@lunora/cli 1.0.0-alpha.49 → 1.0.0-alpha.490

package/dist/packem_chunks/runInitCommand.mjs

@@ -1,42 +1,50 @@
-import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, rmSync, mkdtempSync, cpSync, renameSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { detectFramework as detectFramework$1, isInteractive, LUNA_ART, LUNA_NAME, LUNA_SIGNOFF, paintAnswer, BADGES } from '@lunora/config';
-import { walkSync } from '@visulima/fs';
-import { join as join$1, dirname as dirname$1, basename, resolve, relative } from '@visulima/path';
-import { downloadTemplate } from 'giget';
-import { modify, applyEdits } from 'jsonc-parser';
-import { join, dirname } from 'node:path';
-import { d as defineHandler } from '../packem_shared/command-D3lB_4Az.mjs';
-import { a as detectInstalledManagers, i as installArgsFor } from '../packem_shared/detect-package-manager-DYp7n3mJ.mjs';
-import MagicString from 'magic-string';
-import { Project, SyntaxKind } from 'ts-morph';
-import { P as PromptCancelledError } from '../packem_shared/prompt-cancelled-APzX1Im-.mjs';
-import { c as resolveTagVersions, d as resolveSourceRef, e as resolveDistTag, r as runAddCommand } from '../packem_shared/commands-B-gR09Z_.mjs';
-import { defaultSpawner } from '../packem_shared/createRecordingSpawner-DxI3mebw.mjs';
-import { d as tuiMascot, e as tuiStep, f as tuiMoonrise, t as tuiText, g as tuiHeadline, h as tuiInfo, a as tuiSelect, b as tuiConfirm, w as withTuiSpinner, i as tuiNextSteps, j as tuiTasks, k as tuiMultiSelect, l as withTuiBadgeProgress } from '../packem_shared/tui-prompts-BjEN8XgP.mjs';
-import { logStep } from '../packem_shared/createLogger-B40gPzQo.mjs';
-import { E as EMAIL_ITEM, p as promptBucketName, w as withStorageBucketName, M as MAIL_DESTINATION_PROMPT, r as resolveTypedDestination, f as withMailDestination, e as promptAuthProvider, c as promptDatabaseName, g as withAuthDatabaseName } from '../packem_shared/storage-BIsph-Vk.mjs';
-import dns from 'node:dns/promises';
-
-const GITHUB_CONTENT = `name: Deploy
+import{existsSync as f,mkdirSync as I,writeFileSync as v,readFileSync as _,appendFileSync as lt,readdirSync as J,rmSync as P,lstatSync as ye,mkdtempSync as be,copyFileSync as ct,renameSync as dt}from"node:fs";import{tmpdir as ke}from"node:os";import{detectFramework as ut,DEV_VARS_EXAMPLE_FILE as xe,DEV_VARS_FILE as ht,isInteractive as k,LUNA_ART as pt,LUNA_NAME as mt,LUNA_SIGNOFF as ft,BADGES as w,paintAnswer as vt,detectLintTools as gt,readProjectDependencies as Ee,applyLintIgnores as wt,readProjectManifest as yt}from"@lunora/config";import{readJsonSync as bt,walkSync as kt}from"@visulima/fs";import{relative as j,join as u,dirname as S,basename as T,resolve as _e}from"@visulima/path";import{downloadTemplate as Ce}from"giget";import{modify as xt,applyEdits as Et}from"jsonc-parser";import{join as Q,dirname as _t}from"node:path";import{EXIT_CODE as g}from"../packem_shared/EXIT_CODE-DQVhSE-1.mjs";import{installArgsFor as Se,execArgsFor as Ct,detectPackageManager as V,detectInstalledManagers as St,runScriptCommand as Lt,addArgsFor as At}from"@lunora/config/cli";import{d as It}from"../packem_shared/command-BpMv2n0o.mjs";import Rt from"magic-string";import{Project as Ot,SyntaxKind as b,ts as y}from"ts-morph";import{P as X}from"../packem_shared/prompt-cancelled-BvsNxg_Q.mjs";import{l as Le,m as Tt,n as Ae,o as Ie,a as $t}from"../packem_shared/resolve-Bdc9KEUv.mjs";import{defaultSpawner as Re}from"../packem_shared/createRecordingSpawner-DchLi0gR.mjs";import{d as Mt,e as Nt,f as Pt,a as Oe,t as D,g as Te,h as Dt,b as $e,i as Me,w as Ut,j as jt,k as Ne,l as Vt}from"../packem_shared/tui-prompts-B3YwUhGw.mjs";import{A as Pe,p as Bt,w as Ft,M as Wt,r as qt,E as De,k as Ht,e as Kt,c as Ue,l as je,i as zt,f as Gt}from"../packem_shared/storage-3GOIFVZm.mjs";import{r as Yt}from"../packem_shared/commands-CkuCMUP_.mjs";import{findWranglerFile as Jt,readWranglerJsonc as Qt,DEFAULT_OBSERVABILITY as Xt,CLOUDFLARE_TOOLCHAIN_VERSIONS as ne}from"@lunora/config/cloudflare";import{logStep as ae}from"../packem_shared/createLogger-4TujevyB.mjs";import{r as Zt}from"../packem_shared/lint-ignore-report-DKZagpqk.mjs";import er from"node:dns/promises";const Z={bun:{githubCacheKey:void 0,githubSetupStep:`      - uses: oven-sh/setup-bun@v2
+`,gitlabImage:"oven/bun:1",gitlabProvisionScript:[],installCmd:"bun install --frozen-lockfile",lockfile:"bun.lockb"},npm:{githubCacheKey:"npm",githubSetupStep:"",gitlabImage:"node:22",gitlabProvisionScript:[],installCmd:"npm ci",lockfile:"package-lock.json"},pnpm:{githubCacheKey:"pnpm",githubSetupStep:`      - uses: pnpm/action-setup@v4
+        with:
+          version: latest
+`,gitlabImage:"node:22",gitlabProvisionScript:["corepack enable"],installCmd:"pnpm install --frozen-lockfile",lockfile:"pnpm-lock.yaml"},yarn:{githubCacheKey:"yarn",githubSetupStep:"",gitlabImage:"node:22",gitlabProvisionScript:["corepack enable"],installCmd:"yarn install --frozen-lockfile",lockfile:"yarn.lock"}},E=(e,t)=>{const r=Ct(e,"lunora",t);return[r.command,...r.args].join(" ")},M=(e,t,r="")=>`      - uses: actions/checkout@v4
+${t===void 0?"":`        with:
+          ref: ${t}
+`}${e.githubSetupStep}      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+${e.githubCacheKey===void 0?"":`          cache: ${e.githubCacheKey}
+`}      - run: ${e.installCmd}${r}`,tr=e=>{const t=Z[e],r=t.githubCacheKey===void 0?`# (below) requires it — run \`${e} install\` locally and`:`# (below) and the ${e} cache both require it — run \`${e} install\` locally and`;return`name: Deploy
 
 on:
   push:
     branches: [main]
   pull_request:
+    types: [opened, synchronize, reopened, closed]
   workflow_dispatch:
 
-# Prerequisite: commit your pnpm-lock.yaml. \`pnpm install --frozen-lockfile\`
-# (below) and the pnpm cache both require it — run \`pnpm install\` locally and
+# Prerequisite: commit your ${t.lockfile}. \`${t.installCmd}\`
+${r}
 # commit the lockfile before pushing, or the first CI run fails.
 #
 # Set these repository secrets (Settings → Secrets and variables → Actions):
-#   CLOUDFLARE_API_TOKEN   — a Workers-scoped API token
+#   CLOUDFLARE_API_TOKEN   — the production deploy's token (Workers Scripts: Edit).
+#                            Only the production deploy step receives it.
+#   CLOUDFLARE_PREVIEW_API_TOKEN — a separate token for previews: Workers Scripts,
+#                            D1, Workers KV Storage and Workers R2 Storage: Edit
+#                            (previews make their own D1, KV and R2), limited to
+#                            one account. Only the \`lunora preview\` steps receive
+#                            it, never the install or checkout steps, which run
+#                            a pull request's own dependency scripts.
 #   CLOUDFLARE_ACCOUNT_ID  — your Cloudflare account id
-env:
-  CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}
-  CLOUDFLARE_ACCOUNT_ID: \${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-
+#   LUNORA_DEPLOY_URL      — the production worker's URL (after the first deploy)
+#   LUNORA_ADMIN_TOKEN     — the production worker's admin token
+#   LUNORA_PREVIEW_SECRET_SEED — optional: any long random string; previews then
+#                            keep their minted secrets across pushes. The preview
+#                            job builds this repository's own pull requests with
+#                            CLOUDFLARE_PREVIEW_API_TOKEN in its environment, and
+#                            that token can redeploy any preview with any secrets,
+#                            so the seed adds no access. Never run previews for
+#                            untrusted pull requests; forks get no secrets here.
+#
+# Previews are recorded under "lunora.appId" in package.json, which the first
+# local \`lunora preview deploy\` writes. Commit it: the jobs below find a
+# project's previews by it, so it survives a rename of the Worker.
 jobs:
   # Production deploy on push to the default branch.
   deploy:
@@ -45,379 +53,257 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      # Codegen + wrangler validation gate (no deploy) — fails fast on drift.
-      - run: pnpm exec lunora prepare
-      - run: pnpm exec lunora deploy
-
-  # Preview version on every pull request — uploads a versioned preview URL;
-  # production traffic is untouched.
+${M(t)}
+      # When a schema change tightens a table, the drift gate reads that table's
+      # stored rows from this worker and lets the change ship if every row fits.
+      # Unset (a first deploy), the gate blocks as before. A *.workers.dev URL is
+      # only trusted when the project is linked and .lunora/ is not committed, so
+      # CI has no link: there the gate stays blocked, and a tightening needs a
+      # migration or --allow-schema-drift. A custom domain on a declared route works.
+      - run: ${E(e,["deploy","--migrate-url",'"${{ secrets.LUNORA_DEPLOY_URL }}"'])}
+        env:
+          CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: \${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          LUNORA_ADMIN_TOKEN: \${{ secrets.LUNORA_ADMIN_TOKEN }}
+
+  # Every pull request from this repository gets an isolated preview: its own
+  # Worker, Durable Objects, D1, KV and R2, never production's. One run per
+  # pull request at a time, so a teardown never races a deploy.
   preview:
-    if: github.event_name == 'pull_request'
+    if: github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
+    concurrency: lunora-preview-\${{ github.event.pull_request.number }}
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm exec lunora deploy --preview
-`;
-const GITLAB_CONTENT = `stages:
+${M(t)}
+      - run: ${E(e,["preview","deploy","${{ github.event.pull_request.number }}"])}
+        env:
+          CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_PREVIEW_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: \${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          LUNORA_PREVIEW_SECRET_SEED: \${{ secrets.LUNORA_PREVIEW_SECRET_SEED }}
+
+  # Closing or merging the pull request deletes the preview Worker and every
+  # resource recorded for it.
+  preview-delete:
+    if: github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    concurrency: lunora-preview-\${{ github.event.pull_request.number }}
+    permissions:
+      contents: read
+    steps:
+      # Deleting needs none of the project's dependency scripts, and one that fails must not keep a closed preview alive.
+      # A closed, unmerged pull request may have no merge ref left to check out;
+      # the base branch names the same production Worker the record is keyed by.
+${M(t,"${{ github.event.pull_request.base.ref }}"," --ignore-scripts")}
+      # The pull request may have changed lunora.appId or the Worker name, so its previews are recorded under an identity
+      # this base checkout does not have. Its package.json and wrangler config are copied out with git and read by the CLI
+      # as data: nothing from the head is installed, built or run. The values never pass through a shell or a \${{ }} in a script.
+      - name: Copy the pull request head's project files
+        env:
+          PR_NUMBER: \${{ github.event.pull_request.number }}
+          HEAD_DIR: \${{ runner.temp }}/lunora-head
+        run: |
+          mkdir -p "$HEAD_DIR"
+          if git fetch --depth=1 origin "refs/pull/$PR_NUMBER/head"; then
+            for file in package.json wrangler.jsonc wrangler.json; do
+              git show "FETCH_HEAD:$file" > "$HEAD_DIR/$file" 2>/dev/null || rm -f "$HEAD_DIR/$file"
+            done
+          else
+            echo "could not fetch the pull request head; the preview is looked up under the base branch's identity only"
+          fi
+      # Exit 5 is "no record": the pull request never got a preview (refused, or opened before this workflow). The CLI
+      # answers it only when the head's identity is the base's; a head whose identity differs, or cannot be read, with no
+      # record under the base's fails the job, since the preview may be recorded under the head's.
+      - run: ${E(e,["preview","delete","${{ github.event.pull_request.number }}","--head-dir",'"$HEAD_DIR"'])} || [ "$?" -eq ${String(g.NOT_FOUND)} ]
+        env:
+          CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_PREVIEW_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: \${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          HEAD_DIR: \${{ runner.temp }}/lunora-head
+
+  # A fork's or Dependabot's pull request gets no secrets, so it runs the
+  # deploy pipeline, bundle included, and publishes nothing.
+  check:
+    if: github.event_name == 'pull_request' && github.event.action != 'closed' && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+${M(t)}
+      - run: ${E(e,["deploy","--dry-run"])}
+`},oe="lunora-preview-$CI_MERGE_REQUEST_IID",rr=e=>{const t=Z[e],r=[...t.gitlabProvisionScript,t.installCmd].map(s=>`    - ${s}`).join(`
+`),n=t.gitlabProvisionScript.map(s=>`    - ${s}`).join(`
+`),a=n===""?" []":`
+${n}`,i=[n,`    - ${t.installCmd} --ignore-scripts`].filter(s=>s!=="").join(`
+`);return`stages:
   - deploy
 
-# Prerequisite: commit your pnpm-lock.yaml. \`pnpm install --frozen-lockfile\`
-# (below) requires it — run \`pnpm install\` locally and commit the lockfile
+# Prerequisite: commit your ${t.lockfile}. \`${t.installCmd}\`
+# (below) requires it — run \`${e} install\` locally and commit the lockfile
 # before pushing, or the first pipeline fails.
 #
-# Set these as masked CI/CD variables (Settings → CI/CD → Variables):
+# Set these as CI/CD variables (Settings → CI/CD → Variables), each Masked AND
+# Protected, with Environment scope "production":
 #   CLOUDFLARE_API_TOKEN   — a Workers-scoped API token
 #   CLOUDFLARE_ACCOUNT_ID  — your Cloudflare account id
+#   LUNORA_DEPLOY_URL      — the production worker's URL (after the first deploy)
+#   LUNORA_ADMIN_TOKEN     — the production worker's admin token
+# Protected variables reach only pipelines on protected branches and tags, so a
+# merge-request pipeline from a feature branch, which runs the project's own
+# code, gets none of them. Keep your default branch protected (it is by default).
+# The "production" scope reaches only jobs that declare environment: production,
+# which is the deploy job alone; the check job below uses none of these.
+#
+# Previews run in merge-request pipelines, so they need credentials of their own.
+# Set these two again, Masked but NOT Protected, with Environment scope "preview/*"
+# (only jobs that declare a preview/* environment get them):
+#   CLOUDFLARE_API_TOKEN   — a separate token: Workers Scripts, D1, Workers KV
+#                            Storage and Workers R2 Storage: Edit (previews make
+#                            their own D1, KV and R2). Never the production token.
+#                            Create it in Cloudflare (My Profile > API Tokens >
+#                            Create Custom Token) with only those four Account
+#                            permissions, "Account Resources" limited to this one
+#                            account (and no Zone, User or other permission).
+#                            Residual risk: the variable is not Protected, so
+#                            anyone who can push a branch here can read it and
+#                            can then edit or delete every Worker, D1 database,
+#                            KV namespace and R2 bucket on that account, not just
+#                            previews: the token cannot be narrowed to the
+#                            preview-named resources. Use a dedicated account for
+#                            previews if production shares this one.
+#   CLOUDFLARE_ACCOUNT_ID  — your Cloudflare account id
+#   LUNORA_PREVIEW_SECRET_SEED — optional: any long random string; previews then
+#                            keep their minted secrets across pushes. The preview
+#                            jobs run only for merge requests from this project
+#                            (never forks) and already hold the preview token, which
+#                            can redeploy any preview with any secrets, so the seed
+#                            adds no access. Anyone who can push a branch here can
+#                            run code with it: never run previews for untrusted
+#                            merge requests.
+#
+# Previews are recorded under "lunora.appId" in package.json, which the first
+# local \`lunora preview deploy\` writes. Commit it: the jobs below find a
+# project's previews by it, so it survives a rename of the Worker.
 .lunora_base:
-  image: node:22
+  image: ${t.gitlabImage}
   stage: deploy
   before_script:
-    - corepack enable
-    - pnpm install --frozen-lockfile
+${r}
 
 # Production deploy on the default branch.
 deploy:
   extends: .lunora_base
+  environment:
+    name: production
   rules:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
   script:
-    # Codegen + wrangler validation gate (no deploy) — fails fast on drift.
-    - pnpm exec lunora prepare
-    - pnpm exec lunora deploy
+    # When a schema change tightens a table, the drift gate reads that table's
+    # stored rows from this worker and lets the change ship if every row fits.
+    # Unset (a first deploy), the gate blocks as before. A *.workers.dev URL is
+    # only trusted when the project is linked and .lunora/ is not committed, so
+    # CI has no link: there the gate stays blocked, and a tightening needs a
+    # migration or --allow-schema-drift. A custom domain on a declared route works.
+    - ${E(e,["deploy","--migrate-url",'"$LUNORA_DEPLOY_URL"'])}
+
+# Every merge request from this project gets an isolated preview: its own
+# Worker, Durable Objects, D1, KV and R2, never production's. GitLab runs the
+# stop job below when the environment stops: its source branch is deleted (merge
+# with "delete source branch"), someone stops it under Operate > Environments,
+# or it auto-stops. A closed merge request that keeps its branch is cleaned up
+# by the auto-stop, or by stopping the environment by hand.
+#
+# The install runs the merge request's own dependency scripts, so it is a job of
+# its own with no environment: the preview/* variables are scoped to jobs that
+# declare one, so this job never receives the preview token. The preview job
+# reuses its node_modules and holds the token only for the preview command.
+preview_install:
+  extends: .lunora_base
+  stage: .pre
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_SOURCE_PROJECT_ID == $CI_PROJECT_ID
+  script:
+    - echo "dependencies installed without credentials"
+  artifacts:
+    paths:
+      - node_modules/
+    expire_in: 1 hour
 
-# Preview version on every merge request (versioned preview URL; production
-# traffic is untouched).
 preview:
   extends: .lunora_base
+  needs:
+    - preview_install
+  before_script:${a}
   rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_SOURCE_PROJECT_ID == $CI_PROJECT_ID
+  resource_group: ${oe}
+  environment:
+    name: preview/$CI_MERGE_REQUEST_IID
+    on_stop: preview_delete
+    auto_stop_in: 2 weeks
   script:
-    - pnpm exec lunora deploy --preview
-`;
-const WORKFLOWS = {
-  github: {
-    content: GITHUB_CONTENT,
-    file: join(".github", "workflows", "deploy.yml"),
-    secretsHint: "repository secrets (Settings → Secrets and variables → Actions)"
-  },
-  gitlab: {
-    content: GITLAB_CONTENT,
-    file: ".gitlab-ci.yml",
-    secretsHint: "masked CI/CD variables (Settings → CI/CD → Variables)"
-  }
-};
-const isCiProvider = (value) => value === "github" || value === "gitlab";
-const writeCiWorkflow = (projectRoot, provider, options = {}) => {
-  const spec = WORKFLOWS[provider];
-  const path = join(projectRoot, spec.file);
-  if (existsSync(path) && options.overwrite !== true) {
-    return { path, skipped: true, written: false };
-  }
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, spec.content, "utf8");
-  return { path, skipped: false, written: true };
-};
-const scaffoldCiWorkflow = (projectRoot, provider, logger, options = {}) => {
-  const spec = WORKFLOWS[provider];
-  try {
-    const result = writeCiWorkflow(projectRoot, provider, options);
-    if (result.skipped) {
-      logger.info(`--ci ${provider}: ${spec.file} already exists — left unchanged (re-run with overwrite to replace).`);
-    } else {
-      logger.success(`--ci ${provider}: wrote ${spec.file}`);
-      logger.info(`--ci ${provider}: set CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID as ${spec.secretsHint} to enable deploys.`);
-      logger.info(
-        `--ci ${provider}: run \`pnpm install\` and commit pnpm-lock.yaml before pushing — the pipeline runs \`pnpm install --frozen-lockfile\`.`
-      );
-    }
-    return result;
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    logger.warn(`--ci ${provider}: could not write ${spec.file} (${message})`);
-    return { path: join(projectRoot, spec.file), skipped: false, written: false };
-  }
-};
+    - ${E(e,["preview","deploy",'"$CI_MERGE_REQUEST_IID"'])}
 
-const ADAPTER_BY_FRAMEWORK = {
-  astro: "@lunora/react",
-  none: "@lunora/react",
-  nuxt: "@lunora/vue",
-  "react-router": "@lunora/react",
-  "solid-start": "@lunora/solid",
-  sveltekit: "@lunora/svelte",
-  "tanstack-start": "@lunora/react",
-  "tanstack-start-solid": "@lunora/solid"
-};
-const detectFramework = (root) => {
-  const base = detectFramework$1(root);
-  return { ...base, adapter: ADAPTER_BY_FRAMEWORK[base.framework] };
-};
-
-const LUNORA_CALL = "lunora()";
-const LUNORA_IMPORT = 'import { lunora } from "@lunora/vite";';
-const LUNORA_CALL_RE = /\blunora\s*\(/u;
-const LUNORA_VITE_DOUBLE = '"@lunora/vite"';
-const LUNORA_VITE_SINGLE = "'@lunora/vite'";
-const findDefineConfigObject = (sf) => {
-  for (const statement of sf.getStatements()) {
-    if (statement.getKind() !== SyntaxKind.ExportAssignment) {
-      continue;
-    }
-    const expr = statement.asKindOrThrow(SyntaxKind.ExportAssignment).getExpression();
-    if (expr.getKind() !== SyntaxKind.CallExpression) {
-      continue;
-    }
-    const call = expr.asKindOrThrow(SyntaxKind.CallExpression);
-    if (call.getExpression().getText() !== "defineConfig") {
-      continue;
-    }
-    const argument = call.getArguments()[0];
-    if (argument?.getKind() === SyntaxKind.ObjectLiteralExpression) {
-      return argument.asKindOrThrow(SyntaxKind.ObjectLiteralExpression);
-    }
-  }
-  return void 0;
-};
-const findPlainExportObject = (sf) => {
-  for (const statement of sf.getStatements()) {
-    if (statement.getKind() !== SyntaxKind.ExportAssignment) {
-      continue;
-    }
-    const expr = statement.asKindOrThrow(SyntaxKind.ExportAssignment).getExpression();
-    if (expr.getKind() === SyntaxKind.ObjectLiteralExpression) {
-      return expr.asKindOrThrow(SyntaxKind.ObjectLiteralExpression);
-    }
-  }
-  return void 0;
-};
-const findConfigObject = (sourceText) => {
-  const project = new Project({
-    compilerOptions: { allowJs: true },
-    useInMemoryFileSystem: true
-  });
-  const sf = project.createSourceFile("vite.config.ts", sourceText, { overwrite: true });
-  return findDefineConfigObject(sf) ?? findPlainExportObject(sf);
-};
-const importInsertPosition = (sourceText) => {
-  const project = new Project({
-    compilerOptions: { allowJs: true },
-    useInMemoryFileSystem: true
-  });
-  const sf = project.createSourceFile("vite.config.ts", sourceText, { overwrite: true });
-  const imports = sf.getImportDeclarations();
-  if (imports.length === 0) {
-    return 0;
-  }
-  const last = imports[imports.length - 1];
-  if (last === void 0) {
-    return 0;
-  }
-  return last.getEnd();
-};
-const addImport = (ms, source) => {
-  const insertAt = importInsertPosition(source);
-  if (insertAt === 0) {
-    ms.prepend(`${LUNORA_IMPORT}
-`);
-  } else {
-    ms.appendLeft(insertAt, `
-${LUNORA_IMPORT}`);
-  }
-};
-const patchPluginsArray = (ms, configObject) => {
-  const pluginsProp = configObject.getProperty("plugins");
-  if (pluginsProp === void 0) {
-    const properties = configObject.getProperties();
-    const openBrace = configObject.getStart() + 1;
-    if (properties.length === 0) {
-      ms.appendLeft(openBrace, ` plugins: [${LUNORA_CALL}] `);
-    } else {
-      const firstProp = properties[0];
-      if (firstProp !== void 0) {
-        ms.appendLeft(firstProp.getStart(), `plugins: [${LUNORA_CALL}],
-    `);
-      }
-    }
-    return;
-  }
-  const arrayLit = pluginsProp.getDescendantsOfKind(SyntaxKind.ArrayLiteralExpression)[0];
-  if (arrayLit === void 0) {
-    return;
-  }
-  const elements = arrayLit.getElements();
-  if (elements.length === 0) {
-    ms.appendLeft(arrayLit.getStart() + 1, LUNORA_CALL);
-  } else {
-    const firstElement = elements[0];
-    if (firstElement !== void 0) {
-      ms.appendLeft(firstElement.getStart(), `${LUNORA_CALL}, `);
-    }
-  }
-};
-const patchViteConfig = (source) => {
-  if (LUNORA_CALL_RE.test(source)) {
-    return { changed: false, code: source, reason: "lunora plugin already present" };
-  }
-  const configObject = findConfigObject(source);
-  if (configObject === void 0) {
-    return { changed: false, code: source, reason: "could not locate a Vite config plugins array to patch" };
-  }
-  const ms = new MagicString(source);
-  const alreadyImported = source.includes(LUNORA_VITE_DOUBLE) || source.includes(LUNORA_VITE_SINGLE);
-  if (alreadyImported) {
-    patchPluginsArray(ms, configObject);
-  } else {
-    addImport(ms, source);
-    patchPluginsArray(ms, configObject);
-  }
-  return { changed: true, code: ms.toString() };
-};
-
-const NETWORK_ERROR_PATTERN = /enotfound|eai_again|econnrefused|etimedout|network|fetch failed|getaddrinfo/u;
-const NOT_FOUND_ERROR_PATTERN = /404|not found|could not find|no such/u;
-const describeDownloadFailure = (error, context) => {
-  const raw = error instanceof Error ? error.message : String(error);
-  const lower = raw.toLowerCase();
-  const genericMessage = `failed to download template "${context.templateType}" from ${context.remote}: ${raw}`;
-  if (NOT_FOUND_ERROR_PATTERN.test(lower)) {
-    return {
-      hints: [
-        `Check the template name "${context.templateType}" and the ref "${context.ref}".`,
-        "List/inspect available templates, or target a branch/tag with `--ref <branch>`."
-      ],
-      message: `template "${context.templateType}" not found at ${context.remote}: ${raw}`
-    };
-  }
-  if (NETWORK_ERROR_PATTERN.test(lower)) {
-    return {
-      hints: [
-        "You appear to be offline or unable to reach GitHub.",
-        "To scaffold without a network, point at a local template root: `lunora init --from <dir>`."
-      ],
-      message: genericMessage
-    };
-  }
-  return {
-    hints: ["If this is a network/offline issue, scaffold from a local root with `lunora init --from <dir>`."],
-    message: genericMessage
-  };
-};
-
-const emitStep = async (type, message, answer) => {
-  if (isInteractive()) {
-    await tuiStep(BADGES[type], message, answer);
-    return;
-  }
-  process.stdout.write("\n");
-  if (answer === void 0 || answer === "") {
-    logStep(type, message);
-    return;
-  }
-  const dimmed = answer.split("\n").map((line) => paintAnswer(line)).join("\n");
-  logStep(type, `${message}
-${dimmed}`);
-};
-const emitMascot = async (logger) => {
-  if (isInteractive()) {
-    await tuiMascot();
-    return;
-  }
-  logger.info(`
-${LUNA_ART}
-${LUNA_NAME}: ${LUNA_SIGNOFF}`);
-};
-
-const STACK_FEATURE_OPTIONS = [
-  { description: "Sign-up / sign-in (asks which provider)", label: "Authentication", value: "auth" },
-  { description: "Cloudflare Email Workers + a dev mail catcher", label: "Transactional email", value: "email" },
-  { description: "Typed R2 buckets + signed URLs (@lunora/storage)", label: "File storage", value: "storage" },
-  { description: "Token-bucket / sliding-window limits (@lunora/ratelimit)", label: "Rate limiting", value: "ratelimit" },
-  { description: "Scheduled jobs via Cron Triggers (@lunora/scheduler)", label: "Cron jobs", value: "crons" },
-  { description: "Live presence / who's-online over hibernated WebSockets", label: "Presence", value: "presence" },
-  { description: "Snapshot + restore your Durable Object data", label: "Backups", value: "backup" }
-];
-const STACK_FEATURE_VALUES = STACK_FEATURE_OPTIONS.map((option) => option.value);
-const featureItem = (feature) => feature === "email" ? EMAIL_ITEM : feature;
-const parseFeatureList = (raw, warn) => {
-  const features = [];
-  for (const part of raw.split(",").map((entry) => entry.trim()).filter(Boolean)) {
-    if (STACK_FEATURE_VALUES.includes(part)) {
-      if (!features.includes(part)) {
-        features.push(part);
-      }
-    } else {
-      warn(`init: unknown --add feature "${part}" — expected ${STACK_FEATURE_VALUES.join(" | ")}; skipping.`);
-    }
-  }
-  return features;
-};
-const collectAuthFeature = async (deps) => {
-  const provider = await promptAuthProvider(deps.select);
-  const databaseName = await promptDatabaseName(deps.text, deps.projectName);
-  return { label: "auth", names: [provider], transformManifest: (manifest) => withAuthDatabaseName(manifest, databaseName) };
-};
-const collectEmailFeature = async (deps) => {
-  const answer = await deps.text(MAIL_DESTINATION_PROMPT, { placeholder: "you@yourdomain.com" });
-  const destination = resolveTypedDestination(answer, (message) => {
-    deps.logger.warn(message);
-  });
-  return {
-    label: "email",
-    names: [EMAIL_ITEM],
-    transformManifest: destination === void 0 ? void 0 : (manifest) => withMailDestination(manifest, destination)
-  };
-};
-const collectStorageFeature = async (deps) => {
-  const bucketName = await promptBucketName(deps.text, deps.projectName);
-  return { label: "storage", names: ["storage"], transformManifest: (manifest) => withStorageBucketName(manifest, bucketName) };
-};
-const FEATURE_COLLECTORS = {
-  auth: collectAuthFeature,
-  email: collectEmailFeature,
-  storage: collectStorageFeature
-};
-const offerRegistryExtras = async (deps) => {
-  if (deps.preselected !== void 0 && deps.preselected.length > 0) {
-    await deps.applyAll(
-      deps.preselected.map((feature) => {
-        return { label: feature, names: [featureItem(feature)] };
-      })
-    );
-    return;
-  }
-  if (!deps.interactive) {
-    deps.logger.info("tip: add features later with `lunora add <auth|email|storage|ratelimit|crons|presence|backup>`.");
-    return;
-  }
-  const picked = await deps.multiSelect("Which features do you want to add?", STACK_FEATURE_OPTIONS, { defaults: [] });
-  if (picked.length === 0) {
-    return;
-  }
-  const plans = [];
-  for (const feature of picked) {
-    const collect = FEATURE_COLLECTORS[feature];
-    plans.push(collect ? await collect(deps) : { label: feature, names: [feature] });
-  }
-  await deps.applyAll(plans);
-};
+# Deletes the preview Worker and every resource recorded for it. It installs in the
+# job that holds the preview token, so dependency scripts are switched off: deleting
+# needs none of them.
+preview_delete:
+  extends: .lunora_base
+  before_script:
+${i}
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_SOURCE_PROJECT_ID == $CI_PROJECT_ID
+      when: manual
+  allow_failure: true
+  resource_group: ${oe}
+  environment:
+    name: preview/$CI_MERGE_REQUEST_IID
+    action: stop
+  script:
+    - ${E(e,["preview","delete",'"$CI_MERGE_REQUEST_IID"'])}
 
-const LOGO_PATH = "M 259.500 10.552 C 220.080 15.859, 182.424 32.566, 152.500 58.025 C 110.179 94.031, 85.380 137.183, 77.518 188.500 C 75.410 202.255, 74.569 225.677, 75.796 236.466 C 76.757 244.917, 76.683 245.692, 74.518 249.966 C 63.118 272.466, 53.141 303.876, 51.382 322.799 L 50.718 329.943 71.960 320.471 C 83.643 315.262, 93.326 311, 93.478 311 C 93.630 311, 96.547 316.063, 99.959 322.250 C 103.371 328.438, 107.249 334.850, 108.577 336.500 L 110.990 339.500 110.981 336 C 110.977 334.075, 111.499 324.991, 112.143 315.813 L 113.312 299.127 121.406 293.336 C 132.495 285.403, 149.593 271.554, 161 261.268 C 171.556 251.748, 189.116 235, 188.540 235 C 188.337 235, 183.069 238.648, 176.835 243.106 C 142.318 267.789, 68.537 314, 63.646 314 C 61.843 314, 72.791 281.179, 80.905 262.259 C 92.233 235.845, 107.473 212.389, 132.106 183.453 L 138.451 176 148.268 176 C 176.192 176, 197.512 187.154, 212.868 209.797 C 216.470 215.108, 217.035 216.595, 216.477 219.297 C 211.386 243.968, 202.359 274.496, 193.797 296 C 183.898 320.861, 167.147 352.101, 152.395 373.215 L 147.004 380.930 152.891 385.830 C 161.400 392.911, 165.563 396, 166.594 395.998 C 167.092 395.998, 168.772 391.641, 170.327 386.317 C 176.279 365.934, 188.422 338.749, 200.942 317.778 C 223.060 280.731, 256.432 244.369, 294.500 215.836 C 309.956 204.252, 313.937 201.603, 314.719 202.385 C 315.116 202.783, 315.449 213.096, 315.460 225.304 C 315.474 241.855, 315.021 250.405, 313.680 258.924 C 307.009 301.272, 291.175 336.677, 263.112 372 C 255.259 381.883, 227.182 410.673, 218.516 417.727 L 213.532 421.783 223.439 424.880 C 281.705 443.093, 349.165 436.018, 398.616 406.508 C 446.728 377.797, 483.322 331.466, 497.366 281.481 C 503.381 260.075, 504.480 250.741, 504.491 221 C 504.501 191.997, 503.598 184.047, 497.987 163.732 C 484.768 115.871, 452.505 72.708, 407.718 42.964 C 381.051 25.254, 352.818 14.828, 319.695 10.460 C 305.932 8.645, 273.298 8.695, 259.500 10.552";
-const WELCOME_CSS = `/* The welcome page is a full-bleed starter — reset the browser's default
+# A fork's merge request runs without this project's CI/CD variables, so it
+# runs the deploy pipeline, bundle included, and publishes nothing.
+check:
+  extends: .lunora_base
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_SOURCE_PROJECT_ID != $CI_PROJECT_ID
+  script:
+    - ${E(e,["deploy","--dry-run"])}
+`},Ve={github:{file:Q(".github","workflows","deploy.yml"),secretsHint:"repository secrets (Settings → Secrets and variables → Actions)"},gitlab:{file:".gitlab-ci.yml",secretsHint:"CI/CD variables, Masked and Protected, scoped to the production environment (Settings → CI/CD → Variables)"}},nr=(e,t)=>e==="github"?tr(t):rr(t),ar=e=>e==="github"||e==="gitlab",or=(e,t,r,n={})=>{const a=Q(e,Ve[t].file);return f(a)&&n.overwrite!==!0?{path:a,skipped:!0,written:!1}:(I(_t(a),{recursive:!0}),v(a,nr(t,r),"utf8"),{path:a,skipped:!1,written:!0})},ir=(e,t,r,n,a={})=>{const i=Ve[t];try{const s=or(e,t,r,a);if(s.skipped)n.info(`--ci ${t}: ${i.file} already exists — left unchanged (re-run with overwrite to replace).`);else{const o=Se(r),l=[o.command,...o.args].join(" "),{installCmd:c,lockfile:d}=Z[r];n.success(`--ci ${t}: wrote ${i.file}`),n.info(`--ci ${t}: set CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID as ${i.secretsHint} to enable deploys.`),n.info(`--ci ${t}: run \`${l}\` and commit ${d} before pushing — the pipeline runs \`${c}\`.`)}return s}catch(s){const o=s instanceof Error?s.message:String(s);return n.warn(`--ci ${t}: could not write ${i.file} (${o})`),{path:Q(e,i.file),skipped:!1,written:!1}}},sr={astro:"@lunora/react",none:"@lunora/react",nuxt:"@lunora/vue","react-router":"@lunora/react","solid-start":"@lunora/solid",sveltekit:"@lunora/svelte","tanstack-start":"@lunora/react","tanstack-start-solid":"@lunora/solid",vinext:"@lunora/react"},lr=e=>{const t=ut(e);return{...t,adapter:sr[t.framework]}},N="lunora()",ie='import { lunora } from "@lunora/vite";',cr="@lunora/vite",dr="lunora",ur=e=>{for(const t of e.getStatements()){if(t.getKind()!==b.ExportAssignment)continue;const r=t.asKindOrThrow(b.ExportAssignment).getExpression();if(r.getKind()!==b.CallExpression)continue;const n=r.asKindOrThrow(b.CallExpression);if(n.getExpression().getText()!=="defineConfig")continue;const a=n.getArguments()[0];if(a?.getKind()===b.ObjectLiteralExpression)return a.asKindOrThrow(b.ObjectLiteralExpression)}},hr=e=>{for(const t of e.getStatements()){if(t.getKind()!==b.ExportAssignment)continue;const r=t.asKindOrThrow(b.ExportAssignment).getExpression();if(r.getKind()===b.ObjectLiteralExpression)return r.asKindOrThrow(b.ObjectLiteralExpression)}},pr=e=>e.getDescendantsOfKind(b.CallExpression).some(t=>t.getExpression().getText()===dr),mr=e=>e.getImportDeclarations().some(t=>t.getModuleSpecifierValue()===cr),fr=e=>new Ot({compilerOptions:{allowJs:!0},useInMemoryFileSystem:!0}).createSourceFile("vite.config.ts",e,{overwrite:!0}),vr=(e,t)=>{const r=t.getImportDeclarations().at(-1)?.getEnd()??0;r===0?e.prepend(`${ie}
+`):e.appendLeft(r,`
+${ie}`)},gr=(e,t)=>{const r=t.getProperty("plugins");if(r===void 0){const s=t.getProperties(),o=t.getStart()+1;if(s.length===0){e.appendLeft(o,` plugins: [${N}] `);return}const l=s[0];if(l===void 0)return"could not locate the start of the Vite config object's first property";e.appendLeft(l.getStart(),`plugins: [${N}],
+    `);return}const n=r.getDescendantsOfKind(b.ArrayLiteralExpression)[0];if(n===void 0)return"the Vite config's `plugins` is not an array literal — add `lunora()` to it by hand";const a=n.getElements();if(a.length===0){e.appendLeft(n.getStart()+1,N);return}const i=a[0];if(i===void 0)return"could not locate the first entry of the Vite config's `plugins` array";e.appendLeft(i.getStart(),`${N}, `)},Be=e=>{const t=fr(e);if(pr(t))return{changed:!1,code:e,reason:"lunora plugin already present"};const r=ur(t)??hr(t);if(r===void 0)return{changed:!1,code:e,reason:"could not locate a Vite config plugins array to patch"};const n=new Rt(e);mr(t)||vr(n,t);const a=gr(n,r);return a!==void 0?{changed:!1,code:e,reason:a}:{changed:!0,code:n.toString()}},wr=/enotfound|eai_again|econnrefused|etimedout|network|fetch failed|getaddrinfo/u,yr=/404|not found|could not find|no such/u,br=(e,t)=>{const r=e instanceof Error?e.message:String(e),n=r.toLowerCase(),a=`failed to download template "${t.templateType}" from ${t.remote}: ${r}`;return yr.test(n)?{hints:[`Check the template name "${t.templateType}" and the ref "${t.ref}".`,"List/inspect available templates, or target a branch/tag with `--ref <branch>`."],message:`template "${t.templateType}" not found at ${t.remote}: ${r}`}:wr.test(n)?{hints:["You appear to be offline or unable to reach GitHub.","To scaffold without a network, point at a local template root: `lunora init --from <dir>`."],message:a}:{hints:["If this is a network/offline issue, scaffold from a local root with `lunora init --from <dir>`."],message:a}},Fe=[{description:"No sign-in yet; add it later with `lunora add auth`",label:"None",value:"none"},{description:"Users and sessions in your own D1, via better-auth (@lunora/auth)",label:"Lunora auth",value:"lunora"},{description:"Clerk owns the session; the Worker verifies its session token",label:"Clerk",value:"clerk"},{description:"WorkOS AuthKit owns the session; the Worker verifies its access token",label:"WorkOS AuthKit",value:"workos"},{description:"Auth0 owns the session; the Worker verifies its access token",label:"Auth0",value:"auth0"}],se=Fe.map(e=>e.value),ee={auth0:{clientSnippet:["// @auth0/auth0-react: <Auth0Provider authorizationParams={{ audience: AUTH0_AUDIENCE }} useRefreshTokens>","// const { getAccessTokenSilently, isLoading, user } = useAuth0();","// In a useEffect over [client, getAccessTokenSilently, isLoading, user?.sub]:","if (isLoading) return;","if (!user) return client.setAuthToken(null);","const fetchToken = () => getAccessTokenSilently().catch((error) => {",'    if (["login_required", "missing_refresh_token"].includes(error?.error)) return null; // signed out',"    throw error;","});","return setAuthTokenProvider(client, fetchToken, { subject: user.sub });"].join(`
+`),envVars:["AUTH0_DOMAIN","AUTH0_AUDIENCE"],identity:"auth0Identity",identityFile:"auth0",item:"auth-auth0-jwt"},clerk:{clientSnippet:["// @clerk/react: const { getToken, isLoaded, isSignedIn, userId } = useAuth();","// In a useEffect over [client, getToken, isLoaded, isSignedIn, userId]:","if (!isLoaded) return;","if (!isSignedIn) return client.setAuthToken(null);","return setAuthTokenProvider(client, getToken, { subject: userId });"].join(`
+`),envVars:["CLERK_PUBLISHABLE_KEY","CLERK_AUTHORIZED_PARTIES"],identity:"clerkIdentity",identityFile:"clerk",item:"auth-clerk-jwt"},workos:{clientSnippet:["// @workos-inc/authkit-react: const { getAccessToken, isLoading, user } = useAuth();","// In a useEffect over [client, getAccessToken, isLoading, user?.id]:","if (isLoading) return;","if (!user) return client.setAuthToken(null);","const fetchToken = () => getAccessToken().catch((error) => {","    if (error instanceof LoginRequiredError) return null; // signed out","    throw error;","});","return setAuthTokenProvider(client, fetchToken, { subject: user.id });"].join(`
+`),envVars:["WORKOS_CLIENT_ID"],identity:"workosIdentity",identityFile:"workos",item:"auth-workos-jwt"}},kr=e=>Object.hasOwn(ee,e),xr=(e,t)=>{const r=e.trim().toLowerCase();return se.includes(r)?r:(t(`init: unknown --auth "${e}" — expected ${se.join(" | ")}; skipping auth.`),"none")},Er=["lunora/app.ts","src/app.ts","lunora/server.ts","src/server.ts","src/server/index.ts","src/server/index.tsx","src/index.ts","src/worker.ts"],_r="virtual:lunora/worker",Cr=["lunora.config.ts","lunora.config.mts","lunora.config.js","lunora.config.mjs"],Sr=["src","app","pages","plugins"],Lr=/\.(?:[jt]sx?|svelte|vue)$/u,le=/\n([\t ]*)\.build(?:FrameworkWorker)?\(/uy,Ar=new Set(["(","[","{"]),Ir=new Set([")","]","}"]),Rr=(e,t)=>{const r=e[t];if(r==="/"&&e[t+1]==="/"){const a=e.indexOf(`
+`,t);return a===-1?e.length:a}if(r==="/"&&e[t+1]==="*"){const a=e.indexOf("*/",t+2);return a===-1?e.length:a+2}if(r!=='"'&&r!=="'"&&r!=="`")return t;let n=t+1;for(;n<e.length&&e[n]!==r;)n+=e[n]==="\\"?2:1;return n+1},Or=(e,t)=>{let r=0,n=t;for(;n<e.length;){const a=Rr(e,n);if(a!==n){n=a;continue}const i=e[n]??"";le.lastIndex=n;const s=r===0?le.exec(e)??void 0:void 0;if(s!==void 0)return{at:n,indent:s[1]??"    "};if(r===0&&i===";")return{at:n,indent:"    "};r+=Ar.has(i)?1:0,r-=Ir.has(i)?1:0,n+=1}},Tr=(e,t,r)=>{const n=j(S(u(e,t)),u(e,"lunora","identity",r.identityFile));return`${n.startsWith(".")?n:`./${n}`}.js`},$r=/\bresolveIdentity\b/u,Mr=/^import[^"']*["'][^"'\n]*["'][^\n]*\n/u,Nr=(e,t,r,n)=>{const a=r.indexOf("defineApp<"),i=a===-1?void 0:Or(r,a);if(i===void 0)return;if(r.includes(`${n.identity}(env)`))return{outcome:"already-wired"};if($r.test(r))return{outcome:"has-resolver"};const{at:s,indent:o}=i,l=`
+${o}// Verify the provider's token on every request and feed it into ctx.auth (memoized for 5 s).
+${o}.extend((env) => ({ resolveIdentity: ${n.identity}(env) }))`,c=`import { ${n.identity} } from "${Tr(e,t,n)}";
+`,d=r.lastIndexOf(`
+import `,a),p=d===-1?void 0:Mr.exec(r.slice(d+1)),m=p==null?0:d+1+p[0].length;return{outcome:"wired",patched:r.slice(0,m)+c+r.slice(m,s)+l+r.slice(s)}},Pr=(e,t)=>{for(const r of Er){const n=u(e,r),a=f(n)?Nr(e,r,_(n,"utf8"),t):void 0;if(a?.outcome==="wired"&&v(n,a.patched),a!==void 0)return{file:r,outcome:a.outcome}}},Dr=e=>{const t=Jt(e);return t!==void 0&&Qt(t).parsed?.main===_r},Ur=(e,t)=>{if(!(!Dr(e)||Cr.some(r=>f(u(e,r)))))return v(u(e,"lunora.config.ts"),`import type { AppBuilder, LunoraConfig } from "./lunora/_generated/app";
+import { ${t.identity} } from "./lunora/identity/${t.identityFile}";
+
+export default {
+    // Verify the provider's token on every request and feed it into ctx.auth (memoized for 5 s).
+    app: (app: AppBuilder<object>): AppBuilder<object> => app.extend((env) => ({ resolveIdentity: ${t.identity}(env) })),
+} satisfies LunoraConfig<object>;
+`),"lunora.config.ts"},We=(e,t=0)=>t>3||!f(e)?[]:J(e,{withFileTypes:!0}).flatMap(r=>{const n=u(e,r.name);return r.isDirectory()?r.name==="node_modules"?[]:We(n,t+1):Lr.test(r.name)?[n]:[]}),jr=/(<script\b[^>]*>)([\s\S]*?)<\/script\b[^>]*>/giu,Vr=/\.(?:svelte|vue)$/u,Br=(e,t)=>e.properties.some(r=>(y.isPropertyAssignment(r)||y.isShorthandPropertyAssignment(r))&&r.name.getText(t)==="authTokenOnUpgrade"),ce=e=>{const t=y.createSourceFile("client.tsx",e,y.ScriptTarget.Latest,!0,y.ScriptKind.TSX),r=[],n=s=>{if(Br(s,t))return;const o=s.properties.at(-1);r.push(o===void 0?{at:s.getStart(t)+1,text:" authTokenOnUpgrade: true "}:{at:o.getEnd(),text:", authTokenOnUpgrade: true"})},a=s=>{if(y.isNewExpression(s)&&y.isIdentifier(s.expression)&&s.expression.text==="LunoraClient"){const[o]=s.arguments??[];o!==void 0&&y.isObjectLiteralExpression(o)&&n(o)}else if(y.isCallExpression(s)&&y.isIdentifier(s.expression)&&s.expression.text==="provideLunora"){const[o]=s.arguments;o===void 0?r.push({at:s.getEnd()-1,text:"{ authTokenOnUpgrade: true }"}):y.isObjectLiteralExpression(o)&&n(o)}y.forEachChild(s,a)};if(a(t),r.length===0)return;let i=e;for(const{at:s,text:o}of r.toSorted((l,c)=>c.at-l.at))i=`${i.slice(0,s)}${o}${i.slice(s)}`;return i},Fr=(e,t)=>{if(!Vr.test(e))return ce(t);let r="",n=0;for(const a of t.matchAll(jr)){const[,i="",s=""]=a,o=a.index+i.length,l=ce(s);l!==void 0&&(r+=`${t.slice(n,o)}${l}`,n=o+s.length)}if(n!==0)return`${r}${t.slice(n)}`},Wr=e=>Sr.flatMap(t=>We(u(e,t))).filter(t=>{const r=Fr(t,_(t,"utf8"));return r===void 0?!1:(v(t,r),!0)}),qr=(e,t)=>{const r=u(e,xe),n=u(e,ht),a=f(r)?_(r,"utf8"):"",i=f(n)?_(n,"utf8").split(`
+`):[],s=t.envVars.filter(c=>!a.split(`
+`).some(d=>d.startsWith(`${c}=`)));if(s.length===0)return!1;const o=s.map(c=>i.find(d=>d.startsWith(`${c}=`))??`${c}=`),l=a.length===0||a.endsWith(`
+`)?"":`
+`;return lt(r,`${l}# ${t.item}: the identity provider the Worker verifies tokens from.
+${o.join(`
+`)}
+`),!0},Hr=(e,t,r)=>{const n=ee[t],a=()=>{const o=Ur(e,n);return o===void 0?void 0:{file:o,outcome:"wired"}},i=Pr(e,n)??a();i===void 0?r.warn(`auth: add \`.extend((env) => ({ resolveIdentity: ${n.identity}(env) }))\` to your app builder (lunora.config.ts \`app\` hook or the Worker entry) — ${n.identity} is in lunora/identity/${n.identityFile}.ts.`):i.outcome==="already-wired"?r.info(`auth: ${i.file} already wires ${n.identity}; left as is.`):i.outcome==="has-resolver"?r.warn(`auth: ${i.file} already sets resolveIdentity, so it was left as is. Compose the two: \`resolveIdentity: composeIdentityResolvers([${n.identity}(env), <your resolver>])\` — ${n.identity} is in lunora/identity/${n.identityFile}.ts.`):r.success(`auth: wired ${n.identity} as resolveIdentity in ${i.file}`),qr(e,n)&&r.success(`auth: listed ${n.envVars.join(", ")} in ${xe}`);const s=Wr(e);for(const o of s)r.success(`auth: turned on authTokenOnUpgrade in ${j(e,o)}`);s.length===0&&r.warn("auth: no client construction found to turn on authTokenOnUpgrade; set it on your client by hand"),r.info(`auth: hand the provider's token to Lunora once signed in (setAuthTokenProvider from lunorash/client or @lunora/client):
+${n.clientSnippet}
+Fill in the env vars the item wrote to .dev.vars.`)},U=async(e,t,r)=>{if(k()){await Nt(w[e],t,r);return}if(process.stdout.write(`
+`),r===void 0||r===""){ae(e,t);return}const n=r.split(`
+`).map(a=>vt(a)).join(`
+`);ae(e,`${t}
+${n}`)},Kr=async e=>{if(k()){await Mt();return}e.info(`
+${pt}
+${mt}: ${ft}`)},qe=[{description:"LLMs via Workers AI (summarize, generate, stream)",label:"AI",value:"ai"},{description:"Sign-up / sign-in with @lunora/auth (asks which provider)",label:"Authentication",value:"auth"},{description:"Copy-in auth screens for your framework (sign in/up, reset, 2FA)",label:"Auth UI",value:"auth-ui"},{description:"Snapshot + restore your Durable Object data",label:"Backups",value:"backup"},{description:"Headless browser screenshots + PDFs",label:"Browser rendering",value:"browser"},{description:"Zero Trust identity via Cloudflare Access",label:"Cloudflare Access",value:"cloudflare-access"},{description:"Scheduled jobs via Cron Triggers (@lunora/scheduler)",label:"Cron jobs",value:"crons"},{description:"Cloudflare Email Workers + a dev mail catcher",label:"Transactional email",value:"email"},{description:"OpenFeature feature flags (ctx.flags)",label:"Feature flags",value:"flags"},{description:"External Postgres/MySQL via Hyperdrive",label:"Hyperdrive",value:"hyperdrive"},{description:"Stripe-first payments (checkout, subscription, webhooks)",label:"Payments",value:"payment"},{description:"Live presence / who's-online over hibernated WebSockets",label:"Presence",value:"presence"},{description:"Async message queues (push/pull consumers)",label:"Queues",value:"queue"},{description:"Typed R2 buckets + signed URLs (@lunora/storage)",label:"File storage",value:"storage"},{description:"Durable long-running workflows (step.do, sleep, branch)",label:"Workflows",value:"workflow"}],de=qe.map(e=>e.value),ue=qe.filter(e=>e.value!=="auth"),He=new Set(["auth","auth-ui"]),zr=e=>e==="email"?De:e,Gr=(e,t)=>{const r=[];for(const n of e.split(",").map(a=>a.trim()).filter(Boolean))de.includes(n)?r.includes(n)||r.push(n):t(`init: unknown --add feature "${n}" — expected ${de.join(" | ")}; skipping.`);return r},Ke=e=>e.resolveAuthUiItem===void 0?"auth-ui-react":e.resolveAuthUiItem(),Yr=async e=>{const t=await Kt(e.select),r=await Ue(e.text,e.projectName);return{label:"auth",names:[t],transformManifest:n=>je(n,r)}},Jr=async e=>{const t=await e.text(Wt,{placeholder:"you@yourdomain.com"}),r=qt(t,n=>{e.logger.warn(n)});return{label:"email",names:[De],transformManifest:r===void 0?void 0:n=>Ht(n,r)}},Qr=async(e,t)=>{const r=Ke(e);if(r===void 0){e.logger.error(`init: ${Pe}`);return}if(t)return{label:"auth-ui",names:[r]};const n=await Ue(e.text,e.projectName);return{label:"auth-ui",names:[r],transformManifest:a=>je(a,n)}},Xr=async e=>{const t=await Bt(e.text,e.projectName);return{label:"storage",names:["storage"],transformManifest:r=>Ft(r,t)}},Zr=(e,t)=>{const r=[];let n=!1;for(const a of t){if(a!=="auth-ui"){r.push({label:a,names:[zr(a)]});continue}const i=Ke(e);if(i===void 0){e.logger.error(`init: ${Pe}`),n=!0;continue}r.push({label:a,names:[i]})}return{plans:r,refused:n}},ze=e=>e!==void 0&&kr(e)?{externalAuth:e,label:e,names:[ee[e].item]}:void 0,en={auth:Yr,"auth-ui":async(e,t)=>Qr(e,t.includes("auth")),email:Jr,storage:Xr},tn=async e=>{const t=ze(e.auth),r=e.auth!==void 0&&e.auth!=="lunora",n=new Set(r?(e.preselected??[]).filter(l=>He.has(l)):[]),a=(e.preselected??[]).filter(l=>!n.has(l));for(const l of n)e.logger.warn(`--auth ${String(e.auth)} rules out Lunora auth; ignoring \`${l}\` from --add.`);e.auth==="lunora"&&!a.includes("auth")&&a.unshift("auth");const{plans:i,refused:s}=Zr(e,a);return t!==void 0&&i.unshift(t),await e.applyAll(i)&&!s&&n.size===0},he=async e=>{if(e.preselected!==void 0&&e.preselected.length>0||e.auth!==void 0&&!e.interactive)return tn(e);if(!e.interactive)return e.logger.info("tip: add features later with `lunora add <ai|auth|backup|browser|cloudflare-access|crons|email|flags|hyperdrive|payment|presence|queue|storage|workflow>`."),!0;const t=e.auth??await e.selectAuth("Which auth do you want?",Fe,{default:"none"})??"none",r=ze(t),n=t==="lunora"?ue:ue.filter(o=>!He.has(o.value)),a=await e.multiSelect("Which features do you want to add?",n,{defaults:[]}),i=t==="lunora"&&!a.includes("auth")?["auth",...a]:a;if(i.length===0&&r===void 0)return!0;const s=r===void 0?[]:[r];for(const o of i){const l=en[o],c=l?await l(e,i):{label:o,names:[o]};c!==void 0&&s.push(c)}return await e.applyAll(s),!0},rn=[{description:"Adds an ignores entry to eslint.config.js",label:"ESLint",value:"eslint"},{description:"Writes .prettierignore",label:"Prettier",value:"prettier"},{description:"Adds negated patterns to biome.json",label:"Biome",value:"biome"},{description:"Writes ignorePatterns to .oxlintrc.json",label:"oxlint (oxc)",value:"oxlint"}],nn="Which linter/formatter do you use? We'll tell it to skip Lunora's generated files.",an=async e=>{const t=e.interactive?await e.multiSelect(nn,rn,{defaults:e.detected}):[...e.detected];if(t.length===0)return[];const r=e.apply(t);return Zt(r,e.logger),r},$="M 259.500 10.552 C 220.080 15.859, 182.424 32.566, 152.500 58.025 C 110.179 94.031, 85.380 137.183, 77.518 188.500 C 75.410 202.255, 74.569 225.677, 75.796 236.466 C 76.757 244.917, 76.683 245.692, 74.518 249.966 C 63.118 272.466, 53.141 303.876, 51.382 322.799 L 50.718 329.943 71.960 320.471 C 83.643 315.262, 93.326 311, 93.478 311 C 93.630 311, 96.547 316.063, 99.959 322.250 C 103.371 328.438, 107.249 334.850, 108.577 336.500 L 110.990 339.500 110.981 336 C 110.977 334.075, 111.499 324.991, 112.143 315.813 L 113.312 299.127 121.406 293.336 C 132.495 285.403, 149.593 271.554, 161 261.268 C 171.556 251.748, 189.116 235, 188.540 235 C 188.337 235, 183.069 238.648, 176.835 243.106 C 142.318 267.789, 68.537 314, 63.646 314 C 61.843 314, 72.791 281.179, 80.905 262.259 C 92.233 235.845, 107.473 212.389, 132.106 183.453 L 138.451 176 148.268 176 C 176.192 176, 197.512 187.154, 212.868 209.797 C 216.470 215.108, 217.035 216.595, 216.477 219.297 C 211.386 243.968, 202.359 274.496, 193.797 296 C 183.898 320.861, 167.147 352.101, 152.395 373.215 L 147.004 380.930 152.891 385.830 C 161.400 392.911, 165.563 396, 166.594 395.998 C 167.092 395.998, 168.772 391.641, 170.327 386.317 C 176.279 365.934, 188.422 338.749, 200.942 317.778 C 223.060 280.731, 256.432 244.369, 294.500 215.836 C 309.956 204.252, 313.937 201.603, 314.719 202.385 C 315.116 202.783, 315.449 213.096, 315.460 225.304 C 315.474 241.855, 315.021 250.405, 313.680 258.924 C 307.009 301.272, 291.175 336.677, 263.112 372 C 255.259 381.883, 227.182 410.673, 218.516 417.727 L 213.532 421.783 223.439 424.880 C 281.705 443.093, 349.165 436.018, 398.616 406.508 C 446.728 377.797, 483.322 331.466, 497.366 281.481 C 503.381 260.075, 504.480 250.741, 504.491 221 C 504.501 191.997, 503.598 184.047, 497.987 163.732 C 484.768 115.871, 452.505 72.708, 407.718 42.964 C 381.051 25.254, 352.818 14.828, 319.695 10.460 C 305.932 8.645, 273.298 8.695, 259.500 10.552",O=`/* The welcome page is a full-bleed starter — reset the browser's default
    body margin/padding so it sits flush; everything else is scoped under
    .lunora-welcome (collision-safe). */
 body {
@@ -522,8 +408,7 @@ body {
 .lunora-welcome .lw-foot { text-align: center; padding-top: 26px; font-family: var(--mono); font-size: 11px; letter-spacing: .1em; text-transform: uppercase; color: var(--t-faint); }
 
 @media (prefers-reduced-motion: reduce) { .lunora-welcome * { transition: none !important; } }
-`;
-const REACT_APP = `import { useEffect, useState } from "react";
+`,on=`import { useEffect, useState } from "react";
 
 type Theme = "dark" | "light";
 
@@ -565,7 +450,7 @@ export default function App() {
             <div className="lw-wrap">
                 <div className="brand">
                     <svg viewBox="0 0 543 446" role="img" aria-label="Lunora">
-                        <path d="${LOGO_PATH}" fill="currentColor" fillRule="evenodd" />
+                        <path d="${$}" fill="currentColor" fillRule="evenodd" />
                     </svg>
                     <span className="word">Lunora</span>
                 </div>
@@ -684,8 +569,7 @@ export default function App() {
         </div>
     );
 }
-`;
-const VUE_APP = `<script setup lang="ts">
+`,sn=`<script setup lang="ts">
 import { onMounted, ref } from "vue";
 
 // Default to "dark" for a stable first paint, then reconcile to the OS
@@ -725,7 +609,7 @@ const toggle = (): void => {
         <div class="lw-wrap">
             <div class="brand">
                 <svg viewBox="0 0 543 446" role="img" aria-label="Lunora">
-                    <path d="${LOGO_PATH}" fill="currentColor" fill-rule="evenodd" />
+                    <path d="${$}" fill="currentColor" fill-rule="evenodd" />
                 </svg>
                 <span class="word">Lunora</span>
             </div>
@@ -841,8 +725,7 @@ const toggle = (): void => {
         </div>
     </div>
 </template>
-`;
-const SOLID_APP = `import { createSignal, onMount } from "solid-js";
+`,ln=`import { createSignal, onMount } from "solid-js";
 
 export default function App() {
     // Default to "dark" for a stable first paint, then reconcile to the OS
@@ -882,7 +765,7 @@ export default function App() {
             <div class="lw-wrap">
                 <div class="brand">
                     <svg viewBox="0 0 543 446" role="img" aria-label="Lunora">
-                        <path d="${LOGO_PATH}" fill="currentColor" fill-rule="evenodd" />
+                        <path d="${$}" fill="currentColor" fill-rule="evenodd" />
                     </svg>
                     <span class="word">Lunora</span>
                 </div>
@@ -1001,8 +884,7 @@ export default function App() {
         </div>
     );
 }
-`;
-const SVELTE_APP = `<script lang="ts">
+`,cn=`<script lang="ts">
     import { onMount } from "svelte";
 
     // Default to "dark" for a stable first paint, then reconcile to the OS
@@ -1045,7 +927,7 @@ const SVELTE_APP = `<script lang="ts">
     <div class="lw-wrap">
         <div class="brand">
             <svg viewBox="0 0 543 446" role="img" aria-label="Lunora">
-                <path d="${LOGO_PATH}" fill="currentColor" fill-rule="evenodd" />
+                <path d="${$}" fill="currentColor" fill-rule="evenodd" />
             </svg>
             <span class="word">Lunora</span>
         </div>
@@ -1160,8 +1042,7 @@ const SVELTE_APP = `<script lang="ts">
         <div class="lw-foot">Running on Lunora · Vite + Svelte</div>
     </div>
 </div>
-`;
-const VANILLA_MAIN = `import "./style.css";
+`,dn=`import "./style.css";
 
 import { LunoraClient } from "lunorash/client";
 
@@ -1189,7 +1070,7 @@ const welcomeHtml = \`
     <div class="lw-wrap">
         <div class="brand">
             <svg viewBox="0 0 543 446" role="img" aria-label="Lunora">
-                <path d="${LOGO_PATH}" fill="currentColor" fill-rule="evenodd" />
+                <path d="${$}" fill="currentColor" fill-rule="evenodd" />
             </svg>
             <span class="word">Lunora</span>
         </div>
@@ -1325,13 +1206,10 @@ toggleButton.addEventListener("click", () => {
 // Live demo: the message count of a demo channel re-renders on every delta.
 const count = document.querySelector<HTMLSpanElement>("#lw-count")!;
 
-client.onUpdate(api.messages.list, { channelId: "channel:demo" }, (result) => {
+client.subscribe(api.messages.list, { channelId: "channel:demo" }, (result) => {
     count.textContent = String(result.messages.length);
 });
-`;
-
-const READ_URL = `const url = (import.meta.env.VITE_LUNORA_URL as string | undefined) ?? globalThis.location.origin;`;
-const REACT_MAIN = `import "./index.css";
+`,B="const url = (import.meta.env.VITE_LUNORA_URL as string | undefined) ?? globalThis.location.origin;",un=`import "./index.css";
 
 import { LunoraProvider } from "@lunora/react";
 import { LunoraClient } from "lunorash/client";
@@ -1343,7 +1221,7 @@ import App from "./App.tsx";
 // \`@lunora/vite\` runs the Worker on the same origin as Vite, so default to
 // \`location.origin\`. Point \`VITE_LUNORA_URL\` at a deployed Worker to develop
 // the client against production data.
-${READ_URL}
+${B}
 const client = new LunoraClient({ url });
 
 const root = document.getElementById("root");
@@ -1359,8 +1237,7 @@ createRoot(root).render(
         </LunoraProvider>
     </StrictMode>,
 );
-`;
-const VUE_MAIN = `import "./style.css";
+`,hn=`import "./style.css";
 
 import { createLunora } from "@lunora/vue";
 import { LunoraClient } from "lunorash/client";
@@ -1369,43 +1246,40 @@ import { createApp } from "vue";
 import App from "./App.vue";
 
 // Provide one LunoraClient at the app root via the Vue plugin form.
-${READ_URL}
+${B}
 createApp(App).use(createLunora(new LunoraClient({ url }))).mount("#app");
-`;
-const SOLID_INDEX = `import "./index.css";
+`,pn=`import "./index.css";
 
-import { LunoraContext } from "@lunora/solid";
+import { LunoraProvider } from "@lunora/solid";
 import { LunoraClient } from "lunorash/client";
 import { render } from "solid-js/web";
 
 import App from "./App";
 
-${READ_URL}
+${B}
 const client = new LunoraClient({ url });
 const root = document.getElementById("root");
 
 render(
     () => (
-        <LunoraContext.Provider value={client}>
+        <LunoraProvider client={client}>
             <App />
-        </LunoraContext.Provider>
+        </LunoraProvider>
     ),
     root!,
 );
-`;
-const SVELTE_ROOT = `<script lang="ts">
+`,mn=`<script lang="ts">
     import { setLunoraClient } from "@lunora/svelte";
     import { LunoraClient } from "lunorash/client";
 
     import App from "./App.svelte";
 
-    ${READ_URL}
+    ${B}
     setLunoraClient(new LunoraClient({ url }));
 <\/script>
 
 <App />
-`;
-const SVELTE_MAIN = `import "./app.css";
+`,fn=`import "./app.css";
 
 import { mount } from "svelte";
 
@@ -1415,62 +1289,84 @@ import Root from "./Root.svelte";
 const app = mount(Root, { target: document.getElementById("app")! });
 
 export default app;
-`;
-const ADAPTERS = {
-  react: {
-    adapter: "@lunora/react",
-    createViteTemplate: "react-ts",
-    files: [
-      { contents: REACT_MAIN, path: "src/main.tsx" },
-      { contents: REACT_APP, path: "src/App.tsx" },
-      { contents: WELCOME_CSS, path: "src/index.css" }
-    ],
-    label: "React"
-  },
-  solid: {
-    adapter: "@lunora/solid",
-    createViteTemplate: "solid",
-    files: [
-      { contents: SOLID_INDEX, path: "src/index.tsx" },
-      { contents: SOLID_APP, path: "src/App.tsx" },
-      { contents: WELCOME_CSS, path: "src/index.css" }
-    ],
-    label: "Solid"
-  },
-  svelte: {
-    adapter: "@lunora/svelte",
-    createViteTemplate: "svelte-ts",
-    files: [
-      { contents: SVELTE_ROOT, path: "src/Root.svelte" },
-      { contents: SVELTE_MAIN, path: "src/main.ts" },
-      { contents: SVELTE_APP, path: "src/App.svelte" },
-      { contents: WELCOME_CSS, path: "src/app.css" }
-    ],
-    label: "Svelte"
-  },
-  vanilla: {
-    adapter: "lunorash/client",
-    createViteTemplate: "vanilla-ts",
-    files: [
-      { contents: VANILLA_MAIN, path: "src/main.ts" },
-      { contents: WELCOME_CSS, path: "src/style.css" }
-    ],
-    label: "Vanilla"
-  },
-  vue: {
-    adapter: "@lunora/vue",
-    createViteTemplate: "vue-ts",
-    files: [
-      { contents: VUE_MAIN, path: "src/main.ts" },
-      { contents: VUE_APP, path: "src/App.vue" },
-      { contents: WELCOME_CSS, path: "src/style.css" }
-    ],
-    label: "Vue"
-  }
-};
-const isOverlayFramework = (value) => Object.hasOwn(ADAPTERS, value);
+`,F={react:{adapter:"@lunora/react",createViteTemplate:"react-ts",files:[{contents:un,path:"src/main.tsx"},{contents:on,path:"src/App.tsx"},{contents:O,path:"src/index.css"}],label:"React"},solid:{adapter:"@lunora/solid",createViteTemplate:"solid-ts",files:[{contents:pn,path:"src/index.tsx"},{contents:ln,path:"src/App.tsx"},{contents:O,path:"src/index.css"}],label:"Solid"},svelte:{adapter:"@lunora/svelte",createViteTemplate:"svelte-ts",files:[{contents:mn,path:"src/Root.svelte"},{contents:fn,path:"src/main.ts"},{contents:cn,path:"src/App.svelte"},{contents:O,path:"src/app.css"}],label:"Svelte"},vanilla:{adapter:"lunorash/client",createViteTemplate:"vanilla-ts",files:[{contents:dn,path:"src/main.ts"},{contents:O,path:"src/style.css"}],label:"Vanilla"},vue:{adapter:"@lunora/vue",createViteTemplate:"vue-ts",files:[{contents:hn,path:"src/main.ts"},{contents:sn,path:"src/App.vue"},{contents:O,path:"src/style.css"}],label:"Vue"}},W=e=>Object.hasOwn(F,e),vn=`/**
+ * Rate-limit schema extension + plugin.
+ *
+ * Defines the \`ratelimit_buckets\` table used by \`createDbStore\` for durable,
+ * DO-backed rate limiting. Included automatically in every Lunora project.
+ */
+import type { RateLimitConfigMap } from "lunorash/ratelimit";
+import { createDbStore, RateLimiter } from "lunorash/ratelimit";
+import type { Middleware } from "lunorash/server";
+import { definePlugin, defineSchemaExtension, defineTable, v } from "lunorash/server";
+
+/**
+ * Named limits this app enforces. This is the one place they live — add your own
+ * and reference them by name from \`rateLimit(limiter, "<name>", …)\` (see
+ * \`lunora/messages.ts\`).
+ */
+export const limits = {
+    /** Chat writes: 10 per caller per minute, refilling continuously over 60s. */
+    send: { kind: "token bucket", period: 60_000, rate: 10 },
+} as const satisfies RateLimitConfigMap;
 
-const LUNORA_SCHEMA = `import { defineSchema, defineTable, v } from "lunorash/server";
+/** The limit names you've configured above. */
+export type LimitName = keyof typeof limits;
+
+/**
+ * Build a durable {@link RateLimiter} bound to this request's \`ctx.db\`. State is
+ * persisted in the \`ratelimit_buckets\` table, so limits survive Durable Object
+ * hibernation/eviction and are shared across every call into the same DO. Each
+ * \`get\`→\`set\` runs under the DO input gate, so the read-modify-write is atomic.
+ */
+export const makeRateLimiter = (ctx: { db: unknown }): RateLimiter<LimitName> =>
+    new RateLimiter<LimitName>({
+        config: limits,
+        // The merged table name carries the plugin prefix.
+        store: createDbStore({ db: ctx.db as never, table: "ratelimit_buckets" }),
+    });
+
+/**
+ * Middleware that injects \`ctx.api.ratelimit\` — a per-request limiter helper —
+ * for any procedure that opts in with \`.use(ratelimit.middleware)\`. Convention
+ * (see \`definePlugin\`): helpers hang off \`ctx.api.<key>\`.
+ */
+const middleware: Middleware<{ api?: Record<string, unknown>; db: unknown }, { api: Record<string, unknown>; db: unknown }> = ({ ctx, next }) =>
+    next({
+        ctx: {
+            ...ctx,
+            api: { ...ctx.api, ratelimit: makeRateLimiter(ctx) },
+        },
+    });
+
+/**
+ * The rate-limit plugin: a schema extension (\`ratelimit_buckets\`) + middleware
+ * (\`ctx.api.ratelimit\`). \`lunora/schema.ts\` wires the extension in with
+ * \`.extend(ratelimit.extension)\`; attach the middleware yourself with
+ * \`c.mutation.use(ratelimit.middleware)\`.
+ */
+export const ratelimit = definePlugin("ratelimit", {
+    extension: defineSchemaExtension("ratelimit", {
+        tables: {
+            // Bare name — auto-prefixes to \`ratelimit_buckets\` at merge time.
+            // \`externallyManaged\`: rows are written by \`createDbStore\` (via
+            // \`makeRateLimiter\`), not a discoverable \`ctx.db.insert(...)\`, so the
+            // \`table_without_insert\` advisor correctly skips it.
+            buckets: defineTable({
+                key: v.string(),
+                value: v.number(),
+                ts: v.number(),
+                prev: v.optional(v.number()),
+            })
+                .index("by_key", ["key"])
+                .index("by_ts", ["ts"])
+                .externallyManaged(),
+        },
+    }),
+    middleware,
+});
+`,gn=`import { ratelimit } from "./ratelimit/schema.js";
+import { defineSchema, defineTable, v } from "lunorash/server";
 
 export default defineSchema({
     messages: defineTable({
@@ -1479,25 +1375,40 @@ export default defineSchema({
     })
         .shardBy("channelId")
         .index("by_channel", ["channelId"]),
-});
-`;
-const LUNORA_MESSAGES = `import { RateLimiter, rateLimit } from "@lunora/ratelimit";
+}).extend(ratelimit.extension);
+`,wn=`import { rateLimit } from "lunorash/ratelimit";
 
+import { makeRateLimiter } from "./ratelimit/schema.js";
+import type { MutationCtx } from "#lunora/_generated/server.js";
 import { mutation, query, v } from "#lunora/_generated/server.js";
 
 /**
- * One in-memory limiter so the public \`send\` mutation isn't an open flood target
- * out of the box. The default store is in-memory (per-isolate, resets on
- * eviction) — fine for a starter; run \`lunora add ratelimit\` for the durable,
- * \`ctx.db\`-backed store when you ship to production.
+ * The limiter comes from \`lunora/ratelimit/schema.ts\` — that file owns the named
+ * limits and the durable store, so tuning \`send\` there is what changes this
+ * procedure's budget. Build it from the generated \`MutationCtx\` so
+ * \`rateLimit(limiter, …)\` infers the full procedure context: \`ctx.auth\`/\`ctx.ip\`
+ * in the key callback and a typed \`ctx.db\` in the handler both depend on it.
  */
-const limiter = new RateLimiter({
-    config: {
-        send: { kind: "token bucket", period: 60_000, rate: 30 },
-    },
-});
+const limiter = (ctx: MutationCtx) => makeRateLimiter(ctx);
+
+/**
+ * One bucket per caller, not one bucket for the whole app.
+ *
+ * \`ctx.auth.userId\` is \`null\` until you wire auth (\`lunora registry add auth\`),
+ * so the \`ctx.ip\` fallback is what actually keys the limit in a fresh project.
+ * Keying on \`"anon"\` alone would let one script exhaust the budget for every user.
+ *
+ * \`ctx.ip\` is Cloudflare's server-side \`CF-Connecting-IP\` and is populated ONLY
+ * when the app runs on Cloudflare, where the edge stamps that header over
+ * anything the client sent. Deploy this to another target and \`ctx.ip\` is
+ * \`undefined\` by design — the runtime will not pass on a header the caller can
+ * type — so every anonymous caller falls back to the shared \`"anon"\` bucket.
+ * Off Cloudflare, key on something the caller cannot choose (an API key, a
+ * signed session) before relying on this limit.
+ */
+const byCaller = { key: (ctx: { auth: { userId?: null | string }; ip?: string }): string => ctx.auth.userId ?? ctx.ip ?? "anon" };
 
-export const list = query.input({ channelId: v.string().meta({ schema: { maxLength: 256 } }), limit: v.optional(v.number()) }).query(async ({ args, ctx }) => {
+export const list = query.input({ channelId: v.string().max(256), limit: v.optional(v.number()) }).query(async ({ args, ctx }) => {
     const messages = await ctx.db
         .query("messages")
         .withIndex("by_channel", (q) => q.eq("channelId", args.channelId))
@@ -1507,1030 +1418,90 @@ export const list = query.input({ channelId: v.string().meta({ schema: { maxLeng
 });
 
 export const send = mutation
-    .input({ channelId: v.string().meta({ schema: { maxLength: 256 } }), text: v.string().meta({ schema: { maxLength: 4096 } }) })
-    .use(rateLimit(limiter, "send", { key: (ctx) => ctx.auth.userId ?? "anon" }))
+    .input({ channelId: v.string().max(256), text: v.string().max(4096) })
+    .use(rateLimit(limiter, "send", byCaller))
     .mutation(async ({ args, ctx }) => {
         const id = await ctx.db.insert("messages", { channelId: args.channelId, text: args.text });
 
         return { channelId: args.channelId, id, text: args.text };
     });
-`;
-const SERVER_ENTRY = `import type { ShardNamespaceLike } from "lunorash/runtime";
+`,yn=`import type { ShardNamespaceLike } from "lunorash/runtime";
 
 import { defineApp } from "../lunora/_generated/app.js";
 
 interface Env extends Record<string, unknown> {
+    ADMIN_REVOCATIONS: ShardNamespaceLike;
     SHARD: ShardNamespaceLike;
 }
 
 const app = defineApp<Env>()
     .shard((env) => env.SHARD)
+    .adminRevocations((env) => env.ADMIN_REVOCATIONS)
     .build();
 
 export const ShardDO = app.ShardDO;
+// Records revoked named admin tokens where a restore of the shard cannot rewind them.
+export { AdminRevocationDO } from "../lunora/_generated/adminRevocations.js";
 export default app;
-`;
-const WRANGLER = `{
+`,bn=`{ ${Object.entries(Xt).map(([e,t])=>`${JSON.stringify(e)}: ${JSON.stringify(t)}`).join(", ")} }`,kn=`{
     "$schema": "node_modules/wrangler/config-schema.json",
     "name": "__NAME__",
     "main": "src/server.ts",
-    "compatibility_date": "2026-06-10",
+    "compatibility_date": "2026-10-01",
     "compatibility_flags": ["nodejs_compat"],
     "durable_objects": {
-        "bindings": [{ "name": "SHARD", "class_name": "ShardDO" }],
+        "bindings": [
+            { "name": "SHARD", "class_name": "ShardDO" },
+            { "name": "ADMIN_REVOCATIONS", "class_name": "AdminRevocationDO" },
+        ],
     },
-    "migrations": [{ "tag": "v1", "new_sqlite_classes": ["ShardDO"] }],
-    "observability": { "enabled": true, "head_sampling_rate": 1 },
+    "migrations": [
+        { "tag": "v1", "new_sqlite_classes": ["ShardDO"] },
+        { "tag": "v2", "new_sqlite_classes": ["AdminRevocationDO"] },
+    ],
+    "observability": ${bn},
 }
-`;
-const GITIGNORE_ADDITIONS = [".wrangler", ".env", ".env.*", "!.env.example", ".lunora/", ".lunora-cache", "lunora/_generated"];
-const ENV_EXAMPLE = `# Lunora endpoint for the browser client.
+`,pe=[".wrangler",".env",".env.*","!.env.example",".dev.vars",".dev.vars.*","!.dev.vars.example",".lunora/",".lunora-cache","lunora/_generated"],xn=`# Lunora endpoint for the browser client.
 # Vite statically replaces \`import.meta.env.VITE_LUNORA_URL\` at \`vite dev\` / build.
 # Leave it unset to use the page origin; set it to point at a deployed Worker:
 #
 # VITE_LUNORA_URL=https://my-app.example.workers.dev
-`;
-const COMMON_DEV_DEPENDENCIES = {
-  "@cloudflare/workers-types": "^4.20260611.1",
-  wrangler: "^4.100.0"
-};
-const writeFile = (target, relativePath, contents, written) => {
-  const destination = join$1(target, relativePath);
-  mkdirSync(dirname$1(destination), { recursive: true });
-  writeFileSync(destination, contents, "utf8");
-  written.push(destination);
-};
-const NEWLINE = /\r?\n/;
-const ensureGitignore = (target) => {
-  const path = join$1(target, ".gitignore");
-  const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
-  const missing = GITIGNORE_ADDITIONS.filter((entry) => !existing.split(NEWLINE).includes(entry));
-  if (missing.length === 0) {
-    return;
-  }
-  const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-  writeFileSync(path, `${existing}${prefix}
+`,En={"@cloudflare/workers-types":ne["@cloudflare/workers-types"],wrangler:ne.wrangler},L=(e,t,r,n)=>{const a=u(e,t);I(S(a),{recursive:!0}),v(a,r,"utf8"),n.push(a)},_n=/\r?\n/,Cn=e=>{const t=u(e,".gitignore"),r=f(t)?_(t,"utf8"):"",n=new Set(r.split(_n)),a=pe.filter(o=>!n.has(o));if(a.length===0)return;const i=a.some(o=>!o.startsWith("!"))?[...a.filter(o=>!o.startsWith("!")),...pe.filter(o=>o.startsWith("!"))]:a,s=r.length>0&&!r.endsWith(`
+`)?`
+`:"";v(t,`${r}${s}
 # Lunora
-${missing.join("\n")}
-`, "utf8");
-};
-const isLunoraDep$1 = (name) => name === "lunorash" || name.startsWith("@lunora/");
-const stampRange = (name, range, distTag, versions) => isLunoraDep$1(name) ? versions?.get(name) ?? distTag : range;
-const withDependency = (map, name, range, distTag) => {
-  return { ...map, [name]: stampRange(name, range, distTag) };
-};
-const restampLunora = (map, distTag, versions) => Object.fromEntries(Object.entries(map).map(([name, range]) => [name, stampRange(name, range, distTag, versions)]));
-const patchPackageJson = async (target, name, adapter, distTag) => {
-  const path = join$1(target, "package.json");
-  const parsed = JSON.parse(readFileSync(path, "utf8"));
-  let dependencies = withDependency(parsed.dependencies ?? {}, "lunorash", distTag, distTag);
-  dependencies = withDependency(dependencies, "@lunora/ratelimit", distTag, distTag);
-  if (adapter.adapter.startsWith("@lunora/")) {
-    dependencies = withDependency(dependencies, adapter.adapter, distTag, distTag);
-  }
-  for (const [depName, range] of Object.entries(adapter.extraDependencies ?? {})) {
-    dependencies = withDependency(dependencies, depName, range, distTag);
-  }
-  let devDependencies = withDependency(parsed.devDependencies ?? {}, "@lunora/vite", distTag, distTag);
-  devDependencies = withDependency(devDependencies, "@lunora/studio", distTag, distTag);
-  for (const [depName, range] of Object.entries(COMMON_DEV_DEPENDENCIES)) {
-    devDependencies = withDependency(devDependencies, depName, range, distTag);
-  }
-  const lunoraNames = [...Object.keys(dependencies), ...Object.keys(devDependencies)].filter((depName) => isLunoraDep$1(depName));
-  const versions = await resolveTagVersions(lunoraNames, distTag);
-  parsed.name = name;
-  parsed.imports = { ...parsed.imports, "#lunora/*": "./lunora/*" };
-  parsed.dependencies = restampLunora(dependencies, distTag, versions);
-  parsed.devDependencies = restampLunora(devDependencies, distTag, versions);
-  parsed.scripts = { ...parsed.scripts, codegen: "lunora codegen", deploy: "vite build && lunora deploy" };
-  writeFileSync(path, `${JSON.stringify(parsed, void 0, 4)}
-`, "utf8");
-};
-const patchBaseViteConfig = (target, logger) => {
-  const candidate = ["vite.config.ts", "vite.config.mts", "vite.config.js", "vite.config.mjs"].map((file) => join$1(target, file)).find((path) => existsSync(path));
-  if (candidate === void 0) {
-    logger.warn("overlay: no vite.config found in the create-vite base — add `lunora()` to your Vite plugins manually.");
-    return;
-  }
-  const result = patchViteConfig(readFileSync(candidate, "utf8"));
-  if (result.changed) {
-    writeFileSync(candidate, result.code, "utf8");
-  }
-};
-const applyLunoraOverlay = async (options) => {
-  const { adapter, distTag, logger, name, target } = options;
-  const written = [];
-  writeFile(target, join$1("lunora", "schema.ts"), LUNORA_SCHEMA, written);
-  writeFile(target, join$1("lunora", "messages.ts"), LUNORA_MESSAGES, written);
-  writeFile(target, join$1("src", "server.ts"), SERVER_ENTRY, written);
-  writeFile(target, "wrangler.jsonc", WRANGLER.replaceAll("__NAME__", name), written);
-  writeFile(target, ".env.example", ENV_EXAMPLE, written);
-  for (const file of adapter.files) {
-    writeFile(target, file.path, file.contents, written);
-  }
-  patchBaseViteConfig(target, logger);
-  await patchPackageJson(target, name, adapter, distTag);
-  ensureGitignore(target);
-  return written;
-};
-
-const ADJECTIVES = [
-  "lunar",
-  "silver",
-  "silent",
-  "waning",
-  "waxing",
-  "crescent",
-  "cosmic",
-  "stellar",
-  "orbital",
-  "gibbous",
-  "twilight",
-  "midnight",
-  "shimmering",
-  "drifting",
-  "weightless"
-];
-const NOUNS = [
-  "moon",
-  "tide",
-  "crater",
-  "comet",
-  "eclipse",
-  "halo",
-  "orbit",
-  "nebula",
-  "voyager",
-  "lander",
-  "rover",
-  "beacon",
-  "harbor",
-  "meadow",
-  "fox"
-];
-const pick = (items) => (
-  // eslint-disable-next-line sonarjs/pseudo-random -- cosmetic default project name, not a security decision.
-  items[Math.floor(Math.random() * items.length)]
-);
-const generateProjectName = () => `${pick(ADJECTIVES)}-${pick(NOUNS)}`;
-
-const isOnline = async () => dns.lookup("github.com").then(
-  () => true,
-  () => false
-);
-const GITHUB_SOURCE = /^(?:gh|github):([^/]+)\/([^#/]+)(?:\/[^#]*)?(?:#(.+))?$/;
-const parseGitHubSource = (source) => {
-  const match = GITHUB_SOURCE.exec(source);
-  if (match === null) {
-    return void 0;
-  }
-  const [, owner, repo, ref] = match;
-  if (owner === void 0 || repo === void 0) {
-    return void 0;
-  }
-  return { owner, ref: ref ?? "HEAD", repo };
-};
-const templateRefExists = async (source) => {
-  const parsed = parseGitHubSource(source);
-  if (parsed === void 0) {
-    return void 0;
-  }
-  const url = `https://codeload.github.com/${parsed.owner}/${parsed.repo}/tar.gz/${parsed.ref}`;
-  try {
-    const response = await fetch(url, { method: "HEAD" });
-    if (response.status === 404) {
-      return false;
-    }
-    return response.ok ? true : void 0;
-  } catch {
-    return void 0;
-  }
-};
-const verifyRemoteTemplate = async (params) => {
-  if (params.isLocal) {
-    return true;
-  }
-  const isGitHubBacked = params.source === void 0 || parseGitHubSource(params.source) !== void 0;
-  if (!isGitHubBacked) {
-    return true;
-  }
-  if (!await isOnline()) {
-    params.logger.error("you appear to be offline — connect to the internet and try again, or scaffold from a local template with `--from <dir>`.");
-    return false;
-  }
-  if (params.source !== void 0 && await templateRefExists(params.source) === false) {
-    params.logger.error(`template source not found: ${params.source} — double-check --ref / --source, or browse the templates at https://lunora.sh/docs.`);
-    return false;
-  }
-  return true;
-};
-
-const COPY = {
-  extras: "Let's finish setting up your app.",
-  framework: "Which framework should we launch?",
-  git: "Initialize a new git repository? (optional)",
-  install: "Install dependencies now?",
-  name: "Where should we land your project?",
-  nextHeader: "Liftoff confirmed — explore your project!",
-  packageManager: "Which package manager?"
-};
-const TEXT_EXTENSIONS = /* @__PURE__ */ new Set([".gitignore", ".html", ".js", ".json", ".jsonc", ".md", ".mjs", ".ts", ".tsx"]);
-const VITE_CONFIG_CANDIDATES = ["vite.config.ts", "vite.config.mts", "vite.config.js", "vite.config.mjs"];
-const MINIMAL_VITE_CONFIG = `import { defineConfig } from "vite";
+${i.join(`
+`)}
+`,"utf8")},q=e=>e==="lunorash"||e.startsWith("@lunora/"),Sn=(e,t,r,n)=>q(e)?n.get(e)??r:t,A=(e,t,r)=>({...e,[t]:r}),me=(e,t,r)=>Object.fromEntries(Object.entries(e).map(([n,a])=>[n,Sn(n,a,t,r)])),Ln=async(e,t,r,n)=>{const a=u(e,"package.json"),i=bt(a);let s=A(i.dependencies??{},"lunorash",n);s=A(s,"@lunora/ratelimit",n),r.adapter.startsWith("@lunora/")&&(s=A(s,r.adapter,n));for(const[d,p]of Object.entries(r.extraDependencies??{}))s=A(s,d,p);let o=A(i.devDependencies??{},"@lunora/vite",n);o=A(o,"@lunora/studio",n);for(const[d,p]of Object.entries(En))o=A(o,d,p);const l=[...Object.keys(s),...Object.keys(o)].filter(d=>q(d)),c=await Le(l,n);i.name=t,i.imports={...i.imports,"#lunora/*":"./lunora/*"},i.dependencies=me(s,n,c),i.devDependencies=me(o,n,c),i.scripts={...i.scripts,codegen:"lunora codegen",deploy:"lunora deploy"},v(a,`${JSON.stringify(i,void 0,4)}
+`,"utf8")},An=["vite.config.ts","vite.config.mts","vite.config.js","vite.config.mjs"],Ge=e=>An.map(t=>u(e,t)).find(t=>f(t)),In=(e,t)=>{const r=Ge(e);if(r===void 0){t.warn("overlay: no vite.config found in the create-vite base — add `lunora()` to your Vite plugins manually.");return}const n=Be(_(r,"utf8"));n.changed&&v(r,n.code,"utf8")},Rn=async e=>{const{adapter:t,distTag:r,logger:n,name:a,target:i}=e,s=[];L(i,u("lunora","ratelimit","schema.ts"),vn,s),L(i,u("lunora","schema.ts"),gn,s),L(i,u("lunora","messages.ts"),wn,s),L(i,u("src","server.ts"),yn,s),L(i,"wrangler.jsonc",kn.replaceAll("__NAME__",a),s),L(i,".env.example",xn,s);for(const o of t.files)L(i,o.path,o.contents,s);return In(i,n),await Ln(i,a,t,r),Cn(i),s},On=["lunar","silver","silent","waning","waxing","crescent","cosmic","stellar","orbital","gibbous","twilight","midnight","shimmering","drifting","weightless"],Tn=["moon","tide","crater","comet","eclipse","halo","orbit","nebula","voyager","lander","rover","beacon","harbor","meadow","fox"],fe=e=>e[Math.floor(Math.random()*e.length)],$n=()=>`${fe(On)}-${fe(Tn)}`,Mn=async()=>er.lookup("github.com").then(()=>!0,()=>!1),Nn=/^(?:gh|github):([^/]+)\/([^#/]+)(?:\/[^#]*)?(?:#(.+))?$/,Ye=e=>{const t=Nn.exec(e);if(t===null)return;const[,r,n,a]=t;if(!(r===void 0||n===void 0))return{owner:r,ref:a??"HEAD",repo:n}},Pn=async e=>{const t=Ye(e);if(t===void 0)return;const r=`https://codeload.github.com/${t.owner}/${t.repo}/tar.gz/${t.ref}`;try{const n=await fetch(r,{method:"HEAD"});return n.status===404?!1:n.ok?!0:void 0}catch{return}},Je=async e=>e.isLocal||!(e.source===void 0||Ye(e.source)!==void 0)?!0:await Mn()?e.source!==void 0&&await Pn(e.source)===!1?(e.logger.error(`template source not found: ${e.source} — double-check --ref / --source, or browse the templates at https://lunora.sh/docs.`),!1):!0:(e.logger.error("you appear to be offline — connect to the internet and try again, or scaffold from a local template with `--from <dir>`."),!1),C={extras:"Let's finish setting up your app.",framework:"Which framework should we launch?",git:"Initialize a new git repository? (optional)",install:"Install dependencies now?",name:"Where should we land your project?",nextHeader:"Liftoff confirmed — explore your project!",packageManager:"Which package manager?"},Dn=new Set([".gitignore",".html",".js",".json",".jsonc",".md",".mjs",".ts",".tsx"]),Un=`import { defineConfig } from "vite";
 import { lunora } from "@lunora/vite";
 
 export default defineConfig({ plugins: [lunora()] });
-`;
-const SAMPLE_SCHEMA = `import { defineSchema, defineTable, v } from "@lunora/server";
+`,jn=`import { defineSchema, defineTable, v } from "@lunora/server";
 
 export default defineSchema({
     messages: defineTable({
-        channelId: v.id("channels"),
+        channelId: v.string(),
         text: v.string(),
     })
         .shardBy("channelId")
         .index("by_channel", ["channelId"]),
 });
-`;
-const SAMPLE_FUNCTION = `import { mutation, query, v } from "./_generated/server";
+`,Vn=`import { mutation, query, v } from "./_generated/server";
 
 export const list = query
-    .input({ channelId: v.id("channels"), limit: v.optional(v.number()) })
+    .input({ channelId: v.string(), limit: v.optional(v.number()) })
     .query(async ({ args }) => {
         return { channelId: args.channelId, limit: args.limit ?? 50, messages: [] };
     });
 
 export const send = mutation
-    .input({ channelId: v.id("channels"), text: v.string() })
+    .input({ channelId: v.string(), text: v.string() })
     .mutation(async ({ args }) => {
         return { channelId: args.channelId, text: args.text };
     });
-`;
-const DEFAULT_SOURCE_BASE = "gh:anolilab/lunora/templates";
-const isTextFile = (filePath) => {
-  const lastDot = filePath.lastIndexOf(".");
-  if (lastDot === -1) {
-    return false;
-  }
-  return TEXT_EXTENSIONS.has(filePath.slice(lastDot));
-};
-const substitute = (content, name) => content.replaceAll("{{name}}", name);
-const isLunoraDep = (name) => name === "lunorash" || name.startsWith("@lunora/");
-const resolveLunoraVersions = async (files, distTag) => {
-  const names = /* @__PURE__ */ new Set();
-  for (const file of files) {
-    if (basename(file) !== "package.json") {
-      continue;
-    }
-    try {
-      const parsed = JSON.parse(readFileSync(file, "utf8"));
-      for (const section of ["dependencies", "devDependencies"]) {
-        for (const name of Object.keys(parsed[section] ?? {})) {
-          if (isLunoraDep(name)) {
-            names.add(name);
-          }
-        }
-      }
-    } catch {
-    }
-  }
-  return resolveTagVersions(names, distTag);
-};
-const stampLunoraDeps = (packageJsonText, distTag, versions) => {
-  let parsed;
-  try {
-    parsed = JSON.parse(packageJsonText);
-  } catch {
-    return packageJsonText;
-  }
-  let text = packageJsonText;
-  for (const section of ["dependencies", "devDependencies"]) {
-    for (const name of Object.keys(parsed[section] ?? {})) {
-      if (!isLunoraDep(name)) {
-        continue;
-      }
-      const pin = versions.get(name) ?? distTag;
-      const edits = modify(text, [section, name], pin, { formattingOptions: { insertSpaces: true, tabSize: 4 } });
-      text = applyEdits(text, edits);
-    }
-  }
-  return text;
-};
-const PNPM_BUILT_DEPENDENCIES = ["esbuild", "sharp", "workerd"];
-const PNPM_WORKSPACE_FILENAME = "pnpm-workspace.yaml";
-const pnpmWorkspaceYaml = () => [
-  "# pnpm reads its settings from here (the package.json `pnpm` field is no longer read).",
-  "# Pre-approve the toolchain's native build scripts so `pnpm install` runs them",
-  "# without the interactive `pnpm approve-builds` step.",
-  "allowBuilds:",
-  ...PNPM_BUILT_DEPENDENCIES.map((name) => `    ${name}: true`),
-  ""
-].join("\n");
-const collectFiles = (directory) => {
-  const out = [];
-  for (const entry of walkSync(directory, { includeDirs: false, includeFiles: true })) {
-    out.push(entry.path);
-  }
-  return out;
-};
-const copyTemplate = async (sourceDirectory, target, name) => {
-  const files = collectFiles(sourceDirectory);
-  const written = [];
-  const distTag = resolveDistTag();
-  const versions = await resolveLunoraVersions(files, distTag);
-  for (const source of files) {
-    const relativePath = relative(sourceDirectory, source);
-    const destination = join$1(target, relativePath);
-    mkdirSync(dirname$1(destination), { recursive: true });
-    const raw = readFileSync(source);
-    let text = isTextFile(source) ? substitute(raw.toString("utf8"), name) : void 0;
-    if (text !== void 0 && basename(source) === "package.json") {
-      text = stampLunoraDeps(text, distTag, versions);
-    }
-    if (text === void 0) {
-      writeFileSync(destination, raw);
-    } else {
-      writeFileSync(destination, text, "utf8");
-    }
-    written.push(destination);
-  }
-  return written;
-};
-const resolveTemplateSource = (templateType, source, ref) => {
-  if (source !== void 0 && source.length > 0) {
-    return source;
-  }
-  return `${DEFAULT_SOURCE_BASE}/${templateType}#${resolveSourceRef(ref)}`;
-};
-const isSafeSource = (source) => {
-  if (source.includes("..")) {
-    return false;
-  }
-  return source.startsWith("gh:") || source.startsWith("github:") || source.startsWith("https://");
-};
-const logWould = (logger, action) => {
-  logger.info(`[dry-run] would ${action}`);
-};
-const logScaffoldSuccess = (logger, written, target) => {
-  if (isInteractive()) {
-    process.stdout.write("\n");
-  }
-  logger.success(`scaffolded ${String(written.length)} files into ${target}`);
-};
-const runScriptCommand = (manager, script) => {
-  if (manager === "npm") {
-    return `npm run ${script}`;
-  }
-  if (manager === "bun") {
-    return `bun run ${script}`;
-  }
-  return `${manager} ${script}`;
-};
-const isInsideMonorepo = (startDirectory) => {
-  let directory = resolve(startDirectory);
-  for (; ; ) {
-    if (existsSync(join$1(directory, "pnpm-workspace.yaml"))) {
-      return true;
-    }
-    const packagePath = join$1(directory, "package.json");
-    if (existsSync(packagePath)) {
-      try {
-        const parsed = JSON.parse(readFileSync(packagePath, "utf8"));
-        if (parsed.workspaces !== void 0) {
-          return true;
-        }
-      } catch {
-      }
-    }
-    const parent = dirname$1(directory);
-    if (parent === directory) {
-      return false;
-    }
-    directory = parent;
-  }
-};
-const isInsideGitRepo = (startDirectory) => {
-  let directory = resolve(startDirectory);
-  for (; ; ) {
-    if (existsSync(join$1(directory, ".git"))) {
-      return true;
-    }
-    const parent = dirname$1(directory);
-    if (parent === directory) {
-      return false;
-    }
-    directory = parent;
-  }
-};
-const maybeOfferGit = async (options, target) => {
-  if (options.yes === true || !isInteractive() || isInsideGitRepo(dirname$1(target))) {
-    return;
-  }
-  if (!await tuiConfirm(COPY.git, { badge: BADGES.git, defaultYes: false })) {
-    await tuiInfo("Sounds good! You can always run git init manually.");
-    return;
-  }
-  if (options.dryRun === true) {
-    logWould(options.logger, "initialize a git repository");
-    return;
-  }
-  const spawner = options.spawner ?? defaultSpawner;
-  const result = await withTuiSpinner("Initializing a git repository…", () => spawner({ args: ["init"], command: "git", cwd: target }));
-  if (result.code === 0) {
-    await emitStep("git", "Initialized an empty git repository.");
-  } else {
-    options.logger.warn("`git init` failed — initialize it yourself later with `git init`.");
-  }
-};
-const printNextSteps = async (name, installed, insideMonorepo) => {
-  const manager = installed ?? "pnpm";
-  const steps = [{ code: `cd ./${name}`, lead: "Enter your project directory using" }];
-  if (installed === void 0) {
-    steps.push({ code: `${manager} install`, lead: "Install dependencies with", tail: insideMonorepo ? " from the workspace root" : void 0 });
-  }
-  steps.push(
-    { code: runScriptCommand(manager, "dev"), lead: "Run", tail: " to start the dev server." },
-    { code: "lunora add", lead: "Add features like auth or storage using" }
-  );
-  const help = [
-    { code: "https://lunora.sh/docs", lead: "Read the docs at" },
-    { code: "https://lunora.sh/chat", lead: "Stuck? Join the chat at" }
-  ];
-  if (isInteractive()) {
-    await tuiNextSteps(BADGES.next, COPY.nextHeader, steps, help);
-    return;
-  }
-  const lines = steps.map((step) => `${step.lead} ${step.code}${step.tail ?? ""}`);
-  lines.push("", ...help.map((line) => `${line.lead} ${line.code}${line.tail ?? ""}`));
-  await emitStep("next", COPY.nextHeader, lines.join("\n"));
-};
-const offerInstallIsInteractive = (options) => options.yes !== true && (options.installPrompt !== void 0 || isInteractive());
-const maybeOfferInstall = async (options, target) => {
-  if (!offerInstallIsInteractive(options)) {
-    return void 0;
-  }
-  if (isInsideMonorepo(dirname$1(target))) {
-    return void 0;
-  }
-  const managers = detectInstalledManagers(options.packageManagerProbe);
-  const [defaultManager] = managers;
-  if (defaultManager === void 0) {
-    return void 0;
-  }
-  const confirm = options.installPrompt?.confirmInstall ?? (async () => tuiConfirm(COPY.install, { badge: BADGES.deps, defaultYes: true }));
-  if (!await confirm()) {
-    await tuiInfo("No problem! Remember to install dependencies after setup.");
-    return void 0;
-  }
-  let manager = defaultManager;
-  if (managers.length > 1) {
-    manager = options.installPrompt ? await options.installPrompt.selectManager(managers) : await tuiSelect(
-      COPY.packageManager,
-      managers.map((candidate) => {
-        return { label: candidate, value: candidate };
-      }),
-      { badge: BADGES.deps, default: defaultManager }
-    ) ?? defaultManager;
-  }
-  if (options.dryRun === true) {
-    logWould(options.logger, `install dependencies with ${manager}`);
-    return void 0;
-  }
-  if (manager === "pnpm") {
-    const workspacePath = join$1(target, PNPM_WORKSPACE_FILENAME);
-    if (!existsSync(workspacePath)) {
-      writeFileSync(workspacePath, pnpmWorkspaceYaml(), "utf8");
-    }
-  }
-  const spawner = options.spawner ?? defaultSpawner;
-  const { args, command } = installArgsFor(manager);
-  await emitStep("deps", `Installing dependencies with ${manager}…`);
-  const result = await spawner({ args, command, cwd: target });
-  if (result.code !== 0) {
-    options.logger.warn(`\`${command} install\` exited with code ${String(result.code)} — run it yourself in ${basename(target)}/.`);
-    return void 0;
-  }
-  await emitStep("deps", `Dependencies installed with ${manager}.`);
-  return manager;
-};
-const scaffoldFromLocal = async (fromRoot, templateType, target, name, logger) => {
-  const templateDirectory = join$1(fromRoot, templateType);
-  if (!existsSync(templateDirectory)) {
-    logger.error(`template not found in local source: ${templateDirectory}`);
-    return { code: 1, files: [], target };
-  }
-  const written = await copyTemplate(templateDirectory, target, name);
-  logScaffoldSuccess(logger, written, target);
-  return { code: 0, files: written, target };
-};
-const scaffoldFromRemote = async (options) => {
-  const { logger, name, ref, source, target, templateType } = options;
-  const stagingRoot = mkdtempSync(join$1(tmpdir(), "lunora-init-fetch-"));
-  const stagingDirectory = join$1(stagingRoot, "template");
-  try {
-    const remote = resolveTemplateSource(templateType, source, ref);
-    let downloaded;
-    let written = [];
-    await tuiTasks(
-      [
-        {
-          label: `${templateType} template fetched`,
-          run: async () => {
-            downloaded = await downloadTemplate(remote, {
-              cwd: stagingRoot,
-              dir: stagingDirectory,
-              force: true,
-              install: false,
-              silent: true
-            });
-          }
-        },
-        {
-          label: `files copied into ${name}/`,
-          run: async () => {
-            written = await copyTemplate(stagingDirectory, target, name);
-          }
-        }
-      ],
-      { end: "Project initialized!", start: "Project initializing…" }
-    );
-    const staged = collectFiles(stagingDirectory);
-    if (isInteractive()) {
-      process.stdout.write("\n");
-    }
-    logger.info(
-      downloaded?.commit ? `template: ${downloaded.source} @ ${downloaded.commit} (${String(staged.length)} files)` : `template: ${downloaded?.source ?? remote} (${String(staged.length)} files)`
-    );
-    logScaffoldSuccess(logger, written, target);
-    return { code: 0, files: written, target };
-  } catch (error) {
-    if (error instanceof PromptCancelledError) {
-      throw error;
-    }
-    const { hints, message } = describeDownloadFailure(error, {
-      ref: resolveSourceRef(ref),
-      remote: resolveTemplateSource(templateType, source, ref),
-      templateType
-    });
-    logger.error(message);
-    for (const hint of hints) {
-      logger.warn(hint);
-    }
-    return { code: 1, files: [], target };
-  } finally {
-    rmSync(stagingRoot, { force: true, recursive: true });
-  }
-};
-const renameCreateViteDotfiles = (directory) => {
-  for (const file of ["_gitignore", "_npmrc", "_gitattributes"]) {
-    const from = join$1(directory, file);
-    if (existsSync(from)) {
-      renameSync(from, join$1(directory, `.${file.slice(1)}`));
-    }
-  }
-};
-const scaffoldViteOverlay = async (options) => {
-  const { framework, logger, name, overlayBaseFrom, target } = options;
-  const adapter = ADAPTERS[framework];
-  const stagingRoot = mkdtempSync(join$1(tmpdir(), "lunora-vite-base-"));
-  try {
-    let localBase;
-    if (overlayBaseFrom !== void 0) {
-      localBase = join$1(overlayBaseFrom, `template-${adapter.createViteTemplate}`);
-      if (!existsSync(localBase)) {
-        logger.error(`create-vite base not found on disk: ${localBase}`);
-        return { code: 1, files: [], target };
-      }
-    }
-    const copyBase = async () => {
-      if (localBase !== void 0) {
-        cpSync(localBase, target, { recursive: true });
-        return;
-      }
-      const stagingDirectory = join$1(stagingRoot, "base");
-      const remote = `github:vitejs/vite/packages/create-vite/template-${adapter.createViteTemplate}#main`;
-      await downloadTemplate(remote, { cwd: stagingRoot, dir: stagingDirectory, force: true, install: false, silent: true });
-      renameCreateViteDotfiles(stagingDirectory);
-      cpSync(stagingDirectory, target, { recursive: true });
-    };
-    let written = [];
-    await tuiTasks(
-      [
-        { label: `create-vite (${adapter.label}) base ready`, run: copyBase },
-        {
-          label: `Lunora overlay applied (${adapter.label})`,
-          run: async () => {
-            written = await applyLunoraOverlay({ adapter, distTag: resolveDistTag(), logger, name, target });
-          }
-        }
-      ],
-      { end: "Project initialized!", start: "Project initializing…" }
-    );
-    logScaffoldSuccess(logger, written, target);
-    return { code: 0, files: [...collectFiles(target)], target };
-  } catch (error) {
-    if (error instanceof PromptCancelledError) {
-      throw error;
-    }
-    const message = error instanceof Error ? error.message : String(error);
-    logger.error(`failed to scaffold the ${adapter.label} base: ${message}`);
-    return { code: 1, files: [], target };
-  } finally {
-    rmSync(stagingRoot, { force: true, recursive: true });
-  }
-};
-const createMinimalViteConfig = (cwd, logger) => {
-  const target = join$1(cwd, "vite.config.ts");
-  try {
-    writeFileSync(target, MINIMAL_VITE_CONFIG, "utf8");
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    logger.error(`init --in-place: could not write ${target}: ${message}`);
-    return { code: 1, files: [], target: cwd };
-  }
-  logger.success(`created ${target} with lunora() plugin`);
-  return { code: 0, files: [target], target: cwd };
-};
-const patchExistingViteConfig = (viteConfigPath, cwd, logger) => {
-  let source;
-  try {
-    source = readFileSync(viteConfigPath, "utf8");
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    logger.error(`init --in-place: could not read ${viteConfigPath}: ${message}`);
-    return { code: 1, files: [], target: cwd };
-  }
-  const result = patchViteConfig(source);
-  if (!result.changed) {
-    logger.info(`${viteConfigPath}: ${result.reason ?? "no changes needed"}`);
-    return { code: 0, files: [], target: cwd };
-  }
-  try {
-    writeFileSync(viteConfigPath, result.code, "utf8");
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    logger.error(`init --in-place: could not write ${viteConfigPath}: ${message}`);
-    return { code: 1, files: [], target: cwd };
-  }
-  logger.success(`patched ${viteConfigPath} — added lunora() plugin`);
-  return { code: 0, files: [viteConfigPath], target: cwd };
-};
-const scaffoldLunoraDirectory = (cwd, logger) => {
-  const lunoraDirectory = join$1(cwd, "lunora");
-  const schemaPath = join$1(lunoraDirectory, "schema.ts");
-  if (existsSync(schemaPath)) {
-    logger.info(`lunora/ already present — left ${schemaPath} untouched`);
-    return [];
-  }
-  const written = [];
-  try {
-    mkdirSync(lunoraDirectory, { recursive: true });
-    writeFileSync(schemaPath, SAMPLE_SCHEMA, "utf8");
-    written.push(schemaPath);
-    const functionPath = join$1(lunoraDirectory, "messages.ts");
-    if (!existsSync(functionPath)) {
-      writeFileSync(functionPath, SAMPLE_FUNCTION, "utf8");
-      written.push(functionPath);
-    }
-    logger.success(`scaffolded lunora/ (${String(written.length)} file(s))`);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    logger.error(`init --here: could not scaffold lunora/: ${message}`);
-  }
-  return written;
-};
-const printFrameworkNextSteps = (detection, logger) => {
-  const { adapter, class: frameworkClass, framework } = detection;
-  logger.info("");
-  logger.info(`detected framework: ${framework} (class ${frameworkClass})`);
-  logger.info("next steps:");
-  logger.info(`  1. install the adapter:  pnpm add ${adapter} @lunora/client @lunora/runtime @lunora/server`);
-  logger.info("  2. run codegen:          lunora codegen");
-  if (frameworkClass === "A") {
-    logger.info("  3. compose one worker:   wrap your worker entry with");
-    logger.info("       createWorker({ httpRouter: <your framework SSR handler>, shardDO: ShardDO, ... })");
-    logger.info(`  4. add the provider:     mount the ${adapter} provider in your root layout/route`);
-    logger.info("  5. make a loader live:   preloadQuery() in a loader, usePreloadedQuery() in the component");
-    logger.info("     see https://lunora.sh/docs/frameworks/reactive-loaders");
-  } else if (frameworkClass === "B") {
-    logger.info("  3. inject Lunora:        mount Lunora realtime under /_lunora/* in your server hook");
-    logger.info(`       (${framework} owns its Cloudflare adapter — Lunora composes into its server entry)`);
-    logger.info(`  4. add the provider:     mount the ${adapter} provider in your root layout`);
-    logger.info("  5. read the guide:       https://lunora.sh/docs/frameworks/deploy");
-  } else {
-    logger.info("  3. add the provider:     wrap your app with the LunoraProvider from @lunora/react");
-    logger.info("  4. read the guide:       https://lunora.sh/docs/frameworks/bring-your-framework");
-  }
-  logger.info("");
-};
-const findExistingViteConfig = (cwd) => {
-  for (const candidate of VITE_CONFIG_CANDIDATES) {
-    const full = join$1(cwd, candidate);
-    if (existsSync(full)) {
-      return full;
-    }
-  }
-  return void 0;
-};
-const patchOrCreateViteConfig = (cwd, framework, logger) => {
-  const viteConfigPath = findExistingViteConfig(cwd);
-  if (viteConfigPath === void 0) {
-    if (framework === "sveltekit" || framework === "nuxt" || framework === "astro") {
-      logger.info(`no Vite config found — ${framework} wires Lunora through its server entry (see next steps)`);
-      return { code: 0, files: [], target: cwd };
-    }
-    return createMinimalViteConfig(cwd, logger);
-  }
-  return patchExistingViteConfig(viteConfigPath, cwd, logger);
-};
-const runInPlaceInit = (cwd, logger) => {
-  const detection = detectFramework(cwd);
-  const viteResult = patchOrCreateViteConfig(cwd, detection.framework, logger);
-  if (viteResult.code !== 0) {
-    return viteResult;
-  }
-  const scaffolded = scaffoldLunoraDirectory(cwd, logger);
-  printFrameworkNextSteps(detection, logger);
-  return { code: 0, files: [...viteResult.files, ...scaffolded], target: cwd };
-};
-const offerIsInteractive = (options) => options.yes !== true && (options.prompt !== void 0 || (options.interactive ?? isInteractive()));
-const maybeOfferExtras = async (options, projectDirectory) => {
-  const interactive = offerIsInteractive(options);
-  const preselected = options.add === void 0 ? [] : parseFeatureList(options.add, (message) => {
-    options.logger.warn(message);
-  });
-  const applyAll = async (plans) => {
-    if (plans.length === 0) {
-      return true;
-    }
-    if (options.dryRun === true) {
-      logWould(options.logger, `add ${plans.map((plan) => plan.label).join(", ")}`);
-      return true;
-    }
-    const buffered = [];
-    const applyLogger = isInteractive() ? {
-      error: (message) => {
-        buffered.push({ level: "error", message });
-      },
-      info: () => {
-      },
-      success: () => {
-      },
-      warn: (message) => {
-        buffered.push({ level: "warn", message });
-      }
-    } : options.logger;
-    const steps = plans.map((plan) => {
-      return {
-        running: `adding ${plan.label}…`,
-        task: () => runAddCommand({
-          allowUnsafeSource: options.allowUnsafeSource,
-          cwd: projectDirectory,
-          from: options.registryFrom,
-          logger: applyLogger,
-          names: [...plan.names],
-          ref: options.ref,
-          source: options.registrySource,
-          transformManifest: plan.transformManifest,
-          yes: true
-        })
-      };
-    });
-    const done = `added ${plans.map((plan) => plan.label).join(", ")}`;
-    const results = await withTuiBadgeProgress(BADGES.add, steps, done);
-    for (const { level, message } of buffered) {
-      options.logger[level](message);
-    }
-    return results.every((result) => result.code === 0);
-  };
-  const deps = {
-    applyAll,
-    interactive,
-    logger: options.logger,
-    multiSelect: options.prompt?.multiSelect ?? ((message, choices, settings) => tuiMultiSelect(message, choices, { ...settings, badge: BADGES.add })),
-    preselected: preselected.length > 0 ? preselected : void 0,
-    projectName: basename(projectDirectory),
-    select: options.prompt?.select ?? ((message, choices, settings) => tuiSelect(message, choices, { ...settings, badge: BADGES.add })),
-    text: options.prompt?.text ?? ((message, settings) => tuiText(message, { ...settings, badge: BADGES.add }))
-  };
-  if (preselected.length > 0) {
-    await offerRegistryExtras(deps);
-    return;
-  }
-  if (isInteractive()) {
-    await tuiHeadline(COPY.extras);
-  }
-  await offerRegistryExtras(deps);
-};
-const DEFAULT_FRAMEWORK = "react";
-const FRAMEWORK_CHOICES = [
-  { description: "React SPA — official create-vite base + the Lunora layer (the default)", label: "React", value: "react" },
-  { description: "Vue SPA — create-vite base + Lunora", label: "Vue", value: "vue" },
-  { description: "Solid SPA — create-vite base + Lunora", label: "Solid", value: "solid" },
-  { description: "Svelte SPA — create-vite base + Lunora", label: "Svelte", value: "svelte" },
-  { description: "TanStack Start (React) — SSR with live-loader routes", label: "TanStack Start · React", value: "tanstack-start-react" },
-  { description: "TanStack Start (Solid)", label: "TanStack Start · Solid", value: "tanstack-start-solid" },
-  { description: "React Router (v7, framework mode) — SSR composed into the Lunora worker", label: "React Router", value: "react-router" },
-  { description: "Astro + a standalone Lunora worker", label: "Astro", value: "astro" },
-  { description: "AnalogJS (Angular) — single-worker, Lunora mounted in Nitro", label: "Analog", value: "analog" },
-  { description: "Nuxt (Vue) — single-worker, Lunora mounted in Nitro", label: "Nuxt", value: "nuxt" },
-  { description: "SvelteKit + a standalone Lunora worker", label: "SvelteKit", value: "sveltekit" },
-  { description: "Worker only — no frontend", label: "Standalone", value: "standalone" }
-];
-const OVERLAY_VALUES = Object.keys(ADAPTERS).join("|");
-const TEMPLATE_VALUES = FRAMEWORK_CHOICES.filter((choice) => !isOverlayFramework(choice.value)).map((choice) => choice.value).join("|");
-const toScaffoldChoice = (value) => isOverlayFramework(value) ? { framework: value, kind: "overlay" } : { kind: "template", templateType: value };
-const resolveScaffoldChoice = async (options) => {
-  if (options.vite !== void 0) {
-    return { framework: options.vite, kind: "overlay" };
-  }
-  if (options.templateType !== void 0) {
-    return { kind: "template", templateType: options.templateType };
-  }
-  if (!isInteractive() || options.yes === true) {
-    return { framework: DEFAULT_FRAMEWORK, kind: "overlay" };
-  }
-  return toScaffoldChoice(await tuiSelect(COPY.framework, FRAMEWORK_CHOICES, { badge: BADGES.tmpl, default: DEFAULT_FRAMEWORK }) ?? DEFAULT_FRAMEWORK);
-};
-const nonInteractiveInitError = (options) => {
-  if (isInteractive() || options.yes === true) {
-    return void 0;
-  }
-  const missing = [];
-  if (options.name === void 0) {
-    missing.push("a project name (`lunora init <name>`)");
-  }
-  if (options.templateType === void 0 && options.vite === void 0) {
-    missing.push(`a framework — \`--vite <${OVERLAY_VALUES}>\` for an SPA, or \`-t <${TEMPLATE_VALUES}>\` for a bespoke template`);
-  }
-  if (missing.length === 0) {
-    return void 0;
-  }
-  return `lunora init can't prompt in a non-interactive terminal — provide ${missing.join(" and ")}, or pass --yes to accept the defaults.`;
-};
-const scaffoldOverlayPath = async (options, framework, name, target) => {
-  if (!isOverlayFramework(framework)) {
-    options.logger.error(`init: unknown framework "${framework}". Supported overlays: ${Object.keys(ADAPTERS).join(", ")}.`);
-    return { code: 1, files: [], target };
-  }
-  if (!await verifyRemoteTemplate({ isLocal: options.overlayBaseFrom !== void 0, logger: options.logger })) {
-    return { code: 1, files: [], target };
-  }
-  mkdirSync(target, { recursive: true });
-  return scaffoldViteOverlay({ framework, logger: options.logger, name, overlayBaseFrom: options.overlayBaseFrom, target });
-};
-const scaffoldTemplatePath = async (options, templateType, name, target) => {
-  if (templateType === "next") {
-    options.logger.warn('template "next" is not yet available — re-run with `--vite react` or `-t standalone`.');
-    return { code: 1, files: [], target };
-  }
-  if (options.from !== void 0) {
-    return await scaffoldFromLocal(options.from, templateType, target, name, options.logger);
-  }
-  if (options.source !== void 0 && options.source.length > 0 && !options.allowUnsafeSource && !isSafeSource(options.source)) {
-    options.logger.error(
-      `init: refusing --source ${options.source} — only gh:, github:, or https:// sources are allowed (and may not contain ".."). Re-run with --allow-unsafe-source if you really want this.`
-    );
-    return { code: 1, files: [], target };
-  }
-  if (!await verifyRemoteTemplate({ isLocal: false, logger: options.logger, source: resolveTemplateSource(templateType, options.source, options.ref) })) {
-    return { code: 1, files: [], target };
-  }
-  return scaffoldFromRemote({ logger: options.logger, name, ref: options.ref, source: options.source, target, templateType });
-};
-const scaffoldNewProject = async (options, cwd, recordTarget) => {
-  await tuiMoonrise("realtime backend on Cloudflare Workers + Durable Objects");
-  const blocked = nonInteractiveInitError(options);
-  if (blocked !== void 0) {
-    options.logger.error(blocked);
-    return { code: 1, files: [], target: "" };
-  }
-  const suggestedName = generateProjectName();
-  const rawName = options.name ?? await tuiText(COPY.name, { badge: BADGES.dir, default: suggestedName, placeholder: suggestedName });
-  const choice = await resolveScaffoldChoice(options);
-  const name = rawName.trim();
-  if (name.length === 0) {
-    options.logger.error(`init: refusing an empty project name — pass a directory name (e.g. \`lunora init my-app\`).`);
-    return { code: 1, files: [], target: "" };
-  }
-  if (name.includes("/") || name.includes("\\") || name === ".." || name === ".") {
-    options.logger.error(`init: refusing project name "${name}" — must not contain path separators or be "." / "..".`);
-    return { code: 1, files: [], target: "" };
-  }
-  const target = resolve(cwd, name);
-  const targetPreExisted = existsSync(target);
-  if (targetPreExisted) {
-    const entries = readdirSync(target);
-    if (entries.length > 0) {
-      options.logger.error(`target directory not empty: ${target}`);
-      return { code: 1, files: [], target };
-    }
-  }
-  if (options.dryRun === true) {
-    const what = choice.kind === "overlay" ? `the ${choice.framework} create-vite overlay` : `the ${choice.templateType} template`;
-    logWould(options.logger, `scaffold ${what} into ${target}`);
-    return { code: 0, files: [], target };
-  }
-  recordTarget(target, targetPreExisted);
-  return choice.kind === "overlay" ? scaffoldOverlayPath(options, choice.framework, name, target) : scaffoldTemplatePath(options, choice.templateType, name, target);
-};
-const resetScaffoldOnCancel = (cleanup, logger) => {
-  const { target, targetPreExisted } = cleanup;
-  if (target === void 0 || !existsSync(target)) {
-    return;
-  }
-  if (targetPreExisted === true) {
-    for (const entry of readdirSync(target)) {
-      rmSync(join$1(target, entry), { force: true, recursive: true });
-    }
-  } else {
-    rmSync(target, { force: true, recursive: true });
-  }
-  logger.info(`removed the partially-created project at ${target}`);
-};
-const runScaffoldStep = async (options, cwd, recordTarget) => {
-  if (options.inPlace !== true) {
-    return scaffoldNewProject(options, cwd, recordTarget);
-  }
-  if (options.dryRun === true) {
-    logWould(options.logger, `configure Lunora into ${cwd}`);
-    return { code: 0, files: [], target: cwd };
-  }
-  return runInPlaceInit(cwd, options.logger);
-};
-const runPostScaffold = async (options, result, cwd) => {
-  await maybeOfferExtras(options, result.target);
-  const installedManager = options.inPlace === true ? void 0 : await maybeOfferInstall(options, result.target);
-  if (options.inPlace !== true) {
-    await maybeOfferGit(options, result.target);
-    await printNextSteps(basename(result.target), installedManager, isInsideMonorepo(cwd));
-    await emitMascot(options.logger);
-  }
-};
-const scaffoldCiPipeline = (options, result, cwd) => {
-  if (result.code !== 0 || options.ci === void 0) {
-    return;
-  }
-  if (options.dryRun === true) {
-    logWould(options.logger, `scaffold a ${options.ci} CI deploy pipeline`);
-    return;
-  }
-  scaffoldCiWorkflow(options.inPlace === true ? cwd : result.target, options.ci, options.logger);
-};
-const runInitCommand = async (options) => {
-  const cwd = options.cwd ?? process.cwd();
-  const cleanup = {};
-  let result;
-  try {
-    result = await runScaffoldStep(options, cwd, (target, preExisted) => {
-      cleanup.target = target;
-      cleanup.targetPreExisted = preExisted;
-    });
-    if (result.code === 0 && result.target !== "") {
-      cleanup.target = void 0;
-      await runPostScaffold(options, result, cwd);
-    }
-  } catch (error) {
-    if (error instanceof PromptCancelledError) {
-      resetScaffoldOnCancel(cleanup, options.logger);
-      process.stdout.write("\n  ✖  Setup cancelled — run `lunora init` again whenever you're ready. 🌙\n");
-      return { code: 130, files: [], target: "" };
-    }
-    throw error;
-  }
-  scaffoldCiPipeline(options, result, cwd);
-  return result;
-};
-const isTemplate = (value) => value === "analog" || value === "astro" || value === "next" || value === "nuxt" || value === "react-router" || value === "standalone" || value === "sveltekit" || value === "tanstack-start-react" || value === "tanstack-start-solid";
-const resolveCiProvider = (raw, logger) => {
-  if (raw === void 0) {
-    return void 0;
-  }
-  if (isCiProvider(raw)) {
-    return raw;
-  }
-  logger.warn(`init: unknown --ci "${raw}" — expected github | gitlab; skipping CI scaffold.`);
-  return void 0;
-};
-const execute = defineHandler(({ argument, cwd, logger, options }) => {
-  const templateType = options.template !== void 0 && isTemplate(options.template) ? options.template : void 0;
-  return runInitCommand({
-    add: options.add,
-    allowUnsafeSource: options.allowUnsafeSource === true,
-    cwd,
-    ci: resolveCiProvider(options.ci, logger),
-    dryRun: options.dryRun === true,
-    from: options.from,
-    inPlace: options.here === true,
-    interactive: options.interactive === true ? true : void 0,
-    logger,
-    name: argument[0],
-    ref: options.ref,
-    source: options.source,
-    templateType,
-    vite: options.vite,
-    yes: options.yes === true
-  });
-});
-
-export { execute, isTemplate, resolveTemplateSource, runInitCommand };
+`,Bn="gh:anolilab/lunora/templates",Fn=e=>{const t=e.lastIndexOf(".");return t===-1?!1:Dn.has(e.slice(t))},Wn=/^[a-z0-9_][a-z0-9\-_]*$/u,qn=/([a-z0-9])([A-Z])/gu,Hn=/[^a-z0-9_]/gu,Kn=e=>{const t=e.replaceAll(qn,"$1-$2").toLowerCase().replaceAll(Hn,"-").split("-").filter(r=>r.length>0);return t.length>0?t.join("-"):"my-app"},zn=(e,t)=>e.replaceAll("{{name}}",t),Gn=async(e,t)=>{const r=new Set;for(const n of e)if(T(n)==="package.json")for(const a of Object.keys(Ee(S(n))))q(a)&&r.add(a);return Le(r,t)},Yn=(e,t,r)=>{let n;try{n=JSON.parse(e)}catch{return e}let a=e;for(const i of["dependencies","devDependencies"])for(const s of Object.keys(n[i]??{})){if(!q(s))continue;const o=r.get(s)??t,l=xt(a,[i,s],o,{formattingOptions:{insertSpaces:!0,tabSize:4}});a=Et(a,l)}return a},Jn=["@parcel/watcher","esbuild","lmdb","msgpackr-extract","rs-module-lexer","sharp","unrs-resolver","vue-demi","workerd"],Qn=["cpu-features","protobufjs","ssh2"],Qe="pnpm-workspace.yaml",Xn=()=>["# pnpm reads its settings from here (the package.json `pnpm` field is no longer read).","# Pre-approve the toolchain's native build scripts so `pnpm install` runs them","# without the interactive `pnpm approve-builds` step; deny the optional native","# builds a scaffold doesn't need (so no C/C++ toolchain is required).","allowBuilds:",...Jn.map(e=>`    '${e}': true`),...Qn.map(e=>`    '${e}': false`),""].join(`
+`),Xe=e=>{const t=u(e,Qe);f(t)||v(t,Xn(),"utf8")},H=e=>{const t=[];for(const r of kt(e,{includeDirs:!1,includeFiles:!0}))ye(r.path).isSymbolicLink()||t.push(r.path);return t},ve="vitejs/vite",ge=(e,t)=>{for(const r of H(e)){const n=u(t,j(e,r));I(S(n),{recursive:!0}),ct(r,n)}},Ze=async(e,t,r)=>{const n=H(e),a=[],i=Ae(),s=await Gn(n,i);for(const o of n){const l=j(e,o),c=u(t,l);I(S(c),{recursive:!0});const d=_(o);let p=Fn(o)?zn(d.toString("utf8"),r):void 0;p!==void 0&&T(o)==="package.json"&&(p=Yn(p,i,s)),p===void 0?v(c,d):v(c,p,"utf8"),a.push(c)}return a},G=(e,t,r)=>t!==void 0&&t.length>0?t:`${Bn}/${e}#${Ie(r)}`,Zn=e=>e.includes("..")?!1:e.startsWith("gh:")||e.startsWith("github:")||e.startsWith("https://"),R=(e,t)=>{e.info(`[dry-run] would ${t}`)},et=(e,t,r)=>(e.error(`init: the template at ${r} contains no files — nothing was scaffolded. Check the template name, \`--source\` layout and \`--ref\`.`),{code:g.NOT_FOUND,files:[],target:t}),tt="Template files copied.",te=(e,t,r)=>{k()&&process.stdout.write(`
+`),e.success(`scaffolded ${String(t.length)} files into ${r}`)},ea=(e,t)=>{const{args:r,command:n}=At(e,t);return`${n} ${r.join(" ")}`},rt=(e,t)=>{let r=_e(e);for(;;){if(t(r))return!0;const n=S(r);if(n===r)return!1;r=n}},ta=e=>f(u(e,Qe))?!0:yt(e)?.workspaces!==void 0,re=e=>rt(e,ta),ra=e=>rt(e,t=>f(u(t,".git"))),na=async(e,t)=>{if(e.yes===!0||!k()||ra(S(t)))return;if(!await $e(C.git,{badge:w.git,defaultYes:!1})){await Me("Sounds good! You can always run git init manually.");return}if(e.dryRun===!0){R(e.logger,"initialize a git repository");return}const r=e.spawner??Re;(await Ut("Initializing a git repository…",()=>r({args:["init"],command:"git",cwd:t}))).code===0?await U("git","Initialized an empty git repository."):e.logger.warn("`git init` failed — initialize it yourself later with `git init`.")},aa=async(e,t,r,n)=>{const a=[{code:`cd ./${e}`,lead:"Enter your project directory using"}];t===void 0&&a.push({code:`${r} install`,lead:"Install dependencies with",tail:n?" from the workspace root":void 0}),a.push({code:Lt(r,"dev"),lead:"Run",tail:" to start the dev server."},{code:"lunora add",lead:"Add features like auth or storage using"});const i=[{code:"https://lunora.sh/docs",lead:"Read the docs at"},{code:"https://lunora.sh/chat",lead:"Stuck? Join the chat at"}];if(k()){await jt(w.next,C.nextHeader,a,i);return}const s=a.map(o=>`${o.lead} ${o.code}${o.tail??""}`);s.push("",...i.map(o=>`${o.lead} ${o.code}${o.tail??""}`)),await U("next",C.nextHeader,s.join(`
+`))},oa=e=>e.yes!==!0&&(e.installPrompt!==void 0||k()),ia=async(e,t)=>{if(!oa(e)||re(S(t)))return;const r=St(e.packageManagerProbe),[n]=r;if(n===void 0)return;if(!await(e.installPrompt?.confirmInstall??(async()=>$e(C.install,{badge:w.deps,defaultYes:!0})))()){await Me("No problem! Remember to install dependencies after setup.");return}let i=n;if(r.length>1&&(i=e.installPrompt?await e.installPrompt.selectManager(r):await D(C.packageManager,r.map(d=>({label:d,value:d})),{badge:w.deps,default:n})??n),e.dryRun===!0){R(e.logger,`install dependencies with ${i}`);return}i==="pnpm"&&Xe(t);const s=e.spawner??Re,{args:o,command:l}=Se(i);await U("deps",`Installing dependencies with ${i}…`);const c=await s({args:o,command:l,cwd:t});if(c.code!==0){e.logger.warn(`\`${l} install\` exited with code ${String(c.code)} — run it yourself in ${T(t)}/.`);return}return await U("deps",`Dependencies installed with ${i}.`),i},sa=async(e,t,r,n,a,i)=>{const s=u(e,t);if(!f(s))return a.error(`template not found in local source: ${s}`),{code:g.NOT_FOUND,files:[],target:r};const o=await Ze(s,r,n);return o.length===0?et(a,r,s):(i(),te(a,o,r),{code:0,files:o,target:r})},la=async e=>{const{logger:t,markComplete:r,name:n,ref:a,source:i,target:s,templateType:o}=e,l=be(u(ke(),"lunora-init-fetch-")),c=u(l,"template");try{const d=i!==void 0&&i.length>0?a:await $t(a,t),p=G(o,i,d);let m,h=[];if(await Ne([{label:`${o} template fetched`,run:async()=>{m=await Ce(p,{cwd:l,dir:c,force:!0,install:!1,silent:!0})}},{label:`files copied into ${n}/`,run:async()=>{h=await Ze(c,s,n)}}],{end:tt,start:"Project initializing…"}),h.length===0)return et(t,s,m?.source??p);r();const x=H(c);return k()&&process.stdout.write(`
+`),t.info(m?.commit?`template: ${m.source} @ ${m.commit} (${String(x.length)} files)`:`template: ${m?.source??p} (${String(x.length)} files)`),te(t,h,s),{code:0,files:h,target:s}}catch(d){if(d instanceof X)throw d;const{hints:p,message:m}=br(d,{ref:Ie(a),remote:G(o,i,a),templateType:o});t.error(m);for(const h of p)t.warn(h);return{code:1,files:[],target:s}}finally{P(l,{force:!0,recursive:!0})}},ca=e=>{for(const t of["_gitignore","_npmrc","_gitattributes"]){const r=u(e,t);f(r)&&dt(r,u(e,`.${t.slice(1)}`))}},da=async e=>{const{framework:t,logger:r,markComplete:n,name:a,overlayBaseFrom:i,target:s}=e,o=F[t],l=be(u(ke(),"lunora-vite-base-"));try{let c;if(i!==void 0&&(c=u(i,`template-${o.createViteTemplate}`),!f(c)))return r.error(`create-vite base not found on disk: ${c}`),{code:g.NOT_FOUND,files:[],target:s};const d=async()=>{if(c!==void 0){ge(c,s);return}const m=u(l,"base"),h=await Tt(ve,"main",r),x=`github:${ve}/packages/create-vite/template-${o.createViteTemplate}#${h}`;await Ce(x,{cwd:l,dir:m,force:!0,install:!1,silent:!0}),ca(m),ge(m,s)};let p=[];return await Ne([{label:`create-vite (${o.label}) base ready`,run:d},{label:`Lunora overlay applied (${o.label})`,run:async()=>{p=await Rn({adapter:o,distTag:Ae(),logger:r,name:a,target:s})}}],{end:tt,start:"Project initializing…"}),n(),te(r,p,s),{code:0,files:[...H(s)],target:s}}catch(c){if(c instanceof X)throw c;const d=c instanceof Error?c.message:String(c);return r.error(`failed to scaffold the ${o.label} base: ${d}`),{code:1,files:[],target:s}}finally{P(l,{force:!0,recursive:!0})}},Y=(e,t,r,n,a)=>(a.error(`init --in-place: could not ${e} ${t}: ${r instanceof Error?r.message:String(r)}`),{code:1,files:[],target:n}),ua=(e,t)=>{const r=u(e,"vite.config.ts");try{v(r,Un,"utf8")}catch(n){return Y("write",r,n,e,t)}return t.success(`created ${r} with lunora() plugin`),{code:0,files:[r],target:e}},ha=(e,t,r)=>{let n;try{n=_(e,"utf8")}catch(i){return Y("read",e,i,t,r)}const a=Be(n);if(!a.changed)return r.info(`${e}: ${a.reason??"no changes needed"}`),{code:0,files:[],target:t};try{v(e,a.code,"utf8")}catch(i){return Y("write",e,i,t,r)}return r.success(`patched ${e} — added lunora() plugin`),{code:0,files:[e],target:t}},pa=(e,t)=>{const r=u(e,"lunora"),n=u(r,"schema.ts");if(f(n))return t.info(`lunora/ already present — left ${n} untouched`),[];const a=[];try{I(r,{recursive:!0}),v(n,jn,"utf8"),a.push(n);const i=u(r,"messages.ts");f(i)||(v(i,Vn,"utf8"),a.push(i)),t.success(`scaffolded lunora/ (${String(a.length)} file(s))`)}catch(i){const s=i instanceof Error?i.message:String(i);t.error(`init --here: could not scaffold lunora/: ${s}`)}return a},nt=e=>e==="sveltekit"||e==="nuxt"||e==="astro",ma=(e,t,r)=>{const{adapter:n,class:a,framework:i}=e;r.info(""),r.info(`detected framework: ${i} (class ${a})`),r.info("next steps:");const s=[n,"@lunora/client","@lunora/runtime","@lunora/server"];nt(i)||s.push("@lunora/vite"),r.info(`  1. install the adapter:  ${ea(t,s)}`),r.info("  2. run codegen:          lunora codegen"),a==="A"?(r.info("  3. compose one worker:   wrap your worker entry with"),r.info("       createWorker({ httpRouter: <your framework SSR handler>, shardDO: ShardDO, ... })"),r.info(`  4. add the provider:     mount the ${n} provider in your root layout/route`),r.info("  5. make a loader live:   preloadQuery() in a loader, usePreloadedQuery() in the component"),r.info("     see https://lunora.sh/docs/frameworks/reactive-loaders")):a==="B"?(r.info("  3. inject Lunora:        mount Lunora realtime under /_lunora/* in your server hook"),r.info(`       (${i} owns its Cloudflare adapter — Lunora composes into its server entry)`),r.info(`  4. add the provider:     mount the ${n} provider in your root layout`),r.info("  5. read the guide:       https://lunora.sh/docs/frameworks/deploy")):(r.info("  3. add the provider:     wrap your app with the LunoraProvider from @lunora/react"),r.info("  4. read the guide:       https://lunora.sh/docs/frameworks/bring-your-framework")),r.info("")},fa=(e,t,r)=>{if(nt(t))return r.info(`${t} wires Lunora through its server entry, not a lunora() Vite plugin — leaving the Vite config alone (see next steps)`),{code:0,files:[],target:e};const n=Ge(e);return n===void 0?ua(e,r):ha(n,e,r)},va=(e,t)=>{const r=lr(e),n=fa(e,r.framework,t);if(n.code!==0)return n;const a=pa(e,t);return ma(r,V(e),t),{code:0,files:[...n.files,...a],target:e}},ga=e=>e.yes!==!0&&(e.prompt!==void 0||(e.interactive??k())),we=async(e,t,r)=>{r.dryRun!==!0&&await an({apply:n=>wt(e,n),detected:gt(e),interactive:t,logger:r.logger,multiSelect:r.lintPrompt??((n,a,i)=>Te(n,a,{...i,badge:w.add}))})},wa=async(e,t)=>{const r=ga(e),n=e.add===void 0?[]:Gr(e.add,o=>{e.logger.warn(o)}),a=async o=>{if(o.length===0)return!0;if(e.dryRun===!0)return R(e.logger,`add ${o.map(h=>h.externalAuth===void 0?h.label:`${h.label} (and wire resolveIdentity)`).join(", ")}`),!0;const l=[],c=k()?{error:h=>{l.push({level:"error",message:h})},info:()=>{},success:()=>{},warn:h=>{l.push({level:"warn",message:h})}}:e.logger,d=o.map(h=>({running:`adding ${h.label}…`,task:()=>Yt({allowUnsafeSource:e.allowUnsafeSource,cwd:t,from:e.registryFrom,logger:c,names:[...h.names],ref:e.ref,source:e.registrySource,transformManifest:h.transformManifest,yes:!0})})),p=`added ${o.map(h=>h.label).join(", ")}`,m=await Vt(w.add,d,p);for(const{level:h,message:x}of l)e.logger[h](x);for(const[h,x]of o.entries())x.externalAuth!==void 0&&m[h]?.code===0&&Hr(t,x.externalAuth,e.logger);return m.every(h=>h.code===0)},i=e.auth===void 0?void 0:xr(e.auth,o=>{e.logger.warn(o)}),s={applyAll:a,auth:i,interactive:r,logger:e.logger,multiSelect:e.prompt?.multiSelect??((o,l,c)=>Te(o,l,{...c,badge:w.add})),preselected:n.length>0?n:void 0,projectName:T(t),resolveAuthUiItem:()=>{const o=Ee(t);if(!zt(o))return Gt(o)??"auth-ui-react"},select:e.prompt?.select??((o,l,c)=>D(o,l,{...c,badge:w.add})),selectAuth:e.prompt===void 0?(o,l,c)=>D(o,l,{...c,badge:w.add}):e.prompt.selectAuth??(()=>Promise.resolve("none")),text:e.prompt?.text??((o,l)=>Oe(o,{...l,badge:w.add}))};if(n.length>0||i!==void 0&&!r){const o=await he(s);return await we(t,r,e),o}return k()&&await Dt(C.extras),await he(s),await we(t,r,e),!0},K="react",at=[{description:"React SPA — official create-vite base + the Lunora layer (the default)",label:"React",value:"react"},{description:"Vue SPA — create-vite base + Lunora",label:"Vue",value:"vue"},{description:"Solid SPA — create-vite base + Lunora",label:"Solid",value:"solid"},{description:"Solid 2.0 SPA — the Solid 2 line (@solidjs/web, vite-plugin-solid 3)",label:"Solid 2",value:"solid-v2"},{description:"Svelte SPA — create-vite base + Lunora",label:"Svelte",value:"svelte"},{description:"React SPA on Rsbuild — the Worker runs under wrangler dev behind the dev server",label:"React · Rsbuild",value:"rspack-react"},{description:"Next.js (App Router) — OpenNext on Cloudflare + a standalone Lunora worker",label:"Next.js",value:"next"},{description:"TanStack Start (React) — SSR with live-loader routes",label:"TanStack Start · React",value:"tanstack-start-react"},{description:"TanStack Start (React) on Rsbuild — SSR composed into the Lunora worker",label:"TanStack Start · React · Rsbuild",value:"tanstack-start-react-rspack"},{description:"SaaS kit — multi-tenant app on TanStack Start: organizations, projects, activity, admin",label:"SaaS kit",value:"saas"},{description:"TanStack Start (Solid)",label:"TanStack Start · Solid",value:"tanstack-start-solid"},{description:"Next.js App Router on Vite (vinext) — composed into the Lunora worker (experimental)",label:"vinext · App Router",value:"vinext"},{description:"Next.js Pages Router on Vite (vinext) — composed into one worker (experimental)",label:"vinext · Pages Router",value:"vinext-pages"},{description:"Astro (islands) — single-worker, Lunora composed into the adapter worker",label:"Astro",value:"astro"},{description:"AnalogJS (Angular) — single-worker, Lunora mounted in Nitro",label:"Analog",value:"analog"},{description:"Nuxt (Vue) — single-worker, Lunora mounted in Nitro",label:"Nuxt",value:"nuxt"},{description:"SvelteKit — single-worker, Lunora composed into the adapter worker",label:"SvelteKit",value:"sveltekit"},{description:"React Native (Expo) — an iOS/Android/web app + a Lunora worker backend",label:"React Native · Expo",value:"expo"},{description:"Worker only — no frontend",label:"Standalone",value:"standalone"}],ot=Object.keys(F).join("|"),it=at.filter(e=>!W(e.value)).map(e=>e.value),st=it.join("|"),ya=e=>W(e)?{framework:e,kind:"overlay"}:{kind:"template",templateType:e},ba=async e=>e.vite!==void 0?{framework:e.vite,kind:"overlay"}:e.templateType!==void 0?{kind:"template",templateType:e.templateType}:!k()||e.yes===!0?{framework:K,kind:"overlay"}:ya(await D(C.framework,at,{badge:w.tmpl,default:K})??K),ka=e=>{if(k()||e.yes===!0)return;const t=[];if(e.name===void 0&&t.push("a project name (`lunora init <name>`)"),e.templateType===void 0&&e.vite===void 0&&t.push(`a framework — \`--vite <${ot}>\` for an SPA, or \`-t <${st}>\` for a bespoke template`),t.length!==0)return`lunora init can't prompt in a non-interactive terminal — provide ${t.join(" and ")}, or pass --yes to accept the defaults.`},xa=async(e,t,r,n,a)=>W(t)?await Je({isLocal:e.overlayBaseFrom!==void 0,logger:e.logger})?(I(n,{recursive:!0}),da({framework:t,logger:e.logger,markComplete:a,name:r,overlayBaseFrom:e.overlayBaseFrom,target:n})):{code:1,files:[],target:n}:(e.logger.error(`init: unknown framework "${t}". Supported overlays: ${Object.keys(F).join(", ")}.`),{code:g.USAGE,files:[],target:n}),Ea=async(e,t,r,n,a)=>e.from!==void 0?await sa(e.from,t,n,r,e.logger,a):e.source!==void 0&&e.source.length>0&&!e.allowUnsafeSource&&!Zn(e.source)?(e.logger.error(`init: refusing --source ${e.source} — only gh:, github:, or https:// sources are allowed (and may not contain ".."). Re-run with --allow-unsafe-source if you really want this.`),{code:g.USAGE,files:[],target:n}):await Je({isLocal:!1,logger:e.logger,source:G(t,e.source,e.ref)})?la({logger:e.logger,markComplete:a,name:r,ref:e.ref,source:e.source,target:n,templateType:t}):{code:1,files:[],target:n},_a=(e,t)=>{if(re(t))return;let r;try{r=V(e)}catch{return}r==="pnpm"&&Xe(e)},Ca=async(e,t,r)=>{await Pt("realtime backend on Cloudflare Workers + Durable Objects");const n=ka(e);if(n!==void 0)return e.logger.error(n),{code:g.USAGE,files:[],target:""};const a=$n(),i=e.name??await Oe(C.name,{badge:w.dir,default:a,placeholder:a}),s=await ba(e),o=i.trim();if(o.length===0)return e.logger.error("init: refusing an empty project name — pass a directory name (e.g. `lunora init my-app`)."),{code:g.USAGE,files:[],target:""};if(o.includes("/")||o.includes("\\")||o===".."||o===".")return e.logger.error(`init: refusing project name "${o}" — must not contain path separators or be "." / "..".`),{code:g.USAGE,files:[],target:""};if(!Wn.test(o))return e.logger.error(`init: refusing project name "${o}" — a Cloudflare Worker name must be lowercase letters, digits, "-" or "_" (starting with a letter, digit or "_"), and wrangler rejects anything else. Try \`${Kn(o)}\`.`),{code:g.USAGE,files:[],target:""};const l=_e(t,o),c=ye(l,{throwIfNoEntry:!1});if(c?.isSymbolicLink()===!0)return e.logger.error(`init: refusing to scaffold into "${l}" — it is a symlink. Remove it, or scaffold into a different directory name.`),{code:g.CONFLICT,files:[],target:l};const d=c!==void 0;if(d&&J(l).length>0)return e.logger.error(`target directory not empty: ${l}`),{code:g.CONFLICT,files:[],target:l};if(e.dryRun===!0){const m=s.kind==="overlay"?`the ${s.framework} create-vite overlay`:`the ${s.templateType} template`;return R(e.logger,`scaffold ${m} into ${l}`),{code:0,files:[],target:l}}r.record(l,d);const p=s.kind==="overlay"?await xa(e,s.framework,o,l,r.complete):await Ea(e,s.templateType,o,l,r.complete);return p.code===0&&_a(l,t),p},z=(e,t)=>{const{target:r,targetPreExisted:n}=e;if(!(r===void 0||!f(r))){if(n===!0)for(const a of J(r))P(u(r,a),{force:!0,recursive:!0});else P(r,{force:!0,recursive:!0});t.info(`removed the partially-created project at ${r}`)}},Sa=async(e,t,r)=>e.inPlace!==!0?Ca(e,t,r):e.dryRun===!0?(R(e.logger,`configure Lunora into ${t}`),{code:0,files:[],target:t}):va(t,e.logger),La=async(e,t,r)=>{const n=await wa(e,t.target),a=e.inPlace===!0?void 0:await ia(e,t.target);if(e.inPlace!==!0){await na(e,t.target);const i=a??V(t.target);await aa(T(t.target),a,i,re(r)),await Kr(e.logger)}return n},Aa=(e,t,r)=>{if(t.code!==0||e.ci===void 0)return;if(e.dryRun===!0){R(e.logger,`scaffold a ${e.ci} CI deploy pipeline`);return}const n=e.inPlace===!0?r:t.target;try{const a=V(n);ir(n,e.ci,a,e.logger)}catch{e.logger.warn(`--ci ${e.ci}: could not detect a package manager for this project — skipped the CI pipeline.`)}},Ia=async e=>{const t=e.cwd??process.cwd(),r={};let n;try{n=await Sa(e,t,{complete:()=>{r.target=void 0},record:(a,i)=>{r.target=a,r.targetPreExisted=i}}),n.code===0&&n.target!==""?(r.target=void 0,await La(e,n,t)||(n={...n,code:1})):n.code!==0&&z(r,e.logger)}catch(a){if(a instanceof X)return z(r,e.logger),process.stdout.write("\n  ✖  Setup cancelled — run `lunora init` again whenever you're ready. 🌙\n"),{code:130,files:[],target:""};throw z(r,e.logger),a}return Aa(e,n,t),n},Ra=e=>typeof e=="string"&&it.includes(e),Oa=(e,t)=>{if(e!==void 0){if(ar(e))return e;t.warn(`init: unknown --ci "${e}" — expected github | gitlab; skipping CI scaffold.`)}},Ta=e=>e===void 0?{}:Ra(e)?{templateType:e}:W(e)?{vite:e}:{error:`init: unknown --template "${e}" — expected a bespoke template (${st}) or an overlay framework (${ot}).`},ro=It(({argument:e,cwd:t,logger:r,options:n})=>{const a=Ta(n.template);return"error"in a?(r.error(a.error),{code:g.USAGE}):Ia({add:n.add,auth:n.auth,allowUnsafeSource:n.allowUnsafeSource===!0,cwd:t,ci:Oa(n.ci,r),dryRun:n.dryRun===!0,from:n.from,inPlace:n.here===!0,interactive:n.interactive===!0?!0:void 0,logger:r,name:e[0],ref:n.ref,source:n.source,templateType:a.templateType,vite:n.vite??a.vite,yes:n.yes===!0})});export{at as FRAMEWORK_CHOICES,ro as execute,Ra as isTemplate,Ta as resolveTemplateFlag,G as resolveTemplateSource,Ia as runInitCommand};