@zintrust/core 0.4.39 → 0.4.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zintrust/core",
-  "version": "0.4.39",
+  "version": "0.4.41",
   "description": "Production-grade TypeScript backend framework for JavaScript",
   "homepage": "https://zintrust.com",
   "repository": {
@@ -58,7 +58,7 @@
   },
   "dependencies": {
     "@cloudflare/containers": "^0.2.0",
-    "@zintrust/workers": "^0.4.39",
+    "@zintrust/workers": "^0.4.41",
     "bcryptjs": "^3.0.3",
     "bullmq": "^5.71.1",
     "chalk": "^5.6.2",

package/src/cli/cloudflare/CloudflareEnvTargetConfig.d.ts

@@ -0,0 +1,37 @@
+type ZintrustConfig = Record<string, unknown>;
+export interface CloudflareEnvTargetConfig {
+    sharedEnv: string[];
+    wranglerEnvs: Record<string, string[]>;
+    targets: Record<string, string[]>;
+}
+type ResolveTargetArgs = {
+    projectRoot: string;
+    cwd: string;
+    configPath?: string;
+};
+export declare const readZintrustConfig: (cwd: string) => ZintrustConfig;
+export declare const resolveCloudflareEnvTargetConfig: (config: ZintrustConfig) => CloudflareEnvTargetConfig;
+export declare const inferCloudflareTarget: ({ projectRoot, cwd, configPath, }: ResolveTargetArgs) => string;
+export declare const resolveCloudflareEnvKeys: (args: {
+    config: ZintrustConfig;
+    projectRoot: string;
+    cwd: string;
+    configPath?: string;
+    wranglerEnv?: string;
+    target?: string;
+}) => string[];
+declare const _default: Readonly<{
+    readZintrustConfig: (cwd: string) => ZintrustConfig;
+    resolveCloudflareEnvTargetConfig: (config: ZintrustConfig) => CloudflareEnvTargetConfig;
+    inferCloudflareTarget: ({ projectRoot, cwd, configPath, }: ResolveTargetArgs) => string;
+    resolveCloudflareEnvKeys: (args: {
+        config: ZintrustConfig;
+        projectRoot: string;
+        cwd: string;
+        configPath?: string;
+        wranglerEnv?: string;
+        target?: string;
+    }) => string[];
+}>;
+export default _default;
+//# sourceMappingURL=CloudflareEnvTargetConfig.d.ts.map

package/src/cli/cloudflare/CloudflareEnvTargetConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareEnvTargetConfig.d.ts","sourceRoot":"","sources":["../../../../src/cli/cloudflare/CloudflareEnvTargetConfig.ts"],"names":[],"mappings":"AAKA,KAAK,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE9C,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACnC;AAED,KAAK,iBAAiB,GAAG;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAkCF,eAAO,MAAM,kBAAkB,GAAI,KAAK,MAAM,KAAG,cAahD,CAAC;AAEF,eAAO,MAAM,gCAAgC,GAC3C,QAAQ,cAAc,KACrB,yBAQF,CAAC;AAqBF,eAAO,MAAM,qBAAqB,GAAI,mCAInC,iBAAiB,KAAG,MActB,CAAC;AAEF,eAAO,MAAM,wBAAwB,GAAI,MAAM;IAC7C,MAAM,EAAE,cAAc,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,KAAG,MAAM,EAiBT,CAAC;;8BA1FsC,MAAM,KAAG,cAAc;+CAgBrD,cAAc,KACrB,yBAAyB;+DAiCzB,iBAAiB,KAAG,MAAM;qCAgBkB;QAC7C,MAAM,EAAE,cAAc,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAG,MAAM,EAAE;;AAmBZ,wBAKG"}

package/src/cli/cloudflare/CloudflareEnvTargetConfig.js

@@ -0,0 +1,104 @@
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { isArray, isNonEmptyString, isObject } from '../../helper/index.js';
+import { existsSync, readFileSync } from '../../node-singletons/fs.js';
+import * as path from '../../node-singletons/path.js';
+const uniq = (items) => {
+    const seen = new Set();
+    const out = [];
+    for (const item of items) {
+        const normalized = item.trim();
+        if (normalized === '' || seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        out.push(normalized);
+    }
+    return out;
+};
+const toStringArray = (value) => {
+    if (!isArray(value))
+        return [];
+    return uniq(value.filter(isNonEmptyString).map((item) => item.trim()));
+};
+const toStringArrayRecord = (value) => {
+    if (!isObject(value))
+        return {};
+    return Object.fromEntries(Object.entries(value)
+        .filter(([key]) => isNonEmptyString(key))
+        .map(([key, entry]) => [key.trim(), toStringArray(entry)]));
+};
+const isAbsolutePath = (value) => value.startsWith('/') || /^[A-Za-z]:[\\/]/.test(value);
+export const readZintrustConfig = (cwd) => {
+    const filePath = path.join(cwd, '.zintrust.json');
+    if (!existsSync(filePath)) {
+        return {};
+    }
+    try {
+        const raw = readFileSync(filePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        return isObject(parsed) ? parsed : {};
+    }
+    catch (error) {
+        throw ErrorFactory.createCliError('Failed to parse .zintrust.json', error);
+    }
+};
+export const resolveCloudflareEnvTargetConfig = (config) => {
+    const raw = isObject(config['cloudflare']) ? config['cloudflare'] : {};
+    return Object.freeze({
+        sharedEnv: toStringArray(raw['shared_env']),
+        wranglerEnvs: toStringArrayRecord(raw['wrangler_envs']),
+        targets: toStringArrayRecord(raw['targets']),
+    });
+};
+const normalizeConfigPath = (cwd, configPath) => {
+    if (!isNonEmptyString(configPath))
+        return undefined;
+    return isAbsolutePath(configPath) ? configPath : path.join(cwd, configPath);
+};
+const inferServiceTarget = (projectRoot, candidateDir) => {
+    const servicesRoot = path.join(projectRoot, 'src', 'services');
+    const relative = path.relative(servicesRoot, candidateDir);
+    if (relative === '' || relative.startsWith('..'))
+        return undefined;
+    const segments = relative
+        .split(path.sep)
+        .map((segment) => segment.trim())
+        .filter((segment) => segment !== '');
+    if (segments.length < 2)
+        return undefined;
+    return `${segments[0]}/${segments[1]}`;
+};
+export const inferCloudflareTarget = ({ projectRoot, cwd, configPath, }) => {
+    const normalizedConfigPath = normalizeConfigPath(cwd, configPath);
+    const configBase = normalizedConfigPath === undefined ? '' : path.basename(normalizedConfigPath);
+    if (configBase.startsWith('wrangler.containers-proxy.')) {
+        return 'containers-proxy';
+    }
+    const candidateDir = normalizedConfigPath === undefined ? cwd : path.dirname(normalizedConfigPath);
+    const serviceTarget = inferServiceTarget(projectRoot, candidateDir);
+    if (serviceTarget !== undefined)
+        return serviceTarget;
+    return 'worker';
+};
+export const resolveCloudflareEnvKeys = (args) => {
+    const cloudflare = resolveCloudflareEnvTargetConfig(args.config);
+    const target = isNonEmptyString(args.target)
+        ? args.target.trim()
+        : inferCloudflareTarget({
+            projectRoot: args.projectRoot,
+            cwd: args.cwd,
+            configPath: args.configPath,
+        });
+    const wranglerEnv = isNonEmptyString(args.wranglerEnv) ? args.wranglerEnv.trim() : undefined;
+    return uniq([
+        ...cloudflare.sharedEnv,
+        ...(cloudflare.targets['default'] ?? []),
+        ...(cloudflare.targets[target] ?? []),
+        ...(wranglerEnv === undefined ? [] : (cloudflare.wranglerEnvs[wranglerEnv] ?? [])),
+    ]);
+};
+export default Object.freeze({
+    readZintrustConfig,
+    resolveCloudflareEnvTargetConfig,
+    inferCloudflareTarget,
+    resolveCloudflareEnvKeys,
+});

package/src/cli/cloudflare/CloudflareSecretSync.d.ts

@@ -0,0 +1,34 @@
+type CloudflareSecretLog = {
+    info: (message: string) => void;
+    warn: (message: string) => void;
+    success?: (message: string) => void;
+};
+export type CloudflareSecretSyncFailure = {
+    wranglerEnv: string;
+    key: string;
+    reason: string;
+};
+type CloudflareSecretSyncArgs = {
+    log: CloudflareSecretLog;
+    cwd: string;
+    wranglerEnvs: string[];
+    envPath: string;
+    dryRun?: boolean;
+    configGroups?: string[];
+    configPath?: string;
+    target?: string;
+    requireSelection?: boolean;
+};
+export type CloudflareSecretSyncResult = {
+    pushed: number;
+    failures: CloudflareSecretSyncFailure[];
+    selectedKeys: string[];
+};
+export declare const reportCloudflareSecretSync: (log: CloudflareSecretLog, result: Pick<CloudflareSecretSyncResult, "pushed" | "failures">) => void;
+export declare const syncCloudflareSecrets: ({ log, cwd, wranglerEnvs, envPath, dryRun, configGroups, configPath, target, requireSelection, }: CloudflareSecretSyncArgs) => Promise<CloudflareSecretSyncResult>;
+declare const _default: Readonly<{
+    syncCloudflareSecrets: ({ log, cwd, wranglerEnvs, envPath, dryRun, configGroups, configPath, target, requireSelection, }: CloudflareSecretSyncArgs) => Promise<CloudflareSecretSyncResult>;
+    reportCloudflareSecretSync: (log: CloudflareSecretLog, result: Pick<CloudflareSecretSyncResult, "pushed" | "failures">) => void;
+}>;
+export default _default;
+//# sourceMappingURL=CloudflareSecretSync.d.ts.map

package/src/cli/cloudflare/CloudflareSecretSync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareSecretSync.d.ts","sourceRoot":"","sources":["../../../../src/cli/cloudflare/CloudflareSecretSync.ts"],"names":[],"mappings":"AAYA,KAAK,mBAAmB,GAAG;IACzB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAaF,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,mBAAmB,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,2BAA2B,EAAE,CAAC;IACxC,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAiJF,eAAO,MAAM,0BAA0B,GACrC,KAAK,mBAAmB,EACxB,QAAQ,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,UAAU,CAAC,KAC9D,IAcF,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAU,kGAUzC,wBAAwB,KAAG,OAAO,CAAC,0BAA0B,CAqC/D,CAAC;;8HArCC,wBAAwB,KAAG,OAAO,CAAC,0BAA0B,CAAC;sCA5B1D,mBAAmB,UAChB,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,UAAU,CAAC,KAC9D,IAAI;;AAiEP,wBAGG"}

package/src/cli/cloudflare/CloudflareSecretSync.js

@@ -0,0 +1,147 @@
+import { readZintrustConfig, resolveCloudflareEnvKeys, } from '../cloudflare/CloudflareEnvTargetConfig.js';
+import { resolveNpmPath } from '../../common/index.js';
+import { appConfig } from '../../config/app.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { execFileSync } from '../../node-singletons/child-process.js';
+import { existsSync } from '../../node-singletons/fs.js';
+import * as path from '../../node-singletons/path.js';
+import { EnvFile } from '../../toolkit/Secrets/EnvFile.js';
+const uniq = (items) => {
+    const seen = new Set();
+    const out = [];
+    for (const item of items) {
+        const normalized = item.trim();
+        if (normalized === '' || seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        out.push(normalized);
+    }
+    return out;
+};
+const getConfigArray = (config, key) => {
+    const raw = config[key];
+    if (!Array.isArray(raw))
+        return [];
+    return uniq(raw.filter((item) => typeof item === 'string'));
+};
+const resolveValue = (key, envMap) => {
+    const fromFile = envMap[key];
+    const fromProcess = process.env[key];
+    return fromFile ?? fromProcess ?? '';
+};
+const getPutTimeoutMs = () => {
+    const raw = process.env['ZT_PUT_TIMEOUT_MS'];
+    if (typeof raw !== 'string')
+        return 120000;
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return 120000;
+    return parsed;
+};
+const putSecret = (wranglerEnv, key, value, configPath) => {
+    const npmPath = resolveNpmPath();
+    const args = ['exec', '--yes', '--', 'wrangler'];
+    if (typeof configPath === 'string' && configPath.trim() !== '') {
+        args.push('--config', configPath.trim());
+    }
+    args.push('secret', 'put', key, '--env', wranglerEnv);
+    execFileSync(npmPath, args, {
+        stdio: ['pipe', 'inherit', 'inherit'],
+        input: value,
+        encoding: 'utf8',
+        timeout: getPutTimeoutMs(),
+        killSignal: 'SIGTERM',
+        env: appConfig.getSafeEnv(),
+    });
+};
+const getFailureReason = (error) => error instanceof Error ? error.message : String(error);
+const resolveSelectedKeys = ({ log, config, cwd, wranglerEnvs, configGroups = [], configPath, target, requireSelection, }) => {
+    const explicitKeys = uniq(configGroups.flatMap((groupKey) => {
+        const keys = getConfigArray(config, groupKey);
+        if (keys.length === 0) {
+            log.warn(`Group \`${groupKey}\` is missing or empty in .zintrust.json`);
+        }
+        return keys;
+    }));
+    const manifestKeys = uniq(wranglerEnvs.flatMap((wranglerEnv) => resolveCloudflareEnvKeys({
+        config,
+        projectRoot: cwd,
+        cwd,
+        ...(configPath === undefined ? {} : { configPath }),
+        wranglerEnv,
+        ...(typeof target === 'string' && target.trim() !== '' ? { target: target.trim() } : {}),
+    })));
+    const selectedKeys = uniq([...explicitKeys, ...manifestKeys]);
+    if (selectedKeys.length > 0 || !requireSelection) {
+        return selectedKeys;
+    }
+    throw ErrorFactory.createCliError(configGroups.length === 0
+        ? 'No secret keys resolved from .zintrust.json cloudflare.shared_env/cloudflare.targets/cloudflare.wrangler_envs. Use --var <group> or add a Cloudflare env manifest.'
+        : 'No secret keys resolved from selected groups.');
+};
+const processSecretSync = (log, wranglerEnvs, selectedKeys, envMap, dryRun, configPath) => {
+    let pushed = 0;
+    const failures = [];
+    for (const wranglerEnv of wranglerEnvs) {
+        for (const key of selectedKeys) {
+            const value = resolveValue(key, envMap);
+            if (value.trim() === '') {
+                failures.push({ wranglerEnv, key, reason: 'empty value' });
+                continue;
+            }
+            try {
+                if (!dryRun) {
+                    log.info(`putting ${key} -> ${wranglerEnv}...`);
+                    putSecret(wranglerEnv, key, value, configPath);
+                }
+                pushed += 1;
+                log.info(`${dryRun ? '[dry-run] ' : ''}put ${key} -> ${wranglerEnv}`);
+            }
+            catch (error) {
+                failures.push({ wranglerEnv, key, reason: getFailureReason(error) });
+            }
+        }
+    }
+    return { pushed, failures };
+};
+export const reportCloudflareSecretSync = (log, result) => {
+    if (typeof log.success === 'function') {
+        log.success(`Cloudflare secrets report: pushed=${result.pushed}, failed=${result.failures.length}`);
+    }
+    else {
+        log.info(`Cloudflare secrets report: pushed=${result.pushed}, failed=${result.failures.length}`);
+    }
+    for (const item of result.failures) {
+        log.warn(`${item.key} -> ${item.wranglerEnv}: ${item.reason}`);
+    }
+};
+export const syncCloudflareSecrets = async ({ log, cwd, wranglerEnvs, envPath, dryRun = false, configGroups = [], configPath, target, requireSelection = true, }) => {
+    const normalizedConfigPath = typeof configPath === 'string' && configPath.trim() !== '' ? configPath.trim() : undefined;
+    if (normalizedConfigPath !== undefined && !existsSync(path.join(cwd, normalizedConfigPath))) {
+        throw ErrorFactory.createCliError(`Wrangler config not found: ${normalizedConfigPath}`);
+    }
+    const config = readZintrustConfig(cwd);
+    const selectedKeys = resolveSelectedKeys({
+        log,
+        config,
+        cwd,
+        wranglerEnvs,
+        configGroups,
+        configPath: normalizedConfigPath,
+        target,
+        requireSelection,
+    });
+    if (selectedKeys.length === 0) {
+        return { pushed: 0, failures: [], selectedKeys: [] };
+    }
+    const envMap = await EnvFile.read({ cwd, path: envPath });
+    const syncResult = processSecretSync(log, wranglerEnvs, selectedKeys, envMap, dryRun, normalizedConfigPath);
+    return {
+        ...syncResult,
+        selectedKeys,
+    };
+};
+export default Object.freeze({
+    syncCloudflareSecrets,
+    reportCloudflareSecretSync,
+});

package/src/cli/commands/DeployCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeployCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DeployCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAyIrE;;;GAGG;AACH,eAAO,MAAM,aAAa;IACxB;;OAEG;cACO,YAAY;EAGtB,CAAC"}
+{"version":3,"file":"DeployCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DeployCommand.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA0LrE;;;GAGG;AACH,eAAO,MAAM,aAAa;IACxB;;OAEG;cACO,YAAY;EAGtB,CAAC"}

package/src/cli/commands/DeployCommand.js

@@ -1,4 +1,5 @@
 import { BaseCommand } from '../BaseCommand.js';
+import { reportCloudflareSecretSync, syncCloudflareSecrets, } from '../cloudflare/CloudflareSecretSync.js';
 import { SpawnUtil } from '../utils/spawn.js';
 import { Logger } from '../../config/logger.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
@@ -44,7 +45,25 @@ const deployProxyStack = async (label) => {
     await runCompose(['compose', '-f', composePath, 'up', '-d', '--build']);
     Logger.info(`✅ ${label} deployed.`);
 };
-const runDeploy = async (target, options) => {
+const syncWranglerSecrets = async (cmd, cwd, wranglerEnv, options) => {
+    if (options.syncSecrets === false)
+        return;
+    const result = await syncCloudflareSecrets({
+        log: cmd,
+        cwd,
+        wranglerEnvs: [wranglerEnv],
+        envPath: typeof options.envPath === 'string' && options.envPath.trim() !== ''
+            ? options.envPath
+            : '.env',
+        configPath: typeof options.config === 'string' ? options.config.trim() : undefined,
+        target: typeof options.target === 'string' ? options.target : undefined,
+        requireSelection: false,
+    });
+    if (result.selectedKeys.length === 0)
+        return;
+    reportCloudflareSecretSync(cmd, result);
+};
+const runDeploy = async (cmd, target, options) => {
     const normalizedTarget = target.trim().toLowerCase();
     if (normalizedTarget === 'cw' || normalizedTarget === 'cwr') {
         const label = normalizedTarget === 'cwr'
@@ -70,6 +89,7 @@ const runDeploy = async (target, options) => {
         }
     }
     Logger.info(`Deploying to Cloudflare environment: ${environment}`);
+    await syncWranglerSecrets(cmd, process.cwd(), environment, options);
     const exitCode = await SpawnUtil.spawnAndWait({
         command: 'wrangler',
         args: ['deploy', ...(config.length > 0 ? ['--config', config] : []), '--env', environment],
@@ -79,7 +99,7 @@ const runDeploy = async (target, options) => {
     }
 };
 const createDeployCommand = () => {
-    return BaseCommand.create({
+    const cmd = BaseCommand.create({
         name: 'deploy',
         description: 'Deploy ZinTrust to Cloudflare Workers',
         addOptions: (command) => {
@@ -87,6 +107,9 @@ const createDeployCommand = () => {
                 .argument('[target]', 'Deployment target (worker, d1-proxy, kv-proxy, production, cw, cp)', 'worker')
                 .option('-e, --env <env>', 'Wrangler environment (overrides target)');
             command.option('-c, --config <path>', 'Wrangler config file (e.g. wrangler.containers-proxy.jsonc)');
+            command.option('--env-path <path>', 'Path to env file used when syncing Cloudflare secrets', '.env');
+            command.option('--target <id>', 'Cloudflare worker target key from .zintrust.json cloudflare.targets');
+            command.option('--no-sync-secrets', 'Skip Cloudflare secret sync before wrangler deploy');
         },
         execute: async (options) => {
             // Note: BaseCommand.create sets up action handler that calls execute(options).
@@ -103,9 +126,10 @@ const createDeployCommand = () => {
             //
             // So 'target' will be available in options.args[0]
             const target = options.args?.[0] ?? 'worker';
-            await runDeploy(target, options);
+            await runDeploy(cmd, target, options);
         },
     });
+    return cmd;
 };
 /**
  * Deploy Command Factory

package/src/cli/commands/DeployContainersProxyCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeployContainersProxyCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DeployContainersProxyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA2CrE,eAAO,MAAM,4BAA4B;cAC7B,YAAY;EAatB,CAAC"}
+{"version":3,"file":"DeployContainersProxyCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/DeployContainersProxyCommand.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA6ErE,eAAO,MAAM,4BAA4B;cAC7B,YAAY;EAyBtB,CAAC"}

package/src/cli/commands/DeployContainersProxyCommand.js

@@ -1,4 +1,5 @@
 import { BaseCommand } from '../BaseCommand.js';
+import { reportCloudflareSecretSync, syncCloudflareSecrets, } from '../cloudflare/CloudflareSecretSync.js';
 import { SpawnUtil } from '../utils/spawn.js';
 import { Logger } from '../../config/logger.js';
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
@@ -17,11 +18,30 @@ const resolveEnv = (raw) => {
     const normalized = typeof raw === 'string' ? raw.trim() : '';
     return normalized.length > 0 ? normalized : 'production';
 };
-const execute = async (options) => {
+const syncDeploySecrets = async (cmd, cwd, config, env, options) => {
+    if (options.syncSecrets === false)
+        return;
+    const result = await syncCloudflareSecrets({
+        log: cmd,
+        cwd,
+        wranglerEnvs: [env],
+        envPath: typeof options.envPath === 'string' && options.envPath.trim() !== ''
+            ? options.envPath
+            : '.env',
+        configPath: config,
+        target: typeof options.target === 'string' ? options.target : undefined,
+        requireSelection: false,
+    });
+    if (result.selectedKeys.length === 0)
+        return;
+    reportCloudflareSecretSync(cmd, result);
+};
+const execute = async (cmd, options) => {
     const cwd = process.cwd();
     const config = resolveConfig(cwd, options.config);
     const env = resolveEnv(options.env);
     Logger.info(`Deploying Containers proxy via Wrangler (env=${env})...`);
+    await syncDeploySecrets(cmd, cwd, config, env, options);
     const exitCode = await SpawnUtil.spawnAndWait({
         command: 'wrangler',
         args: ['deploy', '--config', config, '--env', env],
@@ -31,15 +51,19 @@ const execute = async (options) => {
 };
 export const DeployContainersProxyCommand = Object.freeze({
     create() {
-        return BaseCommand.create({
+        const cmd = BaseCommand.create({
             name: 'deploy:ccp',
             aliases: ['deploy:containers-proxy', 'deploy:cf-containers-proxy', 'd:ccp', 'ccp:deploy'],
             description: 'Deploy Cloudflare Containers proxy Worker (wrangler.containers-proxy.jsonc)',
             addOptions: (command) => {
                 command.option('-e, --env <name>', 'Wrangler environment name', 'production');
                 command.option('-c, --config <path>', 'Wrangler config file', DEFAULT_CONFIG);
+                command.option('--env-path <path>', 'Path to env file used when syncing Cloudflare secrets', '.env');
+                command.option('--target <id>', 'Cloudflare worker target key from .zintrust.json cloudflare.targets');
+                command.option('--no-sync-secrets', 'Skip Cloudflare secret sync before wrangler deploy');
             },
-            execute: async (options) => execute(options),
+            execute: async (options) => execute(cmd, options),
         });
+        return cmd;
     },
 });

package/src/cli/commands/ProxyScaffoldUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProxyScaffoldUtils.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/ProxyScaffoldUtils.ts"],"names":[],"mappings":"AAKA,KAAK,4BAA4B,GAAG;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,KAAK,2BAA2B,CAAC,OAAO,EAAE,QAAQ,IAAI;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,QAAQ,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC;IAC3E,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,0BAA0B,CAAC,OAAO,IAAI;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAIvE,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,GAAG,SAAS,EAAE,iBAA2B,KAAG,MAExF,CAAC;AAmBF,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,EAAE,KAAK,MAAM,KAAG,MAAM,GAAG,SAQvE,CAAC;AAmBF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,EAAE,SAAS,MAAM,EAAE,OAAO,MAAM,KAAG,MAuBhF,CAAC;AAEF,eAAO,MAAM,2BAA2B,GACtC,UAAU,MAAM,EAChB,mBAAmB,MAAM,KACxB,MAaF,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,SAAS,4BAA4B,KACpC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAoB3C,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAI,OAAO,EAAE,QAAQ,EACpD,SAAS,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,KACtD,0BAA0B,CAAC,OAAO,CAqBpC,CAAC"}
+{"version":3,"file":"ProxyScaffoldUtils.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/ProxyScaffoldUtils.ts"],"names":[],"mappings":"AAKA,KAAK,4BAA4B,GAAG;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,KAAK,2BAA2B,CAAC,OAAO,EAAE,QAAQ,IAAI;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,QAAQ,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC;IAC3E,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,0BAA0B,CAAC,OAAO,IAAI;IACzC,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAIvE,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,GAAG,SAAS,EAAE,iBAA2B,KAAG,MAExF,CAAC;AAmBF,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,EAAE,KAAK,MAAM,KAAG,MAAM,GAAG,SAQvE,CAAC;AAmBF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,EAAE,SAAS,MAAM,EAAE,OAAO,MAAM,KAAG,MAuBhF,CAAC;AAEF,eAAO,MAAM,2BAA2B,GACtC,UAAU,MAAM,EAChB,mBAAmB,MAAM,KACxB,MAaF,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,SAAS,4BAA4B,KACpC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAmB3C,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAI,OAAO,EAAE,QAAQ,EACpD,SAAS,2BAA2B,CAAC,OAAO,EAAE,QAAQ,CAAC,KACtD,0BAA0B,CAAC,OAAO,CAqBpC,CAAC"}

package/src/cli/commands/ProxyScaffoldUtils.js

@@ -1,7 +1,7 @@
 import { ErrorFactory } from '../../exceptions/ZintrustError.js';
 import { isNonEmptyString } from '../../helper/index.js';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from '../../node-singletons/fs.js';
-import { join } from '../../node-singletons/path.js';
+import { dirname, join } from '../../node-singletons/path.js';
 export const trimNonEmptyOption = (value) => {
     if (!isNonEmptyString(value))
         return undefined;
@@ -93,8 +93,7 @@ export const ensureProxyEntrypoint = (options) => {
     if (existsSync(entryFilePath)) {
         return { created: false, entryFilePath };
     }
-    const lastSlashIndex = entryFilePath.lastIndexOf('/');
-    const entryDir = lastSlashIndex > 0 ? entryFilePath.slice(0, lastSlashIndex) : options.cwd;
+    const entryDir = dirname(entryFilePath);
     mkdirSync(entryDir, { recursive: true });
     writeFileSync(entryFilePath, [
         `export { ${options.exportName} } from '${options.moduleSpecifier}';`,

package/src/cli/commands/PutCommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PutCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/PutCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AA0OvF,eAAO,MAAM,UAAU;cACX,YAAY;EAWtB,CAAC;AAEH,eAAe,UAAU,CAAC"}
+{"version":3,"file":"PutCommand.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/PutCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAqFvF,eAAO,MAAM,UAAU;cACX,YAAY;EAWtB,CAAC;AAEH,eAAe,UAAU,CAAC"}