@saacms/cli 0.1.0

package/dist/main.js

@@ -0,0 +1,1634 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/main.ts
+import { defineCommand as defineCommand8, runMain } from "citty";
+
+// src/commands/init.ts
+import { defineCommand } from "citty";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+var ASTRO_CONFIG_FILES = [
+  "astro.config.ts",
+  "astro.config.mjs",
+  "astro.config.js",
+  "astro.config.cjs"
+];
+var NEXTJS_CONFIG_FILES = [
+  "next.config.ts",
+  "next.config.mjs",
+  "next.config.js"
+];
+var SVELTEKIT_CONFIG_FILES = ["svelte.config.js", "svelte.config.ts"];
+var NUXT_CONFIG_FILES = ["nuxt.config.ts", "nuxt.config.js"];
+function readPackageJson(cwd) {
+  const path = join(cwd, "package.json");
+  if (!existsSync(path))
+    return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function hasDep(pkg, name) {
+  if (!pkg)
+    return false;
+  return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name] ?? pkg.peerDependencies?.[name]);
+}
+function hasAnyFile(cwd, files) {
+  return files.some((file) => existsSync(join(cwd, file)));
+}
+function detectHost(cwd) {
+  const pkg = readPackageJson(cwd);
+  if (hasAnyFile(cwd, ASTRO_CONFIG_FILES) || hasDep(pkg, "astro"))
+    return "astro";
+  if (hasAnyFile(cwd, NEXTJS_CONFIG_FILES) || hasDep(pkg, "next"))
+    return "nextjs";
+  if (hasAnyFile(cwd, SVELTEKIT_CONFIG_FILES) || hasDep(pkg, "@sveltejs/kit"))
+    return "sveltekit";
+  if (hasAnyFile(cwd, NUXT_CONFIG_FILES) || hasDep(pkg, "nuxt"))
+    return "nuxt";
+  return "unknown";
+}
+function locateApiMountTemplate(cwd) {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    resolve(here, "..", "..", "..", "host-astro", "templates", "api-mount.ts.txt"),
+    resolve(cwd, "packages", "host-astro", "templates", "api-mount.ts.txt")
+  ];
+  for (const candidate of candidates) {
+    if (existsSync(candidate))
+      return candidate;
+  }
+  return null;
+}
+function renderSaacmsConfig(cwd) {
+  const title = basename(resolve(cwd));
+  return [
+    `import { defineConfig } from "@saacms/core"`,
+    `import { astroHostAdapter } from "@saacms/host-astro"`,
+    ``,
+    `export default defineConfig({`,
+    `  host: astroHostAdapter(),`,
+    `  title: ${JSON.stringify(title)},`,
+    `  version: "0.0.0",`,
+    `  // collections, blocks, pages, plugins are added as you import them`,
+    `  collections: [],`,
+    `  blocks: [],`,
+    `  pages: [],`,
+    `})`,
+    ``
+  ].join(`
+`);
+}
+function writeIfMissing(path, contents, label, log) {
+  if (existsSync(path)) {
+    log(`[saacms init] ${label} already exists; skipping`);
+    return;
+  }
+  writeFileSync(path, contents);
+  log(`[saacms init] wrote ${label}`);
+}
+var initCommand = defineCommand({
+  meta: {
+    name: "init",
+    description: "Bootstrap saacms into an existing host-framework project (v1 alpha: Astro only)."
+  },
+  args: {
+    host: {
+      type: "string",
+      description: "Host framework to scaffold for. Defaults to auto-detection from package.json + config files. v1 alpha only accepts 'astro'.",
+      required: false
+    },
+    storage: {
+      type: "string",
+      description: "Storage adapter to wire into saacms.config.ts. v1 alpha defaults to 'r2' (Cloudflare R2).",
+      default: "r2"
+    },
+    cwd: {
+      type: "string",
+      description: "Working directory to scaffold into. Defaults to process.cwd().",
+      required: false
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "Print the actions without writing files (the v0.1 default behaviour).",
+      default: false
+    }
+  },
+  run({ args }) {
+    const cwd = args.cwd ?? process.cwd();
+    const host = args.host ?? detectHost(cwd);
+    const storage = args.storage;
+    const dryRun = Boolean(args["dry-run"]);
+    console.log(`saacms init — target dir: ${cwd}`);
+    console.log(`detected host: ${host}`);
+    console.log(`storage adapter: ${storage}`);
+    if (host !== "astro") {
+      throw new Error(`init for host '${host}' not supported in v1 alpha. ` + "Per ADR 0024, v1 alpha only ships @saacms/host-astro. " + "Other hosts (Next.js, SvelteKit, Nuxt) are deferred to v1.x. " + "If this is an Astro project, pass --host=astro explicitly.");
+    }
+    if (dryRun) {
+      console.log("would create: saacms.config.ts (root)");
+      console.log("would create: saacms/collections/.gitkeep");
+      console.log("would create: saacms/blocks/.gitkeep");
+      console.log("would create: saacms/pages/.gitkeep");
+      console.log("would create: src/pages/api/saacms/[...slug].ts (mount point)");
+      console.log("would create: src/pages/admin/[...slug].astro (admin mount)");
+      console.log("would add: predeploy script -> 'saacms migrate check --strict'");
+      console.log(`would install peer deps: @saacms/core @saacms/host-astro @saacms/storage-${storage}`);
+      console.log("dry-run — no filesystem changes performed.");
+      return;
+    }
+    const log = (line) => {
+      console.log(line);
+    };
+    mkdirSync(join(cwd, "saacms"), { recursive: true });
+    mkdirSync(join(cwd, "saacms", "collections"), { recursive: true });
+    mkdirSync(join(cwd, "saacms", "blocks"), { recursive: true });
+    mkdirSync(join(cwd, "saacms", "pages"), { recursive: true });
+    mkdirSync(join(cwd, "src", "pages", "api", "saacms"), { recursive: true });
+    writeIfMissing(join(cwd, "saacms.config.ts"), renderSaacmsConfig(cwd), "saacms.config.ts", log);
+    const apiMountDest = join(cwd, "src", "pages", "api", "saacms", "[...slug].ts");
+    if (existsSync(apiMountDest)) {
+      log("[saacms init] src/pages/api/saacms/[...slug].ts already exists; skipping");
+    } else {
+      const templatePath = locateApiMountTemplate(cwd);
+      if (templatePath === null) {
+        throw new Error("Could not locate api-mount.ts.txt template. " + "Expected it under @saacms/host-astro/templates/ or " + "packages/host-astro/templates/. Is @saacms/host-astro installed?");
+      }
+      const template = readFileSync(templatePath, "utf8");
+      writeFileSync(apiMountDest, template);
+      log("[saacms init] wrote src/pages/api/saacms/[...slug].ts");
+    }
+    writeIfMissing(join(cwd, "saacms", "collections", ".gitkeep"), "", "saacms/collections/.gitkeep", log);
+    writeIfMissing(join(cwd, "saacms", "blocks", ".gitkeep"), "", "saacms/blocks/.gitkeep", log);
+    writeIfMissing(join(cwd, "saacms", "pages", ".gitkeep"), "", "saacms/pages/.gitkeep", log);
+    console.log("[saacms init] next steps:");
+    console.log("  1. bun add @saacms/core @saacms/host-astro @saacms/storage-d1 @saacms/storage-r2");
+    console.log("  2. edit saacms.config.ts to register your first Collection");
+    console.log("  3. bunx saacms codegen");
+  }
+});
+
+// src/commands/codegen.ts
+import { defineCommand as defineCommand2 } from "citty";
+import {
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  watch as fsWatch,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { dirname as dirname2, resolve as resolve2 } from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  collectionToOpenApiPaths,
+  schemaToD1Migration,
+  schemaToPuckFields
+} from "@saacms/core";
+var LOG_PREFIX = "[saacms codegen]";
+function pascalCase(slug) {
+  return slug.split(/[-_\s]+/).filter((s) => s.length > 0).map((s) => s.charAt(0).toUpperCase() + s.slice(1)).join("");
+}
+function resolvePaths(args) {
+  const cwd = resolve2(args.cwd ?? process.cwd());
+  const out = resolve2(args.out ?? `${cwd}/.saacms`);
+  const configPath = resolve2(cwd, "saacms.config.ts");
+  return { cwd, out, configPath };
+}
+async function loadConfig(configPath) {
+  if (!existsSync2(configPath)) {
+    throw new Error(`${LOG_PREFIX} no saacms.config.ts found at ${configPath}; run 'saacms init' first`);
+  }
+  const url = `${pathToFileURL(configPath).href}?t=${Date.now()}`;
+  const mod = await import(url);
+  if (mod.default === undefined) {
+    throw new Error(`${LOG_PREFIX} ${configPath} has no default export; export your defineConfig({...}) as default`);
+  }
+  return mod.default;
+}
+function ensureDir(path) {
+  if (!existsSync2(path)) {
+    mkdirSync2(path, { recursive: true });
+  }
+}
+function writeFileLogged(filePath, content) {
+  ensureDir(dirname2(filePath));
+  writeFileSync2(filePath, content);
+  console.log(`${LOG_PREFIX} wrote ${filePath}`);
+}
+function renderDrizzleStub(slug) {
+  const pascal = pascalCase(slug);
+  return `// generated stub: drizzle table for "${slug}" — see schemaToDrizzle in @saacms/core
+import { schemaToDrizzle } from "@saacms/core"
+import type { Schema } from "effect"
+
+export const make${pascal}Table = (
+  schema: Schema.Schema<any, any, any>,
+) => schemaToDrizzle("${slug}", schema)
+`;
+}
+function emitForCollection(coll, out, agg) {
+  const slug = String(coll.slug);
+  const { paths, components } = collectionToOpenApiPaths(coll);
+  const sql = schemaToD1Migration(coll);
+  const puck = schemaToPuckFields(coll);
+  const drizzleStub = renderDrizzleStub(slug);
+  writeFileLogged(`${out}/openapi/${slug}.json`, JSON.stringify(paths, null, 2));
+  writeFileLogged(`${out}/drizzle/${slug}.ts`, drizzleStub);
+  writeFileLogged(`${out}/migrations/${slug}.sql`, `${sql}
+`);
+  writeFileLogged(`${out}/puck/${slug}.json`, JSON.stringify(puck, null, 2));
+  for (const [k, v] of Object.entries(paths)) {
+    agg.paths[k] = v;
+  }
+  for (const [k, v] of Object.entries(components.schemas)) {
+    agg.schemas[k] = v;
+  }
+  return 4;
+}
+async function runOnce(args) {
+  const { out, configPath } = resolvePaths(args);
+  const config = await loadConfig(configPath);
+  const collections = config.collections ?? [];
+  ensureDir(out);
+  const agg = {
+    paths: {},
+    schemas: {}
+  };
+  let filesWritten = 0;
+  let errored = false;
+  for (const coll of collections) {
+    const slug = String(coll.slug);
+    try {
+      filesWritten += emitForCollection(coll, out, agg);
+    } catch (err) {
+      errored = true;
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(`${LOG_PREFIX} error in ${slug}: ${msg}`);
+    }
+  }
+  const aggregate = {
+    openapi: "3.1.0",
+    info: {
+      title: config.title ?? "saacms",
+      version: config.version ?? "0.0.0",
+      ...config.description !== undefined ? { description: config.description } : {}
+    },
+    paths: agg.paths,
+    components: { schemas: agg.schemas }
+  };
+  writeFileLogged(`${out}/openapi.json`, JSON.stringify(aggregate, null, 2));
+  filesWritten++;
+  console.log(`${LOG_PREFIX} wrote ${filesWritten} files for ${collections.length} collections`);
+  return { filesWritten, collectionsTouched: collections.length, errored };
+}
+var codegenCommand = defineCommand2({
+  meta: {
+    name: "codegen",
+    description: "Run Schema -> Drizzle / OpenAPI / TS-types / Puck-fields projections (writes to .saacms/)."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      description: "Working directory (where saacms.config.ts lives). Defaults to process.cwd().",
+      required: false
+    },
+    out: {
+      type: "string",
+      description: "Output directory for generated artefacts. Defaults to <cwd>/.saacms.",
+      required: false
+    },
+    watch: {
+      type: "boolean",
+      description: "Re-run on changes to saacms.config.ts (best-effort).",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const { configPath } = resolvePaths(args);
+    const result = await runOnce(args);
+    if (result.errored) {
+      process.exitCode = 1;
+    }
+    if (!args.watch)
+      return;
+    let watcher;
+    try {
+      let debounce;
+      watcher = fsWatch(configPath, () => {
+        if (debounce !== undefined)
+          clearTimeout(debounce);
+        debounce = setTimeout(() => {
+          if (!existsSync2(configPath)) {
+            watcher?.close();
+            return;
+          }
+          console.log(`${LOG_PREFIX} re-running due to change in ${configPath}`);
+          runOnce(args).then((r) => {
+            if (r.errored)
+              process.exitCode = 1;
+          }).catch((err) => {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`${LOG_PREFIX} watch re-run failed: ${msg}`);
+            process.exitCode = 1;
+          });
+        }, 25);
+      });
+      console.log(`${LOG_PREFIX} watching ${configPath} for changes`);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.warn(`${LOG_PREFIX} fs.watch unsupported: ${msg}`);
+    }
+  }
+});
+
+// src/commands/dev.ts
+import { defineCommand as defineCommand3 } from "citty";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+var ASTRO_CONFIG_FILES2 = [
+  "astro.config.ts",
+  "astro.config.mjs",
+  "astro.config.js",
+  "astro.config.cjs"
+];
+var NEXTJS_CONFIG_FILES2 = [
+  "next.config.ts",
+  "next.config.mjs",
+  "next.config.js"
+];
+var SVELTEKIT_CONFIG_FILES2 = ["svelte.config.js", "svelte.config.ts"];
+var NUXT_CONFIG_FILES2 = ["nuxt.config.ts", "nuxt.config.js"];
+function readPackageJson2(cwd) {
+  const path = join2(cwd, "package.json");
+  if (!existsSync3(path))
+    return null;
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function hasDep2(pkg, name) {
+  if (!pkg)
+    return false;
+  return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name] ?? pkg.peerDependencies?.[name]);
+}
+function hasAnyFile2(cwd, files) {
+  return files.some((file) => existsSync3(join2(cwd, file)));
+}
+function detectHost2(cwd) {
+  const pkg = readPackageJson2(cwd);
+  if (hasAnyFile2(cwd, ASTRO_CONFIG_FILES2) || hasDep2(pkg, "astro"))
+    return "astro";
+  if (hasAnyFile2(cwd, NEXTJS_CONFIG_FILES2) || hasDep2(pkg, "next"))
+    return "nextjs";
+  if (hasAnyFile2(cwd, SVELTEKIT_CONFIG_FILES2) || hasDep2(pkg, "@sveltejs/kit"))
+    return "sveltekit";
+  if (hasAnyFile2(cwd, NUXT_CONFIG_FILES2) || hasDep2(pkg, "nuxt"))
+    return "nuxt";
+  return "unknown";
+}
+function resolveHostCommand(host) {
+  if (host === "astro")
+    return ["bun", "run", "astro", "dev"];
+  if (host === "unknown") {
+    throw new Error("[saacms dev] no host detected — make sure you are in a host-framework project root.");
+  }
+  throw new Error(`[saacms dev] host '${host}' not supported in v1 alpha. ` + "Per ADR 0024, v1 alpha is Astro-only. " + "Next.js, SvelteKit, and Nuxt are deferred to v1.x.");
+}
+async function readStream(stream) {
+  if (stream === undefined || stream === null)
+    return "";
+  return new Response(stream).text();
+}
+async function startDev(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const codegenEnabled = opts.noCodegen !== true;
+  const stdio = opts.stdio ?? "inherit";
+  const host = detectHost2(cwd);
+  const hostCmd = resolveHostCommand(host);
+  console.log(`[saacms dev] starting host: ${hostCmd.join(" ")} | codegen watcher: ${codegenEnabled ? "enabled" : "disabled"}`);
+  const hostProc = Bun.spawn({
+    cmd: [...hostCmd],
+    cwd,
+    stdin: "inherit",
+    stdout: stdio === "pipe" ? "pipe" : "inherit",
+    stderr: stdio === "pipe" ? "pipe" : "inherit"
+  });
+  let codegenProc = null;
+  if (codegenEnabled) {
+    const cliPath = process.argv[1] ?? "";
+    codegenProc = Bun.spawn({
+      cmd: ["bun", "run", cliPath, "codegen", "--watch", "--cwd", cwd],
+      cwd,
+      stdin: "inherit",
+      stdout: stdio === "pipe" ? "pipe" : "inherit",
+      stderr: stdio === "pipe" ? "pipe" : "inherit"
+    });
+  }
+  let signalReceived = false;
+  let hostExitedFirst = false;
+  const forward = (sig) => {
+    signalReceived = true;
+    try {
+      hostProc.kill(sig);
+    } catch {}
+    if (codegenProc !== null) {
+      try {
+        codegenProc.kill(sig);
+      } catch {}
+    }
+  };
+  const onSigint = () => forward("SIGINT");
+  const onSigterm = () => forward("SIGTERM");
+  process.on("SIGINT", onSigint);
+  process.on("SIGTERM", onSigterm);
+  const hostStdoutP = stdio === "pipe" ? readStream(hostProc.stdout) : Promise.resolve("");
+  const hostStderrP = stdio === "pipe" ? readStream(hostProc.stderr) : Promise.resolve("");
+  const codegenStdoutP = codegenProc !== null && stdio === "pipe" ? readStream(codegenProc.stdout) : Promise.resolve("");
+  const codegenStderrP = codegenProc !== null && stdio === "pipe" ? readStream(codegenProc.stderr) : Promise.resolve("");
+  const hostExitP = hostProc.exited.then((code) => {
+    if (!signalReceived) {
+      hostExitedFirst = true;
+      console.log(`[saacms dev] host dev exited with code ${code}; shutting down codegen watcher`);
+      if (codegenProc !== null) {
+        try {
+          codegenProc.kill("SIGTERM");
+        } catch {}
+      }
+    }
+    return code;
+  });
+  const codegenExitP = codegenProc === null ? Promise.resolve(null) : codegenProc.exited.then((code) => {
+    if (!signalReceived && !hostExitedFirst && code !== 0) {
+      console.warn(`[saacms dev] codegen watcher exited non-zero with code ${code} (non-fatal; host dev continues)`);
+    }
+    return code;
+  });
+  const hostExitCode = await hostExitP;
+  const codegenExitCode = await codegenExitP;
+  process.off("SIGINT", onSigint);
+  process.off("SIGTERM", onSigterm);
+  const [hostStdout, hostStderr, codegenStdout, codegenStderr] = await Promise.all([
+    hostStdoutP,
+    hostStderrP,
+    codegenStdoutP,
+    codegenStderrP
+  ]);
+  console.log("[saacms dev] all children exited");
+  return {
+    hostExitCode,
+    codegenExitCode,
+    hostStdout,
+    hostStderr,
+    codegenStdout,
+    codegenStderr
+  };
+}
+var devCommand = defineCommand3({
+  meta: {
+    name: "dev",
+    description: "Run the host's dev command alongside `saacms codegen --watch` (DX sugar; not a server)."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      description: "Working directory. Defaults to process.cwd().",
+      required: false
+    },
+    "no-codegen": {
+      type: "boolean",
+      description: "Skip the codegen --watch subprocess (run host dev only).",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const cwd = args.cwd ?? process.cwd();
+    const noCodegen = Boolean(args["no-codegen"]);
+    const result = await startDev({ cwd, noCodegen });
+    process.exit(result.hostExitCode);
+  }
+});
+
+// src/commands/migrate.ts
+import { defineCommand as defineCommand4 } from "citty";
+import {
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync3,
+  readdirSync,
+  readFileSync as readFileSync3,
+  rmSync,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { dirname as dirname3, resolve as resolve3 } from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
+import {
+  schemaToD1Migration as schemaToD1Migration2,
+  fingerprintBlockSchema,
+  fingerprintToString,
+  diffBlockSchemas,
+  contentMigrationModuleSource,
+  detectPendingContentMigrations
+} from "@saacms/core";
+var LOG_PREFIX2 = "[saacms migrate]";
+var BREAKGLASS_AUDIT_PREFIX = "[saacms audit]";
+function resolveBreakGlassReason(args) {
+  const raw = args["break-glass"] ?? process.env.SAACMS_BREAKGLASS_REASON;
+  const attempted = raw !== undefined;
+  const trimmed = (raw ?? "").trim();
+  return trimmed.length > 0 ? { reason: trimmed, attempted: true } : { attempted };
+}
+var BLOCKS_KEY = "$blocks";
+function resolveCwd(args) {
+  return resolve3(args.cwd ?? process.cwd());
+}
+async function loadConfig2(cwd) {
+  const configPath = resolve3(cwd, "saacms.config.ts");
+  if (!existsSync4(configPath)) {
+    throw new Error(`${LOG_PREFIX2} no saacms.config.ts; run 'saacms init' first`);
+  }
+  const shadow = resolve3(cwd, `.saacms.config.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.ts`);
+  writeFileSync3(shadow, readFileSync3(configPath, "utf8"));
+  try {
+    const mod = await import(pathToFileURL2(shadow).href);
+    if (mod.default === undefined) {
+      throw new Error(`${LOG_PREFIX2} ${configPath} has no default export; export your defineConfig({...}) as default`);
+    }
+    return mod.default;
+  } finally {
+    rmSync(shadow, { force: true });
+  }
+}
+function snapshotPath(cwd) {
+  return resolve3(cwd, ".saacms/migrations/snapshot.json");
+}
+function readRawSnapshot(cwd) {
+  const path = snapshotPath(cwd);
+  if (!existsSync4(path))
+    return {};
+  return JSON.parse(readFileSync3(path, "utf8"));
+}
+function readSnapshot(cwd) {
+  const raw = readRawSnapshot(cwd);
+  const { [BLOCKS_KEY]: _blocks, ...collections } = raw;
+  return collections;
+}
+function readBlockSnapshot(cwd) {
+  const raw = readRawSnapshot(cwd);
+  const blocks = raw[BLOCKS_KEY];
+  return blocks !== undefined ? blocks : {};
+}
+function ensureDir2(path) {
+  if (!existsSync4(path)) {
+    mkdirSync3(path, { recursive: true });
+  }
+}
+function utcTimestamp(d) {
+  const p = (n, w = 2) => String(n).padStart(w, "0");
+  return `${d.getUTCFullYear()}${p(d.getUTCMonth() + 1)}${p(d.getUTCDate())}${p(d.getUTCHours())}${p(d.getUTCMinutes())}${p(d.getUTCSeconds())}`;
+}
+function sanitizeName(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]/g, "-");
+}
+function computeDdls(config) {
+  return (config.collections ?? []).map((coll) => [String(coll.slug), schemaToD1Migration2(coll)]);
+}
+function computeBlockFingerprints(config) {
+  return (config.blocks ?? []).map((block) => [
+    String(block.slug),
+    fingerprintBlockSchema(block),
+    block.version ?? 1
+  ]);
+}
+var generateSubCommand = defineCommand4({
+  meta: {
+    name: "generate",
+    description: "Project Schemas to D1 DDL and emit a SQL migration per new/changed Collection (saacms/migrations/db/)."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Human-readable name for the migration (becomes the file slug).",
+      required: false
+    },
+    cwd: {
+      type: "string",
+      description: "Working directory (where saacms.config.ts lives). Defaults to process.cwd().",
+      required: false
+    },
+    rename: {
+      type: "string",
+      description: "Explicit rename hint, e.g. --rename=posts.body:posts.content. Echoed back; full rename-aware diffing is v1.x.",
+      required: false
+    }
+  },
+  async run({ args }) {
+    const cwd = resolveCwd(args);
+    const name = args.name ?? "unnamed";
+    const config = await loadConfig2(cwd);
+    if (args.rename) {
+      console.log(`${LOG_PREFIX2} rename hint acknowledged: ${args.rename} (full rename-aware diffing is v1.x)`);
+    }
+    const ddls = computeDdls(config);
+    const snapshot = readSnapshot(cwd);
+    const dbDir = resolve3(cwd, "saacms/migrations/db");
+    const now = new Date;
+    const iso = now.toISOString();
+    const ts = utcTimestamp(now);
+    const sanitized = sanitizeName(name);
+    const nextSnapshot = {};
+    let generated = 0;
+    for (const [slug, currentDdl] of ddls) {
+      const prev = snapshot[slug];
+      const isNew = prev === undefined;
+      const changed = prev !== undefined && prev.ddl !== currentDdl;
+      if (!isNew && !changed) {
+        console.log(`${LOG_PREFIX2} ${slug}: no change`);
+        nextSnapshot[slug] = prev;
+        continue;
+      }
+      const file = resolve3(dbDir, `${ts}_${sanitized}_${slug}.sql`);
+      const header = `-- saacms migration: ${slug} | generated ${iso} | name: ${name}
+-- NOTE: v1 emits full desired state; ALTER-diffing lands in v1.x
+`;
+      ensureDir2(dirname3(file));
+      writeFileSync3(file, `${header}
+${currentDdl}
+`);
+      console.log(`${LOG_PREFIX2} ${slug}: ${isNew ? "new table" : "schema changed"} — wrote ${file}`);
+      nextSnapshot[slug] = {
+        ddl: currentDdl,
+        migrationCount: (prev?.migrationCount ?? 0) + 1
+      };
+      generated++;
+    }
+    const blockFps = computeBlockFingerprints(config);
+    const blockSnapshot = readBlockSnapshot(cwd);
+    const contentDir = resolve3(cwd, "saacms/migrations/content");
+    const nextBlockSnapshot = {};
+    let contentGenerated = 0;
+    for (const [slug, fp, authoredVersion] of blockFps) {
+      const prev = blockSnapshot[slug];
+      const currentFp = fingerprintToString(fp);
+      if (prev === undefined) {
+        console.log(`${LOG_PREFIX2} block ${slug}: registered (no content migration)`);
+        nextBlockSnapshot[slug] = {
+          fingerprint: currentFp,
+          version: authoredVersion,
+          migrationCount: 0
+        };
+        continue;
+      }
+      if (prev.fingerprint === currentFp) {
+        console.log(`${LOG_PREFIX2} block ${slug}: no change`);
+        nextBlockSnapshot[slug] = prev;
+        continue;
+      }
+      const diff = diffBlockSchemas({ fields: JSON.parse(prev.fingerprint) }, fp);
+      const fromVersion = prev.version;
+      const toVersion = prev.version + 1;
+      const source = contentMigrationModuleSource(slug, fromVersion, toVersion, diff);
+      const file = resolve3(contentDir, `${ts}_${sanitized}_${slug}.ts`);
+      ensureDir2(dirname3(file));
+      writeFileSync3(file, source);
+      console.log(`${LOG_PREFIX2} block ${slug}: schema changed (v${fromVersion} → v${toVersion}) — wrote ${file}`);
+      console.log(`${LOG_PREFIX2} ACTION REQUIRED: set \`version: ${toVersion}\` on the defineBlock({...}) for "${slug}" in your Block source — saacms does ` + `not edit your authored structure (ADR 0012)`);
+      nextBlockSnapshot[slug] = {
+        fingerprint: currentFp,
+        version: toVersion,
+        migrationCount: prev.migrationCount + 1
+      };
+      contentGenerated++;
+    }
+    const snapPath = snapshotPath(cwd);
+    ensureDir2(dirname3(snapPath));
+    const hadBlocks = Object.keys(nextBlockSnapshot).length > 0 || Object.keys(blockSnapshot).length > 0;
+    const merged = hadBlocks ? { ...nextSnapshot, [BLOCKS_KEY]: nextBlockSnapshot } : { ...nextSnapshot };
+    writeFileSync3(snapPath, `${JSON.stringify(merged, null, 2)}
+`);
+    console.log(`${LOG_PREFIX2} generated ${contentGenerated} content migration(s) for ${blockFps.length} block(s)`);
+    console.log(`${LOG_PREFIX2} generated ${generated} migration(s) for ${ddls.length} collection(s)`);
+  }
+});
+var RUN_PREFIX = "[saacms migrate run]";
+async function defaultExec(cmd, cwd) {
+  const [bin, ...rest] = cmd;
+  const proc = Bun.spawn({
+    cmd: [bin, ...rest],
+    cwd,
+    env: { ...process.env },
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  return { code, stdout, stderr };
+}
+function ledgerPath(cwd) {
+  return resolve3(cwd, ".saacms/migrations/applied.json");
+}
+function readLedger(cwd) {
+  const path = ledgerPath(cwd);
+  if (!existsSync4(path))
+    return { applied: [] };
+  const parsed = JSON.parse(readFileSync3(path, "utf8"));
+  return { applied: Array.isArray(parsed.applied) ? parsed.applied : [] };
+}
+function writeLedger(cwd, ledger) {
+  const path = ledgerPath(cwd);
+  ensureDir2(dirname3(path));
+  writeFileSync3(path, `${JSON.stringify(ledger, null, 2)}
+`);
+}
+async function runMigrateRun(args, deps = {}) {
+  const cwd = resolve3(args.cwd ?? process.cwd());
+  const target = args.target === "remote" ? "remote" : "local";
+  const exec = deps.exec ?? defaultExec;
+  const dbDir = resolve3(cwd, "saacms/migrations/db");
+  if (!existsSync4(dbDir)) {
+    console.log(`${RUN_PREFIX} no migrations directory; run 'saacms migrate generate' first`);
+    return 0;
+  }
+  const candidates = readdirSync(dbDir).filter((f) => f.endsWith(".sql")).sort();
+  const ledger = readLedger(cwd);
+  const appliedSet = new Set(ledger.applied);
+  const pending = candidates.filter((f) => !appliedSet.has(f));
+  if (pending.length === 0) {
+    console.log(`${RUN_PREFIX} up to date (${ledger.applied.length} applied, 0 pending)`);
+    return 0;
+  }
+  const database = args.database ?? process.env.SAACMS_D1_DATABASE;
+  if (!database) {
+    throw new Error(`${RUN_PREFIX} no D1 database — pass --database or set $SAACMS_D1_DATABASE`);
+  }
+  const targetFlag = target === "remote" ? "--remote" : "--local";
+  const wranglerCmd = (file) => [
+    "wrangler",
+    "d1",
+    "execute",
+    database,
+    targetFlag,
+    `--file=saacms/migrations/db/${file}`,
+    "--yes"
+  ];
+  if (args.dry) {
+    console.log(`${RUN_PREFIX} would apply ${pending.length} pending: ${pending.join(", ")}`);
+    for (const file of pending) {
+      console.log(`${RUN_PREFIX} would run: ${wranglerCmd(file).join(" ")}`);
+    }
+    return 0;
+  }
+  let appliedNow = 0;
+  for (const file of pending) {
+    const result = await exec(wranglerCmd(file), cwd);
+    if (result.code !== 0) {
+      writeLedger(cwd, ledger);
+      console.log(`${RUN_PREFIX} FAILED applying ${file}: ${result.stderr.slice(0, 300)}`);
+      return 1;
+    }
+    ledger.applied.push(file);
+    writeLedger(cwd, ledger);
+    appliedNow++;
+    console.log(`${RUN_PREFIX} applied ${file}`);
+  }
+  console.log(`${RUN_PREFIX} applied ${appliedNow} migration(s); ledger now ${ledger.applied.length} total`);
+  console.log(`${RUN_PREFIX} content migrations: none applied (saacms/migrations/content/ transforms are a v1.x dispatch)`);
+  return 0;
+}
+var runSubCommand = defineCommand4({
+  meta: {
+    name: "run",
+    description: "Apply pending DB migrations to a Cloudflare D1 database via wrangler (idempotent; ledger-tracked)."
+  },
+  args: {
+    target: {
+      type: "string",
+      description: "Migration target: 'local' (default) or 'remote'.",
+      default: "local"
+    },
+    cwd: {
+      type: "string",
+      description: "Working directory (where saacms/migrations/db/ lives). Defaults to process.cwd().",
+      required: false
+    },
+    database: {
+      type: "string",
+      description: "D1 database/binding name. Falls back to $SAACMS_D1_DATABASE.",
+      required: false
+    },
+    dry: {
+      type: "boolean",
+      description: "Print the apply plan and the wrangler commands; touch nothing.",
+      default: false
+    }
+  },
+  async run({ args }) {
+    process.exitCode = await runMigrateRun({
+      cwd: args.cwd,
+      target: args.target,
+      database: args.database,
+      dry: Boolean(args.dry)
+    });
+  }
+});
+var checkSubCommand = defineCommand4({
+  meta: {
+    name: "check",
+    description: "Read-only predeploy gate: report per-Collection drift; exit non-zero with --strict if any is pending."
+  },
+  args: {
+    strict: {
+      type: "boolean",
+      description: "Treat any pending migration or Schema drift as an error (exit code 1).",
+      default: false
+    },
+    cwd: {
+      type: "string",
+      description: "Working directory (where saacms.config.ts lives). Defaults to process.cwd().",
+      required: false
+    },
+    "break-glass": {
+      type: "string",
+      description: "Emergency override (ADR 0032): with a NON-EMPTY <reason>, a --strict drift gate exits 0 instead of 1 under explicit operator authority. Drift is still printed in full; the override is loud and ALWAYS audited (banner + structured stderr record). An empty/missing reason is NOT a break-glass — the gate still fails. Also accepts $SAACMS_BREAKGLASS_REASON.",
+      required: false
+    }
+  },
+  async run({ args }) {
+    const cwd = resolveCwd(args);
+    const config = await loadConfig2(cwd);
+    const ddls = computeDdls(config);
+    const snapshot = readSnapshot(cwd);
+    const drifted = [];
+    for (const [slug, currentDdl] of ddls) {
+      const prev = snapshot[slug];
+      if (prev === undefined) {
+        console.log(`${LOG_PREFIX2} ${slug}: NEW (never migrated)`);
+        drifted.push(slug);
+      } else if (prev.ddl !== currentDdl) {
+        console.log(`${LOG_PREFIX2} ${slug}: DRIFT (schema changed since last migrate generate)`);
+        drifted.push(slug);
+      } else {
+        console.log(`${LOG_PREFIX2} ${slug}: in-sync`);
+      }
+    }
+    if (drifted.length === 0) {
+      console.log(`${LOG_PREFIX2} check: all collections in sync`);
+    }
+    const contentReport = detectPendingContentMigrations({
+      blocks: config.blocks ?? [],
+      snapshot: readBlockSnapshot(cwd)
+    });
+    for (const p of contentReport.pending) {
+      console.log(`${LOG_PREFIX2} block ${p.slug}: DRIFT — ${p.reason}`);
+    }
+    if (contentReport.clean && (config.blocks ?? []).length > 0) {
+      console.log(`${LOG_PREFIX2} check: all blocks in sync`);
+    }
+    const collectionsPending = drifted.length > 0;
+    const contentPending = !contentReport.clean;
+    if (!collectionsPending && !contentPending) {
+      return;
+    }
+    const parts = [];
+    if (collectionsPending)
+      parts.push(`${drifted.length} collection(s): ${drifted.join(", ")}`);
+    if (contentPending) {
+      parts.push(`${contentReport.pending.length} block(s): ${contentReport.pending.map((p) => p.slug).join(", ")}`);
+    }
+    const summary = parts.join("; ");
+    if (args.strict) {
+      console.log(`${LOG_PREFIX2} check FAILED: ${summary} pending`);
+      console.log(`${LOG_PREFIX2} check: run 'saacms migrate generate <name>'`);
+      process.exitCode = 1;
+      const bg = resolveBreakGlassReason(args);
+      if (bg.reason !== undefined) {
+        const at = new Date().toISOString();
+        const pending = [
+          ...drifted,
+          ...contentReport.pending.map((p) => p.slug)
+        ];
+        const record = {
+          kind: "breakglass",
+          surface: "migrate-check",
+          reason: bg.reason,
+          pending,
+          at
+        };
+        console.error(`${LOG_PREFIX2} ============================================================`);
+        console.error(`${LOG_PREFIX2} *** BREAK-GLASS OVERRIDE — fail-closed migration gate bypassed ***`);
+        console.error(`${LOG_PREFIX2} BREAK-GLASS reason : ${bg.reason}`);
+        console.error(`${LOG_PREFIX2} BREAK-GLASS pending: ${pending.join(", ")}`);
+        console.error(`${LOG_PREFIX2} BREAK-GLASS at     : ${at}`);
+        console.error(`${LOG_PREFIX2} BREAK-GLASS: exit overridden 1 → 0 under explicit operator authority — the drift above is NOT resolved; review this record post-hoc`);
+        console.error(`${LOG_PREFIX2} ============================================================`);
+        console.error(`${BREAKGLASS_AUDIT_PREFIX} ${JSON.stringify(record)}`);
+        process.exitCode = 0;
+      } else if (bg.attempted) {
+        console.error(`${LOG_PREFIX2} BREAK-GLASS REJECTED: a break-glass requires a non-empty --break-glass="<reason>" (or $SAACMS_BREAKGLASS_REASON). Gate still FAILED (exit 1).`);
+      }
+    } else {
+      console.warn(`${LOG_PREFIX2} check: ${summary} pending (advisory)`);
+      console.warn(`${LOG_PREFIX2} check: run 'saacms migrate generate <name>' (non-strict — exit 0)`);
+    }
+  }
+});
+var migrateCommand = defineCommand4({
+  meta: {
+    name: "migrate",
+    description: "Generate, run, or check DB + content migrations (per ADR 0012)."
+  },
+  subCommands: {
+    generate: generateSubCommand,
+    run: runSubCommand,
+    check: checkSubCommand
+  }
+});
+
+// src/commands/publish.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { resolve as resolve4 } from "node:path";
+import { pathToFileURL as pathToFileURL3 } from "node:url";
+import { defineCommand as defineCommand5 } from "citty";
+import { compileForPublish } from "@saacms/core";
+var SAACMS_PATHSPECS = [
+  "saacms",
+  "saacms.config.ts",
+  "src/pages/api/saacms"
+];
+var REDACTED = "[REDACTED]";
+var TOKEN_SHAPES = [
+  /\bgh[pousr]_[A-Za-z0-9]{16,}\b/g,
+  /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+  /\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}\b/g,
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
+  /\bAKIA[0-9A-Z]{16}\b/g
+];
+var LABELED_SECRET = /((?:api[_-]?key|access[_-]?token|token|secret|password|passwd|pwd|credential|key)["'`]?\s*[:=]\s*["'`]?)([A-Za-z0-9_\-./+=]{12,})/gi;
+var ENV_SECRET = /\b([A-Z0-9]*(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|CREDENTIAL)[A-Z0-9_]*\s*=\s*)(\S{6,})/g;
+function redactSecrets(text) {
+  let out = text;
+  for (const re of TOKEN_SHAPES)
+    out = out.replace(re, REDACTED);
+  out = out.replace(LABELED_SECRET, (_m, label) => `${label}${REDACTED}`);
+  out = out.replace(ENV_SECRET, (_m, label) => `${label}${REDACTED}`);
+  return out;
+}
+function emit(line) {
+  console.log(redactSecrets(line));
+}
+function isSaacmsOwned(path, manifestWritten) {
+  for (const spec of SAACMS_PATHSPECS) {
+    if (path === spec || path.startsWith(`${spec}/`))
+      return true;
+  }
+  return manifestWritten.includes(path);
+}
+async function git(cwd, args) {
+  const proc = Bun.spawn({
+    cmd: ["git", "-C", cwd, ...args],
+    env: { ...process.env },
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  return { code, stdout, stderr };
+}
+function parsePorcelain(out) {
+  const entries = [];
+  for (const raw of out.split(`
+`)) {
+    if (raw.length < 4)
+      continue;
+    const xy = raw.slice(0, 2);
+    let path = raw.slice(3);
+    let changeType;
+    if (xy === "??")
+      changeType = "??";
+    else if (xy.includes("D"))
+      changeType = "D";
+    else if (xy.includes("R"))
+      changeType = "R";
+    else if (xy.includes("A"))
+      changeType = "A";
+    else if (xy.includes("M"))
+      changeType = "M";
+    else
+      changeType = xy.trim()[0] || "?";
+    if (xy.includes("R") && path.includes(" -> ")) {
+      path = path.slice(path.indexOf(" -> ") + 4);
+    }
+    entries.push({ path, changeType });
+  }
+  return entries;
+}
+function stagedForeignPaths(fullStatus, manifestWritten) {
+  const foreign = [];
+  for (const raw of fullStatus.split(`
+`)) {
+    if (raw.length < 4)
+      continue;
+    const x = raw[0];
+    if (x === " " || x === "?" || x === "!")
+      continue;
+    let path = raw.slice(3);
+    if (path.includes(" -> "))
+      path = path.slice(path.indexOf(" -> ") + 4);
+    if (!isSaacmsOwned(path, manifestWritten))
+      foreign.push(path);
+  }
+  return foreign;
+}
+function deriveMessage(entries) {
+  const paths = entries.map((e) => e.path);
+  const shown = paths.slice(0, 5).join(", ");
+  const suffix = paths.length > 5 ? `${shown}, +${paths.length - 5} more` : shown;
+  return `saacms: publish (${paths.length} file(s): ${suffix})`;
+}
+async function loadSaacmsConfig(cwd) {
+  const configPath = resolve4(cwd, "saacms.config.ts");
+  if (!existsSync5(configPath))
+    return null;
+  const shadow = resolve4(cwd, `.saacms.config.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.ts`);
+  writeFileSync4(shadow, readFileSync4(configPath, "utf8"));
+  try {
+    const mod = await import(pathToFileURL3(shadow).href);
+    return mod.default ?? null;
+  } finally {
+    rmSync2(shadow, { force: true });
+  }
+}
+var publishCommand = defineCommand5({
+  meta: {
+    name: "publish",
+    description: "Compile + commit the saacms source set to your Git repo (v1 alpha: local git only; --push optional)."
+  },
+  args: {
+    dry: {
+      type: "boolean",
+      description: "Print the commit plan without staging or committing anything.",
+      default: false
+    },
+    message: {
+      type: "string",
+      description: "Override the commit message saacms would otherwise derive from the changed set.",
+      required: false
+    },
+    cwd: {
+      type: "string",
+      description: "Repository directory to publish from. Defaults to process.cwd().",
+      required: false
+    },
+    push: {
+      type: "boolean",
+      description: "After committing, run `git push`. A push failure does not lose the local commit.",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const cwd = args.cwd ?? process.cwd();
+    const dry = Boolean(args.dry);
+    const push = Boolean(args.push);
+    const insideTree = await git(cwd, ["rev-parse", "--is-inside-work-tree"]);
+    if (insideTree.code !== 0 || insideTree.stdout.trim() !== "true") {
+      throw new Error(`[saacms publish] not a git repository at ${cwd}; saacms publishes by committing to your repo`);
+    }
+    let manifest = null;
+    const config = await loadSaacmsConfig(cwd);
+    if (config !== null) {
+      manifest = await compileForPublish(config, { cwd, dryRun: dry });
+    }
+    const allPathspecs = [
+      ...SAACMS_PATHSPECS,
+      ...manifest?.written ?? []
+    ];
+    const status = await git(cwd, [
+      "status",
+      "--porcelain",
+      "--",
+      ...allPathspecs
+    ]);
+    if (status.code !== 0) {
+      throw new Error(redactSecrets(`[saacms publish] git status failed: ${status.stderr.trim() || `exit ${status.code}`}`));
+    }
+    const entries = parsePorcelain(status.stdout);
+    const manifestWritten = manifest?.written ?? [];
+    const message = redactSecrets(typeof args.message === "string" && args.message.length > 0 ? args.message : deriveMessage(entries));
+    if (dry) {
+      if (manifest !== null && manifest.written.length > 0) {
+        emit(`[saacms publish] compile (dry-run): ${manifest.routes.length} route(s), ${manifest.content.length} content file(s), ${manifest.media.length} media file(s) would be emitted`);
+        for (const p of manifest.written) {
+          emit(`    ${p}`);
+        }
+      }
+      emit(`[saacms publish] would stage ${entries.length} path(s):`);
+      for (const entry of entries) {
+        emit(`  ${entry.changeType.padEnd(2)} ${entry.path}`);
+      }
+      emit(`[saacms publish] commit message: ${message}`);
+      emit("[saacms publish] dry-run — no commit made");
+      return;
+    }
+    if (entries.length === 0) {
+      emit("[saacms publish] nothing to publish (working tree clean for saacms paths)");
+      return;
+    }
+    const fullStatus = await git(cwd, ["status", "--porcelain"]);
+    if (fullStatus.code !== 0) {
+      throw new Error(redactSecrets(`[saacms publish] git status failed: ${fullStatus.stderr.trim() || `exit ${fullStatus.code}`}`));
+    }
+    const foreign = stagedForeignPaths(fullStatus.stdout, manifestWritten);
+    if (foreign.length > 0) {
+      throw new Error([
+        "[saacms publish] refusing to publish — staged changes outside the saacms-owned path set",
+        `  What: ${foreign.length} non-saacms path(s) are staged: ${foreign.slice(0, 5).join(", ")}${foreign.length > 5 ? `, +${foreign.length - 5} more` : ""}`,
+        "  Why: publish commits the whole index; non-saacms staged changes would ride along in the publish commit (blast-radius containment, ADR 0028 §D3).",
+        "  Fix: unstage them — `git restore --staged <path>` — then re-run `saacms publish`, or commit them separately first.",
+        "  Learn more: docs/adr/0028-publish-credential-and-blast-radius-model.md"
+      ].join(`
+`));
+    }
+    const addPaths = Array.from(new Set(entries.map((e) => e.path)));
+    const outOfScope = addPaths.filter((p) => !isSaacmsOwned(p, manifestWritten));
+    if (outOfScope.length > 0) {
+      throw new Error([
+        "[saacms publish] refusing to publish — path(s) outside the saacms-owned manifest scope",
+        `  What: ${outOfScope.slice(0, 5).join(", ")}${outOfScope.length > 5 ? `, +${outOfScope.length - 5} more` : ""}`,
+        "  Why: publish stages only SAACMS_PATHSPECS + exact compile-manifest paths (ADR 0028 §D3 publish-scope invariant).",
+        "  Fix: this is a saacms bug if it fires — file an issue; do not bypass by staging manually.",
+        "  Learn more: docs/adr/0028-publish-credential-and-blast-radius-model.md"
+      ].join(`
+`));
+    }
+    const add = await git(cwd, ["add", "--", ...addPaths]);
+    if (add.code !== 0) {
+      throw new Error(redactSecrets(`[saacms publish] git add failed: ${add.stderr.trim() || `exit ${add.code}`}`));
+    }
+    const authorName = process.env.GIT_AUTHOR_NAME;
+    const authorEmail = process.env.GIT_AUTHOR_EMAIL;
+    const identityArgs = authorName && authorEmail ? ["-c", `user.name=${authorName}`, "-c", `user.email=${authorEmail}`] : [];
+    const commit = await git(cwd, [
+      ...identityArgs,
+      "commit",
+      "-m",
+      message
+    ]);
+    if (commit.code !== 0) {
+      throw new Error(redactSecrets(`[saacms publish] git commit failed: ${commit.stderr.trim() || commit.stdout.trim() || `exit ${commit.code}`}`));
+    }
+    const head = await git(cwd, ["rev-parse", "--short", "HEAD"]);
+    const sha = head.code === 0 ? head.stdout.trim() : "(unknown)";
+    emit(`[saacms publish] committed ${sha}: ${message}`);
+    if (push) {
+      const pushed = await git(cwd, ["push"]);
+      if (pushed.code !== 0) {
+        emit(`[saacms publish] push failed: ${pushed.stderr.trim() || `exit ${pushed.code}`}`);
+        process.exitCode = 1;
+        return;
+      }
+      emit("[saacms publish] pushed to remote");
+    }
+  }
+});
+
+// src/commands/logs.ts
+import { defineCommand as defineCommand6 } from "citty";
+var LOG_PREFIX3 = "[saacms logs]";
+var CF_API_BASE = "https://api.cloudflare.com/client/v4";
+var POLL_INTERVAL_MS = 3000;
+var TERMINAL_STATUSES = ["success", "failure", "canceled"];
+function isTerminalStatus(s) {
+  return s !== undefined && TERMINAL_STATUSES.includes(s);
+}
+function resolveCreds(args) {
+  const token = args.token ?? process.env.CLOUDFLARE_API_TOKEN;
+  if (!token) {
+    throw new Error(`${LOG_PREFIX3} missing Cloudflare API token — pass --token or set $CLOUDFLARE_API_TOKEN`);
+  }
+  const account = args.account ?? process.env.CLOUDFLARE_ACCOUNT_ID;
+  if (!account) {
+    throw new Error(`${LOG_PREFIX3} missing Cloudflare account id — pass --account or set $CLOUDFLARE_ACCOUNT_ID`);
+  }
+  const project = args.project ?? process.env.CLOUDFLARE_PAGES_PROJECT;
+  if (!project) {
+    throw new Error(`${LOG_PREFIX3} missing Cloudflare Pages project — pass --project or set $CLOUDFLARE_PAGES_PROJECT`);
+  }
+  return { token, account, project };
+}
+async function cfGet(url, token, fetchFn) {
+  const res = await fetchFn(url, {
+    headers: { Authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    let snippet = "";
+    try {
+      snippet = (await res.text()).slice(0, 200);
+    } catch {
+      snippet = "<unreadable body>";
+    }
+    throw new Error(`${LOG_PREFIX3} Cloudflare API HTTP ${res.status}: ${snippet}`);
+  }
+  const env = await res.json();
+  if (!env.success) {
+    const msg = env.errors?.[0]?.message ?? "unknown error";
+    throw new Error(`${LOG_PREFIX3} Cloudflare API error: ${msg}`);
+  }
+  return env.result;
+}
+function deploymentUrl(c, deployId) {
+  return `${CF_API_BASE}/accounts/${c.account}/pages/projects/${c.project}/deployments/${deployId}`;
+}
+function logsUrl(c, deployId) {
+  return `${deploymentUrl(c, deployId)}/history/logs`;
+}
+function defaultSleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+function printLines(entries) {
+  for (const e of entries)
+    console.log(`${e.ts}  ${e.line}`);
+}
+async function runLogs(args, deps = {}) {
+  const creds = resolveCreds(args);
+  const fetchFn = deps.fetchFn ?? fetch;
+  const sleep = deps.sleep ?? defaultSleep;
+  const depUrl = deploymentUrl(creds, args.deployId);
+  const lgUrl = logsUrl(creds, args.deployId);
+  if (!args.follow) {
+    await cfGet(depUrl, creds.token, fetchFn);
+    const logs = await cfGet(lgUrl, creds.token, fetchFn);
+    printLines(logs.data ?? []);
+    return 0;
+  }
+  let printed = 0;
+  let interrupted = false;
+  const onSigint = () => {
+    interrupted = true;
+  };
+  process.on("SIGINT", onSigint);
+  try {
+    while (true) {
+      const dep = await cfGet(depUrl, creds.token, fetchFn);
+      const logs = await cfGet(lgUrl, creds.token, fetchFn);
+      const data = logs.data ?? [];
+      printLines(data.slice(printed));
+      printed = data.length;
+      if (interrupted)
+        return 0;
+      const status = dep.latest_stage?.status;
+      if (isTerminalStatus(status)) {
+        console.log(`${LOG_PREFIX3} deployment ${status}`);
+        return status === "success" ? 0 : 1;
+      }
+      await sleep(POLL_INTERVAL_MS);
+      if (interrupted)
+        return 0;
+    }
+  } finally {
+    process.removeListener("SIGINT", onSigint);
+  }
+}
+var logsCommand = defineCommand6({
+  meta: {
+    name: "logs",
+    description: "Fetch build + runtime logs for a deploy (v1 alpha: Cloudflare Pages)."
+  },
+  args: {
+    deployId: {
+      type: "positional",
+      description: "Deploy identifier as reported by Cloudflare Pages.",
+      required: true
+    },
+    follow: {
+      type: "boolean",
+      description: "Stream logs (tail mode) by polling instead of one-shot fetch.",
+      default: false
+    },
+    project: {
+      type: "string",
+      description: "Cloudflare Pages project name. Falls back to $CLOUDFLARE_PAGES_PROJECT.",
+      required: false
+    },
+    account: {
+      type: "string",
+      description: "Cloudflare account id. Falls back to $CLOUDFLARE_ACCOUNT_ID.",
+      required: false
+    },
+    token: {
+      type: "string",
+      description: "Cloudflare API token. Falls back to $CLOUDFLARE_API_TOKEN.",
+      required: false
+    }
+  },
+  async run({ args }) {
+    process.exitCode = await runLogs({
+      deployId: args.deployId,
+      follow: args.follow,
+      project: args.project,
+      account: args.account,
+      token: args.token
+    });
+  }
+});
+
+// src/commands/doctor.ts
+import { defineCommand as defineCommand7 } from "citty";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "node:fs";
+import { join as join3, resolve as resolve5 } from "node:path";
+var LOG_PREFIX4 = "[saacms doctor]";
+var MIN_BUN = [1, 3, 0];
+var STATUS_ICON = {
+  pass: "v",
+  info: "i",
+  warn: "W",
+  fail: "x"
+};
+var ASTRO_CONFIG_FILES3 = [
+  "astro.config.ts",
+  "astro.config.mjs",
+  "astro.config.js",
+  "astro.config.cjs"
+];
+var NEXTJS_CONFIG_FILES3 = [
+  "next.config.ts",
+  "next.config.mjs",
+  "next.config.js"
+];
+var SVELTEKIT_CONFIG_FILES3 = ["svelte.config.js", "svelte.config.ts"];
+var NUXT_CONFIG_FILES3 = ["nuxt.config.ts", "nuxt.config.js"];
+function loadPackageJson(cwd) {
+  const path = join3(cwd, "package.json");
+  if (!existsSync6(path))
+    return { kind: "absent" };
+  try {
+    return { kind: "ok", pkg: JSON.parse(readFileSync5(path, "utf8")) };
+  } catch {
+    return { kind: "invalid" };
+  }
+}
+function hasDep3(pkg, name) {
+  if (!pkg)
+    return false;
+  return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name] ?? pkg.peerDependencies?.[name]);
+}
+function hasAnyFile3(cwd, files) {
+  return files.some((file) => existsSync6(join3(cwd, file)));
+}
+function detectHost3(cwd, pkg) {
+  if (hasAnyFile3(cwd, ASTRO_CONFIG_FILES3) || hasDep3(pkg, "astro"))
+    return "astro";
+  if (hasAnyFile3(cwd, NEXTJS_CONFIG_FILES3) || hasDep3(pkg, "next"))
+    return "nextjs";
+  if (hasAnyFile3(cwd, SVELTEKIT_CONFIG_FILES3) || hasDep3(pkg, "@sveltejs/kit"))
+    return "sveltekit";
+  if (hasAnyFile3(cwd, NUXT_CONFIG_FILES3) || hasDep3(pkg, "nuxt"))
+    return "nuxt";
+  return "unknown";
+}
+function parseSemver(version) {
+  const core = version.split(/[-+]/, 1)[0] ?? "";
+  const parts = core.split(".").map((p) => {
+    const n = Number.parseInt(p, 10);
+    return Number.isNaN(n) ? 0 : n;
+  });
+  return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
+}
+function isBunVersionOk(version) {
+  const got = parseSemver(version);
+  for (let i = 0;i < 3; i++) {
+    const g = got[i] ?? 0;
+    const m = MIN_BUN[i] ?? 0;
+    if (g > m)
+      return true;
+    if (g < m)
+      return false;
+  }
+  return true;
+}
+var MIN_BUN_STR = MIN_BUN.join(".");
+function runChecks(cwd) {
+  const results = [];
+  const bunVersion = Bun.version;
+  if (isBunVersionOk(bunVersion)) {
+    results.push({
+      name: "bun-version",
+      status: "pass",
+      message: `Bun ${bunVersion} (>= ${MIN_BUN_STR} required)`
+    });
+  } else {
+    results.push({
+      name: "bun-version",
+      status: "fail",
+      message: `Bun version ${bunVersion} below required >= ${MIN_BUN_STR}`,
+      why: "saacms uses bun:test + Bun.file in core paths.",
+      fix: "bun upgrade",
+      learn: "https://bun.sh/docs"
+    });
+  }
+  const pkgState = loadPackageJson(cwd);
+  const pkg = pkgState.kind === "ok" ? pkgState.pkg : null;
+  if (pkgState.kind === "ok") {
+    results.push({
+      name: "package-json",
+      status: "pass",
+      message: `package.json found at ${join3(cwd, "package.json")}`
+    });
+  } else {
+    results.push({
+      name: "package-json",
+      status: "fail",
+      message: pkgState.kind === "invalid" ? `package.json at ${cwd} is not valid JSON` : `no package.json at ${cwd}`,
+      why: "saacms scaffolding expects a host project.",
+      fix: "bun init in this directory, then 'saacms init'.",
+      learn: "https://saacms.dev/init"
+    });
+  }
+  const host = detectHost3(cwd, pkg);
+  if (host === "astro") {
+    results.push({
+      name: "host-adapter",
+      status: "pass",
+      message: "host: astro (supported in v1 alpha)"
+    });
+  } else if (host === "unknown") {
+    results.push({
+      name: "host-adapter",
+      status: "fail",
+      message: "no host framework detected",
+      why: "saacms needs to know which host adapter to wire.",
+      fix: "add astro to package.json (npm i astro), then 'saacms init'.",
+      learn: "https://saacms.dev/hosts"
+    });
+  } else {
+    results.push({
+      name: "host-adapter",
+      status: "info",
+      message: `host: ${host} (deferred to v1.x — only @saacms/host-astro ships in v1 alpha)`
+    });
+  }
+  if (existsSync6(join3(cwd, "saacms.config.ts"))) {
+    results.push({
+      name: "saacms-config",
+      status: "pass",
+      message: "saacms.config.ts found"
+    });
+  } else {
+    results.push({
+      name: "saacms-config",
+      status: "fail",
+      message: `no saacms.config.ts at ${cwd}`,
+      why: "the config registers Collections, Blocks, host adapter.",
+      fix: "'saacms init' to scaffold one.",
+      learn: "https://saacms.dev/config"
+    });
+  }
+  const requiredPeers = [
+    {
+      pkg: "@saacms/core",
+      why: "required to import defineConfig in saacms.config.ts"
+    }
+  ];
+  if (host === "astro") {
+    requiredPeers.push({
+      pkg: "@saacms/host-astro",
+      why: "required to wire the Astro host adapter in saacms.config.ts"
+    });
+  }
+  const missingPeers = requiredPeers.filter((p) => !hasDep3(pkg, p.pkg));
+  if (missingPeers.length === 0) {
+    results.push({
+      name: "peer-deps",
+      status: "pass",
+      message: `peer deps installed: ${requiredPeers.map((p) => p.pkg).join(", ")}`
+    });
+  } else {
+    for (const m of missingPeers) {
+      results.push({
+        name: "peer-deps",
+        status: "fail",
+        message: `missing peer dependency '${m.pkg}'`,
+        why: m.why,
+        fix: `bun add ${m.pkg}`,
+        learn: "https://saacms.dev/peer-deps"
+      });
+    }
+  }
+  const storageAdapters = ["@saacms/storage-d1", "@saacms/storage-r2"].filter((s) => hasDep3(pkg, s));
+  if (storageAdapters.length > 0) {
+    results.push({
+      name: "storage-adapter",
+      status: "pass",
+      message: `storage adapter installed: ${storageAdapters.join(", ")}`
+    });
+  } else {
+    results.push({
+      name: "storage-adapter",
+      status: "warn",
+      message: "no storage adapter installed",
+      why: "Collections need row + (optionally) media storage.",
+      fix: "'bun add @saacms/storage-d1 @saacms/storage-r2'",
+      learn: "https://saacms.dev/storage"
+    });
+  }
+  if (existsSync6(join3(cwd, "tsconfig.json"))) {
+    results.push({
+      name: "tsconfig",
+      status: "pass",
+      message: "tsconfig.json found"
+    });
+  } else {
+    results.push({
+      name: "tsconfig",
+      status: "warn",
+      message: "no tsconfig.json",
+      why: "saacms.config.ts uses TS imports.",
+      fix: "'bunx astro init --tsconfig' or copy tsconfig from a fresh Astro project.",
+      learn: "https://saacms.dev/tsconfig"
+    });
+  }
+  return results;
+}
+function summarize(results) {
+  const summary = { pass: 0, info: 0, warn: 0, fail: 0 };
+  for (const r of results)
+    summary[r.status]++;
+  return summary;
+}
+function printHuman(cwd, results, summary) {
+  console.log(`${LOG_PREFIX4} checking ${cwd}`);
+  const nameWidth = Math.max(...results.map((r) => r.name.length));
+  for (const r of results) {
+    const icon = STATUS_ICON[r.status];
+    console.log(`  ${icon} ${r.name.padEnd(nameWidth)}  ${r.message}`);
+    const indent = " ".repeat(2 + 1 + 1 + nameWidth + 2);
+    if (r.why !== undefined)
+      console.log(`${indent}Why: ${r.why}`);
+    if (r.fix !== undefined)
+      console.log(`${indent}Fix: ${r.fix}`);
+    if (r.learn !== undefined)
+      console.log(`${indent}Learn: ${r.learn}`);
+  }
+  console.log(`${LOG_PREFIX4} ${summary.pass} pass, ${summary.info} info, ${summary.warn} warn, ${summary.fail} fail`);
+}
+var doctorCommand = defineCommand7({
+  meta: {
+    name: "doctor",
+    description: "Report environment health: bun version, package.json, host adapter, config, peer deps, storage adapter, tsconfig."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      description: "Working directory to inspect. Defaults to process.cwd().",
+      required: false
+    },
+    json: {
+      type: "boolean",
+      description: "Emit machine-readable JSON instead of the human-readable report.",
+      default: false
+    }
+  },
+  run({ args }) {
+    const cwd = resolve5(args.cwd ?? process.cwd());
+    const results = runChecks(cwd);
+    const summary = summarize(results);
+    if (args.json) {
+      console.log(JSON.stringify({ results, summary }, null, 2));
+    } else {
+      printHuman(cwd, results, summary);
+    }
+    process.exitCode = summary.fail > 0 ? 1 : 0;
+  }
+});
+
+// src/main.ts
+var main = defineCommand8({
+  meta: {
+    name: "saacms",
+    version: "0.1.0",
+    description: "saacms \u2014 framework-agnostic content compiler. v1 alpha: Astro + Cloudflare Pages + D1 + R2."
+  },
+  subCommands: {
+    init: initCommand,
+    codegen: codegenCommand,
+    dev: devCommand,
+    migrate: migrateCommand,
+    publish: publishCommand,
+    logs: logsCommand,
+    doctor: doctorCommand
+  }
+});
+runMain(main);