cajonzero 0.1.1 → 0.1.2

package/README.md

@@ -10,27 +10,27 @@ npm install cajonzero
 npx cj0 --help
 ```
 
-## 本地运行
+## 本地运行（本仓库）
 
 ```bash
 npm install
 npm run build     # 构建大厅与管理后台
-npm run demo      # 启动在 http://127.0.0.1:8787
+npm run demo      # http://127.0.0.1:8787
 ```
 
-打开页面，注册账号后选择地图即可进入房间。
-管理后台地址是 `/admin/login`，演示环境的令牌为 `cajonzero-demo-admin-token`。
+管理后台地址 `/admin/login`，演示令牌 `cajonzero-demo-admin-token`。
 
-## 创建自己的服务
+## 创建项目
 
 ```bash
-cj0 create my-server
+npx cj0 create my-server
 cd my-server
 npm install
-npm run dev       # 本地预览
+npx cj0 setup     # 交互配置 ENV：vars 写 wrangler.jsonc，密钥写 .dev.vars
+npm run dev
 ```
 
-部署前需要完成以下配置：
+## 部署
 
 ```bash
 npx wrangler kv namespace create CAJONZERO_KV     # 把返回的 id 填进 wrangler.jsonc
@@ -41,8 +41,8 @@ npm run deploy
 
 ## 配置地图
 
-地图文件需要单独上传，不随 worker 打包。把解包后的 `.boxplay` 目录上传到
-OSS/S3/CDN，然后在 `cajonzero/maps.json` 中登记：
+地图文件单独上传，不随 worker 打包。把解包后的 `.boxplay` 目录上传到
+OSS/S3/CDN（需允许 CORS），然后在 `cajonzero/maps.json` 中登记：
 
 ```json
 {
@@ -58,17 +58,15 @@ OSS/S3/CDN，然后在 `cajonzero/maps.json` 中登记：
 }
 ```
 
-地图文件由客户端和房间直接向 CDN 拉取，服务端不做缓存。
-更新地图后请刷新 CDN 缓存，或改用带版本的路径。
+`root` 必须以 `/` 结尾；更新地图后刷新 CDN 缓存或改用带版本的路径。
 房间参数、地图拉取策略等配置位于 `cajonzero/config.json`。
 
 ## 常用命令
 
 ```bash
-cj0 serve [--port <port>] [--host <host>]   # 本地启动
 cj0 create <folder>                         # 生成部署项目
+cj0 setup [--config <file>]                 # 交互配置必需/可选的 ENV
+cj0 serve [--port <port>] [--host <host>]   # 本地启动
 npm test                                    # 运行测试
 npm run ci:gates                            # 完整检查（类型/测试/构建）
 ```
-
-详细说明见 [`docs/`](./docs/)。

package/dist/bin/cj0.js

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
-import { mkdirSync, existsSync, statSync, writeFileSync, readdirSync, readFileSync } from 'fs';
-import path from 'path';
+import { mkdirSync, existsSync, readFileSync, writeFileSync, statSync, readdirSync } from 'fs';
+import path3 from 'path';
+import { createInterface } from 'readline/promises';
 import { fileURLToPath } from 'url';
+import { randomBytes } from 'crypto';
 
 // src/scaffold/templates.ts
 var SCAFFOLD_ENTRY_PATH = "src/index.ts";
@@ -51,7 +53,7 @@ var SCAFFOLD_ENTRY_CONTENT = [
   "    };",
   "  },",
   "});",
-  'export { Room } from "cajonzero";',
+  'export { Room } from "cajonzero/serve";',
   ""
 ].join("\n");
 var SCAFFOLD_CONFIG_CONTENT = `${JSON.stringify(
@@ -156,82 +158,49 @@ function readme(options) {
   return [
     `# ${options.packageName}`,
     "",
-    "A serverless (Cloudflare Workers) BOX3 **play** server, scaffolded by",
-    "[`cajonzero`](https://www.npmjs.com/package/cajonzero).",
+    "\u7531 cajonzero \u751F\u6210\u7684 Cloudflare Workers \u670D\u52A1\u3002\u9879\u76EE\u53EA\u6709\u914D\u7F6E\u548C\u4E00\u4E2A\u5F88\u8584\u7684 worker",
+    "\u5165\u53E3\uFF0C\u6CA1\u6709\u5F15\u64CE\u6E90\u7801\u3002",
     "",
-    "This project contains **no engine source code** \u2014 configuration plus a short",
-    "worker entry that hands `cajonzero/config.json` and `cajonzero/maps.json` to the",
-    "runtime:",
-    "",
-    "```ts",
-    'import config from "../cajonzero/config.json";',
-    'import maps from "../cajonzero/maps.json";',
-    'import { serve } from "cajonzero/serve";',
-    "",
-    "export default serve({",
-    "  config,",
-    "  maps,",
-    "  storage: (env) => /* any unstorage driver over env bindings */,",
-    "  sessionSecret: (env) => env.CAJONZERO_SESSION_SECRET,",
-    "  // adminToken / environment / rooms / settings \u2026",
-    "});",
-    'export { Room } from "cajonzero";',
-    "```",
-    "",
-    "## Quick start",
+    "## \u5FEB\u901F\u5F00\u59CB",
     "",
     "```bash",
-    "npm install     # also syncs cajonzero's prebuilt lobby/console into dist/ui",
-    "npm run dev     # wrangler dev \u2192 http://localhost:8787",
+    "npm install",
+    "npx cj0 setup   # \u4EA4\u4E92\u5F0F\u914D\u7F6E\u5FC5\u9700/\u53EF\u9009\u7684 ENV",
+    "npm run dev     # http://localhost:8787",
     "```",
     "",
-    "`npm run build` validates the deploy by bundling the worker without",
-    "publishing (`wrangler deploy --dry-run`).",
-    "",
-    "## Environment",
-    "",
-    "Every value the runtime consumes is passed explicitly in `src/index.ts`;",
-    "the package never guesses env var names.",
-    "",
-    "| Name | Kind | Required | Purpose |",
-    "|---|---|---|---|",
-    "| `CAJONZERO_KV` | KV binding | yes | player/account data + map-script KV |",
-    "| `ROOMS` | Durable Object binding | yes | room actors |",
-    "| `CAJONZERO_SESSION_SECRET` | secret | yes | signs session proofs and login cookies |",
-    "| `BOX_PLAY_ADMIN_TOKEN` | secret | yes | owner console and `/api/admin/*` |",
-    "| `CAJONZERO_ENV` | var | no | deployment label (`development` relaxes cookie `Secure`) |",
-    "| `CAJONZERO_PLAYER_LIMIT` | var | no | maximum players per room |",
-    "| `CAJONZERO_ZERO_PLAYER_TIMEOUT_MS` | var | no | empty-room grace window |",
-    "| `CAJONZERO_AUTOSAVE_INTERVAL_MS` | var | no | snapshot cadence |",
-    "| `CAJONZERO_DEBUG` | var | no | verbose logging |",
-    "| `CAJONZERO_TELEPORT_ACCESS` | var | no | allow non-team containers |",
-    "| `CAJONZERO_PAID_ACCESS` | var | no | restrict joins to paid containers |",
-    "| `CAJONZERO_SCRIPT_HEAP_MB` | var | no | QuickJS heap per script host |",
-    "| `CAJONZERO_SCRIPT_TIMEOUT_MS` | var | no | script invocation timeout |",
-    "| `CAJONZERO_DB_SIZE_LIMIT` | var | no | map-script storage budget |",
+    "## \u73AF\u5883\u53D8\u91CF",
     "",
-    "Create the namespace and set the secrets before deploying:",
+    "`cj0 setup` \u628A\u975E\u5BC6\u94A5\u5199\u5165 `wrangler.jsonc` \u7684 `vars`\uFF0C\u628A\u5BC6\u94A5\u5199\u5165 `.dev.vars`\uFF08\u672C\u5730\uFF09\u3002",
+    "\u90E8\u7F72\u65F6\u5BC6\u94A5\u8981\u5355\u72EC\u8BBE\u7F6E\uFF1A",
     "",
     "```bash",
-    "npx wrangler kv namespace create CAJONZERO_KV   # paste the id into wrangler.jsonc",
+    "npx wrangler kv namespace create CAJONZERO_KV   # id \u586B\u8FDB wrangler.jsonc",
     "npx wrangler secret put CAJONZERO_SESSION_SECRET",
     "npx wrangler secret put BOX_PLAY_ADMIN_TOKEN",
     "```",
     "",
-    "## Maps (object storage)",
-    "",
-    "Maps are **not** uploaded with the worker and are never unpacked at runtime.",
-    "Unpack the `.boxplay` yourself and upload the resulting directory to OSS/S3/CDN",
-    "with the archive layout preserved:",
+    "| \u540D\u79F0 | \u7C7B\u578B | \u5FC5\u9700 | \u8BF4\u660E |",
+    "|---|---|---|---|",
+    "| `CAJONZERO_KV` | KV \u7ED1\u5B9A | \u662F | \u8D26\u53F7/\u73A9\u5BB6\u6570\u636E + \u5730\u56FE\u811A\u672C KV |",
+    "| `ROOMS` | Durable Object \u7ED1\u5B9A | \u662F | \u623F\u95F4\u5B9E\u4F8B |",
+    "| `CAJONZERO_SESSION_SECRET` | \u5BC6\u94A5 | \u662F | \u4F1A\u8BDD\u51ED\u8BC1\u4E0E Cookie \u7B7E\u540D |",
+    "| `BOX_PLAY_ADMIN_TOKEN` | \u5BC6\u94A5 | \u662F | \u7BA1\u7406\u540E\u53F0\u4EE4\u724C |",
+    "| `CAJONZERO_ENV` | \u53D8\u91CF | \u5426 | \u90E8\u7F72\u540D\u79F0\uFF08`development` \u65F6 Cookie \u4E0D\u52A0 Secure\uFF09 |",
+    "| `CAJONZERO_PLAYER_LIMIT` | \u53D8\u91CF | \u5426 | \u5355\u623F\u95F4\u73A9\u5BB6\u4E0A\u9650 |",
+    "| `CAJONZERO_ZERO_PLAYER_TIMEOUT_MS` | \u53D8\u91CF | \u5426 | \u7A7A\u623F\u95F4\u4FDD\u7559\u65F6\u95F4 |",
+    "| `CAJONZERO_AUTOSAVE_INTERVAL_MS` | \u53D8\u91CF | \u5426 | \u81EA\u52A8\u5B58\u6863\u95F4\u9694 |",
+    "| `CAJONZERO_DEBUG` | \u53D8\u91CF | \u5426 | \u8C03\u8BD5\u65E5\u5FD7 |",
+    "| `CAJONZERO_TELEPORT_ACCESS` | \u53D8\u91CF | \u5426 | \u5141\u8BB8\u4F20\u9001\u7C7B\u5BB9\u5668 |",
+    "| `CAJONZERO_PAID_ACCESS` | \u53D8\u91CF | \u5426 | \u4EC5\u4ED8\u8D39\u5BB9\u5668\u53EF\u52A0\u5165 |",
+    "| `CAJONZERO_SCRIPT_HEAP_MB` | \u53D8\u91CF | \u5426 | \u811A\u672C\u5806\u4E0A\u9650 |",
+    "| `CAJONZERO_SCRIPT_TIMEOUT_MS` | \u53D8\u91CF | \u5426 | \u5355\u6B21\u811A\u672C\u8D85\u65F6 |",
+    "| `CAJONZERO_DB_SIZE_LIMIT` | \u53D8\u91CF | \u5426 | \u5730\u56FE\u811A\u672C\u5B58\u50A8\u4E0A\u9650 |",
     "",
-    "```text",
-    "<root>/bundle.json",
-    "<root>/worlds/<worldId>/manifest.json",
-    "<root>/worlds/<worldId>/data/project-state.json",
-    "<root>/worlds/<worldId>/data/blobs/<cid>",
-    "```",
+    "## \u5730\u56FE",
     "",
-    "Then add an entry to `cajonzero/maps.json`:",
+    "\u5730\u56FE\u4E0D\u968F worker \u4E0A\u4F20\u3002\u628A\u89E3\u5305\u540E\u7684 `.boxplay` \u76EE\u5F55\u4F20\u5230 OSS/S3/CDN\uFF08\u9700\u5141\u8BB8 CORS\uFF09\uFF0C",
+    "\u518D\u5728 `cajonzero/maps.json` \u767B\u8BB0\uFF1A",
     "",
     "```json",
     "{",
@@ -241,30 +210,21 @@ function readme(options) {
     '      "slug": "omega",',
     '      "root": "https://cdn.example.com/cajonzero/omega/",',
     '      "worldId": "project-omega",',
-    '      "name": "Omega City Reloaded",',
-    '      "version": "1.0.4"',
+    '      "name": "Omega City Reloaded"',
     "    }",
     "  ]",
     "}",
     "```",
     "",
-    "- `root` must be the unpacked map directory and end with `/`.",
-    "- The browser loads the map files directly, so the bucket must allow CORS",
-    "  (`Access-Control-Allow-Origin`) for this deployment's origin.",
-    "- Re-uploaded maps need a CDN cache refresh (or a versioned path).",
+    "`root` \u5FC5\u987B\u4EE5 `/` \u7ED3\u5C3E\uFF1B\u66F4\u65B0\u5730\u56FE\u540E\u5237\u65B0 CDN \u7F13\u5B58\u6216\u6362\u8DEF\u5F84\u3002",
     "",
-    "## Where things live",
-    "",
-    "- **Play lobby** \u2014 the worker serves the lobby at `/`.",
-    "- **Admin console** \u2014 at `/admin` (sign in with `BOX_PLAY_ADMIN_TOKEN`) for",
-    "  player bans and runtime settings; its JSON API is under `/api/admin/*`.",
-    "- **Map catalog** \u2014 `GET /api/maps` returns the entries from `maps.json`.",
-    "",
-    "## Deploy",
+    "## \u90E8\u7F72",
     "",
     "```bash",
-    "npm run deploy  # wrangler deploy",
+    "npm run deploy",
     "```",
+    "",
+    "\u5927\u5385\u5728 `/`\uFF0C\u7BA1\u7406\u540E\u53F0\u5728 `/admin`\u3002",
     ""
   ].join("\n");
 }
@@ -306,7 +266,7 @@ function readCajonzeroPackage(manifestPath) {
   return { version, wranglerRange, unstorageRange };
 }
 function toPackageName(folder) {
-  const base = path.basename(folder);
+  const base = path3.basename(folder);
   const slug = base.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[-._]+/, "").replace(/[-._]+$/, "");
   return slug.length > 0 ? slug : "cajonzero-app";
 }
@@ -321,7 +281,7 @@ function createProject(folder, options = {}) {
     throw new ScaffoldError("INVALID_TARGET", "create requires a target folder");
   }
   const cwd = options.cwd ?? process.cwd();
-  const target = path.resolve(cwd, name);
+  const target = path3.resolve(cwd, name);
   if (existsSync(target) && !statSync(target).isDirectory()) {
     throw new ScaffoldError("INVALID_TARGET", `target exists and is not a directory: ${target}`);
   }
@@ -344,12 +304,280 @@ function createProject(folder, options = {}) {
   });
   mkdirSync(target, { recursive: true });
   for (const file of files) {
-    const fullPath = path.join(target, file.path);
-    mkdirSync(path.dirname(fullPath), { recursive: true });
+    const fullPath = path3.join(target, file.path);
+    mkdirSync(path3.dirname(fullPath), { recursive: true });
     writeFileSync(fullPath, file.content, "utf8");
   }
   return { target, files: files.map((file) => file.path) };
 }
+var SETTING_FIELDS = [
+  {
+    name: "CAJONZERO_PLAYER_LIMIT",
+    label: "\u5355\u623F\u95F4\u73A9\u5BB6\u4E0A\u9650",
+    kind: "var",
+    required: false,
+    hint: "\u9ED8\u8BA4 100"
+  },
+  {
+    name: "CAJONZERO_ZERO_PLAYER_TIMEOUT_MS",
+    label: "\u7A7A\u623F\u95F4\u4FDD\u7559\u65F6\u95F4\uFF08\u6BEB\u79D2\uFF09",
+    kind: "var",
+    required: false,
+    hint: "\u9ED8\u8BA4 480000\uFF088 \u5206\u949F\uFF09"
+  },
+  {
+    name: "CAJONZERO_AUTOSAVE_INTERVAL_MS",
+    label: "\u81EA\u52A8\u5B58\u6863\u95F4\u9694\uFF08\u6BEB\u79D2\uFF09",
+    kind: "var",
+    required: false,
+    hint: "\u9ED8\u8BA4 300000"
+  },
+  {
+    name: "CAJONZERO_DEBUG",
+    label: "\u8C03\u8BD5\u65E5\u5FD7\uFF08true/false\uFF09",
+    kind: "var",
+    required: false,
+    hint: "\u9ED8\u8BA4 false"
+  },
+  {
+    name: "CAJONZERO_TELEPORT_ACCESS",
+    label: "\u5141\u8BB8\u4F20\u9001\u7C7B\u5BB9\u5668\uFF08true/false\uFF09",
+    kind: "var",
+    required: false,
+    hint: "\u9ED8\u8BA4 false"
+  },
+  {
+    name: "CAJONZERO_PAID_ACCESS",
+    label: "\u4EC5\u4ED8\u8D39\u5BB9\u5668\u53EF\u52A0\u5165\uFF08true/false\uFF09",
+    kind: "var",
+    required: false,
+    hint: "\u9ED8\u8BA4 false"
+  },
+  {
+    name: "CAJONZERO_SCRIPT_HEAP_MB",
+    label: "\u811A\u672C\u5806\u4E0A\u9650\uFF08MB\uFF09",
+    kind: "var",
+    required: false,
+    hint: "\u9ED8\u8BA4 256"
+  },
+  {
+    name: "CAJONZERO_SCRIPT_TIMEOUT_MS",
+    label: "\u5355\u6B21\u811A\u672C\u8D85\u65F6\uFF08\u6BEB\u79D2\uFF09",
+    kind: "var",
+    required: false,
+    hint: "\u9ED8\u8BA4 10000"
+  },
+  {
+    name: "CAJONZERO_DB_SIZE_LIMIT",
+    label: "\u5730\u56FE\u811A\u672C\u5B58\u50A8\u4E0A\u9650\uFF08\u5B57\u8282\uFF09",
+    kind: "var",
+    required: false,
+    hint: "\u9ED8\u8BA4 134217728"
+  }
+];
+var SETUP_FIELDS = [
+  {
+    name: "CAJONZERO_SESSION_SECRET",
+    label: "\u4F1A\u8BDD\u7B7E\u540D\u5BC6\u94A5",
+    kind: "secret",
+    required: true,
+    hint: "\u7559\u7A7A\u81EA\u52A8\u751F\u6210\uFF1B\u672C\u5730\u5199\u5165 .dev.vars"
+  },
+  {
+    name: "BOX_PLAY_ADMIN_TOKEN",
+    label: "\u7BA1\u7406\u540E\u53F0\u4EE4\u724C",
+    kind: "secret",
+    required: true,
+    hint: "\u7559\u7A7A\u81EA\u52A8\u751F\u6210\uFF1B\u672C\u5730\u5199\u5165 .dev.vars"
+  },
+  {
+    name: "CAJONZERO_ENV",
+    label: "\u90E8\u7F72\u540D\u79F0",
+    kind: "var",
+    required: true,
+    default: "development",
+    hint: "development \u65F6 Cookie \u4E0D\u52A0 Secure"
+  },
+  ...SETTING_FIELDS
+];
+function generateSecret() {
+  return randomBytes(32).toString("hex");
+}
+function generateAdminToken() {
+  return randomBytes(24).toString("base64url");
+}
+function suggestedValue(field) {
+  if (field.default !== void 0) return field.default;
+  if (field.kind === "secret") {
+    return field.name === "BOX_PLAY_ADMIN_TOKEN" ? generateAdminToken() : generateSecret();
+  }
+  return void 0;
+}
+function parseDevVars(text) {
+  const out = {};
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+function encodeDevVar(value) {
+  return /[\s#'"]/.test(value) ? `"${value.replace(/"/g, '\\"')}"` : value;
+}
+function serializeDevVars(values) {
+  const lines = Object.entries(values).map(([key, value]) => `${key}=${encodeDevVar(value)}`);
+  return `${lines.join("\n")}
+`;
+}
+function findVarsBlock(raw) {
+  const match = /"vars"\s*:\s*\{/.exec(raw);
+  if (match === null) return null;
+  const open = raw.indexOf("{", match.index);
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let i = open; i < raw.length; i += 1) {
+    const ch = raw[i];
+    if (inString) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === '"') inString = false;
+      continue;
+    }
+    if (ch === '"') inString = true;
+    else if (ch === "{") depth += 1;
+    else if (ch === "}") {
+      depth -= 1;
+      if (depth === 0) {
+        const lineStart = raw.lastIndexOf("\n", match.index) + 1;
+        const indent = /^\s*/.exec(raw.slice(lineStart, match.index))?.[0] ?? "  ";
+        return { start: match.index, open, close: i, indent };
+      }
+    }
+  }
+  return null;
+}
+function parseJsoncObject(text) {
+  let out = "";
+  let inString = false;
+  let escaped = false;
+  for (let i = 0; i < text.length; i += 1) {
+    const ch = text[i];
+    if (inString) {
+      out += ch;
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === '"') inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      out += ch;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i += 1;
+      out += "\n";
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i += 1;
+      i += 1;
+      continue;
+    }
+    out += ch;
+  }
+  out = out.replace(/,(\s*[}\]])/g, "$1");
+  try {
+    const parsed = JSON.parse(out);
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function setWranglerVars(raw, vars) {
+  const managed = new Set(SETUP_FIELDS.filter((f) => f.kind === "var").map((f) => f.name));
+  const block = findVarsBlock(raw);
+  const existing = block === null ? {} : parseJsoncObject(`{${raw.slice(block.open + 1, block.close)}}`);
+  const merged = {};
+  for (const [key, value] of Object.entries(existing)) {
+    if (!managed.has(key)) merged[key] = value;
+  }
+  for (const field of SETUP_FIELDS) {
+    if (field.kind !== "var") continue;
+    const value = vars[field.name];
+    if (value !== void 0 && value.length > 0) merged[field.name] = value;
+  }
+  const indent = block?.indent ?? "  ";
+  const inner = `${indent}  `;
+  const body = Object.entries(merged).map(([key, value]) => `${inner}${JSON.stringify(key)}: ${JSON.stringify(value)}`).join(",\n");
+  const bodyText = `"vars": {
+${body}${body.length > 0 ? "\n" : ""}${indent}}`;
+  if (block !== null) {
+    return `${raw.slice(0, block.start)}${bodyText}${raw.slice(block.close + 1)}`;
+  }
+  const open = raw.indexOf("{");
+  if (open < 0) throw new Error("wrangler config is not a JSON object");
+  return `${raw.slice(0, open + 1)}
+${indent}${bodyText},
+${raw.slice(open + 1)}`;
+}
+function readSetupValues(cwd, configPath, devVarsPath) {
+  const out = {};
+  if (existsSync(devVarsPath)) {
+    Object.assign(out, parseDevVars(readFileSync(devVarsPath, "utf8")));
+  }
+  if (existsSync(configPath)) {
+    const raw = readFileSync(configPath, "utf8");
+    const block = findVarsBlock(raw);
+    if (block !== null) {
+      const parsed = parseJsoncObject(`{${raw.slice(block.open + 1, block.close)}}`);
+      for (const [key, value] of Object.entries(parsed)) {
+        if (typeof value === "string") out[key] = value;
+      }
+    }
+  }
+  return out;
+}
+function applySetup(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const configPath = path3.resolve(cwd, options.configPath ?? "wrangler.jsonc");
+  const devVarsPath = path3.join(path3.dirname(configPath), ".dev.vars");
+  if (!existsSync(configPath)) {
+    throw new Error(`\u627E\u4E0D\u5230 ${path3.basename(configPath)}\uFF0C\u8BF7\u5728 cj0 create \u751F\u6210\u7684\u9879\u76EE\u76EE\u5F55\u4E2D\u8FD0\u884C`);
+  }
+  const vars = {};
+  const secrets = {};
+  for (const field of SETUP_FIELDS) {
+    const value = options.values[field.name]?.trim();
+    if (value === void 0 || value.length === 0) continue;
+    if (field.kind === "secret") secrets[field.name] = value;
+    else vars[field.name] = value;
+  }
+  const raw = readFileSync(configPath, "utf8");
+  const next = setWranglerVars(raw, vars);
+  if (next !== raw) writeFileSync(configPath, next, "utf8");
+  const existingDev = existsSync(devVarsPath) ? parseDevVars(readFileSync(devVarsPath, "utf8")) : {};
+  const managedSecrets = new Set(
+    SETUP_FIELDS.filter((f) => f.kind === "secret").map((f) => f.name)
+  );
+  const mergedDev = {};
+  for (const [key, value] of Object.entries(existingDev)) {
+    if (!managedSecrets.has(key)) mergedDev[key] = value;
+  }
+  Object.assign(mergedDev, secrets);
+  writeFileSync(devVarsPath, serializeDevVars(mergedDev), "utf8");
+  return { configPath, devVarsPath, vars, secrets };
+}
 
 // src/bin/cj0.ts
 var USAGE = `cj0 \u2014 serverless (Cloudflare) play-only BOX3 engine
@@ -359,6 +587,7 @@ Usage:
 
 Commands:
   create <folder>                         Scaffold a deployable project
+  setup [--config <file>]                 Configure required/optional ENV values
   serve [--port <port>] [--host <host>]   Run the cajonzero server locally (workerd)
 
 Serve options:
@@ -408,10 +637,94 @@ function runCreate(args) {
   process.stdout.write(
     `created project in ${result.target} (${result.files.length} files)
   ${result.files.join(", ")}
-  next: cd ${folder} && npm install && npm run dev
+  next: cd ${folder} && npm install && npx cj0 setup && npm run dev
 `
   );
 }
+function parseSetupFlags(args) {
+  let config = DEFAULT_CONFIG;
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === void 0) continue;
+    if (arg === "--config" || arg.startsWith("--config=")) {
+      config = readFlagValue(args, i, "--config");
+      if (!arg.includes("=")) i += 1;
+    } else {
+      throw new Error(`unexpected setup option "${arg}"`);
+    }
+  }
+  return { config };
+}
+async function runSetup(args) {
+  const { config } = parseSetupFlags(args);
+  const cwd = process.cwd();
+  const configPath = path3.resolve(cwd, config);
+  const devVarsPath = path3.join(path3.dirname(configPath), ".dev.vars");
+  const current = readSetupValues(cwd, configPath, devVarsPath);
+  if (!process.stdin.isTTY) {
+    const values2 = {};
+    for (const field of SETUP_FIELDS) {
+      if (!field.required) continue;
+      const value = current[field.name] ?? suggestedValue(field) ?? "";
+      if (value.length > 0) values2[field.name] = value;
+    }
+    const result2 = applySetup({ cwd, configPath: config, values: values2 });
+    process.stdout.write(
+      `cajonzero setup\uFF08\u975E\u4EA4\u4E92\uFF09\uFF1Avars=${Object.keys(result2.vars).join(", ") || "\u65E0"} secrets=${Object.keys(result2.secrets).join(", ") || "\u65E0"}
+`
+    );
+    return;
+  }
+  const values = {};
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    process.stdout.write("cajonzero setup \u2014 \u914D\u7F6E\u5FC5\u9700\u4E0E\u53EF\u9009\u7684 ENV\n\n");
+    for (const field of SETUP_FIELDS) {
+      if (!field.required) continue;
+      const existing = current[field.name];
+      const hint = field.kind === "secret" ? existing !== void 0 ? "\u5DF2\u914D\u7F6E\uFF0C\u56DE\u8F66\u4FDD\u7559" : "\u56DE\u8F66\u81EA\u52A8\u751F\u6210" : field.hint;
+      const label = `? ${field.label}\uFF08${field.name}\uFF09${hint !== void 0 ? ` [${hint}]` : ""}: `;
+      const answer = (await rl.question(label)).trim();
+      const value = answer.length > 0 ? answer : existing ?? suggestedValue(field) ?? "";
+      if (value.length > 0) values[field.name] = value;
+    }
+    const configureOptional = (await rl.question("? \u914D\u7F6E\u53EF\u9009\u8BBE\u7F6E\u9879\uFF1F(y/N): ")).trim().toLowerCase();
+    if (configureOptional === "y" || configureOptional === "yes") {
+      process.stdout.write("  \uFF08\u56DE\u8F66\u4FDD\u7559\u5F53\u524D\u503C\uFF0C\u8F93\u5165 - \u6E05\u9664\uFF09\n");
+      for (const field of SETUP_FIELDS) {
+        if (field.required) continue;
+        const existing = current[field.name];
+        const shown = existing ?? "";
+        const currentLabel = shown.length > 0 ? ` \u5F53\u524D ${shown}` : "";
+        const hint = field.hint !== void 0 ? ` [${field.hint}]` : "";
+        const answer = (await rl.question(`? ${field.label}\uFF08${field.name}\uFF09${hint}${currentLabel}: `)).trim();
+        if (answer === "-") continue;
+        const value = answer.length > 0 ? answer : shown;
+        if (value.length > 0) values[field.name] = value;
+      }
+    }
+  } finally {
+    rl.close();
+  }
+  const result = applySetup({ cwd, configPath: config, values });
+  const varNames = Object.keys(result.vars);
+  const secretNames = Object.keys(result.secrets);
+  process.stdout.write(`
+\u5DF2\u66F4\u65B0 ${path3.relative(cwd, result.configPath)}\uFF1A
+`);
+  process.stdout.write(`  vars: ${varNames.length > 0 ? varNames.join(", ") : "\uFF08\u65E0\uFF09"}
+`);
+  process.stdout.write(`\u5DF2\u5199\u5165 .dev.vars\uFF1A${secretNames.length > 0 ? secretNames.join(", ") : "\uFF08\u65E0\uFF09"}
+`);
+  process.stdout.write("\n\u672C\u5730\u5F00\u53D1\uFF1Anpm run dev\n");
+  if (secretNames.length > 0) {
+    process.stdout.write("\u90E8\u7F72\u524D\u8BBE\u7F6E Cloudflare secret\uFF1A\n");
+    for (const name of secretNames) {
+      process.stdout.write(`  npx wrangler secret put ${name}
+`);
+    }
+  }
+}
 function readFlagValue(args, index, flag) {
   const inline = args[index];
   if (inline !== void 0 && inline.startsWith(`${flag}=`)) {
@@ -460,8 +773,8 @@ async function runServe(args) {
   }
   const assetsDir = config.assets?.directory;
   if (typeof assetsDir === "string" && assetsDir.length > 0) {
-    const configDir = path.dirname(path.resolve(process.cwd(), flags.config));
-    mkdirSync(path.resolve(configDir, assetsDir), { recursive: true });
+    const configDir = path3.dirname(path3.resolve(process.cwd(), flags.config));
+    mkdirSync(path3.resolve(configDir, assetsDir), { recursive: true });
   }
   const secrets = localDevVars();
   const worker = await unstable_dev(entry, {
@@ -520,6 +833,9 @@ async function main(argv) {
       case "create":
         runCreate(rest);
         return;
+      case "setup":
+        await runSetup(rest);
+        return;
       default:
         process.stderr.write(`cajonzero: unknown command "${command}"
 

package/dist/{config-YtU8BYQM.d.ts → config-BOzAyP7m.d.ts}

@@ -1,4 +1,4 @@
-import { T as TimestampedClientInput, N as NetPublic, O as NetSecret } from './providers-Dh-umPQ6.js';
+import { T as TimestampedClientInput, N as NetPublic, O as NetSecret } from './providers-BX7e4pNW.js';
 
 /**
  * cajonzero — mudb protocol envelope (message-id tables + `raw` channel).