@beechcms/cli 0.8.0 → 0.9.0

package/dist/index.js

@@ -17,8 +17,15 @@ var __export = (target, all) => {
 import { spawnSync } from "node:child_process";
 import { writeFileSync, rmSync, existsSync, readFileSync, readdirSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { DatabaseSync } from "node:sqlite";
+import { createRequire } from "node:module";
+function validateDbName(name) {
+  if (typeof name !== "string" || !/^[A-Za-z0-9_-]+$/.test(name)) {
+    throw new Error(`Invalid D1 database name: ${name}`);
+  }
+  return name;
+}
 function buildArgs(options) {
   const args = [];
   if (options.configPath) args.push("--config", options.configPath);
@@ -50,6 +57,7 @@ function getLocalD1SqlitePath(startDir = process.cwd()) {
   return null;
 }
 function executeD1File(sql, options) {
+  validateDbName(options.db);
   if (options.local) {
     const sqlitePath = getLocalD1SqlitePath();
     if (sqlitePath) {
@@ -65,10 +73,10 @@ function executeD1File(sql, options) {
   try {
     writeFileSync(tmpFile, sql, "utf-8");
     const args = ["d1", "execute", options.db, "--file", tmpFile, ...buildArgs(options)];
-    const result = spawnSync("npx", ["wrangler", ...args], {
+    const result = spawnSync(process.execPath, [join(dirname(require2.resolve("wrangler/package.json")), "bin", "wrangler.js"), ...args], {
       stdio: "inherit",
       cwd: process.cwd(),
-      shell: true,
+      shell: false,
       env: { ...process.env, WRANGLER_SEND_METRICS: "false" }
     });
     return result.status === 0;
@@ -80,6 +88,7 @@ function executeD1File(sql, options) {
   }
 }
 function queryD1(sql, options) {
+  validateDbName(options.db);
   if (options.local) {
     const sqlitePath = getLocalD1SqlitePath();
     if (sqlitePath) {
@@ -95,10 +104,10 @@ function queryD1(sql, options) {
   try {
     writeFileSync(tmpFile, sql, "utf-8");
     const args = ["d1", "execute", options.db, "--file", tmpFile, "--json", ...buildArgs(options)];
-    result = spawnSync("npx", ["wrangler", ...args], {
+    result = spawnSync(process.execPath, [join(dirname(require2.resolve("wrangler/package.json")), "bin", "wrangler.js"), ...args], {
       encoding: "utf-8",
       cwd: process.cwd(),
-      shell: true,
+      shell: false,
       env: { ...process.env, WRANGLER_SEND_METRICS: "false" }
     });
   } finally {
@@ -123,12 +132,12 @@ function findWranglerConfig() {
   let dir = process.cwd();
   while (true) {
     for (const name of ["wrangler.jsonc", "wrangler.json", "wrangler.toml"]) {
-      const p3 = resolve(dir, name);
-      if (existsSync(p3)) return p3;
+      const p4 = resolve(dir, name);
+      if (existsSync(p4)) return p4;
     }
     for (const name of ["wrangler.jsonc", "wrangler.json", "wrangler.toml"]) {
-      const p3 = resolve(dir, "apps", "api", name);
-      if (existsSync(p3)) return p3;
+      const p4 = resolve(dir, "apps", "api", name);
+      if (existsSync(p4)) return p4;
     }
     const parent = resolve(dir, "..");
     if (parent === dir) break;
@@ -138,6 +147,7 @@ function findWranglerConfig() {
 }
 function resolveDbName(configPath) {
   if (!configPath) return "beech-db";
+  let name = "beech-db";
   try {
     const raw = readFileSync(configPath, "utf-8");
     if (configPath.endsWith(".toml")) {
@@ -145,21 +155,24 @@ function resolveDbName(configPath) {
       if (d1SectionMatch) {
         const section = d1SectionMatch[0];
         const dbNameMatch = section.match(/database_name\s*=\s*["'](.+?)["']/);
-        if (dbNameMatch) return dbNameMatch[1];
+        if (dbNameMatch) name = dbNameMatch[1];
       }
-      return "beech-db";
+    } else {
+      const stripped = raw.replace(/\/\/[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
+      const parsed = JSON.parse(stripped);
+      const bindings = parsed?.d1_databases ?? [];
+      name = bindings[0]?.database_name ?? "beech-db";
     }
-    const stripped = raw.replace(/\/\/[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
-    const parsed = JSON.parse(stripped);
-    const bindings = parsed?.d1_databases ?? [];
-    return bindings[0]?.database_name ?? "beech-db";
   } catch {
     return "beech-db";
   }
+  return validateDbName(name);
 }
+var require2;
 var init_wrangler = __esm({
   "src/lib/wrangler.ts"() {
     "use strict";
+    require2 = createRequire(import.meta.url);
   }
 });
 
@@ -169,10 +182,11 @@ __export(init_exports, {
   init: () => init
 });
 import pc2 from "picocolors";
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { appendFileSync, existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { resolve as resolve2, basename } from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
+import { randomBytes } from "node:crypto";
 function checkWranglerAuth() {
   const result = spawnSync2("npx", ["wrangler", "whoami", "--json"], {
     encoding: "utf-8",
@@ -287,6 +301,24 @@ function echoApiKeys(configPath) {
   } catch {
   }
 }
+function ensurePrivacyMasterKey(devVarsPath) {
+  const content = readFileSync2(devVarsPath, "utf8");
+  const lines = content.split(/\r?\n/);
+  const index = lines.findIndex((line) => /^PRIVACY_MASTER_KEY=/.test(line));
+  if (index !== -1 && lines[index].slice("PRIVACY_MASTER_KEY=".length).trim() !== "") return false;
+  const entry = `PRIVACY_MASTER_KEY=${randomBytes(32).toString("hex")}`;
+  if (index !== -1) {
+    lines[index] = entry;
+    writeFileSync2(devVarsPath, lines.join("\n"), "utf8");
+  } else {
+    const separator = content === "" || content.endsWith("\n") ? "" : "\n";
+    appendFileSync(devVarsPath, `${separator}
+# Master key for protected fields (AES-GCM + blind index). Do NOT change once data is stored.
+${entry}
+`, "utf8");
+  }
+  return true;
+}
 function checkFiles(cwd, checkDevVars) {
   let ok = true;
   const workerExists = existsSync2(resolve2(cwd, "worker.ts")) || existsSync2(resolve2(cwd, "worker.js"));
@@ -309,6 +341,9 @@ function checkFiles(cwd, checkDevVars) {
       console.log(pc2.dim("  \u25CB .dev.vars        \u2014 not found (optional: only needed for production R2 credentials)"));
     } else {
       console.log(pc2.green("  \u2713 .dev.vars"));
+      if (ensurePrivacyMasterKey(resolve2(cwd, ".dev.vars"))) {
+        console.log(pc2.green("  \u2713 PRIVACY_MASTER_KEY \u2014 generated in .dev.vars"));
+      }
     }
   }
   return ok;
@@ -1021,132 +1056,1291 @@ async function reset(args) {
 }
 
 // src/commands/generate-types.ts
-init_wrangler();
 import { writeFileSync as writeFileSync3, mkdirSync } from "node:fs";
-import { dirname, resolve as resolve4 } from "node:path";
+import { dirname as dirname2, resolve as resolve4 } from "node:path";
+import pc12 from "picocolors";
+import { computeSchemaFingerprint, generateSeedTypes } from "@beechcms/core";
+
+// src/lib/d1-context.ts
+init_wrangler();
 import pc11 from "picocolors";
-import { generateSeedTypes } from "@beechcms/core";
-async function generateTypes(args = {}) {
-  const isLocal = args.local !== false;
+import { introspectSeedDefinitions } from "@beechcms/core";
+
+// src/lib/d1-executor.ts
+init_wrangler();
+function createWranglerExecutor(options) {
+  return {
+    all(sql) {
+      return Promise.resolve(queryD1(sql, options));
+    }
+  };
+}
+
+// src/lib/d1-context.ts
+var CliError = class extends Error {
+  constructor(message, hint, cause) {
+    super(message);
+    this.hint = hint;
+    this.cause = cause;
+    this.name = "CliError";
+  }
+  hint;
+  cause;
+};
+function createD1Context(args = {}) {
+  const local = args.local !== false;
   const configPath = findWranglerConfig();
   const db = args.db ?? resolveDbName(configPath);
-  if (isLocal) {
-    const sqlitePath = getLocalD1SqlitePath();
-    if (!sqlitePath) {
-      console.error(
-        pc11.red("\n  \u2717 Local D1 database state not found.") + pc11.gray("\n    Start your local development environment with `beech dev` or initialize with `beech init --db`.\n")
+  if (local && !getLocalD1SqlitePath()) {
+    throw new CliError(
+      "Local D1 database state not found.",
+      "Start the local environment with `beech dev`, or initialize it with `beech init --db`."
+    );
+  }
+  const options = { db, local, configPath };
+  return { executor: createWranglerExecutor(options), options };
+}
+async function loadLiveSeeds(context) {
+  let seeds;
+  try {
+    seeds = await introspectSeedDefinitions(context.executor);
+  } catch (error) {
+    const detail = describeCause(error);
+    if (detail.includes("no such table: seeds")) {
+      throw new CliError(
+        "System table `seeds` not found in the database.",
+        "Run `beech init --db` or `beech onboard` to create the system tables.",
+        error
       );
-      process.exit(1);
     }
+    throw new CliError(
+      `Failed to introspect D1 database (${context.options.db}): ${detail}`,
+      void 0,
+      error
+    );
   }
-  const options = {
-    db,
-    local: isLocal,
-    configPath
-  };
-  let rows;
+  if (seeds.length === 0) {
+    throw new CliError(
+      `No active seeds found in D1 database (${context.options.db}).`,
+      "Create a content type in the dashboard (/admin) or through POST /api/seeds."
+    );
+  }
+  return seeds;
+}
+function describeCause(error) {
+  const parts = [];
+  let current = error;
+  for (let depth = 0; current instanceof Error && depth < 5; depth++) {
+    parts.push(current.message);
+    current = current.cause;
+  }
+  if (parts.length === 0) parts.push(String(error));
+  return parts.join(" \u2014 ");
+}
+function exitWithError(error) {
+  if (error instanceof CliError) {
+    console.error(pc11.red(`
+  \u2717 ${error.message}`) + (error.hint ? pc11.gray(`
+    ${error.hint}
+`) : "\n"));
+  } else {
+    console.error(pc11.red(`
+  \u2717 ${error instanceof Error ? error.message : String(error)}
+`));
+  }
+  process.exit(1);
+}
+
+// src/commands/generate-types.ts
+var DEFAULT_TYPES_PATH = "beech.generated.ts";
+async function generateTypes(args = {}) {
   try {
-    rows = queryD1(
-      `SELECT slug, definition FROM seeds WHERE status = 'active' ORDER BY slug ASC;`,
-      options
+    const context = createD1Context(args);
+    const seeds = await loadLiveSeeds(context);
+    const fingerprint = await computeSchemaFingerprint(seeds);
+    const code = generateSeedTypes(seeds, { fingerprint });
+    if (args.out === null) {
+      process.stdout.write(code);
+      return;
+    }
+    const target = args.out ?? DEFAULT_TYPES_PATH;
+    const outPath = resolve4(process.cwd(), target);
+    mkdirSync(dirname2(outPath), { recursive: true });
+    writeFileSync3(outPath, code, "utf-8");
+    console.log(
+      pc12.green(`
+  \u2713 Generated ${seeds.length} interface(s) \u2192 ${target}`) + pc12.gray(`
+    schema fingerprint ${fingerprint}
+`)
     );
   } catch (error) {
-    const errMsg = error?.message || String(error);
-    if (errMsg.includes("no such table: seeds")) {
-      console.error(
-        pc11.red("\n  \u2717 System table `seeds` not found in database.") + pc11.gray("\n    Run `beech init --db` or `beech onboard` to initialize system tables.\n")
+    exitWithError(error);
+  }
+}
+
+// src/commands/types-check.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "node:fs";
+import { resolve as resolve5 } from "node:path";
+import pc13 from "picocolors";
+import { computeSchemaFingerprint as computeSchemaFingerprint2, generateSeedTypes as generateSeedTypes2 } from "@beechcms/core";
+async function typesCheck(args = {}) {
+  try {
+    const context = createD1Context(args);
+    const seeds = await loadLiveSeeds(context);
+    const fingerprint = await computeSchemaFingerprint2(seeds);
+    const fresh = generateSeedTypes2(seeds, { fingerprint });
+    const target = args.out ?? DEFAULT_TYPES_PATH;
+    const outPath = resolve5(process.cwd(), target);
+    if (!existsSync4(outPath)) {
+      console.log(
+        pc13.yellow(`
+  \u26A0 ${target} not found.`) + pc13.gray(`
+    Run \`beech types generate\` to create it.
+`)
       );
-    } else {
-      console.error(
-        pc11.red(`
-  \u2717 Failed to introspect D1 database (${db}):`) + pc11.gray(`
-    ${errMsg}
+      process.exit(1);
+    }
+    const committed = readFileSync5(outPath, "utf-8");
+    if (normalizeEol(committed) !== normalizeEol(fresh)) {
+      console.log(
+        pc13.yellow(`
+  \u26A0 ${target} is stale \u2014 it does not match the live D1 schema.`) + pc13.gray(`
+    Run \`beech types generate\` and commit the result.
 `)
       );
+      process.exit(1);
     }
-    process.exit(1);
+    console.log(
+      pc13.green(`
+  \u2713 ${target} matches live D1.`) + pc13.gray(`
+    schema fingerprint ${fingerprint}
+`)
+    );
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+function normalizeEol(text3) {
+  return text3.replace(/\r\n/g, "\n");
+}
+
+// src/commands/schema-diff.ts
+import { existsSync as existsSync6 } from "node:fs";
+import { resolve as resolve7 } from "node:path";
+import pc16 from "picocolors";
+
+// src/lib/manifest-loader.ts
+import { existsSync as existsSync5 } from "node:fs";
+import { resolve as resolve6 } from "node:path";
+import { pathToFileURL } from "node:url";
+import { MANIFEST_VERSION, validateManifest } from "@beechcms/core/schema";
+var DEFAULT_MANIFEST_PATH = "beech.schema.ts";
+var ManifestLoadError = class extends Error {
+  constructor(message, issues = [], cause) {
+    super(message);
+    this.issues = issues;
+    this.cause = cause;
+    this.name = "ManifestLoadError";
+  }
+  issues;
+  cause;
+};
+function interpretManifestModule(module, path) {
+  const candidate = module?.default;
+  if (candidate === void 0) {
+    throw new ManifestLoadError(
+      `${path} has no default export. A manifest ends with \`export default defineSchema({ seeds: [...] })\`.`
+    );
   }
-  if (!rows || rows.length === 0) {
-    console.error(
-      pc11.red(`
-  \u2717 No active seeds found in D1 database (${db}).`) + pc11.gray("\n    Create or activate seeds via the dashboard (/admin) or REST API (/api/seeds).\n")
+  if (typeof candidate !== "object" || candidate === null) {
+    throw new ManifestLoadError(`${path} default-exports a ${typeof candidate}, not a manifest object.`);
+  }
+  const manifest = candidate;
+  if (manifest.version !== MANIFEST_VERSION) {
+    throw new ManifestLoadError(
+      `${path} declares manifest version ${String(manifest.version)}; this build understands ${MANIFEST_VERSION}.`
     );
-    process.exit(1);
   }
-  let seeds;
+  if (!Array.isArray(manifest.seeds)) {
+    throw new ManifestLoadError(`${path} is missing a \`seeds\` array.`);
+  }
+  const complete = manifest;
+  const issues = validateManifest(complete);
+  const fatal = issues.filter((issue) => issue.fatal);
+  if (fatal.length > 0) {
+    throw new ManifestLoadError(
+      `${path} is not a valid schema: ${fatal.flatMap((issue) => issue.messages).join("; ")}`,
+      issues
+    );
+  }
+  return complete;
+}
+async function loadManifest(path = DEFAULT_MANIFEST_PATH) {
+  const absolute = resolve6(process.cwd(), path);
+  if (!existsSync5(absolute)) {
+    throw new ManifestLoadError(
+      `No manifest at ${path}. Produce one from the live database with \`beech schema export\`.`
+    );
+  }
+  let module;
   try {
-    seeds = rows.map((r) => JSON.parse(r.definition));
-  } catch (err) {
-    console.error(
-      pc11.red("\n  \u2717 Failed to parse seed definitions from database:") + pc11.gray(`
-    ${err?.message || err}
-`)
+    module = await import(pathToFileURL(absolute).href);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ERR_UNKNOWN_FILE_EXTENSION" || code === "ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING") {
+      throw new ManifestLoadError(
+        `This Node build cannot import ${path} directly (TypeScript type stripping unavailable).`,
+        [],
+        error
+      );
+    }
+    throw new ManifestLoadError(`${path} failed to load: ${error.message}`, [], error);
+  }
+  return interpretManifestModule(module, path);
+}
+
+// src/lib/manifest-compare.ts
+import pc14 from "picocolors";
+import { normalizeSeedDefinition } from "@beechcms/core";
+import { MANIFEST_VERSION as MANIFEST_VERSION2, seedsToManifest, toCanonicalJson } from "@beechcms/core/schema";
+function canonicalize(seed) {
+  const normalized = normalizeSeedDefinition(seed);
+  return toCanonicalJson({ version: MANIFEST_VERSION2, seeds: [normalized] });
+}
+function compareManifest(manifest, liveSeeds) {
+  const authored = new Map(manifest.seeds.map((seed) => [seed.slug, canonicalize(seed)]));
+  const deployed = new Map(seedsToManifest(liveSeeds).seeds.map((seed) => [seed.slug, canonicalize(seed)]));
+  const slugs = [.../* @__PURE__ */ new Set([...authored.keys(), ...deployed.keys()])].sort((a, b) => a.localeCompare(b));
+  const seeds = slugs.map((slug) => {
+    const left = authored.get(slug);
+    const right = deployed.get(slug);
+    if (left === void 0) return { slug, status: "only_in_database" };
+    if (right === void 0) return { slug, status: "only_in_manifest" };
+    return { slug, status: left === right ? "in_sync" : "differs" };
+  });
+  return { seeds, inSync: seeds.every((seed) => seed.status === "in_sync") };
+}
+function renderManifestDrift(drift, manifestPath) {
+  if (drift.inSync) {
+    console.log(pc14.green(`  \u2713 ${manifestPath} matches the deployed schema`));
+    return;
+  }
+  for (const seed of drift.seeds) {
+    switch (seed.status) {
+      case "in_sync":
+        console.log(pc14.green(`  \u2713 ${seed.slug}`));
+        break;
+      case "only_in_manifest":
+        console.log(pc14.yellow(`  + ${seed.slug} \u2014 in the manifest, not deployed (apply would create it)`));
+        break;
+      case "only_in_database":
+        console.log(pc14.yellow(`  - ${seed.slug} \u2014 deployed, absent from the manifest (re-export to refresh)`));
+        break;
+      case "differs":
+        console.log(pc14.red(`  \u2260 ${seed.slug} \u2014 manifest and deployed definition disagree`));
+        break;
+    }
+  }
+}
+
+// src/lib/schema-diff.ts
+import pc15 from "picocolors";
+import { getExpectedColumns, introspectTable } from "@beechcms/core";
+function isSeedClean(diff) {
+  return diff.tableExists && diff.columns.every((c) => c.status === "ok");
+}
+function renderSeedDiff(diff) {
+  const table = `content_${diff.slug}`;
+  if (!diff.tableExists) {
+    console.log(pc15.red(`  \u2717 ${table} \u2014 table missing`));
+    return;
+  }
+  const problems = diff.columns.filter((c) => c.status !== "ok");
+  if (problems.length === 0) {
+    console.log(pc15.green(`  \u2713 ${table}`));
+    return;
+  }
+  console.log(pc15.yellow(`  \u26A0 ${table}`));
+  for (const col of problems) {
+    switch (col.status) {
+      case "missing":
+        console.log(pc15.red(`    + missing column: ${col.name} ${col.expectedType}`));
+        break;
+      case "extra":
+        console.log(pc15.dim(`    ~ orphaned column: "${col.name}" (${col.actualType}) \u2014 in DB, not in schema definition`));
+        break;
+      case "type_mismatch":
+        console.log(pc15.red(`    \u2260 type mismatch:  ${col.name} (expected ${col.expectedType}, got ${col.actualType})`));
+        break;
+      case "fk_missing":
+        console.log(pc15.red(`    \u292C missing FK: ${col.name} \u2192 content_${col.expectedTarget}(id)`));
+        break;
+      case "fk_mismatch":
+        console.log(pc15.yellow(`    \u292C FK mismatch: ${col.name} expected ${col.expected}, got ${col.actual}`));
+        break;
+      case "index_missing":
+        console.log(pc15.yellow(`    \u2298 missing index on ${col.name}`));
+        break;
+    }
+  }
+}
+async function diffSeed(seed, executor) {
+  const live = await introspectTable(executor, `content_${seed.slug}`);
+  const expected = getExpectedColumns(seed);
+  if (!live.exists) {
+    return {
+      slug: seed.slug,
+      tableExists: false,
+      columns: expected.map((c) => ({ name: c.name, status: "missing", expectedType: c.sqlType }))
+    };
+  }
+  const actualMap = new Map(live.columns.map((c) => [c.name, c]));
+  const expectedSet = new Set(expected.map((c) => c.name));
+  const columns = [];
+  for (const col of expected) {
+    const actual = actualMap.get(col.name);
+    if (!actual) {
+      columns.push({ name: col.name, status: "missing", expectedType: col.sqlType });
+    } else if (actual.sqlType !== col.sqlType) {
+      columns.push({ name: col.name, status: "type_mismatch", expectedType: col.sqlType, actualType: actual.sqlType });
+    } else {
+      columns.push({ name: col.name, status: "ok" });
+    }
+  }
+  for (const actual of live.columns) {
+    if (!expectedSet.has(actual.name)) {
+      columns.push({ name: actual.name, status: "extra", actualType: actual.sqlType });
+    }
+  }
+  const relationBranches = seed.branches.filter((b) => b.type === "relation" && b.targetSeed);
+  if (relationBranches.length > 0) {
+    const fkByColumn = new Map(live.foreignKeys.map((fk) => [fk.column, fk]));
+    const indexNames = new Set(live.indexes.map((i) => i.name));
+    for (const branch of relationBranches) {
+      const expectedFkTable = `content_${branch.targetSeed}`;
+      const expectedOnDelete = (branch.onDelete ?? "SET NULL").toUpperCase();
+      const expectedIndexName = `idx_${seed.slug}_${branch.alias}`;
+      const colDiff = columns.find((c) => c.name === branch.alias);
+      if (!colDiff || colDiff.status === "missing") continue;
+      const fk = fkByColumn.get(branch.alias);
+      if (!fk) {
+        colDiff.status = "fk_missing";
+        colDiff.expectedTarget = branch.targetSeed;
+      } else if (fk.targetTable !== expectedFkTable || fk.onDelete !== expectedOnDelete) {
+        colDiff.status = "fk_mismatch";
+        colDiff.expected = `\u2192 ${expectedFkTable}(id) ON DELETE ${expectedOnDelete}`;
+        colDiff.actual = `\u2192 ${fk.targetTable}(id) ON DELETE ${fk.onDelete}`;
+        colDiff.expectedTarget = branch.targetSeed;
+      }
+      if (!indexNames.has(expectedIndexName)) {
+        if (colDiff.status === "ok") colDiff.status = "index_missing";
+        else columns.push({ name: branch.alias, status: "index_missing" });
+      }
+    }
+  }
+  return { slug: seed.slug, tableExists: true, columns };
+}
+
+// src/commands/schema-diff.ts
+async function schemaDiff(args = {}) {
+  try {
+    const context = createD1Context(args);
+    const liveSeeds = await loadLiveSeeds(context);
+    const manifestPath = args.manifest ?? DEFAULT_MANIFEST_PATH;
+    let manifestDrifted = false;
+    console.log(pc16.cyan(`
+  Manifest vs deployed definitions (${context.options.db})
+`));
+    if (existsSync6(resolve7(process.cwd(), manifestPath))) {
+      const manifest = await loadManifest(manifestPath);
+      const drift = compareManifest(manifest, liveSeeds);
+      renderManifestDrift(drift, manifestPath);
+      manifestDrifted = !drift.inSync;
+    } else {
+      console.log(pc16.dim(`  \u2298 no ${manifestPath} \u2014 run \`beech schema export\` to create one`));
+    }
+    console.log(pc16.cyan("\n  Deployed definitions vs physical tables\n"));
+    let physicalDrifted = false;
+    for (const seed of liveSeeds) {
+      const diff = await diffSeed(seed, context.executor);
+      renderSeedDiff(diff);
+      if (!isSeedClean(diff)) physicalDrifted = true;
+    }
+    console.log("");
+    if (manifestDrifted || physicalDrifted) {
+      console.log(pc16.yellow("  \u26A0 Schema drift detected.\n"));
+      process.exit(1);
+    }
+    console.log(pc16.green("  \u2713 No drift.\n"));
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+
+// src/commands/schema-migrate.ts
+import pc17 from "picocolors";
+import {
+  findTagOrphans,
+  manualTagSteps,
+  planTagMigration,
+  tagMigrationStatements
+} from "@beechcms/core";
+init_wrangler();
+function renderTagMigrationPlan(plan) {
+  for (const step of plan.steps) {
+    if (step.action === "manual") {
+      console.log(pc17.red(`  \u2717 ${step.seed}: ${step.summary}`));
+    } else {
+      console.log(pc17.green(`  \u2713 ${step.seed}: ${step.summary}`));
+    }
+    for (const warning of step.warnings) console.log(pc17.yellow(`      \u26A0 ${warning}`));
+  }
+}
+async function schemaMigrate(args = {}) {
+  try {
+    const context = createD1Context(args);
+    const seeds = await loadLiveSeeds(context);
+    const plan = planTagMigration(seeds);
+    console.log(pc17.cyan(`
+  Tags contract migration (${context.options.db})
+`));
+    if (plan.steps.length === 0) {
+      console.log(pc17.green("  \u2713 Every seed already uses the closed-vocabulary tags contract. Nothing to migrate.\n"));
+      return;
+    }
+    renderTagMigrationPlan(plan);
+    const orphans = await findTagOrphans(context.executor, plan, seeds);
+    for (const orphan of orphans) {
+      console.log(pc17.yellow(
+        `  \u26A0 ${orphan.seed}.${orphan.alias}: ${orphan.rows} row(s) hold '${orphan.value}', which is not an option. Left untouched.`
+      ));
+    }
+    const manual = manualTagSteps(plan);
+    const statements = tagMigrationStatements(plan, seeds);
+    if (!args.apply) {
+      console.log(pc17.dim(`
+  Dry run: nothing was changed. ${statements.length > 0 ? "Re-run with --apply to migrate." : ""}`));
+      if (manual.length > 0) console.log(pc17.red(`  ${manual.length} step(s) need a manual edit of the seed.`));
+      console.log("");
+      process.exit(1);
+      return;
+    }
+    if (statements.length === 0) {
+      console.log(pc17.red(`
+  \u2717 Nothing can be migrated automatically: ${manual.length} step(s) need a manual edit.
+`));
+      process.exit(1);
+      return;
+    }
+    if (!executeD1File(statements.join("\n"), context.options)) {
+      throw new CliError(
+        "The migration statements failed to execute.",
+        "They are idempotent: fix the reported error and run `beech schema migrate --apply` again."
+      );
+    }
+    const remaining = planTagMigration(await loadLiveSeeds(context));
+    console.log(pc17.green(`
+  \u2713 Migrated ${plan.seeds.length} seed(s).`));
+    if (remaining.steps.length > 0) {
+      console.log(pc17.yellow(`  \u26A0 ${remaining.steps.length} step(s) still need attention; run \`beech schema audit\`.`));
+      console.log("");
+      process.exit(1);
+      return;
+    }
+    console.log(pc17.dim("  Restart running Workers or wait for the registry cache to refresh, then run `beech types generate`.\n"));
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+
+// src/commands/schema-audit.ts
+import pc18 from "picocolors";
+import { auditRelationStorage, planTagMigration as planTagMigration2 } from "@beechcms/core";
+async function schemaAudit(args = {}) {
+  try {
+    const context = createD1Context(args);
+    const seeds = await loadLiveSeeds(context);
+    const findings = await auditRelationStorage(context.executor, seeds);
+    console.log(pc18.cyan(`
+  Relation storage audit (${context.options.db})
+`));
+    if (findings.length === 0) {
+      console.log(pc18.green("  \u2713 Every relation branch matches its physical storage.\n"));
+    }
+    for (const finding of findings) {
+      console.log(pc18.yellow(`  \u26A0 ${finding.seed}.${finding.alias} \u2014 ${finding.issue}`));
+      console.log(pc18.dim(`      expected: ${finding.expected}`));
+      console.log(pc18.dim(`      actual:   ${finding.actual}`));
+      if (finding.strandedRows > 0) {
+        console.log(pc18.red(`      ${finding.strandedRows} stranded value(s) NOT read by the API; do not drop this storage`));
+      }
+    }
+    if (findings.length > 0) {
+      console.log(pc18.yellow(`
+  \u26A0 ${findings.length} relation storage mismatch(es). Nothing was changed.
+`));
+    }
+    const tagPlan = planTagMigration2(seeds);
+    console.log(pc18.cyan("  Tags contract audit\n"));
+    if (tagPlan.steps.length === 0) {
+      console.log(pc18.green("  \u2713 Every seed uses the closed-vocabulary tags contract.\n"));
+    } else {
+      renderTagMigrationPlan(tagPlan);
+      console.log(pc18.yellow("\n  \u26A0 Legacy tag/choice definitions found. Run `beech schema migrate` to review and apply the fix.\n"));
+    }
+    if (findings.length > 0 || tagPlan.steps.length > 0) process.exit(1);
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+
+// src/commands/schema-export.ts
+import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync2 } from "node:fs";
+import { dirname as dirname3, resolve as resolve8 } from "node:path";
+import pc19 from "picocolors";
+import { emitManifestModule, seedsToManifest as seedsToManifest2 } from "@beechcms/core/schema";
+async function schemaExport(args = {}) {
+  try {
+    const context = createD1Context(args);
+    const seeds = await loadLiveSeeds(context);
+    const source = emitManifestModule(seedsToManifest2(seeds));
+    if (args.out === null) {
+      process.stdout.write(source);
+      return;
+    }
+    const target = args.out ?? DEFAULT_MANIFEST_PATH;
+    const outPath = resolve8(process.cwd(), target);
+    mkdirSync2(dirname3(outPath), { recursive: true });
+    writeFileSync4(outPath, source, "utf-8");
+    console.log(pc19.green(`
+  \u2713 Exported ${seeds.length} seed(s) \u2192 ${target}
+`));
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+
+// src/commands/schema-plan.ts
+import pc20 from "picocolors";
+
+// ../api-client/dist/index.js
+import { existsSync as existsSync22, readFileSync as readFileSync22 } from "node:fs";
+import { join as join2 } from "node:path";
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { deriveCodeChallenge } from "@beechcms/core";
+import { chmodSync, existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6, renameSync, unlinkSync, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir } from "node:os";
+import { dirname as dirname4, join as join3 } from "node:path";
+var BeechClientError = class extends Error {
+  constructor(message, status, problem) {
+    super(message);
+    this.status = status;
+    this.problem = problem;
+    this.name = "BeechClientError";
+  }
+  status;
+  problem;
+};
+function base64Url(bytes) {
+  return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function createPkcePair() {
+  const verifier = base64Url(randomBytes2(32));
+  const challenge = await deriveCodeChallenge(verifier);
+  return { verifier, challenge };
+}
+async function exchangeToken(apiUrl, body) {
+  const response = await fetch(`${apiUrl}/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body
+  });
+  if (response.status === 429) {
+    const retryAfter = response.headers.get("Retry-After");
+    throw new BeechClientError(`OAuth token request rate-limited.${retryAfter ? ` Retry after ${retryAfter}s.` : ""}`);
+  }
+  if (!response.ok) {
+    const problem = await response.json();
+    throw new BeechClientError(`OAuth token request failed (${problem.error}): ${problem.error_description ?? ""}`);
+  }
+  const data = await response.json();
+  return {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    scope: data.scope,
+    expiresAt: Date.now() + data.expires_in * 1e3
+  };
+}
+function renderClosePage() {
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Authorization Successful - BeechCMS</title>
+  <style>
+    :root {
+      --bg: #f8fafc;
+      --card-bg: #ffffff;
+      --card-border: #e2e8f0;
+      --text-primary: #0f172a;
+      --text-muted: #64748b;
+      --success-bg: #dcfce7;
+      --success-border: #bbf7d0;
+      --success-text: #15803d;
+    }
+    @media (prefers-color-scheme: dark) {
+      :root {
+        --bg: #09090b;
+        --card-bg: #121215;
+        --card-border: #27272a;
+        --text-primary: #f4f4f5;
+        --text-muted: #a1a1aa;
+        --success-bg: rgba(34, 197, 94, 0.15);
+        --success-border: rgba(34, 197, 94, 0.3);
+        --success-text: #4ade80;
+      }
+    }
+    * { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+      background-color: var(--bg);
+      color: var(--text-primary);
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 1.5rem;
+      -webkit-font-smoothing: antialiased;
+    }
+    .card {
+      background-color: var(--card-bg);
+      border: 1px solid var(--card-border);
+      border-radius: 1rem;
+      box-shadow: 0 10px 25px -5px rgba(0, 0, 0, 0.05), 0 8px 10px -6px rgba(0, 0, 0, 0.05);
+      max-width: 380px;
+      width: 100%;
+      padding: 2.5rem 2rem;
+      text-align: center;
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      justify-content: center;
+    }
+    .icon-badge {
+      width: 3.5rem;
+      height: 3.5rem;
+      border-radius: 50%;
+      background-color: var(--success-bg);
+      border: 1px solid var(--success-border);
+      color: var(--success-text);
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      margin-bottom: 1.25rem;
+    }
+    .icon-badge svg {
+      width: 1.75rem;
+      height: 1.75rem;
+    }
+    h1 {
+      font-size: 1.25rem;
+      font-weight: 600;
+      letter-spacing: -0.02em;
+      margin-bottom: 0.5rem;
+    }
+    p {
+      color: var(--text-muted);
+      font-size: 0.875rem;
+      line-height: 1.5;
+      margin: 0;
+    }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="icon-badge">
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
+        <polyline points="20 6 9 17 4 12"></polyline>
+      </svg>
+    </div>
+    <h1>Authorization Successful</h1>
+    <p>You can safely close this tab and return to your terminal or editor.</p>
+  </div>
+  <script>try { window.close(); } catch (_) {}</script>
+</body>
+</html>`;
+}
+function waitForCallback(state, timeoutMs, callbackPath) {
+  let resolvePort;
+  const redirectUriPromise = new Promise((resolve15) => {
+    resolvePort = resolve15;
+  });
+  const result = new Promise((resolve15, reject) => {
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== callbackPath) {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const callbackState = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      const code = url.searchParams.get("code");
+      if (callbackState !== state) {
+        res.writeHead(400, { "Content-Type": "text/plain" });
+        res.end("state mismatch");
+        finish(() => reject(new BeechClientError("OAuth callback state mismatch. Aborting for safety.")));
+        return;
+      }
+      if (error) {
+        res.writeHead(400, { "Content-Type": "text/plain" });
+        res.end("authorization error");
+        finish(() => reject(new BeechClientError(url.searchParams.get("error_description") ?? error)));
+        return;
+      }
+      if (code) {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(renderClosePage());
+        finish(() => resolve15({ code }));
+        return;
+      }
+      res.writeHead(404);
+      res.end();
+    });
+    let timer;
+    let finished = false;
+    function finish(action) {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      server.close(() => action());
+    }
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      resolvePort(`http://127.0.0.1:${port}${callbackPath}`);
+    });
+    timer = setTimeout(() => {
+      finish(() => reject(new BeechClientError(`Authorization timed out after ${timeoutMs / 1e3}s. Re-run the tool and complete the consent in the browser.`)));
+    }, timeoutMs);
+  });
+  return { redirectUriPromise, result };
+}
+function openBrowser(url) {
+  const platform = process.platform;
+  const child = platform === "darwin" ? spawn("open", [url], { detached: true, stdio: "ignore" }) : platform === "win32" ? spawn("cmd", ["/d", "/c", "start", '""', `"${url}"`], { detached: true, stdio: "ignore", windowsVerbatimArguments: true }) : spawn("xdg-open", [url], { detached: true, stdio: "ignore" });
+  child.on("error", () => {
+    process.stderr.write(`Open this URL to continue: ${url}
+`);
+  });
+  process.stderr.write(`Open this URL to continue: ${url}
+`);
+  child.unref();
+}
+async function authorize(config) {
+  const { verifier, challenge } = await createPkcePair();
+  const state = base64Url(randomBytes2(16));
+  const callbackPath = config.callbackPath ?? "/oauth/callback";
+  const { redirectUriPromise, result } = waitForCallback(state, config.timeoutMs, callbackPath);
+  const redirectUri = await redirectUriPromise;
+  const authorizeUrl = new URL(`${config.authUrl}/oauth/authorize`);
+  authorizeUrl.searchParams.set("response_type", "code");
+  authorizeUrl.searchParams.set("client_id", config.clientId);
+  authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+  authorizeUrl.searchParams.set("scope", config.scope);
+  authorizeUrl.searchParams.set("state", state);
+  authorizeUrl.searchParams.set("code_challenge", challenge);
+  authorizeUrl.searchParams.set("code_challenge_method", "S256");
+  openBrowser(authorizeUrl.toString());
+  const { code } = await result;
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: redirectUri,
+    client_id: config.clientId,
+    code_verifier: verifier
+  });
+  return exchangeToken(config.apiUrl, body);
+}
+async function refresh(config, refreshToken) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: config.clientId
+  });
+  return exchangeToken(config.apiUrl, body);
+}
+function cachePath() {
+  return process.env.BEECH_TOKEN_CACHE ?? join3(homedir(), ".beechcms", "mcp-tokens.json");
+}
+function cacheKey(apiUrl, clientId) {
+  return `${apiUrl}|${clientId}`;
+}
+function isValidGrant(value) {
+  if (!value || typeof value !== "object") return false;
+  const grant = value;
+  return typeof grant.accessToken === "string" && grant.accessToken.length > 0 && typeof grant.refreshToken === "string" && grant.refreshToken.length > 0 && typeof grant.scope === "string" && grant.scope.length > 0 && typeof grant.expiresAt === "number" && Number.isFinite(grant.expiresAt);
+}
+function readCacheFile() {
+  const path = cachePath();
+  if (!existsSync7(path)) return {};
+  const parsed = JSON.parse(readFileSync6(path, "utf8"));
+  if (!parsed || typeof parsed !== "object") return {};
+  return parsed;
+}
+function readGrant(apiUrl, clientId) {
+  try {
+    const entry = readCacheFile()[cacheKey(apiUrl, clientId)];
+    return isValidGrant(entry) ? entry : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function writeGrant(apiUrl, clientId, grant) {
+  try {
+    const path = cachePath();
+    mkdirSync3(dirname4(path), { recursive: true, mode: 448 });
+    let cache;
+    try {
+      cache = readCacheFile();
+    } catch {
+      cache = {};
+    }
+    cache[cacheKey(apiUrl, clientId)] = grant;
+    const tmpPath = `${path}.tmp`;
+    writeFileSync5(tmpPath, JSON.stringify(cache));
+    chmodSync(tmpPath, 384);
+    renameSync(tmpPath, path);
+  } catch {
+  }
+}
+function clearGrant(apiUrl, clientId) {
+  try {
+    const path = cachePath();
+    if (!existsSync7(path)) return;
+    const cache = readCacheFile();
+    delete cache[cacheKey(apiUrl, clientId)];
+    if (Object.keys(cache).length === 0) {
+      unlinkSync(path);
+      return;
+    }
+    const tmpPath = `${path}.tmp`;
+    writeFileSync5(tmpPath, JSON.stringify(cache));
+    chmodSync(tmpPath, 384);
+    renameSync(tmpPath, path);
+  } catch {
+  }
+}
+var EXPIRY_SKEW_MS = 3e4;
+var MAX_TRANSIENT_RETRIES = 2;
+var RETRY_BASE_DELAY_MS = 100;
+function readDevVarsApiUrl() {
+  const devVarsPath = join2(process.cwd(), ".dev.vars");
+  if (!existsSync22(devVarsPath)) return void 0;
+  const match = readFileSync22(devVarsPath, "utf8").match(/^BEECH_API_URL=(.*)$/m);
+  return match ? match[1].trim() : void 0;
+}
+function resolveApiConfig(overrides = {}) {
+  const baseUrl = overrides.baseUrl ?? process.env.BEECH_API_URL ?? readDevVarsApiUrl() ?? "http://localhost:8789";
+  return {
+    baseUrl,
+    oauth: {
+      apiUrl: baseUrl,
+      authUrl: process.env.BEECH_AUTH_URL ?? baseUrl,
+      clientId: overrides.clientId ?? process.env.BEECH_OAUTH_CLIENT_ID ?? "beech-mcp",
+      scope: overrides.scope ?? process.env.BEECH_OAUTH_SCOPE ?? "schema:read schema:write",
+      timeoutMs: process.env.BEECH_OAUTH_TIMEOUT_MS ? Number(process.env.BEECH_OAUTH_TIMEOUT_MS) : 18e4,
+      callbackPath: overrides.callbackPath
+    }
+  };
+}
+function isRetryableStatus(status) {
+  return status === 502 || status === 503 || status === 504;
+}
+function sleep(ms) {
+  return new Promise((resolve15) => setTimeout(resolve15, ms));
+}
+function createApiClient(config) {
+  let grant;
+  let inFlightAuth;
+  async function getAccessToken(forceRefresh = false) {
+    if (grant === void 0) grant = readGrant(config.baseUrl, config.oauth.clientId);
+    if (grant && !forceRefresh && grant.expiresAt - Date.now() > EXPIRY_SKEW_MS) return grant.accessToken;
+    if (inFlightAuth) return (await inFlightAuth).accessToken;
+    const authPromise = (async () => {
+      if (grant?.refreshToken) {
+        try {
+          const refreshed = await refresh(config.oauth, grant.refreshToken);
+          writeGrant(config.baseUrl, config.oauth.clientId, refreshed);
+          grant = refreshed;
+          return refreshed;
+        } catch {
+          clearGrant(config.baseUrl, config.oauth.clientId);
+          grant = void 0;
+        }
+      }
+      const authorized = await authorize(config.oauth);
+      writeGrant(config.baseUrl, config.oauth.clientId, authorized);
+      grant = authorized;
+      return authorized;
+    })();
+    inFlightAuth = authPromise;
+    try {
+      return (await authPromise).accessToken;
+    } finally {
+      inFlightAuth = void 0;
+    }
+  }
+  async function rawFetch(method, path, accessToken, body) {
+    try {
+      return await fetch(`${config.baseUrl}${path}`, {
+        method,
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${accessToken}` },
+        body: body !== void 0 ? JSON.stringify(body) : void 0
+      });
+    } catch (error) {
+      if (error instanceof TypeError || error?.code === "ECONNREFUSED") {
+        throw new BeechClientError(`Cannot reach the BeechCMS API at ${config.baseUrl}. Start the local stack with: pnpm beech dev`);
+      }
+      throw error;
+    }
+  }
+  async function request(method, path, body) {
+    let accessToken = await getAccessToken();
+    let response = await rawFetch(method, path, accessToken, body);
+    if (response.status === 401) {
+      accessToken = await getAccessToken(true);
+      response = await rawFetch(method, path, accessToken, body);
+      if (response.status === 401) {
+        throw new BeechClientError(
+          "Authorization failed. Run any Beech tool again to re-authorize in the browser, or revoke and re-grant the client from Settings \u2192 Connected apps.",
+          401
+        );
+      }
+    }
+    for (let attempt = 0; isRetryableStatus(response.status) && attempt < MAX_TRANSIENT_RETRIES; attempt++) {
+      await sleep(RETRY_BASE_DELAY_MS * 2 ** attempt + Math.random() * RETRY_BASE_DELAY_MS);
+      response = await rawFetch(method, path, accessToken, body);
+    }
+    if (response.status === 403) {
+      let errorBody = {};
+      try {
+        errorBody = await response.json();
+      } catch {
+      }
+      if (errorBody.error === "insufficient_scope") {
+        const scope = errorBody.error_description?.match(/'([^']+)'/)?.[1] ?? "";
+        throw new BeechClientError(
+          `Token lacks the '${scope}' scope. Revoke 'BeechCMS MCP Server' under Settings \u2192 Connected apps and re-authorize.`,
+          403
+        );
+      }
+      throw new BeechClientError(
+        JSON.stringify({ status: 403, title: errorBody.error ?? response.statusText, detail: errorBody.error_description ?? "" }),
+        403
+      );
+    }
+    if (!response.ok) {
+      let problem = {};
+      try {
+        problem = await response.json();
+      } catch {
+      }
+      throw new BeechClientError(
+        JSON.stringify({ status: problem.status ?? response.status, title: problem.title ?? response.statusText, detail: problem.detail ?? "" }),
+        problem.status ?? response.status,
+        problem
+      );
+    }
+    return { data: await response.json(), headers: response.headers };
+  }
+  return { request, baseUrl: config.baseUrl };
+}
+
+// src/lib/control-plane.ts
+var CLI_OAUTH_CLIENT_ID = "beech-mcp-cli";
+var CLI_CALLBACK_PATH = "/callback";
+function toCliError(error, slug) {
+  if (!(error instanceof BeechClientError)) {
+    return new CliError(error instanceof Error ? error.message : String(error), void 0, error);
+  }
+  const detail = error.problem?.detail ?? error.message;
+  if (error.status === 401 || error.status === 403) {
+    return new CliError(`Not authorized to change schema (${slug}).`, error.message, error);
+  }
+  if (error.status === 409) {
+    return new CliError(
+      `The schema registry moved while '${slug}' was being applied. Nothing was written.`,
+      "Re-run `beech schema plan` and apply again.",
+      error
     );
-    process.exit(1);
   }
-  const code = generateSeedTypes(seeds);
-  if (args.out) {
-    const outPath = resolve4(process.cwd(), args.out);
-    mkdirSync(dirname(outPath), { recursive: true });
-    writeFileSync3(outPath, code, "utf-8");
-    console.log(pc11.green(`
-  \u2713 Generated ${seeds.length} interface(s) \u2192 ${args.out}
+  if (error.status === 422) {
+    return new CliError(`Server refused the change to '${slug}': ${detail}`, void 0, error);
+  }
+  return new CliError(`Control plane request failed for '${slug}': ${detail}`, void 0, error);
+}
+function createControlPlane(options = {}) {
+  const config = resolveApiConfig({
+    baseUrl: options.apiUrl,
+    clientId: CLI_OAUTH_CLIENT_ID,
+    scope: "schema:read schema:write",
+    callbackPath: CLI_CALLBACK_PATH
+  });
+  const client = createApiClient(config);
+  return {
+    baseUrl: config.baseUrl,
+    async plan(slug, candidate) {
+      try {
+        const { data } = await client.request("POST", `/api/seeds/${slug}/mcp-plan`, { candidate });
+        return data;
+      } catch (error) {
+        throw toCliError(error, slug);
+      }
+    },
+    async apply({ slug, candidate, expectedVersion, planId }) {
+      try {
+        const { data } = await client.request("POST", `/api/seeds/${slug}/mcp-apply`, {
+          candidate,
+          expectedVersion,
+          planId,
+          source: "code"
+        });
+        return data;
+      } catch (error) {
+        throw toCliError(error, slug);
+      }
+    }
+  };
+}
+
+// src/lib/manifest-order.ts
+function manifestTargets(seed, slugs) {
+  const targets = /* @__PURE__ */ new Set();
+  for (const branch of seed.branches ?? []) {
+    if (branch.type === "relation" && branch.targetSeed && branch.targetSeed !== seed.slug && slugs.has(branch.targetSeed)) {
+      targets.add(branch.targetSeed);
+    }
+  }
+  return [...targets].sort((a, b) => a.localeCompare(b));
+}
+function orderSeedsForApply(seeds) {
+  const bySlug = new Map(seeds.map((seed) => [seed.slug, seed]));
+  const slugs = new Set(bySlug.keys());
+  const sorted = [...seeds].sort((a, b) => a.slug.localeCompare(b.slug));
+  const ordered = [];
+  const state = /* @__PURE__ */ new Map();
+  const cycles = [];
+  function visit(seed, stack) {
+    const mark = state.get(seed.slug);
+    if (mark === "done") return;
+    if (mark === "visiting") {
+      cycles.push([...stack.slice(stack.indexOf(seed.slug)), seed.slug]);
+      return;
+    }
+    state.set(seed.slug, "visiting");
+    for (const target of manifestTargets(seed, slugs)) {
+      const next = bySlug.get(target);
+      if (next) visit(next, [...stack, seed.slug]);
+    }
+    state.set(seed.slug, "done");
+    ordered.push(seed);
+  }
+  for (const seed of sorted) visit(seed, []);
+  return { ordered, cycles };
+}
+
+// src/commands/schema-plan.ts
+async function schemaPlan(args = {}) {
+  try {
+    const manifestPath = args.manifest ?? DEFAULT_MANIFEST_PATH;
+    const manifest = await loadManifest(manifestPath);
+    const { ordered, cycles } = orderSeedsForApply(manifest.seeds);
+    if (cycles.length > 0) {
+      throw new CliError(
+        `Relation cycle in ${manifestPath}: ${cycles.map((cycle) => cycle.join(" \u2192 ")).join("; ")}.`,
+        "Apply one of these seeds without its relation branch first, then add the branch and apply again."
+      );
+    }
+    const controlPlane = createControlPlane({ apiUrl: args.apiUrl });
+    console.log(pc20.cyan(`
+  Plan for ${manifestPath} against ${controlPlane.baseUrl}
+`));
+    const plans = [];
+    for (const seed of ordered) {
+      const plan = await controlPlane.plan(seed.slug, seed);
+      plans.push(plan);
+      renderPlan(plan);
+    }
+    const blocked = plans.filter((plan) => !plan.applicable);
+    console.log("");
+    if (blocked.length > 0) {
+      console.log(pc20.yellow(`  \u26A0 ${blocked.length} seed(s) cannot be applied: ${blocked.map((p4) => p4.slug).join(", ")}
 `));
+      process.exit(1);
+    }
+    const changing = plans.filter((plan) => plan.definitionChanged);
+    if (changing.length === 0) {
+      console.log(pc20.green("  \u2713 Nothing to apply \u2014 the deployed schema already matches the manifest.\n"));
+      return;
+    }
+    console.log(pc20.green(`  \u2713 ${changing.length} seed(s) ready to apply. Run \`beech schema apply\`.
+`));
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+function renderPlan(plan) {
+  const label = plan.classification === "create" ? pc20.green("create") : plan.classification === "additive" ? pc20.cyan("additive") : pc20.red("destructive");
+  const owner = plan.source === null ? "new" : plan.source === "code" ? "manifest-owned" : "dashboard-owned";
+  console.log(`  ${pc20.bold(plan.slug)} \u2014 ${label} (${owner})`);
+  if (plan.source === "runtime") {
+    console.log(pc20.dim("    note: stays dashboard-editable \u2014 applying does not transfer ownership"));
+  }
+  for (const issue of plan.issues) {
+    for (const message of issue.messages) {
+      console.log(issue.fatal ? pc20.red(`    \u2717 ${message}`) : pc20.yellow(`    ! ${message}`));
+    }
+  }
+  for (const reason of plan.blockedReasons) console.log(pc20.red(`    \u2717 ${reason}`));
+  if (plan.applicable && !plan.definitionChanged) {
+    console.log(pc20.dim("    (no change)"));
   } else {
-    process.stdout.write(code);
+    for (const statement of plan.statements) console.log(pc20.dim(`    ${statement}`));
+    for (const alias of plan.changedBranches) console.log(pc20.yellow(`    ~ ${alias} \u2014 definition changed`));
   }
+  if (plan.ftsRebuildNeeded) console.log(pc20.yellow("    ! full-text index will be rebuilt after apply"));
 }
 
-// src/commands/schema-diff.ts
-import pc12 from "picocolors";
-async function schemaDiff(_args = {}) {
-  console.log(pc12.yellow('\n  \u26A0 "beech schema:diff" is deprecated'));
-  console.log(pc12.dim("  Cloudflare D1 is the canonical authority for schema definitions."));
-  console.log(pc12.dim("  Runtime schema mutations are handled automatically by the Botanical Engine."));
-  console.log(pc12.cyan("\n  \u2192 Schema diffing from static files is no longer supported.\n"));
+// src/commands/schema-apply.ts
+import { randomUUID } from "node:crypto";
+import * as p from "@clack/prompts";
+import pc21 from "picocolors";
+async function schemaApply(args = {}) {
+  try {
+    const manifestPath = args.manifest ?? DEFAULT_MANIFEST_PATH;
+    const manifest = await loadManifest(manifestPath);
+    const { ordered, cycles } = orderSeedsForApply(manifest.seeds);
+    if (cycles.length > 0) {
+      throw new CliError(
+        `Relation cycle in ${manifestPath}: ${cycles.map((cycle) => cycle.join(" \u2192 ")).join("; ")}.`,
+        "Apply one of these seeds without its relation branch first, then add the branch and apply again."
+      );
+    }
+    const controlPlane = createControlPlane({ apiUrl: args.apiUrl });
+    console.log(pc21.cyan(`
+  Plan for ${manifestPath} against ${controlPlane.baseUrl}
+`));
+    const previews = /* @__PURE__ */ new Map();
+    for (const seed of ordered) {
+      const plan = await controlPlane.plan(seed.slug, seed);
+      previews.set(seed.slug, plan);
+      renderPlan(plan);
+    }
+    const blocked = [...previews.values()].filter((plan) => !plan.applicable);
+    if (blocked.length > 0) {
+      throw new CliError(
+        `${blocked.length} seed(s) cannot be applied: ${blocked.map((plan) => plan.slug).join(", ")}. Nothing was written.`,
+        "Fix the manifest, or perform the flagged changes through the endpoints named above."
+      );
+    }
+    const pending = ordered.filter((seed) => previews.get(seed.slug)?.definitionChanged === true);
+    if (pending.length === 0) {
+      console.log(pc21.green("\n  \u2713 Nothing to apply \u2014 the deployed schema already matches the manifest.\n"));
+      return;
+    }
+    await confirmApply(pending, args.yes === true);
+    const planId = randomUUID();
+    console.log("");
+    for (const seed of pending) {
+      const result = await applyOne(controlPlane, seed, previews.get(seed.slug), planId);
+      console.log(pc21.green(`  \u2713 ${seed.slug} \u2014 registry version ${result.newVersion}`));
+      if (result.warning) console.log(pc21.yellow(`    ! ${result.warning}`));
+    }
+    console.log(pc21.green(`
+  \u2713 Applied ${pending.length} seed(s).`));
+    console.log(pc21.dim("    Regenerate client types with `beech types generate`.\n"));
+  } catch (error) {
+    exitWithError(error);
+  }
+}
+async function applyOne(controlPlane, seed, preview, planId) {
+  const fresh = await controlPlane.plan(seed.slug, seed);
+  if (!fresh.applicable) {
+    throw new CliError(
+      `'${seed.slug}' became unappliable between plan and apply: ${fresh.blockedReasons.join("; ")}`,
+      "The deployed schema changed under this run. Re-run `beech schema plan`."
+    );
+  }
+  if (fresh.statements.join("\n") !== preview.statements.join("\n") || fresh.changedBranches.join("\n") !== preview.changedBranches.join("\n")) {
+    throw new CliError(
+      `The plan for '${seed.slug}' changed between review and apply. Nothing was written for it.`,
+      "Someone else changed the schema during this run. Re-run `beech schema plan`."
+    );
+  }
+  return controlPlane.apply({ slug: seed.slug, candidate: seed, expectedVersion: fresh.expectedVersion, planId });
+}
+async function confirmApply(pending, skip) {
+  if (skip) return;
+  if (!process.stdout.isTTY) {
+    throw new CliError(
+      "Refusing to apply schema changes without confirmation in a non-interactive shell.",
+      "Re-run with --yes once the plan above has been reviewed."
+    );
+  }
+  const answer = await p.confirm({
+    message: `Apply ${pending.length} seed(s) to the deployed schema? (${pending.map((seed) => seed.slug).join(", ")})`,
+    initialValue: false
+  });
+  if (p.isCancel(answer) || !answer) {
+    throw new CliError("Aborted. Nothing was written.");
+  }
 }
 
 // src/commands/db-migrate.ts
-import pc13 from "picocolors";
+import pc22 from "picocolors";
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync5 } from "node:fs";
-import { resolve as resolve5 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
+import { resolve as resolve9 } from "node:path";
 async function dbMigrate(_args) {
-  console.log(pc13.cyan("\n  beech db:migrate \u2014 apply migrations\n"));
+  console.log(pc22.cyan("\n  beech db:migrate \u2014 apply migrations\n"));
   const cwd = process.cwd();
-  const apiDir = resolve5(cwd, "apps", "api");
-  if (existsSync4(resolve5(apiDir, "package.json"))) {
+  const apiDir = resolve9(cwd, "apps", "api");
+  if (existsSync8(resolve9(apiDir, "package.json"))) {
     const result = spawnSync7("npm", ["run", "db:migrate:local"], {
       stdio: "inherit",
       cwd: apiDir,
       shell: true
     });
     if (result.status !== 0) {
-      console.log(pc13.red("\n  \u2717 Failed to apply migrations."));
+      console.log(pc22.red("\n  \u2717 Failed to apply migrations."));
       process.exit(1);
       return;
     }
-    console.log(pc13.green("\n  \u2713 Migrations applied successfully."));
+    console.log(pc22.green("\n  \u2713 Migrations applied successfully."));
     return;
   }
-  if (existsSync4(resolve5(cwd, "scripts", "bootstrap-d1.mjs"))) {
+  if (existsSync8(resolve9(cwd, "scripts", "bootstrap-d1.mjs"))) {
     const result = spawnSync7("node", ["scripts/bootstrap-d1.mjs"], {
       stdio: "inherit",
       cwd,
       shell: true
     });
     if (result.status !== 0) {
-      console.log(pc13.red("\n  \u2717 Failed to apply migrations."));
+      console.log(pc22.red("\n  \u2717 Failed to apply migrations."));
       process.exit(1);
       return;
     }
-    console.log(pc13.green("\n  \u2713 Migrations applied successfully."));
+    console.log(pc22.green("\n  \u2713 Migrations applied successfully."));
     return;
   }
-  const rootPkgPath = resolve5(cwd, "package.json");
-  if (existsSync4(rootPkgPath)) {
+  const rootPkgPath = resolve9(cwd, "package.json");
+  if (existsSync8(rootPkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync5(rootPkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync7(rootPkgPath, "utf-8"));
       if (pkg.scripts?.["db:migrate:local"]) {
         const result = spawnSync7("npm", ["run", "db:migrate:local"], {
           stdio: "inherit",
@@ -1154,38 +2348,38 @@ async function dbMigrate(_args) {
           shell: true
         });
         if (result.status !== 0) {
-          console.log(pc13.red("\n  \u2717 Failed to apply migrations."));
+          console.log(pc22.red("\n  \u2717 Failed to apply migrations."));
           process.exit(1);
           return;
         }
-        console.log(pc13.green("\n  \u2713 Migrations applied successfully."));
+        console.log(pc22.green("\n  \u2713 Migrations applied successfully."));
         return;
       }
     } catch {
     }
   }
-  console.log(pc13.dim("  No migration script found \u2014 initialising database via beech init --db...\n"));
+  console.log(pc22.dim("  No migration script found \u2014 initialising database via beech init --db...\n"));
   const { init: init2 } = await Promise.resolve().then(() => (init_init(), init_exports));
   try {
     await init2({ initDb: true, local: true, nonInteractive: true });
   } catch {
-    console.log(pc13.red("\n  \u2717 Database initialisation failed."));
-    console.log(pc13.dim("  Run: npm run db:migrate:local  or  npx beech init --db\n"));
+    console.log(pc22.red("\n  \u2717 Database initialisation failed."));
+    console.log(pc22.dim("  Run: npm run db:migrate:local  or  npx beech init --db\n"));
     process.exit(1);
   }
 }
 
 // src/commands/dev.ts
-import pc14 from "picocolors";
+import pc23 from "picocolors";
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync5 } from "node:fs";
-import { resolve as resolve6 } from "node:path";
+import { existsSync as existsSync9 } from "node:fs";
+import { resolve as resolve10 } from "node:path";
 async function dev(args) {
-  console.log(pc14.cyan("\n  beech dev \u2014 start development environment\n"));
+  console.log(pc23.cyan("\n  beech dev \u2014 start development environment\n"));
   const cwd = process.cwd();
-  const devScript = resolve6(cwd, "scripts", "dev.mjs");
-  if (!existsSync5(devScript)) {
-    console.log(pc14.red("  \u2717 Could not find development script (scripts/dev.mjs)."));
+  const devScript = resolve10(cwd, "scripts", "dev.mjs");
+  if (!existsSync9(devScript)) {
+    console.log(pc23.red("  \u2717 Could not find development script (scripts/dev.mjs)."));
     process.exit(1);
     return;
   }
@@ -1206,7 +2400,7 @@ async function dev(args) {
 }
 
 // src/commands/dev-stop.ts
-import pc15 from "picocolors";
+import pc24 from "picocolors";
 import { spawnSync as spawnSync9 } from "node:child_process";
 function isDockerInstalled2() {
   try {
@@ -1225,44 +2419,44 @@ function isDockerRunning2() {
   }
 }
 async function devStop() {
-  console.log(pc15.cyan("\n  beech dev:stop \u2014 stop Docker environment\n"));
+  console.log(pc24.cyan("\n  beech dev:stop \u2014 stop Docker environment\n"));
   if (!isDockerInstalled2()) {
-    console.log(pc15.red("  \u2717 Docker is not installed or not found in your PATH."));
+    console.log(pc24.red("  \u2717 Docker is not installed or not found in your PATH."));
     process.exit(1);
     return;
   }
   if (!isDockerRunning2()) {
-    console.log(pc15.yellow("  \u26A0 Docker is installed, but the Docker daemon is NOT running."));
+    console.log(pc24.yellow("  \u26A0 Docker is installed, but the Docker daemon is NOT running."));
     process.exit(1);
     return;
   }
-  console.log(pc15.dim("  Stopping Docker containers\u2026\n"));
+  console.log(pc24.dim("  Stopping Docker containers\u2026\n"));
   const result = spawnSync9("docker", ["compose", "-f", "docker/docker-compose.yml", "stop"], {
     stdio: "inherit",
     cwd: process.cwd(),
     shell: true
   });
   if (result.status === 0) {
-    console.log(pc15.green("\n  \u2713 Docker containers stopped."));
+    console.log(pc24.green("\n  \u2713 Docker containers stopped."));
   } else {
-    console.log(pc15.red("\n  \u2717 Failed to stop Docker containers."));
+    console.log(pc24.red("\n  \u2717 Failed to stop Docker containers."));
     process.exit(1);
     return;
   }
 }
 
 // src/commands/dev-tunnel.ts
-import pc16 from "picocolors";
+import pc25 from "picocolors";
 import { spawnSync as spawnSync10 } from "node:child_process";
 async function devTunnel() {
-  console.log(pc16.cyan("\n  beech dev:tunnel \u2014 get Cloudflare Tunnel URL\n"));
+  console.log(pc25.cyan("\n  beech dev:tunnel \u2014 get Cloudflare Tunnel URL\n"));
   const result = spawnSync10("docker", ["compose", "-f", "docker/docker-compose.yml", "logs", "tunnel"], {
     encoding: "utf-8",
     cwd: process.cwd(),
     shell: true
   });
   if (result.status !== 0) {
-    console.log(pc16.red("  \u2717 Failed to retrieve tunnel logs."));
+    console.log(pc25.red("  \u2717 Failed to retrieve tunnel logs."));
     process.exit(1);
     return;
   }
@@ -1270,38 +2464,38 @@ async function devTunnel() {
   const match = logs2.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/g);
   if (match && match.length > 0) {
     const url = match[match.length - 1];
-    console.log(pc16.green(`  \u2713 Active Cloudflare Tunnel URL: ${pc16.bold(url)}`));
+    console.log(pc25.green(`  \u2713 Active Cloudflare Tunnel URL: ${pc25.bold(url)}`));
   } else {
-    console.log(pc16.yellow("  \u26A0 No active Cloudflare Tunnel URL found in logs."));
-    console.log(pc16.dim("    Make sure the dev server is running with Docker (`pnpm beech dev`)."));
+    console.log(pc25.yellow("  \u26A0 No active Cloudflare Tunnel URL found in logs."));
+    console.log(pc25.dim("    Make sure the dev server is running with Docker (`pnpm beech dev`)."));
   }
 }
 
 // src/commands/mailpit-clear.ts
-import pc17 from "picocolors";
+import pc26 from "picocolors";
 async function mailpitClear() {
-  console.log(pc17.cyan("\n  beech mailpit:clear \u2014 clear test emails\n"));
+  console.log(pc26.cyan("\n  beech mailpit:clear \u2014 clear test emails\n"));
   try {
     const res = await fetch("http://localhost:8025/api/v1/messages", {
       method: "DELETE"
     });
     if (res.ok) {
-      console.log(pc17.green("  \u2713 Mailpit inbox cleared successfully."));
+      console.log(pc26.green("  \u2713 Mailpit inbox cleared successfully."));
     } else {
-      console.log(pc17.red(`  \u2717 Failed to clear Mailpit inbox: ${res.statusText}`));
+      console.log(pc26.red(`  \u2717 Failed to clear Mailpit inbox: ${res.statusText}`));
       process.exit(1);
       return;
     }
   } catch (err) {
-    console.log(pc17.red(`  \u2717 Error connecting to Mailpit: ${err.message}`));
-    console.log(pc17.dim("    Make sure Mailpit is running (default port 8025)."));
+    console.log(pc26.red(`  \u2717 Error connecting to Mailpit: ${err.message}`));
+    console.log(pc26.dim("    Make sure Mailpit is running (default port 8025)."));
     process.exit(1);
     return;
   }
 }
 
 // src/commands/logs.ts
-import pc18 from "picocolors";
+import pc27 from "picocolors";
 import { spawnSync as spawnSync11 } from "node:child_process";
 var SERVICE_MAP = {
   mailpit: "mailpit",
@@ -1314,18 +2508,18 @@ var SERVICE_MAP = {
 async function logs(args) {
   const inputService = args.service?.toLowerCase();
   if (!inputService || !SERVICE_MAP[inputService]) {
-    console.log(pc18.red("\n  \u2717 Error: Please specify a valid service name."));
-    console.log(pc18.dim("\n  Accepted services:"));
-    console.log(`    - ${pc18.cyan("mailpit")}`);
-    console.log(`    - ${pc18.cyan("db")} / ${pc18.cyan("sqlite")}`);
-    console.log(`    - ${pc18.cyan("tunnel")}`);
-    console.log(`    - ${pc18.cyan("storage")} / ${pc18.cyan("minio")}
+    console.log(pc27.red("\n  \u2717 Error: Please specify a valid service name."));
+    console.log(pc27.dim("\n  Accepted services:"));
+    console.log(`    - ${pc27.cyan("mailpit")}`);
+    console.log(`    - ${pc27.cyan("db")} / ${pc27.cyan("sqlite")}`);
+    console.log(`    - ${pc27.cyan("tunnel")}`);
+    console.log(`    - ${pc27.cyan("storage")} / ${pc27.cyan("minio")}
 `);
     process.exit(1);
     return;
   }
   const service = SERVICE_MAP[inputService];
-  console.log(pc18.cyan(`
+  console.log(pc27.cyan(`
   beech logs ${inputService} \u2014 streaming logs for ${service}\u2026
 `));
   const result = spawnSync11("docker", ["compose", "-f", "docker/docker-compose.yml", "logs", "-f", service], {
@@ -1340,33 +2534,97 @@ async function logs(args) {
 }
 
 // src/commands/test.ts
-import pc19 from "picocolors";
+import pc28 from "picocolors";
 import { spawnSync as spawnSync12 } from "node:child_process";
-import { existsSync as existsSync6 } from "node:fs";
-import { resolve as resolve7 } from "node:path";
+import { existsSync as existsSync11 } from "node:fs";
+import { resolve as resolve12 } from "node:path";
+import { pathToFileURL as pathToFileURL3 } from "node:url";
+
+// src/lib/cpu-slot.ts
+import { existsSync as existsSync10 } from "node:fs";
+import { resolve as resolve11 } from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
+async function loadCpuSlot(cwd) {
+  const modulePath = resolve11(cwd, "scripts", "lib", "cpu-slot.mjs");
+  if (!existsSync10(modulePath)) return null;
+  return await import(pathToFileURL2(modulePath).href);
+}
+
+// src/commands/test.ts
+var RUNNABLE_TIERS = ["unit", "flow", "integration", "e2e", "scale"];
+async function loadTestResources(cwd) {
+  const modulePath = resolve12(cwd, "scripts", "lib", "test-resources.mjs");
+  if (!existsSync11(modulePath)) return { env: {}, turboArgs: [] };
+  try {
+    const mod = await import(pathToFileURL3(modulePath).href);
+    const resources = mod.resolveTestResources();
+    console.log(pc28.dim(`  ${mod.describeTestResources(resources)}
+`));
+    if (!resources) return { env: {}, turboArgs: [] };
+    mod.lowerProcessPriority();
+    return { env: mod.testResourceEnv(resources), turboArgs: [`--concurrency=${resources.turboConcurrency}`] };
+  } catch {
+    return { env: {}, turboArgs: [] };
+  }
+}
 async function test(args) {
-  console.log(pc19.cyan("\n  beech test \u2014 run test suite\n"));
+  console.log(pc28.cyan("\n  beech test \u2014 run test suite\n"));
   const cwd = process.cwd();
+  const tiers = (args.tier ?? "").split(",").map((t) => t.trim()).filter(Boolean);
+  const invalid = tiers.filter((t) => !RUNNABLE_TIERS.includes(t));
+  if (invalid.length > 0) {
+    console.log(pc28.red(`  \u2717 Unknown tier(s): ${invalid.join(", ")}. Valid tiers: ${RUNNABLE_TIERS.join(", ")}.`));
+    process.exit(1);
+    return;
+  }
+  if (args.diff && (tiers.includes("e2e") || tiers.includes("scale"))) {
+    console.log(pc28.red("  \u2717 The e2e and scale tiers are never selected by --diff."));
+    process.exit(1);
+    return;
+  }
   let command = "turbo";
   let commandArgs = ["run", "test"];
   if (args.diff) {
-    const diffScript = resolve7(cwd, "scripts", "test-coverage-diff.mjs");
-    if (existsSync6(diffScript)) {
-      command = "node";
-      commandArgs = ["scripts/test-coverage-diff.mjs"];
-    } else {
-      console.log(pc19.red("  \u2717 Coverage diff script not found (scripts/test-coverage-diff.mjs)."));
+    const diffScript = resolve12(cwd, "scripts", "test-coverage-diff.mjs");
+    if (!existsSync11(diffScript)) {
+      console.log(pc28.red("  \u2717 Coverage diff script not found (scripts/test-coverage-diff.mjs)."));
       process.exit(1);
       return;
     }
+    command = "node";
+    commandArgs = ["scripts/test-coverage-diff.mjs"];
+    if (tiers.length > 0) commandArgs.push("--tier", tiers.join(","));
+  } else if (tiers.length > 0) {
+    commandArgs = ["run", ...tiers.map((t) => `test:${t}`)];
   } else if (args.coverage) {
     commandArgs = ["run", "test:coverage"];
   }
+  let releaseSlot = () => {
+  };
+  const slotEnv = {};
+  const cpuSlot = command === "turbo" ? await loadCpuSlot(cwd) : null;
+  if (cpuSlot) {
+    const exclusive = tiers.length === 0 || tiers.includes("flow");
+    try {
+      releaseSlot = await cpuSlot.acquireCpuSlot({ exclusive, label: `beech test: turbo ${commandArgs.join(" ")}` });
+    } catch (err) {
+      if (err.code !== "SLOT_TIMEOUT") throw err;
+      console.log(pc28.red(`  \u2717 ${err.message} The tests did NOT run.`));
+      process.exit(cpuSlot.EXIT_SLOT_TIMEOUT);
+      return;
+    }
+    cpuSlot.releaseOnExit(releaseSlot);
+    slotEnv[cpuSlot.HELD_ENV] = "1";
+  }
+  const resources = await loadTestResources(cwd);
+  if (command === "turbo") commandArgs.push(...resources.turboArgs);
   const result = spawnSync12(command, commandArgs, {
     stdio: "inherit",
     cwd,
-    shell: true
+    shell: true,
+    env: { ...process.env, ...resources.env, ...slotEnv }
   });
+  releaseSlot();
   if (result.status !== 0) {
     process.exit(result.status ?? 1);
     return;
@@ -1374,10 +2632,17 @@ async function test(args) {
 }
 
 // src/commands/lint.ts
-import pc20 from "picocolors";
+import pc29 from "picocolors";
 import { spawnSync as spawnSync13 } from "node:child_process";
 async function lint() {
-  console.log(pc20.cyan("\n  beech lint \u2014 check code style\n"));
+  console.log(pc29.cyan("\n  beech lint \u2014 check code style\n"));
+  const placement = spawnSync13("node", ["scripts/check-test-placement.mjs"], {
+    stdio: "inherit",
+    cwd: process.cwd()
+  });
+  if (placement.status !== 0) {
+    process.exit(placement.status ?? 1);
+  }
   const result = spawnSync13("turbo", ["run", "lint"], {
     stdio: "inherit",
     cwd: process.cwd(),
@@ -1389,10 +2654,10 @@ async function lint() {
 }
 
 // src/commands/doctor.ts
-import pc21 from "picocolors";
+import pc30 from "picocolors";
 import { spawnSync as spawnSync14 } from "node:child_process";
 async function doctor() {
-  console.log(pc21.cyan("\n  beech doctor \u2014 React diagnostics\n"));
+  console.log(pc30.cyan("\n  beech doctor \u2014 React diagnostics\n"));
   const cmd = process.env.npm_config_user_agent?.includes("pnpm") ? "pnpm" : "npx";
   const args = cmd === "pnpm" ? ["dlx", "react-doctor@latest"] : ["--yes", "react-doctor@latest"];
   const result = spawnSync14(cmd, args, {
@@ -1406,10 +2671,10 @@ async function doctor() {
 }
 
 // src/commands/forms.ts
-import * as p from "@clack/prompts";
-import pc22 from "picocolors";
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname2, resolve as resolve8 } from "node:path";
+import * as p2 from "@clack/prompts";
+import pc31 from "picocolors";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname5, resolve as resolve13 } from "node:path";
 function getReactTemplate(seedSlug, mode) {
   if (mode === "headless") {
     return `import React, { useState, useEffect } from 'react'
@@ -2042,9 +3307,9 @@ export { BeechFormElement }
 async function forms(options = {}) {
   let { framework, seed, mode, out, yes, json } = options;
   if (!yes && !json) {
-    p.intro(pc22.bgCyan(pc22.black(" \u{1F332} BeechCMS Form Generator ")));
+    p2.intro(pc31.bgCyan(pc31.black(" \u{1F332} BeechCMS Form Generator ")));
     if (!framework) {
-      const selected = await p.select({
+      const selected = await p2.select({
         message: "Which framework are you using?",
         options: [
           { value: "react", label: "React", hint: "Next.js / Vite / Remix (.tsx)" },
@@ -2054,14 +3319,14 @@ async function forms(options = {}) {
         ],
         initialValue: "react"
       });
-      if (p.isCancel(selected)) {
-        p.cancel("Operation cancelled.");
+      if (p2.isCancel(selected)) {
+        p2.cancel("Operation cancelled.");
         process.exit(0);
       }
       framework = selected;
     }
     if (!seed) {
-      const seedInput = await p.text({
+      const seedInput = await p2.text({
         message: "Which Seed do you want to bind this form to?",
         placeholder: "clienti",
         defaultValue: "clienti",
@@ -2069,14 +3334,14 @@ async function forms(options = {}) {
           if (!value.trim()) return "Seed slug cannot be empty";
         }
       });
-      if (p.isCancel(seedInput)) {
-        p.cancel("Operation cancelled.");
+      if (p2.isCancel(seedInput)) {
+        p2.cancel("Operation cancelled.");
         process.exit(0);
       }
       seed = seedInput.trim();
     }
     if (!mode && framework !== "vanilla") {
-      const modeSelected = await p.select({
+      const modeSelected = await p2.select({
         message: "Choose styling preset:",
         options: [
           { value: "styled", label: "Tailwind CSS", hint: "Full responsive ready-to-use component" },
@@ -2084,8 +3349,8 @@ async function forms(options = {}) {
         ],
         initialValue: "styled"
       });
-      if (p.isCancel(modeSelected)) {
-        p.cancel("Operation cancelled.");
+      if (p2.isCancel(modeSelected)) {
+        p2.cancel("Operation cancelled.");
         process.exit(0);
       }
       mode = modeSelected;
@@ -2096,7 +3361,7 @@ async function forms(options = {}) {
   mode = mode || "styled";
   const ext = framework === "react" ? "tsx" : framework === "vue" ? "vue" : framework === "svelte" ? "svelte" : "js";
   const filename = `BeechForm.${ext}`;
-  const targetPath = out ? resolve8(process.cwd(), out) : resolve8(process.cwd(), "src", "components", filename);
+  const targetPath = out ? resolve13(process.cwd(), out) : resolve13(process.cwd(), "src", "components", filename);
   let content = "";
   if (framework === "react") {
     content = getReactTemplate(seed, mode);
@@ -2107,8 +3372,8 @@ async function forms(options = {}) {
   } else {
     content = getVanillaTemplate(seed);
   }
-  mkdirSync2(dirname2(targetPath), { recursive: true });
-  writeFileSync4(targetPath, content, "utf-8");
+  mkdirSync4(dirname5(targetPath), { recursive: true });
+  writeFileSync6(targetPath, content, "utf-8");
   if (json) {
     console.log(
       JSON.stringify(
@@ -2127,24 +3392,24 @@ async function forms(options = {}) {
     return;
   }
   if (!yes) {
-    p.outro(pc22.green(`\u2714 Form component created at ${out ? out : `src/components/${filename}`}`));
+    p2.outro(pc31.green(`\u2714 Form component created at ${out ? out : `src/components/${filename}`}`));
     console.log(`
-  ${pc22.bold("Next steps:")}`);
+  ${pc31.bold("Next steps:")}`);
     if (framework === "react") {
-      console.log(pc22.cyan(`  import { BeechForm } from './components/BeechForm'`));
-      console.log(pc22.cyan(`  <BeechForm seed="${seed}" />
+      console.log(pc31.cyan(`  import { BeechForm } from './components/BeechForm'`));
+      console.log(pc31.cyan(`  <BeechForm seed="${seed}" />
 `));
     } else if (framework === "vue") {
-      console.log(pc22.cyan(`  import BeechForm from './components/BeechForm.vue'`));
-      console.log(pc22.cyan(`  <BeechForm seed="${seed}" />
+      console.log(pc31.cyan(`  import BeechForm from './components/BeechForm.vue'`));
+      console.log(pc31.cyan(`  <BeechForm seed="${seed}" />
 `));
     } else if (framework === "svelte") {
-      console.log(pc22.cyan(`  import BeechForm from './components/BeechForm.svelte'`));
-      console.log(pc22.cyan(`  <BeechForm seed="${seed}" />
+      console.log(pc31.cyan(`  import BeechForm from './components/BeechForm.svelte'`));
+      console.log(pc31.cyan(`  <BeechForm seed="${seed}" />
 `));
     } else {
-      console.log(pc22.cyan(`  <script type="module" src="./src/components/BeechForm.js"></script>`));
-      console.log(pc22.cyan(`  <beech-form seed="${seed}"></beech-form>
+      console.log(pc31.cyan(`  <script type="module" src="./src/components/BeechForm.js"></script>`));
+      console.log(pc31.cyan(`  <beech-form seed="${seed}"></beech-form>
 `));
     }
   } else {
@@ -2154,19 +3419,19 @@ async function forms(options = {}) {
 
 // src/commands/setup-cloudflare.ts
 init_wrangler();
-import pc23 from "picocolors";
-import * as p2 from "@clack/prompts";
+import pc32 from "picocolors";
+import * as p3 from "@clack/prompts";
 import { spawnSync as spawnSync15 } from "node:child_process";
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "node:fs";
-import { resolve as resolve9 } from "node:path";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync7, existsSync as existsSync13 } from "node:fs";
+import { resolve as resolve14 } from "node:path";
 function parseWranglerConfig(configPath) {
-  const raw = readFileSync6(configPath, "utf-8");
+  const raw = readFileSync8(configPath, "utf-8");
   const stripped = raw.replace(/\/\/[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
   const parsed = JSON.parse(stripped);
   return { name: parsed.name || "my-beech-project", raw, parsed };
 }
 async function setupCloudflare(options = {}) {
-  p2.intro(pc23.cyan("\u26A1 BeechCMS \u2014 Automated Cloudflare Provisioning"));
+  p3.intro(pc32.cyan("\u26A1 BeechCMS \u2014 Automated Cloudflare Provisioning"));
   const configPath = findWranglerConfig();
   let projectName = options.projectName;
   if (!projectName && configPath) {
@@ -2180,7 +3445,7 @@ async function setupCloudflare(options = {}) {
     if (options.nonInteractive) {
       projectName = "my-beech-project";
     } else {
-      const input = await p2.text({
+      const input = await p3.text({
         message: "Project name",
         placeholder: "my-website",
         validate: (v) => {
@@ -2188,8 +3453,8 @@ async function setupCloudflare(options = {}) {
           if (!/^[a-z0-9][a-z0-9-]*$/.test(v.trim())) return "Lowercase letters, numbers and hyphens only";
         }
       });
-      if (p2.isCancel(input)) {
-        p2.cancel("Setup cancelled");
+      if (p3.isCancel(input)) {
+        p3.cancel("Setup cancelled");
         return;
       }
       projectName = input.trim();
@@ -2197,8 +3462,8 @@ async function setupCloudflare(options = {}) {
   }
   const d1Name = `${projectName}-db`;
   const r2Bucket = `${projectName}-media`;
-  const s = p2.spinner();
-  s.start(`Creating Cloudflare D1 database: ${pc23.bold(d1Name)}\u2026`);
+  const s = p3.spinner();
+  s.start(`Creating Cloudflare D1 database: ${pc32.bold(d1Name)}\u2026`);
   const d1Result = spawnSync15("npx", ["wrangler", "d1", "create", d1Name], {
     encoding: "utf-8",
     shell: true,
@@ -2209,13 +3474,13 @@ async function setupCloudflare(options = {}) {
   const idMatch = d1Output.match(/database_id\s*=\s*["']?([a-f0-9-]{36})["']?/i) || d1Output.match(/"database_id":\s*"([a-f0-9-]{36})"/i) || d1Output.match(/([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})/i);
   if (idMatch) {
     databaseId = idMatch[1];
-    s.stop(pc23.green(`\u2713 D1 database ready: ${pc23.bold(d1Name)} (${databaseId})`));
+    s.stop(pc32.green(`\u2713 D1 database ready: ${pc32.bold(d1Name)} (${databaseId})`));
   } else if (d1Output.includes("already exists") || d1Result.status === 0) {
-    s.stop(pc23.yellow(`\u2139 D1 database ${pc23.bold(d1Name)} already exists or created.`));
+    s.stop(pc32.yellow(`\u2139 D1 database ${pc32.bold(d1Name)} already exists or created.`));
   } else {
-    s.stop(pc23.yellow(`\u26A0 Note on D1 create: ${d1Output.trim().slice(0, 150)}`));
+    s.stop(pc32.yellow(`\u26A0 Note on D1 create: ${d1Output.trim().slice(0, 150)}`));
   }
-  s.start(`Creating Cloudflare R2 bucket: ${pc23.bold(r2Bucket)}\u2026`);
+  s.start(`Creating Cloudflare R2 bucket: ${pc32.bold(r2Bucket)}\u2026`);
   const r2Result = spawnSync15("npx", ["wrangler", "r2", "bucket", "create", r2Bucket], {
     encoding: "utf-8",
     shell: true,
@@ -2223,26 +3488,26 @@ async function setupCloudflare(options = {}) {
   });
   const r2Output = (r2Result.stdout || "") + (r2Result.stderr || "");
   if (r2Result.status === 0 || r2Output.includes("already exists")) {
-    s.stop(pc23.green(`\u2713 R2 bucket ready: ${pc23.bold(r2Bucket)}`));
+    s.stop(pc32.green(`\u2713 R2 bucket ready: ${pc32.bold(r2Bucket)}`));
   } else {
-    s.stop(pc23.yellow(`\u26A0 Note on R2 create: ${r2Output.trim().slice(0, 150)}`));
+    s.stop(pc32.yellow(`\u26A0 Note on R2 create: ${r2Output.trim().slice(0, 150)}`));
   }
-  if (configPath && existsSync8(configPath)) {
+  if (configPath && existsSync13(configPath)) {
     try {
-      let content = readFileSync6(configPath, "utf-8");
+      let content = readFileSync8(configPath, "utf-8");
       content = content.replace(/"database_name":\s*"[^"]*"/, `"database_name": "${d1Name}"`);
       if (databaseId) {
         content = content.replace(/"database_id":\s*"[^"]*"/, `"database_id": "${databaseId}"`);
       }
       content = content.replace(/"bucket_name":\s*"[^"]*"/, `"bucket_name": "${r2Bucket}"`);
-      writeFileSync5(configPath, content, "utf-8");
-      p2.log.success(pc23.green(`Updated ${pc23.bold(configPath)} with database_id and bucket_name.`));
+      writeFileSync7(configPath, content, "utf-8");
+      p3.log.success(pc32.green(`Updated ${pc32.bold(configPath)} with database_id and bucket_name.`));
     } catch (err) {
-      p2.log.warn(`Could not update wrangler config automatically: ${err.message}`);
+      p3.log.warn(`Could not update wrangler config automatically: ${err.message}`);
     }
   }
   if (!options.nonInteractive) {
-    p2.note(
+    p3.note(
       [
         "Direct uploads via Presigned URLs (SigV4) stream directly from browser to R2 with zero Worker CPU/RAM.",
         "To configure Presigned uploads:",
@@ -2252,33 +3517,33 @@ async function setupCloudflare(options = {}) {
       ].join("\n"),
       "R2 S3 Credentials Setup"
     );
-    const configureSecrets = await p2.confirm({
+    const configureSecrets = await p3.confirm({
       message: "Do you have your R2 API Token ready to configure now?",
       initialValue: true
     });
-    if (!p2.isCancel(configureSecrets) && configureSecrets) {
-      const accountId = await p2.text({
+    if (!p3.isCancel(configureSecrets) && configureSecrets) {
+      const accountId = await p3.text({
         message: "Cloudflare Account ID (from dash.cloudflare.com)",
         placeholder: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
         validate: (v) => {
           if (!v.trim()) return "Required";
         }
       });
-      const accessKeyId = !p2.isCancel(accountId) ? await p2.text({
+      const accessKeyId = !p3.isCancel(accountId) ? await p3.text({
         message: "R2 Access Key ID",
         validate: (v) => {
           if (!v.trim()) return "Required";
         }
       }) : null;
-      const secretAccessKey = !p2.isCancel(accessKeyId) && accessKeyId ? await p2.password({
+      const secretAccessKey = !p3.isCancel(accessKeyId) && accessKeyId ? await p3.password({
         message: "R2 Secret Access Key",
         validate: (v) => {
           if (!v.trim()) return "Required";
         }
       }) : null;
-      if (!p2.isCancel(accountId) && !p2.isCancel(accessKeyId) && !p2.isCancel(secretAccessKey) && accountId && accessKeyId && secretAccessKey) {
+      if (!p3.isCancel(accountId) && !p3.isCancel(accessKeyId) && !p3.isCancel(secretAccessKey) && accountId && accessKeyId && secretAccessKey) {
         const endpoint = `https://${accountId.trim()}.r2.cloudflarestorage.com`;
-        const devVarsPath = resolve9(process.cwd(), ".dev.vars");
+        const devVarsPath = resolve14(process.cwd(), ".dev.vars");
         const devVarsContent = [
           "# Cloudflare R2 S3 credentials (for direct Presigned URL uploads)",
           `R2_ACCESS_KEY_ID=${accessKeyId.trim()}`,
@@ -2286,8 +3551,8 @@ async function setupCloudflare(options = {}) {
           `R2_ENDPOINT=${endpoint}`,
           `R2_BUCKET_NAME=${r2Bucket}`
         ].join("\n") + "\n";
-        writeFileSync5(devVarsPath, devVarsContent, "utf-8");
-        p2.log.success(pc23.green(`Created ${pc23.bold(".dev.vars")} with local development credentials.`));
+        writeFileSync7(devVarsPath, devVarsContent, "utf-8");
+        p3.log.success(pc32.green(`Created ${pc32.bold(".dev.vars")} with local development credentials.`));
         s.start("Setting production secrets on Cloudflare Worker\u2026");
         spawnSync15("npx", ["wrangler", "secret", "put", "R2_ACCESS_KEY_ID"], {
           input: accessKeyId.trim(),
@@ -2309,11 +3574,11 @@ async function setupCloudflare(options = {}) {
           encoding: "utf-8",
           shell: true
         });
-        s.stop(pc23.green("\u2713 Production secrets configured on Cloudflare Worker."));
+        s.stop(pc32.green("\u2713 Production secrets configured on Cloudflare Worker."));
       }
     }
   }
-  p2.outro(pc23.green("\u2728 Cloudflare infrastructure setup complete! You are ready to run `npx beech deploy`."));
+  p3.outro(pc32.green("\u2728 Cloudflare infrastructure setup complete! You are ready to run `npx beech deploy`."));
 }
 export {
   dbMigrate,
@@ -2332,11 +3597,17 @@ export {
   mailpitClear,
   onboard,
   reset,
+  schemaApply,
+  schemaAudit,
   schemaDiff,
+  schemaExport,
+  schemaMigrate,
+  schemaPlan,
   seedCreate,
   seedLoad,
   setupCloudflare,
   test,
+  typesCheck,
   update,
   validate,
   validateSeeds