@lunora/config 1.0.0-alpha.2 → 1.0.0-alpha.20

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-import { ContainerIR, WorkflowIR } from '@lunora/codegen';
+import { ContainerIR, WorkflowIR, QueueIR } from '@lunora/codegen';
 export type { ContainerIR, WorkflowIR } from '@lunora/codegen';
+import { Writable } from 'node:stream';
 import 'ts-morph';
 export { type A as AdditivePolicyEdit, type D as DestructivePolicyEdit, type P as PolicyEdit, type a as PolicyScaffoldFailureReason, type b as ScaffoldFileResult, type S as ScaffoldPolicyEdit, type c as WireResult, type W as WireRlsEdit, d as classifyPolicyEdit, s as scaffoldPolicyFile, w as wireRlsIntoProcedure } from "./packem_shared/policy-scaffold.d-DCmwn7zQ.js";
 /**
@@ -65,6 +66,77 @@ interface DiscoverContainerInfoResult {
 * (inference).
 */
 declare const discoverContainerInfo: (projectRoot: string, schemaDirectory: string) => DiscoverContainerInfoResult;
+/** Severity a container output line is surfaced at: `stderr` → `error`, `stdout` → `info`. */
+type ContainerLogLevel = "error" | "info";
+/** One declared container to follow, identified by the names codegen lifts from `defineContainer`. */
+interface ContainerLogSource {
+  /** Generated Durable Object class name, e.g. `TranscoderContainer`. Wrangler's dev image is `cloudflare-dev/<lowercased>`. */
+  className: string;
+  /** The `lunora/containers.ts` export name, e.g. `transcoder` — used as the display tag. */
+  exportName: string;
+}
+/** A single line of container output handed back to the caller. */
+interface ContainerLogLine {
+  /** `"error"` for the container's stderr, `"info"` for its stdout. */
+  level: ContainerLogLevel;
+  /** The container's export name (`transcoder`), for tagging the line. */
+  name: string;
+  /** One output line, with the trailing newline (and any `\r`) stripped. */
+  text: string;
+}
+interface ContainerLogStreamOptions {
+  /** The declared containers to follow. An empty list yields an inert handle. */
+  containers: ReadonlyArray<ContainerLogSource>;
+  /** Injected Docker client — defaults to a real lazily-imported `dockerode` instance. Tests pass a stub. */
+  docker?: DockerLike;
+  /** Called once per container output line. */
+  onLine: (line: ContainerLogLine) => void;
+  /** Called once when the Docker engine can't be reached (re-armed after it recovers). Defaults to silent. */
+  onUnavailable?: (message: string) => void;
+  /** Poll interval override, in ms. */
+  pollIntervalMs?: number;
+}
+/** Handle controlling a running log stream. */
+interface ContainerLogStreamHandle {
+  /** Stop polling and tear down every attached log stream. Idempotent. */
+  close: () => void;
+}
+/** The minimal structural slice of a `dockerode` log stream this module consumes. */
+interface DockerLogStream {
+  destroy: () => void;
+  on: (event: "data" | "end" | "error", listener: (chunk?: Buffer) => void) => void;
+}
+/** The minimal structural slice of a `dockerode` instance this module consumes. */
+interface DockerLike {
+  getContainer: (id: string) => {
+    logs: (options: {
+      follow: true;
+      stderr: true;
+      stdout: true;
+      tail: "all";
+      timestamps: false;
+    }) => Promise<DockerLogStream>;
+  };
+  listContainers: (options: {
+    filters: {
+      status: ["running"];
+    };
+  }) => Promise<{
+    Id: string;
+    Image: string;
+  }[]>;
+  modem: {
+    demuxStream: (stream: DockerLogStream, stdout: Writable, stderr: Writable) => void;
+  };
+}
+/**
+* Follow the local Docker logs of every declared container, emitting each output
+* line through `onLine` tagged with its export name. Polls for containers (they
+* start lazily on first request and may be replaced on restart), attaches once
+* per container id, and drops streams whose container has gone. Returns
+* immediately with a `close()` handle; all work happens asynchronously.
+*/
+declare const streamContainerLogs: (options: ContainerLogStreamOptions) => ContainerLogStreamHandle;
 /**
 * The meta-frameworks Lunora can compose with, plus `"none"` for a standalone
 * SPA / SSR-less project (the current default). Mirrors PLAN4 §2.4.
@@ -156,6 +228,13 @@ interface InferredContainer extends ContainerIR {
 interface InferredWorkflow extends WorkflowIR {
   exported: boolean;
 }
+/**
+* A queue declared in `lunora/queues.ts`. Unlike workflows, a queue needs no
+* worker-entry class export (its `queue()` handler rides `createWorker`), so
+* there is no `exported` flag — every declared queue is reconcilable into the
+* wrangler `queues.producers[]` / `queues.consumers[]`.
+*/
+type InferredQueue = QueueIR;
 interface InferredBindings {
   /** Containers declared in `lunora/containers.ts` (exported or not — see {@link InferredContainer.exported}). */
   containers: InferredContainer[];
@@ -163,11 +242,13 @@ interface InferredBindings {
   durableObjects: DurableObjectSpec[];
   /** Schema declares a `.global()` table → needs the `DB` D1 binding. */
   needsD1: boolean;
+  /** Queues declared in `lunora/queues.ts` → reconciled into `queues.producers[]` / `queues.consumers[]`. */
+  queues: InferredQueue[];
   /** Human-readable provenance for each inferred binding / hint, for logging. */
   signals: string[];
   /** `@lunora/ai` is imported or `env.AI` is used → needs the `ai` Workers AI binding. */
   usesAi: boolean;
-  /** `@lunora/analytics` is imported → self-describing `analytics_engine_datasets` binding (auto-writeable). */
+  /** `@lunora/bindings/analytics` is imported → self-describing `analytics_engine_datasets` binding (auto-writeable). */
   usesAnalytics: boolean;
   /** `@lunora/auth` is imported (sessions may be D1- or `SessionDO`-backed). */
   usesAuth: boolean;
@@ -175,15 +256,15 @@ interface InferredBindings {
   usesBrowser: boolean;
   /** `@lunora/hyperdrive` is imported (binding needs an un-mintable remote `id`; hint-only). */
   usesHyperdrive: boolean;
-  /** `@lunora/images` is imported → self-describing `images` binding (auto-writeable). */
+  /** `@lunora/bindings/images` is imported → self-describing `images` binding (auto-writeable). */
   usesImages: boolean;
-  /** `@lunora/kv` is imported (namespace binding name + id are user-defined; hint-only). */
+  /** `@lunora/bindings/kv` is imported (namespace binding name + id are user-defined; hint-only). */
   usesKv: boolean;
   /** `@lunora/mail` is imported (Resend API key must be set in `.dev.vars`; no binding). */
   usesMail: boolean;
   /** `@lunora/payment` is imported (provider secrets must be set in `.dev.vars`; no binding). */
   usesPayment: boolean;
-  /** `@lunora/pipelines` is imported (binding needs an un-mintable remote pipeline name; hint-only). */
+  /** `ctx.pipelines` is used (binding needs an un-mintable remote pipeline name; hint-only). */
   usesPipelines: boolean;
   /** `@lunora/scheduler` is imported. */
   usesScheduler: boolean;
@@ -288,6 +369,12 @@ declare const LUNORA_EVENT_SOURCE = "lunora";
 * — so the caller passes the original line through untouched. Pure and total.
 */
 declare const formatLunoraEvent: (line: string) => LunoraFormattedLine | undefined;
+declare class LunoraReporter {
+  #private;
+  setStdout(stdout: NodeJS.WriteStream): void;
+  setStderr(stderr: NodeJS.WriteStream): void;
+  log(meta: unknown): void;
+}
 /**
 * Per-package secret-requirements registry for `.dev.vars` scaffolding.
 *
@@ -332,6 +419,15 @@ interface SecretEntry {
   */
   placeholderValue: string;
 }
+/**
+* Secrets every Lunora project needs regardless of which capability packages are
+* installed — scaffolded into `.dev.vars` always. `LUNORA_ADMIN_TOKEN` is the
+* bearer the local Studio uses to call the worker's admin endpoints (the data
+* browser, schema edits) in dev; the worker reads the SAME `.dev.vars` value via
+* its admin gate, so both agree and the Studio authenticates without a prompt.
+* Without it, every `/_lunora/admin/*` call is `ADMIN_FORBIDDEN` (403).
+*/
+
 /**
 * The canonical registry of per-package secret requirements.
 *
@@ -653,6 +749,8 @@ interface RemoteEnableInputs {
 * is still overridable per-run by `--remote` or `LUNORA_REMOTE=1`.
 */
 declare const resolveRemoteEnabled: (inputs: RemoteEnableInputs) => boolean;
+/** Core (always-scaffolded) secrets followed by the package-specific ones for the detected capabilities. */
+declare const requiredSecrets: (packageNames: ReadonlyArray<string>) => SecretEntry[];
 /**
 * Whether an (already-unquoted) value looks like a fill-me-in placeholder —
 * empty, angle-bracketed, or containing a known marker — rather than a real
@@ -661,6 +759,15 @@ declare const resolveRemoteEnabled: (inputs: RemoteEnableInputs) => boolean;
 */
 declare const isPlaceholderValue: (value: string) => boolean;
 /**
+* True for a secret-looking key whose value Lunora can mint locally (a random
+* 32-byte hex, like `openssl rand -hex 32`) — e.g. `AUTH_SECRET`,
+* `LUNORA_ADMIN_TOKEN`, `STORAGE_SIGNING_SECRET`. False for provider-issued keys
+* ({@link PROVIDER_SECRET_KEYS}) and any non-secret key.
+*/
+declare const isMintableSecretKey: (key: string) => boolean;
+/** Mint a fresh strong secret value — 64 hex chars (32 bytes), like `openssl rand -hex 32`. */
+declare const generateSecretValue: (randomHex?: (bytes: number) => string) => string;
+/**
 * The outcome of planning a scaffold — a discriminated union so the orchestrator
 * never has to re-derive whether `content` is present.
 *
@@ -762,6 +869,58 @@ declare const buildPackageSecretsBlock: (packageNames: ReadonlyArray<string>, ex
 * **Safety invariant:** only placeholder values are written — no real secrets.
 */
 declare const ensureDevVariablesExample: (cwd: string, packageNames: ReadonlyArray<string>) => string[];
+interface DevSecretsFillPlan {
+  /** {@link CORE_SECRETS} keys appended because they were absent (each generated). */
+  addedKeys: string[];
+  /** The full new file content to write. */
+  content: string;
+  /** Existing empty/placeholder secret-keyed entries filled with fresh values. */
+  filledKeys: string[];
+}
+/**
+* Plan the in-place generation of dev secrets for a `.dev.vars`. First, every
+* line whose KEY looks like a secret (`*_SECRET`, `*_TOKEN`, `*_KEY`,
+* `*_PASSWORD`) and whose value is empty or a placeholder gets a freshly
+* generated value — so a `lunora add`-scaffolded `.dev.vars` (which writes each
+* secret blank) becomes usable on `lunora dev` / `vite dev` without the user
+* running `openssl` by hand. Second, any {@link CORE_SECRETS} key absent from
+* the file is appended (generated) — notably `LUNORA_ADMIN_TOKEN`, which the
+* local Studio needs to call the worker's admin gate in dev (without it the
+* Studio shows its login gate).
+*
+* Pure (given `randomHex`): real (non-placeholder) values are never touched, and
+* comments + non-secret entries are preserved verbatim.
+*/
+declare const planDevSecretsFill: (input: {
+  existingContent: string;
+  randomHex?: (bytes: number) => string;
+}) => DevSecretsFillPlan;
+interface FillDevSecretsResult {
+  /** Core secret keys appended (generated) because they were missing. */
+  addedKeys: string[];
+  /** Existing empty/placeholder secrets filled with generated values. */
+  filledKeys: string[];
+  /** `created` = no `.dev.vars` existed; `filled` = topped up an existing one; `unchanged` = nothing to do. */
+  status: "created" | "filled" | "unchanged";
+}
+/**
+* Generate any missing/empty dev secrets in the project's `.dev.vars`, in place.
+*
+* Complements {@link ensureDevVariables} (which scaffolds `.dev.vars` from
+* `.dev.vars.example`). A `lunora add`-scaffolded project writes secrets blank
+* straight into `.dev.vars` (no example) and never includes `LUNORA_ADMIN_TOKEN`
+* — so the worker boots with empty secrets and the Studio shows its login gate.
+* This fills those gaps at dev startup, so both `lunora dev` and the
+* `@lunora/vite` dev server give a working project with zero manual `openssl`.
+*
+* Never overwrites a real (non-placeholder) value. The write is atomic + owner-
+* only (temp + rename, `mode: 0o600`), matching the other `.dev.vars` writers.
+*/
+declare const fillDevSecrets: (deps: {
+  cwd: string;
+  info?: (message: string) => void;
+  randomHex?: (bytes: number) => string;
+}) => FillDevSecretsResult;
 /** Add a new table to `defineSchema({ ... })`. */
 interface AddTableEdit {
   readonly kind: "addTable";
@@ -891,6 +1050,56 @@ interface DiscoverSchemaInfoResult {
 * parse failure is a warning (validator) or simply ignorable (inference).
 */
 declare const discoverSchemaInfo: (projectRoot: string, schemaDirectory: string) => DiscoverSchemaInfoResult;
+/**
+* A badge: the short colored label that prefixes a line. `bg`/`fg` are hex so the
+* same value drives both colorize's `bgHex().hex()` and the tui `&lt;Text>` props.
+*/
+interface BadgeSpec {
+  bg: `#${string}`;
+  fg: `#${string}`;
+  text: string;
+}
+/** Lunora purple — the accent shared with the CLI prompt frames. */
+declare const ACCENT: `#${string}`;
+/** Standard log-level badge names (the restyled base output). */
+type LevelBadgeName = "debug" | "error" | "info" | "success" | "warn";
+/** Step-phase badge names (the create-astro-style flow transcript). */
+type StepBadgeName = "add" | "deps" | "dir" | "git" | "lunora" | "next" | "tmpl";
+type BadgeName = LevelBadgeName | StepBadgeName;
+/** The ordered step-phase names, used to register custom pail log types. */
+declare const STEP_BADGE_NAMES: ReadonlyArray<StepBadgeName>;
+/**
+* Every badge, keyed by name. Levels get their conventional colors (red/amber/
+* green/blue/grey); step phases follow create-astro's green→purple→cyan rhythm.
+*/
+declare const BADGES: Record<BadgeName, BadgeSpec>;
+/**
+* Luna, the mascot: the folklore rabbit-in-the-moon — a bunny tucked inside the
+* moon disc. Pure ASCII so it renders the same everywhere (including piped logs).
+* The CLI signs off the `init` flow with it, the way create-astro closes with
+* Houston.
+*/
+declare const LUNA_NAME = "Luna";
+declare const LUNA_SIGNOFF = "Safe travels, voyager.";
+declare const LUNA_BUNNY: string;
+/**
+* {@link LUNA_BUNNY} with its leading newline stripped, ready to render inline
+* (beside the name + sign-off). Both render paths — the tui mascot frame and the
+* pail off-TTY fallback — use this so neither re-implements the strip.
+*/
+declare const LUNA_ART: string;
+/** The colored part of a badge — the word with one space of padding each side. */
+declare const padBadge: (text: string) => string;
+/** Leading spaces that right-align a badge's box within the gutter. */
+declare const badgeLead: (text: string) => string;
+/** Total columns a rendered badge column occupies (lead + box), constant across badges. */
+declare const BADGE_COLUMN_WIDTH: number;
+/** Columns a rendered badge occupies — the gutter-aligned column width. */
+declare const badgeWidth: (_spec: BadgeSpec) => number;
+/** Paint a badge as an ANSI string (the non-tui path): right-aligning spaces + the colored box. */
+declare const paintBadge: (spec: BadgeSpec) => string;
+/** Dim continuation text (a step's chosen answer, shown under the question). */
+declare const paintAnswer: (text: string) => string;
 /** Candidate wrangler config filenames, in the order every consumer probes them. */
 declare const WRANGLER_FILES: readonly ["wrangler.jsonc", "wrangler.json"];
 /** Locate the project's wrangler config, or `undefined` when none exists. */
@@ -946,6 +1155,22 @@ interface WranglerWorkflowEntry {
   class_name?: string;
   name?: string;
 }
+/** A wrangler `queues.producers[]` entry — a `Queue` binding sending to `queue`. */
+interface WranglerQueueProducer {
+  binding?: string;
+  delivery_delay?: number;
+  queue?: string;
+}
+/** A wrangler `queues.consumers[]` entry — push (worker) or `type: "http_pull"`. */
+interface WranglerQueueConsumer {
+  dead_letter_queue?: string;
+  max_batch_size?: number;
+  max_batch_timeout?: number;
+  max_retries?: number;
+  queue?: string;
+  retry_delay?: number;
+  type?: string;
+}
 interface WranglerConfig {
   analytics_engine_datasets?: ReadonlyArray<{
     binding?: string;
@@ -1010,9 +1235,18 @@ interface WranglerConfig {
   placement?: {
     mode?: string;
   };
+  queues?: {
+    consumers?: ReadonlyArray<WranglerQueueConsumer | null | undefined>;
+    producers?: ReadonlyArray<WranglerQueueProducer | null | undefined>;
+  };
   r2_buckets?: ReadonlyArray<{
     binding?: string;
   }>;
+  secrets_store_secrets?: ReadonlyArray<{
+    binding?: string;
+    secret_name?: string;
+    store_id?: string;
+  } | null | undefined>;
   send_email?: ReadonlyArray<{
     allowed_destination_addresses?: ReadonlyArray<string>;
     destination_address?: string;
@@ -1072,4 +1306,4 @@ interface WranglerProjectValidationResult {
 * `{ problems, wranglerPath }` shape plus the structured `report`.
 */
 declare const validateWranglerProject: (options: WranglerProjectValidationOptions) => WranglerProjectValidationResult;
-export { AGENT_RULES_DIR, AGENT_RULES_HINT, AGENT_RULES_HINT_ENV, type AddIndexEdit, type AddOptionalColumnEdit, type AddTableEdit, type AdditiveEdit, type AgentRulesStatus, type ApplyEditResult, type ApplyFailureReason, type AugmentPlan, DEV_VARS_EXAMPLE_FILE, DEV_VARS_FILE, DEV_VARS_KEY_PATTERN, type DestructiveEdit, type DetectedFramework, type DiscoverContainerInfoResult, type DiscoverSchemaInfoResult, type DiscoverWorkflowInfoResult, type EnsureDevVariablesDeps, type EnsureDevVariablesResult, type EnsureDevVariablesStatus, type ExportGap, type FrameworkClass, type FrameworkDetection, type InferOptions, type InferredBindings, type InferredContainer, type InferredWorkflow, LINKED_PROJECT_DIR, LINKED_PROJECT_FILE, LUNORA_CONFIG_FILE, LUNORA_EVENT_SOURCE, LUNORA_SKILL_NAMES, type LinkedProject, type LunoraFormattedLine, type LunoraLineLevel, type LunoraProjectConfig, type MaterializeOptions, type MaterializeResult, type MultiSelectOption, PACKAGE_SECRETS_REGISTRY, type ParseSchemaResult, REMOTE_ELIGIBLE_KEYS, REQUIRED_COMPATIBILITY_DATE, REQUIRED_FLAG, ROOT_SKILL_NAME, type ReadWranglerResult, type ReconcileBindingsResult, type RemoteBindingPlan, type RemoteEnableInputs, type RemotePreference, type RemoteWranglerShape, type ScaffoldPlan, type SchemaColumn, type SchemaEdit, type SchemaIndex, type SchemaInfo, type SchemaTable, type SecretEntry, type SelectOption, type TailConsumer, WRANGLER_FILES, type WranglerConfig, type WranglerContainerEntry, type WranglerProjectValidationOptions, type WranglerProjectValidationResult, type WranglerValidationReport, type WranglerWorkflowEntry, applyAdditiveEdit, buildPackageSecretsBlock, claimAgentRulesHint, classifyEdit, createConfirm, detectAgentRules, detectFramework, discoverContainerInfo, discoverSchemaInfo, discoverWorkflowInfo, ensureDevVariables, ensureDevVariablesExample as ensureDevVarsExample, findWranglerFile, formatLunoraEvent, inferLunoraBindings, injectRemoteFlags, interpretRemote, isInteractive, isPlaceholderValue, isRemoteEnvEnabled, materializeRemoteWranglerConfig, packageNamesFromBindings, parseDevVariableEntries, parseSchema, planDevVariablesAugment, planDevVariablesScaffold, planRemoteBindings, promptMultiSelect, promptSelect, promptYesNo, readLinkedProject, readProjectRemotePreference, readWranglerJsonc, reconcileWranglerBindings, resolveRemoteEnabled, secretsForPackages, validateWrangler, validateWranglerConfig, validateWranglerProject, withTailConsumer, writeLinkedProject };
+export { ACCENT, AGENT_RULES_DIR, AGENT_RULES_HINT, AGENT_RULES_HINT_ENV, type AddIndexEdit, type AddOptionalColumnEdit, type AddTableEdit, type AdditiveEdit, type AgentRulesStatus, type ApplyEditResult, type ApplyFailureReason, type AugmentPlan, BADGES, BADGE_COLUMN_WIDTH, type BadgeName, type BadgeSpec, type ContainerLogLevel, type ContainerLogLine, type ContainerLogSource, type ContainerLogStreamHandle, type ContainerLogStreamOptions, DEV_VARS_EXAMPLE_FILE, DEV_VARS_FILE, DEV_VARS_KEY_PATTERN, type DestructiveEdit, type DetectedFramework, type DevSecretsFillPlan, type DiscoverContainerInfoResult, type DiscoverSchemaInfoResult, type DiscoverWorkflowInfoResult, type DockerLike, type EnsureDevVariablesDeps, type EnsureDevVariablesResult, type EnsureDevVariablesStatus, type ExportGap, type FillDevSecretsResult, type FrameworkClass, type FrameworkDetection, type InferOptions, type InferredBindings, type InferredContainer, type InferredWorkflow, LINKED_PROJECT_DIR, LINKED_PROJECT_FILE, LUNA_ART, LUNA_BUNNY, LUNA_NAME, LUNA_SIGNOFF, LUNORA_CONFIG_FILE, LUNORA_EVENT_SOURCE, LUNORA_SKILL_NAMES, type LevelBadgeName, type LinkedProject, type LunoraFormattedLine, type LunoraLineLevel, type LunoraProjectConfig, LunoraReporter, type MaterializeOptions, type MaterializeResult, type MultiSelectOption, PACKAGE_SECRETS_REGISTRY, type ParseSchemaResult, REMOTE_ELIGIBLE_KEYS, REQUIRED_COMPATIBILITY_DATE, REQUIRED_FLAG, ROOT_SKILL_NAME, type ReadWranglerResult, type ReconcileBindingsResult, type RemoteBindingPlan, type RemoteEnableInputs, type RemotePreference, type RemoteWranglerShape, STEP_BADGE_NAMES, type ScaffoldPlan, type SchemaColumn, type SchemaEdit, type SchemaIndex, type SchemaInfo, type SchemaTable, type SecretEntry, type SelectOption, type StepBadgeName, type TailConsumer, WRANGLER_FILES, type WranglerConfig, type WranglerContainerEntry, type WranglerProjectValidationOptions, type WranglerProjectValidationResult, type WranglerValidationReport, type WranglerWorkflowEntry, applyAdditiveEdit, badgeLead, badgeWidth, buildPackageSecretsBlock, claimAgentRulesHint, classifyEdit, createConfirm, detectAgentRules, detectFramework, discoverContainerInfo, discoverSchemaInfo, discoverWorkflowInfo, ensureDevVariables, ensureDevVariablesExample as ensureDevVarsExample, fillDevSecrets, findWranglerFile, formatLunoraEvent, generateSecretValue, inferLunoraBindings, injectRemoteFlags, interpretRemote, isInteractive, isMintableSecretKey, isPlaceholderValue, isRemoteEnvEnabled, materializeRemoteWranglerConfig, packageNamesFromBindings, padBadge, paintAnswer, paintBadge, parseDevVariableEntries, parseSchema, planDevSecretsFill, planDevVariablesAugment, planDevVariablesScaffold, planRemoteBindings, promptMultiSelect, promptSelect, promptYesNo, readLinkedProject, readProjectRemotePreference, readWranglerJsonc, reconcileWranglerBindings, requiredSecrets, resolveRemoteEnabled, secretsForPackages, streamContainerLogs, validateWrangler, validateWranglerConfig, validateWranglerProject, withTailConsumer, writeLinkedProject };

package/dist/index.mjs

@@ -1,20 +1,23 @@
 export { AGENT_RULES_DIR, AGENT_RULES_HINT, AGENT_RULES_HINT_ENV, LUNORA_SKILL_NAMES, ROOT_SKILL_NAME, claimAgentRulesHint, detectAgentRules } from './packem_shared/AGENT_RULES_DIR-lcgC08aE.mjs';
 export { discoverContainerInfo } from './packem_shared/discoverContainerInfo-BXFs6Wav.mjs';
+export { streamContainerLogs } from './packem_shared/streamContainerLogs-BZ4cOZwH.mjs';
 export { detectFramework } from './packem_shared/detectFramework-Br-BcPBq.mjs';
 export { DEV_VARS_EXAMPLE_FILE, DEV_VARS_FILE, DEV_VARS_KEY_PATTERN, parseDevVariableEntries } from './packem_shared/DEV_VARS_EXAMPLE_FILE-dJPNTEnK.mjs';
-export { inferLunoraBindings, packageNamesFromBindings } from './packem_shared/inferLunoraBindings-0W3eRdIP.mjs';
+export { inferLunoraBindings, packageNamesFromBindings } from './packem_shared/inferLunoraBindings-b9SJwb2s.mjs';
 export { LINKED_PROJECT_DIR, LINKED_PROJECT_FILE, readLinkedProject, writeLinkedProject } from './packem_shared/LINKED_PROJECT_DIR-CXwXzV_C.mjs';
-export { LUNORA_EVENT_SOURCE, formatLunoraEvent } from './packem_shared/formatLunoraEvent-D2fDeGB6.mjs';
-export { PACKAGE_SECRETS_REGISTRY, secretsForPackages } from './packem_shared/PACKAGE_SECRETS_REGISTRY-CySy5vR_.mjs';
-export { LUNORA_CONFIG_FILE, interpretRemote, readProjectRemotePreference } from './packem_shared/interpretRemote-CtcIcB5-.mjs';
+export { LUNORA_EVENT_SOURCE, formatLunoraEvent } from './packem_shared/LUNORA_EVENT_SOURCE-D2fDeGB6.mjs';
+export { default as LunoraReporter } from './packem_shared/LunoraReporter-Ci-bDCK9.mjs';
+export { PACKAGE_SECRETS_REGISTRY, secretsForPackages } from './packem_shared/PACKAGE_SECRETS_REGISTRY-B8t_SdoZ.mjs';
+export { LUNORA_CONFIG_FILE, interpretRemote, readProjectRemotePreference } from './packem_shared/LUNORA_CONFIG_FILE-CtcIcB5-.mjs';
 export { createConfirm, isInteractive, promptMultiSelect, promptSelect, promptYesNo } from './packem_shared/createConfirm-fvpdgJ9s.mjs';
-export { reconcileWranglerBindings } from './packem_shared/reconcileWranglerBindings-ByJk3yLU.mjs';
-export { REMOTE_ELIGIBLE_KEYS, injectRemoteFlags, isRemoteEnvEnabled, materializeRemoteWranglerConfig, planRemoteBindings, resolveRemoteEnabled } from './packem_shared/injectRemoteFlags-C-WZAKLY.mjs';
-export { buildPackageSecretsBlock, ensureDevVariables, ensureDevVarsExample, isPlaceholderValue, planDevVariablesAugment, planDevVariablesScaffold } from './packem_shared/buildPackageSecretsBlock-S74dgmwy.mjs';
+export { reconcileWranglerBindings } from './packem_shared/reconcileWranglerBindings-27af-Qvt.mjs';
+export { REMOTE_ELIGIBLE_KEYS, injectRemoteFlags, isRemoteEnvEnabled, materializeRemoteWranglerConfig, planRemoteBindings, resolveRemoteEnabled } from './packem_shared/REMOTE_ELIGIBLE_KEYS-BC7_e9Bz.mjs';
+export { buildPackageSecretsBlock, ensureDevVariables, ensureDevVarsExample, fillDevSecrets, generateSecretValue, isMintableSecretKey, isPlaceholderValue, planDevSecretsFill, planDevVariablesAugment, planDevVariablesScaffold, requiredSecrets } from './packem_shared/buildPackageSecretsBlock-DWDKHViT.mjs';
 export { applyAdditiveEdit, classifyEdit } from './packem_shared/applyAdditiveEdit-C-snTFEV.mjs';
 export { parseSchema } from './packem_shared/parseSchema-DSeyktvG.mjs';
 export { classifyPolicyEdit, scaffoldPolicyFile, wireRlsIntoProcedure } from './packem_shared/classifyPolicyEdit-BHeAqF8P.mjs';
-export { discoverSchemaInfo } from './packem_shared/discoverSchemaInfo-DWtypqpP.mjs';
+export { discoverSchemaInfo } from './packem_shared/discoverSchemaInfo-BB-CKlTK.mjs';
+export { ACCENT, BADGES, BADGE_COLUMN_WIDTH, LUNA_ART, LUNA_BUNNY, LUNA_NAME, LUNA_SIGNOFF, STEP_BADGE_NAMES, badgeLead, badgeWidth, padBadge, paintAnswer, paintBadge } from './packem_shared/ACCENT-DW1XJn8i.mjs';
 export { discoverWorkflowInfo } from './packem_shared/discoverWorkflowInfo-CedvR0mn.mjs';
-export { WRANGLER_FILES, findWranglerFile, readWranglerJsonc } from './packem_shared/findWranglerFile-DwSuC-Kn.mjs';
-export { REQUIRED_COMPATIBILITY_DATE, REQUIRED_FLAG, validateWrangler, validateWranglerConfig, validateWranglerProject, withTailConsumer } from './packem_shared/REQUIRED_COMPATIBILITY_DATE-Dd1suoit.mjs';
+export { WRANGLER_FILES, findWranglerFile, readWranglerJsonc } from './packem_shared/WRANGLER_FILES-DwSuC-Kn.mjs';
+export { REQUIRED_COMPATIBILITY_DATE, REQUIRED_FLAG, validateWrangler, validateWranglerConfig, validateWranglerProject, withTailConsumer } from './packem_shared/REQUIRED_COMPATIBILITY_DATE-USQQ7NfE.mjs';

package/dist/packem_shared/ACCENT-DW1XJn8i.mjs

@@ -0,0 +1,40 @@
+import colorize from '@visulima/colorize';
+
+const ACCENT = "#a855f7";
+const INK = "#0b0b0b";
+const STEP_BADGE_NAMES = ["lunora", "dir", "tmpl", "add", "deps", "git", "next"];
+const BADGES = {
+  add: { bg: ACCENT, fg: INK, text: "add" },
+  debug: { bg: "#6b7280", fg: "#f3f4f6", text: "debug" },
+  deps: { bg: ACCENT, fg: INK, text: "deps" },
+  dir: { bg: ACCENT, fg: INK, text: "dir" },
+  error: { bg: "#ef4444", fg: INK, text: "error" },
+  git: { bg: "#f59e0b", fg: INK, text: "git" },
+  info: { bg: "#3b82f6", fg: INK, text: "info" },
+  lunora: { bg: "#22c55e", fg: INK, text: "lunora" },
+  next: { bg: "#06b6d4", fg: INK, text: "next" },
+  success: { bg: "#22c55e", fg: INK, text: "ok" },
+  tmpl: { bg: ACCENT, fg: INK, text: "tmpl" },
+  warn: { bg: "#f59e0b", fg: INK, text: "warn" }
+};
+const LUNA_NAME = "Luna";
+const LUNA_SIGNOFF = "Safe travels, voyager.";
+const LUNA_BUNNY = String.raw`
+   .-"""""-.
+  /  (\(\   \
+ |   ( -.-)  |
+  \  o(")(") /
+   '-._____.-'`;
+const LUNA_ART = LUNA_BUNNY.startsWith("\n") ? LUNA_BUNNY.slice(1) : LUNA_BUNNY;
+const BADGE_GUTTER = 6;
+const padBadge = (text) => ` ${text} `;
+const badgeLead = (text) => " ".repeat(Math.max(0, BADGE_GUTTER - text.length));
+const BADGE_COLUMN_WIDTH = BADGE_GUTTER + 2;
+const badgeWidth = (_spec) => BADGE_COLUMN_WIDTH;
+const paintBadge = (spec) => (
+  // eslint-disable-next-line import/no-named-as-default-member -- see file header.
+  badgeLead(spec.text) + colorize.bgHex(spec.bg).hex(spec.fg).bold(padBadge(spec.text))
+);
+const paintAnswer = (text) => colorize.dim(text);
+
+export { ACCENT, BADGES, BADGE_COLUMN_WIDTH, LUNA_ART, LUNA_BUNNY, LUNA_NAME, LUNA_SIGNOFF, STEP_BADGE_NAMES, badgeLead, badgeWidth, padBadge, paintAnswer, paintBadge };

package/dist/packem_shared/LunoraReporter-Ci-bDCK9.mjs

@@ -0,0 +1,70 @@
+import { paintBadge, badgeWidth, BADGES } from './ACCENT-DW1XJn8i.mjs';
+
+const NAME_ALIASES = {
+  informational: "info",
+  warning: "warn"
+};
+const STDERR_LEVELS = /* @__PURE__ */ new Set(["alert", "critical", "emergency", "error", "warn", "warning"]);
+const resolveBadge = (name) => {
+  if (name in BADGES) {
+    return BADGES[name];
+  }
+  const alias = NAME_ALIASES[name];
+  return alias === void 0 ? void 0 : BADGES[alias];
+};
+const renderContextArgument = (value) => {
+  if (value instanceof Error) {
+    return `
+${value.stack ?? value.message}`;
+  }
+  if (typeof value === "object" && value !== null) {
+    try {
+      return ` ${JSON.stringify(value)}`;
+    } catch {
+      return " [unserializable]";
+    }
+  }
+  return ` ${String(value)}`;
+};
+const composeMessage = (meta) => {
+  const base = typeof meta.message === "string" ? meta.message : String(meta.message);
+  const context = meta.context ?? [];
+  return context.length === 0 ? base : base + context.map((value) => renderContextArgument(value)).join("");
+};
+class LunoraReporter {
+  #stdout = process.stdout;
+  #stderr = process.stderr;
+  setStdout(stdout) {
+    this.#stdout = stdout;
+  }
+  setStderr(stderr) {
+    this.#stderr = stderr;
+  }
+  // Note: pail's other reporter setters (setLoggerTypes / setInteractiveManager /
+  // setIsInteractive) are optional and intentionally omitted — this reporter keeps
+  // no type or interactive state; it only needs the two stream setters above.
+  log(meta) {
+    const data = meta;
+    const badge = resolveBadge(data.type.name);
+    const stream = STDERR_LEVELS.has(data.type.level ?? data.type.name) ? this.#stderr : this.#stdout;
+    stream.write(LunoraReporter.#render(badge, composeMessage(data)));
+  }
+  /**
+   * Frame `text` under `badge`: `<badge> <first line>`, with any further lines
+   * indented to align beneath the message. Without a badge (unknown type) the
+   * message is written plain.
+   */
+  static #render(badge, text) {
+    if (badge === void 0) {
+      return `${text}
+`;
+    }
+    const [first = "", ...rest] = text.split("\n");
+    const indent = " ".repeat(badgeWidth() + 1);
+    const lines = [`${paintBadge(badge)} ${first}`, ...rest.map((line) => `${indent}${line}`)];
+    return `${lines.join("\n")}
+`;
+  }
+}
+
+export { LunoraReporter as default };

package/dist/packem_shared/{PACKAGE_SECRETS_REGISTRY-CySy5vR_.mjs → PACKAGE_SECRETS_REGISTRY-B8t_SdoZ.mjs}

@@ -1,3 +1,11 @@
+const CORE_SECRETS = [
+  {
+    description: "Bearer token the local Lunora Studio uses to call the worker's admin endpoints (data browser, schema edits) in dev. Generate with: openssl rand -hex 32",
+    docsUrl: "https://lunora.sh/docs/packages/studio",
+    key: "LUNORA_ADMIN_TOKEN",
+    placeholderValue: "replace-with-openssl-rand-hex-32"
+  }
+];
 const PACKAGE_SECRETS_REGISTRY = {
   "@lunora/auth": [
     {
@@ -59,4 +67,4 @@ const secretsForPackages = (packageNames) => {
   return result;
 };
 
-export { PACKAGE_SECRETS_REGISTRY, secretsForPackages };
+export { CORE_SECRETS, PACKAGE_SECRETS_REGISTRY, secretsForPackages };

package/dist/packem_shared/{injectRemoteFlags-C-WZAKLY.mjs → REMOTE_ELIGIBLE_KEYS-BC7_e9Bz.mjs}

@@ -1,6 +1,6 @@
 import { writeFileSync, rmSync } from 'node:fs';
 import { modify, applyEdits } from 'jsonc-parser';
-import { findWranglerFile, readWranglerJsonc } from './findWranglerFile-DwSuC-Kn.mjs';
+import { findWranglerFile, readWranglerJsonc } from './WRANGLER_FILES-DwSuC-Kn.mjs';
 import { join } from 'node:path';
 
 const FORMATTING = { formattingOptions: { insertSpaces: true, tabSize: 4 } };

package/dist/packem_shared/{REQUIRED_COMPATIBILITY_DATE-Dd1suoit.mjs → REQUIRED_COMPATIBILITY_DATE-USQQ7NfE.mjs}

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { discoverSchemaInfo } from './discoverSchemaInfo-DWtypqpP.mjs';
-import { findWranglerFile, readWranglerJsonc } from './findWranglerFile-DwSuC-Kn.mjs';
+import { discoverSchemaInfo } from './discoverSchemaInfo-BB-CKlTK.mjs';
+import { findWranglerFile, readWranglerJsonc } from './WRANGLER_FILES-DwSuC-Kn.mjs';
 
 const REQUIRED_COMPATIBILITY_DATE = "2026-04-07";
 const REQUIRED_FLAG = "web_socket_auto_reply_to_close";
@@ -127,6 +127,82 @@ const validateWorkflows = (wrangler, errors) => {
     }
   }
 };
+const validateQueueProducers = (producers, errors) => {
+  if (producers === void 0) {
+    return;
+  }
+  if (!Array.isArray(producers)) {
+    errors.push("queues.producers must be an array of { binding, queue } entries");
+    return;
+  }
+  const entries = producers;
+  for (const [index, entry] of entries.entries()) {
+    const label = `queues.producers[${String(index)}]`;
+    if (!entry || typeof entry !== "object") {
+      errors.push(`${label} must be a { binding, queue } object`);
+      continue;
+    }
+    if (typeof entry.binding !== "string" || entry.binding.length === 0) {
+      errors.push(`${label} must have a non-empty "binding" naming the Queue producer (e.g. QUEUE_EMAIL)`);
+    }
+    if (typeof entry.queue !== "string" || entry.queue.length === 0) {
+      errors.push(`${label} must have a non-empty "queue" naming the deployed queue`);
+    }
+  }
+};
+const validateQueueConsumers = (consumers, errors) => {
+  if (consumers === void 0) {
+    return;
+  }
+  if (!Array.isArray(consumers)) {
+    errors.push("queues.consumers must be an array of { queue } entries");
+    return;
+  }
+  const entries = consumers;
+  for (const [index, entry] of entries.entries()) {
+    const label = `queues.consumers[${String(index)}]`;
+    if (!entry || typeof entry !== "object") {
+      errors.push(`${label} must be a { queue } object`);
+      continue;
+    }
+    if (typeof entry.queue !== "string" || entry.queue.length === 0) {
+      errors.push(`${label} must have a non-empty "queue" naming the consumed queue`);
+    }
+  }
+};
+const validateQueues = (wrangler, errors) => {
+  if (wrangler.queues === void 0) {
+    return;
+  }
+  if (typeof wrangler.queues !== "object" || Array.isArray(wrangler.queues)) {
+    errors.push("queues must be a { producers, consumers } object");
+    return;
+  }
+  validateQueueProducers(wrangler.queues.producers, errors);
+  validateQueueConsumers(wrangler.queues.consumers, errors);
+};
+const validateSecretsStore = (wrangler, errors) => {
+  if (wrangler.secrets_store_secrets === void 0) {
+    return;
+  }
+  if (!Array.isArray(wrangler.secrets_store_secrets)) {
+    errors.push("secrets_store_secrets must be an array of { binding, store_id, secret_name } entries");
+    return;
+  }
+  const entries = wrangler.secrets_store_secrets;
+  for (const [index, entry] of entries.entries()) {
+    const label = `secrets_store_secrets[${String(index)}]`;
+    if (!entry || typeof entry !== "object") {
+      errors.push(`${label} must be a { binding, store_id, secret_name } object`);
+      continue;
+    }
+    for (const field of ["binding", "store_id", "secret_name"]) {
+      if (typeof entry[field] !== "string" || entry[field].length === 0) {
+        errors.push(`${label} must have a non-empty "${field}"`);
+      }
+    }
+  }
+};
 const isNonEmptyString = (value) => typeof value === "string" && value.length > 0;
 const asBindingEntries = (value) => value;
 const HINT_BINDING_RULES = [
@@ -398,6 +474,8 @@ const validateWranglerConfig = (wrangler, schema) => {
   validateTailConsumers(wrangler, errors);
   validateContainers(wrangler, errors, warnings);
   validateWorkflows(wrangler, errors);
+  validateQueues(wrangler, errors);
+  validateSecretsStore(wrangler, errors);
   for (const rule of HINT_BINDING_RULES) {
     validateHintBinding(wrangler, rule, errors, warnings);
   }