spfn 0.2.0-beta.52 → 0.2.0-beta.56

package/dist/index.js

@@ -69,12 +69,24 @@ function detectPackageManager(cwd) {
   }
   return "npm";
 }
+function getRunCommand(pm) {
+  return pm === "npm" ? "npm run" : `${pm} run`;
+}
 var init_package_manager = __esm({
   "src/utils/package-manager.ts"() {
     "use strict";
   }
 });
 
+// src/utils/messages.ts
+var ENV_FILES_HINT;
+var init_messages = __esm({
+  "src/utils/messages.ts"() {
+    "use strict";
+    ENV_FILES_HINT = "server secrets belong in .env.server \u2014 Next.js never loads it";
+  }
+});
+
 // src/commands/setup.ts
 var setup_exports = {};
 __export(setup_exports, {
@@ -572,10 +584,78 @@ var init_api_proxy = __esm({
   }
 });
 
-// src/commands/init/steps/docker.ts
+// src/commands/init/steps/next-config.ts
 import { existsSync as existsSync7, readFileSync as readFileSync2 } from "fs";
 import { join as join7 } from "path";
+import chalk3 from "chalk";
 import fse4 from "fs-extra";
+function printManualInstructions() {
+  logger.warn("Could not update next.config automatically.");
+  logger.info("@spfn/auth OAuth requires this rewrite in your next.config:\n");
+  console.log(chalk3.gray(AUTH_REWRITES_BLOCK + "\n"));
+}
+async function setupNextConfig(cwd, includeAuth) {
+  if (!includeAuth) {
+    return;
+  }
+  const configPath = ["next.config.ts", "next.config.js", "next.config.mjs"].map((name) => join7(cwd, name)).find(existsSync7);
+  if (!configPath) {
+    writeFileSync3(join7(cwd, "next.config.ts"), NEW_CONFIG_TEMPLATE);
+    logger.step("Created next.config.ts with the /_auth/* \u2192 SPFN API rewrite");
+    return;
+  }
+  const content = readFileSync2(configPath, "utf-8");
+  if (content.includes("/_auth/:path*")) {
+    logger.warn("next.config already forwards /_auth/*, skipping");
+    return;
+  }
+  if (content.includes("rewrites")) {
+    printManualInstructions();
+    return;
+  }
+  const patched = content.replace(
+    /(const\s+nextConfig[^=]*=\s*\{)(\s*\})?/,
+    (_match, opening, closing) => `${opening}
+${AUTH_REWRITES_BLOCK}${closing ? "\n}" : ""}`
+  );
+  if (patched === content) {
+    printManualInstructions();
+    return;
+  }
+  writeFileSync3(configPath, patched);
+  logger.step(`Added the /_auth/* \u2192 SPFN API rewrite to ${configPath.split("/").pop()}`);
+}
+var writeFileSync3, AUTH_REWRITES_BLOCK, NEW_CONFIG_TEMPLATE;
+var init_next_config = __esm({
+  "src/commands/init/steps/next-config.ts"() {
+    "use strict";
+    init_logger();
+    ({ writeFileSync: writeFileSync3 } = fse4);
+    AUTH_REWRITES_BLOCK = `  async rewrites() {
+    // @spfn/auth: OAuth provider callbacks must return to this app's origin \u2014
+    // the oauth_csrf cookie is set here. Forward /_auth/* to the SPFN API.
+    return [
+      {
+        source: '/_auth/:path*',
+        destination: \`\${process.env.SPFN_API_URL || 'http://localhost:8790'}/_auth/:path*\`,
+      },
+    ];
+  },`;
+    NEW_CONFIG_TEMPLATE = `import type { NextConfig } from "next";
+
+const nextConfig: NextConfig = {
+${AUTH_REWRITES_BLOCK}
+};
+
+export default nextConfig;
+`;
+  }
+});
+
+// src/commands/init/steps/docker.ts
+import { existsSync as existsSync8, readFileSync as readFileSync3 } from "fs";
+import { join as join8 } from "path";
+import fse5 from "fs-extra";
 function adaptDockerfileForPm(content, pm) {
   const adaptations = PM_DOCKERFILE_ADAPTATIONS[pm];
   if (!adaptations) {
@@ -585,11 +665,11 @@ function adaptDockerfileForPm(content, pm) {
 }
 async function setupDockerFiles(cwd, pm = "pnpm") {
   const templatesDir = findTemplatesPath();
-  const dockerComposePath = join7(cwd, "docker-compose.yml");
-  if (!existsSync7(dockerComposePath)) {
+  const dockerComposePath = join8(cwd, "docker-compose.yml");
+  if (!existsSync8(dockerComposePath)) {
     try {
-      const dockerComposeTemplate = join7(templatesDir, "docker-compose.yml");
-      if (existsSync7(dockerComposeTemplate)) {
+      const dockerComposeTemplate = join8(templatesDir, "docker-compose.yml");
+      if (existsSync8(dockerComposeTemplate)) {
         copySync2(dockerComposeTemplate, dockerComposePath);
         logger.success("Created docker-compose.yml (PostgreSQL + Redis)");
       }
@@ -598,27 +678,27 @@ async function setupDockerFiles(cwd, pm = "pnpm") {
     }
   }
   try {
-    const dockerfilePath = join7(cwd, "Dockerfile");
-    if (!existsSync7(dockerfilePath)) {
-      const dockerfileTemplate = join7(templatesDir, "Dockerfile");
-      if (existsSync7(dockerfileTemplate)) {
-        const content = adaptDockerfileForPm(readFileSync2(dockerfileTemplate, "utf-8"), pm);
-        writeFileSync3(dockerfilePath, content);
+    const dockerfilePath = join8(cwd, "Dockerfile");
+    if (!existsSync8(dockerfilePath)) {
+      const dockerfileTemplate = join8(templatesDir, "Dockerfile");
+      if (existsSync8(dockerfileTemplate)) {
+        const content = adaptDockerfileForPm(readFileSync3(dockerfileTemplate, "utf-8"), pm);
+        writeFileSync4(dockerfilePath, content);
         logger.success(`Created Dockerfile (${pm})`);
       }
     }
-    const dockerignorePath = join7(cwd, ".dockerignore");
-    if (!existsSync7(dockerignorePath)) {
-      const dockerignoreTemplate = join7(templatesDir, ".dockerignore");
-      if (existsSync7(dockerignoreTemplate)) {
+    const dockerignorePath = join8(cwd, ".dockerignore");
+    if (!existsSync8(dockerignorePath)) {
+      const dockerignoreTemplate = join8(templatesDir, ".dockerignore");
+      if (existsSync8(dockerignoreTemplate)) {
         copySync2(dockerignoreTemplate, dockerignorePath);
         logger.success("Created .dockerignore");
       }
     }
-    const dockerComposeProdPath = join7(cwd, "docker-compose.production.yml");
-    if (!existsSync7(dockerComposeProdPath)) {
-      const dockerComposeProdTemplate = join7(templatesDir, "docker-compose.production.yml");
-      if (existsSync7(dockerComposeProdTemplate)) {
+    const dockerComposeProdPath = join8(cwd, "docker-compose.production.yml");
+    if (!existsSync8(dockerComposeProdPath)) {
+      const dockerComposeProdTemplate = join8(templatesDir, "docker-compose.production.yml");
+      if (existsSync8(dockerComposeProdTemplate)) {
         copySync2(dockerComposeProdTemplate, dockerComposeProdPath);
         logger.success("Created docker-compose.production.yml");
       }
@@ -627,13 +707,13 @@ async function setupDockerFiles(cwd, pm = "pnpm") {
     logger.warn("Could not copy Docker files (you can create them manually)");
   }
 }
-var copySync2, writeFileSync3, PM_DOCKERFILE_ADAPTATIONS;
+var copySync2, writeFileSync4, PM_DOCKERFILE_ADAPTATIONS;
 var init_docker = __esm({
   "src/commands/init/steps/docker.ts"() {
     "use strict";
     init_logger();
     init_templates();
-    ({ copySync: copySync2, writeFileSync: writeFileSync3 } = fse4);
+    ({ copySync: copySync2, writeFileSync: writeFileSync4 } = fse5);
     PM_DOCKERFILE_ADAPTATIONS = {
       npm: [
         ["# Install pnpm\nRUN corepack enable pnpm\n\n", ""],
@@ -664,12 +744,12 @@ var init_docker = __esm({
 });
 
 // src/commands/init/steps/deployment-config.ts
-import { existsSync as existsSync8 } from "fs";
-import { join as join8 } from "path";
-import fse5 from "fs-extra";
+import { existsSync as existsSync9 } from "fs";
+import { join as join9 } from "path";
+import fse6 from "fs-extra";
 async function setupDeploymentConfig(cwd, packageJson, packageManager) {
-  const deploymentConfigPath = join8(cwd, "spfn.config.js");
-  if (!existsSync8(deploymentConfigPath)) {
+  const deploymentConfigPath = join9(cwd, "spfn.config.js");
+  if (!existsSync9(deploymentConfigPath)) {
     try {
       const projectName = packageJson.name?.replace(/[@\/]/g, "-").toLowerCase() || cwd.split("/").pop()?.toLowerCase() || "my-app";
       const configContent = `/**
@@ -771,25 +851,25 @@ export default {
   }
 }
 `;
-      writeFileSync4(deploymentConfigPath, configContent);
+      writeFileSync5(deploymentConfigPath, configContent);
       logger.success(`Created spfn.config.js (subdomain: ${projectName}.spfn.app)`);
     } catch (error) {
       logger.warn("Could not create spfn.config.js");
     }
   }
 }
-var writeFileSync4;
+var writeFileSync5;
 var init_deployment_config = __esm({
   "src/commands/init/steps/deployment-config.ts"() {
     "use strict";
     init_logger();
-    ({ writeFileSync: writeFileSync4 } = fse5);
+    ({ writeFileSync: writeFileSync5 } = fse6);
   }
 });
 
 // src/utils/version.ts
 function getCliVersion() {
-  return "0.2.0-beta.52";
+  return "0.2.0-beta.56";
 }
 function getTagFromVersion(version) {
   const match = version.match(/-([a-z]+)\./i);
@@ -807,7 +887,7 @@ var init_version = __esm({
 // src/commands/init/steps/package.ts
 import ora3 from "ora";
 import { execa as execa2 } from "execa";
-import fse6 from "fs-extra";
+import fse7 from "fs-extra";
 async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManager, includeAuth) {
   const spinner = ora3("Updating package.json...").start();
   packageJson.dependencies = packageJson.dependencies || {};
@@ -842,7 +922,7 @@ async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManage
   packageJson.scripts["spfn:start"] = "spfn start";
   packageJson.scripts["spfn:build"] = "spfn build";
   packageJson.scripts["codegen"] = "spfn codegen run";
-  writeFileSync5(packageJsonPath, JSON.stringify(packageJson, null, 2));
+  writeFileSync6(packageJsonPath, JSON.stringify(packageJson, null, 2));
   spinner.succeed("package.json updated");
   spinner.start("Installing dependencies...");
   try {
@@ -855,24 +935,122 @@ async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManage
     process.exit(1);
   }
 }
-var writeFileSync5;
+var writeFileSync6;
 var init_package = __esm({
   "src/commands/init/steps/package.ts"() {
     "use strict";
     init_logger();
     init_version();
-    ({ writeFileSync: writeFileSync5 } = fse6);
+    ({ writeFileSync: writeFileSync6 } = fse7);
+  }
+});
+
+// src/utils/env-file.ts
+import { existsSync as existsSync10, readFileSync as readFileSync4, writeFileSync as writeFileSync7, chmodSync } from "fs";
+import { join as join10 } from "path";
+import { parse } from "dotenv";
+function restrictEnvFilePerms(filePath) {
+  try {
+    chmodSync(filePath, 384);
+  } catch {
+  }
+}
+function envKeyOf(line) {
+  const match = line.match(/^\s*(?:export\s+)?([A-Z_][A-Z0-9_]*)\s*=/);
+  return match ? match[1] : null;
+}
+function collectDeclaredKeys(content) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const line of content.split("\n")) {
+    const key = envKeyOf(line.replace(/^\s*#\s*/, ""));
+    if (key !== null) {
+      keys.add(key);
+    }
+  }
+  return keys;
+}
+function parseEnvFile(filePath) {
+  if (!existsSync10(filePath)) {
+    return {};
+  }
+  return parse(readFileSync4(filePath, "utf-8"));
+}
+function upsertEnvVar(filePath, key, value) {
+  const existing = existsSync10(filePath) ? readFileSync4(filePath, "utf-8") : "";
+  const line = `${key}=${value}`;
+  let replaced = false;
+  const next = existing.split("\n").map((current) => {
+    if (!replaced && envKeyOf(current) === key) {
+      replaced = true;
+      return line;
+    }
+    return current;
+  });
+  if (replaced) {
+    writeFileSync7(filePath, next.join("\n"));
+    return "updated";
+  }
+  const base = existing.length > 0 && !existing.endsWith("\n") ? existing + "\n" : existing;
+  writeFileSync7(filePath, base + line + "\n");
+  return "added";
+}
+function gitignoreCovers(lines, target) {
+  const normalized = stripSlashes(target);
+  let covered = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#")) {
+      continue;
+    }
+    const negation = line.startsWith("!");
+    const rule = stripSlashes(negation ? line.slice(1) : line);
+    if (rule === normalized || rule.endsWith("*") && normalized.startsWith(rule.slice(0, -1))) {
+      covered = !negation;
+    }
+  }
+  return covered;
+}
+function stripSlashes(value) {
+  return value.replace(/^\//, "").replace(/\/$/, "");
+}
+function ensureGitignored(cwd, entries) {
+  const gitignorePath = join10(cwd, ".gitignore");
+  const content = existsSync10(gitignorePath) ? readFileSync4(gitignorePath, "utf-8") : "";
+  const lines = content.split("\n");
+  const added = [];
+  let appended = "";
+  for (const { pattern, comment } of entries) {
+    if (!gitignoreCovers(lines, pattern)) {
+      appended += `
+# ${comment}
+${pattern}
+`;
+      added.push(pattern);
+    }
+  }
+  if (appended.length > 0) {
+    writeFileSync7(gitignorePath, content + appended);
+  }
+  return added;
+}
+var init_env_file = __esm({
+  "src/utils/env-file.ts"() {
+    "use strict";
   }
 });
 
 // src/commands/init/steps/config-files.ts
-import { existsSync as existsSync9, readFileSync as readFileSync3 } from "fs";
-import { join as join9 } from "path";
-import fse7 from "fs-extra";
+import { existsSync as existsSync11, readFileSync as readFileSync5 } from "fs";
+import { join as join11 } from "path";
+import fse8 from "fs-extra";
+function withPlaceholderCreds(text) {
+  return text.replace(/(postgresql:\/\/)[^@\s/]+@/g, "$1user:password@");
+}
 async function setupConfigFiles(cwd) {
-  generateEnvExamples(cwd);
-  const spfnrcPath = join9(cwd, ".spfnrc.ts");
-  if (!existsSync9(spfnrcPath)) {
+  updateGitignore(cwd);
+  generateEnvFiles(cwd);
+  const spfnrcPath = join11(cwd, ".spfnrc.ts");
+  if (!existsSync11(spfnrcPath)) {
     const spfnrcContent = `import { defineConfig, defineGenerator } from '@spfn/core/codegen';
 
 /**
@@ -893,136 +1071,207 @@ export default defineConfig({
     ]
 });
 `;
-    writeFileSync6(spfnrcPath, spfnrcContent);
+    writeFileSync8(spfnrcPath, spfnrcContent);
     logger.success("Created .spfnrc.ts (codegen configuration)");
   }
-  updateGitignore(cwd);
   updateTsconfig(cwd);
 }
-function generateEnvExamples(cwd) {
-  writeEnvExample(cwd, ".env.example", `# Shared defaults (committed)
-# These values are shared across all environments.
-
-# Environment
-NODE_ENV=local
-
-# Logging
-SPFN_LOG_LEVEL=info
-
-# Server
-PORT=4000
-
-# SPFN API Server URL (for API Route Proxy and SSR)
-SPFN_API_URL=http://localhost:8790
-NEXT_PUBLIC_SPFN_API_URL=http://localhost:8790
-`);
-  writeEnvExample(cwd, ".env.local.example", `# Local overrides (gitignored)
-# Developer-specific values that should NOT be committed.
-
-# Database (matches docker-compose.yml)
-DATABASE_URL=postgresql://spfn:spfn@localhost:5432/spfn_dev
-
-# Cache - Redis/Valkey (optional)
-CACHE_URL=redis://localhost:6379
-
-# SPFN App URL (optional, for CORS and redirects)
-# SPFN_APP_URL=http://localhost:3790
-`);
-  writeEnvExample(cwd, ".env.server.example", `# Server-only environment (template)
-# Copy to .env.server (gitignored) and fill in real values.
-# These values are only loaded by the SPFN server, not by Next.js.
-
-# Database pool
-DB_POOL_MAX=10
-DB_POOL_IDLE_TIMEOUT=30
-
-# Server timeouts
-SERVER_TIMEOUT=120000
-SHUTDOWN_TIMEOUT=30000
-
-# --- Secrets (never commit .env.server) ---
-
-# Database write/read URLs (master-replica pattern, optional)
-# DATABASE_WRITE_URL=postgresql://user:password@master:5432/dbname
-# DATABASE_READ_URL=postgresql://user:password@replica:5432/dbname
-
-# Cache password (optional)
-# CACHE_PASSWORD=your-redis-password
-`);
+function generateEnvFiles(cwd) {
+  writeEnvFile(cwd, ".env.local", ENV_LOCAL_TEMPLATE);
+  writeServerEnv(cwd);
+  writeExampleEnv(cwd, ENV_EXAMPLE_TEMPLATE);
 }
-function writeEnvExample(cwd, filename, content) {
-  const filePath = join9(cwd, filename);
-  if (existsSync9(filePath)) {
+function writeServerEnv(cwd) {
+  const filePath = join11(cwd, ".env.server");
+  if (!existsSync11(filePath)) {
+    writeFileSync8(filePath, ENV_SERVER_TEMPLATE);
+    restrictEnvFilePerms(filePath);
+    logger.success("Created .env.server");
     return;
   }
-  writeFileSync6(filePath, content);
-  logger.success(`Created ${filename}`);
+  writeFileSync8(join11(cwd, ".env.server.example"), withPlaceholderCreds(ENV_SERVER_TEMPLATE));
+  logger.warn(".env.server already exists \u2014 left it untouched; wrote SPFN's reference to .env.server.example, add any missing keys manually");
 }
-function updateGitignore(cwd) {
-  const gitignorePath = join9(cwd, ".gitignore");
-  if (!existsSync9(gitignorePath)) {
+function writeExampleEnv(cwd, content) {
+  const filePath = join11(cwd, ".env.example");
+  if (existsSync11(filePath)) {
     return;
   }
-  try {
-    const content = readFileSync3(gitignorePath, "utf-8");
-    let updated = content;
-    let changed = false;
-    if (!content.includes(".spfn")) {
-      updated = updated.replace(
-        /# production\n\/build/,
-        "# production\n/build\n\n# spfn\n/.spfn/"
-      );
-      changed = true;
-    }
-    if (!content.includes(".env.local") && !content.includes(".env.*.local")) {
-      updated += `
-# environment secrets (local overrides)
-.env.local
-.env.*.local
-`;
-      changed = true;
-    }
-    if (!content.includes(".env.server")) {
-      updated += `
-# spfn server env (secrets)
-.env.server
+  writeFileSync8(filePath, content);
+  logger.success("Created .env.example (committed reference)");
+}
+function writeEnvFile(cwd, filename, content) {
+  const filePath = join11(cwd, filename);
+  if (!existsSync11(filePath)) {
+    writeFileSync8(filePath, content);
+    logger.success(`Created ${filename}`);
+    return;
+  }
+  mergeMissingEnvKeys(filePath, filename, content);
+}
+function mergeMissingEnvKeys(filePath, filename, template) {
+  const existing = readFileSync5(filePath, "utf-8");
+  const existingKeys = collectDeclaredKeys(existing);
+  const missing = template.split("\n").filter((line) => {
+    const key = envKeyOf(line);
+    return key !== null && !existingKeys.has(key);
+  });
+  if (missing.length === 0) {
+    return;
+  }
+  const block = `
+# Added by spfn init
+${missing.join("\n")}
 `;
-      changed = true;
-    }
-    if (changed) {
-      writeFileSync6(gitignorePath, updated);
-      logger.success("Updated .gitignore with .spfn directory and env patterns");
+  writeFileSync8(filePath, existing.replace(/\n*$/, "\n") + block);
+  logger.success(`Updated ${filename} (added ${missing.length} SPFN key(s))`);
+}
+function updateGitignore(cwd) {
+  const gitignorePath = join11(cwd, ".gitignore");
+  const existed = existsSync11(gitignorePath);
+  try {
+    const content = existed ? readFileSync5(gitignorePath, "utf-8") : "";
+    const additions = pendingIgnoreRules(content);
+    if (additions.length === 0) {
+      return;
     }
-  } catch (error) {
-    logger.warn("Could not update .gitignore (you can add patterns manually)");
+    writeFileSync8(gitignorePath, content + additions.join(""));
+    logger.success(existed ? "Updated .gitignore with .spfn directory and env patterns" : "Created .gitignore with .spfn directory and env patterns");
+  } catch {
+    logger.warn("Could not update .gitignore \u2014 add .env.local and .env.server manually before committing, so the generated .env.server secrets are not tracked");
+  }
+}
+function pendingIgnoreRules(content) {
+  const lines = content.split("\n");
+  const rules = [];
+  if (!gitignoreCovers(lines, ".spfn")) {
+    rules.push("\n# spfn\n/.spfn/\n");
+  }
+  if (!gitignoreCovers(lines, ".env.local")) {
+    rules.push("\n# environment secrets (local overrides)\n.env.local\n");
+  }
+  if (!gitignoreCovers(lines, ".env.*.local")) {
+    rules.push("\n# environment secrets (env-specific local overrides)\n.env.*.local\n");
+  }
+  if (!gitignoreCovers(lines, ".env.server")) {
+    rules.push("\n# spfn server env (secrets)\n.env.server\n");
   }
+  if (!lines.some((line) => line.trim() === "!.env.example")) {
+    rules.push("\n# spfn env reference (committed)\n!.env.example\n");
+  }
+  return rules;
 }
 function updateTsconfig(cwd) {
-  const tsconfigPath = join9(cwd, "tsconfig.json");
-  if (!existsSync9(tsconfigPath)) {
+  const tsconfigPath = join11(cwd, "tsconfig.json");
+  if (!existsSync11(tsconfigPath)) {
     return;
   }
   try {
-    const tsconfigContent = readFileSync3(tsconfigPath, "utf-8");
+    const tsconfigContent = readFileSync5(tsconfigPath, "utf-8");
     const tsconfig = JSON.parse(tsconfigContent);
     if (!tsconfig.exclude) {
       tsconfig.exclude = [];
     }
     if (!tsconfig.exclude.includes("src/server")) {
       tsconfig.exclude.push("src/server");
-      writeFileSync6(tsconfigPath, JSON.stringify(tsconfig, null, 2) + "\n");
+      writeFileSync8(tsconfigPath, JSON.stringify(tsconfig, null, 2) + "\n");
       logger.success("Updated tsconfig.json (excluded src/server for Vercel compatibility)");
     }
-  } catch (error) {
+  } catch {
     logger.warn('Could not update tsconfig.json (you can add "src/server" to exclude manually)');
   }
 }
-var writeFileSync6;
+var writeFileSync8, ENV_LOCAL_TEMPLATE, ENV_SERVER_TEMPLATE, ENV_EXAMPLE_TEMPLATE;
 var init_config_files = __esm({
   "src/commands/init/steps/config-files.ts"() {
     "use strict";
     init_logger();
-    ({ writeFileSync: writeFileSync6 } = fse7);
+    init_env_file();
+    ({ writeFileSync: writeFileSync8 } = fse8);
+    ENV_LOCAL_TEMPLATE = `# Next.js environment
+# Loaded by Next.js (and the SPFN backend). Only non-secret, Next.js-facing
+# values belong here \u2014 server secrets go in .env.server.
+
+# SPFN API endpoint \u2014 browser + Next.js SSR/proxy target
+SPFN_API_URL=http://localhost:8790
+NEXT_PUBLIC_SPFN_API_URL=http://localhost:8790
+
+# Next.js app URL (used by the SPFN server for CORS/redirects)
+SPFN_APP_URL=http://localhost:3790
+`;
+    ENV_SERVER_TEMPLATE = `# SPFN backend environment
+# Loaded ONLY by the SPFN server, never by Next.js. Keep all server-only config
+# and secrets here so they never reach the Next.js process.
+
+# Environment
+NODE_ENV=local
+
+# Logging
+SPFN_LOG_LEVEL=info
+
+# Database (matches docker-compose.yml) \u2014 secret, server-only
+DATABASE_URL=postgresql://spfn:spfn@localhost:5432/spfn_dev
+
+# Cache \u2014 Redis/Valkey (optional)
+CACHE_URL=redis://localhost:6379
+
+# Database pool
+DB_POOL_MAX=10
+DB_POOL_IDLE_TIMEOUT=30
+
+# --- Optional secrets (uncomment and set as needed) ---
+# DATABASE_WRITE_URL=postgresql://user:password@master:5432/dbname
+# DATABASE_READ_URL=postgresql://user:password@replica:5432/dbname
+# CACHE_PASSWORD=your-redis-password
+`;
+    ENV_EXAMPLE_TEMPLATE = withPlaceholderCreds(`# Example environment \u2014 committed reference for the variables SPFN uses.
+# Real values live in .env.local (Next.js) and .env.server (backend secrets),
+# both gitignored. This file documents the keys; it is not loaded by anything.
+
+${ENV_LOCAL_TEMPLATE}
+${ENV_SERVER_TEMPLATE}`);
+  }
+});
+
+// src/commands/init/steps/readme.ts
+import { existsSync as existsSync12, readFileSync as readFileSync6 } from "fs";
+import { basename, join as join12 } from "path";
+import fse9 from "fs-extra";
+async function setupReadme(cwd, ctx) {
+  const readmePath = join12(cwd, "README.md");
+  if (existsSync12(readmePath) && !ctx.overwrite) {
+    logger.info("README.md already exists \u2014 keeping it");
+    return;
+  }
+  const templatePath = join12(findTemplatesPath(), "README.md");
+  let template;
+  try {
+    template = readFileSync6(templatePath, "utf-8");
+  } catch {
+    logger.warn("README template not found \u2014 skipping README generation");
+    return;
+  }
+  const content = renderReadme(template, {
+    projectName: ctx.packageJson.name || basename(cwd) || "my-app",
+    pm: ctx.pm,
+    pmRun: getRunCommand(ctx.pm),
+    includeAuth: ctx.includeAuth
+  });
+  writeFileSync9(readmePath, content);
+  logger.success("Created README.md");
+}
+function renderReadme(template, vars) {
+  const authBlock = /\r?\n?<!-- \{\{#auth\}\} -->\r?\n([\s\S]*?)\r?\n<!-- \{\{\/auth\}\} -->\r?\n/;
+  return template.replace(authBlock, vars.includeAuth ? "\n$1\n" : "\n").replaceAll("{{projectName}}", () => vars.projectName).replaceAll("{{pmRun}}", () => vars.pmRun).replaceAll("{{pm}}", () => vars.pm);
+}
+var writeFileSync9;
+var init_readme = __esm({
+  "src/commands/init/steps/readme.ts"() {
+    "use strict";
+    init_logger();
+    init_package_manager();
+    init_templates();
+    ({ writeFileSync: writeFileSync9 } = fse9);
   }
 });
 
@@ -1033,7 +1282,7 @@ __export(init_exports, {
   initializeSpfn: () => initializeSpfn
 });
 import { Command as Command2 } from "commander";
-import chalk3 from "chalk";
+import chalk4 from "chalk";
 async function initializeSpfn(options = {}) {
   const cwd = process.cwd();
   const { packageJson, packageJsonPath, includeAuth } = await validateProject(cwd, options.yes || false);
@@ -1041,26 +1290,28 @@ async function initializeSpfn(options = {}) {
   logger.step(`Detected package manager: ${pm}`);
   await setupServerStructure(cwd);
   await setupApiProxy(cwd, includeAuth);
+  await setupNextConfig(cwd, includeAuth);
   await setupDockerFiles(cwd, pm);
   await setupDeploymentConfig(cwd, packageJson, pm);
   await setupPackageJson(cwd, packageJsonPath, packageJson, pm, includeAuth);
   await setupConfigFiles(cwd);
-  console.log("\n" + chalk3.green.bold("\u2713 SPFN initialized successfully!\n"));
+  await setupReadme(cwd, { pm, packageJson, includeAuth, overwrite: options.overwriteReadme ?? false });
+  console.log("\n" + chalk4.green.bold("\u2713 SPFN initialized successfully!\n"));
   console.log("Next steps:");
   console.log("  1. Start PostgreSQL & Redis (if not installed locally):");
-  console.log("     " + chalk3.cyan("docker compose up -d"));
-  console.log("  2. Copy .env.local.example to .env.local");
-  console.log("     " + chalk3.cyan("cp .env.local.example .env.local"));
-  console.log("  3. Run: " + chalk3.cyan(pm === "npm" ? "npm run spfn:dev" : `${pm} run spfn:dev`));
+  console.log("     " + chalk4.cyan("docker compose up -d"));
+  console.log("  2. Review the generated env files (.env.local, .env.server)");
+  console.log("     " + chalk4.dim(ENV_FILES_HINT));
+  console.log("  3. Run: " + chalk4.cyan(`${getRunCommand(pm)} spfn:dev`));
   console.log("  4. Visit:");
-  console.log("     - Next.js: " + chalk3.cyan("http://localhost:3790"));
-  console.log("     - API:     " + chalk3.cyan("http://localhost:8790/health"));
+  console.log("     - Next.js: " + chalk4.cyan("http://localhost:3790"));
+  console.log("     - API:     " + chalk4.cyan("http://localhost:8790/health"));
   console.log("\nAvailable commands:");
-  console.log("  \u2022 " + chalk3.cyan(pm === "npm" ? "npm run spfn:dev" : `${pm} spfn:dev`) + "       - Start SPFN + Next.js");
-  console.log("  \u2022 " + chalk3.cyan("spfn env:validate") + "   - Validate environment variables");
-  console.log("  \u2022 " + chalk3.cyan("spfn env:docs") + "       - Generate env documentation");
-  console.log("  \u2022 " + chalk3.cyan("spfn env:check") + "      - Check environment status");
-  console.log("\n" + chalk3.blue("\u{1F4A1} Tip:") + " Edit " + chalk3.cyan("src/server/config/env.config.ts") + " to manage environment variables");
+  console.log("  \u2022 " + chalk4.cyan(`${getRunCommand(pm)} spfn:dev`) + "       - Start SPFN + Next.js");
+  console.log("  \u2022 " + chalk4.cyan("spfn env validate") + "  - Validate environment variables");
+  console.log("  \u2022 " + chalk4.cyan("spfn env list") + "      - List env vars from the schema");
+  console.log("  \u2022 " + chalk4.cyan("spfn secret set") + "    - Store a secret (keychain / SOPS)");
+  console.log("\n" + chalk4.blue("\u{1F4A1} Tip:") + " Edit " + chalk4.cyan("src/server/config/env.config.ts") + " to manage environment variables");
 }
 var initCommand;
 var init_init = __esm({
@@ -1068,13 +1319,16 @@ var init_init = __esm({
     "use strict";
     init_package_manager();
     init_logger();
+    init_messages();
     init_validate();
     init_server_structure();
     init_api_proxy();
+    init_next_config();
     init_docker();
     init_deployment_config();
     init_package();
     init_config_files();
+    init_readme();
     initCommand = new Command2("init").description("Initialize SPFN in your Next.js project").option("-y, --yes", "Skip prompts and use defaults").action(initializeSpfn);
   }
 });
@@ -1085,38 +1339,38 @@ __export(function_migrations_exports, {
   discoverFunctionMigrations: () => discoverFunctionMigrations,
   executeFunctionMigrations: () => executeFunctionMigrations
 });
-import chalk12 from "chalk";
-import { join as join15 } from "path";
+import chalk13 from "chalk";
+import { join as join19 } from "path";
 import { env as env2 } from "@spfn/core/config";
 import { loadEnv as loadEnv2 } from "@spfn/core/server";
-import { existsSync as existsSync16, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync19, readdirSync as readdirSync2, readFileSync as readFileSync9 } from "fs";
 function discoverFunctionMigrations(cwd = process.cwd()) {
-  const nodeModulesPath = join15(cwd, "node_modules");
-  if (!existsSync16(nodeModulesPath)) {
+  const nodeModulesPath = join19(cwd, "node_modules");
+  if (!existsSync19(nodeModulesPath)) {
     return [];
   }
   const functions = [];
-  const spfnDir = join15(nodeModulesPath, "@spfn");
-  if (!existsSync16(spfnDir)) {
+  const spfnDir = join19(nodeModulesPath, "@spfn");
+  if (!existsSync19(spfnDir)) {
     return [];
   }
   const packages = readdirSync2(spfnDir);
   for (const pkg of packages) {
-    const packagePath = join15(spfnDir, pkg);
-    const packageJsonPath = join15(packagePath, "package.json");
-    if (!existsSync16(packageJsonPath)) {
+    const packagePath = join19(spfnDir, pkg);
+    const packageJsonPath = join19(packagePath, "package.json");
+    if (!existsSync19(packageJsonPath)) {
       continue;
     }
     try {
-      const packageJson = JSON.parse(readFileSync6(packageJsonPath, "utf-8"));
+      const packageJson = JSON.parse(readFileSync9(packageJsonPath, "utf-8"));
       const spfnConfig = packageJson.spfn;
       if (!spfnConfig?.migrations) {
         continue;
       }
-      const migrationsDir = join15(packagePath, spfnConfig.migrations.dir);
-      if (!existsSync16(migrationsDir)) {
+      const migrationsDir = join19(packagePath, spfnConfig.migrations.dir);
+      if (!existsSync19(migrationsDir)) {
         console.warn(
-          chalk12.yellow(`\u26A0\uFE0F  Package @spfn/${pkg} specifies migrations but directory not found: ${migrationsDir}`)
+          chalk13.yellow(`\u26A0\uFE0F  Package @spfn/${pkg} specifies migrations but directory not found: ${migrationsDir}`)
         );
         continue;
       }
@@ -1126,7 +1380,7 @@ function discoverFunctionMigrations(cwd = process.cwd()) {
         packagePath
       });
     } catch (error) {
-      console.warn(chalk12.yellow(`\u26A0\uFE0F  Failed to parse package.json for @spfn/${pkg}`));
+      console.warn(chalk13.yellow(`\u26A0\uFE0F  Failed to parse package.json for @spfn/${pkg}`));
     }
   }
   return functions;
@@ -1141,7 +1395,7 @@ async function migrateLegacyTable(db, functionMigrations) {
   if (!legacyCheck[0]?.exists) {
     return;
   }
-  console.log(chalk12.dim("\n  Migrating legacy shared migration table to per-package tables..."));
+  console.log(chalk13.dim("\n  Migrating legacy shared migration table to per-package tables..."));
   const legacyRows = await db.execute(
     `SELECT hash, created_at FROM drizzle."__spfn_fn_migrations" ORDER BY id`
   );
@@ -1150,11 +1404,11 @@ async function migrateLegacyTable(db, functionMigrations) {
     return;
   }
   for (const func of functionMigrations) {
-    const journalPath = join15(func.migrationsDir, "meta", "_journal.json");
-    if (!existsSync16(journalPath)) {
+    const journalPath = join19(func.migrationsDir, "meta", "_journal.json");
+    if (!existsSync19(journalPath)) {
       continue;
     }
-    const journal = JSON.parse(readFileSync6(journalPath, "utf-8"));
+    const journal = JSON.parse(readFileSync9(journalPath, "utf-8"));
     const entries = journal.entries || [];
     const tableName = `__spfn_fn_${func.packageName.replace("@spfn/", "")}_migrations`;
     await db.execute(
@@ -1176,11 +1430,11 @@ async function migrateLegacyTable(db, functionMigrations) {
     const { createHash } = await import("crypto");
     let copied = 0;
     for (const entry of entries) {
-      const sqlPath = join15(func.migrationsDir, `${entry.tag}.sql`);
-      if (!existsSync16(sqlPath)) {
+      const sqlPath = join19(func.migrationsDir, `${entry.tag}.sql`);
+      if (!existsSync19(sqlPath)) {
         continue;
       }
-      const sqlContent = readFileSync6(sqlPath, "utf-8");
+      const sqlContent = readFileSync9(sqlPath, "utf-8");
       const hash = createHash("sha256").update(sqlContent).digest("hex");
       const found = legacyRows.find((r) => r.hash === hash);
       if (found) {
@@ -1191,11 +1445,11 @@ async function migrateLegacyTable(db, functionMigrations) {
       }
     }
     if (copied > 0) {
-      console.log(chalk12.dim(`    \u2713 ${func.packageName}: copied ${copied} migration record(s)`));
+      console.log(chalk13.dim(`    \u2713 ${func.packageName}: copied ${copied} migration record(s)`));
     }
   }
   await db.execute(`DROP TABLE drizzle."__spfn_fn_migrations"`);
-  console.log(chalk12.dim("    \u2713 Legacy migration table removed\n"));
+  console.log(chalk13.dim("    \u2713 Legacy migration table removed\n"));
 }
 async function executeFunctionMigrations(functionMigrations) {
   let executedCount = 0;
@@ -1211,14 +1465,14 @@ async function executeFunctionMigrations(functionMigrations) {
   try {
     await migrateLegacyTable(db, functionMigrations);
     for (const func of functionMigrations) {
-      console.log(chalk12.blue(`
+      console.log(chalk13.blue(`
   \u{1F4E6} Running ${func.packageName} migrations...`));
       const tableName = `__spfn_fn_${func.packageName.replace("@spfn/", "")}_migrations`;
       await migrate(db, {
         migrationsFolder: func.migrationsDir,
         migrationsTable: tableName
       });
-      console.log(chalk12.green(`  \u2713 ${func.packageName} migrations applied`));
+      console.log(chalk13.green(`  \u2713 ${func.packageName} migrations applied`));
       executedCount++;
     }
   } finally {
@@ -1233,22 +1487,23 @@ var init_function_migrations = __esm({
 });
 
 // src/index.ts
-import { Command as Command12 } from "commander";
+import { Command as Command13 } from "commander";
 
 // src/commands/create.ts
 init_logger();
 init_package_manager();
+init_messages();
 import { Command as Command3 } from "commander";
-import { existsSync as existsSync10 } from "fs";
-import { join as join10, resolve, dirname as dirname2 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import { join as join13, resolve, dirname as dirname2 } from "path";
 import prompts2 from "prompts";
 import ora4 from "ora";
 import { execa as execa3 } from "execa";
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 function findPnpmWorkspaceRoot(startDir) {
   let dir = resolve(startDir);
   while (true) {
-    if (existsSync10(join10(dir, "pnpm-workspace.yaml"))) {
+    if (existsSync13(join13(dir, "pnpm-workspace.yaml"))) {
       return dir;
     }
     const parent = dirname2(dir);
@@ -1259,12 +1514,12 @@ function findPnpmWorkspaceRoot(startDir) {
 }
 async function createProject(projectName, options) {
   const cwd = process.cwd();
-  const projectPath = join10(cwd, projectName);
-  if (existsSync10(projectPath)) {
+  const projectPath = join13(cwd, projectName);
+  if (existsSync13(projectPath)) {
     logger.error(`Directory ${projectName} already exists.`);
     process.exit(1);
   }
-  console.log(chalk4.blue.bold("\n\u{1F680} Creating Next.js project with SPFN...\n"));
+  console.log(chalk5.blue.bold("\n\u{1F680} Creating Next.js project with SPFN...\n"));
   let pm = options.pm || detectPackageManager(cwd);
   if (!options.yes && !options.pm) {
     const { selectedPm } = await prompts2({
@@ -1383,33 +1638,33 @@ async function createProject(projectName, options) {
   const initSpinner = ora4("Initializing SPFN...").start();
   try {
     const { initializeSpfn: initializeSpfn2 } = await Promise.resolve().then(() => (init_init(), init_exports));
-    await initializeSpfn2({ yes: true });
+    await initializeSpfn2({ yes: true, overwriteReadme: true });
     initSpinner.succeed("SPFN initialized");
   } catch (error) {
     initSpinner.fail("Failed to initialize SPFN");
     logger.error(String(error));
     process.exit(1);
   }
-  console.log("\n" + chalk4.green.bold("\u2713 Project created successfully!\n"));
-  console.log(chalk4.bold("Next steps:\n"));
-  console.log(`  ${chalk4.cyan("cd")} ${projectName}`);
-  console.log(`  ${chalk4.cyan("docker compose up -d")}  ${chalk4.gray("# Start PostgreSQL & Redis")}`);
-  console.log(`  ${chalk4.cyan("cp .env.local.example .env.local")}  ${chalk4.gray("# Configure environment")}`);
-  console.log(`  ${chalk4.cyan(`${pm === "npm" ? "npm run" : pm + " run"} spfn:dev`)}  ${chalk4.gray("# Start dev server")}
+  console.log("\n" + chalk5.green.bold("\u2713 Project created successfully!\n"));
+  console.log(chalk5.bold("Next steps:\n"));
+  console.log(`  ${chalk5.cyan("cd")} ${projectName}`);
+  console.log(`  ${chalk5.cyan("docker compose up -d")}  ${chalk5.gray("# Start PostgreSQL & Redis")}`);
+  console.log(`  ${chalk5.gray(`# .env.local & .env.server are generated \u2014 ${ENV_FILES_HINT}`)}`);
+  console.log(`  ${chalk5.cyan(`${getRunCommand(pm)} spfn:dev`)}  ${chalk5.gray("# Start dev server")}
 `);
-  console.log(chalk4.bold("Your app will be available at:\n"));
-  console.log(`  ${chalk4.cyan("http://localhost:3790")}  ${chalk4.gray("(Next.js)")}`);
-  console.log(`  ${chalk4.cyan("http://localhost:8790")}  ${chalk4.gray("(SPFN API)")}
+  console.log(chalk5.bold("Your app will be available at:\n"));
+  console.log(`  ${chalk5.cyan("http://localhost:3790")}  ${chalk5.gray("(Next.js)")}`);
+  console.log(`  ${chalk5.cyan("http://localhost:8790")}  ${chalk5.gray("(SPFN API)")}
 `);
-  console.log(chalk4.bold("\u{1F680} Ready for production?\n"));
-  console.log("  " + chalk4.cyan("Build for production:"));
-  console.log(`    ${chalk4.cyan(pm === "npm" ? "npm run" : pm + " run")} spfn:build`);
-  console.log(`    ${chalk4.cyan(pm === "npm" ? "npm run" : pm + " run")} spfn:start
+  console.log(chalk5.bold("\u{1F680} Ready for production?\n"));
+  console.log("  " + chalk5.cyan("Build for production:"));
+  console.log(`    ${chalk5.cyan(getRunCommand(pm))} spfn:build`);
+  console.log(`    ${chalk5.cyan(getRunCommand(pm))} spfn:start
 `);
-  console.log("  " + chalk4.cyan("Or deploy with Docker:"));
-  console.log(`    ${chalk4.cyan("docker compose -f docker-compose.production.yml up --build -d")}
+  console.log("  " + chalk5.cyan("Or deploy with Docker:"));
+  console.log(`    ${chalk5.cyan("docker compose -f docker-compose.production.yml up --build -d")}
 `);
-  console.log(chalk4.dim("  \u{1F310} Documentation: https://github.com/spfn/spfn\n"));
+  console.log(chalk5.dim("  \u{1F310} Documentation: https://github.com/spfn/spfn\n"));
 }
 var createCommand = new Command3("create").description("Create a new Next.js project with SPFN").argument("<project-name>", "Name of the project directory").option("--skip-install", "Skip installing dependencies").option("--skip-git", "Skip initializing a git repository").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--shadcn", "Setup shadcn/ui (component library)").option("-y, --yes", "Skip prompts and use defaults").action(async (projectName, options) => {
   await createProject(projectName, options);
@@ -1422,75 +1677,278 @@ init_init();
 init_logger();
 init_package_manager();
 import { Command as Command4 } from "commander";
-import { existsSync as existsSync11, readFileSync as readFileSync4, writeFileSync as writeFileSync7, mkdirSync, unlinkSync, rmSync, watch } from "fs";
-import { join as join11 } from "path";
-import { execa as execa4 } from "execa";
+import { existsSync as existsSync14, readFileSync as readFileSync7, writeFileSync as writeFileSync10, mkdirSync, unlinkSync, rmSync, watch } from "fs";
+import { join as join15, relative, sep } from "path";
+import { execa as execa6 } from "execa";
 import chokidar from "chokidar";
-function waitForReadyFile(filePath, timeoutMs = 3e4) {
-  return new Promise((resolve3, reject) => {
-    if (existsSync11(filePath)) {
-      unlinkSync(filePath);
+
+// src/utils/secret-store/index.ts
+init_env_file();
+import { join as join14 } from "path";
+
+// src/utils/secret-store/macos.ts
+import { execa as execa4 } from "execa";
+var MacosKeychainStore = class {
+  id = "macos-keychain";
+  label = "macOS Keychain";
+  async isAvailable() {
+    if (process.platform !== "darwin") {
+      return false;
+    }
+    try {
+      await execa4("security", ["help"]);
+      return true;
+    } catch {
+      return false;
     }
-    const timer = setTimeout(() => {
-      watcher.close();
-      reject(new Error(`Server did not become ready within ${timeoutMs / 1e3}s`));
-    }, timeoutMs);
-    const dir = join11(filePath, "..");
-    const fileName = filePath.split("/").pop();
-    const watcher = watch(dir, (_event, name) => {
-      if (name === fileName && existsSync11(filePath)) {
-        watcher.close();
-        clearTimeout(timer);
-        resolve3(readFileSync4(filePath, "utf-8").trim());
-      }
-    });
-  });
-}
-var devCommand = new Command4("dev").description("Start SPFN development server (detects and runs Next.js + Hono)").option("-p, --port <port>", "Server port").option("-H, --host <host>", "Server host").option("--routes <path>", "Routes directory path").option("--server-only", "Run only Hono server (skip Next.js)").option("--watch", "Enable hot reload (watch mode)").action(async (options) => {
-  process.setMaxListeners(20);
-  if (!process.env.NODE_ENV) {
-    process.env.NODE_ENV = "development";
-  }
-  const cwd = process.cwd();
-  const serverDir = join11(cwd, "src", "server");
-  if (!existsSync11(serverDir)) {
-    logger.error("src/server directory not found.");
-    logger.info('Run "spfn init" first to initialize SPFN in your project.');
-    process.exit(1);
   }
-  const packageJsonPath = join11(cwd, "package.json");
-  let hasNext = false;
-  if (existsSync11(packageJsonPath)) {
-    const packageJson = JSON.parse(readFileSync4(packageJsonPath, "utf-8"));
-    hasNext = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
+  async get(name) {
+    try {
+      const { stdout } = await execa4("security", [
+        "find-generic-password",
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-a",
+        name,
+        "-w"
+      ]);
+      return stdout;
+    } catch {
+      return null;
+    }
   }
-  const tempDir = join11(cwd, ".spfn");
-  const serverEntry = join11(tempDir, "server.mjs");
-  const watcherEntry = join11(tempDir, "watcher.mjs");
-  mkdirSync(tempDir, { recursive: true });
-  const serverBuildDir = join11(tempDir, "server");
-  if (existsSync11(serverBuildDir)) {
-    rmSync(serverBuildDir, { recursive: true, force: true });
-    logger.info("[SPFN] Cleaned stale build cache (.spfn/server)");
+  async set(name, value) {
+    await execa4("security", [
+      "add-generic-password",
+      "-U",
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-a",
+      name,
+      "-w",
+      value
+    ]);
   }
-  const readySignal = join11(tempDir, "server-ready");
-  if (existsSync11(readySignal)) {
-    unlinkSync(readySignal);
+  async delete(name) {
+    try {
+      await execa4("security", [
+        "delete-generic-password",
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-a",
+        name
+      ]);
+    } catch {
+    }
   }
-  const configParts = [];
-  if (options.port) configParts.push(`port: ${options.port}`);
-  if (options.host) configParts.push(`host: '${options.host}'`);
-  if (options.routes) configParts.push(`routesPath: '${options.routes}'`);
-  configParts.push("debug: true");
-  const readyFile = join11(tempDir, "server-ready");
-  writeFileSync7(serverEntry, `
-import { writeFileSync } from 'fs';
-
-// Load environment variables FIRST (before any imports that depend on them)
-await import('@spfn/core/config');
+};
 
-// Import and start server
-const { startServer } = await import('@spfn/core/server');
+// src/utils/secret-store/windows.ts
+var INSTALL_HINT = "Windows keychain support needs the optional native dependency: install `@napi-rs/keyring`.";
+async function loadKeyring() {
+  try {
+    return await import("@napi-rs/keyring");
+  } catch {
+    return null;
+  }
+}
+var WindowsCredentialStore = class {
+  id = "windows-credential-manager";
+  label = "Windows Credential Manager";
+  async isAvailable() {
+    if (process.platform !== "win32") {
+      return false;
+    }
+    return await loadKeyring() !== null;
+  }
+  async entry(name) {
+    const keyring = await loadKeyring();
+    if (!keyring) {
+      throw new Error(INSTALL_HINT);
+    }
+    return new keyring.Entry(KEYCHAIN_SERVICE, name);
+  }
+  async get(name) {
+    try {
+      return (await this.entry(name)).getPassword();
+    } catch {
+      return null;
+    }
+  }
+  async set(name, value) {
+    (await this.entry(name)).setPassword(value);
+  }
+  async delete(name) {
+    try {
+      (await this.entry(name)).deletePassword();
+    } catch {
+    }
+  }
+};
+
+// src/utils/secret-store/linux.ts
+import { execa as execa5 } from "execa";
+var ATTRS = (name) => ["service", KEYCHAIN_SERVICE, "account", name];
+var LinuxSecretToolStore = class {
+  id = "linux-secret-tool";
+  label = "libsecret (secret-tool)";
+  async isAvailable() {
+    if (process.platform !== "linux") {
+      return false;
+    }
+    try {
+      await execa5("secret-tool", ["--version"]);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async get(name) {
+    try {
+      const { stdout } = await execa5("secret-tool", ["lookup", ...ATTRS(name)]);
+      return stdout;
+    } catch {
+      return null;
+    }
+  }
+  async set(name, value) {
+    await execa5(
+      "secret-tool",
+      ["store", "--label", `spfn ${name}`, ...ATTRS(name)],
+      { input: value }
+    );
+  }
+  async delete(name) {
+    try {
+      await execa5("secret-tool", ["clear", ...ATTRS(name)]);
+    } catch {
+    }
+  }
+};
+
+// src/utils/secret-store/index.ts
+var KEYCHAIN_REF_PREFIX = "secret:keychain:";
+var KEYCHAIN_SERVICE = "spfn";
+function detectStore() {
+  switch (process.platform) {
+    case "darwin":
+      return new MacosKeychainStore();
+    case "win32":
+      return new WindowsCredentialStore();
+    case "linux":
+      return new LinuxSecretToolStore();
+    default:
+      return new MacosKeychainStore();
+  }
+}
+function keychainName(key) {
+  return `${KEYCHAIN_SERVICE}_${key}`;
+}
+function keychainRef(key) {
+  return `${KEYCHAIN_REF_PREFIX}${keychainName(key)}`;
+}
+async function resolveKeychainEnv(cwd) {
+  const parsed = parseEnvFile(join14(cwd, ".env.server"));
+  const refs = Object.entries(parsed).filter(([, value]) => value.startsWith(KEYCHAIN_REF_PREFIX));
+  if (refs.length === 0) {
+    return { env: {}, missing: [] };
+  }
+  const store = detectStore();
+  const env8 = {};
+  const missing = [];
+  if (!await store.isAvailable()) {
+    return { env: env8, missing: refs.map(([key]) => key) };
+  }
+  for (const [key, value] of refs) {
+    const name = value.slice(KEYCHAIN_REF_PREFIX.length);
+    const resolved = await store.get(name);
+    if (resolved === null) {
+      missing.push(key);
+    } else {
+      env8[key] = resolved;
+    }
+  }
+  return { env: env8, missing };
+}
+
+// src/commands/dev.ts
+function ignoreDotfilesUnder(root) {
+  return (watchedPath) => relative(root, watchedPath).split(sep).some((segment) => segment.startsWith(".") && segment !== "." && segment !== "..");
+}
+function waitForReadyFile(filePath, timeoutMs = 3e4) {
+  return new Promise((resolve3, reject) => {
+    if (existsSync14(filePath)) {
+      unlinkSync(filePath);
+    }
+    const timer = setTimeout(() => {
+      watcher.close();
+      reject(new Error(`Server did not become ready within ${timeoutMs / 1e3}s`));
+    }, timeoutMs);
+    const dir = join15(filePath, "..");
+    const fileName = filePath.split("/").pop();
+    const watcher = watch(dir, (_event, name) => {
+      if (name === fileName && existsSync14(filePath)) {
+        watcher.close();
+        clearTimeout(timer);
+        resolve3(readFileSync7(filePath, "utf-8").trim());
+      }
+    });
+  });
+}
+var devCommand = new Command4("dev").description("Start SPFN development server (detects and runs Next.js + Hono)").option("-p, --port <port>", "Server port").option("-H, --host <host>", "Server host").option("--routes <path>", "Routes directory path").option("--server-only", "Run only Hono server (skip Next.js)").option("--watch", "Enable hot reload (watch mode)").action(async (options) => {
+  process.setMaxListeners(20);
+  if (!process.env.NODE_ENV) {
+    process.env.NODE_ENV = "development";
+  }
+  const cwd = process.cwd();
+  const serverDir = join15(cwd, "src", "server");
+  if (!existsSync14(serverDir)) {
+    logger.error("src/server directory not found.");
+    logger.info('Run "spfn init" first to initialize SPFN in your project.');
+    process.exit(1);
+  }
+  const { env: keychainEnv, missing: keychainMissing } = await resolveKeychainEnv(cwd);
+  const injectedCount = Object.keys(keychainEnv).length;
+  if (injectedCount > 0) {
+    logger.info(`[SPFN] Injecting ${injectedCount} secret(s) from the keychain`);
+  }
+  if (keychainMissing.length > 0) {
+    logger.warn(`[SPFN] Could not resolve keychain secret(s): ${keychainMissing.join(", ")} \u2014 run \`spfn secret set <KEY>\``);
+  }
+  const serverEnv = { ...process.env, ...keychainEnv };
+  const packageJsonPath = join15(cwd, "package.json");
+  let hasNext = false;
+  if (existsSync14(packageJsonPath)) {
+    const packageJson = JSON.parse(readFileSync7(packageJsonPath, "utf-8"));
+    hasNext = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
+  }
+  const tempDir = join15(cwd, ".spfn");
+  const serverEntry = join15(tempDir, "server.mjs");
+  const watcherEntry = join15(tempDir, "watcher.mjs");
+  mkdirSync(tempDir, { recursive: true });
+  const serverBuildDir = join15(tempDir, "server");
+  if (existsSync14(serverBuildDir)) {
+    rmSync(serverBuildDir, { recursive: true, force: true });
+    logger.info("[SPFN] Cleaned stale build cache (.spfn/server)");
+  }
+  const readySignal = join15(tempDir, "server-ready");
+  if (existsSync14(readySignal)) {
+    unlinkSync(readySignal);
+  }
+  const configParts = [];
+  if (options.port) configParts.push(`port: ${options.port}`);
+  if (options.host) configParts.push(`host: '${options.host}'`);
+  if (options.routes) configParts.push(`routesPath: '${options.routes}'`);
+  configParts.push("debug: true");
+  const readyFile = join15(tempDir, "server-ready");
+  writeFileSync10(serverEntry, `
+import { writeFileSync } from 'fs';
+
+// Load environment variables FIRST (before any imports that depend on them)
+await import('@spfn/core/config');
+
+// Import and start server
+const { startServer } = await import('@spfn/core/server');
 
 const instance = await startServer({
     ${configParts.join(",\n    ")}
@@ -1499,7 +1957,7 @@ const instance = await startServer({
 // Signal ready with actual port
 writeFileSync(${JSON.stringify(readyFile)}, String(instance.config.port));
 `);
-  writeFileSync7(watcherEntry, `
+  writeFileSync10(watcherEntry, `
 // Load environment variables
 // const { loadEnvFiles } = await import('@spfn/core/server');
 // loadEnvFiles();
@@ -1564,7 +2022,7 @@ catch (error)
     const startWatcher2 = () => {
       const watcherCmd = pm === "npm" ? "npx" : pm;
       const watcherArgs = pm === "npm" ? ["tsx", watcherEntry] : ["exec", "tsx", watcherEntry];
-      watcherProcess2 = execa4(watcherCmd, watcherArgs, {
+      watcherProcess2 = execa6(watcherCmd, watcherArgs, {
         cwd,
         stdio: "inherit",
         reject: false
@@ -1572,17 +2030,18 @@ catch (error)
       watcherProcess2.then((result) => {
         if (result.exitCode !== 0 && result.exitCode !== 130) {
           logger.error(`Codegen watcher exited with code ${result.exitCode}`);
-          process.exit(1);
+          logger.warn("[SPFN] Codegen watch is disabled for this session \u2014 the server keeps running. Run codegen manually after route changes.");
         }
       });
     };
     const startServer2 = () => {
       const serverCmd = pm === "npm" ? "npx" : pm;
       const serverArgs = pm === "npm" ? ["tsx", serverEntry] : ["exec", "tsx", serverEntry];
-      serverProcess2 = execa4(serverCmd, serverArgs, {
+      serverProcess2 = execa6(serverCmd, serverArgs, {
         cwd,
         stdio: "inherit",
-        reject: false
+        reject: false,
+        env: serverEnv
       });
     };
     const restartServer2 = async () => {
@@ -1603,8 +2062,7 @@ catch (error)
     };
     if (watchMode2) {
       const watcher = chokidar.watch(serverDir, {
-        ignored: /(^|[\/\\])\../,
-        // ignore dotfiles
+        ignored: ignoreDotfilesUnder(serverDir),
         persistent: true,
         ignoreInitial: true,
         awaitWriteFinish: {
@@ -1658,7 +2116,7 @@ catch (error)
   const startWatcher = () => {
     const watcherCmd = pm === "npm" ? "npx" : pm;
     const watcherArgs = pm === "npm" ? ["tsx", watcherEntry] : ["exec", "tsx", watcherEntry];
-    watcherProcess = execa4(watcherCmd, watcherArgs, {
+    watcherProcess = execa6(watcherCmd, watcherArgs, {
       cwd,
       stdio: "inherit",
       reject: false
@@ -1666,14 +2124,14 @@ catch (error)
     watcherProcess.then((result) => {
       if (result.exitCode !== 0 && result.exitCode !== 130) {
         logger.error(`Codegen watcher exited with code ${result.exitCode}`);
-        process.exit(1);
+        logger.warn("[SPFN] Codegen watch is disabled for this session \u2014 the server keeps running. Run codegen manually after route changes.");
       }
     });
   };
   const startNext = () => {
     const nextCmd = pm === "npm" ? "npm" : pm;
     const nextArgs = pm === "npm" ? ["run", "spfn:next"] : ["run", "spfn:next"];
-    nextProcess = execa4(nextCmd, nextArgs, {
+    nextProcess = execa6(nextCmd, nextArgs, {
       cwd,
       stdio: "inherit",
       reject: false
@@ -1688,10 +2146,11 @@ catch (error)
   const startServer = () => {
     const serverCmd = pm === "npm" ? "npx" : pm;
     const serverArgs = pm === "npm" ? ["tsx", serverEntry] : ["exec", "tsx", serverEntry];
-    serverProcess = execa4(serverCmd, serverArgs, {
+    serverProcess = execa6(serverCmd, serverArgs, {
       cwd,
       stdio: "inherit",
-      reject: false
+      reject: false,
+      env: serverEnv
     });
   };
   const restartServer = async () => {
@@ -1712,8 +2171,7 @@ catch (error)
   };
   if (watchMode) {
     const watcher = chokidar.watch(serverDir, {
-      ignored: /(^|[\/\\])\../,
-      // ignore dotfiles
+      ignored: ignoreDotfilesUnder(serverDir),
       persistent: true,
       ignoreInitial: true,
       awaitWriteFinish: {
@@ -1772,11 +2230,11 @@ catch (error)
 init_logger();
 init_package_manager();
 import { Command as Command5 } from "commander";
-import { existsSync as existsSync12, writeFileSync as writeFileSync8, mkdirSync as mkdirSync2, readdirSync } from "fs";
-import { join as join12 } from "path";
-import { execa as execa5 } from "execa";
+import { existsSync as existsSync15, writeFileSync as writeFileSync11, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { join as join16 } from "path";
+import { execa as execa7 } from "execa";
 import ora5 from "ora";
-import chalk5 from "chalk";
+import chalk6 from "chalk";
 import { build } from "tsup";
 async function buildProject(options) {
   if (!process.env.NODE_ENV) {
@@ -1787,17 +2245,17 @@ async function buildProject(options) {
   }
   const cwd = process.cwd();
   const pm = detectPackageManager(cwd);
-  const packageJsonPath = join12(cwd, "package.json");
+  const packageJsonPath = join16(cwd, "package.json");
   let hasNext = false;
-  if (existsSync12(packageJsonPath)) {
+  if (existsSync15(packageJsonPath)) {
     const packageJson = JSON.parse(await import("fs").then(
       (fs5) => fs5.promises.readFile(packageJsonPath, "utf-8")
     ));
     hasNext = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
   }
-  const serverDir = join12(cwd, "src", "server");
-  const hasServer = existsSync12(serverDir);
-  console.log(chalk5.blue.bold("\n\u{1F3D7}\uFE0F  Building SPFN project for production...\n"));
+  const serverDir = join16(cwd, "src", "server");
+  const hasServer = existsSync15(serverDir);
+  console.log(chalk6.blue.bold("\n\u{1F3D7}\uFE0F  Building SPFN project for production...\n"));
   if (hasServer) {
     const spinner = ora5("Generating API client...").start();
     try {
@@ -1819,7 +2277,7 @@ async function buildProject(options) {
   if (hasNext && !options.serverOnly) {
     const spinner = ora5("Building Next.js...").start();
     try {
-      await execa5(pm, ["run", "build"], {
+      await execa7(pm, ["run", "build"], {
         cwd,
         stdio: "inherit"
       });
@@ -1833,10 +2291,10 @@ async function buildProject(options) {
   if (hasServer && !options.nextOnly) {
     const spinner = ora5("Building SPFN server...").start();
     try {
-      const outputDir = join12(cwd, ".spfn", "server");
+      const outputDir = join16(cwd, ".spfn", "server");
       mkdirSync2(outputDir, { recursive: true });
-      const serverDir2 = join12(cwd, "src", "server");
-      if (!existsSync12(serverDir2)) {
+      const serverDir2 = join16(cwd, "src", "server");
+      if (!existsSync15(serverDir2)) {
         spinner.fail("SPFN server build failed");
         logger.error("src/server/ directory not found");
         logger.error('Please run "spfn init" to initialize the project.');
@@ -1864,7 +2322,7 @@ async function buildProject(options) {
         onSuccess: async () => {
         }
       });
-      const prodServerPath = join12(cwd, ".spfn", "prod-server.mjs");
+      const prodServerPath = join16(cwd, ".spfn", "prod-server.mjs");
       const prodServerContent = `// Load environment variables FIRST (before any imports that depend on them)
 // Use centralized environment loader for standard dotenv priority
 const { env } = await import('@spfn/core/config');
@@ -1888,12 +2346,12 @@ await startServer({
     debug: false
 });
 `;
-      writeFileSync8(prodServerPath, prodServerContent);
+      writeFileSync11(prodServerPath, prodServerContent);
       spinner.succeed(`SPFN server build completed \u2192 .spfn/server`);
-      const routesDir = join12(cwd, ".spfn", "server", "routes");
-      if (existsSync12(routesDir)) {
+      const routesDir = join16(cwd, ".spfn", "server", "routes");
+      if (existsSync15(routesDir)) {
         console.log();
-        console.log(chalk5.bold("Route (api)"));
+        console.log(chalk6.bold("Route (api)"));
         try {
           const routes = readdirSync(routesDir, { withFileTypes: true }).filter((dirent) => dirent.isDirectory()).map((dirent) => dirent.name).sort();
           if (routes.length > 0) {
@@ -1902,13 +2360,13 @@ await startServer({
               const prefix = isLast ? "\u2514" : "\u251C";
               const routePath = `/api/${route}`;
               if (route === "health") {
-                console.log(`${prefix} ${chalk5.green("GET")}  ${routePath}`);
+                console.log(`${prefix} ${chalk6.green("GET")}  ${routePath}`);
               } else {
-                console.log(`${prefix} ${chalk5.cyan("*")}    ${routePath}`);
+                console.log(`${prefix} ${chalk6.cyan("*")}    ${routePath}`);
               }
             });
             console.log();
-            console.log(chalk5.cyan("*") + "  (Hono)  multiple methods supported");
+            console.log(chalk6.cyan("*") + "  (Hono)  multiple methods supported");
           }
         } catch (error) {
         }
@@ -1916,9 +2374,9 @@ await startServer({
     } catch (error) {
       spinner.fail("SPFN server build failed");
       if (error instanceof Error) {
-        console.error("\n" + chalk5.red(error.message));
+        console.error("\n" + chalk6.red(error.message));
         if (error.stack) {
-          console.error(chalk5.dim("\n" + error.stack));
+          console.error(chalk6.dim("\n" + error.stack));
         }
       } else {
         logger.error(String(error));
@@ -1930,13 +2388,13 @@ await startServer({
     logger.error("No Next.js or SPFN server found in this project.");
     process.exit(1);
   }
-  console.log("\n" + chalk5.green.bold("\u2713 Build completed successfully!\n"));
-  console.log(chalk5.bold("Next steps:\n"));
-  console.log("  " + chalk5.cyan("Start production server:"));
-  console.log(`    ${chalk5.cyan(pm === "npm" ? "npm run" : pm + " run")} spfn:start  ${chalk5.gray("# Start SPFN + Next.js")}
+  console.log("\n" + chalk6.green.bold("\u2713 Build completed successfully!\n"));
+  console.log(chalk6.bold("Next steps:\n"));
+  console.log("  " + chalk6.cyan("Start production server:"));
+  console.log(`    ${chalk6.cyan(getRunCommand(pm))} spfn:start  ${chalk6.gray("# Start SPFN + Next.js")}
 `);
-  console.log("  " + chalk5.cyan("Or deploy with Docker:"));
-  console.log(`    ${chalk5.cyan("docker compose -f docker-compose.production.yml up --build -d")}
+  console.log("  " + chalk6.cyan("Or deploy with Docker:"));
+  console.log(`    ${chalk6.cyan("docker compose -f docker-compose.production.yml up --build -d")}
 `);
 }
 var buildCommand = new Command5("build").description("Build SPFN project for production (Next.js + Server)").option("--server-only", "Build only SPFN server (skip Next.js)").option("--next-only", "Build only Next.js (skip SPFN server)").option("--turbo", "Use Turbopack for Next.js build").action(async (options) => {
@@ -1947,25 +2405,25 @@ var buildCommand = new Command5("build").description("Build SPFN project for pro
 init_logger();
 init_package_manager();
 import { Command as Command6 } from "commander";
-import { existsSync as existsSync13, readFileSync as readFileSync5 } from "fs";
-import { join as join13 } from "path";
-import { execa as execa6 } from "execa";
-import chalk6 from "chalk";
+import { existsSync as existsSync16, readFileSync as readFileSync8 } from "fs";
+import { join as join17 } from "path";
+import { execa as execa8 } from "execa";
+import chalk7 from "chalk";
 var startCommand = new Command6("start").description("Start SPFN production server (Next.js + Hono)").option("--server-only", "Run only SPFN server (skip Next.js)").option("--next-only", "Run only Next.js (skip SPFN server)").option("-p, --port <port>", "Server port", "8790").option("-h, --host <host>", "Server host", "0.0.0.0").action(async (options) => {
   if (!process.env.NODE_ENV) {
     process.env.NODE_ENV = "production";
   }
   const cwd = process.cwd();
-  const packageJsonPath = join13(cwd, "package.json");
+  const packageJsonPath = join17(cwd, "package.json");
   let hasNext = false;
-  if (existsSync13(packageJsonPath)) {
-    const packageJson = JSON.parse(readFileSync5(packageJsonPath, "utf-8"));
+  if (existsSync16(packageJsonPath)) {
+    const packageJson = JSON.parse(readFileSync8(packageJsonPath, "utf-8"));
     hasNext = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
   }
-  const builtServerDir = join13(cwd, ".spfn", "server");
-  const hasBuiltServer = existsSync13(builtServerDir);
-  const nextBuildDir = join13(cwd, ".next");
-  const hasNextBuild = existsSync13(nextBuildDir);
+  const builtServerDir = join17(cwd, ".spfn", "server");
+  const hasBuiltServer = existsSync16(builtServerDir);
+  const nextBuildDir = join17(cwd, ".next");
+  const hasNextBuild = existsSync16(nextBuildDir);
   if (!options.nextOnly && !hasBuiltServer) {
     logger.error('.spfn/server directory not found. Please run "spfn build" first.');
     process.exit(1);
@@ -1975,8 +2433,8 @@ var startCommand = new Command6("start").description("Start SPFN production serv
     process.exit(1);
   }
   const pm = detectPackageManager(cwd);
-  const serverEntry = join13(cwd, ".spfn", "prod-server.mjs");
-  if (!existsSync13(serverEntry)) {
+  const serverEntry = join17(cwd, ".spfn", "prod-server.mjs");
+  if (!existsSync16(serverEntry)) {
     logger.error('.spfn/prod-server.mjs not found. Please run "spfn build" first.');
     process.exit(1);
   }
@@ -1986,7 +2444,7 @@ var startCommand = new Command6("start").description("Start SPFN production serv
     logger.info(`Starting SPFN Server (production) on http://${options.host}:${options.port}
 `);
     try {
-      await execa6("node", [serverEntry], {
+      await execa8("node", [serverEntry], {
         stdio: "inherit",
         cwd,
         env: { ...process.env }
@@ -2000,7 +2458,7 @@ var startCommand = new Command6("start").description("Start SPFN production serv
   if (options.nextOnly) {
     logger.info("Starting Next.js (production) on http://0.0.0.0:3790\n");
     try {
-      await execa6("npx", ["next", "start", "-H", "0.0.0.0", "-p", "3790"], {
+      await execa8("npx", ["next", "start", "-H", "0.0.0.0", "-p", "3790"], {
         stdio: "inherit",
         cwd
       });
@@ -2012,12 +2470,12 @@ var startCommand = new Command6("start").description("Start SPFN production serv
   }
   const nextCmd = "next start -H 0.0.0.0 -p 3790";
   const serverCmd = `node "${serverEntry}"`;
-  console.log(chalk6.blue.bold("\n\u{1F680} Starting SPFN production server...\n"));
+  console.log(chalk7.blue.bold("\n\u{1F680} Starting SPFN production server...\n"));
   logger.info("Next.js: http://0.0.0.0:3790");
   logger.info(`SPFN API: http://${options.host}:${options.port}
 `);
   try {
-    await execa6(
+    await execa8(
       pm === "npm" ? "npx" : pm,
       pm === "npm" ? ["concurrently", "--raw", "--kill-others", nextCmd, serverCmd] : ["exec", "concurrently", "--raw", "--kill-others", nextCmd, serverCmd],
       {
@@ -2039,13 +2497,13 @@ var startCommand = new Command6("start").description("Start SPFN production serv
 // src/commands/codegen.ts
 init_logger();
 import { Command as Command7 } from "commander";
-import { existsSync as existsSync14, writeFileSync as writeFileSync9 } from "fs";
-import { join as join14 } from "path";
-import chalk7 from "chalk";
+import { existsSync as existsSync17, writeFileSync as writeFileSync12 } from "fs";
+import { join as join18 } from "path";
+import chalk8 from "chalk";
 async function initCodegen(options) {
   const cwd = process.cwd();
-  const rcPath = join14(cwd, ".spfnrc.ts");
-  if (existsSync14(rcPath)) {
+  const rcPath = join18(cwd, ".spfnrc.ts");
+  if (existsSync17(rcPath)) {
     logger.warn(".spfnrc.ts already exists");
     logger.info("Edit manually to add custom generators");
     process.exit(0);
@@ -2070,14 +2528,14 @@ export default defineConfig({
     ],
 });
 `;
-  writeFileSync9(rcPath, content);
-  console.log("\n" + chalk7.green.bold("\u2713 Created .spfnrc.ts\n"));
-  console.log(chalk7.gray("Configured the @spfn/core:route-map generator."));
+  writeFileSync12(rcPath, content);
+  console.log("\n" + chalk8.green.bold("\u2713 Created .spfnrc.ts\n"));
+  console.log(chalk8.gray("Configured the @spfn/core:route-map generator."));
   if (options.withExample) {
-    console.log("\n" + chalk7.yellow("\u{1F4DD} To add custom generators:"));
+    console.log("\n" + chalk8.yellow("\u{1F4DD} To add custom generators:"));
     console.log("  1. Create your generator file (e.g., src/generators/my-generator.ts)");
     console.log("  2. Add to .spfnrc.ts:");
-    console.log(chalk7.gray(`
+    console.log(chalk8.gray(`
 {
   "codegen": {
     "generators": [
@@ -2087,11 +2545,11 @@ export default defineConfig({
   }
 }
         `));
-    console.log("  3. Run: " + chalk7.cyan("spfn dev") + " (generators run automatically)");
+    console.log("  3. Run: " + chalk8.cyan("spfn dev") + " (generators run automatically)");
   } else {
-    console.log("\n" + chalk7.yellow("\u{1F4DD} Next steps:"));
+    console.log("\n" + chalk8.yellow("\u{1F4DD} Next steps:"));
     console.log("  \u2022 Add custom generators to .spfnrc.ts");
-    console.log("  \u2022 Run: " + chalk7.cyan("spfn dev") + " to start development with code generation");
+    console.log("  \u2022 Run: " + chalk8.cyan("spfn dev") + " to start development with code generation");
   }
 }
 async function listGenerators() {
@@ -2104,10 +2562,10 @@ async function listGenerators() {
     logger.info('Run "spfn codegen init" to initialize configuration');
     return;
   }
-  console.log("\n" + chalk7.bold("Registered Generators:"));
+  console.log("\n" + chalk8.bold("Registered Generators:"));
   generators.forEach((gen, index) => {
-    console.log(`  ${index + 1}. ${chalk7.cyan(gen.name)}`);
-    console.log(`     Patterns: ${chalk7.gray(gen.watchPatterns.join(", "))}`);
+    console.log(`  ${index + 1}. ${chalk8.cyan(gen.name)}`);
+    console.log(`     Patterns: ${chalk8.gray(gen.watchPatterns.join(", "))}`);
   });
   console.log("");
 }
@@ -2128,7 +2586,7 @@ async function runGenerators() {
     debug: true
   });
   await orchestrator.generateAll();
-  console.log("\n" + chalk7.green.bold("\u2713 Code generation completed"));
+  console.log("\n" + chalk8.green.bold("\u2713 Code generation completed"));
 }
 var codegenCommand = new Command7("codegen").description("Code generation management");
 codegenCommand.command("init").description("Initialize .spfnrc.ts with codegen configuration").option("--with-example", "Show example custom generator usage").action(initCodegen);
@@ -2138,9 +2596,30 @@ codegenCommand.command("run").description("Run code generators once (no watch mo
 // src/commands/key.ts
 init_logger();
 import { Command as Command8 } from "commander";
-import { randomBytes } from "crypto";
 import { execSync } from "child_process";
-import chalk8 from "chalk";
+import chalk9 from "chalk";
+
+// src/utils/secret-gen.ts
+import { randomBytes, randomUUID } from "crypto";
+function randomBase64Url(bytes) {
+  return randomBytes(bytes).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function generateSecretValue(spec) {
+  switch (spec) {
+    case "hex32":
+      return randomBytes(32).toString("hex");
+    case "hex64":
+      return randomBytes(64).toString("hex");
+    case "base64url32":
+      return randomBase64Url(32);
+    case "uuid":
+      return randomUUID();
+    default:
+      throw new Error(`Unknown generate strategy: ${spec}`);
+  }
+}
+
+// src/commands/key.ts
 var PRESETS = {
   "auth-encryption": {
     bytes: 32,
@@ -2191,43 +2670,43 @@ function copyToClipboard(text) {
   }
 }
 function generateSecret(bytes, preset, envVarName, copy) {
-  const key = randomBytes(bytes).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  const key = randomBase64Url(bytes);
   const config = preset ? PRESETS[preset] : null;
-  console.log("\n" + chalk8.green.bold("\u2713 Generated secret key:"));
+  console.log("\n" + chalk9.green.bold("\u2713 Generated secret key:"));
   if (config) {
-    console.log(chalk8.dim(`  ${config.description} (${bytes * 8} bits)`));
+    console.log(chalk9.dim(`  ${config.description} (${bytes * 8} bits)`));
   } else {
-    console.log(chalk8.dim(`  ${bytes * 8}-bit secret`));
+    console.log(chalk9.dim(`  ${bytes * 8}-bit secret`));
   }
-  console.log("\n" + chalk8.cyan(key) + "\n");
+  console.log("\n" + chalk9.cyan(key) + "\n");
   const varName = envVarName || config?.envVar || "SECRET_KEY";
-  console.log(chalk8.dim("Add to your .env file:"));
-  console.log(chalk8.yellow(`${varName}=${key}
+  console.log(chalk9.dim("Add to your .env file:"));
+  console.log(chalk9.yellow(`${varName}=${key}
 `));
   if (config?.usage) {
-    console.log(chalk8.dim("Usage:"));
-    console.log(chalk8.gray(`  ${config.usage}
+    console.log(chalk9.dim("Usage:"));
+    console.log(chalk9.gray(`  ${config.usage}
 `));
   }
   if (copy) {
     if (copyToClipboard(key)) {
-      console.log(chalk8.green("\u2713 Copied to clipboard!\n"));
+      console.log(chalk9.green("\u2713 Copied to clipboard!\n"));
     } else {
       logger.warn("Could not copy to clipboard");
     }
   }
 }
 function listPresets() {
-  console.log("\n" + chalk8.bold("Available presets:"));
+  console.log("\n" + chalk9.bold("Available presets:"));
   console.log();
   Object.entries(PRESETS).forEach(([name, config]) => {
-    console.log(`  ${chalk8.cyan(name.padEnd(20))} ${chalk8.dim(config.description)}`);
-    console.log(`  ${" ".repeat(20)} ${chalk8.gray(`\u2192 ${config.envVar} (${config.bytes * 8} bits)`)}`);
+    console.log(`  ${chalk9.cyan(name.padEnd(20))} ${chalk9.dim(config.description)}`);
+    console.log(`  ${" ".repeat(20)} ${chalk9.gray(`\u2192 ${config.envVar} (${config.bytes * 8} bits)`)}`);
     console.log();
   });
-  console.log(chalk8.dim("Usage:"));
-  console.log(chalk8.gray("  spfn key <preset>"));
-  console.log(chalk8.gray("  spfn key auth-encryption --copy"));
+  console.log(chalk9.dim("Usage:"));
+  console.log(chalk9.gray("  spfn key <preset>"));
+  console.log(chalk9.gray("  spfn key auth-encryption --copy"));
   console.log();
 }
 var generateValueCommand = new Command8("generate").alias("gen").description("Generate random value (simple output, no metadata)").option("-b, --bytes <number>", "Number of random bytes", "32").option("-c, --copy", "Copy to clipboard").action((options) => {
@@ -2236,13 +2715,13 @@ var generateValueCommand = new Command8("generate").alias("gen").description("Ge
     logger.error("Invalid bytes value. Must be between 1 and 128.");
     process.exit(1);
   }
-  const value = randomBytes(bytes).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  const value = randomBase64Url(bytes);
   console.log(value);
   if (options.copy) {
     if (copyToClipboard(value)) {
-      console.error(chalk8.green("\u2713 Copied to clipboard"));
+      console.error(chalk9.green("\u2713 Copied to clipboard"));
     } else {
-      console.error(chalk8.yellow("\u26A0 Could not copy to clipboard"));
+      console.error(chalk9.yellow("\u26A0 Could not copy to clipboard"));
     }
   }
 });
@@ -2260,9 +2739,9 @@ var keyCommand = new Command8("key").alias("k").description("Generate secure ran
     logger.error(`Unknown preset: ${preset}`);
     console.log("\nAvailable presets:");
     Object.entries(PRESETS).forEach(([name, config]) => {
-      console.log(`  ${chalk8.cyan(name)}: ${config.description}`);
+      console.log(`  ${chalk9.cyan(name)}: ${config.description}`);
     });
-    console.log("\nUse " + chalk8.cyan("--list") + " to see detailed information");
+    console.log("\nUse " + chalk9.cyan("--list") + " to see detailed information");
     process.exit(1);
   }
   generateSecret(
@@ -2281,13 +2760,13 @@ init_setup();
 import { Command as Command9 } from "commander";
 
 // src/commands/db/generate.ts
-import chalk10 from "chalk";
+import chalk11 from "chalk";
 
 // src/commands/db/utils/drizzle.ts
-import { existsSync as existsSync15, writeFileSync as writeFileSync10, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync18, writeFileSync as writeFileSync13, unlinkSync as unlinkSync2 } from "fs";
 import { spawn } from "child_process";
 import { pathToFileURL } from "url";
-import chalk9 from "chalk";
+import chalk10 from "chalk";
 import ora6 from "ora";
 import { env } from "@spfn/core/config";
 import { loadEnv } from "@spfn/core/server";
@@ -2308,20 +2787,20 @@ function shouldRelaxDbTls(databaseUrl) {
 function validateDatabasePrerequisites() {
   loadEnv();
   if (!env.DATABASE_URL) {
-    console.error(chalk9.red("\u274C DATABASE_URL not found in environment"));
-    console.log(chalk9.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+    console.error(chalk10.red("\u274C DATABASE_URL not found in environment"));
+    console.log(chalk10.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     throw new Error("DATABASE_URL is required for database operations");
   }
 }
 async function runDrizzleCommand(command) {
-  const hasUserConfig = existsSync15("./drizzle.config.ts");
+  const hasUserConfig = existsSync18("./drizzle.config.ts");
   const tempConfigPath = `./drizzle.config.${process.pid}.${Date.now()}.temp.ts`;
   const configPath = hasUserConfig ? "./drizzle.config.ts" : tempConfigPath;
   if (!hasUserConfig) {
     loadEnv();
     if (!env.DATABASE_URL) {
-      console.error(chalk9.red("\u274C DATABASE_URL not found in environment"));
-      console.log(chalk9.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+      console.error(chalk10.red("\u274C DATABASE_URL not found in environment"));
+      console.log(chalk10.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
       process.exit(1);
     }
     const { generateDrizzleConfigFile } = await import("@spfn/core/db");
@@ -2333,8 +2812,8 @@ async function runDrizzleCommand(command) {
       expandGlobs: true,
       autoDetectSchemas: true
     });
-    writeFileSync10(tempConfigPath, configContent);
-    console.log(chalk9.dim("Using auto-generated Drizzle config\n"));
+    writeFileSync13(tempConfigPath, configContent);
+    console.log(chalk10.dim("Using auto-generated Drizzle config\n"));
   }
   const args = command.split(" ");
   args.push(`--config=${configPath}`);
@@ -2346,7 +2825,7 @@ async function runDrizzleCommand(command) {
       env: shouldRelaxDbTls(env.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
     });
     const cleanup = () => {
-      if (!hasUserConfig && existsSync15(tempConfigPath)) {
+      if (!hasUserConfig && existsSync18(tempConfigPath)) {
         unlinkSync2(tempConfigPath);
       }
     };
@@ -2369,10 +2848,10 @@ async function runWithSpinner(spinnerText, command, successMessage, failMessage)
   try {
     spinner.stop();
     await runDrizzleCommand(command);
-    console.log(chalk9.green(`\u2705 ${successMessage}`));
+    console.log(chalk10.green(`\u2705 ${successMessage}`));
   } catch (error) {
     spinner.fail(failMessage);
-    console.error(chalk9.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk10.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
@@ -2418,16 +2897,16 @@ async function createPushConnection() {
 async function dbGenerate() {
   try {
     await runDrizzleCommand("generate");
-    console.log(chalk10.green("\n\u2705 Migrations generated successfully"));
+    console.log(chalk11.green("\n\u2705 Migrations generated successfully"));
   } catch (error) {
-    console.error(chalk10.red("\n\u274C Failed to generate migrations"));
-    console.error(chalk10.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk11.red("\n\u274C Failed to generate migrations"));
+    console.error(chalk11.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
 
 // src/commands/db/push.ts
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 import prompts3 from "prompts";
 import "@spfn/core/config";
 import { loadEnv as loadEnv3 } from "@spfn/core/server";
@@ -2474,7 +2953,7 @@ function classifyStatements(statements) {
 }
 
 // src/commands/db/utils/push-display.ts
-import chalk11 from "chalk";
+import chalk12 from "chalk";
 function formatSql(sql2) {
   return sql2.replace(/\s+/g, " ").trim();
 }
@@ -2482,30 +2961,30 @@ function printStatements(statements, color) {
   for (const stmt of statements) {
     console.log(color(`   ${formatSql(stmt.sql)}`));
     if (stmt.reason) {
-      console.log(chalk11.dim(`   \u2192 ${stmt.reason}`));
+      console.log(chalk12.dim(`   \u2192 ${stmt.reason}`));
     }
   }
 }
 function displayClassifiedStatements(result) {
   if (result.safe.length > 0) {
-    console.log(chalk11.green(`
+    console.log(chalk12.green(`
 \u2705 Safe changes (${result.safe.length}):`));
-    printStatements(result.safe, chalk11.green);
+    printStatements(result.safe, chalk12.green);
   }
   if (result.warning.length > 0) {
-    console.log(chalk11.yellow(`
+    console.log(chalk12.yellow(`
 \u26A0\uFE0F  Warnings (${result.warning.length}):`));
-    printStatements(result.warning, chalk11.yellow);
+    printStatements(result.warning, chalk12.yellow);
   }
   if (result.destructive.length > 0) {
-    console.log(chalk11.red(`
+    console.log(chalk12.red(`
 \u274C Destructive changes (${result.destructive.length}):`));
-    printStatements(result.destructive, chalk11.red);
+    printStatements(result.destructive, chalk12.red);
   }
 }
 function displayDryRunSummary(result) {
   const total = result.safe.length + result.warning.length + result.destructive.length;
-  console.log(chalk11.cyan(`
+  console.log(chalk12.cyan(`
 \u{1F50D} Dry-run: ${total} statement(s) detected
 `));
   displayClassifiedStatements(result);
@@ -2513,11 +2992,11 @@ function displayDryRunSummary(result) {
 }
 function displayApplySummary(applied, skipped) {
   if (applied > 0) {
-    console.log(chalk11.green(`
+    console.log(chalk12.green(`
 \u2705 Applied ${applied} statement(s)`));
   }
   if (skipped > 0) {
-    console.log(chalk11.yellow(`\u23ED\uFE0F  Skipped ${skipped} destructive statement(s)`));
+    console.log(chalk12.yellow(`\u23ED\uFE0F  Skipped ${skipped} destructive statement(s)`));
   }
   console.log("");
 }
@@ -2535,10 +3014,10 @@ async function dbPush(options = {}) {
   });
   const schemaFiles = Array.isArray(config.schema) ? config.schema : [config.schema];
   if (schemaFiles.length === 0) {
-    console.log(chalk13.yellow("No schema files found."));
+    console.log(chalk14.yellow("No schema files found."));
     return;
   }
-  console.log(chalk13.dim(`Found ${schemaFiles.length} schema file(s)
+  console.log(chalk14.dim(`Found ${schemaFiles.length} schema file(s)
 `));
   const imports = await loadSchemaImports(schemaFiles);
   const detectedSchemas = new Set(config.schemaFilter ?? ["public"]);
@@ -2564,7 +3043,7 @@ async function dbPush(options = {}) {
     const patched = statementsToExecute.filter((s) => {
       const dropMatch = s.match(/^\s*DROP\s+SCHEMA\s+"?([^"\s;]+)"?/i);
       if (dropMatch && managedSchemaSet.has(dropMatch[1])) {
-        console.log(chalk13.dim(`  [skip] DROP SCHEMA "${dropMatch[1]}" \u2014 managed schema, ignoring`));
+        console.log(chalk14.dim(`  [skip] DROP SCHEMA "${dropMatch[1]}" \u2014 managed schema, ignoring`));
         return false;
       }
       return true;
@@ -2575,7 +3054,7 @@ async function dbPush(options = {}) {
 `);
     const statements = [...ensureSchemas, ...patched];
     if (patched.length === 0) {
-      console.log(chalk13.green("\u2705 No changes detected \u2014 database is up to date\n"));
+      console.log(chalk14.green("\u2705 No changes detected \u2014 database is up to date\n"));
       await applyFunctionMigrations();
       return;
     }
@@ -2586,7 +3065,7 @@ async function dbPush(options = {}) {
     }
     displayClassifiedStatements(result);
     if (options.force) {
-      console.log(chalk13.dim("\n--force: applying all changes..."));
+      console.log(chalk14.dim("\n--force: applying all changes..."));
       for (const stmt of statements) {
         await db.execute(sql.raw(stmt));
       }
@@ -2603,14 +3082,14 @@ async function dbPush(options = {}) {
         for (const stmt of nonDestructive) {
           await db.execute(sql.raw(stmt));
         }
-        console.log(chalk13.green(`
+        console.log(chalk14.green(`
 \u2705 Applied ${nonDestructive.length} safe statement(s)`));
       }
-      console.log(chalk13.red(`
+      console.log(chalk14.red(`
 \u274C ${result.destructive.length} destructive change(s) require confirmation:`));
       for (const stmt of result.destructive) {
-        console.log(chalk13.red(`   ${stmt.sql.replace(/\s+/g, " ").trim()}`));
-        console.log(chalk13.dim(`   \u2192 ${stmt.reason}`));
+        console.log(chalk14.red(`   ${stmt.sql.replace(/\s+/g, " ").trim()}`));
+        console.log(chalk14.dim(`   \u2192 ${stmt.reason}`));
       }
       const { confirm } = await prompts3({
         type: "confirm",
@@ -2625,7 +3104,7 @@ async function dbPush(options = {}) {
         displayApplySummary(statements.length, 0);
       } else {
         displayApplySummary(nonDestructive.length, result.destructive.length);
-        console.log(chalk13.dim("Tip: Use --force to apply all changes without prompting.\n"));
+        console.log(chalk14.dim("Tip: Use --force to apply all changes without prompting.\n"));
       }
     }
     await applyFunctionMigrations();
@@ -2639,35 +3118,35 @@ async function applyFunctionMigrations() {
   if (functions.length === 0) {
     return;
   }
-  console.log(chalk13.blue("\n\u{1F4E6} Applying function package migrations:"));
+  console.log(chalk14.blue("\n\u{1F4E6} Applying function package migrations:"));
   functions.forEach((func) => {
-    console.log(chalk13.dim(`  - ${func.packageName}`));
+    console.log(chalk14.dim(`  - ${func.packageName}`));
   });
   try {
     await executeFunctionMigrations2(functions);
-    console.log(chalk13.green("\n\u2705 All function migrations applied\n"));
+    console.log(chalk14.green("\n\u2705 All function migrations applied\n"));
   } catch (error) {
-    console.error(chalk13.red("\n\u274C Failed to apply function migrations"));
-    console.error(chalk13.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk14.red("\n\u274C Failed to apply function migrations"));
+    console.error(chalk14.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
 
 // src/commands/db/migrate.ts
-import chalk18 from "chalk";
-import { join as join16 } from "path";
-import { existsSync as existsSync18 } from "fs";
+import chalk19 from "chalk";
+import { join as join20 } from "path";
+import { existsSync as existsSync21 } from "fs";
 
 // src/commands/db/backup.ts
 import { promises as fs3 } from "fs";
 import path3 from "path";
 import { spawn as spawn2 } from "child_process";
-import chalk17 from "chalk";
+import chalk18 from "chalk";
 import ora7 from "ora";
 
 // src/commands/db/utils/database.ts
 import net from "net";
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 import prompts4 from "prompts";
 function parseDatabaseUrl(dbUrl) {
   try {
@@ -2698,7 +3177,7 @@ async function confirmDangerousTarget(dbInfo) {
     message: `Remote/production database detected. Type the database name "${dbInfo.database}" to continue:`
   });
   if (typed !== dbInfo.database) {
-    console.log(chalk14.gray("Cancelled (database name mismatch)."));
+    console.log(chalk15.gray("Cancelled (database name mismatch)."));
     process.exit(0);
   }
 }
@@ -2749,16 +3228,16 @@ function formatTimestamp() {
 
 // src/commands/db/utils/backup-files.ts
 import { promises as fs2 } from "fs";
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 import path2 from "path";
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 
 // src/commands/db/utils/metadata.ts
 import { promises as fs } from "fs";
 import path from "path";
 import { promisify } from "util";
 import { exec } from "child_process";
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 var execAsync = promisify(exec);
 async function collectGitInfo() {
   try {
@@ -2821,7 +3300,7 @@ async function collectMigrationInfo(dbUrl) {
       await pool.end();
     }
   } catch (error) {
-    console.log(chalk15.dim("\u26A0\uFE0F  Could not fetch migration info"));
+    console.log(chalk16.dim("\u26A0\uFE0F  Could not fetch migration info"));
     return void 0;
   }
 }
@@ -2829,9 +3308,9 @@ async function saveBackupMetadata(metadata, backupFilename) {
   const metadataPath = backupFilename.replace(/\.(sql|dump)$/, ".meta.json");
   try {
     await fs.writeFile(metadataPath, JSON.stringify(metadata, null, 2));
-    console.log(chalk15.dim(`\u2713 Metadata saved: ${path.basename(metadataPath)}`));
+    console.log(chalk16.dim(`\u2713 Metadata saved: ${path.basename(metadataPath)}`));
   } catch (error) {
-    console.log(chalk15.dim("\u26A0\uFE0F  Could not save metadata"));
+    console.log(chalk16.dim("\u26A0\uFE0F  Could not save metadata"));
   }
 }
 async function loadBackupMetadata(backupFilename) {
@@ -2849,7 +3328,7 @@ async function ensureBackupInGitignore() {
   const gitignorePath = path2.join(process.cwd(), ".gitignore");
   try {
     let content = "";
-    let exists = existsSync17(gitignorePath);
+    let exists = existsSync20(gitignorePath);
     if (exists) {
       content = await fs2.readFile(gitignorePath, "utf-8");
     }
@@ -2860,10 +3339,10 @@ async function ensureBackupInGitignore() {
     if (!hasBackupsIgnore) {
       const entry = exists && content && !content.endsWith("\n") ? "\n\n# Database backups\nbackups/\n" : "# Database backups\nbackups/\n";
       await fs2.appendFile(gitignorePath, entry);
-      console.log(chalk16.dim("\u2713 Added backups/ to .gitignore"));
+      console.log(chalk17.dim("\u2713 Added backups/ to .gitignore"));
     }
   } catch (error) {
-    console.log(chalk16.dim("\u26A0\uFE0F  Could not update .gitignore"));
+    console.log(chalk17.dim("\u26A0\uFE0F  Could not update .gitignore"));
   }
 }
 async function ensureBackupDir() {
@@ -2871,7 +3350,7 @@ async function ensureBackupDir() {
   try {
     await fs2.mkdir(backupDir, { recursive: true });
     const gitignorePath = path2.join(backupDir, ".gitignore");
-    const gitignoreExists = existsSync17(gitignorePath);
+    const gitignoreExists = existsSync20(gitignorePath);
     if (!gitignoreExists) {
       await fs2.writeFile(gitignorePath, "# Ignore all backup files\n*.sql\n*.dump\n*.meta.json\n");
     }
@@ -2913,12 +3392,12 @@ async function listBackupFiles() {
 import { env as env3 } from "@spfn/core/config";
 import { loadEnv as loadEnv4 } from "@spfn/core/server";
 async function dbBackup(options) {
-  console.log(chalk17.blue("\u{1F4BE} Creating database backup...\n"));
+  console.log(chalk18.blue("\u{1F4BE} Creating database backup...\n"));
   loadEnv4();
   const dbUrl = env3.DATABASE_URL;
   if (!dbUrl) {
-    console.error(chalk17.red("\u274C DATABASE_URL not found in environment"));
-    console.log(chalk17.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+    console.error(chalk18.red("\u274C DATABASE_URL not found in environment"));
+    console.log(chalk18.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     process.exit(1);
   }
   const dbInfo = parseDatabaseUrl(dbUrl);
@@ -2928,7 +3407,7 @@ async function dbBackup(options) {
   const ext = format === "sql" ? "sql" : "dump";
   const filename = options.output || path3.join(backupDir, `${dbInfo.database}_${timestamp}.${ext}`);
   if (options.dataOnly && options.schemaOnly) {
-    console.error(chalk17.red("\u274C Cannot use --data-only and --schema-only together"));
+    console.error(chalk18.red("\u274C Cannot use --data-only and --schema-only together"));
     process.exit(1);
   }
   const args = [
@@ -2974,11 +3453,11 @@ async function dbBackup(options) {
           const stats = await fs3.stat(filename);
           const size = formatBytes(stats.size);
           spinner.succeed("Backup created");
-          console.log(chalk17.green(`
+          console.log(chalk18.green(`
 \u2705 Backup created successfully`));
-          console.log(chalk17.gray(`   File: ${filename}`));
-          console.log(chalk17.gray(`   Size: ${size}`));
-          console.log(chalk17.dim("\n\u{1F4CB} Collecting metadata..."));
+          console.log(chalk18.gray(`   File: ${filename}`));
+          console.log(chalk18.gray(`   Size: ${size}`));
+          console.log(chalk18.dim("\n\u{1F4CB} Collecting metadata..."));
           const [gitInfo, migrationInfo] = await Promise.all([
             collectGitInfo(),
             collectMigrationInfo(dbUrl)
@@ -3018,11 +3497,11 @@ async function dbBackup(options) {
       reject(error);
     });
   }).catch((error) => {
-    console.error(chalk17.red("\n\u274C Failed to create backup"));
+    console.error(chalk18.red("\n\u274C Failed to create backup"));
     if (errorOutput.includes("pg_dump: command not found") || errorOutput.includes("not found")) {
-      console.error(chalk17.yellow("\n\u{1F4A1} pg_dump is not installed. Please install PostgreSQL client tools."));
+      console.error(chalk18.yellow("\n\u{1F4A1} pg_dump is not installed. Please install PostgreSQL client tools."));
     } else {
-      console.error(chalk17.red(error instanceof Error ? error.message : "Unknown error"));
+      console.error(chalk18.red(error instanceof Error ? error.message : "Unknown error"));
     }
     process.exit(1);
   });
@@ -3039,7 +3518,7 @@ async function dbMigrate(options = {}) {
     process.exit(1);
   }
   if (options.withBackup) {
-    console.log(chalk18.blue("\u{1F4E6} Creating pre-migration backup...\n"));
+    console.log(chalk19.blue("\u{1F4E6} Creating pre-migration backup...\n"));
     await dbBackup({
       format: "custom",
       tag: "pre-migration",
@@ -3052,66 +3531,66 @@ async function dbMigrate(options = {}) {
   const postgres = await import("postgres");
   loadEnv5();
   if (!env4.DATABASE_URL) {
-    console.error(chalk18.red("\u274C DATABASE_URL not found in environment"));
+    console.error(chalk19.red("\u274C DATABASE_URL not found in environment"));
     process.exit(1);
   }
   const { discoverFunctionMigrations: discoverFunctionMigrations2, executeFunctionMigrations: executeFunctionMigrations2 } = await Promise.resolve().then(() => (init_function_migrations(), function_migrations_exports));
   const functions = discoverFunctionMigrations2(process.cwd());
   if (functions.length > 0) {
-    console.log(chalk18.blue("\u{1F4E6} Applying function package migrations:"));
+    console.log(chalk19.blue("\u{1F4E6} Applying function package migrations:"));
     functions.forEach((func) => {
-      console.log(chalk18.dim(`  - ${func.packageName}`));
+      console.log(chalk19.dim(`  - ${func.packageName}`));
     });
     await executeFunctionMigrations2(functions);
-    console.log(chalk18.green("\u2705 Function migrations applied\n"));
+    console.log(chalk19.green("\u2705 Function migrations applied\n"));
   }
-  const projectMigrationsDir = join16(process.cwd(), "src/server/drizzle");
-  if (existsSync18(projectMigrationsDir)) {
+  const projectMigrationsDir = join20(process.cwd(), "src/server/drizzle");
+  if (existsSync21(projectMigrationsDir)) {
     const projConn = postgres.default(env4.DATABASE_URL, { max: 1 });
     const projDb = drizzle(projConn);
     try {
-      console.log(chalk18.blue("\u{1F4E6} Running project migrations..."));
+      console.log(chalk19.blue("\u{1F4E6} Running project migrations..."));
       await migrate(projDb, {
         migrationsFolder: projectMigrationsDir,
         migrationsTable: PROJECT_MIGRATIONS_TABLE
       });
-      console.log(chalk18.green("\u2705 Project migrations applied successfully"));
+      console.log(chalk19.green("\u2705 Project migrations applied successfully"));
     } finally {
       await projConn.end();
     }
   } else {
-    console.log(chalk18.dim("No project migrations found (src/server/drizzle)"));
+    console.log(chalk19.dim("No project migrations found (src/server/drizzle)"));
   }
 }
 
 // src/commands/db/studio.ts
-import chalk19 from "chalk";
-import { existsSync as existsSync19, writeFileSync as writeFileSync11, unlinkSync as unlinkSync3 } from "fs";
+import chalk20 from "chalk";
+import { existsSync as existsSync22, writeFileSync as writeFileSync14, unlinkSync as unlinkSync3 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { env as env5 } from "@spfn/core/config";
 async function dbStudio(requestedPort) {
-  console.log(chalk19.blue("\u{1F3A8} Opening Drizzle Studio...\n"));
+  console.log(chalk20.blue("\u{1F3A8} Opening Drizzle Studio...\n"));
   const defaultPort = 4983;
   const startPort = requestedPort || defaultPort;
   let port;
   try {
     port = await findAvailablePort(startPort);
     if (port !== startPort) {
-      console.log(chalk19.yellow(`\u26A0\uFE0F  Port ${startPort} is in use, using port ${port} instead
+      console.log(chalk20.yellow(`\u26A0\uFE0F  Port ${startPort} is in use, using port ${port} instead
 `));
     }
   } catch (error) {
-    console.error(chalk19.red(error instanceof Error ? error.message : "Failed to find available port"));
+    console.error(chalk20.red(error instanceof Error ? error.message : "Failed to find available port"));
     process.exit(1);
   }
-  const hasUserConfig = existsSync19("./drizzle.config.ts");
+  const hasUserConfig = existsSync22("./drizzle.config.ts");
   const tempConfigPath = `./drizzle.config.${process.pid}.${Date.now()}.temp.ts`;
   try {
     const configPath = hasUserConfig ? "./drizzle.config.ts" : tempConfigPath;
     if (!hasUserConfig) {
       if (!env5.DATABASE_URL) {
-        console.error(chalk19.red("\u274C DATABASE_URL not found in environment"));
-        console.log(chalk19.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+        console.error(chalk20.red("\u274C DATABASE_URL not found in environment"));
+        console.log(chalk20.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
         process.exit(1);
       }
       const { generateDrizzleConfigFile } = await import("@spfn/core/db");
@@ -3121,8 +3600,8 @@ async function dbStudio(requestedPort) {
         expandGlobs: true
         // Expand glob patterns for Studio compatibility
       });
-      writeFileSync11(tempConfigPath, configContent);
-      console.log(chalk19.dim("Using auto-generated Drizzle config\n"));
+      writeFileSync14(tempConfigPath, configContent);
+      console.log(chalk20.dim("Using auto-generated Drizzle config\n"));
     }
     const studioProcess = spawn3("drizzle-kit", ["studio", `--port=${port}`, `--config=${configPath}`], {
       stdio: "inherit",
@@ -3130,26 +3609,26 @@ async function dbStudio(requestedPort) {
       env: shouldRelaxDbTls(env5.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
     });
     const cleanup = () => {
-      if (!hasUserConfig && existsSync19(tempConfigPath)) {
+      if (!hasUserConfig && existsSync22(tempConfigPath)) {
         unlinkSync3(tempConfigPath);
       }
     };
     studioProcess.on("exit", (code) => {
       cleanup();
       if (code !== 0 && code !== null) {
-        console.error(chalk19.red(`
+        console.error(chalk20.red(`
 \u274C Drizzle Studio exited with code ${code}`));
         process.exit(code);
       }
     });
     studioProcess.on("error", (error) => {
       cleanup();
-      console.error(chalk19.red("\u274C Failed to start Drizzle Studio"));
-      console.error(chalk19.red(error.message));
+      console.error(chalk20.red("\u274C Failed to start Drizzle Studio"));
+      console.error(chalk20.red(error.message));
       process.exit(1);
     });
     process.on("SIGINT", () => {
-      console.log(chalk19.yellow("\n\n\u{1F44B} Shutting down Drizzle Studio..."));
+      console.log(chalk20.yellow("\n\n\u{1F44B} Shutting down Drizzle Studio..."));
       studioProcess.kill("SIGTERM");
       cleanup();
       process.exit(0);
@@ -3160,30 +3639,30 @@ async function dbStudio(requestedPort) {
       process.exit(0);
     });
   } catch (error) {
-    if (!hasUserConfig && existsSync19(tempConfigPath)) {
+    if (!hasUserConfig && existsSync22(tempConfigPath)) {
       unlinkSync3(tempConfigPath);
     }
-    console.error(chalk19.red("\u274C Failed to start Drizzle Studio"));
-    console.error(chalk19.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk20.red("\u274C Failed to start Drizzle Studio"));
+    console.error(chalk20.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
 
 // src/commands/db/drop.ts
-import chalk20 from "chalk";
+import chalk21 from "chalk";
 import prompts5 from "prompts";
 import { env as env6 } from "@spfn/core/config";
 import { loadEnv as loadEnv6 } from "@spfn/core/server";
 async function dbDrop() {
   loadEnv6();
   if (!env6.DATABASE_URL) {
-    console.error(chalk20.red("\u274C DATABASE_URL not found in environment"));
-    console.log(chalk20.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+    console.error(chalk21.red("\u274C DATABASE_URL not found in environment"));
+    console.log(chalk21.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     process.exit(1);
   }
   const dbInfo = parseDatabaseUrl(env6.DATABASE_URL);
-  console.log(chalk20.yellow("\u26A0\uFE0F  WARNING: This will drop all tables in your database!"));
-  console.log(chalk20.dim(`   Target: ${dbInfo.database} @ ${dbInfo.host}:${dbInfo.port}
+  console.log(chalk21.yellow("\u26A0\uFE0F  WARNING: This will drop all tables in your database!"));
+  console.log(chalk21.dim(`   Target: ${dbInfo.database} @ ${dbInfo.host}:${dbInfo.port}
 `));
   const { confirm } = await prompts5({
     type: "confirm",
@@ -3192,7 +3671,7 @@ async function dbDrop() {
     initial: false
   });
   if (!confirm) {
-    console.log(chalk20.gray("Cancelled."));
+    console.log(chalk21.gray("Cancelled."));
     process.exit(0);
   }
   await confirmDangerousTarget(dbInfo);
@@ -3205,7 +3684,7 @@ async function dbDrop() {
 }
 
 // src/commands/db/check.ts
-import chalk21 from "chalk";
+import chalk22 from "chalk";
 import ora8 from "ora";
 async function dbCheck() {
   const spinner = ora8("Checking database connection...").start();
@@ -3214,7 +3693,7 @@ async function dbCheck() {
     spinner.succeed("Database connection OK");
   } catch (error) {
     spinner.fail("Database connection failed");
-    console.error(chalk21.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk22.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
@@ -3222,25 +3701,25 @@ async function dbCheck() {
 // src/commands/db/restore.ts
 import path4 from "path";
 import { spawn as spawn4 } from "child_process";
-import chalk22 from "chalk";
+import chalk23 from "chalk";
 import ora9 from "ora";
 import prompts6 from "prompts";
 import { env as env7 } from "@spfn/core/config";
 import { loadEnv as loadEnv7 } from "@spfn/core/server";
 async function dbRestore(backupFile, options = {}) {
-  console.log(chalk22.blue("\u267B\uFE0F  Restoring database from backup...\n"));
+  console.log(chalk23.blue("\u267B\uFE0F  Restoring database from backup...\n"));
   loadEnv7();
   const dbUrl = env7.DATABASE_URL;
   if (!dbUrl) {
-    console.error(chalk22.red("\u274C DATABASE_URL not found in environment"));
-    console.log(chalk22.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+    console.error(chalk23.red("\u274C DATABASE_URL not found in environment"));
+    console.log(chalk23.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     process.exit(1);
   }
   let file = backupFile;
   if (!file) {
     const backups = await listBackupFiles();
     if (backups.length === 0) {
-      console.log(chalk22.yellow("No backups found in ./backups directory"));
+      console.log(chalk23.yellow("No backups found in ./backups directory"));
       process.exit(0);
     }
     const { selected } = await prompts6({
@@ -3253,31 +3732,31 @@ async function dbRestore(backupFile, options = {}) {
       }))
     });
     if (!selected) {
-      console.log(chalk22.gray("Cancelled"));
+      console.log(chalk23.gray("Cancelled"));
       process.exit(0);
     }
     file = selected;
   }
   if (!file) {
-    console.error(chalk22.red("\u274C No backup file selected"));
+    console.error(chalk23.red("\u274C No backup file selected"));
     process.exit(1);
   }
   const metadata = await loadBackupMetadata(file);
   if (metadata) {
-    console.log(chalk22.blue("\n\u{1F4CB} Backup Information:\n"));
-    console.log(chalk22.dim(`  Database: ${metadata.database}`));
-    console.log(chalk22.dim(`  Created: ${new Date(metadata.timestamp).toLocaleString()}`));
+    console.log(chalk23.blue("\n\u{1F4CB} Backup Information:\n"));
+    console.log(chalk23.dim(`  Database: ${metadata.database}`));
+    console.log(chalk23.dim(`  Created: ${new Date(metadata.timestamp).toLocaleString()}`));
     if (metadata.environment) {
-      console.log(chalk22.dim(`  Environment: ${metadata.environment}`));
+      console.log(chalk23.dim(`  Environment: ${metadata.environment}`));
     }
     if (metadata.tags && metadata.tags.length > 0) {
-      console.log(chalk22.dim(`  Tags: ${metadata.tags.join(", ")}`));
+      console.log(chalk23.dim(`  Tags: ${metadata.tags.join(", ")}`));
     }
     if (metadata.backup.dataOnly) {
-      console.log(chalk22.yellow("  \u26A0\uFE0F  Data-only backup (no schema)"));
+      console.log(chalk23.yellow("  \u26A0\uFE0F  Data-only backup (no schema)"));
     }
     if (metadata.backup.schemaOnly) {
-      console.log(chalk22.yellow("  \u26A0\uFE0F  Schema-only backup (no data)"));
+      console.log(chalk23.yellow("  \u26A0\uFE0F  Schema-only backup (no data)"));
     }
     const warnings2 = [];
     const [currentGitInfo, currentMigrationInfo] = await Promise.all([
@@ -3300,8 +3779,8 @@ async function dbRestore(backupFile, options = {}) {
       }
     }
     if (warnings2.length > 0) {
-      console.log(chalk22.yellow("\n\u26A0\uFE0F  Version Warnings:\n"));
-      warnings2.forEach((warning) => console.log(chalk22.yellow(`  - ${warning}`)));
+      console.log(chalk23.yellow("\n\u26A0\uFE0F  Version Warnings:\n"));
+      warnings2.forEach((warning) => console.log(chalk23.yellow(`  - ${warning}`)));
       console.log("");
     }
   }
@@ -3309,16 +3788,16 @@ async function dbRestore(backupFile, options = {}) {
   const { confirm } = await prompts6({
     type: "confirm",
     name: "confirm",
-    message: chalk22.yellow(`\u26A0\uFE0F  This will replace all data in "${dbInfo.database}" @ ${dbInfo.host}:${dbInfo.port}. Continue?`),
+    message: chalk23.yellow(`\u26A0\uFE0F  This will replace all data in "${dbInfo.database}" @ ${dbInfo.host}:${dbInfo.port}. Continue?`),
     initial: false
   });
   if (!confirm) {
-    console.log(chalk22.gray("Cancelled"));
+    console.log(chalk23.gray("Cancelled"));
     process.exit(0);
   }
   await confirmDangerousTarget(dbInfo);
   if (options.dataOnly && options.schemaOnly) {
-    console.error(chalk22.red("\u274C Cannot use --data-only and --schema-only together"));
+    console.error(chalk23.red("\u274C Cannot use --data-only and --schema-only together"));
     process.exit(1);
   }
   const ext = path4.extname(file);
@@ -3346,11 +3825,11 @@ async function dbRestore(backupFile, options = {}) {
     args.push(file);
   } else {
     if (options.drop) {
-      console.log(chalk22.yellow("\u26A0\uFE0F  Note: --drop only works with custom format backups (.dump) and was ignored."));
+      console.log(chalk23.yellow("\u26A0\uFE0F  Note: --drop only works with custom format backups (.dump) and was ignored."));
     }
     if (options.dataOnly || options.schemaOnly) {
-      console.log(chalk22.yellow("\u26A0\uFE0F  Note: --data-only and --schema-only options only work with custom format backups (.dump)"));
-      console.log(chalk22.yellow("    For SQL files, the backup must have been created with the desired option.\n"));
+      console.log(chalk23.yellow("\u26A0\uFE0F  Note: --data-only and --schema-only options only work with custom format backups (.dump)"));
+      console.log(chalk23.yellow("    For SQL files, the backup must have been created with the desired option.\n"));
     }
     args.push("-h", dbInfo.host);
     args.push("-p", dbInfo.port);
@@ -3393,7 +3872,7 @@ async function dbRestore(backupFile, options = {}) {
       }
       if (verbose) {
         spinner.stop();
-        console.log(chalk22.dim(`  ${line.trim()}`));
+        console.log(chalk23.dim(`  ${line.trim()}`));
         spinner.start();
       }
     }
@@ -3401,7 +3880,7 @@ async function dbRestore(backupFile, options = {}) {
   restoreProcess.stdout?.on("data", (data) => {
     if (verbose) {
       spinner.stop();
-      console.log(chalk22.dim(`  ${data.toString().trim()}`));
+      console.log(chalk23.dim(`  ${data.toString().trim()}`));
       spinner.start();
     }
   });
@@ -3411,31 +3890,31 @@ async function dbRestore(backupFile, options = {}) {
         const summary = objectCount > 0 ? ` (${objectCount} objects)` : "";
         spinner.succeed(`Restore completed${summary}`);
         if (warnings.length > 0) {
-          console.log(chalk22.yellow(`
+          console.log(chalk23.yellow(`
 \u26A0\uFE0F  Warnings during restore (${warnings.length}):
 `));
           for (const w of warnings) {
-            console.log(chalk22.yellow(`  - ${w}`));
+            console.log(chalk23.yellow(`  - ${w}`));
           }
         }
-        console.log(chalk22.green("\n\u2705 Database restored successfully"));
+        console.log(chalk23.green("\n\u2705 Database restored successfully"));
         resolve3();
       } else {
         spinner.fail("Restore failed");
         if (errors.length > 0) {
-          console.error(chalk22.red(`
+          console.error(chalk23.red(`
 \u274C Errors (${errors.length}):
 `));
           for (const e of errors) {
-            console.error(chalk22.red(`  - ${e}`));
+            console.error(chalk23.red(`  - ${e}`));
           }
         }
         if (warnings.length > 0) {
-          console.log(chalk22.yellow(`
+          console.log(chalk23.yellow(`
 \u26A0\uFE0F  Warnings (${warnings.length}):
 `));
           for (const w of warnings) {
-            console.log(chalk22.yellow(`  - ${w}`));
+            console.log(chalk23.yellow(`  - ${w}`));
           }
         }
         const fallback = errors.length === 0 && warnings.length === 0 ? "Restore failed with no output" : "";
@@ -3449,7 +3928,7 @@ async function dbRestore(backupFile, options = {}) {
   }).catch((error) => {
     const msg = error instanceof Error ? error.message : "Unknown error";
     if (msg) {
-      console.error(chalk22.red(`
+      console.error(chalk23.red(`
 \u274C ${msg}`));
     }
     process.exit(1);
@@ -3457,17 +3936,17 @@ async function dbRestore(backupFile, options = {}) {
 }
 
 // src/commands/db/list.ts
-import chalk23 from "chalk";
+import chalk24 from "chalk";
 async function dbBackupList() {
-  console.log(chalk23.blue("\u{1F4CB} Database backups:\n"));
+  console.log(chalk24.blue("\u{1F4CB} Database backups:\n"));
   const backups = await listBackupFiles();
   if (backups.length === 0) {
-    console.log(chalk23.yellow("No backups found in ./backups directory"));
-    console.log(chalk23.gray("\n\u{1F4A1} Create a backup with: pnpm spfn db backup\n"));
+    console.log(chalk24.yellow("No backups found in ./backups directory"));
+    console.log(chalk24.gray("\n\u{1F4A1} Create a backup with: pnpm spfn db backup\n"));
     return;
   }
-  console.log(chalk23.bold("  Date                  Size        File"));
-  console.log(chalk23.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(chalk24.bold("  Date                  Size        File"));
+  console.log(chalk24.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   backups.forEach((backup) => {
     const date = backup.date.toLocaleString("en-US", {
       year: "numeric",
@@ -3478,23 +3957,23 @@ async function dbBackupList() {
       second: "2-digit"
     });
     const sizeStr = backup.size.padEnd(10);
-    console.log(chalk23.white(`  ${date}  ${sizeStr}  ${backup.name}`));
+    console.log(chalk24.white(`  ${date}  ${sizeStr}  ${backup.name}`));
   });
-  console.log(chalk23.gray(`
+  console.log(chalk24.gray(`
   Total: ${backups.length} backup(s)
 `));
 }
 
 // src/commands/db/clean.ts
 import { promises as fs4 } from "fs";
-import chalk24 from "chalk";
+import chalk25 from "chalk";
 import ora10 from "ora";
 import prompts7 from "prompts";
 async function dbBackupClean(options) {
-  console.log(chalk24.blue("\u{1F9F9} Cleaning old backups...\n"));
+  console.log(chalk25.blue("\u{1F9F9} Cleaning old backups...\n"));
   const backups = await listBackupFiles();
   if (backups.length === 0) {
-    console.log(chalk24.yellow("No backups found"));
+    console.log(chalk25.yellow("No backups found"));
     return;
   }
   let toDelete = [];
@@ -3511,13 +3990,13 @@ async function dbBackupClean(options) {
     toDelete = backups.slice(defaultKeep);
   }
   if (toDelete.length === 0) {
-    console.log(chalk24.green("\u2705 No backups to clean"));
+    console.log(chalk25.green("\u2705 No backups to clean"));
     return;
   }
-  console.log(chalk24.yellow(`The following ${toDelete.length} backup(s) will be deleted:
+  console.log(chalk25.yellow(`The following ${toDelete.length} backup(s) will be deleted:
 `));
   toDelete.forEach((backup) => {
-    console.log(chalk24.gray(`  - ${backup.name} (${backup.size})`));
+    console.log(chalk25.gray(`  - ${backup.name} (${backup.size})`));
   });
   const { confirm } = await prompts7({
     type: "confirm",
@@ -3526,7 +4005,7 @@ async function dbBackupClean(options) {
     initial: false
   });
   if (!confirm) {
-    console.log(chalk24.gray("Cancelled"));
+    console.log(chalk25.gray("Cancelled"));
     return;
   }
   const spinner = ora10("Deleting backups...").start();
@@ -3537,19 +4016,19 @@ async function dbBackupClean(options) {
       fs4.rm(backup.path.replace(/\.(sql|dump)$/, ".meta.json"), { force: true })
     ]));
     spinner.succeed("Backups deleted");
-    console.log(chalk24.green(`
+    console.log(chalk25.green(`
 \u2705 Deleted ${toDelete.length} backup(s)`));
   } catch (error) {
     spinner.fail("Failed to delete backups");
-    console.error(chalk24.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk25.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
 
 // src/commands/db/reindex.ts
-import { existsSync as existsSync20, readFileSync as readFileSync7, writeFileSync as writeFileSync12, renameSync, copyFileSync } from "fs";
-import { join as join17 } from "path";
-import chalk25 from "chalk";
+import { existsSync as existsSync23, readFileSync as readFileSync10, writeFileSync as writeFileSync15, renameSync, copyFileSync } from "fs";
+import { join as join21 } from "path";
+import chalk26 from "chalk";
 import { loadEnv as loadEnv8 } from "@spfn/core/server";
 function isTimestampPrefix(tag) {
   const prefix = tag.split("_")[0];
@@ -3570,15 +4049,15 @@ async function dbReindex(options = {}) {
   const { getDrizzleConfig } = await import("@spfn/core/db");
   const config = getDrizzleConfig({ disablePackageDiscovery: true });
   const outDir = config.out;
-  const journalPath = join17(outDir, "meta", "_journal.json");
-  if (!existsSync20(journalPath)) {
-    console.error(chalk25.red("\u274C No _journal.json found at:"), journalPath);
-    console.log(chalk25.yellow("\u{1F4A1} Run `spfn db generate` first to create migrations"));
+  const journalPath = join21(outDir, "meta", "_journal.json");
+  if (!existsSync23(journalPath)) {
+    console.error(chalk26.red("\u274C No _journal.json found at:"), journalPath);
+    console.log(chalk26.yellow("\u{1F4A1} Run `spfn db generate` first to create migrations"));
     process.exit(1);
   }
-  const journal = JSON.parse(readFileSync7(journalPath, "utf-8"));
+  const journal = JSON.parse(readFileSync10(journalPath, "utf-8"));
   if (journal.entries.length === 0) {
-    console.log(chalk25.yellow("No migration entries found \u2014 nothing to reindex."));
+    console.log(chalk26.yellow("No migration entries found \u2014 nothing to reindex."));
     return;
   }
   const renames = [];
@@ -3592,46 +4071,46 @@ async function dbReindex(options = {}) {
     const { prefix: oldPrefix, suffix } = parseTag(entry.tag);
     const newPrefix = String(entry.when);
     const newTag = suffix ? `${newPrefix}_${suffix}` : newPrefix;
-    const oldSql = join17(outDir, `${entry.tag}.sql`);
-    const newSql = join17(outDir, `${newTag}.sql`);
-    if (existsSync20(oldSql)) {
+    const oldSql = join21(outDir, `${entry.tag}.sql`);
+    const newSql = join21(outDir, `${newTag}.sql`);
+    if (existsSync23(oldSql)) {
       renames.push({ type: "sql", from: oldSql, to: newSql });
     }
-    const oldSnapshot = join17(outDir, "meta", `${oldPrefix}_snapshot.json`);
-    const newSnapshot = join17(outDir, "meta", `${newPrefix}_snapshot.json`);
-    if (existsSync20(oldSnapshot)) {
+    const oldSnapshot = join21(outDir, "meta", `${oldPrefix}_snapshot.json`);
+    const newSnapshot = join21(outDir, "meta", `${newPrefix}_snapshot.json`);
+    if (existsSync23(oldSnapshot)) {
       renames.push({ type: "snapshot", from: oldSnapshot, to: newSnapshot });
     }
     tagUpdates.push({ idx: entry.idx, oldTag: entry.tag, newTag });
   }
   if (tagUpdates.length === 0) {
-    console.log(chalk25.green("\u2705 All migrations already use timestamp prefix \u2014 nothing to do."));
+    console.log(chalk26.green("\u2705 All migrations already use timestamp prefix \u2014 nothing to do."));
     if (skipped > 0) {
-      console.log(chalk25.dim(`   (${skipped} entries already timestamp-prefixed)`));
+      console.log(chalk26.dim(`   (${skipped} entries already timestamp-prefixed)`));
     }
     return;
   }
-  console.log(chalk25.bold("\n\u{1F4CB} Reindex plan:\n"));
+  console.log(chalk26.bold("\n\u{1F4CB} Reindex plan:\n"));
   for (const update of tagUpdates) {
     console.log(
-      chalk25.dim(`  [${update.idx}]`),
-      chalk25.red(update.oldTag),
-      chalk25.dim("\u2192"),
-      chalk25.green(update.newTag)
+      chalk26.dim(`  [${update.idx}]`),
+      chalk26.red(update.oldTag),
+      chalk26.dim("\u2192"),
+      chalk26.green(update.newTag)
     );
   }
-  console.log(chalk25.dim(`
+  console.log(chalk26.dim(`
   ${renames.length} file(s) to rename, ${tagUpdates.length} journal tag(s) to update`));
   if (skipped > 0) {
-    console.log(chalk25.dim(`  ${skipped} entry/entries already timestamp-prefixed (skipped)`));
+    console.log(chalk26.dim(`  ${skipped} entry/entries already timestamp-prefixed (skipped)`));
   }
   if (options.dryRun) {
-    console.log(chalk25.yellow("\n\u{1F50D} Dry run \u2014 no changes applied."));
+    console.log(chalk26.yellow("\n\u{1F50D} Dry run \u2014 no changes applied."));
     return;
   }
   const backupPath = journalPath + ".bak";
   copyFileSync(journalPath, backupPath);
-  console.log(chalk25.dim(`
+  console.log(chalk26.dim(`
   Backed up journal \u2192 ${backupPath}`));
   for (const rename of renames) {
     renameSync(rename.from, rename.to);
@@ -3642,8 +4121,8 @@ async function dbReindex(options = {}) {
       entry.tag = update.newTag;
     }
   }
-  writeFileSync12(journalPath, JSON.stringify(journal, null, 2) + "\n");
-  console.log(chalk25.green(`
+  writeFileSync15(journalPath, JSON.stringify(journal, null, 2) + "\n");
+  console.log(chalk26.green(`
 \u2705 Reindex complete \u2014 ${tagUpdates.length} migration(s) converted to timestamp prefix.`));
 }
 
@@ -3664,52 +4143,52 @@ dbCommand.command("reindex").description("Convert migration files from sequentia
 // src/commands/add.ts
 init_package_manager();
 import { Command as Command10 } from "commander";
-import { existsSync as existsSync21, readFileSync as readFileSync8 } from "fs";
-import { join as join18 } from "path";
-import { execa as execa7 } from "execa";
-import chalk26 from "chalk";
+import { existsSync as existsSync24, readFileSync as readFileSync11 } from "fs";
+import { join as join22 } from "path";
+import { execa as execa9 } from "execa";
+import chalk27 from "chalk";
 import ora11 from "ora";
 async function addPackage(packageName) {
   if (!packageName.includes("/")) {
-    console.error(chalk26.red("\u274C Please specify full package name"));
-    console.log(chalk26.yellow("\n\u{1F4A1} Examples:"));
-    console.log(chalk26.gray("  pnpm spfn add @spfn/cms"));
-    console.log(chalk26.gray("  pnpm spfn add @mycompany/spfn-analytics"));
+    console.error(chalk27.red("\u274C Please specify full package name"));
+    console.log(chalk27.yellow("\n\u{1F4A1} Examples:"));
+    console.log(chalk27.gray("  pnpm spfn add @spfn/cms"));
+    console.log(chalk27.gray("  pnpm spfn add @mycompany/spfn-analytics"));
     process.exit(1);
   }
-  console.log(chalk26.blue(`
+  console.log(chalk27.blue(`
 \u{1F4E6} Setting up ${packageName}...
 `));
-  const pkgPath = join18(process.cwd(), "node_modules", ...packageName.split("/"));
-  const pkgJsonPath = join18(pkgPath, "package.json");
-  if (!existsSync21(pkgJsonPath)) {
+  const pkgPath = join22(process.cwd(), "node_modules", ...packageName.split("/"));
+  const pkgJsonPath = join22(pkgPath, "package.json");
+  if (!existsSync24(pkgJsonPath)) {
     const pm = detectPackageManager(process.cwd());
     const installSpinner = ora11("Installing package...").start();
     try {
-      await execa7(pm, ["add", packageName]);
+      await execa9(pm, ["add", packageName]);
       installSpinner.succeed("Package installed");
     } catch (error) {
       installSpinner.fail("Failed to install package");
-      console.error(chalk26.red(error instanceof Error ? error.message : "Unknown error"));
+      console.error(chalk27.red(error instanceof Error ? error.message : "Unknown error"));
       process.exit(1);
     }
   } else {
-    console.log(chalk26.gray("\u2713 Package already installed (using local version)\n"));
+    console.log(chalk27.gray("\u2713 Package already installed (using local version)\n"));
   }
-  if (!existsSync21(pkgJsonPath)) {
-    console.error(chalk26.red(`\u274C Package ${packageName} not found after installation`));
+  if (!existsSync24(pkgJsonPath)) {
+    console.error(chalk27.red(`\u274C Package ${packageName} not found after installation`));
     process.exit(1);
   }
-  const pkgJson = JSON.parse(readFileSync8(pkgJsonPath, "utf-8"));
+  const pkgJson = JSON.parse(readFileSync11(pkgJsonPath, "utf-8"));
   if (pkgJson.spfn?.migrations) {
-    console.log(chalk26.blue(`
+    console.log(chalk27.blue(`
 \u{1F5C4}\uFE0F  Setting up database for ${packageName}...
 `));
     const { env: env8 } = await import("@spfn/core/config");
     if (!env8.DATABASE_URL) {
-      console.log(chalk26.yellow("\u26A0\uFE0F  DATABASE_URL not found"));
-      console.log(chalk26.gray("Skipping database setup. Run migrations manually when ready:\n"));
-      console.log(chalk26.gray("  pnpm spfn db push\n"));
+      console.log(chalk27.yellow("\u26A0\uFE0F  DATABASE_URL not found"));
+      console.log(chalk27.gray("Skipping database setup. Run migrations manually when ready:\n"));
+      console.log(chalk27.gray("  pnpm spfn db push\n"));
     } else {
       const { discoverFunctionMigrations: discoverFunctionMigrations2, executeFunctionMigrations: executeFunctionMigrations2 } = await Promise.resolve().then(() => (init_function_migrations(), function_migrations_exports));
       const functions = discoverFunctionMigrations2(process.cwd());
@@ -3721,21 +4200,21 @@ async function addPackage(packageName) {
           spinner.succeed("Migrations applied");
         } catch (error) {
           spinner.fail("Failed to apply migrations");
-          console.error(chalk26.red(error instanceof Error ? error.message : "Unknown error"));
+          console.error(chalk27.red(error instanceof Error ? error.message : "Unknown error"));
           process.exit(1);
         }
       } else {
-        console.log(chalk26.gray("\u2139\uFE0F  No migrations found for this package"));
+        console.log(chalk27.gray("\u2139\uFE0F  No migrations found for this package"));
       }
     }
   } else {
-    console.log(chalk26.gray("\n\u2139\uFE0F  No database migrations to apply"));
+    console.log(chalk27.gray("\n\u2139\uFE0F  No database migrations to apply"));
   }
-  console.log(chalk26.green(`
+  console.log(chalk27.green(`
 \u2705 ${packageName} installed successfully!
 `));
   if (pkgJson.spfn?.setupMessage) {
-    console.log(chalk26.cyan("\u{1F4DA} Setup Guide:"));
+    console.log(chalk27.cyan("\u{1F4DA} Setup Guide:"));
     console.log(pkgJson.spfn.setupMessage);
     console.log();
   }
@@ -3744,11 +4223,43 @@ var addCommand = new Command10("add").description("Install and set up SPFN ecosy
 
 // src/commands/env.ts
 import { Command as Command11 } from "commander";
-import chalk27 from "chalk";
-import { existsSync as existsSync22, readFileSync as readFileSync9, writeFileSync as writeFileSync13 } from "fs";
+import chalk28 from "chalk";
+import { existsSync as existsSync25, readFileSync as readFileSync12, writeFileSync as writeFileSync16 } from "fs";
 import { resolve as resolve2 } from "path";
-import { parse } from "dotenv";
+import { parse as parse2 } from "dotenv";
+
+// src/utils/env-schema.ts
 var VALID_ENVS = ["local", "development", "staging", "production", "test"];
+async function loadEnvSchema(packageName) {
+  try {
+    const module = await import(`${packageName}/config`);
+    if (!module.envSchema) {
+      throw new Error(`Package ${packageName} does not export envSchema from config`);
+    }
+    return module.envSchema;
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("does not export envSchema")) {
+      throw error;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to load package ${packageName}: ${message}`);
+  }
+}
+function getTargetFile(schema) {
+  const isNextjs = schema.nextjs ?? schema.key?.startsWith("NEXT_PUBLIC_");
+  if (isNextjs) {
+    return schema.sensitive ? ".env.local" : ".env";
+  }
+  return ".env.server";
+}
+function secretEntries(schema) {
+  return Object.values(schema).filter((entry) => entry.sensitive);
+}
+function generatableSecrets(schema) {
+  return secretEntries(schema).filter((entry) => !!entry.generate);
+}
+
+// src/commands/env.ts
 var BASE_ENV_FILES = {
   nextjs: [".env", ".env.local"],
   server: [".env.server"]
@@ -3767,51 +4278,28 @@ function getEnvFilesForEnvironment(nodeEnv) {
   files.push(".env.server");
   return files;
 }
-function getTargetFile(schema) {
-  const isNextjs = schema.nextjs ?? schema.key?.startsWith("NEXT_PUBLIC_");
-  if (isNextjs) {
-    return schema.sensitive ? ".env.local" : ".env";
-  }
-  return ".env.server";
-}
-async function loadEnvSchema(packageName) {
-  try {
-    const schemaPath = `${packageName}/config`;
-    const module = await import(schemaPath);
-    if (!module.envSchema) {
-      throw new Error(`Package ${packageName} does not export envSchema from config`);
-    }
-    return module.envSchema;
-  } catch (error) {
-    if (error instanceof Error && error.message.includes("does not export envSchema")) {
-      throw error;
-    }
-    const errorMessage = error instanceof Error ? error.message : String(error);
-    throw new Error(`Failed to load package ${packageName}: ${errorMessage}`);
-  }
-}
 function formatType(type) {
   const typeColors = {
-    string: chalk27.green,
-    number: chalk27.blue,
-    boolean: chalk27.yellow,
-    url: chalk27.cyan,
-    enum: chalk27.magenta,
-    json: chalk27.red
+    string: chalk28.green,
+    number: chalk28.blue,
+    boolean: chalk28.yellow,
+    url: chalk28.cyan,
+    enum: chalk28.magenta,
+    json: chalk28.red
   };
-  return (typeColors[type] || chalk27.white)(type);
+  return (typeColors[type] || chalk28.white)(type);
 }
 function formatDefault(value, type) {
   if (value === void 0) {
-    return chalk27.dim("(none)");
+    return chalk28.dim("(none)");
   }
   if (type === "string" || type === "url") {
-    return chalk27.green(`"${value}"`);
+    return chalk28.green(`"${value}"`);
   }
   if (type === "boolean") {
-    return value ? chalk27.green("true") : chalk27.red("false");
+    return value ? chalk28.green("true") : chalk28.red("false");
   }
-  return chalk27.cyan(String(value));
+  return chalk28.cyan(String(value));
 }
 async function listEnvVars(options) {
   const packageName = options.package || "@spfn/core";
@@ -3825,28 +4313,28 @@ async function listEnvVars(options) {
         acc[target].push([key, schema]);
         return acc;
       }, {});
-      console.log(chalk27.blue.bold(`
+      console.log(chalk28.blue.bold(`
 \u{1F4CB} Environment Variables by File (${packageName})
 `));
       for (const [file, vars] of Object.entries(grouped)) {
-        console.log(chalk27.bold.magenta(`
+        console.log(chalk28.bold.magenta(`
 ${file}`));
-        console.log(chalk27.dim("\u2500".repeat(50)));
+        console.log(chalk28.dim("\u2500".repeat(50)));
         for (const [key, schema] of vars) {
           printEnvVar(key, schema);
         }
       }
     } else {
-      console.log(chalk27.blue.bold(`
+      console.log(chalk28.blue.bold(`
 \u{1F4CB} Environment Variables (${packageName})
 `));
       for (const [key, schema] of allVars) {
         printEnvVar(key, schema, true);
       }
     }
-    console.log(chalk27.dim("\n\u{1F4A1} Tip: Use `spfn env init` to generate .env template files\n"));
+    console.log(chalk28.dim("\n\u{1F4A1} Tip: Use `spfn env init` to generate .env template files\n"));
   } catch (error) {
-    console.error(chalk27.red(`
+    console.error(chalk28.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -3854,17 +4342,17 @@ ${file}`));
 }
 function printEnvVar(key, schema, showFile = false) {
   const typeStr = formatType(schema.type);
-  const requiredStr = schema.required || schema.default !== void 0 ? chalk27.red("[required]") : chalk27.dim("[optional]");
-  const sensitiveStr = schema.sensitive ? chalk27.yellow(" [sensitive]") : "";
-  const fileStr = showFile ? chalk27.dim(` \u2192 ${getTargetFile(schema)}`) : "";
-  console.log(`${chalk27.bold.cyan(key)} ${chalk27.dim("(")}${typeStr}${chalk27.dim(")")} ${requiredStr}${sensitiveStr}${fileStr}`);
-  console.log(`  ${chalk27.dim(schema.description)}`);
+  const requiredStr = schema.required || schema.default !== void 0 ? chalk28.red("[required]") : chalk28.dim("[optional]");
+  const sensitiveStr = schema.sensitive ? chalk28.yellow(" [sensitive]") : "";
+  const fileStr = showFile ? chalk28.dim(` \u2192 ${getTargetFile(schema)}`) : "";
+  console.log(`${chalk28.bold.cyan(key)} ${chalk28.dim("(")}${typeStr}${chalk28.dim(")")} ${requiredStr}${sensitiveStr}${fileStr}`);
+  console.log(`  ${chalk28.dim(schema.description)}`);
   if (schema.default !== void 0) {
-    console.log(`  ${chalk27.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
+    console.log(`  ${chalk28.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
   }
   if (schema.examples && schema.examples.length > 0) {
     const exampleStr = schema.examples.map((ex) => formatDefault(ex, schema.type)).join(", ");
-    console.log(`  ${chalk27.dim("Examples:")} ${exampleStr}`);
+    console.log(`  ${chalk28.dim("Examples:")} ${exampleStr}`);
   }
   console.log();
 }
@@ -3872,7 +4360,7 @@ async function showEnvStats(options) {
   const packageName = options.package || "@spfn/core";
   try {
     const envSchema = await loadEnvSchema(packageName);
-    console.log(chalk27.blue.bold(`
+    console.log(chalk28.blue.bold(`
 \u{1F4CA} Environment Variable Statistics (${packageName})
 `));
     const allVars = Object.entries(envSchema);
@@ -3894,24 +4382,24 @@ async function showEnvStats(options) {
       acc[file] = (acc[file] || 0) + 1;
       return acc;
     }, {});
-    console.log(`${chalk27.bold("Total variables:")} ${chalk27.cyan(allVars.length)}`);
-    console.log(`${chalk27.bold("Required:")} ${chalk27.red(required.length)}`);
-    console.log(`${chalk27.bold("Optional:")} ${chalk27.dim(optional.length)}`);
-    console.log(`${chalk27.bold("Sensitive:")} ${chalk27.yellow(sensitive.length)}`);
-    console.log(chalk27.bold("\nBy Target:"));
-    console.log(`  ${chalk27.blue("Next.js accessible:")} ${chalk27.cyan(nextjsVars.length)}`);
-    console.log(`  ${chalk27.magenta("SPFN server only:")} ${chalk27.cyan(serverOnlyVars.length)}`);
-    console.log(chalk27.bold("\nBy File:"));
+    console.log(`${chalk28.bold("Total variables:")} ${chalk28.cyan(allVars.length)}`);
+    console.log(`${chalk28.bold("Required:")} ${chalk28.red(required.length)}`);
+    console.log(`${chalk28.bold("Optional:")} ${chalk28.dim(optional.length)}`);
+    console.log(`${chalk28.bold("Sensitive:")} ${chalk28.yellow(sensitive.length)}`);
+    console.log(chalk28.bold("\nBy Target:"));
+    console.log(`  ${chalk28.blue("Next.js accessible:")} ${chalk28.cyan(nextjsVars.length)}`);
+    console.log(`  ${chalk28.magenta("SPFN server only:")} ${chalk28.cyan(serverOnlyVars.length)}`);
+    console.log(chalk28.bold("\nBy File:"));
     for (const [file, count] of Object.entries(fileCount)) {
-      console.log(`  ${chalk27.dim(file)}: ${chalk27.cyan(count)}`);
+      console.log(`  ${chalk28.dim(file)}: ${chalk28.cyan(count)}`);
     }
-    console.log(chalk27.bold("\nBy Type:"));
+    console.log(chalk28.bold("\nBy Type:"));
     for (const [type, count] of Object.entries(typeCount)) {
-      console.log(`  ${formatType(type)}: ${chalk27.cyan(count)}`);
+      console.log(`  ${formatType(type)}: ${chalk28.cyan(count)}`);
     }
     console.log();
   } catch (error) {
-    console.error(chalk27.red(`
+    console.error(chalk28.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -3931,26 +4419,26 @@ async function searchEnvVars(query, options) {
       }
     }
     if (results.length === 0) {
-      console.log(chalk27.yellow(`
+      console.log(chalk28.yellow(`
 \u26A0\uFE0F  No environment variables found matching "${query}"
 `));
       return;
     }
-    console.log(chalk27.blue.bold(`
+    console.log(chalk28.blue.bold(`
 \u{1F50D} Found ${results.length} environment variable(s) matching "${query}"
 `));
     for (const [key, schema] of results) {
       const typeStr = formatType(schema.type);
-      const requiredStr = schema.required || schema.default !== void 0 ? chalk27.red("[required]") : chalk27.dim("[optional]");
-      console.log(`${chalk27.bold.cyan(key)} ${chalk27.dim("(")}${typeStr}${chalk27.dim(")")} ${requiredStr}`);
-      console.log(`  ${chalk27.dim(schema.description)}`);
+      const requiredStr = schema.required || schema.default !== void 0 ? chalk28.red("[required]") : chalk28.dim("[optional]");
+      console.log(`${chalk28.bold.cyan(key)} ${chalk28.dim("(")}${typeStr}${chalk28.dim(")")} ${requiredStr}`);
+      console.log(`  ${chalk28.dim(schema.description)}`);
       if (schema.default !== void 0) {
-        console.log(`  ${chalk27.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
+        console.log(`  ${chalk28.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
       }
       console.log();
     }
   } catch (error) {
-    console.error(chalk27.red(`
+    console.error(chalk28.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -3962,9 +4450,9 @@ envCommand.command("stats").description("Show environment variable statistics").
 envCommand.command("search").description("Search environment variables").argument("<query>", "Search query (matches key or description)").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").action(searchEnvVars);
 function validateEnvOption(envValue) {
   if (!VALID_ENVS.includes(envValue)) {
-    console.error(chalk27.red(`
+    console.error(chalk28.red(`
 \u274C Invalid environment: "${envValue}"`));
-    console.log(chalk27.dim(`   Valid values: ${VALID_ENVS.join(", ")}
+    console.log(chalk28.dim(`   Valid values: ${VALID_ENVS.join(", ")}
 `));
     process.exit(1);
   }
@@ -3985,8 +4473,8 @@ async function initEnvFiles(options) {
       return acc;
     }, {});
     if (targetEnv) {
-      console.log(chalk27.blue.bold(`
-\u{1F680} Generating .env template files for ${chalk27.cyan(targetEnv)} environment
+      console.log(chalk28.blue.bold(`
+\u{1F680} Generating .env template files for ${chalk28.cyan(targetEnv)} environment
 `));
       const envSpecificFiles = {};
       const committedVars = allVars.filter(([_, schema]) => !schema.sensitive);
@@ -4002,24 +4490,24 @@ async function initEnvFiles(options) {
         writeEnvTemplate(cwd, file, vars, options.force ?? false);
       }
     } else {
-      console.log(chalk27.blue.bold(`
+      console.log(chalk28.blue.bold(`
 \u{1F680} Generating .env template files
 `));
       for (const [file, vars] of Object.entries(grouped)) {
         writeEnvTemplate(cwd, file, vars, options.force ?? false);
       }
     }
-    console.log(chalk27.dim("\n\u{1F4A1} Copy .example files to create your actual .env files:"));
-    console.log(chalk27.dim("   cp .env.example .env"));
-    console.log(chalk27.dim("   cp .env.local.example .env.local"));
-    console.log(chalk27.dim("   cp .env.server.example .env.server"));
+    console.log(chalk28.dim("\n\u{1F4A1} Copy .example files to create your actual .env files:"));
+    console.log(chalk28.dim("   cp .env.example .env"));
+    console.log(chalk28.dim("   cp .env.local.example .env.local"));
+    console.log(chalk28.dim("   cp .env.server.example .env.server"));
     if (targetEnv) {
-      console.log(chalk27.dim(`   cp .env.${targetEnv}.example .env.${targetEnv}`));
-      console.log(chalk27.dim(`   cp .env.${targetEnv}.local.example .env.${targetEnv}.local`));
+      console.log(chalk28.dim(`   cp .env.${targetEnv}.example .env.${targetEnv}`));
+      console.log(chalk28.dim(`   cp .env.${targetEnv}.local.example .env.${targetEnv}.local`));
     }
     console.log("");
   } catch (error) {
-    console.error(chalk27.red(`
+    console.error(chalk28.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4027,12 +4515,12 @@ async function initEnvFiles(options) {
 }
 function writeEnvTemplate(cwd, file, vars, force) {
   const filePath = resolve2(cwd, file);
-  if (existsSync22(filePath) && !force) {
-    console.log(chalk27.yellow(`  \u23ED\uFE0F  ${file} already exists (use --force to overwrite)`));
+  if (existsSync25(filePath) && !force) {
+    console.log(chalk28.yellow(`  \u23ED\uFE0F  ${file} already exists (use --force to overwrite)`));
     return;
   }
-  writeFileSync13(filePath, generateEnvFileContent(vars), "utf-8");
-  console.log(chalk27.green(`  \u2705 ${file} (${vars.length} variables)`));
+  writeFileSync16(filePath, generateEnvFileContent(vars), "utf-8");
+  console.log(chalk28.green(`  \u2705 ${file} (${vars.length} variables)`));
 }
 function generateEnvFileContent(vars) {
   const lines = [
@@ -4067,7 +4555,7 @@ async function checkEnvFiles(options) {
     const envSchema = await loadEnvSchema(packageName);
     const allVars = Object.entries(envSchema);
     const envLabel = targetEnv ? ` (${targetEnv})` : "";
-    console.log(chalk27.blue.bold(`
+    console.log(chalk28.blue.bold(`
 \u{1F50D} Checking .env files against schema${envLabel}
 `));
     const filesToCheck = targetEnv ? getEnvFilesForEnvironment(targetEnv) : [...BASE_ENV_FILES.nextjs, ...BASE_ENV_FILES.server];
@@ -4076,15 +4564,15 @@ async function checkEnvFiles(options) {
     const warnings = [];
     for (const file of filesToCheck) {
       const filePath = resolve2(cwd, file);
-      if (!existsSync22(filePath)) {
+      if (!existsSync25(filePath)) {
         continue;
       }
-      const content = readFileSync9(filePath, "utf-8");
-      const parsed = parse(content);
+      const content = readFileSync12(filePath, "utf-8");
+      const parsed = parse2(content);
       for (const [key, value] of Object.entries(parsed)) {
         loadedEnv[key] = { value: value || "", file };
       }
-      console.log(chalk27.dim(`  \u{1F4C4} ${file} loaded`));
+      console.log(chalk28.dim(`  \u{1F4C4} ${file} loaded`));
     }
     console.log("");
     for (const [key, schema] of allVars) {
@@ -4092,7 +4580,7 @@ async function checkEnvFiles(options) {
       const found = loadedEnv[key];
       if (!found) {
         if (schema.required && schema.default === void 0) {
-          issues.push(`${chalk27.red("\u2717")} ${chalk27.cyan(key)} is required but not found in any .env file`);
+          issues.push(`${chalk28.red("\u2717")} ${chalk28.cyan(key)} is required but not found in any .env file`);
         }
         continue;
       }
@@ -4102,11 +4590,11 @@ async function checkEnvFiles(options) {
       if (!shouldBeNextjs && isNextjsFile && !isServerFile) {
         if (schema.sensitive) {
           issues.push(
-            `${chalk27.red("\u2717")} ${chalk27.cyan(key)} is sensitive and should be in ${chalk27.magenta(expectedFile)}, but found in ${chalk27.yellow(found.file)} (security risk!)`
+            `${chalk28.red("\u2717")} ${chalk28.cyan(key)} is sensitive and should be in ${chalk28.magenta(expectedFile)}, but found in ${chalk28.yellow(found.file)} (security risk!)`
           );
         } else {
           warnings.push(
-            `${chalk27.yellow("\u26A0")} ${chalk27.cyan(key)} should be in ${chalk27.magenta(expectedFile)}, but found in ${chalk27.dim(found.file)}`
+            `${chalk28.yellow("\u26A0")} ${chalk28.cyan(key)} should be in ${chalk28.magenta(expectedFile)}, but found in ${chalk28.dim(found.file)}`
           );
         }
       }
@@ -4114,34 +4602,34 @@ async function checkEnvFiles(options) {
     for (const [key, { file }] of Object.entries(loadedEnv)) {
       const inSchema = allVars.some(([k]) => k === key);
       if (!inSchema) {
-        warnings.push(`${chalk27.yellow("\u26A0")} ${chalk27.cyan(key)} in ${chalk27.dim(file)} is not in schema`);
+        warnings.push(`${chalk28.yellow("\u26A0")} ${chalk28.cyan(key)} in ${chalk28.dim(file)} is not in schema`);
       }
     }
     if (issues.length > 0) {
-      console.log(chalk27.red.bold("Issues:"));
+      console.log(chalk28.red.bold("Issues:"));
       for (const issue of issues) {
         console.log(`  ${issue}`);
       }
       console.log("");
     }
     if (warnings.length > 0) {
-      console.log(chalk27.yellow.bold("Warnings:"));
+      console.log(chalk28.yellow.bold("Warnings:"));
       for (const warning of warnings) {
         console.log(`  ${warning}`);
       }
       console.log("");
     }
     if (issues.length === 0 && warnings.length === 0) {
-      console.log(chalk27.green("\u2705 All environment variables are correctly configured!\n"));
+      console.log(chalk28.green("\u2705 All environment variables are correctly configured!\n"));
     } else {
-      console.log(chalk27.dim(`Found ${issues.length} issue(s) and ${warnings.length} warning(s)
+      console.log(chalk28.dim(`Found ${issues.length} issue(s) and ${warnings.length} warning(s)
 `));
       if (issues.length > 0) {
         process.exit(1);
       }
     }
   } catch (error) {
-    console.error(chalk27.red(`
+    console.error(chalk28.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4155,15 +4643,15 @@ async function validateEnvVars(options) {
   if (targetEnv) {
     const { loadEnv: loadEnv9 } = await import("@spfn/core/env/loader");
     const result = loadEnv9({ nodeEnv: targetEnv });
-    console.log(chalk27.blue.bold(`
-\u{1F50D} Validating environment variables for ${chalk27.cyan(targetEnv)}
+    console.log(chalk28.blue.bold(`
+\u{1F50D} Validating environment variables for ${chalk28.cyan(targetEnv)}
 `));
     if (result.loadedFiles.length > 0) {
-      console.log(chalk27.dim(`  Loaded: ${result.loadedFiles.join(", ")}`));
+      console.log(chalk28.dim(`  Loaded: ${result.loadedFiles.join(", ")}`));
     }
     console.log("");
   } else {
-    console.log(chalk27.blue.bold(`
+    console.log(chalk28.blue.bold(`
 \u{1F50D} Validating environment variables
 `));
   }
@@ -4171,7 +4659,7 @@ async function validateEnvVars(options) {
   const allWarnings = [];
   for (const packageName of packages) {
     try {
-      console.log(chalk27.dim(`  \u{1F4E6} ${packageName}`));
+      console.log(chalk28.dim(`  \u{1F4E6} ${packageName}`));
       const envSchema = await loadEnvSchema(packageName);
       const { createEnvRegistry } = await import("@spfn/core/env");
       const registry = createEnvRegistry(envSchema);
@@ -4184,10 +4672,10 @@ async function validateEnvVars(options) {
       }
     } catch (error) {
       if (error instanceof Error && error.message.includes("does not export envSchema")) {
-        console.log(chalk27.dim(`    \u23ED\uFE0F  No envSchema exported, skipping`));
+        console.log(chalk28.dim(`    \u23ED\uFE0F  No envSchema exported, skipping`));
         continue;
       }
-      console.error(chalk27.red(`    \u274C Failed to load: ${error instanceof Error ? error.message : String(error)}`));
+      console.error(chalk28.red(`    \u274C Failed to load: ${error instanceof Error ? error.message : String(error)}`));
       if (options.strict) {
         process.exit(1);
       }
@@ -4195,32 +4683,32 @@ async function validateEnvVars(options) {
   }
   console.log("");
   if (allErrors.length > 0) {
-    console.log(chalk27.red.bold(`\u274C Validation Errors (${allErrors.length}):
+    console.log(chalk28.red.bold(`\u274C Validation Errors (${allErrors.length}):
 `));
     for (const error of allErrors) {
-      console.log(`  ${chalk27.red("\u2717")} ${chalk27.cyan(error.key)}`);
-      console.log(`    ${chalk27.dim(error.message)}`);
-      console.log(`    ${chalk27.dim(`from ${error.package}`)}`);
+      console.log(`  ${chalk28.red("\u2717")} ${chalk28.cyan(error.key)}`);
+      console.log(`    ${chalk28.dim(error.message)}`);
+      console.log(`    ${chalk28.dim(`from ${error.package}`)}`);
       console.log("");
     }
   }
   if (allWarnings.length > 0) {
-    console.log(chalk27.yellow.bold(`\u26A0\uFE0F  Warnings (${allWarnings.length}):
+    console.log(chalk28.yellow.bold(`\u26A0\uFE0F  Warnings (${allWarnings.length}):
 `));
     for (const warning of allWarnings) {
-      console.log(`  ${chalk27.yellow("\u26A0")} ${chalk27.cyan(warning.key)}`);
-      console.log(`    ${chalk27.dim(warning.message)}`);
+      console.log(`  ${chalk28.yellow("\u26A0")} ${chalk28.cyan(warning.key)}`);
+      console.log(`    ${chalk28.dim(warning.message)}`);
       console.log("");
     }
   }
   if (allErrors.length === 0 && allWarnings.length === 0) {
-    console.log(chalk27.green.bold("\u2705 All environment variables are valid!\n"));
+    console.log(chalk28.green.bold("\u2705 All environment variables are valid!\n"));
   } else if (allErrors.length === 0) {
-    console.log(chalk27.green("\u2705 No errors found."));
-    console.log(chalk27.yellow(`\u26A0\uFE0F  ${allWarnings.length} warning(s) found.
+    console.log(chalk28.green("\u2705 No errors found."));
+    console.log(chalk28.yellow(`\u26A0\uFE0F  ${allWarnings.length} warning(s) found.
 `));
   } else {
-    console.log(chalk27.red(`
+    console.log(chalk28.red(`
 \u274C Validation failed with ${allErrors.length} error(s)
 `));
     process.exit(1);
@@ -4228,9 +4716,591 @@ async function validateEnvVars(options) {
 }
 envCommand.command("validate").description("Validate environment variables against schema (for CI/CD)").option("-p, --packages <packages...>", "Packages to validate", ["@spfn/core"]).option("-e, --env <environment>", "Load env files for specific environment before validating").option("-s, --strict", "Exit on any error (including load failures)").action(validateEnvVars);
 
+// src/commands/secret/index.ts
+import { Command as Command12 } from "commander";
+
+// src/commands/secret/set.ts
+init_logger();
+import prompts8 from "prompts";
+import chalk29 from "chalk";
+
+// src/commands/secret/options.ts
+init_logger();
+function resolveEnv(env8) {
+  const value = env8 ?? "local";
+  if (!VALID_ENVS.includes(value)) {
+    logger.error(`Invalid environment: "${value}". Valid values: ${VALID_ENVS.join(", ")}`);
+    process.exit(1);
+  }
+  return value;
+}
+
+// src/commands/secret/store-value.ts
+init_logger();
+import { join as join24 } from "path";
+init_env_file();
+
+// src/utils/sops.ts
+import { execa as execa10 } from "execa";
+import { existsSync as existsSync26, mkdirSync as mkdirSync3, writeFileSync as writeFileSync17 } from "fs";
+import { dirname as dirname3 } from "path";
+async function ensureSopsInstalled() {
+  try {
+    await execa10("sops", ["--version"]);
+  } catch {
+    throw new Error("`sops` not found on PATH. Install it: https://github.com/getsops/sops");
+  }
+}
+async function sopsDecrypt(absFile) {
+  if (!existsSync26(absFile)) {
+    return {};
+  }
+  const { stdout } = await execa10("sops", ["--decrypt", "--output-type", "json", absFile]);
+  return JSON.parse(stdout);
+}
+async function sopsSetValue(absFile, relFile, key, value) {
+  if (existsSync26(absFile)) {
+    await execa10("sops", ["set", absFile, `["${key}"]`, JSON.stringify(value)]);
+    return;
+  }
+  mkdirSync3(dirname3(absFile), { recursive: true });
+  const { stdout } = await execa10(
+    "sops",
+    [
+      "--encrypt",
+      "--input-type",
+      "json",
+      "--output-type",
+      "json",
+      "--filename-override",
+      relFile,
+      "/dev/stdin"
+    ],
+    { input: JSON.stringify({ [key]: value }) }
+  );
+  writeFileSync17(absFile, stdout);
+}
+async function sopsUpdateKeys(absFile) {
+  await execa10("sops", ["updatekeys", "-y", absFile]);
+}
+
+// src/utils/secret-config.ts
+import { existsSync as existsSync27, readdirSync as readdirSync3 } from "fs";
+import { join as join23 } from "path";
+var SECRETS_DIR = "secrets";
+function getSopsFile(cwd, env8) {
+  const relFile = `${SECRETS_DIR}/${env8}.enc.json`;
+  return { absFile: join23(cwd, relFile), relFile };
+}
+function findUp(cwd, filename, maxDepth = 6) {
+  let dir = cwd;
+  for (let depth = 0; depth < maxDepth; depth++) {
+    if (existsSync27(join23(dir, filename))) {
+      return dir;
+    }
+    const parent = join23(dir, "..");
+    if (parent === dir) {
+      break;
+    }
+    dir = parent;
+  }
+  return null;
+}
+function findSopsConfig(cwd) {
+  const dir = findUp(cwd, ".sops.yaml");
+  return dir ? join23(dir, ".sops.yaml") : null;
+}
+function hasSopsConfig(cwd) {
+  return findSopsConfig(cwd) !== null;
+}
+function listSopsFiles(cwd) {
+  const dir = join23(cwd, SECRETS_DIR);
+  if (!existsSync27(dir)) {
+    return [];
+  }
+  return readdirSync3(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join23(dir, name));
+}
+
+// src/commands/secret/store-value.ts
+function isLocalEnv(env8) {
+  return env8 === "local";
+}
+var KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function assertValidKey(key) {
+  if (!KEY_PATTERN.test(key)) {
+    throw new Error(`Invalid secret key "${key}". Use an env-var name: letters, digits, and underscores, not starting with a digit.`);
+  }
+}
+async function describeTarget(env8) {
+  if (isLocalEnv(env8)) {
+    return detectStore().label;
+  }
+  return `SOPS (${getSopsFile(process.cwd(), env8).relFile})`;
+}
+async function storeSecret(cwd, env8, key, value) {
+  assertValidKey(key);
+  if (isLocalEnv(env8)) {
+    const store = detectStore();
+    if (!await store.isAvailable()) {
+      throw new Error(
+        `${store.label} is unavailable on this machine. On Windows install \`@napi-rs/keyring\`; on headless Linux no keyring daemon is present.`
+      );
+    }
+    await store.set(keychainName(key), value);
+    const serverEnvPath = join24(cwd, ".env.server");
+    const result = upsertEnvVar(serverEnvPath, key, keychainRef(key));
+    restrictEnvFilePerms(serverEnvPath);
+    ensureGitignored(cwd, [{ pattern: ".env.server", comment: "spfn server env (secrets)" }]);
+    logger.success(`Stored ${key} in ${store.label}; .env.server ${result} the reference.`);
+    return;
+  }
+  await ensureSopsInstalled();
+  if (!hasSopsConfig(cwd)) {
+    logger.warn(
+      ".sops.yaml not found \u2014 add a backend (run `spfn secret keygen` for age, or a KMS rule) so the file can be decrypted on deploy."
+    );
+  }
+  const { absFile, relFile } = getSopsFile(cwd, env8);
+  await sopsSetValue(absFile, relFile, key, value);
+  logger.success(`Set ${key} in ${relFile} (encrypted). Commit and deploy to apply.`);
+}
+
+// src/commands/secret/set.ts
+async function secretSet(key, options) {
+  const env8 = resolveEnv(options.env);
+  const pkg = options.package ?? "@spfn/core";
+  const resolvedKey = key ?? await pickSecretKey(pkg);
+  if (!resolvedKey) {
+    logger.error("No secret key provided.");
+    process.exit(1);
+  }
+  await warnIfNotSecret(pkg, resolvedKey);
+  const { value } = await prompts8({
+    type: "password",
+    name: "value",
+    message: `Value for ${chalk29.cyan(resolvedKey)} (${env8})`
+  });
+  if (!value) {
+    logger.warn("Cancelled \u2014 no value entered.");
+    process.exit(0);
+  }
+  logger.step(`Storing ${resolvedKey} \u2192 ${await describeTarget(env8)}`);
+  try {
+    await storeSecret(process.cwd(), env8, resolvedKey, value);
+  } catch (error) {
+    logger.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+}
+async function pickSecretKey(pkg) {
+  let entries;
+  try {
+    entries = secretEntries(await loadEnvSchema(pkg));
+  } catch {
+    return void 0;
+  }
+  if (entries.length === 0) {
+    return void 0;
+  }
+  const { key } = await prompts8({
+    type: "select",
+    name: "key",
+    message: "Which secret?",
+    choices: entries.map((entry) => ({
+      title: entry.key,
+      description: entry.description,
+      value: entry.key
+    }))
+  });
+  return key;
+}
+async function warnIfNotSecret(pkg, key) {
+  try {
+    const schema = await loadEnvSchema(pkg);
+    const entry = schema[key];
+    if (entry && !entry.sensitive) {
+      logger.warn(`${key} is not marked as a secret in ${pkg}. Consider declaring it with envSecret().`);
+    }
+  } catch {
+  }
+}
+
+// src/commands/secret/list.ts
+init_logger();
+import chalk30 from "chalk";
+async function secretList(options) {
+  const env8 = resolveEnv(options.env);
+  const pkg = options.package ?? "@spfn/core";
+  let entries;
+  try {
+    entries = secretEntries(await loadEnvSchema(pkg));
+  } catch (error) {
+    logger.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+  if (entries.length === 0) {
+    logger.info(`No secrets declared in ${pkg}.`);
+    return;
+  }
+  const present = await loadPresence(env8, entries);
+  console.log(chalk30.blue.bold(`
+\u{1F511} Secrets (${pkg}) \u2014 ${env8}
+`));
+  for (const entry of entries) {
+    const status = statusOf(entry, present.has(entry.key));
+    console.log(`  ${badge(status)} ${chalk30.cyan(entry.key)}${entry.generate ? chalk30.dim(" (generatable)") : ""}`);
+  }
+  console.log();
+}
+async function loadPresence(env8, entries) {
+  if (isLocalEnv(env8)) {
+    const store = detectStore();
+    if (!await store.isAvailable()) {
+      logger.warn(`${store.label} unavailable \u2014 status shown as missing.`);
+      return /* @__PURE__ */ new Set();
+    }
+    const present = /* @__PURE__ */ new Set();
+    for (const entry of entries) {
+      if (await store.get(keychainName(entry.key)) !== null) {
+        present.add(entry.key);
+      }
+    }
+    return present;
+  }
+  await ensureSopsInstalled();
+  const { absFile } = getSopsFile(process.cwd(), env8);
+  const decrypted = await sopsDecrypt(absFile);
+  return new Set(Object.keys(decrypted));
+}
+function statusOf(entry, present) {
+  if (present) {
+    return "set";
+  }
+  return entry.generate ? "missing" : "awaiting-input";
+}
+function badge(status) {
+  switch (status) {
+    case "set":
+      return chalk30.green("\u25CF");
+    case "missing":
+      return chalk30.yellow("\u25CB");
+    case "awaiting-input":
+      return chalk30.red("\u25CB");
+  }
+}
+
+// src/commands/secret/generate.ts
+init_logger();
+import chalk31 from "chalk";
+async function secretGenerate(key, options) {
+  const env8 = resolveEnv(options.env);
+  const pkg = options.package ?? "@spfn/core";
+  let schema;
+  try {
+    schema = await loadEnvSchema(pkg);
+  } catch (error) {
+    logger.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+  const targets = options.all ? generatableSecrets(schema) : [requireGeneratable(schema, key)];
+  if (targets.length === 0) {
+    logger.warn("No generatable secrets found (none declare a `generate` strategy).");
+    return;
+  }
+  logger.step(`Generating ${targets.length} secret(s) \u2192 ${await describeTarget(env8)}`);
+  for (const entry of targets) {
+    const value = generateSecretValue(entry.generate);
+    try {
+      await storeSecret(process.cwd(), env8, entry.key, value);
+    } catch (error) {
+      logger.error(`${entry.key}: ${error instanceof Error ? error.message : String(error)}`);
+      process.exit(1);
+    }
+  }
+}
+function requireGeneratable(schema, key) {
+  if (!key) {
+    logger.error("Provide a KEY, or use --all to generate every generatable secret.");
+    process.exit(1);
+  }
+  const entry = schema[key];
+  if (!entry) {
+    logger.error(`${key} is not declared in the schema.`);
+    process.exit(1);
+  }
+  if (!entry.generate) {
+    logger.error(`${chalk31.cyan(key)} has no generate strategy \u2014 it's an external value. Use \`spfn secret set ${key}\`.`);
+    process.exit(1);
+  }
+  return entry;
+}
+
+// src/commands/secret/rotate.ts
+init_logger();
+import chalk32 from "chalk";
+async function secretRotate(key, options) {
+  const env8 = resolveEnv(options.env);
+  const pkg = options.package ?? "@spfn/core";
+  let schema;
+  try {
+    schema = await loadEnvSchema(pkg);
+  } catch (error) {
+    logger.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+  const targets = options.all ? secretEntries(schema) : [requireEntry(schema, key)];
+  const generatable = targets.filter((entry) => entry.generate);
+  const external = targets.filter((entry) => !entry.generate);
+  if (generatable.length > 0) {
+    logger.step(`Rotating ${generatable.length} secret(s) \u2192 ${await describeTarget(env8)}`);
+    for (const entry of generatable) {
+      try {
+        await storeSecret(process.cwd(), env8, entry.key, generateSecretValue(entry.generate));
+      } catch (error) {
+        logger.error(`${entry.key}: ${error instanceof Error ? error.message : String(error)}`);
+        process.exit(1);
+      }
+    }
+  }
+  for (const entry of external) {
+    logger.warn(`${chalk32.cyan(entry.key)} is external \u2014 reissue it at the provider, then \`spfn secret set ${entry.key} --env ${env8}\`.`);
+  }
+  if (generatable.length > 0) {
+    logger.info("Rotation updates the source only \u2014 commit and deploy to apply.");
+  }
+}
+function requireEntry(schema, key) {
+  if (!key) {
+    logger.error("Provide a KEY, or use --all to rotate every secret.");
+    process.exit(1);
+  }
+  const entry = schema[key];
+  if (!entry) {
+    logger.error(`${key} is not declared in the schema.`);
+    process.exit(1);
+  }
+  return entry;
+}
+
+// src/commands/secret/keygen.ts
+init_logger();
+import { execa as execa11 } from "execa";
+import { existsSync as existsSync28, mkdirSync as mkdirSync4 } from "fs";
+import { homedir } from "os";
+import { dirname as dirname4, join as join25 } from "path";
+import chalk33 from "chalk";
+function ageKeyFile() {
+  return process.env.SOPS_AGE_KEY_FILE ?? join25(homedir(), ".config", "sops", "age", "keys.txt");
+}
+async function ensureAgeInstalled() {
+  try {
+    await execa11("age-keygen", ["--version"]);
+  } catch {
+    throw new Error("`age-keygen` not found on PATH. Install age: https://github.com/FiloSottile/age");
+  }
+}
+function publicKeys(text) {
+  return text.match(/age1[0-9a-z]+/g) ?? [];
+}
+async function secretKeygen() {
+  try {
+    await ensureAgeInstalled();
+  } catch (error) {
+    logger.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+  const keyFile = ageKeyFile();
+  if (existsSync28(keyFile)) {
+    const { stdout } = await execa11("age-keygen", ["-y", keyFile]);
+    logger.warn(`age key file already exists: ${keyFile}`);
+    printPublicKeys(publicKeys(stdout));
+    return;
+  }
+  mkdirSync4(dirname4(keyFile), { recursive: true });
+  const { stderr } = await execa11("age-keygen", ["-o", keyFile]);
+  logger.success(`Created age key: ${keyFile}`);
+  printPublicKeys(publicKeys(stderr));
+}
+function printPublicKeys(keys) {
+  if (keys.length === 0) {
+    logger.warn("Could not read the public key \u2014 run `age-keygen -y <file>` manually.");
+    return;
+  }
+  console.log(chalk33.bold("\nPublic key(s):"));
+  for (const key of keys) {
+    console.log(`  ${chalk33.cyan(key)}`);
+  }
+  console.log(chalk33.dim("\nRegister it as a recipient:"));
+  console.log(chalk33.dim(`  spfn secret recipients add ${keys[0]}
+`));
+}
+
+// src/commands/secret/recipients.ts
+init_logger();
+import { existsSync as existsSync29, readFileSync as readFileSync13, writeFileSync as writeFileSync18 } from "fs";
+import { join as join26 } from "path";
+import { parse as parse3, stringify } from "yaml";
+import chalk34 from "chalk";
+var SOPS_CONFIG = ".sops.yaml";
+var DEFAULT_PATH_REGEX = "secrets/.*\\.enc\\.json$";
+var AGE_RECIPIENT = /^age1[0-9a-z]+$/;
+async function secretRecipients(action, key, _options) {
+  const cwd = process.cwd();
+  const configPath = join26(cwd, SOPS_CONFIG);
+  if (action === "list") {
+    listRecipients(configPath);
+    return;
+  }
+  if (action !== "add" && action !== "remove") {
+    logger.error(`Unknown action "${action}". Use add | remove | list.`);
+    process.exit(1);
+  }
+  if (!key) {
+    logger.error(`A recipient (age1...) is required for \`recipients ${action}\`.`);
+    process.exit(1);
+  }
+  const config = loadConfig(configPath);
+  const rule = ensureRule(config);
+  const recipients = parseRecipients(rule.age);
+  if (action === "add") {
+    if (!AGE_RECIPIENT.test(key)) {
+      logger.error(`"${key}" is not an age recipient (expected age1\u2026). Run \`spfn secret keygen\` to mint one.`);
+      process.exit(1);
+    }
+    recipients.add(key);
+  } else {
+    recipients.delete(key);
+    logger.warn("Removing a recipient does not revoke values they already decrypted \u2014 rotate those values.");
+  }
+  rule.age = [...recipients].join(",");
+  writeFileSync18(configPath, stringify(config));
+  logger.success(`${action === "add" ? "Added" : "Removed"} recipient; updated ${SOPS_CONFIG}.`);
+  await reencrypt(cwd);
+}
+function listRecipients(configPath) {
+  if (!existsSync29(configPath)) {
+    logger.info(`No ${SOPS_CONFIG} found.`);
+    return;
+  }
+  const config = loadConfig(configPath);
+  const rules = config.creation_rules ?? [];
+  console.log(chalk34.blue.bold(`
+\u{1F465} Recipients (${SOPS_CONFIG})
+`));
+  for (const rule of rules) {
+    console.log(chalk34.dim(`  ${rule.path_regex ?? "(any path)"}`));
+    for (const recipient of parseRecipients(rule.age)) {
+      console.log(`    ${chalk34.cyan(recipient)}`);
+    }
+  }
+  console.log();
+}
+function loadConfig(configPath) {
+  if (!existsSync29(configPath)) {
+    return { creation_rules: [] };
+  }
+  return parse3(readFileSync13(configPath, "utf-8")) ?? { creation_rules: [] };
+}
+function ensureRule(config) {
+  if (!config.creation_rules) {
+    config.creation_rules = [];
+  }
+  let rule = config.creation_rules.find((r) => r.path_regex === DEFAULT_PATH_REGEX);
+  if (!rule) {
+    rule = { path_regex: DEFAULT_PATH_REGEX, age: "" };
+    config.creation_rules.push(rule);
+  }
+  return rule;
+}
+function parseRecipients(age) {
+  return new Set(
+    (age ?? "").split(",").map((value) => value.trim()).filter((value) => value.length > 0)
+  );
+}
+async function reencrypt(cwd) {
+  const files = listSopsFiles(cwd);
+  if (files.length === 0) {
+    return;
+  }
+  await ensureSopsInstalled();
+  logger.step(`Re-encrypting ${files.length} secret file(s) for the new recipient set\u2026`);
+  for (const file of files) {
+    await sopsUpdateKeys(file);
+  }
+}
+
+// src/commands/secret/check.ts
+init_logger();
+import { join as join27 } from "path";
+import chalk35 from "chalk";
+init_env_file();
+var COMMITTED_FILES = [".env", ".env.example"];
+var PLACEHOLDER = /(your-|changeme|placeholder|example|<.*>)/i;
+async function secretCheck(options) {
+  const cwd = process.cwd();
+  const pkg = options.package ?? "@spfn/core";
+  let entries;
+  try {
+    entries = secretEntries(await loadEnvSchema(pkg));
+  } catch (error) {
+    logger.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+  const secretKeys = new Set(entries.map((entry) => entry.key));
+  const issues = [];
+  const warnings = [];
+  for (const file of COMMITTED_FILES) {
+    const parsed = parseEnvFile(join27(cwd, file));
+    for (const [key, value] of Object.entries(parsed)) {
+      if (secretKeys.has(key) && value.length > 0 && !PLACEHOLDER.test(value)) {
+        issues.push(`${chalk35.cyan(key)} has a real value in committed ${chalk35.yellow(file)} \u2014 move it to the keychain/SOPS.`);
+      }
+    }
+  }
+  const serverEnv = parseEnvFile(join27(cwd, ".env.server"));
+  for (const key of secretKeys) {
+    const value = serverEnv[key];
+    if (value && !value.startsWith(KEYCHAIN_REF_PREFIX)) {
+      warnings.push(`${chalk35.cyan(key)} is plaintext in .env.server \u2014 run \`spfn secret set ${key}\` to move it to the keychain.`);
+    }
+  }
+  report(issues, warnings, cwd);
+}
+function report(issues, warnings, cwd) {
+  console.log(chalk35.blue.bold("\n\u{1F50D} Secret hygiene check\n"));
+  for (const issue of issues) {
+    console.log(`  ${chalk35.red("\u2717")} ${issue}`);
+  }
+  for (const warning of warnings) {
+    console.log(`  ${chalk35.yellow("\u26A0")} ${warning}`);
+  }
+  if (!hasSopsConfig(cwd)) {
+    console.log(`  ${chalk35.dim("\u2139 no .sops.yaml \u2014 prod secrets need a backend (spfn secret keygen, or add a KMS rule)")}`);
+  }
+  if (issues.length === 0 && warnings.length === 0) {
+    console.log(chalk35.green("  \u2713 No plaintext secret leaks found."));
+  }
+  console.log();
+  if (issues.length > 0) {
+    process.exit(1);
+  }
+}
+
+// src/commands/secret/index.ts
+var ENV_OPTION = ["-e, --env <env>", "Target environment (local | development | staging | production)", "local"];
+var PKG_OPTION = ["-p, --package <package>", "Package whose env schema to read", "@spfn/core"];
+var secretCommand = new Command12("secret").description("Manage secrets: keychain locally, SOPS (age / GCP KMS / AWS KMS) for deployed environments");
+secretCommand.command("set [key]").description("Store a secret value (prompts for the value, masked)").option(...ENV_OPTION).option(...PKG_OPTION).action(secretSet);
+secretCommand.command("list").description("List declared secrets and their status (never prints values)").option(...ENV_OPTION).option(...PKG_OPTION).action(secretList);
+secretCommand.command("generate [key]").description("Generate value(s) for schema secrets that declare a generate strategy").option("-a, --all", "Generate every generatable secret").option(...ENV_OPTION).option(...PKG_OPTION).action(secretGenerate);
+secretCommand.command("rotate [key]").description("Rotate secret value(s); external secrets are flagged for manual reissue").option("-a, --all", "Rotate every secret").option(...ENV_OPTION).option(...PKG_OPTION).action(secretRotate);
+secretCommand.command("keygen").description("Generate an age key pair for SOPS (no-cloud backend)").action(secretKeygen);
+secretCommand.command("recipients <action> [key]").description("Manage .sops.yaml age recipients: add | remove | list").action(secretRecipients);
+secretCommand.command("check").description("Static hygiene lint \u2014 flag plaintext secret leaks").option(...PKG_OPTION).action(secretCheck);
+
 // src/index.ts
 init_version();
-var program = new Command12();
+var program = new Command13();
 program.name("spfn").description("SPFN CLI - The Missing Backend for Next.js").version(getCliVersion());
 program.addCommand(createCommand);
 program.addCommand(initCommand);
@@ -4243,6 +5313,7 @@ program.addCommand(keyCommand);
 program.addCommand(setupCommand);
 program.addCommand(dbCommand);
 program.addCommand(envCommand);
+program.addCommand(secretCommand);
 async function run() {
   await program.parseAsync(process.argv);
 }