the generated src/index.ts content.
the generated provision.config.ts content.
Optionalcontractthe generated src/contract.ops.ts — the COMPOSED contract surface (one RouteContract[] fragment per module). Present
ONLY when the contract service is installed; the base src/contract.ts consumes its ALL_OPS.
the generated package.json content (the FRAMEWORK baseline — generate merges it with any existing so app-added
deps/scripts survive). @suluk/* on "latest" so fixes flow via bun update; ecosystem deps on pinned ranges.
the generated tsconfig.json content (the Workers + TS config; test files excluded from the build).
the generated components.json content (so shadcn add resolves the file targets).
the generated .env.example — the SECRET keys the selected services need (non-secrets live in the manifest vars).
the generated wrangler.toml — [vars] from the manifest's non-secret config + the D1/KV binding placeholders.
the generated .gitignore — ignores .env.keys (the private key) + .env.temp, but NOT .env (committed ENCRYPTED).
the generated scripts/env-check.ts — the encrypted-env preflight (keypair present? required secrets set + encrypted?).
the generated src/env.ts — the @suluk/env defineEnv declaration (declare-once: the app's secrets, surfaced).
the generated scripts/sync-secrets.ts — decrypt the cloudflare-surfaced secrets from the committed .env and push them
as wrangler secrets (the toolfactory-exact deploy path; the alternative is the entry's runtime loadEnv).
the generated scripts/link-key.ts — register the private key into the centralized ~/.suluk/settings.json (the store
@suluk/env reads by default for local dev/deploy/CI), the toolfactory model.
the generated .env.temp SCAFFOLD — the PLAINTEXT bootstrap for bun run provision (gitignored; consumed + deleted).
the generated scripts/provision.ts — the credential lifecycle: source .env.temp/.env → provision → mint scoped
tokens → encrypt keepers → DELETE the ephemeral master token → stage the encrypted .env.
the generated scripts/mint-tokens.ts — mint scoped least-privilege CF tokens from the master, encrypted into .env.
the generated .env SCAFFOLD (committed) — a header + the setup steps, NO values. generate writes it only if absent
(never clobbering the operator's encrypted secrets). Secret VALUES are added encrypted via suluk-env set.
Optionaldevthe generated src/dev.ts — the bun MOCK-PROVIDER dev server (bun:sqlite DB + JSON KV + mocked providers when keys
absent). Present ONLY when the manifest sets local: true; undefined otherwise (so the golden path is unchanged).
Optionalpurgethe generated scripts/purge-state.ts — clears dev/live state (recommended on a mock↔real swap or a provision
migration). Present ONLY when local: true.
shadcn refs to add, in order (e.g. "MahmoodKhalil57/suluk/credits").