wlmaker 1.8.1 → 1.9.0

package/dist/cli.mjs

@@ -47,10 +47,10 @@ import {
 
 // src/cli.ts
 import { createRequire } from "module";
-import * as fs24 from "fs";
+import * as fs30 from "fs";
 import { Command } from "commander";
-import chalk26 from "chalk";
-import { z as z3 } from "zod";
+import chalk27 from "chalk";
+import { z as z4 } from "zod";
 
 // src/generators/bloc/generator.ts
 import * as fs from "fs";
@@ -491,48 +491,85 @@ function knobForProp(p) {
       return `(context.knobs.string(label: '${p.name}', initialValue: '') ?? '') // TODO: nullable, review requirements`;
   }
 }
-function useCaseTemplate(name, pascal2, tierPlural2, tier, properties, hasVariants) {
+function useCaseTemplate(name, pascal2, tierPlural2, tier, properties, variantNames = [], includeSkeleton = false) {
   const isTemplate = tier === "template";
   const className = isTemplate && !pascal2.endsWith("Template") ? `Wl${pascal2}Template` : `Wl${pascal2}`;
+  const hasKnobs = properties.length > 0;
+  const hasVariants = variantNames.length > 1;
   const knobs = properties.map((p) => {
     const camel = propNameToCamel(p.name);
     return `  final ${camel} = ${knobForProp(p)};`;
   }).join("\n");
-  const i18nArgs = properties.map((p) => {
+  const propArgs = properties.map((p) => {
     const camel = propNameToCamel(p.name);
     return `        ${camel}: ${camel},`;
   }).join("\n");
-  let widgetCall;
-  if (isTemplate && properties.length > 0) {
-    widgetCall = `${className}(
+  function factoryCall(factoryName) {
+    if (isTemplate && properties.length > 0) {
+      return `${className}.${factoryName}(
       i18n: Wl${pascal2}I18n(
-${i18nArgs}
+${propArgs}
       ),
     )`;
-  } else if (properties.length > 0) {
-    widgetCall = `${className}(
-${i18nArgs}
+    }
+    if (properties.length > 0) {
+      return `${className}.${factoryName}(
+${propArgs}
       )`;
+    }
+    return `${className}.${factoryName}()`;
+  }
+  function defaultCall() {
+    if (isTemplate && properties.length > 0) {
+      return `${className}(
+      i18n: Wl${pascal2}I18n(
+${propArgs}
+      ),
+    )`;
+    }
+    if (properties.length > 0) {
+      return `${className}(
+${propArgs}
+      )`;
+    }
+    return `const ${className}()`;
+  }
+  const orderedVariants = hasVariants ? [
+    ...variantNames.filter((v) => v === "defaultVariant"),
+    ...variantNames.filter((v) => v !== "defaultVariant")
+  ] : [];
+  const childrenLines = [];
+  if (hasVariants) {
+    for (const v of orderedVariants) {
+      childrenLines.push(`      ${factoryCall(v)},`);
+    }
   } else {
-    widgetCall = `const ${className}()`;
+    childrenLines.push(`      ${defaultCall()},`);
+  }
+  if (includeSkeleton) {
+    childrenLines.push(`      ${factoryCall("skeleton")},`);
   }
+  const children = childrenLines.join("\n");
+  const knobBlock = hasKnobs ? `${knobs}
+
+` : "";
+  const widgetbookImport = hasKnobs ? `import 'package:widgetbook/widgetbook.dart';
+` : "";
+  const useCasePath = `wl_design_system/${tierPlural2}`;
   return `import 'package:design_system/design_system.dart';
 import 'package:flutter/material.dart';
-import 'package:widgetbook/widgetbook.dart';
-import 'package:widgetbook_annotation/widgetbook_annotation.dart' as widgetbook;
+${widgetbookImport}import 'package:widgetbook_annotation/widgetbook_annotation.dart' as widgetbook;
 
 @widgetbook.UseCase(
   name: '.default',
   type: ${className},
-  path: 'wl_design_system/${tierPlural2}/wl_${name}',
+  path: '${useCasePath}',
 )
 Widget useCase${className}(BuildContext context) {
-${knobs}
-
-  return ListView(
+${knobBlock}  return ListView(
     padding: const EdgeInsets.all(16),
     children: [
-      ${widgetCall},
+${children}
     ],
   );
 }
@@ -733,7 +770,8 @@ async function createUseCase(name, tierInput, options) {
     ds.widgetbookDir,
     "lib",
     "usecases",
-    "wl_design_system"
+    "wl_design_system",
+    plural
   );
   if (!fs3.existsSync(useCasesDir)) {
     fs3.mkdirSync(useCasesDir, { recursive: true });
@@ -750,12 +788,13 @@ async function createUseCase(name, tierInput, options) {
       plural,
       tier,
       options.properties ?? [],
-      options.hasVariants ?? false
+      options.variantNames ?? [],
+      options.includeSkeleton ?? false
     )
   );
   console.log(
     chalk3.green(
-      `Use-case for "Wl${pascal2}" created in widgetbook/lib/usecases/wl_design_system/`
+      `Use-case for "Wl${pascal2}" created in widgetbook/lib/usecases/wl_design_system/${plural}/`
     )
   );
   if (options.buildRunner) {
@@ -909,8 +948,8 @@ function extractPackageName(pagesPath) {
 }
 
 // src/flows/main-menu.ts
-import * as clack12 from "@clack/prompts";
-import chalk25 from "chalk";
+import * as clack13 from "@clack/prompts";
+import chalk26 from "chalk";
 
 // src/flows/project-resolver.ts
 import * as fs5 from "fs";
@@ -1072,7 +1111,7 @@ import * as fs8 from "fs";
 import * as path8 from "path";
 import * as clack4 from "@clack/prompts";
 import chalk8 from "chalk";
-import { snakeCase as snakeCase2 } from "change-case";
+import { snakeCase as snakeCase2, pascalCase as pascalCase6 } from "change-case";
 
 // src/shared/json-editor.ts
 import * as fs7 from "fs";
@@ -1217,8 +1256,8 @@ function validateAndParse(schema, content) {
     clack3.log.error("Errores de validaci\xF3n:");
     if (error instanceof z.ZodError) {
       for (const issue of error.issues) {
-        const path24 = issue.path.length > 0 ? issue.path.join(".") : "(root)";
-        clack3.log.warn(`  \u2022 ${path24}: ${issue.message}`);
+        const path27 = issue.path.length > 0 ? issue.path.join(".") : "(root)";
+        clack3.log.warn(`  \u2022 ${path27}: ${issue.message}`);
       }
     } else {
       clack3.log.warn(`  \u2022 ${error}`);
@@ -1304,33 +1343,109 @@ var WidgetJsonSchema = z2.object({
 import { pascalCase as pascalCase5, snakeCase } from "change-case";
 
 // src/generators/widget/component-ref-aliases.ts
+var BUTTON_DROP = [
+  "showTrailingIcon",
+  "showLeadingIcon",
+  "state",
+  "type"
+];
+var BUTTON_PROP_MAP = { label: "text" };
+var BUTTON_VARIANT_MAP = {
+  Primary: "primary",
+  Secondary: "secondary",
+  Tertiary: "tertiary"
+};
+var BUTTON_SIZE_RE = /^WlButton(Primary|Secondary|Tertiary)(?:\.(xs|sm|md|lg))?$/i;
 var COMPONENT_REF_ALIASES = {
   "WlButtonPrimary.xs": {
     component: "WlButton.primary",
-    props: { label: "text" },
-    dropProps: ["showTrailingIcon", "showLeadingIcon", "state", "type"],
-    extraProps: { buttonSize: "ButtonSize.xs" }
+    props: { ...BUTTON_PROP_MAP },
+    dropProps: [...BUTTON_DROP],
+    extraProps: { buttonSize: "ButtonSize.xs" },
+    mapLoadingState: true
   },
   WlButtonPrimary: {
     component: "WlButton.primary",
-    props: { label: "text" },
-    dropProps: ["showTrailingIcon", "showLeadingIcon", "state", "type"]
+    props: { ...BUTTON_PROP_MAP },
+    dropProps: [...BUTTON_DROP],
+    mapLoadingState: true
+  },
+  "WlInputs.textfield": {
+    component: "WlInputText",
+    dropProps: ["state"],
+    mapLoadingState: true,
+    mapStateToLabel: true,
+    // Stub so generated gallery code analyzes; hoist to parent in real widgets
+    extraProps: { controller: "TextEditingController()" },
+    todoComment: "// TODO: hoist TextEditingController to parent (created inline for preview)"
+  },
+  "WlInputs.Textfield": {
+    component: "WlInputText",
+    dropProps: ["state"],
+    mapLoadingState: true,
+    mapStateToLabel: true,
+    extraProps: { controller: "TextEditingController()" },
+    todoComment: "// TODO: hoist TextEditingController to parent (created inline for preview)"
+  },
+  "WlSkeleton.brick": {
+    component: "WlSkeleton"
   }
 };
+function resolveButtonPattern(rawComponent) {
+  const match = BUTTON_SIZE_RE.exec(rawComponent);
+  if (!match) return null;
+  const normalized = Object.keys(BUTTON_VARIANT_MAP).find(
+    (k) => k.toLowerCase() === match[1].toLowerCase()
+  ) ?? match[1];
+  const factory = BUTTON_VARIANT_MAP[normalized];
+  if (!factory) return null;
+  const size = match[2]?.toLowerCase();
+  const alias = {
+    component: `WlButton.${factory}`,
+    props: { ...BUTTON_PROP_MAP },
+    dropProps: [...BUTTON_DROP],
+    mapLoadingState: true
+  };
+  if (size) {
+    alias.extraProps = { buttonSize: `ButtonSize.${size}` };
+  }
+  return alias;
+}
+function lookupAlias(rawComponent) {
+  const exact = COMPONENT_REF_ALIASES[rawComponent];
+  if (exact) return exact;
+  return resolveButtonPattern(rawComponent);
+}
+function isLoadingState(value) {
+  if (!value) return false;
+  const cleaned = value.replace(/^['"]|['"]$/g, "").trim();
+  return /^loading$/i.test(cleaned);
+}
 function resolveComponentRef(rawComponent, rawProps) {
-  const alias = COMPONENT_REF_ALIASES[rawComponent];
+  const alias = lookupAlias(rawComponent);
   if (!alias) {
     return { component: rawComponent, props: { ...rawProps ?? {} } };
   }
   const drop = new Set(alias.dropProps ?? []);
   const propMap = alias.props ?? {};
   const props = { ...alias.extraProps ?? {} };
+  const stateValue = rawProps?.state;
+  if (alias.mapLoadingState && isLoadingState(stateValue)) {
+    props.isLoading = "true";
+  } else if (alias.mapStateToLabel && stateValue) {
+    props.label = stateValue.includes("'") || stateValue.includes('"') ? stateValue : `'${stateValue}'`;
+  }
   for (const [key, value] of Object.entries(rawProps ?? {})) {
     if (drop.has(key)) continue;
+    if (key === "state" && alias.mapLoadingState) continue;
     const mappedKey = propMap[key] ?? key;
     props[mappedKey] = value;
   }
-  return { component: alias.component, props };
+  return {
+    component: alias.component,
+    props,
+    todoComment: alias.todoComment
+  };
 }
 
 // src/generators/widget/dart-emitter.ts
@@ -1380,7 +1495,7 @@ function normalizeTier2(tier) {
   if (VALID_TIERS.includes(t)) return t;
   return "molecule";
 }
-function generateWidgetCode(json) {
+function generateWidgetCode(json, options) {
   const rawName = json.componentName.replace(/^Wl/, "");
   const name = snakeCase(rawName);
   const pascal2 = pascalCase5(rawName);
@@ -1388,6 +1503,7 @@ function generateWidgetCode(json) {
   const tier = normalizeTier2(json.tier);
   const isTemplate = tier === "template";
   const isSkeleton = json.mode === "skeleton";
+  const includeSkeleton = options?.includeSkeleton === true || isTemplate;
   const hasTextProps = json.properties.some((p) => p.type === "text" && p.name);
   const hasMultipleVariants = json.variants.length > 1;
   const pattern = isTemplate ? "subdirectory-show" : "single";
@@ -1430,14 +1546,14 @@ function generateWidgetCode(json) {
     parentFlex: null
   };
   if (isSkeleton) {
-    const skeleton2 = emitSkeletonFile(name, pascal2);
-    return { main: "", skeleton: skeleton2, tier, pattern };
+    const tree = json.variants[0]?.widget;
+    const skeleton = emitSkeletonFile(name, pascal2, tree);
+    return { main: "", skeleton, tier, pattern };
   }
-  const main = emitMainFile(name, pascal2, json, ctx, tier);
+  const main = emitMainFile(name, pascal2, json, ctx, tier, includeSkeleton);
   const variant = isTemplate && hasMultipleVariants ? emitVariantFile(name, pascal2, json) : void 0;
   const i18n = isTemplate && hasTextProps ? emitI18nFile(name, pascal2, json) : void 0;
-  const skeleton = isTemplate && isSkeleton ? emitSkeletonFile(name, pascal2) : void 0;
-  return { main, variant, i18n, skeleton, tier, pattern };
+  return { main, variant, i18n, skeleton: void 0, tier, pattern };
 }
 function placeholderJson() {
   return JSON.stringify({
@@ -1475,13 +1591,15 @@ function placeholderJson() {
     ]
   }, null, 2);
 }
-function emitMainFile(name, pascal2, json, ctx, tier) {
+function emitMainFile(name, pascal2, json, ctx, tier, includeSkeleton) {
   const isTemplate = tier === "template";
   const hasMultipleVariants = json.variants.length > 1;
   const hasI18n = isTemplate && json.properties.some((p) => p.type === "text");
   const parts = [];
-  if (isTemplate) {
+  if (includeSkeleton) {
     parts.push(`part 'wl_${name}_skeleton.dart';`);
+  }
+  if (isTemplate) {
     if (hasMultipleVariants) parts.push(`part 'wl_${name}_variant.dart';`);
     if (hasI18n) parts.push(`part 'wl_${name}_i18n.dart';`);
   }
@@ -1494,25 +1612,40 @@ function emitMainFile(name, pascal2, json, ctx, tier) {
     if (!isTemplate) {
       variantEnumCode = emitVariantEnumInline(name, pascal2, json);
     }
-    const variantNames = json.variants.map((v) => normalizeVariantName(v.name, pascal2));
+    const variantNames = json.variants.map(
+      (v) => normalizeVariantName(v.name, pascal2, v.variantProps)
+    );
+    const defaultVariantName = variantNames.find((v) => v === "defaultVariant") ?? variantNames[0];
     const factories = variantNames.map(
       (vn) => `  factory ${ctx.componentName}.${vn}({
-    ${isTemplate ? "required Wl" + pascal2 + "I18n i18n,\n    " : ""}${emitFactoryParams(otherProps)}    Key? key,
+    ${isTemplate ? "required Wl" + pascal2 + "I18n i18n,\n    " : ""}${emitFactoryParams(otherProps)}${includeSkeleton ? "    bool isLoading = false,\n" : ""}    Key? key,
   }) {
     return ${ctx.componentName}._(
       key: key,
-      variant: ${ctx.componentName}Variant.${vn},${isTemplate ? "\n      i18n: i18n," : ""}
+      variant: ${ctx.componentName}Variant.${vn},${isTemplate ? "\n      i18n: i18n," : ""}${includeSkeleton ? "\n      isLoading: isLoading," : ""}
 ${emitFactoryArgs(otherProps)}
     );
   }`
     ).join("\n\n");
+    const skeletonFactory = includeSkeleton ? `
+
+  factory ${ctx.componentName}.skeleton({
+    ${isTemplate ? "required Wl" + pascal2 + "I18n i18n,\n    " : ""}    Key? key,
+  }) {
+    return ${ctx.componentName}._(
+      key: key,
+      variant: ${ctx.componentName}Variant.${defaultVariantName},${isTemplate ? "\n      i18n: i18n," : ""}
+      isLoading: true,
+    );
+  }` : "";
     const privateParams = [
       "    required this.variant,",
       isTemplate ? "    required this.i18n," : "",
       emitConstructorParams(otherProps),
+      includeSkeleton ? "    this.isLoading = false," : "",
       "    super.key,"
     ].filter(Boolean).join("\n");
-    constructorCode = factories + `
+    constructorCode = factories + skeletonFactory + `
 
   const ${ctx.componentName}._({
 ${privateParams}
@@ -1527,22 +1660,34 @@ ${privateParams}
 ` + emitFields(otherProps) : emitFields(json.properties);
     constructorCode = `  const ${ctx.componentName}({
     super.key,
-${params}  });`;
+${includeSkeleton ? "    this.isLoading = false,\n" : ""}${params}  });`;
+    if (includeSkeleton) {
+      constructorCode += `
+
+  factory ${ctx.componentName}.skeleton({
+    ${isTemplate ? "required Wl" + pascal2 + "I18n i18n,\n    " : ""}    Key? key,
+  }) {
+    return ${ctx.componentName}(
+      key: key,
+${isTemplate ? "      i18n: i18n,\n" : ""}      isLoading: true,
+    );
+  }`;
+    }
     fieldCode = fields;
   }
-  const buildBody = emitBuildMethod(json, { ...ctx, indent: 1 });
-  if (isTemplate) {
-    constructorCode = constructorCode.replace("super.key,", "this.isLoading = false,\n    super.key,");
-    fieldCode = fieldCode + "\n  final bool isLoading;";
+  if (includeSkeleton) {
+    fieldCode = fieldCode + (fieldCode.endsWith("\n") ? "" : "\n") + `  final bool isLoading;`;
   }
-  const skeletonCheck = isTemplate ? `
+  const buildBody = emitBuildMethod(json, { ...ctx, indent: 1 });
+  const skeletonCheck = includeSkeleton ? `
 ${indent(1)}if (isLoading) return const ${ctx.componentName}Skeleton();
+` : "";
+  const partsBlock = parts.length > 0 ? `${parts.join("\n")}
 ` : "";
   return `import 'package:design_system/design_system.dart';
 import 'package:flutter/material.dart';
 
-${parts.join("\n")}
-${variantEnumCode}
+${partsBlock}${variantEnumCode}
 class ${ctx.componentName} extends StatelessWidget {
 //#region Constructor
 ${constructorCode}
@@ -1558,9 +1703,107 @@ ${fieldCode}
 }
 `;
 }
-function normalizeVariantName(name, pascal2) {
-  const raw = name.replace(new RegExp(`^Wl${pascal2}`), "").trim() || "primary";
-  return raw.charAt(0).toLowerCase() + raw.slice(1);
+var DART_RESERVED = /* @__PURE__ */ new Set([
+  "assert",
+  "break",
+  "case",
+  "catch",
+  "class",
+  "const",
+  "continue",
+  "default",
+  "do",
+  "else",
+  "enum",
+  "extends",
+  "false",
+  "final",
+  "finally",
+  "for",
+  "if",
+  "in",
+  "is",
+  "new",
+  "null",
+  "rethrow",
+  "return",
+  "super",
+  "switch",
+  "this",
+  "throw",
+  "true",
+  "try",
+  "var",
+  "void",
+  "while",
+  "with"
+]);
+function variantSourceLabel(name, variantProps) {
+  const fromProps = variantProps?.Variant ?? variantProps?.State ?? variantProps?.Type;
+  return String(fromProps ?? name).trim();
+}
+function normalizeVariantName(name, pascal2, variantProps) {
+  let raw = variantSourceLabel(name, variantProps);
+  if (raw.includes("=")) {
+    raw = raw.split("=").pop().trim();
+  }
+  const stripped = raw.replace(new RegExp(`^Wl${pascal2}`, "i"), "").trim();
+  if (stripped) raw = stripped;
+  raw = raw.replace(/[^a-zA-Z0-9_]+/g, " ").trim().split(/\s+/).filter(Boolean).map((part, i) => {
+    if (i === 0) return part.charAt(0).toLowerCase() + part.slice(1);
+    return part.charAt(0).toUpperCase() + part.slice(1);
+  }).join("");
+  if (!raw) {
+    throw new Error(
+      `Invalid variant name "${name}": could not derive a Dart identifier`
+    );
+  }
+  if (DART_RESERVED.has(raw)) {
+    raw = `${raw}Variant`;
+  }
+  if (!/^[a-z][a-zA-Z0-9_]*$/.test(raw)) {
+    throw new Error(
+      `Invalid variant name "${name}" \u2192 "${raw}" (not a valid Dart identifier)`
+    );
+  }
+  return raw;
+}
+function isSkeletonVariant(name, variantProps) {
+  let raw = variantSourceLabel(name, variantProps);
+  if (raw.includes("=")) {
+    raw = raw.split("=").pop().trim();
+  }
+  return /^skeleton$/i.test(raw);
+}
+function splitSkeletonVariant(json) {
+  const skeletonVariants = json.variants.filter(
+    (v) => isSkeletonVariant(v.name, v.variantProps)
+  );
+  const variants = json.variants.filter(
+    (v) => !isSkeletonVariant(v.name, v.variantProps)
+  );
+  return {
+    hasSkeleton: skeletonVariants.length > 0,
+    skeletonVariants,
+    componentJson: {
+      ...json,
+      variants,
+      variantCount: variants.length
+    }
+  };
+}
+function assertUniqueVariantNames(variants, pascal2) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const v of variants) {
+    const normalized = normalizeVariantName(v.name, pascal2, v.variantProps);
+    const prev = seen.get(normalized);
+    if (prev) {
+      throw new Error(
+        `Duplicate variant name after normalize: "${prev}" and "${v.name}" \u2192 "${normalized}"`
+      );
+    }
+    seen.set(normalized, v.name);
+  }
 }
 function emitConstructorParams(props) {
   if (props.length === 0) return "";
@@ -1603,7 +1846,10 @@ function emitBuildMethod(json, ctx) {
     return `${indent(ctx.indent)}return ${statement.trimStart()}
 `;
   }
-  const variantNames = json.variants.map((v) => normalizeVariantName(v.name, ctx.componentName.replace(/^Wl/, "")));
+  const pascal2 = ctx.componentName.replace(/^Wl/, "");
+  const variantNames = json.variants.map(
+    (v) => normalizeVariantName(v.name, pascal2, v.variantProps)
+  );
   let code = `${indent(ctx.indent)}return switch (variant) {
 `;
   for (let i = 0; i < json.variants.length; i++) {
@@ -1643,6 +1889,104 @@ function wrapExpanded(code, i) {
 ${indent(i + 1)}child: ${code.trim()}
 ${indent(i)}),`;
 }
+var RADIUS_PX_TO_TOKEN = {
+  0: "theme.borderRadius.radiusNone",
+  2: "theme.borderRadius.radiusXs",
+  4: "theme.borderRadius.radiusS",
+  8: "theme.borderRadius.radiusM",
+  12: "theme.borderRadius.radiusL",
+  16: "theme.borderRadius.radiusXl",
+  20: "theme.borderRadius.radius2xl",
+  24: "theme.borderRadius.radius3xl"
+};
+var SPACING_PX_TO_TOKEN = {
+  0: "theme.spacing.spacingNone",
+  2: "theme.spacing.spacingXs",
+  4: "theme.spacing.spacingS",
+  6: "theme.spacing.spacingM",
+  8: "theme.spacing.spacingL",
+  12: "theme.spacing.spacingXl",
+  16: "theme.spacing.spacing2xl",
+  20: "theme.spacing.spacing3xl",
+  24: "theme.spacing.spacing4xl",
+  32: "theme.spacing.spacing5xl",
+  40: "theme.spacing.spacing6xl",
+  48: "theme.spacing.spacing7xl",
+  56: "theme.spacing.spacing8xl",
+  64: "theme.spacing.spacing9xl"
+};
+var ICON_TODO_MAP = {
+  "ticket-percent": "LucideIcons.ticketPercent"
+};
+function parsePxNumber(raw) {
+  const cleaned = raw.trim().replace(/\.0$/, "");
+  if (!/^-?\d+(\.\d+)?$/.test(cleaned)) return null;
+  const n = Number(cleaned);
+  return Number.isFinite(n) ? n : null;
+}
+function resolveRadiusExpr(raw) {
+  const trimmed = raw.trim();
+  const circularMatch = /^BorderRadius\.circular\(\s*([0-9.]+)\s*\)$/.exec(trimmed);
+  if (circularMatch) {
+    const n2 = parsePxNumber(circularMatch[1]);
+    if (n2 !== null) {
+      const token = RADIUS_PX_TO_TOKEN[n2];
+      if (token) return `BorderRadius.circular(${token})`;
+    }
+    return `BorderRadius.circular(${circularMatch[1]})`;
+  }
+  if (trimmed.startsWith("BorderRadius.")) return trimmed;
+  if (trimmed.includes("theme.borderRadius")) {
+    return `BorderRadius.circular(${trimmed})`;
+  }
+  const n = parsePxNumber(trimmed);
+  if (n !== null) {
+    const token = RADIUS_PX_TO_TOKEN[n];
+    if (token) return `BorderRadius.circular(${token})`;
+    return `BorderRadius.circular(${trimmed})`;
+  }
+  return `BorderRadius.circular(${trimmed})`;
+}
+function resolveSpacingExpr(raw) {
+  const trimmed = raw.trim();
+  if (trimmed.includes("theme.spacing") || trimmed.startsWith("theme.")) {
+    return trimmed;
+  }
+  const n = parsePxNumber(trimmed);
+  if (n !== null) {
+    return SPACING_PX_TO_TOKEN[n] ?? trimmed;
+  }
+  return trimmed;
+}
+function resolvePaddingExpr(raw) {
+  let trimmed = raw.trim().replace(/^const\s+/, "");
+  if (trimmed.includes("theme.spacing")) return trimmed;
+  if (trimmed.startsWith("EdgeInsets.")) {
+    return trimmed.replace(
+      /\b(\d+(?:\.\d+)?)\b/g,
+      (num) => resolveSpacingExpr(num)
+    );
+  }
+  const bare = parsePxNumber(trimmed);
+  if (bare !== null) {
+    return `EdgeInsets.all(${resolveSpacingExpr(trimmed)})`;
+  }
+  return trimmed;
+}
+function resolveIconData(rawIcon) {
+  const todoMatch = /(?:\/\/\s*)?TODO:\s*icon\s+"([^"]+)"/i.exec(rawIcon) ?? /(?:\/\/\s*)?TODO:\s*icon\s+'([^']+)'/i.exec(rawIcon);
+  if (todoMatch) {
+    const mapped = ICON_TODO_MAP[todoMatch[1]];
+    if (mapped) {
+      return { iconData: mapped, todoLine: null };
+    }
+  }
+  const isTodo = rawIcon.startsWith("// TODO") || rawIcon.startsWith("TODO");
+  if (isTodo) {
+    return { iconData: "LucideIcons.helpCircle", todoLine: rawIcon };
+  }
+  return { iconData: rawIcon, todoLine: null };
+}
 function emitContainer(node, ctx) {
   const i = ctx.indent;
   const hasLayout = !!(node.layout && node.children?.length);
@@ -1665,8 +2009,8 @@ function emitContainer(node, ctx) {
   } else if (node.height && !isFillHeight) {
     lines.push(`${indent(i)}height: ${node.height},`);
   }
-  if (hasPadding) {
-    lines.push(`${indent(i)}padding: ${node.padding},`);
+  if (hasPadding && node.padding) {
+    lines.push(`${indent(i)}padding: ${resolvePaddingExpr(node.padding)},`);
   }
   if (hasDecoration && node.decoration) {
     lines.push(`${indent(i)}decoration: ${emitDecoration(node.decoration, i)},`);
@@ -1724,7 +2068,7 @@ function emitLayoutContainer(node, ctx) {
   const rawCross = node.layout.crossAxisAlignment ?? "start";
   const mainAlign = rawMain.startsWith("MainAxisAlignment") ? rawMain : `MainAxisAlignment.${rawMain}`;
   const crossAlign = rawCross.startsWith("CrossAxisAlignment") ? rawCross : `CrossAxisAlignment.${rawCross}`;
-  const gap = node.gap ?? "0";
+  const gap = resolveSpacingExpr(node.gap ?? "0");
   const hasWrapper = !!(node.padding || node.decoration || node.width || node.height);
   const flatChildren = flattenLayoutChildren(node.children, layoutType);
   const needsStack = flatChildren.some((c) => c.positioning === "absolute");
@@ -1760,7 +2104,11 @@ function emitLayoutContainer(node, ctx) {
     } else if (node.height && !isFillHeight) {
       wrapperLines.push(`${indent(base)}height: ${node.height},`);
     }
-    if (node.padding) wrapperLines.push(`${indent(base)}padding: ${node.padding},`);
+    if (node.padding) {
+      wrapperLines.push(
+        `${indent(base)}padding: ${resolvePaddingExpr(node.padding)},`
+      );
+    }
     if (node.decoration) {
       wrapperLines.push(`${indent(base)}decoration: ${emitDecoration(node.decoration, base)},`);
     }
@@ -1843,9 +2191,9 @@ function emitIcon(node, ctx) {
   const rawIcon = node.icon ?? "// TODO: icon";
   const color = node.color;
   const hasColor = !!color;
-  const isTodo = rawIcon.startsWith("// TODO") || rawIcon.startsWith("TODO");
-  const iconData = isTodo ? "LucideIcons.helpCircle" : rawIcon;
-  const todoLine = isTodo ? `${indent(i)}${rawIcon}
+  const resolvedIcon = resolveIconData(rawIcon);
+  const iconData = resolvedIcon.iconData;
+  const todoLine = resolvedIcon.todoLine ? `${indent(i)}${resolvedIcon.todoLine}
 ` : "";
   const hasSize = !!(node.width || node.height);
   const w = node.width ? parseFloat(node.width) : null;
@@ -1896,9 +2244,23 @@ function emitComponentRef(node, ctx) {
   const i = ctx.indent;
   const resolved = resolveComponentRef(node.component ?? "SizedBox", node.props);
   const component = resolved.component;
+  const props = { ...resolved.props };
+  if (component === "WlSkeleton" || component.startsWith("WlSkeleton.")) {
+    if (node.width && node.width !== "double.infinity" && props.width == null) {
+      props.width = node.width;
+    }
+    if (node.height && node.height !== "double.infinity" && props.height == null) {
+      props.height = node.height;
+    }
+    if (props.radius == null && !component.includes("custom")) {
+      props.radius = "theme.borderRadius.radiusL";
+    }
+  }
+  const todoPrefix = resolved.todoComment ? `${indent(i)}${resolved.todoComment}
+` : "";
   const propEntries = [];
   let optionalPropField = null;
-  for (const [key, value] of Object.entries(resolved.props)) {
+  for (const [key, value] of Object.entries(props)) {
     const fieldOrValue = ctx.textDefaults[value] ?? value;
     const isOptionalField = /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(fieldOrValue) && ctx.optionalTextFields.has(fieldOrValue);
     propEntries.push(`${key}: ${isOptionalField ? `${fieldOrValue}!` : fieldOrValue}`);
@@ -1915,6 +2277,10 @@ ${indent(i)}),`;
   } else {
     result = `${indent(i)}${component}(),`;
   }
+  if (shouldWrapWithExpanded(node, ctx)) {
+    result = wrapExpanded(result, i);
+  }
+  result = todoPrefix + result;
   if (optionalPropField) {
     return wrapOptionalGuard(result, optionalPropField, ctx);
   }
@@ -1926,7 +2292,7 @@ function emitDecoration(dec, i) {
     parts.push(`color: ${dec.color}`);
   }
   if (dec.borderRadius) {
-    parts.push(`borderRadius: BorderRadius.circular(${dec.borderRadius})`);
+    parts.push(`borderRadius: ${resolveRadiusExpr(dec.borderRadius)}`);
   }
   if (dec.border) {
     parts.push(`border: ${dec.border}`);
@@ -1941,7 +2307,9 @@ ${indent(i + 1)}`)},
 ${indent(i)})`;
 }
 function emitVariantEnumInline(name, pascal2, json) {
-  const variantNames = json.variants.map((v) => normalizeVariantName(v.name, pascal2));
+  const variantNames = json.variants.map(
+    (v) => normalizeVariantName(v.name, pascal2, v.variantProps)
+  );
   const enumCases = variantNames.map((v) => `  ${v},`).join("\n");
   const extMethods = variantNames.map(
     (v) => `  bool get is${v.charAt(0).toUpperCase() + v.slice(1)} => this == Wl${pascal2}Variant.${v};`
@@ -1957,10 +2325,9 @@ ${extMethods}
 `;
 }
 function emitVariantFile(name, pascal2, json) {
-  const variantNames = json.variants.map((v) => {
-    const raw = v.name.replace(`Wl${pascal2}`, "").trim() || "primary";
-    return raw.charAt(0).toLowerCase() + raw.slice(1);
-  });
+  const variantNames = json.variants.map(
+    (v) => normalizeVariantName(v.name, pascal2, v.variantProps)
+  );
   const enumCases = variantNames.map((v) => `  ${v},`).join("\n");
   const extMethods = variantNames.map(
     (v) => `  bool get is${v.charAt(0).toUpperCase() + v.slice(1)} => this == Wl${pascal2}Variant.${v};`
@@ -1997,7 +2364,26 @@ ${fieldDecls || `  const Wl${pascal2}I18n();`}
 }
 `;
 }
-function emitSkeletonFile(name, pascal2) {
+function emitSkeletonFile(name, pascal2, tree) {
+  let body;
+  if (tree) {
+    const ctx = {
+      componentName: `Wl${pascal2}`,
+      indent: 2,
+      textDefaults: {},
+      optionalTextFields: /* @__PURE__ */ new Set(),
+      showGuards: {},
+      parentFlex: null
+    };
+    const emitted = emitWidgetTree(tree, ctx).trim().replace(/,$/, "");
+    body = `return ${emitted};`;
+  } else {
+    body = `return WlSkeleton(
+      width: double.infinity,
+      height: 120,
+      radius: theme.borderRadius.radiusL,
+    );`;
+  }
   return `part of 'wl_${name}.dart';
 
 class Wl${pascal2}Skeleton extends StatelessWidget {
@@ -2007,11 +2393,7 @@ class Wl${pascal2}Skeleton extends StatelessWidget {
   Widget build(BuildContext context) {
     final theme = context.theme;
 
-    return WlSkeleton(
-      width: double.infinity,
-      height: 120,
-      radius: theme.borderRadius.radiusL,
-    );
+    ${body}
   }
 }
 `;
@@ -2136,12 +2518,31 @@ async function widgetFlow(jsonParams) {
     clack4.outro(chalk8.red(`Error: ${error}`));
   }
 }
-async function writeGeneratedWidget(json, ds, projectRoot) {
+async function writeGeneratedWidget(json, ds, projectRoot, options) {
+  const skipPrompts = options?.skipPrompts === true;
+  let working = json;
+  let hasSkeletonRedirect = false;
+  let skeletonVariants = [];
+  if (json.mode !== "skeleton") {
+    const split = splitSkeletonVariant(json);
+    working = split.componentJson;
+    hasSkeletonRedirect = split.hasSkeleton;
+    skeletonVariants = split.skeletonVariants;
+    const pascal2 = pascalCase6(json.componentName.replace(/^Wl/, ""));
+    assertUniqueVariantNames(working.variants, pascal2);
+    if (hasSkeletonRedirect) {
+      clack4.log.info(
+        chalk8.cyan("Detected Skeleton variant \u2192 using skeleton flow (not a UI factory)")
+      );
+    }
+  }
   const genSpinner = clack4.spinner();
   genSpinner.start("Generando desde JSON...");
   try {
-    const code = generateWidgetCode(json);
-    const rawName = json.componentName.replace(/^Wl/, "");
+    const code = generateWidgetCode(working, {
+      includeSkeleton: hasSkeletonRedirect || working.mode === "skeleton" || working.tier === "template"
+    });
+    const rawName = working.componentName.replace(/^Wl/, "");
     const name = snakeCase2(rawName);
     const tier = code.tier;
     const plural = tierPlural(tier);
@@ -2152,49 +2553,53 @@ async function writeGeneratedWidget(json, ds, projectRoot) {
       fs8.mkdirSync(outDir, { recursive: true });
     }
     const targetFile = path8.join(outDir, `${fileName}.dart`);
-    if (json.mode === "skeleton") {
+    if (working.mode === "skeleton") {
       const skeletonPath = path8.join(outDir, `${fileName}_skeleton.dart`);
       if (fs8.existsSync(skeletonPath)) {
-        const overwrite = await clack4.confirm({
-          message: `El skeleton de "${json.componentName}" ya existe. \xBFReemplazar?`,
-          initialValue: false
-        });
-        if (clack4.isCancel(overwrite) || !overwrite) {
-          genSpinner.stop("Cancelado");
-          clack4.outro(chalk8.yellow("No se modific\xF3 nada."));
-          return;
+        if (!skipPrompts) {
+          const overwrite = await clack4.confirm({
+            message: `El skeleton de "${working.componentName}" ya existe. \xBFReemplazar?`,
+            initialValue: false
+          });
+          if (clack4.isCancel(overwrite) || !overwrite) {
+            genSpinner.stop("Cancelado");
+            clack4.outro(chalk8.yellow("No se modific\xF3 nada."));
+            return false;
+          }
         }
       } else if (fs8.existsSync(targetFile)) {
-        const add = await clack4.confirm({
-          message: `\xBFAgregar skeleton a "${json.componentName}"?`,
-          initialValue: true
-        });
-        if (clack4.isCancel(add) || !add) {
-          genSpinner.stop("Cancelado");
-          clack4.outro(chalk8.yellow("No se modific\xF3 nada."));
-          return;
+        if (!skipPrompts) {
+          const add = await clack4.confirm({
+            message: `\xBFAgregar skeleton a "${working.componentName}"?`,
+            initialValue: true
+          });
+          if (clack4.isCancel(add) || !add) {
+            genSpinner.stop("Cancelado");
+            clack4.outro(chalk8.yellow("No se modific\xF3 nada."));
+            return false;
+          }
         }
       }
-    } else {
-      if (fs8.existsSync(targetFile)) {
+    } else if (fs8.existsSync(targetFile)) {
+      if (!skipPrompts) {
         const overwrite = await clack4.confirm({
-          message: `El componente "${json.componentName}" ya existe en ${plural}/${fileName}/. \xBFReemplazar?`,
+          message: `El componente "${working.componentName}" ya existe en ${plural}/${fileName}/. \xBFReemplazar?`,
           initialValue: false
         });
         if (clack4.isCancel(overwrite) || !overwrite) {
           genSpinner.stop("Cancelado");
           clack4.outro(chalk8.yellow("No se modific\xF3 nada."));
-          return;
+          return false;
         }
       }
     }
-    if (json.mode === "skeleton") {
+    if (working.mode === "skeleton") {
       const skeletonPath = path8.join(outDir, `${fileName}_skeleton.dart`);
       fs8.writeFileSync(skeletonPath, code.skeleton ?? "");
       if (fs8.existsSync(targetFile)) {
         let mainContent = fs8.readFileSync(targetFile, "utf-8");
         const partLine = `part '${fileName}_skeleton.dart';`;
-        const componentName = json.componentName;
+        const componentName = working.componentName;
         if (!mainContent.includes(partLine)) {
           if (/part '.+';/.test(mainContent)) {
             mainContent = mainContent.replace(/(part '.+';)\n/, `$1
@@ -2240,7 +2645,7 @@ ${partLine}
       if (code.i18n) filesToFormat.push(path8.join(outDir, `${fileName}_i18n.dart`));
       if (code.skeleton) filesToFormat.push(path8.join(outDir, `${fileName}_skeleton.dart`));
     }
-    if (json.mode === "skeleton") {
+    if (working.mode === "skeleton") {
       filesToFormat.push(path8.join(outDir, `${fileName}_skeleton.dart`));
     }
     for (const f of filesToFormat) {
@@ -2250,42 +2655,76 @@ ${partLine}
     for (const f of filesToFormat) {
       if (fs8.existsSync(f)) await dartFix(f);
     }
-    genSpinner.stop(`${json.componentName} generado en ${plural}/`);
-    if (ds.widgetbookDir && json.mode !== "skeleton") {
+    genSpinner.stop(`${working.componentName} generado en ${plural}/`);
+    if (ds.widgetbookDir && working.mode !== "skeleton") {
       genSpinner.start("Creating widgetbook use-case...");
       try {
         await createUseCase(name, code.tier, {
           projectRoot,
           buildRunner: false,
-          properties: json.properties,
-          hasVariants: json.variants.length > 1
+          properties: working.properties,
+          variantNames: working.variants.length > 1 ? working.variants.map(
+            (v) => normalizeVariantName(
+              v.name,
+              pascalCase6(working.componentName.replace(/^Wl/, "")),
+              v.variantProps
+            )
+          ) : [],
+          includeSkeleton: hasSkeletonRedirect
         });
         genSpinner.stop("Use-case created");
-        const useCaseFile = path8.join(ds.widgetbookDir, "lib", "usecases", "wl_design_system", `${fileName}.dart`);
+        const useCaseFile = path8.join(
+          ds.widgetbookDir,
+          "lib",
+          "usecases",
+          "wl_design_system",
+          plural,
+          `${fileName}.dart`
+        );
         if (fs8.existsSync(useCaseFile)) {
           dartFormat(useCaseFile);
         }
-        const runBr = await clack4.confirm({
-          message: "\xBFCorrer build_runner en el widgetbook?",
-          initialValue: true
-        });
-        if (!clack4.isCancel(runBr) && runBr) {
-          genSpinner.start("Corriendo build_runner...");
-          try {
-            await runBuildRunner(ds.widgetbookDir);
-            genSpinner.stop("Widgetbook actualizado");
-          } catch {
-            genSpinner.stop("build_runner fall\xF3");
+        if (!skipPrompts) {
+          const runBr = await clack4.confirm({
+            message: "\xBFCorrer build_runner en el widgetbook?",
+            initialValue: true
+          });
+          if (!clack4.isCancel(runBr) && runBr) {
+            genSpinner.start("Corriendo build_runner...");
+            try {
+              await runBuildRunner(ds.widgetbookDir);
+              genSpinner.stop("Widgetbook actualizado");
+            } catch {
+              genSpinner.stop("build_runner fall\xF3");
+            }
           }
         }
       } catch (e) {
         genSpinner.stop(`Use-case skipped: ${e}`);
       }
     }
-    clack4.outro(chalk8.green("\xA1Listo!"));
+    if (hasSkeletonRedirect) {
+      const ok = await writeGeneratedWidget(
+        {
+          ...working,
+          mode: "skeleton",
+          variants: skeletonVariants,
+          variantCount: skeletonVariants.length
+        },
+        ds,
+        projectRoot,
+        { skipPrompts: true }
+      );
+      if (!ok) return false;
+    }
+    if (!skipPrompts) {
+      clack4.outro(chalk8.green("\xA1Listo!"));
+    }
+    return true;
   } catch (error) {
     genSpinner.stop("Fall\xF3");
     clack4.outro(chalk8.red(`Error: ${error}`));
+    return false;
   }
 }
 async function useCaseFlow() {
@@ -2477,7 +2916,7 @@ import chalk11 from "chalk";
 import * as fs10 from "fs";
 import * as path10 from "path";
 import chalk10 from "chalk";
-import { pascalCase as pascalCase6, camelCase as camelCase2 } from "change-case";
+import { pascalCase as pascalCase7, camelCase as camelCase2 } from "change-case";
 
 // src/generators/endpoint/templates.ts
 import { camelCase } from "change-case";
@@ -2560,8 +2999,8 @@ ${paramsClass}
 }
 `;
 }
-function retrofitMethod(methodName, path24, httpMethod, params, returnType) {
-  const httpAnnotation = `@${httpMethod.toUpperCase()}('${path24}')`;
+function retrofitMethod(methodName, path27, httpMethod, params, returnType) {
+  const httpAnnotation = `@${httpMethod.toUpperCase()}('${path27}')`;
   const paramList = params.map((p) => {
     if (p.isPath) return `@Path('${p.name}') ${p.type} ${p.name}`;
     if (p.isBody) return `@Body() ${p.type} ${p.name}`;
@@ -2629,17 +3068,17 @@ ${annotation}${useCaseClass} ${useCaseCamel}(${repoInterface} repository) =>
 // src/generators/endpoint/generator.ts
 async function createEndpoint(options) {
   const lib = path10.join(options.projectRoot, "lib");
-  const pascal2 = pascalCase6(options.useCaseName);
-  const useCasePascal = pascalCase6(options.useCaseName);
+  const pascal2 = pascalCase7(options.useCaseName);
+  const useCasePascal = pascalCase7(options.useCaseName);
   const useCaseSnake = options.useCaseName;
   const needsBody = ["POST", "PUT", "PATCH"].includes(options.httpMethod);
   const domain = extractDomain(options.bffApiFile);
   const datasourceFile = path10.join(lib, "data", "datasources", `${domain}_rest_datasource.dart`);
-  const datasourceClassName = `${pascalCase6(domain)}RestDataSource`;
+  const datasourceClassName = `${pascalCase7(domain)}RestDataSource`;
   const repositoryInterfaceFile = path10.join(lib, "domain", "repositories", `${domain}_repository.dart`);
-  const repositoryInterfaceName = `${pascalCase6(domain)}Repository`;
+  const repositoryInterfaceName = `${pascalCase7(domain)}Repository`;
   const repositoryImplFile = path10.join(lib, "data", "repositories", `${domain}_repository_data.dart`);
-  const repositoryImplClassName = `${pascalCase6(domain)}RepositoryData`;
+  const repositoryImplClassName = `${pascalCase7(domain)}RepositoryData`;
   const feature = domain;
   const pathParams = extractPathParams(options.endpointPath);
   const methodParams = buildMethodParams(options, pathParams, needsBody);
@@ -2769,7 +3208,7 @@ async function createEndpoint(options) {
     spinner11("Registering in DI modules");
     const appBaseDir = findAppBasePackageDir(options.projectRoot, options.diTarget);
     if (appBaseDir) {
-      const domainPascal = pascalCase6(domain);
+      const domainPascal = pascalCase7(domain);
       const lazy = options.diLazySingleton !== false;
       const dsModuleFile = path10.join(appBaseDir, "datasources_module.dart");
       const dsRegistration = datasourceModuleRegistration(domainPascal, lazy);
@@ -2824,7 +3263,7 @@ function extractPathParams(endpointPath) {
 function buildMethodParams(options, pathParams, hasRequestBody) {
   const params = [...pathParams];
   if (hasRequestBody) {
-    const reqPascal = pascalCase6(options.useCaseName);
+    const reqPascal = pascalCase7(options.useCaseName);
     params.push({ name: "body", type: `${reqPascal}RequestModel` });
   }
   return params;
@@ -2835,7 +3274,7 @@ function buildRetrofitParams(options, pathParams, hasRequestBody) {
     params.push({ ...pp, isPath: true });
   }
   if (hasRequestBody) {
-    const reqPascal = pascalCase6(options.useCaseName);
+    const reqPascal = pascalCase7(options.useCaseName);
     params.push({ name: "body", type: `${reqPascal}RequestModel`, isBody: true });
   }
   return params;
@@ -3774,6 +4213,23 @@ function appConfigDefaultValue(dartType) {
       return "const []";
   }
 }
+function dartDefaultLiteral(defaultValue, dartType) {
+  if (!defaultValue || !defaultValue.trim()) {
+    return appConfigDefaultValue(dartType);
+  }
+  switch (dartType) {
+    case "String":
+      return `'${defaultValue.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+    case "int":
+      return defaultValue.trim();
+    case "bool":
+      return defaultValue.trim() === "true" ? "true" : "false";
+    case "List<String>": {
+      const items = defaultValue.split(",").map((s) => s.trim()).filter(Boolean).map((s) => `'${s.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`);
+      return items.length === 0 ? "const []" : `const [${items.join(", ")}]`;
+    }
+  }
+}
 function appConfigModelJsonKey(camelName, dartType) {
   switch (dartType) {
     case "bool":
@@ -3909,7 +4365,7 @@ function injectIntoRemoteConfigDefaults(vendorsPath, camelName, dartType) {
   console.log(chalk14.green(`  Injected into VendorsModule defaultValues`));
   return vendorsPath;
 }
-function injectAppConfigProperty(configPath, camelName, dartType) {
+function injectAppConfigProperty(configPath, camelName, dartType, defaultValue) {
   const content = fs15.readFileSync(configPath, "utf8");
   if (content.includes(`final ${dartTypeForGetter(dartType)} ${camelName}`)) {
     console.log(chalk14.yellow(`  '${camelName}' already in AppConfig`));
@@ -3924,13 +4380,13 @@ function injectAppConfigProperty(configPath, camelName, dartType) {
   } else {
     newContent = injectBeforeClassClose(newContent, "AppConfig", `  final ${dartTypeForGetter(dartType)} ${camelName};`);
   }
-  newContent = injectConstructorParam(newContent, "AppConfig", camelName, appConfigDefaultValue(dartType));
+  newContent = injectConstructorParam(newContent, "AppConfig", camelName, dartDefaultLiteral(defaultValue, dartType));
   newContent = injectIntoPropsList(newContent, camelName);
   fs15.writeFileSync(configPath, newContent);
   console.log(chalk14.green(`  Injected into AppConfig entity`));
   return configPath;
 }
-function injectAppConfigModelProperty(modelPath, camelName, dartType) {
+function injectAppConfigModelProperty(modelPath, camelName, dartType, defaultValue) {
   const content = fs15.readFileSync(modelPath, "utf8");
   if (content.includes(`final ${dartTypeForGetter(dartType)} ${camelName}`)) {
     console.log(chalk14.yellow(`  '${camelName}' already in AppConfigModel`));
@@ -3957,7 +4413,12 @@ function injectAppConfigModelProperty(modelPath, camelName, dartType) {
   } else {
     newContent = injectBeforeClassClose(newContent, "AppConfigModel", fieldLines);
   }
-  newContent = injectConstructorParam(newContent, "AppConfigModel", camelName, dartType);
+  newContent = injectConstructorParam(
+    newContent,
+    "AppConfigModel",
+    camelName,
+    dartDefaultLiteral(defaultValue, dartType)
+  );
   newContent = injectIntoSuperCall(newContent, camelName);
   fs15.writeFileSync(modelPath, newContent);
   console.log(chalk14.green(`  Injected into AppConfigModel`));
@@ -4008,14 +4469,14 @@ Adding environment variable: ${chalk14.cyan(variableName)}
   const jsonValue = typedJsonValue(defaultValue, dartType);
   const appsDir = path15.join(monorepoRoot, "apps");
   for (const app of selectedApps) {
-    const appEnvDir = path15.join(appsDir, app, "env");
+    const appEnvDir2 = path15.join(appsDir, app, "env");
     const files = [
       { name: "example.env.json", isTemplate: true },
       { name: "development.env.json", isTemplate: false },
       { name: "production.env.json", isTemplate: false }
     ];
     for (const { name, isTemplate } of files) {
-      const modified = injectIntoJsonFile(path15.join(appEnvDir, name), variableName, jsonValue, isTemplate);
+      const modified = injectIntoJsonFile(path15.join(appEnvDir2, name), variableName, jsonValue, isTemplate);
       if (modified) modifiedFiles.push(modified);
     }
   }
@@ -4043,7 +4504,7 @@ Adding environment variable: ${chalk14.cyan(variableName)}
     spinner7("PASO 5: Injecting into AppConfig entity");
     const configPath = findAppConfigFile(monorepoRoot);
     if (configPath) {
-      const modified = injectAppConfigProperty(configPath, camelName, dartType);
+      const modified = injectAppConfigProperty(configPath, camelName, dartType, defaultValue);
       if (modified) modifiedFiles.push(modified);
     } else {
       console.log(chalk14.yellow("  app_config.dart not found, skipping AppConfig"));
@@ -4051,7 +4512,7 @@ Adding environment variable: ${chalk14.cyan(variableName)}
     spinner7("PASO 6: Injecting into AppConfigModel");
     const modelPath = findAppConfigModelFile(monorepoRoot);
     if (modelPath) {
-      const modified = injectAppConfigModelProperty(modelPath, camelName, dartType);
+      const modified = injectAppConfigModelProperty(modelPath, camelName, dartType, defaultValue);
       if (modified) modifiedFiles.push(modified);
     } else {
       console.log(chalk14.yellow("  app_config_model.dart not found, skipping AppConfigModel"));
@@ -4109,15 +4570,26 @@ async function envVarFlow() {
     return;
   }
   const selectedType = dartType;
-  const defaultValue = await clack8.text({
-    message: "Default value (leave empty to skip)",
-    placeholder: selectedType === "bool" ? "false" : selectedType === "int" ? "0" : "",
-    validate: (v) => {
-      if (!v || !v.trim()) return void 0;
-      if (selectedType === "int" && !/^-?\d+$/.test(v)) return "Must be an integer";
-      if (selectedType === "bool" && !["true", "false"].includes(v)) return "Must be true or false";
-    }
-  });
+  let defaultValue;
+  if (selectedType === "bool") {
+    defaultValue = await clack8.select({
+      message: "Default value",
+      options: [
+        { value: "false", label: "false" },
+        { value: "true", label: "true" }
+      ],
+      initialValue: "false"
+    });
+  } else {
+    defaultValue = await clack8.text({
+      message: "Default value (leave empty to skip)",
+      placeholder: selectedType === "int" ? "0" : "",
+      validate: (v) => {
+        if (!v || !v.trim()) return void 0;
+        if (selectedType === "int" && !/^-?\d+$/.test(v)) return "Must be an integer";
+      }
+    });
+  }
   if (clack8.isCancel(defaultValue)) {
     clack8.cancel("Cancelled");
     return;
@@ -4207,9 +4679,9 @@ import { execSync as execSync4 } from "child_process";
 import chalk16 from "chalk";
 
 // src/generators/app/app-templates.ts
-import { pascalCase as pascalCase7 } from "change-case";
+import { pascalCase as pascalCase8 } from "change-case";
 function pascal(name) {
-  return pascalCase7(name);
+  return pascalCase8(name);
 }
 function pubspecTemplate(params, pubWorkspace = false) {
   if (pubWorkspace) {
@@ -7589,11 +8061,11 @@ import * as fs19 from "fs";
 import * as path19 from "path";
 import { execSync as execSync7 } from "child_process";
 import chalk19 from "chalk";
-import { pascalCase as pascalCase8, camelCase as camelCase4 } from "change-case";
+import { pascalCase as pascalCase9, camelCase as camelCase4 } from "change-case";
 var SNAKE_CASE_REGEX6 = /^[a-z][a-z0-9_]*$/;
 async function createCollaborativeEndpoint(options) {
   const { featurePath, featureName } = options;
-  const pascal2 = pascalCase8(options.useCaseName);
+  const pascal2 = pascalCase9(options.useCaseName);
   const needsBody = ["POST", "PUT", "PATCH"].includes(options.httpMethod);
   const pathParams = extractPathParams2(options.endpointPath);
   const lib = path19.join(featurePath, "lib");
@@ -7629,7 +8101,7 @@ async function createCollaborativeEndpoint(options) {
   fs19.mkdirSync(bffDir, { recursive: true });
   const domain = featureName.replace(/^feature_/, "");
   const bffApiFile = path19.join(bffDir, `bff_${domain}_api.dart`);
-  const bffApiClass = `Bff${pascalCase8(domain)}Api`;
+  const bffApiClass = `Bff${pascalCase9(domain)}Api`;
   if (fs19.existsSync(bffApiFile)) {
     const method = bffApiMethodSnippet(
       camelCase4(options.useCaseName),
@@ -7660,7 +8132,7 @@ async function createCollaborativeEndpoint(options) {
     "datasources",
     `${featureName}_datasource_fake.dart`
   );
-  const dsClass = `${pascalCase8(featureName)}DatasourceFake`;
+  const dsClass = `${pascalCase9(featureName)}DatasourceFake`;
   if (fs19.existsSync(datasourceFile)) {
     const dsMethod = datasourceMethodSnippet(
       camelCase4(options.useCaseName),
@@ -7676,7 +8148,7 @@ async function createCollaborativeEndpoint(options) {
     "repositories",
     `${featureName}_repository.dart`
   );
-  const repoInterface = `${pascalCase8(featureName)}Repository`;
+  const repoInterface = `${pascalCase9(featureName)}Repository`;
   if (fs19.existsSync(repoInterfaceFile)) {
     const ifaceMethod = repositoryInterfaceMethodSnippet(
       camelCase4(options.useCaseName),
@@ -7692,7 +8164,7 @@ async function createCollaborativeEndpoint(options) {
     "repositories",
     `${featureName}_repository_data.dart`
   );
-  const repoImpl = `${pascalCase8(featureName)}RepositoryData`;
+  const repoImpl = `${pascalCase9(featureName)}RepositoryData`;
   if (fs19.existsSync(repoImplFile)) {
     const implMethod = repositoryImplMethodSnippet(
       camelCase4(options.useCaseName),
@@ -7878,7 +8350,7 @@ function updateBarrels(lib, useCaseName, needsBody, domain) {
 }
 function registerEndpointDi(lib, featureName, pascal2, params) {
   const diDir = path19.join(lib, "di");
-  const featurePascal = pascalCase8(featureName);
+  const featurePascal = pascalCase9(featureName);
   const ucModulePath = path19.join(diDir, "usecases_module.dart");
   if (fs19.existsSync(ucModulePath)) {
     const useCaseClass = `${pascal2}UseCase`;
@@ -8455,8 +8927,8 @@ function displayArchitecture(info) {
 }
 
 // src/flows/docs-flow.ts
-function normalizeChallenge(text11) {
-  return text11.trim().toLowerCase().replace(/[áä]/g, "a").replace(/[éë]/g, "e").replace(/[íï]/g, "i").replace(/[óö]/g, "o").replace(/[úü]/g, "u");
+function normalizeChallenge(text12) {
+  return text12.trim().toLowerCase().replace(/[áä]/g, "a").replace(/[éë]/g, "e").replace(/[íï]/g, "i").replace(/[óö]/g, "o").replace(/[úü]/g, "u");
 }
 async function docsInteractiveMode() {
   clack11.intro(chalk24.bgCyan(chalk24.black(" wlmaker docs ")));
@@ -8556,12 +9028,1093 @@ async function docsInteractiveMode() {
   }
 }
 
+// src/flows/vault-flow.ts
+import { execSync as execSync9 } from "child_process";
+import { randomBytes as randomBytes3 } from "crypto";
+import * as fs29 from "fs";
+import * as clack12 from "@clack/prompts";
+import chalk25 from "chalk";
+
+// src/vault/types.ts
+var ENV_NAMES = ["development", "production"];
+
+// src/vault/identity.ts
+import * as crypto2 from "crypto";
+import * as fs24 from "fs";
+import * as os6 from "os";
+import * as path24 from "path";
+
+// src/vault/crypto.ts
+import * as crypto from "crypto";
+var DATA_KEY_BYTES = 32;
+var NONCE_BYTES = 12;
+var HKDF_HASH = "sha256";
+var HKDF_KEY_BYTES = 32;
+var HKDF_WRAP_INFO = Buffer.from("wlmaker-vault-wrap-v1", "utf8");
+function generateX25519KeyPair() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("x25519");
+  const publicJwk = publicKey.export({ format: "jwk" });
+  const privateJwk = privateKey.export({ format: "jwk" });
+  return {
+    publicKey: Buffer.from(publicJwk.x, "base64url"),
+    privateKey: Buffer.from(privateJwk.d, "base64url")
+  };
+}
+function importX25519PublicKey(publicKey) {
+  return crypto.createPublicKey({
+    key: { kty: "OKP", crv: "X25519", x: publicKey.toString("base64url") },
+    format: "jwk"
+  });
+}
+function importX25519PrivateKey(privateKey, publicKey) {
+  return crypto.createPrivateKey({
+    key: {
+      kty: "OKP",
+      crv: "X25519",
+      x: publicKey.toString("base64url"),
+      d: privateKey.toString("base64url")
+    },
+    format: "jwk"
+  });
+}
+function deriveSharedSecret(privateKey, publicKeyForEcdh, publicKeyForPrivate) {
+  const privateKeyObj = importX25519PrivateKey(privateKey, publicKeyForPrivate);
+  const publicKeyObj = importX25519PublicKey(publicKeyForEcdh);
+  return crypto.diffieHellman({ privateKey: privateKeyObj, publicKey: publicKeyObj });
+}
+function hkdf(ikm, info) {
+  return Buffer.from(crypto.hkdfSync(HKDF_HASH, ikm, Buffer.alloc(0), info, HKDF_KEY_BYTES));
+}
+function generateDataKey() {
+  return crypto.randomBytes(DATA_KEY_BYTES);
+}
+function wrapDataKey(dataKey, recipientPublicKey) {
+  const ephemeral = generateX25519KeyPair();
+  const shared = deriveSharedSecret(ephemeral.privateKey, recipientPublicKey, ephemeral.publicKey);
+  const wrapKey = hkdf(shared, HKDF_WRAP_INFO);
+  const nonce = crypto.randomBytes(NONCE_BYTES);
+  const cipher = crypto.createCipheriv("aes-256-gcm", wrapKey, nonce);
+  const ct = Buffer.concat([cipher.update(dataKey), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    ephemeralPublicKey: ephemeral.publicKey.toString("base64"),
+    nonce: nonce.toString("base64"),
+    ct: ct.toString("base64"),
+    tag: tag.toString("base64")
+  };
+}
+function unwrapDataKey(wrapped, recipientPrivateKey, recipientPublicKey) {
+  const ephemeralPublicKey = Buffer.from(wrapped.ephemeralPublicKey, "base64");
+  const shared = deriveSharedSecret(recipientPrivateKey, ephemeralPublicKey, recipientPublicKey);
+  const wrapKey = hkdf(shared, HKDF_WRAP_INFO);
+  const nonce = Buffer.from(wrapped.nonce, "base64");
+  const tag = Buffer.from(wrapped.tag, "base64");
+  const ct = Buffer.from(wrapped.ct, "base64");
+  const decipher = crypto.createDecipheriv("aes-256-gcm", wrapKey, nonce);
+  decipher.setAuthTag(tag);
+  try {
+    return Buffer.concat([decipher.update(ct), decipher.final()]);
+  } catch {
+    throw new Error("Unable to unwrap data key: wrong key or corrupted entry.");
+  }
+}
+function buildAad(vaultId, app, env, varName) {
+  return Buffer.from(`${vaultId}|${app}|${env}|${varName}`, "utf8");
+}
+function sealValue(value, dataKey, aad) {
+  const plaintext = Buffer.from(JSON.stringify(value), "utf8");
+  const nonce = crypto.randomBytes(NONCE_BYTES);
+  const cipher = crypto.createCipheriv("aes-256-gcm", dataKey, nonce);
+  cipher.setAAD(aad);
+  const ct = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    nonce: nonce.toString("base64"),
+    ct: ct.toString("base64"),
+    tag: tag.toString("base64")
+  };
+}
+function openValue(sealed, dataKey, aad) {
+  const nonce = Buffer.from(sealed.nonce, "base64");
+  const tag = Buffer.from(sealed.tag, "base64");
+  const ct = Buffer.from(sealed.ct, "base64");
+  const decipher = crypto.createDecipheriv("aes-256-gcm", dataKey, nonce);
+  decipher.setAAD(aad);
+  decipher.setAuthTag(tag);
+  let plaintext;
+  try {
+    plaintext = Buffer.concat([decipher.update(ct), decipher.final()]);
+  } catch {
+    throw new Error("Unable to open sealed value: wrong key, wrong coordinate, or corrupted entry.");
+  }
+  return JSON.parse(plaintext.toString("utf8"));
+}
+
+// src/vault/identity.ts
+var IDENTITY_FILE_NAME = "identity";
+var IDENTITY_DIR_MODE = 448;
+var IDENTITY_FILE_MODE = 384;
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var SCRYPT_KEY_BYTES = 32;
+var SALT_BYTES = 16;
+var NONCE_BYTES2 = 12;
+function getIdentityDir() {
+  return path24.join(os6.homedir(), ".wlmaker");
+}
+function getIdentityPath() {
+  return path24.join(getIdentityDir(), IDENTITY_FILE_NAME);
+}
+function identityExists() {
+  return fs24.existsSync(getIdentityPath());
+}
+function fingerprintFor(publicKey) {
+  return crypto2.createHash("sha256").update(publicKey).digest("hex").slice(0, 16);
+}
+function deriveKeyEncryptionKey(passphrase, salt, n, r, p) {
+  return crypto2.scryptSync(passphrase, salt, SCRYPT_KEY_BYTES, { N: n, r, p });
+}
+function encryptPrivateKey(privateKey, passphrase) {
+  const salt = crypto2.randomBytes(SALT_BYTES);
+  const key = deriveKeyEncryptionKey(passphrase, salt, SCRYPT_N, SCRYPT_R, SCRYPT_P);
+  const nonce = crypto2.randomBytes(NONCE_BYTES2);
+  const cipher = crypto2.createCipheriv("aes-256-gcm", key, nonce);
+  const ct = Buffer.concat([cipher.update(privateKey), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    salt: salt.toString("base64"),
+    n: SCRYPT_N,
+    r: SCRYPT_R,
+    p: SCRYPT_P,
+    nonce: nonce.toString("base64"),
+    ct: ct.toString("base64"),
+    tag: tag.toString("base64")
+  };
+}
+function decryptPrivateKey(encrypted, passphrase) {
+  const salt = Buffer.from(encrypted.salt, "base64");
+  const key = deriveKeyEncryptionKey(passphrase, salt, encrypted.n, encrypted.r, encrypted.p);
+  const nonce = Buffer.from(encrypted.nonce, "base64");
+  const tag = Buffer.from(encrypted.tag, "base64");
+  const ct = Buffer.from(encrypted.ct, "base64");
+  const decipher = crypto2.createDecipheriv("aes-256-gcm", key, nonce);
+  decipher.setAuthTag(tag);
+  try {
+    return Buffer.concat([decipher.update(ct), decipher.final()]);
+  } catch {
+    throw new Error("Incorrect passphrase, or the identity file is corrupted.");
+  }
+}
+function readIdentityFile() {
+  const raw = fs24.readFileSync(getIdentityPath(), "utf8");
+  return JSON.parse(raw);
+}
+function writeIdentityFile(file) {
+  const dir = getIdentityDir();
+  fs24.mkdirSync(dir, { recursive: true, mode: IDENTITY_DIR_MODE });
+  const filePath = getIdentityPath();
+  fs24.writeFileSync(filePath, JSON.stringify(file, null, 2) + "\n", { mode: IDENTITY_FILE_MODE });
+  fs24.chmodSync(filePath, IDENTITY_FILE_MODE);
+}
+function createIdentity(passphrase, name) {
+  if (identityExists()) {
+    throw new Error(`Identity already exists at ${getIdentityPath()}.`);
+  }
+  const { publicKey, privateKey } = generateX25519KeyPair();
+  const file = {
+    version: 1,
+    name,
+    publicKey: publicKey.toString("base64"),
+    encryptedPrivateKey: encryptPrivateKey(privateKey, passphrase)
+  };
+  writeIdentityFile(file);
+  return { fingerprint: fingerprintFor(publicKey), name, publicKey, privateKey };
+}
+function loadIdentity(passphrase) {
+  if (!identityExists()) {
+    throw new Error(`No identity found at ${getIdentityPath()}. Create one first.`);
+  }
+  const file = readIdentityFile();
+  const publicKey = Buffer.from(file.publicKey, "base64");
+  const privateKey = decryptPrivateKey(file.encryptedPrivateKey, passphrase);
+  return { fingerprint: fingerprintFor(publicKey), name: file.name, publicKey, privateKey };
+}
+var cachedIdentity = null;
+function getCachedIdentity() {
+  return cachedIdentity;
+}
+function cacheIdentity(identity) {
+  cachedIdentity = identity;
+}
+
+// src/vault/vault-file.ts
+import * as fs25 from "fs";
+import { z as z3 } from "zod";
+var sealedValueSchema = z3.object({
+  nonce: z3.string(),
+  ct: z3.string(),
+  tag: z3.string()
+});
+var wrappedDataKeySchema = z3.object({
+  ephemeralPublicKey: z3.string(),
+  nonce: z3.string(),
+  ct: z3.string(),
+  tag: z3.string()
+});
+var recipientSchema = z3.object({
+  fingerprint: z3.string(),
+  name: z3.string(),
+  publicKey: z3.string(),
+  wrappedDataKey: wrappedDataKeySchema,
+  addedAt: z3.string(),
+  addedBy: z3.string()
+});
+var pendingRequestSchema = z3.object({
+  fingerprint: z3.string(),
+  name: z3.string(),
+  publicKey: z3.string(),
+  requestedAt: z3.string()
+});
+var envValuesSchema = z3.record(z3.string(), sealedValueSchema);
+var envRecordSchema = z3.object({
+  development: envValuesSchema.default({}),
+  production: envValuesSchema.default({})
+});
+var appsSchema = z3.record(z3.string(), envRecordSchema);
+var vaultFileSchema = z3.object({
+  version: z3.literal(1),
+  vaultId: z3.string().min(1),
+  keyringVersion: z3.number().int().nonnegative(),
+  recipients: z3.array(recipientSchema),
+  pending: z3.array(pendingRequestSchema),
+  apps: appsSchema
+});
+function parseVault(raw) {
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch (error) {
+    throw new Error(`Vault file is not valid JSON: ${error.message}`);
+  }
+  const result = vaultFileSchema.safeParse(json);
+  if (!result.success) {
+    throw new Error(`Vault file failed schema validation: ${result.error.message}`);
+  }
+  return result.data;
+}
+function sortedKeys(record) {
+  return Object.keys(record).sort((a, b) => a.localeCompare(b));
+}
+function canonicalize(vault) {
+  const apps = {};
+  for (const app of sortedKeys(vault.apps)) {
+    const envs = vault.apps[app];
+    const orderedEnvs = {};
+    for (const env of ENV_NAMES) {
+      const values = envs[env] ?? {};
+      const orderedValues = {};
+      for (const key of sortedKeys(values)) {
+        orderedValues[key] = values[key];
+      }
+      orderedEnvs[env] = orderedValues;
+    }
+    apps[app] = orderedEnvs;
+  }
+  return {
+    version: vault.version,
+    vaultId: vault.vaultId,
+    keyringVersion: vault.keyringVersion,
+    recipients: vault.recipients,
+    pending: vault.pending,
+    apps
+  };
+}
+function serializeVault(vault) {
+  return JSON.stringify(canonicalize(vault), null, 2) + "\n";
+}
+function readVaultFile(filePath) {
+  if (!fs25.existsSync(filePath)) {
+    throw new Error(`Vault file not found at ${filePath}. Run "wlmaker vault init" first.`);
+  }
+  const raw = fs25.readFileSync(filePath, "utf8");
+  return parseVault(raw);
+}
+function writeVaultFile(filePath, vault) {
+  fs25.writeFileSync(filePath, serializeVault(vault));
+}
+function emptyVault(vaultId) {
+  return {
+    version: 1,
+    vaultId,
+    keyringVersion: 1,
+    recipients: [],
+    pending: [],
+    apps: {}
+  };
+}
+
+// src/vault/discovery.ts
+import * as fs26 from "fs";
+import * as path25 from "path";
+var EXAMPLE_ENV_FILE = "example.env.json";
+var VAULT_FILE_NAME = ".wlmaker.vault.json";
+function vaultPath(monorepoRoot) {
+  return path25.join(monorepoRoot, VAULT_FILE_NAME);
+}
+var ENV_FILE_NAMES = {
+  development: "development.env.json",
+  production: "production.env.json"
+};
+function appEnvDir(monorepoRoot, app) {
+  return path25.join(monorepoRoot, "apps", app, "env");
+}
+function envFilePath(monorepoRoot, app, env) {
+  return path25.join(appEnvDir(monorepoRoot, app), ENV_FILE_NAMES[env]);
+}
+function exampleEnvPath(monorepoRoot, app) {
+  return path25.join(appEnvDir(monorepoRoot, app), EXAMPLE_ENV_FILE);
+}
+function readLocalEnvFile(monorepoRoot, app, env) {
+  const filePath = envFilePath(monorepoRoot, app, env);
+  if (!fs26.existsSync(filePath)) return null;
+  const raw = fs26.readFileSync(filePath, "utf8");
+  return JSON.parse(raw);
+}
+function readAllowlist(monorepoRoot, app) {
+  const filePath = exampleEnvPath(monorepoRoot, app);
+  if (!fs26.existsSync(filePath)) return [];
+  const raw = fs26.readFileSync(filePath, "utf8");
+  const json = JSON.parse(raw);
+  return Object.keys(json);
+}
+
+// src/vault/ops/shared.ts
+var NotAnApprovedRecipientError = class extends Error {
+  constructor(fingerprint) {
+    super(
+      `Identity ${fingerprint} is not an approved recipient of this vault. Ask an existing recipient to approve your request first.`
+    );
+    this.name = "NotAnApprovedRecipientError";
+  }
+};
+function findRecipient(vault, fingerprint) {
+  return vault.recipients.find((recipient) => recipient.fingerprint === fingerprint);
+}
+function resolveDataKey(vault, identity) {
+  const recipient = findRecipient(vault, identity.fingerprint);
+  if (!recipient) {
+    throw new NotAnApprovedRecipientError(identity.fingerprint);
+  }
+  return unwrapDataKey(recipient.wrappedDataKey, identity.privateKey, identity.publicKey);
+}
+
+// src/vault/ops/capture.ts
+function emptyAppEnvs() {
+  return { development: {}, production: {} };
+}
+function captureApp(vault, identity, options) {
+  const dataKey = resolveDataKey(vault, identity);
+  const envs = options.envs ?? ENV_NAMES;
+  const allowlist = new Set(readAllowlist(options.monorepoRoot, options.app));
+  const existing = vault.apps[options.app] ?? emptyAppEnvs();
+  const nextApp = {
+    development: { ...existing.development },
+    production: { ...existing.production }
+  };
+  const captured = [];
+  const skippedEnvs = [];
+  const refusedKeys = [];
+  for (const env of envs) {
+    const local = readLocalEnvFile(options.monorepoRoot, options.app, env);
+    if (local === null) {
+      skippedEnvs.push({
+        env,
+        reason: `No local file at ${envFilePath(options.monorepoRoot, options.app, env)}; skipping "${env}" (nothing captured, no empty file created).`
+      });
+      continue;
+    }
+    const sealedEnv = { ...nextApp[env] };
+    for (const [key, value] of Object.entries(local)) {
+      if (!allowlist.has(key) && !options.force) {
+        refusedKeys.push({ env, key });
+        continue;
+      }
+      const aad = buildAad(vault.vaultId, options.app, env, key);
+      sealedEnv[key] = sealValue(value, dataKey, aad);
+      captured.push({ env, key });
+    }
+    nextApp[env] = sealedEnv;
+  }
+  return {
+    vault: { ...vault, apps: { ...vault.apps, [options.app]: nextApp } },
+    captured,
+    skippedEnvs,
+    refusedKeys
+  };
+}
+
+// src/vault/ops/apply.ts
+import * as fs28 from "fs";
+
+// src/vault/gitignore-guard.ts
+import * as fs27 from "fs";
+import * as path26 from "path";
+function escapeRegExpLiteral(char) {
+  return /[.+^${}()|[\]\\]/.test(char) ? `\\${char}` : char;
+}
+function globToRegExp(pattern) {
+  let source = "";
+  for (const char of pattern) {
+    if (char === "*") source += "[^/]*";
+    else if (char === "?") source += "[^/]";
+    else source += escapeRegExpLiteral(char);
+  }
+  return new RegExp(`^${source}$`);
+}
+function parseGitignore(content) {
+  const rules = [];
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const negated = line.startsWith("!");
+    const pattern = negated ? line.slice(1) : line;
+    const normalized = pattern.replace(/^\/+/, "").replace(/\/+$/, "");
+    if (!normalized) continue;
+    rules.push({ negated, regex: globToRegExp(normalized) });
+  }
+  return rules;
+}
+function isIgnoredByRules(rules, fileName) {
+  let ignored = false;
+  for (const rule of rules) {
+    if (rule.regex.test(fileName)) {
+      ignored = !rule.negated;
+    }
+  }
+  return ignored;
+}
+function assertIgnored(dir, fileName) {
+  const gitignorePath = path26.join(dir, ".gitignore");
+  if (!fs27.existsSync(gitignorePath)) {
+    throw new Error(
+      `Refusing to write ${fileName}: no .gitignore found at ${gitignorePath}. Add "*.json" and "!example.env.json" to it before applying.`
+    );
+  }
+  const content = fs27.readFileSync(gitignorePath, "utf8");
+  if (!content.trim()) {
+    throw new Error(
+      `Refusing to write ${fileName}: ${gitignorePath} is empty. Add "*.json" and "!example.env.json" to it before applying.`
+    );
+  }
+  const rules = parseGitignore(content);
+  if (!isIgnoredByRules(rules, fileName)) {
+    throw new Error(
+      `Refusing to write ${fileName}: it is not covered by an ignore rule in ${gitignorePath}. This file could be committed to Git.`
+    );
+  }
+}
+
+// src/vault/ops/apply.ts
+var ENV_FILE_NAME = {
+  development: "development.env.json",
+  production: "production.env.json"
+};
+function applyApp(vault, identity, options) {
+  const dataKey = resolveDataKey(vault, identity);
+  const envs = options.envs ?? ENV_NAMES;
+  const appEntry = vault.apps[options.app];
+  const applied = [];
+  const skippedEnvs = [];
+  for (const env of envs) {
+    const sealedValues = appEntry?.[env] ?? {};
+    const keys = Object.keys(sealedValues);
+    if (keys.length === 0) {
+      skippedEnvs.push({
+        env,
+        reason: `Nothing captured for "${options.app}" / "${env}" yet; run capture first.`
+      });
+      continue;
+    }
+    const dir = appEnvDir(options.monorepoRoot, options.app);
+    const fileName = ENV_FILE_NAME[env];
+    assertIgnored(dir, fileName);
+    const plaintext = {};
+    for (const key of keys) {
+      const aad = buildAad(vault.vaultId, options.app, env, key);
+      plaintext[key] = openValue(sealedValues[key], dataKey, aad);
+    }
+    const filePath = envFilePath(options.monorepoRoot, options.app, env);
+    const created = !fs28.existsSync(filePath);
+    fs28.writeFileSync(filePath, JSON.stringify(plaintext, null, 2) + "\n");
+    applied.push({ env, filePath, keysWritten: keys.length, created });
+  }
+  return { applied, skippedEnvs };
+}
+
+// src/vault/ops/diff.ts
+function diffApp(vault, identity, options) {
+  const dataKey = resolveDataKey(vault, identity);
+  const envs = options.envs ?? ENV_NAMES;
+  return envs.map((env) => {
+    const local = readLocalEnvFile(options.monorepoRoot, options.app, env) ?? {};
+    const sealedValues = vault.apps[options.app]?.[env] ?? {};
+    const keys = /* @__PURE__ */ new Set([...Object.keys(local), ...Object.keys(sealedValues)]);
+    const entries = Array.from(keys).sort((a, b) => a.localeCompare(b)).map((key) => {
+      const hasLocal = Object.prototype.hasOwnProperty.call(local, key);
+      const hasVault = Object.prototype.hasOwnProperty.call(sealedValues, key);
+      if (hasLocal && !hasVault) return { key, status: "local-only" };
+      if (!hasLocal && hasVault) return { key, status: "vault-only" };
+      const aad = buildAad(vault.vaultId, options.app, env, key);
+      const vaultValue = openValue(sealedValues[key], dataKey, aad);
+      const same = JSON.stringify(vaultValue) === JSON.stringify(local[key]);
+      return { key, status: same ? "same" : "differs" };
+    });
+    return { env, entries };
+  });
+}
+
+// src/vault/ops/status.ts
+function resolveOwnAccessState(vault, fingerprint) {
+  if (vault.recipients.some((recipient) => recipient.fingerprint === fingerprint)) return "approved";
+  if (vault.pending.some((pending) => pending.fingerprint === fingerprint)) return "pending";
+  return "no-access";
+}
+function getVaultStatus(vault, identity) {
+  const apps = Object.keys(vault.apps).sort((a, b) => a.localeCompare(b)).map((app) => ({
+    app,
+    envs: ENV_NAMES.map((env) => ({
+      env,
+      keyCount: Object.keys(vault.apps[app][env] ?? {}).length
+    }))
+  }));
+  return {
+    vaultId: vault.vaultId,
+    keyringVersion: vault.keyringVersion,
+    recipientCount: vault.recipients.length,
+    pendingCount: vault.pending.length,
+    apps,
+    ownFingerprint: identity.fingerprint,
+    ownAccessState: resolveOwnAccessState(vault, identity.fingerprint)
+  };
+}
+
+// src/vault/ops/access.ts
+var MIN_RECOMMENDED_RECIPIENTS = 2;
+function initVault(existingVault, identity, options) {
+  if (existingVault) {
+    throw new Error(
+      "A vault already exists. Refusing to re-initialize an existing vault \u2014 this would orphan every value already sealed under its current data key."
+    );
+  }
+  const dataKey = generateDataKey();
+  const owner = {
+    fingerprint: identity.fingerprint,
+    name: options.name,
+    publicKey: identity.publicKey.toString("base64"),
+    wrappedDataKey: wrapDataKey(dataKey, identity.publicKey),
+    addedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    addedBy: identity.fingerprint
+  };
+  const vault = { ...emptyVault(options.vaultId), recipients: [owner] };
+  const warning = vault.recipients.length < MIN_RECOMMENDED_RECIPIENTS ? "Only 1 recipient so far (the operator). This vault is a single point of failure until at least one teammate requests access and is approved." : void 0;
+  return { vault, warning };
+}
+function requestAccess(vault, identity, name) {
+  if (findRecipient(vault, identity.fingerprint)) {
+    throw new Error(`Identity ${identity.fingerprint} is already an approved recipient of this vault.`);
+  }
+  if (vault.pending.some((request2) => request2.fingerprint === identity.fingerprint)) {
+    throw new Error(`Identity ${identity.fingerprint} already has a pending request for this vault.`);
+  }
+  const request = {
+    fingerprint: identity.fingerprint,
+    name: name ?? identity.name,
+    publicKey: identity.publicKey.toString("base64"),
+    requestedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  return { ...vault, pending: [...vault.pending, request] };
+}
+function approveAccess(vault, approver, requesterFingerprint) {
+  const dataKey = resolveDataKey(vault, approver);
+  const request = vault.pending.find((pending) => pending.fingerprint === requesterFingerprint);
+  if (!request) {
+    throw new Error(`No pending request with fingerprint ${requesterFingerprint} to approve.`);
+  }
+  const newRecipient = {
+    fingerprint: request.fingerprint,
+    name: request.name,
+    publicKey: request.publicKey,
+    wrappedDataKey: wrapDataKey(dataKey, Buffer.from(request.publicKey, "base64")),
+    addedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    addedBy: approver.fingerprint
+  };
+  return {
+    ...vault,
+    recipients: [...vault.recipients, newRecipient],
+    pending: vault.pending.filter((pending) => pending.fingerprint !== requesterFingerprint)
+  };
+}
+function listRecipients(vault) {
+  return {
+    recipients: vault.recipients.map(({ fingerprint, name, addedAt, addedBy }) => ({
+      fingerprint,
+      name,
+      addedAt,
+      addedBy
+    })),
+    pending: vault.pending.map(({ fingerprint, name, requestedAt }) => ({ fingerprint, name, requestedAt }))
+  };
+}
+function describeIdentity(identity) {
+  return {
+    fingerprint: identity.fingerprint,
+    name: identity.name,
+    publicKey: identity.publicKey.toString("base64")
+  };
+}
+function revokeAccess(vault, revoker, targetFingerprint) {
+  const target = findRecipient(vault, targetFingerprint);
+  if (!target) {
+    throw new Error(`No approved recipient with fingerprint ${targetFingerprint} to revoke.`);
+  }
+  const oldDataKey = resolveDataKey(vault, revoker);
+  const newDataKey = generateDataKey();
+  const remainingRecipients = vault.recipients.filter((recipient) => recipient.fingerprint !== targetFingerprint).map((recipient) => ({
+    ...recipient,
+    wrappedDataKey: wrapDataKey(newDataKey, Buffer.from(recipient.publicKey, "base64"))
+  }));
+  const nextApps = {};
+  for (const app of Object.keys(vault.apps)) {
+    const envs = vault.apps[app];
+    const nextEnvs = { development: {}, production: {} };
+    for (const env of ENV_NAMES) {
+      const values = envs[env] ?? {};
+      const nextValues = {};
+      for (const [key, sealed] of Object.entries(values)) {
+        const aad = buildAad(vault.vaultId, app, env, key);
+        const plaintext = openValue(sealed, oldDataKey, aad);
+        nextValues[key] = sealValue(plaintext, newDataKey, aad);
+      }
+      nextEnvs[env] = nextValues;
+    }
+    nextApps[app] = nextEnvs;
+  }
+  return {
+    ...vault,
+    keyringVersion: vault.keyringVersion + 1,
+    recipients: remainingRecipients,
+    apps: nextApps
+  };
+}
+
+// src/flows/vault-flow.ts
+function gitUserEmail() {
+  try {
+    return execSync9("git config user.email", { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+  } catch {
+    return "";
+  }
+}
+async function promptRecipientName() {
+  const defaultName = gitUserEmail();
+  const name = await clack12.text({
+    message: "Your name/email for this vault (shown to teammates in Who)",
+    placeholder: defaultName || "you@example.com",
+    initialValue: defaultName || void 0,
+    validate: (v) => {
+      if (!v || !v.trim()) return "Name is required";
+    }
+  });
+  if (clack12.isCancel(name)) {
+    clack12.cancel("Cancelled");
+    return null;
+  }
+  return name.trim();
+}
+async function ensureIdentity() {
+  const cached = getCachedIdentity();
+  if (cached) return cached;
+  if (!identityExists()) {
+    clack12.log.info("No local identity found yet \u2014 creating one.");
+    const name = await promptRecipientName();
+    if (name === null) return null;
+    const passphrase2 = await clack12.password({ message: "Choose a passphrase to encrypt your identity key" });
+    if (clack12.isCancel(passphrase2)) {
+      clack12.cancel("Cancelled");
+      return null;
+    }
+    const confirmPassphrase = await clack12.password({ message: "Confirm passphrase" });
+    if (clack12.isCancel(confirmPassphrase)) {
+      clack12.cancel("Cancelled");
+      return null;
+    }
+    if (passphrase2 !== confirmPassphrase) {
+      clack12.log.error("Passphrases did not match.");
+      return null;
+    }
+    const identity = createIdentity(passphrase2, name);
+    cacheIdentity(identity);
+    clack12.log.success(
+      `Identity created at ${chalk25.cyan("~/.wlmaker/identity")} (fingerprint ${chalk25.cyan(identity.fingerprint)}).`
+    );
+    return identity;
+  }
+  const passphrase = await clack12.password({ message: "Enter your identity passphrase" });
+  if (clack12.isCancel(passphrase)) {
+    clack12.cancel("Cancelled");
+    return null;
+  }
+  try {
+    const identity = loadIdentity(passphrase);
+    cacheIdentity(identity);
+    return identity;
+  } catch (error) {
+    clack12.log.error(`${error}`);
+    return null;
+  }
+}
+function requireVault(filePath) {
+  if (!fs29.existsSync(filePath)) {
+    clack12.log.error(`No vault found at ${filePath}. Run "wlmaker vault init" first.`);
+    return null;
+  }
+  return readVaultFile(filePath);
+}
+async function resolveApp(monorepoRoot, provided, message) {
+  const apps = discoverAppsWithEnv(monorepoRoot);
+  if (apps.length === 0) {
+    clack12.log.error("No apps with an env/ directory found in this monorepo.");
+    return null;
+  }
+  if (provided) {
+    if (!apps.includes(provided)) {
+      clack12.log.error(`App "${provided}" not found (or has no env/ directory). Available: ${apps.join(", ")}`);
+      return null;
+    }
+    return provided;
+  }
+  const selection = await clack12.select({ message, options: apps.map((a) => ({ value: a, label: a })) });
+  if (clack12.isCancel(selection)) {
+    clack12.cancel("Cancelled");
+    return null;
+  }
+  return selection;
+}
+async function runVaultStatus(monorepoRoot) {
+  const identity = await ensureIdentity();
+  if (!identity) return;
+  const vault = requireVault(vaultPath(monorepoRoot));
+  if (!vault) return;
+  const status = getVaultStatus(vault, identity);
+  clack12.log.info(`Vault ${chalk25.cyan(status.vaultId)} \u2014 keyring v${status.keyringVersion}`);
+  clack12.log.info(`Recipients: ${status.recipientCount} approved, ${status.pendingCount} pending`);
+  clack12.log.info(`Your access: ${chalk25.cyan(status.ownAccessState)}`);
+  if (status.apps.length === 0) {
+    clack12.log.info("No apps captured yet.");
+    return;
+  }
+  for (const app of status.apps) {
+    const summary = app.envs.map((e) => `${e.env}=${e.keyCount}`).join(", ");
+    clack12.log.info(`  ${chalk25.cyan(app.app)}: ${summary}`);
+  }
+}
+async function runVaultInit(monorepoRoot) {
+  const filePath = vaultPath(monorepoRoot);
+  if (fs29.existsSync(filePath)) {
+    clack12.log.warn(`A vault already exists at ${filePath}.`);
+    return;
+  }
+  const identity = await ensureIdentity();
+  if (!identity) return;
+  const name = await promptRecipientName();
+  if (name === null) return;
+  try {
+    const result = initVault(null, identity, { vaultId: randomBytes3(16).toString("hex"), name });
+    writeVaultFile(filePath, result.vault);
+    clack12.log.success(`Vault created at ${chalk25.cyan(filePath)}.`);
+    if (result.warning) clack12.log.warn(result.warning);
+  } catch (error) {
+    clack12.log.error(`${error}`);
+  }
+}
+async function runVaultCapture(monorepoRoot, options = {}) {
+  const identity = await ensureIdentity();
+  if (!identity) return;
+  const filePath = vaultPath(monorepoRoot);
+  const vault = requireVault(filePath);
+  if (!vault) return;
+  const app = await resolveApp(monorepoRoot, options.app, "Select app to capture");
+  if (!app) return;
+  let result;
+  try {
+    result = captureApp(vault, identity, { monorepoRoot, app, envs: options.envs, force: options.force });
+  } catch (error) {
+    clack12.log.error(`${error}`);
+    return;
+  }
+  if (result.refusedKeys.length > 0 && !options.force) {
+    clack12.log.warn(`${result.refusedKeys.length} key(s) are not declared in example.env.json:`);
+    for (const { env, key } of result.refusedKeys) {
+      clack12.log.warn(`  ${env}/${key}`);
+    }
+    clack12.log.info('Add them with "wlmaker env-var" first, or force-capture them now.');
+    const typed = await clack12.text({
+      message: 'Type "force" to capture these undeclared key(s) anyway (leave empty to skip them)'
+    });
+    if (!clack12.isCancel(typed) && typed.trim().toLowerCase() === "force") {
+      try {
+        result = captureApp(vault, identity, { monorepoRoot, app, envs: options.envs, force: true });
+      } catch (error) {
+        clack12.log.error(`${error}`);
+        return;
+      }
+    }
+  }
+  for (const { env, reason } of result.skippedEnvs) {
+    clack12.log.info(`Skipped ${env}: ${reason}`);
+  }
+  writeVaultFile(filePath, result.vault);
+  clack12.log.success(`Captured ${result.captured.length} value(s) for ${chalk25.cyan(app)}.`);
+}
+async function runVaultApply(monorepoRoot, options = {}) {
+  const identity = await ensureIdentity();
+  if (!identity) return;
+  const filePath = vaultPath(monorepoRoot);
+  const vault = requireVault(filePath);
+  if (!vault) return;
+  const app = await resolveApp(monorepoRoot, options.app, "Select app to apply");
+  if (!app) return;
+  try {
+    const result = applyApp(vault, identity, { monorepoRoot, app, envs: options.envs });
+    for (const outcome of result.applied) {
+      clack12.log.success(
+        `${outcome.env}: wrote ${outcome.keysWritten} key(s) to ${outcome.filePath}${outcome.created ? " (created)" : ""}`
+      );
+    }
+    for (const { env, reason } of result.skippedEnvs) {
+      clack12.log.info(`Skipped ${env}: ${reason}`);
+    }
+  } catch (error) {
+    clack12.log.error(`${error}`);
+  }
+}
+async function runVaultDiff(monorepoRoot, options = {}) {
+  const identity = await ensureIdentity();
+  if (!identity) return;
+  const filePath = vaultPath(monorepoRoot);
+  const vault = requireVault(filePath);
+  if (!vault) return;
+  const app = await resolveApp(monorepoRoot, options.app, "Select app to diff");
+  if (!app) return;
+  try {
+    const results = diffApp(vault, identity, { monorepoRoot, app, envs: options.envs });
+    for (const { env, entries } of results) {
+      clack12.log.info(`${chalk25.cyan(env)}:`);
+      if (entries.length === 0) {
+        clack12.log.info("  (nothing)");
+        continue;
+      }
+      for (const { key, status } of entries) {
+        clack12.log.info(`  ${key}: ${status}`);
+      }
+    }
+  } catch (error) {
+    clack12.log.error(`${error}`);
+  }
+}
+async function runVaultRequestAccess(monorepoRoot) {
+  const identity = await ensureIdentity();
+  if (!identity) return;
+  const filePath = vaultPath(monorepoRoot);
+  const vault = requireVault(filePath);
+  if (!vault) return;
+  const name = await promptRecipientName();
+  if (name === null) return;
+  try {
+    const nextVault = requestAccess(vault, identity, name);
+    writeVaultFile(filePath, nextVault);
+    clack12.log.success(
+      `Access requested (fingerprint ${chalk25.cyan(identity.fingerprint)}). Ask an existing recipient to approve you.`
+    );
+  } catch (error) {
+    clack12.log.error(`${error}`);
+  }
+}
+async function runVaultApprove(monorepoRoot) {
+  const identity = await ensureIdentity();
+  if (!identity) return;
+  const filePath = vaultPath(monorepoRoot);
+  const vault = requireVault(filePath);
+  if (!vault) return;
+  if (vault.pending.length === 0) {
+    clack12.log.info("No pending requests.");
+    return;
+  }
+  const selection = await clack12.select({
+    message: "Select a pending request to approve",
+    options: vault.pending.map((p) => ({
+      value: p.fingerprint,
+      label: `${p.name} (${p.fingerprint})`,
+      hint: `requested ${p.requestedAt}`
+    }))
+  });
+  if (clack12.isCancel(selection)) {
+    clack12.cancel("Cancelled");
+    return;
+  }
+  try {
+    const nextVault = approveAccess(vault, identity, selection);
+    writeVaultFile(filePath, nextVault);
+    clack12.log.success(`Approved ${chalk25.cyan(selection)}. They can now capture/apply/diff.`);
+  } catch (error) {
+    clack12.log.error(`${error}`);
+  }
+}
+async function runVaultWho(monorepoRoot) {
+  const vault = requireVault(vaultPath(monorepoRoot));
+  if (!vault) return;
+  const { recipients, pending } = listRecipients(vault);
+  clack12.log.info("Approved recipients:");
+  if (recipients.length === 0) {
+    clack12.log.info("  (none)");
+  } else {
+    for (const r of recipients) {
+      clack12.log.info(`  ${r.name} \u2014 ${r.fingerprint} (added ${r.addedAt} by ${r.addedBy})`);
+    }
+  }
+  clack12.log.info("Pending requests:");
+  if (pending.length === 0) {
+    clack12.log.info("  (none)");
+  } else {
+    for (const p of pending) {
+      clack12.log.info(`  ${p.name} \u2014 ${p.fingerprint} (requested ${p.requestedAt})`);
+    }
+  }
+}
+async function runVaultIdentity() {
+  const identity = await ensureIdentity();
+  if (!identity) return;
+  const view = describeIdentity(identity);
+  clack12.log.info(`Name: ${view.name}`);
+  clack12.log.info(`Fingerprint: ${chalk25.cyan(view.fingerprint)}`);
+  clack12.log.info(`Public key: ${view.publicKey}`);
+  clack12.log.info("Share the public key above with an approver when requesting access.");
+}
+async function runVaultRevoke(monorepoRoot) {
+  const identity = await ensureIdentity();
+  if (!identity) return;
+  const filePath = vaultPath(monorepoRoot);
+  const vault = requireVault(filePath);
+  if (!vault) return;
+  if (vault.recipients.length === 0) {
+    clack12.log.info("No recipients to revoke.");
+    return;
+  }
+  const selection = await clack12.select({
+    message: "Select a recipient to revoke",
+    options: vault.recipients.map((r) => ({ value: r.fingerprint, label: `${r.name} (${r.fingerprint})` }))
+  });
+  if (clack12.isCancel(selection)) {
+    clack12.cancel("Cancelled");
+    return;
+  }
+  const targetFingerprint = selection;
+  const remainingAfter = vault.recipients.filter((r) => r.fingerprint !== targetFingerprint).length;
+  if (remainingAfter === 0) {
+    clack12.log.warn(chalk25.red("This is the LAST recipient. Revoking will leave NO ONE able to decrypt this vault."));
+  }
+  const confirmRevoke = await clack12.confirm({
+    message: `Revoke ${targetFingerprint}? This rotates the shared data key for everyone else.`,
+    initialValue: false
+  });
+  if (clack12.isCancel(confirmRevoke) || !confirmRevoke) {
+    clack12.cancel("Cancelled");
+    return;
+  }
+  try {
+    const nextVault = revokeAccess(vault, identity, targetFingerprint);
+    writeVaultFile(filePath, nextVault);
+    clack12.log.success(`Revoked ${chalk25.cyan(targetFingerprint)}. Data key rotated (keyring v${nextVault.keyringVersion}).`);
+  } catch (error) {
+    clack12.log.error(`${error}`);
+  }
+}
+async function vaultFlow(monorepoRoot) {
+  clack12.intro(chalk25.bgMagenta(chalk25.white(" vault ")));
+  clack12.log.info("Share STG/PROD env values with the team \u2014 encrypted, via Git. See docs/VAULT.md");
+  async function showMenu() {
+    const action = await clack12.select({
+      message: "Vault \u2014 what do you need?",
+      options: [
+        { value: "status", label: "Status", hint: "Apps, recipients, your access" },
+        { value: "init", label: "Init", hint: "Create the vault (once, per monorepo)" },
+        { value: "capture", label: "Capture", hint: "Seal local env values into the vault" },
+        { value: "apply", label: "Apply", hint: "Write vault values to local env files" },
+        { value: "diff", label: "Diff", hint: "Compare local env files vs the vault" },
+        { value: "request-access", label: "Request Access", hint: "Ask to join the shared keyring" },
+        { value: "approve", label: "Approve", hint: "Approve a pending request" },
+        { value: "who", label: "Who", hint: "List recipients and pending requests" },
+        { value: "identity", label: "Identity", hint: "Show your public key / fingerprint" },
+        { value: "revoke", label: "Revoke", hint: "Remove a recipient and rotate the key" },
+        { value: "done", label: "Done", hint: "Back to main menu" }
+      ]
+    });
+    if (clack12.isCancel(action)) {
+      clack12.cancel("Cancelled");
+      return;
+    }
+    switch (action) {
+      case "status":
+        await runVaultStatus(monorepoRoot);
+        break;
+      case "init":
+        await runVaultInit(monorepoRoot);
+        break;
+      case "capture":
+        await runVaultCapture(monorepoRoot, {});
+        break;
+      case "apply":
+        await runVaultApply(monorepoRoot, {});
+        break;
+      case "diff":
+        await runVaultDiff(monorepoRoot, {});
+        break;
+      case "request-access":
+        await runVaultRequestAccess(monorepoRoot);
+        break;
+      case "approve":
+        await runVaultApprove(monorepoRoot);
+        break;
+      case "who":
+        await runVaultWho(monorepoRoot);
+        break;
+      case "identity":
+        await runVaultIdentity();
+        break;
+      case "revoke":
+        await runVaultRevoke(monorepoRoot);
+        break;
+      case "done":
+        clack12.outro(chalk25.green("Done!"));
+        return;
+    }
+    await showMenu();
+  }
+  await showMenu();
+}
+
 // src/flows/main-menu.ts
 async function interactiveMode() {
-  clack12.intro(chalk25.bgCyan(chalk25.black(" wlmaker ")));
-  const createType = await clack12.select({
-    message: "What do you want to create?",
+  clack13.intro(chalk26.bgCyan(chalk26.black(" wlmaker ")));
+  const createType = await clack13.select({
+    message: "What do you want to do?",
     options: [
+      {
+        value: "vault",
+        label: chalk26.bold("Vault"),
+        hint: chalk26.cyan("NEW \u2014 sync encrypted STG/PROD env values with the team")
+      },
       { value: "app", label: "App", hint: "Create and manage apps" },
       { value: "bloc", label: "BLoC", hint: "State management" },
       { value: "widget", label: "Widget", hint: "Design system component" },
@@ -8574,12 +10127,25 @@ async function interactiveMode() {
       { value: "docs", label: "Docs", hint: "Project documentation tools" }
     ]
   });
-  if (clack12.isCancel(createType)) {
-    clack12.cancel("Cancelled");
+  if (clack13.isCancel(createType)) {
+    clack13.cancel("Cancelled");
     return;
   }
   const type = createType;
   switch (type) {
+    case "vault": {
+      const monorepoRoot = findMonorepoRoot(process.cwd());
+      if (!monorepoRoot) {
+        clack13.outro(
+          chalk26.red(
+            "Not inside a monorepo. Run from a Melos repo (root pubspec with workspace:/melos:, or legacy melos.yaml)."
+          )
+        );
+        return;
+      }
+      await vaultFlow(monorepoRoot);
+      break;
+    }
     case "bloc": {
       const project = await resolveProject();
       if (!project) return;
@@ -8632,7 +10198,7 @@ program.command("bloc").description("Create a new BLoC with Freezed sealed class
     try {
       await createBloc(name, options);
     } catch (error) {
-      console.error(chalk26.red(`Error: ${error}`));
+      console.error(chalk27.red(`Error: ${error}`));
       process.exit(1);
     }
   }
@@ -8641,7 +10207,7 @@ program.command("widget").description("Create a new widget in the design system"
   async (name, options) => {
     try {
       if (options.json || options.file) {
-        const raw = options.json ? JSON.parse(options.json) : JSON.parse(fs24.readFileSync(options.file, "utf-8"));
+        const raw = options.json ? JSON.parse(options.json) : JSON.parse(fs30.readFileSync(options.file, "utf-8"));
         const params = WidgetJsonSchema.parse(raw);
         await widgetFlow(params);
         return;
@@ -8659,20 +10225,20 @@ program.command("widget").description("Create a new widget in the design system"
           projectRoot: options.dir,
           buildRunner: false
         });
-        console.log(chalk26.green("Widgetbook use-case created"));
+        console.log(chalk27.green("Widgetbook use-case created"));
       } catch {
-        console.log(chalk26.yellow("Use-case skipped (may already exist)"));
+        console.log(chalk27.yellow("Use-case skipped (may already exist)"));
       }
     } catch (error) {
-      if (error instanceof z3.ZodError) {
-        console.error(chalk26.red("Invalid JSON parameters:"));
+      if (error instanceof z4.ZodError) {
+        console.error(chalk27.red("Invalid JSON parameters:"));
         for (const issue of error.issues) {
           console.error(
-            chalk26.yellow(`  \u2022 ${issue.path.join(".") || "(root)"}: ${issue.message}`)
+            chalk27.yellow(`  \u2022 ${issue.path.join(".") || "(root)"}: ${issue.message}`)
           );
         }
       } else {
-        console.error(chalk26.red(`Error: ${error}`));
+        console.error(chalk27.red(`Error: ${error}`));
       }
       process.exit(1);
     }
@@ -8686,7 +10252,7 @@ program.command("usecase").description("Create a Widgetbook use-case for an exis
         buildRunner: options.buildRunner
       });
     } catch (error) {
-      console.error(chalk26.red(`Error: ${error}`));
+      console.error(chalk27.red(`Error: ${error}`));
       process.exit(1);
     }
   }
@@ -8700,7 +10266,7 @@ program.command("page").description("Create a new page (GoRoute + View) with bar
     try {
       await createPage(name, { pagesPath: options.path });
     } catch (error) {
-      console.error(chalk26.red(`Error: ${error}`));
+      console.error(chalk27.red(`Error: ${error}`));
       process.exit(1);
     }
   }
@@ -8714,7 +10280,68 @@ program.command("package").description("Create a new package in the monorepo").a
 program.command("env-var").description("Add an environment variable across the Flutter monorepo").action(async () => {
   await envVarFlow();
 });
-program.command("app").description("Create and manage apps in the monorepo").action(async () => {
+async function runVaultCliAction(action, options) {
+  const monorepoRoot = findMonorepoRoot(process.cwd());
+  if (!monorepoRoot) {
+    console.error(chalk27.red("Not inside a monorepo. Run from a Melos repo (root pubspec with workspace:/melos:, or legacy melos.yaml)."));
+    process.exit(1);
+  }
+  if (!action) {
+    await vaultFlow(monorepoRoot);
+    return;
+  }
+  let envs;
+  if (options.env) {
+    if (options.env !== "development" && options.env !== "production") {
+      console.error(chalk27.red(`Invalid --env "${options.env}". Must be "development" or "production".`));
+      process.exit(1);
+    }
+    envs = [options.env];
+  }
+  switch (action) {
+    case "status":
+      await runVaultStatus(monorepoRoot);
+      break;
+    case "init":
+      await runVaultInit(monorepoRoot);
+      break;
+    case "capture":
+      await runVaultCapture(monorepoRoot, { app: options.app, envs, force: options.force });
+      break;
+    case "apply":
+      await runVaultApply(monorepoRoot, { app: options.app, envs });
+      break;
+    case "diff":
+      await runVaultDiff(monorepoRoot, { app: options.app, envs });
+      break;
+    case "request-access":
+      await runVaultRequestAccess(monorepoRoot);
+      break;
+    case "approve":
+      await runVaultApprove(monorepoRoot);
+      break;
+    case "who":
+      await runVaultWho(monorepoRoot);
+      break;
+    case "identity":
+      await runVaultIdentity();
+      break;
+    case "revoke":
+      await runVaultRevoke(monorepoRoot);
+      break;
+    default:
+      console.error(chalk27.red(`Unknown vault action: ${action}`));
+      process.exit(1);
+  }
+}
+program.command("vault").description("Vault: sync encrypted STG/PROD env values with the team via Git").argument("[action]", "status|init|capture|apply|diff|request-access|approve|who|identity|revoke").option("--app <name>", "app to target (capture/apply/diff)").option("--env <development|production>", "limit to one environment").option("--force", "bypass the capture allowlist confirmation").action(async (action, options) => {
+  await runVaultCliAction(action, options);
+});
+var appCmd = program.command("app").description("Create and manage apps in the monorepo");
+appCmd.command("vault").description("(alias) Same as `wlmaker vault` \u2014 prefer the top-level command").argument("[action]", "status|init|capture|apply|diff|request-access|approve|who|identity|revoke").option("--app <name>", "app to target (capture/apply/diff)").option("--env <development|production>", "limit to one environment").option("--force", "bypass the capture allowlist confirmation").action(async (action, options) => {
+  await runVaultCliAction(action, options);
+});
+appCmd.action(async () => {
   await appFlow();
 });
 var collabCmd = program.command("collaborative").description("Generate collaborative feature structure (WL collaborative template)");
@@ -8726,14 +10353,14 @@ collabCmd.command("feature").description("Create a complete collaborative featur
   const { findMonorepoRoot: findMonorepoRoot2 } = await import("./project-433ZRUBC.mjs");
   const monorepoRoot = findMonorepoRoot2(process.cwd());
   if (!monorepoRoot) {
-    console.error(chalk26.red("Not inside a monorepo. Run from a Melos repo (root pubspec with workspace:/melos:, or legacy melos.yaml)."));
+    console.error(chalk27.red("Not inside a monorepo. Run from a Melos repo (root pubspec with workspace:/melos:, or legacy melos.yaml)."));
     process.exit(1);
   }
   try {
     const { createCollaborativeFeature: createCollaborativeFeature2 } = await import("./generator-NQ6GX2L6.mjs");
     await createCollaborativeFeature2({ monorepoRoot, featureName: name });
   } catch (error) {
-    console.error(chalk26.red(`Error: ${error}`));
+    console.error(chalk27.red(`Error: ${error}`));
     process.exit(1);
   }
 });
@@ -8746,7 +10373,7 @@ collabCmd.command("page").description("Add a page + view to an existing collabor
     const { createCollaborativePage: createCollaborativePage2 } = await import("./generator-OYLKPDQC.mjs");
     await createCollaborativePage2({ featurePath: options.feature, pageName: name });
   } catch (error) {
-    console.error(chalk26.red(`Error: ${error}`));
+    console.error(chalk27.red(`Error: ${error}`));
     process.exit(1);
   }
 });
@@ -8759,7 +10386,7 @@ collabCmd.command("bloc").description("Add a BLoC to an existing collaborative f
     const { createCollaborativeBloc: createCollaborativeBloc2 } = await import("./generator-CACGWIBO.mjs");
     await createCollaborativeBloc2({ featurePath: options.feature, blocName: name });
   } catch (error) {
-    console.error(chalk26.red(`Error: ${error}`));
+    console.error(chalk27.red(`Error: ${error}`));
     process.exit(1);
   }
 });
@@ -8773,26 +10400,26 @@ var docsCmd = program.command("docs").description("Project documentation tools")
 docsCmd.command("serve").description("Start Docusaurus dev server").option("-d, --dir <path>", "project root directory", process.cwd()).action(async (options) => {
   const bookDir = detectBookDir(options.dir);
   if (!bookDir) {
-    console.error(chalk26.red("No Docusaurus book/ directory found. Run from a monorepo root."));
+    console.error(chalk27.red("No Docusaurus book/ directory found. Run from a monorepo root."));
     process.exit(1);
   }
-  console.log(chalk26.cyan(`Serving docs from ${bookDir}`));
+  console.log(chalk27.cyan(`Serving docs from ${bookDir}`));
   await serveBook(bookDir);
 });
 docsCmd.command("commands").description("Show Makefile & melos commands reference").option("-d, --dir <path>", "project root directory", process.cwd()).action(async (options) => {
   const commands = discoverCommands(options.dir);
   if (commands.length === 0) {
-    console.log(chalk26.yellow("No commands found. Run from a monorepo root."));
+    console.log(chalk27.yellow("No commands found. Run from a monorepo root."));
     return;
   }
-  console.log(chalk26.green(`Found ${commands.length} command(s)
+  console.log(chalk27.green(`Found ${commands.length} command(s)
 `));
   displayCommands(commands);
 });
 docsCmd.command("architecture").description("Display monorepo architecture tree").option("-d, --dir <path>", "project root directory", process.cwd()).action(async (options) => {
   const info = discoverArchitecture(options.dir);
   if (!info) {
-    console.log(chalk26.yellow("No monorepo detected. Run from a Melos repo (root pubspec with workspace:/melos:, or legacy melos.yaml)."));
+    console.log(chalk27.yellow("No monorepo detected. Run from a Melos repo (root pubspec with workspace:/melos:, or legacy melos.yaml)."));
     return;
   }
   displayArchitecture(info);