playcademy 0.16.3 → 0.16.5

package/dist/cli.js

@@ -653,7 +653,7 @@ function setupGlobalErrorHandlers() {
 import { execSync as execSync5 } from "child_process";
 import { writeFileSync as writeFileSync10 } from "fs";
 import { resolve as resolve7 } from "path";
-import { confirm as confirm4 } from "@inquirer/prompts";
+import { confirm as confirm5 } from "@inquirer/prompts";
 
 // ../utils/src/ansi.ts
 var colors = {
@@ -2965,7 +2965,7 @@ import { join as join13 } from "path";
 // package.json with { type: 'json' }
 var package_default2 = {
   name: "playcademy",
-  version: "0.16.2",
+  version: "0.16.4",
   type: "module",
   exports: {
     ".": {
@@ -3448,6 +3448,16 @@ function hasLocalCustomRoutes(projectPath, config) {
   return existsSync13(customRoutesDir);
 }
 
+// src/lib/deploy/hash.ts
+init_file_loader();
+
+// src/lib/secrets/diff.ts
+import { green as green3, red as red3, yellow as yellow4 } from "colorette";
+
+// src/lib/secrets/sync.ts
+import { confirm as confirm4 } from "@inquirer/prompts";
+import { bold as bold5 } from "colorette";
+
 // src/lib/init/bucket.ts
 function hasBucketSetup(config) {
   return !!config.integrations?.bucket;
@@ -3725,7 +3735,7 @@ async function runInit(options = {}) {
         `Configuration file already exists: ${relativePath}`
       ]);
       logger.newLine();
-      const shouldOverwrite = await confirm4({
+      const shouldOverwrite = await confirm5({
         message: "Do you want to overwrite it?",
         default: false
       });

package/dist/constants/src/workers.ts

@@ -19,3 +19,18 @@ export const WORKER_NAMING = {
     /** Suffix for staging worker hostnames (e.g., "bamboo-staging.playcademy.gg") */
     STAGING_SUFFIX: '-staging',
 } as const
+
+/**
+ * Prefix for user-defined secrets in Cloudflare Worker bindings.
+ *
+ * Cloudflare bindings are flat, so we namespace user secrets with this prefix
+ * to distinguish them from platform bindings (like GAME_ID, PLAYCADEMY_API_KEY).
+ *
+ * Usage:
+ * - When setting secrets: `bindings[SECRETS_PREFIX + key] = value`
+ * - When reading secrets: strip prefix and expose as `c.env.secrets.KEY`
+ *
+ * @see reconstructSecrets in edge-play/entry/setup.ts
+ * @see prefixSecrets in edge-play/entry/setup.ts
+ */
+export const SECRETS_PREFIX = 'secrets_'

package/dist/db.d.ts

@@ -63,6 +63,7 @@ interface SeedWorkerBundle {
  * - Imports the user's seed function from the specified path
  * - Captures console output (log/warn/error/info) with timestamps
  * - Parses D1/SQLite errors into structured details
+ * - Reconstructs secrets from env bindings (secrets_KEY -> c.env.secrets.KEY)
  * - Returns success/error as JSON with logs and timing
  *
  * @param seedFilePath - Absolute path to user's seed file

package/dist/db.js

@@ -436,13 +436,9 @@ async function getParseD1ErrorSource() {
 function createLogCapture(startTime) {
   const logs = [];
   const originalConsole = {
-    // eslint-disable-next-line no-console
     log: console.log.bind(console),
-    // eslint-disable-next-line no-console
     warn: console.warn.bind(console),
-    // eslint-disable-next-line no-console
     error: console.error.bind(console),
-    // eslint-disable-next-line no-console
     info: console.info.bind(console)
   };
   const isSilent = typeof process !== "undefined" && typeof process.env !== "undefined" && process.env.LOG_SILENT === "true";
@@ -502,12 +498,26 @@ function buildErrorResponse(error, logs, duration, details) {
     duration
   };
 }
+function reconstructSecrets(env) {
+  const secrets = {};
+  const prefix = "secrets_";
+  for (const key of Object.keys(env)) {
+    if (key.startsWith(prefix)) {
+      const secretKey = key.slice(prefix.length);
+      secrets[secretKey] = env[key];
+    }
+  }
+  return secrets;
+}
 function createSeedFetchHandler(seedFn, parseD1ErrorFn) {
   return async function fetch(req, env, ctx) {
     const startTime = Date.now();
     const { logs, restore } = createLogCapture(startTime);
     try {
-      const c = { env, ctx, req };
+      const envRecord = env;
+      const secrets = reconstructSecrets(envRecord);
+      const enrichedEnv = { ...envRecord, secrets };
+      const c = { env: enrichedEnv, ctx, req };
       await seedFn(c);
       const duration = Date.now() - startTime;
       restore();
@@ -529,6 +539,9 @@ async function getBuildSuccessResponseSource() {
 async function getBuildErrorResponseSource() {
   return transpileTypeScript(buildErrorResponse.toString());
 }
+async function getReconstructSecretsSource() {
+  return transpileTypeScript(reconstructSecrets.toString());
+}
 async function getCreateSeedFetchHandlerSource() {
   return transpileTypeScript(createSeedFetchHandler.toString());
 }
@@ -540,12 +553,14 @@ async function createSeedWorkerEntry(seedFilePath) {
     createLogCaptureSource,
     buildSuccessResponseSource,
     buildErrorResponseSource,
+    reconstructSecretsSource,
     createSeedFetchHandlerSource
   ] = await Promise.all([
     getParseD1ErrorSource(),
     getCreateLogCaptureSource(),
     getBuildSuccessResponseSource(),
     getBuildErrorResponseSource(),
+    getReconstructSecretsSource(),
     getCreateSeedFetchHandlerSource()
   ]);
   return `import { seed } from '${seedFilePath}'
@@ -558,6 +573,8 @@ ${buildSuccessResponseSource}
 
 ${buildErrorResponseSource}
 
+${reconstructSecretsSource}
+
 ${createSeedFetchHandlerSource}
 
 export default { fetch: createSeedFetchHandler(seed, parseD1Error) }

package/dist/edge-play/src/entry/setup.ts

@@ -4,6 +4,8 @@
  * Helper functions for preparing the Worker environment
  */
 
+import { SECRETS_PREFIX } from '@playcademy/constants'
+
 import { ENV_VARS } from '../constants'
 
 import type { ServerEnv } from '../types'
@@ -20,17 +22,21 @@ export function populateProcessEnv(env: ServerEnv): void {
 }
 
 /**
- * Reconstruct secrets object from flat Cloudflare bindings
+ * Reconstruct secrets object from flat Cloudflare bindings.
  *
  * Cloudflare bindings are flat (secrets_KEY_NAME), but we expose them
  * as c.env.secrets.KEY_NAME for better developer ergonomics.
+ *
+ * @param env - Raw Cloudflare Worker environment bindings
+ * @returns Object with secrets keyed by their original names (without prefix)
  */
 export function reconstructSecrets(env: Record<string, unknown>): Record<string, string> {
     const secrets: Record<string, string> = {}
+    const prefixLength = SECRETS_PREFIX.length
 
     for (const key in env) {
-        if (key.startsWith('secrets_')) {
-            const secretKey = key.slice(8) // Remove 'secrets_' prefix
+        if (key.startsWith(SECRETS_PREFIX)) {
+            const secretKey = key.slice(prefixLength)
             secrets[secretKey] = env[key] as string
         }
     }
@@ -38,6 +44,25 @@ export function reconstructSecrets(env: Record<string, unknown>): Record<string,
     return secrets
 }
 
+/**
+ * Add the secrets prefix to a record of secrets.
+ *
+ * Use this when setting up Cloudflare Worker bindings to namespace
+ * user secrets separately from platform bindings.
+ *
+ * @param secrets - Record of secret key-value pairs
+ * @returns Record with prefixed keys (secrets_KEY)
+ */
+export function prefixSecrets(secrets: Record<string, string>): Record<string, string> {
+    const prefixed: Record<string, string> = {}
+
+    for (const [key, value] of Object.entries(secrets)) {
+        prefixed[SECRETS_PREFIX + key] = value
+    }
+
+    return prefixed
+}
+
 /**
  * Setup process global polyfill for SDK compatibility
  *

package/dist/index.d.ts

@@ -882,6 +882,21 @@ type ExternalGame = BaseGame & {
 };
 type Game = HostedGame | ExternalGame;
 
+/**
+ * Secrets Diff Utilities
+ *
+ * Computes and displays differences between local and remote secrets
+ */
+/**
+ * Represents the diff between local and remote secrets
+ */
+interface SecretsDiff {
+    added: string[];
+    updated: string[];
+    unchanged: string[];
+    removed: string[];
+}
+
 /**
  * Integration-related types
  */
@@ -964,6 +979,7 @@ interface DeployedGameInfo {
     schemaSnapshot?: unknown;
     integrationKeys?: string[];
     integrationsHash?: string;
+    secretsHashes?: Record<string, string>;
 }
 interface GameStore {
     /** Staging environment game deployments, keyed by absolute project path */
@@ -1003,6 +1019,8 @@ interface DeploymentContext {
     previousResources?: string[];
     previousIntegrationKeys?: string[];
     previousIntegrationsHash?: string;
+    localSecrets?: Record<string, string>;
+    remoteSecretKeys?: string[];
     isDryRun: boolean;
     deployBackend: boolean;
     forceBackend: boolean;
@@ -1022,6 +1040,7 @@ interface DeploymentChanges {
         changes: IntegrationConfigChange[];
     }>;
     schema?: boolean;
+    secrets?: SecretsDiff;
 }
 /**
  * Plan for what needs to be deployed
@@ -1259,6 +1278,7 @@ interface DeploymentDiffOptions {
     build?: BuildDiff;
     backend?: BackendDiff;
     integrations?: IntegrationsDiff;
+    secrets?: SecretsDiff;
 }
 
 /**
@@ -1542,6 +1562,7 @@ interface ProjectDirectoryInfo {
  *
  * Options for secret management CLI commands.
  */
+
 /**
  * Base options shared by all secret commands.
  */
@@ -1550,19 +1571,79 @@ interface SecretCommandOptions {
     env?: string;
 }
 /**
- * Options for the `secret set` command.
+ * Options for the `secrets list` command.
  */
-type SecretSetOptions = SecretCommandOptions;
+type SecretListOptions = SecretCommandOptions;
 /**
- * Options for the `secret list` command.
+ * Options for the `secrets push` command.
  */
-type SecretListOptions = SecretCommandOptions;
+type SecretPushOptions = SecretCommandOptions;
 /**
- * Options for the `secret delete` command.
+ * Options for checking secrets sync status.
  */
-interface SecretDeleteOptions extends SecretCommandOptions {
-    /** Skip confirmation prompt */
-    force?: boolean;
+interface SecretsSyncOptions {
+    /** Absolute path to the project workspace */
+    workspace: string;
+    /** Project/game slug */
+    gameSlug: string;
+    /** Target environment (staging or production) */
+    environment: string;
+    /** Authenticated API client */
+    client: PlaycademyClient;
+    /** Cached hashes from last push (for accurate diff) */
+    cachedHashes?: Record<string, string>;
+}
+/**
+ * Options for checking and prompting secrets sync.
+ */
+interface CheckSecretsOptions extends SecretsSyncOptions {
+    /**
+     * Context for the sync check - affects messaging
+     * - 'blocking': Used before operations that require secrets (e.g., db seed)
+     *   Shows error on decline, returns cancelled state
+     * - 'optional': Used after operations complete (e.g., deploy)
+     *   Shows remark on decline, non-blocking
+     */
+    mode: 'blocking' | 'optional';
+}
+/**
+ * A missing secret required by an integration.
+ */
+interface MissingSecret {
+    /** The secret key that's missing */
+    key: string;
+    /** The integration that requires it */
+    integration: string;
+    /** Documentation URL for the integration */
+    docs: string;
+}
+/**
+ * Result from checking secrets sync status.
+ */
+interface SecretsSyncResult {
+    /** Local secrets from .env file */
+    localSecrets: Record<string, string>;
+    /** Whether secrets were synced (or already in sync) */
+    synced: boolean;
+    /** Whether user cancelled the operation */
+    cancelled: boolean;
+}
+/**
+ * Options for applying secret changes to remote.
+ */
+interface ApplySecretsOptions {
+    /** The computed diff to apply */
+    diff: SecretsDiff;
+    /** Local secrets with values (needed for setting secrets) */
+    localSecrets: Record<string, string>;
+    /** Game slug for API calls */
+    gameSlug: string;
+    /** Authenticated API client */
+    client: PlaycademyClient;
+    /** Environment name for display */
+    environment: string;
+    /** Workspace path for saving hashes */
+    workspace: string;
 }
 
-export type { ApiConfig, ApiErrorResponse, ApiKeyListItem, ApiKeyWithSecret, ApiRequestOptions, AuthProfile, AuthStore, AuthStrategy, BackendBundle, BackendDeploymentMetadata, BackendDiff, BackendFeatures, BaseKVOptions, BucketBulkOptions, BucketDeleteOptions, BucketGetOptions, BucketListOptions, BucketPutOptions, BuildDiff, BulkCollectionResult, BundleOptions, CallbackServerResult, CollectedFile, ComponentConfig, ComponentResourceConfig, ConfigDiff, CreateApiKeyResponse, CustomRoutesIntegrationOptions, DatabaseIntegrationOptions, DeployConfig, DeployNewGameOptions, DeployedGameInfo, DeploymentChanges, DeploymentContext, DeploymentDiffOptions, DeploymentPlan, DeploymentResult, DevServerOptions, EmbeddedSourcePaths, EngineConfig, EngineType, EnvironmentAuthProfiles, GameStore, IntegrationChangeDetector, IntegrationChangeDetectors, IntegrationConfigChange, IntegrationsConfig, IntegrationsDiff, KVClearOptions, KVDeleteOptions, KVGetOptions, KVInspectOptions, KVListOptions, KVSeedOptions, KVSetOptions, KVStatsOptions, KeyMetadata, KeyStats, LoadConfigResult, LogEntry, LogStreamConfig, LogStreamUrlOptions, LoginCredentials, LoginResponse, OrganizationConfig, PlaycademyConfig, PluginLogger, PreviewOptions, PreviewResponse, ProjectDirectoryInfo, ResourceConfig, ScaffoldResult, SecretCommandOptions, SecretDeleteOptions, SecretListOptions, SecretSetOptions, SignInResponse, SsoCallbackData, Template, TemplateFramework, TemplateHook, TemplateHookOptions, TemplateSource, TimebackBaseConfig, TimebackCourseConfig, TimebackCourseConfigWithOverrides, TimebackGrade, TimebackIntegrationConfig, TimebackSourcedIds, TimebackSubject, TokenType, UpdateExistingGameOptions };
+export type { ApiConfig, ApiErrorResponse, ApiKeyListItem, ApiKeyWithSecret, ApiRequestOptions, ApplySecretsOptions, AuthProfile, AuthStore, AuthStrategy, BackendBundle, BackendDeploymentMetadata, BackendDiff, BackendFeatures, BaseKVOptions, BucketBulkOptions, BucketDeleteOptions, BucketGetOptions, BucketListOptions, BucketPutOptions, BuildDiff, BulkCollectionResult, BundleOptions, CallbackServerResult, CheckSecretsOptions, CollectedFile, ComponentConfig, ComponentResourceConfig, ConfigDiff, CreateApiKeyResponse, CustomRoutesIntegrationOptions, DatabaseIntegrationOptions, DeployConfig, DeployNewGameOptions, DeployedGameInfo, DeploymentChanges, DeploymentContext, DeploymentDiffOptions, DeploymentPlan, DeploymentResult, DevServerOptions, EmbeddedSourcePaths, EngineConfig, EngineType, EnvironmentAuthProfiles, GameStore, IntegrationChangeDetector, IntegrationChangeDetectors, IntegrationConfigChange, IntegrationsConfig, IntegrationsDiff, KVClearOptions, KVDeleteOptions, KVGetOptions, KVInspectOptions, KVListOptions, KVSeedOptions, KVSetOptions, KVStatsOptions, KeyMetadata, KeyStats, LoadConfigResult, LogEntry, LogStreamConfig, LogStreamUrlOptions, LoginCredentials, LoginResponse, MissingSecret, OrganizationConfig, PlaycademyConfig, PluginLogger, PreviewOptions, PreviewResponse, ProjectDirectoryInfo, ResourceConfig, ScaffoldResult, SecretCommandOptions, SecretListOptions, SecretPushOptions, SecretsSyncOptions, SecretsSyncResult, SignInResponse, SsoCallbackData, Template, TemplateFramework, TemplateHook, TemplateHookOptions, TemplateSource, TimebackBaseConfig, TimebackCourseConfig, TimebackCourseConfigWithOverrides, TimebackGrade, TimebackIntegrationConfig, TimebackSourcedIds, TimebackSubject, TokenType, UpdateExistingGameOptions };