@lunora/config 1.0.0-alpha.6 → 1.0.0-alpha.61

package/dist/packem_shared/collectWranglerSecretVariables-Red5H-4V.mjs

@@ -0,0 +1,56 @@
+import { relative } from 'node:path';
+import { secretKindOf, redact } from '@lunora/codegen';
+import { isPlaceholderValue } from './buildPackageSecretsBlock-BDXX0mKG.mjs';
+import { findWranglerFile, readWranglerJsonc } from './WRANGLER_FILES-DwSuC-Kn.mjs';
+
+const MIN_SECRET_NAMED_VALUE_LENGTH = 8;
+const SECRET_WORD_TOKENS = /* @__PURE__ */ new Set(["CREDENTIAL", "CREDENTIALS", "DSN", "PASSPHRASE", "PASSWD", "PASSWORD", "SECRET", "TOKEN"]);
+const SECRET_KEY_SUFFIXES = ["ACCESS_KEY", "API_KEY", "ENCRYPTION_KEY", "PRIVATE_KEY", "SIGNING_KEY"];
+const PUBLIC_KEY_TOKENS = /* @__PURE__ */ new Set(["PUBLIC", "PUBLISHABLE"]);
+const KEY_SEPARATOR_RE = /[_-]/u;
+const keyTokens = (key) => key.toUpperCase().split(KEY_SEPARATOR_RE);
+const isSecretKeyName = (key) => {
+  const normalized = key.toUpperCase().replaceAll("-", "_");
+  if (keyTokens(key).some((token) => SECRET_WORD_TOKENS.has(token))) {
+    return true;
+  }
+  return SECRET_KEY_SUFFIXES.some((suffix) => normalized === suffix || normalized.endsWith(`_${suffix}`));
+};
+const isPublicKeyName = (key) => keyTokens(key).some((token) => PUBLIC_KEY_TOKENS.has(token));
+const scanWranglerVariablesForSecrets = (variables, file) => {
+  if (variables === void 0) {
+    return [];
+  }
+  const findings = [];
+  for (const [key, rawValue] of Object.entries(variables)) {
+    if (typeof rawValue !== "string") {
+      continue;
+    }
+    if (isPlaceholderValue(rawValue)) {
+      continue;
+    }
+    if (isPublicKeyName(key)) {
+      continue;
+    }
+    const shapeKind = secretKindOf(rawValue);
+    const kind = shapeKind ?? (isSecretKeyName(key) && rawValue.length >= MIN_SECRET_NAMED_VALUE_LENGTH ? "secret_named_var" : void 0);
+    if (kind === void 0) {
+      continue;
+    }
+    findings.push({ file, key, kind, preview: redact(rawValue) });
+  }
+  return findings;
+};
+const collectWranglerSecretVariables = (projectRoot) => {
+  const wranglerPath = findWranglerFile(projectRoot);
+  if (wranglerPath === void 0) {
+    return [];
+  }
+  const { parsed } = readWranglerJsonc(wranglerPath);
+  if (parsed === void 0) {
+    return [];
+  }
+  return scanWranglerVariablesForSecrets(parsed.vars, relative(projectRoot, wranglerPath));
+};
+
+export { collectWranglerSecretVariables, scanWranglerVariablesForSecrets };

package/dist/packem_shared/{detectFramework-Br-BcPBq.mjs → detectFramework-U08038Yp.mjs}

@@ -12,7 +12,7 @@ const FRAMEWORK_SIGNATURES = [
   { class: "B", dependency: "astro", framework: "astro" }
 ];
 const STANDALONE = { class: "C", framework: "none" };
-const readDependencyNames = (root) => {
+const readProjectDependencyNames = (root) => {
   const packageJsonPath = join(root, "package.json");
   if (!existsSync(packageJsonPath)) {
     return /* @__PURE__ */ new Set();
@@ -26,7 +26,7 @@ const readDependencyNames = (root) => {
   }
 };
 const detectFramework = (root) => {
-  const dependencies = readDependencyNames(root);
+  const dependencies = readProjectDependencyNames(root);
   if (dependencies.size === 0) {
     return STANDALONE;
   }
@@ -38,4 +38,4 @@ const detectFramework = (root) => {
   return STANDALONE;
 };
 
-export { detectFramework };
+export { detectFramework, readProjectDependencyNames };

package/dist/packem_shared/{discoverSchemaInfo-DWtypqpP.mjs → discoverSchemaInfo-BB-CKlTK.mjs}

@@ -10,7 +10,7 @@ const discoverSchemaInfo = (projectRoot, schemaDirectory) => {
   }
   try {
     const project = new Project({ skipAddingFilesFromTsConfig: true, useInMemoryFileSystem: false });
-    const schema = discoverSchema(project, schemaPath);
+    const schema = discoverSchema(project, schemaPath, projectRoot);
     return {
       info: {
         hasGlobalTable: schema.tables.some((table) => table.shardMode === "global"),

package/dist/packem_shared/{inferLunoraBindings-XNJH4pup.mjs → inferLunoraBindings-BadOK1UZ.mjs}

@@ -1,10 +1,38 @@
 import { existsSync, statSync, readFileSync, readdirSync } from 'node:fs';
 import { init, parse } from 'es-module-lexer';
 import { discoverContainerInfo } from './discoverContainerInfo-BXFs6Wav.mjs';
-import { discoverSchemaInfo } from './discoverSchemaInfo-DWtypqpP.mjs';
+import { FLAGS_FILENAME, discoverFlags, QUEUES_FILENAME, discoverQueues } from '@lunora/codegen';
+import { Project } from 'ts-morph';
+import { join } from 'node:path';
+import { discoverSchemaInfo } from './discoverSchemaInfo-BB-CKlTK.mjs';
 import { discoverWorkflowInfo } from './discoverWorkflowInfo-CedvR0mn.mjs';
 import { WRANGLER_FILES, readWranglerJsonc } from './WRANGLER_FILES-DwSuC-Kn.mjs';
-import { join } from 'node:path';
+
+const discoverFlagsInfo = (projectRoot, schemaDirectory) => {
+  const flagsPath = join(projectRoot, schemaDirectory, FLAGS_FILENAME);
+  if (!existsSync(flagsPath)) {
+    return {};
+  }
+  try {
+    const project = new Project({ skipAddingFilesFromTsConfig: true, useInMemoryFileSystem: false });
+    return { flags: discoverFlags(project, join(projectRoot, schemaDirectory)) };
+  } catch (error) {
+    return { error: error instanceof Error ? error.message : String(error) };
+  }
+};
+
+const discoverQueueInfo = (projectRoot, schemaDirectory) => {
+  const queuesPath = join(projectRoot, schemaDirectory, QUEUES_FILENAME);
+  if (!existsSync(queuesPath)) {
+    return { queues: [] };
+  }
+  try {
+    const project = new Project({ skipAddingFilesFromTsConfig: true, useInMemoryFileSystem: false });
+    return { queues: discoverQueues(project, join(projectRoot, schemaDirectory)) };
+  } catch (error) {
+    return { error: error instanceof Error ? error.message : String(error), queues: [] };
+  }
+};
 
 const SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".cjs", ".cts", ".js", ".jsx", ".mjs", ".mts", ".ts", ".tsx"]);
 const IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([".git", ".lunora-cache", ".wrangler", "_generated", "dist", "node_modules"]);
@@ -23,20 +51,31 @@ const TYPE_ONLY_EXPORT_PATTERNS = {
 };
 const ENV_DB_PATTERN = /\benv\s*\.\s*DB\b/;
 const ENV_AI_PATTERN = /\benv\s*\.\s*AI\b/;
+const CTX_PIPELINES_PATTERN = /\bctx\s*\.\s*pipelines\b/;
 const TYPE_ONLY_IMPORT_PATTERN = /^\s*import\s+type\b/;
 const CAPABILITY_SOURCES = {
   usesAi: { pattern: /\bfrom\s+["']@lunora\/ai["']/, source: "@lunora/ai" },
-  usesAnalytics: { pattern: /\bfrom\s+["']@lunora\/analytics["']/, source: "@lunora/analytics" },
+  usesAnalytics: { pattern: /\bfrom\s+["']@lunora\/bindings\/analytics["']/, source: "@lunora/bindings/analytics" },
   usesAuth: { pattern: /\bfrom\s+["']@lunora\/auth["']/, source: "@lunora/auth" },
   usesBrowser: { pattern: /\bfrom\s+["']@lunora\/browser["']/, source: "@lunora/browser" },
   usesHyperdrive: { pattern: /\bfrom\s+["']@lunora\/hyperdrive["']/, source: "@lunora/hyperdrive" },
-  usesImages: { pattern: /\bfrom\s+["']@lunora\/images["']/, source: "@lunora/images" },
-  usesKv: { pattern: /\bfrom\s+["']@lunora\/kv["']/, source: "@lunora/kv" },
+  usesImages: { pattern: /\bfrom\s+["']@lunora\/bindings\/images["']/, source: "@lunora/bindings/images" },
+  usesKv: { pattern: /\bfrom\s+["']@lunora\/bindings\/kv["']/, source: "@lunora/bindings/kv" },
   usesMail: { pattern: /\bfrom\s+["']@lunora\/mail["']/, source: "@lunora/mail" },
   usesPayment: { pattern: /\bfrom\s+["']@lunora\/payment["']/, source: "@lunora/payment" },
-  usesPipelines: { pattern: /\bfrom\s+["']@lunora\/pipelines["']/, source: "@lunora/pipelines" },
+  // Keyed off the `ctx.pipelines` access (not an import) — see CTX_PIPELINES_PATTERN.
+  // Pipelines is codegen-wired onto ActionCtx, so apps reach it via `ctx.pipelines`
+  // rather than importing `@lunora/bindings/pipelines`; `source` names that subpath
+  // for the hint message.
+  usesPipelines: { pattern: CTX_PIPELINES_PATTERN, source: "@lunora/bindings/pipelines" },
   usesScheduler: { pattern: /\bfrom\s+["']@lunora\/scheduler["']/, source: "@lunora/scheduler" },
-  usesStorage: { pattern: /\bfrom\s+["']@lunora\/storage["']/, source: "@lunora/storage" }
+  usesStorage: { pattern: /\bfrom\s+["']@lunora\/storage["']/, source: "@lunora/storage" },
+  // x402 rails are opt-in add-on subpaths (not part of the `lunorash` umbrella),
+  // so they key off the exact `@lunora/x402/{charge,pay}` specifiers. Neither
+  // implies a `.dev.vars` secret: the charge recipient is a user-named `[vars]`
+  // entry and the pay wallet key is a Secrets Store binding — both hint-only.
+  usesX402Charge: { pattern: /\bfrom\s+["']@lunora\/x402\/charge["']/, source: "@lunora/x402/charge" },
+  usesX402Pay: { pattern: /\bfrom\s+["']@lunora\/x402\/pay["']/, source: "@lunora/x402/pay" }
 };
 const CAPABILITY_FLAGS = Object.keys(CAPABILITY_SOURCES);
 const PAYMENT_PROVIDER_SECRETS = "STRIPE_SECRET_KEY + STRIPE_WEBHOOK_SECRET (Stripe) or POLAR_ACCESS_TOKEN + POLAR_WEBHOOK_SECRET (Polar)";
@@ -90,7 +129,12 @@ const capabilitiesFromSource = (code) => {
   } catch {
     capabilities = regexCapabilities(code);
   }
-  return mergeCapabilities(capabilities, { ...NO_CAPABILITIES, needsD1: ENV_DB_PATTERN.test(code), usesAi: ENV_AI_PATTERN.test(code) });
+  return mergeCapabilities(capabilities, {
+    ...NO_CAPABILITIES,
+    needsD1: ENV_DB_PATTERN.test(code),
+    usesAi: ENV_AI_PATTERN.test(code),
+    usesPipelines: CTX_PIPELINES_PATTERN.test(code)
+  });
 };
 const collectSourceFiles = (directory, accumulator) => {
   let entries;
@@ -237,14 +281,14 @@ const describeCapabilitySignals = (capabilities, exported) => {
     // Self-describing bindings: the binding name is the whole config (no remote
     // id to mint), so reconcile auto-writes them like the DO/D1 bindings.
     [capabilities.usesBrowser, "browser (@lunora/browser imported) — self-describing { binding: BROWSER }"],
-    [capabilities.usesImages, "images (@lunora/images imported) — self-describing { binding: IMAGES }"],
-    [capabilities.usesAnalytics, "analytics_engine_datasets (@lunora/analytics imported) — self-describing { binding: ANALYTICS, dataset }"],
+    [capabilities.usesImages, "images (@lunora/bindings/images imported) — self-describing { binding: IMAGES }"],
+    [capabilities.usesAnalytics, "analytics_engine_datasets (@lunora/bindings/analytics imported) — self-describing { binding: ANALYTICS, dataset }"],
     // Hint bindings: each needs a remote resource Lunora can't fabricate (a KV
     // namespace id, a Hyperdrive id, a Pipelines pipeline name), so they surface
     // as hints — never an auto-write — exactly like R2's user-defined bucket name.
     [
       capabilities.usesKv,
-      "hint: @lunora/kv is imported; add a kv_namespaces binding ({ binding, id }) and pass env.<BINDING> to createKv() — the namespace id can't be auto-provisioned"
+      "hint: @lunora/bindings/kv is imported; add a kv_namespaces binding ({ binding, id }) and pass env.<BINDING> to createKv() — the namespace id can't be auto-provisioned"
     ],
     [
       capabilities.usesHyperdrive,
@@ -252,7 +296,15 @@ const describeCapabilitySignals = (capabilities, exported) => {
     ],
     [
       capabilities.usesPipelines,
-      "hint: @lunora/pipelines is imported; run 'wrangler pipelines create <name>' and add a 'pipelines' binding ({ binding, pipeline }) — the pipeline resource can't be auto-provisioned"
+      "hint: ctx.pipelines is used; run 'wrangler pipelines create <name>' and add a 'pipelines' binding ({ binding, pipeline }) — the pipeline resource can't be auto-provisioned"
+    ],
+    [
+      capabilities.usesX402Charge,
+      "hint: @lunora/x402/charge is imported; set the recipient wallet address as a [vars] entry (the var name is yours to choose) and pass it to the charge config — the x402 facilitator settles USDC to that address"
+    ],
+    [
+      capabilities.usesX402Pay,
+      "hint: @lunora/x402/pay is imported (ActionCtx-only, spends real funds); add a secrets_store_secrets[] binding for the agent wallet key (name it to match signer.secretName) and pair the pay rail with a spend policy — ctx.secrets reads a Secrets Store binding, not .dev.vars, so the key can't be auto-provisioned"
     ]
   ];
   return rules.filter(([active]) => active).map(([, signal]) => signal);
@@ -276,15 +328,27 @@ const inferLunoraBindings = async (options) => {
   const needsD1 = capabilities.needsD1 || schemaNeedsD1(options.projectRoot, schemaDirectory);
   const containers = detectContainerExports(entryPath, discoverContainerInfo(options.projectRoot, schemaDirectory).containers);
   const workflows = detectWorkflowExports(entryPath, discoverWorkflowInfo(options.projectRoot, schemaDirectory).workflows);
+  const queues = [...discoverQueueInfo(options.projectRoot, schemaDirectory).queues];
+  const { flags } = discoverFlagsInfo(options.projectRoot, schemaDirectory);
+  const flagshipBinding = flags?.provider === "flagship" && flags.mode === "binding" ? flags.bindingName : void 0;
   const capabilityFlags = {};
   for (const flag of CAPABILITY_FLAGS) {
     capabilityFlags[flag] = capabilities[flag];
   }
+  const signals = describeSignals(durableObjects, needsD1, capabilities, containers, workflows);
+  if (flagshipBinding !== void 0) {
+    signals.push(
+      `hint: lunora/flags.ts uses Flagship in binding mode; add a flagship binding ({ binding: "${flagshipBinding}", app_id }) — the app_id can't be auto-provisioned`
+    );
+  }
   return {
     containers,
     durableObjects,
+    flagshipBinding,
     needsD1,
-    signals: describeSignals(durableObjects, needsD1, capabilities, containers, workflows),
+    queues,
+    signals,
+    usesFlags: flags !== void 0,
     workflows,
     ...capabilityFlags
   };

package/dist/packem_shared/{reconcileWranglerBindings-DTHmqTbL.mjs → reconcileWranglerBindings-BZdPBnpZ.mjs}

@@ -20,10 +20,11 @@ const collectExportGaps = (inferred) => {
   return gaps;
 };
 const collectHintBindingWarnings = (inferred, parsed) => {
+  const flagshipBindingMissing = inferred.flagshipBinding !== void 0 && !(parsed?.flagship ?? []).some((entry) => entry.binding === inferred.flagshipBinding);
   const rules = [
     [
       inferred.usesKv && (parsed?.kv_namespaces?.length ?? 0) === 0,
-      "@lunora/kv is used but no kv_namespaces binding exists; add a kv_namespaces entry ({ binding, id }) and pass env.<BINDING> to createKv() — the namespace id can't be auto-provisioned."
+      "@lunora/bindings/kv is used but no kv_namespaces binding exists; add a kv_namespaces entry ({ binding, id }) and pass env.<BINDING> to createKv() — the namespace id can't be auto-provisioned."
     ],
     [
       inferred.usesHyperdrive && (parsed?.hyperdrive?.length ?? 0) === 0,
@@ -31,7 +32,24 @@ const collectHintBindingWarnings = (inferred, parsed) => {
     ],
     [
       inferred.usesPipelines && (parsed?.pipelines?.length ?? 0) === 0,
-      "@lunora/pipelines is used but no pipelines binding exists; run 'wrangler pipelines create <name>' and add a 'pipelines' binding ({ binding, pipeline }) — the pipeline resource can't be auto-provisioned."
+      "ctx.pipelines is used but no pipelines binding exists; run 'wrangler pipelines create <name>' and add a 'pipelines' binding ({ binding, pipeline }) — the pipeline resource can't be auto-provisioned."
+    ],
+    [
+      flagshipBindingMissing,
+      `lunora/flags.ts uses Flagship in binding mode but no flagship binding "${inferred.flagshipBinding ?? ""}" exists; add a flagship entry ({ binding: "${inferred.flagshipBinding ?? ""}", app_id }) — the app_id can't be auto-provisioned.`
+    ]
+  ];
+  return rules.filter(([active]) => active).map(([, warning]) => warning);
+};
+const collectX402Warnings = (inferred) => {
+  const rules = [
+    [
+      inferred.usesX402Charge,
+      "@lunora/x402/charge is used; set the recipient wallet address as a [vars] entry (the var name is your choice) and pass it to the charge config — the x402 facilitator settles USDC to that address."
+    ],
+    [
+      inferred.usesX402Pay,
+      "@lunora/x402/pay is used (ActionCtx-only, spends real funds); add a secrets_store_secrets[] binding holding the agent wallet key (binding name == signer.secretName) and pair the pay rail with a spend policy — ctx.secrets reads a Secrets Store binding, not .dev.vars."
     ]
   ];
   return rules.filter(([active]) => active).map(([, warning]) => warning);
@@ -76,7 +94,7 @@ const collectWarnings = (inferred, parsed) => {
       "@lunora/payment is used; set the provider secrets in .dev.vars — STRIPE_SECRET_KEY + STRIPE_WEBHOOK_SECRET (Stripe) or POLAR_ACCESS_TOKEN + POLAR_WEBHOOK_SECRET (Polar)."
     );
   }
-  warnings.push(...collectHintBindingWarnings(inferred, parsed));
+  warnings.push(...collectX402Warnings(inferred), ...collectHintBindingWarnings(inferred, parsed));
   return warnings;
 };
 const applyModify = (text, path, value) => {
@@ -222,6 +240,57 @@ const reconcileWorkflows = (text, parsed, workflows) => {
   const nextText = applyModify(text, ["workflows"], [...existing, ...missing.map((workflow) => workflowEntryFor(workflow))]);
   return { added: missing.map((workflow) => `workflows/${workflow.className}`), text: nextText };
 };
+const reconcileQueues = (text, parsed, queues) => {
+  const existing = parsed.queues ?? {};
+  const existingProducers = existing.producers ?? [];
+  const existingConsumers = existing.consumers ?? [];
+  const haveProducer = new Set(existingProducers.map((entry) => entry.binding));
+  const haveConsumer = new Set(existingConsumers.map((entry) => entry.queue));
+  const missingProducers = queues.filter((queue) => !haveProducer.has(queue.bindingName));
+  const missingConsumers = queues.filter((queue) => !haveConsumer.has(queue.name));
+  if (missingProducers.length === 0 && missingConsumers.length === 0) {
+    return { added: [], text };
+  }
+  const nextProducers = [
+    ...existingProducers,
+    ...missingProducers.map((queue) => {
+      return { binding: queue.bindingName, queue: queue.name };
+    })
+  ];
+  const nextConsumers = [
+    ...existingConsumers,
+    ...missingConsumers.map((queue) => {
+      const consumer = { queue: queue.name };
+      if (queue.mode === "pull") {
+        consumer.type = "http_pull";
+      }
+      if (queue.tuning.maxBatchSize !== void 0) {
+        consumer.max_batch_size = queue.tuning.maxBatchSize;
+      }
+      if (queue.tuning.maxBatchTimeout !== void 0) {
+        consumer.max_batch_timeout = queue.tuning.maxBatchTimeout;
+      }
+      if (queue.tuning.maxRetries !== void 0) {
+        consumer.max_retries = queue.tuning.maxRetries;
+      }
+      if (queue.tuning.deadLetterQueue !== void 0) {
+        consumer.dead_letter_queue = queue.tuning.deadLetterQueue;
+      }
+      if (queue.tuning.retryDelay !== void 0) {
+        consumer.retry_delay = queue.tuning.retryDelay;
+      }
+      return consumer;
+    })
+  ];
+  const nextText = applyModify(text, ["queues"], { consumers: nextConsumers, producers: nextProducers });
+  return {
+    added: [
+      ...missingProducers.map((queue) => `queues.producers/${queue.bindingName}`),
+      ...missingConsumers.map((queue) => `queues.consumers/${queue.name}`)
+    ],
+    text: nextText
+  };
+};
 const reconcileWranglerBindings = (projectRoot, inferred) => {
   const wranglerPath = findWranglerFile(projectRoot);
   const exportGaps = collectExportGaps(inferred);
@@ -250,7 +319,8 @@ const reconcileWranglerBindings = (projectRoot, inferred) => {
     { enabled: inferred.usesAnalytics, run: (text2) => reconcileAnalytics(text2, parsed) },
     { enabled: true, run: (text2) => reconcileObservability(text2, parsed) },
     { enabled: exportedContainers.length > 0, run: (text2) => reconcileContainers(text2, parsed, exportedContainers) },
-    { enabled: exportedWorkflows.length > 0, run: (text2) => reconcileWorkflows(text2, parsed, exportedWorkflows) }
+    { enabled: exportedWorkflows.length > 0, run: (text2) => reconcileWorkflows(text2, parsed, exportedWorkflows) },
+    { enabled: inferred.queues.length > 0, run: (text2) => reconcileQueues(text2, parsed, inferred.queues) }
   ];
   let text = original;
   const added = [];

package/dist/packem_shared/reconcileWranglerCompatibilityDate-CYY0rVnJ.mjs

@@ -0,0 +1,34 @@
+import { writeFileSync } from 'node:fs';
+import { modify, applyEdits } from 'jsonc-parser';
+import { findWranglerFile, readWranglerJsonc } from './WRANGLER_FILES-DwSuC-Kn.mjs';
+
+const WORKERS_CACHE_MIN_DATE = "2026-05-01";
+const FORMATTING = { formattingOptions: { insertSpaces: true, tabSize: 4 } };
+const reconcileWranglerCompatibilityDate = (projectRoot) => {
+  const wranglerPath = findWranglerFile(projectRoot);
+  if (!wranglerPath) {
+    return { changed: false, date: void 0, reason: "wrangler.jsonc not found" };
+  }
+  const { parsed, text } = readWranglerJsonc(wranglerPath);
+  if (parsed === void 0) {
+    return { changed: false, date: void 0, reason: `failed to parse ${wranglerPath} as JSONC`, wranglerPath };
+  }
+  const currentDate = parsed.compatibility_date ?? "";
+  const cacheEnabledTopLevel = typeof parsed.cache === "object" && parsed.cache !== null && parsed.cache.enabled === true;
+  const cacheEnabledInExports = typeof parsed.exports === "object" && parsed.exports !== null && Object.values(parsed.exports).some((entry) => typeof entry === "object" && entry !== null && entry.cache?.enabled === true);
+  const needsCacheDate = cacheEnabledTopLevel || cacheEnabledInExports;
+  if (!needsCacheDate) {
+    return { changed: false, date: currentDate || void 0, reason: "cache not enabled", wranglerPath };
+  }
+  if (currentDate >= WORKERS_CACHE_MIN_DATE) {
+    return { changed: false, date: currentDate, reason: `compatibility_date already >= ${WORKERS_CACHE_MIN_DATE}`, wranglerPath };
+  }
+  const edits = modify(text, ["compatibility_date"], WORKERS_CACHE_MIN_DATE, FORMATTING);
+  if (edits.length === 0) {
+    return { changed: false, date: currentDate || void 0, reason: "no structural edit produced", wranglerPath };
+  }
+  writeFileSync(wranglerPath, applyEdits(text, edits), "utf8");
+  return { changed: true, date: WORKERS_CACHE_MIN_DATE, wranglerPath };
+};
+
+export { reconcileWranglerCompatibilityDate };

package/dist/packem_shared/streamContainerLogs-BZ4cOZwH.mjs

@@ -0,0 +1,157 @@
+import { Writable } from 'node:stream';
+import { StringDecoder } from 'node:string_decoder';
+
+const DEV_CONTAINER_IMAGE_PREFIX = "cloudflare-dev/";
+const DEFAULT_POLL_INTERVAL_MS = 1500;
+const createDefaultDocker = async () => {
+  const { default: Dockerode } = await import('dockerode');
+  return new Dockerode();
+};
+const classFromImage = (image) => {
+  if (!image.startsWith(DEV_CONTAINER_IMAGE_PREFIX)) {
+    return void 0;
+  }
+  const [segment] = image.slice(DEV_CONTAINER_IMAGE_PREFIX.length).split(":");
+  return segment !== void 0 && segment.length > 0 ? segment : void 0;
+};
+const lineBufferWritable = (emit) => {
+  const decoder = new StringDecoder("utf8");
+  let buffer = "";
+  const flushLine = (line) => {
+    emit(line.endsWith("\r") ? line.slice(0, -1) : line);
+  };
+  return new Writable({
+    final(callback) {
+      buffer += decoder.end();
+      if (buffer.length > 0) {
+        flushLine(buffer);
+        buffer = "";
+      }
+      callback();
+    },
+    write(chunk, _encoding, callback) {
+      buffer += decoder.write(chunk);
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        flushLine(line);
+      }
+      callback();
+    }
+  });
+};
+const streamContainerLogs = (options) => {
+  const classToExport = new Map(options.containers.map((source) => [source.className.toLowerCase(), source.exportName]));
+  if (classToExport.size === 0) {
+    return { close: () => {
+    } };
+  }
+  const interval = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const attached = /* @__PURE__ */ new Map();
+  let closed = false;
+  let unavailableNotified = false;
+  let timer;
+  let dockerPromise;
+  const getDocker = async () => {
+    dockerPromise ??= options.docker ? Promise.resolve(options.docker) : createDefaultDocker();
+    return dockerPromise;
+  };
+  const attach = async (docker, id, exportName) => {
+    try {
+      const stream = await docker.getContainer(id).logs({ follow: true, stderr: true, stdout: true, tail: "all", timestamps: false });
+      if (closed) {
+        stream.destroy();
+        return;
+      }
+      const stdout = lineBufferWritable((text) => {
+        options.onLine({ level: "info", name: exportName, text });
+      });
+      const stderr = lineBufferWritable((text) => {
+        options.onLine({ level: "error", name: exportName, text });
+      });
+      docker.modem.demuxStream(stream, stdout, stderr);
+      stream.on("end", () => {
+        stdout.end();
+        stderr.end();
+        attached.delete(id);
+      });
+      stream.on("error", () => {
+        attached.delete(id);
+      });
+      attached.set(id, stream);
+    } catch {
+    }
+  };
+  const listRunning = async () => {
+    try {
+      const docker = await getDocker();
+      const running = await docker.listContainers({ filters: { status: ["running"] } });
+      unavailableNotified = false;
+      return running;
+    } catch (error) {
+      if (!unavailableNotified) {
+        unavailableNotified = true;
+        options.onUnavailable?.(error instanceof Error ? error.message : String(error));
+      }
+      return void 0;
+    }
+  };
+  const reconcile = async (docker, running) => {
+    const live = /* @__PURE__ */ new Set();
+    for (const summary of running) {
+      const className = classFromImage(summary.Image);
+      const exportName = className === void 0 ? void 0 : classToExport.get(className);
+      if (exportName === void 0) {
+        continue;
+      }
+      live.add(summary.Id);
+      if (!attached.has(summary.Id)) {
+        await attach(docker, summary.Id, exportName);
+      }
+    }
+    for (const [id, stream] of attached) {
+      if (!live.has(id)) {
+        stream.destroy();
+        attached.delete(id);
+      }
+    }
+  };
+  const poll = async () => {
+    if (closed) {
+      return;
+    }
+    const running = await listRunning();
+    if (running === void 0) {
+      return;
+    }
+    await reconcile(await getDocker(), running);
+  };
+  let polling = false;
+  const onTick = () => {
+    if (polling || closed) {
+      return;
+    }
+    polling = true;
+    poll().finally(() => {
+      polling = false;
+    }).catch(() => void 0);
+  };
+  timer = setInterval(onTick, interval);
+  timer.unref();
+  onTick();
+  return {
+    close: () => {
+      closed = true;
+      if (timer) {
+        clearInterval(timer);
+        timer = void 0;
+      }
+      for (const [id, stream] of attached) {
+        stream.destroy();
+        attached.delete(id);
+      }
+    }
+  };
+};
+
+export { streamContainerLogs };

package/dist/studio-host/index.d.mts

@@ -81,6 +81,38 @@ declare const loadStudioAssets: (logger?: WarnLogger, resolveFrom?: string) => S
 */
 declare const studioAssetsStamp: (resolveFrom?: string) => number | undefined;
 /**
+* Absolute path of the built standalone directory — `@lunora/studio`'s
+* `dist/standalone`, where the `studio.js` entry and its code-split `chunk-*.js`
+* siblings live — or `undefined` when the studio isn't installed/built. The
+* standalone bundle is emitted with esbuild `splitting`, so the hosts must serve
+* the whole directory (not two fixed paths); this resolves its root.
+*/
+declare const resolveStandaloneDirectory: (resolveFrom?: string) => string | undefined;
+/**
+* Read a single file from the standalone directory by its plain filename (the
+* `studio.js` entry, a `chunk-*.js`, or a `.map`). **Path-traversal-safe** via
+* {@link resolveContainedFile}: only a lone filename resolving to a direct child
+* of the standalone directory is served — any separator, `..`, NUL, or absolute
+* path is rejected — so a request like `../../etc/passwd` can never escape it.
+* Returns the bytes, or `undefined` when the studio isn't built or the name
+* doesn't resolve to a file inside the directory (the host answers that 404).
+*/
+declare const readStandaloneAsset: (fileName: string, resolveFrom?: string) => Buffer | undefined;
+/**
+* True when `pathname` addresses a standalone JS module — the `studio.js` entry
+* or one of its code-split `chunk-*.js` siblings (and their `.map`s). Shared by
+* the CLI and Vite hosts so both route the same request shapes to the directory
+* server; the stylesheet is matched separately at each host's own style path.
+*/
+declare const isStandaloneModulePath: (pathname: string) => boolean;
+/**
+* Content-Type for a served standalone asset, by extension: `.css` → CSS,
+* `.map` → JSON (a source map), everything else (the `.js` entry + chunks) →
+* JavaScript. Shared by the CLI and Vite hosts so the MIME decision lives in one
+* place.
+*/
+declare const assetContentType: (fileName: string) => string;
+/**
 * Endpoint path both dev hosts mount the handler at. A sibling of the schema
 * editor's `/__lunora/schema-edit`; the double underscore keeps it clear of the
 * CLI's `/_lunora/*` worker proxy (single underscore).
@@ -224,4 +256,4 @@ type LocalEndpointHandler = (request: LocalEndpointRequest) => LocalEndpointResp
 * `400`; an unexpected throw (e.g. the body-size guard) is a `500`.
 */
 declare const serveJsonHandler: (request: IncomingMessage, response: ServerResponse, handle: LocalEndpointHandler, projectRoot: string) => void;
-export { type LocalEndpointHandler, type LocalEndpointRequest, type LocalEndpointResponse, POLICY_SCAFFOLD_ENDPOINT, type PolicyScaffoldBody, type PolicyScaffoldRequest, type PolicyScaffoldResponse, SCHEMA_EDIT_ENDPOINT, SEED_ENDPOINT, type SchemaEditRequest, type SchemaEditResponse, type SeedRequest, type SeedRequestBody, type SeedResponse, type StudioAssets, type StudioHtmlConfig, type WarnLogger, type WirePolicyEdit, handlePolicyScaffoldRequest, handleSchemaEditRequest, handleSeedRequest, loadStudioAssets, parseDevVariable, renderStudioHtml, resolveAdminToken, serveJsonHandler, studioAssetsStamp };
+export { type LocalEndpointHandler, type LocalEndpointRequest, type LocalEndpointResponse, POLICY_SCAFFOLD_ENDPOINT, type PolicyScaffoldBody, type PolicyScaffoldRequest, type PolicyScaffoldResponse, SCHEMA_EDIT_ENDPOINT, SEED_ENDPOINT, type SchemaEditRequest, type SchemaEditResponse, type SeedRequest, type SeedRequestBody, type SeedResponse, type StudioAssets, type StudioHtmlConfig, type WarnLogger, type WirePolicyEdit, assetContentType, handlePolicyScaffoldRequest, handleSchemaEditRequest, handleSeedRequest, isStandaloneModulePath, loadStudioAssets, parseDevVariable, readStandaloneAsset, renderStudioHtml, resolveAdminToken, resolveStandaloneDirectory, serveJsonHandler, studioAssetsStamp };

package/dist/studio-host/index.d.ts

@@ -81,6 +81,38 @@ declare const loadStudioAssets: (logger?: WarnLogger, resolveFrom?: string) => S
 */
 declare const studioAssetsStamp: (resolveFrom?: string) => number | undefined;
 /**
+* Absolute path of the built standalone directory — `@lunora/studio`'s
+* `dist/standalone`, where the `studio.js` entry and its code-split `chunk-*.js`
+* siblings live — or `undefined` when the studio isn't installed/built. The
+* standalone bundle is emitted with esbuild `splitting`, so the hosts must serve
+* the whole directory (not two fixed paths); this resolves its root.
+*/
+declare const resolveStandaloneDirectory: (resolveFrom?: string) => string | undefined;
+/**
+* Read a single file from the standalone directory by its plain filename (the
+* `studio.js` entry, a `chunk-*.js`, or a `.map`). **Path-traversal-safe** via
+* {@link resolveContainedFile}: only a lone filename resolving to a direct child
+* of the standalone directory is served — any separator, `..`, NUL, or absolute
+* path is rejected — so a request like `../../etc/passwd` can never escape it.
+* Returns the bytes, or `undefined` when the studio isn't built or the name
+* doesn't resolve to a file inside the directory (the host answers that 404).
+*/
+declare const readStandaloneAsset: (fileName: string, resolveFrom?: string) => Buffer | undefined;
+/**
+* True when `pathname` addresses a standalone JS module — the `studio.js` entry
+* or one of its code-split `chunk-*.js` siblings (and their `.map`s). Shared by
+* the CLI and Vite hosts so both route the same request shapes to the directory
+* server; the stylesheet is matched separately at each host's own style path.
+*/
+declare const isStandaloneModulePath: (pathname: string) => boolean;
+/**
+* Content-Type for a served standalone asset, by extension: `.css` → CSS,
+* `.map` → JSON (a source map), everything else (the `.js` entry + chunks) →
+* JavaScript. Shared by the CLI and Vite hosts so the MIME decision lives in one
+* place.
+*/
+declare const assetContentType: (fileName: string) => string;
+/**
 * Endpoint path both dev hosts mount the handler at. A sibling of the schema
 * editor's `/__lunora/schema-edit`; the double underscore keeps it clear of the
 * CLI's `/_lunora/*` worker proxy (single underscore).
@@ -224,4 +256,4 @@ type LocalEndpointHandler = (request: LocalEndpointRequest) => LocalEndpointResp
 * `400`; an unexpected throw (e.g. the body-size guard) is a `500`.
 */
 declare const serveJsonHandler: (request: IncomingMessage, response: ServerResponse, handle: LocalEndpointHandler, projectRoot: string) => void;
-export { type LocalEndpointHandler, type LocalEndpointRequest, type LocalEndpointResponse, POLICY_SCAFFOLD_ENDPOINT, type PolicyScaffoldBody, type PolicyScaffoldRequest, type PolicyScaffoldResponse, SCHEMA_EDIT_ENDPOINT, SEED_ENDPOINT, type SchemaEditRequest, type SchemaEditResponse, type SeedRequest, type SeedRequestBody, type SeedResponse, type StudioAssets, type StudioHtmlConfig, type WarnLogger, type WirePolicyEdit, handlePolicyScaffoldRequest, handleSchemaEditRequest, handleSeedRequest, loadStudioAssets, parseDevVariable, renderStudioHtml, resolveAdminToken, serveJsonHandler, studioAssetsStamp };
+export { type LocalEndpointHandler, type LocalEndpointRequest, type LocalEndpointResponse, POLICY_SCAFFOLD_ENDPOINT, type PolicyScaffoldBody, type PolicyScaffoldRequest, type PolicyScaffoldResponse, SCHEMA_EDIT_ENDPOINT, SEED_ENDPOINT, type SchemaEditRequest, type SchemaEditResponse, type SeedRequest, type SeedRequestBody, type SeedResponse, type StudioAssets, type StudioHtmlConfig, type WarnLogger, type WirePolicyEdit, assetContentType, handlePolicyScaffoldRequest, handleSchemaEditRequest, handleSeedRequest, isStandaloneModulePath, loadStudioAssets, parseDevVariable, readStandaloneAsset, renderStudioHtml, resolveAdminToken, resolveStandaloneDirectory, serveJsonHandler, studioAssetsStamp };

package/dist/studio-host/index.mjs

@@ -1,6 +1,6 @@
 export { parseDevVariable, resolveAdminToken } from '../packem_shared/parseDevVariable-CJiq2IwE.mjs';
-export { default as loadStudioAssets, studioAssetsStamp } from '../packem_shared/loadStudioAssets-Csk5RS4E.mjs';
-export { POLICY_SCAFFOLD_ENDPOINT, handlePolicyScaffoldRequest } from '../packem_shared/POLICY_SCAFFOLD_ENDPOINT-CiC2IGKx.mjs';
+export { assetContentType, isStandaloneModulePath, loadStudioAssets, readStandaloneAsset, resolveStandaloneDirectory, studioAssetsStamp } from '../packem_shared/assetContentType-ByZjeV3D.mjs';
+export { POLICY_SCAFFOLD_ENDPOINT, handlePolicyScaffoldRequest } from '../packem_shared/POLICY_SCAFFOLD_ENDPOINT-8bNMHGiu.mjs';
 export { default as renderStudioHtml } from '../packem_shared/renderStudioHtml-449Ysn75.mjs';
 export { SCHEMA_EDIT_ENDPOINT, handleSchemaEditRequest } from '../packem_shared/SCHEMA_EDIT_ENDPOINT-Df-Wrix-.mjs';
 export { SEED_ENDPOINT, handleSeedRequest } from '../packem_shared/SEED_ENDPOINT-DVCjaGO-.mjs';