@brightsideoy/kama 1.0.0-alpha.13 → 1.0.0-alpha.16

package/bin/cli.js

@@ -2,11 +2,11 @@
 import { execSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, appendFileSync } from 'node:fs';
 import { join, dirname, basename, resolve } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
+import { fileURLToPath } from 'node:url';
 import crypto from 'node:crypto'; // 🎯 NEW: Cryptographically secure token generator
 
 // 🎯 Modern CLI UI Components
-import { intro, outro, text, select, confirm, spinner, note, isCancel, cancel } from '@clack/prompts';
+import { intro, outro, text, password, select, confirm, spinner, note, isCancel, cancel } from '@clack/prompts';
 
 // --- UI HELPERS (Zero Dependency Colors) ---
 const pc = {
@@ -106,31 +106,29 @@ function getWranglerCmd() {
 function runWrangler(cmd, options = {}) {
     const baseWrangler = getWranglerCmd();
     try {
-        return execSync(`${baseWrangler} ${cmd}`, {
+        const result = execSync(`${baseWrangler} ${cmd}`, {
             encoding: 'utf-8',
-            stdio: options.stdio || ['ignore', 'pipe', 'pipe'],
+            stdio: options.stdio || 'pipe',
+            input: options.input,
+            cwd: options.cwd || process.cwd(),
             env: {
                 ...process.env,
                 PATH: process.env.PATH
             }
         });
+        return typeof result === 'string' ? result : '';
     } catch (e) {
-        if (options.throw) throw e;
+        if (options.throw) throw new Error(`Wrangler command failed: ${cmd}\n${e.stderr || e.message}`);
         return null;
     }
 }
 
-/**
-- 🎯 BULLETPROOF KV PROVISIONING ENGINE
- */
-function getOrCreateKV(title) {
-    const out = runWrangler(`kv namespace create "${title}"`);
-    if (out) {
-        const match = out.match(/"id":\s*"([a-fA-F0-9]{32})"/);
-        if (match) return match[1];
-    }
+function shellQuote(value) {
+    return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
 
-    const listOut = runWrangler(`kv namespace list`);
+function getOrCreateKV(title, cwd = process.cwd()) {
+    const listOut = runWrangler('kv namespace list', { cwd });
     if (listOut) {
         try {
             const namespaces = JSON.parse(listOut);
@@ -139,7 +137,136 @@ function getOrCreateKV(title) {
         } catch (err) { }
     }
 
-    return `REPLACE_WITH_${title}_ID`;
+    const createOut = runWrangler(`kv namespace create ${shellQuote(title)}`, { cwd, throw: true });
+    const match = createOut.match(/"id":\s*"([a-fA-F0-9]{32})"/);
+    if (match) return match[1];
+
+    throw new Error(`Unable to create or find Cloudflare KV namespace "${title}". Check Wrangler authentication and permissions.`);
+}
+
+function getOrCreateD1(name, cwd = process.cwd()) {
+    const listOutput = runWrangler('d1 list --json', { cwd, throw: true });
+    let databases;
+    try {
+        databases = JSON.parse(listOutput);
+    } catch (error) {
+        throw new Error('Wrangler returned invalid JSON while listing D1 databases.');
+    }
+
+    const existing = databases.find(database => database.name === name);
+    if (existing?.uuid) return existing.uuid;
+
+    const createOutput = runWrangler(`d1 create ${shellQuote(name)}`, { cwd, throw: true });
+    const created = createOutput.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/);
+    if (created) return created[0];
+
+    throw new Error(`Cloudflare D1 database "${name}" was not created or returned a valid ID.`);
+}
+
+function ensureR2Bucket(name, cwd = process.cwd()) {
+    if (runWrangler(`r2 bucket info ${shellQuote(name)} --json`, { cwd })) return;
+
+    const createOutput = runWrangler(`r2 bucket create ${shellQuote(name)}`, { cwd });
+    if (createOutput || runWrangler(`r2 bucket info ${shellQuote(name)} --json`, { cwd })) return;
+
+    throw new Error(`Unable to create or find Cloudflare R2 bucket "${name}". Check Wrangler authentication and permissions.`);
+}
+
+function ensureCloudflareAuth(cwd) {
+    if (runWrangler('whoami', { cwd })) return;
+
+    console.log(pc.dim('Launching browser for Cloudflare login...'));
+    runWrangler('login', { cwd, stdio: 'inherit', throw: true });
+    if (!runWrangler('whoami', { cwd })) {
+        throw new Error('Cloudflare authentication could not be verified after login.');
+    }
+}
+
+function writeWorkerSecrets(workerDir, secret, cloudflareApiToken = '') {
+    const values = [`FRONTEND_API_SECRET=${secret}`];
+    if (cloudflareApiToken) values.push(`CLOUDFLARE_API_TOKEN=${cloudflareApiToken}`);
+    writeFileSync(join(workerDir, '.secrets'), `${values.join('\n')}\n`, { mode: 0o600 });
+}
+
+function readEnvValue(filePath, key) {
+    if (!existsSync(filePath)) return '';
+    const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const match = readFileSync(filePath, 'utf8').match(new RegExp(`^${escapedKey}=["']?([^"'\\r\\n]*)`, 'm'));
+    return match?.[1]?.trim() || '';
+}
+
+async function resolveCloudflareZoneId(domain, token) {
+    if (!token) return '';
+
+    const labels = domain.split('.');
+    for (let index = 0; index < labels.length - 1; index++) {
+        const zoneName = labels.slice(index).join('.');
+        const response = await fetch(`https://api.cloudflare.com/client/v4/zones?name=${encodeURIComponent(zoneName)}&per_page=50`, {
+            headers: { Authorization: `Bearer ${token}` }
+        });
+        const data = await response.json();
+        if (!response.ok || !data.success) {
+            throw new Error(`Could not look up Cloudflare zone for ${domain}. Check the token's Zone Read permission.`);
+        }
+        const zone = data.result?.find(item => item.name === zoneName && item.status === 'active');
+        if (zone?.id) return zone.id;
+    }
+
+    throw new Error(`No active Cloudflare zone was found for ${domain}. Add the domain to Cloudflare or enter its Zone ID manually.`);
+}
+
+async function promptForCloudflareApiToken(existingToken = '') {
+    const token = handleCancel(await password({
+        message: `Optional Cloudflare API token (Zone Read + Zone Cache Purge${existingToken ? '; leave blank to keep existing token' : ''}):`,
+        mask: '*'
+    }));
+    return token.trim() || existingToken;
+}
+
+function normalizeCloudflareDomain(value, label) {
+    const input = String(value || '').trim();
+    if (!input) throw new Error(`${label} is required for Cloudflare deployment.`);
+
+    try {
+        const url = new URL(input.includes('://') ? input : `https://${input}`);
+        if (!url.hostname.includes('.') || url.hostname === 'localhost') throw new Error();
+        return url.host.toLowerCase();
+    } catch {
+        throw new Error(`${label} must be a valid Cloudflare domain, for example example.com.`);
+    }
+}
+
+function ensureGitIgnoreEntries(rootDir, entries) {
+    const gitignorePath = join(rootDir, '.gitignore');
+    const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, 'utf8') : '';
+    const lines = new Set(existing.split(/\r?\n/));
+    const missing = entries.filter(line => !lines.has(line));
+    if (missing.length > 0) appendFileSync(gitignorePath, `${existing && !existing.endsWith('\n') ? '\n' : ''}${missing.join('\n')}\n`);
+}
+
+function ignoreSecretFiles(rootDir) {
+    ensureGitIgnoreEntries(rootDir, ['kama-worker/.secrets', 'kama-worker/.dev.vars', 'sites/*/.secrets', 'sites/*/.dev.vars']);
+}
+
+function updateEnvFile(filePath, values, removeKeys = []) {
+    const existing = existsSync(filePath) ? readFileSync(filePath, 'utf8') : '';
+    const keys = new Set(Object.keys(values));
+    const found = new Set();
+    const lines = existing.split(/\r?\n/).filter(line => {
+        const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/);
+        return !match || !removeKeys.includes(match[1]);
+    }).map(line => {
+        const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/);
+        if (!match || !keys.has(match[1])) return line;
+        found.add(match[1]);
+        return `${match[1]}=${JSON.stringify(values[match[1]])}`;
+    });
+
+    for (const key of keys) {
+        if (!found.has(key)) lines.push(`${key}=${JSON.stringify(values[key])}`);
+    }
+
+    writeFileSync(filePath, `${lines.filter((line, index) => line || index < lines.length - 1).join('\n')}\n`);
 }
 
 function showHelp() {
@@ -156,7 +283,7 @@ function showHelp() {
     console.log('  npm run setup                Initialize database schema (Run Once)');
     console.log('  npm run seed -w kama-worker  Seed the database with mock test data');
     console.log('  npm run dev                  Boot up the CMS backend and Astro frontend concurrently');
-    console.log('  npm run deploy:cms           Deploy the backend worker and database to Cloudflare');
+    console.log('  npm run deploy:kama           Deploy the backend worker and database to Cloudflare');
     console.log('  npm run deploy:site          Deploy the Astro frontend site to Cloudflare\n');
 }
 
@@ -278,8 +405,14 @@ async function createFullWorkspace() {
                 defaultValue: ''
             }));
         }
+
+        cmsDomain = normalizeCloudflareDomain(cmsDomain, 'CMS Admin Domain');
+        if (shouldCreateSite) siteDomain = normalizeCloudflareDomain(siteDomain, 'Frontend Website Domain');
     }
 
+    const cloudflareApiToken = isCloudflare ? await promptForCloudflareApiToken() : '';
+    const cloudflareZoneId = isCloudflare ? await resolveCloudflareZoneId(cmsDomain, cloudflareApiToken) : '';
+
     const cmsProtocol = isCloudflare ? 'https://' : 'http://';
     const cmsFullUrl = cmsDomain ? `${cmsProtocol}${cmsDomain.replace(/^https?:\/\//, '')}` : 'http://localhost:8787';
 
@@ -295,82 +428,42 @@ async function createFullWorkspace() {
 
     if (!isCurrentDir) mkdirSync(rootDir, { recursive: true });
 
-    writeFileSync(
-        join(rootDir, '.gitignore'),
-        `node_modules/\n.env\n.DS_Store\nkama-worker/.dev.vars\nkama-worker/.env\nkama-worker/.wrangler/\nkama-worker/public/\nkama-worker/*.db\nsites/*/.env\nsites/*/.astro/\nsites/*/dist/\nkama-worker/bundled-definitions.js\n`
-    );
+    ensureGitIgnoreEntries(rootDir, [
+        'node_modules/', '.env', '.DS_Store', 'kama-worker/.dev.vars', 'kama-worker/.secrets',
+        'kama-worker/.env', 'kama-worker/.wrangler/', 'kama-worker/public/', 'kama-worker/*.db',
+        'sites/*/.env', 'sites/*/.secrets', 'sites/*/.astro/', 'sites/*/dist/',
+        'kama-worker/bundled-definitions.js'
+    ]);
 
     const sourceDefsDir = join(__dirname, '../content/definitions');
     const targetDefsDir = join(rootDir, 'content', 'definitions');
     if (existsSync(sourceDefsDir)) cpSync(sourceDefsDir, targetDefsDir, { recursive: true });
 
     let d1DatabaseId = '00000000-0000-0000-0000-000000000000';
-    let backendCacheId = 'REPLACE_WITH_CACHE_KV_ID';
-    let isAuthenticated = false;
-
+    let backendCacheId = '';
     if (isCloudflare) {
-        s.message('Checking Cloudflare authentication...');
-        const whoami = runWrangler('whoami');
-        if (whoami && (whoami.includes('Getting User Settings') || whoami.includes('You are logged in'))) {
-            isAuthenticated = true;
-        } else {
-            s.stop('Not authenticated with Cloudflare.', true);
-            console.log(pc.dim('Launching browser for Cloudflare login...'));
-            const login = runWrangler('login', { stdio: 'inherit' });
-            if (login !== null) isAuthenticated = true;
-            s.start('Resuming provisioning...');
-        }
-
-        if (isAuthenticated) {
-            s.message('Provisioning backend KV Cache...');
-            backendCacheId = getOrCreateKV(`CACHE_KV_${workerName.toUpperCase().replace(/-/g, '_')}`);
-
-            s.message('Checking existing Cloudflare D1 databases...');
-            const listOutput = runWrangler('d1 list --json');
-            if (listOutput) {
-                try {
-                    const jsonStart = listOutput.indexOf('[');
-                    const jsonEnd = listOutput.lastIndexOf(']') + 1;
-                    let databases = [];
-
-                    if (jsonStart !== -1 && jsonEnd !== -1) databases = JSON.parse(listOutput.substring(jsonStart, jsonEnd));
-                    const existingDb = databases.find(db => db.name === dbName);
-
-                    if (existingDb) {
-                        s.stop(`Database '${dbName}' already exists on your account.`);
-                        const useExisting = handleCancel(await confirm({ message: 'Do you want to link this existing database?', initialValue: true }));
-
-                        if (useExisting) {
-                            d1DatabaseId = existingDb.uuid;
-                            s.start(`Linked existing database ID: ${d1DatabaseId}`);
-                        } else {
-                            dbName = handleCancel(await text({ message: 'Enter a new database name:' }));
-                            s.start(`Creating new database '${dbName}'...`);
-                            const d1Output = runWrangler(`d1 create ${dbName}`);
-                            const match = d1Output ? d1Output.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/) : null;
-                            if (match) d1DatabaseId = match[0];
-                        }
-                    } else {
-                        s.message(`Attempting to auto-create Cloudflare D1 Database '${dbName}'...`);
-                        const d1Output = runWrangler(`d1 create ${dbName}`);
-                        const match = d1Output ? d1Output.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/) : null;
-                        if (match) d1DatabaseId = match[0];
-                    }
-                } catch (error) { }
-            }
-        }
+        s.message('Authenticating with Cloudflare...');
+        ensureCloudflareAuth(process.cwd());
+        s.message('Provisioning D1, KV, and R2 resources...');
+        backendCacheId = getOrCreateKV(`CACHE_KV_${workerName.toUpperCase().replace(/-/g, '_')}`, rootDir);
+        d1DatabaseId = getOrCreateD1(dbName, rootDir);
+        ensureR2Bucket(bucketName, rootDir);
     }
 
     s.message('Writing configuration files...');
 
+    const rootPkgPath = join(rootDir, 'package.json');
+    const existingRootPkg = existsSync(rootPkgPath) ? JSON.parse(readFileSync(rootPkgPath, 'utf-8')) : {};
+    const existingWorkspaces = Array.isArray(existingRootPkg.workspaces) ? existingRootPkg.workspaces : [];
     const rootPkg = {
-        name: projName,
+        ...existingRootPkg,
+        name: existingRootPkg.name || projName,
         private: true,
-        type: 'module',
-        workspaces: ['kama-worker', 'sites/*'],
-        scripts: { 'setup': 'npm run setup:local -w kama-worker' },
-        dependencies: { '@brightsideoy/kama': currentKamaVersion },
-        devDependencies: {}
+        type: existingRootPkg.type || 'module',
+        workspaces: [...new Set([...existingWorkspaces, 'kama-worker', 'sites/*'])],
+        scripts: { ...existingRootPkg.scripts, 'setup': 'npx kama bundle && npm run setup:local -w kama-worker' },
+        dependencies: { ...existingRootPkg.dependencies, '@brightsideoy/kama': currentKamaVersion },
+        devDependencies: { ...existingRootPkg.devDependencies }
     };
 
     if (isCloudflare) rootPkg.devDependencies['wrangler'] = WRANGLER_LATEST;
@@ -381,14 +474,14 @@ async function createFullWorkspace() {
         rootPkg.scripts['predev'] = 'npx kama bundle';
         rootPkg.scripts['dev'] = 'npx concurrently "npm run dev -w kama-worker" "npm run dev -w sites/' + siteFolderName + '"';
         rootPkg.scripts['deploy:site'] = `npm run deploy -w sites/${siteFolderName}`;
-        rootPkg.scripts['deploy:cms'] = `npm run deploy -w kama-worker`;
+        rootPkg.scripts['deploy:kama'] = `npm run deploy -w kama-worker`;
     } else {
         rootPkg.scripts['predev'] = 'npx kama bundle';
         rootPkg.scripts['dev'] = 'npm run dev -w kama-worker';
-        rootPkg.scripts['deploy:cms'] = `npm run deploy -w kama-worker`;
+        rootPkg.scripts['deploy:kama'] = `npm run deploy -w kama-worker`;
     }
 
-    writeFileSync(join(rootDir, 'package.json'), JSON.stringify(rootPkg, null, 2));
+    writeFileSync(rootPkgPath, JSON.stringify(rootPkg, null, 2));
 
     const cmsDir = join(rootDir, 'kama-worker');
     mkdirSync(cmsDir, { recursive: true });
@@ -410,10 +503,10 @@ async function createFullWorkspace() {
                     "seed": "npm run seed:local",
                     "seed:local": "node ../node_modules/@brightsideoy/kama/dist/build-seed.js && for f in seed-*.sql; do wrangler d1 execute " + dbName + " --local --file=\"$f\"; done",
                     "seed:remote": "node ../node_modules/@brightsideoy/kama/dist/build-seed.js && for f in seed-*.sql; do wrangler d1 execute " + dbName + " --remote --file=\"$f\"; done",
-                    "setup:local": `wrangler d1 execute ${dbName} --local --file=../node_modules/@brightsideoy/kama/schema.sql > /dev/null 2>&1`,
+                    "setup:local": `wrangler d1 execute ${dbName} --local --file=../node_modules/@brightsideoy/kama/schema.sql`,
                     "setup:remote": `wrangler d1 execute ${dbName} --remote --file=../node_modules/@brightsideoy/kama/schema.sql`,
                     "dev": "wrangler dev --port 8787 --inspector-port 9239",
-                    "deploy": "npm run setup:remote && wrangler deploy"
+                    "deploy": "npm run setup:remote && wrangler deploy --secrets-file .secrets"
                 },
                 dependencies: { '@brightsideoy/kama': currentKamaVersion, '@libsql/client': '^0.14.0' },
                 devDependencies: { "wrangler": WRANGLER_LATEST },
@@ -433,7 +526,7 @@ async function createFullWorkspace() {
             vars: {
                 CDN_DOMAIN: cmsDomain || 'localhost:8787',
                 PUBLIC_FRONTEND_URL: (shouldCreateSite) ? (siteDomain && siteDomain !== 'localhost:4321' ? `https://${siteDomain}` : 'http://localhost:4321') : 'http://localhost:4321',
-                CLOUDFLARE_ZONE_ID: "REPLACE_WITH_YOUR_32_CHAR_ZONE_ID",
+                CLOUDFLARE_ZONE_ID: cloudflareZoneId,
                 KAMA_RUNTIME: 'cloudflare'
             },
             d1_databases: [{ binding: 'DB', database_name: dbName, database_id: d1DatabaseId }],
@@ -444,7 +537,10 @@ async function createFullWorkspace() {
         writeFileSync(join(cmsDir, 'wrangler.json'), JSON.stringify(cmsWranglerConfig, null, 2));
 
         const publicFrontendUrl = (shouldCreateSite) ? (siteDomain && siteDomain !== 'localhost:4321' ? `https://${siteDomain}` : 'http://localhost:4321') : 'http://localhost:4321';
-        writeFileSync(join(cmsDir, '.dev.vars'), `# Cloudflare Edge Cache Purging Secrets\nCLOUDFLARE_API_TOKEN=cfut_YOUR_CUSTOM_PURGE_TOKEN\n\n# Local Development Overrides\nCDN_DOMAIN=\nPUBLIC_FRONTEND_URL=${publicFrontendUrl}\n\n# Server-to-Server API Security\nFRONTEND_API_SECRET="${frontendApiSecret}"\n`);
+        const devVars = [`# Local Development Overrides`, `CDN_DOMAIN=`, `PUBLIC_FRONTEND_URL=${publicFrontendUrl}`, ``, `# Server-to-Server API Security`, `FRONTEND_API_SECRET="${frontendApiSecret}"`];
+        if (cloudflareApiToken) devVars.push(`CLOUDFLARE_API_TOKEN="${cloudflareApiToken}"`);
+        writeFileSync(join(cmsDir, '.dev.vars'), `${devVars.join('\n')}\n`, { mode: 0o600 });
+        writeWorkerSecrets(cmsDir, frontendApiSecret, cloudflareApiToken);
     } else {
         const templateServerPath = join(__dirname, '../templates/kama-worker/server.js');
         if (existsSync(templateServerPath)) cpSync(templateServerPath, join(cmsDir, 'server.js'));
@@ -457,8 +553,8 @@ async function createFullWorkspace() {
                 version: '1.0.0',
                 scripts: {
                     "seed": "npm run seed:local",
-                    "seed:local": "node ../node_modules/@brightsideoy/kama/dist/build-seed.js && cat seed-*.sql | sqlite3 kama.db",
-                    "setup:local": "sqlite3 kama.db < ../node_modules/@brightsideoy/kama/schema.sql",
+                    "seed:local": "node ../node_modules/@brightsideoy/kama/dist/build-seed.js && node setup-local-db.mjs seed",
+                    "setup:local": "node setup-local-db.mjs schema",
                     "dev": "tsx server.js",
                     "start": "node server.js"
                 },
@@ -468,6 +564,7 @@ async function createFullWorkspace() {
         );
 
         writeFileSync(join(cmsDir, '.env'), `PORT=8787\nKAMA_RUNTIME=node\nDB_PATH=./kama.db\nLOCAL_MEDIA_PATH=./public/media\nPUBLIC_CMS_URL=http://127.0.0.1:8787\nPUBLIC_API_URL=http://127.0.0.1:8787\nPUBLIC_FRONTEND_URL=http://127.0.0.1:4321\n\n# Server-to-Server API Security\nFRONTEND_API_SECRET="${frontendApiSecret}"\n`);
+        cpSync(join(__dirname, '../templates/kama-worker/setup-local-db.mjs'), join(cmsDir, 'setup-local-db.mjs'));
     }
 
     s.message('Bundling schemas...');
@@ -478,20 +575,23 @@ async function createFullWorkspace() {
         await generateAstroSite(rootDir, siteFolderName, siteDomain, cmsFullUrl, workerName, isCloudflare, frontendApiSecret);
     }
 
-    s.stop('Workspace provisioned successfully.');
+    s.message('Installing workspace dependencies...');
+    execSync('npm install', { cwd: rootDir, stdio: 'inherit' });
+    s.message('Bundling schemas and initializing the local database...');
+    execSync('npm run setup', { cwd: rootDir, stdio: 'inherit' });
+
+    s.stop('Workspace installed and initialized successfully.');
 
     let nextSteps = '';
     let stepCount = 1;
     if (!isCurrentDir) nextSteps += `${stepCount++}. cd ${projName}\n`;
-    nextSteps += `${stepCount++}. npm install\n`;
-    nextSteps += `${stepCount++}. npm run setup  ${pc.dim('<- Run this once to init the database schema!')}\n`;
     nextSteps += `${stepCount++}. npm run dev\n`;
 
     if (isCloudflare) {
         nextSteps += `\n${pc.dim('Cloudflare Note:')}\n`;
-        nextSteps += `${pc.dim('Update CLOUDFLARE_ZONE_ID in wrangler.json')}\n`;
-        nextSteps += `${pc.dim('Set Cache purge token: npx wrangler secret put CLOUDFLARE_API_TOKEN')}\n`;
-        nextSteps += `${pc.dim('Set Frontend API secret: npx wrangler secret put FRONTEND_API_SECRET')}`;
+        nextSteps += cloudflareApiToken
+            ? `${pc.dim('Zone ID was discovered automatically; the purge token is stored as an ignored Worker secret.')}`
+            : `${pc.dim('Zone-level cache purging is disabled. Run kama promote with a token to enable it.')}`;
     }
 
     note(nextSteps, 'Next steps');
@@ -544,22 +644,29 @@ async function createNewSiteOnly() {
 
     if (isCloudflare) {
         siteDomain = handleCancel(await text({ message: 'Website Domain (e.g., brand.com):', defaultValue: '' }));
+        siteDomain = normalizeCloudflareDomain(siteDomain, 'Frontend Website Domain');
         if (detectedCmsDomain) {
             cmsFullUrl = detectedCmsDomain.startsWith('http') ? detectedCmsDomain : `https://${detectedCmsDomain.replace(/^https?:\/\//, '')}`;
         } else {
             const cmsDomainInput = handleCancel(await text({ message: 'CMS API Domain (e.g., admin.brand.com):', defaultValue: '' }));
-            cmsFullUrl = `https://${cmsDomainInput.replace(/^https?:\/\//, '')}`;
+            cmsFullUrl = `https://${normalizeCloudflareDomain(cmsDomainInput, 'CMS API Domain')}`;
         }
+        ensureCloudflareAuth(rootDir);
     }
 
+    ignoreSecretFiles(rootDir);
+
     const s = spinner();
     s.start(`Generating Astro site...`);
 
     await generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, targetWorkerName, isCloudflare, frontendApiSecret);
+    ignoreSecretFiles(rootDir);
+    s.message('Installing workspace dependencies...');
+    execSync('npm install', { cwd: rootDir, stdio: 'inherit' });
 
     s.stop(`Site created in sites/${siteFolder}!`);
 
-    note(`1. npm install\n2. npm run dev`, 'Next steps');
+    note('Run `npm run dev` from the workspace root to start the new site.', 'Next steps');
     outro('Site added successfully! 🚀');
 }
 
@@ -575,10 +682,11 @@ async function bundleWorkspaceSchemas(targetRootDir, silent = false) {
     try {
         let compilerPath = join(__dirname, '../dist/schema-compiler.js');
         if (!existsSync(compilerPath)) compilerPath = join(__dirname, '../scripts/schema-compiler.ts');
-        await import(pathToFileURL(compilerPath).href);
+        execSync(`${shellQuote(process.execPath)} ${shellQuote(compilerPath)}`, { cwd: rootDir, stdio: 'inherit' });
         if (!silent) s.stop('Schemas bundled successfully.');
     } catch (e) {
         if (!silent) s.stop(`Schema compilation failed: ${e.message}`, true);
+        else throw e;
     }
 }
 
@@ -599,21 +707,16 @@ async function promoteLocalToCloudflare() {
 
     const s = spinner();
     s.start('Checking Cloudflare authentication...');
+    ensureCloudflareAuth(rootDir);
+    s.stop('Cloudflare authentication verified.');
 
-    const whoami = runWrangler('whoami');
-    if (whoami && (whoami.includes('Getting User Settings') || whoami.includes('You are logged in'))) {
-        s.stop('Logged in to Cloudflare.');
-    } else {
-        s.stop('Not logged in to Cloudflare.', true);
-        console.log(pc.dim('Launching browser for Cloudflare login...'));
-        const login = runWrangler('login', { stdio: 'inherit' });
-        if (login === null) {
-            cancel('Cloudflare login failed.');
-            process.exit(1);
-        }
-    }
-
-    const cmsDomain = handleCancel(await text({ message: 'CMS Admin Domain (e.g., admin.yourdomain.com):', defaultValue: '' }));
+    const cmsDomain = normalizeCloudflareDomain(
+        handleCancel(await text({ message: 'CMS Admin Domain (e.g., admin.yourdomain.com):', defaultValue: '' })),
+        'CMS Admin Domain'
+    );
+    const existingCloudflareToken = readEnvValue(join(workerDir, '.dev.vars'), 'CLOUDFLARE_API_TOKEN') || readEnvValue(join(workerDir, '.secrets'), 'CLOUDFLARE_API_TOKEN');
+    const cloudflareApiToken = await promptForCloudflareApiToken(existingCloudflareToken);
+    const cloudflareZoneId = await resolveCloudflareZoneId(cmsDomain, cloudflareApiToken);
 
     const sitesFolderDir = join(rootDir, 'sites');
     let siteDomain = '';
@@ -622,48 +725,24 @@ async function promoteLocalToCloudflare() {
         const sites = readdirSync(sitesFolderDir);
         if (sites.length > 0) {
             siteDir = join(sitesFolderDir, sites[0]);
-            siteDomain = handleCancel(await text({ message: `Frontend Website Domain for ${sites[0]}:`, defaultValue: '' }));
+            siteDomain = normalizeCloudflareDomain(
+                handleCancel(await text({ message: `Frontend Website Domain for ${sites[0]}:`, defaultValue: '' })),
+                'Frontend Website Domain'
+            );
         }
     }
 
+    ignoreSecretFiles(rootDir);
+
     s.start('Upgrading workspace to Cloudflare Edge...');
 
     const projName = basename(rootDir);
-    let dbName = `${projName}-db`.replace(/[^a-zA-Z0-9_-]/g, '_');
-
-    // 🎯 1. ARCHITECTURE FIX: Check if the database already exists
-    let d1DatabaseId = '00000000-0000-0000-0000-000000000000';
-    const listOutput = runWrangler('d1 list --json');
-    let dbExists = false;
-
-    if (listOutput) {
-        try {
-            const jsonStart = listOutput.indexOf('[');
-            const jsonEnd = listOutput.lastIndexOf(']') + 1;
-            if (jsonStart !== -1 && jsonEnd !== -1) {
-                const databases = JSON.parse(listOutput.substring(jsonStart, jsonEnd));
-                const existingDb = databases.find(db => db.name === dbName);
-                if (existingDb) {
-                    d1DatabaseId = existingDb.uuid;
-                    dbExists = true;
-                }
-            }
-        } catch (e) { }
-    }
-
-    // 2. If it doesn't exist, create it safely
-    if (!dbExists) {
-        const d1Output = runWrangler(`d1 create ${dbName}`);
-        if (d1Output) {
-            const match = d1Output.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/);
-            if (match) d1DatabaseId = match[0];
-        }
-    }
-
     const workerName = `${projName}-worker`.toLowerCase().replace(/[^a-z0-9_-]/g, '-');
     const bucketName = `${projName}-media-prod`.toLowerCase().replace(/[^a-z0-9_-]/g, '-');
-
-    const backendCacheId = getOrCreateKV(`CACHE_KV_${workerName.toUpperCase().replace(/-/g, '_')}`);
+    const dbName = `${projName}-db`.replace(/[^a-zA-Z0-9_-]/g, '_');
+    const d1DatabaseId = getOrCreateD1(dbName, rootDir);
+    const backendCacheId = getOrCreateKV(`CACHE_KV_${workerName.toUpperCase().replace(/-/g, '_')}`, rootDir);
+    ensureR2Bucket(bucketName, rootDir);
 
     const rootPkg = JSON.parse(readFileSync(rootPkgPath, 'utf-8'));
     rootPkg.devDependencies = rootPkg.devDependencies || {};
@@ -679,10 +758,21 @@ async function promoteLocalToCloudflare() {
         compatibility_flags: ['nodejs_compat'],
         assets: { directory: '../node_modules/@brightsideoy/kama/dist', binding: 'ASSETS' },
         images: { binding: 'IMAGES' },
-        vars: { CLOUDFLARE_ZONE_ID: "REPLACE_WITH_YOUR_32_CHAR_ZONE_ID", KAMA_RUNTIME: 'cloudflare' }
+        vars: { CLOUDFLARE_ZONE_ID: '', KAMA_RUNTIME: 'cloudflare' }
     };
 
+    const cloudflareEntryPath = join(workerDir, 'index.js');
+    if (!existsSync(cloudflareEntryPath)) {
+        cpSync(join(__dirname, '../templates/kama-worker/index.js'), cloudflareEntryPath);
+    }
+
+    currentConfig.main = 'index.js';
     currentConfig.dev = currentConfig.dev || { host: 'localhost', port: 8787 };
+    currentConfig.vars = currentConfig.vars || {};
+    if (String(currentConfig.vars.CLOUDFLARE_ZONE_ID || '').startsWith('REPLACE_WITH_')) {
+        currentConfig.vars.CLOUDFLARE_ZONE_ID = '';
+    }
+    currentConfig.vars.CLOUDFLARE_ZONE_ID = cloudflareZoneId || currentConfig.vars.CLOUDFLARE_ZONE_ID || '';
     currentConfig.vars.CDN_DOMAIN = cmsDomain;
     if (siteDomain) currentConfig.vars.PUBLIC_FRONTEND_URL = `https://${siteDomain}`;
     currentConfig.routes = [{ pattern: cmsDomain, custom_domain: true }];
@@ -692,15 +782,19 @@ async function promoteLocalToCloudflare() {
 
     writeFileSync(workerWranglerPath, JSON.stringify(currentConfig, null, 2));
 
-    if (!existsSync(join(workerDir, '.dev.vars'))) {
-        writeFileSync(join(workerDir, '.dev.vars'), `CLOUDFLARE_API_TOKEN=cfut_YOUR_CUSTOM_PURGE_TOKEN\nCDN_DOMAIN=\nPUBLIC_FRONTEND_URL=http://localhost:4321\n\n# Server-to-Server API Security\nFRONTEND_API_SECRET="${frontendApiSecret}"\n`);
-    }
+    updateEnvFile(join(workerDir, '.dev.vars'), {
+        CDN_DOMAIN: '',
+        PUBLIC_FRONTEND_URL: 'http://localhost:4321',
+        FRONTEND_API_SECRET: frontendApiSecret,
+        ...(cloudflareApiToken ? { CLOUDFLARE_API_TOKEN: cloudflareApiToken } : {})
+    });
+    writeWorkerSecrets(workerDir, frontendApiSecret, cloudflareApiToken);
 
     const workerPkgPath = join(workerDir, 'package.json');
     if (existsSync(workerPkgPath)) {
         const workerPkg = JSON.parse(readFileSync(workerPkgPath, 'utf-8'));
         workerPkg.scripts.dev = "wrangler dev --port 8787 --inspector-port 9239";
-        workerPkg.scripts.deploy = "npm run setup:remote && wrangler deploy";
+        workerPkg.scripts.deploy = "npm run setup:remote && wrangler deploy --secrets-file .secrets";
         workerPkg.scripts["setup:local"] = `wrangler d1 execute ${dbName} --local --file=../node_modules/@brightsideoy/kama/schema.sql`;
         workerPkg.scripts["setup:remote"] = `wrangler d1 execute ${dbName} --remote --file=../node_modules/@brightsideoy/kama/schema.sql`;
 
@@ -718,8 +812,8 @@ async function promoteLocalToCloudflare() {
 
     if (siteDir && siteDomain) {
         const prefix = basename(siteDir).replace(/[^a-zA-Z0-9]/g, '_').toUpperCase();
-        const sessionId = getOrCreateKV(`SESSION_${prefix}`);
-        const htmlCacheId = getOrCreateKV(`HTML_CACHE_${prefix}`);
+        const sessionId = getOrCreateKV(`SESSION_${prefix}`, rootDir);
+        const htmlCacheId = getOrCreateKV(`HTML_CACHE_${prefix}`, rootDir);
 
         const siteWranglerPath = join(siteDir, 'wrangler.json');
         const siteConfig = {
@@ -747,14 +841,35 @@ async function promoteLocalToCloudflare() {
             sitePkg.dependencies['@astrojs/cloudflare'] = ASTRO_CF_LATEST;
             sitePkg.devDependencies = sitePkg.devDependencies || {};
             sitePkg.devDependencies['wrangler'] = WRANGLER_LATEST;
+            sitePkg.scripts = sitePkg.scripts || {};
+            sitePkg.scripts.deploy = 'astro build && wrangler deploy --secrets-file .secrets';
             writeFileSync(sitePkgPath, JSON.stringify(sitePkg, null, 2));
         }
 
+        writeWorkerSecrets(siteDir, frontendApiSecret);
+        updateEnvFile(join(siteDir, '.env'), {
+            PUBLIC_CMS_URL: `https://${cmsDomain}`,
+            PUBLIC_API_URL: `https://${cmsDomain}`
+        }, ['FRONTEND_API_SECRET']);
+        updateEnvFile(join(siteDir, '.dev.vars'), { FRONTEND_API_SECRET: frontendApiSecret });
         convertAstroConfigToCloudflare(siteDir);
     }
 
-    s.stop('Workspace successfully upgraded to Cloudflare Edge!');
-    outro('Promotion complete. 🚀\nRemember to run `npx wrangler secret put FRONTEND_API_SECRET` in both your worker and site directories before production deployment!');
+    s.message('Installing Cloudflare dependencies...');
+    execSync('npm install', { cwd: rootDir, stdio: 'inherit' });
+    s.message('Bundling workspace schemas...');
+    await bundleWorkspaceSchemas(rootDir, true);
+    s.message('Deploying CMS and initializing the remote database...');
+    execSync('npm run deploy -w kama-worker', { cwd: rootDir, stdio: 'inherit' });
+
+    if (siteDir && siteDomain) {
+        const siteFolder = basename(siteDir);
+        s.message(`Building and deploying ${siteFolder}...`);
+        execSync(`npm run deploy -w sites/${shellQuote(siteFolder)}`, { cwd: rootDir, stdio: 'inherit' });
+    }
+
+    s.stop('Workspace provisioned and deployed to Cloudflare.');
+    outro('Promotion complete.');
 }
 
 /**
@@ -792,6 +907,7 @@ async function generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, wo
             if (sitePkg.dependencies['wrangler']) delete sitePkg.dependencies['wrangler'];
             sitePkg.devDependencies = sitePkg.devDependencies || {};
             sitePkg.devDependencies['wrangler'] = WRANGLER_LATEST;
+            sitePkg.scripts.deploy = 'astro build && wrangler deploy --secrets-file .secrets';
             convertAstroConfigToCloudflare(siteDir);
         }
 
@@ -825,15 +941,23 @@ async function generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, wo
 
         if (siteDomain !== 'localhost:4321') siteConfig.routes = [{ pattern: siteDomain, custom_domain: true, enabled: true, previews_enabled: false }];
         writeFileSync(join(siteDir, 'wrangler.json'), JSON.stringify(siteConfig, null, 2));
+        writeWorkerSecrets(siteDir, frontendApiSecret);
     }
 
-    let envContent = `# Local Development Overrides\nPUBLIC_CMS_URL="http://127.0.0.1:8787"\nPUBLIC_API_URL="http://127.0.0.1:8787"\nPUBLIC_CHANNEL_ID="${channelKey}"\nPUBLIC_TREE_ID="${treeKey}"\nPUBLIC_SITE_NAME="${siteLabel.replace(/"/g, '\\"')}"\n`;
+    const localCmsUrl = isCloudflare ? cmsFullUrl : 'http://127.0.0.1:8787';
+    let envContent = `# Local Development Overrides\nPUBLIC_CMS_URL="${localCmsUrl}"\nPUBLIC_API_URL="${localCmsUrl}"\nPUBLIC_CHANNEL_ID="${channelKey}"\nPUBLIC_TREE_ID="${treeKey}"\nPUBLIC_SITE_NAME="${siteLabel.replace(/"/g, '\\"')}"\n`;
 
-    if (frontendApiSecret) {
+    if (frontendApiSecret && !isCloudflare) {
         envContent += `\n# Server-to-Server API Security\nFRONTEND_API_SECRET="${frontendApiSecret}"\n`;
     }
 
     writeFileSync(join(siteDir, '.env'), envContent);
+    if (isCloudflare && frontendApiSecret) {
+        writeFileSync(join(siteDir, '.dev.vars'), `FRONTEND_API_SECRET="${frontendApiSecret}"\n`, { mode: 0o600 });
+    }
 }
 
-main().catch(console.error);
+main().catch(error => {
+    console.error(error);
+    process.exitCode = 1;
+});