spfn 0.2.0-beta.60 → 0.2.0-beta.63

package/dist/index.js

@@ -87,6 +87,44 @@ var init_messages = __esm({
   }
 });
 
+// src/commands/init/mode.ts
+import prompts from "prompts";
+async function selectScaffoldMode(options) {
+  if (options.mode) {
+    return options.mode;
+  }
+  if (options.yes) {
+    return "bare";
+  }
+  const { selectedMode } = await prompts({
+    type: "select",
+    name: "selectedMode",
+    message: "Which SPFN scaffold do you want?",
+    choices: [
+      {
+        title: "full (recommended)",
+        description: "Core, auth, i18n, and MCP \u2014 ready for Prototype to Production",
+        value: "full"
+      },
+      {
+        title: "bare",
+        description: "Core-only full-stack skeleton",
+        value: "bare"
+      }
+    ],
+    initial: 0
+  });
+  if (!selectedMode) {
+    process.exit(0);
+  }
+  return selectedMode;
+}
+var init_mode = __esm({
+  "src/commands/init/mode.ts"() {
+    "use strict";
+  }
+});
+
 // src/commands/setup.ts
 var setup_exports = {};
 __export(setup_exports, {
@@ -387,7 +425,7 @@ var init_setup = __esm({
 // src/commands/init/steps/validate.ts
 import { existsSync as existsSync3 } from "fs";
 import { join as join3 } from "path";
-import prompts from "prompts";
+import prompts2 from "prompts";
 async function validateProject(cwd, skipPrompts) {
   const packageJsonPath = join3(cwd, "package.json");
   if (!existsSync3(packageJsonPath)) {
@@ -401,7 +439,7 @@ async function validateProject(cwd, skipPrompts) {
   if (!hasNext) {
     logger.warn("Next.js not detected in dependencies.");
     if (!skipPrompts) {
-      const { proceed } = await prompts(
+      const { proceed } = await prompts2(
         {
           type: "confirm",
           name: "proceed",
@@ -418,7 +456,7 @@ async function validateProject(cwd, skipPrompts) {
   if (existsSync3(join3(cwd, "src", "server"))) {
     logger.warn("src/server directory already exists.");
     if (!skipPrompts) {
-      const { overwrite } = await prompts(
+      const { overwrite } = await prompts2(
         {
           type: "confirm",
           name: "overwrite",
@@ -432,19 +470,7 @@ async function validateProject(cwd, skipPrompts) {
       }
     }
   }
-  let includeAuth = false;
-  if (!skipPrompts) {
-    const { auth } = await prompts(
-      {
-        type: "confirm",
-        name: "auth",
-        message: "Include authentication (@spfn/auth)?",
-        initial: true
-      }
-    );
-    includeAuth = auth;
-  }
-  return { packageJson, packageJsonPath, includeAuth };
+  return { packageJson, packageJsonPath };
 }
 var init_validate = __esm({
   "src/commands/init/steps/validate.ts"() {
@@ -470,6 +496,10 @@ function findTemplatesPath() {
   if (existsSync4(devPath)) {
     return devPath;
   }
+  const sourcePath = join4(__dirname, "..", "..", "..", "..", "templates");
+  if (existsSync4(sourcePath)) {
+    return sourcePath;
+  }
   throw new Error("Templates directory not found. Please rebuild the package.");
 }
 var __dirname;
@@ -482,10 +512,10 @@ var init_templates = __esm({
 
 // src/commands/init/steps/server-structure.ts
 import { existsSync as existsSync5 } from "fs";
-import { join as join5 } from "path";
+import { join as join5, sep } from "path";
 import ora2 from "ora";
 import fse2 from "fs-extra";
-async function setupServerStructure(cwd) {
+async function setupServerStructure(cwd, mode) {
   const spinner = ora2("Setting up server structure...").start();
   try {
     const templatesDir = findTemplatesPath();
@@ -511,6 +541,27 @@ async function setupServerStructure(cwd) {
       copySync(envConfigTemplate, envConfigTarget);
       logger.success("Created src/server/config/env.config.ts (environment management)");
     }
+    if (mode === "full") {
+      const fullTemplateDir = join5(templatesDir, "modes", "full");
+      if (!existsSync5(fullTemplateDir)) {
+        throw new Error(`Full scaffold templates not found at: ${fullTemplateDir}`);
+      }
+      const fullAppTemplateDir = join5(fullTemplateDir, "src", "app");
+      const fullI18nTemplateDir = join5(fullTemplateDir, "src", "i18n");
+      const mergeOnlyDirs = [fullAppTemplateDir, fullI18nTemplateDir];
+      copySync(fullTemplateDir, cwd, {
+        filter: (source) => !mergeOnlyDirs.some((directory) => source === directory || source.startsWith(`${directory}${sep}`))
+      });
+      const appTargetDir = existsSync5(join5(cwd, "src", "app")) ? join5(cwd, "src", "app") : join5(cwd, "app");
+      copySync(fullAppTemplateDir, appTargetDir, {
+        overwrite: false,
+        errorOnExist: false
+      });
+      copySync(fullI18nTemplateDir, join5(cwd, "src", "i18n"), {
+        overwrite: false,
+        errorOnExist: false
+      });
+    }
     spinner.succeed("Server structure created");
   } catch (error) {
     spinner.fail("Failed to create server structure");
@@ -551,8 +602,10 @@ async function setupApiProxy(cwd, includeAuth) {
     return;
   }
   ensureDirSync3(rpcDir);
-  const authImport = includeAuth ? `import '@spfn/auth/nextjs/api';
+  const authImports = includeAuth ? `import '@spfn/auth/nextjs/api';
+import { authRouteMap } from '@spfn/auth';
 ` : "";
+  const proxyRouteMap = includeAuth ? "{ ...routeMap, ...authRouteMap }" : "routeMap";
   const routeContent = `/**
  * SPFN RPC Proxy
  *
@@ -566,10 +619,10 @@ async function setupApiProxy(cwd, includeAuth) {
  * Run \`spfn codegen run\` if route-map.ts is missing.
  */
 
-${authImport}import { routeMap } from '@/generated/route-map';
+${authImports}import { routeMap } from '@/generated/route-map';
 import { createRpcProxy } from '@spfn/core/nextjs/server';
 
-export const { GET, POST } = createRpcProxy({ routeMap });
+export const { GET, POST } = createRpcProxy({ routeMap: ${proxyRouteMap} });
 `;
   writeFileSync2(rpcRoutePath, routeContent);
   const relativePath = rpcRoutePath.replace(cwd + "/", "");
@@ -869,7 +922,7 @@ var init_deployment_config = __esm({
 
 // src/utils/version.ts
 function getCliVersion() {
-  return "0.2.0-beta.60";
+  return "0.2.0-beta.63";
 }
 function getTagFromVersion(version) {
   const match = version.match(/-([a-z]+)\./i);
@@ -888,7 +941,7 @@ var init_version = __esm({
 import ora3 from "ora";
 import { execa as execa2 } from "execa";
 import fse7 from "fs-extra";
-async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManager, includeAuth) {
+async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManager, mode) {
   const spinner = ora3("Updating package.json...").start();
   packageJson.dependencies = packageJson.dependencies || {};
   packageJson.devDependencies = packageJson.devDependencies || {};
@@ -902,8 +955,19 @@ async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManage
   packageJson.dependencies["pg"] = "^8.16.3";
   packageJson.dependencies["spfn"] = spfnTag;
   packageJson.dependencies["concurrently"] = "^9.2.1";
-  if (includeAuth) {
+  if (mode === "full") {
     packageJson.dependencies["@spfn/auth"] = spfnTag;
+    packageJson.dependencies["@spfn/i18n"] = spfnTag;
+    packageJson.dependencies["@spfn/mcp"] = spfnTag;
+    packageJson.dependencies["@spfn/notification"] = spfnTag;
+    packageJson.engines = packageJson.engines || {};
+    const existingNodeRange = packageJson.engines.node;
+    if (!existingNodeRange || !requiresNode20OrNewer(existingNodeRange)) {
+      packageJson.engines.node = ">=20.0.0";
+      if (existingNodeRange) {
+        logger.warn(`Updated engines.node from "${existingNodeRange}" to ">=20.0.0" because full mode includes @spfn/mcp`);
+      }
+    }
   }
   packageJson.devDependencies["@types/node"] = "^20.11.0";
   packageJson.devDependencies["tsx"] = "^4.20.6";
@@ -935,6 +999,16 @@ async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManage
     process.exit(1);
   }
 }
+function requiresNode20OrNewer(range) {
+  return range.split("||").map((alternative) => alternative.trim()).every((alternative) => {
+    const lowerBound = alternative.match(/^(?:>=|>|\^|~|=)?\s*v?(\d+)/);
+    if (!lowerBound) {
+      return false;
+    }
+    const major = Number(lowerBound[1]);
+    return major >= 20;
+  });
+}
 var writeFileSync6;
 var init_package = __esm({
   "src/commands/init/steps/package.ts"() {
@@ -1041,14 +1115,70 @@ var init_env_file = __esm({
 
 // src/commands/init/steps/config-files.ts
 import { existsSync as existsSync11, readFileSync as readFileSync5 } from "fs";
+import { randomBytes } from "crypto";
+import { spawnSync } from "child_process";
 import { join as join11 } from "path";
 import fse8 from "fs-extra";
+function envExampleTemplate(mode) {
+  return withPlaceholderCreds(`# Example environment \u2014 committed reference for the variables SPFN uses.
+# Real values live in .env.local (Next.js) and .env.server (backend secrets),
+# both gitignored. This file documents the keys; it is not loaded by anything.
+
+${ENV_LOCAL_TEMPLATE}${mode === "full" ? FULL_ENV_LOCAL_EXAMPLE : ""}
+${ENV_SERVER_TEMPLATE}${mode === "full" ? FULL_ENV_SERVER_EXAMPLE : ""}`);
+}
+function envServerExampleTemplate(mode) {
+  return withPlaceholderCreds(
+    `${ENV_SERVER_TEMPLATE}${mode === "full" ? FULL_ENV_SERVER_EXAMPLE : ""}`
+  );
+}
+function envLocalTemplate(mode) {
+  if (mode === "bare") {
+    return ENV_LOCAL_TEMPLATE;
+  }
+  return `${ENV_LOCAL_TEMPLATE}
+# Full scaffold: auth session encryption (Next.js server only; never NEXT_PUBLIC_*)
+SPFN_AUTH_SESSION_SECRET=${randomSecret("base64url")}
+SPFN_AUTH_SESSION_TTL=7d
+NEXT_PUBLIC_SPFN_APP_URL=http://localhost:3790
+`;
+}
+function envLocalExampleTemplate(mode) {
+  return `${ENV_LOCAL_TEMPLATE}${mode === "full" ? FULL_ENV_LOCAL_EXAMPLE : ""}`;
+}
+function envServerTemplate(mode) {
+  if (mode === "bare") {
+    return ENV_SERVER_TEMPLATE;
+  }
+  return `${ENV_SERVER_TEMPLATE}
+# Full scaffold: authentication
+SPFN_AUTH_VERIFICATION_TOKEN_SECRET=${randomSecret("base64url")}
+SPFN_AUTH_TOKEN_ENCRYPTION_KEYS=v1:${randomSecret("base64")}
+
+# Enable the social providers you need.
+# SPFN_AUTH_GOOGLE_CLIENT_ID=your-google-client-id
+# SPFN_AUTH_GOOGLE_CLIENT_SECRET=your-google-client-secret
+# SPFN_AUTH_GITHUB_CLIENT_ID=your-github-client-id
+# SPFN_AUTH_GITHUB_CLIENT_SECRET=your-github-client-secret
+# SPFN_AUTH_KAKAO_CLIENT_ID=your-kakao-rest-api-key
+# SPFN_AUTH_KAKAO_CLIENT_SECRET=your-kakao-client-secret
+# SPFN_AUTH_NAVER_CLIENT_ID=your-naver-client-id
+# SPFN_AUTH_NAVER_CLIENT_SECRET=your-naver-client-secret
+
+# Full scaffold: MCP operator endpoint
+SPFN_MCP_URL=http://localhost:8790
+SPFN_MCP_API_KEY=${randomSecret("base64url")}
+`;
+}
+function randomSecret(encoding) {
+  return randomBytes(32).toString(encoding);
+}
 function withPlaceholderCreds(text) {
   return text.replace(/(postgresql:\/\/)[^@\s/]+@/g, "$1user:password@");
 }
-async function setupConfigFiles(cwd) {
+async function setupConfigFiles(cwd, mode) {
   updateGitignore(cwd);
-  generateEnvFiles(cwd);
+  generateEnvFiles(cwd, mode);
   const spfnrcPath = join11(cwd, ".spfnrc.ts");
   if (!existsSync11(spfnrcPath)) {
     const spfnrcContent = `import { defineConfig, defineGenerator } from '@spfn/core/codegen';
@@ -1076,20 +1206,42 @@ export default defineConfig({
   }
   updateTsconfig(cwd);
 }
-function generateEnvFiles(cwd) {
-  writeEnvFile(cwd, ".env.local", ENV_LOCAL_TEMPLATE);
-  writeServerEnv(cwd);
-  writeExampleEnv(cwd, ENV_EXAMPLE_TEMPLATE);
+function generateEnvFiles(cwd, mode) {
+  writeLocalEnv(cwd, envLocalTemplate(mode), envLocalExampleTemplate(mode));
+  writeServerEnv(cwd, envServerTemplate(mode), envServerExampleTemplate(mode));
+  writeExampleEnv(cwd, envExampleTemplate(mode));
+}
+function writeLocalEnv(cwd, template, exampleTemplate) {
+  const filename = ".env.local";
+  const filePath = join11(cwd, filename);
+  if (isGitTracked(cwd, filename)) {
+    const referenceName = ".env.local.spfn.example";
+    const referencePath = join11(cwd, referenceName);
+    if (!existsSync11(referencePath)) {
+      writeFileSync8(referencePath, exampleTemplate);
+    }
+    logger.warn(`${filename} is tracked by Git \u2014 left it untouched; wrote ${referenceName}. Untrack ${filename}, then add the missing keys with freshly generated values`);
+    return;
+  }
+  writeEnvFile(cwd, filename, template);
+  restrictEnvFilePerms(filePath);
+}
+function isGitTracked(cwd, filename) {
+  const result = spawnSync("git", ["ls-files", "--error-unmatch", "--", filename], {
+    cwd,
+    stdio: "ignore"
+  });
+  return result.status === 0;
 }
-function writeServerEnv(cwd) {
+function writeServerEnv(cwd, template, exampleTemplate) {
   const filePath = join11(cwd, ".env.server");
   if (!existsSync11(filePath)) {
-    writeFileSync8(filePath, ENV_SERVER_TEMPLATE);
+    writeFileSync8(filePath, template);
     restrictEnvFilePerms(filePath);
     logger.success("Created .env.server");
     return;
   }
-  writeFileSync8(join11(cwd, ".env.server.example"), withPlaceholderCreds(ENV_SERVER_TEMPLATE));
+  writeFileSync8(join11(cwd, ".env.server.example"), exampleTemplate);
   logger.warn(".env.server already exists \u2014 left it untouched; wrote SPFN's reference to .env.server.example, add any missing keys manually");
 }
 function writeExampleEnv(cwd, content) {
@@ -1181,7 +1333,7 @@ function updateTsconfig(cwd) {
     logger.warn('Could not update tsconfig.json (you can add "src/server" to exclude manually)');
   }
 }
-var writeFileSync8, ENV_LOCAL_TEMPLATE, ENV_SERVER_TEMPLATE, ENV_EXAMPLE_TEMPLATE;
+var writeFileSync8, ENV_LOCAL_TEMPLATE, FULL_ENV_LOCAL_EXAMPLE, ENV_SERVER_TEMPLATE, FULL_ENV_SERVER_EXAMPLE;
 var init_config_files = __esm({
   "src/commands/init/steps/config-files.ts"() {
     "use strict";
@@ -1189,8 +1341,8 @@ var init_config_files = __esm({
     init_env_file();
     ({ writeFileSync: writeFileSync8 } = fse8);
     ENV_LOCAL_TEMPLATE = `# Next.js environment
-# Loaded by Next.js (and the SPFN backend). Only non-secret, Next.js-facing
-# values belong here \u2014 server secrets go in .env.server.
+# Loaded by Next.js (and the SPFN backend). Never prefix secrets with
+# NEXT_PUBLIC_. Backend-only secrets belong in .env.server.
 
 # SPFN API endpoint \u2014 browser + Next.js SSR/proxy target
 SPFN_API_URL=http://localhost:8790
@@ -1198,6 +1350,12 @@ NEXT_PUBLIC_SPFN_API_URL=http://localhost:8790
 
 # Next.js app URL (used by the SPFN server for CORS/redirects)
 SPFN_APP_URL=http://localhost:3790
+`;
+    FULL_ENV_LOCAL_EXAMPLE = `
+# Full scaffold: auth session encryption (Next.js server only; never NEXT_PUBLIC_*)
+SPFN_AUTH_SESSION_SECRET=replace-with-a-random-secret-at-least-32-characters
+SPFN_AUTH_SESSION_TTL=7d
+NEXT_PUBLIC_SPFN_APP_URL=http://localhost:3790
 `;
     ENV_SERVER_TEMPLATE = `# SPFN backend environment
 # Loaded ONLY by the SPFN server, never by Next.js. Keep all server-only config
@@ -1224,12 +1382,25 @@ DB_POOL_IDLE_TIMEOUT=30
 # DATABASE_READ_URL=postgresql://user:password@replica:5432/dbname
 # CACHE_PASSWORD=your-redis-password
 `;
-    ENV_EXAMPLE_TEMPLATE = withPlaceholderCreds(`# Example environment \u2014 committed reference for the variables SPFN uses.
-# Real values live in .env.local (Next.js) and .env.server (backend secrets),
-# both gitignored. This file documents the keys; it is not loaded by anything.
-
-${ENV_LOCAL_TEMPLATE}
-${ENV_SERVER_TEMPLATE}`);
+    FULL_ENV_SERVER_EXAMPLE = `
+# Full scaffold: authentication
+SPFN_AUTH_VERIFICATION_TOKEN_SECRET=replace-with-a-random-secret-at-least-32-characters
+SPFN_AUTH_TOKEN_ENCRYPTION_KEYS=v1:replace-with-a-base64-encoded-32-byte-key
+
+# Enable the social providers you need.
+# SPFN_AUTH_GOOGLE_CLIENT_ID=your-google-client-id
+# SPFN_AUTH_GOOGLE_CLIENT_SECRET=your-google-client-secret
+# SPFN_AUTH_GITHUB_CLIENT_ID=your-github-client-id
+# SPFN_AUTH_GITHUB_CLIENT_SECRET=your-github-client-secret
+# SPFN_AUTH_KAKAO_CLIENT_ID=your-kakao-rest-api-key
+# SPFN_AUTH_KAKAO_CLIENT_SECRET=your-kakao-client-secret
+# SPFN_AUTH_NAVER_CLIENT_ID=your-naver-client-id
+# SPFN_AUTH_NAVER_CLIENT_SECRET=your-naver-client-secret
+
+# Full scaffold: MCP operator endpoint
+SPFN_MCP_URL=http://localhost:8790
+SPFN_MCP_API_KEY=replace-with-a-random-operator-key
+`;
   }
 });
 
@@ -1254,15 +1425,16 @@ async function setupReadme(cwd, ctx) {
   const content = renderReadme(template, {
     projectName: ctx.packageJson.name || basename(cwd) || "my-app",
     pm: ctx.pm,
+    pmExec: ctx.pm === "npm" ? "npx" : ctx.pm,
     pmRun: getRunCommand(ctx.pm),
-    includeAuth: ctx.includeAuth
+    mode: ctx.mode
   });
   writeFileSync9(readmePath, content);
   logger.success("Created README.md");
 }
 function renderReadme(template, vars) {
   const authBlock = /\r?\n?<!-- \{\{#auth\}\} -->\r?\n([\s\S]*?)\r?\n<!-- \{\{\/auth\}\} -->\r?\n/;
-  return template.replace(authBlock, vars.includeAuth ? "\n$1\n" : "\n").replaceAll("{{projectName}}", () => vars.projectName).replaceAll("{{pmRun}}", () => vars.pmRun).replaceAll("{{pm}}", () => vars.pm);
+  return template.replace(authBlock, vars.mode === "full" ? "\n$1\n" : "\n").replaceAll("{{mode}}", () => vars.mode).replaceAll("{{projectName}}", () => vars.projectName).replaceAll("{{pmRun}}", () => vars.pmRun).replaceAll("{{pmExec}}", () => vars.pmExec).replaceAll("{{pm}}", () => vars.pm);
 }
 var writeFileSync9;
 var init_readme = __esm({
@@ -1281,31 +1453,40 @@ __export(init_exports, {
   initCommand: () => initCommand,
   initializeSpfn: () => initializeSpfn
 });
-import { Command as Command2 } from "commander";
+import { Command as Command2, Option } from "commander";
 import chalk4 from "chalk";
 async function initializeSpfn(options = {}) {
   const cwd = process.cwd();
-  const { packageJson, packageJsonPath, includeAuth } = await validateProject(cwd, options.yes || false);
+  const { packageJson, packageJsonPath } = await validateProject(cwd, options.yes || false);
+  const mode = await selectScaffoldMode(options);
+  const includeAuth = mode === "full";
   const pm = detectPackageManager(cwd);
   logger.step(`Detected package manager: ${pm}`);
-  await setupServerStructure(cwd);
+  await setupServerStructure(cwd, mode);
   await setupApiProxy(cwd, includeAuth);
   await setupNextConfig(cwd, includeAuth);
   await setupDockerFiles(cwd, pm);
   await setupDeploymentConfig(cwd, packageJson, pm);
-  await setupPackageJson(cwd, packageJsonPath, packageJson, pm, includeAuth);
-  await setupConfigFiles(cwd);
-  await setupReadme(cwd, { pm, packageJson, includeAuth, overwrite: options.overwriteReadme ?? false });
+  await setupPackageJson(cwd, packageJsonPath, packageJson, pm, mode);
+  await setupConfigFiles(cwd, mode);
+  await setupReadme(cwd, { pm, packageJson, mode, overwrite: options.overwriteReadme ?? false });
   console.log("\n" + chalk4.green.bold("\u2713 SPFN initialized successfully!\n"));
   console.log("Next steps:");
   console.log("  1. Start PostgreSQL & Redis (if not installed locally):");
   console.log("     " + chalk4.cyan("docker compose up -d"));
   console.log("  2. Review the generated env files (.env.local, .env.server)");
   console.log("     " + chalk4.dim(ENV_FILES_HINT));
-  console.log("  3. Run: " + chalk4.cyan(`${getRunCommand(pm)} spfn:dev`));
-  console.log("  4. Visit:");
+  if (mode === "full") {
+    const spfnCommand = pm === "npm" ? "npx spfn" : `${pm} spfn`;
+    console.log("  3. Apply the auth migrations: " + chalk4.cyan(`${spfnCommand} db migrate`));
+  }
+  console.log(`  ${mode === "full" ? "4" : "3"}. Run: ` + chalk4.cyan(`${getRunCommand(pm)} spfn:dev`));
+  console.log(`  ${mode === "full" ? "5" : "4"}. Visit:`);
   console.log("     - Next.js: " + chalk4.cyan("http://localhost:3790"));
   console.log("     - API:     " + chalk4.cyan("http://localhost:8790/health"));
+  if (mode === "full") {
+    console.log("     - MCP:     " + chalk4.cyan("http://localhost:8790/mcp"));
+  }
   console.log("\nAvailable commands:");
   console.log("  \u2022 " + chalk4.cyan(`${getRunCommand(pm)} spfn:dev`) + "       - Start SPFN + Next.js");
   console.log("  \u2022 " + chalk4.cyan("spfn env validate") + "  - Validate environment variables");
@@ -1329,7 +1510,8 @@ var init_init = __esm({
     init_package();
     init_config_files();
     init_readme();
-    initCommand = new Command2("init").description("Initialize SPFN in your Next.js project").option("-y, --yes", "Skip prompts and use defaults").action(initializeSpfn);
+    init_mode();
+    initCommand = new Command2("init").description("Initialize SPFN in your Next.js project").addOption(new Option("--mode <mode>", "Scaffold mode: bare (core) or full (core, auth, i18n, MCP)").choices(["bare", "full"])).option("-y, --yes", "Skip prompts and use defaults").action(initializeSpfn);
   }
 });
 
@@ -1342,39 +1524,39 @@ __export(function_migrations_exports, {
   loadFunctionMigrationPlans: () => loadFunctionMigrationPlans,
   readMigrationEntries: () => readMigrationEntries
 });
-import chalk13 from "chalk";
+import chalk6 from "chalk";
 import { createHash } from "crypto";
-import { join as join19 } from "path";
-import { env as env2 } from "@spfn/core/config";
-import { loadEnv as loadEnv2 } from "@spfn/core/server";
-import { existsSync as existsSync19, readdirSync as readdirSync2, readFileSync as readFileSync9 } from "fs";
+import { join as join15 } from "path";
+import { env } from "@spfn/core/config";
+import { loadEnv } from "@spfn/core/server";
+import { existsSync as existsSync14, readdirSync, readFileSync as readFileSync7 } from "fs";
 function discoverFunctionMigrations(cwd = process.cwd()) {
-  const nodeModulesPath = join19(cwd, "node_modules");
-  if (!existsSync19(nodeModulesPath)) {
+  const nodeModulesPath = join15(cwd, "node_modules");
+  if (!existsSync14(nodeModulesPath)) {
     return [];
   }
   const functions = [];
-  const spfnDir = join19(nodeModulesPath, "@spfn");
-  if (!existsSync19(spfnDir)) {
+  const spfnDir = join15(nodeModulesPath, "@spfn");
+  if (!existsSync14(spfnDir)) {
     return [];
   }
-  const packages = readdirSync2(spfnDir);
+  const packages = readdirSync(spfnDir);
   for (const pkg of packages) {
-    const packagePath = join19(spfnDir, pkg);
-    const packageJsonPath = join19(packagePath, "package.json");
-    if (!existsSync19(packageJsonPath)) {
+    const packagePath = join15(spfnDir, pkg);
+    const packageJsonPath = join15(packagePath, "package.json");
+    if (!existsSync14(packageJsonPath)) {
       continue;
     }
     try {
-      const packageJson = JSON.parse(readFileSync9(packageJsonPath, "utf-8"));
+      const packageJson = JSON.parse(readFileSync7(packageJsonPath, "utf-8"));
       const spfnConfig = packageJson.spfn;
       if (!spfnConfig?.migrations) {
         continue;
       }
-      const migrationsDir = join19(packagePath, spfnConfig.migrations.dir);
-      if (!existsSync19(migrationsDir)) {
+      const migrationsDir = join15(packagePath, spfnConfig.migrations.dir);
+      if (!existsSync14(migrationsDir)) {
         console.warn(
-          chalk13.yellow(`\u26A0\uFE0F  Package @spfn/${pkg} specifies migrations but directory not found: ${migrationsDir}`)
+          chalk6.yellow(`\u26A0\uFE0F  Package @spfn/${pkg} specifies migrations but directory not found: ${migrationsDir}`)
         );
         continue;
       }
@@ -1384,14 +1566,14 @@ function discoverFunctionMigrations(cwd = process.cwd()) {
         packagePath
       });
     } catch (error) {
-      console.warn(chalk13.yellow(`\u26A0\uFE0F  Failed to parse package.json for @spfn/${pkg}`));
+      console.warn(chalk6.yellow(`\u26A0\uFE0F  Failed to parse package.json for @spfn/${pkg}`));
     }
   }
   return functions;
 }
 function readMigrationEntries(migrationsDir, packageName) {
-  const journalPath = join19(migrationsDir, "meta", "_journal.json");
-  return existsSync19(journalPath) ? readJournalEntries(migrationsDir, journalPath, packageName) : readFolderEntries(migrationsDir, packageName);
+  const journalPath = join15(migrationsDir, "meta", "_journal.json");
+  return existsSync14(journalPath) ? readJournalEntries(migrationsDir, journalPath, packageName) : readFolderEntries(migrationsDir, packageName);
 }
 function loadFunctionMigrationPlans(functionMigrations) {
   return functionMigrations.map((func) => ({
@@ -1402,7 +1584,7 @@ function loadFunctionMigrationPlans(functionMigrations) {
 function readJournalEntries(migrationsDir, journalPath, packageName) {
   let journal;
   try {
-    journal = JSON.parse(readFileSync9(journalPath, "utf-8"));
+    journal = JSON.parse(readFileSync7(journalPath, "utf-8"));
   } catch {
     journal = {};
   }
@@ -1415,18 +1597,18 @@ function readJournalEntries(migrationsDir, journalPath, packageName) {
     if (typeof entry?.tag !== "string" || typeof entry?.when !== "number") {
       throw new Error(`${packageName}: invalid journal entry in ${journalPath}`);
     }
-    const sqlPath = join19(migrationsDir, `${entry.tag}.sql`);
-    if (!existsSync19(sqlPath)) {
+    const sqlPath = join15(migrationsDir, `${entry.tag}.sql`);
+    if (!existsSync14(sqlPath)) {
       throw new Error(`${packageName}: migration file not found: ${entry.tag}.sql`);
     }
-    return toEntry(entry.tag, readFileSync9(sqlPath, "utf-8"), entry.when);
+    return toEntry(entry.tag, readFileSync7(sqlPath, "utf-8"), entry.when);
   });
 }
 function readFolderEntries(migrationsDir, packageName) {
-  const folders = readdirSync2(migrationsDir, { withFileTypes: true }).filter((dirent) => dirent.isDirectory()).map((dirent) => dirent.name).filter((name) => existsSync19(join19(migrationsDir, name, "migration.sql"))).sort((a, b) => a.localeCompare(b));
+  const folders = readdirSync(migrationsDir, { withFileTypes: true }).filter((dirent) => dirent.isDirectory()).map((dirent) => dirent.name).filter((name) => existsSync14(join15(migrationsDir, name, "migration.sql"))).sort((a, b) => a.localeCompare(b));
   return folders.map((name) => toEntry(
     name,
-    readFileSync9(join19(migrationsDir, name, "migration.sql"), "utf-8"),
+    readFileSync7(join15(migrationsDir, name, "migration.sql"), "utf-8"),
     folderTimestampMillis(name, packageName)
   ));
 }
@@ -1466,7 +1648,7 @@ async function migrateLegacyTable(db, plans) {
   if (!legacyCheck[0]?.exists) {
     return;
   }
-  console.log(chalk13.dim("\n  Migrating legacy shared migration table to per-package tables..."));
+  console.log(chalk6.dim("\n  Migrating legacy shared migration table to per-package tables..."));
   const legacyRows = await db.query(
     `SELECT hash, created_at FROM drizzle."__spfn_fn_migrations" ORDER BY id`
   );
@@ -1496,11 +1678,11 @@ async function migrateLegacyTable(db, plans) {
       copied++;
     }
     if (copied > 0) {
-      console.log(chalk13.dim(`    \u2713 ${plan.packageName}: copied ${copied} migration record(s)`));
+      console.log(chalk6.dim(`    \u2713 ${plan.packageName}: copied ${copied} migration record(s)`));
     }
   }
   await db.query(`DROP TABLE drizzle."__spfn_fn_migrations"`);
-  console.log(chalk13.dim("    \u2713 Legacy migration table removed\n"));
+  console.log(chalk6.dim("    \u2713 Legacy migration table removed\n"));
 }
 async function ensureMigrationsTable(db, tableName) {
   await db.query(`CREATE SCHEMA IF NOT EXISTS drizzle`);
@@ -1544,20 +1726,20 @@ function createPostgresJsMigrationDb(client) {
 }
 async function executeFunctionMigrations(plans) {
   const postgres = await import("postgres");
-  loadEnv2();
-  if (!env2.DATABASE_URL) {
+  loadEnv();
+  if (!env.DATABASE_URL) {
     throw new Error("DATABASE_URL not found in environment");
   }
-  const connection = postgres.default(env2.DATABASE_URL, { max: 1 });
+  const connection = postgres.default(env.DATABASE_URL, { max: 1 });
   const db = createPostgresJsMigrationDb(connection);
   let appliedCount = 0;
   try {
     await migrateLegacyTable(db, plans);
     for (const plan of plans) {
-      console.log(chalk13.blue(`
+      console.log(chalk6.blue(`
   \u{1F4E6} Running ${plan.packageName} migrations...`));
       const applied = await applyFunctionMigrationPlan(db, plan);
-      console.log(applied > 0 ? chalk13.green(`  \u2713 ${plan.packageName}: ${applied} migration(s) applied`) : chalk13.dim(`  \u2013 ${plan.packageName}: up to date`));
+      console.log(applied > 0 ? chalk6.green(`  \u2713 ${plan.packageName}: ${applied} migration(s) applied`) : chalk6.dim(`  \u2013 ${plan.packageName}: up to date`));
       appliedCount += applied;
     }
   } finally {
@@ -1571,6 +1753,112 @@ var init_function_migrations = __esm({
   }
 });
 
+// src/utils/migration-status.ts
+var migration_status_exports = {};
+__export(migration_status_exports, {
+  filterPendingEntries: () => filterPendingEntries,
+  functionMigrationsTable: () => functionMigrationsTable2,
+  getMigrationStatus: () => getMigrationStatus,
+  warnPendingMigrations: () => warnPendingMigrations
+});
+import { join as join16 } from "path";
+import { existsSync as existsSync15 } from "fs";
+import chalk7 from "chalk";
+import { env as env2 } from "@spfn/core/config";
+import { loadEnv as loadEnv2 } from "@spfn/core/server";
+function functionMigrationsTable2(packageName) {
+  return `__spfn_fn_${packageName.replace("@spfn/", "")}_migrations`;
+}
+function filterPendingEntries(entries, lastAppliedMillis, appliedNames) {
+  return entries.filter((entry) => entry.millis > lastAppliedMillis && !appliedNames.has(entry.name));
+}
+async function readAppliedNames(sql2, tableName) {
+  const columnCheck = await sql2`
+        SELECT EXISTS (
+            SELECT 1 FROM information_schema.columns
+            WHERE table_schema = 'drizzle' AND table_name = ${tableName} AND column_name = 'name'
+        ) AS "exists"`;
+  if (!columnCheck[0]?.exists) {
+    return /* @__PURE__ */ new Set();
+  }
+  const rows = await sql2`
+        SELECT name FROM drizzle.${sql2(tableName)} WHERE name IS NOT NULL`;
+  return new Set(rows.map((row) => row.name));
+}
+async function collectTargetStatus(sql2, name, migrationsDir, tableName) {
+  const entries = readMigrationEntries(migrationsDir, name);
+  const tableCheck = await sql2`
+        SELECT EXISTS (
+            SELECT 1 FROM information_schema.tables
+            WHERE table_schema = 'drizzle' AND table_name = ${tableName}
+        ) AS "exists"`;
+  let lastApplied = 0;
+  let appliedNames = /* @__PURE__ */ new Set();
+  if (tableCheck[0]?.exists) {
+    const rows = await sql2`
+            SELECT created_at FROM drizzle.${sql2(tableName)}
+            ORDER BY created_at DESC LIMIT 1`;
+    lastApplied = rows[0]?.created_at ? Number(rows[0].created_at) : 0;
+    appliedNames = await readAppliedNames(sql2, tableName);
+  }
+  const pendingEntries = filterPendingEntries(entries, lastApplied, appliedNames);
+  return {
+    name,
+    total: entries.length,
+    applied: entries.length - pendingEntries.length,
+    pending: pendingEntries.length,
+    pendingTags: pendingEntries.map((e) => e.name)
+  };
+}
+async function getMigrationStatus(cwd = process.cwd(), databaseUrl) {
+  loadEnv2();
+  const url = databaseUrl ?? env2.DATABASE_URL;
+  if (!url) {
+    throw new Error("DATABASE_URL not found in environment");
+  }
+  const postgres = await import("postgres");
+  const sql2 = postgres.default(url, { max: 1, connect_timeout: 5 });
+  try {
+    const packages = [];
+    for (const func of discoverFunctionMigrations(cwd)) {
+      packages.push(await collectTargetStatus(
+        sql2,
+        func.packageName,
+        func.migrationsDir,
+        functionMigrationsTable2(func.packageName)
+      ));
+    }
+    const projectDir = join16(cwd, "src", "server", "drizzle");
+    const project = existsSync15(projectDir) ? await collectTargetStatus(sql2, "project (src/server/drizzle)", projectDir, "__drizzle_migrations") : null;
+    return { packages, project: project && project.total > 0 ? project : null };
+  } finally {
+    await sql2.end();
+  }
+}
+async function warnPendingMigrations(cwd, databaseUrl) {
+  let status;
+  try {
+    status = await getMigrationStatus(cwd, databaseUrl);
+  } catch {
+    return;
+  }
+  const targets = [...status.packages, ...status.project ? [status.project] : []].filter((t) => t.pending > 0);
+  if (targets.length === 0) {
+    return;
+  }
+  console.warn("");
+  for (const target of targets) {
+    console.warn(chalk7.yellow(`\u26A0\uFE0F  ${target.name}: ${target.pending} pending migration(s)`));
+  }
+  console.warn(chalk7.yellow("   Missing tables will fail at request time \u2014 run: pnpm spfn db migrate\n"));
+}
+var init_migration_status = __esm({
+  "src/utils/migration-status.ts"() {
+    "use strict";
+    init_function_migrations();
+  }
+});
+
 // src/index.ts
 import { Command as Command13 } from "commander";
 
@@ -1578,10 +1866,11 @@ import { Command as Command13 } from "commander";
 init_logger();
 init_package_manager();
 init_messages();
-import { Command as Command3 } from "commander";
+init_mode();
+import { Command as Command3, Option as Option2 } from "commander";
 import { existsSync as existsSync13 } from "fs";
 import { join as join13, resolve, dirname as dirname2 } from "path";
-import prompts2 from "prompts";
+import prompts3 from "prompts";
 import ora4 from "ora";
 import { execa as execa3 } from "execa";
 import chalk5 from "chalk";
@@ -1607,7 +1896,7 @@ async function createProject(projectName, options) {
   console.log(chalk5.blue.bold("\n\u{1F680} Creating Next.js project with SPFN...\n"));
   let pm = options.pm || detectPackageManager(cwd);
   if (!options.yes && !options.pm) {
-    const { selectedPm } = await prompts2({
+    const { selectedPm } = await prompts3({
       type: "select",
       name: "selectedPm",
       message: "Which package manager do you want to use?",
@@ -1625,6 +1914,8 @@ async function createProject(projectName, options) {
     pm = selectedPm;
   }
   logger.step(`Using package manager: ${pm}`);
+  const mode = await selectScaffoldMode(options);
+  logger.step(`Using scaffold mode: ${mode}`);
   const workspaceRoot = pm === "pnpm" ? findPnpmWorkspaceRoot(cwd) : null;
   const isInWorkspace = workspaceRoot !== null;
   if (isInWorkspace) {
@@ -1723,7 +2014,7 @@ async function createProject(projectName, options) {
   const initSpinner = ora4("Initializing SPFN...").start();
   try {
     const { initializeSpfn: initializeSpfn2 } = await Promise.resolve().then(() => (init_init(), init_exports));
-    await initializeSpfn2({ yes: true, overwriteReadme: true });
+    await initializeSpfn2({ yes: true, overwriteReadme: true, mode });
     initSpinner.succeed("SPFN initialized");
   } catch (error) {
     initSpinner.fail("Failed to initialize SPFN");
@@ -1735,6 +2026,10 @@ async function createProject(projectName, options) {
   console.log(`  ${chalk5.cyan("cd")} ${projectName}`);
   console.log(`  ${chalk5.cyan("docker compose up -d")}  ${chalk5.gray("# Start PostgreSQL & Redis")}`);
   console.log(`  ${chalk5.gray(`# .env.local & .env.server are generated \u2014 ${ENV_FILES_HINT}`)}`);
+  if (mode === "full") {
+    const spfnCommand = pm === "npm" ? "npx spfn" : `${pm} spfn`;
+    console.log(`  ${chalk5.cyan(`${spfnCommand} db migrate`)}  ${chalk5.gray("# Apply auth migrations")}`);
+  }
   console.log(`  ${chalk5.cyan(`${getRunCommand(pm)} spfn:dev`)}  ${chalk5.gray("# Start dev server")}
 `);
   console.log(chalk5.bold("Your app will be available at:\n"));
@@ -1751,7 +2046,7 @@ async function createProject(projectName, options) {
 `);
   console.log(chalk5.dim("  \u{1F310} Documentation: https://github.com/spfn/spfn\n"));
 }
-var createCommand = new Command3("create").description("Create a new Next.js project with SPFN").argument("<project-name>", "Name of the project directory").option("--skip-install", "Skip installing dependencies").option("--skip-git", "Skip initializing a git repository").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--shadcn", "Setup shadcn/ui (component library)").option("-y, --yes", "Skip prompts and use defaults").action(async (projectName, options) => {
+var createCommand = new Command3("create").description("Create a new Next.js project with SPFN").argument("<project-name>", "Name of the project directory").option("--skip-install", "Skip installing dependencies").option("--skip-git", "Skip initializing a git repository").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--shadcn", "Setup shadcn/ui (component library)").addOption(new Option2("--mode <mode>", "Scaffold mode: bare (core) or full (core, auth, i18n, MCP)").choices(["bare", "full"])).option("-y, --yes", "Skip prompts and use defaults").action(async (projectName, options) => {
   await createProject(projectName, options);
 });
 
@@ -1762,8 +2057,8 @@ init_init();
 init_logger();
 init_package_manager();
 import { Command as Command4 } from "commander";
-import { existsSync as existsSync14, readFileSync as readFileSync7, writeFileSync as writeFileSync10, mkdirSync, unlinkSync, rmSync, watch } from "fs";
-import { join as join15, relative, sep } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync8, writeFileSync as writeFileSync10, mkdirSync, unlinkSync, rmSync, watch } from "fs";
+import { join as join17, relative, sep as sep2 } from "path";
 import { execa as execa6 } from "execa";
 import chokidar from "chokidar";
 
@@ -1939,10 +2234,10 @@ async function resolveKeychainEnv(cwd) {
     return { env: {}, missing: [] };
   }
   const store = detectStore();
-  const env8 = {};
+  const env9 = {};
   const missing = [];
   if (!await store.isAvailable()) {
-    return { env: env8, missing: refs.map(([key]) => key) };
+    return { env: env9, missing: refs.map(([key]) => key) };
   }
   for (const [key, value] of refs) {
     const name = value.slice(KEYCHAIN_REF_PREFIX.length);
@@ -1950,32 +2245,32 @@ async function resolveKeychainEnv(cwd) {
     if (resolved === null) {
       missing.push(key);
     } else {
-      env8[key] = resolved;
+      env9[key] = resolved;
     }
   }
-  return { env: env8, missing };
+  return { env: env9, missing };
 }
 
 // src/commands/dev.ts
 function ignoreDotfilesUnder(root) {
-  return (watchedPath) => relative(root, watchedPath).split(sep).some((segment) => segment.startsWith(".") && segment !== "." && segment !== "..");
+  return (watchedPath) => relative(root, watchedPath).split(sep2).some((segment) => segment.startsWith(".") && segment !== "." && segment !== "..");
 }
 function waitForReadyFile(filePath, timeoutMs = 3e4) {
   return new Promise((resolve3, reject) => {
-    if (existsSync14(filePath)) {
+    if (existsSync16(filePath)) {
       unlinkSync(filePath);
     }
     const timer = setTimeout(() => {
       watcher.close();
       reject(new Error(`Server did not become ready within ${timeoutMs / 1e3}s`));
     }, timeoutMs);
-    const dir = join15(filePath, "..");
+    const dir = join17(filePath, "..");
     const fileName = filePath.split("/").pop();
     const watcher = watch(dir, (_event, name) => {
-      if (name === fileName && existsSync14(filePath)) {
+      if (name === fileName && existsSync16(filePath)) {
         watcher.close();
         clearTimeout(timer);
-        resolve3(readFileSync7(filePath, "utf-8").trim());
+        resolve3(readFileSync8(filePath, "utf-8").trim());
       }
     });
   });
@@ -1986,8 +2281,8 @@ var devCommand = new Command4("dev").description("Start SPFN development server
     process.env.NODE_ENV = "development";
   }
   const cwd = process.cwd();
-  const serverDir = join15(cwd, "src", "server");
-  if (!existsSync14(serverDir)) {
+  const serverDir = join17(cwd, "src", "server");
+  if (!existsSync16(serverDir)) {
     logger.error("src/server directory not found.");
     logger.info('Run "spfn init" first to initialize SPFN in your project.');
     process.exit(1);
@@ -2001,23 +2296,25 @@ var devCommand = new Command4("dev").description("Start SPFN development server
     logger.warn(`[SPFN] Could not resolve keychain secret(s): ${keychainMissing.join(", ")} \u2014 run \`spfn secret set <KEY>\``);
   }
   const serverEnv = { ...process.env, ...keychainEnv };
-  const packageJsonPath = join15(cwd, "package.json");
+  const { warnPendingMigrations: warnPendingMigrations2 } = await Promise.resolve().then(() => (init_migration_status(), migration_status_exports));
+  await warnPendingMigrations2(cwd, serverEnv.DATABASE_URL);
+  const packageJsonPath = join17(cwd, "package.json");
   let hasNext = false;
-  if (existsSync14(packageJsonPath)) {
-    const packageJson = JSON.parse(readFileSync7(packageJsonPath, "utf-8"));
+  if (existsSync16(packageJsonPath)) {
+    const packageJson = JSON.parse(readFileSync8(packageJsonPath, "utf-8"));
     hasNext = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
   }
-  const tempDir = join15(cwd, ".spfn");
-  const serverEntry = join15(tempDir, "server.mjs");
-  const watcherEntry = join15(tempDir, "watcher.mjs");
+  const tempDir = join17(cwd, ".spfn");
+  const serverEntry = join17(tempDir, "server.mjs");
+  const watcherEntry = join17(tempDir, "watcher.mjs");
   mkdirSync(tempDir, { recursive: true });
-  const serverBuildDir = join15(tempDir, "server");
-  if (existsSync14(serverBuildDir)) {
+  const serverBuildDir = join17(tempDir, "server");
+  if (existsSync16(serverBuildDir)) {
     rmSync(serverBuildDir, { recursive: true, force: true });
     logger.info("[SPFN] Cleaned stale build cache (.spfn/server)");
   }
-  const readySignal = join15(tempDir, "server-ready");
-  if (existsSync14(readySignal)) {
+  const readySignal = join17(tempDir, "server-ready");
+  if (existsSync16(readySignal)) {
     unlinkSync(readySignal);
   }
   const configParts = [];
@@ -2025,7 +2322,7 @@ var devCommand = new Command4("dev").description("Start SPFN development server
   if (options.host) configParts.push(`host: '${options.host}'`);
   if (options.routes) configParts.push(`routesPath: '${options.routes}'`);
   configParts.push("debug: true");
-  const readyFile = join15(tempDir, "server-ready");
+  const readyFile = join17(tempDir, "server-ready");
   writeFileSync10(serverEntry, `
 import { writeFileSync } from 'fs';
 
@@ -2315,11 +2612,11 @@ catch (error)
 init_logger();
 init_package_manager();
 import { Command as Command5 } from "commander";
-import { existsSync as existsSync15, writeFileSync as writeFileSync11, mkdirSync as mkdirSync2, readdirSync } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync17, writeFileSync as writeFileSync11, mkdirSync as mkdirSync2, readdirSync as readdirSync2 } from "fs";
+import { join as join18 } from "path";
 import { execa as execa7 } from "execa";
 import ora5 from "ora";
-import chalk6 from "chalk";
+import chalk8 from "chalk";
 import { build } from "tsup";
 async function buildProject(options) {
   if (!process.env.NODE_ENV) {
@@ -2330,17 +2627,17 @@ async function buildProject(options) {
   }
   const cwd = process.cwd();
   const pm = detectPackageManager(cwd);
-  const packageJsonPath = join16(cwd, "package.json");
+  const packageJsonPath = join18(cwd, "package.json");
   let hasNext = false;
-  if (existsSync15(packageJsonPath)) {
+  if (existsSync17(packageJsonPath)) {
     const packageJson = JSON.parse(await import("fs").then(
       (fs5) => fs5.promises.readFile(packageJsonPath, "utf-8")
     ));
     hasNext = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
   }
-  const serverDir = join16(cwd, "src", "server");
-  const hasServer = existsSync15(serverDir);
-  console.log(chalk6.blue.bold("\n\u{1F3D7}\uFE0F  Building SPFN project for production...\n"));
+  const serverDir = join18(cwd, "src", "server");
+  const hasServer = existsSync17(serverDir);
+  console.log(chalk8.blue.bold("\n\u{1F3D7}\uFE0F  Building SPFN project for production...\n"));
   if (hasServer) {
     const spinner = ora5("Generating API client...").start();
     try {
@@ -2376,10 +2673,10 @@ async function buildProject(options) {
   if (hasServer && !options.nextOnly) {
     const spinner = ora5("Building SPFN server...").start();
     try {
-      const outputDir = join16(cwd, ".spfn", "server");
+      const outputDir = join18(cwd, ".spfn", "server");
       mkdirSync2(outputDir, { recursive: true });
-      const serverDir2 = join16(cwd, "src", "server");
-      if (!existsSync15(serverDir2)) {
+      const serverDir2 = join18(cwd, "src", "server");
+      if (!existsSync17(serverDir2)) {
         spinner.fail("SPFN server build failed");
         logger.error("src/server/ directory not found");
         logger.error('Please run "spfn init" to initialize the project.');
@@ -2407,7 +2704,7 @@ async function buildProject(options) {
         onSuccess: async () => {
         }
       });
-      const prodServerPath = join16(cwd, ".spfn", "prod-server.mjs");
+      const prodServerPath = join18(cwd, ".spfn", "prod-server.mjs");
       const prodServerContent = `// Load environment variables FIRST (before any imports that depend on them)
 // Use centralized environment loader for standard dotenv priority
 const { env } = await import('@spfn/core/config');
@@ -2433,25 +2730,25 @@ await startServer({
 `;
       writeFileSync11(prodServerPath, prodServerContent);
       spinner.succeed(`SPFN server build completed \u2192 .spfn/server`);
-      const routesDir = join16(cwd, ".spfn", "server", "routes");
-      if (existsSync15(routesDir)) {
+      const routesDir = join18(cwd, ".spfn", "server", "routes");
+      if (existsSync17(routesDir)) {
         console.log();
-        console.log(chalk6.bold("Route (api)"));
+        console.log(chalk8.bold("Route (api)"));
         try {
-          const routes = readdirSync(routesDir, { withFileTypes: true }).filter((dirent) => dirent.isDirectory()).map((dirent) => dirent.name).sort();
+          const routes = readdirSync2(routesDir, { withFileTypes: true }).filter((dirent) => dirent.isDirectory()).map((dirent) => dirent.name).sort();
           if (routes.length > 0) {
             routes.forEach((route, index) => {
               const isLast = index === routes.length - 1;
               const prefix = isLast ? "\u2514" : "\u251C";
               const routePath = `/api/${route}`;
               if (route === "health") {
-                console.log(`${prefix} ${chalk6.green("GET")}  ${routePath}`);
+                console.log(`${prefix} ${chalk8.green("GET")}  ${routePath}`);
               } else {
-                console.log(`${prefix} ${chalk6.cyan("*")}    ${routePath}`);
+                console.log(`${prefix} ${chalk8.cyan("*")}    ${routePath}`);
               }
             });
             console.log();
-            console.log(chalk6.cyan("*") + "  (Hono)  multiple methods supported");
+            console.log(chalk8.cyan("*") + "  (Hono)  multiple methods supported");
           }
         } catch (error) {
         }
@@ -2459,9 +2756,9 @@ await startServer({
     } catch (error) {
       spinner.fail("SPFN server build failed");
       if (error instanceof Error) {
-        console.error("\n" + chalk6.red(error.message));
+        console.error("\n" + chalk8.red(error.message));
         if (error.stack) {
-          console.error(chalk6.dim("\n" + error.stack));
+          console.error(chalk8.dim("\n" + error.stack));
         }
       } else {
         logger.error(String(error));
@@ -2473,13 +2770,13 @@ await startServer({
     logger.error("No Next.js or SPFN server found in this project.");
     process.exit(1);
   }
-  console.log("\n" + chalk6.green.bold("\u2713 Build completed successfully!\n"));
-  console.log(chalk6.bold("Next steps:\n"));
-  console.log("  " + chalk6.cyan("Start production server:"));
-  console.log(`    ${chalk6.cyan(getRunCommand(pm))} spfn:start  ${chalk6.gray("# Start SPFN + Next.js")}
+  console.log("\n" + chalk8.green.bold("\u2713 Build completed successfully!\n"));
+  console.log(chalk8.bold("Next steps:\n"));
+  console.log("  " + chalk8.cyan("Start production server:"));
+  console.log(`    ${chalk8.cyan(getRunCommand(pm))} spfn:start  ${chalk8.gray("# Start SPFN + Next.js")}
 `);
-  console.log("  " + chalk6.cyan("Or deploy with Docker:"));
-  console.log(`    ${chalk6.cyan("docker compose -f docker-compose.production.yml up --build -d")}
+  console.log("  " + chalk8.cyan("Or deploy with Docker:"));
+  console.log(`    ${chalk8.cyan("docker compose -f docker-compose.production.yml up --build -d")}
 `);
 }
 var buildCommand = new Command5("build").description("Build SPFN project for production (Next.js + Server)").option("--server-only", "Build only SPFN server (skip Next.js)").option("--next-only", "Build only Next.js (skip SPFN server)").option("--turbo", "Use Turbopack for Next.js build").action(async (options) => {
@@ -2490,25 +2787,25 @@ var buildCommand = new Command5("build").description("Build SPFN project for pro
 init_logger();
 init_package_manager();
 import { Command as Command6 } from "commander";
-import { existsSync as existsSync16, readFileSync as readFileSync8 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync9 } from "fs";
+import { join as join19 } from "path";
 import { execa as execa8 } from "execa";
-import chalk7 from "chalk";
+import chalk9 from "chalk";
 var startCommand = new Command6("start").description("Start SPFN production server (Next.js + Hono)").option("--server-only", "Run only SPFN server (skip Next.js)").option("--next-only", "Run only Next.js (skip SPFN server)").option("-p, --port <port>", "Server port", "8790").option("-h, --host <host>", "Server host", "0.0.0.0").action(async (options) => {
   if (!process.env.NODE_ENV) {
     process.env.NODE_ENV = "production";
   }
   const cwd = process.cwd();
-  const packageJsonPath = join17(cwd, "package.json");
+  const packageJsonPath = join19(cwd, "package.json");
   let hasNext = false;
-  if (existsSync16(packageJsonPath)) {
-    const packageJson = JSON.parse(readFileSync8(packageJsonPath, "utf-8"));
+  if (existsSync18(packageJsonPath)) {
+    const packageJson = JSON.parse(readFileSync9(packageJsonPath, "utf-8"));
     hasNext = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
   }
-  const builtServerDir = join17(cwd, ".spfn", "server");
-  const hasBuiltServer = existsSync16(builtServerDir);
-  const nextBuildDir = join17(cwd, ".next");
-  const hasNextBuild = existsSync16(nextBuildDir);
+  const builtServerDir = join19(cwd, ".spfn", "server");
+  const hasBuiltServer = existsSync18(builtServerDir);
+  const nextBuildDir = join19(cwd, ".next");
+  const hasNextBuild = existsSync18(nextBuildDir);
   if (!options.nextOnly && !hasBuiltServer) {
     logger.error('.spfn/server directory not found. Please run "spfn build" first.');
     process.exit(1);
@@ -2518,8 +2815,8 @@ var startCommand = new Command6("start").description("Start SPFN production serv
     process.exit(1);
   }
   const pm = detectPackageManager(cwd);
-  const serverEntry = join17(cwd, ".spfn", "prod-server.mjs");
-  if (!existsSync16(serverEntry)) {
+  const serverEntry = join19(cwd, ".spfn", "prod-server.mjs");
+  if (!existsSync18(serverEntry)) {
     logger.error('.spfn/prod-server.mjs not found. Please run "spfn build" first.');
     process.exit(1);
   }
@@ -2555,7 +2852,7 @@ var startCommand = new Command6("start").description("Start SPFN production serv
   }
   const nextCmd = "next start -H 0.0.0.0 -p 3790";
   const serverCmd = `node "${serverEntry}"`;
-  console.log(chalk7.blue.bold("\n\u{1F680} Starting SPFN production server...\n"));
+  console.log(chalk9.blue.bold("\n\u{1F680} Starting SPFN production server...\n"));
   logger.info("Next.js: http://0.0.0.0:3790");
   logger.info(`SPFN API: http://${options.host}:${options.port}
 `);
@@ -2582,13 +2879,13 @@ var startCommand = new Command6("start").description("Start SPFN production serv
 // src/commands/codegen.ts
 init_logger();
 import { Command as Command7 } from "commander";
-import { existsSync as existsSync17, writeFileSync as writeFileSync12 } from "fs";
-import { join as join18 } from "path";
-import chalk8 from "chalk";
+import { existsSync as existsSync19, writeFileSync as writeFileSync12 } from "fs";
+import { join as join20 } from "path";
+import chalk10 from "chalk";
 async function initCodegen(options) {
   const cwd = process.cwd();
-  const rcPath = join18(cwd, ".spfnrc.ts");
-  if (existsSync17(rcPath)) {
+  const rcPath = join20(cwd, ".spfnrc.ts");
+  if (existsSync19(rcPath)) {
     logger.warn(".spfnrc.ts already exists");
     logger.info("Edit manually to add custom generators");
     process.exit(0);
@@ -2614,13 +2911,13 @@ export default defineConfig({
 });
 `;
   writeFileSync12(rcPath, content);
-  console.log("\n" + chalk8.green.bold("\u2713 Created .spfnrc.ts\n"));
-  console.log(chalk8.gray("Configured the @spfn/core:route-map generator."));
+  console.log("\n" + chalk10.green.bold("\u2713 Created .spfnrc.ts\n"));
+  console.log(chalk10.gray("Configured the @spfn/core:route-map generator."));
   if (options.withExample) {
-    console.log("\n" + chalk8.yellow("\u{1F4DD} To add custom generators:"));
+    console.log("\n" + chalk10.yellow("\u{1F4DD} To add custom generators:"));
     console.log("  1. Create your generator file (e.g., src/generators/my-generator.ts)");
     console.log("  2. Add to .spfnrc.ts:");
-    console.log(chalk8.gray(`
+    console.log(chalk10.gray(`
 {
   "codegen": {
     "generators": [
@@ -2630,11 +2927,11 @@ export default defineConfig({
   }
 }
         `));
-    console.log("  3. Run: " + chalk8.cyan("spfn dev") + " (generators run automatically)");
+    console.log("  3. Run: " + chalk10.cyan("spfn dev") + " (generators run automatically)");
   } else {
-    console.log("\n" + chalk8.yellow("\u{1F4DD} Next steps:"));
+    console.log("\n" + chalk10.yellow("\u{1F4DD} Next steps:"));
     console.log("  \u2022 Add custom generators to .spfnrc.ts");
-    console.log("  \u2022 Run: " + chalk8.cyan("spfn dev") + " to start development with code generation");
+    console.log("  \u2022 Run: " + chalk10.cyan("spfn dev") + " to start development with code generation");
   }
 }
 async function listGenerators() {
@@ -2647,10 +2944,10 @@ async function listGenerators() {
     logger.info('Run "spfn codegen init" to initialize configuration');
     return;
   }
-  console.log("\n" + chalk8.bold("Registered Generators:"));
+  console.log("\n" + chalk10.bold("Registered Generators:"));
   generators.forEach((gen, index) => {
-    console.log(`  ${index + 1}. ${chalk8.cyan(gen.name)}`);
-    console.log(`     Patterns: ${chalk8.gray(gen.watchPatterns.join(", "))}`);
+    console.log(`  ${index + 1}. ${chalk10.cyan(gen.name)}`);
+    console.log(`     Patterns: ${chalk10.gray(gen.watchPatterns.join(", "))}`);
   });
   console.log("");
 }
@@ -2671,7 +2968,7 @@ async function runGenerators() {
     debug: true
   });
   await orchestrator.generateAll();
-  console.log("\n" + chalk8.green.bold("\u2713 Code generation completed"));
+  console.log("\n" + chalk10.green.bold("\u2713 Code generation completed"));
 }
 var codegenCommand = new Command7("codegen").description("Code generation management");
 codegenCommand.command("init").description("Initialize .spfnrc.ts with codegen configuration").option("--with-example", "Show example custom generator usage").action(initCodegen);
@@ -2682,19 +2979,19 @@ codegenCommand.command("run").description("Run code generators once (no watch mo
 init_logger();
 import { Command as Command8 } from "commander";
 import { execSync } from "child_process";
-import chalk9 from "chalk";
+import chalk11 from "chalk";
 
 // src/utils/secret-gen.ts
-import { randomBytes, randomUUID } from "crypto";
+import { randomBytes as randomBytes2, randomUUID } from "crypto";
 function randomBase64Url(bytes) {
-  return randomBytes(bytes).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  return randomBytes2(bytes).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 function generateSecretValue(spec) {
   switch (spec) {
     case "hex32":
-      return randomBytes(32).toString("hex");
+      return randomBytes2(32).toString("hex");
     case "hex64":
-      return randomBytes(64).toString("hex");
+      return randomBytes2(64).toString("hex");
     case "base64url32":
       return randomBase64Url(32);
     case "uuid":
@@ -2757,41 +3054,41 @@ function copyToClipboard(text) {
 function generateSecret(bytes, preset, envVarName, copy) {
   const key = randomBase64Url(bytes);
   const config = preset ? PRESETS[preset] : null;
-  console.log("\n" + chalk9.green.bold("\u2713 Generated secret key:"));
+  console.log("\n" + chalk11.green.bold("\u2713 Generated secret key:"));
   if (config) {
-    console.log(chalk9.dim(`  ${config.description} (${bytes * 8} bits)`));
+    console.log(chalk11.dim(`  ${config.description} (${bytes * 8} bits)`));
   } else {
-    console.log(chalk9.dim(`  ${bytes * 8}-bit secret`));
+    console.log(chalk11.dim(`  ${bytes * 8}-bit secret`));
   }
-  console.log("\n" + chalk9.cyan(key) + "\n");
+  console.log("\n" + chalk11.cyan(key) + "\n");
   const varName = envVarName || config?.envVar || "SECRET_KEY";
-  console.log(chalk9.dim("Add to your .env file:"));
-  console.log(chalk9.yellow(`${varName}=${key}
+  console.log(chalk11.dim("Add to your .env file:"));
+  console.log(chalk11.yellow(`${varName}=${key}
 `));
   if (config?.usage) {
-    console.log(chalk9.dim("Usage:"));
-    console.log(chalk9.gray(`  ${config.usage}
+    console.log(chalk11.dim("Usage:"));
+    console.log(chalk11.gray(`  ${config.usage}
 `));
   }
   if (copy) {
     if (copyToClipboard(key)) {
-      console.log(chalk9.green("\u2713 Copied to clipboard!\n"));
+      console.log(chalk11.green("\u2713 Copied to clipboard!\n"));
     } else {
       logger.warn("Could not copy to clipboard");
     }
   }
 }
 function listPresets() {
-  console.log("\n" + chalk9.bold("Available presets:"));
+  console.log("\n" + chalk11.bold("Available presets:"));
   console.log();
   Object.entries(PRESETS).forEach(([name, config]) => {
-    console.log(`  ${chalk9.cyan(name.padEnd(20))} ${chalk9.dim(config.description)}`);
-    console.log(`  ${" ".repeat(20)} ${chalk9.gray(`\u2192 ${config.envVar} (${config.bytes * 8} bits)`)}`);
+    console.log(`  ${chalk11.cyan(name.padEnd(20))} ${chalk11.dim(config.description)}`);
+    console.log(`  ${" ".repeat(20)} ${chalk11.gray(`\u2192 ${config.envVar} (${config.bytes * 8} bits)`)}`);
     console.log();
   });
-  console.log(chalk9.dim("Usage:"));
-  console.log(chalk9.gray("  spfn key <preset>"));
-  console.log(chalk9.gray("  spfn key auth-encryption --copy"));
+  console.log(chalk11.dim("Usage:"));
+  console.log(chalk11.gray("  spfn key <preset>"));
+  console.log(chalk11.gray("  spfn key auth-encryption --copy"));
   console.log();
 }
 var generateValueCommand = new Command8("generate").alias("gen").description("Generate random value (simple output, no metadata)").option("-b, --bytes <number>", "Number of random bytes", "32").option("-c, --copy", "Copy to clipboard").action((options) => {
@@ -2804,9 +3101,9 @@ var generateValueCommand = new Command8("generate").alias("gen").description("Ge
   console.log(value);
   if (options.copy) {
     if (copyToClipboard(value)) {
-      console.error(chalk9.green("\u2713 Copied to clipboard"));
+      console.error(chalk11.green("\u2713 Copied to clipboard"));
     } else {
-      console.error(chalk9.yellow("\u26A0 Could not copy to clipboard"));
+      console.error(chalk11.yellow("\u26A0 Could not copy to clipboard"));
     }
   }
 });
@@ -2824,9 +3121,9 @@ var keyCommand = new Command8("key").alias("k").description("Generate secure ran
     logger.error(`Unknown preset: ${preset}`);
     console.log("\nAvailable presets:");
     Object.entries(PRESETS).forEach(([name, config]) => {
-      console.log(`  ${chalk9.cyan(name)}: ${config.description}`);
+      console.log(`  ${chalk11.cyan(name)}: ${config.description}`);
     });
-    console.log("\nUse " + chalk9.cyan("--list") + " to see detailed information");
+    console.log("\nUse " + chalk11.cyan("--list") + " to see detailed information");
     process.exit(1);
   }
   generateSecret(
@@ -2845,16 +3142,16 @@ init_setup();
 import { Command as Command9 } from "commander";
 
 // src/commands/db/generate.ts
-import chalk11 from "chalk";
+import chalk13 from "chalk";
 
 // src/commands/db/utils/drizzle.ts
-import { existsSync as existsSync18, writeFileSync as writeFileSync13, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync20, writeFileSync as writeFileSync13, unlinkSync as unlinkSync2 } from "fs";
 import { spawn } from "child_process";
 import { pathToFileURL } from "url";
-import chalk10 from "chalk";
+import chalk12 from "chalk";
 import ora6 from "ora";
-import { env } from "@spfn/core/config";
-import { loadEnv } from "@spfn/core/server";
+import { env as env3 } from "@spfn/core/config";
+import { loadEnv as loadEnv3 } from "@spfn/core/server";
 var TLS_SSL_MODES = /* @__PURE__ */ new Set(["no-verify", "prefer", "require", "verify-ca", "verify-full"]);
 function parseDatabaseUrl(databaseUrl) {
   if (!databaseUrl) {
@@ -2907,22 +3204,22 @@ function resolvePushConnectionConfig(databaseUrl) {
   return { connectionString: parsedUrl.toString() };
 }
 function validateDatabasePrerequisites() {
-  loadEnv();
-  if (!env.DATABASE_URL) {
-    console.error(chalk10.red("\u274C DATABASE_URL not found in environment"));
-    console.log(chalk10.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+  loadEnv3();
+  if (!env3.DATABASE_URL) {
+    console.error(chalk12.red("\u274C DATABASE_URL not found in environment"));
+    console.log(chalk12.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     throw new Error("DATABASE_URL is required for database operations");
   }
 }
 async function runDrizzleCommand(command) {
-  const hasUserConfig = existsSync18("./drizzle.config.ts");
+  const hasUserConfig = existsSync20("./drizzle.config.ts");
   const tempConfigPath = `./drizzle.config.${process.pid}.${Date.now()}.temp.ts`;
   const configPath = hasUserConfig ? "./drizzle.config.ts" : tempConfigPath;
   if (!hasUserConfig) {
-    loadEnv();
-    if (!env.DATABASE_URL) {
-      console.error(chalk10.red("\u274C DATABASE_URL not found in environment"));
-      console.log(chalk10.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+    loadEnv3();
+    if (!env3.DATABASE_URL) {
+      console.error(chalk12.red("\u274C DATABASE_URL not found in environment"));
+      console.log(chalk12.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
       process.exit(1);
     }
     const { generateDrizzleConfigFile } = await import("@spfn/core/db");
@@ -2935,7 +3232,7 @@ async function runDrizzleCommand(command) {
       autoDetectSchemas: true
     });
     writeFileSync13(tempConfigPath, configContent);
-    console.log(chalk10.dim("Using auto-generated Drizzle config\n"));
+    console.log(chalk12.dim("Using auto-generated Drizzle config\n"));
   }
   const args = command.split(" ");
   args.push(`--config=${configPath}`);
@@ -2944,10 +3241,10 @@ async function runDrizzleCommand(command) {
       stdio: "inherit",
       // Allow interactive input
       shell: true,
-      env: shouldRelaxDbTls(env.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
+      env: shouldRelaxDbTls(env3.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
     });
     const cleanup = () => {
-      if (!hasUserConfig && existsSync18(tempConfigPath)) {
+      if (!hasUserConfig && existsSync20(tempConfigPath)) {
         unlinkSync2(tempConfigPath);
       }
     };
@@ -2970,10 +3267,10 @@ async function runWithSpinner(spinnerText, command, successMessage, failMessage)
   try {
     spinner.stop();
     await runDrizzleCommand(command);
-    console.log(chalk10.green(`\u2705 ${successMessage}`));
+    console.log(chalk12.green(`\u2705 ${successMessage}`));
   } catch (error) {
     spinner.fail(failMessage);
-    console.error(chalk10.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk12.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
@@ -2997,13 +3294,13 @@ async function loadSchemaImports(schemaFiles) {
   return imports;
 }
 async function createPushConnection() {
-  loadEnv();
-  if (!env.DATABASE_URL) {
+  loadEnv3();
+  if (!env3.DATABASE_URL) {
     throw new Error("DATABASE_URL is required");
   }
   const pg = await import("pg");
   const { drizzle } = await import("drizzle-orm/node-postgres");
-  const connectionConfig = resolvePushConnectionConfig(env.DATABASE_URL);
+  const connectionConfig = resolvePushConnectionConfig(env3.DATABASE_URL);
   const pool = new pg.default.Pool({
     ...connectionConfig,
     max: 1
@@ -3019,19 +3316,19 @@ async function createPushConnection() {
 async function dbGenerate() {
   try {
     await runDrizzleCommand("generate");
-    console.log(chalk11.green("\n\u2705 Migrations generated successfully"));
+    console.log(chalk13.green("\n\u2705 Migrations generated successfully"));
   } catch (error) {
-    console.error(chalk11.red("\n\u274C Failed to generate migrations"));
-    console.error(chalk11.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk13.red("\n\u274C Failed to generate migrations"));
+    console.error(chalk13.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
 
 // src/commands/db/push.ts
-import chalk14 from "chalk";
-import prompts3 from "prompts";
+import chalk15 from "chalk";
+import prompts4 from "prompts";
 import "@spfn/core/config";
-import { loadEnv as loadEnv3 } from "@spfn/core/server";
+import { loadEnv as loadEnv4 } from "@spfn/core/server";
 import { sql } from "drizzle-orm";
 import { getTableConfig } from "drizzle-orm/pg-core";
 
@@ -3075,7 +3372,7 @@ function classifyStatements(statements) {
 }
 
 // src/commands/db/utils/push-display.ts
-import chalk12 from "chalk";
+import chalk14 from "chalk";
 function formatSql(sql2) {
   return sql2.replace(/\s+/g, " ").trim();
 }
@@ -3083,30 +3380,30 @@ function printStatements(statements, color) {
   for (const stmt of statements) {
     console.log(color(`   ${formatSql(stmt.sql)}`));
     if (stmt.reason) {
-      console.log(chalk12.dim(`   \u2192 ${stmt.reason}`));
+      console.log(chalk14.dim(`   \u2192 ${stmt.reason}`));
     }
   }
 }
 function displayClassifiedStatements(result) {
   if (result.safe.length > 0) {
-    console.log(chalk12.green(`
+    console.log(chalk14.green(`
 \u2705 Safe changes (${result.safe.length}):`));
-    printStatements(result.safe, chalk12.green);
+    printStatements(result.safe, chalk14.green);
   }
   if (result.warning.length > 0) {
-    console.log(chalk12.yellow(`
+    console.log(chalk14.yellow(`
 \u26A0\uFE0F  Warnings (${result.warning.length}):`));
-    printStatements(result.warning, chalk12.yellow);
+    printStatements(result.warning, chalk14.yellow);
   }
   if (result.destructive.length > 0) {
-    console.log(chalk12.red(`
+    console.log(chalk14.red(`
 \u274C Destructive changes (${result.destructive.length}):`));
-    printStatements(result.destructive, chalk12.red);
+    printStatements(result.destructive, chalk14.red);
   }
 }
 function displayDryRunSummary(result) {
   const total = result.safe.length + result.warning.length + result.destructive.length;
-  console.log(chalk12.cyan(`
+  console.log(chalk14.cyan(`
 \u{1F50D} Dry-run: ${total} statement(s) detected
 `));
   displayClassifiedStatements(result);
@@ -3114,11 +3411,11 @@ function displayDryRunSummary(result) {
 }
 function displayApplySummary(applied, skipped) {
   if (applied > 0) {
-    console.log(chalk12.green(`
+    console.log(chalk14.green(`
 \u2705 Applied ${applied} statement(s)`));
   }
   if (skipped > 0) {
-    console.log(chalk12.yellow(`\u23ED\uFE0F  Skipped ${skipped} destructive statement(s)`));
+    console.log(chalk14.yellow(`\u23ED\uFE0F  Skipped ${skipped} destructive statement(s)`));
   }
   console.log("");
 }
@@ -3153,7 +3450,7 @@ async function applyStatements(db, statements) {
 }
 async function dbPush(options = {}) {
   validateDatabasePrerequisites();
-  loadEnv3();
+  loadEnv4();
   const { getDrizzleConfig } = await import("@spfn/core/db");
   const config = getDrizzleConfig({
     cwd: process.cwd(),
@@ -3163,10 +3460,10 @@ async function dbPush(options = {}) {
   });
   const schemaFiles = Array.isArray(config.schema) ? config.schema : [config.schema];
   if (schemaFiles.length === 0) {
-    console.log(chalk14.yellow("No schema files found."));
+    console.log(chalk15.yellow("No schema files found."));
     return;
   }
-  console.log(chalk14.dim(`Found ${schemaFiles.length} schema file(s)
+  console.log(chalk15.dim(`Found ${schemaFiles.length} schema file(s)
 `));
   const imports = await loadSchemaImports(schemaFiles);
   const detectedSchemas = new Set(config.schemaFilter ?? ["public"]);
@@ -3185,10 +3482,10 @@ async function dbPush(options = {}) {
   try {
     const { statements, hints } = await resolvePushPlan(imports, db, schemaFilter);
     for (const hint of hints) {
-      console.log(chalk14.yellow(`\u26A0\uFE0F  ${hint.hint}`));
+      console.log(chalk15.yellow(`\u26A0\uFE0F  ${hint.hint}`));
     }
     if (statements.length === 0) {
-      console.log(chalk14.green("\u2705 No changes detected \u2014 database is up to date\n"));
+      console.log(chalk15.green("\u2705 No changes detected \u2014 database is up to date\n"));
       await applyFunctionMigrations(functionPlans);
       return;
     }
@@ -3199,7 +3496,7 @@ async function dbPush(options = {}) {
     }
     displayClassifiedStatements(result);
     if (options.force) {
-      console.log(chalk14.dim("\n--force: applying all changes..."));
+      console.log(chalk15.dim("\n--force: applying all changes..."));
       await applyStatements(db, statements);
       displayApplySummary(statements.length, 0);
     } else if (result.destructive.length === 0) {
@@ -3208,13 +3505,13 @@ async function dbPush(options = {}) {
     } else {
       const destructiveSet = new Set(result.destructive.map((s) => s.sql));
       const nonDestructive = statements.filter((s) => !destructiveSet.has(s));
-      console.log(chalk14.red(`
+      console.log(chalk15.red(`
 \u274C ${result.destructive.length} destructive change(s) require confirmation:`));
       for (const stmt of result.destructive) {
-        console.log(chalk14.red(`   ${stmt.sql.replace(/\s+/g, " ").trim()}`));
-        console.log(chalk14.dim(`   \u2192 ${stmt.reason}`));
+        console.log(chalk15.red(`   ${stmt.sql.replace(/\s+/g, " ").trim()}`));
+        console.log(chalk15.dim(`   \u2192 ${stmt.reason}`));
       }
-      const { confirm } = await prompts3({
+      const { confirm } = await prompts4({
         type: "confirm",
         name: "confirm",
         message: "Apply destructive changes?",
@@ -3228,7 +3525,7 @@ async function dbPush(options = {}) {
           await applyStatements(db, nonDestructive);
         }
         displayApplySummary(nonDestructive.length, result.destructive.length);
-        console.log(chalk14.dim("Tip: Use --force to apply all changes without prompting.\n"));
+        console.log(chalk15.dim("Tip: Use --force to apply all changes without prompting.\n"));
       }
     }
     await applyFunctionMigrations(functionPlans);
@@ -3241,8 +3538,8 @@ function loadFunctionPlansOrExit() {
   try {
     return loadFunctionMigrationPlans(functions);
   } catch (error) {
-    console.error(chalk14.red("\n\u274C Invalid function package migrations \u2014 nothing was applied"));
-    console.error(chalk14.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk15.red("\n\u274C Invalid function package migrations \u2014 nothing was applied"));
+    console.error(chalk15.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
@@ -3250,37 +3547,37 @@ async function applyFunctionMigrations(plans) {
   if (plans.length === 0) {
     return;
   }
-  console.log(chalk14.blue("\n\u{1F4E6} Applying function package migrations:"));
+  console.log(chalk15.blue("\n\u{1F4E6} Applying function package migrations:"));
   plans.forEach((plan) => {
-    console.log(chalk14.dim(`  - ${plan.packageName}`));
+    console.log(chalk15.dim(`  - ${plan.packageName}`));
   });
   try {
     await executeFunctionMigrations(plans);
-    console.log(chalk14.green("\n\u2705 All function migrations applied\n"));
+    console.log(chalk15.green("\n\u2705 All function migrations applied\n"));
   } catch (error) {
-    console.error(chalk14.red("\n\u274C Failed to apply function package migrations"));
-    console.error(chalk14.red(error instanceof Error ? error.message : "Unknown error"));
-    console.error(chalk14.yellow("Project schema changes (if any) were already applied \u2014 only function package migrations failed."));
+    console.error(chalk15.red("\n\u274C Failed to apply function package migrations"));
+    console.error(chalk15.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk15.yellow("Project schema changes (if any) were already applied \u2014 only function package migrations failed."));
     process.exit(1);
   }
 }
 
 // src/commands/db/migrate.ts
-import chalk19 from "chalk";
-import { join as join20 } from "path";
-import { existsSync as existsSync21 } from "fs";
+import chalk20 from "chalk";
+import { join as join21 } from "path";
+import { existsSync as existsSync22 } from "fs";
 
 // src/commands/db/backup.ts
 import { promises as fs3 } from "fs";
 import path3 from "path";
 import { spawn as spawn2 } from "child_process";
-import chalk18 from "chalk";
+import chalk19 from "chalk";
 import ora7 from "ora";
 
 // src/commands/db/utils/database.ts
 import net from "net";
-import chalk15 from "chalk";
-import prompts4 from "prompts";
+import chalk16 from "chalk";
+import prompts5 from "prompts";
 function parseDatabaseUrl2(dbUrl) {
   try {
     const url = new URL(dbUrl);
@@ -3304,13 +3601,13 @@ async function confirmDangerousTarget(dbInfo) {
   if (!isRemoteHost(dbInfo.host) && process.env.NODE_ENV !== "production") {
     return;
   }
-  const { typed } = await prompts4({
+  const { typed } = await prompts5({
     type: "text",
     name: "typed",
     message: `Remote/production database detected. Type the database name "${dbInfo.database}" to continue:`
   });
   if (typed !== dbInfo.database) {
-    console.log(chalk15.gray("Cancelled (database name mismatch)."));
+    console.log(chalk16.gray("Cancelled (database name mismatch)."));
     process.exit(0);
   }
 }
@@ -3361,16 +3658,16 @@ function formatTimestamp() {
 
 // src/commands/db/utils/backup-files.ts
 import { promises as fs2 } from "fs";
-import { existsSync as existsSync20 } from "fs";
+import { existsSync as existsSync21 } from "fs";
 import path2 from "path";
-import chalk17 from "chalk";
+import chalk18 from "chalk";
 
 // src/commands/db/utils/metadata.ts
 import { promises as fs } from "fs";
 import path from "path";
 import { promisify } from "util";
 import { exec } from "child_process";
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 var execAsync = promisify(exec);
 async function collectGitInfo() {
   try {
@@ -3433,7 +3730,7 @@ async function collectMigrationInfo(dbUrl) {
       await pool.end();
     }
   } catch (error) {
-    console.log(chalk16.dim("\u26A0\uFE0F  Could not fetch migration info"));
+    console.log(chalk17.dim("\u26A0\uFE0F  Could not fetch migration info"));
     return void 0;
   }
 }
@@ -3441,9 +3738,9 @@ async function saveBackupMetadata(metadata, backupFilename) {
   const metadataPath = backupFilename.replace(/\.(sql|dump)$/, ".meta.json");
   try {
     await fs.writeFile(metadataPath, JSON.stringify(metadata, null, 2));
-    console.log(chalk16.dim(`\u2713 Metadata saved: ${path.basename(metadataPath)}`));
+    console.log(chalk17.dim(`\u2713 Metadata saved: ${path.basename(metadataPath)}`));
   } catch (error) {
-    console.log(chalk16.dim("\u26A0\uFE0F  Could not save metadata"));
+    console.log(chalk17.dim("\u26A0\uFE0F  Could not save metadata"));
   }
 }
 async function loadBackupMetadata(backupFilename) {
@@ -3461,7 +3758,7 @@ async function ensureBackupInGitignore() {
   const gitignorePath = path2.join(process.cwd(), ".gitignore");
   try {
     let content = "";
-    let exists = existsSync20(gitignorePath);
+    let exists = existsSync21(gitignorePath);
     if (exists) {
       content = await fs2.readFile(gitignorePath, "utf-8");
     }
@@ -3472,10 +3769,10 @@ async function ensureBackupInGitignore() {
     if (!hasBackupsIgnore) {
       const entry = exists && content && !content.endsWith("\n") ? "\n\n# Database backups\nbackups/\n" : "# Database backups\nbackups/\n";
       await fs2.appendFile(gitignorePath, entry);
-      console.log(chalk17.dim("\u2713 Added backups/ to .gitignore"));
+      console.log(chalk18.dim("\u2713 Added backups/ to .gitignore"));
     }
   } catch (error) {
-    console.log(chalk17.dim("\u26A0\uFE0F  Could not update .gitignore"));
+    console.log(chalk18.dim("\u26A0\uFE0F  Could not update .gitignore"));
   }
 }
 async function ensureBackupDir() {
@@ -3483,7 +3780,7 @@ async function ensureBackupDir() {
   try {
     await fs2.mkdir(backupDir, { recursive: true });
     const gitignorePath = path2.join(backupDir, ".gitignore");
-    const gitignoreExists = existsSync20(gitignorePath);
+    const gitignoreExists = existsSync21(gitignorePath);
     if (!gitignoreExists) {
       await fs2.writeFile(gitignorePath, "# Ignore all backup files\n*.sql\n*.dump\n*.meta.json\n");
     }
@@ -3522,15 +3819,15 @@ async function listBackupFiles() {
 }
 
 // src/commands/db/backup.ts
-import { env as env3 } from "@spfn/core/config";
-import { loadEnv as loadEnv4 } from "@spfn/core/server";
+import { env as env4 } from "@spfn/core/config";
+import { loadEnv as loadEnv5 } from "@spfn/core/server";
 async function dbBackup(options) {
-  console.log(chalk18.blue("\u{1F4BE} Creating database backup...\n"));
-  loadEnv4();
-  const dbUrl = env3.DATABASE_URL;
+  console.log(chalk19.blue("\u{1F4BE} Creating database backup...\n"));
+  loadEnv5();
+  const dbUrl = env4.DATABASE_URL;
   if (!dbUrl) {
-    console.error(chalk18.red("\u274C DATABASE_URL not found in environment"));
-    console.log(chalk18.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+    console.error(chalk19.red("\u274C DATABASE_URL not found in environment"));
+    console.log(chalk19.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     process.exit(1);
   }
   const dbInfo = parseDatabaseUrl2(dbUrl);
@@ -3540,7 +3837,7 @@ async function dbBackup(options) {
   const ext = format === "sql" ? "sql" : "dump";
   const filename = options.output || path3.join(backupDir, `${dbInfo.database}_${timestamp}.${ext}`);
   if (options.dataOnly && options.schemaOnly) {
-    console.error(chalk18.red("\u274C Cannot use --data-only and --schema-only together"));
+    console.error(chalk19.red("\u274C Cannot use --data-only and --schema-only together"));
     process.exit(1);
   }
   const args = [
@@ -3586,11 +3883,11 @@ async function dbBackup(options) {
           const stats = await fs3.stat(filename);
           const size = formatBytes(stats.size);
           spinner.succeed("Backup created");
-          console.log(chalk18.green(`
+          console.log(chalk19.green(`
 \u2705 Backup created successfully`));
-          console.log(chalk18.gray(`   File: ${filename}`));
-          console.log(chalk18.gray(`   Size: ${size}`));
-          console.log(chalk18.dim("\n\u{1F4CB} Collecting metadata..."));
+          console.log(chalk19.gray(`   File: ${filename}`));
+          console.log(chalk19.gray(`   Size: ${size}`));
+          console.log(chalk19.dim("\n\u{1F4CB} Collecting metadata..."));
           const [gitInfo, migrationInfo] = await Promise.all([
             collectGitInfo(),
             collectMigrationInfo(dbUrl)
@@ -3630,19 +3927,19 @@ async function dbBackup(options) {
       reject(error);
     });
   }).catch((error) => {
-    console.error(chalk18.red("\n\u274C Failed to create backup"));
+    console.error(chalk19.red("\n\u274C Failed to create backup"));
     if (errorOutput.includes("pg_dump: command not found") || errorOutput.includes("not found")) {
-      console.error(chalk18.yellow("\n\u{1F4A1} pg_dump is not installed. Please install PostgreSQL client tools."));
+      console.error(chalk19.yellow("\n\u{1F4A1} pg_dump is not installed. Please install PostgreSQL client tools."));
     } else {
-      console.error(chalk18.red(error instanceof Error ? error.message : "Unknown error"));
+      console.error(chalk19.red(error instanceof Error ? error.message : "Unknown error"));
     }
     process.exit(1);
   });
 }
 
 // src/commands/db/migrate.ts
-import { env as env4 } from "@spfn/core/config";
-import { loadEnv as loadEnv5 } from "@spfn/core/server";
+import { env as env5 } from "@spfn/core/config";
+import { loadEnv as loadEnv6 } from "@spfn/core/server";
 var PROJECT_MIGRATIONS_TABLE = "__drizzle_migrations";
 async function dbMigrate(options = {}) {
   try {
@@ -3651,7 +3948,7 @@ async function dbMigrate(options = {}) {
     process.exit(1);
   }
   if (options.withBackup) {
-    console.log(chalk19.blue("\u{1F4E6} Creating pre-migration backup...\n"));
+    console.log(chalk20.blue("\u{1F4E6} Creating pre-migration backup...\n"));
     await dbBackup({
       format: "custom",
       tag: "pre-migration",
@@ -3662,68 +3959,108 @@ async function dbMigrate(options = {}) {
   const { drizzle } = await import("drizzle-orm/postgres-js");
   const { migrate } = await import("drizzle-orm/postgres-js/migrator");
   const postgres = await import("postgres");
-  loadEnv5();
-  if (!env4.DATABASE_URL) {
-    console.error(chalk19.red("\u274C DATABASE_URL not found in environment"));
+  loadEnv6();
+  if (!env5.DATABASE_URL) {
+    console.error(chalk20.red("\u274C DATABASE_URL not found in environment"));
     process.exit(1);
   }
   const { discoverFunctionMigrations: discoverFunctionMigrations2, loadFunctionMigrationPlans: loadFunctionMigrationPlans2, executeFunctionMigrations: executeFunctionMigrations2 } = await Promise.resolve().then(() => (init_function_migrations(), function_migrations_exports));
   const functions = discoverFunctionMigrations2(process.cwd());
   if (functions.length > 0) {
-    console.log(chalk19.blue("\u{1F4E6} Applying function package migrations:"));
+    console.log(chalk20.blue("\u{1F4E6} Applying function package migrations:"));
     functions.forEach((func) => {
-      console.log(chalk19.dim(`  - ${func.packageName}`));
+      console.log(chalk20.dim(`  - ${func.packageName}`));
     });
     await executeFunctionMigrations2(loadFunctionMigrationPlans2(functions));
-    console.log(chalk19.green("\u2705 Function migrations applied\n"));
+    console.log(chalk20.green("\u2705 Function migrations applied\n"));
   }
-  const projectMigrationsDir = join20(process.cwd(), "src/server/drizzle");
-  if (existsSync21(projectMigrationsDir)) {
-    const projConn = postgres.default(env4.DATABASE_URL, { max: 1 });
+  const projectMigrationsDir = join21(process.cwd(), "src/server/drizzle");
+  if (existsSync22(projectMigrationsDir)) {
+    const projConn = postgres.default(env5.DATABASE_URL, { max: 1 });
     const projDb = drizzle({ client: projConn });
     try {
-      console.log(chalk19.blue("\u{1F4E6} Running project migrations..."));
+      console.log(chalk20.blue("\u{1F4E6} Running project migrations..."));
       await migrate(projDb, {
         migrationsFolder: projectMigrationsDir,
         migrationsTable: PROJECT_MIGRATIONS_TABLE
       });
-      console.log(chalk19.green("\u2705 Project migrations applied successfully"));
+      console.log(chalk20.green("\u2705 Project migrations applied successfully"));
     } finally {
       await projConn.end();
     }
   } else {
-    console.log(chalk19.dim("No project migrations found (src/server/drizzle)"));
+    console.log(chalk20.dim("No project migrations found (src/server/drizzle)"));
+  }
+}
+
+// src/commands/db/status.ts
+import chalk21 from "chalk";
+init_migration_status();
+async function dbStatus() {
+  try {
+    validateDatabasePrerequisites();
+  } catch (error) {
+    process.exit(1);
+  }
+  let status;
+  try {
+    status = await getMigrationStatus(process.cwd());
+  } catch (error) {
+    console.error(chalk21.red("\u274C Failed to read migration status"));
+    console.error(chalk21.red(error instanceof Error ? error.message : "Unknown error"));
+    process.exit(1);
+  }
+  const targets = [...status.packages, ...status.project ? [status.project] : []];
+  if (targets.length === 0) {
+    console.log(chalk21.dim("No migrations found (no @spfn packages with migrations, no src/server/drizzle)."));
+    return;
+  }
+  console.log(chalk21.blue("\u{1F4E6} Migration status:\n"));
+  for (const target of targets) {
+    const state = target.pending === 0 ? chalk21.green(`${target.applied}/${target.total} applied`) : chalk21.yellow(`${target.applied}/${target.total} applied, ${target.pending} pending`);
+    console.log(`  ${target.name.padEnd(32)} ${state}`);
+    for (const tag of target.pendingTags) {
+      console.log(chalk21.dim(`      - ${tag}`));
+    }
+  }
+  const pendingTotal = targets.reduce((sum, t) => sum + t.pending, 0);
+  if (pendingTotal === 0) {
+    console.log(chalk21.green("\n\u2705 Database is up to date\n"));
+  } else {
+    console.log(chalk21.yellow(`
+\u26A0\uFE0F  ${pendingTotal} pending migration(s) \u2014 run: pnpm spfn db migrate
+`));
   }
 }
 
 // src/commands/db/studio.ts
-import chalk20 from "chalk";
-import { existsSync as existsSync22, writeFileSync as writeFileSync14, unlinkSync as unlinkSync3 } from "fs";
+import chalk22 from "chalk";
+import { existsSync as existsSync23, writeFileSync as writeFileSync14, unlinkSync as unlinkSync3 } from "fs";
 import { spawn as spawn3 } from "child_process";
-import { env as env5 } from "@spfn/core/config";
+import { env as env6 } from "@spfn/core/config";
 async function dbStudio(requestedPort) {
-  console.log(chalk20.blue("\u{1F3A8} Opening Drizzle Studio...\n"));
+  console.log(chalk22.blue("\u{1F3A8} Opening Drizzle Studio...\n"));
   const defaultPort = 4983;
   const startPort = requestedPort || defaultPort;
   let port;
   try {
     port = await findAvailablePort(startPort);
     if (port !== startPort) {
-      console.log(chalk20.yellow(`\u26A0\uFE0F  Port ${startPort} is in use, using port ${port} instead
+      console.log(chalk22.yellow(`\u26A0\uFE0F  Port ${startPort} is in use, using port ${port} instead
 `));
     }
   } catch (error) {
-    console.error(chalk20.red(error instanceof Error ? error.message : "Failed to find available port"));
+    console.error(chalk22.red(error instanceof Error ? error.message : "Failed to find available port"));
     process.exit(1);
   }
-  const hasUserConfig = existsSync22("./drizzle.config.ts");
+  const hasUserConfig = existsSync23("./drizzle.config.ts");
   const tempConfigPath = `./drizzle.config.${process.pid}.${Date.now()}.temp.ts`;
   try {
     const configPath = hasUserConfig ? "./drizzle.config.ts" : tempConfigPath;
     if (!hasUserConfig) {
-      if (!env5.DATABASE_URL) {
-        console.error(chalk20.red("\u274C DATABASE_URL not found in environment"));
-        console.log(chalk20.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+      if (!env6.DATABASE_URL) {
+        console.error(chalk22.red("\u274C DATABASE_URL not found in environment"));
+        console.log(chalk22.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
         process.exit(1);
       }
       const { generateDrizzleConfigFile } = await import("@spfn/core/db");
@@ -3734,34 +4071,34 @@ async function dbStudio(requestedPort) {
         // Expand glob patterns for Studio compatibility
       });
       writeFileSync14(tempConfigPath, configContent);
-      console.log(chalk20.dim("Using auto-generated Drizzle config\n"));
+      console.log(chalk22.dim("Using auto-generated Drizzle config\n"));
     }
     const studioProcess = spawn3("drizzle-kit", ["studio", `--port=${port}`, `--config=${configPath}`], {
       stdio: "inherit",
       shell: true,
-      env: shouldRelaxDbTls(env5.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
+      env: shouldRelaxDbTls(env6.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
     });
     const cleanup = () => {
-      if (!hasUserConfig && existsSync22(tempConfigPath)) {
+      if (!hasUserConfig && existsSync23(tempConfigPath)) {
         unlinkSync3(tempConfigPath);
       }
     };
     studioProcess.on("exit", (code) => {
       cleanup();
       if (code !== 0 && code !== null) {
-        console.error(chalk20.red(`
+        console.error(chalk22.red(`
 \u274C Drizzle Studio exited with code ${code}`));
         process.exit(code);
       }
     });
     studioProcess.on("error", (error) => {
       cleanup();
-      console.error(chalk20.red("\u274C Failed to start Drizzle Studio"));
-      console.error(chalk20.red(error.message));
+      console.error(chalk22.red("\u274C Failed to start Drizzle Studio"));
+      console.error(chalk22.red(error.message));
       process.exit(1);
     });
     process.on("SIGINT", () => {
-      console.log(chalk20.yellow("\n\n\u{1F44B} Shutting down Drizzle Studio..."));
+      console.log(chalk22.yellow("\n\n\u{1F44B} Shutting down Drizzle Studio..."));
       studioProcess.kill("SIGTERM");
       cleanup();
       process.exit(0);
@@ -3772,39 +4109,39 @@ async function dbStudio(requestedPort) {
       process.exit(0);
     });
   } catch (error) {
-    if (!hasUserConfig && existsSync22(tempConfigPath)) {
+    if (!hasUserConfig && existsSync23(tempConfigPath)) {
       unlinkSync3(tempConfigPath);
     }
-    console.error(chalk20.red("\u274C Failed to start Drizzle Studio"));
-    console.error(chalk20.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk22.red("\u274C Failed to start Drizzle Studio"));
+    console.error(chalk22.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
 
 // src/commands/db/drop.ts
-import chalk21 from "chalk";
-import prompts5 from "prompts";
-import { env as env6 } from "@spfn/core/config";
-import { loadEnv as loadEnv6 } from "@spfn/core/server";
+import chalk23 from "chalk";
+import prompts6 from "prompts";
+import { env as env7 } from "@spfn/core/config";
+import { loadEnv as loadEnv7 } from "@spfn/core/server";
 async function dbDrop() {
-  loadEnv6();
-  if (!env6.DATABASE_URL) {
-    console.error(chalk21.red("\u274C DATABASE_URL not found in environment"));
-    console.log(chalk21.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+  loadEnv7();
+  if (!env7.DATABASE_URL) {
+    console.error(chalk23.red("\u274C DATABASE_URL not found in environment"));
+    console.log(chalk23.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     process.exit(1);
   }
-  const dbInfo = parseDatabaseUrl2(env6.DATABASE_URL);
-  console.log(chalk21.yellow("\u26A0\uFE0F  WARNING: This will drop all tables in your database!"));
-  console.log(chalk21.dim(`   Target: ${dbInfo.database} @ ${dbInfo.host}:${dbInfo.port}
+  const dbInfo = parseDatabaseUrl2(env7.DATABASE_URL);
+  console.log(chalk23.yellow("\u26A0\uFE0F  WARNING: This will drop all tables in your database!"));
+  console.log(chalk23.dim(`   Target: ${dbInfo.database} @ ${dbInfo.host}:${dbInfo.port}
 `));
-  const { confirm } = await prompts5({
+  const { confirm } = await prompts6({
     type: "confirm",
     name: "confirm",
     message: "Are you sure you want to drop all tables?",
     initial: false
   });
   if (!confirm) {
-    console.log(chalk21.gray("Cancelled."));
+    console.log(chalk23.gray("Cancelled."));
     process.exit(0);
   }
   await confirmDangerousTarget(dbInfo);
@@ -3817,16 +4154,16 @@ async function dbDrop() {
 }
 
 // src/commands/db/check.ts
-import chalk22 from "chalk";
+import chalk24 from "chalk";
 import ora8 from "ora";
 async function dbCheck() {
-  const spinner = ora8("Checking database connection...").start();
+  const spinner = ora8("Checking migration files...").start();
   try {
     await runDrizzleCommand("check");
-    spinner.succeed("Database connection OK");
+    spinner.succeed("Migration files consistent");
   } catch (error) {
-    spinner.fail("Database connection failed");
-    console.error(chalk22.red(error instanceof Error ? error.message : "Unknown error"));
+    spinner.fail("Migration file check failed");
+    console.error(chalk24.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
@@ -3834,28 +4171,28 @@ async function dbCheck() {
 // src/commands/db/restore.ts
 import path4 from "path";
 import { spawn as spawn4 } from "child_process";
-import chalk23 from "chalk";
+import chalk25 from "chalk";
 import ora9 from "ora";
-import prompts6 from "prompts";
-import { env as env7 } from "@spfn/core/config";
-import { loadEnv as loadEnv7 } from "@spfn/core/server";
+import prompts7 from "prompts";
+import { env as env8 } from "@spfn/core/config";
+import { loadEnv as loadEnv8 } from "@spfn/core/server";
 async function dbRestore(backupFile, options = {}) {
-  console.log(chalk23.blue("\u267B\uFE0F  Restoring database from backup...\n"));
-  loadEnv7();
-  const dbUrl = env7.DATABASE_URL;
+  console.log(chalk25.blue("\u267B\uFE0F  Restoring database from backup...\n"));
+  loadEnv8();
+  const dbUrl = env8.DATABASE_URL;
   if (!dbUrl) {
-    console.error(chalk23.red("\u274C DATABASE_URL not found in environment"));
-    console.log(chalk23.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+    console.error(chalk25.red("\u274C DATABASE_URL not found in environment"));
+    console.log(chalk25.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     process.exit(1);
   }
   let file = backupFile;
   if (!file) {
     const backups = await listBackupFiles();
     if (backups.length === 0) {
-      console.log(chalk23.yellow("No backups found in ./backups directory"));
+      console.log(chalk25.yellow("No backups found in ./backups directory"));
       process.exit(0);
     }
-    const { selected } = await prompts6({
+    const { selected } = await prompts7({
       type: "select",
       name: "selected",
       message: "Select backup to restore:",
@@ -3865,31 +4202,31 @@ async function dbRestore(backupFile, options = {}) {
       }))
     });
     if (!selected) {
-      console.log(chalk23.gray("Cancelled"));
+      console.log(chalk25.gray("Cancelled"));
       process.exit(0);
     }
     file = selected;
   }
   if (!file) {
-    console.error(chalk23.red("\u274C No backup file selected"));
+    console.error(chalk25.red("\u274C No backup file selected"));
     process.exit(1);
   }
   const metadata = await loadBackupMetadata(file);
   if (metadata) {
-    console.log(chalk23.blue("\n\u{1F4CB} Backup Information:\n"));
-    console.log(chalk23.dim(`  Database: ${metadata.database}`));
-    console.log(chalk23.dim(`  Created: ${new Date(metadata.timestamp).toLocaleString()}`));
+    console.log(chalk25.blue("\n\u{1F4CB} Backup Information:\n"));
+    console.log(chalk25.dim(`  Database: ${metadata.database}`));
+    console.log(chalk25.dim(`  Created: ${new Date(metadata.timestamp).toLocaleString()}`));
     if (metadata.environment) {
-      console.log(chalk23.dim(`  Environment: ${metadata.environment}`));
+      console.log(chalk25.dim(`  Environment: ${metadata.environment}`));
     }
     if (metadata.tags && metadata.tags.length > 0) {
-      console.log(chalk23.dim(`  Tags: ${metadata.tags.join(", ")}`));
+      console.log(chalk25.dim(`  Tags: ${metadata.tags.join(", ")}`));
     }
     if (metadata.backup.dataOnly) {
-      console.log(chalk23.yellow("  \u26A0\uFE0F  Data-only backup (no schema)"));
+      console.log(chalk25.yellow("  \u26A0\uFE0F  Data-only backup (no schema)"));
     }
     if (metadata.backup.schemaOnly) {
-      console.log(chalk23.yellow("  \u26A0\uFE0F  Schema-only backup (no data)"));
+      console.log(chalk25.yellow("  \u26A0\uFE0F  Schema-only backup (no data)"));
     }
     const warnings2 = [];
     const [currentGitInfo, currentMigrationInfo] = await Promise.all([
@@ -3912,25 +4249,25 @@ async function dbRestore(backupFile, options = {}) {
       }
     }
     if (warnings2.length > 0) {
-      console.log(chalk23.yellow("\n\u26A0\uFE0F  Version Warnings:\n"));
-      warnings2.forEach((warning) => console.log(chalk23.yellow(`  - ${warning}`)));
+      console.log(chalk25.yellow("\n\u26A0\uFE0F  Version Warnings:\n"));
+      warnings2.forEach((warning) => console.log(chalk25.yellow(`  - ${warning}`)));
       console.log("");
     }
   }
   const dbInfo = parseDatabaseUrl2(dbUrl);
-  const { confirm } = await prompts6({
+  const { confirm } = await prompts7({
     type: "confirm",
     name: "confirm",
-    message: chalk23.yellow(`\u26A0\uFE0F  This will replace all data in "${dbInfo.database}" @ ${dbInfo.host}:${dbInfo.port}. Continue?`),
+    message: chalk25.yellow(`\u26A0\uFE0F  This will replace all data in "${dbInfo.database}" @ ${dbInfo.host}:${dbInfo.port}. Continue?`),
     initial: false
   });
   if (!confirm) {
-    console.log(chalk23.gray("Cancelled"));
+    console.log(chalk25.gray("Cancelled"));
     process.exit(0);
   }
   await confirmDangerousTarget(dbInfo);
   if (options.dataOnly && options.schemaOnly) {
-    console.error(chalk23.red("\u274C Cannot use --data-only and --schema-only together"));
+    console.error(chalk25.red("\u274C Cannot use --data-only and --schema-only together"));
     process.exit(1);
   }
   const ext = path4.extname(file);
@@ -3958,11 +4295,11 @@ async function dbRestore(backupFile, options = {}) {
     args.push(file);
   } else {
     if (options.drop) {
-      console.log(chalk23.yellow("\u26A0\uFE0F  Note: --drop only works with custom format backups (.dump) and was ignored."));
+      console.log(chalk25.yellow("\u26A0\uFE0F  Note: --drop only works with custom format backups (.dump) and was ignored."));
     }
     if (options.dataOnly || options.schemaOnly) {
-      console.log(chalk23.yellow("\u26A0\uFE0F  Note: --data-only and --schema-only options only work with custom format backups (.dump)"));
-      console.log(chalk23.yellow("    For SQL files, the backup must have been created with the desired option.\n"));
+      console.log(chalk25.yellow("\u26A0\uFE0F  Note: --data-only and --schema-only options only work with custom format backups (.dump)"));
+      console.log(chalk25.yellow("    For SQL files, the backup must have been created with the desired option.\n"));
     }
     args.push("-h", dbInfo.host);
     args.push("-p", dbInfo.port);
@@ -4005,7 +4342,7 @@ async function dbRestore(backupFile, options = {}) {
       }
       if (verbose) {
         spinner.stop();
-        console.log(chalk23.dim(`  ${line.trim()}`));
+        console.log(chalk25.dim(`  ${line.trim()}`));
         spinner.start();
       }
     }
@@ -4013,7 +4350,7 @@ async function dbRestore(backupFile, options = {}) {
   restoreProcess.stdout?.on("data", (data) => {
     if (verbose) {
       spinner.stop();
-      console.log(chalk23.dim(`  ${data.toString().trim()}`));
+      console.log(chalk25.dim(`  ${data.toString().trim()}`));
       spinner.start();
     }
   });
@@ -4023,31 +4360,31 @@ async function dbRestore(backupFile, options = {}) {
         const summary = objectCount > 0 ? ` (${objectCount} objects)` : "";
         spinner.succeed(`Restore completed${summary}`);
         if (warnings.length > 0) {
-          console.log(chalk23.yellow(`
+          console.log(chalk25.yellow(`
 \u26A0\uFE0F  Warnings during restore (${warnings.length}):
 `));
           for (const w of warnings) {
-            console.log(chalk23.yellow(`  - ${w}`));
+            console.log(chalk25.yellow(`  - ${w}`));
           }
         }
-        console.log(chalk23.green("\n\u2705 Database restored successfully"));
+        console.log(chalk25.green("\n\u2705 Database restored successfully"));
         resolve3();
       } else {
         spinner.fail("Restore failed");
         if (errors.length > 0) {
-          console.error(chalk23.red(`
+          console.error(chalk25.red(`
 \u274C Errors (${errors.length}):
 `));
           for (const e of errors) {
-            console.error(chalk23.red(`  - ${e}`));
+            console.error(chalk25.red(`  - ${e}`));
           }
         }
         if (warnings.length > 0) {
-          console.log(chalk23.yellow(`
+          console.log(chalk25.yellow(`
 \u26A0\uFE0F  Warnings (${warnings.length}):
 `));
           for (const w of warnings) {
-            console.log(chalk23.yellow(`  - ${w}`));
+            console.log(chalk25.yellow(`  - ${w}`));
           }
         }
         const fallback = errors.length === 0 && warnings.length === 0 ? "Restore failed with no output" : "";
@@ -4061,7 +4398,7 @@ async function dbRestore(backupFile, options = {}) {
   }).catch((error) => {
     const msg = error instanceof Error ? error.message : "Unknown error";
     if (msg) {
-      console.error(chalk23.red(`
+      console.error(chalk25.red(`
 \u274C ${msg}`));
     }
     process.exit(1);
@@ -4069,17 +4406,17 @@ async function dbRestore(backupFile, options = {}) {
 }
 
 // src/commands/db/list.ts
-import chalk24 from "chalk";
+import chalk26 from "chalk";
 async function dbBackupList() {
-  console.log(chalk24.blue("\u{1F4CB} Database backups:\n"));
+  console.log(chalk26.blue("\u{1F4CB} Database backups:\n"));
   const backups = await listBackupFiles();
   if (backups.length === 0) {
-    console.log(chalk24.yellow("No backups found in ./backups directory"));
-    console.log(chalk24.gray("\n\u{1F4A1} Create a backup with: pnpm spfn db backup\n"));
+    console.log(chalk26.yellow("No backups found in ./backups directory"));
+    console.log(chalk26.gray("\n\u{1F4A1} Create a backup with: pnpm spfn db backup\n"));
     return;
   }
-  console.log(chalk24.bold("  Date                  Size        File"));
-  console.log(chalk24.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(chalk26.bold("  Date                  Size        File"));
+  console.log(chalk26.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   backups.forEach((backup) => {
     const date = backup.date.toLocaleString("en-US", {
       year: "numeric",
@@ -4090,23 +4427,23 @@ async function dbBackupList() {
       second: "2-digit"
     });
     const sizeStr = backup.size.padEnd(10);
-    console.log(chalk24.white(`  ${date}  ${sizeStr}  ${backup.name}`));
+    console.log(chalk26.white(`  ${date}  ${sizeStr}  ${backup.name}`));
   });
-  console.log(chalk24.gray(`
+  console.log(chalk26.gray(`
   Total: ${backups.length} backup(s)
 `));
 }
 
 // src/commands/db/clean.ts
 import { promises as fs4 } from "fs";
-import chalk25 from "chalk";
+import chalk27 from "chalk";
 import ora10 from "ora";
-import prompts7 from "prompts";
+import prompts8 from "prompts";
 async function dbBackupClean(options) {
-  console.log(chalk25.blue("\u{1F9F9} Cleaning old backups...\n"));
+  console.log(chalk27.blue("\u{1F9F9} Cleaning old backups...\n"));
   const backups = await listBackupFiles();
   if (backups.length === 0) {
-    console.log(chalk25.yellow("No backups found"));
+    console.log(chalk27.yellow("No backups found"));
     return;
   }
   let toDelete = [];
@@ -4123,22 +4460,22 @@ async function dbBackupClean(options) {
     toDelete = backups.slice(defaultKeep);
   }
   if (toDelete.length === 0) {
-    console.log(chalk25.green("\u2705 No backups to clean"));
+    console.log(chalk27.green("\u2705 No backups to clean"));
     return;
   }
-  console.log(chalk25.yellow(`The following ${toDelete.length} backup(s) will be deleted:
+  console.log(chalk27.yellow(`The following ${toDelete.length} backup(s) will be deleted:
 `));
   toDelete.forEach((backup) => {
-    console.log(chalk25.gray(`  - ${backup.name} (${backup.size})`));
+    console.log(chalk27.gray(`  - ${backup.name} (${backup.size})`));
   });
-  const { confirm } = await prompts7({
+  const { confirm } = await prompts8({
     type: "confirm",
     name: "confirm",
     message: "\nProceed with deletion?",
     initial: false
   });
   if (!confirm) {
-    console.log(chalk25.gray("Cancelled"));
+    console.log(chalk27.gray("Cancelled"));
     return;
   }
   const spinner = ora10("Deleting backups...").start();
@@ -4149,20 +4486,20 @@ async function dbBackupClean(options) {
       fs4.rm(backup.path.replace(/\.(sql|dump)$/, ".meta.json"), { force: true })
     ]));
     spinner.succeed("Backups deleted");
-    console.log(chalk25.green(`
+    console.log(chalk27.green(`
 \u2705 Deleted ${toDelete.length} backup(s)`));
   } catch (error) {
     spinner.fail("Failed to delete backups");
-    console.error(chalk25.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk27.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
 
 // src/commands/db/reindex.ts
-import { existsSync as existsSync23, readFileSync as readFileSync10, writeFileSync as writeFileSync15, renameSync, copyFileSync } from "fs";
-import { join as join21 } from "path";
-import chalk26 from "chalk";
-import { loadEnv as loadEnv8 } from "@spfn/core/server";
+import { existsSync as existsSync24, readFileSync as readFileSync10, writeFileSync as writeFileSync15, renameSync, copyFileSync } from "fs";
+import { join as join22 } from "path";
+import chalk28 from "chalk";
+import { loadEnv as loadEnv9 } from "@spfn/core/server";
 function isTimestampPrefix(tag) {
   const prefix = tag.split("_")[0];
   return /^\d{5,}$/.test(prefix);
@@ -4178,19 +4515,19 @@ function parseTag(tag) {
   };
 }
 async function dbReindex(options = {}) {
-  loadEnv8();
+  loadEnv9();
   const { getDrizzleConfig } = await import("@spfn/core/db");
   const config = getDrizzleConfig({ disablePackageDiscovery: true });
   const outDir = config.out;
-  const journalPath = join21(outDir, "meta", "_journal.json");
-  if (!existsSync23(journalPath)) {
-    console.error(chalk26.red("\u274C No _journal.json found at:"), journalPath);
-    console.log(chalk26.yellow("\u{1F4A1} Run `spfn db generate` first to create migrations"));
+  const journalPath = join22(outDir, "meta", "_journal.json");
+  if (!existsSync24(journalPath)) {
+    console.error(chalk28.red("\u274C No _journal.json found at:"), journalPath);
+    console.log(chalk28.yellow("\u{1F4A1} Run `spfn db generate` first to create migrations"));
     process.exit(1);
   }
   const journal = JSON.parse(readFileSync10(journalPath, "utf-8"));
   if (journal.entries.length === 0) {
-    console.log(chalk26.yellow("No migration entries found \u2014 nothing to reindex."));
+    console.log(chalk28.yellow("No migration entries found \u2014 nothing to reindex."));
     return;
   }
   const renames = [];
@@ -4204,46 +4541,46 @@ async function dbReindex(options = {}) {
     const { prefix: oldPrefix, suffix } = parseTag(entry.tag);
     const newPrefix = String(entry.when);
     const newTag = suffix ? `${newPrefix}_${suffix}` : newPrefix;
-    const oldSql = join21(outDir, `${entry.tag}.sql`);
-    const newSql = join21(outDir, `${newTag}.sql`);
-    if (existsSync23(oldSql)) {
+    const oldSql = join22(outDir, `${entry.tag}.sql`);
+    const newSql = join22(outDir, `${newTag}.sql`);
+    if (existsSync24(oldSql)) {
       renames.push({ type: "sql", from: oldSql, to: newSql });
     }
-    const oldSnapshot = join21(outDir, "meta", `${oldPrefix}_snapshot.json`);
-    const newSnapshot = join21(outDir, "meta", `${newPrefix}_snapshot.json`);
-    if (existsSync23(oldSnapshot)) {
+    const oldSnapshot = join22(outDir, "meta", `${oldPrefix}_snapshot.json`);
+    const newSnapshot = join22(outDir, "meta", `${newPrefix}_snapshot.json`);
+    if (existsSync24(oldSnapshot)) {
       renames.push({ type: "snapshot", from: oldSnapshot, to: newSnapshot });
     }
     tagUpdates.push({ idx: entry.idx, oldTag: entry.tag, newTag });
   }
   if (tagUpdates.length === 0) {
-    console.log(chalk26.green("\u2705 All migrations already use timestamp prefix \u2014 nothing to do."));
+    console.log(chalk28.green("\u2705 All migrations already use timestamp prefix \u2014 nothing to do."));
     if (skipped > 0) {
-      console.log(chalk26.dim(`   (${skipped} entries already timestamp-prefixed)`));
+      console.log(chalk28.dim(`   (${skipped} entries already timestamp-prefixed)`));
     }
     return;
   }
-  console.log(chalk26.bold("\n\u{1F4CB} Reindex plan:\n"));
+  console.log(chalk28.bold("\n\u{1F4CB} Reindex plan:\n"));
   for (const update of tagUpdates) {
     console.log(
-      chalk26.dim(`  [${update.idx}]`),
-      chalk26.red(update.oldTag),
-      chalk26.dim("\u2192"),
-      chalk26.green(update.newTag)
+      chalk28.dim(`  [${update.idx}]`),
+      chalk28.red(update.oldTag),
+      chalk28.dim("\u2192"),
+      chalk28.green(update.newTag)
     );
   }
-  console.log(chalk26.dim(`
+  console.log(chalk28.dim(`
   ${renames.length} file(s) to rename, ${tagUpdates.length} journal tag(s) to update`));
   if (skipped > 0) {
-    console.log(chalk26.dim(`  ${skipped} entry/entries already timestamp-prefixed (skipped)`));
+    console.log(chalk28.dim(`  ${skipped} entry/entries already timestamp-prefixed (skipped)`));
   }
   if (options.dryRun) {
-    console.log(chalk26.yellow("\n\u{1F50D} Dry run \u2014 no changes applied."));
+    console.log(chalk28.yellow("\n\u{1F50D} Dry run \u2014 no changes applied."));
     return;
   }
   const backupPath = journalPath + ".bak";
   copyFileSync(journalPath, backupPath);
-  console.log(chalk26.dim(`
+  console.log(chalk28.dim(`
   Backed up journal \u2192 ${backupPath}`));
   for (const rename of renames) {
     renameSync(rename.from, rename.to);
@@ -4255,7 +4592,7 @@ async function dbReindex(options = {}) {
     }
   }
   writeFileSync15(journalPath, JSON.stringify(journal, null, 2) + "\n");
-  console.log(chalk26.green(`
+  console.log(chalk28.green(`
 \u2705 Reindex complete \u2014 ${tagUpdates.length} migration(s) converted to timestamp prefix.`));
 }
 
@@ -4264,9 +4601,10 @@ var dbCommand = new Command9("db").description("Database management commands (wr
 dbCommand.command("generate").alias("g").description("Generate database migrations from schema changes").action(dbGenerate);
 dbCommand.command("push").description("Push schema changes to database (safe mode by default)").option("--force", "Apply all changes including destructive ones").option("--dry-run", "Show changes without applying").action((options) => dbPush(options));
 dbCommand.command("migrate").alias("m").description("Run pending migrations").option("--with-backup", "Create backup before running migrations").action((options) => dbMigrate(options));
+dbCommand.command("status").description("Show applied/pending migration status (function packages + project)").action(dbStatus);
 dbCommand.command("studio").description("Open Drizzle Studio (database GUI)").option("-p, --port <port>", "Studio port (auto-finds if in use)").action((options) => dbStudio(options.port ? Number(options.port) : void 0));
 dbCommand.command("drop").description("Drop all database tables (\u26A0\uFE0F  dangerous!)").action(dbDrop);
-dbCommand.command("check").description("Check database connection").action(dbCheck);
+dbCommand.command("check").description("Check migration file consistency (drizzle-kit check)").action(dbCheck);
 dbCommand.command("backup").description("Create a database backup").option("-f, --format <format>", "Backup format (sql or custom)", "sql").option("-o, --output <path>", "Custom output path").option("-s, --schema <name>", "Backup specific schema only").option("--data-only", "Backup data only (no schema)").option("--schema-only", "Backup schema only (no data)").option("--tag <tags>", "Comma-separated tags for this backup").option("--env <environment>", "Environment label (e.g., production, staging)").action((options) => dbBackup(options));
 dbCommand.command("restore [file]").description("Restore database from backup").option("--drop", "Drop existing tables before restore").option("-s, --schema <name>", "Restore specific schema only").option("--data-only", "Restore data only (requires custom format .dump file)").option("--schema-only", "Restore schema only (requires custom format .dump file)").option("-v, --verbose", "Show detailed restore progress").action((file, options) => dbRestore(file, options));
 dbCommand.command("backup:list").description("List all database backups").action(dbBackupList);
@@ -4276,25 +4614,25 @@ dbCommand.command("reindex").description("Convert migration files from sequentia
 // src/commands/add.ts
 init_package_manager();
 import { Command as Command10 } from "commander";
-import { existsSync as existsSync24, readFileSync as readFileSync11 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync11 } from "fs";
+import { join as join23 } from "path";
 import { execa as execa9 } from "execa";
-import chalk27 from "chalk";
+import chalk29 from "chalk";
 import ora11 from "ora";
 async function addPackage(packageName) {
   if (!packageName.includes("/")) {
-    console.error(chalk27.red("\u274C Please specify full package name"));
-    console.log(chalk27.yellow("\n\u{1F4A1} Examples:"));
-    console.log(chalk27.gray("  pnpm spfn add @spfn/cms"));
-    console.log(chalk27.gray("  pnpm spfn add @mycompany/spfn-analytics"));
+    console.error(chalk29.red("\u274C Please specify full package name"));
+    console.log(chalk29.yellow("\n\u{1F4A1} Examples:"));
+    console.log(chalk29.gray("  pnpm spfn add @spfn/cms"));
+    console.log(chalk29.gray("  pnpm spfn add @mycompany/spfn-analytics"));
     process.exit(1);
   }
-  console.log(chalk27.blue(`
+  console.log(chalk29.blue(`
 \u{1F4E6} Setting up ${packageName}...
 `));
-  const pkgPath = join22(process.cwd(), "node_modules", ...packageName.split("/"));
-  const pkgJsonPath = join22(pkgPath, "package.json");
-  if (!existsSync24(pkgJsonPath)) {
+  const pkgPath = join23(process.cwd(), "node_modules", ...packageName.split("/"));
+  const pkgJsonPath = join23(pkgPath, "package.json");
+  if (!existsSync25(pkgJsonPath)) {
     const pm = detectPackageManager(process.cwd());
     const installSpinner = ora11("Installing package...").start();
     try {
@@ -4302,26 +4640,27 @@ async function addPackage(packageName) {
       installSpinner.succeed("Package installed");
     } catch (error) {
       installSpinner.fail("Failed to install package");
-      console.error(chalk27.red(error instanceof Error ? error.message : "Unknown error"));
+      console.error(chalk29.red(error instanceof Error ? error.message : "Unknown error"));
       process.exit(1);
     }
   } else {
-    console.log(chalk27.gray("\u2713 Package already installed (using local version)\n"));
+    console.log(chalk29.gray("\u2713 Package already installed (using local version)\n"));
   }
-  if (!existsSync24(pkgJsonPath)) {
-    console.error(chalk27.red(`\u274C Package ${packageName} not found after installation`));
+  if (!existsSync25(pkgJsonPath)) {
+    console.error(chalk29.red(`\u274C Package ${packageName} not found after installation`));
     process.exit(1);
   }
   const pkgJson = JSON.parse(readFileSync11(pkgJsonPath, "utf-8"));
   if (pkgJson.spfn?.migrations) {
-    console.log(chalk27.blue(`
+    console.log(chalk29.blue(`
 \u{1F5C4}\uFE0F  Setting up database for ${packageName}...
 `));
-    const { env: env8 } = await import("@spfn/core/config");
-    if (!env8.DATABASE_URL) {
-      console.log(chalk27.yellow("\u26A0\uFE0F  DATABASE_URL not found"));
-      console.log(chalk27.gray("Skipping database setup. Run migrations manually when ready:\n"));
-      console.log(chalk27.gray("  pnpm spfn db push\n"));
+    const { env: env9 } = await import("@spfn/core/config");
+    if (!env9.DATABASE_URL) {
+      console.log(chalk29.yellow("\u26A0\uFE0F  DATABASE_URL not found \u2014 skipping database setup."));
+      console.log(chalk29.yellow(`   ${packageName} tables are created by its bundled migrations, not by schema push.`));
+      console.log(chalk29.cyan("   Once DATABASE_URL is set, run: pnpm spfn db migrate"));
+      console.log(chalk29.gray("   (check state anytime with: pnpm spfn db status)\n"));
     } else {
       const { discoverFunctionMigrations: discoverFunctionMigrations2, loadFunctionMigrationPlans: loadFunctionMigrationPlans2, executeFunctionMigrations: executeFunctionMigrations2 } = await Promise.resolve().then(() => (init_function_migrations(), function_migrations_exports));
       const functions = discoverFunctionMigrations2(process.cwd());
@@ -4333,21 +4672,21 @@ async function addPackage(packageName) {
           spinner.succeed("Migrations applied");
         } catch (error) {
           spinner.fail("Failed to apply migrations");
-          console.error(chalk27.red(error instanceof Error ? error.message : "Unknown error"));
+          console.error(chalk29.red(error instanceof Error ? error.message : "Unknown error"));
           process.exit(1);
         }
       } else {
-        console.log(chalk27.gray("\u2139\uFE0F  No migrations found for this package"));
+        console.log(chalk29.gray("\u2139\uFE0F  No migrations found for this package"));
       }
     }
   } else {
-    console.log(chalk27.gray("\n\u2139\uFE0F  No database migrations to apply"));
+    console.log(chalk29.gray("\n\u2139\uFE0F  No database migrations to apply"));
   }
-  console.log(chalk27.green(`
+  console.log(chalk29.green(`
 \u2705 ${packageName} installed successfully!
 `));
   if (pkgJson.spfn?.setupMessage) {
-    console.log(chalk27.cyan("\u{1F4DA} Setup Guide:"));
+    console.log(chalk29.cyan("\u{1F4DA} Setup Guide:"));
     console.log(pkgJson.spfn.setupMessage);
     console.log();
   }
@@ -4356,8 +4695,8 @@ var addCommand = new Command10("add").description("Install and set up SPFN ecosy
 
 // src/commands/env.ts
 import { Command as Command11 } from "commander";
-import chalk28 from "chalk";
-import { existsSync as existsSync25, readFileSync as readFileSync12, writeFileSync as writeFileSync16 } from "fs";
+import chalk30 from "chalk";
+import { existsSync as existsSync26, readFileSync as readFileSync12, writeFileSync as writeFileSync16 } from "fs";
 import { resolve as resolve2 } from "path";
 import { parse as parse2 } from "dotenv";
 
@@ -4413,26 +4752,26 @@ function getEnvFilesForEnvironment(nodeEnv) {
 }
 function formatType(type) {
   const typeColors = {
-    string: chalk28.green,
-    number: chalk28.blue,
-    boolean: chalk28.yellow,
-    url: chalk28.cyan,
-    enum: chalk28.magenta,
-    json: chalk28.red
+    string: chalk30.green,
+    number: chalk30.blue,
+    boolean: chalk30.yellow,
+    url: chalk30.cyan,
+    enum: chalk30.magenta,
+    json: chalk30.red
   };
-  return (typeColors[type] || chalk28.white)(type);
+  return (typeColors[type] || chalk30.white)(type);
 }
 function formatDefault(value, type) {
   if (value === void 0) {
-    return chalk28.dim("(none)");
+    return chalk30.dim("(none)");
   }
   if (type === "string" || type === "url") {
-    return chalk28.green(`"${value}"`);
+    return chalk30.green(`"${value}"`);
   }
   if (type === "boolean") {
-    return value ? chalk28.green("true") : chalk28.red("false");
+    return value ? chalk30.green("true") : chalk30.red("false");
   }
-  return chalk28.cyan(String(value));
+  return chalk30.cyan(String(value));
 }
 async function listEnvVars(options) {
   const packageName = options.package || "@spfn/core";
@@ -4446,28 +4785,28 @@ async function listEnvVars(options) {
         acc[target].push([key, schema]);
         return acc;
       }, {});
-      console.log(chalk28.blue.bold(`
+      console.log(chalk30.blue.bold(`
 \u{1F4CB} Environment Variables by File (${packageName})
 `));
       for (const [file, vars] of Object.entries(grouped)) {
-        console.log(chalk28.bold.magenta(`
+        console.log(chalk30.bold.magenta(`
 ${file}`));
-        console.log(chalk28.dim("\u2500".repeat(50)));
+        console.log(chalk30.dim("\u2500".repeat(50)));
         for (const [key, schema] of vars) {
           printEnvVar(key, schema);
         }
       }
     } else {
-      console.log(chalk28.blue.bold(`
+      console.log(chalk30.blue.bold(`
 \u{1F4CB} Environment Variables (${packageName})
 `));
       for (const [key, schema] of allVars) {
         printEnvVar(key, schema, true);
       }
     }
-    console.log(chalk28.dim("\n\u{1F4A1} Tip: Use `spfn env init` to generate .env template files\n"));
+    console.log(chalk30.dim("\n\u{1F4A1} Tip: Use `spfn env init` to generate .env template files\n"));
   } catch (error) {
-    console.error(chalk28.red(`
+    console.error(chalk30.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4475,17 +4814,17 @@ ${file}`));
 }
 function printEnvVar(key, schema, showFile = false) {
   const typeStr = formatType(schema.type);
-  const requiredStr = schema.required || schema.default !== void 0 ? chalk28.red("[required]") : chalk28.dim("[optional]");
-  const sensitiveStr = schema.sensitive ? chalk28.yellow(" [sensitive]") : "";
-  const fileStr = showFile ? chalk28.dim(` \u2192 ${getTargetFile(schema)}`) : "";
-  console.log(`${chalk28.bold.cyan(key)} ${chalk28.dim("(")}${typeStr}${chalk28.dim(")")} ${requiredStr}${sensitiveStr}${fileStr}`);
-  console.log(`  ${chalk28.dim(schema.description)}`);
+  const requiredStr = schema.required || schema.default !== void 0 ? chalk30.red("[required]") : chalk30.dim("[optional]");
+  const sensitiveStr = schema.sensitive ? chalk30.yellow(" [sensitive]") : "";
+  const fileStr = showFile ? chalk30.dim(` \u2192 ${getTargetFile(schema)}`) : "";
+  console.log(`${chalk30.bold.cyan(key)} ${chalk30.dim("(")}${typeStr}${chalk30.dim(")")} ${requiredStr}${sensitiveStr}${fileStr}`);
+  console.log(`  ${chalk30.dim(schema.description)}`);
   if (schema.default !== void 0) {
-    console.log(`  ${chalk28.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
+    console.log(`  ${chalk30.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
   }
   if (schema.examples && schema.examples.length > 0) {
     const exampleStr = schema.examples.map((ex) => formatDefault(ex, schema.type)).join(", ");
-    console.log(`  ${chalk28.dim("Examples:")} ${exampleStr}`);
+    console.log(`  ${chalk30.dim("Examples:")} ${exampleStr}`);
   }
   console.log();
 }
@@ -4493,7 +4832,7 @@ async function showEnvStats(options) {
   const packageName = options.package || "@spfn/core";
   try {
     const envSchema = await loadEnvSchema(packageName);
-    console.log(chalk28.blue.bold(`
+    console.log(chalk30.blue.bold(`
 \u{1F4CA} Environment Variable Statistics (${packageName})
 `));
     const allVars = Object.entries(envSchema);
@@ -4515,24 +4854,24 @@ async function showEnvStats(options) {
       acc[file] = (acc[file] || 0) + 1;
       return acc;
     }, {});
-    console.log(`${chalk28.bold("Total variables:")} ${chalk28.cyan(allVars.length)}`);
-    console.log(`${chalk28.bold("Required:")} ${chalk28.red(required.length)}`);
-    console.log(`${chalk28.bold("Optional:")} ${chalk28.dim(optional.length)}`);
-    console.log(`${chalk28.bold("Sensitive:")} ${chalk28.yellow(sensitive.length)}`);
-    console.log(chalk28.bold("\nBy Target:"));
-    console.log(`  ${chalk28.blue("Next.js accessible:")} ${chalk28.cyan(nextjsVars.length)}`);
-    console.log(`  ${chalk28.magenta("SPFN server only:")} ${chalk28.cyan(serverOnlyVars.length)}`);
-    console.log(chalk28.bold("\nBy File:"));
+    console.log(`${chalk30.bold("Total variables:")} ${chalk30.cyan(allVars.length)}`);
+    console.log(`${chalk30.bold("Required:")} ${chalk30.red(required.length)}`);
+    console.log(`${chalk30.bold("Optional:")} ${chalk30.dim(optional.length)}`);
+    console.log(`${chalk30.bold("Sensitive:")} ${chalk30.yellow(sensitive.length)}`);
+    console.log(chalk30.bold("\nBy Target:"));
+    console.log(`  ${chalk30.blue("Next.js accessible:")} ${chalk30.cyan(nextjsVars.length)}`);
+    console.log(`  ${chalk30.magenta("SPFN server only:")} ${chalk30.cyan(serverOnlyVars.length)}`);
+    console.log(chalk30.bold("\nBy File:"));
     for (const [file, count] of Object.entries(fileCount)) {
-      console.log(`  ${chalk28.dim(file)}: ${chalk28.cyan(count)}`);
+      console.log(`  ${chalk30.dim(file)}: ${chalk30.cyan(count)}`);
     }
-    console.log(chalk28.bold("\nBy Type:"));
+    console.log(chalk30.bold("\nBy Type:"));
     for (const [type, count] of Object.entries(typeCount)) {
-      console.log(`  ${formatType(type)}: ${chalk28.cyan(count)}`);
+      console.log(`  ${formatType(type)}: ${chalk30.cyan(count)}`);
     }
     console.log();
   } catch (error) {
-    console.error(chalk28.red(`
+    console.error(chalk30.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4552,26 +4891,26 @@ async function searchEnvVars(query, options) {
       }
     }
     if (results.length === 0) {
-      console.log(chalk28.yellow(`
+      console.log(chalk30.yellow(`
 \u26A0\uFE0F  No environment variables found matching "${query}"
 `));
       return;
     }
-    console.log(chalk28.blue.bold(`
+    console.log(chalk30.blue.bold(`
 \u{1F50D} Found ${results.length} environment variable(s) matching "${query}"
 `));
     for (const [key, schema] of results) {
       const typeStr = formatType(schema.type);
-      const requiredStr = schema.required || schema.default !== void 0 ? chalk28.red("[required]") : chalk28.dim("[optional]");
-      console.log(`${chalk28.bold.cyan(key)} ${chalk28.dim("(")}${typeStr}${chalk28.dim(")")} ${requiredStr}`);
-      console.log(`  ${chalk28.dim(schema.description)}`);
+      const requiredStr = schema.required || schema.default !== void 0 ? chalk30.red("[required]") : chalk30.dim("[optional]");
+      console.log(`${chalk30.bold.cyan(key)} ${chalk30.dim("(")}${typeStr}${chalk30.dim(")")} ${requiredStr}`);
+      console.log(`  ${chalk30.dim(schema.description)}`);
       if (schema.default !== void 0) {
-        console.log(`  ${chalk28.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
+        console.log(`  ${chalk30.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
       }
       console.log();
     }
   } catch (error) {
-    console.error(chalk28.red(`
+    console.error(chalk30.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4583,9 +4922,9 @@ envCommand.command("stats").description("Show environment variable statistics").
 envCommand.command("search").description("Search environment variables").argument("<query>", "Search query (matches key or description)").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").action(searchEnvVars);
 function validateEnvOption(envValue) {
   if (!VALID_ENVS.includes(envValue)) {
-    console.error(chalk28.red(`
+    console.error(chalk30.red(`
 \u274C Invalid environment: "${envValue}"`));
-    console.log(chalk28.dim(`   Valid values: ${VALID_ENVS.join(", ")}
+    console.log(chalk30.dim(`   Valid values: ${VALID_ENVS.join(", ")}
 `));
     process.exit(1);
   }
@@ -4606,8 +4945,8 @@ async function initEnvFiles(options) {
       return acc;
     }, {});
     if (targetEnv) {
-      console.log(chalk28.blue.bold(`
-\u{1F680} Generating .env template files for ${chalk28.cyan(targetEnv)} environment
+      console.log(chalk30.blue.bold(`
+\u{1F680} Generating .env template files for ${chalk30.cyan(targetEnv)} environment
 `));
       const envSpecificFiles = {};
       const committedVars = allVars.filter(([_, schema]) => !schema.sensitive);
@@ -4623,24 +4962,24 @@ async function initEnvFiles(options) {
         writeEnvTemplate(cwd, file, vars, options.force ?? false);
       }
     } else {
-      console.log(chalk28.blue.bold(`
+      console.log(chalk30.blue.bold(`
 \u{1F680} Generating .env template files
 `));
       for (const [file, vars] of Object.entries(grouped)) {
         writeEnvTemplate(cwd, file, vars, options.force ?? false);
       }
     }
-    console.log(chalk28.dim("\n\u{1F4A1} Copy .example files to create your actual .env files:"));
-    console.log(chalk28.dim("   cp .env.example .env"));
-    console.log(chalk28.dim("   cp .env.local.example .env.local"));
-    console.log(chalk28.dim("   cp .env.server.example .env.server"));
+    console.log(chalk30.dim("\n\u{1F4A1} Copy .example files to create your actual .env files:"));
+    console.log(chalk30.dim("   cp .env.example .env"));
+    console.log(chalk30.dim("   cp .env.local.example .env.local"));
+    console.log(chalk30.dim("   cp .env.server.example .env.server"));
     if (targetEnv) {
-      console.log(chalk28.dim(`   cp .env.${targetEnv}.example .env.${targetEnv}`));
-      console.log(chalk28.dim(`   cp .env.${targetEnv}.local.example .env.${targetEnv}.local`));
+      console.log(chalk30.dim(`   cp .env.${targetEnv}.example .env.${targetEnv}`));
+      console.log(chalk30.dim(`   cp .env.${targetEnv}.local.example .env.${targetEnv}.local`));
     }
     console.log("");
   } catch (error) {
-    console.error(chalk28.red(`
+    console.error(chalk30.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4648,12 +4987,12 @@ async function initEnvFiles(options) {
 }
 function writeEnvTemplate(cwd, file, vars, force) {
   const filePath = resolve2(cwd, file);
-  if (existsSync25(filePath) && !force) {
-    console.log(chalk28.yellow(`  \u23ED\uFE0F  ${file} already exists (use --force to overwrite)`));
+  if (existsSync26(filePath) && !force) {
+    console.log(chalk30.yellow(`  \u23ED\uFE0F  ${file} already exists (use --force to overwrite)`));
     return;
   }
   writeFileSync16(filePath, generateEnvFileContent(vars), "utf-8");
-  console.log(chalk28.green(`  \u2705 ${file} (${vars.length} variables)`));
+  console.log(chalk30.green(`  \u2705 ${file} (${vars.length} variables)`));
 }
 function generateEnvFileContent(vars) {
   const lines = [
@@ -4688,7 +5027,7 @@ async function checkEnvFiles(options) {
     const envSchema = await loadEnvSchema(packageName);
     const allVars = Object.entries(envSchema);
     const envLabel = targetEnv ? ` (${targetEnv})` : "";
-    console.log(chalk28.blue.bold(`
+    console.log(chalk30.blue.bold(`
 \u{1F50D} Checking .env files against schema${envLabel}
 `));
     const filesToCheck = targetEnv ? getEnvFilesForEnvironment(targetEnv) : [...BASE_ENV_FILES.nextjs, ...BASE_ENV_FILES.server];
@@ -4697,7 +5036,7 @@ async function checkEnvFiles(options) {
     const warnings = [];
     for (const file of filesToCheck) {
       const filePath = resolve2(cwd, file);
-      if (!existsSync25(filePath)) {
+      if (!existsSync26(filePath)) {
         continue;
       }
       const content = readFileSync12(filePath, "utf-8");
@@ -4705,7 +5044,7 @@ async function checkEnvFiles(options) {
       for (const [key, value] of Object.entries(parsed)) {
         loadedEnv[key] = { value: value || "", file };
       }
-      console.log(chalk28.dim(`  \u{1F4C4} ${file} loaded`));
+      console.log(chalk30.dim(`  \u{1F4C4} ${file} loaded`));
     }
     console.log("");
     for (const [key, schema] of allVars) {
@@ -4713,7 +5052,7 @@ async function checkEnvFiles(options) {
       const found = loadedEnv[key];
       if (!found) {
         if (schema.required && schema.default === void 0) {
-          issues.push(`${chalk28.red("\u2717")} ${chalk28.cyan(key)} is required but not found in any .env file`);
+          issues.push(`${chalk30.red("\u2717")} ${chalk30.cyan(key)} is required but not found in any .env file`);
         }
         continue;
       }
@@ -4723,11 +5062,11 @@ async function checkEnvFiles(options) {
       if (!shouldBeNextjs && isNextjsFile && !isServerFile) {
         if (schema.sensitive) {
           issues.push(
-            `${chalk28.red("\u2717")} ${chalk28.cyan(key)} is sensitive and should be in ${chalk28.magenta(expectedFile)}, but found in ${chalk28.yellow(found.file)} (security risk!)`
+            `${chalk30.red("\u2717")} ${chalk30.cyan(key)} is sensitive and should be in ${chalk30.magenta(expectedFile)}, but found in ${chalk30.yellow(found.file)} (security risk!)`
           );
         } else {
           warnings.push(
-            `${chalk28.yellow("\u26A0")} ${chalk28.cyan(key)} should be in ${chalk28.magenta(expectedFile)}, but found in ${chalk28.dim(found.file)}`
+            `${chalk30.yellow("\u26A0")} ${chalk30.cyan(key)} should be in ${chalk30.magenta(expectedFile)}, but found in ${chalk30.dim(found.file)}`
           );
         }
       }
@@ -4735,34 +5074,34 @@ async function checkEnvFiles(options) {
     for (const [key, { file }] of Object.entries(loadedEnv)) {
       const inSchema = allVars.some(([k]) => k === key);
       if (!inSchema) {
-        warnings.push(`${chalk28.yellow("\u26A0")} ${chalk28.cyan(key)} in ${chalk28.dim(file)} is not in schema`);
+        warnings.push(`${chalk30.yellow("\u26A0")} ${chalk30.cyan(key)} in ${chalk30.dim(file)} is not in schema`);
       }
     }
     if (issues.length > 0) {
-      console.log(chalk28.red.bold("Issues:"));
+      console.log(chalk30.red.bold("Issues:"));
       for (const issue of issues) {
         console.log(`  ${issue}`);
       }
       console.log("");
     }
     if (warnings.length > 0) {
-      console.log(chalk28.yellow.bold("Warnings:"));
+      console.log(chalk30.yellow.bold("Warnings:"));
       for (const warning of warnings) {
         console.log(`  ${warning}`);
       }
       console.log("");
     }
     if (issues.length === 0 && warnings.length === 0) {
-      console.log(chalk28.green("\u2705 All environment variables are correctly configured!\n"));
+      console.log(chalk30.green("\u2705 All environment variables are correctly configured!\n"));
     } else {
-      console.log(chalk28.dim(`Found ${issues.length} issue(s) and ${warnings.length} warning(s)
+      console.log(chalk30.dim(`Found ${issues.length} issue(s) and ${warnings.length} warning(s)
 `));
       if (issues.length > 0) {
         process.exit(1);
       }
     }
   } catch (error) {
-    console.error(chalk28.red(`
+    console.error(chalk30.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4774,17 +5113,17 @@ async function validateEnvVars(options) {
   const packages = options.packages || ["@spfn/core"];
   const targetEnv = options.env ? validateEnvOption(options.env) : void 0;
   if (targetEnv) {
-    const { loadEnv: loadEnv9 } = await import("@spfn/core/env/loader");
-    const result = loadEnv9({ nodeEnv: targetEnv });
-    console.log(chalk28.blue.bold(`
-\u{1F50D} Validating environment variables for ${chalk28.cyan(targetEnv)}
+    const { loadEnv: loadEnv10 } = await import("@spfn/core/env/loader");
+    const result = loadEnv10({ nodeEnv: targetEnv });
+    console.log(chalk30.blue.bold(`
+\u{1F50D} Validating environment variables for ${chalk30.cyan(targetEnv)}
 `));
     if (result.loadedFiles.length > 0) {
-      console.log(chalk28.dim(`  Loaded: ${result.loadedFiles.join(", ")}`));
+      console.log(chalk30.dim(`  Loaded: ${result.loadedFiles.join(", ")}`));
     }
     console.log("");
   } else {
-    console.log(chalk28.blue.bold(`
+    console.log(chalk30.blue.bold(`
 \u{1F50D} Validating environment variables
 `));
   }
@@ -4792,7 +5131,7 @@ async function validateEnvVars(options) {
   const allWarnings = [];
   for (const packageName of packages) {
     try {
-      console.log(chalk28.dim(`  \u{1F4E6} ${packageName}`));
+      console.log(chalk30.dim(`  \u{1F4E6} ${packageName}`));
       const envSchema = await loadEnvSchema(packageName);
       const { createEnvRegistry } = await import("@spfn/core/env");
       const registry = createEnvRegistry(envSchema);
@@ -4805,10 +5144,10 @@ async function validateEnvVars(options) {
       }
     } catch (error) {
       if (error instanceof Error && error.message.includes("does not export envSchema")) {
-        console.log(chalk28.dim(`    \u23ED\uFE0F  No envSchema exported, skipping`));
+        console.log(chalk30.dim(`    \u23ED\uFE0F  No envSchema exported, skipping`));
         continue;
       }
-      console.error(chalk28.red(`    \u274C Failed to load: ${error instanceof Error ? error.message : String(error)}`));
+      console.error(chalk30.red(`    \u274C Failed to load: ${error instanceof Error ? error.message : String(error)}`));
       if (options.strict) {
         process.exit(1);
       }
@@ -4816,32 +5155,32 @@ async function validateEnvVars(options) {
   }
   console.log("");
   if (allErrors.length > 0) {
-    console.log(chalk28.red.bold(`\u274C Validation Errors (${allErrors.length}):
+    console.log(chalk30.red.bold(`\u274C Validation Errors (${allErrors.length}):
 `));
     for (const error of allErrors) {
-      console.log(`  ${chalk28.red("\u2717")} ${chalk28.cyan(error.key)}`);
-      console.log(`    ${chalk28.dim(error.message)}`);
-      console.log(`    ${chalk28.dim(`from ${error.package}`)}`);
+      console.log(`  ${chalk30.red("\u2717")} ${chalk30.cyan(error.key)}`);
+      console.log(`    ${chalk30.dim(error.message)}`);
+      console.log(`    ${chalk30.dim(`from ${error.package}`)}`);
       console.log("");
     }
   }
   if (allWarnings.length > 0) {
-    console.log(chalk28.yellow.bold(`\u26A0\uFE0F  Warnings (${allWarnings.length}):
+    console.log(chalk30.yellow.bold(`\u26A0\uFE0F  Warnings (${allWarnings.length}):
 `));
     for (const warning of allWarnings) {
-      console.log(`  ${chalk28.yellow("\u26A0")} ${chalk28.cyan(warning.key)}`);
-      console.log(`    ${chalk28.dim(warning.message)}`);
+      console.log(`  ${chalk30.yellow("\u26A0")} ${chalk30.cyan(warning.key)}`);
+      console.log(`    ${chalk30.dim(warning.message)}`);
       console.log("");
     }
   }
   if (allErrors.length === 0 && allWarnings.length === 0) {
-    console.log(chalk28.green.bold("\u2705 All environment variables are valid!\n"));
+    console.log(chalk30.green.bold("\u2705 All environment variables are valid!\n"));
   } else if (allErrors.length === 0) {
-    console.log(chalk28.green("\u2705 No errors found."));
-    console.log(chalk28.yellow(`\u26A0\uFE0F  ${allWarnings.length} warning(s) found.
+    console.log(chalk30.green("\u2705 No errors found."));
+    console.log(chalk30.yellow(`\u26A0\uFE0F  ${allWarnings.length} warning(s) found.
 `));
   } else {
-    console.log(chalk28.red(`
+    console.log(chalk30.red(`
 \u274C Validation failed with ${allErrors.length} error(s)
 `));
     process.exit(1);
@@ -4854,13 +5193,13 @@ import { Command as Command12 } from "commander";
 
 // src/commands/secret/set.ts
 init_logger();
-import prompts8 from "prompts";
-import chalk29 from "chalk";
+import prompts9 from "prompts";
+import chalk31 from "chalk";
 
 // src/commands/secret/options.ts
 init_logger();
-function resolveEnv(env8) {
-  const value = env8 ?? "local";
+function resolveEnv(env9) {
+  const value = env9 ?? "local";
   if (!VALID_ENVS.includes(value)) {
     logger.error(`Invalid environment: "${value}". Valid values: ${VALID_ENVS.join(", ")}`);
     process.exit(1);
@@ -4870,12 +5209,12 @@ function resolveEnv(env8) {
 
 // src/commands/secret/store-value.ts
 init_logger();
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 init_env_file();
 
 // src/utils/sops.ts
 import { execa as execa10 } from "execa";
-import { existsSync as existsSync26, mkdirSync as mkdirSync3, writeFileSync as writeFileSync17 } from "fs";
+import { existsSync as existsSync27, mkdirSync as mkdirSync3, writeFileSync as writeFileSync17 } from "fs";
 import { dirname as dirname3 } from "path";
 async function ensureSopsInstalled() {
   try {
@@ -4885,14 +5224,14 @@ async function ensureSopsInstalled() {
   }
 }
 async function sopsDecrypt(absFile) {
-  if (!existsSync26(absFile)) {
+  if (!existsSync27(absFile)) {
     return {};
   }
   const { stdout } = await execa10("sops", ["--decrypt", "--output-type", "json", absFile]);
   return JSON.parse(stdout);
 }
 async function sopsSetValue(absFile, relFile, key, value) {
-  if (existsSync26(absFile)) {
+  if (existsSync27(absFile)) {
     await execa10("sops", ["set", absFile, `["${key}"]`, JSON.stringify(value)]);
     return;
   }
@@ -4918,20 +5257,20 @@ async function sopsUpdateKeys(absFile) {
 }
 
 // src/utils/secret-config.ts
-import { existsSync as existsSync27, readdirSync as readdirSync3 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync28, readdirSync as readdirSync3 } from "fs";
+import { join as join24 } from "path";
 var SECRETS_DIR = "secrets";
-function getSopsFile(cwd, env8) {
-  const relFile = `${SECRETS_DIR}/${env8}.enc.json`;
-  return { absFile: join23(cwd, relFile), relFile };
+function getSopsFile(cwd, env9) {
+  const relFile = `${SECRETS_DIR}/${env9}.enc.json`;
+  return { absFile: join24(cwd, relFile), relFile };
 }
 function findUp(cwd, filename, maxDepth = 6) {
   let dir = cwd;
   for (let depth = 0; depth < maxDepth; depth++) {
-    if (existsSync27(join23(dir, filename))) {
+    if (existsSync28(join24(dir, filename))) {
       return dir;
     }
-    const parent = join23(dir, "..");
+    const parent = join24(dir, "..");
     if (parent === dir) {
       break;
     }
@@ -4941,22 +5280,22 @@ function findUp(cwd, filename, maxDepth = 6) {
 }
 function findSopsConfig(cwd) {
   const dir = findUp(cwd, ".sops.yaml");
-  return dir ? join23(dir, ".sops.yaml") : null;
+  return dir ? join24(dir, ".sops.yaml") : null;
 }
 function hasSopsConfig(cwd) {
   return findSopsConfig(cwd) !== null;
 }
 function listSopsFiles(cwd) {
-  const dir = join23(cwd, SECRETS_DIR);
-  if (!existsSync27(dir)) {
+  const dir = join24(cwd, SECRETS_DIR);
+  if (!existsSync28(dir)) {
     return [];
   }
-  return readdirSync3(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join23(dir, name));
+  return readdirSync3(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join24(dir, name));
 }
 
 // src/commands/secret/store-value.ts
-function isLocalEnv(env8) {
-  return env8 === "local";
+function isLocalEnv(env9) {
+  return env9 === "local";
 }
 var KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function assertValidKey(key) {
@@ -4964,15 +5303,15 @@ function assertValidKey(key) {
     throw new Error(`Invalid secret key "${key}". Use an env-var name: letters, digits, and underscores, not starting with a digit.`);
   }
 }
-async function describeTarget(env8) {
-  if (isLocalEnv(env8)) {
+async function describeTarget(env9) {
+  if (isLocalEnv(env9)) {
     return detectStore().label;
   }
-  return `SOPS (${getSopsFile(process.cwd(), env8).relFile})`;
+  return `SOPS (${getSopsFile(process.cwd(), env9).relFile})`;
 }
-async function storeSecret(cwd, env8, key, value) {
+async function storeSecret(cwd, env9, key, value) {
   assertValidKey(key);
-  if (isLocalEnv(env8)) {
+  if (isLocalEnv(env9)) {
     const store = detectStore();
     if (!await store.isAvailable()) {
       throw new Error(
@@ -4980,7 +5319,7 @@ async function storeSecret(cwd, env8, key, value) {
       );
     }
     await store.set(keychainName(key), value);
-    const serverEnvPath = join24(cwd, ".env.server");
+    const serverEnvPath = join25(cwd, ".env.server");
     const result = upsertEnvVar(serverEnvPath, key, keychainRef(key));
     restrictEnvFilePerms(serverEnvPath);
     ensureGitignored(cwd, [{ pattern: ".env.server", comment: "spfn server env (secrets)" }]);
@@ -4993,14 +5332,14 @@ async function storeSecret(cwd, env8, key, value) {
       ".sops.yaml not found \u2014 add a backend (run `spfn secret keygen` for age, or a KMS rule) so the file can be decrypted on deploy."
     );
   }
-  const { absFile, relFile } = getSopsFile(cwd, env8);
+  const { absFile, relFile } = getSopsFile(cwd, env9);
   await sopsSetValue(absFile, relFile, key, value);
   logger.success(`Set ${key} in ${relFile} (encrypted). Commit and deploy to apply.`);
 }
 
 // src/commands/secret/set.ts
 async function secretSet(key, options) {
-  const env8 = resolveEnv(options.env);
+  const env9 = resolveEnv(options.env);
   const pkg = options.package ?? "@spfn/core";
   const resolvedKey = key ?? await pickSecretKey(pkg);
   if (!resolvedKey) {
@@ -5008,18 +5347,18 @@ async function secretSet(key, options) {
     process.exit(1);
   }
   await warnIfNotSecret(pkg, resolvedKey);
-  const { value } = await prompts8({
+  const { value } = await prompts9({
     type: "password",
     name: "value",
-    message: `Value for ${chalk29.cyan(resolvedKey)} (${env8})`
+    message: `Value for ${chalk31.cyan(resolvedKey)} (${env9})`
   });
   if (!value) {
     logger.warn("Cancelled \u2014 no value entered.");
     process.exit(0);
   }
-  logger.step(`Storing ${resolvedKey} \u2192 ${await describeTarget(env8)}`);
+  logger.step(`Storing ${resolvedKey} \u2192 ${await describeTarget(env9)}`);
   try {
-    await storeSecret(process.cwd(), env8, resolvedKey, value);
+    await storeSecret(process.cwd(), env9, resolvedKey, value);
   } catch (error) {
     logger.error(error instanceof Error ? error.message : String(error));
     process.exit(1);
@@ -5035,7 +5374,7 @@ async function pickSecretKey(pkg) {
   if (entries.length === 0) {
     return void 0;
   }
-  const { key } = await prompts8({
+  const { key } = await prompts9({
     type: "select",
     name: "key",
     message: "Which secret?",
@@ -5060,9 +5399,9 @@ async function warnIfNotSecret(pkg, key) {
 
 // src/commands/secret/list.ts
 init_logger();
-import chalk30 from "chalk";
+import chalk32 from "chalk";
 async function secretList(options) {
-  const env8 = resolveEnv(options.env);
+  const env9 = resolveEnv(options.env);
   const pkg = options.package ?? "@spfn/core";
   let entries;
   try {
@@ -5075,18 +5414,18 @@ async function secretList(options) {
     logger.info(`No secrets declared in ${pkg}.`);
     return;
   }
-  const present = await loadPresence(env8, entries);
-  console.log(chalk30.blue.bold(`
-\u{1F511} Secrets (${pkg}) \u2014 ${env8}
+  const present = await loadPresence(env9, entries);
+  console.log(chalk32.blue.bold(`
+\u{1F511} Secrets (${pkg}) \u2014 ${env9}
 `));
   for (const entry of entries) {
     const status = statusOf(entry, present.has(entry.key));
-    console.log(`  ${badge(status)} ${chalk30.cyan(entry.key)}${entry.generate ? chalk30.dim(" (generatable)") : ""}`);
+    console.log(`  ${badge(status)} ${chalk32.cyan(entry.key)}${entry.generate ? chalk32.dim(" (generatable)") : ""}`);
   }
   console.log();
 }
-async function loadPresence(env8, entries) {
-  if (isLocalEnv(env8)) {
+async function loadPresence(env9, entries) {
+  if (isLocalEnv(env9)) {
     const store = detectStore();
     if (!await store.isAvailable()) {
       logger.warn(`${store.label} unavailable \u2014 status shown as missing.`);
@@ -5101,7 +5440,7 @@ async function loadPresence(env8, entries) {
     return present;
   }
   await ensureSopsInstalled();
-  const { absFile } = getSopsFile(process.cwd(), env8);
+  const { absFile } = getSopsFile(process.cwd(), env9);
   const decrypted = await sopsDecrypt(absFile);
   return new Set(Object.keys(decrypted));
 }
@@ -5114,19 +5453,19 @@ function statusOf(entry, present) {
 function badge(status) {
   switch (status) {
     case "set":
-      return chalk30.green("\u25CF");
+      return chalk32.green("\u25CF");
     case "missing":
-      return chalk30.yellow("\u25CB");
+      return chalk32.yellow("\u25CB");
     case "awaiting-input":
-      return chalk30.red("\u25CB");
+      return chalk32.red("\u25CB");
   }
 }
 
 // src/commands/secret/generate.ts
 init_logger();
-import chalk31 from "chalk";
+import chalk33 from "chalk";
 async function secretGenerate(key, options) {
-  const env8 = resolveEnv(options.env);
+  const env9 = resolveEnv(options.env);
   const pkg = options.package ?? "@spfn/core";
   let schema;
   try {
@@ -5140,11 +5479,11 @@ async function secretGenerate(key, options) {
     logger.warn("No generatable secrets found (none declare a `generate` strategy).");
     return;
   }
-  logger.step(`Generating ${targets.length} secret(s) \u2192 ${await describeTarget(env8)}`);
+  logger.step(`Generating ${targets.length} secret(s) \u2192 ${await describeTarget(env9)}`);
   for (const entry of targets) {
     const value = generateSecretValue(entry.generate);
     try {
-      await storeSecret(process.cwd(), env8, entry.key, value);
+      await storeSecret(process.cwd(), env9, entry.key, value);
     } catch (error) {
       logger.error(`${entry.key}: ${error instanceof Error ? error.message : String(error)}`);
       process.exit(1);
@@ -5162,7 +5501,7 @@ function requireGeneratable(schema, key) {
     process.exit(1);
   }
   if (!entry.generate) {
-    logger.error(`${chalk31.cyan(key)} has no generate strategy \u2014 it's an external value. Use \`spfn secret set ${key}\`.`);
+    logger.error(`${chalk33.cyan(key)} has no generate strategy \u2014 it's an external value. Use \`spfn secret set ${key}\`.`);
     process.exit(1);
   }
   return entry;
@@ -5170,9 +5509,9 @@ function requireGeneratable(schema, key) {
 
 // src/commands/secret/rotate.ts
 init_logger();
-import chalk32 from "chalk";
+import chalk34 from "chalk";
 async function secretRotate(key, options) {
-  const env8 = resolveEnv(options.env);
+  const env9 = resolveEnv(options.env);
   const pkg = options.package ?? "@spfn/core";
   let schema;
   try {
@@ -5185,10 +5524,10 @@ async function secretRotate(key, options) {
   const generatable = targets.filter((entry) => entry.generate);
   const external = targets.filter((entry) => !entry.generate);
   if (generatable.length > 0) {
-    logger.step(`Rotating ${generatable.length} secret(s) \u2192 ${await describeTarget(env8)}`);
+    logger.step(`Rotating ${generatable.length} secret(s) \u2192 ${await describeTarget(env9)}`);
     for (const entry of generatable) {
       try {
-        await storeSecret(process.cwd(), env8, entry.key, generateSecretValue(entry.generate));
+        await storeSecret(process.cwd(), env9, entry.key, generateSecretValue(entry.generate));
       } catch (error) {
         logger.error(`${entry.key}: ${error instanceof Error ? error.message : String(error)}`);
         process.exit(1);
@@ -5196,7 +5535,7 @@ async function secretRotate(key, options) {
     }
   }
   for (const entry of external) {
-    logger.warn(`${chalk32.cyan(entry.key)} is external \u2014 reissue it at the provider, then \`spfn secret set ${entry.key} --env ${env8}\`.`);
+    logger.warn(`${chalk34.cyan(entry.key)} is external \u2014 reissue it at the provider, then \`spfn secret set ${entry.key} --env ${env9}\`.`);
   }
   if (generatable.length > 0) {
     logger.info("Rotation updates the source only \u2014 commit and deploy to apply.");
@@ -5218,12 +5557,12 @@ function requireEntry(schema, key) {
 // src/commands/secret/keygen.ts
 init_logger();
 import { execa as execa11 } from "execa";
-import { existsSync as existsSync28, mkdirSync as mkdirSync4 } from "fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync4 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname4, join as join25 } from "path";
-import chalk33 from "chalk";
+import { dirname as dirname4, join as join26 } from "path";
+import chalk35 from "chalk";
 function ageKeyFile() {
-  return process.env.SOPS_AGE_KEY_FILE ?? join25(homedir(), ".config", "sops", "age", "keys.txt");
+  return process.env.SOPS_AGE_KEY_FILE ?? join26(homedir(), ".config", "sops", "age", "keys.txt");
 }
 async function ensureAgeInstalled() {
   try {
@@ -5243,7 +5582,7 @@ async function secretKeygen() {
     process.exit(1);
   }
   const keyFile = ageKeyFile();
-  if (existsSync28(keyFile)) {
+  if (existsSync29(keyFile)) {
     const { stdout } = await execa11("age-keygen", ["-y", keyFile]);
     logger.warn(`age key file already exists: ${keyFile}`);
     printPublicKeys(publicKeys(stdout));
@@ -5259,27 +5598,27 @@ function printPublicKeys(keys) {
     logger.warn("Could not read the public key \u2014 run `age-keygen -y <file>` manually.");
     return;
   }
-  console.log(chalk33.bold("\nPublic key(s):"));
+  console.log(chalk35.bold("\nPublic key(s):"));
   for (const key of keys) {
-    console.log(`  ${chalk33.cyan(key)}`);
+    console.log(`  ${chalk35.cyan(key)}`);
   }
-  console.log(chalk33.dim("\nRegister it as a recipient:"));
-  console.log(chalk33.dim(`  spfn secret recipients add ${keys[0]}
+  console.log(chalk35.dim("\nRegister it as a recipient:"));
+  console.log(chalk35.dim(`  spfn secret recipients add ${keys[0]}
 `));
 }
 
 // src/commands/secret/recipients.ts
 init_logger();
-import { existsSync as existsSync29, readFileSync as readFileSync13, writeFileSync as writeFileSync18 } from "fs";
-import { join as join26 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync13, writeFileSync as writeFileSync18 } from "fs";
+import { join as join27 } from "path";
 import { parse as parse3, stringify } from "yaml";
-import chalk34 from "chalk";
+import chalk36 from "chalk";
 var SOPS_CONFIG = ".sops.yaml";
 var DEFAULT_PATH_REGEX = "secrets/.*\\.enc\\.json$";
 var AGE_RECIPIENT = /^age1[0-9a-z]+$/;
 async function secretRecipients(action, key, _options) {
   const cwd = process.cwd();
-  const configPath = join26(cwd, SOPS_CONFIG);
+  const configPath = join27(cwd, SOPS_CONFIG);
   if (action === "list") {
     listRecipients(configPath);
     return;
@@ -5311,25 +5650,25 @@ async function secretRecipients(action, key, _options) {
   await reencrypt(cwd);
 }
 function listRecipients(configPath) {
-  if (!existsSync29(configPath)) {
+  if (!existsSync30(configPath)) {
     logger.info(`No ${SOPS_CONFIG} found.`);
     return;
   }
   const config = loadConfig(configPath);
   const rules = config.creation_rules ?? [];
-  console.log(chalk34.blue.bold(`
+  console.log(chalk36.blue.bold(`
 \u{1F465} Recipients (${SOPS_CONFIG})
 `));
   for (const rule of rules) {
-    console.log(chalk34.dim(`  ${rule.path_regex ?? "(any path)"}`));
+    console.log(chalk36.dim(`  ${rule.path_regex ?? "(any path)"}`));
     for (const recipient of parseRecipients(rule.age)) {
-      console.log(`    ${chalk34.cyan(recipient)}`);
+      console.log(`    ${chalk36.cyan(recipient)}`);
     }
   }
   console.log();
 }
 function loadConfig(configPath) {
-  if (!existsSync29(configPath)) {
+  if (!existsSync30(configPath)) {
     return { creation_rules: [] };
   }
   return parse3(readFileSync13(configPath, "utf-8")) ?? { creation_rules: [] };
@@ -5364,8 +5703,8 @@ async function reencrypt(cwd) {
 
 // src/commands/secret/check.ts
 init_logger();
-import { join as join27 } from "path";
-import chalk35 from "chalk";
+import { join as join28 } from "path";
+import chalk37 from "chalk";
 init_env_file();
 var COMMITTED_FILES = [".env", ".env.example"];
 var PLACEHOLDER = /(your-|changeme|placeholder|example|<.*>)/i;
@@ -5383,35 +5722,35 @@ async function secretCheck(options) {
   const issues = [];
   const warnings = [];
   for (const file of COMMITTED_FILES) {
-    const parsed = parseEnvFile(join27(cwd, file));
+    const parsed = parseEnvFile(join28(cwd, file));
     for (const [key, value] of Object.entries(parsed)) {
       if (secretKeys.has(key) && value.length > 0 && !PLACEHOLDER.test(value)) {
-        issues.push(`${chalk35.cyan(key)} has a real value in committed ${chalk35.yellow(file)} \u2014 move it to the keychain/SOPS.`);
+        issues.push(`${chalk37.cyan(key)} has a real value in committed ${chalk37.yellow(file)} \u2014 move it to the keychain/SOPS.`);
       }
     }
   }
-  const serverEnv = parseEnvFile(join27(cwd, ".env.server"));
+  const serverEnv = parseEnvFile(join28(cwd, ".env.server"));
   for (const key of secretKeys) {
     const value = serverEnv[key];
     if (value && !value.startsWith(KEYCHAIN_REF_PREFIX)) {
-      warnings.push(`${chalk35.cyan(key)} is plaintext in .env.server \u2014 run \`spfn secret set ${key}\` to move it to the keychain.`);
+      warnings.push(`${chalk37.cyan(key)} is plaintext in .env.server \u2014 run \`spfn secret set ${key}\` to move it to the keychain.`);
     }
   }
   report(issues, warnings, cwd);
 }
 function report(issues, warnings, cwd) {
-  console.log(chalk35.blue.bold("\n\u{1F50D} Secret hygiene check\n"));
+  console.log(chalk37.blue.bold("\n\u{1F50D} Secret hygiene check\n"));
   for (const issue of issues) {
-    console.log(`  ${chalk35.red("\u2717")} ${issue}`);
+    console.log(`  ${chalk37.red("\u2717")} ${issue}`);
   }
   for (const warning of warnings) {
-    console.log(`  ${chalk35.yellow("\u26A0")} ${warning}`);
+    console.log(`  ${chalk37.yellow("\u26A0")} ${warning}`);
   }
   if (!hasSopsConfig(cwd)) {
-    console.log(`  ${chalk35.dim("\u2139 no .sops.yaml \u2014 prod secrets need a backend (spfn secret keygen, or add a KMS rule)")}`);
+    console.log(`  ${chalk37.dim("\u2139 no .sops.yaml \u2014 prod secrets need a backend (spfn secret keygen, or add a KMS rule)")}`);
   }
   if (issues.length === 0 && warnings.length === 0) {
-    console.log(chalk35.green("  \u2713 No plaintext secret leaks found."));
+    console.log(chalk37.green("  \u2713 No plaintext secret leaks found."));
   }
   console.log();
   if (issues.length > 0) {