@brightsideoy/kama 0.1.0-alpha.99 → 1.0.0-alpha.11

package/bin/cli.js

@@ -1,343 +1,820 @@
 #!/usr/bin/env node
 import { execSync } from 'node:child_process';
-import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import * as readline from 'node:readline/promises';
+import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, appendFileSync } from 'node:fs';
+import { join, dirname, basename, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import crypto from 'node:crypto'; // 🎯 NEW: Cryptographically secure token generator
+
+// 🎯 Modern CLI UI Components
+import { intro, outro, text, select, confirm, spinner, note, isCancel, cancel } from '@clack/prompts';
+
+// --- UI HELPERS (Zero Dependency Colors) ---
+const pc = {
+    green: (t) => `\x1b[32m${t}\x1b[0m`,
+    cyan: (t) => `\x1b[36m${t}\x1b[0m`,
+    dim: (t) => `\x1b[2m${t}\x1b[0m`,
+    yellow: (t) => `\x1b[33m${t}\x1b[0m`,
+    red: (t) => `\x1b[31m${t}\x1b[0m`,
+    bgCyan: (t) => `\x1b[46m\x1b[30m ${t} \x1b[0m`,
+    bold: (t) => `\x1b[1m${t}\x1b[0m`,
+    reset: '\x1b[0m'
+};
+
+// Graceful exit handler for Ctrl+C
+function handleCancel(value) {
+    if (isCancel(value)) {
+        cancel('Operation cancelled.');
+        process.exit(0);
+    }
+    return value;
+}
+
+// 🎯 Always use the absolute newest ecosystem
+const ASTRO_LATEST = "latest";
+const ASTRO_NODE_LATEST = "latest";
+const ASTRO_CF_LATEST = "latest";
+const WRANGLER_LATEST = "latest";
+
+// Dynamically resolve current package version
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+let currentKamaVersion = 'alpha';
+try {
+    const pkgPath = join(__dirname, '../package.json');
+    if (existsSync(pkgPath)) {
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+        if (pkg.version) currentKamaVersion = `^${pkg.version}`;
+    }
+} catch (e) {
+    console.warn("⚠️ Could not detect Kama version, defaulting to 'alpha'");
+}
+
+/**
+ * 🎯 SECURE SECRET MANAGER
+ * Gracefully retrieves an existing workspace secret, or generates and injects one if missing.
+ */
+function getOrGenerateWorkspaceSecret(workerDir) {
+    const envPath = join(workerDir, '.env');
+    const devVarsPath = join(workerDir, '.dev.vars');
+
+    let secret = null;
+
+    // Check local Node .env
+    if (existsSync(envPath)) {
+        const match = readFileSync(envPath, 'utf-8').match(/^FRONTEND_API_SECRET=["']?([^"'\n]+)/m);
+        if (match) secret = match[1];
+    }
+
+    // Check Cloudflare .dev.vars
+    if (!secret && existsSync(devVarsPath)) {
+        const match = readFileSync(devVarsPath, 'utf-8').match(/^FRONTEND_API_SECRET=["']?([^"'\n]+)/m);
+        if (match) secret = match[1];
+    }
+
+    // Generate and inject if missing
+    if (!secret) {
+        secret = crypto.randomBytes(32).toString('hex');
+        const secretLine = `\n# KAMA Auto-Generated Server-to-Server Security\nFRONTEND_API_SECRET="${secret}"\n`;
+
+        if (existsSync(devVarsPath)) {
+            appendFileSync(devVarsPath, secretLine);
+        } else if (existsSync(envPath)) {
+            appendFileSync(envPath, secretLine);
+        } else {
+            writeFileSync(devVarsPath, secretLine);
+        }
+    }
+
+    return secret;
+}
+
+/**
+ * 🎯 BULLETPROOF WRANGLER EXECUTION RESOLVER
+ */
+function getWranglerCmd() {
+    try {
+        execSync('wrangler --version', { stdio: 'ignore' });
+        return 'wrangler';
+    } catch (e) {
+        return 'npx --yes --package=wrangler wrangler';
+    }
+}
+
+/**
+ * 🎯 ROBUST WRANGLER RUNNER
+ */
+function runWrangler(cmd, options = {}) {
+    const baseWrangler = getWranglerCmd();
+    try {
+        return execSync(`${baseWrangler} ${cmd}`, {
+            encoding: 'utf-8',
+            stdio: options.stdio || ['ignore', 'pipe', 'pipe'],
+            env: {
+                ...process.env,
+                PATH: process.env.PATH
+            }
+        });
+    } catch (e) {
+        if (options.throw) throw e;
+        return null;
+    }
+}
+
+/**
+ * 🎯 BULLETPROOF KV PROVISIONING ENGINE
+ */
+function getOrCreateKV(title) {
+    const out = runWrangler(`kv namespace create "${title}"`);
+    if (out) {
+        const match = out.match(/"id":\s*"([a-fA-F0-9]{32})"/);
+        if (match) return match[1];
+    }
+
+    const listOut = runWrangler(`kv namespace list`);
+    if (listOut) {
+        try {
+            const namespaces = JSON.parse(listOut);
+            const found = namespaces.find(n => n.title === title);
+            if (found) return found.id;
+        } catch (err) { }
+    }
+
+    return `REPLACE_WITH_${title}_ID`;
+}
 
-const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout,
-});
+function showHelp() {
+    console.log(`\n${pc.bgCyan(' KAMA • ENGINE CLI ')}\n`);
+    console.log('Usage: npx kama <command> [options]\n');
+    console.log(pc.cyan('Commands:'));
+    console.log('  init         Kickstart a new Monorepo (CMS Worker + Optional Astro Site)');
+    console.log('  add site     Add a new Astro Frontend Site to the current workspace (sites/)');
+    console.log('  bundle       Compile and bundle YAML schemas into bundled-definitions.js for Edge deployment');
+    console.log('  promote      Promote the current Local workspace to Cloudflare Edge');
+    console.log('  help, -h     Show this help message\n');
+    console.log(pc.cyan('Workspace Scripts (Run from project root):'));
+    console.log('  npm update                   Update to latest KAMA version');
+    console.log('  npm run setup                Initialize database schema (Run Once)');
+    console.log('  npm run seed -w kama-worker  Seed the database with mock test data'); // 🎯 NEW LINE
+    console.log('  npm run dev                  Boot up the CMS backend and Astro frontend concurrently');
+    console.log('  npm run deploy:cms           Deploy the backend worker and database to Cloudflare');
+    console.log('  npm run deploy:site          Deploy the Astro frontend site to Cloudflare\n');
+}
 
 async function main() {
-    console.log('\n🔥 --- KAMA SITE GENERATOR --- 🔥\n');
+    const args = process.argv.slice(2);
+    const command = args[0]?.toLowerCase();
+    const subCommand = args[1]?.toLowerCase();
 
-    console.log('Select mode:');
-    console.log('  1) Kickstart new Kama Monorepo (CMS + Initial Site)');
-    console.log('  2) Add a new Astro Site to current workspace (sites/)');
+    if (['help', '--help', '-h'].includes(command)) {
+        showHelp();
+        process.exit(0);
+    }
 
-    const choice = await rl.question('\nChoice [1/2]: ');
+    console.clear();
+    intro(`${pc.bgCyan(' KAMA • ENGINE ')} ${pc.dim('v' + currentKamaVersion.replace('^', ''))}`);
 
-    if (choice.trim() === '2') {
+    if (command === 'init') {
+        await createFullWorkspace();
+    } else if (command === 'add' && subCommand === 'site') {
         await createNewSiteOnly();
+    } else if (command === 'promote') {
+        await promoteLocalToCloudflare();
+    } else if (command === 'bundle') {
+        await bundleWorkspaceSchemas();
     } else {
-        await createFullWorkspace();
+        const choice = handleCancel(await select({
+            message: 'What would you like to do?',
+            options: [
+                { value: 'init', label: 'Init', hint: 'Kickstart new Workspace (CMS + Optional Site)' },
+                { value: 'add_site', label: 'Add Site', hint: 'Add Astro Site to current workspace (sites/)' },
+                { value: 'bundle', label: 'Bundle', hint: 'Compile YAML schemas for Edge deployment' },
+                { value: 'promote', label: 'Promote', hint: 'Promote current Local workspace to Cloudflare Edge' },
+                { value: 'help', label: 'Help', hint: 'Show all commands and usage' },
+                { value: 'exit', label: 'Exit' }
+            ]
+        }));
+
+        if (choice === 'help') {
+            showHelp();
+            process.exit(0);
+        } else if (choice === 'promote') {
+            await promoteLocalToCloudflare();
+        } else if (choice === 'bundle') {
+            await bundleWorkspaceSchemas();
+        } else if (choice === 'add_site') {
+            await createNewSiteOnly();
+        } else if (choice === 'init') {
+            await createFullWorkspace();
+        } else {
+            outro('Goodbye!');
+            process.exit(0);
+        }
     }
+}
 
-    rl.close();
+function convertAstroConfigToCloudflare(siteDir) {
+    const configPath = join(siteDir, 'astro.config.mjs');
+    if (existsSync(configPath)) {
+        let content = readFileSync(configPath, 'utf-8');
+        content = content
+            .replace("import node from '@astrojs/node';", "import cloudflare from '@astrojs/cloudflare';")
+            .replace('adapter: node({ mode: "standalone" })', 'adapter: cloudflare({ imageService: process.env.NODE_ENV === "production" ? "cloudflare" : "passthrough" })');
+        writeFileSync(configPath, content, 'utf-8');
+    }
 }
 
 /**
- * MODE 1: Kickstart full Monorepo Workspace
+ * COMMAND: npx kama init
  */
 async function createFullWorkspace() {
-    const projName = (await rl.question('Project folder name [kama-workspace]: ')) || 'kama-workspace';
-    const cmsDomain = (await rl.question('CMS Admin Domain (e.g., admin.t3cloud.eu): ')) || 'admin.t3cloud.eu';
-    const siteDomain = (await rl.question('First Website Domain (e.g., kama.t3cloud.eu): ')) || 'kama.t3cloud.eu';
+    const cwdName = basename(process.cwd());
+    const hasExistingPkg = existsSync(join(process.cwd(), 'package.json'));
+    const defaultDirPrompt = hasExistingPkg ? '.' : cwdName;
+
+    const inputName = handleCancel(await text({
+        message: 'Project folder name (use "." for current dir):',
+        placeholder: defaultDirPrompt,
+        defaultValue: defaultDirPrompt
+    }));
+
+    const chosenFolder = inputName.trim() || defaultDirPrompt;
+    const isCurrentDir = chosenFolder === '.';
+    const projName = isCurrentDir ? cwdName : chosenFolder;
+    const rootDir = isCurrentDir ? process.cwd() : join(process.cwd(), projName);
+
+    const isCloudflare = handleCancel(await select({
+        message: 'Choose your Deployment Architecture:',
+        options: [
+            { value: true, label: 'Cloudflare Edge', hint: 'Workers, D1, R2, CF Image Resizing' },
+            { value: false, label: 'VPS / Local Server', hint: 'Node.js, SQLite, Sharp cropping' }
+        ]
+    }));
+
+    const shouldCreateSite = handleCancel(await confirm({
+        message: 'Do you want to scaffold an initial Astro frontend site?',
+        initialValue: true
+    }));
+
+    let siteFolderName = 'kama-starter';
+    let siteDomain = 'localhost:4321';
+    let cmsDomain = 'localhost:8787';
+
+    if (shouldCreateSite) {
+        siteFolderName = handleCancel(await text({
+            message: 'Astro package/folder name (e.g., my-website.eu):',
+            placeholder: 'kama-starter',
+            defaultValue: 'kama-starter'
+        }));
+    }
+
+    if (isCloudflare) {
+        cmsDomain = handleCancel(await text({
+            message: 'CMS Admin Domain (e.g., admin.yourdomain.com):',
+            defaultValue: ''
+        }));
+        if (shouldCreateSite) {
+            siteDomain = handleCancel(await text({
+                message: 'First Website Domain (e.g., yourdomain.com):',
+                defaultValue: ''
+            }));
+        }
+    }
+
+    const cmsProtocol = isCloudflare ? 'https://' : 'http://';
+    const cmsFullUrl = cmsDomain ? `${cmsProtocol}${cmsDomain.replace(/^https?:\/\//, '')}` : 'http://localhost:8787';
 
-    const rootDir = join(process.cwd(), projName);
+    // 🎯 INITIALIZE UNIQUE SECURE API SECRET
+    const frontendApiSecret = crypto.randomBytes(32).toString('hex');
 
-    // 🎯 Derive dynamic worker, database, and bucket names from project folder name
     const workerName = `${projName}-worker`.toLowerCase().replace(/[^a-z0-9_-]/g, '-');
     let dbName = `${projName}-db`.replace(/[^a-zA-Z0-9_-]/g, '_');
     const bucketName = `${projName}-media-prod`.toLowerCase().replace(/[^a-z0-9_-]/g, '-');
 
-    console.log(`\n📁 Creating workspace folder at ./${projName}...`);
-    mkdirSync(rootDir, { recursive: true });
+    const s = spinner();
+    s.start('Provisioning workspace...');
+
+    if (!isCurrentDir) mkdirSync(rootDir, { recursive: true });
+
+    writeFileSync(
+        join(rootDir, '.gitignore'),
+        `node_modules/\n.env\n.DS_Store\nkama-worker/.dev.vars\nkama-worker/.env\nkama-worker/.wrangler/\nkama-worker/public/\nkama-worker/*.db\nsites/*/.env\nsites/*/.astro/\nsites/*/dist/\nkama-worker/bundled-definitions.js\n`
+    );
 
-    // 🎯 Scaffold schemas directory for project-level custom YAML definitions
-    mkdirSync(join(rootDir, 'schemas', 'nodes'), { recursive: true });
-    mkdirSync(join(rootDir, 'schemas', 'blocks'), { recursive: true });
+    const sourceDefsDir = join(__dirname, '../content/definitions');
+    const targetDefsDir = join(rootDir, 'content', 'definitions');
+    if (existsSync(sourceDefsDir)) cpSync(sourceDefsDir, targetDefsDir, { recursive: true });
 
-    // --- AUTO D1 CREATION MAGIC ---
-    let d1DatabaseId = 'REPLACE_WITH_YOUR_D1_ID';
+    let d1DatabaseId = '00000000-0000-0000-0000-000000000000';
+    let backendCacheId = 'REPLACE_WITH_CACHE_KV_ID';
     let isAuthenticated = false;
 
-    console.log(`\n🔑 Checking Cloudflare authentication...`);
-    try {
-        execSync('npx wrangler whoami', { stdio: 'pipe' });
-        isAuthenticated = true;
-        console.log(`✅ Logged in to Cloudflare.`);
-    } catch (error) {
-        console.log(`⚠️ You are not logged in to Cloudflare.`);
-        console.log(`🌐 Launching browser for Cloudflare login...`);
-        try {
-            execSync('npx wrangler login', { stdio: 'inherit' });
+    if (isCloudflare) {
+        s.message('Checking Cloudflare authentication...');
+        const whoami = runWrangler('whoami');
+        if (whoami && (whoami.includes('Getting User Settings') || whoami.includes('You are logged in'))) {
             isAuthenticated = true;
-            console.log(`✅ Successfully logged in!`);
-        } catch (loginError) {
-            console.log(`❌ Login failed or was cancelled.`);
+        } else {
+            s.stop('Not authenticated with Cloudflare.', true);
+            console.log(pc.dim('Launching browser for Cloudflare login...'));
+            const login = runWrangler('login', { stdio: 'inherit' });
+            if (login !== null) isAuthenticated = true;
+            s.start('Resuming provisioning...');
         }
-    }
-
-    if (isAuthenticated) {
-        try {
-            console.log(`\n🗄️ Checking existing Cloudflare D1 databases...`);
-            const listOutput = execSync(`npx wrangler d1 list --json`, { encoding: 'utf-8', stdio: 'pipe' });
-
-            const jsonStart = listOutput.indexOf('[');
-            const jsonEnd = listOutput.lastIndexOf(']') + 1;
-            let databases = [];
 
-            if (jsonStart !== -1 && jsonEnd !== -1) {
-                databases = JSON.parse(listOutput.substring(jsonStart, jsonEnd));
-            }
-
-            const existingDb = databases.find(db => db.name === dbName);
-
-            if (existingDb) {
-                console.log(`⚠️ Database '${dbName}' already exists on your account.`);
-                const useExisting = await rl.question(`Do you want to link this existing database? (y/n) [y]: `);
-
-                if (useExisting.toLowerCase() !== 'n') {
-                    d1DatabaseId = existingDb.uuid;
-                    console.log(`✅ Linked existing database ID: ${d1DatabaseId}`);
-                } else {
-                    dbName = (await rl.question(`Enter a new database name: `)).trim();
-                    console.log(`\n🗄️ Creating new database '${dbName}'...`);
-                    const d1Output = execSync(`npx wrangler d1 create ${dbName}`, { encoding: 'utf-8', stdio: 'pipe' });
-                    const match = d1Output.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/);
-                    if (match) {
-                        d1DatabaseId = match[0];
-                        console.log(`✅ Success! Database ID bound: ${d1DatabaseId}`);
+        if (isAuthenticated) {
+            s.message('Provisioning backend KV Cache...');
+            backendCacheId = getOrCreateKV(`CACHE_KV_${workerName.toUpperCase().replace(/-/g, '_')}`);
+
+            s.message('Checking existing Cloudflare D1 databases...');
+            const listOutput = runWrangler('d1 list --json');
+            if (listOutput) {
+                try {
+                    const jsonStart = listOutput.indexOf('[');
+                    const jsonEnd = listOutput.lastIndexOf(']') + 1;
+                    let databases = [];
+
+                    if (jsonStart !== -1 && jsonEnd !== -1) databases = JSON.parse(listOutput.substring(jsonStart, jsonEnd));
+                    const existingDb = databases.find(db => db.name === dbName);
+
+                    if (existingDb) {
+                        s.stop(`Database '${dbName}' already exists on your account.`);
+                        const useExisting = handleCancel(await confirm({ message: 'Do you want to link this existing database?', initialValue: true }));
+
+                        if (useExisting) {
+                            d1DatabaseId = existingDb.uuid;
+                            s.start(`Linked existing database ID: ${d1DatabaseId}`);
+                        } else {
+                            dbName = handleCancel(await text({ message: 'Enter a new database name:' }));
+                            s.start(`Creating new database '${dbName}'...`);
+                            const d1Output = runWrangler(`d1 create ${dbName}`);
+                            const match = d1Output ? d1Output.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/) : null;
+                            if (match) d1DatabaseId = match[0];
+                        }
+                    } else {
+                        s.message(`Attempting to auto-create Cloudflare D1 Database '${dbName}'...`);
+                        const d1Output = runWrangler(`d1 create ${dbName}`);
+                        const match = d1Output ? d1Output.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/) : null;
+                        if (match) d1DatabaseId = match[0];
                     }
-                }
-            } else {
-                console.log(`\n🗄️ Attempting to auto-create Cloudflare D1 Database '${dbName}'...`);
-                const d1Output = execSync(`npx wrangler d1 create ${dbName}`, { encoding: 'utf-8', stdio: 'pipe' });
-                const match = d1Output.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/);
-                if (match) {
-                    d1DatabaseId = match[0];
-                    console.log(`✅ Success! Database ID bound: ${d1DatabaseId}`);
-                }
+                } catch (error) { }
             }
-        } catch (error) {
-            console.log(`⚠️ Database operation failed. We'll leave a placeholder.`);
         }
+    }
+
+    s.message('Writing configuration files...');
+
+    const rootPkg = {
+        name: projName,
+        private: true,
+        type: 'module',
+        workspaces: ['kama-worker', 'sites/*'],
+        scripts: { 'setup': 'npm run setup:local -w kama-worker' },
+        dependencies: { '@brightsideoy/kama': currentKamaVersion },
+        devDependencies: {}
+    };
+
+    if (isCloudflare) rootPkg.devDependencies['wrangler'] = WRANGLER_LATEST;
+
+    if (shouldCreateSite) {
+        rootPkg.devDependencies['concurrently'] = '^9.0.0';
+        rootPkg.scripts['dev:site'] = `npm run dev -w sites/${siteFolderName}`;
+        rootPkg.scripts['predev'] = 'npx kama bundle';
+        rootPkg.scripts['dev'] = 'npx concurrently "npm run dev -w kama-worker" "npm run dev -w sites/' + siteFolderName + '"';
+        rootPkg.scripts['deploy:site'] = `npm run deploy -w sites/${siteFolderName}`;
+        rootPkg.scripts['deploy:cms'] = `npm run deploy -w kama-worker`;
     } else {
-        console.log(`⚠️ Skipping database creation. We'll leave a placeholder in wrangler.json.`);
+        rootPkg.scripts['predev'] = 'npx kama bundle';
+        rootPkg.scripts['dev'] = 'npm run dev -w kama-worker';
+        rootPkg.scripts['deploy:cms'] = `npm run deploy -w kama-worker`;
     }
-    // ------------------------------
 
-    // 🎯 1. Root package.json
-    writeFileSync(
-        join(rootDir, 'package.json'),
-        JSON.stringify({
-            name: projName,
-            private: true,
-            type: 'module',
-            workspaces: ['cms-worker', 'sites/*'],
-            scripts: {
-                'bundle:schemas': 'node node_modules/@brightsideoy/kama/scripts/bundle-definitions.js',
-                'dev:cms': 'npm run bundle:schemas && npm run dev -w cms-worker',
-                'deploy:cms': 'npm run bundle:schemas && npm run deploy -w cms-worker',
-            },
-            dependencies: {
-                '@brightsideoy/kama': 'alpha',
-            }
-        }, null, 2)
-    );
+    writeFileSync(join(rootDir, 'package.json'), JSON.stringify(rootPkg, null, 2));
 
-    // 🎯 2. Setup CMS Worker with Dynamic Names
-    console.log(`\n☁️ Configuring CMS Worker '${workerName}' (${cmsDomain})...`);
-    const cmsDir = join(rootDir, 'cms-worker');
+    const cmsDir = join(rootDir, 'kama-worker');
     mkdirSync(cmsDir, { recursive: true });
 
-    writeFileSync(
-        join(cmsDir, 'index.js'),
-        `export { default } from '@brightsideoy/kama';\n`
-    );
-
-    writeFileSync(
-        join(cmsDir, 'package.json'),
-        JSON.stringify({
-            name: workerName,
-            type: 'module',
-            version: '1.0.0',
-            scripts: {
-                "bundle:schemas": "node ../node_modules/@brightsideoy/kama/scripts/bundle-definitions.js",
-                "schema:local": `npm run bundle:schemas && wrangler d1 execute ${dbName} --local --file=../node_modules/@brightsideoy/kama/schema.sql`,
-                "schema:remote": `npm run bundle:schemas && wrangler d1 execute ${dbName} --remote --file=../node_modules/@brightsideoy/kama/schema.sql`,
-                "dev": "npm run schema:local && wrangler dev",
-                "deploy": "npm run schema:remote && wrangler deploy"
-            },
-            dependencies: {
-                '@brightsideoy/kama': 'alpha',
-            },
-            devDependencies: {
-                wrangler: '^4.127.1',
-                tsx: '^4.19.2',
-            },
-        }, null, 2)
-    );
-
-    // 🎯 Fixed CMS wrangler.json (Added PUBLIC_FRONTEND_URL & CLOUDFLARE_ZONE_ID to public vars)
-    writeFileSync(
-        join(cmsDir, 'wrangler.json'),
-        JSON.stringify({
+    const emptyDefs = `{ nodes: {}, trees: {}, blocks: {}, nodeLayouts: {}, blockLayouts: {}, channels: {} }`;
+    writeFileSync(join(cmsDir, 'bundled-definitions.js'), `const defs = ${emptyDefs};\nexport const BUNDLED_DEFINITIONS = defs;\nexport default defs;\n`);
+
+    if (isCloudflare) {
+        const templateIndexPath = join(__dirname, '../templates/kama-worker/index.js');
+        if (existsSync(templateIndexPath)) cpSync(templateIndexPath, join(cmsDir, 'index.js'));
+
+        writeFileSync(
+            join(cmsDir, 'package.json'),
+            JSON.stringify({
+                name: workerName,
+                type: 'module',
+                version: '1.0.0',
+                scripts: {
+                    // 🎯 Uses native node with the compiled dist/build-seed.js
+                    "seed": "node ../node_modules/@brightsideoy/kama/dist/build-seed.js && wrangler d1 execute " + dbName + " --local --file=seed.sql",
+                    "setup:local": `wrangler d1 execute ${dbName} --local --file=../node_modules/@brightsideoy/kama/schema.sql > /dev/null 2>&1`,
+                    "setup:remote": `wrangler d1 execute ${dbName} --remote --file=../node_modules/@brightsideoy/kama/schema.sql`,
+                    "dev": "wrangler dev --port 8787 --inspector-port 9239",
+                    "deploy": "npm run setup:remote && wrangler deploy"
+                },
+                dependencies: { '@brightsideoy/kama': currentKamaVersion, '@libsql/client': '^0.14.0' },
+                devDependencies: { "wrangler": WRANGLER_LATEST }, // 🎯 Removed TSX requirement
+            }, null, 2)
+        );
+
+        const cmsWranglerConfig = {
             $schema: '../node_modules/wrangler/config-schema.json',
             name: workerName,
             main: 'index.js',
-            compatibility_date: '2026-08-01',
+            compatibility_date: '2024-09-23',
             compatibility_flags: ['nodejs_compat'],
-            assets: {
-                directory: '../node_modules/@brightsideoy/kama/dist',
-                binding: 'ASSETS'
-            },
-            images: {
-                binding: 'IMAGES'
-            },
-            routes: [{ pattern: cmsDomain, custom_domain: true }],
+            dev: { host: 'localhost', port: 8787 },
+            assets: { directory: '../node_modules/@brightsideoy/kama/dist', binding: 'ASSETS' },
+            images: { binding: 'IMAGES' },
+            kv_namespaces: [{ binding: 'CACHE_KV', id: backendCacheId }],
             vars: {
-                CDN_DOMAIN: cmsDomain,
-                PUBLIC_FRONTEND_URL: `https://${siteDomain}`,
-                CLOUDFLARE_ZONE_ID: "REPLACE_WITH_YOUR_32_CHAR_ZONE_ID"
+                CDN_DOMAIN: cmsDomain || 'localhost:8787',
+                PUBLIC_FRONTEND_URL: (shouldCreateSite) ? (siteDomain && siteDomain !== 'localhost:4321' ? `https://${siteDomain}` : 'http://localhost:4321') : 'http://localhost:4321',
+                CLOUDFLARE_ZONE_ID: "REPLACE_WITH_YOUR_32_CHAR_ZONE_ID",
+                KAMA_RUNTIME: 'cloudflare'
             },
-            d1_databases: [{
-                binding: 'DB',
-                database_name: dbName,
-                database_id: d1DatabaseId,
-            }],
-            r2_buckets: [{
-                binding: 'MEDIA_BUCKET',
-                bucket_name: bucketName,
-            }],
-        }, null, 2)
-    );
+            d1_databases: [{ binding: 'DB', database_name: dbName, database_id: d1DatabaseId }],
+            r2_buckets: [{ binding: 'MEDIA_BUCKET', bucket_name: bucketName }],
+            routes: cmsDomain ? [{ pattern: cmsDomain, custom_domain: true }] : [{ pattern: "", custom_domain: true }]
+        };
 
-    // 🎯 Fixed .dev.vars (Only contains API token for local dev, not public Zone ID)
-    writeFileSync(
-        join(cmsDir, '.dev.vars'),
-        `# Cloudflare Edge Cache Purging Secrets\nCLOUDFLARE_API_TOKEN=cfut_YOUR_CUSTOM_PURGE_TOKEN\n`
-    );
+        writeFileSync(join(cmsDir, 'wrangler.json'), JSON.stringify(cmsWranglerConfig, null, 2));
+
+        // 🎯 Inject API Secret directly into .dev.vars
+        const publicFrontendUrl = (shouldCreateSite) ? (siteDomain && siteDomain !== 'localhost:4321' ? `https://${siteDomain}` : 'http://localhost:4321') : 'http://localhost:4321';
+        writeFileSync(join(cmsDir, '.dev.vars'), `# Cloudflare Edge Cache Purging Secrets\nCLOUDFLARE_API_TOKEN=cfut_YOUR_CUSTOM_PURGE_TOKEN\n\n# Local Development Overrides\nCDN_DOMAIN=\nPUBLIC_FRONTEND_URL=${publicFrontendUrl}\n\n# Server-to-Server API Security\nFRONTEND_API_SECRET="${frontendApiSecret}"\n`);
+    } else {
+        const templateServerPath = join(__dirname, '../templates/kama-worker/server.js');
+        if (existsSync(templateServerPath)) cpSync(templateServerPath, join(cmsDir, 'server.js'));
+
+        writeFileSync(
+            join(cmsDir, 'package.json'),
+            JSON.stringify({
+                name: workerName,
+                type: 'module',
+                version: '1.0.0',
+                scripts: {
+                    // 🎯 Uses native node with the compiled dist/build-seed.js
+                    "seed": "node ../node_modules/@brightsideoy/kama/dist/build-seed.js && sqlite3 kama.db < seed.sql",
+                    "setup:local": "sqlite3 kama.db < ../node_modules/@brightsideoy/kama/schema.sql",
+                    "dev": "tsx server.js",
+                    "start": "node server.js"
+                },
+                dependencies: { '@brightsideoy/kama': currentKamaVersion, '@hono/node-server': '^1.13.0', '@libsql/client': '^0.14.0', 'sharp': '^0.33.5', 'dotenv': '^16.4.5' },
+                devDependencies: { "tsx": "^4.19.0" }, // 🎯 Kept because "dev" uses it
+            }, null, 2)
+        );
+
+        // 🎯 Inject API Secret directly into .env
+        writeFileSync(join(cmsDir, '.env'), `PORT=8787\nKAMA_RUNTIME=node\nDB_PATH=./kama.db\nLOCAL_MEDIA_PATH=./public/media\nPUBLIC_CMS_URL=http://127.0.0.1:8787\nPUBLIC_API_URL=http://127.0.0.1:8787\nPUBLIC_FRONTEND_URL=http://127.0.0.1:4321\n\n# Server-to-Server API Security\nFRONTEND_API_SECRET="${frontendApiSecret}"\n`);
+    }
+
+    s.message('Bundling schemas...');
+    await bundleWorkspaceSchemas(rootDir, true);
 
-    // 🎯 3. Setup First Astro Site tied to target workerName
-    const siteFolderName = siteDomain.split('.')[0];
-    await generateAstroSite(rootDir, siteFolderName, siteDomain, cmsDomain, workerName);
+    if (shouldCreateSite) {
+        s.message(`Scaffolding Astro site (${siteFolderName})...`);
+        // 🎯 Pass secret to the frontend generator
+        await generateAstroSite(rootDir, siteFolderName, siteDomain, cmsFullUrl, workerName, isCloudflare, frontendApiSecret);
+    }
+
+    s.stop('Workspace provisioned successfully.');
+
+    let nextSteps = '';
+    let stepCount = 1;
+    if (!isCurrentDir) nextSteps += `${stepCount++}. cd ${projName}\n`;
+    nextSteps += `${stepCount++}. npm install\n`;
+    nextSteps += `${stepCount++}. npm run setup  ${pc.dim('<- Run this once to init the database schema!')}\n`;
+    nextSteps += `${stepCount++}. npm run dev\n`;
 
-    console.log(`\n✨ Workspace ready! Next steps:`);
-    console.log(`  1. cd ${projName}`);
-    console.log(`  2. npm install`);
-    if (d1DatabaseId === 'REPLACE_WITH_YOUR_D1_ID') {
-        console.log(`  3. Run 'npx wrangler login' and create a D1 database.`);
+    if (isCloudflare) {
+        nextSteps += `\n${pc.dim('Cloudflare Note:')}\n`;
+        nextSteps += `${pc.dim('Update CLOUDFLARE_ZONE_ID in wrangler.json')}\n`;
+        nextSteps += `${pc.dim('Set Cache purge token: npx wrangler secret put CLOUDFLARE_API_TOKEN')}\n`;
+        nextSteps += `${pc.dim('Set Frontend API secret: npx wrangler secret put FRONTEND_API_SECRET')}`;
     }
-    console.log(`  4. Update CLOUDFLARE_ZONE_ID in cms-worker/wrangler.json with your actual Zone ID`);
-    console.log(`  5. Securely store your purge token: cd cms-worker && npx wrangler secret put CLOUDFLARE_API_TOKEN`);
-    console.log(`  6. Run 'npm run dev:cms' from the workspace root to start the backend.`);
+
+    note(nextSteps, 'Next steps');
+    outro(`KAMA • ENGINE is ready! 🚀`);
 }
 
 /**
- * MODE 2: Add Site to existing workspace
+ * COMMAND: npx kama add site
  */
 async function createNewSiteOnly() {
     const rootDir = process.cwd();
 
     if (!existsSync(join(rootDir, 'package.json'))) {
-        console.error('❌ Error: Must run this command inside the root of your workspace.');
-        return;
+        cancel('Error: Must run this command inside the root of your workspace.');
+        process.exit(1);
     }
 
     let targetWorkerName = 'kama-worker';
-    const cmsWranglerPath = join(rootDir, 'cms-worker', 'wrangler.json');
+    let detectedCmsDomain = '';
+    const workerDir = join(rootDir, 'kama-worker');
+
+    const cmsWranglerPath = join(workerDir, 'wrangler.json');
     if (existsSync(cmsWranglerPath)) {
         try {
             const cmsWrangler = JSON.parse(readFileSync(cmsWranglerPath, 'utf-8'));
             if (cmsWrangler.name) targetWorkerName = cmsWrangler.name;
+            if (cmsWrangler.vars?.CDN_DOMAIN) detectedCmsDomain = cmsWrangler.vars.CDN_DOMAIN;
+            else if (cmsWrangler.routes?.[0]?.pattern) detectedCmsDomain = cmsWrangler.routes[0].pattern;
         } catch (e) { }
     }
 
-    const siteFolder = await rl.question('Site folder name (e.g., my-new-site): ');
-    const siteDomain = await rl.question('Website Domain (e.g., brand.com): ');
-    const cmsDomain = (await rl.question('CMS API Domain (e.g., admin.t3cloud.eu): ')) || 'admin.t3cloud.eu';
+    // 🎯 Ensure secret exists in worker before provisioning site
+    const frontendApiSecret = existsSync(workerDir) ? getOrGenerateWorkspaceSecret(workerDir) : crypto.randomBytes(32).toString('hex');
+
+    const isCloudflare = handleCancel(await select({
+        message: 'Deployment Architecture for this site:',
+        options: [
+            { value: true, label: 'Cloudflare Edge' },
+            { value: false, label: 'VPS / Local Server' }
+        ]
+    }));
+
+    const siteFolder = handleCancel(await text({
+        message: 'Astro package/folder name (e.g., my-new-site):',
+        placeholder: 'kama-starter',
+        defaultValue: 'kama-starter'
+    }));
+
+    let siteDomain = 'localhost:4321';
+    let cmsFullUrl = 'http://localhost:8787';
+
+    if (isCloudflare) {
+        siteDomain = handleCancel(await text({ message: 'Website Domain (e.g., brand.com):', defaultValue: '' }));
+        if (detectedCmsDomain) {
+            cmsFullUrl = detectedCmsDomain.startsWith('http') ? detectedCmsDomain : `https://${detectedCmsDomain.replace(/^https?:\/\//, '')}`;
+        } else {
+            const cmsDomainInput = handleCancel(await text({ message: 'CMS API Domain (e.g., admin.brand.com):', defaultValue: '' }));
+            cmsFullUrl = `https://${cmsDomainInput.replace(/^https?:\/\//, '')}`;
+        }
+    }
+
+    const s = spinner();
+    s.start(`Generating Astro site...`);
+
+    // 🎯 Pass secret to the frontend generator
+    await generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, targetWorkerName, isCloudflare, frontendApiSecret);
+
+    s.stop(`Site created in sites/${siteFolder}!`);
 
-    await generateAstroSite(rootDir, siteFolder, siteDomain, cmsDomain.replace(/^https?:\/\//, ''), targetWorkerName);
+    note(`1. npm install\n2. npm run dev`, 'Next steps');
+    outro('Site added successfully! 🚀');
+}
 
-    console.log(`\n✨ Site created in sites/${siteFolder}! Run 'npm install' at workspace root.`);
+/**
+ * COMMAND: npx kama bundle
+ */
+async function bundleWorkspaceSchemas(targetRootDir, silent = false) {
+    let rootDir = targetRootDir || process.cwd();
+    if (basename(rootDir) === 'kama-worker') rootDir = resolve(rootDir, '..');
+
+    const s = spinner();
+    if (!silent) s.start('Bundling schemas...');
+    try {
+        let compilerPath = join(__dirname, '../dist/schema-compiler.js');
+        if (!existsSync(compilerPath)) compilerPath = join(__dirname, '../scripts/schema-compiler.ts');
+        await import(pathToFileURL(compilerPath).href);
+        if (!silent) s.stop('Schemas bundled successfully.');
+    } catch (e) {
+        if (!silent) s.stop(`Schema compilation failed: ${e.message}`, true);
+    }
 }
 
 /**
- * Helper: Scaffolds the Astro site with middleware, wrangler.json, & slug page
+ * COMMAND: npx kama promote
  */
-async function generateAstroSite(rootDir, siteFolder, siteDomain, cmsDomain, workerName = 'kama-worker') {
-    console.log(`\n🚀 Scaffolding Astro site (${siteFolder}) mapped to ${siteDomain} (Service: ${workerName})...`);
+async function promoteLocalToCloudflare() {
+    const rootDir = process.cwd();
+    const workerDir = join(rootDir, 'kama-worker');
+    const rootPkgPath = join(rootDir, 'package.json');
+
+    if (!existsSync(workerDir) || !existsSync(rootPkgPath)) {
+        cancel('Error: Could not find kama-worker folder or package.json.');
+        process.exit(1);
+    }
+
+    // 🎯 Safely persist the secret during promotion
+    const frontendApiSecret = getOrGenerateWorkspaceSecret(workerDir);
+
+    const s = spinner();
+    s.start('Checking Cloudflare authentication...');
+
+    const whoami = runWrangler('whoami');
+    if (whoami && (whoami.includes('Getting User Settings') || whoami.includes('You are logged in'))) {
+        s.stop('Logged in to Cloudflare.');
+    } else {
+        s.stop('Not logged in to Cloudflare.', true);
+        console.log(pc.dim('Launching browser for Cloudflare login...'));
+        const login = runWrangler('login', { stdio: 'inherit' });
+        if (login === null) {
+            cancel('Cloudflare login failed.');
+            process.exit(1);
+        }
+    }
+
+    const cmsDomain = handleCancel(await text({ message: 'CMS Admin Domain (e.g., admin.yourdomain.com):', defaultValue: '' }));
+
+    const sitesFolderDir = join(rootDir, 'sites');
+    let siteDomain = '';
+    let siteDir = null;
+    if (existsSync(sitesFolderDir)) {
+        const sites = readdirSync(sitesFolderDir);
+        if (sites.length > 0) {
+            siteDir = join(sitesFolderDir, sites[0]);
+            siteDomain = handleCancel(await text({ message: `Frontend Website Domain for ${sites[0]}:`, defaultValue: '' }));
+        }
+    }
+
+    s.start('Upgrading workspace to Cloudflare Edge...');
 
+    const projName = basename(rootDir);
+    let dbName = `${projName}-db`.replace(/[^a-zA-Z0-9_-]/g, '_');
+    let d1DatabaseId = '00000000-0000-0000-0000-000000000000';
+
+    const d1Output = runWrangler(`d1 create ${dbName}`);
+    if (d1Output) {
+        const match = d1Output.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/);
+        if (match) d1DatabaseId = match[0];
+    }
+
+    const workerName = `${projName}-worker`.toLowerCase().replace(/[^a-z0-9_-]/g, '-');
+    const bucketName = `${projName}-media-prod`.toLowerCase().replace(/[^a-z0-9_-]/g, '-');
+
+    const backendCacheId = getOrCreateKV(`CACHE_KV_${workerName.toUpperCase().replace(/-/g, '_')}`);
+
+    const rootPkg = JSON.parse(readFileSync(rootPkgPath, 'utf-8'));
+    rootPkg.devDependencies = rootPkg.devDependencies || {};
+    rootPkg.devDependencies['wrangler'] = WRANGLER_LATEST;
+    writeFileSync(rootPkgPath, JSON.stringify(rootPkg, null, 2));
+
+    const workerWranglerPath = join(workerDir, 'wrangler.json');
+    let currentConfig = existsSync(workerWranglerPath) ? JSON.parse(readFileSync(workerWranglerPath, 'utf-8')) : {
+        $schema: '../node_modules/wrangler/config-schema.json',
+        name: workerName,
+        main: 'index.js',
+        compatibility_date: '2024-09-23',
+        compatibility_flags: ['nodejs_compat'],
+        assets: { directory: '../node_modules/@brightsideoy/kama/dist', binding: 'ASSETS' },
+        images: { binding: 'IMAGES' },
+        vars: { CLOUDFLARE_ZONE_ID: "REPLACE_WITH_YOUR_32_CHAR_ZONE_ID", KAMA_RUNTIME: 'cloudflare' }
+    };
+
+    currentConfig.dev = currentConfig.dev || { host: 'localhost', port: 8787 };
+    currentConfig.vars.CDN_DOMAIN = cmsDomain;
+    if (siteDomain) currentConfig.vars.PUBLIC_FRONTEND_URL = `https://${siteDomain}`;
+    currentConfig.routes = [{ pattern: cmsDomain, custom_domain: true }];
+    currentConfig.d1_databases = [{ binding: 'DB', database_name: dbName, database_id: d1DatabaseId }];
+    currentConfig.r2_buckets = [{ binding: 'MEDIA_BUCKET', bucket_name: bucketName }];
+    currentConfig.kv_namespaces = [{ binding: 'CACHE_KV', id: backendCacheId }];
+
+    writeFileSync(workerWranglerPath, JSON.stringify(currentConfig, null, 2));
+
+    if (!existsSync(join(workerDir, '.dev.vars'))) {
+        writeFileSync(join(workerDir, '.dev.vars'), `CLOUDFLARE_API_TOKEN=cfut_YOUR_CUSTOM_PURGE_TOKEN\nCDN_DOMAIN=\nPUBLIC_FRONTEND_URL=http://localhost:4321\n\n# Server-to-Server API Security\nFRONTEND_API_SECRET="${frontendApiSecret}"\n`);
+    }
+
+    const workerPkgPath = join(workerDir, 'package.json');
+    if (existsSync(workerPkgPath)) {
+        const workerPkg = JSON.parse(readFileSync(workerPkgPath, 'utf-8'));
+        workerPkg.scripts.dev = "wrangler dev --port 8787 --inspector-port 9239";
+        workerPkg.scripts.deploy = "npm run setup:remote && wrangler deploy";
+        workerPkg.scripts["setup:local"] = `wrangler d1 execute ${dbName} --local --file=../node_modules/@brightsideoy/kama/schema.sql`;
+        workerPkg.scripts["setup:remote"] = `wrangler d1 execute ${dbName} --remote --file=../node_modules/@brightsideoy/kama/schema.sql`;
+
+        // 🎯 Uses native node with the compiled dist/build-seed.js
+        workerPkg.scripts["seed"] = `node ../node_modules/@brightsideoy/kama/dist/build-seed.js && wrangler d1 execute ${dbName} --local --file=seed.sql`;
+
+        workerPkg.devDependencies = workerPkg.devDependencies || {};
+        workerPkg.devDependencies.wrangler = WRANGLER_LATEST;
+        // 🎯 explicit deletion of TSX addition on promotion
+        if (workerPkg.devDependencies.tsx) delete workerPkg.devDependencies.tsx;
+
+        writeFileSync(workerPkgPath, JSON.stringify(workerPkg, null, 2));
+    }
+
+    if (siteDir && siteDomain) {
+        const prefix = basename(siteDir).replace(/[^a-zA-Z0-9]/g, '_').toUpperCase();
+        const sessionId = getOrCreateKV(`SESSION_${prefix}`);
+        const htmlCacheId = getOrCreateKV(`HTML_CACHE_${prefix}`);
+
+        const siteWranglerPath = join(siteDir, 'wrangler.json');
+        const siteConfig = {
+            $schema: "node_modules/wrangler/config-schema.json",
+            name: `${basename(siteDir).toLowerCase().replace(/[^a-z0-9-]/g, '-')}-site`,
+            compatibility_date: "2024-09-23",
+            compatibility_flags: ["nodejs_compat"],
+            dev: { host: 'localhost', port: 4321 },
+            cache: { enabled: true },
+            assets: { directory: "./dist/client", binding: "ASSETS", run_worker_first: true },
+            kv_namespaces: [{ binding: "SESSION", id: sessionId }, { binding: "HTML_CACHE", id: htmlCacheId }],
+            services: [{ binding: "CMS_WORKER", service: currentConfig.name }],
+            routes: [{ pattern: siteDomain, zone_name: siteDomain, custom_domain: true, enabled: true, previews_enabled: false }],
+            vars: { PUBLIC_CMS_URL: `https://${cmsDomain}`, PUBLIC_API_URL: `https://${cmsDomain}` }
+        };
+        writeFileSync(siteWranglerPath, JSON.stringify(siteConfig, null, 2));
+
+        const sitePkgPath = join(siteDir, 'package.json');
+        if (existsSync(sitePkgPath)) {
+            const sitePkg = JSON.parse(readFileSync(sitePkgPath, 'utf-8'));
+            sitePkg.dependencies = sitePkg.dependencies || {};
+            sitePkg.dependencies['astro'] = ASTRO_LATEST;
+            if (sitePkg.dependencies['@astrojs/node']) delete sitePkg.dependencies['@astrojs/node'];
+            sitePkg.dependencies['@astrojs/cloudflare'] = ASTRO_CF_LATEST;
+            sitePkg.devDependencies = sitePkg.devDependencies || {};
+            sitePkg.devDependencies['wrangler'] = WRANGLER_LATEST;
+            writeFileSync(sitePkgPath, JSON.stringify(sitePkg, null, 2));
+        }
+
+        convertAstroConfigToCloudflare(siteDir);
+    }
+
+    s.stop('Workspace successfully upgraded to Cloudflare Edge!');
+    outro('Promotion complete. 🚀\nRemember to run `npx wrangler secret put FRONTEND_API_SECRET` in both your worker and site directories before production deployment!');
+}
+
+/**
+ * Helper: Copies the Astro starter template and hydrates runtime tokens
+ */
+async function generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, workerName = 'kama-worker', isCloudflare = false, frontendApiSecret = '') {
     const siteDir = join(rootDir, 'sites', siteFolder);
-    mkdirSync(join(siteDir, 'src/pages'), { recursive: true });
-    mkdirSync(join(siteDir, 'src/layouts'), { recursive: true });
-    mkdirSync(join(siteDir, 'src/components/blocks'), { recursive: true });
-    mkdirSync(join(siteDir, 'src/lib'), { recursive: true });
+    const templateDir = join(__dirname, '../templates/astro-starter');
+
+    if (!existsSync(templateDir)) return;
+
+    cpSync(templateDir, siteDir, { recursive: true });
+
+    const tsConfig = { extends: "astro/tsconfigs/strict", compilerOptions: { baseUrl: ".", paths: { "@/*": ["src/*"] } } };
+    if (isCloudflare) tsConfig.compilerOptions.types = ["@cloudflare/workers-types"];
+    writeFileSync(join(siteDir, 'tsconfig.json'), JSON.stringify(tsConfig, null, 2));
+
+    const templatePkgPath = join(siteDir, 'package.json.template');
+    if (existsSync(templatePkgPath)) {
+        const rawContent = readFileSync(templatePkgPath, 'utf-8')
+            .replace(/\{\{SITE_NAME\}\}/g, siteFolder)
+            .replace(/\{\{KAMA_VERSION\}\}/g, currentKamaVersion);
+        const sitePkg = JSON.parse(rawContent);
+
+        sitePkg.dependencies = sitePkg.dependencies || {};
+        sitePkg.dependencies['astro'] = ASTRO_LATEST;
+
+        if (!isCloudflare) {
+            if (sitePkg.dependencies['@astrojs/cloudflare']) delete sitePkg.dependencies['@astrojs/cloudflare'];
+            if (sitePkg.dependencies['wrangler']) delete sitePkg.dependencies['wrangler'];
+            if (sitePkg.devDependencies && sitePkg.devDependencies['wrangler']) delete sitePkg.devDependencies['wrangler'];
+            sitePkg.dependencies['@astrojs/node'] = ASTRO_NODE_LATEST;
+        } else {
+            sitePkg.dependencies['@astrojs/cloudflare'] = ASTRO_CF_LATEST;
+            if (sitePkg.dependencies['wrangler']) delete sitePkg.dependencies['wrangler'];
+            sitePkg.devDependencies = sitePkg.devDependencies || {};
+            sitePkg.devDependencies['wrangler'] = WRANGLER_LATEST;
+            convertAstroConfigToCloudflare(siteDir);
+        }
 
-    writeFileSync(
-        join(siteDir, 'package.json'),
-        JSON.stringify({
-            name: siteFolder,
-            type: 'module',
-            version: '0.0.1',
-            engines: { node: '>=22.12.0' },
-            scripts: {
-                dev: 'astro dev',
-                build: 'astro build',
-                preview: 'astro preview',
-                deploy: 'astro build && wrangler deploy',
-            },
-            dependencies: {
-                '@astrojs/cloudflare': '^14.2.5',
-                '@brightsideoy/kama': 'alpha',
-                astro: '^7.2.2',
-                wrangler: '^4.127.1',
-            },
-        }, null, 2)
-    );
+        writeFileSync(join(siteDir, 'package.json'), JSON.stringify(sitePkg, null, 2));
+        unlinkSync(templatePkgPath);
+    }
 
-    // 🎯 Fixed Astro wrangler.json: Added `run_worker_first: true` to prevent media routing 404s on Edge
-    writeFileSync(
-        join(siteDir, 'wrangler.json'),
-        JSON.stringify({
-            $schema: 'node_modules/wrangler/config-schema.json',
-            name: siteFolder,
-            compatibility_date: '2026-08-01',
-            compatibility_flags: ['nodejs_compat'],
-            assets: {
-                directory: './dist/client',
-                binding: 'ASSETS',
-                html_handling: 'drop-trailing-slash',
-                not_found_handling: '404-page',
-                run_worker_first: true
-            },
-            services: [{ binding: 'CMS_WORKER', service: workerName }],
-            routes: [{ pattern: siteDomain, custom_domain: true }],
-            vars: {
-                PUBLIC_CMS_URL: `https://${cmsDomain}`,
-                PUBLIC_API_URL: `https://${cmsDomain}`,
-            },
-        }, null, 2)
-    );
+    const siteLabel = siteFolder.split(/[-_]/).map(word => word.charAt(0).toUpperCase() + word.slice(1)).join(' ');
+    const channelKey = siteFolder.replace(/[^a-z0-9_-]/gi, '-').toLowerCase();
+    const treeKey = 'main-tree';
+    const safeWorkerName = `${siteFolder.toLowerCase().replace(/[^a-z0-9-]/g, '-')}-site`;
+
+    if (isCloudflare) {
+        const prefix = siteFolder.replace(/[^a-zA-Z0-9]/g, '_').toUpperCase();
+        const sessionId = getOrCreateKV(`SESSION_${prefix}`);
+        const htmlCacheId = getOrCreateKV(`HTML_CACHE_${prefix}`);
+
+        const siteConfig = {
+            $schema: "node_modules/wrangler/config-schema.json",
+            name: safeWorkerName,
+            compatibility_date: "2024-09-23",
+            compatibility_flags: ["nodejs_compat"],
+            dev: { host: "localhost", port: 4321 },
+            cache: { enabled: true },
+            assets: { directory: "./dist/client", binding: "ASSETS", run_worker_first: true },
+            kv_namespaces: [{ binding: "SESSION", id: sessionId }, { binding: "HTML_CACHE", id: htmlCacheId }],
+            services: [{ binding: "CMS_WORKER", service: workerName }],
+            vars: { PUBLIC_CMS_URL: cmsFullUrl, PUBLIC_API_URL: cmsFullUrl, PUBLIC_CHANNEL_ID: channelKey, PUBLIC_TREE_ID: treeKey, PUBLIC_SITE_NAME: siteLabel }
+        };
+
+        if (siteDomain !== 'localhost:4321') siteConfig.routes = [{ pattern: siteDomain, custom_domain: true, enabled: true, previews_enabled: false }];
+        writeFileSync(join(siteDir, 'wrangler.json'), JSON.stringify(siteConfig, null, 2));
+    }
 
-    const astroConfig = `import { defineConfig } from 'astro/config';
-import cloudflare from '@astrojs/cloudflare';
-
-export default defineConfig({
-  output: 'server',
-  trailingSlash: 'ignore',
-  image: {
-    remotePatterns: [
-      { protocol: 'http', hostname: 'localhost', port: '3000' },
-      { protocol: 'https', hostname: '${cmsDomain}' }
-    ]
-  },
-  build: {
-    inlineStylesheets: 'always',
-  },
-  adapter: cloudflare({
-    imageService: 'cloudflare',
-  })
-});`;
-    writeFileSync(join(siteDir, 'astro.config.mjs'), astroConfig);
+    // 🎯 Dynamically append the secret to the Astro environment setup
+    let envContent = `# Local Development Overrides\nPUBLIC_CMS_URL="http://127.0.0.1:8787"\nPUBLIC_API_URL="http://127.0.0.1:8787"\nPUBLIC_CHANNEL_ID="${channelKey}"\nPUBLIC_TREE_ID="${treeKey}"\nPUBLIC_SITE_NAME="${siteLabel.replace(/"/g, '\\"')}"\n`;
 
-    writeFileSync(
-        join(siteDir, '.env'),
-        `PUBLIC_CMS_URL="https://${cmsDomain}"\nPUBLIC_API_URL="https://${cmsDomain}"\n`
-    );
+    if (frontendApiSecret) {
+        envContent += `\n# Server-to-Server API Security\nFRONTEND_API_SECRET="${frontendApiSecret}"\n`;
+    }
+
+    writeFileSync(join(siteDir, '.env'), envContent);
 }
 
 main().catch(console.error);