playcademy 0.13.19 → 0.13.21

package/dist/index.js

@@ -117,7 +117,8 @@ async function loadFile(filename, options = {}) {
     required = false,
     searchUp = false,
     maxLevels = 3,
-    parseJson = false
+    parseJson = false,
+    stripComments = false
   } = options;
   let fileResult;
   if (searchUp) {
@@ -146,8 +147,11 @@ async function loadFile(filename, options = {}) {
     return null;
   }
   try {
-    const content = await readFile(fileResult.path, "utf-8");
+    let content = await readFile(fileResult.path, "utf-8");
     if (parseJson) {
+      if (stripComments) {
+        content = stripJsonComments(content);
+      }
       return JSON.parse(content);
     }
     return content;
@@ -212,6 +216,11 @@ function getCurrentDirectoryName(fallback = "unknown-directory") {
 function getFileExtension(path2) {
   return path2.split(".").pop()?.toLowerCase();
 }
+function stripJsonComments(jsonc) {
+  let result = jsonc.replace(/\/\*[\s\S]*?\*\//g, "");
+  result = result.replace(/\/\/.*/g, "");
+  return result;
+}
 async function loadModule(filename, options = {}) {
   const { cwd = process.cwd(), required = false, searchUp = false, maxLevels = 3 } = options;
   let fileResult;
@@ -2099,6 +2108,28 @@ var init_api = __esm({
   }
 });
 
+// src/constants/config.ts
+var ENV_FILES, TSCONFIG_FILES;
+var init_config = __esm({
+  "src/constants/config.ts"() {
+    "use strict";
+    ENV_FILES = [
+      ".env",
+      // Loaded first
+      ".env.development",
+      // Overrides .env
+      ".env.local"
+      // Overrides all (highest priority)
+    ];
+    TSCONFIG_FILES = [
+      "tsconfig.app.json",
+      // Modern tooling (try first)
+      "tsconfig.json"
+      // Standard (fallback)
+    ];
+  }
+});
+
 // src/constants/database.ts
 var init_database = __esm({
   "src/constants/database.ts"() {
@@ -2311,6 +2342,7 @@ var init_constants = __esm({
   "src/constants/index.ts"() {
     "use strict";
     init_api();
+    init_config();
     init_database();
     init_http_server();
     init_paths();
@@ -2364,6 +2396,7 @@ var init_context = __esm({
 // src/lib/core/logger.ts
 import {
   blue,
+  blueBright,
   bold as bold2,
   cyan,
   dim as dim2,
@@ -2376,8 +2409,10 @@ import {
 } from "colorette";
 import { colorize } from "json-colorizer";
 function customTransform(text5) {
-  const highlightCode = (text6) => text6.replace(/`([^`]+)`/g, (_, code) => greenBright(code));
-  return highlightCode(text5);
+  let result = text5;
+  result = result.replace(/`([^`]+)`/g, (_, code) => greenBright(code));
+  result = result.replace(/<([^>]+)>/g, (_, path2) => blueBright(path2));
+  return result;
 }
 function formatTable(data, title) {
   if (data.length === 0) return;
@@ -2545,6 +2580,10 @@ var init_logger = __esm({
         const spaces = "  ".repeat(indent);
         console.log(`${spaces}${text5}`);
       },
+      customRaw: (text5, indent = 0) => {
+        const spaces = "  ".repeat(indent);
+        console.log(`${spaces}${customTransform(text5)}`);
+      },
       /**
        * Display a configuration error with helpful suggestions
        */
@@ -2625,7 +2664,7 @@ function getProfileName() {
 function getWebBaseUrl(apiBaseUrl) {
   return apiBaseUrl.replace(/\/api\/?$/, "");
 }
-var init_config = __esm({
+var init_config2 = __esm({
   "src/lib/core/config.ts"() {
     "use strict";
     init_constants2();
@@ -2757,7 +2796,7 @@ var init_storage = __esm({
   "src/lib/auth/storage.ts"() {
     "use strict";
     init_constants2();
-    init_config();
+    init_config2();
   }
 });
 
@@ -3154,7 +3193,7 @@ var init_game = __esm({
     "use strict";
     init_src();
     init_slug();
-    init_config2();
+    init_config3();
   }
 });
 
@@ -3573,7 +3612,7 @@ __export(config_exports, {
   updateConfigFile: () => updateConfigFile,
   validateConfig: () => validateConfig
 });
-var init_config2 = __esm({
+var init_config3 = __esm({
   "src/lib/config/index.ts"() {
     "use strict";
     init_loader();
@@ -3617,7 +3656,7 @@ var init_client = __esm({
     "use strict";
     init_storage();
     init_logger();
-    init_config();
+    init_config2();
   }
 });
 
@@ -3715,7 +3754,7 @@ var init_core = __esm({
   "src/lib/core/index.ts"() {
     "use strict";
     init_client();
-    init_config();
+    init_config2();
     init_context();
     init_errors();
     init_game();
@@ -3751,7 +3790,7 @@ import { program } from "commander";
 
 // src/commands/init/index.ts
 import { execSync as execSync4 } from "child_process";
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync8 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync9 } from "fs";
 import { resolve as resolve10 } from "path";
 
 // ../../node_modules/@inquirer/core/dist/esm/lib/errors.js
@@ -4548,7 +4587,7 @@ function getCallbackUrl() {
 }
 
 // src/lib/index.ts
-init_config2();
+init_config3();
 init_core();
 
 // src/lib/db/path.ts
@@ -4639,8 +4678,8 @@ function resetDatabase() {
 init_src();
 init_constants2();
 init_core();
-import { existsSync as existsSync11 } from "node:fs";
-import { join as join13 } from "node:path";
+import { existsSync as existsSync13 } from "node:fs";
+import { join as join15 } from "node:path";
 
 // src/lib/init/bucket.ts
 function hasBucketSetup(config) {
@@ -4805,7 +4844,7 @@ var timebackChangeDetector = {
         return;
       }
       const currentConfig = await client.timeback.management.getConfig(gameId);
-      const { deriveTimebackConfig: deriveTimebackConfig2 } = await Promise.resolve().then(() => (init_config2(), config_exports));
+      const { deriveTimebackConfig: deriveTimebackConfig2 } = await Promise.resolve().then(() => (init_config3(), config_exports));
       const newConfig = await deriveTimebackConfig2(config);
       const changes = this.detectChanges(currentConfig, newConfig);
       if (changes.length > 0) {
@@ -4877,7 +4916,7 @@ import { existsSync as existsSync7 } from "fs";
 import { join as join8 } from "path";
 
 // ../edge-play/src/entry.ts
-var entry_default = "/**\n * Game Backend Entry Point\n *\n * This file is the main entry point for deployed game backends.\n * It creates a Hono app and registers all enabled integration routes.\n *\n * Bundled with esbuild and deployed to Cloudflare Workers (or AWS Lambda).\n * Config is injected at build time via esbuild's `define` option.\n */\n\nimport { Hono } from 'hono'\nimport { cors } from 'hono/cors'\n\nimport { PlaycademyClient } from '@playcademy/sdk/server'\n\nimport { ENV_VARS } from './constants'\nimport { registerBuiltinRoutes } from './register-routes'\n\nimport type { PlaycademyConfig } from '@playcademy/sdk/server'\nimport type { HonoEnv } from './types'\n\n/**\n * Config injected at build time by esbuild\n *\n * The `declare const` tells TypeScript \"this exists at runtime, trust me.\"\n * During bundling, esbuild's `define` option does literal text replacement:\n *\n * Example bundling:\n *   Source:  if (PLAYCADEMY_CONFIG.integrations.timeback) { ... }\n *   Define:  { 'PLAYCADEMY_CONFIG': JSON.stringify({ integrations: { timeback: {...} } }) }\n *   Output:  if ({\"integrations\":{\"timeback\":{...}}}.integrations.timeback) { ... }\n *\n * This enables tree-shaking: if timeback is not configured, those code paths are removed.\n * The bundled Worker only includes the routes that are actually enabled.\n */\ndeclare const PLAYCADEMY_CONFIG: PlaycademyConfig & {\n    customRoutes?: Array<{ path: string; file: string }>\n}\n\n// XXX: Polyfill process global for SDK compatibility\n// SDK code may reference process.env without importing it\n// @ts-expect-error - Adding global for Worker environment\nglobalThis.process = {\n    env: {}, // Populated per-request from Worker env bindings\n    cwd: () => '/',\n}\n\nconst app = new Hono<HonoEnv>()\n\n// TODO: Harden CORS in production - restrict to trusted origins:\n// - Game's assetBundleBase (for hosted games)\n// - Game's externalUrl (for external games)\n// - Platform frontend domains (hub.playcademy.com, hub.dev.playcademy.net)\n// This would require passing game metadata through env bindings during deployment\napp.use(\n    '*',\n    cors({\n        origin: '*', // Permissive for now\n        allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],\n        allowHeaders: ['Content-Type', 'Authorization'],\n    }),\n)\n\nlet sdkPromise: Promise<PlaycademyClient> | null = null\n\napp.use('*', async (c, next) => {\n    // Populate process.env from Worker bindings for SDK compatibility\n    globalThis.process.env = {\n        [ENV_VARS.PLAYCADEMY_API_KEY]: c.env.PLAYCADEMY_API_KEY,\n        [ENV_VARS.GAME_ID]: c.env.GAME_ID,\n        [ENV_VARS.PLAYCADEMY_BASE_URL]: c.env.PLAYCADEMY_BASE_URL,\n    }\n\n    // Set config for all routes\n    c.set('config', PLAYCADEMY_CONFIG)\n    c.set('customRoutes', PLAYCADEMY_CONFIG.customRoutes || [])\n\n    await next()\n})\n\n// Initialize SDK lazily on first request\napp.use('*', async (c, next) => {\n    if (!sdkPromise) {\n        sdkPromise = PlaycademyClient.init({\n            apiKey: c.env[ENV_VARS.PLAYCADEMY_API_KEY],\n            gameId: c.env[ENV_VARS.GAME_ID],\n            baseUrl: c.env[ENV_VARS.PLAYCADEMY_BASE_URL],\n            config: PLAYCADEMY_CONFIG,\n        })\n    }\n\n    c.set('sdk', await sdkPromise)\n    await next()\n})\n\n/**\n * Register built-in integration routes based on enabled integrations\n *\n * This function conditionally imports and registers routes like:\n * - POST /api/integrations/timeback/end-activity (if timeback enabled)\n * - GET /api/health (always included)\n *\n * Uses dynamic imports for tree-shaking: if an integration is not enabled,\n * its route code is completely removed from the bundle.\n */\nawait registerBuiltinRoutes(app, PLAYCADEMY_CONFIG.integrations)\n\nexport default app\n";
+var entry_default = "/**\n * Game Backend Entry Point\n *\n * This file is the main entry point for deployed game backends.\n * It creates a Hono app and registers all enabled integration routes.\n *\n * Bundled with esbuild and deployed to Cloudflare Workers (or AWS Lambda).\n * Config is injected at build time via esbuild's `define` option.\n */\n\nimport { Hono } from 'hono'\n\nimport { registerCors, registerEnvSetup, registerSdkInit } from './entry/middleware'\nimport { setupProcessGlobal } from './entry/setup'\nimport { registerBuiltinRoutes } from './register-routes'\n\nimport type { RuntimeConfig } from './entry/types'\nimport type { HonoEnv } from './types'\n\n/**\n * Config injected at build time by esbuild\n *\n * The `declare const` tells TypeScript \"this exists at runtime, trust me.\"\n * During bundling, esbuild's `define` option does literal text replacement:\n *\n * Example bundling:\n *   Source:  if (PLAYCADEMY_CONFIG.integrations.timeback) { ... }\n *   Define:  { 'PLAYCADEMY_CONFIG': JSON.stringify({ integrations: { timeback: {...} } }) }\n *   Output:  if ({\"integrations\":{\"timeback\":{...}}}.integrations.timeback) { ... }\n *\n * This enables tree-shaking: if timeback is not configured, those code paths are removed.\n * The bundled Worker only includes the routes that are actually enabled.\n */\ndeclare const PLAYCADEMY_CONFIG: RuntimeConfig\n\n// Setup process global polyfill for SDK compatibility\nsetupProcessGlobal()\n\n// Create Hono app\nconst app = new Hono<HonoEnv>()\n\n// Register middleware\nregisterCors(app)\nregisterEnvSetup(app, PLAYCADEMY_CONFIG)\nregisterSdkInit(app, PLAYCADEMY_CONFIG)\n\n// Register built-in integration routes based on enabled integrations\n// This function conditionally imports and registers routes like:\n// - GET /api (always included)\n// - GET /api/health (always included)\n// - POST /api/integrations/timeback/end-activity (if timeback enabled)\n//\n// Uses dynamic imports for tree-shaking: if an integration is not enabled,\n// its route code is completely removed from the bundle.\nawait registerBuiltinRoutes(app, PLAYCADEMY_CONFIG.integrations)\n\nexport default app\n";
 
 // ../utils/src/path.ts
 import fs from "node:fs";
@@ -5219,6 +5258,7 @@ function filePathToRoutePath(filePath) {
     routePath = routePath.replace(/\/?index$/, "");
   }
   let urlPath = "/" + routePath.replace(/\\/g, "/");
+  urlPath = urlPath.replace(/\[\.\.\.([^\]]+)\]/g, ":$1{.*}");
   urlPath = urlPath.replace(/\[([^\]]+)\]/g, ":$1");
   urlPath = urlPath === "/" ? "/api" : `/api${urlPath}`;
   return urlPath;
@@ -5380,7 +5420,7 @@ async function bundleBackend(config, options = {}) {
   const { customRouteData, customRoutesDir } = await discoverCustomRoutes(config);
   const bundleConfig = {
     ...config,
-    customRoutes: customRouteData
+    __routeMetadata: customRouteData
   };
   const entryCode = generateEntryCode(customRouteData, customRoutesDir);
   const paths = resolveEmbeddedSourcePaths();
@@ -5429,9 +5469,9 @@ function generateEntryCode(customRoutes, customRoutesDir) {
 
 // src/lib/deploy/schema.ts
 init_core();
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { createRequire } from "module";
-import { join as join12 } from "path";
+import { join as join14 } from "path";
 
 // src/lib/init/prompts.ts
 init_constants3();
@@ -5670,7 +5710,6 @@ async function selectConfigFormat(hasPackageJson2) {
 init_package_manager();
 init_context();
 init_logger();
-import { blueBright } from "colorette";
 function displayConfigSuccess(timebackConfig) {
   logger.success("Playcademy configuration created successfully!");
   logger.newLine();
@@ -5698,9 +5737,9 @@ function displaySuccessMessage(context2) {
   logger.newLine();
   const nextSteps = [];
   const pm = getPackageManager();
-  nextSteps.push(`1. Review your config file: ${blueBright(context2.configFileName)}`);
+  nextSteps.push(`1. Review your config file: <${context2.configFileName}>`);
   if (context2.hasDatabase) {
-    nextSteps.push(`3. Review schema: ${blueBright(`db/schema/index.ts`)}`);
+    nextSteps.push(`3. Review schema: <db/schema/index.ts>`);
     nextSteps.push("4. Start dev server: `playcademy dev`");
     nextSteps.push(`5. Push your schema: \`${getRunCommand(pm, "db:push")}\``);
   }
@@ -5712,7 +5751,7 @@ function displaySuccessMessage(context2) {
   }
   if (context2.apiDirectory) {
     const stepNum = context2.hasDatabase ? "7" : "3";
-    nextSteps.push(`${stepNum}. Customize API routes: ${blueBright(`${context2.apiDirectory}`)}`);
+    nextSteps.push(`${stepNum}. Customize API routes: <${context2.apiDirectory}>`);
   }
   if (context2.timebackConfig) {
     const stepNum = nextSteps.length + 1;
@@ -5727,61 +5766,256 @@ function displaySuccessMessage(context2) {
 // src/lib/init/types.ts
 init_file_loader();
 init_package_manager();
+init_string();
 init_constants2();
 init_loader();
 init_core();
-init_loader2();
 import { execSync as execSync3 } from "child_process";
-import { writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname4, join as join10 } from "path";
+import { writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname4, join as join12 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
+
+// src/lib/secrets/env.ts
+init_file_loader();
+init_constants2();
+import { existsSync as existsSync9 } from "fs";
+import { join as join10 } from "path";
+function parseEnvFile(contents) {
+  const secrets = {};
+  for (const line of contents.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    const match = trimmed.match(/^([A-Z_][A-Z0-9_]*)=(.*)$/);
+    if (match) {
+      const [, key, value] = match;
+      if (!key || !value) {
+        continue;
+      }
+      const unquoted = value.replace(/^["']|["']$/g, "");
+      secrets[key] = unquoted;
+    }
+  }
+  return secrets;
+}
+async function readEnvFile(workspace) {
+  let secrets = {};
+  for (const filename of ENV_FILES) {
+    try {
+      const contents = await loadFile(filename, { cwd: workspace, searchUp: false });
+      if (contents) {
+        const fileSecrets = parseEnvFile(contents);
+        secrets = { ...secrets, ...fileSecrets };
+      }
+    } catch {
+      continue;
+    }
+  }
+  return secrets;
+}
+function getLoadedEnvFiles(workspace) {
+  return ENV_FILES.filter((filename) => existsSync9(join10(workspace, filename)));
+}
+function hasEnvFile(workspace) {
+  return ENV_FILES.some((filename) => existsSync9(join10(workspace, filename)));
+}
+
+// src/lib/init/types.ts
+init_loader2();
+
+// src/lib/init/tsconfig.ts
+init_file_loader();
+init_constants2();
+import { existsSync as existsSync10, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join11 } from "path";
+function hasPlaycademyEnv(config) {
+  return config.include?.includes("playcademy-env.d.ts") ?? false;
+}
+function addPlaycademyEnv(config) {
+  if (!config.include) {
+    config.include = [];
+  }
+  config.include.push("playcademy-env.d.ts");
+}
+function updateExistingIncludeArray(content) {
+  const includeRegex = /"include"\s*:\s*\[([^\]]*)\]/;
+  const match = content.match(includeRegex);
+  if (!match || !match[1]) {
+    return null;
+  }
+  const fullMatch = match[0];
+  const arrayContents = match[1];
+  if (arrayContents.includes("playcademy-env.d.ts")) {
+    return content;
+  }
+  const trimmedContents = arrayContents.trim();
+  const newEntry = '"playcademy-env.d.ts"';
+  let newArrayContents;
+  if (trimmedContents === "") {
+    newArrayContents = newEntry;
+  } else if (arrayContents.includes("\n")) {
+    newArrayContents = `${arrayContents},
+        ${newEntry}
+    `;
+  } else {
+    newArrayContents = `${trimmedContents}, ${newEntry}`;
+  }
+  const newIncludeArray = `"include": [${newArrayContents}]`;
+  return content.replace(fullMatch, newIncludeArray);
+}
+function addNewIncludeProperty(content) {
+  const closingBraceMatch = content.match(/\n(\s*)\}(\s*)$/);
+  if (!closingBraceMatch || closingBraceMatch.index === void 0) {
+    return null;
+  }
+  const propertyMatch = content.match(/\n(\s+)"/);
+  const propertyIndent = propertyMatch ? propertyMatch[1] : "    ";
+  const insertPosition = closingBraceMatch.index;
+  const beforeClosing = content.slice(0, insertPosition).trim();
+  const needsComma = beforeClosing.endsWith("]") || beforeClosing.endsWith("}") || beforeClosing.endsWith('"');
+  const comma = needsComma ? "," : "";
+  const includeEntry = `${comma}
+${propertyIndent}"include": ["playcademy-env.d.ts"]`;
+  const updatedContent = content.slice(0, insertPosition) + includeEntry + content.slice(insertPosition);
+  return updatedContent;
+}
+function addToIncludeArrayPreservingComments(content) {
+  return updateExistingIncludeArray(content) || addNewIncludeProperty(content);
+}
+async function ensureTsconfigIncludes(workspace) {
+  for (const filename of TSCONFIG_FILES) {
+    const configPath = join11(workspace, filename);
+    if (!existsSync10(configPath)) {
+      continue;
+    }
+    try {
+      const config = await loadFile(configPath, {
+        parseJson: true,
+        stripComments: true
+      });
+      if (!config) continue;
+      if (config.references && filename !== "tsconfig.json") {
+        continue;
+      }
+      if (hasPlaycademyEnv(config)) {
+        return filename;
+      }
+      try {
+        const rawContent = readFileSync4(configPath, "utf-8");
+        const updatedContent = addToIncludeArrayPreservingComments(rawContent);
+        if (updatedContent && updatedContent !== rawContent) {
+          writeFileSync4(configPath, updatedContent);
+          return filename;
+        }
+      } catch {
+      }
+      addPlaycademyEnv(config);
+      writeFileSync4(configPath, JSON.stringify(config, null, 4) + "\n");
+      return filename;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
+// src/lib/init/types.ts
 var playcademyEnvTemplate = loadTemplateString("playcademy-env.d.ts");
-async function ensurePlaycademyTypes() {
+function detectBackendFeatures(workspace, config) {
+  return {
+    hasDB: hasDatabaseSetup(),
+    hasKV: hasKVSetup(config),
+    hasBucket: hasBucketSetup(config),
+    hasRoutes: hasLocalCustomRoutes(workspace, config),
+    hasSecrets: hasEnvFile(workspace)
+  };
+}
+function hasAnyBackend(features) {
+  return Object.values(features).some(Boolean);
+}
+async function setupPlaycademyDependencies(workspace) {
+  const playcademyDir = join12(workspace, CLI_DIRECTORIES.WORKSPACE);
+  const playcademyPkgPath = join12(playcademyDir, "package.json");
+  const __dirname2 = dirname4(fileURLToPath2(import.meta.url));
+  const cliPkg = await loadPackageJson({ cwd: __dirname2, searchUp: true, required: true });
+  const workersTypesVersion = cliPkg?.devDependencies?.["@cloudflare/workers-types"] || "latest";
+  const honoVersion = cliPkg?.dependencies?.hono || "latest";
+  const playcademyPkg = {
+    private: true,
+    dependencies: { hono: honoVersion },
+    devDependencies: { "@cloudflare/workers-types": workersTypesVersion }
+  };
+  writeFileSync5(playcademyPkgPath, JSON.stringify(playcademyPkg, null, 4) + "\n");
+  const pm = detectPackageManager(workspace);
+  const installCmd = getInstallCommand(pm);
+  execSync3(installCmd, {
+    cwd: playcademyDir,
+    stdio: ["ignore", "ignore", "ignore"]
+  });
+}
+function generateBindingsTypeString(features) {
+  const bindings = [];
+  if (features.hasKV) bindings.push("        KV: KVNamespace");
+  if (features.hasDB) bindings.push("        DB: D1Database");
+  if (features.hasBucket) bindings.push("        BUCKET: R2Bucket");
+  return bindings.length > 0 ? "\n" + bindings.join("\n") : "";
+}
+async function generateSecretsTypeString(workspace, verbose = false) {
+  try {
+    const envSecrets = await readEnvFile(workspace);
+    const secretKeys = Object.keys(envSecrets);
+    if (secretKeys.length === 0) {
+      if (verbose) logger.success("No secrets in <.env> files");
+      return "\n        secrets: Record<string, string>";
+    }
+    if (verbose) {
+      const loadedFiles = getLoadedEnvFiles(workspace);
+      const fileList = loadedFiles.map((f) => `<${f}>`).join(", ");
+      logger.success(
+        `Loaded ${secretKeys.length} ${pluralize(secretKeys.length, "secret")} from ${fileList}`
+      );
+    }
+    const secretTypes = secretKeys.map((key) => `            ${key}: string`).join("\n");
+    return `
+        secrets: {
+${secretTypes}
+            [key: string]: string
+        }`;
+  } catch {
+    return "\n        secrets: Record<string, string>";
+  }
+}
+async function ensurePlaycademyTypes(options = {}) {
+  const { verbose = false } = options;
   try {
     const workspace = getWorkspace();
     const config = await loadConfig();
-    const hasDB = hasDatabaseSetup();
-    const hasKV = hasKVSetup(config);
-    const hasBucket = hasBucketSetup(config);
-    if (!hasDB && !hasKV && !hasBucket) {
+    const features = detectBackendFeatures(workspace, config);
+    if (!hasAnyBackend(features)) {
+      if (verbose) {
+        logger.dim("No backend functionality detected");
+      }
       return;
     }
-    const playcademyDir = join10(workspace, CLI_DIRECTORIES.WORKSPACE);
-    const playcademyPkgPath = join10(playcademyDir, "package.json");
-    const __dirname2 = dirname4(fileURLToPath2(import.meta.url));
-    const cliPkg = await loadPackageJson({ cwd: __dirname2, searchUp: true, required: true });
-    const workersTypesVersion = cliPkg?.devDependencies?.["@cloudflare/workers-types"] || "latest";
-    const honoVersion = cliPkg?.dependencies?.hono || "latest";
-    const playcademyPkg = {
-      private: true,
-      dependencies: {
-        hono: honoVersion
-      },
-      devDependencies: {
-        "@cloudflare/workers-types": workersTypesVersion
-      }
-    };
-    writeFileSync4(playcademyPkgPath, JSON.stringify(playcademyPkg, null, 4) + "\n");
-    const pm = detectPackageManager(workspace);
-    const installCmd = getInstallCommand(pm);
-    execSync3(installCmd, {
-      cwd: playcademyDir,
-      stdio: ["ignore", "ignore", "ignore"]
-    });
-    const bindings = [];
-    if (hasKV) {
-      bindings.push("        KV: KVNamespace");
+    await setupPlaycademyDependencies(workspace);
+    if (verbose) {
+      logger.success(`Installed packages in <${CLI_DIRECTORIES.WORKSPACE}>`);
     }
-    if (hasDB) {
-      bindings.push("        DB: D1Database");
+    const bindingsStr = generateBindingsTypeString(features);
+    const secretsStr = await generateSecretsTypeString(workspace, verbose);
+    let envContent = playcademyEnvTemplate.replace("{{BINDINGS}}", bindingsStr);
+    envContent = envContent.replace("{{SECRETS}}", secretsStr);
+    const envPath = join12(workspace, "playcademy-env.d.ts");
+    writeFileSync5(envPath, envContent);
+    if (verbose) {
+      logger.success(`Generated <playcademy-env.d.ts>`);
     }
-    if (hasBucket) {
-      bindings.push("        BUCKET: R2Bucket");
+    const tsConfigFilename = await ensureTsconfigIncludes(workspace);
+    if (verbose) {
+      logger.success(`Updated <${tsConfigFilename}>`);
     }
-    const bindingsStr = bindings.length > 0 ? "\n" + bindings.join("\n") : "";
-    const envContent = playcademyEnvTemplate.replace("{{BINDINGS}}", bindingsStr);
-    const envPath = join10(workspace, "playcademy-env.d.ts");
-    writeFileSync4(envPath, envContent);
+    logger.newLine();
   } catch (error) {
     logger.warn(
       `Failed to generate TypeScript types: ${error instanceof Error ? error.message : String(error)}`
@@ -5792,19 +6026,19 @@ async function ensurePlaycademyTypes() {
 // src/lib/init/gitignore.ts
 init_core();
 init_loader2();
-import { existsSync as existsSync9, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
+import { join as join13 } from "path";
 var rootGitignoreTemplate = loadTemplateString("gitignore");
 function normalizeGitignoreEntry(entry) {
   return entry.replace(/^\/+/, "").replace(/\/+$/, "");
 }
 function ensureRootGitignore(workspace = getWorkspace()) {
-  const gitignorePath = join11(workspace, ".gitignore");
-  if (!existsSync9(gitignorePath)) {
-    writeFileSync5(gitignorePath, rootGitignoreTemplate);
+  const gitignorePath = join13(workspace, ".gitignore");
+  if (!existsSync11(gitignorePath)) {
+    writeFileSync6(gitignorePath, rootGitignoreTemplate);
     return;
   }
-  const existingContent = readFileSync4(gitignorePath, "utf-8");
+  const existingContent = readFileSync5(gitignorePath, "utf-8");
   const existingNormalized = new Set(
     existingContent.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).map(normalizeGitignoreEntry)
   );
@@ -5821,7 +6055,7 @@ function ensureRootGitignore(workspace = getWorkspace()) {
   const prefix = hasTrailingNewline ? "\n" : "\n\n";
   const header = "# Generated by Playcademy\n";
   const newEntries = entriesToAdd.join("\n");
-  writeFileSync5(gitignorePath, existingContent + prefix + header + newEntries + "\n");
+  writeFileSync6(gitignorePath, existingContent + prefix + header + newEntries + "\n");
 }
 
 // src/lib/deploy/schema.ts
@@ -5839,8 +6073,8 @@ async function getSchemaInfo(previousSchemaSnapshot) {
   if (!hasDatabaseSetup()) {
     return null;
   }
-  const schemaPath = join12(workspace, "db/schema/index.ts");
-  if (!existsSync10(schemaPath)) {
+  const schemaPath = join14(workspace, "db/schema/index.ts");
+  if (!existsSync12(schemaPath)) {
     return null;
   }
   try {
@@ -5874,6 +6108,42 @@ async function getSchemaStatementCount(previousSchemaSnapshot) {
   return schemaInfo.sql.split(";").filter((stmt) => stmt.trim()).length;
 }
 
+// src/lib/deploy/secrets.ts
+init_core();
+init_logger();
+function compareSecrets(current, previous) {
+  const currentKeys = Object.keys(current);
+  const changes = [];
+  for (const key of currentKeys) {
+    if (!previous.includes(key)) {
+      changes.push({ key, type: "added" });
+    }
+  }
+  for (const key of previous) {
+    if (!currentKeys.includes(key)) {
+      changes.push({ key, type: "removed" });
+    }
+  }
+  return {
+    hasChanges: changes.length > 0,
+    changes
+  };
+}
+async function fetchSecretsForDeployment(slug) {
+  try {
+    const client = await requireAuthenticatedClient();
+    const secrets = await client.dev.games.secrets.get(slug);
+    const keys = Object.keys(secrets);
+    return { secrets, keys };
+  } catch (error) {
+    logger.warn(
+      `Could not fetch secrets: ${error instanceof Error ? error.message : String(error)}`
+    );
+    logger.debug(`[Secrets] Error details: ${error}`);
+    return { secrets: {}, keys: [] };
+  }
+}
+
 // src/lib/deploy/utils.ts
 init_src2();
 function getDeploymentId(gameSlug) {
@@ -5887,11 +6157,11 @@ var CUSTOM_ROUTES_EXTENSIONS_WITH_DOT = [".ts", ".js", ".mjs", ".cjs"];
 function getCustomRoutesDirectory(projectPath, config) {
   const customRoutes = config?.integrations?.customRoutes;
   const customRoutesDir = typeof customRoutes === "object" && customRoutes.directory || DEFAULT_API_ROUTES_DIRECTORY;
-  return join13(projectPath, customRoutesDir);
+  return join15(projectPath, customRoutesDir);
 }
 function hasLocalCustomRoutes(projectPath, config) {
   const customRoutesDir = getCustomRoutesDirectory(projectPath, config);
-  return existsSync11(customRoutesDir);
+  return existsSync13(customRoutesDir);
 }
 async function getCustomRoutesHash(projectPath, config) {
   const customRoutesDir = getCustomRoutesDirectory(projectPath, config);
@@ -5899,16 +6169,16 @@ async function getCustomRoutesHash(projectPath, config) {
 }
 async function getCustomRoutesSize(projectPath, config) {
   const { stat: stat3, readdir } = await import("node:fs/promises");
-  const { join: join35 } = await import("node:path");
+  const { join: join37 } = await import("node:path");
   const customRoutesDir = getCustomRoutesDirectory(projectPath, config);
-  if (!existsSync11(customRoutesDir)) {
+  if (!existsSync13(customRoutesDir)) {
     return null;
   }
   let totalSize = 0;
   async function calculateDirSize(dir) {
     const entries = await readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join35(dir, entry.name);
+      const fullPath = join37(dir, entry.name);
       if (entry.isDirectory()) {
         await calculateDirSize(fullPath);
       } else if (entry.isFile()) {
@@ -5958,7 +6228,7 @@ function getBackendBindings(config, slug) {
   }
   return Object.keys(bindings).length > 0 ? bindings : void 0;
 }
-async function deployGameBackend(client, slug, config, projectPath, previousCustomRoutesHash, fullConfig, forceBackend, previousIntegrationKeys, previousSchemaSnapshot, debug) {
+async function deployGameBackend(client, slug, config, projectPath, previousCustomRoutesHash, fullConfig, forceBackend, previousIntegrationKeys, previousSchemaSnapshot, debug, previousDeployedSecrets) {
   try {
     if (fullConfig === void 0 || fullConfig === null) {
       return null;
@@ -5967,11 +6237,29 @@ async function deployGameBackend(client, slug, config, projectPath, previousCust
     const currentIntegrationKeys = getIntegrationKeys(fullConfig?.integrations);
     const hasIntegrations = currentIntegrationKeys.length > 0;
     const currentIntegrationsHash = hasIntegrations ? hashContent(fullConfig.integrations) : null;
-    if (!hasCustomRoutes2 && !hasIntegrations) {
+    const { secrets, keys: currentSecretKeys } = await fetchSecretsForDeployment(slug);
+    const hasSecrets = currentSecretKeys.length > 0;
+    if (!hasCustomRoutes2 && !hasIntegrations && !hasSecrets) {
       return null;
     }
     const currentCustomRoutesHash = hasCustomRoutes2 ? await getCustomRoutesHash(projectPath, fullConfig) : null;
     const currentCustomRoutesSize = hasCustomRoutes2 ? await getCustomRoutesSize(projectPath, fullConfig) : null;
+    const secretsComparison = compareSecrets(secrets, previousDeployedSecrets || []);
+    const secretsChanged = secretsComparison.hasChanges;
+    if (debug) {
+      logger.highlight("Debug: Secrets Info");
+      logger.data("Current secret keys", currentSecretKeys.join(", ") || "none", 1);
+      logger.data(
+        "Previous secret keys",
+        (previousDeployedSecrets || []).join(", ") || "none",
+        1
+      );
+      logger.data("Secrets changed", String(secretsChanged), 1);
+      if (secretsChanged) {
+        logger.data("Changes", JSON.stringify(secretsComparison.changes), 1);
+      }
+      logger.newLine();
+    }
     const customRoutesChanged = currentCustomRoutesHash !== previousCustomRoutesHash;
     const integrationsComparison = compareIntegrationKeys(
       previousIntegrationKeys,
@@ -5979,7 +6267,7 @@ async function deployGameBackend(client, slug, config, projectPath, previousCust
     );
     const integrationsChanged = integrationsComparison.hasChanges;
     const schemaChanged = await hasSchemaChanged(previousSchemaSnapshot);
-    const nothingChanged = !customRoutesChanged && !integrationsChanged && !schemaChanged;
+    const nothingChanged = !customRoutesChanged && !integrationsChanged && !schemaChanged && !secretsChanged;
     if (!forceBackend && nothingChanged) {
       return null;
     }
@@ -6002,7 +6290,8 @@ async function deployGameBackend(client, slug, config, projectPath, previousCust
       async () => client.dev.games.deploy.backend(slug, {
         ...bundle,
         bindings,
-        schema: schemaInfo || void 0
+        schema: schemaInfo || void 0,
+        secrets: Object.keys(secrets).length > 0 ? secrets : void 0
       }),
       "Backend deployed"
     );
@@ -6013,7 +6302,8 @@ async function deployGameBackend(client, slug, config, projectPath, previousCust
       integrationKeys: currentIntegrationKeys,
       integrationsHash: currentIntegrationsHash,
       backendSize: bundle.code.length,
-      schemaSnapshot: schemaInfo?.hash ? JSON.parse(schemaInfo.hash) : void 0
+      schemaSnapshot: schemaInfo?.hash ? JSON.parse(schemaInfo.hash) : void 0,
+      deployedSecrets: currentSecretKeys
     };
   } catch (error) {
     logger.error("Backend deployment failed");
@@ -6211,7 +6501,7 @@ function displayDeploymentDiff(options) {
   }
   if (backendChanged || customRoutesChanged || forceBackend || schemaStatementCount && schemaStatementCount > 0) {
     logger.bold("Backend", 1);
-    if (customRoutesChanged || backend?.currentCustomRoutesSize !== void 0) {
+    if (customRoutesChanged) {
       const previousSize = backend?.previousCustomRoutesSize;
       const currentSize = backend?.currentCustomRoutesSize;
       let routesInfo;
@@ -6226,7 +6516,7 @@ function displayDeploymentDiff(options) {
       } else {
         routesInfo = green2("Updated");
       }
-      logger.data("Routes (src)", routesInfo, 2);
+      logger.data("Routes", routesInfo, 2);
     }
     if (backendChanged || forceBackend) {
       const previousSize = backend?.previousBundleSize;
@@ -6245,7 +6535,7 @@ function displayDeploymentDiff(options) {
       } else {
         bundleInfo = green2("Updated");
       }
-      logger.data("Bundle (dep)", bundleInfo, 2);
+      logger.data("Bundle", bundleInfo, 2);
     }
     if (schemaStatementCount && schemaStatementCount > 0) {
       const schemaInfo = green2(
@@ -6272,6 +6562,25 @@ function displayDeploymentDiff(options) {
       logger.newLine();
     }
   }
+  const previousSecretKeys = options.secrets?.previousKeys;
+  const currentSecretKeys = options.secrets?.currentKeys;
+  if (previousSecretKeys !== void 0 && currentSecretKeys !== void 0) {
+    const added = currentSecretKeys.filter((k) => !previousSecretKeys.includes(k));
+    const removed = previousSecretKeys.filter((k) => !currentSecretKeys.includes(k));
+    const hasSecretsChanges = added.length > 0 || removed.length > 0;
+    if (hasSecretsChanges) {
+      logger.bold("Secrets", 1);
+      if (added.length > 0) {
+        const addedList = added.map((k) => green2(k)).join(", ");
+        logger.data("Added", addedList, 2);
+      }
+      if (removed.length > 0) {
+        const removedList = removed.map((k) => red2(k)).join(", ");
+        logger.data("Removed", removedList, 2);
+      }
+      logger.newLine();
+    }
+  }
 }
 
 // src/lib/deploy/interaction.ts
@@ -6287,10 +6596,10 @@ import { dim as dim4 } from "colorette";
 init_file_loader();
 init_constants2();
 init_core();
-import { join as join14, relative as relative2 } from "path";
+import { join as join16, relative as relative2 } from "path";
 function findSingleBuildZip() {
   const workspace = getWorkspace();
-  const playcademyDir = join14(workspace, CLI_DIRECTORIES.WORKSPACE);
+  const playcademyDir = join16(workspace, CLI_DIRECTORIES.WORKSPACE);
   const zipFiles = findFilesByExtension(playcademyDir, "zip");
   if (zipFiles.length === 1) {
     return zipFiles[0] ? relative2(workspace, zipFiles[0]) : null;
@@ -6326,14 +6635,14 @@ function hasOptionalFieldsMissing(missing) {
 
 // src/lib/deploy/validate.ts
 init_logger();
-import { existsSync as existsSync12 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { resolve as resolve7 } from "path";
 function validateBuildPath(path2) {
   if (!path2.trim()) {
     return "Build path is required";
   }
   const resolvedPath = resolve7(path2.trim());
-  if (!existsSync12(resolvedPath)) {
+  if (!existsSync14(resolvedPath)) {
     return `Build path not found: ${path2.trim()}`;
   }
   return true;
@@ -6552,6 +6861,10 @@ async function confirmDeploymentPlan(plan, context2) {
       integrations: {
         previousKeys: context2.previousIntegrationKeys,
         currentKeys: currentIntegrationKeys
+      },
+      secrets: {
+        previousKeys: context2.deployedGameInfo?.deployedSecrets,
+        currentKeys: context2.currentSecretKeys
       }
     });
     const shouldDeploy = await confirm2({
@@ -6565,9 +6878,9 @@ async function confirmDeploymentPlan(plan, context2) {
 
 // src/lib/deploy/output.ts
 init_src2();
-init_config();
+init_config2();
 init_logger();
-import { blueBright as blueBright2, underline } from "colorette";
+import { underline } from "colorette";
 function displayCurrentConfiguration(context2) {
   const { config } = context2;
   logger.newLine();
@@ -6627,12 +6940,12 @@ function reportDeploymentSuccess(result, context2) {
   logger.success(`${game.displayName} ${action} successfully!`);
   logger.newLine();
   const baseUrl = getWebBaseUrl(client.getBaseUrl());
-  logger.data("Game URL", underline(blueBright2(`${baseUrl}/g/${game.slug}`)), 1);
+  logger.data("Game URL", underline(`${baseUrl}/g/${game.slug}`), 1);
   if (backendDeployment || previousCustomRoutesHash) {
     const env = getEnvironment();
     const subdomain = env === "staging" ? `${game.slug}-staging` : game.slug;
     const backendUrl = `https://${subdomain}.${GAME_WORKER_DOMAINS.production}/api`;
-    logger.data("Backend API", underline(blueBright2(backendUrl)), 1);
+    logger.data("Backend API", underline(`${backendUrl}`), 1);
   }
   if (game.version !== "external") {
     logger.data("Version", game.version || "latest", 1);
@@ -6701,6 +7014,10 @@ async function reportDryRun(plan, context2) {
       integrations: {
         previousKeys: context2.previousIntegrationKeys,
         currentKeys: currentIntegrationKeys
+      },
+      secrets: {
+        previousKeys: context2.deployedGameInfo?.deployedSecrets,
+        currentKeys: context2.currentSecretKeys
       }
     });
   } else {
@@ -7126,28 +7443,28 @@ var INTERACTION_TYPE = Object.fromEntries(
 
 // src/lib/deploy/preparation.ts
 init_src();
-init_config2();
+init_config3();
 init_client();
 init_context();
 
 // src/lib/games/storage.ts
 init_constants2();
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { join as join15 } from "node:path";
+import { join as join17 } from "node:path";
 function getGamesStorePath() {
-  return join15(homedir2(), CLI_USER_DIRECTORIES.CONFIG, CLI_FILES.GAMES_STORE);
+  return join17(homedir2(), CLI_USER_DIRECTORIES.CONFIG, CLI_FILES.GAMES_STORE);
 }
 async function ensureConfigDir() {
-  const configDir = join15(homedir2(), CLI_USER_DIRECTORIES.CONFIG);
+  const configDir = join17(homedir2(), CLI_USER_DIRECTORIES.CONFIG);
   await mkdir3(configDir, { recursive: true });
 }
 async function loadGameStore() {
   try {
     await ensureConfigDir();
     const storePath = getGamesStorePath();
-    if (existsSync13(storePath)) {
+    if (existsSync15(storePath)) {
       const content = await readFile3(storePath, "utf-8");
       return JSON.parse(content);
     }
@@ -7231,6 +7548,11 @@ async function prepareDeploymentContext(options) {
       buildHash = await hashFile(finalConfig.buildPath);
     }
   }
+  let currentSecretKeys;
+  if (finalConfig.slug && gameIsDeployed) {
+    const { keys } = await fetchSecretsForDeployment(finalConfig.slug);
+    currentSecretKeys = keys;
+  }
   return {
     config: finalConfig,
     fullConfig,
@@ -7249,6 +7571,7 @@ async function prepareDeploymentContext(options) {
     previousBackendSize: deployedGameInfo?.backendSize,
     previousIntegrationKeys: deployedGameInfo?.integrationKeys,
     previousIntegrationsHash: deployedGameInfo?.integrationsHash,
+    currentSecretKeys,
     isDryRun: options.dryRun ?? false,
     deployBackend: options.backend !== false,
     forceBackend: options.forceBackend ?? false,
@@ -7284,11 +7607,24 @@ async function analyzeChanges(context2) {
   let backendChanged;
   let customRoutesChanged = false;
   let schemaChanged = false;
+  let secretsChanged = false;
+  let hasSecrets = false;
   if (!deployBackend) {
     backendChanged = void 0;
   } else {
     const hasCustomRoutes2 = hasLocalCustomRoutes(projectPath, context2.fullConfig);
     const hasIntegrations = !!context2.fullConfig?.integrations;
+    if (context2.currentSecretKeys) {
+      const currentSecretKeys = context2.currentSecretKeys;
+      const previousSecretKeys = context2.deployedGameInfo?.deployedSecrets || [];
+      hasSecrets = currentSecretKeys.length > 0;
+      const secretsComparison = compareSecrets(
+        Object.fromEntries(currentSecretKeys.map((k) => [k, ""])),
+        // We only care about keys for change detection
+        previousSecretKeys
+      );
+      secretsChanged = secretsComparison.hasChanges;
+    }
     if (hasCustomRoutes2) {
       if (!context2.previousCustomRoutesHash) {
         customRoutesChanged = true;
@@ -7313,10 +7649,10 @@ async function analyzeChanges(context2) {
     if (context2.fullConfig) {
       schemaChanged = await hasSchemaChanged(context2.deployedGameInfo?.schemaSnapshot);
     }
-    if (!hasCustomRoutes2 && !hasIntegrations) {
+    if (!hasCustomRoutes2 && !hasIntegrations && !hasSecrets) {
       backendChanged = void 0;
     } else {
-      backendChanged = customRoutesChanged || integrationKeysChanged || schemaChanged;
+      backendChanged = customRoutesChanged || integrationKeysChanged || schemaChanged || secretsChanged;
     }
   }
   let integrationsMetadataChanged;
@@ -7336,7 +7672,8 @@ async function analyzeChanges(context2) {
     backend: backendChanged,
     customRoutes: customRoutesChanged,
     integrations: integrationsMetadataChanged,
-    schema: schemaChanged
+    schema: schemaChanged,
+    secrets: secretsChanged
   };
 }
 async function calculateDeploymentPlan(context2, changes) {
@@ -7379,7 +7716,8 @@ async function calculateDeploymentPlan(context2, changes) {
     }
   }
   const shouldDeployFrontend = changes.build !== false || changes.config;
-  const needsBackend2 = hasLocalCustomRoutes(projectPath, context2.fullConfig) || !!context2.fullConfig?.integrations;
+  const hasSecretsForUpdate = (context2.currentSecretKeys?.length ?? 0) > 0;
+  const needsBackend2 = hasLocalCustomRoutes(projectPath, context2.fullConfig) || !!context2.fullConfig?.integrations || hasSecretsForUpdate;
   const shouldDeployBackend = deployBackend && (backendHasChanges || forceBackend || needsBackend2);
   return {
     action: "update-existing",
@@ -7395,7 +7733,7 @@ async function calculateDeploymentPlan(context2, changes) {
 // src/lib/deploy/steps.ts
 init_src();
 init_logger();
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { readFile as readFile4 } from "fs/promises";
 import { basename as basename2, resolve as resolve8 } from "path";
 function prepareGameMetadata(config) {
@@ -7415,7 +7753,7 @@ function prepareGameMetadata(config) {
 }
 async function prepareBuildFile(buildPath) {
   const resolvedPath = resolve8(buildPath);
-  if (resolvedPath.endsWith(".zip") && existsSync14(resolvedPath)) {
+  if (resolvedPath.endsWith(".zip") && existsSync16(resolvedPath)) {
     const buffer = await readFile4(resolvedPath);
     const uint8Array = new Uint8Array(buffer);
     const blob = new Blob([uint8Array], { type: "application/zip" });
@@ -7576,7 +7914,8 @@ async function deployBackendIfNeeded(game, context2) {
     forceBackend,
     previousIntegrationKeys,
     context2.deployedGameInfo?.schemaSnapshot,
-    debug
+    debug,
+    context2.deployedGameInfo?.deployedSecrets
   );
   return backendDeployment;
 }
@@ -7611,14 +7950,16 @@ async function saveDeploymentState(game, backendDeployment, context2) {
         customRoutesSize: backendDeployment.customRoutesSize ?? void 0,
         backendSize: backendDeployment.backendSize,
         backendDeployedAt: backendDeployment.deployedAt,
-        schemaSnapshot: backendDeployment.schemaSnapshot
+        schemaSnapshot: backendDeployment.schemaSnapshot,
+        deployedSecrets: backendDeployment.deployedSecrets
       },
       ...!backendDeployment && context2.deployedGameInfo && {
         customRoutesHash: context2.deployedGameInfo.customRoutesHash,
         customRoutesSize: context2.deployedGameInfo.customRoutesSize,
         backendSize: context2.deployedGameInfo.backendSize,
         backendDeployedAt: context2.deployedGameInfo.backendDeployedAt,
-        schemaSnapshot: context2.deployedGameInfo.schemaSnapshot
+        schemaSnapshot: context2.deployedGameInfo.schemaSnapshot,
+        deployedSecrets: context2.deployedGameInfo.deployedSecrets
       },
       integrationKeys,
       // Always save (even if empty array)
@@ -7630,20 +7971,20 @@ async function saveDeploymentState(game, backendDeployment, context2) {
 // src/lib/dev/backend.ts
 init_constants2();
 init_core();
-import { existsSync as existsSync15 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync17 } from "fs";
+import { join as join18 } from "path";
 function hasCustomRoutes(config) {
   const workspace = getWorkspace();
   const customRoutesConfig = config?.integrations?.customRoutes;
   const customRoutesDir = typeof customRoutesConfig === "object" && customRoutesConfig.directory || DEFAULT_API_ROUTES_DIRECTORY;
-  return existsSync15(join16(workspace, customRoutesDir));
+  return existsSync17(join18(workspace, customRoutesDir));
 }
 function needsBackend(config) {
   return !!config?.integrations || hasCustomRoutes(config);
 }
 
 // src/lib/dev/display.ts
-import { blueBright as blueBright3, dim as dim5 } from "colorette";
+import { dim as dim5 } from "colorette";
 
 // ../edge-play/src/register-routes.ts
 init_constants4();
@@ -7653,6 +7994,57 @@ init_constants4();
 
 // src/lib/dev/display.ts
 init_core();
+
+// src/lib/dev/route-sorting.ts
+function getSegmentType(segment) {
+  if (segment.startsWith(":") && segment.includes("{.*}")) {
+    return 2 /* CatchAll */;
+  }
+  if (segment.startsWith(":")) {
+    return 1 /* Dynamic */;
+  }
+  return 0 /* Static */;
+}
+function compareSegments(a, b) {
+  const typeA = getSegmentType(a);
+  const typeB = getSegmentType(b);
+  if (typeA !== typeB) {
+    if (typeA === 1 /* Dynamic */ && typeB === 0 /* Static */) {
+      return -1;
+    }
+    if (typeA === 0 /* Static */ && typeB === 1 /* Dynamic */) {
+      return 1;
+    }
+    if (typeA === 2 /* CatchAll */ && typeB === 0 /* Static */) {
+      return -1;
+    }
+    if (typeA === 0 /* Static */ && typeB === 2 /* CatchAll */) {
+      return 1;
+    }
+    return typeA - typeB;
+  }
+  return a.localeCompare(b);
+}
+function sortRoutes(routes) {
+  return [...routes].sort((a, b) => {
+    const segmentsA = a.path.split("/").filter(Boolean);
+    const segmentsB = b.path.split("/").filter(Boolean);
+    const maxLength = Math.max(segmentsA.length, segmentsB.length);
+    for (let i = 0; i < maxLength; i++) {
+      const segA = segmentsA[i];
+      const segB = segmentsB[i];
+      if (segA === void 0) return -1;
+      if (segB === void 0) return 1;
+      const comparison = compareSegments(segA, segB);
+      if (comparison !== 0) {
+        return comparison;
+      }
+    }
+    return 0;
+  });
+}
+
+// src/lib/dev/display.ts
 function displayRegisteredRoutes(integrations, customRoutes = []) {
   const healthRoutes = [
     { path: ROUTES.HEALTH, method: "GET" }
@@ -7663,29 +8055,27 @@ function displayRegisteredRoutes(integrations, customRoutes = []) {
     const method = hasSandboxCreds ? "POST" : "POST (not configured)";
     timebackRoutes.push({ path: ROUTES.TIMEBACK.END_ACTIVITY, method });
   }
-  const customRoutesList = customRoutes.map((route) => ({
-    path: route.path,
-    method: route.methods?.join(", ") || "*"
-  }));
+  const customRoutesList = customRoutes.map((route) => {
+    const methods = route.methods?.join(", ") || "*";
+    const isCatchAll = /{\.\*}/.test(route.path);
+    return {
+      path: route.path,
+      method: isCatchAll ? `${methods} (catch-all)` : methods
+    };
+  });
   const allRoutes = [...healthRoutes, ...timebackRoutes, ...customRoutesList];
-  const maxPathLength = Math.max(...allRoutes.map((r) => r.path.length));
-  const displayRoute = (route) => {
+  const sortedRoutes = sortRoutes(allRoutes);
+  const maxPathLength = Math.max(...sortedRoutes.map((r) => r.path.length));
+  sortedRoutes.forEach((route) => {
     const paddedPath = route.path.padEnd(maxPathLength + 2, " ");
-    logger.raw(`${blueBright3(paddedPath)} ${dim5(route.method)}`, 1);
-  };
-  healthRoutes.forEach(displayRoute);
-  if (timebackRoutes.length > 0) {
-    timebackRoutes.forEach(displayRoute);
-  }
-  if (customRoutesList.length > 0) {
-    customRoutesList.forEach(displayRoute);
-  }
+    logger.customRaw(`<${paddedPath}> ${dim5(route.method)}`, 1);
+  });
 }
 
 // src/lib/dev/reload.ts
 init_constants2();
 init_core();
-import { join as join17, relative as relative3 } from "path";
+import { join as join19, relative as relative3 } from "path";
 import chokidar from "chokidar";
 import { bold as bold4, cyan as cyan3, dim as dim6, green as green3 } from "colorette";
 function formatTime() {
@@ -7702,9 +8092,9 @@ function startHotReload(onReload, options = {}) {
   const customRoutesConfig = options.config?.integrations?.customRoutes;
   const customRoutesDir = typeof customRoutesConfig === "object" && customRoutesConfig.directory || DEFAULT_API_ROUTES_DIRECTORY;
   const watchPaths = [
-    join17(workspace, customRoutesDir),
-    join17(workspace, "playcademy.config.js"),
-    join17(workspace, "playcademy.config.json")
+    join19(workspace, customRoutesDir),
+    join19(workspace, "playcademy.config.js"),
+    join19(workspace, "playcademy.config.json")
   ];
   const watcher = chokidar.watch(watchPaths, {
     persistent: true,
@@ -7746,53 +8136,65 @@ function startHotReload(onReload, options = {}) {
 // src/lib/dev/server.ts
 init_src2();
 import { mkdir as mkdir4 } from "fs/promises";
-import { join as join19 } from "path";
+import { join as join21 } from "path";
 import { Log, LogLevel, Miniflare } from "miniflare";
 
 // ../utils/src/port.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "node:fs";
 import { createServer as createServer2 } from "node:net";
 import { homedir as homedir3 } from "node:os";
-import { join as join18 } from "node:path";
+import { join as join20 } from "node:path";
 async function isPortAvailableOnHost(port, host) {
   return new Promise((resolve11) => {
     const server = createServer2();
-    server.once("error", () => {
-      resolve11(false);
+    let resolved = false;
+    const cleanup = (result) => {
+      if (resolved) return;
+      resolved = true;
+      try {
+        server.close();
+      } catch {
+      }
+      resolve11(result);
+    };
+    const timeout = setTimeout(() => cleanup(true), 100);
+    server.once("error", (err) => {
+      clearTimeout(timeout);
+      if (err.code === "EAFNOSUPPORT" || err.code === "EADDRNOTAVAIL") {
+        cleanup(true);
+      } else {
+        cleanup(false);
+      }
     });
     server.once("listening", () => {
-      server.close();
-      resolve11(true);
+      clearTimeout(timeout);
+      cleanup(true);
     });
-    server.listen(port, host);
+    server.listen(port, host).unref();
   });
 }
 async function findAvailablePort(startPort = 4321) {
-  const [localhostAvailable, ipv4AllAvailable, ipv6AllAvailable] = await Promise.all([
-    isPortAvailableOnHost(startPort, "127.0.0.1"),
-    isPortAvailableOnHost(startPort, "0.0.0.0"),
-    isPortAvailableOnHost(startPort, "::")
-  ]);
-  if (localhostAvailable && ipv4AllAvailable && ipv6AllAvailable) {
+  if (await isPortAvailableOnHost(startPort, "0.0.0.0")) {
     return startPort;
+  } else {
+    return findAvailablePort(startPort + 1);
   }
-  return findAvailablePort(startPort + 1);
 }
 function getRegistryPath() {
   const home = homedir3();
-  const dir = join18(home, ".playcademy");
-  if (!existsSync16(dir)) {
+  const dir = join20(home, ".playcademy");
+  if (!existsSync18(dir)) {
     mkdirSync4(dir, { recursive: true });
   }
-  return join18(dir, ".proc");
+  return join20(dir, ".proc");
 }
 function readRegistry() {
   const registryPath = getRegistryPath();
-  if (!existsSync16(registryPath)) {
+  if (!existsSync18(registryPath)) {
     return {};
   }
   try {
-    const content = readFileSync5(registryPath, "utf-8");
+    const content = readFileSync6(registryPath, "utf-8");
     return JSON.parse(content);
   } catch {
     return {};
@@ -7800,7 +8202,7 @@ function readRegistry() {
 }
 function writeRegistry(registry) {
   const registryPath = getRegistryPath();
-  writeFileSync6(registryPath, JSON.stringify(registry, null, 2), "utf-8");
+  writeFileSync7(registryPath, JSON.stringify(registry, null, 2), "utf-8");
 }
 function getServerKey(type, port) {
   return `${type}-${port}`;
@@ -7900,9 +8302,19 @@ async function startDevServer(options) {
   const kvDir = hasKV ? await ensureKvDirectory() : void 0;
   const hasBucket = hasBucketSetup(config);
   const bucketDir = hasBucket ? await ensureBucketDirectory() : void 0;
+  const workspace = getWorkspace();
+  const envSecrets = await readEnvFile(workspace);
   const log2 = logger2 ? new FilteredLog(LogLevel.INFO) : new Log(LogLevel.NONE);
-  const sandboxInfo = readServerInfo("sandbox", getWorkspace());
+  const sandboxInfo = readServerInfo("sandbox", workspace);
   const baseUrl = platformUrl ?? sandboxInfo?.url ?? process.env.PLAYCADEMY_BASE_URL ?? `http://localhost:${DEFAULT_PORTS.SANDBOX}`;
+  const bindings = {
+    PLAYCADEMY_API_KEY: process.env.PLAYCADEMY_API_KEY || "dev-api-key",
+    GAME_ID: CORE_GAME_UUIDS.PLAYGROUND,
+    PLAYCADEMY_BASE_URL: baseUrl
+  };
+  for (const [key, value] of Object.entries(envSecrets)) {
+    bindings[`secrets_${key}`] = value;
+  }
   const mf = new Miniflare({
     port,
     log: log2,
@@ -7913,11 +8325,7 @@ async function startDevServer(options) {
         contents: bundle.code
       }
     ],
-    bindings: {
-      PLAYCADEMY_API_KEY: process.env.PLAYCADEMY_API_KEY || "dev-api-key",
-      GAME_ID: CORE_GAME_UUIDS.PLAYGROUND,
-      PLAYCADEMY_BASE_URL: baseUrl
-    },
+    bindings,
     d1Databases: hasDatabase ? ["DB"] : [],
     d1Persist: dbDir,
     kvNamespaces: hasKV ? ["KV"] : [],
@@ -7933,7 +8341,7 @@ async function startDevServer(options) {
   return { server: mf, port };
 }
 async function ensureDatabaseDirectory() {
-  const dbDir = join19(getWorkspace(), CLI_DIRECTORIES.DATABASE);
+  const dbDir = join21(getWorkspace(), CLI_DIRECTORIES.DATABASE);
   try {
     await mkdir4(dbDir, { recursive: true });
   } catch (error) {
@@ -7942,7 +8350,7 @@ async function ensureDatabaseDirectory() {
   return dbDir;
 }
 async function ensureKvDirectory() {
-  const kvDir = join19(getWorkspace(), CLI_DIRECTORIES.KV);
+  const kvDir = join21(getWorkspace(), CLI_DIRECTORIES.KV);
   try {
     await mkdir4(kvDir, { recursive: true });
   } catch (error) {
@@ -7951,7 +8359,7 @@ async function ensureKvDirectory() {
   return kvDir;
 }
 async function ensureBucketDirectory() {
-  const bucketDir = join19(getWorkspace(), CLI_DIRECTORIES.BUCKET);
+  const bucketDir = join21(getWorkspace(), CLI_DIRECTORIES.BUCKET);
   try {
     await mkdir4(bucketDir, { recursive: true });
   } catch (error) {
@@ -8036,7 +8444,7 @@ function displayResourcesStatus(resources, logger2) {
 }
 
 // src/commands/init/config.ts
-import { writeFileSync as writeFileSync7 } from "fs";
+import { writeFileSync as writeFileSync8 } from "fs";
 import { resolve as resolve9 } from "path";
 init_file_loader();
 init_constants2();
@@ -8088,7 +8496,7 @@ var configCommand = new Command("config").description("Create playcademy.config
       emoji: gameInfo.emoji,
       timeback: timebackConfig ?? void 0
     });
-    writeFileSync7(resolve9(getWorkspace(), configFileName), configContent, "utf-8");
+    writeFileSync8(resolve9(getWorkspace(), configFileName), configContent, "utf-8");
     displayConfigSuccess(!!timebackConfig);
   } catch (error) {
     logger.newLine();
@@ -8207,7 +8615,7 @@ var initCommand = new Command2("init").description("Initialize a playcademy.conf
       bucket: bucket ?? void 0,
       timeback: timebackConfig ?? void 0
     });
-    writeFileSync8(resolve10(getWorkspace(), configFileName), configContent, "utf-8");
+    writeFileSync9(resolve10(getWorkspace(), configFileName), configContent, "utf-8");
     if (database || kv || bucket) {
       await ensurePlaycademyTypes();
     }
@@ -8225,14 +8633,14 @@ var initCommand = new Command2("init").description("Initialize a playcademy.conf
 });
 async function addPlaycademySdk() {
   const pkgPath = resolve10(getWorkspace(), "package.json");
-  const pkg = JSON.parse(readFileSync6(pkgPath, "utf-8"));
+  const pkg = JSON.parse(readFileSync7(pkgPath, "utf-8"));
   const hasSdk = pkg.dependencies?.["@playcademy/sdk"] || pkg.devDependencies?.["@playcademy/sdk"];
   if (hasSdk) {
     return false;
   }
   if (!pkg.dependencies) pkg.dependencies = {};
   pkg.dependencies["@playcademy/sdk"] = "latest";
-  writeFileSync8(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+  writeFileSync9(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
   return true;
 }
 initCommand.addCommand(configCommand);
@@ -8823,7 +9231,7 @@ var getStatusCommand = new Command11("status").description("Check your developer
 });
 
 // src/commands/dev/server.ts
-import { blueBright as blueBright4, underline as underline2 } from "colorette";
+import { underline as underline2 } from "colorette";
 function setupCleanupHandlers(workspace, getServer) {
   let isShuttingDown = false;
   const cleanup = () => {
@@ -8873,7 +9281,7 @@ async function runDevServer(options) {
       logger.warn("No backend integrations or custom routes configured");
       logger.newLine();
       logger.admonition("tip", "How to Add Backend", [
-        `Add integrations to ${blueBright4("playcademy.config.js")} or run \`playcademy api init\``
+        `Add integrations to <playcademy.config.js> or run \`playcademy api init\``
       ]);
       logger.newLine();
       logger.remark("Nothing to do");
@@ -8887,7 +9295,7 @@ async function runDevServer(options) {
       logger: options.logger !== false
     });
     serverRef.current = server;
-    logger.success(`Game API started: ${blueBright4(underline2(`http://localhost:${port}/api`))}`);
+    logger.success(`Game API started: ${underline2(`<http://localhost:${port}/api>`)}`);
     logger.newLine();
     const customRoutesDir = getCustomRoutesDirectory(workspace, config);
     const customRoutes = await discoverRoutes(customRoutesDir);
@@ -9101,16 +9509,16 @@ async function runDbInit() {
 init_src2();
 init_src();
 import { spawn } from "child_process";
-import { existsSync as existsSync17, rmSync as rmSync2 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync19, rmSync as rmSync2 } from "fs";
+import { join as join22 } from "path";
 import { confirm as confirm6 } from "@inquirer/prompts";
 import { Miniflare as Miniflare2 } from "miniflare";
 init_constants2();
 async function runDbReset() {
   try {
     const workspace = getWorkspace();
-    const dbDir = join20(workspace, CLI_DIRECTORIES.DATABASE);
-    if (!existsSync17(dbDir)) {
+    const dbDir = join22(workspace, CLI_DIRECTORIES.DATABASE);
+    if (!existsSync19(dbDir)) {
       logger.warn("No database found to reset");
       logger.newLine();
       logger.remark("Nothing to do");
@@ -9213,8 +9621,8 @@ async function runDbReset() {
 // src/commands/db/seed.ts
 init_package_manager();
 import { execSync as execSync5 } from "child_process";
-import { existsSync as existsSync18 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync20 } from "fs";
+import { join as join23 } from "path";
 async function runDbSeed(options) {
   const workspace = getWorkspace();
   try {
@@ -9223,8 +9631,8 @@ async function runDbSeed(options) {
       logger.newLine();
     }
     if (options.file) {
-      const seedPath = join21(workspace, options.file);
-      if (!existsSync18(seedPath)) {
+      const seedPath = join23(workspace, options.file);
+      if (!existsSync20(seedPath)) {
         logger.error(`Seed file not found: ${options.file}`);
         logger.newLine();
         process.exit(1);
@@ -9255,7 +9663,7 @@ import { Command as Command15 } from "commander";
 // src/commands/kv/clear.ts
 init_string();
 init_constants2();
-import { join as join22 } from "path";
+import { join as join24 } from "path";
 import { confirm as confirm7 } from "@inquirer/prompts";
 import { Miniflare as Miniflare3 } from "miniflare";
 async function runKVClear(options = {}) {
@@ -9292,7 +9700,7 @@ async function runKVClear(options = {}) {
       sourcemap: false,
       minify: false
     });
-    const kvDir = join22(getWorkspace(), CLI_DIRECTORIES.KV);
+    const kvDir = join24(getWorkspace(), CLI_DIRECTORIES.KV);
     const mf = new Miniflare3({
       modules: [
         {
@@ -9370,7 +9778,7 @@ async function runKVClear(options = {}) {
 
 // src/commands/kv/delete.ts
 init_constants2();
-import { join as join23 } from "path";
+import { join as join25 } from "path";
 import { Miniflare as Miniflare4 } from "miniflare";
 async function runKVDelete(key, options = {}) {
   try {
@@ -9415,7 +9823,7 @@ async function runKVDelete(key, options = {}) {
       sourcemap: false,
       minify: false
     });
-    const kvDir = join23(getWorkspace(), CLI_DIRECTORIES.KV);
+    const kvDir = join25(getWorkspace(), CLI_DIRECTORIES.KV);
     const mf = new Miniflare4({
       modules: [
         {
@@ -9458,7 +9866,7 @@ async function runKVDelete(key, options = {}) {
 
 // src/commands/kv/get.ts
 init_constants2();
-import { join as join24 } from "path";
+import { join as join26 } from "path";
 import { Miniflare as Miniflare5 } from "miniflare";
 async function runKVGet(key, options = {}) {
   try {
@@ -9503,7 +9911,7 @@ async function runKVGet(key, options = {}) {
       sourcemap: false,
       minify: false
     });
-    const kvDir = join24(getWorkspace(), CLI_DIRECTORIES.KV);
+    const kvDir = join26(getWorkspace(), CLI_DIRECTORIES.KV);
     const mf = new Miniflare5({
       modules: [
         {
@@ -9648,7 +10056,7 @@ async function runKVInit() {
 
 // src/commands/kv/inspect.ts
 init_constants2();
-import { join as join25 } from "path";
+import { join as join27 } from "path";
 import { Miniflare as Miniflare6 } from "miniflare";
 async function runKVInspect(key, options = {}) {
   try {
@@ -9693,7 +10101,7 @@ async function runKVInspect(key, options = {}) {
       sourcemap: false,
       minify: false
     });
-    const kvDir = join25(getWorkspace(), CLI_DIRECTORIES.KV);
+    const kvDir = join27(getWorkspace(), CLI_DIRECTORIES.KV);
     const mf = new Miniflare6({
       modules: [
         {
@@ -9787,7 +10195,7 @@ async function runKVInspect(key, options = {}) {
 // src/commands/kv/list.ts
 init_string();
 init_constants2();
-import { join as join26 } from "path";
+import { join as join28 } from "path";
 import { Miniflare as Miniflare7 } from "miniflare";
 async function runKVList(options = {}) {
   try {
@@ -9823,7 +10231,7 @@ async function runKVList(options = {}) {
       sourcemap: false,
       minify: false
     });
-    const kvDir = join26(getWorkspace(), CLI_DIRECTORIES.KV);
+    const kvDir = join28(getWorkspace(), CLI_DIRECTORIES.KV);
     const mf = new Miniflare7({
       modules: [
         {
@@ -9878,7 +10286,7 @@ async function runKVList(options = {}) {
 init_file_loader();
 init_string();
 init_constants2();
-import { join as join27 } from "path";
+import { join as join29 } from "path";
 import { confirm as confirm8 } from "@inquirer/prompts";
 import { Miniflare as Miniflare8 } from "miniflare";
 async function runKVSeed(seedFile, options = {}) {
@@ -9948,7 +10356,7 @@ async function runKVSeed(seedFile, options = {}) {
       sourcemap: false,
       minify: false
     });
-    const kvDir = join27(workspace, CLI_DIRECTORIES.KV);
+    const kvDir = join29(workspace, CLI_DIRECTORIES.KV);
     const mf = new Miniflare8({
       modules: [
         {
@@ -10035,7 +10443,7 @@ async function runKVSeed(seedFile, options = {}) {
 // src/commands/kv/set.ts
 init_file_loader();
 init_constants2();
-import { join as join28 } from "path";
+import { join as join30 } from "path";
 import { Miniflare as Miniflare9 } from "miniflare";
 async function runKVSet(key, value, options = {}) {
   try {
@@ -10109,7 +10517,7 @@ async function runKVSet(key, value, options = {}) {
       sourcemap: false,
       minify: false
     });
-    const kvDir = join28(getWorkspace(), CLI_DIRECTORIES.KV);
+    const kvDir = join30(getWorkspace(), CLI_DIRECTORIES.KV);
     const mf = new Miniflare9({
       modules: [
         {
@@ -10153,7 +10561,7 @@ async function runKVSet(key, value, options = {}) {
 // src/commands/kv/stats.ts
 init_string();
 init_constants2();
-import { join as join29 } from "path";
+import { join as join31 } from "path";
 import { Miniflare as Miniflare10 } from "miniflare";
 async function runKVStats(options = {}) {
   try {
@@ -10189,7 +10597,7 @@ async function runKVStats(options = {}) {
       sourcemap: false,
       minify: false
     });
-    const kvDir = join29(getWorkspace(), CLI_DIRECTORIES.KV);
+    const kvDir = join31(getWorkspace(), CLI_DIRECTORIES.KV);
     const mf = new Miniflare10({
       modules: [
         {
@@ -10312,7 +10720,7 @@ import { Command as Command16 } from "commander";
 
 // src/commands/bucket/delete.ts
 init_constants2();
-import { join as join30 } from "path";
+import { join as join32 } from "path";
 import { Miniflare as Miniflare11 } from "miniflare";
 async function runBucketDelete(key, options = {}) {
   try {
@@ -10357,7 +10765,7 @@ async function runBucketDelete(key, options = {}) {
       sourcemap: false,
       minify: false
     });
-    const bucketDir = join30(getWorkspace(), CLI_DIRECTORIES.BUCKET);
+    const bucketDir = join32(getWorkspace(), CLI_DIRECTORIES.BUCKET);
     const mf = new Miniflare11({
       modules: [
         {
@@ -10415,8 +10823,8 @@ async function runBucketDelete(key, options = {}) {
 
 // src/commands/bucket/get.ts
 init_constants2();
-import { writeFileSync as writeFileSync9 } from "fs";
-import { join as join31 } from "path";
+import { writeFileSync as writeFileSync10 } from "fs";
+import { join as join33 } from "path";
 import { Miniflare as Miniflare12 } from "miniflare";
 async function runBucketGet(key, options = {}) {
   try {
@@ -10461,7 +10869,7 @@ async function runBucketGet(key, options = {}) {
       sourcemap: false,
       minify: false
     });
-    const bucketDir = join31(getWorkspace(), CLI_DIRECTORIES.BUCKET);
+    const bucketDir = join33(getWorkspace(), CLI_DIRECTORIES.BUCKET);
     const mf = new Miniflare12({
       modules: [
         {
@@ -10501,7 +10909,7 @@ async function runBucketGet(key, options = {}) {
       }
       if (options.output) {
         const buffer = await object.arrayBuffer();
-        writeFileSync9(options.output, Buffer.from(buffer));
+        writeFileSync10(options.output, Buffer.from(buffer));
         if (!options.raw) {
           logger.success(`Downloaded '${key}' to '${options.output}'`);
           logger.newLine();
@@ -10616,7 +11024,7 @@ async function runBucketInit() {
 
 // src/commands/bucket/list.ts
 init_constants2();
-import { join as join32 } from "path";
+import { join as join34 } from "path";
 import { Miniflare as Miniflare13 } from "miniflare";
 async function runBucketList(options = {}) {
   try {
@@ -10652,7 +11060,7 @@ async function runBucketList(options = {}) {
       sourcemap: false,
       minify: false
     });
-    const bucketDir = join32(getWorkspace(), CLI_DIRECTORIES.BUCKET);
+    const bucketDir = join34(getWorkspace(), CLI_DIRECTORIES.BUCKET);
     const mf = new Miniflare13({
       modules: [
         {
@@ -10735,8 +11143,8 @@ function formatBytes(bytes) {
 
 // src/commands/bucket/put.ts
 init_constants2();
-import { readFileSync as readFileSync7, statSync as statSync2 } from "fs";
-import { join as join33 } from "path";
+import { readFileSync as readFileSync8, statSync as statSync2 } from "fs";
+import { join as join35 } from "path";
 import { Miniflare as Miniflare14 } from "miniflare";
 async function runBucketPut(key, filePath, options = {}) {
   try {
@@ -10780,7 +11188,7 @@ async function runBucketPut(key, filePath, options = {}) {
     let fileBuffer;
     let fileSize;
     try {
-      fileBuffer = readFileSync7(filePath);
+      fileBuffer = readFileSync8(filePath);
       fileSize = statSync2(filePath).size;
     } catch {
       if (!options.raw && !options.json) {
@@ -10793,7 +11201,7 @@ async function runBucketPut(key, filePath, options = {}) {
       sourcemap: false,
       minify: false
     });
-    const bucketDir = join33(getWorkspace(), CLI_DIRECTORIES.BUCKET);
+    const bucketDir = join35(getWorkspace(), CLI_DIRECTORIES.BUCKET);
     const mf = new Miniflare14({
       modules: [
         {
@@ -10891,12 +11299,153 @@ bucketCommand.command("delete <key>").alias("del").alias("rm").description("Dele
   "Environment to use with --remote: staging (default) or production"
 ).action(runBucketDelete);
 
-// src/commands/profiles/index.ts
+// src/commands/secret/index.ts
 import { Command as Command20 } from "commander";
 
+// src/commands/secret/delete.ts
+init_src();
+import { confirm as confirm9 } from "@inquirer/prompts";
+import { Command as Command17 } from "commander";
+var deleteCommand2 = new Command17("delete").description("Delete a game secret").argument("<key>", "Secret key to delete").option("--env <environment>", "Environment (staging or production)").option("-f, --force", "Skip confirmation").action(async (key, options) => {
+  const { env } = options;
+  try {
+    const environment = ensureEnvironment(env);
+    const client = await requireAuthenticatedClient();
+    logger.newLine();
+    const workspace = getWorkspace();
+    const deployedGame = await getDeployedGame(workspace);
+    if (!deployedGame) {
+      logger.admonition("warning", "Deploy First", [
+        `Deploy your game before managing secrets: \`playcademy deploy\``,
+        `For local development, use an \`.env\` file in your project root`
+      ]);
+      logger.newLine();
+      process.exit(1);
+    }
+    const game = await client.games.fetch(deployedGame.gameId);
+    if (!options.force) {
+      const confirmed = await confirm9({
+        message: `Delete secret "${key}" from "${game.slug}" in ${environment}?`,
+        default: false
+      });
+      if (!confirmed) {
+        logger.newLine();
+        logger.remark("Nothing to do");
+        logger.newLine();
+        return;
+      }
+    }
+    await runStep(
+      `Deleting secret from ${environment}`,
+      () => client.dev.games.secrets.delete(game.slug, key),
+      `Secret deleted successfully from ${environment}`
+    );
+    logger.newLine();
+  } catch (error) {
+    logAndExit(error, logger, { prefix: "Failed to delete secret" });
+  }
+});
+
+// src/commands/secret/list.ts
+init_src();
+init_string();
+import { Command as Command18 } from "commander";
+var listCommand2 = new Command18("list").description("List game secret keys").option("--env <environment>", "Environment (staging or production)").action(async (options) => {
+  const { env } = options;
+  try {
+    const environment = ensureEnvironment(env);
+    const client = await requireAuthenticatedClient();
+    logger.newLine();
+    const workspace = getWorkspace();
+    const deployedGame = await getDeployedGame(workspace);
+    if (!deployedGame) {
+      logger.admonition("warning", "Deploy First", [
+        `Deploy your game before managing secrets: \`playcademy deploy\``,
+        `For local development, use an \`.env\` file in your project root`
+      ]);
+      logger.newLine();
+      process.exit(1);
+    }
+    const game = await client.games.fetch(deployedGame.gameId);
+    const keys = await runStep(
+      `Fetching secrets from ${environment}`,
+      () => client.dev.games.secrets.list(game.slug),
+      (keys2) => `Found ${keys2.length} ${pluralize(keys2.length, "secret")}`
+    );
+    if (keys.length === 0) {
+      logger.newLine();
+      logger.remark("No secrets configured");
+      logger.newLine();
+      return;
+    }
+    logger.newLine();
+    keys.forEach((key) => {
+      logger.highlight(key, 1);
+      logger.dim("(value hidden)", 2);
+    });
+    logger.newLine();
+  } catch (error) {
+    logAndExit(error, logger, { prefix: "Failed to list secrets" });
+  }
+});
+
+// src/commands/secret/set.ts
+init_src();
+import { Command as Command19 } from "commander";
+var setCommand = new Command19("set").description("Set or update a game secret").argument("<key>", "Secret key (e.g., STRIPE_KEY)").argument("<value>", "Secret value").option("--env <environment>", "Environment (staging or production)").action(async (key, value, options) => {
+  const { env } = options;
+  try {
+    const environment = ensureEnvironment(env);
+    const client = await requireAuthenticatedClient();
+    logger.newLine();
+    const workspace = getWorkspace();
+    const deployedGame = await getDeployedGame(workspace);
+    if (!deployedGame) {
+      logger.admonition("warning", "Deploy First", [
+        `Deploy your game before managing secrets: \`playcademy deploy\``,
+        `For local development, use an \`.env\` file in your project root`
+      ]);
+      logger.newLine();
+      process.exit(1);
+    }
+    const game = await client.games.fetch(deployedGame.gameId);
+    await runStep(
+      `Setting secret "${key}" in ${environment}`,
+      () => client.dev.games.secrets.set(game.slug, { [key]: value }),
+      `Secret "${key}" set successfully in ${environment}`
+    );
+    logger.newLine();
+  } catch (error) {
+    logAndExit(error, logger, { prefix: "Failed to set secret" });
+  }
+});
+
+// src/commands/secret/index.ts
+var secretCommand = new Command20("secrets").description("Manage game secrets").addCommand(setCommand).addCommand(listCommand2).addCommand(deleteCommand2);
+
+// src/commands/types.ts
+init_src();
+import { Command as Command21 } from "commander";
+var typesCommand = new Command21("types").description("Generate TypeScript type definitions").action(async () => {
+  try {
+    logger.newLine();
+    await runStep(
+      "Generating TypeScript types",
+      () => ensurePlaycademyTypes({ verbose: true }),
+      "Types generated successfully"
+    );
+    logger.newLine();
+  } catch (error) {
+    logAndExit(error, logger, { prefix: "Failed to generate types" });
+  }
+});
+
+// src/commands/profiles/index.ts
+import { Command as Command25 } from "commander";
+
 // src/commands/profiles/list.ts
 init_string();
-import { Command as Command17 } from "commander";
+import { Command as Command22 } from "commander";
 async function listProfilesAction() {
   try {
     const profilesMap = await listProfiles();
@@ -10938,12 +11487,12 @@ async function listProfilesAction() {
     process.exit(1);
   }
 }
-var listCommand2 = new Command17("list").alias("ls").description("List all stored authentication profiles").action(listProfilesAction);
+var listCommand3 = new Command22("list").alias("ls").description("List all stored authentication profiles").action(listProfilesAction);
 
 // src/commands/profiles/remove.ts
 import { bold as bold6 } from "colorette";
-import { Command as Command18 } from "commander";
-var removeCommand = new Command18("remove").alias("rm").description('Remove an authentication profile (defaults to "default")').argument("[name]", "Profile name to remove", "default").option("--env <environment>", "Environment to remove profile from (staging or production)").action(async (name, options) => {
+import { Command as Command23 } from "commander";
+var removeCommand = new Command23("remove").alias("rm").description('Remove an authentication profile (defaults to "default")').argument("[name]", "Profile name to remove", "default").option("--env <environment>", "Environment to remove profile from (staging or production)").action(async (name, options) => {
   const { env } = options;
   const environment = ensureEnvironment(env);
   try {
@@ -10968,9 +11517,9 @@ var removeCommand = new Command18("remove").alias("rm").description('Remove an a
 
 // src/commands/profiles/reset.ts
 init_string();
-import { confirm as confirm9 } from "@inquirer/prompts";
-import { Command as Command19 } from "commander";
-var resetCommand = new Command19("reset").description(
+import { confirm as confirm10 } from "@inquirer/prompts";
+import { Command as Command24 } from "commander";
+var resetCommand = new Command24("reset").description(
   "Remove all authentication profiles across all environments (requires confirmation)"
 ).alias("clear").action(async () => {
   try {
@@ -11006,7 +11555,7 @@ var resetCommand = new Command19("reset").description(
         logger.newLine();
       }
     }
-    const confirmed = await confirm9({
+    const confirmed = await confirm10({
       message: "Are you sure you want to remove all profiles?",
       default: false
     });
@@ -11046,19 +11595,19 @@ var resetCommand = new Command19("reset").description(
 });
 
 // src/commands/profiles/index.ts
-var profilesCommand = new Command20("profiles").description("Manage authentication profiles").action(listProfilesAction);
-profilesCommand.addCommand(listCommand2);
+var profilesCommand = new Command25("profiles").description("Manage authentication profiles").action(listProfilesAction);
+profilesCommand.addCommand(listCommand3);
 profilesCommand.addCommand(removeCommand);
 profilesCommand.addCommand(resetCommand);
 
 // src/commands/timeback/index.ts
-import { Command as Command26 } from "commander";
+import { Command as Command31 } from "commander";
 
 // src/commands/timeback/cleanup.ts
 init_src();
-import { confirm as confirm10 } from "@inquirer/prompts";
-import { Command as Command21 } from "commander";
-var cleanupCommand = new Command21("cleanup").description("Remove TimeBack integration for your game").option(
+import { confirm as confirm11 } from "@inquirer/prompts";
+import { Command as Command26 } from "commander";
+var cleanupCommand = new Command26("cleanup").description("Remove TimeBack integration for your game").option(
   "--env <environment>",
   "Environment to remove TimeBack integration from (staging or production)"
 ).action(async (options) => {
@@ -11080,7 +11629,7 @@ var cleanupCommand = new Command21("cleanup").description("Remove TimeBack integ
       return;
     }
     displayCleanupWarning(integration, game.displayName, logger);
-    const confirmed = await confirm10({
+    const confirmed = await confirm11({
       message: "Are you sure you want to remove TimeBack integration?",
       default: false
     });
@@ -11109,8 +11658,8 @@ var cleanupCommand = new Command21("cleanup").description("Remove TimeBack integ
 });
 
 // src/commands/timeback/init.ts
-import { Command as Command22 } from "commander";
-var initCommand2 = new Command22("init").description("Add TimeBack integration to your project").action(async () => {
+import { Command as Command27 } from "commander";
+var initCommand2 = new Command27("init").description("Add TimeBack integration to your project").action(async () => {
   try {
     logger.newLine();
     const configPath = await findConfigPath().catch(() => {
@@ -11163,8 +11712,8 @@ var initCommand2 = new Command22("init").description("Add TimeBack integration t
 
 // src/commands/timeback/setup.ts
 init_src();
-import { Command as Command23 } from "commander";
-var setupCommand = new Command23("setup").description("Set up TimeBack integration for your game").option("--dry-run", "Validate configuration without creating resources").option("--verbose, -v", "Output detailed information").option(
+import { Command as Command28 } from "commander";
+var setupCommand = new Command28("setup").description("Set up TimeBack integration for your game").option("--dry-run", "Validate configuration without creating resources").option("--verbose, -v", "Output detailed information").option(
   "--env <environment>",
   "Environment to set up TimeBack integration in (staging or production)"
 ).action(async (options) => {
@@ -11256,10 +11805,10 @@ var setupCommand = new Command23("setup").description("Set up TimeBack integrati
 // src/commands/timeback/update.ts
 init_src();
 init_string();
-import { confirm as confirm11 } from "@inquirer/prompts";
+import { confirm as confirm12 } from "@inquirer/prompts";
 import { green as green4, red as red3 } from "colorette";
-import { Command as Command24 } from "commander";
-var updateCommand = new Command24("update").description("Update TimeBack integration configuration for your game").option("--verbose, -v", "Output detailed information").option(
+import { Command as Command29 } from "commander";
+var updateCommand = new Command29("update").description("Update TimeBack integration configuration for your game").option("--verbose, -v", "Output detailed information").option(
   "--env <environment>",
   "Environment to update TimeBack integration in (staging or production)"
 ).action(async (options) => {
@@ -11337,7 +11886,7 @@ var updateCommand = new Command24("update").description("Update TimeBack integra
       logger.data(change.label, `${red3(change.current)} \u2192 ${green4(change.next)}`, 1);
     }
     logger.newLine();
-    const confirmed = await confirm11({
+    const confirmed = await confirm12({
       message: `Update ${changeDetails.length} ${pluralize(changeDetails.length, "field")} in TimeBack?`,
       default: false
     });
@@ -11377,8 +11926,8 @@ var updateCommand = new Command24("update").description("Update TimeBack integra
 
 // src/commands/timeback/verify.ts
 init_src();
-import { Command as Command25 } from "commander";
-var verifyCommand = new Command25("verify").description("Verify TimeBack integration for your game").option("--verbose, -v", "Output detailed resource information").option(
+import { Command as Command30 } from "commander";
+var verifyCommand = new Command30("verify").description("Verify TimeBack integration for your game").option("--verbose, -v", "Output detailed resource information").option(
   "--env <environment>",
   "Environment to verify TimeBack integration in (staging or production)"
 ).action(async (options) => {
@@ -11428,7 +11977,7 @@ var verifyCommand = new Command25("verify").description("Verify TimeBack integra
 });
 
 // src/commands/timeback/index.ts
-var timebackCommand = new Command26("timeback").description(
+var timebackCommand = new Command31("timeback").description(
   "TimeBack integration management"
 );
 timebackCommand.addCommand(initCommand2);
@@ -11438,15 +11987,15 @@ timebackCommand.addCommand(verifyCommand);
 timebackCommand.addCommand(cleanupCommand);
 
 // src/commands/debug/index.ts
-import { Command as Command28 } from "commander";
+import { Command as Command33 } from "commander";
 
 // src/commands/debug/bundle.ts
 init_src();
 init_constants2();
-import { writeFileSync as writeFileSync10 } from "fs";
-import { join as join34 } from "path";
-import { Command as Command27 } from "commander";
-var bundleCommand = new Command27("bundle").description("Bundle and inspect the game backend worker code (for debugging)").option("-o, --output <path>", "Output file path", CLI_DEFAULT_OUTPUTS.WORKER_BUNDLE).option("--minify", "Minify the output").option("--sourcemap", "Include source maps").action(async (options) => {
+import { writeFileSync as writeFileSync11 } from "fs";
+import { join as join36 } from "path";
+import { Command as Command32 } from "commander";
+var bundleCommand = new Command32("bundle").description("Bundle and inspect the game backend worker code (for debugging)").option("-o, --output <path>", "Output file path", CLI_DEFAULT_OUTPUTS.WORKER_BUNDLE).option("--minify", "Minify the output").option("--sourcemap", "Include source maps").action(async (options) => {
   try {
     const workspace = getWorkspace();
     logger.newLine();
@@ -11474,8 +12023,8 @@ var bundleCommand = new Command27("bundle").description("Bundle and inspect the
       }),
       (result) => `Bundled ${formatSize(result.code.length)}`
     );
-    const outputPath = join34(workspace, options.output);
-    writeFileSync10(outputPath, bundle.code, "utf-8");
+    const outputPath = join36(workspace, options.output);
+    writeFileSync11(outputPath, bundle.code, "utf-8");
     logger.success(`Bundle saved to ${options.output}`);
     logger.newLine();
     logger.highlight("Bundle Analysis");
@@ -11515,7 +12064,7 @@ var bundleCommand = new Command27("bundle").description("Bundle and inspect the
 });
 
 // src/commands/debug/index.ts
-var debugCommand = new Command28("debug").description("Debug and inspect game builds").addCommand(bundleCommand);
+var debugCommand = new Command33("debug").description("Debug and inspect game builds").addCommand(bundleCommand);
 
 // src/index.ts
 var __dirname = dirname5(fileURLToPath3(import.meta.url));
@@ -11534,6 +12083,8 @@ program.addCommand(apiCommand);
 program.addCommand(dbCommand);
 program.addCommand(kvCommand);
 program.addCommand(bucketCommand);
+program.addCommand(secretCommand);
+program.addCommand(typesCommand);
 program.addCommand(gamesCommand);
 program.addCommand(deployCommand);
 program.addCommand(timebackCommand);