@zveltio/cli 2.0.0 → 3.0.0-beta.1

package/dist/index.js

@@ -31,6 +31,20 @@ var __toESM = (mod, isNodeMode, target) => {
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/lib/error.js
@@ -1872,6 +1886,649 @@ var require_commander = __commonJS((exports) => {
   exports.InvalidOptionArgumentError = InvalidArgumentError;
 });
 
+// src/lib/publisher-tier.ts
+function tierAllowsInline(tier) {
+  return tier === "first-party" || tier === "verified";
+}
+async function resolvePublisherTier(opts = {}) {
+  if (opts.firstParty) {
+    return { tier: "first-party", allowsInline: true, source: "flag" };
+  }
+  const token = opts.token ?? process.env.ZVELTIO_REGISTRY_TOKEN;
+  const registryUrl = opts.registryUrl ?? process.env.ZVELTIO_REGISTRY_URL ?? "https://registry.zveltio.com";
+  if (token) {
+    try {
+      const base = registryUrl.replace(/\/$/, "");
+      const url = new URL(`${base}/api/dev/publisher/self`);
+      if (opts.keyId)
+        url.searchParams.set("keyId", opts.keyId);
+      const res = await fetch(url.toString(), {
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(5000)
+      });
+      if (res.ok) {
+        const data = await res.json();
+        const tier = normalizeTier(data.tier);
+        if (tier) {
+          return { tier, allowsInline: tierAllowsInline(tier), source: "registry" };
+        }
+      }
+    } catch {}
+  }
+  return { tier: "community", allowsInline: false, source: "default" };
+}
+function normalizeTier(v) {
+  return v === "first-party" || v === "verified" || v === "community" ? v : null;
+}
+
+// ../sdk/dist/build/index.js
+import { createRequire } from "module";
+import { existsSync as existsSync8, readFileSync as readFileSync3 } from "fs";
+import { dirname, join as join8 } from "path";
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function pickExportTarget(target) {
+  if (typeof target === "string")
+    return target;
+  if (target && typeof target === "object") {
+    const o = target;
+    if (typeof o.import === "string")
+      return o.import;
+    if (typeof o.default === "string")
+      return o.default;
+    if (o.import)
+      return pickExportTarget(o.import);
+  }
+  return;
+}
+function resolveSearchPaths(resolveFromDir) {
+  const paths = [resolveFromDir];
+  let cur = resolveFromDir;
+  for (let i = 0;i < 6; i++) {
+    cur = dirname(cur);
+    paths.push(cur);
+    if (existsSync8(join8(cur, "node_modules")))
+      break;
+  }
+  return [...new Set(paths)];
+}
+function resolvePackageRoot(pkg, searchPaths) {
+  let candidate;
+  try {
+    candidate = dirname(require2.resolve(pkg, { paths: searchPaths }));
+  } catch {
+    throw new Error(`Cannot find package "${pkg}" from ${searchPaths[0]}. ` + `Run \`bun install\` in the extension directory or monorepo root.`);
+  }
+  for (;; ) {
+    const pkgJsonPath = join8(candidate, "package.json");
+    if (existsSync8(pkgJsonPath)) {
+      const manifest = JSON.parse(readFileSync3(pkgJsonPath, "utf8"));
+      if (manifest.name === pkg)
+        return candidate;
+    }
+    const parent = dirname(candidate);
+    if (parent === candidate)
+      break;
+    candidate = parent;
+  }
+  throw new Error(`Cannot find package root for "${pkg}"`);
+}
+function resolvePackageEsmEntry(pkg, resolveFromDir) {
+  const searchPaths = resolveSearchPaths(resolveFromDir);
+  const root = resolvePackageRoot(pkg, searchPaths);
+  const pkgJsonPath = join8(root, "package.json");
+  const manifest = JSON.parse(readFileSync3(pkgJsonPath, "utf8"));
+  const dot = manifest.exports?.["."];
+  let rel = pickExportTarget(dot);
+  rel ??= manifest.module ?? manifest.main;
+  if (!rel || typeof rel !== "string") {
+    throw new Error(`Cannot determine ESM entry for package "${pkg}"`);
+  }
+  const abs = join8(root, rel.replace(/^\.\//, ""));
+  if (!existsSync8(abs)) {
+    throw new Error(`ESM entry missing for "${pkg}": ${abs}`);
+  }
+  if (abs.endsWith(".d.ts")) {
+    throw new Error(`Package "${pkg}" resolved to a declaration file (${abs}). ` + `Expected exports.import or module field to point at JavaScript.`);
+  }
+  return abs;
+}
+function createExtensionBundleResolvePlugin(resolveFromDir) {
+  return {
+    name: "zveltio-extension-bundle-resolve",
+    setup(build) {
+      for (const pkg of EXTENSION_BUNDLE_CORE_DEPS) {
+        const filter = new RegExp(`^${escapeRegExp(pkg)}$`);
+        build.onResolve({ filter }, () => ({
+          path: resolvePackageEsmEntry(pkg, resolveFromDir)
+        }));
+      }
+    }
+  };
+}
+function createExtensionBuildConfig(opts) {
+  return {
+    entrypoints: [opts.entry],
+    outdir: opts.outdir,
+    target: "bun",
+    format: "esm",
+    sourcemap: opts.sourcemap ? "linked" : "none",
+    external: opts.external ?? [],
+    conditions: [...BUNDLE_CONDITIONS],
+    plugins: [createExtensionBundleResolvePlugin(opts.resolveDir)]
+  };
+}
+var require2, EXTENSION_BUNDLE_CORE_DEPS, BUNDLE_CONDITIONS;
+var init_build = __esm(() => {
+  require2 = createRequire(import.meta.url);
+  EXTENSION_BUNDLE_CORE_DEPS = [
+    "hono",
+    "zod",
+    "kysely",
+    "@hono/zod-validator"
+  ];
+  BUNDLE_CONDITIONS = ["import", "bun", "node", "default"];
+});
+
+// src/lib/extension-bundle.ts
+import { existsSync as existsSync9, renameSync } from "fs";
+import { basename, dirname as dirname2, join as join9 } from "path";
+async function bundleExtensionEngine(opts) {
+  const outdir = dirname2(opts.outfile);
+  const entryBase = basename(opts.entry).replace(/\.[^.]+$/, "");
+  const builtPath = join9(outdir, `${entryBase}.js`);
+  const result = await Bun.build({
+    ...createExtensionBuildConfig({
+      entry: opts.entry,
+      outdir,
+      resolveDir: opts.resolveDir,
+      external: opts.external,
+      sourcemap: opts.sourcemap
+    }),
+    naming: `${entryBase}.[ext]`
+  });
+  if (!result.success) {
+    const messages = result.logs.map((l) => l.message).join(`
+`);
+    throw new Error(messages || "Bun.build failed");
+  }
+  if (!existsSync9(builtPath)) {
+    throw new Error(`Bun.build succeeded but ${builtPath} was not produced`);
+  }
+  if (builtPath !== opts.outfile) {
+    renameSync(builtPath, opts.outfile);
+  }
+}
+var EXTENSION_BUNDLE_CORE_DEPS2;
+var init_extension_bundle = __esm(() => {
+  init_build();
+  EXTENSION_BUNDLE_CORE_DEPS2 = EXTENSION_BUNDLE_CORE_DEPS;
+});
+
+// src/commands/extension-pack.ts
+var exports_extension_pack = {};
+__export(exports_extension_pack, {
+  extensionPackCommand: () => extensionPackCommand
+});
+import { createHash } from "crypto";
+import { existsSync as existsSync10, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { join as join10, resolve } from "path";
+function readManifest(dir) {
+  const path = join10(dir, "manifest.json");
+  if (!existsSync10(path)) {
+    throw new Error(`No manifest.json at ${path}.`);
+  }
+  return JSON.parse(readFileSync4(path, "utf8"));
+}
+function writeManifest(dir, m) {
+  writeFileSync2(join10(dir, "manifest.json"), `${JSON.stringify(m, null, 2)}
+`, "utf8");
+}
+function validatePeerDeps(m) {
+  const peers = Object.keys(m.peerDependencies ?? {});
+  if (peers.length === 0)
+    return [];
+  const bundlePeers = m.engine?.bundlePeers === true;
+  if (!bundlePeers) {
+    return peers;
+  }
+  return [];
+}
+async function extensionPackCommand(opts) {
+  const dir = resolve(opts.dir ?? process.cwd());
+  const entry = join10(dir, "engine", "index.ts");
+  const outfile = join10(dir, "engine", "index.js");
+  if (!existsSync10(entry)) {
+    throw new Error(`No engine/index.ts at ${entry}. ` + `Run from the extension root or pass --dir. Extensions without an engine entry don't need pack.`);
+  }
+  const manifest = readManifest(dir);
+  console.log(`\uD83D\uDCE6 Packing ${c7.bold(manifest.name)} v${manifest.version}`);
+  const violations = validatePeerDeps(manifest);
+  if (violations.length > 0) {
+    throw new Error(`peerDependencies declared without engine.bundlePeers=true:
+` + violations.map((v) => `  - ${v}`).join(`
+`) + `
+
+` + `Bun compiled binary cannot resolve bare specifiers from a ` + `dynamically-imported extension bundle, so external peer deps don't ` + `work in production. Either set engine.bundlePeers=true in ` + `manifest.json (and install the deps locally so Bun.build can ` + `inline them), or drop the peerDependencies entry if the import ` + `is dead code.`);
+  }
+  const externals = [];
+  console.log(`  ${c7.dim(`$ bun build ${entry} (zveltio extension-bundle plugin)`)}` + (externals.length > 0 ? c7.dim(` external:${externals.join(",")}`) : ""));
+  try {
+    await bundleExtensionEngine({
+      entry,
+      outfile,
+      external: externals,
+      sourcemap: opts.sourcemap,
+      resolveDir: dir
+    });
+  } catch (err2) {
+    throw new Error(`Bun bundle failed: ${err2.message}`);
+  }
+  const bundleBytes = readFileSync4(outfile);
+  const engineSha256 = createHash("sha256").update(bundleBytes).digest("hex");
+  const bundleText = bundleBytes.toString("utf8").replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|\s)\/\/[^\n]*/g, "$1");
+  for (const dep of CORE_DEPS) {
+    const baseImportRe = new RegExp(`(?:from|import\\()\\s*['"]${dep.replace(/[.*+?^${}()|[\\]/g, "\\$&")}['"]`, "m");
+    if (baseImportRe.test(bundleText)) {
+      throw new Error(`Bundled output still contains a bare import of '${dep}'. ` + `Bun couldn't bundle it \u2014 check that the dep is installed in node_modules ` + `(extension dir or a parent workspace).`);
+    }
+  }
+  const sizeKb = Math.round(bundleBytes.byteLength / 1024);
+  console.log(`  ${c7.green("\u2713")} ${c7.bold(`engine/index.js`)} ${c7.dim(`(${sizeKb} KB, sha256=${engineSha256.slice(0, 12)}\u2026)`)}`);
+  let resolvedIsolation = manifest.engine?.isolation;
+  if (!resolvedIsolation) {
+    const resolved = await resolvePublisherTier({
+      firstParty: opts.firstParty,
+      token: opts.token,
+      registryUrl: opts.registryUrl
+    });
+    if (!resolved.allowsInline) {
+      resolvedIsolation = "worker";
+      console.log(`  ${c7.yellow("\u26A0")} ${resolved.tier} publisher \u2014 auto-set ${c7.bold('engine.isolation: "worker"')} ` + `(community extensions can't run inline).`);
+      if (resolved.source === "default") {
+        console.log(c7.dim("    Tier defaulted to community (no --first-party flag, no registry token). " + "If you are verified/first-party, pass --first-party or set ZVELTIO_REGISTRY_TOKEN."));
+      }
+    }
+  }
+  if (!opts.noManifestUpdate) {
+    manifest.engine = {
+      entry: "engine/index.js",
+      format: "esm",
+      target: "bun",
+      bundled: true,
+      bundlePeers: manifest.engine?.bundlePeers ?? false,
+      ...resolvedIsolation ? { isolation: resolvedIsolation } : {}
+    };
+    manifest.integrity = {
+      engineSha256,
+      ...manifest.integrity?.archiveSha256 ? { archiveSha256: manifest.integrity.archiveSha256 } : {}
+    };
+    writeManifest(dir, manifest);
+    console.log(`  ${c7.green("\u2713")} manifest.json updated with engine + integrity blocks`);
+  }
+  console.log(`${c7.green("\u2713")} pack complete`);
+}
+var PEER_DEP_ALLOWLIST, CORE_DEPS, c7;
+var init_extension_pack = __esm(() => {
+  init_extension_bundle();
+  PEER_DEP_ALLOWLIST = new Set;
+  CORE_DEPS = [...EXTENSION_BUNDLE_CORE_DEPS2];
+  c7 = {
+    bold: (s) => `\x1B[1m${s}\x1B[0m`,
+    green: (s) => `\x1B[32m${s}\x1B[0m`,
+    red: (s) => `\x1B[31m${s}\x1B[0m`,
+    yellow: (s) => `\x1B[33m${s}\x1B[0m`,
+    dim: (s) => `\x1B[2m${s}\x1B[0m`
+  };
+});
+
+// src/commands/extension-status.ts
+var exports_extension_status = {};
+__export(exports_extension_status, {
+  extensionStatusCommand: () => extensionStatusCommand
+});
+async function extensionStatusCommand(name, opts = {}) {
+  const registryUrl = (opts.registryUrl ?? process.env.ZVELTIO_REGISTRY_URL ?? "https://registry.zveltio.com").replace(/\/$/, "");
+  console.log(`
+${c14.bold("Extension status")}
+`);
+  console.log(`  Name:      ${c14.bold(name)}`);
+  console.log(`  Registry:  ${c14.dim(registryUrl)}
+`);
+  const listRes = await fetch(`${registryUrl}/api/extensions/list`).catch(() => null);
+  if (listRes?.ok) {
+    const body = await listRes.json();
+    const found = body.extensions.find((e) => e.name === name);
+    if (found) {
+      console.log(`  Status:    ${c14.green("published")} (v${found.version})`);
+      console.log(`  ${c14.dim("Live in marketplace. Engines can install + enable it.")}`);
+      console.log("");
+      return;
+    }
+  }
+  const detailRes = await fetch(`${registryUrl}/api/dev/extensions/by-name/${encodeURIComponent(name)}`).catch(() => null);
+  if (detailRes?.ok) {
+    const body = await detailRes.json();
+    const statusColor = body.status === "published" ? c14.green : body.status === "pending" ? c14.yellow : c14.red;
+    console.log(`  Status:    ${statusColor(body.status)} (v${body.version})`);
+    console.log(`  Submitted: ${c14.dim(body.created_at)}`);
+    if (body.rejection_reason) {
+      console.log(`  ${c14.red("Rejection:")} ${body.rejection_reason}`);
+    }
+    if (body.taken_down_reason) {
+      console.log(`  ${c14.red("Takedown:")}  ${body.taken_down_reason}`);
+    }
+    switch (body.status) {
+      case "pending":
+        console.log(c14.dim("  Awaiting marketplace admin review."));
+        break;
+      case "published":
+        console.log(c14.dim("  Live in marketplace."));
+        break;
+      case "rejected":
+        console.log(c14.dim("  Address the reason above and re-submit."));
+        break;
+      case "taken_down":
+        console.log(c14.dim("  Removed by admin. Contact support to dispute."));
+        break;
+    }
+    console.log("");
+    return;
+  }
+  console.log(c14.yellow(`  \u26A0 Extension "${name}" not found in the marketplace.`));
+  console.log(c14.dim(`  - If you just submitted, the registry may take a moment to index.
+` + `  - If you publish under a developer account, sign in to the registry web UI to see pending/rejected submissions.
+` + "  - First-party / bundled extensions are not surfaced by this command \u2014 they ship with the engine binary directly."));
+  console.log("");
+}
+var c14;
+var init_extension_status = __esm(() => {
+  c14 = {
+    bold: (s) => `\x1B[1m${s}\x1B[0m`,
+    green: (s) => `\x1B[32m${s}\x1B[0m`,
+    red: (s) => `\x1B[31m${s}\x1B[0m`,
+    yellow: (s) => `\x1B[33m${s}\x1B[0m`,
+    dim: (s) => `\x1B[2m${s}\x1B[0m`
+  };
+});
+
+// src/commands/admin-marketplace.ts
+var exports_admin_marketplace = {};
+__export(exports_admin_marketplace, {
+  adminTeamSetRole: () => adminTeamSetRole,
+  adminTeamRemove: () => adminTeamRemove,
+  adminTeamList: () => adminTeamList,
+  adminTeamAdd: () => adminTeamAdd,
+  adminMarketplaceTakedown: () => adminMarketplaceTakedown,
+  adminMarketplaceReject: () => adminMarketplaceReject,
+  adminMarketplacePublishers: () => adminMarketplacePublishers,
+  adminMarketplacePending: () => adminMarketplacePending,
+  adminMarketplaceEnrollPublisher: () => adminMarketplaceEnrollPublisher,
+  adminMarketplaceApprove: () => adminMarketplaceApprove
+});
+import { readFileSync as readFileSync7 } from "fs";
+function getRegistryUrl(opts) {
+  return opts.registryUrl ?? process.env.ZVELTIO_REGISTRY_URL ?? "https://registry.zveltio.com";
+}
+function getCookie(opts) {
+  const cookie = opts.cookie ?? process.env.ZVELTIO_ADMIN_COOKIE;
+  if (!cookie) {
+    console.error(c15.red("No admin session cookie. Sign in to the registry web UI and pass --cookie or set ZVELTIO_ADMIN_COOKIE."));
+    process.exit(1);
+  }
+  return cookie;
+}
+async function adminFetch(opts, path, init = {}) {
+  return fetch(`${getRegistryUrl(opts).replace(/\/$/, "")}${path}`, {
+    ...init,
+    headers: {
+      ...init.headers,
+      Cookie: getCookie(opts)
+    }
+  });
+}
+async function resolveExtensionId(opts, nameOrId) {
+  if (/^[0-9a-f-]{36}$/i.test(nameOrId))
+    return nameOrId;
+  const res = await adminFetch(opts, "/api/admin/pending");
+  if (!res.ok) {
+    throw new Error(`Could not list pending to resolve name: ${res.status}`);
+  }
+  const body = await res.json();
+  const found = body.pending.find((e) => e.name === nameOrId);
+  if (!found) {
+    throw new Error(`No pending extension named "${nameOrId}". Use the id directly if it's already approved.`);
+  }
+  return found.id;
+}
+async function adminMarketplacePending(opts) {
+  const res = await adminFetch(opts, "/api/admin/pending");
+  if (!res.ok) {
+    console.error(c15.red(`Registry returned ${res.status}: ${await res.text()}`));
+    process.exit(1);
+  }
+  const body = await res.json();
+  console.log(`
+${c15.bold("Pending submissions:")} ${body.count}
+`);
+  if (body.count === 0) {
+    console.log(c15.dim("  (review queue empty)"));
+    return;
+  }
+  for (const e of body.pending) {
+    console.log(`  ${c15.bold(e.name)} v${e.version}  ${c15.dim(`(${e.category})`)}`);
+    console.log(`    id:        ${c15.dim(e.id)}`);
+    console.log(`    publisher: ${e.publisher_name ?? "(no name)"} <${e.publisher_email}>`);
+    console.log(`    submitted: ${c15.dim(e.created_at)}
+`);
+  }
+}
+async function adminMarketplaceApprove(nameOrId, opts) {
+  const id = await resolveExtensionId(opts, nameOrId);
+  const res = await adminFetch(opts, `/api/admin/approve/${id}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ note: opts.note ?? null })
+  });
+  if (!res.ok) {
+    console.error(c15.red(`Approve failed (${res.status}): ${await res.text()}`));
+    process.exit(1);
+  }
+  console.log(c15.green(`\u2713 Approved ${nameOrId}`));
+}
+async function adminMarketplaceReject(nameOrId, opts) {
+  if (!opts.reason) {
+    console.error(c15.red("--reason is required for reject"));
+    process.exit(1);
+  }
+  const id = await resolveExtensionId(opts, nameOrId);
+  const res = await adminFetch(opts, `/api/admin/reject/${id}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ reason: opts.reason })
+  });
+  if (!res.ok) {
+    console.error(c15.red(`Reject failed (${res.status}): ${await res.text()}`));
+    process.exit(1);
+  }
+  console.log(c15.green(`\u2713 Rejected ${nameOrId}`));
+}
+async function adminMarketplaceTakedown(nameOrId, opts) {
+  if (!opts.reason) {
+    console.error(c15.red("--reason is required for takedown"));
+    process.exit(1);
+  }
+  if (!/^[0-9a-f-]{36}$/i.test(nameOrId)) {
+    console.error(c15.red(`Takedown requires the extension id (UUID), not the name. Look it up at ${getRegistryUrl(opts)}/extensions/${encodeURIComponent(nameOrId)}.`));
+    process.exit(1);
+  }
+  const res = await adminFetch(opts, `/api/admin/takedown/${nameOrId}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ reason: opts.reason })
+  });
+  if (!res.ok) {
+    console.error(c15.red(`Takedown failed (${res.status}): ${await res.text()}`));
+    process.exit(1);
+  }
+  console.log(c15.green(`\u2713 Taken down ${nameOrId}`));
+}
+async function adminMarketplacePublishers(opts) {
+  const res = await adminFetch(opts, "/api/admin/publishers");
+  if (!res.ok) {
+    console.error(c15.red(`Registry returned ${res.status}: ${await res.text()}`));
+    process.exit(1);
+  }
+  const body = await res.json();
+  console.log(`
+${c15.bold("Enrolled publishers:")} ${body.count}
+`);
+  if (body.count === 0) {
+    console.log(c15.dim("  (no publishers enrolled \u2014 only first-party SYNC_TOKEN flow active)"));
+    return;
+  }
+  for (const p of body.publishers) {
+    const statusColor = p.status === "active" ? c15.green : p.status === "suspended" ? c15.yellow : c15.red;
+    console.log(`  ${c15.bold(p.publisher_name)} ${c15.dim(`(${p.contact_email})`)}  [${statusColor(p.status)}]`);
+    console.log(`    tier:        ${p.tier}`);
+    console.log(`    key_id:      ${c15.dim(p.key_id)}`);
+    console.log(`    id:          ${c15.dim(p.id)}`);
+    console.log(`    enrolled:    ${c15.dim(p.enrolled_at)}
+`);
+  }
+}
+async function adminTeamList(opts) {
+  const res = await adminFetch(opts, "/api/admin/team");
+  if (!res.ok) {
+    console.error(c15.red(`Registry returned ${res.status}: ${await res.text()}`));
+    process.exit(1);
+  }
+  const body = await res.json();
+  console.log(`
+${c15.bold("Admin team:")} ${body.count}
+`);
+  if (body.count === 0) {
+    console.log(c15.dim("  (empty \u2014 sign in with the ADMIN_EMAIL user to bootstrap)"));
+    return;
+  }
+  for (const m of body.team) {
+    const roleColor = m.role === "owner" ? c15.green : c15.dim;
+    console.log(`  ${c15.bold(m.name ?? m.email)} ${c15.dim(`(${m.email})`)} [${roleColor(m.role)}]`);
+    console.log(`    added: ${c15.dim(m.added_at)}${m.added_by_email ? ` by ${m.added_by_email}` : " (bootstrap)"}`);
+    if (m.notes)
+      console.log(`    notes: ${c15.dim(m.notes)}`);
+    console.log("");
+  }
+}
+async function adminTeamAdd(email, opts) {
+  const res = await adminFetch(opts, "/api/admin/team", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      email,
+      role: opts.role ?? "admin",
+      notes: opts.notes ?? null
+    })
+  });
+  if (!res.ok) {
+    console.error(c15.red(`Add failed (${res.status}): ${await res.text()}`));
+    process.exit(1);
+  }
+  console.log(c15.green(`\u2713 Added ${email} as ${opts.role ?? "admin"}`));
+}
+async function adminTeamSetRole(email, role, opts) {
+  const listRes = await adminFetch(opts, "/api/admin/team");
+  if (!listRes.ok) {
+    console.error(c15.red(`Could not list team: ${listRes.status}`));
+    process.exit(1);
+  }
+  const body = await listRes.json();
+  const match = body.team.find((m) => m.email.toLowerCase() === email.toLowerCase());
+  if (!match) {
+    console.error(c15.red(`No team member with email ${email}`));
+    process.exit(1);
+  }
+  const res = await adminFetch(opts, `/api/admin/team/${match.user_id}`, {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ role })
+  });
+  if (!res.ok) {
+    console.error(c15.red(`Role change failed (${res.status}): ${await res.text()}`));
+    process.exit(1);
+  }
+  console.log(c15.green(`\u2713 ${email} is now ${role}`));
+}
+async function adminTeamRemove(email, opts) {
+  const listRes = await adminFetch(opts, "/api/admin/team");
+  if (!listRes.ok) {
+    console.error(c15.red(`Could not list team: ${listRes.status}`));
+    process.exit(1);
+  }
+  const body = await listRes.json();
+  const match = body.team.find((m) => m.email.toLowerCase() === email.toLowerCase());
+  if (!match) {
+    console.error(c15.red(`No team member with email ${email}`));
+    process.exit(1);
+  }
+  const res = await adminFetch(opts, `/api/admin/team/${match.user_id}`, {
+    method: "DELETE"
+  });
+  if (!res.ok) {
+    console.error(c15.red(`Remove failed (${res.status}): ${await res.text()}`));
+    process.exit(1);
+  }
+  console.log(c15.green(`\u2713 Removed ${email} from admin team`));
+}
+async function adminMarketplaceEnrollPublisher(opts) {
+  if (!opts.name || !opts.email || !opts.keyId || !opts.keyFile) {
+    console.error(c15.red("--name, --email, --key-id, --key-file required for enroll-publisher"));
+    process.exit(1);
+  }
+  let keyJwk;
+  try {
+    keyJwk = readFileSync7(opts.keyFile, "utf8").trim();
+  } catch (err2) {
+    console.error(c15.red(`Could not read key file ${opts.keyFile}: ${err2.message}`));
+    process.exit(1);
+  }
+  try {
+    JSON.parse(keyJwk);
+  } catch {
+    console.error(c15.red(`Key file ${opts.keyFile} is not valid JSON`));
+    process.exit(1);
+  }
+  const res = await adminFetch(opts, "/api/admin/publishers", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      publisher_name: opts.name,
+      contact_email: opts.email,
+      public_key_jwk: keyJwk,
+      key_id: opts.keyId,
+      tier: opts.tier ?? "community",
+      notes: opts.notes ?? null
+    })
+  });
+  if (!res.ok) {
+    console.error(c15.red(`Enroll failed (${res.status}): ${await res.text()}`));
+    process.exit(1);
+  }
+  const body = await res.json();
+  console.log(c15.green(`\u2713 Publisher enrolled \u2014 id ${body.id}`));
+}
+var c15;
+var init_admin_marketplace = __esm(() => {
+  c15 = {
+    bold: (s) => `\x1B[1m${s}\x1B[0m`,
+    green: (s) => `\x1B[32m${s}\x1B[0m`,
+    red: (s) => `\x1B[31m${s}\x1B[0m`,
+    yellow: (s) => `\x1B[33m${s}\x1B[0m`,
+    dim: (s) => `\x1B[2m${s}\x1B[0m`
+  };
+});
+
 // ../../node_modules/.bun/commander@12.1.0/node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
@@ -1983,6 +2640,31 @@ ${c.bold(c.cyan("Zveltio Init"))}
   const portStr = await askWithDefault(iface, `Port ${c.dim("[3000]")}: `, "3000");
   const port = parseInt(portStr, 10) || 3000;
   const enableStudio = await askYesNo(iface, "Enable Studio (admin UI)?", true);
+  const enableIntranet = await askYesNo(iface, "Enable Employee Intranet zone? (portal for non-admin employees)", false);
+  const enableClientPortal = await askYesNo(iface, "Enable Client Portal? (customer-facing portal with multiple templates)", false);
+  let clientPortalTemplate = "generic";
+  if (enableClientPortal) {
+    console.log("");
+    console.log(c.dim("  Available templates:"));
+    console.log(c.dim("    1. generic      \u2014 Dashboard + support tickets + profile"));
+    console.log(c.dim("    2. saas         \u2014 Subscription management + support"));
+    console.log(c.dim("    3. services     \u2014 Professional services portal"));
+    console.log(c.dim("    4. regulatory   \u2014 Authorizations, inspections, business locations"));
+    console.log("");
+    const tmplAnswer = await ask(iface, `  Template ${c.dim("[1-4, default: 1]")}: `);
+    const tmplMap = {
+      "1": "generic",
+      "2": "saas",
+      "3": "services",
+      "4": "regulatory",
+      generic: "generic",
+      saas: "saas",
+      services: "services",
+      regulatory: "regulatory"
+    };
+    clientPortalTemplate = tmplMap[tmplAnswer.trim()] ?? "generic";
+    console.log(`  ${c.green("\u2714")} Template: ${clientPortalTemplate}`);
+  }
   const officialExtensions = await extensionsPromise;
   let selectedExtensions = [];
   if (officialExtensions.length > 0) {
@@ -2004,7 +2686,7 @@ Directory "${name}" already exists`));
   const s3SecretKey = crypto.randomUUID().replace(/-/g, "");
   const authSecret = crypto.randomUUID().replace(/-/g, "");
   const extensionsValue = selectedExtensions.join(",");
-  await Bun.write(join(dir, ".env"), [
+  const envLines = [
     "# WARNING: NEVER commit this file to git \u2014 it contains secrets.",
     "# For production, replace ALL values with strong credentials.",
     `DATABASE_URL=${databaseUrl}`,
@@ -2016,9 +2698,19 @@ Directory "${name}" already exists`));
     `S3_ACCESS_KEY=${s3AccessKey}`,
     `S3_SECRET_KEY=${s3SecretKey}`,
     `ENABLE_STUDIO=${enableStudio ? "true" : "false"}`,
-    `ZVELTIO_EXTENSIONS=${extensionsValue}`,
-    ""
-  ].join(`
+    `ZVELTIO_EXTENSIONS=${extensionsValue}`
+  ];
+  if (enableIntranet) {
+    envLines.push("# Intranet employee zone is enabled");
+    envLines.push("ENABLE_INTRANET=true");
+  }
+  if (enableClientPortal) {
+    envLines.push("# Client Portal");
+    envLines.push("ENABLE_CLIENT_PORTAL=true");
+    envLines.push(`CLIENT_PORTAL_TEMPLATE=${clientPortalTemplate}`);
+  }
+  envLines.push("");
+  await Bun.write(join(dir, ".env"), envLines.join(`
 `));
   await Bun.write(join(dir, ".env.example"), [
     "# Copy to .env and fill in real values. Never commit .env to git.",
@@ -2032,6 +2724,10 @@ Directory "${name}" already exists`));
     "S3_SECRET_KEY=CHANGE_ME",
     "ENABLE_STUDIO=true",
     `ZVELTIO_EXTENSIONS=${extensionsValue}`,
+    "# Optional zones",
+    "# ENABLE_INTRANET=true",
+    "# ENABLE_CLIENT_PORTAL=true",
+    "# CLIENT_PORTAL_TEMPLATE=generic   # generic | saas | services | regulatory",
     ""
   ].join(`
 `));
@@ -2080,20 +2776,20 @@ services:
 volumes:
   pgdata:
 `);
-  await Bun.write(join(dir, ".gitignore"), [
-    ".env",
-    "node_modules/",
-    "dist/",
-    ".DS_Store",
-    "*.local",
-    "types/",
-    ""
-  ].join(`
+  await Bun.write(join(dir, ".gitignore"), [".env", "node_modules/", "dist/", ".DS_Store", "*.local", "types/", ""].join(`
 `));
   const extSummary = selectedExtensions.length > 0 ? `
   ${c.green("\u2714")} Extensions: ${selectedExtensions.map((e) => e.split("/").pop()).join(", ")}` : "";
+  const intranetSummary = enableIntranet ? `
+  ${c.green("\u2714")} Employee Intranet: enabled` : "";
+  const portalSummary = enableClientPortal ? `
+  ${c.green("\u2714")} Client Portal: ${clientPortalTemplate} template` : "";
   console.log(`
-${c.green(`\u2714 Project "${projectName}" initialized`)} at ${dir}${extSummary}`);
+${c.green(`\u2714 Project "${projectName}" initialized`)} at ${dir}${extSummary}${intranetSummary}${portalSummary}`);
+  const portalNote = enableClientPortal ? `
+  ${c.cyan(`Client Portal:  http://localhost:${port}/portal-client/login`)}` : "";
+  const intranetNote = enableIntranet ? `
+  ${c.cyan(`Intranet:       http://localhost:${port}/admin/intranet`)}` : "";
   console.log(`
 ${c.bold("Next steps:")}
   ${name !== "." ? `cd ${name}
@@ -2102,7 +2798,7 @@ ${c.bold("Next steps:")}
   zveltio migrate           ${c.dim("# apply database migrations")}
   zveltio dev               ${c.dim("# start development server")}
 
-  ${c.cyan(`Open http://localhost:${port}${enableStudio ? "/admin" : "/api"}`)}
+  ${c.cyan(`Studio:         http://localhost:${port}${enableStudio ? "/admin" : "/api"}`)}${intranetNote}${portalNote}
 `);
 }
 
@@ -2156,11 +2852,7 @@ ${c2.dim("  Press Ctrl+C to stop")}
   process.exit(exitCode);
 }
 function findEngineEntry() {
-  const candidates = [
-    "packages/engine/src/index.ts",
-    "src/index.ts",
-    "index.ts"
-  ];
+  const candidates = ["packages/engine/src/index.ts", "src/index.ts", "index.ts"];
   for (const candidate of candidates) {
     if (existsSync2(join2(process.cwd(), candidate))) {
       return candidate;
@@ -2249,11 +2941,7 @@ function findBinary() {
   return null;
 }
 function findEngineEntry2() {
-  const candidates = [
-    "packages/engine/src/index.ts",
-    "src/index.ts",
-    "index.ts"
-  ];
+  const candidates = ["packages/engine/src/index.ts", "src/index.ts", "index.ts"];
   for (const candidate of candidates) {
     const full = join3(process.cwd(), candidate);
     if (existsSync3(full))
@@ -2329,14 +3017,7 @@ ${c4.bold(c4.cyan("Zveltio Deploy"))}
       await generateDockerfile(cwd, projectName);
       console.log(c4.dim("  Created: Dockerfile"));
     }
-    const buildArgs = [
-      "docker",
-      "build",
-      "--platform",
-      platform,
-      "-t",
-      imageName
-    ];
+    const buildArgs = ["docker", "build", "--platform", platform, "-t", imageName];
     if (dockerfile) {
       buildArgs.push("-f", dockerfile);
     }
@@ -2508,6 +3189,19 @@ async function runMigrationsViaAPI(opts) {
       method: "POST",
       headers: { "Content-Type": "application/json" }
     });
+    if (res.status === 401 || res.status === 403) {
+      console.error(`
+\u274C The engine requires authentication for migrations via API.`);
+      console.log("");
+      console.log("   Run migrations directly instead (no running engine needed):");
+      console.log(`     DATABASE_URL=<your-url> zveltio migrate`);
+      console.log(`     zveltio migrate --database-url postgresql://...`);
+      console.log("");
+      console.log("   Or set DATABASE_URL in your .env and run:");
+      console.log(`     source .env && zveltio migrate
+`);
+      process.exit(1);
+    }
     if (!res.ok) {
       const body = await res.json().catch(() => ({}));
       throw new Error(body.error ?? `Engine returned ${res.status}`);
@@ -2516,10 +3210,20 @@ async function runMigrationsViaAPI(opts) {
     console.log(`\u2705 ${data.applied} migration(s) applied. Schema version: ${data.schema_version}
 `);
   } catch (err) {
-    console.error(`
+    if (err.message?.includes("fetch") || err.code === "ECONNREFUSED") {
+      console.error(`
+\u274C Cannot reach engine at ${opts.url}`);
+      console.log("");
+      console.log("   Run migrations directly (no engine needed):");
+      console.log(`     DATABASE_URL=<your-url> zveltio migrate`);
+      console.log(`     zveltio migrate --database-url postgresql://...
+`);
+    } else {
+      console.error(`
 \u274C ${err.message}`);
-    console.log(`   Tip: Start the engine first, or use --database-url for direct migration
+      console.log(`   Tip: use --database-url for direct migration without a running engine
 `);
+    }
     process.exit(1);
   }
 }
@@ -2564,8 +3268,8 @@ Creating extension: ${category}/${safeName}
     displayName: name,
     description: `${name} extension for Zveltio`,
     version: "1.0.0",
-    zveltioMinVersion: "2.0.0",
-    zveltioMaxVersion: "3.0.0",
+    zveltioMinVersion: "1.0.0",
+    zveltioMaxVersion: "4.0.0",
     permissions: ["database"],
     contributes: { engine: true, studio: true, fieldTypes: [] }
   }, null, 2));
@@ -2665,6 +3369,51 @@ export default defineConfig({
       vite: "^6.0.0"
     }
   }, null, 2));
+  await writeFile(join5(targetDir, ".gitattributes"), `* text=auto eol=lf
+
+# Packed engine bundle: byte-identical across OSes. Manifest
+# integrity.engineSha256 is computed over these exact bytes.
+engine/index.js binary
+engine/index.js.map binary
+`);
+  await mkdir(join5(targetDir, ".github", "workflows"), { recursive: true });
+  await writeFile(join5(targetDir, ".github", "workflows", "ci.yml"), `name: Extension CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+jobs:
+  pack-and-verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with: { bun-version: latest }
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Pack extension (engine/index.ts \u2192 engine/index.js + manifest hash)
+        run: bunx @zveltio/cli extension pack
+
+      - name: Verify committed bundle matches manifest engineSha256
+        # If pack changed engine/index.js, the committed bytes drift
+        # from manifest.integrity.engineSha256. The publishing pipeline
+        # would reject this \u2014 fail PR before merging.
+        run: |
+          actual=$(sha256sum engine/index.js | awk '{print $1}')
+          declared=$(node -e "console.log(require('./manifest.json').integrity?.engineSha256 ?? '')")
+          if [ "$actual" != "$declared" ]; then
+            echo "::error::Bundle hash $actual \u2260 manifest engineSha256 $declared"
+            echo "::error::Run \\\`bunx @zveltio/cli extension pack\\\` locally and commit the result."
+            exit 1
+          fi
+
+      - name: Validate manifest + structure
+        run: bunx @zveltio/cli extension validate
+`);
   console.log(`Extension scaffolded at extensions/${category}/${safeName}/
 
 Structure:
@@ -2677,11 +3426,25 @@ Structure:
       pages/          <- Svelte UI components
     vite.config.ts
   manifest.json
+  .gitattributes      <- pins engine/index.js as binary (no EOL conversion)
+  .github/workflows/
+    ci.yml            <- pack + hash verify + validate on every PR
 
 Next steps:
   1. Add your business logic in engine/index.ts
   2. Create your UI in studio/src/pages/
-  3. Enable the extension: ZVELTIO_EXTENSIONS=${category}/${safeName}
+  3. Run \`bunx @zveltio/cli extension pack\` to build the bundle
+  4. Enable the extension: ZVELTIO_EXTENSIONS=${category}/${safeName}
+
+Isolation (MARKETPLACE-POLICY \xA72):
+  Community publishers MUST run in worker isolation. \`extension pack\`
+  auto-sets "engine": { ..., "isolation": "worker" } for you unless it can
+  confirm you're a verified/first-party publisher (via --first-party or a
+  registry token). Worker mode = Bun.Worker with crash isolation and no
+  direct DB credentials.
+
+  First-party / vendor builds that want inline isolation: pack with
+  --first-party. See https://github.com/zveltio-devs/zveltio/blob/master/docs/EXTENSION-DEVELOPER-GUIDE.md#135-isolation-tiers-be-honest-about-what-you-ship
 `);
 }
 async function buildExtension() {
@@ -2738,68 +3501,1432 @@ Publishing to Zveltio marketplace...`);
   console.log("  (Marketplace coming soon!)");
 }
 
-// src/commands/generate-types.ts
-import { mkdirSync as mkdirSync2 } from "fs";
-import { dirname } from "path";
-var c5 = {
-  bold: (s) => `\x1B[1m${s}\x1B[0m`,
-  green: (s) => `\x1B[32m${s}\x1B[0m`,
-  cyan: (s) => `\x1B[36m${s}\x1B[0m`,
-  dim: (s) => `\x1B[2m${s}\x1B[0m`,
-  red: (s) => `\x1B[31m${s}\x1B[0m`
-};
-async function generateTypesCommand(collection, opts) {
-  const engineUrl = opts.url || process.env.ZVELTIO_URL || "http://localhost:3000";
-  const outputPath = opts.output || "./types/zveltio.d.ts";
-  console.log(`
-${c5.bold("Generate Types")}
-`);
-  console.log(`  Engine: ${c5.dim(engineUrl)}`);
-  console.log(`  Output: ${c5.dim(outputPath)}`);
-  if (collection) {
-    console.log(`  Collection: ${c5.dim(collection)}`);
-  }
-  console.log("");
-  try {
-    const path = collection ? `/api/admin/types/${encodeURIComponent(collection)}` : `/api/admin/types`;
-    const res = await fetch(`${engineUrl}${path}`, {
-      headers: {
-        Authorization: `Bearer ${process.env.ZVELTIO_API_KEY || ""}`
+// src/commands/extension-types.ts
+import { existsSync as existsSync6, readdirSync, readFileSync, mkdirSync as mkdirSync2, writeFileSync } from "fs";
+import { join as join6, relative } from "path";
+
+// ../sdk/dist/schema-codegen.js
+var NUMERIC_TYPES = new Set([
+  "int",
+  "int2",
+  "int4",
+  "int8",
+  "integer",
+  "bigint",
+  "smallint",
+  "serial",
+  "bigserial",
+  "smallserial",
+  "numeric",
+  "decimal",
+  "real",
+  "double precision",
+  "float",
+  "float4",
+  "float8"
+]);
+var STRING_TYPES = new Set([
+  "text",
+  "varchar",
+  "char",
+  "character",
+  "character varying",
+  "name",
+  "uuid",
+  "citext",
+  "inet",
+  "cidr",
+  "macaddr"
+]);
+var BOOLEAN_TYPES = new Set(["boolean", "bool"]);
+var DATE_TYPES = new Set([
+  "date",
+  "time",
+  "timetz",
+  "timestamp",
+  "timestamptz",
+  "timestamp without time zone",
+  "timestamp with time zone",
+  "time without time zone",
+  "time with time zone"
+]);
+var JSON_TYPES = new Set(["json", "jsonb"]);
+var BYTES_TYPES = new Set(["bytea"]);
+function mapPgTypeToTs(pgType) {
+  const lower = pgType.toLowerCase().trim();
+  const isArray = /\[\]\s*$/.test(lower);
+  const base = lower.replace(/\[\]\s*$/, "").replace(/\(.*\)/, "").trim();
+  let tsBase;
+  if (NUMERIC_TYPES.has(base))
+    tsBase = "number";
+  else if (BOOLEAN_TYPES.has(base))
+    tsBase = "boolean";
+  else if (DATE_TYPES.has(base))
+    tsBase = "Date";
+  else if (JSON_TYPES.has(base))
+    tsBase = "Record<string, unknown>";
+  else if (BYTES_TYPES.has(base))
+    tsBase = "Uint8Array";
+  else if (STRING_TYPES.has(base))
+    tsBase = "string";
+  else
+    tsBase = "unknown";
+  return isArray ? `${tsBase}[]` : tsBase;
+}
+function stripComments(sql) {
+  let out = "";
+  let i = 0;
+  const n = sql.length;
+  let inSingle = false;
+  let dollarTag = null;
+  while (i < n) {
+    const ch = sql[i];
+    const next = sql[i + 1];
+    if (dollarTag !== null) {
+      out += ch;
+      if (sql.startsWith(dollarTag, i)) {
+        out += sql.slice(i + 1, i + dollarTag.length);
+        i += dollarTag.length;
+        dollarTag = null;
+      } else {
+        i++;
       }
-    });
-    if (!res.ok) {
-      console.error(c5.red(`Failed to fetch types: ${res.status} ${res.statusText}`));
+      continue;
+    }
+    if (inSingle) {
+      out += ch;
+      if (ch === "'" && next === "'") {
+        out += next;
+        i += 2;
+      } else if (ch === "'") {
+        inSingle = false;
+        i++;
+      } else
+        i++;
+      continue;
+    }
+    if (ch === "-" && next === "-") {
+      while (i < n && sql[i] !== `
+`)
+        i++;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < n && !(sql[i] === "*" && sql[i + 1] === "/"))
+        i++;
+      i += 2;
+      continue;
+    }
+    if (ch === "$") {
+      const m = sql.substring(i).match(/^\$[a-zA-Z_]*\$/);
+      if (m) {
+        dollarTag = m[0];
+        out += dollarTag;
+        i += dollarTag.length;
+        continue;
+      }
+    }
+    if (ch === "'") {
+      inSingle = true;
+      out += ch;
+      i++;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function findMatchingParen(sql, openIdx) {
+  let depth = 0;
+  let i = openIdx;
+  const n = sql.length;
+  let inSingle = false;
+  let dollarTag = null;
+  while (i < n) {
+    const ch = sql[i];
+    if (dollarTag !== null) {
+      if (sql.startsWith(dollarTag, i)) {
+        dollarTag = null;
+        i += sql.substring(i).match(/^\$[a-zA-Z_]*\$/)[0].length;
+        continue;
+      }
+      i++;
+      continue;
+    }
+    if (inSingle) {
+      if (ch === "'" && sql[i + 1] === "'")
+        i += 2;
+      else if (ch === "'") {
+        inSingle = false;
+        i++;
+      } else
+        i++;
+      continue;
+    }
+    if (ch === "'") {
+      inSingle = true;
+      i++;
+      continue;
+    }
+    if (ch === "$") {
+      const m = sql.substring(i).match(/^\$[a-zA-Z_]*\$/);
+      if (m) {
+        dollarTag = m[0];
+        i += dollarTag.length;
+        continue;
+      }
+    }
+    if (ch === "(")
+      depth++;
+    else if (ch === ")") {
+      depth--;
+      if (depth === 0)
+        return i;
+    }
+    i++;
+  }
+  return -1;
+}
+function parseColumnList(body) {
+  const columns = [];
+  const parts = [];
+  let depth = 0;
+  let buf = "";
+  for (let i = 0;i < body.length; i++) {
+    const ch = body[i];
+    if (ch === "(")
+      depth++;
+    else if (ch === ")")
+      depth--;
+    if (ch === "," && depth === 0) {
+      parts.push(buf);
+      buf = "";
+      continue;
+    }
+    buf += ch;
+  }
+  if (buf.trim())
+    parts.push(buf);
+  for (const rawPart of parts) {
+    const part = rawPart.trim();
+    if (!part)
+      continue;
+    if (/^(constraint|primary\s+key|foreign\s+key|unique|check|exclude|like)\b/i.test(part))
+      continue;
+    const col = parseColumnDef(part);
+    if (col)
+      columns.push(col);
+  }
+  return columns;
+}
+function parseColumnDef(line) {
+  const m = line.match(/^\s*(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s+(.+)$/);
+  if (!m)
+    return null;
+  const name = m[1] ?? m[2];
+  if (!name || name === "")
+    return null;
+  const rest = m[3];
+  const typeMatch = rest.match(/^((?:character\s+varying|character|double\s+precision|timestamp\s+(?:without|with)\s+time\s+zone|time\s+(?:without|with)\s+time\s+zone|[a-zA-Z_][a-zA-Z0-9_]*)(?:\s*\([^)]*\))?(?:\s*\[\s*\])?)\s*(.*)$/i);
+  if (!typeMatch)
+    return null;
+  const pgType = typeMatch[1].trim();
+  const tail = typeMatch[2] ?? "";
+  const upperTail = " " + tail.toUpperCase() + " ";
+  const notNull = / NOT NULL /.test(upperTail) || / PRIMARY KEY /.test(upperTail);
+  const tsBase = mapPgTypeToTs(pgType);
+  const tsType = notNull ? tsBase : `${tsBase} | null`;
+  return { name, pgType, tsType, nullable: !notNull };
+}
+function parseSchema(sqlChunks) {
+  const tables = new Map;
+  const order = [];
+  const ensureTable = (name) => {
+    if (!tables.has(name)) {
+      tables.set(name, new Map);
+      order.push(name);
+    }
+    return tables.get(name);
+  };
+  const allSql = sqlChunks.map(stripComments).join(`
+`);
+  const createRe = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s*\(/gi;
+  let m;
+  while ((m = createRe.exec(allSql)) !== null) {
+    const tableName = m[1] ?? m[2];
+    const openIdx = createRe.lastIndex - 1;
+    const closeIdx = findMatchingParen(allSql, openIdx);
+    if (closeIdx < 0)
+      continue;
+    const body = allSql.substring(openIdx + 1, closeIdx);
+    const columns = parseColumnList(body);
+    const tableCols = ensureTable(tableName);
+    for (const c5 of columns)
+      tableCols.set(c5.name, c5);
+    createRe.lastIndex = closeIdx + 1;
+  }
+  const alterRe = /ALTER\s+TABLE\s+(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s+ADD\s+COLUMN\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"([^"]+)"|([a-zA-Z_][a-zA-Z0-9_]*))\s+([^;]+?)(?=;|$)/gi;
+  while ((m = alterRe.exec(allSql)) !== null) {
+    const tableName = m[1] ?? m[2];
+    const colName = m[3] ?? m[4];
+    const tail = m[5];
+    const col = parseColumnDef(`${colName} ${tail}`);
+    if (col) {
+      const tableCols = ensureTable(tableName);
+      tableCols.set(col.name, col);
+    }
+  }
+  return {
+    tables: order.map((name) => ({ name, columns: [...tables.get(name).values()] }))
+  };
+}
+function emitTypeScript(schema, opts = {}) {
+  const interfaceName = opts.interfaceName ?? "ExtensionSchema";
+  const lines = [];
+  lines.push("// AUTO-GENERATED by zveltio CLI \u2014 do NOT edit by hand.");
+  lines.push("// Regenerate with: zveltio extension types");
+  if (opts.banner)
+    lines.push(`// ${opts.banner}`);
+  lines.push("");
+  lines.push("/* eslint-disable */");
+  lines.push("");
+  lines.push(`export interface ${interfaceName} {`);
+  if (schema.tables.length === 0) {
+    lines.push("  // No tables parsed from migrations.");
+  }
+  for (const t of schema.tables) {
+    lines.push(`  ${quoteIdentifierIfNeeded(t.name)}: {`);
+    for (const c5 of t.columns) {
+      lines.push(`    ${quoteIdentifierIfNeeded(c5.name)}: ${c5.tsType}; // ${c5.pgType}`);
+    }
+    lines.push("  };");
+  }
+  lines.push("}");
+  lines.push("");
+  return lines.join(`
+`);
+}
+function quoteIdentifierIfNeeded(name) {
+  return /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name) ? name : `'${name.replace(/'/g, "\\'")}'`;
+}
+
+// src/commands/extension-types.ts
+var c5 = {
+  bold: (s) => `\x1B[1m${s}\x1B[0m`,
+  green: (s) => `\x1B[32m${s}\x1B[0m`,
+  dim: (s) => `\x1B[2m${s}\x1B[0m`,
+  red: (s) => `\x1B[31m${s}\x1B[0m`,
+  yellow: (s) => `\x1B[33m${s}\x1B[0m`
+};
+async function extensionTypesCommand(opts = {}) {
+  const dir = opts.dir ?? process.cwd();
+  console.log(`
+${c5.bold("Extension types")}
+`);
+  console.log(`  Extension dir: ${c5.dim(dir)}`);
+  const manifestPath = join6(dir, "manifest.json");
+  if (!existsSync6(manifestPath)) {
+    console.error(c5.red(`No manifest.json found in ${dir}`));
+    console.error(c5.dim("  Run this command from your extension's root folder, or pass --dir."));
+    process.exit(1);
+  }
+  const migrationsDir = join6(dir, "engine", "migrations");
+  if (!existsSync6(migrationsDir)) {
+    console.error(c5.yellow(`No engine/migrations directory found at ${migrationsDir}`));
+    console.error(c5.dim("  Nothing to generate. Add SQL migrations first."));
+    process.exit(0);
+  }
+  const sqlFiles = readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort();
+  if (sqlFiles.length === 0) {
+    console.error(c5.yellow(`No .sql files in ${migrationsDir}`));
+    process.exit(0);
+  }
+  console.log(`  Migrations:    ${c5.dim(`${sqlFiles.length} file(s)`)}`);
+  const chunks = sqlFiles.map((f) => readFileSync(join6(migrationsDir, f), "utf8"));
+  const schema = parseSchema(chunks);
+  if (schema.tables.length === 0) {
+    console.log(c5.yellow("  No tables parsed. Check that CREATE TABLE statements are well-formed."));
+  } else {
+    console.log(`  Tables parsed: ${c5.dim(`${schema.tables.length}`)}`);
+    for (const t of schema.tables) {
+      console.log(`    - ${t.name} (${t.columns.length} cols)`);
+    }
+  }
+  let extName = "<unknown>";
+  try {
+    const m = JSON.parse(readFileSync(manifestPath, "utf8"));
+    if (typeof m.name === "string")
+      extName = m.name;
+  } catch {}
+  const banner = `Generated from ${extName} migrations: ${sqlFiles.join(", ")}`;
+  const tsBody = emitTypeScript(schema, { banner });
+  const outputPath = opts.output ?? join6(dir, ".zveltio", "db.d.ts");
+  mkdirSync2(join6(outputPath, ".."), { recursive: true });
+  writeFileSync(outputPath, tsBody, "utf8");
+  console.log(`
+${c5.green("Written:")} ${relative(process.cwd(), outputPath) || outputPath}`);
+  console.log(c5.dim("  Add `.zveltio/` to your .gitignore. Regenerate with this command after every migration."));
+  console.log("");
+}
+
+// src/commands/extension-validate.ts
+import { existsSync as existsSync7, readdirSync as readdirSync2, readFileSync as readFileSync2, statSync } from "fs";
+import { join as join7 } from "path";
+
+// ../sdk/dist/validate/migration-parse.js
+function parseMigrationSql(raw) {
+  const downIdx = raw.search(/^--\s*DOWN\b/im);
+  if (downIdx < 0) {
+    return { up: raw.trim(), down: null };
+  }
+  const up = raw.slice(0, downIdx).trim();
+  const downSection = raw.slice(downIdx);
+  const firstNewline = downSection.indexOf(`
+`);
+  const downBody = firstNewline >= 0 ? downSection.slice(firstNewline + 1).trim() : "";
+  return { up, down: downBody.length > 0 ? downBody : null };
+}
+
+// ../sdk/dist/validate/index.js
+var SEMVER_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/;
+var KNOWN_CATEGORIES = new Set([
+  "auth",
+  "content",
+  "crm",
+  "finance",
+  "hr",
+  "operations",
+  "developer",
+  "compliance",
+  "communications",
+  "analytics",
+  "geospatial",
+  "ai",
+  "integrations",
+  "i18n",
+  "workflow",
+  "storage",
+  "ecommerce",
+  "projects",
+  "sms",
+  "forms",
+  "billing",
+  "intelligence",
+  "business",
+  "search",
+  "data",
+  "custom"
+]);
+var SAFE_PACKAGE_NAME = /^(@[a-z0-9-_]+\/)?[a-z0-9-_.]+$/;
+var SAFE_VERSION_RANGE = /^[\d.*^~>=<| -]+$/;
+function err(code, message, file) {
+  return file ? { code, message, file } : { code, message };
+}
+function validateManifest(input) {
+  const out = [];
+  const m = input.manifest;
+  if (m === null || typeof m !== "object" || Array.isArray(m)) {
+    out.push(err("MANIFEST_NOT_OBJECT", "manifest.json must be a JSON object"));
+    return out;
+  }
+  const obj = m;
+  for (const k of ["name", "displayName", "category", "description", "version"]) {
+    if (typeof obj[k] !== "string" || obj[k].trim() === "") {
+      out.push(err("MANIFEST_MISSING_FIELD", `manifest.json missing required string field "${k}"`));
+    }
+  }
+  const name = typeof obj.name === "string" ? obj.name : "";
+  if (input.expectedName && name && name !== input.expectedName) {
+    out.push(err("MANIFEST_NAME_MISMATCH", `manifest "name": "${name}" does not match folder path "${input.expectedName}"`));
+  }
+  if (typeof obj.version === "string" && !SEMVER_RE.test(obj.version)) {
+    out.push(err("MANIFEST_BAD_VERSION", `version "${obj.version}" is not valid semver (x.y.z)`));
+  }
+  if (typeof obj.zveltioMinVersion === "string" && !SEMVER_RE.test(obj.zveltioMinVersion)) {
+    out.push(err("MANIFEST_BAD_MIN_VERSION", `zveltioMinVersion "${obj.zveltioMinVersion}" is not valid semver`));
+  }
+  if (typeof obj.zveltioMaxVersion === "string" && !SEMVER_RE.test(obj.zveltioMaxVersion)) {
+    out.push(err("MANIFEST_BAD_MAX_VERSION", `zveltioMaxVersion "${obj.zveltioMaxVersion}" is not valid semver`));
+  }
+  if (typeof obj.category === "string" && !KNOWN_CATEGORIES.has(obj.category)) {
+    out.push(err("MANIFEST_UNKNOWN_CATEGORY", `category "${obj.category}" isn't in the known set \u2014 typo? Known: ${[...KNOWN_CATEGORIES].sort().join(", ")}`));
+  }
+  return out;
+}
+function validatePeerDependencies(input) {
+  const out = [];
+  const deps = input.peerDependencies ?? {};
+  for (const [pkg, version] of Object.entries(deps)) {
+    if (typeof version !== "string") {
+      out.push(err("PEERDEP_BAD_VERSION", `peerDependency "${pkg}" version must be a string, got ${typeof version}`));
+      continue;
+    }
+    if (!SAFE_PACKAGE_NAME.test(pkg)) {
+      out.push(err("PEERDEP_UNSAFE_NAME", `peerDependency "${pkg}" uses an unsupported name format (file:, git:, etc. are forbidden)`));
+      continue;
+    }
+    if (!SAFE_VERSION_RANGE.test(version)) {
+      out.push(err("PEERDEP_UNSAFE_VERSION", `peerDependency "${pkg}" version range "${version}" is not a plain semver range`));
+      continue;
+    }
+    if (!input.allowedPackages.has(pkg)) {
+      out.push(err("PEERDEP_NOT_ALLOWED", `peerDependency "${pkg}" is not on the platform allow-list \u2014 open a PR to peer-deps-allowlist.ts to request inclusion`));
+    }
+  }
+  return out;
+}
+function hasDestructiveDdl(upSql) {
+  const s = upSql.replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
+  if (/\bDROP\s+TABLE\b/i.test(s))
+    return true;
+  if (/\bDROP\s+COLUMN\b/i.test(s))
+    return true;
+  if (/\bALTER\s+COLUMN\b[\s\S]*?\bDROP\s+(NOT\s+NULL|DEFAULT)\b/i.test(s))
+    return true;
+  return false;
+}
+function validateMigrations(input) {
+  const out = [];
+  for (const file of input.files) {
+    if (file.sql.trim() === "") {
+      out.push(err("MIGRATION_EMPTY", "migration file is empty", file.filename));
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = parseMigrationSql(file.sql);
+    } catch (e) {
+      out.push(err("MIGRATION_PARSE", `could not parse migration: ${e.message}`, file.filename));
+      continue;
+    }
+    if (parsed.up.trim() === "") {
+      out.push(err("MIGRATION_NO_UP", "migration has no UP section (everything before -- DOWN)", file.filename));
+      continue;
+    }
+    if (input.requireDownForDestructive && hasDestructiveDdl(parsed.up) && !parsed.down) {
+      out.push(err("MIGRATION_DESTRUCTIVE_NO_DOWN", 'migration contains destructive DDL (DROP TABLE/COLUMN or ALTER ... DROP) but has no "-- DOWN" section. Add one so uninstall --purgeData can roll back.', file.filename));
+    }
+  }
+  return out;
+}
+function validateFilePresence(input) {
+  const out = [];
+  for (const p of input.required) {
+    if (!input.paths[p]) {
+      out.push(err("FILE_MISSING", `required file is missing`, p));
+    }
+  }
+  return out;
+}
+var DEFAULT_BUNDLE_KB_MAX = 50000;
+function validateBundleSize(input) {
+  const cap = input.bundleSizeKbMax ?? DEFAULT_BUNDLE_KB_MAX;
+  const observedKb = Math.ceil(input.bundleBytes / 1024);
+  if (observedKb > cap) {
+    return [
+      err("BUNDLE_TOO_LARGE", `extension bundle is ${observedKb} KB; quota is ${cap} KB. Reduce the bundle or raise the quota in manifest.quotas.bundleSizeKbMax.`)
+    ];
+  }
+  return [];
+}
+function validateExtension(input) {
+  const errors = [
+    ...validateManifest(input.manifest),
+    ...validatePeerDependencies(input.peerDeps),
+    ...validateMigrations(input.migrations),
+    ...validateFilePresence(input.filePresence),
+    ...input.bundleSize ? validateBundleSize(input.bundleSize) : []
+  ];
+  return {
+    ok: errors.length === 0,
+    errors,
+    stats: {
+      tables: input.stats.tables,
+      migrations: input.stats.migrations,
+      peerDeps: Object.keys(input.peerDeps.peerDependencies ?? {}).length
+    }
+  };
+}
+
+// src/commands/extension-validate.ts
+var c6 = {
+  bold: (s) => `\x1B[1m${s}\x1B[0m`,
+  green: (s) => `\x1B[32m${s}\x1B[0m`,
+  red: (s) => `\x1B[31m${s}\x1B[0m`,
+  yellow: (s) => `\x1B[33m${s}\x1B[0m`,
+  dim: (s) => `\x1B[2m${s}\x1B[0m`
+};
+var PEER_DEPS_ALLOWLIST = new Set([
+  "node-saml",
+  "ldapts",
+  "imapflow",
+  "mailparser",
+  "nodemailer",
+  "@aws-sdk/client-s3",
+  "@aws-sdk/s3-request-presigner",
+  "nanoid",
+  "qrcode",
+  "pdfkit",
+  "graphql"
+]);
+function recursiveSize(dir) {
+  let total = 0;
+  if (!existsSync7(dir))
+    return 0;
+  for (const name of readdirSync2(dir)) {
+    const full = join7(dir, name);
+    if (name === "node_modules" || name === ".zveltio" || name === "dist")
+      continue;
+    let st;
+    try {
+      st = statSync(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory())
+      total += recursiveSize(full);
+    else if (st.isFile())
+      total += st.size;
+  }
+  return total;
+}
+function inferExpectedName(dir) {
+  const norm = dir.replace(/\\/g, "/");
+  const idx = norm.indexOf("zveltio-extensions/");
+  if (idx >= 0) {
+    return norm.slice(idx + "zveltio-extensions/".length).replace(/\/$/, "");
+  }
+  return norm.split("/").filter(Boolean).pop() ?? "";
+}
+async function extensionValidateCommand(opts = {}) {
+  const dir = opts.dir ?? process.cwd();
+  console.log(`
+${c6.bold("Extension validate")}
+`);
+  console.log(`  Extension dir: ${c6.dim(dir)}`);
+  const manifestPath = join7(dir, "manifest.json");
+  let manifest = null;
+  if (existsSync7(manifestPath)) {
+    try {
+      manifest = JSON.parse(readFileSync2(manifestPath, "utf8"));
+    } catch (e) {
+      console.error(c6.red(`  manifest.json is not valid JSON: ${e.message}`));
+      manifest = null;
+    }
+  }
+  const migrationsDir = join7(dir, "engine", "migrations");
+  let sqlFiles = [];
+  let parsedTableCount = 0;
+  if (existsSync7(migrationsDir)) {
+    sqlFiles = readdirSync2(migrationsDir).filter((f) => f.endsWith(".sql")).sort().map((filename) => ({
+      filename,
+      sql: readFileSync2(join7(migrationsDir, filename), "utf8")
+    }));
+    try {
+      parsedTableCount = parseSchema(sqlFiles.map((f) => f.sql)).tables.length;
+    } catch {
+      parsedTableCount = 0;
+    }
+  }
+  const paths = {};
+  for (const rel of ["manifest.json", "engine/index.ts", "engine/index.js"]) {
+    paths[rel] = existsSync7(join7(dir, rel));
+  }
+  const required = ["manifest.json"];
+  if (!(paths["engine/index.ts"] || paths["engine/index.js"])) {
+    required.push("engine/index.ts");
+  }
+  const bundleBytes = recursiveSize(dir);
+  const result = validateExtension({
+    manifest: {
+      manifest,
+      expectedName: inferExpectedName(dir)
+    },
+    peerDeps: {
+      peerDependencies: manifest && typeof manifest === "object" && !Array.isArray(manifest) ? manifest.peerDependencies : undefined,
+      allowedPackages: PEER_DEPS_ALLOWLIST
+    },
+    migrations: {
+      files: sqlFiles,
+      requireDownForDestructive: true
+    },
+    filePresence: { paths, required },
+    bundleSize: {
+      bundleBytes,
+      bundleSizeKbMax: manifest && typeof manifest === "object" && !Array.isArray(manifest) ? manifest?.quotas?.bundleSizeKbMax : undefined
+    },
+    stats: { tables: parsedTableCount, migrations: sqlFiles.length }
+  });
+  const m = manifest;
+  const v2Status = (() => {
+    if (!m)
+      return "unknown";
+    if (!m.engine)
+      return "v1-legacy";
+    if (m.engine.bundled !== true)
+      return "engine-not-bundled";
+    if (!m.engine.entry)
+      return "missing-engine-entry";
+    if (!m.integrity?.engineSha256)
+      return "missing-engine-sha";
+    return "v2-ok";
+  })();
+  console.log(`  Manifest:      ${manifest ? c6.green("OK") : c6.red("missing or invalid")}`);
+  console.log(`  Migrations:    ${c6.dim(`${result.stats.migrations} file(s), ${result.stats.tables} table(s) parsed`)}`);
+  console.log(`  Peer deps:     ${c6.dim(`${result.stats.peerDeps} declared`)}`);
+  console.log(`  Bundle size:   ${c6.dim(`${Math.ceil(bundleBytes / 1024)} KB`)}`);
+  const v2Label = v2Status === "v2-ok" ? c6.green("v2 (bundled)") : v2Status === "v1-legacy" ? c6.yellow("v1 (no engine block \u2014 run `zveltio extension pack`)") : v2Status === "engine-not-bundled" ? c6.red("engine.bundled !== true \u2014 re-pack required") : v2Status === "missing-engine-entry" ? c6.red("engine.entry missing") : v2Status === "missing-engine-sha" ? c6.red("integrity.engineSha256 missing \u2014 re-pack required") : c6.dim("unknown");
+  console.log(`  Manifest v2:   ${v2Label}`);
+  const isolation = m?.engine?.isolation ?? "inline";
+  const resolved = await resolvePublisherTier({
+    firstParty: opts.firstParty,
+    token: opts.token,
+    registryUrl: opts.registryUrl
+  });
+  const inlineOk = tierAllowsInline(resolved.tier);
+  const tierSrc = resolved.source === "flag" ? "--first-party" : resolved.source === "registry" ? "registry" : "default";
+  if (isolation === "worker") {
+    console.log(`  Isolation:     ${c6.green("worker (runs in any tier)")}`);
+  } else if (inlineOk) {
+    console.log(`  Isolation:     ${c6.dim(`inline (${resolved.tier} \u2014 allowed, via ${tierSrc})`)}`);
+  } else {
+    console.log(`  Isolation:     ${c6.red(`inline \u2014 ${resolved.tier} publishers MUST use 'worker'`)}`);
+  }
+  console.log("");
+  if (isolation !== "worker" && !inlineOk) {
+    console.error(c6.red(`Validation failed: ${resolved.tier} publishers must declare ` + `engine.isolation: "worker" (MARKETPLACE-POLICY \xA72).`));
+    console.error(c6.dim('  Add `"isolation": "worker"` to the engine block in manifest.json, ' + "then re-pack. If you are a verified/first-party publisher, pass " + "--first-party or set ZVELTIO_REGISTRY_TOKEN so the tier can be confirmed. " + "See docs/MARKETPLACE-POLICY.md \xA72."));
+    if (opts.silentExit)
+      throw new Error("Validation failed: community inline isolation");
+    process.exit(1);
+  }
+  if (v2Status === "v1-legacy") {
+    console.error(c6.red("Validation failed: manifest is v1 (no engine.bundled block)."));
+    console.error(c6.dim("  v1 manifests are unsupported since 1.0.0-beta.1. Run `zveltio extension pack` to " + "generate the v2 engine + integrity blocks. See docs/EXTENSION-DEVELOPER-GUIDE.md \xA74."));
+    if (opts.silentExit)
+      throw new Error("Validation failed: v1 manifest unsupported");
+    process.exit(1);
+  }
+  if (v2Status === "engine-not-bundled" || v2Status === "missing-engine-entry" || v2Status === "missing-engine-sha") {
+    console.error(c6.red("Validation failed: manifest declares v2 engine block but is incomplete."));
+    console.error(c6.dim("  Run `zveltio extension pack --dir <ext>` to regenerate engine + integrity blocks."));
+    if (opts.silentExit)
+      throw new Error("Validation failed: incomplete v2 manifest");
+    process.exit(1);
+  }
+  if (result.ok) {
+    console.log(c6.green("Validation passed."));
+    console.log(c6.dim("  Run `zveltio extension types` to refresh generated types, then `zveltio extension publish` when ready."));
+    console.log("");
+    return;
+  }
+  console.log(c6.red(`Validation failed with ${result.errors.length} error(s):`));
+  console.log("");
+  for (const e of result.errors) {
+    printError(e);
+  }
+  console.log("");
+  if (!opts.silentExit)
+    process.exit(1);
+}
+function printError(e) {
+  const loc = e.file ? c6.dim(` (${e.file})`) : "";
+  console.log(`  ${c6.red(e.code)}  ${e.message}${loc}`);
+}
+
+// src/commands/extension-publish.ts
+import { existsSync as existsSync12, mkdirSync as mkdirSync4, readFileSync as readFileSync6, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join12, resolve as resolve2 } from "path";
+import { tmpdir } from "os";
+
+// ../sdk/dist/publish/index.js
+function bytesToHex(bytes) {
+  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let out = "";
+  for (let i = 0;i < view.length; i++)
+    out += view[i].toString(16).padStart(2, "0");
+  return out;
+}
+function bytesToBase64(bytes) {
+  let bin = "";
+  for (let i = 0;i < bytes.length; i++)
+    bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
+}
+async function sha256Hex(bytes) {
+  const buf = await crypto.subtle.digest("SHA-256", bytes);
+  return bytesToHex(buf);
+}
+async function generateKeypair(keyId) {
+  const pair = await crypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]);
+  const kp = pair;
+  const publicJwk = await crypto.subtle.exportKey("jwk", kp.publicKey);
+  const privateJwk = await crypto.subtle.exportKey("jwk", kp.privateKey);
+  const finalKeyId = keyId ?? randomKeyId();
+  return {
+    keyId: finalKeyId,
+    createdAt: new Date().toISOString(),
+    publicJwk,
+    privateJwk
+  };
+}
+function randomKeyId() {
+  const buf = new Uint8Array(6);
+  crypto.getRandomValues(buf);
+  return "zv-" + bytesToHex(buf);
+}
+async function importPrivateKey(jwk) {
+  return await crypto.subtle.importKey("jwk", jwk, { name: "Ed25519" }, false, ["sign"]);
+}
+async function signBundle(archive, keypair) {
+  const bundleSha256 = await sha256Hex(archive);
+  const key = await importPrivateKey(keypair.privateJwk);
+  const dataBytes = new TextEncoder().encode(bundleSha256.toLowerCase());
+  const sigBuf = await crypto.subtle.sign({ name: "Ed25519" }, key, dataBytes);
+  return {
+    algorithm: "ed25519",
+    signature: bytesToBase64(new Uint8Array(sigBuf)),
+    bundleSha256,
+    signedAt: new Date().toISOString(),
+    keyId: keypair.keyId
+  };
+}
+async function exportTrustedKeyEntry(keyId, publicJwk) {
+  const key = await crypto.subtle.importKey("jwk", publicJwk, { name: "Ed25519" }, true, [
+    "verify"
+  ]);
+  const rawBuf = await crypto.subtle.exportKey("raw", key);
+  return { keyId, publicKeyHex: bytesToHex(new Uint8Array(rawBuf)) };
+}
+
+// src/commands/extension-publish.ts
+init_extension_pack();
+
+// src/commands/keys.ts
+import {
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync3,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync5,
+  writeFileSync as writeFileSync3,
+  chmodSync,
+  statSync as statSync2
+} from "fs";
+import { join as join11 } from "path";
+import { homedir, platform } from "os";
+var c8 = {
+  bold: (s) => `\x1B[1m${s}\x1B[0m`,
+  green: (s) => `\x1B[32m${s}\x1B[0m`,
+  red: (s) => `\x1B[31m${s}\x1B[0m`,
+  yellow: (s) => `\x1B[33m${s}\x1B[0m`,
+  dim: (s) => `\x1B[2m${s}\x1B[0m`
+};
+function keysDir() {
+  return join11(homedir(), ".zveltio", "keys");
+}
+function ensureKeysDir() {
+  const dir = keysDir();
+  if (!existsSync11(dir)) {
+    mkdirSync3(dir, { recursive: true });
+    if (platform() !== "win32") {
+      try {
+        chmodSync(dir, 448);
+      } catch {}
+    }
+  }
+  return dir;
+}
+function keyPath(keyId) {
+  return join11(keysDir(), `${keyId}.json`);
+}
+function writeKeyFile(kp) {
+  const path = keyPath(kp.keyId);
+  writeFileSync3(path, JSON.stringify(kp, null, 2), "utf8");
+  if (platform() !== "win32") {
+    try {
+      chmodSync(path, 384);
+    } catch {}
+  }
+}
+function readKeyFile(keyId) {
+  const path = keyPath(keyId);
+  if (!existsSync11(path)) {
+    throw new Error(`Keypair "${keyId}" not found at ${path}. Run \`zveltio keys generate --id ${keyId}\` first.`);
+  }
+  const raw = readFileSync5(path, "utf8");
+  const kp = JSON.parse(raw);
+  if (!kp.privateJwk || !kp.publicJwk || kp.keyId !== keyId) {
+    throw new Error(`Keypair file at ${path} is malformed`);
+  }
+  return kp;
+}
+function resolveKeyId(explicit) {
+  if (explicit)
+    return explicit;
+  const dir = keysDir();
+  if (!existsSync11(dir)) {
+    throw new Error("No keypairs found. Run `zveltio keys generate` first.");
+  }
+  const ids = readdirSync3(dir).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -5));
+  if (ids.length === 0)
+    throw new Error("No keypairs found. Run `zveltio keys generate` first.");
+  if (ids.length > 1) {
+    throw new Error(`Multiple keypairs exist (${ids.join(", ")}). Pass --key-id to choose one.`);
+  }
+  return ids[0];
+}
+async function keysGenerateCommand(opts = {}) {
+  ensureKeysDir();
+  const kp = await generateKeypair(opts.id);
+  if (existsSync11(keyPath(kp.keyId)) && !opts.force) {
+    console.error(c8.red(`Key "${kp.keyId}" already exists. Pass --force to overwrite.`));
+    process.exit(1);
+  }
+  writeKeyFile(kp);
+  console.log(`
+${c8.bold("Keypair generated")}
+`);
+  console.log(`  keyId:      ${c8.green(kp.keyId)}`);
+  console.log(`  Created:    ${c8.dim(kp.createdAt)}`);
+  console.log(`  Stored at:  ${c8.dim(keyPath(kp.keyId))}`);
+  if (platform() !== "win32") {
+    console.log(`  Permissions: ${c8.dim("0600 (user-only)")}`);
+  }
+  const trusted = await exportTrustedKeyEntry(kp.keyId, kp.publicJwk);
+  console.log(`
+${c8.bold("Public key (share with registry admin):")}
+`);
+  console.log(`  ${JSON.stringify([trusted], null, 2)}`);
+  console.log(c8.dim("\n  Paste the array above into the engine's `REGISTRY_PUBLIC_KEYS_JSON` env to trust this key locally."));
+  console.log("");
+}
+async function keysListCommand() {
+  const dir = keysDir();
+  if (!existsSync11(dir)) {
+    console.log(`${c8.yellow("No keypairs yet.")} Run ${c8.dim("zveltio keys generate")} to create one.`);
+    return;
+  }
+  const files = readdirSync3(dir).filter((f) => f.endsWith(".json")).sort();
+  if (files.length === 0) {
+    console.log(`${c8.yellow("No keypairs yet.")} Run ${c8.dim("zveltio keys generate")} to create one.`);
+    return;
+  }
+  console.log(`
+${c8.bold("Keypairs in")} ${c8.dim(dir)}
+`);
+  for (const file of files) {
+    const keyId = file.slice(0, -5);
+    try {
+      const kp = readKeyFile(keyId);
+      const st = statSync2(join11(dir, file));
+      const sizeKb = (st.size / 1024).toFixed(1);
+      console.log(`  ${c8.green(keyId.padEnd(24))} ${c8.dim(kp.createdAt)} ${c8.dim(`(${sizeKb} KB)`)}`);
+    } catch (err2) {
+      console.log(`  ${c8.red(keyId)} ${c8.dim("\u2014 malformed: " + err2.message)}`);
+    }
+  }
+  console.log("");
+}
+async function keysExportCommand(keyId) {
+  const kp = readKeyFile(keyId);
+  const trusted = await exportTrustedKeyEntry(kp.keyId, kp.publicJwk);
+  console.log(JSON.stringify([trusted], null, 2));
+}
+
+// src/commands/extension-publish.ts
+var c9 = {
+  bold: (s) => `\x1B[1m${s}\x1B[0m`,
+  green: (s) => `\x1B[32m${s}\x1B[0m`,
+  red: (s) => `\x1B[31m${s}\x1B[0m`,
+  yellow: (s) => `\x1B[33m${s}\x1B[0m`,
+  dim: (s) => `\x1B[2m${s}\x1B[0m`
+};
+function readManifest2(dir) {
+  const path = join12(dir, "manifest.json");
+  if (!existsSync12(path)) {
+    throw new Error(`No manifest.json at ${path}. Run from the extension's root or pass --dir.`);
+  }
+  const raw = readFileSync6(path, "utf8");
+  let m;
+  try {
+    m = JSON.parse(raw);
+  } catch (e) {
+    throw new Error(`manifest.json is not valid JSON: ${e.message}`);
+  }
+  if (!m.name || !m.version) {
+    throw new Error("manifest.json is missing required `name` or `version` field.");
+  }
+  return m;
+}
+function artifactBaseName(m) {
+  return `${m.name.replace(/\//g, "__")}-${m.version}`;
+}
+async function createArchive(dir, outFile) {
+  const excludes = [
+    "node_modules",
+    ".zveltio",
+    "dist",
+    "engine/dist",
+    ".git",
+    ".DS_Store",
+    "*.zvext",
+    "*.zvext.sig"
+  ];
+  const args = ["--force-local", "-czf", outFile];
+  for (const ex of excludes) {
+    args.push("--exclude", ex);
+  }
+  args.push(".");
+  const proc = Bun.spawn(["tar", ...args], { cwd: dir, stdout: "inherit", stderr: "inherit" });
+  const code = await proc.exited;
+  if (code !== 0)
+    throw new Error(`tar failed (exit ${code})`);
+}
+async function runStudioBuild(dir) {
+  if (!existsSync12(join12(dir, "studio")))
+    return;
+  const proc = Bun.spawn(["bun", "run", "build"], {
+    cwd: join12(dir, "studio"),
+    stdout: "inherit",
+    stderr: "inherit"
+  });
+  const code = await proc.exited;
+  if (code !== 0)
+    throw new Error(`Studio build failed (exit ${code})`);
+}
+async function runEnginePack(dir, tierOpts) {
+  if (!existsSync12(join12(dir, "engine", "index.ts")))
+    return;
+  await extensionPackCommand({ dir, ...tierOpts });
+}
+async function uploadToRegistry(opts) {
+  const url = `${opts.registryUrl.replace(/\/$/, "")}/api/v1/extensions/publish`;
+  const form = new FormData;
+  form.append("manifest", new Blob([JSON.stringify(opts.manifest)], { type: "application/json" }), "manifest.json");
+  form.append("signature", new Blob([opts.signatureJson], { type: "application/json" }), "signature.json");
+  form.append("archive", new Blob([opts.archive], { type: "application/gzip" }), `${artifactBaseName(opts.manifest)}.zvext`);
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${opts.token}` },
+    body: form
+  });
+  const body = await res.text();
+  return { ok: res.ok, status: res.status, body };
+}
+async function extensionPublishCommand(opts = {}) {
+  const dir = resolve2(opts.dir ?? process.cwd());
+  const registryUrl = opts.registryUrl ?? process.env.ZVELTIO_REGISTRY_URL ?? "https://registry.zveltio.com";
+  const token = opts.token ?? process.env.ZVELTIO_REGISTRY_TOKEN;
+  console.log(`
+${c9.bold("Extension publish")}
+`);
+  console.log(`  Extension dir: ${c9.dim(dir)}`);
+  let manifest;
+  try {
+    manifest = readManifest2(dir);
+  } catch (e) {
+    console.error(c9.red(e.message));
+    process.exit(1);
+  }
+  console.log(`  Name:          ${c9.bold(manifest.name)} ${c9.dim("v" + manifest.version)}`);
+  const runValidate = opts.validate !== false;
+  if (runValidate) {
+    console.log(`
+${c9.bold("Step 1/5: validate")}`);
+    try {
+      await extensionValidateCommand({
+        dir,
+        silentExit: true,
+        firstParty: opts.firstParty,
+        token,
+        registryUrl
+      });
+    } catch (e) {
+      console.error(c9.red(`Validate failed: ${e.message}`));
+      process.exit(1);
+    }
+  } else {
+    console.log(c9.yellow(`
+Skipping validate (--no-validate)`));
+  }
+  const runPackStep = opts.pack !== false && opts.build !== false;
+  if (runPackStep) {
+    console.log(`
+${c9.bold("Step 2/6: pack engine")}`);
+    try {
+      await runEnginePack(dir, {
+        firstParty: opts.firstParty,
+        token,
+        registryUrl
+      });
+      manifest = readManifest2(dir);
+    } catch (e) {
+      console.error(c9.red(e.message));
+      process.exit(1);
+    }
+  } else {
+    console.log(c9.yellow(`
+Skipping pack (${opts.build === false ? "--no-build" : "--no-pack"})`));
+  }
+  const runBuildStep = opts.build !== false;
+  if (runBuildStep) {
+    console.log(`
+${c9.bold("Step 3/6: studio build")}`);
+    try {
+      await runStudioBuild(dir);
+    } catch (e) {
+      console.error(c9.red(e.message));
+      process.exit(1);
+    }
+    console.log(c9.green("  build OK"));
+  } else {
+    console.log(c9.yellow(`
+Skipping build (--no-build)`));
+  }
+  if (opts.dryRun) {
+    console.log(`
+${c9.green("Dry-run complete")} \u2014 skipped archive/sign/publish.
+`);
+    return;
+  }
+  console.log(`
+${c9.bold("Step 4/6: archive")}`);
+  const tmpDir = opts.output ? resolve2(opts.output) : join12(tmpdir(), `zveltio-publish-${Date.now()}`);
+  if (!existsSync12(tmpDir))
+    mkdirSync4(tmpDir, { recursive: true });
+  const zvextPath = join12(tmpDir, `${artifactBaseName(manifest)}.zvext`);
+  try {
+    await createArchive(dir, zvextPath);
+  } catch (e) {
+    console.error(c9.red(e.message));
+    process.exit(1);
+  }
+  const archive = new Uint8Array(readFileSync6(zvextPath));
+  const stat = statSync3(zvextPath);
+  console.log(`  ${c9.dim(zvextPath)} ${c9.dim(`(${(stat.size / 1024).toFixed(1)} KB)`)}`);
+  console.log(`
+${c9.bold("Step 5/6: sign")}`);
+  let keyId;
+  try {
+    keyId = resolveKeyId(opts.keyId);
+  } catch (e) {
+    console.error(c9.red(e.message));
+    process.exit(1);
+  }
+  let signature;
+  let sigPath;
+  try {
+    const keypair = readKeyFile(keyId);
+    signature = await signBundle(archive, keypair);
+    sigPath = `${zvextPath}.sig`;
+    writeFileSync4(sigPath, JSON.stringify(signature, null, 2), "utf8");
+  } catch (e) {
+    console.error(c9.red(`  Signing failed: ${e.message}`));
+    console.error(c9.dim(e.stack ?? ""));
+    process.exit(1);
+  }
+  const digest = await sha256Hex(archive);
+  console.log(`  keyId:         ${c9.green(keyId)}`);
+  console.log(`  bundleSha256:  ${c9.dim(digest.slice(0, 16) + "\u2026")}`);
+  console.log(`  signature:     ${c9.dim(sigPath)}`);
+  if (opts.output) {
+    console.log(`
+${c9.green("Local publish complete.")}`);
+    console.log(c9.dim(`  Artifacts in ${tmpDir}. Upload them to the registry manually, or re-run without --output.`));
+    console.log("");
+    return;
+  }
+  if (!token) {
+    console.error(c9.red(`
+No registry token provided.`));
+    console.error(c9.dim("  Pass --token <token>, set ZVELTIO_REGISTRY_TOKEN, or use --output <dir> for a local-only build."));
+    process.exit(1);
+  }
+  console.log(`
+${c9.bold("Step 6/6: upload")}`);
+  console.log(`  Registry:      ${c9.dim(registryUrl)}`);
+  try {
+    const result = await uploadToRegistry({
+      registryUrl,
+      token,
+      archive,
+      signatureJson: JSON.stringify(signature, null, 2),
+      manifest
+    });
+    if (result.ok) {
+      console.log(c9.green(`  HTTP ${result.status} \u2014 submission received.`));
+      console.log(c9.dim(`  Body: ${result.body.slice(0, 200)}`));
+      console.log("");
+      console.log(c9.yellow("  \u23F3 Your submission is in the review queue (status: pending)."));
+      console.log(c9.dim(`     Marketplace admins review community submissions before they go live.`));
+      console.log(c9.dim(`     You'll be notified at your registered email when the decision lands.`));
+      console.log(c9.dim(`     Check status: zveltio extension status ${manifest.name}`));
+    } else if (result.status === 404) {
+      console.error(c9.yellow(`  HTTP 404 \u2014 the registry at ${registryUrl} does not implement /api/v1/extensions/publish yet.`));
+      console.error(c9.dim("  Use --output <dir> to ship locally for now. The CLI bits ahead of the server is intentional."));
+      process.exit(2);
+    } else if (result.status === 422) {
+      let parsed = {};
+      try {
+        parsed = JSON.parse(result.body);
+      } catch {}
+      if (parsed.code === "ISOLATION_POLICY_VIOLATION") {
+        console.error(c9.red(`  HTTP 422 \u2014 isolation policy violation.`));
+        console.error(c9.dim(`  ${parsed.error ?? result.body.slice(0, 300)}`));
+        console.error(c9.dim('  Re-pack with engine.isolation: "worker" (community publishers), ' + "or enroll as a verified publisher to ship inline."));
+        if (parsed.docs)
+          console.error(c9.dim(`  ${parsed.docs}`));
+      } else {
+        console.error(c9.red(`  HTTP 422 \u2014 ${parsed.error ?? "submission rejected"}.`));
+        console.error(c9.dim(`  Body: ${result.body.slice(0, 400)}`));
+      }
+      process.exit(1);
+    } else {
+      console.error(c9.red(`  HTTP ${result.status} \u2014 upload failed.`));
+      console.error(c9.dim(`  Body: ${result.body.slice(0, 400)}`));
+      process.exit(1);
+    }
+  } catch (e) {
+    console.error(c9.red(`  Upload error: ${e.message}`));
+    process.exit(1);
+  }
+  console.log("");
+}
+
+// src/commands/extension-dev.ts
+import { existsSync as existsSync13, statSync as statSync4 } from "fs";
+import { watch as fsWatch } from "fs";
+import { join as join13, resolve as resolve3, relative as relative3 } from "path";
+import { readdirSync as readdirSync4 } from "fs";
+var c10 = {
+  bold: (s) => `\x1B[1m${s}\x1B[0m`,
+  green: (s) => `\x1B[32m${s}\x1B[0m`,
+  red: (s) => `\x1B[31m${s}\x1B[0m`,
+  yellow: (s) => `\x1B[33m${s}\x1B[0m`,
+  dim: (s) => `\x1B[2m${s}\x1B[0m`,
+  cyan: (s) => `\x1B[36m${s}\x1B[0m`
+};
+function readManifestName(dir, override) {
+  if (override)
+    return override;
+  const manifestPath = join13(dir, "manifest.json");
+  if (!existsSync13(manifestPath)) {
+    throw new Error(`No manifest.json at ${manifestPath}. Pass --name or run from the extension's root.`);
+  }
+  const Bun_ = globalThis.Bun;
+  const raw = __require("fs").readFileSync(manifestPath, "utf8");
+  let m;
+  try {
+    m = JSON.parse(raw);
+  } catch (e) {
+    throw new Error(`manifest.json is not valid JSON: ${e.message}`);
+  }
+  if (typeof m.name !== "string")
+    throw new Error("manifest.json missing string `name`");
+  return m.name;
+}
+function collectEngineFiles(engineDir) {
+  if (!existsSync13(engineDir))
+    return [];
+  const out = [];
+  const stack = [engineDir];
+  while (stack.length > 0) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = readdirSync4(dir);
+    } catch {
+      continue;
+    }
+    for (const name of entries) {
+      if (name === "node_modules" || name === "dist" || name.startsWith("."))
+        continue;
+      const full = join13(dir, name);
+      let st;
+      try {
+        st = statSync4(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        stack.push(full);
+      } else if (st.isFile() && (name.endsWith(".ts") || name.endsWith(".js") || name.endsWith(".sql"))) {
+        out.push(full);
+      }
+    }
+  }
+  return out;
+}
+async function postReload(url, name) {
+  const endpoint = `${url.replace(/\/$/, "")}/__zveltio_dev_reload`;
+  let res;
+  try {
+    res = await fetch(endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ name })
+    });
+  } catch (e) {
+    return { ok: false, status: 0, body: { error: e.message } };
+  }
+  const body = await res.json().catch(() => ({}));
+  return { ok: res.ok, status: res.status, body };
+}
+async function extensionDevCommand(opts = {}) {
+  const dir = resolve3(opts.dir ?? process.cwd());
+  const url = (opts.url ?? process.env.ZVELTIO_ENGINE_URL ?? "http://localhost:3000").replace(/\/$/, "");
+  const engineDir = join13(dir, "engine");
+  let extName;
+  try {
+    extName = readManifestName(dir, opts.name);
+  } catch (e) {
+    console.error(c10.red(e.message));
+    process.exit(1);
+  }
+  console.log(`
+${c10.bold("Extension dev")}
+`);
+  console.log(`  Extension:  ${c10.cyan(extName)}`);
+  console.log(`  Folder:     ${c10.dim(dir)}`);
+  console.log(`  Engine:     ${c10.dim(url)}`);
+  const probe = await postReload(url, "__probe__");
+  if (probe.status === 0) {
+    console.error(c10.red(`
+  Cannot reach engine at ${url}. Start it with \`bun run dev\` in the engine package first.`));
+    process.exit(1);
+  }
+  if (probe.status === 404) {
+    console.error(c10.red(`
+  Engine returned 404 on /__zveltio_dev_reload. Is NODE_ENV=production? The endpoint is dev-only.`));
+    process.exit(1);
+  }
+  let studioProc = null;
+  if (!opts.noStudio && existsSync13(join13(dir, "studio"))) {
+    studioProc = Bun.spawn(["bun", "run", "dev"], {
+      cwd: join13(dir, "studio"),
+      stdout: "inherit",
+      stderr: "inherit"
+    });
+    console.log(`  Studio:     ${c10.green("watching (vite dev)")}`);
+  } else {
+    console.log(`  Studio:     ${c10.dim(opts.noStudio ? "skipped (--no-studio)" : "no studio/ folder \u2014 skipped")}`);
+  }
+  if (!existsSync13(engineDir)) {
+    console.log(`  Engine src: ${c10.yellow("no engine/ folder \u2014 engine watch disabled")}`);
+  } else {
+    const files = collectEngineFiles(engineDir);
+    console.log(`  Engine src: ${c10.green(`watching ${files.length} file(s)`)} ${c10.dim(`(.ts / .js / .sql under engine/)`)}`);
+    let timer = null;
+    let lastTrigger = "";
+    const debounceMs = 250;
+    const onChange = (filePath) => {
+      lastTrigger = relative3(dir, filePath);
+      if (timer)
+        clearTimeout(timer);
+      timer = setTimeout(async () => {
+        console.log(`
+${c10.dim("\u2192")} ${c10.cyan(lastTrigger)} ${c10.dim("changed \u2014 reloading\u2026")}`);
+        const result = await postReload(url, extName);
+        if (result.ok) {
+          console.log(`  ${c10.green("\u2713")} engine reloaded ${c10.dim(`(${result.status})`)}`);
+        } else {
+          console.log(`  ${c10.red("\u2717")} reload failed ${c10.dim(`(HTTP ${result.status})`)}`);
+          if (result.body?.error)
+            console.log(`  ${c10.red(result.body.error)}`);
+        }
+      }, debounceMs);
+    };
+    const watchers = files.map((f) => fsWatch(f, () => onChange(f)));
+    const cleanup = () => {
+      console.log(`
+
+${c10.dim("Stopping watchers\u2026")}`);
+      for (const w of watchers) {
+        try {
+          w.close();
+        } catch {}
+      }
+      if (studioProc && !studioProc.killed)
+        studioProc.kill();
+      process.exit(0);
+    };
+    process.on("SIGINT", cleanup);
+    process.on("SIGTERM", cleanup);
+  }
+  console.log(`
+${c10.dim(`Ready. Edit engine/ files to trigger a hot-reload. Ctrl+C to stop.
+`)}`);
+  if (studioProc) {
+    await studioProc.exited;
+  } else {
+    await new Promise(() => {});
+  }
+}
+
+// src/commands/generate-types.ts
+import { mkdirSync as mkdirSync5 } from "fs";
+import { dirname as dirname4 } from "path";
+var c11 = {
+  bold: (s) => `\x1B[1m${s}\x1B[0m`,
+  green: (s) => `\x1B[32m${s}\x1B[0m`,
+  cyan: (s) => `\x1B[36m${s}\x1B[0m`,
+  dim: (s) => `\x1B[2m${s}\x1B[0m`,
+  red: (s) => `\x1B[31m${s}\x1B[0m`
+};
+async function generateTypesCommand(collection, opts) {
+  const engineUrl = opts.url || process.env.ZVELTIO_URL || "http://localhost:3000";
+  const outputPath = opts.output || "./types/zveltio.d.ts";
+  console.log(`
+${c11.bold("Generate Types")}
+`);
+  console.log(`  Engine: ${c11.dim(engineUrl)}`);
+  console.log(`  Output: ${c11.dim(outputPath)}`);
+  if (collection) {
+    console.log(`  Collection: ${c11.dim(collection)}`);
+  }
+  console.log("");
+  try {
+    const path = collection ? `/api/admin/types/${encodeURIComponent(collection)}` : `/api/admin/types`;
+    const res = await fetch(`${engineUrl}${path}`, {
+      headers: {
+        Authorization: `Bearer ${process.env.ZVELTIO_API_KEY || ""}`
+      }
+    });
+    if (!res.ok) {
+      console.error(c11.red(`Failed to fetch types: ${res.status} ${res.statusText}`));
       if (res.status === 401) {
-        console.error(c5.dim("  Set ZVELTIO_API_KEY env var or use an authenticated session."));
+        console.error(c11.dim("  Set ZVELTIO_API_KEY env var or use an authenticated session."));
       } else if (res.status === 404) {
-        console.error(c5.dim("  Ensure the engine is running and the /api/admin/types endpoint is available."));
+        console.error(c11.dim("  Ensure the engine is running and the /api/admin/types endpoint is available."));
       }
       process.exit(1);
     }
     const types = await res.text();
-    const dir = dirname(outputPath);
+    const dir = dirname4(outputPath);
     if (dir && dir !== ".") {
-      mkdirSync2(dir, { recursive: true });
+      mkdirSync5(dir, { recursive: true });
     }
     await Bun.write(outputPath, types);
-    console.log(`${c5.green("Types generated:")} ${outputPath}`);
+    console.log(`${c11.green("Types generated:")} ${outputPath}`);
     if (!collection) {
       const typeCount = (types.match(/^export (interface|type) /gm) || []).length;
       if (typeCount > 0) {
-        console.log(c5.dim(`  ${typeCount} type declaration(s) written`));
+        console.log(c11.dim(`  ${typeCount} type declaration(s) written`));
       }
     }
     console.log("");
-  } catch (err) {
-    console.error(c5.red(`Failed to generate types: ${err.message}`));
+  } catch (err2) {
+    console.error(c11.red(`Failed to generate types: ${err2.message}`));
     process.exit(1);
   }
 }
 
 // src/commands/install.ts
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { readFile as readFile2, mkdir as mkdir2, cp } from "fs/promises";
-import { join as join6 } from "path";
+import { join as join14 } from "path";
 async function installCommand(name, opts) {
   const engineUrl = opts.url || process.env.ENGINE_URL || "http://localhost:3000";
   console.log(`
@@ -2812,13 +4939,13 @@ async function installCommand(name, opts) {
   await installFromCatalog(name, engineUrl);
 }
 async function installFromPath(name, sourcePath, engineUrl, force) {
-  if (!existsSync6(join6(sourcePath, "manifest.json"))) {
+  if (!existsSync14(join14(sourcePath, "manifest.json"))) {
     console.error("\u274C No manifest.json found at", sourcePath);
     process.exit(1);
   }
   let manifest;
   try {
-    manifest = JSON.parse(await readFile2(join6(sourcePath, "manifest.json"), "utf-8"));
+    manifest = JSON.parse(await readFile2(join14(sourcePath, "manifest.json"), "utf-8"));
   } catch {
     console.error("\u274C Failed to read manifest.json");
     process.exit(1);
@@ -2842,8 +4969,8 @@ async function installFromPath(name, sourcePath, engineUrl, force) {
   console.log(`  Name:     ${manifest.displayName || manifest.name}`);
   console.log(`  Version:  ${manifest.version || "?"}`);
   console.log(`  Category: ${category}`);
-  const enginePkgPath = join6(process.cwd(), "packages/engine/package.json");
-  if (existsSync6(enginePkgPath)) {
+  const enginePkgPath = join14(process.cwd(), "packages/engine/package.json");
+  if (existsSync14(enginePkgPath)) {
     const enginePkg = JSON.parse(await readFile2(enginePkgPath, "utf-8"));
     const engineVersion = enginePkg.version || "2.0.0";
     if (manifest.zveltioMinVersion) {
@@ -2854,8 +4981,8 @@ async function installFromPath(name, sourcePath, engineUrl, force) {
     }
   }
   const extName = manifest.name;
-  const targetDir = join6(process.cwd(), "extensions", category, extName);
-  if (existsSync6(targetDir) && !force) {
+  const targetDir = join14(process.cwd(), "extensions", category, extName);
+  if (existsSync14(targetDir) && !force) {
     console.error(`\u274C Extension already exists at ${targetDir}`);
     console.error(`   Use --force to overwrite.`);
     process.exit(1);
@@ -2925,23 +5052,27 @@ Available extensions:`);
   if (entry.is_installed) {
     console.log(`  Already installed. Enabling...`);
   } else {
-    const installRes = await fetch(`${engineUrl}/api/marketplace/${entry.name}/install`, { method: "POST" }).catch(() => null);
+    const installRes = await fetch(`${engineUrl}/api/marketplace/${entry.name}/install`, {
+      method: "POST"
+    }).catch(() => null);
     if (!installRes?.ok) {
-      const err = await installRes?.json().catch(() => ({}));
+      const err2 = await installRes?.json().catch(() => ({}));
       if (installRes?.status === 501) {
         console.log(`  \u2139\uFE0F  Bundled extension \u2014 skipping install step, enabling directly...`);
       } else {
-        console.error(`\u274C Install failed: ${err?.error || `HTTP ${installRes?.status}`}`);
+        console.error(`\u274C Install failed: ${err2?.error || `HTTP ${installRes?.status}`}`);
         process.exit(1);
       }
     } else {
       console.log(`  \u2713 Marked as installed`);
     }
   }
-  const enableRes = await fetch(`${engineUrl}/api/marketplace/${entry.name}/enable`, { method: "POST" }).catch(() => null);
+  const enableRes = await fetch(`${engineUrl}/api/marketplace/${entry.name}/enable`, {
+    method: "POST"
+  }).catch(() => null);
   if (!enableRes?.ok) {
-    const err = await enableRes?.json().catch(() => ({}));
-    console.error(`\u274C Enable failed: ${err?.error || `HTTP ${enableRes?.status}`}`);
+    const err2 = await enableRes?.json().catch(() => ({}));
+    console.error(`\u274C Enable failed: ${err2?.error || `HTTP ${enableRes?.status}`}`);
     process.exit(1);
   }
   const result = await enableRes.json();
@@ -2979,12 +5110,12 @@ async function activateViaApi(name, category, engineUrl) {
 // src/commands/create-god.ts
 import { createInterface as createInterface2 } from "readline";
 async function prompt(rl2, question) {
-  return new Promise((resolve) => {
-    rl2.question(question, resolve);
+  return new Promise((resolve4) => {
+    rl2.question(question, resolve4);
   });
 }
 async function promptHidden(question) {
-  return new Promise((resolve) => {
+  return new Promise((resolve4) => {
     process.stdout.write(question);
     const stdin = process.stdin;
     const wasPaused = stdin.isPaused();
@@ -3003,7 +5134,7 @@ async function promptHidden(question) {
         stdin.off("data", handler);
         process.stdout.write(`
 `);
-        resolve(value);
+        resolve4(value);
       } else if (char === "\x7F") {
         if (value.length > 0)
           value = value.slice(0, -1);
@@ -3091,8 +5222,8 @@ Creating God (super-admin) user at ${engineUrl}
       })
     });
     if (!res.ok) {
-      const err = await res.json().catch(() => ({ message: res.statusText }));
-      throw new Error(err.message || `HTTP ${res.status}`);
+      const err2 = await res.json().catch(() => ({ message: res.statusText }));
+      throw new Error(err2.message || `HTTP ${res.status}`);
     }
     const { user } = await res.json();
     console.log("\uD83D\uDD11 Granting god permissions...");
@@ -3133,10 +5264,10 @@ Creating God (super-admin) user at ${engineUrl}
       console.warn(`   Use the Permissions page in Studio to assign the admin role manually.
 `);
     }
-  } catch (err) {
+  } catch (err2) {
     rl2.close();
     console.error(`
-\u274C Failed to create god user: ${err.message}
+\u274C Failed to create god user: ${err2.message}
 `);
     process.exit(1);
   }
@@ -3242,9 +5373,9 @@ var rollbackCommand = new Command("rollback").description("Rollback database mig
       input: process.stdin,
       output: process.stdout
     });
-    const answer = await new Promise((resolve) => {
+    const answer = await new Promise((resolve4) => {
       rl2.question(`
-\u26A0\uFE0F  This will rollback schema changes. Type "yes" to continue: `, resolve);
+\u26A0\uFE0F  This will rollback schema changes. Type "yes" to continue: `, resolve4);
     });
     rl2.close();
     if (answer.trim().toLowerCase() !== "yes") {
@@ -3270,9 +5401,9 @@ var rollbackCommand = new Command("rollback").description("Rollback database mig
     console.log("   \u26A0\uFE0F  Restart engine after rollback:");
     console.log(`   zveltio stop && zveltio start
 `);
-  } catch (err) {
+  } catch (err2) {
     console.error(`
-\u274C Rollback error: ${err.message}
+\u274C Rollback error: ${err2.message}
 `);
     process.exit(1);
   }
@@ -3324,85 +5455,166 @@ var versionCommand = new Command("version").description("Show version informatio
 });
 
 // src/commands/update.ts
-import { existsSync as existsSync7 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync15 } from "fs";
+import { join as join15 } from "path";
+var c12 = {
+  bold: (s) => `\x1B[1m${s}\x1B[0m`,
+  green: (s) => `\x1B[32m${s}\x1B[0m`,
+  red: (s) => `\x1B[31m${s}\x1B[0m`,
+  yellow: (s) => `\x1B[33m${s}\x1B[0m`,
+  cyan: (s) => `\x1B[36m${s}\x1B[0m`,
+  dim: (s) => `\x1B[2m${s}\x1B[0m`
+};
+var VERSIONS_URL = process.env.ZVELTIO_VERSIONS_URL || "https://get.zveltio.com/versions.json";
 var updateCommand = new Command("update").description("Update Zveltio to the latest version").option("--version <v>", "Target version (default: latest stable)").option("--channel <c>", "Channel: stable | beta", "stable").option("--check", "Check for updates without installing").option("--force", "Skip confirmation").option("--dir <path>", "Installation directory").action(async (opts) => {
   console.log(`
-Zveltio Update
+${c12.bold("Zveltio Update")}
 `);
-  const installDir = opts.dir || process.env.ZVELTIO_DIR || join7(process.cwd(), "zveltio");
-  const metaPath = join7(installDir, ".zveltio-install.json");
+  const installDir = opts.dir || process.env.ZVELTIO_DIR || join15(process.cwd(), "zveltio");
+  const metaPath = join15(installDir, ".zveltio-install.json");
   let meta = null;
-  if (existsSync7(metaPath)) {
-    meta = JSON.parse(await Bun.file(metaPath).text());
+  if (existsSync15(metaPath)) {
+    try {
+      meta = JSON.parse(await Bun.file(metaPath).text());
+    } catch {}
   }
-  const currentVersion = meta?.version || await getCurrentVersionFromAPI(meta?.port ?? 3000) || "0.0.0";
-  console.log(`   Current version: v${currentVersion}`);
-  let versionsData;
+  const currentVersion = meta?.version || await getVersionFromPackageJson() || await getCurrentVersionFromAPI(meta?.port ?? Number(process.env.PORT ?? 3000)) || "0.0.0";
+  const versionSource = meta?.version ? "install meta" : await getVersionFromPackageJson() ? "package.json" : "running engine";
+  console.log(`  Current version: ${c12.cyan(`v${currentVersion}`)} ${c12.dim(`(from ${versionSource})`)}`);
+  let versionsData = null;
   try {
-    const res = await fetch("https://raw.githubusercontent.com/zveltio/zveltio/main/versions.json");
+    const res = await fetch(VERSIONS_URL, {
+      signal: AbortSignal.timeout(8000)
+    });
+    if (!res.ok) {
+      throw new Error(`Registry returned ${res.status}`);
+    }
     versionsData = await res.json();
-  } catch {
-    console.error("Cannot fetch version information. Check your connection.");
+    if (!versionsData?.latest) {
+      throw new Error('Invalid versions response (missing "latest" field)');
+    }
+  } catch (err2) {
+    if (opts.check) {
+      console.log(c12.yellow(`
+  Cannot reach version registry.`));
+      console.log(c12.dim(`  URL tried: ${VERSIONS_URL}`));
+      console.log(c12.dim("  Override with: ZVELTIO_VERSIONS_URL=<url> zveltio update --check"));
+      console.log(c12.dim(`  Error: ${err2.message}
+`));
+      return;
+    }
+    if (opts.version) {
+      console.log(c12.yellow(`
+  Registry unavailable \u2014 proceeding with explicit version: v${opts.version}`));
+      await runUpdateScript(opts.version, installDir, meta, opts.force ?? false);
+      return;
+    }
+    console.error(c12.red(`
+  Cannot reach the version registry.`));
+    console.error(c12.dim(`  URL: ${VERSIONS_URL}`));
+    console.error(c12.dim(`  Error: ${err2.message}`));
+    console.log("");
+    console.log("  Options:");
+    console.log(`    ${c12.cyan("zveltio update --version <x.y.z>")}   ${c12.dim("skip registry, update to specific version")}`);
+    console.log(`    ${c12.cyan("ZVELTIO_VERSIONS_URL=<url> zveltio update")}   ${c12.dim("use a custom registry")}`);
+    console.log("");
     process.exit(1);
   }
   const targetVersion = opts.version || (opts.channel === "beta" ? versionsData.latest_beta ?? versionsData.latest : versionsData.latest);
-  console.log(`   Target version:  v${targetVersion}`);
+  console.log(`  Target version:  ${c12.cyan(`v${targetVersion}`)}`);
   if (opts.check) {
     const hasUpdate = compareVersions(targetVersion, currentVersion) > 0;
     if (hasUpdate) {
       const entry = versionsData.versions.find((v) => v.version === targetVersion);
-      console.log(`
-   Update available!
-`);
+      console.log(c12.green(`
+  Update available: v${currentVersion} \u2192 v${targetVersion}
+`));
       if (entry?.breaking_changes) {
-        console.log(`   Contains BREAKING CHANGES`);
+        console.log(c12.yellow("  \u26A0  Contains BREAKING CHANGES \u2014 read release notes before updating."));
+      }
+      if (entry?.release_notes) {
+        console.log(`  Release notes: ${entry.release_notes}`);
       }
-      console.log(`   Release notes: ${entry?.release_notes ?? ""}`);
       console.log(`
-   Run: zveltio update
+  Run: ${c12.cyan("zveltio update")}
 `);
     } else {
-      console.log(`
-   Already up to date.
-`);
+      console.log(c12.green(`
+  Already up to date.
+`));
     }
     return;
   }
-  if (compareVersions(targetVersion, currentVersion) <= 0) {
-    console.log(`
-   Already up to date.
-`);
+  if (compareVersions(targetVersion, currentVersion) <= 0 && !opts.force) {
+    console.log(c12.green(`
+  Already up to date.
+`));
     return;
   }
   const targetEntry = versionsData.versions.find((v) => v.version === targetVersion);
   if (targetEntry?.breaking_changes && !opts.force) {
-    console.log(`
-   This update contains BREAKING CHANGES.`);
-    console.log(`   Review: ${targetEntry.release_notes}`);
+    console.log(c12.yellow(`
+  This update contains BREAKING CHANGES.`));
+    if (targetEntry.release_notes) {
+      console.log(`  Review: ${targetEntry.release_notes}`);
+    }
     console.log("");
-    process.stdout.write("   Continue? (yes/no): ");
+    process.stdout.write("  Continue? (yes/no): ");
     const confirm = await readLine();
     if (confirm !== "yes") {
-      console.log(`
-   Update cancelled.
-`);
+      console.log(c12.dim(`
+  Update cancelled.
+`));
       return;
     }
   }
   console.log(`
-   Upgrading v${currentVersion} -> v${targetVersion}...
+  Upgrading ${c12.cyan(`v${currentVersion}`)} \u2192 ${c12.cyan(`v${targetVersion}`)}...
 `);
-  const envPath = join7(installDir, ".env");
-  if (existsSync7(envPath)) {
+  await runUpdateScript(targetVersion, installDir, meta, opts.force ?? false);
+  console.log(c12.green(`
+  Updated to Zveltio v${targetVersion}
+`));
+});
+async function getVersionFromPackageJson() {
+  const candidates = [
+    join15(process.cwd(), "packages/engine/package.json"),
+    join15(process.cwd(), "package.json")
+  ];
+  for (const pkgPath of candidates) {
+    if (!existsSync15(pkgPath))
+      continue;
+    try {
+      const pkg = JSON.parse(await Bun.file(pkgPath).text());
+      if (pkg.name === "@zveltio/engine" || pkg._zveltio_version) {
+        return pkg.version ?? null;
+      }
+    } catch {}
+  }
+  return null;
+}
+async function getCurrentVersionFromAPI(port) {
+  try {
+    const res = await fetch(`http://localhost:${port}/api/health`, {
+      signal: AbortSignal.timeout(3000)
+    });
+    const data = await res.json();
+    return data.engine ?? data.version ?? data.engine_version ?? null;
+  } catch {
+    return null;
+  }
+}
+async function runUpdateScript(targetVersion, installDir, meta, force) {
+  const envPath = join15(installDir, ".env");
+  if (existsSync15(envPath)) {
     const backupPath = `${envPath}.backup.${Date.now()}`;
     const envContent = await Bun.file(envPath).text();
     await Bun.write(backupPath, envContent);
-    console.log(`   Backed up .env to ${backupPath}`);
+    console.log(`  Backed up .env \u2192 ${backupPath}`);
   }
-  const installScript = join7(installDir, "install.sh");
-  if (existsSync7(installScript)) {
-    const proc = Bun.spawn([
+  const installScript = join15(installDir, "install.sh");
+  if (existsSync15(installScript)) {
+    const args = [
       "bash",
       installScript,
       "--version",
@@ -3412,40 +5624,53 @@ Zveltio Update
       installDir,
       "--mode",
       meta?.mode ?? "auto"
-    ], { stdout: "inherit", stderr: "inherit", stdin: "inherit" });
+    ];
+    if (force)
+      args.push("--force");
+    const proc = Bun.spawn(args, { stdout: "inherit", stderr: "inherit", stdin: "inherit" });
     const code = await proc.exited;
     if (code !== 0) {
       console.error(`
-Update failed. Your previous version is still running.`);
-      console.log(`   Restore .env: copy ${envPath}.backup.* to ${envPath}`);
+  Update failed. Your previous version is still running.`);
+      if (existsSync15(envPath)) {
+        console.log(`  Restore .env: copy ${envPath}.backup.* to ${envPath}`);
+      }
       process.exit(1);
     }
   } else {
-    console.log("   Downloading installer...");
-    const dlProc = Bun.spawn([
+    console.log("  No local install.sh found \u2014 downloading installer from registry...");
+    const installUrl = process.env.ZVELTIO_INSTALL_URL || "https://get.zveltio.com/install.sh";
+    if (!/^\d+\.\d+\.\d+(-[\w.]+)?$/.test(targetVersion)) {
+      console.error(c12.red(`
+  Invalid version format: ${targetVersion}`));
+      process.exit(1);
+    }
+    const dlProc = Bun.spawn(["curl", "-fsSL", installUrl, "-o", "/tmp/zveltio-update.sh"], {
+      stdout: "inherit",
+      stderr: "inherit"
+    });
+    if (await dlProc.exited !== 0) {
+      console.error(`
+  Failed to download installer.`);
+      console.error(`  Installer URL: ${installUrl}`);
+      process.exit(1);
+    }
+    const installProc = Bun.spawn([
       "bash",
-      "-c",
-      `curl -fsSL https://get.zveltio.com/install.sh -o /tmp/zveltio-update.sh && ` + `bash /tmp/zveltio-update.sh ` + `--version ${targetVersion} --unattended --dir ${installDir}`
+      "/tmp/zveltio-update.sh",
+      "--version",
+      targetVersion,
+      "--unattended",
+      "--dir",
+      installDir
     ], { stdout: "inherit", stderr: "inherit", stdin: "inherit" });
-    const code = await dlProc.exited;
+    const code = await installProc.exited;
     if (code !== 0) {
       console.error(`
-Update download/install failed.`);
+  Update install failed.`);
       process.exit(1);
     }
   }
-  console.log(`
-Updated to Zveltio v${targetVersion}
-`);
-});
-async function getCurrentVersionFromAPI(port) {
-  try {
-    const res = await fetch(`http://localhost:${port}/api/health/version`);
-    const data = await res.json();
-    return data.engine ?? null;
-  } catch {
-    return null;
-  }
 }
 function compareVersions(a, b) {
   const pa = a.split(".").map(Number);
@@ -3459,13 +5684,13 @@ function compareVersions(a, b) {
   return 0;
 }
 async function readLine() {
-  return new Promise((resolve) => {
-    process.stdin.once("data", (data) => resolve(data.toString().trim()));
+  return new Promise((resolve4) => {
+    process.stdin.once("data", (data) => resolve4(data.toString().trim()));
   });
 }
 
 // src/commands/status.ts
-var c6 = {
+var c13 = {
   bold: (s) => `\x1B[1m${s}\x1B[0m`,
   green: (s) => `\x1B[32m${s}\x1B[0m`,
   red: (s) => `\x1B[31m${s}\x1B[0m`,
@@ -3475,10 +5700,10 @@ var c6 = {
 };
 function statusIcon(ok) {
   if (ok === true || ok === "ok" || ok === "healthy" || ok === "connected")
-    return c6.green("OK");
+    return c13.green("OK");
   if (ok === false || ok === "error" || ok === "unhealthy")
-    return c6.red("FAIL");
-  return c6.yellow("UNKNOWN");
+    return c13.red("FAIL");
+  return c13.yellow("UNKNOWN");
 }
 function formatUptime(seconds) {
   if (seconds < 60)
@@ -3493,9 +5718,9 @@ async function statusCommand(opts) {
   const engineUrl = opts.url || process.env.ZVELTIO_URL || process.env.ENGINE_URL || "http://localhost:3000";
   if (!opts.json) {
     console.log(`
-${c6.bold("Zveltio Status")}
+${c13.bold("Zveltio Status")}
 `);
-    console.log(`  Engine: ${c6.dim(engineUrl)}`);
+    console.log(`  Engine: ${c13.dim(engineUrl)}`);
     console.log("");
   }
   let healthData;
@@ -3507,23 +5732,23 @@ ${c6.bold("Zveltio Status")}
       if (opts.json) {
         console.log(JSON.stringify({ status: "error", code: res.status, message: res.statusText }));
       } else {
-        console.error(c6.red(`Engine returned ${res.status} ${res.statusText}`));
-        console.error(c6.dim("  Is the engine running? Try: zveltio dev"));
+        console.error(c13.red(`Engine returned ${res.status} ${res.statusText}`));
+        console.error(c13.dim("  Is the engine running? Try: zveltio dev"));
       }
       process.exit(1);
     }
     healthData = await res.json();
-  } catch (err) {
+  } catch (err2) {
     if (opts.json) {
-      console.log(JSON.stringify({ status: "error", message: err.message }));
+      console.log(JSON.stringify({ status: "error", message: err2.message }));
     } else {
-      if (err.name === "TimeoutError") {
-        console.error(c6.red("Connection timed out after 8s"));
+      if (err2.name === "TimeoutError") {
+        console.error(c13.red("Connection timed out after 8s"));
       } else {
-        console.error(c6.red(`Cannot reach engine at ${engineUrl}`));
-        console.error(c6.dim(`  ${err.message}`));
+        console.error(c13.red(`Cannot reach engine at ${engineUrl}`));
+        console.error(c13.dim(`  ${err2.message}`));
       }
-      console.error(c6.dim("  Is the engine running? Try: zveltio dev"));
+      console.error(c13.dim("  Is the engine running? Try: zveltio dev"));
     }
     process.exit(1);
   }
@@ -3534,9 +5759,9 @@ ${c6.bold("Zveltio Status")}
   const db = healthData.database ?? healthData.db;
   const cache = healthData.cache ?? healthData.redis ?? healthData.valkey;
   const uptime = healthData.uptime_seconds ?? healthData.uptime;
-  const version = healthData.version ?? healthData.engine_version ?? healthData.engine;
   const status = healthData.status ?? "ok";
-  const overallIcon = status === "ok" || status === "healthy" ? c6.green("HEALTHY") : c6.red("DEGRADED");
+  const version = healthData.version ?? healthData.engine_version ?? healthData.engine ?? await getLocalVersion();
+  const overallIcon = status === "ok" || status === "healthy" ? c13.green("HEALTHY") : c13.red("DEGRADED");
   console.log(`  Status:   ${overallIcon}`);
   if (version) {
     console.log(`  Version:  ${version}`);
@@ -3548,13 +5773,13 @@ ${c6.bold("Zveltio Status")}
   if (db !== undefined) {
     const dbStatus = typeof db === "object" ? db.status ?? db.ok : db;
     const dbLatency = typeof db === "object" ? db.latency_ms : undefined;
-    const dbLabel = dbLatency !== undefined ? `${statusIcon(dbStatus)} ${c6.dim(`(${dbLatency}ms)`)}` : statusIcon(dbStatus);
+    const dbLabel = dbLatency !== undefined ? `${statusIcon(dbStatus)} ${c13.dim(`(${dbLatency}ms)`)}` : statusIcon(dbStatus);
     console.log(`  Database: ${dbLabel}`);
   }
   if (cache !== undefined) {
     const cacheStatus = typeof cache === "object" ? cache.status ?? cache.ok : cache;
     const cacheLatency = typeof cache === "object" ? cache.latency_ms : undefined;
-    const cacheLabel = cacheLatency !== undefined ? `${statusIcon(cacheStatus)} ${c6.dim(`(${cacheLatency}ms)`)}` : statusIcon(cacheStatus);
+    const cacheLabel = cacheLatency !== undefined ? `${statusIcon(cacheStatus)} ${c13.dim(`(${cacheLatency}ms)`)}` : statusIcon(cacheStatus);
     console.log(`  Cache:    ${cacheLabel}`);
   }
   if (healthData.storage !== undefined) {
@@ -3571,6 +5796,24 @@ ${c6.bold("Zveltio Status")}
   }
   console.log("");
 }
+async function getLocalVersion() {
+  const { existsSync: existsSync16 } = await import("fs");
+  const { join: join16 } = await import("path");
+  const candidates = [
+    join16(process.cwd(), "packages/engine/package.json"),
+    join16(process.cwd(), "package.json")
+  ];
+  for (const p of candidates) {
+    if (!existsSync16(p))
+      continue;
+    try {
+      const pkg = JSON.parse(await Bun.file(p).text());
+      if (pkg.name === "@zveltio/engine" || pkg._zveltio_version)
+        return pkg.version;
+    } catch {}
+  }
+  return;
+}
 
 // src/index.ts
 var program2 = new Command;
@@ -3614,6 +5857,67 @@ extensions.command("disable <name>").description("Disable an active extension").
 var ext = program2.command("extension").description('Manage Zveltio extensions (use "extensions" for new commands)');
 ext.command("create <name>").description("Scaffold a new extension").option("--category <category>", "Extension category", "custom").action((name, opts) => extensionCommand("create", name, opts));
 ext.command("build").description("Build the current extension (.zvext bundle)").action(() => extensionCommand("build", "", {}));
-ext.command("dev").description("Start extension dev server with hot reload").action(() => extensionCommand("dev", "", {}));
-ext.command("publish").description("Publish extension to the Zveltio marketplace").option("--token <token>", "Marketplace auth token").action((_opts) => extensionCommand("publish", "", _opts));
-program2.parse(process.argv);
+ext.command("dev").description("Watch engine/ + studio/, hot-reload the running engine on changes (S4-03)").option("--dir <dir>", "Extension root directory (defaults to cwd)").option("--url <url>", "Engine URL (env: ZVELTIO_ENGINE_URL)", "http://localhost:3000").option("--name <name>", "Extension name (default: read from manifest.json)").option("--no-studio", "Skip the Studio dev process (engine watch only)").action((opts) => extensionDevCommand(opts));
+ext.command("pack").description("Bundle engine/index.ts \u2192 engine/index.js (target=bun, ESM) and write engine + integrity blocks into manifest.json. Required before publish on v2 channels.").option("--dir <dir>", "Extension root directory (defaults to cwd)").option("--sourcemap", "Emit engine/index.js.map alongside the bundle").option("--no-manifest-update", "Build the bundle but do not patch manifest.json").option("--first-party", "Vendor / monorepo build \u2014 keep inline isolation, skip worker auto-inject").option("--token <token>", "Registry token for the publisher-tier lookup (env: ZVELTIO_REGISTRY_TOKEN)").option("--registry-url <url>", "Registry base URL (env: ZVELTIO_REGISTRY_URL)").action(async (opts) => {
+  const { extensionPackCommand: extensionPackCommand2 } = await Promise.resolve().then(() => (init_extension_pack(), exports_extension_pack));
+  return extensionPackCommand2(opts);
+});
+ext.command("publish").description("Validate, build, archive, sign, and upload an extension to the registry (S4-05)").option("--dir <dir>", "Extension root directory (defaults to cwd)").option("--token <token>", "Registry auth token (env: ZVELTIO_REGISTRY_TOKEN)").option("--registry-url <url>", "Registry base URL (env: ZVELTIO_REGISTRY_URL)").option("--key-id <id>", "Signing key id (default: the only key in ~/.zveltio/keys/)").option("--output <dir>", "Local-only mode: write .zvext + .sig here, skip upload").option("--no-build", "Skip both engine pack and Studio build").option("--no-pack", "Skip engine pack (use existing engine/index.js if present)").option("--no-validate", "Skip the validate step (NOT recommended)").option("--dry-run", "Run validate + pack + build, skip archive/sign/upload").option("--first-party", "Vendor / monorepo build \u2014 allow inline isolation (skip \xA72 worker requirement)").action((opts) => extensionPublishCommand(opts));
+ext.command("status <name>").description("Show marketplace submission status (pending / published / rejected / taken_down)").option("--registry-url <url>", "Registry base URL (env: ZVELTIO_REGISTRY_URL)").action(async (name, opts) => {
+  const { extensionStatusCommand: extensionStatusCommand2 } = await Promise.resolve().then(() => (init_extension_status(), exports_extension_status));
+  await extensionStatusCommand2(name, opts);
+});
+ext.command("types").description("Generate a .d.ts from the extension's SQL migrations (S4-01). Writes <extension>/.zveltio/db.d.ts.").option("--dir <dir>", "Extension root directory (defaults to cwd)").option("--output <path>", "Output file path (default: <dir>/.zveltio/db.d.ts)").action((opts) => extensionTypesCommand(opts));
+ext.command("validate").description("Pre-publish checks: manifest schema, peerDeps allow-list, migrations parse, destructive DDL has DOWN, bundle quota (S4-04)").option("--dir <dir>", "Extension root directory (defaults to cwd)").option("--first-party", "Vendor / monorepo build \u2014 allow inline isolation (skip \xA72 worker requirement)").option("--token <token>", "Registry token for the publisher-tier lookup (env: ZVELTIO_REGISTRY_TOKEN)").option("--registry-url <url>", "Registry base URL (env: ZVELTIO_REGISTRY_URL)").action((opts) => extensionValidateCommand(opts));
+var keys = program2.command("keys").description("Manage Ed25519 keypairs for signing extensions");
+keys.command("generate").description("Generate a new keypair and store it in ~/.zveltio/keys/").option("--id <id>", "Stable identifier for the key (random if omitted)").option("--force", "Overwrite an existing key with the same id").action((opts) => keysGenerateCommand(opts));
+keys.command("list").description("List keypairs stored in ~/.zveltio/keys/").action(() => keysListCommand());
+keys.command("export <keyId>").description("Print the public key as a trusted-key JSON entry for REGISTRY_PUBLIC_KEYS_JSON").action((keyId) => keysExportCommand(keyId));
+var admin = program2.command("admin").description("Registry admin commands (operator-only)");
+var adminMarketplace = admin.command("marketplace").description("Review-queue management for community extension submissions");
+adminMarketplace.command("pending").description("List extension submissions awaiting review").option("--registry-url <url>", "Registry base URL (env: ZVELTIO_REGISTRY_URL)").option("--cookie <cookie>", "Admin session cookie (env: ZVELTIO_ADMIN_COOKIE)").action(async (opts) => {
+  const { adminMarketplacePending: adminMarketplacePending2 } = await Promise.resolve().then(() => (init_admin_marketplace(), exports_admin_marketplace));
+  await adminMarketplacePending2(opts);
+});
+adminMarketplace.command("approve <nameOrId>").description("Approve a pending submission (status \u2192 published)").option("--registry-url <url>", "Registry base URL").option("--cookie <cookie>", "Admin session cookie").option("--note <note>", "Optional internal note for the audit trail").action(async (nameOrId, opts) => {
+  const { adminMarketplaceApprove: adminMarketplaceApprove2 } = await Promise.resolve().then(() => (init_admin_marketplace(), exports_admin_marketplace));
+  await adminMarketplaceApprove2(nameOrId, opts);
+});
+adminMarketplace.command("reject <nameOrId>").description("Reject a pending submission with a reason (visible to publisher)").option("--registry-url <url>", "Registry base URL").option("--cookie <cookie>", "Admin session cookie").requiredOption("--reason <reason>", "Rejection reason").action(async (nameOrId, opts) => {
+  const { adminMarketplaceReject: adminMarketplaceReject2 } = await Promise.resolve().then(() => (init_admin_marketplace(), exports_admin_marketplace));
+  await adminMarketplaceReject2(nameOrId, opts);
+});
+adminMarketplace.command("takedown <extensionId>").description("Pull a previously approved extension (status \u2192 taken_down)").option("--registry-url <url>", "Registry base URL").option("--cookie <cookie>", "Admin session cookie").requiredOption("--reason <reason>", "Takedown reason").action(async (id, opts) => {
+  const { adminMarketplaceTakedown: adminMarketplaceTakedown2 } = await Promise.resolve().then(() => (init_admin_marketplace(), exports_admin_marketplace));
+  await adminMarketplaceTakedown2(id, opts);
+});
+adminMarketplace.command("publishers").description("List enrolled allowed publishers").option("--registry-url <url>", "Registry base URL").option("--cookie <cookie>", "Admin session cookie").action(async (opts) => {
+  const { adminMarketplacePublishers: adminMarketplacePublishers2 } = await Promise.resolve().then(() => (init_admin_marketplace(), exports_admin_marketplace));
+  await adminMarketplacePublishers2(opts);
+});
+var adminTeam = admin.command("team").description("Marketplace admin roster (review-queue access). Owner-only writes.");
+adminTeam.command("list").description("List current admin team members + roles").option("--registry-url <url>", "Registry base URL").option("--cookie <cookie>", "Admin session cookie").action(async (opts) => {
+  const { adminTeamList: adminTeamList2 } = await Promise.resolve().then(() => (init_admin_marketplace(), exports_admin_marketplace));
+  await adminTeamList2(opts);
+});
+adminTeam.command("add <email>").description("Add a user to the admin team (they must have an apps account first)").option("--registry-url <url>", "Registry base URL").option("--cookie <cookie>", "Admin session cookie").option("--role <role>", "Role: 'owner' | 'admin'", "admin").option("--notes <notes>", "Internal notes").action(async (email, opts) => {
+  const { adminTeamAdd: adminTeamAdd2 } = await Promise.resolve().then(() => (init_admin_marketplace(), exports_admin_marketplace));
+  await adminTeamAdd2(email, opts);
+});
+adminTeam.command("set-role <email> <role>").description("Change a team member's role (owner|admin). Refuses to demote the last owner.").option("--registry-url <url>", "Registry base URL").option("--cookie <cookie>", "Admin session cookie").action(async (email, role, opts) => {
+  if (role !== "owner" && role !== "admin") {
+    console.error(`Invalid role "${role}" \u2014 must be 'owner' or 'admin'`);
+    process.exit(1);
+  }
+  const { adminTeamSetRole: adminTeamSetRole2 } = await Promise.resolve().then(() => (init_admin_marketplace(), exports_admin_marketplace));
+  await adminTeamSetRole2(email, role, opts);
+});
+adminTeam.command("remove <email>").description("Remove a user from the admin team").option("--registry-url <url>", "Registry base URL").option("--cookie <cookie>", "Admin session cookie").action(async (email, opts) => {
+  const { adminTeamRemove: adminTeamRemove2 } = await Promise.resolve().then(() => (init_admin_marketplace(), exports_admin_marketplace));
+  await adminTeamRemove2(email, opts);
+});
+adminMarketplace.command("enroll-publisher").description("Add a new publisher to the allowlist (key-based submissions)").option("--registry-url <url>", "Registry base URL").option("--cookie <cookie>", "Admin session cookie").requiredOption("--name <name>", "Publisher display name").requiredOption("--email <email>", "Publisher contact email").requiredOption("--key-id <keyId>", "Ed25519 key id (used at signature time)").requiredOption("--key-file <path>", "Path to JSON file containing the public JWK").option("--tier <tier>", "Trust tier: first-party | verified | community", "community").option("--notes <notes>", "Internal notes").action(async (opts) => {
+  const { adminMarketplaceEnrollPublisher: adminMarketplaceEnrollPublisher2 } = await Promise.resolve().then(() => (init_admin_marketplace(), exports_admin_marketplace));
+  await adminMarketplaceEnrollPublisher2(opts);
+});
+await program2.parseAsync(process.argv);