@brightsideoy/kama 1.0.0-alpha.2 → 1.0.0-alpha.21

package/bin/cli.js

@@ -2,16 +2,35 @@
 import { execSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, appendFileSync } from 'node:fs';
 import { join, dirname, basename, resolve } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import * as readline from 'node:readline/promises';
+import { fileURLToPath } from 'node:url';
+import crypto from 'node:crypto';
+
+import { intro, outro, text, password, select, confirm, spinner, note, isCancel, cancel } from '@clack/prompts';
+
+const pc = {
+    green: (t) => `\x1b[32m${t}\x1b[0m`,
+    cyan: (t) => `\x1b[36m${t}\x1b[0m`,
+    dim: (t) => `\x1b[2m${t}\x1b[0m`,
+    yellow: (t) => `\x1b[33m${t}\x1b[0m`,
+    red: (t) => `\x1b[31m${t}\x1b[0m`,
+    bgCyan: (t) => `\x1b[46m\x1b[30m ${t} \x1b[0m`,
+    bold: (t) => `\x1b[1m${t}\x1b[0m`,
+    reset: '\x1b[0m'
+};
+
+function handleCancel(value) {
+    if (isCancel(value)) {
+        cancel('Operation cancelled.');
+        process.exit(0);
+    }
+    return value;
+}
 
-// 🎯 Always use the absolute newest ecosystem
 const ASTRO_LATEST = "latest";
 const ASTRO_NODE_LATEST = "latest";
 const ASTRO_CF_LATEST = "latest";
 const WRANGLER_LATEST = "latest";
 
-// Dynamically resolve current package version
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 let currentKamaVersion = 'alpha';
@@ -25,31 +44,284 @@ try {
     console.warn("⚠️ Could not detect Kama version, defaulting to 'alpha'");
 }
 
-const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout,
-});
+function getOrGenerateWorkspaceSecret(workerDir) {
+    const envPath = join(workerDir, '.env');
+    const devVarsPath = join(workerDir, '.dev.vars');
+
+    let secret = null;
+
+    if (existsSync(envPath)) {
+        const match = readFileSync(envPath, 'utf-8').match(/^FRONTEND_API_SECRET=["']?([^"'\n]+)/m);
+        if (match) secret = match[1];
+    }
+
+    if (!secret && existsSync(devVarsPath)) {
+        const match = readFileSync(devVarsPath, 'utf-8').match(/^FRONTEND_API_SECRET=["']?([^"'\n]+)/m);
+        if (match) secret = match[1];
+    }
+
+    if (!secret) {
+        secret = crypto.randomBytes(32).toString('hex');
+        const secretLine = `\n# KAMA Auto-Generated Server-to-Server Security\nFRONTEND_API_SECRET="${secret}"\n`;
+
+        if (existsSync(devVarsPath)) {
+            appendFileSync(devVarsPath, secretLine);
+        } else if (existsSync(envPath)) {
+            appendFileSync(envPath, secretLine);
+        } else {
+            writeFileSync(devVarsPath, secretLine);
+        }
+    }
+
+    return secret;
+}
+
+function getWranglerCmd() {
+    try {
+        execSync('wrangler --version', { stdio: 'ignore' });
+        return 'wrangler';
+    } catch (e) {
+        return 'npx --yes --package=wrangler wrangler';
+    }
+}
+
+function runWrangler(cmd, options = {}) {
+    const baseWrangler = getWranglerCmd();
+    try {
+        const result = execSync(`${baseWrangler} ${cmd}`, {
+            encoding: 'utf-8',
+            stdio: options.stdio || 'pipe',
+            input: options.input,
+            cwd: options.cwd || process.cwd(),
+            env: {
+                ...process.env,
+                PATH: process.env.PATH
+            }
+        });
+        return typeof result === 'string' ? result : '';
+    } catch (e) {
+        if (options.throw) throw new Error(`Wrangler command failed: ${cmd}\n${e.stderr || e.message}`);
+        return null;
+    }
+}
+
+function shellQuote(value) {
+    return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+
+function getOrCreateKV(title, cwd = process.cwd()) {
+    const listOut = runWrangler('kv namespace list', { cwd });
+    if (listOut) {
+        try {
+            const namespaces = JSON.parse(listOut);
+            const found = namespaces.find(n => n.title === title);
+            if (found) return found.id;
+        } catch (err) { }
+    }
+
+    const createOut = runWrangler(`kv namespace create ${shellQuote(title)}`, { cwd, throw: true });
+    const match = createOut.match(/"id":\s*"([a-fA-F0-9]{32})"/);
+    if (match) return match[1];
+
+    throw new Error(`Unable to create or find Cloudflare KV namespace "${title}". Check Wrangler authentication and permissions.`);
+}
+
+function getOrCreateD1(name, cwd = process.cwd()) {
+    const listOutput = runWrangler('d1 list --json', { cwd, throw: true });
+    let databases;
+    try {
+        databases = JSON.parse(listOutput);
+    } catch (error) {
+        throw new Error('Wrangler returned invalid JSON while listing D1 databases.');
+    }
+
+    const existing = databases.find(database => database.name === name);
+    if (existing?.uuid) return existing.uuid;
+
+    const createOutput = runWrangler(`d1 create ${shellQuote(name)}`, { cwd, throw: true });
+    const created = createOutput.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/);
+    if (created) return created[0];
+
+    throw new Error(`Cloudflare D1 database "${name}" was not created or returned a valid ID.`);
+}
+
+function ensureR2Bucket(name, cwd = process.cwd()) {
+    if (runWrangler(`r2 bucket info ${shellQuote(name)} --json`, { cwd })) return;
+
+    const createOutput = runWrangler(`r2 bucket create ${shellQuote(name)}`, { cwd });
+    if (createOutput || runWrangler(`r2 bucket info ${shellQuote(name)} --json`, { cwd })) return;
+
+    throw new Error(`Unable to create or find Cloudflare R2 bucket "${name}". Check Wrangler authentication and permissions.`);
+}
+
+function ensureCloudflareAuth(cwd) {
+    if (runWrangler('whoami', { cwd })) return;
+
+    console.log(pc.dim('Launching browser for Cloudflare login...'));
+    runWrangler('login', { cwd, stdio: 'inherit', throw: true });
+    if (!runWrangler('whoami', { cwd })) {
+        throw new Error('Cloudflare authentication could not be verified after login.');
+    }
+}
+
+function writeWorkerSecrets(workerDir, secret, cloudflareApiToken = '') {
+    const values = [`FRONTEND_API_SECRET=${secret}`];
+    if (cloudflareApiToken) values.push(`CLOUDFLARE_API_TOKEN=${cloudflareApiToken}`);
+    writeFileSync(join(workerDir, '.secrets'), `${values.join('\n')}\n`, { mode: 0o600 });
+}
+
+function readEnvValue(filePath, key) {
+    if (!existsSync(filePath)) return '';
+    const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const match = readFileSync(filePath, 'utf8').match(new RegExp(`^${escapedKey}=["']?([^"'\\r\\n]*)`, 'm'));
+    return match?.[1]?.trim() || '';
+}
+
+async function resolveCloudflareZoneId(domain, token) {
+    if (!token) return '';
+
+    const labels = domain.split('.');
+    for (let index = 0; index < labels.length - 1; index++) {
+        const zoneName = labels.slice(index).join('.');
+        const response = await fetch(`https://api.cloudflare.com/client/v4/zones?name=${encodeURIComponent(zoneName)}&per_page=50`, {
+            headers: { Authorization: `Bearer ${token}` }
+        });
+        const data = await response.json();
+        if (!response.ok || !data.success) {
+            throw new Error(`Could not look up Cloudflare zone for ${domain}. Check the token's Zone Read permission.`);
+        }
+        const zone = data.result?.find(item => item.name === zoneName && item.status === 'active');
+        if (zone?.id) return zone.id;
+    }
+
+    throw new Error(`No active Cloudflare zone was found for ${domain}. Add the domain to Cloudflare or enter its Zone ID manually.`);
+}
+
+async function promptForCloudflareApiToken(existingToken = '') {
+    const token = handleCancel(await password({
+        message: `Optional Cloudflare API token (Zone Read + Zone Cache Purge${existingToken ? '; leave blank to keep existing token' : ''}):`,
+        mask: '*'
+    }));
+    return token.trim() || existingToken;
+}
+
+function normalizeCloudflareDomain(value, label) {
+    const input = String(value || '').trim();
+    if (!input) throw new Error(`${label} is required for Cloudflare deployment.`);
+
+    try {
+        const url = new URL(input.includes('://') ? input : `https://${input}`);
+        if (!url.hostname.includes('.') || url.hostname === 'localhost') throw new Error();
+        return url.host.toLowerCase();
+    } catch {
+        throw new Error(`${label} must be a valid Cloudflare domain, for example example.com.`);
+    }
+}
+
+function ensureGitIgnoreEntries(rootDir, entries) {
+    const gitignorePath = join(rootDir, '.gitignore');
+    const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, 'utf8') : '';
+    const lines = new Set(existing.split(/\r?\n/));
+    const missing = entries.filter(line => !lines.has(line));
+    if (missing.length > 0) appendFileSync(gitignorePath, `${existing && !existing.endsWith('\n') ? '\n' : ''}${missing.join('\n')}\n`);
+}
+
+function ignoreSecretFiles(rootDir) {
+    ensureGitIgnoreEntries(rootDir, ['kama-worker/.secrets', 'kama-worker/.dev.vars', 'sites/*/.secrets', 'sites/*/.dev.vars']);
+}
+
+function updateEnvFile(filePath, values, removeKeys = []) {
+    const existing = existsSync(filePath) ? readFileSync(filePath, 'utf8') : '';
+    const keys = new Set(Object.keys(values));
+    const found = new Set();
+    const lines = existing.split(/\r?\n/).filter(line => {
+        const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/);
+        return !match || !removeKeys.includes(match[1]);
+    }).map(line => {
+        const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/);
+        if (!match || !keys.has(match[1])) return line;
+        found.add(match[1]);
+        return `${match[1]}=${JSON.stringify(values[match[1]])}`;
+    });
+
+    for (const key of keys) {
+        if (!found.has(key)) lines.push(`${key}=${JSON.stringify(values[key])}`);
+    }
+
+    writeFileSync(filePath, `${lines.filter((line, index) => line || index < lines.length - 1).join('\n')}\n`);
+}
+
+function generateExtensionRegistry(rootDir) {
+    const workerDir = join(rootDir, 'kama-worker');
+    const extDir = join(rootDir, 'extensions');
+    const registryPath = join(workerDir, 'extension-registry.js');
+
+    let imports = '';
+    let arrayElements = [];
+
+    if (existsSync(extDir)) {
+        const folders = readdirSync(extDir, { withFileTypes: true })
+            .filter(dirent => dirent.isDirectory())
+            .map(dirent => dirent.name);
+
+        folders.forEach((folder, i) => {
+            const tsPath = join(extDir, folder, 'index.ts');
+            const jsPath = join(extDir, folder, 'index.js');
+            let extFile = '';
+
+            if (existsSync(tsPath)) extFile = 'index.ts';
+            else if (existsSync(jsPath)) extFile = 'index.js';
+
+            if (extFile) {
+                imports += `import ext_${i} from '../extensions/${folder}/${extFile}';\n`;
+                arrayElements.push(`ext_${i}`);
+            }
+
+            // Auto-inject extension schemas into the workspace definitions
+            const defDir = join(extDir, folder, 'definitions');
+            if (existsSync(defDir)) {
+                cpSync(defDir, join(rootDir, 'content', 'definitions'), { recursive: true });
+            }
+
+            // 🎯 Enterprise Static Asset Sync for Extensions
+            // Syncs extension UI dist/ui static assets into the ASSETS directory served by Cloudflare Wrangler
+            const extUiDir = join(extDir, folder, 'ui');
+            const extDistDir = join(extDir, folder, 'dist');
+            const targetAssetDir = join(rootDir, 'node_modules', '@brightsideoy', 'kama', 'dist', 'ext', folder);
+
+            if (existsSync(extDistDir)) {
+                mkdirSync(targetAssetDir, { recursive: true });
+                cpSync(extDistDir, targetAssetDir, { recursive: true });
+            } else if (existsSync(extUiDir)) {
+                mkdirSync(targetAssetDir, { recursive: true });
+                cpSync(extUiDir, targetAssetDir, { recursive: true });
+            }
+        });
+    }
+
+    const fileContent = `// 🤖 AUTO-GENERATED - DO NOT EDIT\n${imports}\nexport const activeExtensions = [\n${arrayElements.join(',\n  ')}\n];\n`;
+
+    if (existsSync(workerDir)) {
+        writeFileSync(registryPath, fileContent, 'utf-8');
+    }
+}
 
 function showHelp() {
-    console.log('\n🔥 --- KAMA ENGINE CLI --- 🔥\n');
+    console.log(`\n${pc.bgCyan(' KAMA • ENGINE CLI ')}\n`);
     console.log('Usage: npx kama <command> [options]\n');
-    console.log('Commands:');
+    console.log(pc.cyan('Commands:'));
     console.log('  init         Kickstart a new Monorepo (CMS Worker + Optional Astro Site)');
     console.log('  add site     Add a new Astro Frontend Site to the current workspace (sites/)');
     console.log('  bundle       Compile and bundle YAML schemas into bundled-definitions.js for Edge deployment');
     console.log('  promote      Promote the current Local workspace to Cloudflare Edge');
     console.log('  help, -h     Show this help message\n');
-
-    console.log('Workspace Scripts (Run from project root):');
-    console.log('  npm update           Update to latest KAMA version');
-    console.log('  npm run dev          Boot up the CMS backend and Astro frontend concurrently');
-    console.log('  npm run deploy:cms   Deploy the backend worker and database to Cloudflare');
-    console.log('  npm run deploy:site  Deploy the Astro frontend site to Cloudflare\n');
-
-    console.log('Examples:');
-    console.log('  npx kama init');
-    console.log('  npx kama add site');
-    console.log('  npx kama bundle\n');
+    console.log(pc.cyan('Workspace Scripts (Run from project root):'));
+    console.log('  npm update                   Update to latest KAMA version');
+    console.log('  npm run setup                Initialize database schema (Run Once)');
+    console.log('  npm run seed -w kama-worker  Seed the database with mock test data');
+    console.log('  npm run dev                  Boot up the CMS backend and Astro frontend concurrently');
+    console.log('  npm run deploy:kama           Deploy the backend worker and database to Cloudflare');
+    console.log('  npm run deploy:site          Deploy the Astro frontend site to Cloudflare\n');
 }
 
 async function main() {
@@ -57,13 +329,13 @@ async function main() {
     const command = args[0]?.toLowerCase();
     const subCommand = args[1]?.toLowerCase();
 
-    if (command === 'help' || command === '--help' || command === '-h') {
+    if (['help', '--help', '-h'].includes(command)) {
         showHelp();
-        rl.close();
         process.exit(0);
     }
 
-    console.log('\n🔥 --- KAMA ENGINE CLI --- 🔥\n');
+    console.clear();
+    intro(`${pc.bgCyan(' KAMA • ENGINE ')} ${pc.dim('v' + currentKamaVersion.replace('^', ''))}`);
 
     if (command === 'init') {
         await createFullWorkspace();
@@ -74,34 +346,36 @@ async function main() {
     } else if (command === 'bundle') {
         await bundleWorkspaceSchemas();
     } else {
-        console.log('Available Commands:');
-        console.log('  1) npx kama init         - Kickstart new Monorepo (CMS + Optional Site)');
-        console.log('  2) npx kama add site     - Add new Astro Site to current workspace (sites/)');
-        console.log('  3) npx kama bundle       - Compile and bundle YAML schemas for Edge deployment');
-        console.log('  4) npx kama promote      - Promote current Local workspace to Cloudflare Edge');
-        console.log('  5) Help                  - Show all commands and usage');
-
-        const choice = (await rl.question('\nSelect choice [1/2/3/4/5]: ')).trim();
-
-        if (choice === '5') {
+        const choice = handleCancel(await select({
+            message: 'What would you like to do?',
+            options: [
+                { value: 'init', label: 'Init', hint: 'Kickstart new Workspace (CMS + Optional Site)' },
+                { value: 'add_site', label: 'Add Site', hint: 'Add Astro Site to current workspace (sites/)' },
+                { value: 'bundle', label: 'Bundle', hint: 'Compile YAML schemas for Edge deployment' },
+                { value: 'promote', label: 'Promote', hint: 'Promote current Local workspace to Cloudflare Edge' },
+                { value: 'help', label: 'Help', hint: 'Show all commands and usage' },
+                { value: 'exit', label: 'Exit' }
+            ]
+        }));
+
+        if (choice === 'help') {
             showHelp();
-        } else if (choice === '4') {
+            process.exit(0);
+        } else if (choice === 'promote') {
             await promoteLocalToCloudflare();
-        } else if (choice === '3') {
+        } else if (choice === 'bundle') {
             await bundleWorkspaceSchemas();
-        } else if (choice === '2') {
+        } else if (choice === 'add_site') {
             await createNewSiteOnly();
-        } else {
+        } else if (choice === 'init') {
             await createFullWorkspace();
+        } else {
+            outro('Goodbye!');
+            process.exit(0);
         }
     }
-
-    rl.close();
 }
 
-/**
- * Helper to update astro.config.mjs for Cloudflare
- */
 function convertAstroConfigToCloudflare(siteDir) {
     const configPath = join(siteDir, 'astro.config.mjs');
     if (existsSync(configPath)) {
@@ -113,195 +387,145 @@ function convertAstroConfigToCloudflare(siteDir) {
     }
 }
 
-/**
- * COMMAND: npx kama init
- * Kickstart full Monorepo Workspace
- */
 async function createFullWorkspace() {
     const cwdName = basename(process.cwd());
     const hasExistingPkg = existsSync(join(process.cwd(), 'package.json'));
-
     const defaultDirPrompt = hasExistingPkg ? '.' : cwdName;
-    const inputName = await rl.question(`Project folder name (use '.' for current dir) [${defaultDirPrompt}]: `);
+
+    const inputName = handleCancel(await text({
+        message: 'Project folder name (use "." for current dir):',
+        placeholder: defaultDirPrompt,
+        defaultValue: defaultDirPrompt
+    }));
 
     const chosenFolder = inputName.trim() || defaultDirPrompt;
     const isCurrentDir = chosenFolder === '.';
-
     const projName = isCurrentDir ? cwdName : chosenFolder;
     const rootDir = isCurrentDir ? process.cwd() : join(process.cwd(), projName);
 
-    console.log('\n🌍 Choose your Deployment Architecture:');
-    console.log('  1) VPS / Local Server (Node.js, SQLite, Sharp cropping)');
-    console.log('  2) Cloudflare Edge (Workers, D1, R2, CF Image Resizing)');
-    const envChoice = await rl.question('\nChoice [1/2]: ');
-    const isCloudflare = envChoice.trim() === '2';
+    const isCloudflare = handleCancel(await select({
+        message: 'Choose your Deployment Architecture:',
+        options: [
+            { value: true, label: 'Cloudflare Edge', hint: 'Workers, D1, R2, CF Image Resizing' },
+            { value: false, label: 'VPS / Local Server', hint: 'Node.js, SQLite, Sharp cropping' }
+        ]
+    }));
 
-    const createSiteInput = await rl.question('\n🚀 Do you want to scaffold an initial Astro frontend site? (y/n) [y]: ');
-    const shouldCreateSite = createSiteInput.trim().toLowerCase() !== 'n';
+    const shouldCreateSite = handleCancel(await confirm({
+        message: 'Do you want to scaffold an initial Astro frontend site?',
+        initialValue: true
+    }));
 
     let siteFolderName = 'kama-starter';
     let siteDomain = 'localhost:4321';
     let cmsDomain = 'localhost:8787';
 
     if (shouldCreateSite) {
-        siteFolderName = (await rl.question('Astro package/folder name (e.g., my-website) [kama-starter]: ')).trim() || 'kama-starter';
+        siteFolderName = handleCancel(await text({
+            message: 'Astro package/folder name (e.g., my-website.eu):',
+            placeholder: 'kama-starter',
+            defaultValue: 'kama-starter'
+        }));
     }
 
     if (isCloudflare) {
-        cmsDomain = (await rl.question('\nCMS Admin Domain (e.g., admin.yourdomain.com): ')).trim();
+        cmsDomain = handleCancel(await text({
+            message: 'CMS Admin Domain (e.g., admin.yourdomain.com):',
+            defaultValue: ''
+        }));
         if (shouldCreateSite) {
-            siteDomain = (await rl.question('First Website Domain (e.g., yourdomain.com): ')).trim();
+            siteDomain = handleCancel(await text({
+                message: 'First Website Domain (e.g., yourdomain.com):',
+                defaultValue: ''
+            }));
         }
+
+        cmsDomain = normalizeCloudflareDomain(cmsDomain, 'CMS Admin Domain');
+        if (shouldCreateSite) siteDomain = normalizeCloudflareDomain(siteDomain, 'Frontend Website Domain');
     }
 
+    const cloudflareApiToken = isCloudflare ? await promptForCloudflareApiToken() : '';
+    const cloudflareZoneId = isCloudflare ? await resolveCloudflareZoneId(cmsDomain, cloudflareApiToken) : '';
+
     const cmsProtocol = isCloudflare ? 'https://' : 'http://';
     const cmsFullUrl = cmsDomain ? `${cmsProtocol}${cmsDomain.replace(/^https?:\/\//, '')}` : 'http://localhost:8787';
 
+    const frontendApiSecret = crypto.randomBytes(32).toString('hex');
+
     const workerName = `${projName}-worker`.toLowerCase().replace(/[^a-z0-9_-]/g, '-');
     let dbName = `${projName}-db`.replace(/[^a-zA-Z0-9_-]/g, '_');
     const bucketName = `${projName}-media-prod`.toLowerCase().replace(/[^a-z0-9_-]/g, '-');
 
-    if (!isCurrentDir) {
-        console.log(`\n📁 Creating workspace folder at ./${projName}...`);
-        mkdirSync(rootDir, { recursive: true });
-    } else {
-        console.log(`\n📁 Initializing workspace in current directory (${rootDir})...`);
-    }
+    const s = spinner();
+    s.start('Provisioning workspace...');
 
-    writeFileSync(
-        join(rootDir, '.gitignore'),
-        `node_modules/\n.env\n.DS_Store\nkama-worker/.dev.vars\nkama-worker/.env\nkama-worker/.wrangler/\nkama-worker/public/\nkama-worker/*.db\nsites/*/.env\nsites/*/.astro/\nsites/*/dist/\nkama-worker/bundled-definitions.js\n`
-    );
+    if (!isCurrentDir) mkdirSync(rootDir, { recursive: true });
+
+    ensureGitIgnoreEntries(rootDir, [
+        'node_modules/', '.env', '.DS_Store', 'kama-worker/.dev.vars', 'kama-worker/.secrets',
+        'kama-worker/.env', 'kama-worker/.wrangler/', 'kama-worker/public/', 'kama-worker/*.db',
+        'sites/*/.env', 'sites/*/.secrets', 'sites/*/.astro/', 'sites/*/dist/',
+        'kama-worker/bundled-definitions.js', 'kama-worker/extension-registry.js'
+    ]);
 
-    console.log(`\n📄 Copying default content definitions...`);
     const sourceDefsDir = join(__dirname, '../content/definitions');
     const targetDefsDir = join(rootDir, 'content', 'definitions');
-    if (existsSync(sourceDefsDir)) {
-        cpSync(sourceDefsDir, targetDefsDir, { recursive: true });
-    } else {
-        console.warn(`⚠️ Could not find default content definitions at ${sourceDefsDir}`);
-    }
+    if (existsSync(sourceDefsDir)) cpSync(sourceDefsDir, targetDefsDir, { recursive: true });
 
     let d1DatabaseId = '00000000-0000-0000-0000-000000000000';
-    let isAuthenticated = false;
-
+    let backendCacheId = '';
     if (isCloudflare) {
-        console.log(`\n🔑 Checking Cloudflare authentication...`);
-        try {
-            // Pass stdio: 'ignore' so child process doesn't drain parent stdin stream!
-            execSync('npx wrangler whoami', { stdio: 'ignore' });
-            isAuthenticated = true;
-            console.log(`✅ Logged in to Cloudflare.`);
-        } catch (error) {
-            console.log(`⚠️ You are not logged in to Cloudflare.`);
-            console.log(`🌐 Launching browser for Cloudflare login...`);
-            try {
-                execSync('npx wrangler login', { stdio: 'ignore' });
-                isAuthenticated = true;
-                console.log(`✅ Successfully logged in!`);
-            } catch (loginError) {
-                console.log(`❌ Login failed or was cancelled.`);
-            }
-        }
-
-        if (isAuthenticated) {
-            try {
-                console.log(`\n🗄️ Checking existing Cloudflare D1 databases...`);
-                const listOutput = execSync(`npx wrangler d1 list --json`, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-                const jsonStart = listOutput.indexOf('[');
-                const jsonEnd = listOutput.lastIndexOf(']') + 1;
-                let databases = [];
-
-                if (jsonStart !== -1 && jsonEnd !== -1) {
-                    databases = JSON.parse(listOutput.substring(jsonStart, jsonEnd));
-                }
-
-                const existingDb = databases.find(db => db.name === dbName);
-
-                if (existingDb) {
-                    console.log(`⚠️ Database '${dbName}' already exists on your account.`);
-                    const useExisting = await rl.question(`Do you want to link this existing database? (y/n) [y]: `);
-
-                    if (useExisting.toLowerCase() !== 'n') {
-                        d1DatabaseId = existingDb.uuid;
-                        console.log(`✅ Linked existing database ID: ${d1DatabaseId}`);
-                    } else {
-                        dbName = (await rl.question(`Enter a new database name: `)).trim();
-                        console.log(`\n🗄️ Creating new database '${dbName}'...`);
-                        const d1Output = execSync(`npx wrangler d1 create ${dbName}`, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-                        const match = d1Output.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/);
-                        if (match) {
-                            d1DatabaseId = match[0];
-                            console.log(`✅ Success! Database ID bound: ${d1DatabaseId}`);
-                        }
-                    }
-                } else {
-                    console.log(`\n🗄️ Attempting to auto-create Cloudflare D1 Database '${dbName}'...`);
-                    const d1Output = execSync(`npx wrangler d1 create ${dbName}`, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-                    const match = d1Output.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/);
-                    if (match) {
-                        d1DatabaseId = match[0];
-                        console.log(`✅ Success! Database ID bound: ${d1DatabaseId}`);
-                    }
-                }
-            } catch (error) {
-                console.log(`⚠️ Database operation failed. We'll leave a placeholder.`);
-            }
-        } else {
-            console.log(`⚠️ Skipping database creation. We'll leave a placeholder in wrangler.json.`);
-        }
-    } else {
-        console.log(`\n💻 Local VPS mode selected. Skipping Cloudflare authentication and domain setup...`);
+        s.message('Authenticating with Cloudflare...');
+        ensureCloudflareAuth(process.cwd());
+        s.message('Provisioning D1, KV, and R2 resources...');
+        backendCacheId = getOrCreateKV(`CACHE_KV_${workerName.toUpperCase().replace(/-/g, '_')}`, rootDir);
+        d1DatabaseId = getOrCreateD1(dbName, rootDir);
+        ensureR2Bucket(bucketName, rootDir);
     }
 
-    const rootScripts = {
-        'dev:cms': 'npm run dev -w kama-worker',
-        'deploy:cms': 'npm run deploy -w kama-worker',
-    };
+    s.message('Writing configuration files...');
 
+    const rootPkgPath = join(rootDir, 'package.json');
+    const existingRootPkg = existsSync(rootPkgPath) ? JSON.parse(readFileSync(rootPkgPath, 'utf-8')) : {};
+    const existingWorkspaces = Array.isArray(existingRootPkg.workspaces) ? existingRootPkg.workspaces : [];
     const rootPkg = {
-        name: projName,
+        ...existingRootPkg,
+        name: existingRootPkg.name || projName,
         private: true,
-        type: 'module',
-        workspaces: ['kama-worker', 'sites/*'],
-        scripts: rootScripts,
-        dependencies: {
-            '@brightsideoy/kama': currentKamaVersion,
-        },
-        devDependencies: {}
+        type: existingRootPkg.type || 'module',
+        workspaces: [...new Set([...existingWorkspaces, 'kama-worker', 'sites/*'])],
+        scripts: { ...existingRootPkg.scripts, 'setup': 'npx kama bundle && npm run setup:local -w kama-worker' },
+        dependencies: { ...existingRootPkg.dependencies, '@brightsideoy/kama': currentKamaVersion },
+        devDependencies: { ...existingRootPkg.devDependencies }
     };
 
-    if (isCloudflare) {
-        rootPkg.devDependencies['wrangler'] = WRANGLER_LATEST;
-    }
+    if (isCloudflare) rootPkg.devDependencies['wrangler'] = WRANGLER_LATEST;
 
     if (shouldCreateSite) {
         rootPkg.devDependencies['concurrently'] = '^9.0.0';
         rootPkg.scripts['dev:site'] = `npm run dev -w sites/${siteFolderName}`;
         rootPkg.scripts['predev'] = 'npx kama bundle';
-        rootPkg.scripts['dev'] = 'npx concurrently "npm run dev:cms" "npm run dev:site"';
+        rootPkg.scripts['dev'] = 'npx concurrently "npm run dev -w kama-worker" "npm run dev -w sites/' + siteFolderName + '"';
         rootPkg.scripts['deploy:site'] = `npm run deploy -w sites/${siteFolderName}`;
+        rootPkg.scripts['deploy:kama'] = `npm run deploy -w kama-worker`;
     } else {
         rootPkg.scripts['predev'] = 'npx kama bundle';
-        rootPkg.scripts['dev'] = 'npm run dev:cms';
+        rootPkg.scripts['dev'] = 'npm run dev -w kama-worker';
+        rootPkg.scripts['deploy:kama'] = `npm run deploy -w kama-worker`;
     }
 
-    writeFileSync(join(rootDir, 'package.json'), JSON.stringify(rootPkg, null, 2));
+    writeFileSync(rootPkgPath, JSON.stringify(rootPkg, null, 2));
 
-    console.log(`\n☁️ Configuring CMS Worker '${workerName}' (${cmsDomain || 'localhost:8787'})...`);
     const cmsDir = join(rootDir, 'kama-worker');
     mkdirSync(cmsDir, { recursive: true });
 
-    writeFileSync(join(cmsDir, 'seed.sql'), '-- Kama Auto-Generated Seed File\nSELECT 1;\n');
-
     const emptyDefs = `{ nodes: {}, trees: {}, blocks: {}, nodeLayouts: {}, blockLayouts: {}, channels: {} }`;
     writeFileSync(join(cmsDir, 'bundled-definitions.js'), `const defs = ${emptyDefs};\nexport const BUNDLED_DEFINITIONS = defs;\nexport default defs;\n`);
+    writeFileSync(join(cmsDir, 'extension-registry.js'), `export const activeExtensions = [];\n`);
 
     if (isCloudflare) {
         const templateIndexPath = join(__dirname, '../templates/kama-worker/index.js');
-        if (existsSync(templateIndexPath)) {
-            cpSync(templateIndexPath, join(cmsDir, 'index.js'));
-        }
+        if (existsSync(templateIndexPath)) cpSync(templateIndexPath, join(cmsDir, 'index.js'));
 
         writeFileSync(
             join(cmsDir, 'package.json'),
@@ -310,20 +534,16 @@ async function createFullWorkspace() {
                 type: 'module',
                 version: '1.0.0',
                 scripts: {
-                    "schema:local": `wrangler d1 execute ${dbName} --local --file=../node_modules/@brightsideoy/kama/schema.sql > /dev/null 2>&1`,
-                    "schema:remote": `wrangler d1 execute ${dbName} --remote --file=../node_modules/@brightsideoy/kama/schema.sql`,
-                    "seed:local": `wrangler d1 execute ${dbName} --local --file=seed.sql > /dev/null 2>&1`,
-                    "seed:remote": `wrangler d1 execute ${dbName} --remote --file=seed.sql`,
-                    "dev": "npm run schema:local && npm run seed:local && wrangler dev --port 8787 --inspector-port 9239",
-                    "deploy": "npm run schema:remote && npm run seed:remote && wrangler deploy"
-                },
-                dependencies: {
-                    '@brightsideoy/kama': currentKamaVersion,
-                    '@libsql/client': '^0.14.0'
-                },
-                devDependencies: {
-                    "wrangler": WRANGLER_LATEST
+                    "seed": "npm run seed:local",
+                    "seed:local": "node ../node_modules/@brightsideoy/kama/dist/build-seed.js && for f in seed-*.sql; do wrangler d1 execute " + dbName + " --local --file=\"$f\"; done",
+                    "seed:remote": "node ../node_modules/@brightsideoy/kama/dist/build-seed.js && for f in seed-*.sql; do wrangler d1 execute " + dbName + " --remote --file=\"$f\"; done",
+                    "setup:local": `wrangler d1 execute ${dbName} --local --file=../node_modules/@brightsideoy/kama/schema.sql`,
+                    "setup:remote": `wrangler d1 execute ${dbName} --remote --file=../node_modules/@brightsideoy/kama/schema.sql`,
+                    "dev": "wrangler dev --port 8787 --inspector-port 9239",
+                    "deploy": "npm run setup:remote && wrangler deploy --secrets-file .secrets"
                 },
+                dependencies: { '@brightsideoy/kama': currentKamaVersion, 'hono': '^4.13.0', '@libsql/client': '^0.14.0' },
+                devDependencies: { "wrangler": WRANGLER_LATEST },
             }, null, 2)
         );
 
@@ -334,13 +554,13 @@ async function createFullWorkspace() {
             compatibility_date: '2024-09-23',
             compatibility_flags: ['nodejs_compat'],
             dev: { host: 'localhost', port: 8787 },
-            cache: { enabled: true },
             assets: { directory: '../node_modules/@brightsideoy/kama/dist', binding: 'ASSETS' },
             images: { binding: 'IMAGES' },
+            kv_namespaces: [{ binding: 'CACHE_KV', id: backendCacheId }],
             vars: {
                 CDN_DOMAIN: cmsDomain || 'localhost:8787',
                 PUBLIC_FRONTEND_URL: (shouldCreateSite) ? (siteDomain && siteDomain !== 'localhost:4321' ? `https://${siteDomain}` : 'http://localhost:4321') : 'http://localhost:4321',
-                CLOUDFLARE_ZONE_ID: "REPLACE_WITH_YOUR_32_CHAR_ZONE_ID",
+                CLOUDFLARE_ZONE_ID: cloudflareZoneId,
                 KAMA_RUNTIME: 'cloudflare'
             },
             d1_databases: [{ binding: 'DB', database_name: dbName, database_id: d1DatabaseId }],
@@ -350,18 +570,14 @@ async function createFullWorkspace() {
 
         writeFileSync(join(cmsDir, 'wrangler.json'), JSON.stringify(cmsWranglerConfig, null, 2));
 
-        writeFileSync(join(cmsDir, '.dev.vars'), `# Cloudflare Edge Cache Purging Secrets
-CLOUDFLARE_API_TOKEN=cfut_YOUR_CUSTOM_PURGE_TOKEN
-
-# Local Development Overrides
-CDN_DOMAIN=
-PUBLIC_FRONTEND_URL=http://localhost:4321
-`);
+        const publicFrontendUrl = (shouldCreateSite) ? (siteDomain && siteDomain !== 'localhost:4321' ? `https://${siteDomain}` : 'http://localhost:4321') : 'http://localhost:4321';
+        const devVars = [`# Local Development Overrides`, `CDN_DOMAIN=`, `PUBLIC_FRONTEND_URL=${publicFrontendUrl}`, ``, `# Server-to-Server API Security`, `FRONTEND_API_SECRET="${frontendApiSecret}"`];
+        if (cloudflareApiToken) devVars.push(`CLOUDFLARE_API_TOKEN="${cloudflareApiToken}"`);
+        writeFileSync(join(cmsDir, '.dev.vars'), `${devVars.join('\n')}\n`, { mode: 0o600 });
+        writeWorkerSecrets(cmsDir, frontendApiSecret, cloudflareApiToken);
     } else {
         const templateServerPath = join(__dirname, '../templates/kama-worker/server.js');
-        if (existsSync(templateServerPath)) {
-            cpSync(templateServerPath, join(cmsDir, 'server.js'));
-        }
+        if (existsSync(templateServerPath)) cpSync(templateServerPath, join(cmsDir, 'server.js'));
 
         writeFileSync(
             join(cmsDir, 'package.json'),
@@ -370,67 +586,65 @@ PUBLIC_FRONTEND_URL=http://localhost:4321
                 type: 'module',
                 version: '1.0.0',
                 scripts: {
-                    "schema:local": "sqlite3 kama.db < ../node_modules/@brightsideoy/kama/schema.sql",
-                    "seed:local": "sqlite3 kama.db < seed.sql",
-                    "dev": "npm run schema:local && npm run seed:local && tsx server.js",
+                    "seed": "npm run seed:local",
+                    "seed:local": "node ../node_modules/@brightsideoy/kama/dist/build-seed.js && node setup-local-db.mjs seed",
+                    "setup:local": "node setup-local-db.mjs schema",
+                    "dev": "tsx server.js",
                     "start": "node server.js"
                 },
-                dependencies: {
-                    '@brightsideoy/kama': currentKamaVersion,
-                    '@hono/node-server': '^1.13.0',
-                    '@libsql/client': '^0.14.0',
-                    'sharp': '^0.33.5',
-                    'dotenv': '^16.4.5'
-                },
-                devDependencies: {
-                    "tsx": "^4.19.0"
-                },
+                dependencies: { '@brightsideoy/kama': currentKamaVersion, 'hono': '^4.13.0', '@hono/node-server': '^1.13.0', '@libsql/client': '^0.14.0', 'sharp': '^0.33.5', 'dotenv': '^16.4.5' },
+                devDependencies: { "tsx": "^4.19.0" },
             }, null, 2)
         );
 
-        writeFileSync(join(cmsDir, '.env'), `PORT=8787\nKAMA_RUNTIME=node\nDB_PATH=./kama.db\nLOCAL_MEDIA_PATH=./public/media\nPUBLIC_CMS_URL=http://127.0.0.1:8787\nPUBLIC_API_URL=http://127.0.0.1:8787\nPUBLIC_FRONTEND_URL=http://127.0.0.1:4321\n`);
+        writeFileSync(join(cmsDir, '.env'), `PORT=8787\nKAMA_RUNTIME=node\nDB_PATH=./kama.db\nLOCAL_MEDIA_PATH=./public/media\nPUBLIC_CMS_URL=http://127.0.0.1:8787\nPUBLIC_API_URL=http://127.0.0.1:8787\nPUBLIC_FRONTEND_URL=http://127.0.0.1:4321\n\n# Server-to-Server API Security\nFRONTEND_API_SECRET="${frontendApiSecret}"\n`);
+        cpSync(join(__dirname, '../templates/kama-worker/setup-local-db.mjs'), join(cmsDir, 'setup-local-db.mjs'));
     }
 
-    await bundleWorkspaceSchemas(rootDir);
+    s.message('Bundling schemas...');
+    await bundleWorkspaceSchemas(rootDir, true);
 
     if (shouldCreateSite) {
-        await generateAstroSite(rootDir, siteFolderName, siteDomain, cmsFullUrl, workerName, isCloudflare);
-    } else {
-        console.log(`\nℹ️ Skipping Astro site creation. You can add a site later by running 'npx kama add site' inside this workspace.`);
+        s.message(`Scaffolding Astro site (${siteFolderName})...`);
+        await generateAstroSite(rootDir, siteFolderName, siteDomain, cmsFullUrl, workerName, isCloudflare, frontendApiSecret);
     }
 
-    console.log(`\n✨ Workspace ready! Next steps:`);
-    if (!isCurrentDir) console.log(`  1. cd ${projName}`);
-    console.log(`  2. npm install`);
+    s.message('Installing workspace dependencies...');
+    execSync('npm install', { cwd: rootDir, stdio: 'inherit' });
+    s.message('Bundling schemas and initializing the local database...');
+    execSync('npm run setup', { cwd: rootDir, stdio: 'inherit' });
+
+    s.stop('Workspace installed and initialized successfully.');
+
+    let nextSteps = '';
+    let stepCount = 1;
+    if (!isCurrentDir) nextSteps += `${stepCount++}. cd ${projName}\n`;
+    nextSteps += `${stepCount++}. npm run dev\n`;
 
     if (isCloudflare) {
-        if (d1DatabaseId === '00000000-0000-0000-0000-000000000000') {
-            console.log(`  3. Run 'npx wrangler login' and create a D1 database manually.`);
-        }
-        console.log(`  4. Update CLOUDFLARE_ZONE_ID in kama-worker/wrangler.json`);
-        console.log(`  5. Securely store your purge token: cd kama-worker && npx wrangler secret put CLOUDFLARE_API_TOKEN`);
-        console.log(`  6. Run 'npm run dev' from the workspace root to start everything.`);
-    } else {
-        console.log(`  3. Run 'npm run dev' from the workspace root to start the local backend and frontend.`);
-        console.log(`\n💡 Note: You can deploy to Cloudflare later by running 'npx kama promote'.`);
+        nextSteps += `\n${pc.dim('Cloudflare Note:')}\n`;
+        nextSteps += cloudflareApiToken
+            ? `${pc.dim('Zone ID was discovered automatically; the purge token is stored as an ignored Worker secret.')}`
+            : `${pc.dim('Zone-level cache purging is disabled. Run kama promote with a token to enable it.')}`;
     }
+
+    note(nextSteps, 'Next steps');
+    outro(`KAMA • ENGINE is ready! 🚀`);
 }
 
-/**
- * COMMAND: npx kama add site
- */
 async function createNewSiteOnly() {
     const rootDir = process.cwd();
 
     if (!existsSync(join(rootDir, 'package.json'))) {
-        console.error('❌ Error: Must run this command inside the root of your workspace.');
-        return;
+        cancel('Error: Must run this command inside the root of your workspace.');
+        process.exit(1);
     }
 
     let targetWorkerName = 'kama-worker';
     let detectedCmsDomain = '';
+    const workerDir = join(rootDir, 'kama-worker');
 
-    const cmsWranglerPath = join(rootDir, 'kama-worker', 'wrangler.json');
+    const cmsWranglerPath = join(workerDir, 'wrangler.json');
     if (existsSync(cmsWranglerPath)) {
         try {
             const cmsWrangler = JSON.parse(readFileSync(cmsWranglerPath, 'utf-8'));
@@ -440,73 +654,97 @@ async function createNewSiteOnly() {
         } catch (e) { }
     }
 
-    console.log('\n🌍 Deployment Mode:');
-    console.log('  1) VPS / Local Server (Node.js)');
-    console.log('  2) Cloudflare Edge');
-    const envChoice = await rl.question('\nChoice [1/2]: ');
-    const isCloudflare = envChoice.trim() === '2';
+    const frontendApiSecret = existsSync(workerDir) ? getOrGenerateWorkspaceSecret(workerDir) : crypto.randomBytes(32).toString('hex');
+
+    const isCloudflare = handleCancel(await select({
+        message: 'Deployment Architecture for this site:',
+        options: [
+            { value: true, label: 'Cloudflare Edge' },
+            { value: false, label: 'VPS / Local Server' }
+        ]
+    }));
+
+    const siteFolder = handleCancel(await text({
+        message: 'Astro package/folder name (e.g., my-new-site):',
+        placeholder: 'kama-starter',
+        defaultValue: 'kama-starter'
+    }));
 
-    const siteFolder = (await rl.question('Astro package/folder name (e.g., my-new-site) [kama-starter]: ')).trim() || 'kama-starter';
     let siteDomain = 'localhost:4321';
     let cmsFullUrl = 'http://localhost:8787';
 
     if (isCloudflare) {
-        siteDomain = (await rl.question('Website Domain (e.g., brand.com): ')).trim();
+        siteDomain = handleCancel(await text({ message: 'Website Domain (e.g., brand.com):', defaultValue: '' }));
+        siteDomain = normalizeCloudflareDomain(siteDomain, 'Frontend Website Domain');
         if (detectedCmsDomain) {
             cmsFullUrl = detectedCmsDomain.startsWith('http') ? detectedCmsDomain : `https://${detectedCmsDomain.replace(/^https?:\/\//, '')}`;
         } else {
-            const cmsDomainInput = (await rl.question('CMS API Domain (e.g., admin.brand.com): ')).trim();
-            cmsFullUrl = `https://${cmsDomainInput.replace(/^https?:\/\//, '')}`;
+            const cmsDomainInput = handleCancel(await text({ message: 'CMS API Domain (e.g., admin.brand.com):', defaultValue: '' }));
+            cmsFullUrl = `https://${normalizeCloudflareDomain(cmsDomainInput, 'CMS API Domain')}`;
         }
+        ensureCloudflareAuth(rootDir);
     }
 
-    await generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, targetWorkerName, isCloudflare);
+    ignoreSecretFiles(rootDir);
+
+    const s = spinner();
+    s.start(`Generating Astro site...`);
+
+    await generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, targetWorkerName, isCloudflare, frontendApiSecret);
+    ignoreSecretFiles(rootDir);
+    s.message('Installing workspace dependencies...');
+    execSync('npm install', { cwd: rootDir, stdio: 'inherit' });
 
-    console.log(`\n✨ Site created in sites/${siteFolder}!`);
-    console.log(`📦 Run 'npm install' at workspace root.`);
+    s.stop(`Site created in sites/${siteFolder}!`);
+
+    note('Run `npm run dev` from the workspace root to start the new site.', 'Next steps');
+    outro('Site added successfully! 🚀');
 }
 
-/**
- * COMMAND: npx kama bundle
- */
-async function bundleWorkspaceSchemas(targetRootDir) {
+async function bundleWorkspaceSchemas(targetRootDir, silent = false) {
     let rootDir = targetRootDir || process.cwd();
     if (basename(rootDir) === 'kama-worker') rootDir = resolve(rootDir, '..');
 
+    const s = spinner();
+    if (!silent) s.start('Bundling schemas & extensions...');
     try {
+        generateExtensionRegistry(rootDir);
+
         let compilerPath = join(__dirname, '../dist/schema-compiler.js');
         if (!existsSync(compilerPath)) compilerPath = join(__dirname, '../scripts/schema-compiler.ts');
-        await import(pathToFileURL(compilerPath).href);
+        execSync(`${shellQuote(process.execPath)} ${shellQuote(compilerPath)}`, { cwd: rootDir, stdio: 'inherit' });
+
+        if (!silent) s.stop('Schemas and Extensions bundled successfully.');
     } catch (e) {
-        console.error(`❌ Schema compilation failed:`, e.message || e);
+        if (!silent) s.stop(`Compilation failed: ${e.message}`, true);
+        else throw e;
     }
 }
 
-/**
- * COMMAND: npx kama promote
- */
 async function promoteLocalToCloudflare() {
     const rootDir = process.cwd();
     const workerDir = join(rootDir, 'kama-worker');
     const rootPkgPath = join(rootDir, 'package.json');
 
     if (!existsSync(workerDir) || !existsSync(rootPkgPath)) {
-        console.error('❌ Error: Could not find kama-worker folder or package.json. Run this command inside your workspace root.');
-        return;
+        cancel('Error: Could not find kama-worker folder or package.json.');
+        process.exit(1);
     }
 
-    console.log('\n🌐 --- UPGRADING WORKSPACE TO CLOUDFLARE EDGE --- 🌐\n');
+    const frontendApiSecret = getOrGenerateWorkspaceSecret(workerDir);
 
-    try {
-        execSync('npx wrangler whoami', { stdio: 'ignore' });
-        console.log('✅ Logged in to Cloudflare.');
-    } catch (e) {
-        console.log('🌐 Launching browser for Cloudflare login...');
-        try { execSync('npx wrangler login', { stdio: 'ignore' }); }
-        catch (loginError) { console.log('❌ Cloudflare login failed.'); return; }
-    }
+    const s = spinner();
+    s.start('Checking Cloudflare authentication...');
+    ensureCloudflareAuth(rootDir);
+    s.stop('Cloudflare authentication verified.');
 
-    const cmsDomain = (await rl.question('\nCMS Admin Domain (e.g., admin.yourdomain.com): ')).trim();
+    const cmsDomain = normalizeCloudflareDomain(
+        handleCancel(await text({ message: 'CMS Admin Domain (e.g., admin.yourdomain.com):', defaultValue: '' })),
+        'CMS Admin Domain'
+    );
+    const existingCloudflareToken = readEnvValue(join(workerDir, '.dev.vars'), 'CLOUDFLARE_API_TOKEN') || readEnvValue(join(workerDir, '.secrets'), 'CLOUDFLARE_API_TOKEN');
+    const cloudflareApiToken = await promptForCloudflareApiToken(existingCloudflareToken);
+    const cloudflareZoneId = await resolveCloudflareZoneId(cmsDomain, cloudflareApiToken);
 
     const sitesFolderDir = join(rootDir, 'sites');
     let siteDomain = '';
@@ -515,87 +753,97 @@ async function promoteLocalToCloudflare() {
         const sites = readdirSync(sitesFolderDir);
         if (sites.length > 0) {
             siteDir = join(sitesFolderDir, sites[0]);
-            siteDomain = (await rl.question('Frontend Website Domain (e.g., yourdomain.com): ')).trim();
+            siteDomain = normalizeCloudflareDomain(
+                handleCancel(await text({ message: `Frontend Website Domain for ${sites[0]}:`, defaultValue: '' })),
+                'Frontend Website Domain'
+            );
         }
     }
 
-    const projName = basename(rootDir);
-    let dbName = `${projName}-db`.replace(/[^a-zA-Z0-9_-]/g, '_');
-    let d1DatabaseId = '00000000-0000-0000-0000-000000000000';
+    ignoreSecretFiles(rootDir);
 
-    try {
-        const d1Output = execSync(`npx wrangler d1 create ${dbName}`, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-        const match = d1Output.match(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/);
-        if (match) d1DatabaseId = match[0];
-    } catch (err) { }
+    s.start('Upgrading workspace to Cloudflare Edge...');
+
+    const projName = basename(rootDir);
+    const workerName = `${projName}-worker`.toLowerCase().replace(/[^a-z0-9_-]/g, '-');
+    const bucketName = `${projName}-media-prod`.toLowerCase().replace(/[^a-z0-9_-]/g, '-');
+    const dbName = `${projName}-db`.replace(/[^a-zA-Z0-9_-]/g, '_');
+    const d1DatabaseId = getOrCreateD1(dbName, rootDir);
+    const backendCacheId = getOrCreateKV(`CACHE_KV_${workerName.toUpperCase().replace(/-/g, '_')}`, rootDir);
+    ensureR2Bucket(bucketName, rootDir);
 
     const rootPkg = JSON.parse(readFileSync(rootPkgPath, 'utf-8'));
     rootPkg.devDependencies = rootPkg.devDependencies || {};
     rootPkg.devDependencies['wrangler'] = WRANGLER_LATEST;
     writeFileSync(rootPkgPath, JSON.stringify(rootPkg, null, 2));
 
-    const workerName = `${projName}-worker`.toLowerCase().replace(/[^a-z0-9_-]/g, '-');
-    const bucketName = `${projName}-media-prod`.toLowerCase().replace(/[^a-z0-9_-]/g, '-');
     const workerWranglerPath = join(workerDir, 'wrangler.json');
+    let currentConfig = existsSync(workerWranglerPath) ? JSON.parse(readFileSync(workerWranglerPath, 'utf-8')) : {
+        $schema: '../node_modules/wrangler/config-schema.json',
+        name: workerName,
+        main: 'index.js',
+        compatibility_date: '2024-09-23',
+        compatibility_flags: ['nodejs_compat'],
+        assets: { directory: '../node_modules/@brightsideoy/kama/dist', binding: 'ASSETS' },
+        images: { binding: 'IMAGES' },
+        vars: { CLOUDFLARE_ZONE_ID: '', KAMA_RUNTIME: 'cloudflare' }
+    };
 
-    let currentConfig = existsSync(workerWranglerPath)
-        ? JSON.parse(readFileSync(workerWranglerPath, 'utf-8'))
-        : {
-            $schema: '../node_modules/wrangler/config-schema.json',
-            name: workerName,
-            main: 'index.js',
-            compatibility_date: '2024-09-23',
-            compatibility_flags: ['nodejs_compat'],
-            assets: { directory: '../node_modules/@brightsideoy/kama/dist', binding: 'ASSETS' },
-            images: { binding: 'IMAGES' },
-            vars: { CLOUDFLARE_ZONE_ID: "REPLACE_WITH_YOUR_32_CHAR_ZONE_ID", KAMA_RUNTIME: 'cloudflare' }
-        };
+    const cloudflareEntryPath = join(workerDir, 'index.js');
+    if (!existsSync(cloudflareEntryPath)) {
+        cpSync(join(__dirname, '../templates/kama-worker/index.js'), cloudflareEntryPath);
+    }
 
+    currentConfig.main = 'index.js';
     currentConfig.dev = currentConfig.dev || { host: 'localhost', port: 8787 };
-    currentConfig.cache = { enabled: true };
+    currentConfig.vars = currentConfig.vars || {};
+    if (String(currentConfig.vars.CLOUDFLARE_ZONE_ID || '').startsWith('REPLACE_WITH_')) {
+        currentConfig.vars.CLOUDFLARE_ZONE_ID = '';
+    }
+    currentConfig.vars.CLOUDFLARE_ZONE_ID = cloudflareZoneId || currentConfig.vars.CLOUDFLARE_ZONE_ID || '';
     currentConfig.vars.CDN_DOMAIN = cmsDomain;
     if (siteDomain) currentConfig.vars.PUBLIC_FRONTEND_URL = `https://${siteDomain}`;
     currentConfig.routes = [{ pattern: cmsDomain, custom_domain: true }];
     currentConfig.d1_databases = [{ binding: 'DB', database_name: dbName, database_id: d1DatabaseId }];
     currentConfig.r2_buckets = [{ binding: 'MEDIA_BUCKET', bucket_name: bucketName }];
+    currentConfig.kv_namespaces = [{ binding: 'CACHE_KV', id: backendCacheId }];
 
     writeFileSync(workerWranglerPath, JSON.stringify(currentConfig, null, 2));
 
-    if (!existsSync(join(workerDir, '.dev.vars'))) {
-        writeFileSync(join(workerDir, '.dev.vars'), `CLOUDFLARE_API_TOKEN=cfut_YOUR_CUSTOM_PURGE_TOKEN\nCDN_DOMAIN=\nPUBLIC_FRONTEND_URL=http://localhost:4321\n`);
-    }
-
-    const workerIndexPath = join(workerDir, 'index.js');
-    if (!existsSync(workerIndexPath)) {
-        const templateIndexPath = join(__dirname, '../templates/kama-worker/index.js');
-        if (existsSync(templateIndexPath)) {
-            cpSync(templateIndexPath, workerIndexPath);
-        }
-    }
+    updateEnvFile(join(workerDir, '.dev.vars'), {
+        CDN_DOMAIN: '',
+        PUBLIC_FRONTEND_URL: 'http://localhost:4321',
+        FRONTEND_API_SECRET: frontendApiSecret,
+        ...(cloudflareApiToken ? { CLOUDFLARE_API_TOKEN: cloudflareApiToken } : {})
+    });
+    writeWorkerSecrets(workerDir, frontendApiSecret, cloudflareApiToken);
 
     const workerPkgPath = join(workerDir, 'package.json');
     if (existsSync(workerPkgPath)) {
         const workerPkg = JSON.parse(readFileSync(workerPkgPath, 'utf-8'));
-        workerPkg.scripts.dev = "npm run schema:local && npm run seed:local && wrangler dev --port 8787 --inspector-port 9239";
-        workerPkg.scripts.deploy = "npm run schema:remote && npm run seed:remote && wrangler deploy";
-        workerPkg.scripts["schema:remote"] = `wrangler d1 execute ${dbName} --remote --file=../node_modules/@brightsideoy/kama/schema.sql`;
-        workerPkg.scripts["seed:remote"] = `wrangler d1 execute ${dbName} --remote --file=seed.sql`;
+        workerPkg.scripts.dev = "wrangler dev --port 8787 --inspector-port 9239";
+        workerPkg.scripts.deploy = "npm run setup:remote && wrangler deploy --secrets-file .secrets";
+        workerPkg.scripts["setup:local"] = `wrangler d1 execute ${dbName} --local --file=../node_modules/@brightsideoy/kama/schema.sql`;
+        workerPkg.scripts["setup:remote"] = `wrangler d1 execute ${dbName} --remote --file=../node_modules/@brightsideoy/kama/schema.sql`;
+
+        workerPkg.scripts["seed"] = "npm run seed:local";
+        workerPkg.scripts["seed:local"] = `node ../node_modules/@brightsideoy/kama/dist/build-seed.js && for f in seed-*.sql; do wrangler d1 execute ${dbName} --local --file="$f"; done`;
+        workerPkg.scripts["seed:remote"] = `node ../node_modules/@brightsideoy/kama/dist/build-seed.js && for f in seed-*.sql; do wrangler d1 execute ${dbName} --remote --file="$f"; done`;
+
+        workerPkg.dependencies = workerPkg.dependencies || {};
+        workerPkg.dependencies.hono = '^4.13.0';
+
         workerPkg.devDependencies = workerPkg.devDependencies || {};
         workerPkg.devDependencies.wrangler = WRANGLER_LATEST;
+        if (workerPkg.devDependencies.tsx) delete workerPkg.devDependencies.tsx;
+
         writeFileSync(workerPkgPath, JSON.stringify(workerPkg, null, 2));
     }
 
     if (siteDir && siteDomain) {
-        let sessionId = "REPLACE_WITH_YOUR_SESSION_KV_ID";
-        let htmlCacheId = "REPLACE_WITH_YOUR_HTML_CACHE_KV_ID";
         const prefix = basename(siteDir).replace(/[^a-zA-Z0-9]/g, '_').toUpperCase();
-
-        try {
-            const sessionOut = execSync(`npx wrangler kv namespace create "SESSION_${prefix}"`, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-            if (sessionOut.match(/"id":\s*"([a-f0-9]{32})"/)) sessionId = sessionOut.match(/"id":\s*"([a-f0-9]{32})"/)[1];
-            const cacheOut = execSync(`npx wrangler kv namespace create "HTML_CACHE_${prefix}"`, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-            if (cacheOut.match(/"id":\s*"([a-f0-9]{32})"/)) htmlCacheId = cacheOut.match(/"id":\s*"([a-f0-9]{32})"/)[1];
-        } catch (err) { }
+        const sessionId = getOrCreateKV(`SESSION_${prefix}`, rootDir);
+        const htmlCacheId = getOrCreateKV(`HTML_CACHE_${prefix}`, rootDir);
 
         const siteWranglerPath = join(siteDir, 'wrangler.json');
         const siteConfig = {
@@ -608,7 +856,7 @@ async function promoteLocalToCloudflare() {
             assets: { directory: "./dist/client", binding: "ASSETS", run_worker_first: true },
             kv_namespaces: [{ binding: "SESSION", id: sessionId }, { binding: "HTML_CACHE", id: htmlCacheId }],
             services: [{ binding: "CMS_WORKER", service: currentConfig.name }],
-            routes: [{ pattern: siteDomain, zone_name: siteDomain, custom_domain: true, enabled: true, previews_enabled: false }],
+            routes: [{ pattern: siteDomain, custom_domain: true, enabled: true, previews_enabled: false }],
             vars: { PUBLIC_CMS_URL: `https://${cmsDomain}`, PUBLIC_API_URL: `https://${cmsDomain}` }
         };
         writeFileSync(siteWranglerPath, JSON.stringify(siteConfig, null, 2));
@@ -618,50 +866,50 @@ async function promoteLocalToCloudflare() {
             const sitePkg = JSON.parse(readFileSync(sitePkgPath, 'utf-8'));
             sitePkg.dependencies = sitePkg.dependencies || {};
             sitePkg.dependencies['astro'] = ASTRO_LATEST;
-
             if (sitePkg.dependencies['@astrojs/node']) delete sitePkg.dependencies['@astrojs/node'];
             sitePkg.dependencies['@astrojs/cloudflare'] = ASTRO_CF_LATEST;
-
             sitePkg.devDependencies = sitePkg.devDependencies || {};
             sitePkg.devDependencies['wrangler'] = WRANGLER_LATEST;
-
+            sitePkg.scripts = sitePkg.scripts || {};
+            sitePkg.scripts.deploy = 'astro build && wrangler deploy --secrets-file .secrets';
             writeFileSync(sitePkgPath, JSON.stringify(sitePkg, null, 2));
         }
 
+        writeWorkerSecrets(siteDir, frontendApiSecret);
+        updateEnvFile(join(siteDir, '.env'), {
+            PUBLIC_CMS_URL: `https://${cmsDomain}`,
+            PUBLIC_API_URL: `https://${cmsDomain}`
+        }, ['FRONTEND_API_SECRET']);
+        updateEnvFile(join(siteDir, '.dev.vars'), { FRONTEND_API_SECRET: frontendApiSecret });
         convertAstroConfigToCloudflare(siteDir);
+    }
 
-        const tsConfigPath = join(siteDir, 'tsconfig.json');
-        if (existsSync(tsConfigPath)) {
-            const tsConfig = JSON.parse(readFileSync(tsConfigPath, 'utf-8'));
-            tsConfig.compilerOptions = tsConfig.compilerOptions || {};
-            tsConfig.compilerOptions.types = ["@cloudflare/workers-types"];
-            writeFileSync(tsConfigPath, JSON.stringify(tsConfig, null, 2));
-        }
+    s.message('Installing Cloudflare dependencies...');
+    execSync('npm install', { cwd: rootDir, stdio: 'inherit' });
+    s.message('Bundling workspace schemas...');
+    await bundleWorkspaceSchemas(rootDir, true);
+    s.message('Deploying CMS and initializing the remote database...');
+    execSync('npm run deploy -w kama-worker', { cwd: rootDir, stdio: 'inherit' });
+
+    if (siteDir && siteDomain) {
+        const siteFolder = basename(siteDir);
+        s.message(`Building and deploying ${siteFolder}...`);
+        execSync(`npm run deploy -w sites/${shellQuote(siteFolder)}`, { cwd: rootDir, stdio: 'inherit' });
     }
 
-    console.log(`\n✅ Workspace successfully upgraded to Cloudflare Edge!`);
+    s.stop('Workspace provisioned and deployed to Cloudflare.');
+    outro('Promotion complete.');
 }
 
-/**
- * Helper: Copies the Astro starter template and hydrates runtime tokens
- */
-async function generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, workerName = 'kama-worker', isCloudflare = false) {
-    console.log(`\n🚀 Scaffolding Astro site (${siteFolder}) mapped to ${siteDomain} (Service: ${workerName})...`);
-
+async function generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, workerName = 'kama-worker', isCloudflare = false, frontendApiSecret = '') {
     const siteDir = join(rootDir, 'sites', siteFolder);
     const templateDir = join(__dirname, '../templates/astro-starter');
 
-    if (!existsSync(templateDir)) {
-        console.error(`❌ Error: Astro template not found at ${templateDir}`);
-        return;
-    }
+    if (!existsSync(templateDir)) return;
 
     cpSync(templateDir, siteDir, { recursive: true });
 
-    const tsConfig = {
-        extends: "astro/tsconfigs/strict",
-        compilerOptions: { baseUrl: ".", paths: { "@/*": ["src/*"] } }
-    };
+    const tsConfig = { extends: "astro/tsconfigs/strict", compilerOptions: { baseUrl: ".", paths: { "@/*": ["src/*"] } } };
     if (isCloudflare) tsConfig.compilerOptions.types = ["@cloudflare/workers-types"];
     writeFileSync(join(siteDir, 'tsconfig.json'), JSON.stringify(tsConfig, null, 2));
 
@@ -670,7 +918,6 @@ async function generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, wo
         const rawContent = readFileSync(templatePkgPath, 'utf-8')
             .replace(/\{\{SITE_NAME\}\}/g, siteFolder)
             .replace(/\{\{KAMA_VERSION\}\}/g, currentKamaVersion);
-
         const sitePkg = JSON.parse(rawContent);
 
         sitePkg.dependencies = sitePkg.dependencies || {};
@@ -680,14 +927,13 @@ async function generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, wo
             if (sitePkg.dependencies['@astrojs/cloudflare']) delete sitePkg.dependencies['@astrojs/cloudflare'];
             if (sitePkg.dependencies['wrangler']) delete sitePkg.dependencies['wrangler'];
             if (sitePkg.devDependencies && sitePkg.devDependencies['wrangler']) delete sitePkg.devDependencies['wrangler'];
-
             sitePkg.dependencies['@astrojs/node'] = ASTRO_NODE_LATEST;
         } else {
             sitePkg.dependencies['@astrojs/cloudflare'] = ASTRO_CF_LATEST;
             if (sitePkg.dependencies['wrangler']) delete sitePkg.dependencies['wrangler'];
             sitePkg.devDependencies = sitePkg.devDependencies || {};
             sitePkg.devDependencies['wrangler'] = WRANGLER_LATEST;
-
+            sitePkg.scripts.deploy = 'astro build && wrangler deploy --secrets-file .secrets';
             convertAstroConfigToCloudflare(siteDir);
         }
 
@@ -696,22 +942,14 @@ async function generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, wo
     }
 
     const siteLabel = siteFolder.split(/[-_]/).map(word => word.charAt(0).toUpperCase() + word.slice(1)).join(' ');
-    const safeSiteLabel = siteLabel.replace(/'/g, "''");
     const channelKey = siteFolder.replace(/[^a-z0-9_-]/gi, '-').toLowerCase();
     const treeKey = 'main-tree';
     const safeWorkerName = `${siteFolder.toLowerCase().replace(/[^a-z0-9-]/g, '-')}-site`;
 
     if (isCloudflare) {
-        let sessionId = "REPLACE_WITH_YOUR_SESSION_KV_ID";
-        let htmlCacheId = "REPLACE_WITH_YOUR_HTML_CACHE_KV_ID";
-
-        try {
-            const prefix = siteFolder.replace(/[^a-zA-Z0-9]/g, '_').toUpperCase();
-            const sessionOut = execSync(`npx wrangler kv namespace create "SESSION_${prefix}"`, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-            if (sessionOut.match(/"id":\s*"([a-f0-9]{32})"/)) sessionId = sessionOut.match(/"id":\s*"([a-f0-9]{32})"/)[1];
-            const cacheOut = execSync(`npx wrangler kv namespace create "HTML_CACHE_${prefix}"`, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-            if (cacheOut.match(/"id":\s*"([a-f0-9]{32})"/)) htmlCacheId = cacheOut.match(/"id":\s*"([a-f0-9]{32})"/)[1];
-        } catch (err) { }
+        const prefix = siteFolder.replace(/[^a-zA-Z0-9]/g, '_').toUpperCase();
+        const sessionId = getOrCreateKV(`SESSION_${prefix}`);
+        const htmlCacheId = getOrCreateKV(`HTML_CACHE_${prefix}`);
 
         const siteConfig = {
             $schema: "node_modules/wrangler/config-schema.json",
@@ -723,27 +961,29 @@ async function generateAstroSite(rootDir, siteFolder, siteDomain, cmsFullUrl, wo
             assets: { directory: "./dist/client", binding: "ASSETS", run_worker_first: true },
             kv_namespaces: [{ binding: "SESSION", id: sessionId }, { binding: "HTML_CACHE", id: htmlCacheId }],
             services: [{ binding: "CMS_WORKER", service: workerName }],
-            vars: { PUBLIC_CMS_URL: cmsFullUrl, PUBLIC_API_URL: cmsFullUrl, PUBLIC_CHANNEL_ID: channelKey, PUBLIC_TREE_ID: treeKey, PUBLIC_HOME_SLUG: "index", PUBLIC_SITE_NAME: siteLabel }
+            routes: [{ pattern: siteDomain, custom_domain: true, enabled: true, previews_enabled: false }],
+            vars: { PUBLIC_CMS_URL: cmsFullUrl, PUBLIC_API_URL: cmsFullUrl, PUBLIC_CHANNEL_ID: channelKey, PUBLIC_TREE_ID: treeKey, PUBLIC_SITE_NAME: siteLabel }
         };
 
         if (siteDomain !== 'localhost:4321') siteConfig.routes = [{ pattern: siteDomain, custom_domain: true, enabled: true, previews_enabled: false }];
         writeFileSync(join(siteDir, 'wrangler.json'), JSON.stringify(siteConfig, null, 2));
+        writeWorkerSecrets(siteDir, frontendApiSecret);
     }
 
-    const seedSql = `
--- Seed data for site: ${safeSiteLabel}
-INSERT OR IGNORE INTO channels (key, label, channelType, defaultLanguage, isHidden, dataJson) VALUES ('${channelKey}', '${safeSiteLabel}', 'website', '', 0, '{}');
-INSERT OR IGNORE INTO trees (key, label, treeType, channelId, isHidden, dataJson) VALUES ('${treeKey}', 'Main Tree', 'navigation', (SELECT id FROM channels WHERE key = '${channelKey}'), 0, '{}');
-INSERT OR IGNORE INTO channel_trees (channelId, treeId, key) VALUES ((SELECT id FROM channels WHERE key = '${channelKey}'), (SELECT id FROM trees WHERE key = '${treeKey}'), 'main');
-INSERT INTO content_nodes (contentType, title, slug, language, status, dataJson) SELECT 'page', 'Welcome to ${safeSiteLabel}', 'index', '', 'published', '{"titleSuffix":"– ${safeSiteLabel}","layoutId":"single-column","subpageLayoutId":"two-column","logoText":"${safeSiteLabel}"}' WHERE NOT EXISTS (SELECT 1 FROM content_nodes WHERE slug = 'index' AND title = 'Welcome to ${safeSiteLabel}');
-INSERT OR IGNORE INTO node_channels (nodeId, channelId) VALUES ((SELECT id FROM content_nodes WHERE slug = 'index' AND title = 'Welcome to ${safeSiteLabel}' ORDER BY id DESC LIMIT 1), (SELECT id FROM channels WHERE key = '${channelKey}'));
-INSERT OR IGNORE INTO tree_nodes (treeId, contentId, parentId, sortOrder) VALUES ((SELECT id FROM trees WHERE key = '${treeKey}'), (SELECT id FROM content_nodes WHERE slug = 'index' AND title = 'Welcome to ${safeSiteLabel}' ORDER BY id DESC LIMIT 1), NULL, 0);
-`;
+    const localCmsUrl = isCloudflare ? cmsFullUrl : 'http://127.0.0.1:8787';
+    let envContent = `# Local Development Overrides\nPUBLIC_CMS_URL="${localCmsUrl}"\nPUBLIC_API_URL="${localCmsUrl}"\nPUBLIC_CHANNEL_ID="${channelKey}"\nPUBLIC_TREE_ID="${treeKey}"\nPUBLIC_SITE_NAME="${siteLabel.replace(/"/g, '\\"')}"\n`;
 
-    const workerDir = join(rootDir, 'kama-worker');
-    if (existsSync(workerDir)) appendFileSync(join(workerDir, 'seed.sql'), seedSql);
+    if (frontendApiSecret && !isCloudflare) {
+        envContent += `\n# Server-to-Server API Security\nFRONTEND_API_SECRET="${frontendApiSecret}"\n`;
+    }
 
-    writeFileSync(join(siteDir, '.env'), `# Local Development Overrides\nPUBLIC_CMS_URL="http://127.0.0.1:8787"\nPUBLIC_API_URL="http://127.0.0.1:8787"\nPUBLIC_CHANNEL_ID="${channelKey}"\nPUBLIC_TREE_ID="${treeKey}"\nPUBLIC_HOME_SLUG="index"\nPUBLIC_SITE_NAME="${siteLabel.replace(/"/g, '\\"')}"\n`);
+    writeFileSync(join(siteDir, '.env'), envContent);
+    if (isCloudflare && frontendApiSecret) {
+        writeFileSync(join(siteDir, '.dev.vars'), `FRONTEND_API_SECRET="${frontendApiSecret}"\n`, { mode: 0o600 });
+    }
 }
 
-main().catch(console.error);
+main().catch(error => {
+    console.error(error);
+    process.exitCode = 1;
+});