@lunora/config 1.0.0-alpha.8 → 1.0.0-alpha.80

package/dist/packem_shared/{REQUIRED_COMPATIBILITY_DATE-DRSNSOOp.mjs → REQUIRED_COMPATIBILITY_DATE-DP0SFVy9.mjs}

@@ -1,6 +1,7 @@
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { discoverSchemaInfo } from './discoverSchemaInfo-BB-CKlTK.mjs';
+import { isCacheEnabled, WORKERS_CACHE_MIN_DATE } from './WORKERS_CACHE_MIN_DATE-CaXbS7CX.mjs';
 import { findWranglerFile, readWranglerJsonc } from './WRANGLER_FILES-DwSuC-Kn.mjs';
 
 const REQUIRED_COMPATIBILITY_DATE = "2026-04-07";
@@ -76,6 +77,7 @@ const validateContainerEntry = (entry, label, checks) => {
     warnings.push(`${label} ("${entry.class_name}") declares no max_instances — set a cap so a traffic spike can't fan out unbounded container spend`);
   }
 };
+const objectBindingEntries = (value) => Array.isArray(value) ? value.filter((entry) => entry !== null && typeof entry === "object") : [];
 const validateContainers = (wrangler, errors, warnings) => {
   if (wrangler.containers === void 0) {
     return;
@@ -88,7 +90,7 @@ const validateContainers = (wrangler, errors, warnings) => {
   if (entries.length === 0) {
     return;
   }
-  const boundClasses = new Set((wrangler.durable_objects?.bindings ?? []).map((binding) => binding.class_name));
+  const boundClasses = new Set(objectBindingEntries(wrangler.durable_objects?.bindings).map((binding) => binding.class_name));
   const migrations = wrangler.migrations ?? [];
   const sqliteClasses = new Set(migrations.flatMap((migration) => [...migration?.new_sqlite_classes ?? []]));
   const nonSqliteClasses = new Set(migrations.flatMap((migration) => [...migration?.new_classes ?? []]));
@@ -127,6 +129,82 @@ const validateWorkflows = (wrangler, errors) => {
     }
   }
 };
+const validateQueueProducers = (producers, errors) => {
+  if (producers === void 0) {
+    return;
+  }
+  if (!Array.isArray(producers)) {
+    errors.push("queues.producers must be an array of { binding, queue } entries");
+    return;
+  }
+  const entries = producers;
+  for (const [index, entry] of entries.entries()) {
+    const label = `queues.producers[${String(index)}]`;
+    if (!entry || typeof entry !== "object") {
+      errors.push(`${label} must be a { binding, queue } object`);
+      continue;
+    }
+    if (typeof entry.binding !== "string" || entry.binding.length === 0) {
+      errors.push(`${label} must have a non-empty "binding" naming the Queue producer (e.g. QUEUE_EMAIL)`);
+    }
+    if (typeof entry.queue !== "string" || entry.queue.length === 0) {
+      errors.push(`${label} must have a non-empty "queue" naming the deployed queue`);
+    }
+  }
+};
+const validateQueueConsumers = (consumers, errors) => {
+  if (consumers === void 0) {
+    return;
+  }
+  if (!Array.isArray(consumers)) {
+    errors.push("queues.consumers must be an array of { queue } entries");
+    return;
+  }
+  const entries = consumers;
+  for (const [index, entry] of entries.entries()) {
+    const label = `queues.consumers[${String(index)}]`;
+    if (!entry || typeof entry !== "object") {
+      errors.push(`${label} must be a { queue } object`);
+      continue;
+    }
+    if (typeof entry.queue !== "string" || entry.queue.length === 0) {
+      errors.push(`${label} must have a non-empty "queue" naming the consumed queue`);
+    }
+  }
+};
+const validateQueues = (wrangler, errors) => {
+  if (wrangler.queues === void 0) {
+    return;
+  }
+  if (typeof wrangler.queues !== "object" || Array.isArray(wrangler.queues)) {
+    errors.push("queues must be a { producers, consumers } object");
+    return;
+  }
+  validateQueueProducers(wrangler.queues.producers, errors);
+  validateQueueConsumers(wrangler.queues.consumers, errors);
+};
+const validateSecretsStore = (wrangler, errors) => {
+  if (wrangler.secrets_store_secrets === void 0) {
+    return;
+  }
+  if (!Array.isArray(wrangler.secrets_store_secrets)) {
+    errors.push("secrets_store_secrets must be an array of { binding, store_id, secret_name } entries");
+    return;
+  }
+  const entries = wrangler.secrets_store_secrets;
+  for (const [index, entry] of entries.entries()) {
+    const label = `secrets_store_secrets[${String(index)}]`;
+    if (!entry || typeof entry !== "object") {
+      errors.push(`${label} must be a { binding, store_id, secret_name } object`);
+      continue;
+    }
+    for (const field of ["binding", "store_id", "secret_name"]) {
+      if (typeof entry[field] !== "string" || entry[field].length === 0) {
+        errors.push(`${label} must have a non-empty "${field}"`);
+      }
+    }
+  }
+};
 const isNonEmptyString = (value) => typeof value === "string" && value.length > 0;
 const asBindingEntries = (value) => value;
 const HINT_BINDING_RULES = [
@@ -137,6 +215,13 @@ const HINT_BINDING_RULES = [
     hintMessage: (label, binding) => `${label} ("${binding}") has no "id" — run \`wrangler kv namespace create\` and set the namespace id, or the binding can't resolve`,
     key: "kv_namespaces"
   },
+  {
+    arrayMessage: "flagship must be an array of { binding, app_id } entries",
+    bindingMessage: (label) => `${label} must have a non-empty "binding" naming the Flagship binding`,
+    hintField: "app_id",
+    hintMessage: (label, binding) => `${label} ("${binding}") has no "app_id" — create a Flagship app and set its id, or the binding can't resolve`,
+    key: "flagship"
+  },
   {
     arrayMessage: "hyperdrive must be an array of { binding, id } entries",
     bindingMessage: (label) => `${label} must have a non-empty "binding" naming the Hyperdrive binding`,
@@ -303,6 +388,45 @@ const validateObservability = (wrangler, errors) => {
     }
   }
 };
+const validateCache = (wrangler, errors) => {
+  const { cache } = wrangler;
+  if (cache === void 0) {
+    return;
+  }
+  if (typeof cache !== "object" || cache === null || Array.isArray(cache)) {
+    errors.push('cache must be an object (e.g. { "enabled": true })');
+    return;
+  }
+  if (cache.enabled !== void 0 && typeof cache.enabled !== "boolean") {
+    errors.push("cache.enabled must be a boolean (true or false)");
+  }
+};
+const validateExports = (wrangler, errors) => {
+  const { exports } = wrangler;
+  if (exports === void 0) {
+    return;
+  }
+  if (typeof exports !== "object" || exports === null || Array.isArray(exports)) {
+    errors.push("exports must be an object keyed by entrypoint name");
+    return;
+  }
+  for (const [name, entry] of Object.entries(exports)) {
+    if (typeof entry !== "object" || entry === null) {
+      errors.push(`exports["${name}"] must be an object`);
+      continue;
+    }
+    if (entry.type !== void 0 && typeof entry.type !== "string") {
+      errors.push(`exports["${name}"].type must be a string`);
+    }
+    if (entry.cache !== void 0) {
+      if (typeof entry.cache !== "object" || entry.cache === null || Array.isArray(entry.cache)) {
+        errors.push(`exports["${name}"].cache must be an object`);
+      } else if (entry.cache.enabled !== void 0 && typeof entry.cache.enabled !== "boolean") {
+        errors.push(`exports["${name}"].cache.enabled must be a boolean`);
+      }
+    }
+  }
+};
 const validateAssets = (wrangler, errors) => {
   const { assets } = wrangler;
   if (assets === void 0) {
@@ -372,7 +496,7 @@ const validateWranglerConfig = (wrangler, schema) => {
     errors.push("wrangler config is not a valid object");
     return { errors, valid: false, warnings };
   }
-  const durableObjectBindings = wrangler.durable_objects?.bindings ?? [];
+  const durableObjectBindings = objectBindingEntries(wrangler.durable_objects?.bindings);
   const shardBinding = durableObjectBindings.find((binding) => binding.name === "SHARD" && binding.class_name === "ShardDO");
   if (!shardBinding) {
     errors.push(
@@ -385,8 +509,11 @@ const validateWranglerConfig = (wrangler, schema) => {
   } else if (compatibilityDate < REQUIRED_COMPATIBILITY_DATE) {
     errors.push(`compatibility_date must be >= "${REQUIRED_COMPATIBILITY_DATE}" (got "${compatibilityDate || "<missing>"}")`);
   }
+  if (isCacheEnabled(wrangler) && ISO_DATE_PATTERN.test(compatibilityDate) && compatibilityDate < WORKERS_CACHE_MIN_DATE) {
+    errors.push(`cache.enabled requires compatibility_date >= "${WORKERS_CACHE_MIN_DATE}" (got "${compatibilityDate || "<missing>"}")`);
+  }
   if (schema?.hasGlobalTable) {
-    const d1Bindings = wrangler.d1_databases ?? [];
+    const d1Bindings = objectBindingEntries(wrangler.d1_databases);
     const databaseBinding = d1Bindings.find((binding) => binding.binding === "DB");
     if (!databaseBinding) {
       errors.push(
@@ -398,6 +525,8 @@ const validateWranglerConfig = (wrangler, schema) => {
   validateTailConsumers(wrangler, errors);
   validateContainers(wrangler, errors, warnings);
   validateWorkflows(wrangler, errors);
+  validateQueues(wrangler, errors);
+  validateSecretsStore(wrangler, errors);
   for (const rule of HINT_BINDING_RULES) {
     validateHintBinding(wrangler, rule, errors, warnings);
   }
@@ -412,6 +541,8 @@ const validateWranglerConfig = (wrangler, schema) => {
   validatePlacement(wrangler, errors);
   validateObservability(wrangler, errors);
   validateAssets(wrangler, errors);
+  validateCache(wrangler, errors);
+  validateExports(wrangler, errors);
   validateCorsVariables(wrangler, errors);
   return { errors, valid: errors.length === 0, warnings };
 };

package/dist/packem_shared/{SCHEMA_EDIT_ENDPOINT-Df-Wrix-.mjs → SCHEMA_EDIT_ENDPOINT-Bt2SNkpV.mjs}

@@ -1,7 +1,8 @@
-import { existsSync, readFileSync, writeFileSync, renameSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { runCodegen, CodegenDiagnosticError } from '@lunora/codegen';
 import { classifyEdit, applyAdditiveEdit } from './applyAdditiveEdit-C-snTFEV.mjs';
 import { parseSchema } from './parseSchema-DSeyktvG.mjs';
+import { w as writeFileAtomic } from './write-atomic-B2REqapi.mjs';
 import { join } from 'node:path';
 
 const SCHEMA_EDIT_ENDPOINT = "/__lunora/schema-edit";
@@ -36,11 +37,6 @@ const readSchema = (schemaPath) => {
   }
   return { tables: parsed.tables };
 };
-const writeSchemaAtomic = (schemaPath, text) => {
-  const temporaryPath = `${schemaPath}.lunora-tmp`;
-  writeFileSync(temporaryPath, text, "utf8");
-  renameSync(temporaryPath, schemaPath);
-};
 const needsMigrationResponse = (edit) => {
   return {
     body: {
@@ -54,7 +50,7 @@ const needsMigrationResponse = (edit) => {
 };
 const handlePost = (request, schemaPath) => {
   const edit = request.body;
-  if (edit === void 0 || typeof edit !== "object" || typeof edit.kind !== "string") {
+  if (edit === void 0 || edit === null || typeof edit !== "object" || typeof edit.kind !== "string") {
     return { body: { error: "invalid-edit", ok: false }, status: 400 };
   }
   if (classifyEdit(edit) === "destructive") {
@@ -67,7 +63,7 @@ const handlePost = (request, schemaPath) => {
   if (!applied.ok) {
     return { body: { error: applied.reason, ok: false }, status: statusForFailure(applied.reason) };
   }
-  writeSchemaAtomic(schemaPath, applied.text);
+  writeFileAtomic(schemaPath, applied.text);
   let diagnostics = [];
   try {
     runCodegen({ lunoraDirectory: request.schemaDirectory ?? "lunora", projectRoot: request.projectRoot });

package/dist/packem_shared/{SEED_ENDPOINT-DVCjaGO-.mjs → SEED_ENDPOINT-7izz_Jao.mjs}

@@ -26,7 +26,7 @@ const handleSeedRequest = (request) => {
     return { body: { error: "method-not-allowed", ok: false }, status: 405 };
   }
   const { body } = request;
-  if (body === void 0 || typeof body !== "object") {
+  if (body === void 0 || body === null || typeof body !== "object") {
     return { body: { error: "invalid-request", ok: false }, status: 400 };
   }
   const { count, existingIds, seed, table } = body;

package/dist/packem_shared/WORKERS_CACHE_MIN_DATE-CaXbS7CX.mjs

@@ -0,0 +1,11 @@
+const WORKERS_CACHE_MIN_DATE = "2026-05-01";
+const isCacheEnabled = (parsed) => {
+  if (!parsed) {
+    return false;
+  }
+  const topLevel = typeof parsed.cache === "object" && parsed.cache !== null && parsed.cache.enabled === true;
+  const inExports = typeof parsed.exports === "object" && parsed.exports !== null && Object.values(parsed.exports).some((entry) => typeof entry === "object" && entry !== null && entry.cache?.enabled === true);
+  return topLevel || inExports;
+};
+
+export { WORKERS_CACHE_MIN_DATE, isCacheEnabled };

package/dist/packem_shared/assetContentType-ByZjeV3D.mjs

@@ -0,0 +1,72 @@
+import { readFileSync, statSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { normalize, join, relative, isAbsolute, dirname } from 'node:path';
+
+const loadStudioAssets = (logger, resolveFrom = import.meta.url) => {
+  try {
+    const require = createRequire(resolveFrom);
+    return {
+      script: readFileSync(require.resolve("@lunora/studio/standalone/studio.js")),
+      styles: readFileSync(require.resolve("@lunora/studio/styles.css"))
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    logger?.warnOnce?.(`[lunora] studio assets unavailable (build @lunora/studio?): ${message}`);
+    return void 0;
+  }
+};
+const studioAssetsStamp = (resolveFrom = import.meta.url) => {
+  try {
+    const require = createRequire(resolveFrom);
+    const scriptMtime = statSync(require.resolve("@lunora/studio/standalone/studio.js")).mtimeMs;
+    const stylesMtime = statSync(require.resolve("@lunora/studio/styles.css")).mtimeMs;
+    return Math.max(scriptMtime, stylesMtime);
+  } catch {
+    return void 0;
+  }
+};
+const resolveStandaloneDirectory = (resolveFrom = import.meta.url) => {
+  try {
+    return dirname(createRequire(resolveFrom).resolve("@lunora/studio/standalone/studio.js"));
+  } catch {
+    return void 0;
+  }
+};
+const resolveContainedFile = (directory, fileName) => {
+  if (fileName === "" || fileName === "." || fileName === ".." || fileName.includes("/") || fileName.includes("\\") || fileName.includes("\0")) {
+    return void 0;
+  }
+  const resolved = normalize(join(directory, fileName));
+  const relativePath = relative(directory, resolved);
+  if (relativePath === "" || relativePath.startsWith("..") || isAbsolute(relativePath) || relativePath.includes("/") || relativePath.includes("\\")) {
+    return void 0;
+  }
+  return resolved;
+};
+const readStandaloneAsset = (fileName, resolveFrom = import.meta.url) => {
+  const directory = resolveStandaloneDirectory(resolveFrom);
+  if (directory === void 0) {
+    return void 0;
+  }
+  const resolved = resolveContainedFile(directory, fileName);
+  if (resolved === void 0) {
+    return void 0;
+  }
+  try {
+    return readFileSync(resolved);
+  } catch {
+    return void 0;
+  }
+};
+const isStandaloneModulePath = (pathname) => pathname.endsWith(".js") || pathname.endsWith(".js.map");
+const assetContentType = (fileName) => {
+  if (fileName.endsWith(".css")) {
+    return "text/css; charset=utf-8";
+  }
+  if (fileName.endsWith(".map")) {
+    return "application/json; charset=utf-8";
+  }
+  return "text/javascript; charset=utf-8";
+};
+
+export { assetContentType, isStandaloneModulePath, loadStudioAssets, readStandaloneAsset, resolveContainedFile, resolveStandaloneDirectory, studioAssetsStamp };

package/dist/packem_shared/{buildPackageSecretsBlock-S74dgmwy.mjs → buildPackageSecretsBlock-BxOcyaAY.mjs}

@@ -1,9 +1,11 @@
 import { randomBytes } from 'node:crypto';
-import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync, renameSync, rmSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-import { DEV_VARS_FILE, DEV_VARS_EXAMPLE_FILE, parseDevVariableEntries, DEV_VARS_NEWLINE, splitDevVariableLine, unquoteDevVariable } from './DEV_VARS_EXAMPLE_FILE-dJPNTEnK.mjs';
-import { secretsForPackages } from './PACKAGE_SECRETS_REGISTRY-CySy5vR_.mjs';
+import { LunoraError } from '@lunora/errors';
+import { DEV_VARS_FILE, DEV_VARS_EXAMPLE_FILE, splitDevVariableLine, parseDevVariableEntries, DEV_VARS_NEWLINE, unquoteDevVariable } from './DEV_VARS_EXAMPLE_FILE-dJPNTEnK.mjs';
+import { CORE_SECRETS, PACKAGE_SECRETS_REGISTRY, secretsForPackages } from './PACKAGE_SECRETS_REGISTRY-NCTSphDk.mjs';
 
+const requiredSecrets = (packageNames) => [...CORE_SECRETS, ...secretsForPackages(packageNames)];
 const SECRET_BYTES = 32;
 const SECRET_KEY = /(?:KEY|PASSWORD|SECRET|TOKEN)$/u;
 const PLACEHOLDER_MARKERS = [
@@ -44,7 +46,12 @@ const isPlaceholderValue = (value) => {
 };
 const isPlaceholder = (rawValue) => isPlaceholderValue(unquoteDevVariable(rawValue.trim()));
 const defaultRandomHex = (bytes) => randomBytes(bytes).toString("hex");
-const generatedSecretFor = (key, rawValue, randomHex) => SECRET_KEY.test(key) && isPlaceholder(rawValue) ? randomHex(SECRET_BYTES) : void 0;
+const PROVIDER_SECRET_KEYS = new Set(
+  [...CORE_SECRETS, ...Object.values(PACKAGE_SECRETS_REGISTRY).flat()].filter((entry) => SECRET_KEY.test(entry.key) && entry.placeholderValue.startsWith("<")).map((entry) => entry.key)
+);
+const isMintableSecretKey = (key) => SECRET_KEY.test(key) && !PROVIDER_SECRET_KEYS.has(key);
+const generatedSecretFor = (key, rawValue, randomHex) => isMintableSecretKey(key) && isPlaceholder(rawValue) ? randomHex(SECRET_BYTES) : void 0;
+const generateSecretValue = (randomHex = defaultRandomHex) => randomHex(SECRET_BYTES);
 const planDevVariablesScaffold = (input) => {
   if (input.devVarsExists) {
     return { status: "exists" };
@@ -98,19 +105,48 @@ const atomicCreateDevVariables = (path, content) => {
     throw error;
   }
 };
-const appendDevVariables = (path, additions) => {
-  const existing = readFileSync(path, "utf8");
-  const separator = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-  const content = `${existing}${separator}${additions.join("\n")}
-`;
-  const temporaryPath = `${path}.tmp-${String(process.pid)}`;
+const APPEND_MAX_ATTEMPTS = 5;
+const fingerprintOf = (path) => {
   try {
-    writeFileSync(temporaryPath, content, { encoding: "utf8", mode: 384 });
-    renameSync(temporaryPath, path);
-  } catch (error) {
-    rmSync(temporaryPath, { force: true });
-    throw error;
+    const stats = statSync(path);
+    return { mtimeMs: stats.mtimeMs, size: stats.size };
+  } catch {
+    return void 0;
+  }
+};
+const sameFingerprint = (a, b) => {
+  if (a === void 0 || b === void 0) {
+    return false;
+  }
+  return a.mtimeMs === b.mtimeMs && a.size === b.size;
+};
+const appendDevVariables = (path, buildAdditions) => {
+  for (let attempt = 0; attempt < APPEND_MAX_ATTEMPTS; attempt += 1) {
+    const beforeFingerprint = fingerprintOf(path);
+    const existing = readFileSync(path, "utf8");
+    const additions = buildAdditions(existing);
+    if (additions.length === 0) {
+      return [];
+    }
+    const separator = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    const content = `${existing}${separator}${additions.join("\n")}
+`;
+    const temporaryPath = `${path}.tmp-${String(process.pid)}-${randomBytes(6).toString("hex")}`;
+    try {
+      writeFileSync(temporaryPath, content, { encoding: "utf8", mode: 384 });
+      const beforeRenameFingerprint = fingerprintOf(path);
+      if (!sameFingerprint(beforeFingerprint, beforeRenameFingerprint)) {
+        rmSync(temporaryPath, { force: true });
+        continue;
+      }
+      renameSync(temporaryPath, path);
+      return additions;
+    } catch (error) {
+      rmSync(temporaryPath, { force: true });
+      throw error;
+    }
   }
+  throw new LunoraError("INTERNAL", `Failed to append to ${path} after ${String(APPEND_MAX_ATTEMPTS)} attempts — a concurrent writer kept winning the race.`);
 };
 const ensureDevVariables = async (deps) => {
   const devVariablesPath = join(deps.cwd, DEV_VARS_FILE);
@@ -146,16 +182,24 @@ const ensureDevVariables = async (deps) => {
     deps.info(`Skipped — add ${list} to ${DEV_VARS_FILE} when you're ready.`);
     return { addedKeys: [], generatedKeys: [], status: "declined" };
   }
-  appendDevVariables(devVariablesPath, augment.additions);
-  deps.info(`Updated ${DEV_VARS_FILE} — added ${list}${generatedSuffix(augment.generatedKeys)}.`);
-  return { addedKeys: augment.missingKeys, generatedKeys: augment.generatedKeys, status: "augmented" };
+  const written = appendDevVariables(
+    devVariablesPath,
+    (currentContent) => planDevVariablesAugment({ existingContent: currentContent, exampleContent, randomHex: deps.randomHex }).additions
+  );
+  const writtenKeys = written.map((line) => splitDevVariableLine(line)?.key).filter((key) => key !== void 0);
+  if (writtenKeys.length === 0) {
+    return { addedKeys: [], generatedKeys: [], status: "exists" };
+  }
+  const writtenGeneratedKeys = augment.generatedKeys.filter((key) => writtenKeys.includes(key));
+  deps.info(`Updated ${DEV_VARS_FILE} — added ${writtenKeys.join(", ")}${generatedSuffix(writtenGeneratedKeys)}.`);
+  return { addedKeys: writtenKeys, generatedKeys: writtenGeneratedKeys, status: "augmented" };
 };
 const secretEntryBlock = (entry) => {
   const lines = [`# ${entry.description}`, `# Docs: ${entry.docsUrl}`, `${entry.key}="${entry.placeholderValue}"`];
   return lines.join("\n");
 };
 const buildPackageSecretsBlock = (packageNames, existingKeys) => {
-  const entries = secretsForPackages(packageNames).filter((entry) => !existingKeys.has(entry.key));
+  const entries = requiredSecrets(packageNames).filter((entry) => !existingKeys.has(entry.key));
   if (entries.length === 0) {
     return "";
   }
@@ -181,7 +225,57 @@ ${block}
     rmSync(temporaryPath, { force: true });
     throw error;
   }
-  return secretsForPackages(packageNames).filter((entry) => !existingKeys.has(entry.key)).map((entry) => entry.key);
+  return requiredSecrets(packageNames).filter((entry) => !existingKeys.has(entry.key)).map((entry) => entry.key);
+};
+const planDevSecretsFill = (input) => {
+  const randomHex = input.randomHex ?? defaultRandomHex;
+  const filledKeys = [];
+  const lines = input.existingContent.split(DEV_VARS_NEWLINE).map((line) => {
+    const parsed = splitDevVariableLine(line);
+    const secret = parsed ? generatedSecretFor(parsed.key, parsed.value, randomHex) : void 0;
+    if (!parsed || secret === void 0) {
+      return line;
+    }
+    filledKeys.push(parsed.key);
+    return `${parsed.key}="${secret}"`;
+  });
+  const present = new Set(parseDevVariableEntries(input.existingContent).map((entry) => entry.key));
+  const addedKeys = [];
+  const additions = [];
+  for (const entry of CORE_SECRETS) {
+    if (present.has(entry.key)) {
+      continue;
+    }
+    addedKeys.push(entry.key);
+    additions.push(`# ${entry.description}`, `${entry.key}="${randomHex(SECRET_BYTES)}"`);
+  }
+  const body = lines.join("\n");
+  if (additions.length === 0) {
+    return { addedKeys, content: body, filledKeys };
+  }
+  const separator = body === "" || body.endsWith("\n") ? "" : "\n";
+  return { addedKeys, content: `${body}${separator}${additions.join("\n")}
+`, filledKeys };
+};
+const fillDevSecrets = (deps) => {
+  const devVariablesPath = join(deps.cwd, DEV_VARS_FILE);
+  const exists = existsSync(devVariablesPath);
+  const existingContent = exists ? readFileSync(devVariablesPath, "utf8") : "";
+  const plan = planDevSecretsFill({ existingContent, randomHex: deps.randomHex });
+  if (plan.filledKeys.length === 0 && plan.addedKeys.length === 0) {
+    return { addedKeys: [], filledKeys: [], status: "unchanged" };
+  }
+  const temporaryPath = `${devVariablesPath}.tmp-${String(process.pid)}`;
+  try {
+    writeFileSync(temporaryPath, plan.content, { encoding: "utf8", mode: 384 });
+    renameSync(temporaryPath, devVariablesPath);
+  } catch (error) {
+    rmSync(temporaryPath, { force: true });
+    throw error;
+  }
+  const generated = [...plan.filledKeys, ...plan.addedKeys];
+  deps.info?.(`Generated ${String(generated.length)} dev secret(s) in ${DEV_VARS_FILE}: ${generated.join(", ")}`);
+  return { addedKeys: plan.addedKeys, filledKeys: plan.filledKeys, status: exists ? "filled" : "created" };
 };
 
-export { buildPackageSecretsBlock, ensureDevVariables, ensureDevVariablesExample as ensureDevVarsExample, isPlaceholderValue, planDevVariablesAugment, planDevVariablesScaffold };
+export { buildPackageSecretsBlock, ensureDevVariables, ensureDevVariablesExample as ensureDevVarsExample, fillDevSecrets, generateSecretValue, isMintableSecretKey, isPlaceholderValue, planDevSecretsFill, planDevVariablesAugment, planDevVariablesScaffold, requiredSecrets };

package/dist/packem_shared/collectWranglerSecretVariables-BRWIvT-e.mjs

@@ -0,0 +1,56 @@
+import { relative } from 'node:path';
+import { secretKindOf, redact } from '@lunora/codegen';
+import { isPlaceholderValue } from './buildPackageSecretsBlock-BxOcyaAY.mjs';
+import { findWranglerFile, readWranglerJsonc } from './WRANGLER_FILES-DwSuC-Kn.mjs';
+
+const MIN_SECRET_NAMED_VALUE_LENGTH = 8;
+const SECRET_WORD_TOKENS = /* @__PURE__ */ new Set(["CREDENTIAL", "CREDENTIALS", "DSN", "PASSPHRASE", "PASSWD", "PASSWORD", "SECRET", "TOKEN"]);
+const SECRET_KEY_SUFFIXES = ["ACCESS_KEY", "API_KEY", "ENCRYPTION_KEY", "PRIVATE_KEY", "SIGNING_KEY"];
+const PUBLIC_KEY_TOKENS = /* @__PURE__ */ new Set(["PUBLIC", "PUBLISHABLE"]);
+const KEY_SEPARATOR_RE = /[_-]/u;
+const keyTokens = (key) => key.toUpperCase().split(KEY_SEPARATOR_RE);
+const isSecretKeyName = (key) => {
+  const normalized = key.toUpperCase().replaceAll("-", "_");
+  if (keyTokens(key).some((token) => SECRET_WORD_TOKENS.has(token))) {
+    return true;
+  }
+  return SECRET_KEY_SUFFIXES.some((suffix) => normalized === suffix || normalized.endsWith(`_${suffix}`));
+};
+const isPublicKeyName = (key) => keyTokens(key).some((token) => PUBLIC_KEY_TOKENS.has(token));
+const scanWranglerVariablesForSecrets = (variables, file) => {
+  if (variables === void 0) {
+    return [];
+  }
+  const findings = [];
+  for (const [key, rawValue] of Object.entries(variables)) {
+    if (typeof rawValue !== "string") {
+      continue;
+    }
+    if (isPlaceholderValue(rawValue)) {
+      continue;
+    }
+    if (isPublicKeyName(key)) {
+      continue;
+    }
+    const shapeKind = secretKindOf(rawValue);
+    const kind = shapeKind ?? (isSecretKeyName(key) && rawValue.length >= MIN_SECRET_NAMED_VALUE_LENGTH ? "secret_named_var" : void 0);
+    if (kind === void 0) {
+      continue;
+    }
+    findings.push({ file, key, kind, preview: redact(rawValue) });
+  }
+  return findings;
+};
+const collectWranglerSecretVariables = (projectRoot) => {
+  const wranglerPath = findWranglerFile(projectRoot);
+  if (wranglerPath === void 0) {
+    return [];
+  }
+  const { parsed } = readWranglerJsonc(wranglerPath);
+  if (parsed === void 0) {
+    return [];
+  }
+  return scanWranglerVariablesForSecrets(parsed.vars, relative(projectRoot, wranglerPath));
+};
+
+export { collectWranglerSecretVariables, scanWranglerVariablesForSecrets };

package/dist/packem_shared/{createConfirm-fvpdgJ9s.mjs → createConfirm-BMikeJC9.mjs}

@@ -28,13 +28,13 @@ const promptSelect = async (message, options, settings) => {
   const lines = options.map(
     (option, index) => `  ${String(index + 1)}) ${option.label}${option.description === void 0 ? "" : ` — ${option.description}`}`
   );
-  const promptText = `${message}
+  const promptMessage = `${message}
 ${lines.join("\n")}
 > ${defaultIndex >= 0 ? `[${String(defaultIndex + 1)}] ` : ""}`;
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
     const answer = await new Promise((resolve) => {
-      rl.question(promptText, (input) => {
+      rl.question(promptMessage, (input) => {
         resolve(input);
       });
     });
@@ -52,6 +52,23 @@ ${lines.join("\n")}
     rl.close();
   }
 };
+const promptText = async (message, settings) => {
+  if (!isInteractive()) {
+    return settings?.default;
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await new Promise((resolve) => {
+      rl.question(message, (input) => {
+        resolve(input);
+      });
+    });
+    const trimmed = answer.trim();
+    return trimmed === "" ? settings?.default : trimmed;
+  } finally {
+    rl.close();
+  }
+};
 const promptMultiSelect = async (message, options, settings) => {
   const defaults = settings?.defaults ?? [];
   if (!isInteractive() || options.length === 0) {
@@ -61,13 +78,13 @@ const promptMultiSelect = async (message, options, settings) => {
     (option, index) => `  ${String(index + 1)}) ${option.label}${option.description === void 0 ? "" : ` — ${option.description}`}`
   );
   const defaultHint = defaults.length === 0 ? "" : `[${defaults.join(", ")}] `;
-  const promptText = `${message} (comma-separated; Enter for default)
+  const promptMessage = `${message} (comma-separated; Enter for default)
 ${lines.join("\n")}
 > ${defaultHint}`;
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
     const answer = await new Promise((resolve) => {
-      rl.question(promptText, (input) => {
+      rl.question(promptMessage, (input) => {
         resolve(input);
       });
     });
@@ -97,4 +114,4 @@ ${lines.join("\n")}
   }
 };
 
-export { createConfirm, isInteractive, promptMultiSelect, promptSelect, promptYesNo };
+export { createConfirm, isInteractive, promptMultiSelect, promptSelect, promptText, promptYesNo };

package/dist/packem_shared/{detectFramework-Br-BcPBq.mjs → detectFramework-U08038Yp.mjs}

@@ -12,7 +12,7 @@ const FRAMEWORK_SIGNATURES = [
   { class: "B", dependency: "astro", framework: "astro" }
 ];
 const STANDALONE = { class: "C", framework: "none" };
-const readDependencyNames = (root) => {
+const readProjectDependencyNames = (root) => {
   const packageJsonPath = join(root, "package.json");
   if (!existsSync(packageJsonPath)) {
     return /* @__PURE__ */ new Set();
@@ -26,7 +26,7 @@ const readDependencyNames = (root) => {
   }
 };
 const detectFramework = (root) => {
-  const dependencies = readDependencyNames(root);
+  const dependencies = readProjectDependencyNames(root);
   if (dependencies.size === 0) {
     return STANDALONE;
   }
@@ -38,4 +38,4 @@ const detectFramework = (root) => {
   return STANDALONE;
 };
 
-export { detectFramework };
+export { detectFramework, readProjectDependencyNames };