@lunora/config 1.0.0-alpha.60 → 1.0.0-alpha.62

package/dist/index.d.mts

@@ -409,6 +409,10 @@ interface InferredBindings {
   usesScheduler: boolean;
   /** `@lunora/storage` is imported (R2 bucket binding name is user-defined). */
   usesStorage: boolean;
+  /** `@lunora/x402/charge` is imported — the charge rail settles USDC to a recipient address (a public `[vars]` entry, user-named; hint-only). */
+  usesX402Charge: boolean;
+  /** `@lunora/x402/pay` is imported — the agent-wallet pay rail signs from a Secrets Store binding paired with a spend policy (ActionCtx-only; hint-only). */
+  usesX402Pay: boolean;
   /** Workflows declared in `lunora/workflows.ts` (exported or not — see {@link InferredWorkflow.exported}). */
   workflows: InferredWorkflow[];
 }

package/dist/index.d.ts

@@ -409,6 +409,10 @@ interface InferredBindings {
   usesScheduler: boolean;
   /** `@lunora/storage` is imported (R2 bucket binding name is user-defined). */
   usesStorage: boolean;
+  /** `@lunora/x402/charge` is imported — the charge rail settles USDC to a recipient address (a public `[vars]` entry, user-named; hint-only). */
+  usesX402Charge: boolean;
+  /** `@lunora/x402/pay` is imported — the agent-wallet pay rail signs from a Secrets Store binding paired with a spend policy (ActionCtx-only; hint-only). */
+  usesX402Pay: boolean;
   /** Workflows declared in `lunora/workflows.ts` (exported or not — see {@link InferredWorkflow.exported}). */
   workflows: InferredWorkflow[];
 }

package/dist/index.mjs

@@ -5,17 +5,17 @@ export { streamContainerLogs } from './packem_shared/streamContainerLogs-BZ4cOZw
 export { detectFramework, readProjectDependencyNames } from './packem_shared/detectFramework-U08038Yp.mjs';
 export { DEV_DAEMON_ENV, DEV_HANDOFF_ENV, DEV_LOG_FILE, DEV_LOG_FILE_ENV, DEV_STATE_DIR, DEV_STATE_FILE, claimDevServerState, clearDevServerState, isProcessAlive, isRecordedProcessCurrent, readDevServerState, readLiveDevServerState, updateDevServerState, writeDevServerState } from './packem_shared/DEV_DAEMON_ENV-FIEtW7Fz.mjs';
 export { DEV_VARS_EXAMPLE_FILE, DEV_VARS_FILE, DEV_VARS_KEY_PATTERN, parseDevVariableEntries } from './packem_shared/DEV_VARS_EXAMPLE_FILE-dJPNTEnK.mjs';
-export { inferLunoraBindings, packageNamesFromBindings } from './packem_shared/inferLunoraBindings-ByMwG-gH.mjs';
+export { inferLunoraBindings, packageNamesFromBindings } from './packem_shared/inferLunoraBindings-BadOK1UZ.mjs';
 export { LINKED_PROJECT_DIR, LINKED_PROJECT_FILE, readLinkedProject, writeLinkedProject } from './packem_shared/LINKED_PROJECT_DIR-CXwXzV_C.mjs';
 export { LUNORA_EVENT_SOURCE, formatLunoraEvent } from './packem_shared/LUNORA_EVENT_SOURCE-D2fDeGB6.mjs';
 export { default as LunoraReporter } from './packem_shared/LunoraReporter-Ci-bDCK9.mjs';
 export { PACKAGE_SECRETS_REGISTRY, secretsForPackages } from './packem_shared/PACKAGE_SECRETS_REGISTRY-BeRSvrl5.mjs';
 export { LUNORA_CONFIG_FILE, interpretRemote, readProjectRemotePreference } from './packem_shared/LUNORA_CONFIG_FILE-CtcIcB5-.mjs';
 export { createConfirm, isInteractive, promptMultiSelect, promptSelect, promptYesNo } from './packem_shared/createConfirm-fvpdgJ9s.mjs';
-export { reconcileWranglerBindings } from './packem_shared/reconcileWranglerBindings-Cruwwx1M.mjs';
-export { reconcileWranglerCompatibilityDate } from './packem_shared/reconcileWranglerCompatibilityDate-CYY0rVnJ.mjs';
-export { REMOTE_ELIGIBLE_KEYS, injectRemoteFlags, isRemoteEnvEnabled, materializeRemoteWranglerConfig, planRemoteBindings, resolveRemoteEnabled } from './packem_shared/REMOTE_ELIGIBLE_KEYS-BC7_e9Bz.mjs';
-export { buildPackageSecretsBlock, ensureDevVariables, ensureDevVarsExample, fillDevSecrets, generateSecretValue, isMintableSecretKey, isPlaceholderValue, planDevSecretsFill, planDevVariablesAugment, planDevVariablesScaffold, requiredSecrets } from './packem_shared/buildPackageSecretsBlock-BDXX0mKG.mjs';
+export { reconcileWranglerBindings } from './packem_shared/reconcileWranglerBindings-BhQN61qp.mjs';
+export { reconcileWranglerCompatibilityDate } from './packem_shared/reconcileWranglerCompatibilityDate-D5Bqjk4P.mjs';
+export { REMOTE_ELIGIBLE_KEYS, injectRemoteFlags, isRemoteEnvEnabled, materializeRemoteWranglerConfig, planRemoteBindings, resolveRemoteEnabled } from './packem_shared/REMOTE_ELIGIBLE_KEYS-C-F_Flgy.mjs';
+export { buildPackageSecretsBlock, ensureDevVariables, ensureDevVarsExample, fillDevSecrets, generateSecretValue, isMintableSecretKey, isPlaceholderValue, planDevSecretsFill, planDevVariablesAugment, planDevVariablesScaffold, requiredSecrets } from './packem_shared/buildPackageSecretsBlock-B-dWb-Sa.mjs';
 export { applyAdditiveEdit, classifyEdit } from './packem_shared/applyAdditiveEdit-C-snTFEV.mjs';
 export { parseSchema } from './packem_shared/parseSchema-DSeyktvG.mjs';
 export { classifyPolicyEdit, scaffoldPolicyFile, wireRlsIntoProcedure } from './packem_shared/classifyPolicyEdit-BHeAqF8P.mjs';
@@ -23,5 +23,5 @@ export { discoverSchemaInfo } from './packem_shared/discoverSchemaInfo-BB-CKlTK.
 export { ACCENT, BADGES, BADGE_COLUMN_WIDTH, LUNA_ART, LUNA_BUNNY, LUNA_NAME, LUNA_SIGNOFF, STEP_BADGE_NAMES, badgeLead, badgeWidth, padBadge, paintAnswer, paintBadge } from './packem_shared/ACCENT-DW1XJn8i.mjs';
 export { discoverWorkflowInfo } from './packem_shared/discoverWorkflowInfo-CedvR0mn.mjs';
 export { WRANGLER_FILES, findWranglerFile, readWranglerJsonc } from './packem_shared/WRANGLER_FILES-DwSuC-Kn.mjs';
-export { collectWranglerSecretVariables, scanWranglerVariablesForSecrets } from './packem_shared/collectWranglerSecretVariables-Red5H-4V.mjs';
-export { REQUIRED_COMPATIBILITY_DATE, REQUIRED_FLAG, validateWrangler, validateWranglerConfig, validateWranglerProject, withTailConsumer } from './packem_shared/REQUIRED_COMPATIBILITY_DATE-DYYxY_If.mjs';
+export { collectWranglerSecretVariables, scanWranglerVariablesForSecrets } from './packem_shared/collectWranglerSecretVariables-p4ezBYQ4.mjs';
+export { REQUIRED_COMPATIBILITY_DATE, REQUIRED_FLAG, validateWrangler, validateWranglerConfig, validateWranglerProject, withTailConsumer } from './packem_shared/REQUIRED_COMPATIBILITY_DATE-CoKkA1uk.mjs';

package/dist/packem_shared/{POLICY_SCAFFOLD_ENDPOINT-8bNMHGiu.mjs → POLICY_SCAFFOLD_ENDPOINT-CvTZpaZF.mjs}

@@ -1,8 +1,9 @@
-import { existsSync, readFileSync, writeFileSync, renameSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { join, isAbsolute, relative } from 'node:path';
 import { runCodegen, CodegenDiagnosticError } from '@lunora/codegen';
 import { LunoraError } from '@lunora/errors';
 import { classifyPolicyEdit, scaffoldPolicyFile, wireRlsIntoProcedure } from './classifyPolicyEdit-BHeAqF8P.mjs';
+import { w as writeFileAtomic } from './write-atomic-B2REqapi.mjs';
 
 const POLICY_SCAFFOLD_ENDPOINT = "/__lunora/policy-scaffold";
 const statusForFailure = (reason) => {
@@ -14,11 +15,6 @@ const statusForFailure = (reason) => {
   }
   return reason === "destructive" ? 409 : 422;
 };
-const writeAtomic = (path, text) => {
-  const temporaryPath = `${path}.lunora-tmp`;
-  writeFileSync(temporaryPath, text, "utf8");
-  renameSync(temporaryPath, path);
-};
 const runCodegenForResponse = (request, okBody) => {
   let diagnostics = [];
   try {
@@ -53,7 +49,7 @@ const handleScaffoldPolicy = (request, edit) => {
   if (existsSync(targetPath)) {
     return { body: { error: "file-exists", fileName: result.fileName, ok: false }, status: 409 };
   }
-  writeAtomic(targetPath, result.source);
+  writeFileAtomic(targetPath, result.source);
   return runCodegenForResponse(request, { fileName: result.fileName });
 };
 const resolveProcedureFile = (projectRoot, lunoraDirectory, filePath) => {
@@ -77,7 +73,7 @@ const handleWireRls = (request, edit) => {
   if (!wired.ok) {
     return { body: { error: wired.reason, ok: false }, status: statusForFailure(wired.reason) };
   }
-  writeAtomic(procedurePath, wired.text);
+  writeFileAtomic(procedurePath, wired.text);
   return runCodegenForResponse(request, { exportName: edit.exportName });
 };
 const handlePolicyScaffoldRequest = (request) => {
@@ -85,7 +81,7 @@ const handlePolicyScaffoldRequest = (request) => {
     return { body: { error: "method-not-allowed", ok: false }, status: 405 };
   }
   const { body } = request;
-  if (body === void 0 || typeof body !== "object" || typeof body.kind !== "string") {
+  if (body === void 0 || body === null || typeof body !== "object" || typeof body.kind !== "string") {
     return { body: { error: "invalid-edit", ok: false }, status: 400 };
   }
   const edit = body;

package/dist/packem_shared/{REMOTE_ELIGIBLE_KEYS-BC7_e9Bz.mjs → REMOTE_ELIGIBLE_KEYS-C-F_Flgy.mjs}

@@ -1,9 +1,8 @@
 import { writeFileSync, rmSync } from 'node:fs';
-import { modify, applyEdits } from 'jsonc-parser';
+import { a as applyModify } from './jsonc-edit-SbcD7MAe.mjs';
 import { findWranglerFile, readWranglerJsonc } from './WRANGLER_FILES-DwSuC-Kn.mjs';
 import { join } from 'node:path';
 
-const FORMATTING = { formattingOptions: { insertSpaces: true, tabSize: 4 } };
 const REMOTE_ELIGIBLE_KEYS = {
   ai: { label: "AI", shape: "object" },
   d1_databases: { label: "D1", shape: "array" },
@@ -38,10 +37,6 @@ const planSection = (section, parsed) => {
   return entry === null || entry === void 0 ? [] : [{ binding: entryName(entry, section), kind: label, path: [], section }];
 };
 const planRemoteBindings = (parsed) => REMOTE_ELIGIBLE_KEY_LIST.flatMap((section) => planSection(section, parsed));
-const applyModify = (text, path, value) => {
-  const edits = modify(text, [...path], value, FORMATTING);
-  return edits.length > 0 ? applyEdits(text, edits) : text;
-};
 const injectRemoteFlags = (text, plans) => {
   let next = text;
   for (const plan of plans) {

package/dist/packem_shared/{REQUIRED_COMPATIBILITY_DATE-DYYxY_If.mjs → REQUIRED_COMPATIBILITY_DATE-CoKkA1uk.mjs}

@@ -76,6 +76,7 @@ const validateContainerEntry = (entry, label, checks) => {
     warnings.push(`${label} ("${entry.class_name}") declares no max_instances — set a cap so a traffic spike can't fan out unbounded container spend`);
   }
 };
+const objectBindingEntries = (value) => Array.isArray(value) ? value.filter((entry) => entry !== null && typeof entry === "object") : [];
 const validateContainers = (wrangler, errors, warnings) => {
   if (wrangler.containers === void 0) {
     return;
@@ -88,7 +89,7 @@ const validateContainers = (wrangler, errors, warnings) => {
   if (entries.length === 0) {
     return;
   }
-  const boundClasses = new Set((wrangler.durable_objects?.bindings ?? []).map((binding) => binding.class_name));
+  const boundClasses = new Set(objectBindingEntries(wrangler.durable_objects?.bindings).map((binding) => binding.class_name));
   const migrations = wrangler.migrations ?? [];
   const sqliteClasses = new Set(migrations.flatMap((migration) => [...migration?.new_sqlite_classes ?? []]));
   const nonSqliteClasses = new Set(migrations.flatMap((migration) => [...migration?.new_classes ?? []]));
@@ -494,7 +495,7 @@ const validateWranglerConfig = (wrangler, schema) => {
     errors.push("wrangler config is not a valid object");
     return { errors, valid: false, warnings };
   }
-  const durableObjectBindings = wrangler.durable_objects?.bindings ?? [];
+  const durableObjectBindings = objectBindingEntries(wrangler.durable_objects?.bindings);
   const shardBinding = durableObjectBindings.find((binding) => binding.name === "SHARD" && binding.class_name === "ShardDO");
   if (!shardBinding) {
     errors.push(
@@ -514,7 +515,7 @@ const validateWranglerConfig = (wrangler, schema) => {
     errors.push(`cache.enabled requires compatibility_date >= "${WORKERS_CACHE_MIN_DATE}" (got "${compatibilityDate || "<missing>"}")`);
   }
   if (schema?.hasGlobalTable) {
-    const d1Bindings = wrangler.d1_databases ?? [];
+    const d1Bindings = objectBindingEntries(wrangler.d1_databases);
     const databaseBinding = d1Bindings.find((binding) => binding.binding === "DB");
     if (!databaseBinding) {
       errors.push(

package/dist/packem_shared/{SCHEMA_EDIT_ENDPOINT-Df-Wrix-.mjs → SCHEMA_EDIT_ENDPOINT-Bt2SNkpV.mjs}

@@ -1,7 +1,8 @@
-import { existsSync, readFileSync, writeFileSync, renameSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { runCodegen, CodegenDiagnosticError } from '@lunora/codegen';
 import { classifyEdit, applyAdditiveEdit } from './applyAdditiveEdit-C-snTFEV.mjs';
 import { parseSchema } from './parseSchema-DSeyktvG.mjs';
+import { w as writeFileAtomic } from './write-atomic-B2REqapi.mjs';
 import { join } from 'node:path';
 
 const SCHEMA_EDIT_ENDPOINT = "/__lunora/schema-edit";
@@ -36,11 +37,6 @@ const readSchema = (schemaPath) => {
   }
   return { tables: parsed.tables };
 };
-const writeSchemaAtomic = (schemaPath, text) => {
-  const temporaryPath = `${schemaPath}.lunora-tmp`;
-  writeFileSync(temporaryPath, text, "utf8");
-  renameSync(temporaryPath, schemaPath);
-};
 const needsMigrationResponse = (edit) => {
   return {
     body: {
@@ -54,7 +50,7 @@ const needsMigrationResponse = (edit) => {
 };
 const handlePost = (request, schemaPath) => {
   const edit = request.body;
-  if (edit === void 0 || typeof edit !== "object" || typeof edit.kind !== "string") {
+  if (edit === void 0 || edit === null || typeof edit !== "object" || typeof edit.kind !== "string") {
     return { body: { error: "invalid-edit", ok: false }, status: 400 };
   }
   if (classifyEdit(edit) === "destructive") {
@@ -67,7 +63,7 @@ const handlePost = (request, schemaPath) => {
   if (!applied.ok) {
     return { body: { error: applied.reason, ok: false }, status: statusForFailure(applied.reason) };
   }
-  writeSchemaAtomic(schemaPath, applied.text);
+  writeFileAtomic(schemaPath, applied.text);
   let diagnostics = [];
   try {
     runCodegen({ lunoraDirectory: request.schemaDirectory ?? "lunora", projectRoot: request.projectRoot });

package/dist/packem_shared/{SEED_ENDPOINT-DVCjaGO-.mjs → SEED_ENDPOINT-7izz_Jao.mjs}

@@ -26,7 +26,7 @@ const handleSeedRequest = (request) => {
     return { body: { error: "method-not-allowed", ok: false }, status: 405 };
   }
   const { body } = request;
-  if (body === void 0 || typeof body !== "object") {
+  if (body === void 0 || body === null || typeof body !== "object") {
     return { body: { error: "invalid-request", ok: false }, status: 400 };
   }
   const { count, existingIds, seed, table } = body;

package/dist/packem_shared/{buildPackageSecretsBlock-BDXX0mKG.mjs → buildPackageSecretsBlock-B-dWb-Sa.mjs}

@@ -46,11 +46,11 @@ const isPlaceholderValue = (value) => {
 };
 const isPlaceholder = (rawValue) => isPlaceholderValue(unquoteDevVariable(rawValue.trim()));
 const defaultRandomHex = (bytes) => randomBytes(bytes).toString("hex");
-const generatedSecretFor = (key, rawValue, randomHex) => SECRET_KEY.test(key) && isPlaceholder(rawValue) ? randomHex(SECRET_BYTES) : void 0;
 const PROVIDER_SECRET_KEYS = new Set(
   [...CORE_SECRETS, ...Object.values(PACKAGE_SECRETS_REGISTRY).flat()].filter((entry) => SECRET_KEY.test(entry.key) && entry.placeholderValue.startsWith("<")).map((entry) => entry.key)
 );
 const isMintableSecretKey = (key) => SECRET_KEY.test(key) && !PROVIDER_SECRET_KEYS.has(key);
+const generatedSecretFor = (key, rawValue, randomHex) => isMintableSecretKey(key) && isPlaceholder(rawValue) ? randomHex(SECRET_BYTES) : void 0;
 const generateSecretValue = (randomHex = defaultRandomHex) => randomHex(SECRET_BYTES);
 const planDevVariablesScaffold = (input) => {
   if (input.devVarsExists) {

package/dist/packem_shared/{collectWranglerSecretVariables-Red5H-4V.mjs → collectWranglerSecretVariables-p4ezBYQ4.mjs}

@@ -1,6 +1,6 @@
 import { relative } from 'node:path';
 import { secretKindOf, redact } from '@lunora/codegen';
-import { isPlaceholderValue } from './buildPackageSecretsBlock-BDXX0mKG.mjs';
+import { isPlaceholderValue } from './buildPackageSecretsBlock-B-dWb-Sa.mjs';
 import { findWranglerFile, readWranglerJsonc } from './WRANGLER_FILES-DwSuC-Kn.mjs';
 
 const MIN_SECRET_NAMED_VALUE_LENGTH = 8;

package/dist/packem_shared/{inferLunoraBindings-ByMwG-gH.mjs → inferLunoraBindings-BadOK1UZ.mjs}

@@ -69,7 +69,13 @@ const CAPABILITY_SOURCES = {
   // for the hint message.
   usesPipelines: { pattern: CTX_PIPELINES_PATTERN, source: "@lunora/bindings/pipelines" },
   usesScheduler: { pattern: /\bfrom\s+["']@lunora\/scheduler["']/, source: "@lunora/scheduler" },
-  usesStorage: { pattern: /\bfrom\s+["']@lunora\/storage["']/, source: "@lunora/storage" }
+  usesStorage: { pattern: /\bfrom\s+["']@lunora\/storage["']/, source: "@lunora/storage" },
+  // x402 rails are opt-in add-on subpaths (not part of the `lunorash` umbrella),
+  // so they key off the exact `@lunora/x402/{charge,pay}` specifiers. Neither
+  // implies a `.dev.vars` secret: the charge recipient is a user-named `[vars]`
+  // entry and the pay wallet key is a Secrets Store binding — both hint-only.
+  usesX402Charge: { pattern: /\bfrom\s+["']@lunora\/x402\/charge["']/, source: "@lunora/x402/charge" },
+  usesX402Pay: { pattern: /\bfrom\s+["']@lunora\/x402\/pay["']/, source: "@lunora/x402/pay" }
 };
 const CAPABILITY_FLAGS = Object.keys(CAPABILITY_SOURCES);
 const PAYMENT_PROVIDER_SECRETS = "STRIPE_SECRET_KEY + STRIPE_WEBHOOK_SECRET (Stripe) or POLAR_ACCESS_TOKEN + POLAR_WEBHOOK_SECRET (Polar)";
@@ -291,6 +297,14 @@ const describeCapabilitySignals = (capabilities, exported) => {
     [
       capabilities.usesPipelines,
       "hint: ctx.pipelines is used; run 'wrangler pipelines create <name>' and add a 'pipelines' binding ({ binding, pipeline }) — the pipeline resource can't be auto-provisioned"
+    ],
+    [
+      capabilities.usesX402Charge,
+      "hint: @lunora/x402/charge is imported; set the recipient wallet address as a [vars] entry (the var name is yours to choose) and pass it to the charge config — the x402 facilitator settles USDC to that address"
+    ],
+    [
+      capabilities.usesX402Pay,
+      "hint: @lunora/x402/pay is imported (ActionCtx-only, spends real funds); add a secrets_store_secrets[] binding for the agent wallet key (name it to match signer.secretName) and pair the pay rail with a spend policy — ctx.secrets reads a Secrets Store binding, not .dev.vars, so the key can't be auto-provisioned"
     ]
   ];
   return rules.filter(([active]) => active).map(([, signal]) => signal);

package/dist/packem_shared/jsonc-edit-SbcD7MAe.mjs

@@ -0,0 +1,9 @@
+import { modify, applyEdits } from 'jsonc-parser';
+
+const FORMATTING = { formattingOptions: { insertSpaces: true, tabSize: 4 } };
+const applyModify = (text, path, value) => {
+  const edits = modify(text, [...path], value, FORMATTING);
+  return edits.length > 0 ? applyEdits(text, edits) : text;
+};
+
+export { FORMATTING as F, applyModify as a };

package/dist/packem_shared/parseDevVariable-B0FEvfHC.mjs

@@ -0,0 +1,21 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parseDevVariableEntries } from './DEV_VARS_EXAMPLE_FILE-dJPNTEnK.mjs';
+
+const parseDevVariable = (contents, key) => {
+  const entry = parseDevVariableEntries(contents).find((candidate) => candidate.key === key);
+  return entry === void 0 || entry.value === "" ? void 0 : entry.value;
+};
+const resolveAdminToken = (root) => {
+  const fromEnv = process.env["LUNORA_ADMIN_TOKEN"];
+  if (typeof fromEnv === "string" && fromEnv !== "") {
+    return fromEnv;
+  }
+  try {
+    return parseDevVariable(readFileSync(join(root, ".dev.vars"), "utf8"), "LUNORA_ADMIN_TOKEN");
+  } catch {
+    return void 0;
+  }
+};
+
+export { parseDevVariable, resolveAdminToken };

package/dist/packem_shared/{reconcileWranglerBindings-Cruwwx1M.mjs → reconcileWranglerBindings-BhQN61qp.mjs}

@@ -1,9 +1,8 @@
 import { writeFileSync } from 'node:fs';
 import { containerBuildTag } from '@lunora/container';
-import { modify, applyEdits } from 'jsonc-parser';
+import { a as applyModify } from './jsonc-edit-SbcD7MAe.mjs';
 import { findWranglerFile, readWranglerJsonc } from './WRANGLER_FILES-DwSuC-Kn.mjs';
 
-const FORMATTING = { formattingOptions: { insertSpaces: true, tabSize: 4 } };
 const D1_PLACEHOLDER_ID = "<replace-with-d1-create-id>";
 const collectExportGaps = (inferred) => {
   const gaps = [];
@@ -41,6 +40,19 @@ const collectHintBindingWarnings = (inferred, parsed) => {
   ];
   return rules.filter(([active]) => active).map(([, warning]) => warning);
 };
+const collectX402Warnings = (inferred) => {
+  const rules = [
+    [
+      inferred.usesX402Charge,
+      "@lunora/x402/charge is used; set the recipient wallet address as a [vars] entry (the var name is your choice) and pass it to the charge config — the x402 facilitator settles USDC to that address."
+    ],
+    [
+      inferred.usesX402Pay,
+      "@lunora/x402/pay is used (ActionCtx-only, spends real funds); add a secrets_store_secrets[] binding holding the agent wallet key (binding name == signer.secretName) and pair the pay rail with a spend policy — ctx.secrets reads a Secrets Store binding, not .dev.vars."
+    ]
+  ];
+  return rules.filter(([active]) => active).map(([, warning]) => warning);
+};
 const collectWarnings = (inferred, parsed) => {
   const exported = new Set(inferred.durableObjects.map((object) => object.className));
   const warnings = [];
@@ -81,13 +93,9 @@ const collectWarnings = (inferred, parsed) => {
       "@lunora/payment is used; set the provider secrets in .dev.vars — STRIPE_SECRET_KEY + STRIPE_WEBHOOK_SECRET (Stripe) or POLAR_ACCESS_TOKEN + POLAR_WEBHOOK_SECRET (Polar)."
     );
   }
-  warnings.push(...collectHintBindingWarnings(inferred, parsed));
+  warnings.push(...collectX402Warnings(inferred), ...collectHintBindingWarnings(inferred, parsed));
   return warnings;
 };
-const applyModify = (text, path, value) => {
-  const edits = modify(text, [...path], value, FORMATTING);
-  return edits.length > 0 ? applyEdits(text, edits) : text;
-};
 const nextMigrationTag = (migrations) => {
   const used = new Set(migrations.map((migration) => migration.tag));
   let index = 1;

package/dist/packem_shared/{reconcileWranglerCompatibilityDate-CYY0rVnJ.mjs → reconcileWranglerCompatibilityDate-D5Bqjk4P.mjs}

@@ -1,9 +1,9 @@
 import { writeFileSync } from 'node:fs';
 import { modify, applyEdits } from 'jsonc-parser';
+import { F as FORMATTING } from './jsonc-edit-SbcD7MAe.mjs';
 import { findWranglerFile, readWranglerJsonc } from './WRANGLER_FILES-DwSuC-Kn.mjs';
 
 const WORKERS_CACHE_MIN_DATE = "2026-05-01";
-const FORMATTING = { formattingOptions: { insertSpaces: true, tabSize: 4 } };
 const reconcileWranglerCompatibilityDate = (projectRoot) => {
   const wranglerPath = findWranglerFile(projectRoot);
   if (!wranglerPath) {

package/dist/packem_shared/{serveJsonHandler-B4OLTGLS.mjs → serveJsonHandler-Cl2Wqkv8.mjs}

@@ -57,7 +57,7 @@ const csrfRejectionReason = (request) => {
   }
   return void 0;
 };
-const serveJsonHandler = (request, response, handle, projectRoot) => {
+const serveJsonHandler = (request, response, handle, projectRoot, schemaDirectory) => {
   const run = async () => {
     try {
       const rejection = csrfRejectionReason(request);
@@ -73,7 +73,7 @@ const serveJsonHandler = (request, response, handle, projectRoot) => {
         respondJson(response, 400, { error: "invalid-json", ok: false });
         return;
       }
-      const result = handle({ body: parsed, method: request.method ?? "POST", projectRoot });
+      const result = handle({ body: parsed, method: request.method ?? "POST", projectRoot, schemaDirectory });
       respondJson(response, result.status, result.body);
     } catch (error) {
       respondJson(response, 500, { error: error instanceof Error ? error.message : String(error), ok: false });

package/dist/packem_shared/write-atomic-B2REqapi.mjs

@@ -0,0 +1,14 @@
+import { writeFileSync, renameSync, rmSync } from 'node:fs';
+
+const writeFileAtomic = (path, text) => {
+  const temporaryPath = `${path}.lunora-tmp`;
+  try {
+    writeFileSync(temporaryPath, text, "utf8");
+    renameSync(temporaryPath, path);
+  } catch (error) {
+    rmSync(temporaryPath, { force: true });
+    throw error;
+  }
+};
+
+export { writeFileAtomic as w };

package/dist/studio-host/index.d.mts

@@ -1,6 +1,12 @@
 import { D as DestructivePolicyEdit, S as ScaffoldPolicyEdit, W as WireRlsEdit } from "../packem_shared/policy-scaffold.d-DCmwn7zQ.mjs";
 import { IncomingMessage, ServerResponse } from 'node:http';
-/** Parse a single `KEY=value` (optionally quoted) out of a `.dev.vars` body. */
+/**
+* Parse a single `KEY=value` (optionally quoted) out of a `.dev.vars` body,
+* returning `undefined` when the key is absent or its value is empty. A thin
+* wrapper over {@link parseDevVariableEntries} — the single owner of the
+* `.dev.vars` line grammar — so the key-validation, comment-skip, and quote-strip
+* rules can't drift from every other reader/writer of the file.
+*/
 declare const parseDevVariable: (contents: string, key: string) => string | undefined;
 /**
 * Resolve the worker's admin token so the studio can auto-authenticate in
@@ -254,6 +260,10 @@ type LocalEndpointHandler = (request: LocalEndpointRequest) => LocalEndpointResp
 * schema); every other method has its body read + JSON-parsed first. The
 * handler's `{ status, body }` is serialised back as JSON. A malformed body is a
 * `400`; an unexpected throw (e.g. the body-size guard) is a `500`.
+*
+* `schemaDirectory` (when the host configures a custom `schemaDir`) is forwarded
+* to the handler so the schema/seed/policy endpoints target the right directory
+* instead of always defaulting to `"lunora"`.
 */
-declare const serveJsonHandler: (request: IncomingMessage, response: ServerResponse, handle: LocalEndpointHandler, projectRoot: string) => void;
+declare const serveJsonHandler: (request: IncomingMessage, response: ServerResponse, handle: LocalEndpointHandler, projectRoot: string, schemaDirectory?: string) => void;
 export { type LocalEndpointHandler, type LocalEndpointRequest, type LocalEndpointResponse, POLICY_SCAFFOLD_ENDPOINT, type PolicyScaffoldBody, type PolicyScaffoldRequest, type PolicyScaffoldResponse, SCHEMA_EDIT_ENDPOINT, SEED_ENDPOINT, type SchemaEditRequest, type SchemaEditResponse, type SeedRequest, type SeedRequestBody, type SeedResponse, type StudioAssets, type StudioHtmlConfig, type WarnLogger, type WirePolicyEdit, assetContentType, handlePolicyScaffoldRequest, handleSchemaEditRequest, handleSeedRequest, isStandaloneModulePath, loadStudioAssets, parseDevVariable, readStandaloneAsset, renderStudioHtml, resolveAdminToken, resolveStandaloneDirectory, serveJsonHandler, studioAssetsStamp };

package/dist/studio-host/index.d.ts

@@ -1,6 +1,12 @@
 import { D as DestructivePolicyEdit, S as ScaffoldPolicyEdit, W as WireRlsEdit } from "../packem_shared/policy-scaffold.d-DCmwn7zQ.js";
 import { IncomingMessage, ServerResponse } from 'node:http';
-/** Parse a single `KEY=value` (optionally quoted) out of a `.dev.vars` body. */
+/**
+* Parse a single `KEY=value` (optionally quoted) out of a `.dev.vars` body,
+* returning `undefined` when the key is absent or its value is empty. A thin
+* wrapper over {@link parseDevVariableEntries} — the single owner of the
+* `.dev.vars` line grammar — so the key-validation, comment-skip, and quote-strip
+* rules can't drift from every other reader/writer of the file.
+*/
 declare const parseDevVariable: (contents: string, key: string) => string | undefined;
 /**
 * Resolve the worker's admin token so the studio can auto-authenticate in
@@ -254,6 +260,10 @@ type LocalEndpointHandler = (request: LocalEndpointRequest) => LocalEndpointResp
 * schema); every other method has its body read + JSON-parsed first. The
 * handler's `{ status, body }` is serialised back as JSON. A malformed body is a
 * `400`; an unexpected throw (e.g. the body-size guard) is a `500`.
+*
+* `schemaDirectory` (when the host configures a custom `schemaDir`) is forwarded
+* to the handler so the schema/seed/policy endpoints target the right directory
+* instead of always defaulting to `"lunora"`.
 */
-declare const serveJsonHandler: (request: IncomingMessage, response: ServerResponse, handle: LocalEndpointHandler, projectRoot: string) => void;
+declare const serveJsonHandler: (request: IncomingMessage, response: ServerResponse, handle: LocalEndpointHandler, projectRoot: string, schemaDirectory?: string) => void;
 export { type LocalEndpointHandler, type LocalEndpointRequest, type LocalEndpointResponse, POLICY_SCAFFOLD_ENDPOINT, type PolicyScaffoldBody, type PolicyScaffoldRequest, type PolicyScaffoldResponse, SCHEMA_EDIT_ENDPOINT, SEED_ENDPOINT, type SchemaEditRequest, type SchemaEditResponse, type SeedRequest, type SeedRequestBody, type SeedResponse, type StudioAssets, type StudioHtmlConfig, type WarnLogger, type WirePolicyEdit, assetContentType, handlePolicyScaffoldRequest, handleSchemaEditRequest, handleSeedRequest, isStandaloneModulePath, loadStudioAssets, parseDevVariable, readStandaloneAsset, renderStudioHtml, resolveAdminToken, resolveStandaloneDirectory, serveJsonHandler, studioAssetsStamp };

package/dist/studio-host/index.mjs

@@ -1,7 +1,7 @@
-export { parseDevVariable, resolveAdminToken } from '../packem_shared/parseDevVariable-CJiq2IwE.mjs';
+export { parseDevVariable, resolveAdminToken } from '../packem_shared/parseDevVariable-B0FEvfHC.mjs';
 export { assetContentType, isStandaloneModulePath, loadStudioAssets, readStandaloneAsset, resolveStandaloneDirectory, studioAssetsStamp } from '../packem_shared/assetContentType-ByZjeV3D.mjs';
-export { POLICY_SCAFFOLD_ENDPOINT, handlePolicyScaffoldRequest } from '../packem_shared/POLICY_SCAFFOLD_ENDPOINT-8bNMHGiu.mjs';
+export { POLICY_SCAFFOLD_ENDPOINT, handlePolicyScaffoldRequest } from '../packem_shared/POLICY_SCAFFOLD_ENDPOINT-CvTZpaZF.mjs';
 export { default as renderStudioHtml } from '../packem_shared/renderStudioHtml-449Ysn75.mjs';
-export { SCHEMA_EDIT_ENDPOINT, handleSchemaEditRequest } from '../packem_shared/SCHEMA_EDIT_ENDPOINT-Df-Wrix-.mjs';
-export { SEED_ENDPOINT, handleSeedRequest } from '../packem_shared/SEED_ENDPOINT-DVCjaGO-.mjs';
-export { serveJsonHandler } from '../packem_shared/serveJsonHandler-B4OLTGLS.mjs';
+export { SCHEMA_EDIT_ENDPOINT, handleSchemaEditRequest } from '../packem_shared/SCHEMA_EDIT_ENDPOINT-Bt2SNkpV.mjs';
+export { SEED_ENDPOINT, handleSeedRequest } from '../packem_shared/SEED_ENDPOINT-7izz_Jao.mjs';
+export { serveJsonHandler } from '../packem_shared/serveJsonHandler-Cl2Wqkv8.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/config",
-  "version": "1.0.0-alpha.60",
+  "version": "1.0.0-alpha.62",
   "description": "Internal shared CLI + Vite config layer for Lunora: wrangler.jsonc validation, binding inference, and .dev.vars scaffolding",
   "keywords": [
     "bindings",
@@ -50,10 +50,10 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/codegen": "1.0.0-alpha.38",
-    "@lunora/container": "1.0.0-alpha.8",
-    "@lunora/errors": "1.0.0-alpha.3",
-    "@lunora/seed": "1.0.0-alpha.20",
+    "@lunora/codegen": "1.0.0-alpha.40",
+    "@lunora/container": "1.0.0-alpha.9",
+    "@lunora/errors": "1.0.0-alpha.4",
+    "@lunora/seed": "1.0.0-alpha.22",
     "@visulima/colorize": "2.0.0",
     "@visulima/find-ai-runner": "1.0.0",
     "dockerode": "^5.0.1",
@@ -62,7 +62,7 @@
     "ts-morph": "^28.0.0"
   },
   "peerDependencies": {
-    "@lunora/studio": "1.0.0-alpha.45"
+    "@lunora/studio": "1.0.0-alpha.47"
   },
   "peerDependenciesMeta": {
     "@lunora/studio": {

package/dist/packem_shared/parseDevVariable-CJiq2IwE.mjs

@@ -1,30 +0,0 @@
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-const LINE_BREAK = /\r?\n/u;
-const parseDevVariable = (contents, key) => {
-  for (const raw of contents.split(LINE_BREAK)) {
-    const line = raw.trim();
-    const eq = line.indexOf("=");
-    if (line === "" || line.startsWith("#") || eq === -1 || line.slice(0, eq).trim() !== key) {
-      continue;
-    }
-    const value = line.slice(eq + 1).trim();
-    const unquoted = value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'") ? value.slice(1, -1) : value;
-    return unquoted === "" ? void 0 : unquoted;
-  }
-  return void 0;
-};
-const resolveAdminToken = (root) => {
-  const fromEnv = process.env["LUNORA_ADMIN_TOKEN"];
-  if (typeof fromEnv === "string" && fromEnv !== "") {
-    return fromEnv;
-  }
-  try {
-    return parseDevVariable(readFileSync(join(root, ".dev.vars"), "utf8"), "LUNORA_ADMIN_TOKEN");
-  } catch {
-    return void 0;
-  }
-};
-
-export { parseDevVariable, resolveAdminToken };