   const now = Date.now();
   const diff = now - timestamp;
   if (diff < 0)
@@ -1713,7 +1692,7 @@ function formatPercent(n, decimals = 2) {
   return `${sign}${n.toFixed(decimals)}%`;
 }
 function formatUptime(seconds) {
-  return formatDuration2(seconds);
+  return formatDuration(seconds);
 }
 function formatLatency(ms) {
   if (!isFinite(ms))
@@ -1737,906 +1716,996 @@ function formatCpu(ms) {
     return "\u2014";
   return `${ms.toFixed(1)}ms`;
 }
-
-// src/health.ts
-function healthCheck(options) {
-  const result = {
-    status: "ok",
-    timestamp: new Date().toISOString()
+// src/config.ts
+import {
+  readFileSync,
+  writeFileSync,
+  existsSync,
+  mkdirSync,
+  chmodSync,
+  statSync
+} from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var HOX_DIR = join(homedir(), ".hoox");
+var CONFIG_PATH = join(HOX_DIR, "config.json");
+var HOOX_DIR_MODE = 448;
+var HOOX_CONFIG_FILE_MODE = 384;
+var DEFAULT_CONFIG = {
+  apiUrl: "http://localhost:8787",
+  apiToken: "",
+  transport: "public",
+  refreshIntervalMs: 500,
+  theme: "dark",
+  activeExchanges: ["binance", "bybit", "mexc"],
+  notifications: {
+    alerts: true,
+    trades: true,
+    debug: false,
+    system: true
+  },
+  soundEnabled: true,
+  defaultView: "dashboard"
+};
+function readConfigSync() {
+  const envConfig = {
+    apiUrl: process.env.HOOX_API_URL,
+    apiToken: process.env.HOOX_API_TOKEN
+  };
+  let fileConfig = {};
+  try {
+    if (existsSync(CONFIG_PATH)) {
+      fileConfig = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    }
+  } catch {}
+  return {
+    ...DEFAULT_CONFIG,
+    ...fileConfig,
+    ...Object.fromEntries(Object.entries(envConfig).filter(([_, v]) => v !== undefined))
   };
-  if (options?.worker !== undefined && options?.worker !== null)
-    result.service = options.worker;
-  if (options?.version !== undefined && options?.version !== null)
-    result.version = options.version;
-  if (options?.details)
-    result.details = options.details;
-  return createSuccessResponse(result);
 }
-
-// src/legal.ts
-var COPYRIGHT = `Copyright (C) ${new Date().getFullYear()} Hoox Team. All rights reserved.`;
-var TRADEMARKS = [
-  "TradingView\xAE is a registered trademark of TradingView, Inc.",
-  "Cloudflare\xAE is a registered trademark of Cloudflare, Inc."
-];
-var TRADEMARK_NOTICE = TRADEMARKS.join(`
-`);
-var DISCLAIMER = "DISCLAIMER: This software is provided for educational and informational purposes only. " + "Trading cryptocurrencies and other financial instruments involves substantial risk of loss. " + "No guarantee of profits or protection against losses is made or implied. " + "Past performance does not indicate future results. Use at your own risk.";
-var FULL_LEGAL_NOTICE = `${COPYRIGHT}
-
-${TRADEMARK_NOTICE}
-
-${DISCLAIMER}`;
-var DISCLAIMER_HEADER = "X-Disclaimer";
-
-// src/types.ts
-import { z as z2 } from "zod";
-var TradeActionSchema = z2.enum([
-  "LONG",
-  "SHORT",
-  "CLOSE_LONG",
-  "CLOSE_SHORT"
-]);
-var MAX_WEBHOOK_LEVERAGE = 125;
-var MAX_WEBHOOK_QUANTITY = 1e6;
-var WebhookPayloadSchema = z2.object({
-  exchange: z2.string().min(1),
-  action: TradeActionSchema,
-  symbol: z2.string().min(1).max(20),
-  quantity: z2.number().positive().finite().max(MAX_WEBHOOK_QUANTITY),
-  price: z2.number().positive().finite().optional(),
-  orderType: z2.string().optional(),
-  leverage: z2.number().int().positive().max(MAX_WEBHOOK_LEVERAGE).optional(),
-  test: z2.boolean().optional()
-}).strict();
-var TradeQueueMessageSchema = z2.object({
-  requestId: z2.string().min(1).max(128),
-  exchange: z2.string().min(1).max(64),
-  action: TradeActionSchema,
-  symbol: z2.string().min(1).max(32),
-  quantity: z2.number().positive().finite().max(MAX_WEBHOOK_QUANTITY),
-  price: z2.number().positive().finite().optional(),
-  leverage: z2.number().int().positive().max(MAX_WEBHOOK_LEVERAGE).optional(),
-  test: z2.boolean().optional(),
-  idempotencyKey: z2.string().min(1).max(512).optional(),
-  queuedAt: z2.string().min(1).max(64)
-}).strict();
-var TradeSignalSchema = z2.object({
-  id: z2.number().int().positive().optional(),
-  source: z2.string().min(1),
-  symbol: z2.string().min(1),
-  action: TradeActionSchema,
-  price: z2.number().positive().finite().optional(),
-  quantity: z2.number().positive().finite(),
-  leverage: z2.number().int().positive().optional(),
-  status: z2.enum(["pending", "executed", "failed", "skipped"]).optional(),
-  createdAt: z2.string().optional(),
-  executedAt: z2.string().optional(),
-  error: z2.string().optional()
-}).strict();
-var PositionSchema = z2.object({
-  id: z2.string(),
-  symbol: z2.string().min(1),
-  side: TradeActionSchema,
-  quantity: z2.number().positive(),
-  entry_price: z2.number().positive(),
-  current_price: z2.number().positive(),
-  unrealized_pnl: z2.number(),
-  timestamp: z2.number().int().positive()
-}).strict();
-var BalanceSchema = z2.object({
-  asset: z2.string().min(1),
-  free: z2.number().min(0),
-  locked: z2.number().min(0),
-  timestamp: z2.number().int().positive()
-}).strict();
-
-// src/kill-switch.ts
-var KILL_SWITCH_ACTIVE_PREFIX = "KILL_SWITCH_ACTIVE";
-var KILL_SWITCH_KEYS = [
-  KV_TRADE_KILL_SWITCH,
-  KV_GLOBAL_KILL_SWITCH
-];
-function isTruthyKillSwitchFlag(value) {
-  if (value == null)
-    return false;
-  const v = value.trim().toLowerCase();
-  return v === "true" || v === "1" || v === "yes" || v === "on";
+async function readConfig() {
+  return readConfigSync();
 }
-async function checkKillSwitch(kv, options) {
-  const onMissingKv = options?.onMissingKv ?? "open";
-  const onReadError = options?.onReadError ?? "closed";
-  if (!kv) {
-    if (onMissingKv === "closed") {
-      return { enabled: true, source: "missing_kv" };
-    }
-    return { enabled: false };
+function ensureHooxDirSecure(dir = HOX_DIR) {
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: HOOX_DIR_MODE });
   }
   try {
-    const values = await Promise.all(KILL_SWITCH_KEYS.map(async (key) => ({
-      key,
-      value: await kv.get(key)
-    })));
-    for (const { key, value } of values) {
-      if (isTruthyKillSwitchFlag(value)) {
-        return { enabled: true, source: key };
-      }
-    }
-    return { enabled: false };
-  } catch (error) {
-    const errorStr = String(error);
-    if (onReadError === "closed") {
-      return { enabled: true, source: "read_error", error: errorStr };
-    }
-    return { enabled: false, error: errorStr };
-  }
-}
-async function isTradingPaused(kv, options) {
-  const result = await checkKillSwitch(kv, options);
-  return result.enabled;
+    chmodSync(dir, HOOX_DIR_MODE);
+  } catch {}
 }
-
-// src/kvUtils.ts
-async function logKvTimestamp(env, prefix = "timestamp") {
-  const timestamp = new Date().toISOString();
-  const key = `${prefix}_${timestamp}`;
+function writeSecureFileSync(filePath, contents, mode = HOOX_CONFIG_FILE_MODE) {
+  writeFileSync(filePath, contents, { encoding: "utf-8", mode });
   try {
-    await env.REPORT_KV.put(key, timestamp);
-  } catch (error) {
-    console.error(`Failed to log timestamp to KV: ${toError(error, "Unknown error")}`);
-  }
+    chmodSync(filePath, mode);
+  } catch {}
 }
-var KV_BULK_GET_MAX_KEYS = 100;
-async function tryBulkGetChunk(kv, chunk) {
+function isUnixModeGroupOrWorldAccessible(mode) {
+  return (mode & 63) !== 0;
+}
+function isConfigWorldOrGroupReadable(filePath = CONFIG_PATH) {
   try {
-    const result = await kv.get([...chunk]);
-    if (!(result instanceof Map)) {
-      return null;
-    }
-    return chunk.map((key) => result.get(key) ?? null);
+    if (!existsSync(filePath))
+      return false;
+    return isUnixModeGroupOrWorldAccessible(statSync(filePath).mode & 511);
   } catch {
-    return null;
+    return false;
   }
 }
-async function kvGetMany(kv, keys) {
-  if (keys.length === 0)
-    return [];
-  const out = new Array(keys.length);
-  let offset = 0;
-  while (offset < keys.length) {
-    const chunk = keys.slice(offset, offset + KV_BULK_GET_MAX_KEYS);
-    const bulk = await tryBulkGetChunk(kv, chunk);
-    if (bulk === null) {
-      const rest = await Promise.all(keys.slice(offset).map((key) => kv.get(key)));
-      for (let i = 0;i < rest.length; i++) {
-        out[offset + i] = rest[i] ?? null;
-      }
-      return out;
-    }
-    for (let i = 0;i < bulk.length; i++) {
-      out[offset + i] = bulk[i] ?? null;
-    }
-    offset += chunk.length;
-  }
-  return out;
+function formatConfigPermissionWarning(filePath = CONFIG_PATH) {
+  if (!isConfigWorldOrGroupReadable(filePath))
+    return null;
+  return `Warning: ${filePath} is group/world-accessible. ` + `Run: chmod 600 ${filePath}  (and chmod 700 on the parent dir). ` + `This file may contain apiToken / operator secrets.`;
 }
-async function kvGetManyAsRecord(kv, keys) {
-  const values = await kvGetMany(kv, keys);
-  const out = {};
-  for (let i = 0;i < keys.length; i++) {
-    out[keys[i]] = values[i] ?? null;
+function writeConfigSync(config) {
+  try {
+    ensureHooxDirSecure(HOX_DIR);
+    writeSecureFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), HOOX_CONFIG_FILE_MODE);
+  } catch (err) {
+    console.error("Failed to write config:", err);
   }
-  return out;
 }
-async function kvPutMany(kv, entries) {
-  if (entries.length === 0)
-    return;
-  await Promise.all(entries.map((entry) => kv.put(entry.key, entry.value, entry.options)));
+async function writeConfig(config) {
+  writeConfigSync(config);
 }
-function headersToObject(headers) {
-  const result = {};
-  if (!headers)
-    return result;
-  try {
-    headers.forEach((value, key) => {
-      result[key] = value;
-    });
-  } catch (error) {
-    console.error(`Error converting headers to object: ${toError(error, "Unknown error")}`);
+var VALID_TRANSPORTS = new Set([
+  "public",
+  "access",
+  "mtls",
+  "tunnel"
+]);
+function validateConfig(config) {
+  const errors = [];
+  if (config.apiUrl && !config.apiUrl.startsWith("http")) {
+    errors.push("apiUrl must start with http:// or https://");
   }
-  return result;
+  if (config.refreshIntervalMs !== undefined && config.refreshIntervalMs < 100) {
+    errors.push("refreshIntervalMs must be >= 100ms");
+  }
+  if (config.theme && !["dark", "light"].includes(config.theme)) {
+    errors.push('theme must be "dark" or "light"');
+  }
+  if (config.transport !== undefined && !VALID_TRANSPORTS.has(config.transport)) {
+    errors.push('transport must be "public" | "access" | "mtls" | "tunnel"');
+  }
+  return errors;
 }
 
-// src/queue-handler.ts
-async function mapPool(items, concurrency, fn) {
-  if (items.length === 0)
-    return;
-  const limit = Math.min(Math.max(1, concurrency), items.length);
-  if (limit === 1) {
-    for (const item of items) {
-      await fn(item);
+// src/index.ts
+init_api_client();
+init_sse();
+init_operator_transport();
+
+// src/path-utils.ts
+import {
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  writeFileSync as writeFileSync2,
+  chmodSync as chmodSync2
+} from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname, join as join2, resolve } from "path";
+function createHooxPath(path) {
+  return path;
+}
+function getHooxHome() {
+  try {
+    const override = process.env.HOOX_HOME?.trim();
+    if (override) {
+      return createHooxPath(resolve(override));
     }
-    return;
-  }
-  let nextIndex = 0;
-  async function worker() {
-    while (true) {
-      const i = nextIndex++;
-      if (i >= items.length)
-        return;
-      await fn(items[i]);
+    const home = homedir2();
+    if (!home || home.length === 0) {
+      return createHooxPath(resolve(process.cwd(), ".hoox"));
     }
+    return createHooxPath(join2(home, ".hoox"));
+  } catch {
+    return createHooxPath(resolve(process.cwd(), ".hoox"));
   }
-  await Promise.all(Array.from({ length: limit }, () => worker()));
 }
-function createQueueHandler(options) {
-  const {
-    maxRetries,
-    backoffDelays,
-    onMessage,
-    onRetry,
-    onDLQ,
-    logger,
-    concurrency: concurrencyOpt
-  } = options;
-  const concurrency = typeof concurrencyOpt === "number" && Number.isFinite(concurrencyOpt) && concurrencyOpt >= 1 ? Math.floor(concurrencyOpt) : 1;
-  async function processMessage(msg) {
-    const attemptNumber = msg.attempts || 0;
-    const logId = `[${msg.id}]`;
-    try {
-      logger?.info(`${logId} Processing message (attempt ${attemptNumber + 1})`);
-      await onMessage(msg.body, attemptNumber);
-      logger?.info(`${logId} Message processed successfully`);
-    } catch (error) {
-      const errorMsg = error instanceof Error ? error.message : String(error);
-      if (attemptNumber < maxRetries) {
-        const delaySeconds = backoffDelays[attemptNumber] ?? backoffDelays[backoffDelays.length - 1] ?? 0;
-        logger?.info(`${logId} Retrying in ${delaySeconds}s (attempt ${attemptNumber + 2}/${maxRetries + 1})`);
-        await onRetry?.(msg.body, attemptNumber, errorMsg, delaySeconds);
-        msg.retry({ delaySeconds });
-      } else {
-        logger?.error(`${logId} Max retries exceeded (${maxRetries + 1} attempts), moving to DLQ`);
-        await onDLQ?.(msg.body, attemptNumber, errorMsg);
-      }
+function isHooxSetupRoot(dir) {
+  if (!dir)
+    return false;
+  try {
+    const root = resolve(dir);
+    if (!existsSync2(join2(root, "packages", "cli", "package.json"))) {
+      return false;
     }
+    return existsSync2(join2(root, "wrangler.jsonc")) || existsSync2(join2(root, "wrangler.jsonc.example")) || existsSync2(join2(root, "workers")) || existsSync2(join2(root, ".gitmodules"));
+  } catch {
+    return false;
   }
-  return async (batch) => {
-    await mapPool(batch.messages, concurrency, processMessage);
-  };
 }
-
-// src/middleware/auth.ts
-function timingSafeEqual(a, b) {
-  const encoder = new TextEncoder;
-  const aBuf = encoder.encode(a);
-  const bBuf = encoder.encode(b);
-  const len = Math.max(aBuf.length, bBuf.length);
-  let result = aBuf.length === bBuf.length ? 0 : 1;
-  for (let i = 0;i < len; i++) {
-    const av = aBuf[i] ?? 0;
-    const bv = bBuf[i] ?? 0;
-    result |= av ^ bv;
-  }
-  return result === 0;
+function getRememberedMonorepoPath() {
+  return resolveHooxPath("config/monorepo.json");
 }
-async function timingSafeEqualAsync(a, b) {
-  const subtle = globalThis.crypto?.subtle;
-  if (!subtle || typeof subtle.digest !== "function" || typeof subtle.timingSafeEqual !== "function") {
-    return timingSafeEqual(a, b);
+function getRememberedMonorepoRoot() {
+  try {
+    const path = getRememberedMonorepoPath();
+    if (!existsSync2(path))
+      return null;
+    const raw = readFileSync2(path, "utf-8");
+    const data = JSON.parse(raw);
+    if (!data.root || typeof data.root !== "string")
+      return null;
+    const resolved = resolve(data.root);
+    return isHooxSetupRoot(resolved) ? resolved : null;
+  } catch {
+    return null;
   }
-  const encoder = new TextEncoder;
-  const [providedHash, expectedHash] = await Promise.all([
-    subtle.digest("SHA-256", encoder.encode(a)),
-    subtle.digest("SHA-256", encoder.encode(b))
-  ]);
-  return subtle.timingSafeEqual(providedHash, expectedHash);
 }
-function resolveOperatorApiKey(env) {
-  const preferred = env.OPERATOR_API_KEY;
-  if (typeof preferred === "string" && preferred.length > 0) {
-    return preferred;
-  }
-  const legacy = env.INTERNAL_API_KEY;
-  if (typeof legacy === "string" && legacy.length > 0) {
-    return legacy;
+function rememberMonorepoRoot(root) {
+  try {
+    const resolved = resolve(root);
+    if (!isHooxSetupRoot(resolved))
+      return false;
+    const configDir = getHooxConfigDir();
+    mkdirSync2(configDir, { recursive: true, mode: 448 });
+    try {
+      chmodSync2(configDir, 448);
+    } catch {}
+    const payload = {
+      root: resolved,
+      updatedAt: new Date().toISOString()
+    };
+    const path = getRememberedMonorepoPath();
+    writeFileSync2(path, JSON.stringify(payload, null, 2) + `
+`, {
+      mode: 384
+    });
+    try {
+      chmodSync2(path, 384);
+    } catch {}
+    return true;
+  } catch {
+    return false;
   }
-  return;
 }
-async function requireAuth(request, env) {
-  return requireOperatorAuth(request, env);
+function findHooxSetupRoot(startDir = process.cwd()) {
+  let dir = resolve(startDir);
+  for (;; ) {
+    if (isHooxSetupRoot(dir))
+      return dir;
+    const parent = dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
 }
-async function requireOperatorAuth(request, env) {
-  const apiKey = resolveOperatorApiKey(env);
-  if (!apiKey) {
-    return new Response(JSON.stringify({
-      error: "Operator API key not configured",
-      hint: "Set OPERATOR_API_KEY (preferred) or INTERNAL_API_KEY on the Worker"
-    }), { status: 401, headers: { "Content-Type": "application/json" } });
+function resolveHooxRuntimeRoot(options) {
+  const env = options?.env ?? process.env;
+  const cwd = resolve(options?.cwd ?? process.cwd());
+  const globalRepo = getHooxRepoPath();
+  const remembered = options?.skipRemembered ? null : getRememberedMonorepoRoot();
+  const envRepo = env.HOOX_REPO?.trim();
+  if (envRepo) {
+    const resolved = resolve(envRepo);
+    if (isHooxSetupRoot(resolved)) {
+      return {
+        root: resolved,
+        source: "env",
+        checked: {
+          env: resolved,
+          cwd: findHooxSetupRoot(cwd),
+          remembered,
+          global: globalRepo
+        }
+      };
+    }
+    return {
+      root: null,
+      source: "env",
+      checked: {
+        env: resolved,
+        cwd: findHooxSetupRoot(cwd),
+        remembered,
+        global: globalRepo
+      }
+    };
   }
-  const authHeader = request.headers.get("Authorization");
-  const expectedHeader = `Bearer ${apiKey}`;
-  if (!authHeader || !await timingSafeEqualAsync(authHeader, expectedHeader)) {
-    return new Response(JSON.stringify({ error: "Unauthorized" }), {
-      status: 401,
-      headers: { "Content-Type": "application/json" }
-    });
+  const local = findHooxSetupRoot(cwd);
+  if (local) {
+    return {
+      root: local,
+      source: "cwd",
+      checked: { cwd: local, remembered, global: globalRepo }
+    };
   }
-  return null;
-}
-function createOperatorAuthMiddleware() {
-  return async (request, env, _ctx) => {
-    const denied = await requireOperatorAuth(request, env);
-    if (denied)
-      return denied;
-    return;
+  if (remembered) {
+    return {
+      root: remembered,
+      source: "remembered",
+      checked: { cwd: null, remembered, global: globalRepo }
+    };
+  }
+  if (isHooxSetupRoot(globalRepo)) {
+    return {
+      root: globalRepo,
+      source: "global",
+      checked: { cwd: null, remembered: null, global: globalRepo }
+    };
+  }
+  return {
+    root: null,
+    source: "none",
+    checked: { cwd: null, remembered: null, global: globalRepo }
   };
 }
-function normalizeKeyNames(keyName) {
-  if (typeof keyName === "string") {
-    return [keyName];
+function getTuiEntryCandidates(runtimeRoot) {
+  const root = resolve(runtimeRoot);
+  return [
+    join2(root, "packages", "tui", "src", "main.tsx"),
+    join2(root, "packages", "tui", "dist", "main.js"),
+    join2(root, "packages", "tui", "src", "main.ts")
+  ];
+}
+function resolveHooxPath(relativePath) {
+  if (!relativePath || typeof relativePath !== "string") {
+    throw new Error("relativePath must be a non-empty string");
   }
-  return [...keyName];
+  if (relativePath.includes("..")) {
+    throw new Error(`Path traversal detected in relativePath: "${relativePath}"`);
+  }
+  const normalizedPath = relativePath.replace(/\\/g, "/");
+  const hooxHome = getHooxHome();
+  const fullPath = join2(hooxHome, normalizedPath);
+  const resolvedPath = resolve(fullPath);
+  const resolvedHome = resolve(hooxHome);
+  if (!resolvedPath.startsWith(resolvedHome)) {
+    throw new Error(`Resolved path "${resolvedPath}" is outside Hoox home directory`);
+  }
+  return createHooxPath(resolvedPath);
 }
-function collectInternalAuthKeys(env, keyNames) {
-  const keys = [];
-  for (const name of normalizeKeyNames(keyNames)) {
-    const value = env[name];
-    if (typeof value === "string" && value.length > 0) {
-      keys.push(value);
-    }
+function isWithinHooxHome(path) {
+  try {
+    const hooxHome = getHooxHome();
+    const resolvedPath = resolve(path);
+    const resolvedHome = resolve(hooxHome);
+    return resolvedPath.startsWith(resolvedHome);
+  } catch {
+    return false;
   }
-  return keys;
 }
-function matchesAnyInternalAuthKey(providedKey, expectedKeys) {
-  let matched = false;
-  for (const expected of expectedKeys) {
-    if (timingSafeEqual(providedKey, expected)) {
-      matched = true;
+function getRelativeHooxPath(absolutePath) {
+  try {
+    if (!isWithinHooxHome(absolutePath)) {
+      return null;
     }
+    const hooxHome = getHooxHome();
+    const resolvedPath = resolve(absolutePath);
+    const resolvedHome = resolve(hooxHome);
+    const relativePath = resolvedPath.slice(resolvedHome.length);
+    return relativePath.startsWith("/") || relativePath.startsWith("\\") ? relativePath.slice(1) : relativePath;
+  } catch {
+    return null;
   }
-  return matched;
 }
-function internalAuthNotConfiguredResponse(keyNames) {
-  const label = normalizeKeyNames(keyNames).join(" | ");
-  return new Response(JSON.stringify({
-    success: false,
-    error: `Internal auth key(s) not configured: ${label}`
-  }), { status: 401, headers: { "Content-Type": "application/json" } });
+function getHooxRepoPath() {
+  return resolveHooxPath("repo");
 }
-function requireInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
-  const expectedKeys = collectInternalAuthKeys(env, keyName);
-  if (expectedKeys.length === 0) {
-    return internalAuthNotConfiguredResponse(keyName);
-  }
-  const providedKey = request.headers.get("X-Internal-Auth-Key");
-  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
-    return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
-  }
-  return null;
+function getHooxConfigDir() {
+  return resolveHooxPath("config");
 }
-function createInternalAuthMiddleware(keyName = "INTERNAL_KEY_BINDING") {
-  return async (request, env, _ctx) => {
-    const expectedKeys = collectInternalAuthKeys(env, keyName);
-    if (expectedKeys.length === 0) {
-      return internalAuthNotConfiguredResponse(keyName);
-    }
-    const providedKey = request.headers.get("X-Internal-Auth-Key");
-    if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
-      return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), { status: 401, headers: { "Content-Type": "application/json" } });
-    }
-    return;
-  };
+function getHooxDataDir() {
+  return resolveHooxPath("data");
 }
-function checkInternalAuth(request, env, keyName = "INTERNAL_KEY_BINDING") {
-  const expectedKeys = collectInternalAuthKeys(env, keyName);
-  if (expectedKeys.length === 0) {
-    return {
-      authorized: false,
-      error: `${normalizeKeyNames(keyName).join(" | ")} not configured`
-    };
-  }
-  const providedKey = request.headers.get("X-Internal-Auth-Key");
-  if (!providedKey || !matchesAnyInternalAuthKey(providedKey, expectedKeys)) {
-    return { authorized: false, error: "Unauthorized" };
-  }
-  return { authorized: true };
+function getHooxWranglerPath() {
+  return resolveHooxPath("config/wrangler.jsonc");
+}
+function getHooxStatePath() {
+  return resolveHooxPath("data/state.json");
 }
 
-// src/service-bindings.ts
-var InternalAuthKeyFields = {
-  DEFAULT: "INTERNAL_KEY_BINDING",
-  D1_READ: "D1_READ_KEY_BINDING",
-  D1_WRITE: "D1_WRITE_KEY_BINDING",
-  TRADE_EXECUTE: "TRADE_EXECUTE_KEY_BINDING",
-  TRADE_READ: "TRADE_READ_KEY_BINDING",
-  TELEGRAM_ALERT: "TELEGRAM_INTERNAL_KEY_BINDING",
-  WALLET_EXECUTE: "WALLET_EXECUTE_KEY_BINDING",
-  AGENT: "AGENT_INTERNAL_KEY",
-  D1_INTERNAL_ALIAS: "D1_INTERNAL_KEY",
-  TRADE_INTERNAL_ALIAS: "TRADE_INTERNAL_KEY",
-  TELEGRAM_INTERNAL_ALIAS: "TELEGRAM_INTERNAL_KEY"
-};
-var D1_READ_AUTH_KEY_FIELDS = [
-  InternalAuthKeyFields.D1_READ,
-  InternalAuthKeyFields.DEFAULT
-];
-var D1_WRITE_AUTH_KEY_FIELDS = [
-  InternalAuthKeyFields.D1_WRITE,
-  InternalAuthKeyFields.DEFAULT
-];
-var TRADE_EXECUTE_AUTH_KEY_FIELDS = [
-  InternalAuthKeyFields.TRADE_EXECUTE,
-  InternalAuthKeyFields.DEFAULT,
-  InternalAuthKeyFields.AGENT
-];
-var TRADE_READ_AUTH_KEY_FIELDS = [
-  InternalAuthKeyFields.TRADE_READ,
-  InternalAuthKeyFields.DEFAULT
-];
-var TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
-  InternalAuthKeyFields.TELEGRAM_ALERT,
-  InternalAuthKeyFields.DEFAULT
-];
-var WALLET_EXECUTE_AUTH_KEY_FIELDS = [
-  InternalAuthKeyFields.WALLET_EXECUTE,
-  InternalAuthKeyFields.DEFAULT
-];
-var DASHBOARD_D1_READ_AUTH_KEY_FIELDS = [
-  InternalAuthKeyFields.D1_READ,
-  InternalAuthKeyFields.D1_INTERNAL_ALIAS,
-  InternalAuthKeyFields.DEFAULT
-];
-var DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS = [
-  InternalAuthKeyFields.TRADE_EXECUTE,
-  InternalAuthKeyFields.TRADE_INTERNAL_ALIAS,
-  InternalAuthKeyFields.DEFAULT
-];
-var DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS = [
-  InternalAuthKeyFields.TELEGRAM_ALERT,
-  InternalAuthKeyFields.TELEGRAM_INTERNAL_ALIAS,
-  InternalAuthKeyFields.DEFAULT
-];
-function resolveInternalAuthKey(env, keyFields) {
-  return collectInternalAuthKeys(env, keyFields)[0];
-}
-
-class ServiceAuthError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ServiceAuthError";
+// src/session.ts
+import { z as z3 } from "zod";
+var SessionStateFileSchema = z3.object({
+  activeView: z3.string().optional(),
+  sidebarExpanded: z3.boolean().optional(),
+  windowSize: z3.object({
+    cols: z3.number().int().positive(),
+    rows: z3.number().int().positive()
+  }).optional(),
+  lastData: z3.number().nonnegative().optional(),
+  savedAt: z3.string().optional()
+}).strict();
+var TUI_STATE_DIR = ".tui-state";
+function getSessionFilePath() {
+  try {
+    const hooxHome = getHooxHome();
+    return `${hooxHome}/${TUI_STATE_DIR}/session.json`;
+  } catch {
+    return `${process.cwd()}/${TUI_STATE_DIR}/session.json`;
   }
 }
-function authenticatedServiceFetch(binding, env, path, body, options) {
-  const key = options?.internalKey ?? (options?.internalKeyFields ? resolveInternalAuthKey(env, options.internalKeyFields) : env.INTERNAL_KEY_BINDING);
-  if (!key) {
-    const label = options?.internalKeyFields ? Array.isArray(options.internalKeyFields) ? options.internalKeyFields.join(" | ") : options.internalKeyFields : "INTERNAL_KEY_BINDING";
-    return Promise.reject(new ServiceAuthError(`${label} not configured`));
+var DEFAULT_SESSION = {
+  activeView: "dashboard",
+  sidebarExpanded: true,
+  windowSize: { cols: 80, rows: 24 },
+  lastData: 0,
+  savedAt: new Date().toISOString()
+};
+async function saveSession(activeView, sidebarExpanded, windowSize, lastData) {
+  try {
+    const session = {
+      activeView,
+      sidebarExpanded,
+      windowSize,
+      lastData,
+      savedAt: new Date().toISOString()
+    };
+    await Bun.write(getSessionFilePath(), JSON.stringify(session, null, 2));
+  } catch (error) {
+    console.error("[session] Failed to save session:", error.message);
   }
-  return serviceFetch(binding, path, body, {
-    method: options?.method,
-    timeout: options?.timeout,
-    headers: {
-      ...options?.headers,
-      "X-Internal-Auth-Key": key
-    }
-  });
-}
-function serviceFetch(binding, path, body, options) {
-  const timeout = options?.timeout ?? 30000;
-  return binding.fetch(`http://internal${path}`, {
-    method: options?.method ?? "POST",
-    headers: {
-      "Content-Type": "application/json",
-      ...options?.headers
-    },
-    body: body != null ? JSON.stringify(body) : undefined,
-    signal: AbortSignal.timeout(timeout)
-  });
-}
-
-// src/test-utils.ts
-function createMockKV(overrides) {
-  return {
-    get: async (_key) => null,
-    put: async (_key, _value, _options) => {},
-    delete: async (_key) => {},
-    list: async (_options) => ({
-      keys: []
-    }),
-    ...overrides
-  };
-}
-function createMockR2(overrides) {
-  return {
-    put: async (key, _value, _options) => ({
-      key
-    }),
-    get: async (_key) => null,
-    delete: async (_key) => {},
-    list: async (_options) => ({
-      objects: []
-    }),
-    ...overrides
-  };
 }
-function createMockPreparedStatement() {
-  return {
-    bind: (..._params) => createMockPreparedStatement(),
-    run: async () => ({ success: true }),
-    all: async () => ({ success: true, results: [] }),
-    first: async () => null
-  };
+async function restoreSession() {
+  try {
+    const file = Bun.file(getSessionFilePath());
+    const exists = await file.exists();
+    if (!exists)
+      return { ...DEFAULT_SESSION };
+    const raw = await file.text();
+    const result = SessionStateFileSchema.safeParse(JSON.parse(raw));
+    const parsed = result.success ? result.data : {};
+    return {
+      activeView: validateViewId(parsed.activeView) ? parsed.activeView : DEFAULT_SESSION.activeView,
+      sidebarExpanded: typeof parsed.sidebarExpanded === "boolean" ? parsed.sidebarExpanded : DEFAULT_SESSION.sidebarExpanded,
+      windowSize: parsed.windowSize ?? DEFAULT_SESSION.windowSize,
+      lastData: typeof parsed.lastData === "number" ? parsed.lastData : DEFAULT_SESSION.lastData,
+      savedAt: parsed.savedAt ?? DEFAULT_SESSION.savedAt
+    };
+  } catch {
+    return { ...DEFAULT_SESSION };
+  }
 }
-function createMockD1(overrides) {
-  return {
-    prepare: (_sql) => createMockPreparedStatement(),
-    dump: async () => new ArrayBuffer(0),
-    batch: async (_statements) => [],
-    exec: async (_sql) => ({ success: true }),
-    ...overrides
-  };
+var VALID_VIEW_IDS = new Set([
+  "dashboard",
+  "workers",
+  "worker-detail",
+  "trade-monitor",
+  "logs-viewer",
+  "service-manager",
+  "config-editor",
+  "setup-wizard",
+  "settings",
+  "queue-depth",
+  "kv-viewer",
+  "secrets-viewer",
+  "db-query",
+  "ai-chat",
+  "edge-topology",
+  "worker-settings"
+]);
+function validateViewId(id) {
+  return typeof id === "string" && VALID_VIEW_IDS.has(id);
 }
-function createMockFetcher(response) {
-  const defaultResponse = response ?? new Response("OK", { status: 200 });
-  return {
-    fetch: async (_request, _init) => defaultResponse
-  };
+// src/format-time.ts
+function formatRelativeTime2(timestampMs, nowMs) {
+  const now = nowMs ?? Date.now();
+  const diffMs = now - timestampMs;
+  if (diffMs < 0)
+    return "just now";
+  if (timestampMs === 0)
+    return "\u2014";
+  const seconds = Math.floor(diffMs / 1000);
+  const minutes = Math.floor(seconds / 60);
+  const hours = Math.floor(minutes / 60);
+  const days = Math.floor(hours / 24);
+  if (seconds < 60)
+    return "< 1m ago";
+  if (minutes < 60)
+    return `${minutes}m ago`;
+  if (hours < 24)
+    return `${hours}h ago`;
+  if (days < 30)
+    return `${days}d ago`;
+  return `> 30d ago`;
 }
-function createMockAnalyticsEngine() {
-  return {
-    writeDataPoint: (_data) => {}
-  };
+function formatDuration2(durationMs) {
+  const seconds = Math.floor(durationMs / 1000);
+  const minutes = Math.floor(seconds / 60);
+  const hours = Math.floor(minutes / 60);
+  if (hours > 0) {
+    const remainMin = minutes % 60;
+    return remainMin > 0 ? `${hours}h ${remainMin}m` : `${hours}h`;
+  }
+  if (minutes > 0) {
+    const remainSec = seconds % 60;
+    return remainSec > 0 ? `${minutes}m ${remainSec}s` : `${minutes}m`;
+  }
+  return `${seconds}s`;
 }
-function createMockAnalyticsEngineDataset() {
-  return createMockAnalyticsEngine();
+// src/entitlements.ts
+function hasScope(ctx, scope) {
+  if (!ctx || !Array.isArray(ctx.scopes))
+    return false;
+  return ctx.scopes.includes(scope);
 }
-function createMockQueue() {
-  return {
-    send: async (_body, _options) => {},
-    sendBatch: async (_messages) => {}
-  };
+function verifyCacheKey(keyHashPrefix) {
+  const clean = (keyHashPrefix ?? "").trim();
+  return `hx:${clean}`;
 }
-function createMockVectorizeIndex(overrides) {
-  return {
-    query: async (_vector, _options) => ({
-      matches: []
-    }),
-    upsert: async (_vectors) => {},
-    deleteByIds: async (_ids) => {},
-    describe: async () => ({ dimension: 384, totalVectors: 0 }),
-    ...overrides
-  };
-}
-function createMockAi(overrides) {
-  return {
-    run: async (_model, _input) => ({}),
-    ...overrides
-  };
-}
-function createMockExecutionContext(overrides) {
-  return {
-    waitUntil: (_promise) => {},
-    passThroughOnException: () => {},
-    ...overrides
-  };
-}
-function createMockSecretsStore(overrides) {
-  return {
-    get: async (_key) => null,
-    put: async (_key, _value) => {},
-    delete: async (_key) => {},
-    ...overrides
-  };
-}
-function createMockEnv(overrides) {
-  return overrides;
+// src/dashboard-manifest.ts
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+var DASHBOARD_WORKER_PREFIX = {
+  hoox: "global:",
+  "trade-worker": "trade:",
+  "agent-worker": "agent:",
+  "telegram-worker": "bot:",
+  "d1-worker": "database:",
+  "email-worker": "email:",
+  "web3-wallet-worker": "wallet:",
+  "analytics-worker": "ai:",
+  "report-worker": "report:",
+  "pyne-worker": "pyne:"
+};
+var DASHBOARD_SECTION_PREFIX = {
+  global: "global:",
+  webhook: "webhook:",
+  routing: "routing:",
+  notify: "telegram:",
+  security: "webhook:",
+  trade: "trade:",
+  agent: "agent:",
+  bot: "bot:",
+  bot_ai: "bot:",
+  email: "email:",
+  signal: "email:",
+  database: "database:",
+  retention: "retention:",
+  cron: "cron:",
+  behavior: "behavior:",
+  risk: "trade:",
+  exchanges: "trade:",
+  fees: "trade:",
+  providers: "agent:",
+  models: "agent:",
+  ai: "ai:",
+  tracking: "ai:",
+  query: "ai:",
+  report: "report:",
+  schedule: "report:",
+  rendering: "report:",
+  storage: "report:",
+  delivery: "report:",
+  endpoints: "report:",
+  wallet: "wallet:",
+  dex: "wallet:",
+  wallet_security: "wallet:",
+  pyne: "pyne:",
+  pyne_alerts: "pyne:"
+};
+var DASHBOARD_FIELD_KV_OVERRIDES = {
+  "webhook:tradingview_ip_check_enabled": "webhook:tradingview:ip_check_enabled",
+  "webhook:tradingview_allowed_ips": "webhook:tradingview:allowed_ips",
+  "webhook:queue_mode": "webhook:queue_mode",
+  "notify:allowed_chat_ids": "telegram:allowed_chat_ids",
+  "exchanges:binance_enabled": "exchange:binance:enabled",
+  "exchanges:mexc_enabled": "exchange:mexc:enabled",
+  "exchanges:bybit_enabled": "exchange:bybit:enabled",
+  "exchanges:uniswap_ethereum_enabled": "exchange:uniswap-ethereum:enabled",
+  "exchanges:uniswap_arbitrum_enabled": "exchange:uniswap-arbitrum:enabled",
+  "exchanges:jupiter_solana_enabled": "exchange:jupiter-solana:enabled",
+  "wallet:config": "wallet:config"
+};
+var DASHBOARD_SECTIONS_NOT_FLAT_KV = new Set([
+  "providers",
+  "models",
+  "cron",
+  "behavior",
+  "endpoints"
+]);
+var DASHBOARD_SECTIONS_UI_SKIP = new Set([
+  "cron",
+  "behavior",
+  "endpoints"
+]);
+function isDashboardSectionFlatKv(sectionId) {
+  return !DASHBOARD_SECTIONS_NOT_FLAT_KV.has(sectionId);
 }
-
-// src/path-utils.ts
-import {
-  existsSync as existsSync3,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync3,
-  writeFileSync as writeFileSync2,
-  chmodSync as chmodSync2
-} from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname, join as join3, resolve } from "path";
-function createHooxPath(path) {
-  return path;
+function isDashboardSectionEditable(sectionId) {
+  return !DASHBOARD_SECTIONS_UI_SKIP.has(sectionId);
 }
-function getHooxHome() {
-  try {
-    const override = process.env.HOOX_HOME?.trim();
-    if (override) {
-      return createHooxPath(resolve(override));
-    }
-    const home = homedir2();
-    if (!home || home.length === 0) {
-      return createHooxPath(resolve(process.cwd(), ".hoox"));
+function buildDashboardKvKey(worker, fieldKey) {
+  const override = DASHBOARD_FIELD_KV_OVERRIDES[fieldKey];
+  if (override)
+    return override;
+  if (fieldKey.includes(":")) {
+    const [section, ...rest] = fieldKey.split(":");
+    const fieldName = rest.join(":");
+    if (section === "exchanges" && fieldName.endsWith("_enabled")) {
+      const exchange = fieldName.slice(0, -"_enabled".length);
+      if (exchange)
+        return `exchange:${exchange}:enabled`;
     }
-    return createHooxPath(join3(home, ".hoox"));
-  } catch {
-    return createHooxPath(resolve(process.cwd(), ".hoox"));
+    const mapped = DASHBOARD_SECTION_PREFIX[section ?? ""];
+    if (mapped)
+      return `${mapped}${fieldName}`;
+    return `${section}:${fieldName}`;
   }
+  const workerPrefix = DASHBOARD_WORKER_PREFIX[worker] ?? "";
+  return `${workerPrefix}${fieldKey}`;
 }
-function isHooxSetupRoot(dir) {
-  if (!dir)
-    return false;
-  try {
-    const root = resolve(dir);
-    if (!existsSync3(join3(root, "packages", "cli", "package.json"))) {
-      return false;
+function stripJsonc(input) {
+  let out = "";
+  let i = 0;
+  let inString = false;
+  let stringChar = "";
+  while (i < input.length) {
+    const c = input[i];
+    const next = input[i + 1];
+    if (inString) {
+      out += c;
+      if (c === "\\" && i + 1 < input.length) {
+        out += next;
+        i += 2;
+        continue;
+      }
+      if (c === stringChar)
+        inString = false;
+      i++;
+      continue;
     }
-    return existsSync3(join3(root, "wrangler.jsonc")) || existsSync3(join3(root, "wrangler.jsonc.example")) || existsSync3(join3(root, "workers")) || existsSync3(join3(root, ".gitmodules"));
-  } catch {
-    return false;
+    if (c === '"' || c === "'") {
+      inString = true;
+      stringChar = c;
+      out += c;
+      i++;
+      continue;
+    }
+    if (c === "/" && next === "/") {
+      while (i < input.length && input[i] !== `
+`)
+        i++;
+      continue;
+    }
+    if (c === "/" && next === "*") {
+      i += 2;
+      while (i < input.length && !(input[i] === "*" && input[i + 1] === "/"))
+        i++;
+      i += 2;
+      continue;
+    }
+    if (c === ",") {
+      let j = i + 1;
+      while (j < input.length && /\s/.test(input[j]))
+        j++;
+      if (j < input.length && (input[j] === "}" || input[j] === "]")) {
+        i++;
+        continue;
+      }
+    }
+    out += c;
+    i++;
   }
+  return out;
 }
-function getRememberedMonorepoPath() {
-  return resolveHooxPath("config/monorepo.json");
+function parseFieldType(value) {
+  if (typeof value === "boolean")
+    return "boolean";
+  if (typeof value === "number")
+    return "number";
+  if (value === "true" || value === "false")
+    return "boolean";
+  if (value.trim().startsWith("{") || value.trim().startsWith("["))
+    return "json";
+  if (!Number.isNaN(Number(value)) && value.trim() !== "")
+    return "number";
+  return "text";
 }
-function getRememberedMonorepoRoot() {
-  try {
-    const path = getRememberedMonorepoPath();
-    if (!existsSync3(path))
-      return null;
-    const raw = readFileSync3(path, "utf-8");
-    const data = JSON.parse(raw);
-    if (!data.root || typeof data.root !== "string")
-      return null;
-    const resolved = resolve(data.root);
-    return isHooxSetupRoot(resolved) ? resolved : null;
-  } catch {
-    return null;
-  }
+function labelFromKey(key) {
+  return key.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
 }
-function rememberMonorepoRoot(root) {
+function parseDashboardManifest(content, workerName, onError) {
   try {
-    const resolved = resolve(root);
-    if (!isHooxSetupRoot(resolved))
-      return false;
-    const configDir = getHooxConfigDir();
-    mkdirSync2(configDir, { recursive: true, mode: 448 });
-    try {
-      chmodSync2(configDir, 448);
-    } catch {}
-    const payload = {
-      root: resolved,
-      updatedAt: new Date().toISOString()
-    };
-    const path = getRememberedMonorepoPath();
-    writeFileSync2(path, JSON.stringify(payload, null, 2) + `
-`, {
-      mode: 384
-    });
-    try {
-      chmodSync2(path, 384);
-    } catch {}
-    return true;
-  } catch {
-    return false;
-  }
-}
-function findHooxSetupRoot(startDir = process.cwd()) {
-  let dir = resolve(startDir);
-  for (;; ) {
-    if (isHooxSetupRoot(dir))
-      return dir;
-    const parent = dirname(dir);
-    if (parent === dir)
-      return null;
-    dir = parent;
-  }
-}
-function resolveHooxRuntimeRoot(options) {
-  const env = options?.env ?? process.env;
-  const cwd = resolve(options?.cwd ?? process.cwd());
-  const globalRepo = getHooxRepoPath();
-  const remembered = options?.skipRemembered ? null : getRememberedMonorepoRoot();
-  const envRepo = env.HOOX_REPO?.trim();
-  if (envRepo) {
-    const resolved = resolve(envRepo);
-    if (isHooxSetupRoot(resolved)) {
-      return {
-        root: resolved,
-        source: "env",
-        checked: {
-          env: resolved,
-          cwd: findHooxSetupRoot(cwd),
-          remembered,
-          global: globalRepo
+    const raw = JSON.parse(stripJsonc(content));
+    const displayName = raw.display_name || raw.displayName || workerName;
+    const description = raw.description || "";
+    const sections = [];
+    if (raw.sections) {
+      for (const [sectionId, sectionData] of Object.entries(raw.sections)) {
+        const fields = [];
+        const sectionFields = sectionData.fields || {};
+        const sectionOptions = sectionData.options || {};
+        const sectionDescriptions = sectionData.descriptions || {};
+        const sectionValidation = sectionData.validation || {};
+        const sectionSecrets = sectionData.secrets || {};
+        const sectionSecretCommands = sectionData.secret_commands || {};
+        for (const [key, value] of Object.entries(sectionFields)) {
+          const field = {
+            key: `${sectionId}:${key}`,
+            label: labelFromKey(key),
+            type: parseFieldType(value),
+            default: value
+          };
+          if (sectionOptions[key]) {
+            field.type = "select";
+            field.options = sectionOptions[key].map((opt) => ({
+              value: String(opt),
+              label: String(opt)
+            }));
+          }
+          if (sectionDescriptions[key]) {
+            field.description = String(sectionDescriptions[key]);
+          }
+          if (sectionValidation[key]) {
+            field.validation = sectionValidation[key];
+          }
+          if (sectionSecrets[key]) {
+            field.kind = "secret";
+            field.cliCommand = sectionSecretCommands[key];
+          }
+          if (key.includes("kill_switch") || key.includes("drawdown") || key === "enabled" && sectionId === "global") {
+            if (field.kind !== "secret")
+              field.kind = "dangerous";
+          }
+          fields.push(field);
         }
-      };
-    }
-    return {
-      root: null,
-      source: "env",
-      checked: {
-        env: resolved,
-        cwd: findHooxSetupRoot(cwd),
-        remembered,
-        global: globalRepo
+        sections.push({
+          id: sectionId,
+          title: sectionData.title || labelFromKey(sectionId),
+          description: sectionData.description || `Configure ${sectionId} settings`,
+          icon: sectionData.icon,
+          priority: sectionData.priority !== undefined ? sectionData.priority : sections.length * 10,
+          fields
+        });
       }
-    };
-  }
-  const local = findHooxSetupRoot(cwd);
-  if (local) {
-    return {
-      root: local,
-      source: "cwd",
-      checked: { cwd: local, remembered, global: globalRepo }
-    };
-  }
-  if (remembered) {
+    }
     return {
-      root: remembered,
-      source: "remembered",
-      checked: { cwd: null, remembered, global: globalRepo }
+      worker: workerName,
+      displayName,
+      description,
+      sections: sections.sort((a, b) => a.priority - b.priority)
     };
-  }
-  if (isHooxSetupRoot(globalRepo)) {
+  } catch (err) {
+    const message = err instanceof Error ? err.message : `parse failed: ${String(err)}`;
+    onError?.(`dashboard.jsonc for ${workerName}: ${message}`);
     return {
-      root: globalRepo,
-      source: "global",
-      checked: { cwd: null, remembered: null, global: globalRepo }
+      worker: workerName,
+      displayName: workerName,
+      description: "Failed to load configuration",
+      sections: []
     };
   }
-  return {
-    root: null,
-    source: "none",
-    checked: { cwd: null, remembered: null, global: globalRepo }
-  };
 }
-function getTuiEntryCandidates(runtimeRoot) {
-  const root = resolve(runtimeRoot);
-  return [
-    join3(root, "packages", "tui", "src", "main.tsx"),
-    join3(root, "packages", "tui", "dist", "main.js"),
-    join3(root, "packages", "tui", "src", "main.ts")
-  ];
+var DASHBOARD_WORKER_IDS = [
+  "hoox",
+  "trade-worker",
+  "agent-worker",
+  "telegram-worker",
+  "d1-worker",
+  "email-worker",
+  "web3-wallet-worker",
+  "analytics-worker",
+  "report-worker",
+  "pyne-worker"
+];
+function dashboardWorkerDir(workerId) {
+  if (workerId === "hoox")
+    return "hoox-worker";
+  return workerId;
 }
-function resolveHooxPath(relativePath) {
-  if (!relativePath || typeof relativePath !== "string") {
-    throw new Error("relativePath must be a non-empty string");
-  }
-  if (relativePath.includes("..")) {
-    throw new Error(`Path traversal detected in relativePath: "${relativePath}"`);
-  }
-  const normalizedPath = relativePath.replace(/\\/g, "/");
-  const hooxHome = getHooxHome();
-  const fullPath = join3(hooxHome, normalizedPath);
-  const resolvedPath = resolve(fullPath);
-  const resolvedHome = resolve(hooxHome);
-  if (!resolvedPath.startsWith(resolvedHome)) {
-    throw new Error(`Resolved path "${resolvedPath}" is outside Hoox home directory`);
-  }
-  return createHooxPath(resolvedPath);
+function fieldTypeToKv(t) {
+  if (t === "boolean")
+    return "boolean";
+  if (t === "number")
+    return "number";
+  return "string";
 }
-function isWithinHooxHome(path) {
-  try {
-    const hooxHome = getHooxHome();
-    const resolvedPath = resolve(path);
-    const resolvedHome = resolve(hooxHome);
-    return resolvedPath.startsWith(resolvedHome);
-  } catch {
-    return false;
-  }
+function defaultToString(value) {
+  if (typeof value === "string")
+    return value;
+  return JSON.stringify(value);
 }
-function getRelativeHooxPath(absolutePath) {
-  try {
-    if (!isWithinHooxHome(absolutePath)) {
-      return null;
+function isDocumentationField(fieldKey) {
+  const name = fieldKey.includes(":") ? fieldKey.slice(fieldKey.indexOf(":") + 1) : fieldKey;
+  return /^(GET|POST|PUT|PATCH|DELETE)\s+\//i.test(name);
+}
+function kvManifestFromDashboardManifests(manifests) {
+  const byKey = new Map;
+  for (const manifest of manifests) {
+    for (const section of manifest.sections) {
+      if (!isDashboardSectionFlatKv(section.id))
+        continue;
+      for (const field of section.fields) {
+        if (isDocumentationField(field.key))
+          continue;
+        const key = buildDashboardKvKey(manifest.worker, field.key);
+        if (!key || key.endsWith(":"))
+          continue;
+        const next = {
+          key,
+          type: fieldTypeToKv(field.type),
+          default: defaultToString(field.default),
+          description: field.description || `${manifest.displayName}: ${field.label}`,
+          secret: field.kind === "secret" ? true : undefined,
+          worker: manifest.worker
+        };
+        const prev = byKey.get(key);
+        if (!prev) {
+          byKey.set(key, next);
+          continue;
+        }
+        if (!prev.secret && next.secret)
+          prev.secret = true;
+        if ((!prev.description || prev.description.length < 8) && next.description) {
+          prev.description = next.description;
+        }
+      }
     }
-    const hooxHome = getHooxHome();
-    const resolvedPath = resolve(absolutePath);
-    const resolvedHome = resolve(hooxHome);
-    const relativePath = resolvedPath.slice(resolvedHome.length);
-    return relativePath.startsWith("/") || relativePath.startsWith("\\") ? relativePath.slice(1) : relativePath;
-  } catch {
-    return null;
   }
+  const keys = [...byKey.values()].sort((a, b) => a.key.localeCompare(b.key));
+  return { namespace: "CONFIG_KV", keys };
 }
-function getHooxRepoPath() {
-  return resolveHooxPath("repo");
-}
-function getHooxConfigDir() {
-  return resolveHooxPath("config");
-}
-function getHooxDataDir() {
-  return resolveHooxPath("data");
-}
-function getHooxWranglerPath() {
-  return resolveHooxPath("config/wrangler.jsonc");
-}
-function getHooxStatePath() {
-  return resolveHooxPath("data/state.json");
+function loadDashboardKvManifestFromRoot(root, onError) {
+  return kvManifestFromDashboardManifests(loadDashboardManifestsFromRoot(root, onError));
 }
-
-// src/session.ts
-import { z as z3 } from "zod";
-var SessionStateFileSchema = z3.object({
-  activeView: z3.string().optional(),
-  sidebarExpanded: z3.boolean().optional(),
-  windowSize: z3.object({
-    cols: z3.number().int().positive(),
-    rows: z3.number().int().positive()
-  }).optional(),
-  lastData: z3.number().nonnegative().optional(),
-  savedAt: z3.string().optional()
-}).strict();
-var TUI_STATE_DIR = ".tui-state";
-function getSessionFilePath() {
+function tryReadFile(path) {
   try {
-    const hooxHome = getHooxHome();
-    return `${hooxHome}/${TUI_STATE_DIR}/session.json`;
+    if (!existsSync3(path))
+      return null;
+    return readFileSync3(path, "utf-8");
   } catch {
-    return `${process.cwd()}/${TUI_STATE_DIR}/session.json`;
+    return null;
   }
 }
-var DEFAULT_SESSION = {
-  activeView: "dashboard",
-  sidebarExpanded: true,
-  windowSize: { cols: 80, rows: 24 },
-  lastData: 0,
-  savedAt: new Date().toISOString()
-};
-async function saveSession(activeView, sidebarExpanded, windowSize, lastData) {
+function loadDashboardManifestsFromRoot(root, onError) {
+  const manifests = [];
+  const seen = new Set;
+  const workersDir = join3(root, "workers");
+  if (!existsSync3(workersDir))
+    return manifests;
+  const warn = onError ?? ((message) => {
+    console.warn(`[dashboard-manifest] ${message}`);
+  });
+  for (const workerId of DASHBOARD_WORKER_IDS) {
+    const dir = dashboardWorkerDir(workerId);
+    const path = join3(workersDir, dir, "dashboard.jsonc");
+    const content = tryReadFile(path);
+    if (!content)
+      continue;
+    const m = parseDashboardManifest(content, workerId, warn);
+    if (m.sections.length > 0) {
+      manifests.push(m);
+      seen.add(workerId);
+    } else if (m.description === "Failed to load configuration") {}
+  }
   try {
-    const session = {
-      activeView,
-      sidebarExpanded,
-      windowSize,
-      lastData,
-      savedAt: new Date().toISOString()
-    };
-    await Bun.write(getSessionFilePath(), JSON.stringify(session, null, 2));
-  } catch (error) {
-    console.error("[session] Failed to save session:", error.message);
+    for (const entry of readdirSync(workersDir)) {
+      if (entry === "dashboard")
+        continue;
+      const workerId = entry === "hoox-worker" || entry === "hoox" ? "hoox" : entry;
+      if (seen.has(workerId))
+        continue;
+      const path = join3(workersDir, entry, "dashboard.jsonc");
+      const content = tryReadFile(path);
+      if (!content)
+        continue;
+      const m = parseDashboardManifest(content, workerId, warn);
+      if (m.sections.length > 0) {
+        manifests.push(m);
+        seen.add(workerId);
+      }
+    }
+  } catch {}
+  const publicDir = join3(workersDir, "dashboard", "public", "workers");
+  if (existsSync3(publicDir)) {
+    try {
+      for (const file of readdirSync(publicDir)) {
+        if (!file.endsWith(".jsonc") && !file.endsWith(".json"))
+          continue;
+        const base = file.replace(/\.jsonc?$/, "");
+        const workerId = base === "hoox-worker" || base === "hoox" ? "hoox" : base;
+        if (seen.has(workerId))
+          continue;
+        const content = tryReadFile(join3(publicDir, file));
+        if (!content)
+          continue;
+        const m = parseDashboardManifest(content, workerId, warn);
+        if (m.sections.length > 0) {
+          manifests.push(m);
+          seen.add(workerId);
+        }
+      }
+    } catch {}
   }
+  return manifests;
 }
-async function restoreSession() {
+// src/agent-config-fields.ts
+var AGENT_CONFIG_KV_KEY = KV_AGENT_CONFIG;
+var AGENT_CONFIG_EMBEDDED_FIELDS = {
+  "providers:default_provider": { kind: "top", key: "defaultProvider" },
+  "providers:fallback_chain": { kind: "top", key: "fallbackChain" },
+  "providers:timeout_ms": { kind: "top", key: "timeoutMs" },
+  "providers:retry_count": { kind: "top", key: "retryCount" },
+  "models:workers_ai_model": { kind: "model", provider: "workers-ai" },
+  "models:openai_model": { kind: "model", provider: "openai" },
+  "models:anthropic_model": { kind: "model", provider: "anthropic" },
+  "models:google_model": { kind: "model", provider: "google" },
+  "risk:max_daily_drawdown_percent": {
+    kind: "top",
+    key: "maxDailyDrawdownPercent"
+  },
+  "risk:trailing_stop_percent": { kind: "top", key: "trailingStopPercent" },
+  "risk:take_profit_percent": { kind: "top", key: "takeProfitPercent" }
+};
+var DASHBOARD_SECTIONS_AGENT_CONFIG = new Set([
+  "providers",
+  "models"
+]);
+function isAgentConfigEmbeddedField(fieldKey) {
+  return Object.prototype.hasOwnProperty.call(AGENT_CONFIG_EMBEDDED_FIELDS, fieldKey);
+}
+function isAgentConfigSection(sectionId) {
+  return DASHBOARD_SECTIONS_AGENT_CONFIG.has(sectionId);
+}
+function parseAgentConfigJson(raw) {
+  if (raw === null || raw === undefined || raw === "")
+    return {};
   try {
-    const file = Bun.file(getSessionFilePath());
-    const exists = await file.exists();
-    if (!exists)
-      return { ...DEFAULT_SESSION };
-    const raw = await file.text();
-    const result = SessionStateFileSchema.safeParse(JSON.parse(raw));
-    const parsed = result.success ? result.data : {};
-    return {
-      activeView: validateViewId(parsed.activeView) ? parsed.activeView : DEFAULT_SESSION.activeView,
-      sidebarExpanded: typeof parsed.sidebarExpanded === "boolean" ? parsed.sidebarExpanded : DEFAULT_SESSION.sidebarExpanded,
-      windowSize: parsed.windowSize ?? DEFAULT_SESSION.windowSize,
-      lastData: typeof parsed.lastData === "number" ? parsed.lastData : DEFAULT_SESSION.lastData,
-      savedAt: parsed.savedAt ?? DEFAULT_SESSION.savedAt
-    };
-  } catch {
-    return { ...DEFAULT_SESSION };
-  }
+    let v = JSON.parse(raw);
+    if (typeof v === "string") {
+      try {
+        v = JSON.parse(v);
+      } catch {
+        return {};
+      }
+    }
+    if (v && typeof v === "object" && !Array.isArray(v)) {
+      return { ...v };
+    }
+  } catch {}
+  return {};
 }
-var VALID_VIEW_IDS = new Set([
-  "dashboard",
-  "workers",
-  "worker-detail",
-  "trade-monitor",
-  "logs-viewer",
-  "service-manager",
-  "config-editor",
-  "setup-wizard",
-  "settings",
-  "queue-depth",
-  "kv-viewer",
-  "secrets-viewer",
-  "db-query",
-  "ai-chat",
-  "edge-topology",
-  "worker-settings"
+function serializeAgentConfigForKv(config) {
+  return JSON.stringify(config);
+}
+var NUMBER_TOP_KEYS = new Set([
+  "timeoutMs",
+  "retryCount",
+  "maxDailyDrawdownPercent",
+  "trailingStopPercent",
+  "takeProfitPercent"
 ]);
-function validateViewId(id) {
-  return typeof id === "string" && VALID_VIEW_IDS.has(id);
+function getAgentConfigEmbeddedValue(config, fieldKey) {
+  const spec = AGENT_CONFIG_EMBEDDED_FIELDS[fieldKey];
+  if (!spec)
+    return;
+  if (spec.kind === "model") {
+    const map = config.modelMap;
+    if (!map || typeof map !== "object" || Array.isArray(map))
+      return;
+    const v = map[spec.provider];
+    if (typeof v === "string" || typeof v === "number" || typeof v === "boolean")
+      return v;
+    return;
+  }
+  const v = config[spec.key];
+  if (spec.key === "fallbackChain") {
+    if (Array.isArray(v))
+      return JSON.stringify(v);
+    if (typeof v === "string")
+      return v;
+    return;
+  }
+  if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
+    return v;
+  }
+  return;
 }
-
+function setAgentConfigEmbeddedValue(config, fieldKey, value) {
+  const spec = AGENT_CONFIG_EMBEDDED_FIELDS[fieldKey];
+  if (!spec)
+    return { ...config };
+  const next = { ...config };
+  if (spec.kind === "model") {
+    const prev = next.modelMap && typeof next.modelMap === "object" && !Array.isArray(next.modelMap) ? next.modelMap : {};
+    next.modelMap = { ...prev, [spec.provider]: String(value) };
+    return next;
+  }
+  if (spec.key === "fallbackChain") {
+    if (typeof value === "string") {
+      try {
+        next.fallbackChain = JSON.parse(value);
+      } catch {
+        next.fallbackChain = value;
+      }
+    } else {
+      next.fallbackChain = value;
+    }
+    return next;
+  }
+  if (NUMBER_TOP_KEYS.has(spec.key)) {
+    const n = typeof value === "number" ? value : Number(value);
+    next[spec.key] = Number.isFinite(n) ? n : value;
+    return next;
+  }
+  next[spec.key] = value;
+  return next;
+}
+function expandAgentConfigToFieldMap(config) {
+  const out = {};
+  for (const fieldKey of Object.keys(AGENT_CONFIG_EMBEDDED_FIELDS)) {
+    const v = getAgentConfigEmbeddedValue(config, fieldKey);
+    if (v !== undefined)
+      out[fieldKey] = v;
+  }
+  return out;
+}
+function applyAgentConfigFieldUpdates(config, updates) {
+  let next = { ...config };
+  for (const [fieldKey, value] of Object.entries(updates)) {
+    if (isAgentConfigEmbeddedField(fieldKey)) {
+      next = setAgentConfigEmbeddedValue(next, fieldKey, value);
+    }
+  }
+  return next;
+}
+// src/wizard/types.ts
+var CLOUDFLARE_API_TOKEN_PLACEHOLDER = "<USE_CLOUDFLARE_API_TOKEN_ENV_OR_WRANGLER_AUTH>";
 // src/wizard/presets.ts
 var PRESETS = [
   {
@@ -2721,6 +2790,10 @@ var INTEGRATIONS = [
     secrets: {
       WALLET_MNEMONIC_SECRET: "Wallet Mnemonic Phrase",
       WALLET_PK_SECRET: "Wallet Private Key"
+    },
+    optionalSecrets: {
+      SOLANA_PRIVATE_KEY: "Solana private key (base58; leave empty to auto-generate)",
+      JUPITER_API_KEY: "Jupiter Swap API key (portal.jup.ag; Solana DEX)"
     }
   },
   {
@@ -2789,7 +2862,7 @@ var BASE_WORKERS = {
   "d1-worker": {
     enabled: true,
     path: "workers/d1-worker",
-    vars: { database_name: "hoox-db" }
+    vars: { database_name: "trade-data-db" }
   },
   hoox: { enabled: true, path: "workers/hoox-worker", vars: {} },
   "agent-worker": { enabled: true, path: "workers/agent-worker", vars: {} },
@@ -3020,7 +3093,10 @@ class WizardEngine {
       if (integration.vars) {
         Object.assign(workers[workerName].vars, integration.vars);
       }
-      for (const secretName of Object.keys(integration.secrets)) {
+      for (const secretName of [
+        ...Object.keys(integration.secrets),
+        ...Object.keys(integration.optionalSecrets ?? {})
+      ]) {
         if (!workers[workerName].secrets.includes(secretName)) {
           workers[workerName].secrets.push(secretName);
         }
@@ -3038,7 +3114,7 @@ class WizardEngine {
     }
     return {
       global: {
-        cloudflare_api_token: cf?.apiToken ?? "",
+        cloudflare_api_token: CLOUDFLARE_API_TOKEN_PLACEHOLDER,
         cloudflare_account_id: cf?.accountId ?? "",
         cloudflare_secret_store_id: cf?.secretStoreId ?? "",
         subdomain_prefix: cf?.subdomain ?? ""
@@ -3051,19 +3127,20 @@ class WizardEngine {
       d1Databases: [],
       kvNamespaces: [],
       r2Buckets: [],
-      queues: []
+      queues: [],
+      vectorizeIndexes: []
     };
     const allWorkers = [
       ...Object.keys(BASE_WORKERS),
       ...this.state.selectedWorkers,
       ...this.state.selectedIntegrations.map((k) => {
-        const i = INTEGRATIONS.find((i2) => i2.key === k);
+        const i = INTEGRATIONS.find((i) => i.key === k);
         return i?.workerName ?? "";
       }).filter(Boolean)
     ];
     const workerSet = new Set(allWorkers);
     if (workerSet.has("d1-worker")) {
-      plan.d1Databases.push("hoox-db");
+      plan.d1Databases.push("trade-data-db");
     }
     if (workerSet.has("hoox") || workerSet.has("analytics-worker")) {
       plan.kvNamespaces.push("CONFIG_KV");
@@ -3071,8 +3148,13 @@ class WizardEngine {
     if (workerSet.has("web3-wallet-worker")) {
       plan.kvNamespaces.push("WEB3_CACHE_KV");
     }
+    if (workerSet.has("hoox") || workerSet.has("telegram-worker")) {
+      plan.vectorizeIndexes = plan.vectorizeIndexes ?? [];
+      plan.vectorizeIndexes.push("hoox-rag-index");
+    }
     plan.d1Databases = [...new Set(plan.d1Databases)];
     plan.kvNamespaces = [...new Set(plan.kvNamespaces)];
+    plan.vectorizeIndexes = [...new Set(plan.vectorizeIndexes ?? [])];
     return plan;
   }
   applyInput(input) {
@@ -3125,10 +3207,13 @@ class WizardEngine {
     }
   }
 }
-
 // src/wizard/persistence.ts
 function serializeState(state) {
-  return JSON.stringify(state, null, 2);
+  const copy = {
+    ...state,
+    cloudflareConfig: state.cloudflareConfig ? { ...state.cloudflareConfig, apiToken: "" } : undefined
+  };
+  return JSON.stringify(copy, null, 2);
 }
 function deserializeState(json) {
   const parsed = JSON.parse(json);
@@ -3241,6 +3326,10 @@ var manifests = {
       EXCHANGE_TESTNET_SECRET_BINDING: {
         type: "secret",
         description: "Optional unified testnet API secret"
+      },
+      WALLET_EXECUTE_KEY_BINDING: {
+        type: "secret",
+        description: "Mesh key for DEX swaps via web3-wallet-worker"
       }
     },
     services: [
@@ -3253,6 +3342,11 @@ var manifests = {
         binding: "TELEGRAM_SERVICE",
         service: "telegram-worker",
         description: "Notifications"
+      },
+      {
+        binding: "WEB3_WALLET_SERVICE",
+        service: "web3-wallet-worker",
+        description: "DEX spot swaps (Uniswap / Jupiter)"
       }
     ],
     infrastructure: {
@@ -3350,6 +3444,22 @@ var manifests = {
       WALLET_MNEMONIC_SECRET: {
         type: "secret",
         description: "Wallet mnemonic phrase"
+      },
+      WALLET_EXECUTE_KEY_BINDING: {
+        type: "secret",
+        description: "Mesh key for privileged wallet routes"
+      },
+      SOLANA_PRIVATE_KEY: {
+        type: "secret",
+        description: "Solana signing key (base58 seed or Phantom export)"
+      },
+      JUPITER_API_KEY: {
+        type: "secret",
+        description: "Jupiter Swap V2 API key"
+      },
+      RPC_URL_SOLANA: {
+        type: "plaintext",
+        description: "Solana JSON-RPC URL"
       }
     },
     services: [
@@ -3587,7 +3697,6 @@ var WORKER_CATALOG = WORKER_NAMES.map((name) => {
 function getWorkerDefaultEnabled(name) {
   return manifests[name]?.defaultEnabled;
 }
-
 // src/schemas/validators.ts
 import { parse } from "jsonc-parser";
 function validateWranglerJsonc(workerName, manifest, jsoncContent) {
@@ -3904,7 +4013,6 @@ var useUIStore = create()(immer((set) => ({
     state.statusErrorExpanded = expanded;
   })
 })));
-
 // src/stores/service-store.ts
 import { create as create2 } from "zustand";
 import { immer as immer2 } from "zustand/middleware/immer";
@@ -3970,9 +4078,9 @@ var useServiceStore = create2()(immer2((set, get) => ({
   ...initialState2,
   fetchWorkers: async () => {
     const gen = ++fetchWorkersGeneration;
-    const { hooxFetch: hooxFetch2 } = await Promise.resolve().then(() => (init_api_client(), exports_api_client));
+    await Promise.resolve().then(() => init_api_client());
     try {
-      const data = await hooxFetch2("/v1/workers");
+      const data = await hooxFetch("/v1/workers");
       if (gen !== fetchWorkersGeneration)
         return;
       clearReconnectTimer();
@@ -4033,11 +4141,11 @@ var useServiceStore = create2()(immer2((set, get) => ({
     }
   },
   streamTrades: async () => {
-    const { subscribeSSE: subscribeSSE2 } = await Promise.resolve().then(() => (init_sse(), exports_sse));
+    await Promise.resolve().then(() => init_sse());
     tradeStreamAbort?.();
     tradeStreamAbort = null;
     try {
-      const sub = subscribeSSE2("/v1/trades/stream", (trade) => {
+      const sub = subscribeSSE("/v1/trades/stream", (trade) => {
         get().pushTrade(trade);
       });
       const resolved = await Promise.resolve(sub);
@@ -4056,11 +4164,11 @@ var useServiceStore = create2()(immer2((set, get) => ({
     }
   },
   streamLogs: async () => {
-    const { subscribeSSE: subscribeSSE2 } = await Promise.resolve().then(() => (init_sse(), exports_sse));
+    await Promise.resolve().then(() => init_sse());
     logStreamAbort?.();
     logStreamAbort = null;
     try {
-      const sub = subscribeSSE2("/v1/logs/stream", (log) => {
+      const sub = subscribeSSE("/v1/logs/stream", (log) => {
         get().pushLog(log);
       });
       const resolved = await Promise.resolve(sub);
@@ -4223,7 +4331,6 @@ scheduledReconnectTick = async () => {
     await useServiceStore.getState().fetchWorkers();
   }
 };
-
 // src/stores/config-store.ts
 import { create as create3 } from "zustand";
 import { immer as immer3 } from "zustand/middleware/immer";
@@ -4372,177 +4479,183 @@ var useConfigStore = create3()(persist(immer3((set) => ({
     ...persisted
   })
 }));
-
-// src/index.ts
-init_api_client();
-init_sse();
-init_operator_transport();
 export {
-  writeSecureFileSync,
-  writeConfigSync,
-  writeConfig,
-  validateWranglerJsonc,
-  validateRootSecrets,
-  validateDevVars,
-  validateConfig,
-  validateAll,
-  useUIStore,
-  useServiceStore,
-  useConfigStore,
-  trackAnalytics,
-  toError,
-  subscribeSSE,
-  stripJsonc,
-  setAgentConfigEmbeddedValue,
-  serviceFetch,
-  serializeState,
-  serializeAgentConfigForKv,
-  saveSession,
-  restoreSession,
-  resolveOperatorTransportProfile,
-  resolveInternalAuthKey,
-  resolveHooxRuntimeRoot,
-  resolveHooxPath,
-  resolveDependencies,
-  rememberMonorepoRoot,
-  readConfigSync,
-  readConfig,
-  parseDashboardManifest,
-  parseAgentConfigJson,
-  operatorUrl,
-  logKvTimestamp,
-  loadDashboardManifestsFromRoot,
-  loadDashboardKvManifestFromRoot,
-  kvPutMany,
-  kvManifestFromDashboardManifests,
-  kvGetManyAsRecord,
-  kvGetMany,
-  isWithinHooxHome,
-  isUnixModeGroupOrWorldAccessible,
-  isTruthyKillSwitchFlag,
-  isTradingPaused,
-  isHooxSetupRoot,
-  isDashboardSectionFlatKv,
-  isDashboardSectionEditable,
-  isConfigWorldOrGroupReadable,
-  isAgentConfigSection,
-  isAgentConfigEmbeddedField,
-  hooxFetch,
-  healthCheck,
-  headersToObject,
-  hasOperatorClientCredentials,
-  getWorkerDefaultEnabled,
-  getTuiEntryCandidates,
-  getRememberedMonorepoRoot,
-  getRememberedMonorepoPath,
-  getRelativeHooxPath,
-  getHooxWranglerPath,
-  getHooxStatePath,
-  getHooxRepoPath,
-  getHooxHome,
-  getHooxDataDir,
-  getHooxConfigDir,
-  getAgentConfigEmbeddedValue,
-  generateWranglerJsonc,
-  generateDevVars,
-  formatUptime,
-  formatTimestamp,
-  formatRequests,
-  formatRelativeTime as formatRelativeTimeFromTime,
-  formatRelativeTime2 as formatRelativeTime,
-  formatPercent,
-  formatNumber,
-  formatMemory,
-  formatLatency,
-  formatDurationCompact,
-  formatDuration2 as formatDuration,
-  formatCurrency,
-  formatCpu,
-  formatConfigPermissionWarning,
-  formatCompactCurrency,
-  findHooxSetupRoot,
-  expandAgentConfigToFieldMap,
-  ensureHooxDirSecure,
-  deserializeState,
-  dashboardWorkerDir,
-  createSuccessResponse,
-  createQueueHandler,
-  createMockVectorizeIndex,
-  createMockSecretsStore,
-  createMockR2,
-  createMockQueue,
-  createMockKV,
-  createMockFetcher,
-  createMockExecutionContext,
-  createMockEnv,
-  createMockD1,
-  createMockAnalyticsEngineDataset,
-  createMockAnalyticsEngine,
-  createMockAi,
-  createJsonResponse,
-  createErrorResponse,
-  createCronHandler,
-  checkKillSwitch,
-  buildOperatorAuthHeaders,
-  buildDashboardKvKey,
-  authenticatedServiceFetch,
-  applyAgentConfigFieldUpdates,
-  WorkerStatusColor,
-  WorkerAPIError,
-  WizardEngine,
-  WebhookPayloadSchema,
-  WORKER_NAMES,
-  WORKER_MANIFESTS,
-  WORKER_DEPENDENCIES,
-  WORKER_CATALOG,
-  WIZARD_STATE_PATH,
-  WALLET_EXECUTE_AUTH_KEY_FIELDS,
-  TradeSignalSchema,
-  TradeQueueMessageSchema,
-  TradeActionSchema,
-  TRADE_READ_AUTH_KEY_FIELDS,
-  TRADE_EXECUTE_AUTH_KEY_FIELDS,
-  TRADEMARK_NOTICE,
-  TRADEMARKS,
-  TELEGRAM_ALERT_AUTH_KEY_FIELDS,
-  ServiceAuthError,
-  PositionSchema,
-  PRESETS,
-  LogLevelColor,
-  KV_BULK_GET_MAX_KEYS,
-  KVKeys,
-  KILL_SWITCH_KEYS,
-  KILL_SWITCH_ACTIVE_PREFIX,
-  InternalAuthKeyFields,
-  INTEGRATIONS,
-  HOOX_DIR_MODE,
-  HOOX_CONFIG_FILE_MODE,
-  FULL_LEGAL_NOTICE,
-  ExchangeRouter,
-  Errors,
-  DISCLAIMER_HEADER,
-  DISCLAIMER,
-  DASHBOARD_WORKER_PREFIX,
-  DASHBOARD_WORKER_IDS,
-  DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS,
-  DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS,
-  DASHBOARD_SECTION_PREFIX,
-  DASHBOARD_SECTIONS_UI_SKIP,
-  DASHBOARD_SECTIONS_NOT_FLAT_KV,
-  DASHBOARD_SECTIONS_AGENT_CONFIG,
-  DASHBOARD_FIELD_KV_OVERRIDES,
-  DASHBOARD_D1_READ_AUTH_KEY_FIELDS,
-  D1_WRITE_AUTH_KEY_FIELDS,
-  D1_READ_AUTH_KEY_FIELDS,
-  D1Repository,
-  CoolBracketPalette,
-  ConnectionStatusColor,
-  Colors,
-  COPYRIGHT,
-  CALLED_BY,
-  BaseExchangeClient2 as BaseExchangeClient,
-  BalanceSchema,
-  AlertSeverityColor,
+  AGENT_CONFIG_EMBEDDED_FIELDS,
   AGENT_CONFIG_KV_KEY,
-  AGENT_CONFIG_EMBEDDED_FIELDS
+  AlertSeverityColor,
+  BalanceSchema,
+  BaseExchangeClient2 as BaseExchangeClient,
+  CALLED_BY,
+  CLOUDFLARE_API_TOKEN_PLACEHOLDER,
+  COPYRIGHT,
+  Colors,
+  ConnectionStatusColor,
+  CoolBracketPalette,
+  D1Repository,
+  D1_READ_AUTH_KEY_FIELDS,
+  D1_WRITE_AUTH_KEY_FIELDS,
+  DASHBOARD_D1_READ_AUTH_KEY_FIELDS,
+  DASHBOARD_FIELD_KV_OVERRIDES,
+  DASHBOARD_SECTIONS_AGENT_CONFIG,
+  DASHBOARD_SECTIONS_NOT_FLAT_KV,
+  DASHBOARD_SECTIONS_UI_SKIP,
+  DASHBOARD_SECTION_PREFIX,
+  DASHBOARD_TELEGRAM_ALERT_AUTH_KEY_FIELDS,
+  DASHBOARD_TRADE_EXECUTE_AUTH_KEY_FIELDS,
+  DASHBOARD_WORKER_IDS,
+  DASHBOARD_WORKER_PREFIX,
+  DISCLAIMER,
+  DISCLAIMER_HEADER,
+  Errors,
+  ExchangeRouter,
+  FULL_LEGAL_NOTICE,
+  HOOX_CONFIG_FILE_MODE,
+  HOOX_DIR_MODE,
+  INTEGRATIONS,
+  InternalAuthKeyFields,
+  KILL_SWITCH_ACTIVE_PREFIX,
+  KILL_SWITCH_KEYS,
+  KVKeys,
+  KV_BULK_GET_MAX_KEYS,
+  LogLevelColor,
+  PRESETS,
+  PositionSchema,
+  ServiceAuthError,
+  TELEGRAM_ALERT_AUTH_KEY_FIELDS,
+  TRADEMARKS,
+  TRADEMARK_NOTICE,
+  TRADE_EXECUTE_AUTH_KEY_FIELDS,
+  TRADE_READ_AUTH_KEY_FIELDS,
+  TradeActionSchema,
+  TradeQueueMessageSchema,
+  TradeSignalSchema,
+  WALLET_EXECUTE_AUTH_KEY_FIELDS,
+  WIZARD_STATE_PATH,
+  WORKER_CATALOG,
+  WORKER_DEPENDENCIES,
+  WORKER_MANIFESTS,
+  WORKER_NAMES,
+  WebhookPayloadSchema,
+  WizardEngine,
+  WorkerAPIError,
+  WorkerStatusColor,
+  applyAgentConfigFieldUpdates,
+  authenticatedServiceFetch,
+  buildDashboardKvKey,
+  buildOperatorAuthHeaders,
+  checkKillSwitch,
+  createCronHandler,
+  createErrorResponse,
+  createJsonResponse,
+  createMockAi,
+  createMockAnalyticsEngine,
+  createMockAnalyticsEngineDataset,
+  createMockD1,
+  createMockEnv,
+  createMockExecutionContext,
+  createMockFetcher,
+  createMockKV,
+  createMockQueue,
+  createMockR2,
+  createMockSecretsStore,
+  createMockVectorizeIndex,
+  createQueueHandler,
+  createSuccessResponse,
+  dashboardWorkerDir,
+  deserializeState,
+  effectiveTenantId,
+  ensureHooxDirSecure,
+  expandAgentConfigToFieldMap,
+  findHooxSetupRoot,
+  formatCompactCurrency,
+  formatConfigPermissionWarning,
+  formatCpu,
+  formatCurrency,
+  formatDuration,
+  formatDurationCompact,
+  formatLatency,
+  formatMemory,
+  formatNumber,
+  formatPercent,
+  formatRelativeTime,
+  formatRelativeTime2 as formatRelativeTimeFromTime,
+  formatRequests,
+  formatTimestamp,
+  formatUptime,
+  generateDevVars,
+  generateWranglerJsonc,
+  getAgentConfigEmbeddedValue,
+  getHooxConfigDir,
+  getHooxDataDir,
+  getHooxHome,
+  getHooxRepoPath,
+  getHooxStatePath,
+  getHooxWranglerPath,
+  getRelativeHooxPath,
+  getRememberedMonorepoPath,
+  getRememberedMonorepoRoot,
+  getTuiEntryCandidates,
+  getWorkerDefaultEnabled,
+  hasOperatorClientCredentials,
+  hasScope,
+  headersToObject,
+  healthCheck,
+  hooxFetch,
+  isAgentConfigEmbeddedField,
+  isAgentConfigSection,
+  isConfigWorldOrGroupReadable,
+  isDashboardSectionEditable,
+  isDashboardSectionFlatKv,
+  isHooxSetupRoot,
+  isTenantFlagOn,
+  isTenantMode,
+  isTradingPaused,
+  isTruthyKillSwitchFlag,
+  isUnixModeGroupOrWorldAccessible,
+  isWithinHooxHome,
+  kvGetMany,
+  kvGetManyAsRecord,
+  kvManifestFromDashboardManifests,
+  kvPutMany,
+  loadDashboardKvManifestFromRoot,
+  loadDashboardManifestsFromRoot,
+  logKvTimestamp,
+  operatorUrl,
+  parseAgentConfigJson,
+  parseDashboardManifest,
+  readConfig,
+  readConfigSync,
+  rememberMonorepoRoot,
+  resolveDependencies,
+  resolveHooxPath,
+  resolveHooxRuntimeRoot,
+  resolveInternalAuthKey,
+  resolveOperatorTransportProfile,
+  restoreSession,
+  saveSession,
+  scopeKey,
+  scopeR2Key,
+  serializeAgentConfigForKv,
+  serializeState,
+  serviceFetch,
+  setAgentConfigEmbeddedValue,
+  stripJsonc,
+  subscribeSSE,
+  tenantContextOf,
+  tenantScope,
+  toError,
+  trackAnalytics,
+  useConfigStore,
+  useServiceStore,
+  useUIStore,
+  validateAll,
+  validateConfig,
+  validateDevVars,
+  validateRootSecrets,
+  validateWranglerJsonc,
+  verifyCacheKey,
+  withTenantId,
+  writeConfig,
+  writeConfigSync,
+  writeSecureFileSync
 };