@jango-blockchained/hoox-cli 0.7.0 → 0.7.2

package/dist/index.js

@@ -21388,18 +21388,15 @@ class KvSyncService {
     return stdout2.trim() || null;
   }
   async set(namespaceId, key, value) {
-    const proc = Bun.spawn([
-      "wrangler",
-      "kv",
-      "key",
-      "put",
-      "--namespace-id",
-      namespaceId,
-      key,
-      value
-    ], { stdout: "pipe", stderr: "pipe" });
+    const proc = Bun.spawn(["wrangler", "kv", "key", "put", "--namespace-id", namespaceId, key], { stdout: "pipe", stderr: "pipe", stdin: "pipe" });
+    proc.stdin.write(value + `
+`);
+    proc.stdin.end();
+    const [, stderr] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text()
+    ]);
     const exitCode = await proc.exited;
-    const stderr = await new Response(proc.stderr).text();
     if (exitCode !== 0) {
       throw new Error(`Failed to set key "${key}": ${stderr.trim() || `exit ${exitCode}`}`);
     }
@@ -21531,7 +21528,7 @@ var exports_schema_service = {};
 __export(exports_schema_service, {
   SchemaService: () => SchemaService
 });
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync4, existsSync as existsSync5 } from "fs";
 import { resolve as resolve5 } from "path";
 
 class SchemaService {
@@ -21565,34 +21562,41 @@ class SchemaService {
     const workerWranglerPath = resolve5(workersDir, name, "wrangler.jsonc");
     const devVarsPath = resolve5(workersDir, name, ".dev.vars");
     const errors4 = [];
+    const isHooxProject = existsSync5(resolve5(this.projectRoot, "wrangler.jsonc")) || existsSync5(resolve5(this.projectRoot, "workers"));
     try {
       const wranglerContent = readFileSync4(workerWranglerPath, "utf-8");
       errors4.push(...validateWranglerJsonc(name, manifest, wranglerContent));
     } catch (e) {
+      const isErrnoException = e instanceof Error && "code" in e;
+      const isEnoent = isErrnoException && e.code === "ENOENT";
+      const errMessage = e instanceof Error ? e.message : String(e);
+      const message = isEnoent && !isHooxProject ? `Cannot read ${workerWranglerPath}: File not found. Are you in the Hoox project root directory?` : `Cannot read ${workerWranglerPath}: ${errMessage}`;
       errors4.push({
         worker: name,
         severity: "error",
-        message: `Cannot read ${workerWranglerPath}: ${e.message}`
+        message
       });
     }
     try {
       const rootContent = readFileSync4(rootWranglerPath, "utf-8");
       errors4.push(...validateRootSecrets(name, manifest, rootContent));
     } catch (e) {
+      const errMessage = e instanceof Error ? e.message : String(e);
       errors4.push({
         worker: name,
         severity: "warning",
-        message: `Cannot read root wrangler.jsonc: ${e.message}`
+        message: `Cannot read root wrangler.jsonc: ${errMessage}`
       });
     }
     try {
       const devVarsContent = readFileSync4(devVarsPath, "utf-8");
       errors4.push(...validateDevVars(name, manifest, devVarsContent));
     } catch (e) {
+      const errMessage = e instanceof Error ? e.message : String(e);
       errors4.push({
         worker: name,
         severity: "warning",
-        message: `Cannot read ${devVarsPath}: ${e.message}`
+        message: `Cannot read ${devVarsPath}: ${errMessage}`
       });
     }
     return {
@@ -23674,11 +23678,13 @@ class CLIError extends Error {
   code;
   details;
   recoverable;
-  constructor(message, code = 1 /* ERROR */, details, recoverable = false) {
+  hint;
+  constructor(message, code = 1 /* ERROR */, details, recoverable = false, hint) {
     super(message);
     this.code = code;
     this.details = details;
     this.recoverable = recoverable;
+    this.hint = hint;
     this.name = "CLIError";
   }
 }
@@ -23746,7 +23752,63 @@ function stripAnsi(str) {
   return ansis_default.strip(str);
 }
 
+// src/utils/timer.ts
+function formatDuration2(ms) {
+  if (!Number.isFinite(ms) || ms < 0)
+    return "0ms";
+  if (ms < 1000)
+    return `${Math.round(ms)}ms`;
+  if (ms < 60000)
+    return `${(ms / 1000).toFixed(1)}s`;
+  if (ms < 3600000) {
+    const m2 = Math.floor(ms / 60000);
+    const s = Math.floor(ms % 60000 / 1000);
+    return `${m2}m ${String(s).padStart(2, "0")}s`;
+  }
+  const h = Math.floor(ms / 3600000);
+  const m = Math.floor(ms % 3600000 / 60000);
+  return `${h}h ${String(m).padStart(2, "0")}m`;
+}
+function startTimer() {
+  const startedAt = Date.now();
+  return {
+    ms: () => Date.now() - startedAt,
+    format: () => formatDuration2(Date.now() - startedAt)
+  };
+}
+
+// src/utils/format-mode.ts
+function isRichMode(opts) {
+  if (opts?.json || opts?.quiet)
+    return false;
+  return Boolean(process.stdout.isTTY);
+}
+
 // src/utils/formatters.ts
+var formatDuration3 = formatDuration2;
+var BADGE_STYLE = {
+  ok: { bg: ansis_default.bgGreen, fg: ansis_default.black },
+  warn: { bg: ansis_default.bgYellow, fg: ansis_default.black },
+  err: { bg: ansis_default.bgRed, fg: ansis_default.white },
+  info: { bg: ansis_default.bgBlue, fg: ansis_default.white }
+};
+function formatBadge(level, text) {
+  const content = (text ?? defaultBadgeLabel(level)).padEnd(4, " ");
+  const { bg, fg } = BADGE_STYLE[level];
+  return bg(fg(` ${content} `));
+}
+function defaultBadgeLabel(level) {
+  switch (level) {
+    case "ok":
+      return "OK";
+    case "warn":
+      return "WARN";
+    case "err":
+      return "FAIL";
+    case "info":
+      return "INFO";
+  }
+}
 function formatSuccess(message, opts) {
   if (opts?.quiet)
     return;
@@ -23770,6 +23832,9 @@ function formatError2(error51, opts) {
     if (cliError?.details) {
       output.details = cliError.details;
     }
+    if (cliError?.hint) {
+      output.hint = cliError.hint;
+    }
     process.stdout.write(JSON.stringify(output) + `
 `);
     return;
@@ -23783,6 +23848,10 @@ function formatError2(error51, opts) {
 `);
   if (cliError?.details) {
     process.stdout.write(`  ${theme.dim(cliError.details)}
+`);
+  }
+  if (cliError?.hint) {
+    process.stdout.write(`${theme.dim("\u21B3 hint:")} ${theme.value(cliError.hint)}
 `);
   }
 }
@@ -25455,6 +25524,16 @@ ${l2}
   }).prompt();
 };
 var i = `${styleText2("gray", S_BAR)}  `;
+var tasks = async (o2, e) => {
+  for (const t2 of o2) {
+    if (t2.enabled === false)
+      continue;
+    const s = spinner(e);
+    s.start(t2.title);
+    const n2 = await t2.task(s.message);
+    s.stop(n2 || t2.title);
+  }
+};
 var text = (t2) => new n({
   validate: t2.validate,
   placeholder: t2.placeholder,
@@ -25540,7 +25619,12 @@ class CloudflareService {
       };
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      return { ok: false, error: `Failed to spawn wrangler: ${message}` };
+      const hint = /ENOENT|not found/i.test(message) ? "Install wrangler with `bun add -g wrangler` (or `npm i -g wrangler`), then run `wrangler login`." : undefined;
+      return {
+        ok: false,
+        error: hint ? `Failed to spawn wrangler: ${message}
+\u21B3 hint: ${hint}` : `Failed to spawn wrangler: ${message}`
+      };
     }
   }
   async whoami() {
@@ -25752,7 +25836,32 @@ class CloudflareService {
     ]);
   }
   async zonesList() {
-    return this.runWrangler(["zones", "list"]);
+    const token = process.env.CLOUDFLARE_API_TOKEN;
+    if (!token) {
+      return {
+        ok: false,
+        error: "CLOUDFLARE_API_TOKEN environment variable is not set. Set it or run `wrangler login`."
+      };
+    }
+    try {
+      const response = await fetch("https://api.cloudflare.com/client/v4/zones?per_page=50", {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json"
+        }
+      });
+      const json2 = await response.json();
+      if (!response.ok || !json2.success) {
+        const errorMsg = json2.errors?.map((e) => e.message).join("; ") || `HTTP ${response.status}`;
+        return { ok: false, error: `Failed to list zones: ${errorMsg}` };
+      }
+      const lines = json2.result.map((z2) => `${z2.name} (${z2.id})`);
+      return { ok: true, value: lines.join(`
+`) };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return { ok: false, error: `Cloudflare API request failed: ${message}` };
+    }
   }
   extractUrl(stdout2) {
     for (const line of stdout2.split(`
@@ -25976,8 +26085,8 @@ OPTIONS:
 
 EXAMPLES:
   hoox init                           Interactive wizard
-  hoox init --token cfut_xxx --account xxx  Non-interactive`).option("--token <token>", "Cloudflare API token (non-interactive)").option("--account <id>", "Cloudflare Account ID (non-interactive)").option("--secret-store <id>", "Secret Store ID (non-interactive)").option("--prefix <prefix>", "Subdomain prefix (non-interactive, default: cryptolinx)").option("--preset <name>", "Worker preset (minimal, standard, full)").option("--resume", "Resume from saved wizard state").option("--accept-risk", "Skip the risk acknowledgment confirmation").action(withErrorHandling(async (options) => {
-    const globalOpts = getFormatOptions(program2);
+  hoox init --token cfut_xxx --account xxx  Non-interactive`).option("--token <token>", "Cloudflare API token (non-interactive)").option("--account <id>", "Cloudflare Account ID (non-interactive)").option("--secret-store <id>", "Secret Store ID (non-interactive)").option("--prefix <prefix>", "Subdomain prefix (non-interactive, default: cryptolinx)").option("--preset <name>", "Worker preset (minimal, standard, full)").option("--resume", "Resume from saved wizard state").option("--accept-risk", "Skip the risk acknowledgment confirmation").action(withErrorHandling(async (options, cmd) => {
+    const globalOpts = getFormatOptions(cmd);
     const isNonInteractive = Boolean(options.token && options.account);
     await runInitCommand(options, globalOpts, isNonInteractive);
   }, { service: "init" }));
@@ -26642,11 +26751,53 @@ class DockerService {
   }
   isCommandAvailable(cmd) {
     return new Promise((resolve2) => {
-      const proc = Bun.spawn(["which", cmd.split(" ")[0]], {
-        stdout: "pipe",
-        stderr: "pipe"
+      const parts = cmd.split(/\s+/).filter(Boolean);
+      const binary = parts[0];
+      const hasSubcommand = parts.length > 1;
+      let proc;
+      try {
+        proc = Bun.spawn(["which", binary], {
+          stdout: "pipe",
+          stderr: "pipe"
+        });
+      } catch {
+        resolve2(false);
+        return;
+      }
+      const timer = setTimeout(() => {
+        try {
+          proc.kill();
+        } catch {}
+        resolve2(false);
+      }, 5000);
+      proc.exited.then((code) => {
+        clearTimeout(timer);
+        if (code !== 0) {
+          resolve2(false);
+          return;
+        }
+        if (!hasSubcommand) {
+          resolve2(true);
+          return;
+        }
+        try {
+          const subproc = Bun.spawn([binary, ...parts.slice(1), "version"], {
+            stdout: "pipe",
+            stderr: "pipe"
+          });
+          subproc.exited.then((subcode) => {
+            try {
+              subproc.kill();
+            } catch {}
+            resolve2(subcode === 0);
+          }).catch(() => resolve2(true));
+        } catch {
+          resolve2(true);
+        }
+      }).catch(() => {
+        clearTimeout(timer);
+        resolve2(false);
       });
-      proc.exited.then((code) => resolve2(code === 0)).catch(() => resolve2(false));
     });
   }
 }
@@ -26684,8 +26835,8 @@ OPTIONS:
 EXAMPLES:
   hoox dev start
   hoox dev start --runtime native
-  hoox dev start --runtime docker`).option("--runtime <native|docker>", "Choose dev runtime (overrides saved preference)").action(withErrorHandling(async (options) => {
-    const fmt = getFormatOptions(program2);
+  hoox dev start --runtime docker`).option("--runtime <native|docker>", "Choose dev runtime (overrides saved preference)").action(withErrorHandling(async (options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     const configService = new ConfigService;
     const prereqs = new PrerequisitesService;
     const docker = new DockerService;
@@ -26803,8 +26954,8 @@ OPTIONS:
 EXAMPLES:
   hoox dev worker trade-worker
   hoox dev worker agent-worker --port 8788
-  hoox dev worker hoox --runtime docker`).option("--port <port>", "Dev server port (default: 8787)", (v) => parseInt(v, 10)).option("--runtime <native|docker>", "Choose dev runtime (overrides saved preference)").action(withErrorHandling(async (name, options) => {
-    const fmt = getFormatOptions(program2);
+  hoox dev worker hoox --runtime docker`).option("--port <port>", "Dev server port (default: 8787)", (v) => parseInt(v, 10)).option("--runtime <native|docker>", "Choose dev runtime (overrides saved preference)").action(withErrorHandling(async (name, options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     const configService = new ConfigService;
     await configService.load();
     const worker = configService.getWorker(name);
@@ -26839,8 +26990,8 @@ OPTIONS:
 
 EXAMPLES:
   hoox dev dashboard
-  hoox dev dashboard --runtime docker`).option("--runtime <native|docker>", "Choose dev runtime (overrides saved preference)").action(withErrorHandling(async () => {
-    const fmt = getFormatOptions(program2);
+  hoox dev dashboard --runtime docker`).option("--runtime <native|docker>", "Choose dev runtime (overrides saved preference)").action(withErrorHandling(async (_options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     const dashboardPath = path3.resolve(process.cwd(), "workers/dashboard");
     const dashboardDir = Bun.file(dashboardPath);
     if (!await dashboardDir.exists()) {
@@ -26859,6 +27010,131 @@ EXAMPLES:
 }
 // src/commands/deploy/deploy-command.ts
 init_config2();
+
+// src/utils/rich.ts
+async function runRichTasks(tasks2, options = {}) {
+  const rich = isRichMode(options.format);
+  const results = [];
+  if (tasks2.length === 0)
+    return results;
+  const silent = options.format?.json === true;
+  if (rich && !silent) {
+    if (options.title)
+      log.step(theme.heading(options.title));
+    await tasks(tasks2.map((t2) => ({
+      title: t2.title,
+      task: async (message) => {
+        const timer = startTimer();
+        try {
+          const value = await t2.run();
+          const result = {
+            title: t2.title,
+            ok: true,
+            ms: timer.ms(),
+            value
+          };
+          if (t2.details) {
+            result.details = await t2.details(value);
+          }
+          results.push(result);
+          const dur = formatDuration2(result.ms);
+          if (result.details) {
+            const summary = Object.entries(result.details).map(([k, v]) => `${theme.dim(k)}=${theme.value(v)}`).join(" ");
+            message(`${theme.success(icons.success)} ${dur}  ${summary}`);
+          } else {
+            message(`${theme.success(icons.success)} ${dur}`);
+          }
+        } catch (err) {
+          const message2 = err instanceof CLIError ? err.message : err instanceof Error ? err.message : String(err);
+          const result = {
+            title: t2.title,
+            ok: false,
+            ms: timer.ms(),
+            error: message2
+          };
+          results.push(result);
+          message(`${theme.error(icons.error)} ${formatDuration2(result.ms)}  ${theme.dim(message2)}`);
+        }
+      }
+    })));
+  } else if (silent) {
+    for (const t2 of tasks2) {
+      const timer = startTimer();
+      try {
+        const value = await t2.run();
+        const result = {
+          title: t2.title,
+          ok: true,
+          ms: timer.ms(),
+          value
+        };
+        if (t2.details) {
+          result.details = await t2.details(value);
+        }
+        results.push(result);
+      } catch (err) {
+        const message2 = err instanceof CLIError ? err.message : err instanceof Error ? err.message : String(err);
+        const result = {
+          title: t2.title,
+          ok: false,
+          ms: timer.ms(),
+          error: message2
+        };
+        results.push(result);
+      }
+    }
+  } else {
+    for (const t2 of tasks2) {
+      log.step(t2.title);
+      const timer = startTimer();
+      try {
+        const value = await t2.run();
+        const result = {
+          title: t2.title,
+          ok: true,
+          ms: timer.ms(),
+          value
+        };
+        if (t2.details) {
+          result.details = await t2.details(value);
+        }
+        results.push(result);
+        log.success(`${t2.title} ${theme.dim(formatDuration2(result.ms))}`);
+      } catch (err) {
+        const message2 = err instanceof CLIError ? err.message : err instanceof Error ? err.message : String(err);
+        const result = {
+          title: t2.title,
+          ok: false,
+          ms: timer.ms(),
+          error: message2
+        };
+        results.push(result);
+        log.error(`${t2.title} ${theme.dim(message2)}`);
+      }
+    }
+  }
+  if (results.some((r2) => !r2.ok)) {
+    process.exitCode = 1;
+  }
+  if (options.onSummary) {
+    options.onSummary(results);
+  } else if (!options.format?.json && !options.format?.quiet) {
+    renderDefaultSummary(results);
+  }
+  return results;
+}
+function renderDefaultSummary(results) {
+  if (results.length === 0)
+    return;
+  const rows = results.map((r2) => ({
+    Task: r2.title,
+    Status: r2.ok ? theme.success(icons.success) : theme.error(icons.error),
+    Duration: formatDuration2(r2.ms)
+  }));
+  formatTable(rows, {});
+}
+
+// src/commands/deploy/deploy-command.ts
 import { statSync, existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { resolve as resolve2 } from "path";
 
@@ -26937,13 +27213,6 @@ class EnvService {
         default: "cryptolinx",
         hint: "Prefix for worker URLs"
       },
-      {
-        name: "INTERNAL_KEY_BINDING",
-        required: true,
-        secret: true,
-        section: "Internal Auth",
-        hint: "Internal key for D1 worker auth"
-      },
       {
         name: "TRADE_INTERNAL_KEY",
         required: true,
@@ -27340,62 +27609,61 @@ var DEPLOY_ORDER = [
   "hoox",
   "dashboard"
 ];
-async function deployAll(configService, cf, env, forceRebuildDashboard = false, autoMode = false) {
+async function deployAll(configService, cf, env, forceRebuildDashboard = false, autoMode = false, format3 = {}) {
   const enabled = configService.listEnabledWorkers();
   const workers = DEPLOY_ORDER.filter((w) => w !== "dashboard" && enabled.includes(w));
   const unknown2 = enabled.filter((w) => w !== "dashboard" && !DEPLOY_ORDER.includes(w));
   const allItems = [...workers, ...unknown2, "dashboard"];
-  const results = [];
   if (allItems.length === 0) {
-    return results;
+    return [];
   }
-  const s = spinner();
-  s.start(`Deploying ${allItems.length} item(s)...`);
-  for (let i2 = 0;i2 < allItems.length; i2++) {
-    const name = allItems[i2];
-    const isDashboard = name === "dashboard";
-    s.message(`[${i2 + 1}/${allItems.length}] ${name}...`);
-    let result;
-    if (isDashboard) {
-      result = await deployDashboard(cf, forceRebuildDashboard, true, autoMode);
-    } else {
-      result = await deploySingle(configService, cf, name, env);
-    }
-    results.push(result);
-    if (result.success) {
-      s.stop(`${theme.success(icons.success)} ${name} deployed`);
-    } else {
-      s.stop(`${theme.error(icons.error)} ${name} failed`);
-    }
-    if (result.success) {
-      if (result.url) {
-        log.step(`  ${theme.dim("URL:")}     ${result.url}`);
-      }
-      if (result.size) {
-        log.step(`  ${theme.dim("Size:")}     ${result.size}`);
-      }
-      if (result.startupTime) {
-        log.step(`  ${theme.dim("Startup:")} ${result.startupTime}`);
+  const tasks2 = allItems.map((name) => ({
+    title: name,
+    run: async () => {
+      if (name === "dashboard") {
+        return await deployDashboard(cf, forceRebuildDashboard, true, autoMode);
       }
-      if (result.versionId) {
-        log.step(`  ${theme.dim("Version:")} ${result.versionId.slice(0, 8)}...`);
-      }
-      if (!result.url && !result.size && !result.startupTime && !result.versionId && result.rawOutput) {
-        log.step(`  ${theme.dim("Output:")}  ${result.rawOutput.slice(0, 80)}`);
-      }
-    } else if (result.error) {
-      log.warn(`  ${theme.error("Error:")} ${result.error}`);
-    }
-    if (i2 < allItems.length - 1) {
-      s.start(`Deploying ${allItems.length} item(s)...`);
+      return await deploySingle(configService, cf, name, env);
+    },
+    details: (r2) => {
+      if (!r2.success)
+        return { error: r2.error ?? "unknown" };
+      const d = {};
+      if (r2.url)
+        d.URL = r2.url;
+      if (r2.size)
+        d.Size = r2.size;
+      if (r2.startupTime)
+        d.Startup = r2.startupTime;
+      if (r2.versionId)
+        d.Version = r2.versionId.slice(0, 8) + "\u2026";
+      if (Object.keys(d).length === 0 && r2.rawOutput) {
+        d.Output = r2.rawOutput.slice(0, 80);
+      }
+      return d;
     }
-  }
-  const succeeded = results.filter((r2) => r2.success).length;
-  const failed = results.filter((r2) => !r2.success).length;
-  if (failed > 0) {
-    log.warn(`Summary: ${succeeded}/${allItems.length} deployed (${failed} failed)`);
-  }
-  return results;
+  }));
+  const richResults = await runRichTasks(tasks2, {
+    title: `Deploying ${allItems.length} item(s)`,
+    format: format3,
+    onSummary: (results) => renderDeploySummary(results, format3)
+  });
+  return richResults.map((r2) => r2.value).filter(Boolean);
+}
+function renderDeploySummary(results, format3) {
+  if (format3.json || format3.quiet)
+    return;
+  const rows = results.map((r2) => {
+    const d = r2.value;
+    return {
+      Worker: r2.title,
+      Status: r2.ok ? formatBadge("ok", "DEPLOYED") : formatBadge("err", "FAILED"),
+      URL: d?.url ?? theme.dim("\u2014"),
+      Size: d?.size ?? theme.dim("\u2014"),
+      Duration: formatDuration3(r2.ms)
+    };
+  });
+  formatTable(rows, {});
 }
 async function deployDashboard(_cf, forceRebuild = false, silentMode = false, autoMode = false) {
   const dashboardPath = "workers/dashboard";
@@ -27803,9 +28071,10 @@ EXAMPLES:
   hoox deploy all
   hoox deploy all --env production
   hoox deploy all --rebuild
-  hoox deploy all --auto`).option("--env <env>", "Cloudflare environment (e.g. production, staging)").option("--rebuild", "Force rebuild of dashboard before deploying").option("--auto", "Skip dashboard rebuild prompt, use existing build if available").option("--dry-run", "Preview deployment plan without executing").action(withErrorHandling(async (options) => {
+  hoox deploy all --auto`).option("--env <env>", "Cloudflare environment (e.g. production, staging)").option("--rebuild", "Force rebuild of dashboard before deploying").option("--auto", "Skip dashboard rebuild prompt, use existing build if available").option("--dry-run", "Preview deployment plan without executing").action(withErrorHandling(async (options, cmd) => {
     const configService = new ConfigService;
     await configService.load();
+    const format3 = getFormatOptions(cmd);
     if (options.dryRun) {
       const enabled = configService.listEnabledWorkers();
       const workers = DEPLOY_ORDER.filter((w) => w !== "dashboard" && enabled.includes(w));
@@ -27838,7 +28107,7 @@ ${theme.dim("Run without --dry-run to deploy.")}
       return;
     }
     const cf = new CloudflareService;
-    await deployAll(configService, cf, options.env, options.rebuild ?? false, options.auto ?? false);
+    await deployAll(configService, cf, options.env, options.rebuild ?? false, options.auto ?? false, format3);
   }, { service: "deploy" }));
   deployCmd.command("workers").summary("Deploy all enabled workers to Cloudflare").description(`Deploy all enabled workers to Cloudflare Workers.
 
@@ -27927,8 +28196,8 @@ OPTIONS:
 
 EXAMPLES:
   hoox deploy worker trade-worker
-  hoox deploy worker agent-worker --env production`).option("--env <env>", "Cloudflare environment (e.g. production, staging)").action(withErrorHandling(async (name, options) => {
-    const fmt = getFormatOptions(program2);
+  hoox deploy worker agent-worker --env production`).option("--env <env>", "Cloudflare environment (e.g. production, staging)").action(withErrorHandling(async (name, options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     const configService = new ConfigService;
     await configService.load();
     const cf = new CloudflareService;
@@ -27950,8 +28219,8 @@ OPTIONS:
 
 EXAMPLES:
   hoox deploy dashboard              Interactive: choose to rebuild or use existing
-  hoox deploy dashboard --rebuild    Force rebuild before deploying`).option("--rebuild", "Force rebuild of dashboard before deploying").action(withErrorHandling(async (options) => {
-    const fmt = getFormatOptions(program2);
+  hoox deploy dashboard --rebuild    Force rebuild before deploying`).option("--rebuild", "Force rebuild of dashboard before deploying").action(withErrorHandling(async (options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     const cf = new CloudflareService;
     const result = await deployDashboard(cf, options.rebuild);
     if (result.success) {
@@ -27977,8 +28246,8 @@ Use --token and --secret-token to override.
 EXAMPLES:
   hoox deploy telegram-webhook
   hoox deploy telegram-webhook --token 123456:ABC-DEF1234
-  hoox deploy telegram-webhook --subdomain myapp`).option("--token <token>", "Telegram bot token (from @BotFather)").option("--secret-token <secret>", "Telegram webhook secret token").option("--subdomain <prefix>", "Worker subdomain prefix (default: from config)").action(withErrorHandling(async (options) => {
-    const fmt = getFormatOptions(program2);
+  hoox deploy telegram-webhook --subdomain myapp`).option("--token <token>", "Telegram bot token (from @BotFather)").option("--secret-token <secret>", "Telegram webhook secret token").option("--subdomain <prefix>", "Worker subdomain prefix (default: from config)").action(withErrorHandling(async (options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     await doTelegramWebhook(fmt, options.token, options.secretToken, options.subdomain);
   }, { service: "deploy" }));
   deployCmd.command("update-internal-urls").summary("Update dashboard wrangler.jsonc with current service URLs").description(`Update the dashboard's wrangler.jsonc with the current service URLs.
@@ -27987,8 +28256,8 @@ This is a post-deployment step that ensures the dashboard has correct
 service binding URLs for all workers.
 
 EXAMPLES:
-  hoox deploy update-internal-urls`).action(withErrorHandling(async () => {
-    const fmt = getFormatOptions(program2);
+  hoox deploy update-internal-urls`).action(withErrorHandling(async (_options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     await doUpdateInternalUrls(fmt);
   }, { service: "deploy" }));
   deployCmd.command("kv-config").summary("Apply KV manifest keys post-deployment").description(`Apply the KV manifest key-value pairs after deploying workers.
@@ -27997,8 +28266,8 @@ Sets all KV keys from the manifest to their default values.
 This post-deployment step initializes the CONFIG_KV namespace.
 
 EXAMPLES:
-  hoox deploy kv-config`).action(withErrorHandling(async () => {
-    const fmt = getFormatOptions(program2);
+  hoox deploy kv-config`).action(withErrorHandling(async (_options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     await doKvConfig(fmt);
   }, { service: "deploy" }));
   deployCmd.command("history <worker>").summary("Show deployment version history for a worker").description(`Display the deployment version history for a Cloudflare Worker.
@@ -28010,8 +28279,8 @@ ARGUMENTS:
 
 EXAMPLES:
   hoox deploy history trade-worker
-  hoox deploy history hoox --json`).action(withErrorHandling(async (worker) => {
-    const fmt = getFormatOptions(program2);
+  hoox deploy history hoox --json`).action(withErrorHandling(async (worker, _options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     await doVersionHistory(worker, fmt);
   }, { service: "deploy" }));
   deployCmd.command("rollback <worker>").argument("[version]", "Version ID to rollback to (if omitted, prompts to select)").summary("Rollback a worker to a previous version").description(`Rollback a Cloudflare Worker to a previous version.
@@ -28029,8 +28298,8 @@ OPTIONS:
 EXAMPLES:
   hoox deploy rollback trade-worker
   hoox deploy rollback trade-worker <version-id>
-  hoox deploy rollback trade-worker <version-id> --yes`).option("--yes", "Skip confirmation prompt").action(withErrorHandling(async (worker, version2, options) => {
-    const fmt = getFormatOptions(program2);
+  hoox deploy rollback trade-worker <version-id> --yes`).option("--yes", "Skip confirmation prompt").action(withErrorHandling(async (worker, version2, options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     await doVersionRollback(worker, version2, fmt, options.yes ?? false);
   }, { service: "deploy" }));
 }
@@ -30101,27 +30370,40 @@ ${summary.failed > 0 ? theme.error(icons.error) : theme.success(icons.success)}
 `);
 }
 async function handleSetup(opts) {
-  const s = spinner();
   try {
     const configService = new ConfigService;
-    s.start("Loading config...");
     await configService.load();
-    s.stop("Config loaded");
     const cf = new CloudflareService;
     const secretsService = await SecretsService.create();
     const categories = [];
-    s.start("Validating config...");
-    categories.push(await runConfigChecks(configService));
-    s.stop("Config validation complete");
-    s.start("Checking infrastructure (D1, KV, R2, Queues)...");
-    categories.push(await runInfraChecks(cf));
-    s.stop("Infrastructure checks complete");
-    s.start("Checking secrets...");
-    categories.push(await runSecretsChecks(secretsService, configService, cf));
-    s.stop("Secrets checks complete");
-    s.start("Checking database...");
-    categories.push(await runDatabaseChecks(cf, configService));
-    s.stop("Database checks complete");
+    const tasks2 = [
+      {
+        title: "Validating config",
+        run: async () => await runConfigChecks(configService)
+      },
+      {
+        title: "Checking infrastructure (D1, KV, R2, Queues)",
+        run: async () => await runInfraChecks(cf)
+      },
+      {
+        title: "Checking secrets",
+        run: async () => await runSecretsChecks(secretsService, configService, cf)
+      },
+      {
+        title: "Checking database",
+        run: async () => await runDatabaseChecks(cf, configService)
+      }
+    ];
+    const results = await runRichTasks(tasks2, {
+      title: "Running diagnostics",
+      format: opts,
+      onSummary: (rows) => {
+        for (const r2 of rows) {
+          if (r2.ok && r2.value)
+            categories.push(r2.value);
+        }
+      }
+    });
     const report = buildReport(categories);
     if (opts.json) {
       process.stdout.write(JSON.stringify(report, null, 2) + `
@@ -30132,6 +30414,9 @@ async function handleSetup(opts) {
     if (!report.success) {
       process.exitCode = 1 /* ERROR */;
     }
+    if (results.some((r2) => !r2.ok)) {
+      process.exitCode = 1 /* ERROR */;
+    }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     formatError2(message, opts);
@@ -30139,7 +30424,6 @@ async function handleSetup(opts) {
   }
 }
 async function handleHealth(opts, autoFix) {
-  const s = spinner();
   const results = [];
   try {
     const configService = new ConfigService;
@@ -30150,29 +30434,37 @@ async function handleHealth(opts, autoFix) {
       formatSuccess("No enabled workers to check", opts);
       return;
     }
-    s.start(`Health-checking ${enabledWorkers.length} worker(s)...`);
-    for (const workerName of enabledWorkers) {
-      s.message(`Probing ${workerName}...`);
-      try {
-        const tailResult = await cf.tail(workerName);
-        const healthy = tailResult.ok;
-        results.push({
-          worker: workerName,
-          status: healthy ? "healthy" : "degraded",
-          connectivity: healthy,
-          error: tailResult.ok ? undefined : tailResult.error ?? "Unknown error"
-        });
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        results.push({
-          worker: workerName,
-          status: "down",
-          connectivity: false,
-          error: message
-        });
+    const tasks2 = enabledWorkers.map((workerName) => ({
+      title: `Probe ${workerName}`,
+      run: async () => {
+        try {
+          const tailResult = await cf.tail(workerName);
+          const healthy = tailResult.ok;
+          return {
+            worker: workerName,
+            status: healthy ? "healthy" : "degraded",
+            connectivity: healthy,
+            error: tailResult.ok ? undefined : tailResult.error ?? "Unknown error"
+          };
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          return {
+            worker: workerName,
+            status: "down",
+            connectivity: false,
+            error: message
+          };
+        }
       }
+    }));
+    const taskResults = await runRichTasks(tasks2, {
+      title: `Health-checking ${enabledWorkers.length} worker(s)`,
+      format: opts
+    });
+    for (const r2 of taskResults) {
+      if (r2.value)
+        results.push(r2.value);
     }
-    s.stop("Health check complete");
     if (opts.json) {
       process.stdout.write(JSON.stringify(results, null, 2) + `
 `);
@@ -30197,7 +30489,6 @@ ${theme.warning(icons.warning)} Auto-fix flag set but health issues require manu
       process.exitCode = 1 /* ERROR */;
     }
   } catch (err) {
-    s.stop("Health check failed");
     const message = err instanceof Error ? err.message : String(err);
     formatError2(message, opts);
     process.exitCode = 1 /* ERROR */;
@@ -30771,8 +31062,8 @@ async function tailAllWorkers(opts, fmt) {
 }
 function registerLogsCommand(program2) {
   const logsCmd = program2.command("logs").description("Tail and view Cloudflare Worker logs in real-time");
-  logsCmd.command("worker <name>").description("Tail logs for a specific Cloudflare Worker").option("--level <level>", "Filter by log level (log, info, warn, error, debug, all)", "all").option("--follow", "Continuously stream logs (default)", true).option("--no-follow", "Show recent logs and exit after 5 seconds").option("--json", "Output logs in JSON format").action(async (name, options) => {
-    const fmt = getFormatOptions(program2);
+  logsCmd.command("worker <name>").description("Tail logs for a specific Cloudflare Worker").option("--level <level>", "Filter by log level (log, info, warn, error, debug, all)", "all").option("--follow", "Continuously stream logs (default)", true).option("--no-follow", "Show recent logs and exit after 5 seconds").option("--json", "Output logs in JSON format").action(async (name, options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     const workerOpts = {
       level: normalizeLevel(options.level ?? "all"),
       follow: options.follow !== false,
@@ -30786,8 +31077,8 @@ function registerLogsCommand(program2) {
       process.exitCode = 1 /* ERROR */;
     }
   });
-  logsCmd.command("all").description("Tail logs from all enabled workers concurrently").option("--level <level>", "Filter by log level (log, info, warn, error, debug, all)", "all").option("--follow", "Continuously stream logs (default)", true).option("--no-follow", "Show recent logs and exit after 5 seconds").option("--json", "Output logs in JSON format").action(async (options) => {
-    const fmt = getFormatOptions(program2);
+  logsCmd.command("all").description("Tail logs from all enabled workers concurrently").option("--level <level>", "Filter by log level (log, info, warn, error, debug, all)", "all").option("--follow", "Continuously stream logs (default)", true).option("--no-follow", "Show recent logs and exit after 5 seconds").option("--json", "Output logs in JSON format").action(async (options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     const workerOpts = {
       level: normalizeLevel(options.level ?? "all"),
       follow: options.follow !== false,
@@ -30896,21 +31187,22 @@ var PIPELINE_STEPS = [
 ];
 function registerTestCommand(program2) {
   const testCmd = program2.command("test").description("Run tests and CI pipeline");
-  testCmd.command("all").description("Run full CI pipeline: lint \u2192 typecheck \u2192 unit tests \u2192 integration tests").option("--json", "Output results as JSON").action(withErrorHandling(async (options) => {
-    const fmt = getFormatOptions(program2);
+  testCmd.command("all").description("Run full CI pipeline: lint \u2192 typecheck \u2192 unit tests \u2192 integration tests").option("--json", "Output results as JSON").action(withErrorHandling(async (options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     const useJson = options.json || fmt.json;
     const opts = { json: useJson, quiet: fmt.quiet };
     const results = [];
     const s = spinner();
+    const pipelineTimer = startTimer();
     s.start("Running CI pipeline...");
     for (const step of PIPELINE_STEPS) {
       s.message(`${theme.info(icons.info)} ${step.label}...`);
       const result = await runStep(step.args, process.cwd());
       results.push({ ...result, step: step.label });
       if (result.success) {
-        s.message(`  ${theme.success(icons.success)} ${step.label} passed (${result.duration}ms)`);
+        s.message(`  ${theme.success(icons.success)} ${step.label} passed (${formatDuration3(result.duration)})`);
       } else {
-        s.message(`  ${theme.error(icons.error)} ${step.label} failed (${result.duration}ms)`);
+        s.message(`  ${theme.error(icons.error)} ${step.label} failed (${formatDuration3(result.duration)})`);
         if (result.error) {
           s.message(theme.dim(result.error.slice(0, 500)));
         }
@@ -30923,14 +31215,14 @@ function registerTestCommand(program2) {
       failed: results.filter((r2) => !r2.success).length,
       results
     };
-    s.stop(summary.failed > 0 ? `Pipeline complete: ${summary.passed} passed, ${summary.failed} failed` : "Pipeline complete");
+    s.stop(summary.failed > 0 ? `Pipeline complete: ${summary.passed} passed, ${summary.failed} failed (${formatDuration3(pipelineTimer.ms())})` : `Pipeline complete (${formatDuration3(pipelineTimer.ms())})`);
     printSummary(summary, opts);
     if (summary.failed > 0) {
       process.exitCode = 1 /* ERROR */;
     }
   }, { service: "test" }));
-  testCmd.command("unit").description("Run unit tests with bun test").option("--coverage", "Run with coverage reporting").action(async (options) => {
-    const fmt = getFormatOptions(program2);
+  testCmd.command("unit").description("Run unit tests with bun test").option("--coverage", "Run with coverage reporting").action(async (options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     const args = ["bun", "test"];
     if (options.coverage)
       args.push("--coverage");
@@ -30942,8 +31234,8 @@ function registerTestCommand(program2) {
       process.exitCode = 1 /* ERROR */;
     }
   });
-  testCmd.command("integration").description("Run integration tests with vitest").option("--coverage", "Run with coverage reporting").action(async (options) => {
-    const fmt = getFormatOptions(program2);
+  testCmd.command("integration").description("Run integration tests with vitest").option("--coverage", "Run with coverage reporting").action(async (options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     const args = ["vitest", "run", "--config", "vitest.config.ts"];
     if (options.coverage)
       args.push("--coverage");
@@ -30955,8 +31247,8 @@ function registerTestCommand(program2) {
       process.exitCode = 1 /* ERROR */;
     }
   });
-  testCmd.command("worker <name>").description("Run tests for a specific worker by name").option("--coverage", "Run with coverage reporting").action(withErrorHandling(async (name, options) => {
-    const fmt = getFormatOptions(program2);
+  testCmd.command("worker <name>").description("Run tests for a specific worker by name").option("--coverage", "Run with coverage reporting").action(withErrorHandling(async (name, options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     const configService = new ConfigService;
     await configService.load();
     const workerConfig = configService.getWorker(name);
@@ -30979,14 +31271,16 @@ function registerTestCommand(program2) {
   }, { service: "test" }));
   testCmd.command("live").description("Run live Cloudflare service integration tests (no mocks)").option("--service <name>", "Test a specific service: d1, kv, r2, queues, ai, api, secrets, durable-objects").action(withErrorHandling(async (options) => {
     const s = spinner();
+    const liveTimer = startTimer();
     let filePattern = options.service ? `tests/live/${options.service}.test.ts` : "tests/live/";
     s.start(`Running live tests${options.service ? ` for ${options.service}` : ""}...`);
     const args = ["bun", "test", filePattern, "--jobs", "1"];
     const result = await runWithInherit(args, process.cwd());
+    const dur = formatDuration3(liveTimer.ms());
     if (result.success) {
-      s.stop("Live tests complete");
+      s.stop(`Live tests complete (${dur})`);
     } else {
-      s.stop(`Live tests: some failures (exit code ${result.exitCode})`);
+      s.stop(`Live tests: some failures (exit code ${result.exitCode}, ${dur})`);
       process.exitCode = 1 /* ERROR */;
     }
   }, { service: "test" }));
@@ -31344,8 +31638,8 @@ EXAMPLES:
   hoox clone --all --home        Clone all workers to $HOME/.hoox/workers
   hoox clone trade-worker        Clone specific worker
   hoox clone trade-worker --home Clone specific worker to $HOME/.hoox/workers
-  hoox clone --org my-org        Clone from specific org`).option("--all", "Clone all worker repositories").option("--home", "Clone into $HOME/.hoox/workers instead of default location").option("--org <org>", "GitHub organization (derived from git remote by default)").argument("[name]", "Worker name to clone (omit to list status)").action(withErrorHandling(async (name, options) => {
-    const fmt = getFormatOptions(program2);
+  hoox clone --org my-org        Clone from specific org`).option("--all", "Clone all worker repositories").option("--home", "Clone into $HOME/.hoox/workers instead of default location").option("--org <org>", "GitHub organization (derived from git remote by default)").argument("[name]", "Worker name to clone (omit to list status)").action(withErrorHandling(async (name, options, cmd) => {
+    const fmt = getFormatOptions(cmd);
     const configService = new ConfigService;
     await configService.load();
     const workers = configService.listWorkers();
@@ -31380,6 +31674,7 @@ EXAMPLES:
       }
       const repoBase = options.org ? `https://github.com/${options.org}` : await resolveRepoBase();
       const s = spinner();
+      const cloneTimer = startTimer();
       const location = options.home ? "$HOME/.hoox/workers" : "workers/";
       s.start(`Cloning ${workers.length} worker(s) to ${location}...`);
       const results = [];
@@ -31419,10 +31714,10 @@ EXAMPLES:
       const succeeded = results.filter((r2) => r2.cloned).length;
       const failed = results.filter((r2) => !r2.cloned).length;
       if (failed > 0) {
-        s.stop(`Clone complete: ${succeeded} succeeded, ${failed} failed`);
+        s.stop(`Clone complete: ${succeeded} succeeded, ${failed} failed (${formatDuration3(cloneTimer.ms())})`);
         process.exitCode = 1 /* ERROR */;
       } else {
-        s.stop(`All ${succeeded} worker(s) cloned successfully`);
+        s.stop(`All ${succeeded} worker(s) cloned successfully (${formatDuration3(cloneTimer.ms())})`);
       }
       if (!fmt.quiet) {
         const rows = results.map((r2) => ({
@@ -31450,6 +31745,7 @@ EXAMPLES:
       }
       const repoBase = options.org ? `https://github.com/${options.org}` : await resolveRepoBase();
       const s = spinner();
+      const singleTimer = startTimer();
       const location = options.home ? "$HOME/.hoox/workers" : "workers/";
       s.start(`Cloning ${name} to ${location}...`);
       const result = await cloneWorker(getRepoUrl(repoBase, name), workerConfig.path, name, process.cwd(), homeDir);
@@ -31458,11 +31754,11 @@ EXAMPLES:
           s.message("Updating submodules...");
           await updateSubmodules(process.cwd());
         } catch {}
-        s.stop(`Successfully cloned ${name}`);
+        s.stop(`Successfully cloned ${name} (${formatDuration3(singleTimer.ms())})`);
         const locationText = options.home ? " at $HOME/.hoox/workers" : "";
         formatSuccess(`Cloned ${name}${locationText} from ${result.repo}`, fmt);
       } else {
-        s.stop(`Failed to clone ${name}`);
+        s.stop(`Failed to clone ${name} (${formatDuration3(singleTimer.ms())})`);
         formatError2(new CLIError(`Failed to clone "${name}": ${result.error}`, 1 /* ERROR */), fmt);
         process.exitCode = 1 /* ERROR */;
       }
@@ -31650,16 +31946,23 @@ class DbService {
     return stdout2.trim();
   }
   async readMigrationSql() {
+    const path5 = this.resolveMigrationScriptPath();
+    let file2;
     try {
-      const file2 = Bun.file(this.resolveMigrationScriptPath());
-      if (await file2.exists()) {
-        const content = await file2.text();
-        const match = content.match(/d1\s+execute\s+\S+\s+--command=["'](.+?)["']/s);
-        if (match)
-          return match[1];
-      }
-    } catch {}
-    return "SELECT 1";
+      file2 = Bun.file(path5);
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e);
+      throw new Error(`Migration script "${path5}" could not be read: ${message}. ` + `Refusing to run no-op migration.`, { cause: e });
+    }
+    if (!await file2.exists()) {
+      throw new Error(`Migration script "${path5}" not found. ` + `Refusing to run no-op migration. Create the script or run \`hoox setup\` first.`);
+    }
+    const content = await file2.text();
+    const match = content.match(/d1\s+execute\s+\S+\s+--command=["'](.+?)["']/s);
+    if (!match) {
+      throw new Error(`Migration script "${path5}" was found but no \`d1 execute \u2026 --command="\u2026"\` line could be extracted. ` + `Refusing to fall back to a no-op migration \u2014 please check the script format.`);
+    }
+    return match[1];
   }
 }
 // src/commands/db/db-command.ts
@@ -31670,34 +31973,36 @@ async function resolveDb(cmd, svc) {
 async function handleApply(opts, dbName, remote, file2) {
   const svc = new DbService;
   const s = spinner();
+  const t2 = startTimer();
   s.start("Applying schema...");
   try {
     const output = await svc.apply(dbName, remote, file2);
-    s.stop("Schema applied");
+    s.stop(`Schema applied (${formatDuration3(t2.ms())})`);
     formatSuccess(`Schema applied to ${dbName}${remote ? " (remote)" : " (local)"}`, opts);
     if (!opts.quiet && output) {
       process.stdout.write(`${output}
 `);
     }
   } catch (err) {
-    s.stop("Schema apply failed");
+    s.stop(`Schema apply failed (${formatDuration3(t2.ms())})`);
     throw err;
   }
 }
 async function handleMigrate(opts, dbName, remote) {
   const svc = new DbService;
   const s = spinner();
+  const t2 = startTimer();
   s.start("Running migrations...");
   try {
     const output = await svc.migrate(dbName, remote);
-    s.stop("Migrations complete");
+    s.stop(`Migrations complete (${formatDuration3(t2.ms())})`);
     formatSuccess(`Migrations applied to ${dbName}${remote ? " (remote)" : " (local)"}`, opts);
     if (!opts.quiet && output) {
       process.stdout.write(`${output}
 `);
     }
   } catch (err) {
-    s.stop("Migrations failed");
+    s.stop(`Migrations failed (${formatDuration3(t2.ms())})`);
     throw err;
   }
 }
@@ -31716,7 +32021,37 @@ async function handleList2(opts, dbName, remote) {
     formatTable(rows, opts);
   }
 }
-async function handleQuery(opts, dbName, sql, remote) {
+var DESTRUCTIVE_SQL_KEYWORDS = [
+  "DROP",
+  "TRUNCATE",
+  "ALTER",
+  "DELETE",
+  "UPDATE",
+  "REPLACE",
+  "INSERT",
+  "CREATE",
+  "ATTACH",
+  "DETACH",
+  "REINDEX",
+  "VACUUM"
+];
+function findDestructiveKeywords(sql) {
+  const upper = sql.toUpperCase();
+  const found = [];
+  for (const kw of DESTRUCTIVE_SQL_KEYWORDS) {
+    const re = new RegExp(`(^|[^A-Z0-9_])${kw}([^A-Z0-9_]|$)`, "g");
+    if (re.test(upper))
+      found.push(kw);
+  }
+  return found;
+}
+async function handleQuery(opts, dbName, sql, remote, allowDestructive) {
+  if (!allowDestructive) {
+    const matches = findDestructiveKeywords(sql);
+    if (matches.length > 0) {
+      throw new Error(`Destructive SQL keywords detected: ${matches.join(", ")}. ` + `Re-run with --allow-destructive to confirm. ` + `(Keywords: ${DESTRUCTIVE_SQL_KEYWORDS.join(", ")})`);
+    }
+  }
   const svc = new DbService;
   const output = await svc.query(dbName, sql, remote);
   if (opts.json) {
@@ -31735,13 +32070,14 @@ async function handleQuery(opts, dbName, sql, remote) {
 async function handleExport(opts, dbName, outputPath) {
   const svc = new DbService;
   const s = spinner();
+  const t2 = startTimer();
   s.start("Exporting database...");
   try {
     const path5 = await svc.export(dbName, outputPath);
-    s.stop("Database exported");
+    s.stop(`Database exported (${formatDuration3(t2.ms())})`);
     formatSuccess(`Database exported to ${path5}`, opts);
   } catch (err) {
-    s.stop("Export failed");
+    s.stop(`Export failed (${formatDuration3(t2.ms())})`);
     throw err;
   }
 }
@@ -31758,17 +32094,18 @@ async function handleReset(opts, dbName, confirmed) {
   }
   const svc = new DbService;
   const s = spinner();
+  const t2 = startTimer();
   s.start("Resetting database...");
   try {
     const output = await svc.reset(dbName);
-    s.stop("Database reset");
+    s.stop(`Database reset (${formatDuration3(t2.ms())})`);
     formatSuccess(`Database "${dbName}" has been recreated`, opts);
     if (!opts.quiet && output) {
       process.stdout.write(`${output}
 `);
     }
   } catch (err) {
-    s.stop("Reset failed");
+    s.stop(`Reset failed (${formatDuration3(t2.ms())})`);
     throw err;
   }
 }
@@ -31816,12 +32153,13 @@ EXAMPLES:
     const remote = Boolean(cmd.optsWithGlobals().remote);
     await handleList2(opts, dbName, remote);
   }, { service: "db" }));
-  dbCmd.command("query <sql>").description("Execute a SQL query").action(withErrorHandling(async (sql, _2, cmd) => {
+  dbCmd.command("query <sql>").description("Execute a SQL query").option("--allow-destructive", "Allow destructive keywords (DROP, DELETE, TRUNCATE, ALTER, UPDATE)").action(withErrorHandling(async (sql, options, cmd) => {
     const opts = getFormatOptions(cmd);
     const svc = new DbService;
     const dbName = await resolveDb(cmd, svc);
     const remote = Boolean(cmd.optsWithGlobals().remote);
-    await handleQuery(opts, dbName, sql, remote);
+    const allowDestructive = Boolean(options.allowDestructive);
+    await handleQuery(opts, dbName, sql, remote, allowDestructive);
   }, { service: "db" }));
   dbCmd.command("export").description("Export database to .sql file").option("--output <path>", "Output file path").action(withErrorHandling(async (options, cmd) => {
     const opts = getFormatOptions(cmd);
@@ -31916,11 +32254,20 @@ ${theme.heading("Summary:")} ${result.healthyCount} healthy, ${result.degradedCo
     process.exitCode = 1 /* ERROR */;
   }
 }
+function assertSafeInteger(value, name, max) {
+  if (!Number.isInteger(value) || value < 0 || value > max || !Number.isSafeInteger(value)) {
+    throw new Error(`Invalid ${name}: ${value} (must be a non-negative integer \u2264 ${max})`);
+  }
+}
+function escapeSqlString(value) {
+  return value.replace(/'/g, "''");
+}
 async function doMonitorTrades(limit, fmt) {
   try {
+    assertSafeInteger(limit, "limit", 100);
     const db = new DbService;
     const dbName = await db.resolveDbName();
-    const sql = `SELECT * FROM trades ORDER BY timestamp DESC LIMIT ${Math.min(limit, 100)}`;
+    const sql = `SELECT * FROM trades ORDER BY timestamp DESC LIMIT ${limit}`;
     const output = await db.query(dbName, sql, true);
     process.stdout.write(output + `
 `);
@@ -31938,7 +32285,7 @@ async function doMonitorLogs(workerName, fmt) {
       if (!/^[a-zA-Z0-9_-]+$/.test(workerName)) {
         throw new Error(`Invalid worker name: "${workerName}"`);
       }
-      sql = `SELECT * FROM system_logs WHERE worker = '${workerName}' ORDER BY timestamp DESC LIMIT 20`;
+      sql = `SELECT * FROM system_logs WHERE worker = '${escapeSqlString(workerName)}' ORDER BY timestamp DESC LIMIT 20`;
     } else {
       sql = "SELECT * FROM system_logs ORDER BY timestamp DESC LIMIT 20";
     }
@@ -32052,6 +32399,7 @@ async function doMonitorAnalyticsSummary(fmt) {
 }
 async function doMonitorAnalyticsErrors(hours, fmt) {
   try {
+    assertSafeInteger(hours, "hours", 8760);
     const db = new DbService;
     const dbName = await db.resolveDbName();
     const sql = `SELECT level, COUNT(*) as count FROM system_logs WHERE level IN ('error', 'warn') AND timestamp > unixepoch('now', '-${hours} hours') GROUP BY level`;
@@ -32713,14 +33061,18 @@ EXAMPLES:
         throw new CLIError(`"${submodulePath}" is not a git submodule \u2014 nothing to update`, 2 /* INVALID_USAGE */);
       }
       const s = spinner();
+      const t2 = startTimer();
       s.start(`Updating ${target}...`);
       const output = await gitSubmoduleUpdate(cwd, submodulePath);
-      s.stop(output ? theme.success(`Updated ${target}`) : theme.muted(`${target} already up to date`));
+      const dur = formatDuration3(t2.ms());
+      s.stop(output ? theme.success(`Updated ${target} (${dur})`) : theme.muted(`${target} already up to date (${dur})`));
     } else {
       const s = spinner();
+      const t2 = startTimer();
       s.start("Pulling latest from remote...");
       const output = await gitPull(cwd);
-      s.stop(output ? theme.success("Repository up to date") : theme.muted("Already up to date"));
+      const dur = formatDuration3(t2.ms());
+      s.stop(output ? theme.success(`Repository up to date (${dur})`) : theme.muted(`Already up to date (${dur})`));
     }
   }, { service: "update" }));
 }
@@ -32807,7 +33159,7 @@ function registerSchemaCommand(program2) {
 import { spawn } from "child_process";
 import { resolve as resolve7, dirname } from "path";
 import { fileURLToPath } from "url";
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 var __dirname2 = dirname(fileURLToPath(import.meta.url));
 function resolveTUIEntry() {
   const candidates = [
@@ -32816,7 +33168,7 @@ function resolveTUIEntry() {
     resolve7(process.cwd(), "../tui/src/main.tsx")
   ];
   for (const path5 of candidates) {
-    if (existsSync5(path5))
+    if (existsSync6(path5))
       return path5;
   }
   throw new CLIError("Could not find TUI entry point. Ensure packages/tui/src/main.tsx exists.", 1 /* ERROR */);
@@ -33005,12 +33357,13 @@ EXAMPLES:
 }
 // src/services/setup/setup-service.ts
 import {
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync6,
   statSync as statSync2,
   writeFileSync as writeFileSync4
 } from "fs";
+import { homedir as homedir4 } from "os";
 import { join as join6 } from "path";
 var ALL_WORKERS = [
   "d1-worker",
@@ -33072,7 +33425,7 @@ class SetupService {
       WEBHOOK_API_KEY_BINDING: this._randomHex(32),
       TELEGRAM_INTERNAL_KEY_BINDING: internalKey
     };
-    if (!existsSync6(KEYS_DIR)) {
+    if (!existsSync7(KEYS_DIR)) {
       mkdirSync3(KEYS_DIR, { recursive: true });
     } else if (!statSync2(KEYS_DIR).isDirectory()) {
       mkdirSync3(KEYS_DIR, { recursive: true });
@@ -33377,8 +33730,7 @@ class SetupService {
     }
     const fallbacks = [
       "/usr/local/bin/wrangler",
-      "/home/jango/.bun/install/global/bin/wrangler",
-      join6(process.env.HOME || "~", ".bun", "bin", "wrangler")
+      join6(homedir4(), ".bun", "bin", "wrangler")
     ];
     for (const fb of fallbacks) {
       try {
@@ -33451,7 +33803,7 @@ class SetupService {
       step: "workers",
       message: `${missing.length} worker(s) not cloned: ${missing.join(", ")}`
     });
-    if (!existsSync6(gitmodulesPath)) {
+    if (!existsSync7(gitmodulesPath)) {
       this.onProgress({
         type: "step-error",
         step: "workers",
@@ -34052,7 +34404,7 @@ EXAMPLES:
     const authOk = await tempSvc.checkAuth();
     if (!authOk) {
       authCheck.stop("Authentication failed");
-      formatError2(new CLIError("Not authenticated with Cloudflare. Run 'wrangler login' first.", 1 /* ERROR */), globalOpts);
+      formatError2(new CLIError("Not authenticated with Cloudflare. Run 'wrangler login' first.", 1 /* ERROR */, undefined, false, "Run `wrangler login` interactively, or set CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID environment variables for CI / non-interactive use."), globalOpts);
       outro(theme.error("Setup aborted"));
       process.exitCode = 1 /* ERROR */;
       return;
@@ -34091,12 +34443,14 @@ EXAMPLES:
         currentSpinner.stop(msg);
       currentSpinner = null;
     }));
+    const totalTimer = startTimer();
     const result = await setupSvc.runAll(opts);
+    const totalMs = totalTimer.ms();
     if (isInteractive) {
-      log.step("\u2500\u2500 Summary \u2500\u2500");
+      log.step(`\u2500\u2500 Summary (total ${formatDuration3(totalMs)}) \u2500\u2500`);
       const rows = result.steps.map((s) => ({
         Step: s.step,
-        Status: s.success ? theme.success("\u2713") : theme.error("\u2717"),
+        Status: s.success ? formatBadge("ok", "DONE") : formatBadge("err", "FAIL"),
         Message: s.message
       }));
       formatTable(rows, globalOpts);