feat: harden wizard flow and env mapping

[onmax]

Summary

• unify env-key mapping so runtime transform and wizard schema generation use the same logic
• keep public keys flattened (PUBLIC_* / NUXT_PUBLIC_*) to match runtime behavior
• add install-wizard safety: action preview + final confirmation before any mutation
• skip install wizard in non-interactive terminals (TTY guard)
• align Shelve docs with actual config resolution sources and wizard behavior
• harden tests (wizard cancellation/no-mutation + deterministic cache TTL test)
• remove stale backup file (src/module.ts.bak)

Tests

• pnpm lint
• pnpm typecheck
• pnpm test
• pnpm test:types

Related: #6

---

Note

Medium Risk
Changes the env-var-to-runtimeConfig key-shaping used for Shelve secrets and wizard-generated schemas, which could affect config shape for existing users. Wizard behavior is also altered to defer mutations until explicit confirmation, reducing risk but changing install-time UX.

Overview
Aligns Shelve/wizard env-key mapping by extracting shared path-resolution logic into src/utils/transform.ts (new buildConfigStructureFromEnvKeys + shared grouping/public-key rules) and reusing it for wizard schema generation to prevent runtime/schema drift.

Hardens the install wizard: it now skips in non-interactive (non-TTY) sessions, previews planned actions, and requires explicit confirmation before installing deps, writing ~/.shelve, or editing nuxt.config. Docs and tests are updated accordingly (including deterministic Shelve cache TTL coverage), and a stale src/module.ts.bak file is removed.

^{Written by Cursor Bugbot for commit cef34dd. This will update automatically on new commits. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nuxt-safe-runtime-config	Ready	Preview, Comment	Feb 23, 2026 9:12am
safe-runtime-config	Ready	Preview, Comment	Feb 23, 2026 9:12am

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/onmax/nuxt-safe-runtime-config@8

commit: 93e4d54

[cursor]

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on March 30.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.