@zintrust/core 0.4.39 → 0.4.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zintrust/core",
-  "version": "0.4.39",
+  "version": "0.4.40",
   "description": "Production-grade TypeScript backend framework for JavaScript",
   "homepage": "https://zintrust.com",
   "repository": {
@@ -58,7 +58,7 @@
   },
   "dependencies": {
     "@cloudflare/containers": "^0.2.0",
-    "@zintrust/workers": "^0.4.39",
+    "@zintrust/workers": "^0.4.40",
     "bcryptjs": "^3.0.3",
     "bullmq": "^5.71.1",
     "chalk": "^5.6.2",

package/src/cli/cloudflare/CloudflareEnvTargetConfig.d.ts

@@ -0,0 +1,37 @@
+type ZintrustConfig = Record<string, unknown>;
+export interface CloudflareEnvTargetConfig {
+    sharedEnv: string[];
+    wranglerEnvs: Record<string, string[]>;
+    targets: Record<string, string[]>;
+}
+type ResolveTargetArgs = {
+    projectRoot: string;
+    cwd: string;
+    configPath?: string;
+};
+export declare const readZintrustConfig: (cwd: string) => ZintrustConfig;
+export declare const resolveCloudflareEnvTargetConfig: (config: ZintrustConfig) => CloudflareEnvTargetConfig;
+export declare const inferCloudflareTarget: ({ projectRoot, cwd, configPath, }: ResolveTargetArgs) => string;
+export declare const resolveCloudflareEnvKeys: (args: {
+    config: ZintrustConfig;
+    projectRoot: string;
+    cwd: string;
+    configPath?: string;
+    wranglerEnv?: string;
+    target?: string;
+}) => string[];
+declare const _default: Readonly<{
+    readZintrustConfig: (cwd: string) => ZintrustConfig;
+    resolveCloudflareEnvTargetConfig: (config: ZintrustConfig) => CloudflareEnvTargetConfig;
+    inferCloudflareTarget: ({ projectRoot, cwd, configPath, }: ResolveTargetArgs) => string;
+    resolveCloudflareEnvKeys: (args: {
+        config: ZintrustConfig;
+        projectRoot: string;
+        cwd: string;
+        configPath?: string;
+        wranglerEnv?: string;
+        target?: string;
+    }) => string[];
+}>;
+export default _default;
+//# sourceMappingURL=CloudflareEnvTargetConfig.d.ts.map

package/src/cli/cloudflare/CloudflareEnvTargetConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareEnvTargetConfig.d.ts","sourceRoot":"","sources":["../../../../src/cli/cloudflare/CloudflareEnvTargetConfig.ts"],"names":[],"mappings":"AAKA,KAAK,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE9C,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACnC;AAED,KAAK,iBAAiB,GAAG;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAkCF,eAAO,MAAM,kBAAkB,GAAI,KAAK,MAAM,KAAG,cAahD,CAAC;AAEF,eAAO,MAAM,gCAAgC,GAC3C,QAAQ,cAAc,KACrB,yBAQF,CAAC;AAqBF,eAAO,MAAM,qBAAqB,GAAI,mCAInC,iBAAiB,KAAG,MActB,CAAC;AAEF,eAAO,MAAM,wBAAwB,GAAI,MAAM;IAC7C,MAAM,EAAE,cAAc,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,KAAG,MAAM,EAiBT,CAAC;;8BA1FsC,MAAM,KAAG,cAAc;+CAgBrD,cAAc,KACrB,yBAAyB;+DAiCzB,iBAAiB,KAAG,MAAM;qCAgBkB;QAC7C,MAAM,EAAE,cAAc,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAG,MAAM,EAAE;;AAmBZ,wBAKG"}

package/src/cli/cloudflare/CloudflareEnvTargetConfig.js

@@ -0,0 +1,104 @@
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { isArray, isNonEmptyString, isObject } from '../../helper/index.js';
+import { existsSync, readFileSync } from '../../node-singletons/fs.js';
+import * as path from '../../node-singletons/path.js';
+const uniq = (items) => {
+    const seen = new Set();
+    const out = [];
+    for (const item of items) {
+        const normalized = item.trim();
+        if (normalized === '' || seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        out.push(normalized);
+    }
+    return out;
+};
+const toStringArray = (value) => {
+    if (!isArray(value))
+        return [];
+    return uniq(value.filter(isNonEmptyString).map((item) => item.trim()));
+};
+const toStringArrayRecord = (value) => {
+    if (!isObject(value))
+        return {};
+    return Object.fromEntries(Object.entries(value)
+        .filter(([key]) => isNonEmptyString(key))
+        .map(([key, entry]) => [key.trim(), toStringArray(entry)]));
+};
+const isAbsolutePath = (value) => value.startsWith('/') || /^[A-Za-z]:[\\/]/.test(value);
+export const readZintrustConfig = (cwd) => {
+    const filePath = path.join(cwd, '.zintrust.json');
+    if (!existsSync(filePath)) {
+        return {};
+    }
+    try {
+        const raw = readFileSync(filePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        return isObject(parsed) ? parsed : {};
+    }
+    catch (error) {
+        throw ErrorFactory.createCliError('Failed to parse .zintrust.json', error);
+    }
+};
+export const resolveCloudflareEnvTargetConfig = (config) => {
+    const raw = isObject(config['cloudflare']) ? config['cloudflare'] : {};
+    return Object.freeze({
+        sharedEnv: toStringArray(raw['shared_env']),
+        wranglerEnvs: toStringArrayRecord(raw['wrangler_envs']),
+        targets: toStringArrayRecord(raw['targets']),
+    });
+};
+const normalizeConfigPath = (cwd, configPath) => {
+    if (!isNonEmptyString(configPath))
+        return undefined;
+    return isAbsolutePath(configPath) ? configPath : path.join(cwd, configPath);
+};
+const inferServiceTarget = (projectRoot, candidateDir) => {
+    const servicesRoot = path.join(projectRoot, 'src', 'services');
+    const relative = path.relative(servicesRoot, candidateDir);
+    if (relative === '' || relative.startsWith('..'))
+        return undefined;
+    const segments = relative
+        .split(path.sep)
+        .map((segment) => segment.trim())
+        .filter((segment) => segment !== '');
+    if (segments.length < 2)
+        return undefined;
+    return `${segments[0]}/${segments[1]}`;
+};
+export const inferCloudflareTarget = ({ projectRoot, cwd, configPath, }) => {
+    const normalizedConfigPath = normalizeConfigPath(cwd, configPath);
+    const configBase = normalizedConfigPath === undefined ? '' : path.basename(normalizedConfigPath);
+    if (configBase.startsWith('wrangler.containers-proxy.')) {
+        return 'containers-proxy';
+    }
+    const candidateDir = normalizedConfigPath === undefined ? cwd : path.dirname(normalizedConfigPath);
+    const serviceTarget = inferServiceTarget(projectRoot, candidateDir);
+    if (serviceTarget !== undefined)
+        return serviceTarget;
+    return 'worker';
+};
+export const resolveCloudflareEnvKeys = (args) => {
+    const cloudflare = resolveCloudflareEnvTargetConfig(args.config);
+    const target = isNonEmptyString(args.target)
+        ? args.target.trim()
+        : inferCloudflareTarget({
+            projectRoot: args.projectRoot,
+            cwd: args.cwd,
+            configPath: args.configPath,
+        });
+    const wranglerEnv = isNonEmptyString(args.wranglerEnv) ? args.wranglerEnv.trim() : undefined;
+    return uniq([
+        ...cloudflare.sharedEnv,
+        ...(cloudflare.targets['default'] ?? []),
+        ...(cloudflare.targets[target] ?? []),
+        ...(wranglerEnv === undefined ? [] : (cloudflare.wranglerEnvs[wranglerEnv] ?? [])),
+    ]);
+};
+export default Object.freeze({
+    readZintrustConfig,
+    resolveCloudflareEnvTargetConfig,
+    inferCloudflareTarget,
+    resolveCloudflareEnvKeys,
+});

package/src/cli/cloudflare/CloudflareSecretSync.d.ts

@@ -0,0 +1,34 @@
+type CloudflareSecretLog = {
+    info: (message: string) => void;
+    warn: (message: string) => void;
+    success?: (message: string) => void;
+};
+export type CloudflareSecretSyncFailure = {
+    wranglerEnv: string;
+    key: string;
+    reason: string;
+};
+type CloudflareSecretSyncArgs = {
+    log: CloudflareSecretLog;
+    cwd: string;
+    wranglerEnvs: string[];
+    envPath: string;
+    dryRun?: boolean;
+    configGroups?: string[];
+    configPath?: string;
+    target?: string;
+    requireSelection?: boolean;
+};
+export type CloudflareSecretSyncResult = {
+    pushed: number;
+    failures: CloudflareSecretSyncFailure[];
+    selectedKeys: string[];
+};
+export declare const reportCloudflareSecretSync: (log: CloudflareSecretLog, result: Pick<CloudflareSecretSyncResult, "pushed" | "failures">) => void;
+export declare const syncCloudflareSecrets: ({ log, cwd, wranglerEnvs, envPath, dryRun, configGroups, configPath, target, requireSelection, }: CloudflareSecretSyncArgs) => Promise<CloudflareSecretSyncResult>;
+declare const _default: Readonly<{
+    syncCloudflareSecrets: ({ log, cwd, wranglerEnvs, envPath, dryRun, configGroups, configPath, target, requireSelection, }: CloudflareSecretSyncArgs) => Promise<CloudflareSecretSyncResult>;
+    reportCloudflareSecretSync: (log: CloudflareSecretLog, result: Pick<CloudflareSecretSyncResult, "pushed" | "failures">) => void;
+}>;
+export default _default;
+//# sourceMappingURL=CloudflareSecretSync.d.ts.map

package/src/cli/cloudflare/CloudflareSecretSync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareSecretSync.d.ts","sourceRoot":"","sources":["../../../../src/cli/cloudflare/CloudflareSecretSync.ts"],"names":[],"mappings":"AAYA,KAAK,mBAAmB,GAAG;IACzB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAaF,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,mBAAmB,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,2BAA2B,EAAE,CAAC;IACxC,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAiJF,eAAO,MAAM,0BAA0B,GACrC,KAAK,mBAAmB,EACxB,QAAQ,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,UAAU,CAAC,KAC9D,IAYF,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAU,kGAUzC,wBAAwB,KAAG,OAAO,CAAC,0BAA0B,CAwC/D,CAAC;;8HAxCC,wBAAwB,KAAG,OAAO,CAAC,0BAA0B,CAAC;sCA1B1D,mBAAmB,UAChB,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,UAAU,CAAC,KAC9D,IAAI;;AAkEP,wBAGG"}

package/src/cli/cloudflare/CloudflareSecretSync.js

@@ -0,0 +1,148 @@
+import { readZintrustConfig, resolveCloudflareEnvKeys, } from '../cloudflare/CloudflareEnvTargetConfig.js';
+import { resolveNpmPath } from '../../common/index.js';
+import { appConfig } from '../../config/app.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { execFileSync } from '../../node-singletons/child-process.js';
+import { existsSync } from '../../node-singletons/fs.js';
+import * as path from '../../node-singletons/path.js';
+import { EnvFile } from '../../toolkit/Secrets/EnvFile.js';
+const uniq = (items) => {
+    const seen = new Set();
+    const out = [];
+    for (const item of items) {
+        const normalized = item.trim();
+        if (normalized === '' || seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        out.push(normalized);
+    }
+    return out;
+};
+const getConfigArray = (config, key) => {
+    const raw = config[key];
+    if (!Array.isArray(raw))
+        return [];
+    return uniq(raw.filter((item) => typeof item === 'string'));
+};
+const resolveValue = (key, envMap) => {
+    const fromFile = envMap[key];
+    const fromProcess = process.env[key];
+    return fromFile ?? fromProcess ?? '';
+};
+const getPutTimeoutMs = () => {
+    const raw = process.env['ZT_PUT_TIMEOUT_MS'];
+    if (typeof raw !== 'string')
+        return 120000;
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return 120000;
+    return parsed;
+};
+const putSecret = (wranglerEnv, key, value, configPath) => {
+    const npmPath = resolveNpmPath();
+    const args = ['exec', '--yes', '--', 'wrangler'];
+    if (typeof configPath === 'string' && configPath.trim() !== '') {
+        args.push('--config', configPath.trim());
+    }
+    args.push('secret', 'put', key, '--env', wranglerEnv);
+    execFileSync(npmPath, args, {
+        stdio: ['pipe', 'inherit', 'inherit'],
+        input: value,
+        encoding: 'utf8',
+        timeout: getPutTimeoutMs(),
+        killSignal: 'SIGTERM',
+        env: appConfig.getSafeEnv(),
+    });
+};
+const getFailureReason = (error) => error instanceof Error ? error.message : String(error);
+const resolveSelectedKeys = ({ log, config, cwd, wranglerEnvs, configGroups = [], configPath, target, requireSelection, }) => {
+    const explicitKeys = uniq(configGroups.flatMap((groupKey) => {
+        const keys = getConfigArray(config, groupKey);
+        if (keys.length === 0) {
+            log.warn(`Group \`${groupKey}\` is missing or empty in .zintrust.json`);
+        }
+        return keys;
+    }));
+    const manifestKeys = uniq(wranglerEnvs.flatMap((wranglerEnv) => resolveCloudflareEnvKeys({
+        config,
+        projectRoot: cwd,
+        cwd,
+        ...(configPath === undefined ? {} : { configPath }),
+        wranglerEnv,
+        ...(typeof target === 'string' && target.trim() !== '' ? { target: target.trim() } : {}),
+    })));
+    const selectedKeys = uniq([...explicitKeys, ...manifestKeys]);
+    if (selectedKeys.length > 0 || !requireSelection) {
+        return selectedKeys;
+    }
+    throw ErrorFactory.createCliError(configGroups.length === 0
+        ? 'No secret keys resolved from .zintrust.json cloudflare.shared_env/cloudflare.targets/cloudflare.wrangler_envs. Use --var <group> or add a Cloudflare env manifest.'
+        : 'No secret keys resolved from selected groups.');
+};
+const processSecretSync = (log, wranglerEnvs, selectedKeys, envMap, dryRun, configPath) => {
+    let pushed = 0;
+    const failures = [];
+    for (const wranglerEnv of wranglerEnvs) {
+        for (const key of selectedKeys) {
+            const value = resolveValue(key, envMap);
+            if (value.trim() === '') {
+                failures.push({ wranglerEnv, key, reason: 'empty value' });
+                continue;
+            }
+            try {
+                if (!dryRun) {
+                    log.info(`putting ${key} -> ${wranglerEnv}...`);
+                    putSecret(wranglerEnv, key, value, configPath);
+                }
+                pushed += 1;
+                log.info(`${dryRun ? '[dry-run] ' : ''}put ${key} -> ${wranglerEnv}`);
+            }
+            catch (error) {
+                failures.push({ wranglerEnv, key, reason: getFailureReason(error) });
+            }
+        }
+    }
+    return { pushed, failures };
+};
+export const reportCloudflareSecretSync = (log, result) => {
+    if (typeof log.success === 'function') {
+        log.success(`Cloudflare secrets report: pushed=${result.pushed}, failed=${result.failures.length}`);
+    }
+    else {
+        log.info(`Cloudflare secrets report: pushed=${result.pushed}, failed=${result.failures.length}`);
+    }
+    for (const item of result.failures) {
+        log.warn(`${item.key} -> ${item.wranglerEnv}: ${item.reason}`);
+    }
+};
+export const syncCloudflareSecrets = async ({ log, cwd, wranglerEnvs, envPath, dryRun = false, configGroups = [], configPath, target, requireSelection = true, }) => {
+    const normalizedConfigPath = typeof configPath === 'string' && configPath.trim() !== '' ? configPath.trim() : undefined;
+    if (normalizedConfigPath !== undefined &&
+        !existsSync(path.join(cwd, normalizedConfigPath))) {
+        throw ErrorFactory.createCliError(`Wrangler config not found: ${normalizedConfigPath}`);
+    }
+    const config = readZintrustConfig(cwd);
+    const selectedKeys = resolveSelectedKeys({
+        log,
+        config,
+        cwd,
+        wranglerEnvs,
+        configGroups,
+        configPath: normalizedConfigPath,
+        target,
+        requireSelection,
+    });
+    if (selectedKeys.length === 0) {
+        return { pushed: 0, failures: [], selectedKeys: [] };
+    }
+    const envMap = await EnvFile.read({ cwd, path: envPath });
+    const syncResult = processSecretSync(log, wranglerEnvs, selectedKeys, envMap, dryRun, normalizedConfigPath);
+    return {
+        ...syncResult,
+        selectedKeys,
+    };
+};
+export default Object.freeze({
+    syncCloudflareSecrets,
+    reportCloudflareSecretSync,
+});

package/src/cli/commands/DeployCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeployCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DeployCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAyIrE;;;GAGG;AACH,eAAO,MAAM,aAAa;IACxB;;OAEG;cACO,YAAY;EAGtB,CAAC"}
+{"version":3,"file":"DeployCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DeployCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAuLrE;;;GAGG;AACH,eAAO,MAAM,aAAa;IACxB;;OAEG;cACO,YAAY;EAGtB,CAAC"}

package/src/cli/commands/DeployCommand.js

@@ -1,4 +1,5 @@
 import { BaseCommand } from '../BaseCommand.js';
+import { reportCloudflareSecretSync, syncCloudflareSecrets, } from '../cloudflare/CloudflareSecretSync.js';
 import { SpawnUtil } from '../utils/spawn.js';
 import { Logger } from '../../config/logger.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
@@ -44,7 +45,23 @@ const deployProxyStack = async (label) => {
     await runCompose(['compose', '-f', composePath, 'up', '-d', '--build']);
     Logger.info(`✅ ${label} deployed.`);
 };
-const runDeploy = async (target, options) => {
+const syncWranglerSecrets = async (cmd, cwd, wranglerEnv, options) => {
+    if (options.syncSecrets === false)
+        return;
+    const result = await syncCloudflareSecrets({
+        log: cmd,
+        cwd,
+        wranglerEnvs: [wranglerEnv],
+        envPath: typeof options.envPath === 'string' && options.envPath.trim() !== '' ? options.envPath : '.env',
+        configPath: typeof options.config === 'string' ? options.config.trim() : undefined,
+        target: typeof options.target === 'string' ? options.target : undefined,
+        requireSelection: false,
+    });
+    if (result.selectedKeys.length === 0)
+        return;
+    reportCloudflareSecretSync(cmd, result);
+};
+const runDeploy = async (cmd, target, options) => {
     const normalizedTarget = target.trim().toLowerCase();
     if (normalizedTarget === 'cw' || normalizedTarget === 'cwr') {
         const label = normalizedTarget === 'cwr'
@@ -70,6 +87,7 @@ const runDeploy = async (target, options) => {
         }
     }
     Logger.info(`Deploying to Cloudflare environment: ${environment}`);
+    await syncWranglerSecrets(cmd, process.cwd(), environment, options);
     const exitCode = await SpawnUtil.spawnAndWait({
         command: 'wrangler',
         args: ['deploy', ...(config.length > 0 ? ['--config', config] : []), '--env', environment],
@@ -79,7 +97,7 @@ const runDeploy = async (target, options) => {
     }
 };
 const createDeployCommand = () => {
-    return BaseCommand.create({
+    const cmd = BaseCommand.create({
         name: 'deploy',
         description: 'Deploy ZinTrust to Cloudflare Workers',
         addOptions: (command) => {
@@ -87,6 +105,9 @@ const createDeployCommand = () => {
                 .argument('[target]', 'Deployment target (worker, d1-proxy, kv-proxy, production, cw, cp)', 'worker')
                 .option('-e, --env <env>', 'Wrangler environment (overrides target)');
             command.option('-c, --config <path>', 'Wrangler config file (e.g. wrangler.containers-proxy.jsonc)');
+            command.option('--env-path <path>', 'Path to env file used when syncing Cloudflare secrets', '.env');
+            command.option('--target <id>', 'Cloudflare worker target key from .zintrust.json cloudflare.targets');
+            command.option('--no-sync-secrets', 'Skip Cloudflare secret sync before wrangler deploy');
         },
         execute: async (options) => {
             // Note: BaseCommand.create sets up action handler that calls execute(options).
@@ -103,9 +124,10 @@ const createDeployCommand = () => {
             //
             // So 'target' will be available in options.args[0]
             const target = options.args?.[0] ?? 'worker';
-            await runDeploy(target, options);
+            await runDeploy(cmd, target, options);
         },
     });
+    return cmd;
 };
 /**
  * Deploy Command Factory

package/src/cli/commands/DeployContainersProxyCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeployContainersProxyCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DeployContainersProxyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA2CrE,eAAO,MAAM,4BAA4B;cAC7B,YAAY;EAatB,CAAC"}
+{"version":3,"file":"DeployContainersProxyCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DeployContainersProxyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA6ErE,eAAO,MAAM,4BAA4B;cAC7B,YAAY;EAkBtB,CAAC"}

package/src/cli/commands/DeployContainersProxyCommand.js

@@ -1,4 +1,5 @@
 import { BaseCommand } from '../BaseCommand.js';
+import { reportCloudflareSecretSync, syncCloudflareSecrets, } from '../cloudflare/CloudflareSecretSync.js';
 import { SpawnUtil } from '../utils/spawn.js';
 import { Logger } from '../../config/logger.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
@@ -17,11 +18,28 @@ const resolveEnv = (raw) => {
     const normalized = typeof raw === 'string' ? raw.trim() : '';
     return normalized.length > 0 ? normalized : 'production';
 };
-const execute = async (options) => {
+const syncDeploySecrets = async (cmd, cwd, config, env, options) => {
+    if (options.syncSecrets === false)
+        return;
+    const result = await syncCloudflareSecrets({
+        log: cmd,
+        cwd,
+        wranglerEnvs: [env],
+        envPath: typeof options.envPath === 'string' && options.envPath.trim() !== '' ? options.envPath : '.env',
+        configPath: config,
+        target: typeof options.target === 'string' ? options.target : undefined,
+        requireSelection: false,
+    });
+    if (result.selectedKeys.length === 0)
+        return;
+    reportCloudflareSecretSync(cmd, result);
+};
+const execute = async (cmd, options) => {
     const cwd = process.cwd();
     const config = resolveConfig(cwd, options.config);
     const env = resolveEnv(options.env);
     Logger.info(`Deploying Containers proxy via Wrangler (env=${env})...`);
+    await syncDeploySecrets(cmd, cwd, config, env, options);
     const exitCode = await SpawnUtil.spawnAndWait({
         command: 'wrangler',
         args: ['deploy', '--config', config, '--env', env],
@@ -31,15 +49,19 @@ const execute = async (options) => {
 };
 export const DeployContainersProxyCommand = Object.freeze({
     create() {
-        return BaseCommand.create({
+        const cmd = BaseCommand.create({
             name: 'deploy:ccp',
             aliases: ['deploy:containers-proxy', 'deploy:cf-containers-proxy', 'd:ccp', 'ccp:deploy'],
             description: 'Deploy Cloudflare Containers proxy Worker (wrangler.containers-proxy.jsonc)',
             addOptions: (command) => {
                 command.option('-e, --env <name>', 'Wrangler environment name', 'production');
                 command.option('-c, --config <path>', 'Wrangler config file', DEFAULT_CONFIG);
+                command.option('--env-path <path>', 'Path to env file used when syncing Cloudflare secrets', '.env');
+                command.option('--target <id>', 'Cloudflare worker target key from .zintrust.json cloudflare.targets');
+                command.option('--no-sync-secrets', 'Skip Cloudflare secret sync before wrangler deploy');
             },
-            execute: async (options) => execute(options),
+            execute: async (options) => execute(cmd, options),
         });
+        return cmd;
     },
 });

package/src/cli/commands/ProxyScaffoldUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProxyScaffoldUtils.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/ProxyScaffoldUtils.ts"],"names":[],"mappings":"AAKA,KAAK,4BAA4B,GAAG;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,KAAK,2BAA2B,CAAC,OAAO,EAAE,QAAQ,IAAI;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,QAAQ,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC;IAC3E,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,0BAA0B,CAAC,OAAO,IAAI;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAIvE,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,GAAG,SAAS,EAAE,iBAA2B,KAAG,MAExF,CAAC;AAmBF,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,EAAE,KAAK,MAAM,KAAG,MAAM,GAAG,SAQvE,CAAC;AAmBF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,EAAE,SAAS,MAAM,EAAE,OAAO,MAAM,KAAG,MAuBhF,CAAC;AAEF,eAAO,MAAM,2BAA2B,GACtC,UAAU,MAAM,EAChB,mBAAmB,MAAM,KACxB,MAaF,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,SAAS,4BAA4B,KACpC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAoB3C,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAI,OAAO,EAAE,QAAQ,EACpD,SAAS,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,KACtD,0BAA0B,CAAC,OAAO,CAqBpC,CAAC"}
+{"version":3,"file":"ProxyScaffoldUtils.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/ProxyScaffoldUtils.ts"],"names":[],"mappings":"AAKA,KAAK,4BAA4B,GAAG;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,KAAK,2BAA2B,CAAC,OAAO,EAAE,QAAQ,IAAI;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,QAAQ,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC;IAC3E,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,0BAA0B,CAAC,OAAO,IAAI;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAIvE,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,GAAG,SAAS,EAAE,iBAA2B,KAAG,MAExF,CAAC;AAmBF,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,EAAE,KAAK,MAAM,KAAG,MAAM,GAAG,SAQvE,CAAC;AAmBF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,EAAE,SAAS,MAAM,EAAE,OAAO,MAAM,KAAG,MAuBhF,CAAC;AAEF,eAAO,MAAM,2BAA2B,GACtC,UAAU,MAAM,EAChB,mBAAmB,MAAM,KACxB,MAaF,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,SAAS,4BAA4B,KACpC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAmB3C,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAI,OAAO,EAAE,QAAQ,EACpD,SAAS,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,KACtD,0BAA0B,CAAC,OAAO,CAqBpC,CAAC"}

package/src/cli/commands/ProxyScaffoldUtils.js

@@ -1,7 +1,7 @@
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
 import { isNonEmptyString } from '../../helper/index.js';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from '../../node-singletons/fs.js';
-import { join } from '../../node-singletons/path.js';
+import { dirname, join } from '../../node-singletons/path.js';
 export const trimNonEmptyOption = (value) => {
     if (!isNonEmptyString(value))
         return undefined;
@@ -93,8 +93,7 @@ export const ensureProxyEntrypoint = (options) => {
     if (existsSync(entryFilePath)) {
         return { created: false, entryFilePath };
     }
-    const lastSlashIndex = entryFilePath.lastIndexOf('/');
-    const entryDir = lastSlashIndex > 0 ? entryFilePath.slice(0, lastSlashIndex) : options.cwd;
+    const entryDir = dirname(entryFilePath);
     mkdirSync(entryDir, { recursive: true });
     writeFileSync(entryFilePath, [
         `export { ${options.exportName} } from '${options.moduleSpecifier}';`,

package/src/cli/commands/PutCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PutCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/PutCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA0OvF,eAAO,MAAM,UAAU;cACX,YAAY;EAWtB,CAAC;AAEH,eAAe,UAAU,CAAC"}
+{"version":3,"file":"PutCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/PutCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAqFvF,eAAO,MAAM,UAAU;cACX,YAAY;EAWtB,CAAC;AAEH,eAAe,UAAU,CAAC"}

package/src/cli/commands/PutCommand.js

@@ -1,11 +1,6 @@
 import { BaseCommand } from '../BaseCommand.js';
-import { resolveNpmPath } from '../../common/index.js';
-import { appConfig } from '../../config/app.js';
+import { reportCloudflareSecretSync, syncCloudflareSecrets, } from '../cloudflare/CloudflareSecretSync.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
-import { execFileSync } from '../../node-singletons/child-process.js';
-import { existsSync, readFileSync } from '../../node-singletons/fs.js';
-import * as path from '../../node-singletons/path.js';
-import { EnvFile } from '../../toolkit/Secrets/EnvFile.js';
 const toStringArray = (value) => {
     if (typeof value === 'string')
         return [value];
@@ -25,26 +20,6 @@ const uniq = (items) => {
     }
     return out;
 };
-const readZintrustConfig = (cwd) => {
-    const filePath = path.join(cwd, '.zintrust.json');
-    if (!existsSync(filePath)) {
-        return {};
-    }
-    try {
-        const raw = readFileSync(filePath, 'utf8');
-        const parsed = JSON.parse(raw);
-        return typeof parsed === 'object' && parsed !== null ? parsed : {};
-    }
-    catch (error) {
-        throw ErrorFactory.createCliError('Failed to parse .zintrust.json', error);
-    }
-};
-const getConfigArray = (config, key) => {
-    const raw = config[key];
-    if (!Array.isArray(raw))
-        return [];
-    return uniq(raw.filter((item) => typeof item === 'string'));
-};
 const resolveConfigGroups = (options) => {
     return uniq(toStringArray(options.var));
 };
@@ -60,41 +35,12 @@ const parseEnvPath = (options) => {
         return direct;
     return '.env';
 };
-const resolveValue = (key, envMap) => {
-    const fromFile = envMap[key];
-    const fromProcess = process.env[key];
-    return fromFile ?? fromProcess ?? '';
-};
-const getPutTimeoutMs = () => {
-    const raw = process.env['ZT_PUT_TIMEOUT_MS'];
-    if (typeof raw !== 'string')
-        return 120000;
-    const parsed = Number.parseInt(raw, 10);
-    if (!Number.isFinite(parsed) || parsed <= 0)
-        return 120000;
-    return parsed;
-};
-const putSecret = (wranglerEnv, key, value, configPath) => {
-    const npmPath = resolveNpmPath();
-    const args = ['exec', '--yes', '--', 'wrangler'];
-    if (typeof configPath === 'string' && configPath.trim().length > 0) {
-        args.push('--config', configPath.trim());
-    }
-    args.push('secret', 'put', key, '--env', wranglerEnv);
-    execFileSync(npmPath, args, {
-        stdio: ['pipe', 'inherit', 'inherit'],
-        input: value,
-        encoding: 'utf8',
-        timeout: getPutTimeoutMs(),
-        killSignal: 'SIGTERM',
-        env: appConfig.getSafeEnv(),
-    });
-};
 const addOptions = (command) => {
     command
         .argument('[provider]', 'Secret provider (cloudflare)', 'cloudflare')
         .option('--wg <env...>', 'Wrangler environment target(s), e.g. d1-proxy kv-proxy')
         .option('--var <configKey...>', 'Config array key(s) from .zintrust.json (e.g. d1_env kv_env)')
+        .option('--target <id>', 'Cloudflare worker target key from .zintrust.json cloudflare.targets')
         .option('--env_path <path>', 'Path to env file used as source values', '.env')
         .option('-c, --config <path>', 'Wrangler config file to target (optional)')
         .option('--dry-run', 'Show what would be uploaded without calling wrangler');
@@ -104,70 +50,21 @@ const ensureCloudflareProvider = (providerRaw) => {
         return;
     throw ErrorFactory.createCliError('Only cloudflare provider is supported for `zin put`');
 };
-const resolveSelectedKeys = (cmd, config, options) => {
-    const configGroups = resolveConfigGroups(options);
-    if (configGroups.length === 0) {
-        throw ErrorFactory.createCliError('No config groups selected. Use --var <group>.');
-    }
-    const selectedKeys = uniq(configGroups.flatMap((groupKey) => {
-        const keys = getConfigArray(config, groupKey);
-        if (keys.length === 0) {
-            cmd.warn(`Group \`${groupKey}\` is missing or empty in .zintrust.json`);
-        }
-        return keys;
-    }));
-    if (selectedKeys.length === 0) {
-        throw ErrorFactory.createCliError('No secret keys resolved from selected groups.');
-    }
-    return selectedKeys;
-};
-const getFailureReason = (error) => error instanceof Error ? error.message : String(error);
-const reportResult = (cmd, pushed, failures) => {
-    cmd.success(`Cloudflare secrets report: pushed=${pushed}, failed=${failures.length}`);
-    for (const item of failures) {
-        cmd.warn(`${item.key} -> ${item.wranglerEnv}: ${item.reason}`);
-    }
-};
-const processPut = (cmd, wranglerEnvs, selectedKeys, envMap, dryRun, configPath) => {
-    let pushed = 0;
-    const failures = [];
-    for (const wranglerEnv of wranglerEnvs) {
-        for (const key of selectedKeys) {
-            const value = resolveValue(key, envMap);
-            if (value.trim() === '') {
-                failures.push({ wranglerEnv, key, reason: 'empty value' });
-                continue;
-            }
-            try {
-                if (!dryRun) {
-                    cmd.info(`putting ${key} -> ${wranglerEnv}...`);
-                    putSecret(wranglerEnv, key, value, configPath);
-                }
-                pushed += 1;
-                cmd.info(`${dryRun ? '[dry-run] ' : ''}put ${key} -> ${wranglerEnv}`);
-            }
-            catch (error) {
-                failures.push({ wranglerEnv, key, reason: getFailureReason(error) });
-            }
-        }
-    }
-    return { pushed, failures };
-};
 const execute = async (cmd, options) => {
     ensureCloudflareProvider(String(options.args?.[0] ?? 'cloudflare'));
     const cwd = process.cwd();
-    const config = readZintrustConfig(cwd);
-    const selectedKeys = resolveSelectedKeys(cmd, config, options);
-    const envFilePath = parseEnvPath(options);
-    const envMap = await EnvFile.read({ cwd, path: envFilePath });
-    const wranglerEnvs = resolveWranglerEnvs(options);
-    const dryRun = options.dryRun === true;
-    const configPath = typeof options.config === 'string' ? options.config.trim() : '';
-    if (configPath !== '' && !existsSync(path.join(cwd, configPath))) {
-        throw ErrorFactory.createCliError(`Wrangler config not found: ${configPath}`);
-    }
-    const result = processPut(cmd, wranglerEnvs, selectedKeys, envMap, dryRun, configPath === '' ? undefined : configPath);
-    reportResult(cmd, result.pushed, result.failures);
+    const result = await syncCloudflareSecrets({
+        log: cmd,
+        cwd,
+        wranglerEnvs: resolveWranglerEnvs(options),
+        envPath: parseEnvPath(options),
+        dryRun: options.dryRun === true,
+        configGroups: resolveConfigGroups(options),
+        configPath: typeof options.config === 'string' ? options.config.trim() : undefined,
+        target: typeof options.target === 'string' ? options.target : undefined,
+        requireSelection: true,
+    });
+    reportCloudflareSecretSync(cmd, result);
 };
 export const PutCommand = Object.freeze({
     create() {

package/src/cli/commands/StartCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"StartCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/StartCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAmhCvF,eAAO,MAAM,YAAY;cACb,YAAY;;mCAr9BU,MAAM,KAAG,OAAO;4CAaP,MAAM,KAAG,MAAM;4CA4Bf,MAAM,KAAG,OAAO;sCAetB,MAAM,WAAW,MAAM,KAAG,OAAO;oCAmBnC,MAAM,KAAG,OAAO;;EAq7BjD,CAAC"}
+{"version":3,"file":"StartCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/StartCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA6lCvF,eAAO,MAAM,YAAY;cACb,YAAY;;mCA3hCU,MAAM,KAAG,OAAO;4CAaP,MAAM,KAAG,MAAM;4CA4Bf,MAAM,KAAG,OAAO;sCAetB,MAAM,WAAW,MAAM,KAAG,OAAO;oCAmBnC,MAAM,KAAG,OAAO;;EA2/BjD,CAAC"}

package/src/cli/commands/StartCommand.js

@@ -1,4 +1,5 @@
 import { BaseCommand } from '../BaseCommand.js';
+import { readZintrustConfig, resolveCloudflareEnvKeys, } from '../cloudflare/CloudflareEnvTargetConfig.js';
 import { createDenoRunnerSource, createLambdaRunnerSource } from '../commands/runner/index.js';
 import { EnvFileLoader } from '../utils/EnvFileLoader.js';
 import { SpawnUtil } from '../utils/spawn.js';
@@ -336,11 +337,31 @@ const buildStartEnv = (projectRoot) => ({
     ...process.env,
     ZINTRUST_PROJECT_ROOT: projectRoot,
 });
-const buildWorkerDevVarsContent = () => {
+const WRANGLER_RUNTIME_ENV_KEYS = Object.freeze([
+    'APP_PORT',
+    'CLOUDFLARE_WORKER',
+    'DOCKER_WORKER',
+    'ENVIRONMENT',
+    'HOST',
+    'NODE_ENV',
+    'PORT',
+    'RUNTIME',
+    'SERVICE_DOMAIN',
+    'SERVICE_NAME',
+    'SERVICE_PORT',
+    'WORKER_ENABLED',
+    'ZINTRUST_PROJECT_ROOT',
+]);
+const buildWorkerDevVarsContent = (selectedKeys) => {
+    const allowedKeys = selectedKeys === undefined || selectedKeys.length === 0
+        ? undefined
+        : new Set([...WRANGLER_RUNTIME_ENV_KEYS, ...selectedKeys]);
     return (Object.entries(process.env)
         .filter((entry) => {
         const [key, value] = entry;
-        return isWranglerVarName(key) && typeof value === 'string';
+        return (isWranglerVarName(key) &&
+            typeof value === 'string' &&
+            (allowedKeys === undefined || allowedKeys.has(key)));
     })
         .map(([key, value]) => `${key}=${JSON.stringify(value)}`)
         .join('\n') + '\n');
@@ -357,7 +378,7 @@ const reconcileWranglerEnvBackup = (targetPath, backupPath) => {
     }
     unlinkSync(backupPath);
 };
-async function withWranglerEnvSnapshot(cwd, envName, fn) {
+async function withWranglerEnvSnapshot(cwd, envName, selectedKeys, fn) {
     const normalizedEnv = typeof envName === 'string' ? envName.trim() : '';
     const targetName = normalizedEnv === '' ? '.dev.vars' : `.dev.vars.${normalizedEnv}`;
     const targetPath = path.join(cwd, targetName);
@@ -372,7 +393,7 @@ async function withWranglerEnvSnapshot(cwd, envName, fn) {
         renameSync(targetPath, backupPath);
     }
     try {
-        writeFileSync(targetPath, buildWorkerDevVarsContent(), 'utf-8');
+        writeFileSync(targetPath, buildWorkerDevVarsContent(selectedKeys), 'utf-8');
         return await fn();
     }
     finally {
@@ -514,42 +535,64 @@ const resolveNodeProdCommand = (cwd) => {
     }
     return { command: 'node', args: [compiled] };
 };
-const executeWranglerStart = async (cmd, context, port, runtime, envName, wranglerConfig) => {
-    if (runtime !== undefined) {
-        throw ErrorFactory.createCliError('Error: --runtime is not supported with --wrangler (Wrangler controls Workers runtime).');
-    }
+const resolveWranglerDevConfig = (context, wranglerConfig) => {
     const normalizedConfig = typeof wranglerConfig === 'string' ? wranglerConfig.trim() : '';
     const explicitConfigFullPath = normalizedConfig.length > 0 ? path.join(context.cwd, normalizedConfig) : undefined;
     const configPath = explicitConfigFullPath ?? findWranglerConfig(context.cwd);
     const entry = resolveWranglerEntry(context.cwd);
-    if (explicitConfigFullPath !== undefined) {
-        if (existsSync(explicitConfigFullPath)) {
-            // ok
-        }
-        else {
-            throw ErrorFactory.createCliError(`Error: Wrangler config not found: ${normalizedConfig}`);
-        }
+    if (explicitConfigFullPath !== undefined && !existsSync(explicitConfigFullPath)) {
+        throw ErrorFactory.createCliError(`Error: Wrangler config not found: ${normalizedConfig}`);
     }
     if (configPath === undefined && entry === undefined) {
         throw ErrorFactory.createCliError("Error: wrangler config not found (wrangler.toml/json). Run 'wrangler init' first.");
     }
-    warnOnUnsafeWranglerBootstrap(cmd, context.cwd, entry);
+    return { normalizedConfig, configPath, entry };
+};
+const buildWranglerDevArgs = (args) => {
     const wranglerArgs = ['dev'];
-    if (normalizedConfig !== '') {
-        wranglerArgs.push('--config', normalizedConfig);
+    if (args.normalizedConfig !== '') {
+        wranglerArgs.push('--config', args.normalizedConfig);
     }
-    if (configPath === undefined && entry !== undefined) {
-        wranglerArgs.push(entry);
+    if (args.configPath === undefined && args.entry !== undefined) {
+        wranglerArgs.push(args.entry);
     }
-    if (typeof port === 'number') {
-        wranglerArgs.push('--port', String(port));
+    if (typeof args.port === 'number') {
+        wranglerArgs.push('--port', String(args.port));
     }
-    if (envName !== undefined && envName.trim() !== '') {
-        wranglerArgs.push('--env', envName.trim());
+    if (args.envName !== undefined && args.envName.trim() !== '') {
+        wranglerArgs.push('--env', args.envName.trim());
+    }
+    return wranglerArgs;
+};
+const resolveWranglerSelectedEnvKeys = (context, configPath, envName) => {
+    const zintrustConfigPath = path.join(context.projectRoot, '.zintrust.json');
+    if (!existsSync(zintrustConfigPath))
+        return undefined;
+    return resolveCloudflareEnvKeys({
+        config: readZintrustConfig(context.projectRoot),
+        projectRoot: context.projectRoot,
+        cwd: context.cwd,
+        ...(configPath === undefined ? {} : { configPath }),
+        ...(envName === undefined ? {} : { wranglerEnv: envName }),
+    });
+};
+const executeWranglerStart = async (cmd, context, port, runtime, envName, wranglerConfig) => {
+    if (runtime !== undefined) {
+        throw ErrorFactory.createCliError('Error: --runtime is not supported with --wrangler (Wrangler controls Workers runtime).');
     }
+    const { normalizedConfig, configPath, entry } = resolveWranglerDevConfig(context, wranglerConfig);
+    warnOnUnsafeWranglerBootstrap(cmd, context.cwd, entry);
+    const wranglerArgs = buildWranglerDevArgs({
+        normalizedConfig,
+        configPath,
+        entry,
+        port,
+        envName,
+    });
     logMySqlProxyHint(cmd);
     cmd.info('Starting in Wrangler dev mode...');
-    const exitCode = await withWranglerEnvSnapshot(context.cwd, envName, async () => {
+    const selectedEnvKeys = resolveWranglerSelectedEnvKeys(context, configPath, envName);
+    const exitCode = await withWranglerEnvSnapshot(context.cwd, envName, selectedEnvKeys, async () => {
         const startEnv = {
             ...buildStartEnv(context.projectRoot),
             WORKER_ENABLED: 'false',

package/src/cli/scaffolding/ProjectScaffolder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectScaffolder.d.ts","sourceRoot":"","sources":["../../../../src/cli/scaffolding/ProjectScaffolder.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAEpD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACtD,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,eAAe,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;IACpE,cAAc,IAAI,MAAM,CAAC;IACzB,sBAAsB,IAAI,OAAO,CAAC;IAClC,iBAAiB,IAAI,MAAM,CAAC;IAC5B,WAAW,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAAC;IACtD,gBAAgB,IAAI,OAAO,CAAC;IAC5B,aAAa,IAAI,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAC3E;AAodD,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAEhD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAsBrE;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG;IAChE,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAsBA;AA8ID;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,GAAE,MAAsB,GAAG,kBAAkB,CAsB/F;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC"}
+{"version":3,"file":"ProjectScaffolder.d.ts","sourceRoot":"","sources":["../../../../src/cli/scaffolding/ProjectScaffolder.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAEpD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACtD,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,eAAe,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;IACpE,cAAc,IAAI,MAAM,CAAC;IACzB,sBAAsB,IAAI,OAAO,CAAC;IAClC,iBAAiB,IAAI,MAAM,CAAC;IAC5B,WAAW,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAAC;IACtD,gBAAgB,IAAI,OAAO,CAAC;IAC5B,aAAa,IAAI,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAC3E;AA4eD,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAEhD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAsBrE;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG;IAChE,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAsBA;AA8ID;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,GAAE,MAAsB,GAAG,kBAAkB,CAsB/F;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC"}

package/src/cli/scaffolding/ProjectScaffolder.js

@@ -93,6 +93,30 @@ const createProjectConfigFile = (projectPath, variables) => {
             server: {
                 port: variables['port'] ?? 7777,
             },
+            cloudflare: {
+                shared_env: ['APP_KEY', 'JWT_SECRET', 'SESSION_SECRET'],
+                targets: {
+                    worker: [],
+                    'containers-proxy': [
+                        'MYSQL_PROXY_KEY_ID',
+                        'MYSQL_PROXY_SECRET',
+                        'POSTGRES_PROXY_KEY_ID',
+                        'POSTGRES_PROXY_SECRET',
+                        'REDIS_PROXY_KEY_ID',
+                        'REDIS_PROXY_SECRET',
+                        'MONGODB_PROXY_KEY_ID',
+                        'MONGODB_PROXY_SECRET',
+                        'SQLSERVER_PROXY_KEY_ID',
+                        'SQLSERVER_PROXY_SECRET',
+                        'SMTP_PROXY_KEY_ID',
+                        'SMTP_PROXY_SECRET',
+                    ],
+                },
+                wrangler_envs: {
+                    'd1-proxy': ['D1_REMOTE_KEY_ID', 'D1_REMOTE_SECRET'],
+                    'kv-proxy': ['KV_REMOTE_KEY_ID', 'KV_REMOTE_SECRET'],
+                },
+            },
         };
         fs.writeFileSync(fullPath, JSON.stringify(config, null, 2));
         return true;

package/src/cli/scaffolding/ServiceScaffolder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ServiceScaffolder.d.ts","sourceRoot":"","sources":["../../../../src/cli/scaffolding/ServiceScaffolder.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;IACjC,IAAI,CAAC,EAAE,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC7C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAaD;;GAEG;AAEH;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAuB7F;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,CAGnF;AAED;;GAEG;AAEH,wBAAgB,QAAQ,CACtB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,qBAAqB,CAAC,CAiDhC;AA+cD,eAAO,MAAM,iBAAiB;;;;EAI5B,CAAC"}
+{"version":3,"file":"ServiceScaffolder.d.ts","sourceRoot":"","sources":["../../../../src/cli/scaffolding/ServiceScaffolder.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;IACjC,IAAI,CAAC,EAAE,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC7C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAeD;;GAEG;AAEH;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAuB7F;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,CAGnF;AAED;;GAEG;AAEH,wBAAgB,QAAQ,CACtB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,qBAAqB,CAAC,CAkDhC;AA8eD,eAAO,MAAM,iBAAiB;;;;EAI5B,CAAC"}

package/src/cli/scaffolding/ServiceScaffolder.js

@@ -4,12 +4,14 @@
  */
 import { FileGenerator } from '../scaffolding/FileGenerator.js';
 import { Logger } from '../../config/logger.js';
+import { isArray, isObject } from '../../helper/index.js';
 import * as path from '../../node-singletons/path.js';
 const coreModuleSpecifier = ['@zintrust', 'core'].join('/');
 const coreStartModuleSpecifier = `${coreModuleSpecifier}/start`;
 const serviceManifestImportExpression = "import('./bootstrap/service-manifest.ts').catch(() => import('./bootstrap/service-manifest.js'))";
 const buildRouteImportExpression = (domain, serviceName) => `import('../services/${domain}/${serviceName}/routes/api.ts').catch(() => import('../services/${domain}/${serviceName}/routes/api.js'))`;
 const getServiceConfigRoot = (domain, serviceName) => `src/services/${domain}/${serviceName}/config`;
+const getServiceId = (domain, serviceName) => `${domain}/${serviceName}`;
 /**
  * ServiceScaffolder generates microservices with all necessary files
  */
@@ -74,6 +76,7 @@ export function scaffold(projectRoot, options) {
         ensureProjectRuntimeFiles(projectRoot, options);
         const filesCreated = createServiceFiles(servicePath, options);
         updateServiceManifest(projectRoot, options);
+        ensureCloudflareServiceTarget(projectRoot, options);
         return Promise.resolve({
             success: true,
             serviceName: options.name,
@@ -95,7 +98,7 @@ export function scaffold(projectRoot, options) {
 }
 function ensureProjectRuntimeFiles(projectRoot, options) {
     const domain = options.domain ?? 'default';
-    const serviceId = `${domain}/${options.name}`;
+    const serviceId = getServiceId(domain, options.name);
     const routeImportExpression = buildRouteImportExpression(domain, options.name);
     const bootstrapDir = path.join(projectRoot, 'src', 'bootstrap');
     FileGenerator.createDirectory(bootstrapDir);
@@ -138,7 +141,7 @@ export default Object.freeze({ serviceManifest });
 }
 function updateServiceManifest(projectRoot, options) {
     const domain = options.domain ?? 'default';
-    const serviceId = `${domain}/${options.name}`;
+    const serviceId = getServiceId(domain, options.name);
     const routeImportExpression = buildRouteImportExpression(domain, options.name);
     const manifestPath = path.join(projectRoot, 'src', 'bootstrap', 'service-manifest.ts');
     if (!FileGenerator.fileExists(manifestPath))
@@ -168,6 +171,33 @@ function updateServiceManifest(projectRoot, options) {
     const next = `${current.slice(0, markerIndex)}${entry}${current.slice(markerIndex)}`;
     FileGenerator.writeFile(manifestPath, next, { overwrite: true });
 }
+function ensureCloudflareServiceTarget(projectRoot, options) {
+    const configPath = path.join(projectRoot, '.zintrust.json');
+    if (!FileGenerator.fileExists(configPath))
+        return;
+    try {
+        const raw = FileGenerator.readFile(configPath);
+        const parsed = JSON.parse(raw);
+        if (!isObject(parsed))
+            return;
+        const config = { ...parsed };
+        const cloudflare = isObject(config['cloudflare']) ? { ...config['cloudflare'] } : {};
+        const targets = isObject(cloudflare['targets']) ? { ...cloudflare['targets'] } : {};
+        const domain = options.domain ?? 'default';
+        const serviceId = getServiceId(domain, options.name);
+        if (isArray(targets[serviceId]))
+            return;
+        targets[serviceId] = [];
+        cloudflare['targets'] = targets;
+        config['cloudflare'] = cloudflare;
+        FileGenerator.writeFile(`${configPath}`, `${JSON.stringify(config, null, 2)}\n`, {
+            overwrite: true,
+        });
+    }
+    catch (error) {
+        Logger.warn(`Unable to update .zintrust.json Cloudflare targets for ${options.domain ?? 'default'}/${options.name}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 /**
  * Create service directory structure
  */

package/src/index.js

@@ -1,11 +1,11 @@
 /**
- * @zintrust/core v0.4.39
+ * @zintrust/core v0.4.40
  *
  * ZinTrust Framework - Production-Grade TypeScript Backend
  * Built for performance, type safety, and exceptional developer experience
  *
  * Build Information:
- *   Built: 2026-03-30T20:09:19.868Z
+ *   Built: 2026-03-31T13:31:43.681Z
  *   Node: >=20.0.0
  *   License: MIT
  *
@@ -21,7 +21,7 @@
  * Available at runtime for debugging and health checks
  */
 export const ZINTRUST_VERSION = '0.1.41';
-export const ZINTRUST_BUILD_DATE = '2026-03-30T20:09:19.808Z'; // Replaced during build
+export const ZINTRUST_BUILD_DATE = '2026-03-31T13:31:43.643Z'; // Replaced during build
 export { Application } from './boot/Application.js';
 export { AwsSigV4 } from './common/index.js';
 export { SignedRequest } from './security/SignedRequest.js';