spfn 0.2.0-beta.61 → 0.2.0-beta.64

package/dist/index.js

@@ -87,6 +87,44 @@ var init_messages = __esm({
   }
 });
 
+// src/commands/init/mode.ts
+import prompts from "prompts";
+async function selectScaffoldMode(options) {
+  if (options.mode) {
+    return options.mode;
+  }
+  if (options.yes) {
+    return "bare";
+  }
+  const { selectedMode } = await prompts({
+    type: "select",
+    name: "selectedMode",
+    message: "Which SPFN scaffold do you want?",
+    choices: [
+      {
+        title: "full (recommended)",
+        description: "Core, auth, i18n, and MCP \u2014 ready for Prototype to Production",
+        value: "full"
+      },
+      {
+        title: "bare",
+        description: "Core-only full-stack skeleton",
+        value: "bare"
+      }
+    ],
+    initial: 0
+  });
+  if (!selectedMode) {
+    process.exit(0);
+  }
+  return selectedMode;
+}
+var init_mode = __esm({
+  "src/commands/init/mode.ts"() {
+    "use strict";
+  }
+});
+
 // src/commands/setup.ts
 var setup_exports = {};
 __export(setup_exports, {
@@ -387,7 +425,7 @@ var init_setup = __esm({
 // src/commands/init/steps/validate.ts
 import { existsSync as existsSync3 } from "fs";
 import { join as join3 } from "path";
-import prompts from "prompts";
+import prompts2 from "prompts";
 async function validateProject(cwd, skipPrompts) {
   const packageJsonPath = join3(cwd, "package.json");
   if (!existsSync3(packageJsonPath)) {
@@ -401,7 +439,7 @@ async function validateProject(cwd, skipPrompts) {
   if (!hasNext) {
     logger.warn("Next.js not detected in dependencies.");
     if (!skipPrompts) {
-      const { proceed } = await prompts(
+      const { proceed } = await prompts2(
         {
           type: "confirm",
           name: "proceed",
@@ -418,7 +456,7 @@ async function validateProject(cwd, skipPrompts) {
   if (existsSync3(join3(cwd, "src", "server"))) {
     logger.warn("src/server directory already exists.");
     if (!skipPrompts) {
-      const { overwrite } = await prompts(
+      const { overwrite } = await prompts2(
         {
           type: "confirm",
           name: "overwrite",
@@ -432,19 +470,7 @@ async function validateProject(cwd, skipPrompts) {
       }
     }
   }
-  let includeAuth = false;
-  if (!skipPrompts) {
-    const { auth } = await prompts(
-      {
-        type: "confirm",
-        name: "auth",
-        message: "Include authentication (@spfn/auth)?",
-        initial: true
-      }
-    );
-    includeAuth = auth;
-  }
-  return { packageJson, packageJsonPath, includeAuth };
+  return { packageJson, packageJsonPath };
 }
 var init_validate = __esm({
   "src/commands/init/steps/validate.ts"() {
@@ -470,6 +496,10 @@ function findTemplatesPath() {
   if (existsSync4(devPath)) {
     return devPath;
   }
+  const sourcePath = join4(__dirname, "..", "..", "..", "..", "templates");
+  if (existsSync4(sourcePath)) {
+    return sourcePath;
+  }
   throw new Error("Templates directory not found. Please rebuild the package.");
 }
 var __dirname;
@@ -482,10 +512,10 @@ var init_templates = __esm({
 
 // src/commands/init/steps/server-structure.ts
 import { existsSync as existsSync5 } from "fs";
-import { join as join5 } from "path";
+import { join as join5, sep } from "path";
 import ora2 from "ora";
 import fse2 from "fs-extra";
-async function setupServerStructure(cwd) {
+async function setupServerStructure(cwd, mode) {
   const spinner = ora2("Setting up server structure...").start();
   try {
     const templatesDir = findTemplatesPath();
@@ -511,6 +541,27 @@ async function setupServerStructure(cwd) {
       copySync(envConfigTemplate, envConfigTarget);
       logger.success("Created src/server/config/env.config.ts (environment management)");
     }
+    if (mode === "full") {
+      const fullTemplateDir = join5(templatesDir, "modes", "full");
+      if (!existsSync5(fullTemplateDir)) {
+        throw new Error(`Full scaffold templates not found at: ${fullTemplateDir}`);
+      }
+      const fullAppTemplateDir = join5(fullTemplateDir, "src", "app");
+      const fullI18nTemplateDir = join5(fullTemplateDir, "src", "i18n");
+      const mergeOnlyDirs = [fullAppTemplateDir, fullI18nTemplateDir];
+      copySync(fullTemplateDir, cwd, {
+        filter: (source) => !mergeOnlyDirs.some((directory) => source === directory || source.startsWith(`${directory}${sep}`))
+      });
+      const appTargetDir = existsSync5(join5(cwd, "src", "app")) ? join5(cwd, "src", "app") : join5(cwd, "app");
+      copySync(fullAppTemplateDir, appTargetDir, {
+        overwrite: false,
+        errorOnExist: false
+      });
+      copySync(fullI18nTemplateDir, join5(cwd, "src", "i18n"), {
+        overwrite: false,
+        errorOnExist: false
+      });
+    }
     spinner.succeed("Server structure created");
   } catch (error) {
     spinner.fail("Failed to create server structure");
@@ -551,8 +602,10 @@ async function setupApiProxy(cwd, includeAuth) {
     return;
   }
   ensureDirSync3(rpcDir);
-  const authImport = includeAuth ? `import '@spfn/auth/nextjs/api';
+  const authImports = includeAuth ? `import '@spfn/auth/nextjs/api';
+import { authRouteMap } from '@spfn/auth';
 ` : "";
+  const proxyRouteMap = includeAuth ? "{ ...routeMap, ...authRouteMap }" : "routeMap";
   const routeContent = `/**
  * SPFN RPC Proxy
  *
@@ -566,10 +619,10 @@ async function setupApiProxy(cwd, includeAuth) {
  * Run \`spfn codegen run\` if route-map.ts is missing.
  */
 
-${authImport}import { routeMap } from '@/generated/route-map';
+${authImports}import { routeMap } from '@/generated/route-map';
 import { createRpcProxy } from '@spfn/core/nextjs/server';
 
-export const { GET, POST } = createRpcProxy({ routeMap });
+export const { GET, POST } = createRpcProxy({ routeMap: ${proxyRouteMap} });
 `;
   writeFileSync2(rpcRoutePath, routeContent);
   const relativePath = rpcRoutePath.replace(cwd + "/", "");
@@ -869,7 +922,7 @@ var init_deployment_config = __esm({
 
 // src/utils/version.ts
 function getCliVersion() {
-  return "0.2.0-beta.61";
+  return "0.2.0-beta.64";
 }
 function getTagFromVersion(version) {
   const match = version.match(/-([a-z]+)\./i);
@@ -888,7 +941,7 @@ var init_version = __esm({
 import ora3 from "ora";
 import { execa as execa2 } from "execa";
 import fse7 from "fs-extra";
-async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManager, includeAuth) {
+async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManager, mode) {
   const spinner = ora3("Updating package.json...").start();
   packageJson.dependencies = packageJson.dependencies || {};
   packageJson.devDependencies = packageJson.devDependencies || {};
@@ -902,8 +955,19 @@ async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManage
   packageJson.dependencies["pg"] = "^8.16.3";
   packageJson.dependencies["spfn"] = spfnTag;
   packageJson.dependencies["concurrently"] = "^9.2.1";
-  if (includeAuth) {
+  if (mode === "full") {
     packageJson.dependencies["@spfn/auth"] = spfnTag;
+    packageJson.dependencies["@spfn/i18n"] = spfnTag;
+    packageJson.dependencies["@spfn/mcp"] = spfnTag;
+    packageJson.dependencies["@spfn/notification"] = spfnTag;
+    packageJson.engines = packageJson.engines || {};
+    const existingNodeRange = packageJson.engines.node;
+    if (!existingNodeRange || !requiresNode20OrNewer(existingNodeRange)) {
+      packageJson.engines.node = ">=20.0.0";
+      if (existingNodeRange) {
+        logger.warn(`Updated engines.node from "${existingNodeRange}" to ">=20.0.0" because full mode includes @spfn/mcp`);
+      }
+    }
   }
   packageJson.devDependencies["@types/node"] = "^20.11.0";
   packageJson.devDependencies["tsx"] = "^4.20.6";
@@ -935,6 +999,16 @@ async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManage
     process.exit(1);
   }
 }
+function requiresNode20OrNewer(range) {
+  return range.split("||").map((alternative) => alternative.trim()).every((alternative) => {
+    const lowerBound = alternative.match(/^(?:>=|>|\^|~|=)?\s*v?(\d+)/);
+    if (!lowerBound) {
+      return false;
+    }
+    const major = Number(lowerBound[1]);
+    return major >= 20;
+  });
+}
 var writeFileSync6;
 var init_package = __esm({
   "src/commands/init/steps/package.ts"() {
@@ -1041,14 +1115,70 @@ var init_env_file = __esm({
 
 // src/commands/init/steps/config-files.ts
 import { existsSync as existsSync11, readFileSync as readFileSync5 } from "fs";
+import { randomBytes } from "crypto";
+import { spawnSync } from "child_process";
 import { join as join11 } from "path";
 import fse8 from "fs-extra";
+function envExampleTemplate(mode) {
+  return withPlaceholderCreds(`# Example environment \u2014 committed reference for the variables SPFN uses.
+# Real values live in .env.local (Next.js) and .env.server (backend secrets),
+# both gitignored. This file documents the keys; it is not loaded by anything.
+
+${ENV_LOCAL_TEMPLATE}${mode === "full" ? FULL_ENV_LOCAL_EXAMPLE : ""}
+${ENV_SERVER_TEMPLATE}${mode === "full" ? FULL_ENV_SERVER_EXAMPLE : ""}`);
+}
+function envServerExampleTemplate(mode) {
+  return withPlaceholderCreds(
+    `${ENV_SERVER_TEMPLATE}${mode === "full" ? FULL_ENV_SERVER_EXAMPLE : ""}`
+  );
+}
+function envLocalTemplate(mode) {
+  if (mode === "bare") {
+    return ENV_LOCAL_TEMPLATE;
+  }
+  return `${ENV_LOCAL_TEMPLATE}
+# Full scaffold: auth session encryption (Next.js server only; never NEXT_PUBLIC_*)
+SPFN_AUTH_SESSION_SECRET=${randomSecret("base64url")}
+SPFN_AUTH_SESSION_TTL=7d
+NEXT_PUBLIC_SPFN_APP_URL=http://localhost:3790
+`;
+}
+function envLocalExampleTemplate(mode) {
+  return `${ENV_LOCAL_TEMPLATE}${mode === "full" ? FULL_ENV_LOCAL_EXAMPLE : ""}`;
+}
+function envServerTemplate(mode) {
+  if (mode === "bare") {
+    return ENV_SERVER_TEMPLATE;
+  }
+  return `${ENV_SERVER_TEMPLATE}
+# Full scaffold: authentication
+SPFN_AUTH_VERIFICATION_TOKEN_SECRET=${randomSecret("base64url")}
+SPFN_AUTH_TOKEN_ENCRYPTION_KEYS=v1:${randomSecret("base64")}
+
+# Enable the social providers you need.
+# SPFN_AUTH_GOOGLE_CLIENT_ID=your-google-client-id
+# SPFN_AUTH_GOOGLE_CLIENT_SECRET=your-google-client-secret
+# SPFN_AUTH_GITHUB_CLIENT_ID=your-github-client-id
+# SPFN_AUTH_GITHUB_CLIENT_SECRET=your-github-client-secret
+# SPFN_AUTH_KAKAO_CLIENT_ID=your-kakao-rest-api-key
+# SPFN_AUTH_KAKAO_CLIENT_SECRET=your-kakao-client-secret
+# SPFN_AUTH_NAVER_CLIENT_ID=your-naver-client-id
+# SPFN_AUTH_NAVER_CLIENT_SECRET=your-naver-client-secret
+
+# Full scaffold: MCP operator endpoint
+SPFN_MCP_URL=http://localhost:8790
+SPFN_MCP_API_KEY=${randomSecret("base64url")}
+`;
+}
+function randomSecret(encoding) {
+  return randomBytes(32).toString(encoding);
+}
 function withPlaceholderCreds(text) {
   return text.replace(/(postgresql:\/\/)[^@\s/]+@/g, "$1user:password@");
 }
-async function setupConfigFiles(cwd) {
+async function setupConfigFiles(cwd, mode) {
   updateGitignore(cwd);
-  generateEnvFiles(cwd);
+  generateEnvFiles(cwd, mode);
   const spfnrcPath = join11(cwd, ".spfnrc.ts");
   if (!existsSync11(spfnrcPath)) {
     const spfnrcContent = `import { defineConfig, defineGenerator } from '@spfn/core/codegen';
@@ -1076,20 +1206,42 @@ export default defineConfig({
   }
   updateTsconfig(cwd);
 }
-function generateEnvFiles(cwd) {
-  writeEnvFile(cwd, ".env.local", ENV_LOCAL_TEMPLATE);
-  writeServerEnv(cwd);
-  writeExampleEnv(cwd, ENV_EXAMPLE_TEMPLATE);
+function generateEnvFiles(cwd, mode) {
+  writeLocalEnv(cwd, envLocalTemplate(mode), envLocalExampleTemplate(mode));
+  writeServerEnv(cwd, envServerTemplate(mode), envServerExampleTemplate(mode));
+  writeExampleEnv(cwd, envExampleTemplate(mode));
+}
+function writeLocalEnv(cwd, template, exampleTemplate) {
+  const filename = ".env.local";
+  const filePath = join11(cwd, filename);
+  if (isGitTracked(cwd, filename)) {
+    const referenceName = ".env.local.spfn.example";
+    const referencePath = join11(cwd, referenceName);
+    if (!existsSync11(referencePath)) {
+      writeFileSync8(referencePath, exampleTemplate);
+    }
+    logger.warn(`${filename} is tracked by Git \u2014 left it untouched; wrote ${referenceName}. Untrack ${filename}, then add the missing keys with freshly generated values`);
+    return;
+  }
+  writeEnvFile(cwd, filename, template);
+  restrictEnvFilePerms(filePath);
+}
+function isGitTracked(cwd, filename) {
+  const result = spawnSync("git", ["ls-files", "--error-unmatch", "--", filename], {
+    cwd,
+    stdio: "ignore"
+  });
+  return result.status === 0;
 }
-function writeServerEnv(cwd) {
+function writeServerEnv(cwd, template, exampleTemplate) {
   const filePath = join11(cwd, ".env.server");
   if (!existsSync11(filePath)) {
-    writeFileSync8(filePath, ENV_SERVER_TEMPLATE);
+    writeFileSync8(filePath, template);
     restrictEnvFilePerms(filePath);
     logger.success("Created .env.server");
     return;
   }
-  writeFileSync8(join11(cwd, ".env.server.example"), withPlaceholderCreds(ENV_SERVER_TEMPLATE));
+  writeFileSync8(join11(cwd, ".env.server.example"), exampleTemplate);
   logger.warn(".env.server already exists \u2014 left it untouched; wrote SPFN's reference to .env.server.example, add any missing keys manually");
 }
 function writeExampleEnv(cwd, content) {
@@ -1181,7 +1333,7 @@ function updateTsconfig(cwd) {
     logger.warn('Could not update tsconfig.json (you can add "src/server" to exclude manually)');
   }
 }
-var writeFileSync8, ENV_LOCAL_TEMPLATE, ENV_SERVER_TEMPLATE, ENV_EXAMPLE_TEMPLATE;
+var writeFileSync8, ENV_LOCAL_TEMPLATE, FULL_ENV_LOCAL_EXAMPLE, ENV_SERVER_TEMPLATE, FULL_ENV_SERVER_EXAMPLE;
 var init_config_files = __esm({
   "src/commands/init/steps/config-files.ts"() {
     "use strict";
@@ -1189,8 +1341,8 @@ var init_config_files = __esm({
     init_env_file();
     ({ writeFileSync: writeFileSync8 } = fse8);
     ENV_LOCAL_TEMPLATE = `# Next.js environment
-# Loaded by Next.js (and the SPFN backend). Only non-secret, Next.js-facing
-# values belong here \u2014 server secrets go in .env.server.
+# Loaded by Next.js (and the SPFN backend). Never prefix secrets with
+# NEXT_PUBLIC_. Backend-only secrets belong in .env.server.
 
 # SPFN API endpoint \u2014 browser + Next.js SSR/proxy target
 SPFN_API_URL=http://localhost:8790
@@ -1198,6 +1350,12 @@ NEXT_PUBLIC_SPFN_API_URL=http://localhost:8790
 
 # Next.js app URL (used by the SPFN server for CORS/redirects)
 SPFN_APP_URL=http://localhost:3790
+`;
+    FULL_ENV_LOCAL_EXAMPLE = `
+# Full scaffold: auth session encryption (Next.js server only; never NEXT_PUBLIC_*)
+SPFN_AUTH_SESSION_SECRET=replace-with-a-random-secret-at-least-32-characters
+SPFN_AUTH_SESSION_TTL=7d
+NEXT_PUBLIC_SPFN_APP_URL=http://localhost:3790
 `;
     ENV_SERVER_TEMPLATE = `# SPFN backend environment
 # Loaded ONLY by the SPFN server, never by Next.js. Keep all server-only config
@@ -1224,12 +1382,25 @@ DB_POOL_IDLE_TIMEOUT=30
 # DATABASE_READ_URL=postgresql://user:password@replica:5432/dbname
 # CACHE_PASSWORD=your-redis-password
 `;
-    ENV_EXAMPLE_TEMPLATE = withPlaceholderCreds(`# Example environment \u2014 committed reference for the variables SPFN uses.
-# Real values live in .env.local (Next.js) and .env.server (backend secrets),
-# both gitignored. This file documents the keys; it is not loaded by anything.
-
-${ENV_LOCAL_TEMPLATE}
-${ENV_SERVER_TEMPLATE}`);
+    FULL_ENV_SERVER_EXAMPLE = `
+# Full scaffold: authentication
+SPFN_AUTH_VERIFICATION_TOKEN_SECRET=replace-with-a-random-secret-at-least-32-characters
+SPFN_AUTH_TOKEN_ENCRYPTION_KEYS=v1:replace-with-a-base64-encoded-32-byte-key
+
+# Enable the social providers you need.
+# SPFN_AUTH_GOOGLE_CLIENT_ID=your-google-client-id
+# SPFN_AUTH_GOOGLE_CLIENT_SECRET=your-google-client-secret
+# SPFN_AUTH_GITHUB_CLIENT_ID=your-github-client-id
+# SPFN_AUTH_GITHUB_CLIENT_SECRET=your-github-client-secret
+# SPFN_AUTH_KAKAO_CLIENT_ID=your-kakao-rest-api-key
+# SPFN_AUTH_KAKAO_CLIENT_SECRET=your-kakao-client-secret
+# SPFN_AUTH_NAVER_CLIENT_ID=your-naver-client-id
+# SPFN_AUTH_NAVER_CLIENT_SECRET=your-naver-client-secret
+
+# Full scaffold: MCP operator endpoint
+SPFN_MCP_URL=http://localhost:8790
+SPFN_MCP_API_KEY=replace-with-a-random-operator-key
+`;
   }
 });
 
@@ -1254,15 +1425,16 @@ async function setupReadme(cwd, ctx) {
   const content = renderReadme(template, {
     projectName: ctx.packageJson.name || basename(cwd) || "my-app",
     pm: ctx.pm,
+    pmExec: ctx.pm === "npm" ? "npx" : ctx.pm,
     pmRun: getRunCommand(ctx.pm),
-    includeAuth: ctx.includeAuth
+    mode: ctx.mode
   });
   writeFileSync9(readmePath, content);
   logger.success("Created README.md");
 }
 function renderReadme(template, vars) {
   const authBlock = /\r?\n?<!-- \{\{#auth\}\} -->\r?\n([\s\S]*?)\r?\n<!-- \{\{\/auth\}\} -->\r?\n/;
-  return template.replace(authBlock, vars.includeAuth ? "\n$1\n" : "\n").replaceAll("{{projectName}}", () => vars.projectName).replaceAll("{{pmRun}}", () => vars.pmRun).replaceAll("{{pm}}", () => vars.pm);
+  return template.replace(authBlock, vars.mode === "full" ? "\n$1\n" : "\n").replaceAll("{{mode}}", () => vars.mode).replaceAll("{{projectName}}", () => vars.projectName).replaceAll("{{pmRun}}", () => vars.pmRun).replaceAll("{{pmExec}}", () => vars.pmExec).replaceAll("{{pm}}", () => vars.pm);
 }
 var writeFileSync9;
 var init_readme = __esm({
@@ -1281,31 +1453,40 @@ __export(init_exports, {
   initCommand: () => initCommand,
   initializeSpfn: () => initializeSpfn
 });
-import { Command as Command2 } from "commander";
+import { Command as Command2, Option } from "commander";
 import chalk4 from "chalk";
 async function initializeSpfn(options = {}) {
   const cwd = process.cwd();
-  const { packageJson, packageJsonPath, includeAuth } = await validateProject(cwd, options.yes || false);
+  const { packageJson, packageJsonPath } = await validateProject(cwd, options.yes || false);
+  const mode = await selectScaffoldMode(options);
+  const includeAuth = mode === "full";
   const pm = detectPackageManager(cwd);
   logger.step(`Detected package manager: ${pm}`);
-  await setupServerStructure(cwd);
+  await setupServerStructure(cwd, mode);
   await setupApiProxy(cwd, includeAuth);
   await setupNextConfig(cwd, includeAuth);
   await setupDockerFiles(cwd, pm);
   await setupDeploymentConfig(cwd, packageJson, pm);
-  await setupPackageJson(cwd, packageJsonPath, packageJson, pm, includeAuth);
-  await setupConfigFiles(cwd);
-  await setupReadme(cwd, { pm, packageJson, includeAuth, overwrite: options.overwriteReadme ?? false });
+  await setupPackageJson(cwd, packageJsonPath, packageJson, pm, mode);
+  await setupConfigFiles(cwd, mode);
+  await setupReadme(cwd, { pm, packageJson, mode, overwrite: options.overwriteReadme ?? false });
   console.log("\n" + chalk4.green.bold("\u2713 SPFN initialized successfully!\n"));
   console.log("Next steps:");
   console.log("  1. Start PostgreSQL & Redis (if not installed locally):");
   console.log("     " + chalk4.cyan("docker compose up -d"));
   console.log("  2. Review the generated env files (.env.local, .env.server)");
   console.log("     " + chalk4.dim(ENV_FILES_HINT));
-  console.log("  3. Run: " + chalk4.cyan(`${getRunCommand(pm)} spfn:dev`));
-  console.log("  4. Visit:");
+  if (mode === "full") {
+    const spfnCommand = pm === "npm" ? "npx spfn" : `${pm} spfn`;
+    console.log("  3. Apply the auth migrations: " + chalk4.cyan(`${spfnCommand} db migrate`));
+  }
+  console.log(`  ${mode === "full" ? "4" : "3"}. Run: ` + chalk4.cyan(`${getRunCommand(pm)} spfn:dev`));
+  console.log(`  ${mode === "full" ? "5" : "4"}. Visit:`);
   console.log("     - Next.js: " + chalk4.cyan("http://localhost:3790"));
   console.log("     - API:     " + chalk4.cyan("http://localhost:8790/health"));
+  if (mode === "full") {
+    console.log("     - MCP:     " + chalk4.cyan("http://localhost:8790/mcp"));
+  }
   console.log("\nAvailable commands:");
   console.log("  \u2022 " + chalk4.cyan(`${getRunCommand(pm)} spfn:dev`) + "       - Start SPFN + Next.js");
   console.log("  \u2022 " + chalk4.cyan("spfn env validate") + "  - Validate environment variables");
@@ -1329,7 +1510,8 @@ var init_init = __esm({
     init_package();
     init_config_files();
     init_readme();
-    initCommand = new Command2("init").description("Initialize SPFN in your Next.js project").option("-y, --yes", "Skip prompts and use defaults").action(initializeSpfn);
+    init_mode();
+    initCommand = new Command2("init").description("Initialize SPFN in your Next.js project").addOption(new Option("--mode <mode>", "Scaffold mode: bare (core) or full (core, auth, i18n, MCP)").choices(["bare", "full"])).option("-y, --yes", "Skip prompts and use defaults").action(initializeSpfn);
   }
 });
 
@@ -1678,16 +1860,17 @@ var init_migration_status = __esm({
 });
 
 // src/index.ts
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 
 // src/commands/create.ts
 init_logger();
 init_package_manager();
 init_messages();
-import { Command as Command3 } from "commander";
+init_mode();
+import { Command as Command3, Option as Option2 } from "commander";
 import { existsSync as existsSync13 } from "fs";
 import { join as join13, resolve, dirname as dirname2 } from "path";
-import prompts2 from "prompts";
+import prompts3 from "prompts";
 import ora4 from "ora";
 import { execa as execa3 } from "execa";
 import chalk5 from "chalk";
@@ -1713,7 +1896,7 @@ async function createProject(projectName, options) {
   console.log(chalk5.blue.bold("\n\u{1F680} Creating Next.js project with SPFN...\n"));
   let pm = options.pm || detectPackageManager(cwd);
   if (!options.yes && !options.pm) {
-    const { selectedPm } = await prompts2({
+    const { selectedPm } = await prompts3({
       type: "select",
       name: "selectedPm",
       message: "Which package manager do you want to use?",
@@ -1731,6 +1914,8 @@ async function createProject(projectName, options) {
     pm = selectedPm;
   }
   logger.step(`Using package manager: ${pm}`);
+  const mode = await selectScaffoldMode(options);
+  logger.step(`Using scaffold mode: ${mode}`);
   const workspaceRoot = pm === "pnpm" ? findPnpmWorkspaceRoot(cwd) : null;
   const isInWorkspace = workspaceRoot !== null;
   if (isInWorkspace) {
@@ -1829,7 +2014,7 @@ async function createProject(projectName, options) {
   const initSpinner = ora4("Initializing SPFN...").start();
   try {
     const { initializeSpfn: initializeSpfn2 } = await Promise.resolve().then(() => (init_init(), init_exports));
-    await initializeSpfn2({ yes: true, overwriteReadme: true });
+    await initializeSpfn2({ yes: true, overwriteReadme: true, mode });
     initSpinner.succeed("SPFN initialized");
   } catch (error) {
     initSpinner.fail("Failed to initialize SPFN");
@@ -1841,6 +2026,10 @@ async function createProject(projectName, options) {
   console.log(`  ${chalk5.cyan("cd")} ${projectName}`);
   console.log(`  ${chalk5.cyan("docker compose up -d")}  ${chalk5.gray("# Start PostgreSQL & Redis")}`);
   console.log(`  ${chalk5.gray(`# .env.local & .env.server are generated \u2014 ${ENV_FILES_HINT}`)}`);
+  if (mode === "full") {
+    const spfnCommand = pm === "npm" ? "npx spfn" : `${pm} spfn`;
+    console.log(`  ${chalk5.cyan(`${spfnCommand} db migrate`)}  ${chalk5.gray("# Apply auth migrations")}`);
+  }
   console.log(`  ${chalk5.cyan(`${getRunCommand(pm)} spfn:dev`)}  ${chalk5.gray("# Start dev server")}
 `);
   console.log(chalk5.bold("Your app will be available at:\n"));
@@ -1857,7 +2046,7 @@ async function createProject(projectName, options) {
 `);
   console.log(chalk5.dim("  \u{1F310} Documentation: https://github.com/spfn/spfn\n"));
 }
-var createCommand = new Command3("create").description("Create a new Next.js project with SPFN").argument("<project-name>", "Name of the project directory").option("--skip-install", "Skip installing dependencies").option("--skip-git", "Skip initializing a git repository").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--shadcn", "Setup shadcn/ui (component library)").option("-y, --yes", "Skip prompts and use defaults").action(async (projectName, options) => {
+var createCommand = new Command3("create").description("Create a new Next.js project with SPFN").argument("<project-name>", "Name of the project directory").option("--skip-install", "Skip installing dependencies").option("--skip-git", "Skip initializing a git repository").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--shadcn", "Setup shadcn/ui (component library)").addOption(new Option2("--mode <mode>", "Scaffold mode: bare (core) or full (core, auth, i18n, MCP)").choices(["bare", "full"])).option("-y, --yes", "Skip prompts and use defaults").action(async (projectName, options) => {
   await createProject(projectName, options);
 });
 
@@ -1869,7 +2058,7 @@ init_logger();
 init_package_manager();
 import { Command as Command4 } from "commander";
 import { existsSync as existsSync16, readFileSync as readFileSync8, writeFileSync as writeFileSync10, mkdirSync, unlinkSync, rmSync, watch } from "fs";
-import { join as join17, relative, sep } from "path";
+import { join as join17, relative, sep as sep2 } from "path";
 import { execa as execa6 } from "execa";
 import chokidar from "chokidar";
 
@@ -2064,7 +2253,7 @@ async function resolveKeychainEnv(cwd) {
 
 // src/commands/dev.ts
 function ignoreDotfilesUnder(root) {
-  return (watchedPath) => relative(root, watchedPath).split(sep).some((segment) => segment.startsWith(".") && segment !== "." && segment !== "..");
+  return (watchedPath) => relative(root, watchedPath).split(sep2).some((segment) => segment.startsWith(".") && segment !== "." && segment !== "..");
 }
 function waitForReadyFile(filePath, timeoutMs = 3e4) {
   return new Promise((resolve3, reject) => {
@@ -2687,16 +2876,95 @@ var startCommand = new Command6("start").description("Start SPFN production serv
   }
 });
 
-// src/commands/codegen.ts
+// src/commands/provision.ts
 init_logger();
+init_package_manager();
 import { Command as Command7 } from "commander";
-import { existsSync as existsSync19, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync3, writeFileSync as writeFileSync12 } from "fs";
 import { join as join20 } from "path";
+import { pathToFileURL } from "url";
+import { execa as execa9 } from "execa";
+var CONFIG_FILE_PATHS = [
+  ".spfn/server/server.config.mjs",
+  ".spfn/server/server.config.js",
+  "src/server/server.config.ts",
+  "src/server/server.config.js"
+];
+function findServerConfig(cwd) {
+  return CONFIG_FILE_PATHS.map((path5) => join20(cwd, path5)).find(existsSync19);
+}
+var provisionCommand = new Command7("provision").description("Run deploy-time provisioning (seed/RBAC lifecycle hooks) \u2014 once per deploy, not per cold start").action(async () => {
+  if (!process.env.NODE_ENV) {
+    process.env.NODE_ENV = "production";
+  }
+  const cwd = process.cwd();
+  const configPath = findServerConfig(cwd);
+  if (!configPath) {
+    logger.error("server.config not found.");
+    logger.info(`Looked for: ${CONFIG_FILE_PATHS.join(", ")}`);
+    logger.info('Run "spfn init" first, or run this command from the app root.');
+    process.exit(1);
+  }
+  const { env: keychainEnv, missing: keychainMissing } = await resolveKeychainEnv(cwd);
+  if (Object.keys(keychainEnv).length > 0) {
+    logger.info(`[SPFN] Injecting ${Object.keys(keychainEnv).length} secret(s) from the keychain`);
+  }
+  if (keychainMissing.length > 0) {
+    logger.warn(`[SPFN] Could not resolve keychain secret(s): ${keychainMissing.join(", ")} \u2014 run \`spfn secret set <KEY>\``);
+  }
+  const tempDir = join20(cwd, ".spfn");
+  const runnerEntry = join20(tempDir, "provision.mjs");
+  mkdirSync3(tempDir, { recursive: true });
+  writeFileSync12(runnerEntry, `
+if (!process.env.NODE_ENV)
+{
+    process.env.NODE_ENV = 'production';
+}
+
+// The Vercel Supabase integration injects POSTGRES_URL but not DATABASE_URL,
+// which is what SPFN reads. Map it so build-step provisioning connects too.
+process.env.DATABASE_URL ??= process.env.POSTGRES_URL;
+
+// Load environment variables FIRST (before any imports that depend on them)
+await import('@spfn/core/config');
+
+const { provisionInfrastructure } = await import('@spfn/core/server');
+
+const config = (await import(${JSON.stringify(pathToFileURL(configPath).href)})).default;
+
+await provisionInfrastructure(config);
+
+// provisionInfrastructure leaves the DB pool open \u2014 exit explicitly.
+process.exit(0);
+`);
+  logger.info(`[SPFN] Provisioning with config: ${configPath.replace(cwd + "/", "")}
+`);
+  const pm = detectPackageManager(cwd);
+  const runnerCmd = pm === "npm" ? "npx" : pm;
+  const runnerArgs = pm === "npm" ? ["tsx", runnerEntry] : ["exec", "tsx", runnerEntry];
+  const result = await execa9(runnerCmd, runnerArgs, {
+    cwd,
+    stdio: "inherit",
+    reject: false,
+    env: { ...process.env, ...keychainEnv }
+  });
+  if (result.exitCode !== 0) {
+    logger.error(`Provisioning failed (exit code ${result.exitCode})`);
+    process.exit(result.exitCode ?? 1);
+  }
+  logger.info("[SPFN] Provisioning complete");
+});
+
+// src/commands/codegen.ts
+init_logger();
+import { Command as Command8 } from "commander";
+import { existsSync as existsSync20, writeFileSync as writeFileSync13 } from "fs";
+import { join as join21 } from "path";
 import chalk10 from "chalk";
 async function initCodegen(options) {
   const cwd = process.cwd();
-  const rcPath = join20(cwd, ".spfnrc.ts");
-  if (existsSync19(rcPath)) {
+  const rcPath = join21(cwd, ".spfnrc.ts");
+  if (existsSync20(rcPath)) {
     logger.warn(".spfnrc.ts already exists");
     logger.info("Edit manually to add custom generators");
     process.exit(0);
@@ -2721,7 +2989,7 @@ export default defineConfig({
     ],
 });
 `;
-  writeFileSync12(rcPath, content);
+  writeFileSync13(rcPath, content);
   console.log("\n" + chalk10.green.bold("\u2713 Created .spfnrc.ts\n"));
   console.log(chalk10.gray("Configured the @spfn/core:route-map generator."));
   if (options.withExample) {
@@ -2781,28 +3049,28 @@ async function runGenerators() {
   await orchestrator.generateAll();
   console.log("\n" + chalk10.green.bold("\u2713 Code generation completed"));
 }
-var codegenCommand = new Command7("codegen").description("Code generation management");
+var codegenCommand = new Command8("codegen").description("Code generation management");
 codegenCommand.command("init").description("Initialize .spfnrc.ts with codegen configuration").option("--with-example", "Show example custom generator usage").action(initCodegen);
 codegenCommand.command("list").alias("ls").description("List registered code generators").action(listGenerators);
 codegenCommand.command("run").description("Run code generators once (no watch mode)").action(runGenerators);
 
 // src/commands/key.ts
 init_logger();
-import { Command as Command8 } from "commander";
+import { Command as Command9 } from "commander";
 import { execSync } from "child_process";
 import chalk11 from "chalk";
 
 // src/utils/secret-gen.ts
-import { randomBytes, randomUUID } from "crypto";
+import { randomBytes as randomBytes2, randomUUID } from "crypto";
 function randomBase64Url(bytes) {
-  return randomBytes(bytes).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  return randomBytes2(bytes).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 function generateSecretValue(spec) {
   switch (spec) {
     case "hex32":
-      return randomBytes(32).toString("hex");
+      return randomBytes2(32).toString("hex");
     case "hex64":
-      return randomBytes(64).toString("hex");
+      return randomBytes2(64).toString("hex");
     case "base64url32":
       return randomBase64Url(32);
     case "uuid":
@@ -2902,7 +3170,7 @@ function listPresets() {
   console.log(chalk11.gray("  spfn key auth-encryption --copy"));
   console.log();
 }
-var generateValueCommand = new Command8("generate").alias("gen").description("Generate random value (simple output, no metadata)").option("-b, --bytes <number>", "Number of random bytes", "32").option("-c, --copy", "Copy to clipboard").action((options) => {
+var generateValueCommand = new Command9("generate").alias("gen").description("Generate random value (simple output, no metadata)").option("-b, --bytes <number>", "Number of random bytes", "32").option("-c, --copy", "Copy to clipboard").action((options) => {
   const bytes = parseInt(options.bytes, 10);
   if (isNaN(bytes) || bytes < 1 || bytes > 128) {
     logger.error("Invalid bytes value. Must be between 1 and 128.");
@@ -2918,7 +3186,7 @@ var generateValueCommand = new Command8("generate").alias("gen").description("Ge
     }
   }
 });
-var keyCommand = new Command8("key").alias("k").description("Generate secure random keys and secrets").argument("[preset]", `Preset type (use --list to see all)`).option("-l, --list", "List all available presets").option("-b, --bytes <number>", "Number of random bytes to generate", "32").option("-e, --env <name>", "Environment variable name").option("-c, --copy", "Copy to clipboard").action((preset, options) => {
+var keyCommand = new Command9("key").alias("k").description("Generate secure random keys and secrets").argument("[preset]", `Preset type (use --list to see all)`).option("-l, --list", "List all available presets").option("-b, --bytes <number>", "Number of random bytes to generate", "32").option("-e, --env <name>", "Environment variable name").option("-c, --copy", "Copy to clipboard").action((preset, options) => {
   if (options.list) {
     listPresets();
     return;
@@ -2950,15 +3218,15 @@ keyCommand.addCommand(generateValueCommand);
 init_setup();
 
 // src/commands/db/index.ts
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 
 // src/commands/db/generate.ts
 import chalk13 from "chalk";
 
 // src/commands/db/utils/drizzle.ts
-import { existsSync as existsSync20, writeFileSync as writeFileSync13, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync21, writeFileSync as writeFileSync14, unlinkSync as unlinkSync2 } from "fs";
 import { spawn } from "child_process";
-import { pathToFileURL } from "url";
+import { pathToFileURL as pathToFileURL2 } from "url";
 import chalk12 from "chalk";
 import ora6 from "ora";
 import { env as env3 } from "@spfn/core/config";
@@ -3023,7 +3291,7 @@ function validateDatabasePrerequisites() {
   }
 }
 async function runDrizzleCommand(command) {
-  const hasUserConfig = existsSync20("./drizzle.config.ts");
+  const hasUserConfig = existsSync21("./drizzle.config.ts");
   const tempConfigPath = `./drizzle.config.${process.pid}.${Date.now()}.temp.ts`;
   const configPath = hasUserConfig ? "./drizzle.config.ts" : tempConfigPath;
   if (!hasUserConfig) {
@@ -3042,7 +3310,7 @@ async function runDrizzleCommand(command) {
       expandGlobs: true,
       autoDetectSchemas: true
     });
-    writeFileSync13(tempConfigPath, configContent);
+    writeFileSync14(tempConfigPath, configContent);
     console.log(chalk12.dim("Using auto-generated Drizzle config\n"));
   }
   const args = command.split(" ");
@@ -3055,7 +3323,7 @@ async function runDrizzleCommand(command) {
       env: shouldRelaxDbTls(env3.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
     });
     const cleanup = () => {
-      if (!hasUserConfig && existsSync20(tempConfigPath)) {
+      if (!hasUserConfig && existsSync21(tempConfigPath)) {
         unlinkSync2(tempConfigPath);
       }
     };
@@ -3094,7 +3362,7 @@ async function loadSchemaImports(schemaFiles) {
   }
   const imports = {};
   for (const file of schemaFiles) {
-    const moduleUrl = pathToFileURL(file).href;
+    const moduleUrl = pathToFileURL2(file).href;
     const mod = await import(moduleUrl);
     for (const [key, value] of Object.entries(mod)) {
       if (key !== "default") {
@@ -3137,7 +3405,7 @@ async function dbGenerate() {
 
 // src/commands/db/push.ts
 import chalk15 from "chalk";
-import prompts3 from "prompts";
+import prompts4 from "prompts";
 import "@spfn/core/config";
 import { loadEnv as loadEnv4 } from "@spfn/core/server";
 import { sql } from "drizzle-orm";
@@ -3322,7 +3590,7 @@ async function dbPush(options = {}) {
         console.log(chalk15.red(`   ${stmt.sql.replace(/\s+/g, " ").trim()}`));
         console.log(chalk15.dim(`   \u2192 ${stmt.reason}`));
       }
-      const { confirm } = await prompts3({
+      const { confirm } = await prompts4({
         type: "confirm",
         name: "confirm",
         message: "Apply destructive changes?",
@@ -3375,8 +3643,8 @@ async function applyFunctionMigrations(plans) {
 
 // src/commands/db/migrate.ts
 import chalk20 from "chalk";
-import { join as join21 } from "path";
-import { existsSync as existsSync22 } from "fs";
+import { join as join22 } from "path";
+import { existsSync as existsSync23 } from "fs";
 
 // src/commands/db/backup.ts
 import { promises as fs3 } from "fs";
@@ -3388,7 +3656,7 @@ import ora7 from "ora";
 // src/commands/db/utils/database.ts
 import net from "net";
 import chalk16 from "chalk";
-import prompts4 from "prompts";
+import prompts5 from "prompts";
 function parseDatabaseUrl2(dbUrl) {
   try {
     const url = new URL(dbUrl);
@@ -3412,7 +3680,7 @@ async function confirmDangerousTarget(dbInfo) {
   if (!isRemoteHost(dbInfo.host) && process.env.NODE_ENV !== "production") {
     return;
   }
-  const { typed } = await prompts4({
+  const { typed } = await prompts5({
     type: "text",
     name: "typed",
     message: `Remote/production database detected. Type the database name "${dbInfo.database}" to continue:`
@@ -3469,7 +3737,7 @@ function formatTimestamp() {
 
 // src/commands/db/utils/backup-files.ts
 import { promises as fs2 } from "fs";
-import { existsSync as existsSync21 } from "fs";
+import { existsSync as existsSync22 } from "fs";
 import path2 from "path";
 import chalk18 from "chalk";
 
@@ -3569,7 +3837,7 @@ async function ensureBackupInGitignore() {
   const gitignorePath = path2.join(process.cwd(), ".gitignore");
   try {
     let content = "";
-    let exists = existsSync21(gitignorePath);
+    let exists = existsSync22(gitignorePath);
     if (exists) {
       content = await fs2.readFile(gitignorePath, "utf-8");
     }
@@ -3591,7 +3859,7 @@ async function ensureBackupDir() {
   try {
     await fs2.mkdir(backupDir, { recursive: true });
     const gitignorePath = path2.join(backupDir, ".gitignore");
-    const gitignoreExists = existsSync21(gitignorePath);
+    const gitignoreExists = existsSync22(gitignorePath);
     if (!gitignoreExists) {
       await fs2.writeFile(gitignorePath, "# Ignore all backup files\n*.sql\n*.dump\n*.meta.json\n");
     }
@@ -3785,8 +4053,8 @@ async function dbMigrate(options = {}) {
     await executeFunctionMigrations2(loadFunctionMigrationPlans2(functions));
     console.log(chalk20.green("\u2705 Function migrations applied\n"));
   }
-  const projectMigrationsDir = join21(process.cwd(), "src/server/drizzle");
-  if (existsSync22(projectMigrationsDir)) {
+  const projectMigrationsDir = join22(process.cwd(), "src/server/drizzle");
+  if (existsSync23(projectMigrationsDir)) {
     const projConn = postgres.default(env5.DATABASE_URL, { max: 1 });
     const projDb = drizzle({ client: projConn });
     try {
@@ -3846,7 +4114,7 @@ async function dbStatus() {
 
 // src/commands/db/studio.ts
 import chalk22 from "chalk";
-import { existsSync as existsSync23, writeFileSync as writeFileSync14, unlinkSync as unlinkSync3 } from "fs";
+import { existsSync as existsSync24, writeFileSync as writeFileSync15, unlinkSync as unlinkSync3 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { env as env6 } from "@spfn/core/config";
 async function dbStudio(requestedPort) {
@@ -3864,7 +4132,7 @@ async function dbStudio(requestedPort) {
     console.error(chalk22.red(error instanceof Error ? error.message : "Failed to find available port"));
     process.exit(1);
   }
-  const hasUserConfig = existsSync23("./drizzle.config.ts");
+  const hasUserConfig = existsSync24("./drizzle.config.ts");
   const tempConfigPath = `./drizzle.config.${process.pid}.${Date.now()}.temp.ts`;
   try {
     const configPath = hasUserConfig ? "./drizzle.config.ts" : tempConfigPath;
@@ -3881,7 +4149,7 @@ async function dbStudio(requestedPort) {
         expandGlobs: true
         // Expand glob patterns for Studio compatibility
       });
-      writeFileSync14(tempConfigPath, configContent);
+      writeFileSync15(tempConfigPath, configContent);
       console.log(chalk22.dim("Using auto-generated Drizzle config\n"));
     }
     const studioProcess = spawn3("drizzle-kit", ["studio", `--port=${port}`, `--config=${configPath}`], {
@@ -3890,7 +4158,7 @@ async function dbStudio(requestedPort) {
       env: shouldRelaxDbTls(env6.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
     });
     const cleanup = () => {
-      if (!hasUserConfig && existsSync23(tempConfigPath)) {
+      if (!hasUserConfig && existsSync24(tempConfigPath)) {
         unlinkSync3(tempConfigPath);
       }
     };
@@ -3920,7 +4188,7 @@ async function dbStudio(requestedPort) {
       process.exit(0);
     });
   } catch (error) {
-    if (!hasUserConfig && existsSync23(tempConfigPath)) {
+    if (!hasUserConfig && existsSync24(tempConfigPath)) {
       unlinkSync3(tempConfigPath);
     }
     console.error(chalk22.red("\u274C Failed to start Drizzle Studio"));
@@ -3931,7 +4199,7 @@ async function dbStudio(requestedPort) {
 
 // src/commands/db/drop.ts
 import chalk23 from "chalk";
-import prompts5 from "prompts";
+import prompts6 from "prompts";
 import { env as env7 } from "@spfn/core/config";
 import { loadEnv as loadEnv7 } from "@spfn/core/server";
 async function dbDrop() {
@@ -3945,7 +4213,7 @@ async function dbDrop() {
   console.log(chalk23.yellow("\u26A0\uFE0F  WARNING: This will drop all tables in your database!"));
   console.log(chalk23.dim(`   Target: ${dbInfo.database} @ ${dbInfo.host}:${dbInfo.port}
 `));
-  const { confirm } = await prompts5({
+  const { confirm } = await prompts6({
     type: "confirm",
     name: "confirm",
     message: "Are you sure you want to drop all tables?",
@@ -3984,7 +4252,7 @@ import path4 from "path";
 import { spawn as spawn4 } from "child_process";
 import chalk25 from "chalk";
 import ora9 from "ora";
-import prompts6 from "prompts";
+import prompts7 from "prompts";
 import { env as env8 } from "@spfn/core/config";
 import { loadEnv as loadEnv8 } from "@spfn/core/server";
 async function dbRestore(backupFile, options = {}) {
@@ -4003,7 +4271,7 @@ async function dbRestore(backupFile, options = {}) {
       console.log(chalk25.yellow("No backups found in ./backups directory"));
       process.exit(0);
     }
-    const { selected } = await prompts6({
+    const { selected } = await prompts7({
       type: "select",
       name: "selected",
       message: "Select backup to restore:",
@@ -4066,7 +4334,7 @@ async function dbRestore(backupFile, options = {}) {
     }
   }
   const dbInfo = parseDatabaseUrl2(dbUrl);
-  const { confirm } = await prompts6({
+  const { confirm } = await prompts7({
     type: "confirm",
     name: "confirm",
     message: chalk25.yellow(`\u26A0\uFE0F  This will replace all data in "${dbInfo.database}" @ ${dbInfo.host}:${dbInfo.port}. Continue?`),
@@ -4249,7 +4517,7 @@ async function dbBackupList() {
 import { promises as fs4 } from "fs";
 import chalk27 from "chalk";
 import ora10 from "ora";
-import prompts7 from "prompts";
+import prompts8 from "prompts";
 async function dbBackupClean(options) {
   console.log(chalk27.blue("\u{1F9F9} Cleaning old backups...\n"));
   const backups = await listBackupFiles();
@@ -4279,7 +4547,7 @@ async function dbBackupClean(options) {
   toDelete.forEach((backup) => {
     console.log(chalk27.gray(`  - ${backup.name} (${backup.size})`));
   });
-  const { confirm } = await prompts7({
+  const { confirm } = await prompts8({
     type: "confirm",
     name: "confirm",
     message: "\nProceed with deletion?",
@@ -4307,8 +4575,8 @@ async function dbBackupClean(options) {
 }
 
 // src/commands/db/reindex.ts
-import { existsSync as existsSync24, readFileSync as readFileSync10, writeFileSync as writeFileSync15, renameSync, copyFileSync } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync10, writeFileSync as writeFileSync16, renameSync, copyFileSync } from "fs";
+import { join as join23 } from "path";
 import chalk28 from "chalk";
 import { loadEnv as loadEnv9 } from "@spfn/core/server";
 function isTimestampPrefix(tag) {
@@ -4330,8 +4598,8 @@ async function dbReindex(options = {}) {
   const { getDrizzleConfig } = await import("@spfn/core/db");
   const config = getDrizzleConfig({ disablePackageDiscovery: true });
   const outDir = config.out;
-  const journalPath = join22(outDir, "meta", "_journal.json");
-  if (!existsSync24(journalPath)) {
+  const journalPath = join23(outDir, "meta", "_journal.json");
+  if (!existsSync25(journalPath)) {
     console.error(chalk28.red("\u274C No _journal.json found at:"), journalPath);
     console.log(chalk28.yellow("\u{1F4A1} Run `spfn db generate` first to create migrations"));
     process.exit(1);
@@ -4352,14 +4620,14 @@ async function dbReindex(options = {}) {
     const { prefix: oldPrefix, suffix } = parseTag(entry.tag);
     const newPrefix = String(entry.when);
     const newTag = suffix ? `${newPrefix}_${suffix}` : newPrefix;
-    const oldSql = join22(outDir, `${entry.tag}.sql`);
-    const newSql = join22(outDir, `${newTag}.sql`);
-    if (existsSync24(oldSql)) {
+    const oldSql = join23(outDir, `${entry.tag}.sql`);
+    const newSql = join23(outDir, `${newTag}.sql`);
+    if (existsSync25(oldSql)) {
       renames.push({ type: "sql", from: oldSql, to: newSql });
     }
-    const oldSnapshot = join22(outDir, "meta", `${oldPrefix}_snapshot.json`);
-    const newSnapshot = join22(outDir, "meta", `${newPrefix}_snapshot.json`);
-    if (existsSync24(oldSnapshot)) {
+    const oldSnapshot = join23(outDir, "meta", `${oldPrefix}_snapshot.json`);
+    const newSnapshot = join23(outDir, "meta", `${newPrefix}_snapshot.json`);
+    if (existsSync25(oldSnapshot)) {
       renames.push({ type: "snapshot", from: oldSnapshot, to: newSnapshot });
     }
     tagUpdates.push({ idx: entry.idx, oldTag: entry.tag, newTag });
@@ -4402,13 +4670,13 @@ async function dbReindex(options = {}) {
       entry.tag = update.newTag;
     }
   }
-  writeFileSync15(journalPath, JSON.stringify(journal, null, 2) + "\n");
+  writeFileSync16(journalPath, JSON.stringify(journal, null, 2) + "\n");
   console.log(chalk28.green(`
 \u2705 Reindex complete \u2014 ${tagUpdates.length} migration(s) converted to timestamp prefix.`));
 }
 
 // src/commands/db/index.ts
-var dbCommand = new Command9("db").description("Database management commands (wraps Drizzle Kit)");
+var dbCommand = new Command10("db").description("Database management commands (wraps Drizzle Kit)");
 dbCommand.command("generate").alias("g").description("Generate database migrations from schema changes").action(dbGenerate);
 dbCommand.command("push").description("Push schema changes to database (safe mode by default)").option("--force", "Apply all changes including destructive ones").option("--dry-run", "Show changes without applying").action((options) => dbPush(options));
 dbCommand.command("migrate").alias("m").description("Run pending migrations").option("--with-backup", "Create backup before running migrations").action((options) => dbMigrate(options));
@@ -4424,54 +4692,114 @@ dbCommand.command("reindex").description("Convert migration files from sequentia
 
 // src/commands/add.ts
 init_package_manager();
-import { Command as Command10 } from "commander";
-import { existsSync as existsSync25, readFileSync as readFileSync11 } from "fs";
-import { join as join23 } from "path";
-import { execa as execa9 } from "execa";
-import chalk29 from "chalk";
+import { Command as Command11 } from "commander";
+import { existsSync as existsSync27, readFileSync as readFileSync11 } from "fs";
+import { join as join25 } from "path";
+import { execa as execa10 } from "execa";
+import chalk30 from "chalk";
 import ora11 from "ora";
+
+// src/commands/add-vercel.ts
+init_templates();
+import { copyFileSync as copyFileSync2, existsSync as existsSync26, mkdirSync as mkdirSync4 } from "fs";
+import { dirname as dirname3, join as join24 } from "path";
+import chalk29 from "chalk";
+var FILES = [
+  {
+    template: "route.ts",
+    target: join24("src", "app", "api", "backend", "[[...route]]", "route.ts"),
+    description: "hono/vercel adapter (mounts the SPFN app under /api/backend)"
+  },
+  {
+    template: "vercel.json",
+    target: "vercel.json",
+    description: "Vercel build config (pnpm spfn:build)"
+  },
+  {
+    template: "npmrc",
+    target: ".npmrc",
+    description: "@spfn registry auth (reads GITEA_NPM_TOKEN from env)"
+  }
+];
+async function addVercel() {
+  console.log(chalk29.blue("\n\u{1F4E6} Setting up the Vercel serverless target...\n"));
+  const cwd = process.cwd();
+  const templatesDir = join24(findTemplatesPath(), "vercel");
+  for (const file of FILES) {
+    const targetPath = join24(cwd, file.target);
+    if (existsSync26(targetPath)) {
+      console.log(chalk29.yellow(`\u23ED\uFE0F  ${file.target} already exists \u2014 skipped (not overwritten)`));
+      continue;
+    }
+    mkdirSync4(dirname3(targetPath), { recursive: true });
+    copyFileSync2(join24(templatesDir, file.template), targetPath);
+    console.log(chalk29.green(`\u2705 ${file.target}`) + chalk29.gray(` \u2014 ${file.description}`));
+  }
+  console.log(chalk29.green("\n\u2705 Vercel target ready!\n"));
+  console.log(chalk29.cyan("\u{1F4DA} Next steps:"));
+  console.log(chalk29.gray("  1. Make sure `hono` is a direct dependency (hono/vercel must resolve from the app):"));
+  console.log(chalk29.gray("       pnpm add hono"));
+  console.log(chalk29.gray("  2. Set Vercel project env vars:"));
+  console.log(chalk29.gray("       GITEA_NPM_TOKEN   \u2014 @spfn registry token (install step)"));
+  console.log(chalk29.gray("       SPFN_AUTH_*       \u2014 auth secrets (same as local .env.server)"));
+  console.log(chalk29.gray("       SPFN_API_URL      \u2014 https://<your-domain>/api/backend (RPC proxy origin)"));
+  console.log(chalk29.gray("       DATABASE_URL      \u2014 set automatically from POSTGRES_URL if you use the"));
+  console.log(chalk29.gray("                           Vercel Supabase integration (mapped in route.ts)"));
+  console.log(chalk29.gray("  3. Run migrations against the DIRECT (non-pooler) connection before deploying:"));
+  console.log(chalk29.gray("       DATABASE_URL=<direct-url> pnpm spfn db migrate"));
+  console.log(chalk29.gray("  4. Seed/RBAC provisioning runs once per deploy, not per cold start:"));
+  console.log(chalk29.gray("       pnpm spfn provision   (e.g. from the build step or a deploy hook)"));
+  console.log(chalk29.gray("  5. Jobs (config.jobs) are NOT processed on serverless \u2014 drain the queue from a"));
+  console.log(chalk29.gray("     scheduled endpoint (Vercel Cron) or run workers on an always-on target.\n"));
+}
+
+// src/commands/add.ts
 async function addPackage(packageName) {
+  if (packageName === "vercel") {
+    await addVercel();
+    return;
+  }
   if (!packageName.includes("/")) {
-    console.error(chalk29.red("\u274C Please specify full package name"));
-    console.log(chalk29.yellow("\n\u{1F4A1} Examples:"));
-    console.log(chalk29.gray("  pnpm spfn add @spfn/cms"));
-    console.log(chalk29.gray("  pnpm spfn add @mycompany/spfn-analytics"));
+    console.error(chalk30.red("\u274C Please specify full package name"));
+    console.log(chalk30.yellow("\n\u{1F4A1} Examples:"));
+    console.log(chalk30.gray("  pnpm spfn add @spfn/cms"));
+    console.log(chalk30.gray("  pnpm spfn add @mycompany/spfn-analytics"));
     process.exit(1);
   }
-  console.log(chalk29.blue(`
+  console.log(chalk30.blue(`
 \u{1F4E6} Setting up ${packageName}...
 `));
-  const pkgPath = join23(process.cwd(), "node_modules", ...packageName.split("/"));
-  const pkgJsonPath = join23(pkgPath, "package.json");
-  if (!existsSync25(pkgJsonPath)) {
+  const pkgPath = join25(process.cwd(), "node_modules", ...packageName.split("/"));
+  const pkgJsonPath = join25(pkgPath, "package.json");
+  if (!existsSync27(pkgJsonPath)) {
     const pm = detectPackageManager(process.cwd());
     const installSpinner = ora11("Installing package...").start();
     try {
-      await execa9(pm, ["add", packageName]);
+      await execa10(pm, ["add", packageName]);
       installSpinner.succeed("Package installed");
     } catch (error) {
       installSpinner.fail("Failed to install package");
-      console.error(chalk29.red(error instanceof Error ? error.message : "Unknown error"));
+      console.error(chalk30.red(error instanceof Error ? error.message : "Unknown error"));
       process.exit(1);
     }
   } else {
-    console.log(chalk29.gray("\u2713 Package already installed (using local version)\n"));
+    console.log(chalk30.gray("\u2713 Package already installed (using local version)\n"));
   }
-  if (!existsSync25(pkgJsonPath)) {
-    console.error(chalk29.red(`\u274C Package ${packageName} not found after installation`));
+  if (!existsSync27(pkgJsonPath)) {
+    console.error(chalk30.red(`\u274C Package ${packageName} not found after installation`));
     process.exit(1);
   }
   const pkgJson = JSON.parse(readFileSync11(pkgJsonPath, "utf-8"));
   if (pkgJson.spfn?.migrations) {
-    console.log(chalk29.blue(`
+    console.log(chalk30.blue(`
 \u{1F5C4}\uFE0F  Setting up database for ${packageName}...
 `));
     const { env: env9 } = await import("@spfn/core/config");
     if (!env9.DATABASE_URL) {
-      console.log(chalk29.yellow("\u26A0\uFE0F  DATABASE_URL not found \u2014 skipping database setup."));
-      console.log(chalk29.yellow(`   ${packageName} tables are created by its bundled migrations, not by schema push.`));
-      console.log(chalk29.cyan("   Once DATABASE_URL is set, run: pnpm spfn db migrate"));
-      console.log(chalk29.gray("   (check state anytime with: pnpm spfn db status)\n"));
+      console.log(chalk30.yellow("\u26A0\uFE0F  DATABASE_URL not found \u2014 skipping database setup."));
+      console.log(chalk30.yellow(`   ${packageName} tables are created by its bundled migrations, not by schema push.`));
+      console.log(chalk30.cyan("   Once DATABASE_URL is set, run: pnpm spfn db migrate"));
+      console.log(chalk30.gray("   (check state anytime with: pnpm spfn db status)\n"));
     } else {
       const { discoverFunctionMigrations: discoverFunctionMigrations2, loadFunctionMigrationPlans: loadFunctionMigrationPlans2, executeFunctionMigrations: executeFunctionMigrations2 } = await Promise.resolve().then(() => (init_function_migrations(), function_migrations_exports));
       const functions = discoverFunctionMigrations2(process.cwd());
@@ -4483,31 +4811,31 @@ async function addPackage(packageName) {
           spinner.succeed("Migrations applied");
         } catch (error) {
           spinner.fail("Failed to apply migrations");
-          console.error(chalk29.red(error instanceof Error ? error.message : "Unknown error"));
+          console.error(chalk30.red(error instanceof Error ? error.message : "Unknown error"));
           process.exit(1);
         }
       } else {
-        console.log(chalk29.gray("\u2139\uFE0F  No migrations found for this package"));
+        console.log(chalk30.gray("\u2139\uFE0F  No migrations found for this package"));
       }
     }
   } else {
-    console.log(chalk29.gray("\n\u2139\uFE0F  No database migrations to apply"));
+    console.log(chalk30.gray("\n\u2139\uFE0F  No database migrations to apply"));
   }
-  console.log(chalk29.green(`
+  console.log(chalk30.green(`
 \u2705 ${packageName} installed successfully!
 `));
   if (pkgJson.spfn?.setupMessage) {
-    console.log(chalk29.cyan("\u{1F4DA} Setup Guide:"));
+    console.log(chalk30.cyan("\u{1F4DA} Setup Guide:"));
     console.log(pkgJson.spfn.setupMessage);
     console.log();
   }
 }
-var addCommand = new Command10("add").description("Install and set up SPFN ecosystem packages").argument("<package>", "Package name (e.g., @spfn/cms, @mycompany/spfn-analytics)").action(addPackage);
+var addCommand = new Command11("add").description("Install and set up SPFN ecosystem packages, or scaffold a deploy target (vercel)").argument("<package>", 'Package name (e.g., @spfn/cms, @mycompany/spfn-analytics) or "vercel"').action(addPackage);
 
 // src/commands/env.ts
-import { Command as Command11 } from "commander";
-import chalk30 from "chalk";
-import { existsSync as existsSync26, readFileSync as readFileSync12, writeFileSync as writeFileSync16 } from "fs";
+import { Command as Command12 } from "commander";
+import chalk31 from "chalk";
+import { existsSync as existsSync28, readFileSync as readFileSync12, writeFileSync as writeFileSync17 } from "fs";
 import { resolve as resolve2 } from "path";
 import { parse as parse2 } from "dotenv";
 
@@ -4563,26 +4891,26 @@ function getEnvFilesForEnvironment(nodeEnv) {
 }
 function formatType(type) {
   const typeColors = {
-    string: chalk30.green,
-    number: chalk30.blue,
-    boolean: chalk30.yellow,
-    url: chalk30.cyan,
-    enum: chalk30.magenta,
-    json: chalk30.red
+    string: chalk31.green,
+    number: chalk31.blue,
+    boolean: chalk31.yellow,
+    url: chalk31.cyan,
+    enum: chalk31.magenta,
+    json: chalk31.red
   };
-  return (typeColors[type] || chalk30.white)(type);
+  return (typeColors[type] || chalk31.white)(type);
 }
 function formatDefault(value, type) {
   if (value === void 0) {
-    return chalk30.dim("(none)");
+    return chalk31.dim("(none)");
   }
   if (type === "string" || type === "url") {
-    return chalk30.green(`"${value}"`);
+    return chalk31.green(`"${value}"`);
   }
   if (type === "boolean") {
-    return value ? chalk30.green("true") : chalk30.red("false");
+    return value ? chalk31.green("true") : chalk31.red("false");
   }
-  return chalk30.cyan(String(value));
+  return chalk31.cyan(String(value));
 }
 async function listEnvVars(options) {
   const packageName = options.package || "@spfn/core";
@@ -4596,28 +4924,28 @@ async function listEnvVars(options) {
         acc[target].push([key, schema]);
         return acc;
       }, {});
-      console.log(chalk30.blue.bold(`
+      console.log(chalk31.blue.bold(`
 \u{1F4CB} Environment Variables by File (${packageName})
 `));
       for (const [file, vars] of Object.entries(grouped)) {
-        console.log(chalk30.bold.magenta(`
+        console.log(chalk31.bold.magenta(`
 ${file}`));
-        console.log(chalk30.dim("\u2500".repeat(50)));
+        console.log(chalk31.dim("\u2500".repeat(50)));
         for (const [key, schema] of vars) {
           printEnvVar(key, schema);
         }
       }
     } else {
-      console.log(chalk30.blue.bold(`
+      console.log(chalk31.blue.bold(`
 \u{1F4CB} Environment Variables (${packageName})
 `));
       for (const [key, schema] of allVars) {
         printEnvVar(key, schema, true);
       }
     }
-    console.log(chalk30.dim("\n\u{1F4A1} Tip: Use `spfn env init` to generate .env template files\n"));
+    console.log(chalk31.dim("\n\u{1F4A1} Tip: Use `spfn env init` to generate .env template files\n"));
   } catch (error) {
-    console.error(chalk30.red(`
+    console.error(chalk31.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4625,17 +4953,17 @@ ${file}`));
 }
 function printEnvVar(key, schema, showFile = false) {
   const typeStr = formatType(schema.type);
-  const requiredStr = schema.required || schema.default !== void 0 ? chalk30.red("[required]") : chalk30.dim("[optional]");
-  const sensitiveStr = schema.sensitive ? chalk30.yellow(" [sensitive]") : "";
-  const fileStr = showFile ? chalk30.dim(` \u2192 ${getTargetFile(schema)}`) : "";
-  console.log(`${chalk30.bold.cyan(key)} ${chalk30.dim("(")}${typeStr}${chalk30.dim(")")} ${requiredStr}${sensitiveStr}${fileStr}`);
-  console.log(`  ${chalk30.dim(schema.description)}`);
+  const requiredStr = schema.required || schema.default !== void 0 ? chalk31.red("[required]") : chalk31.dim("[optional]");
+  const sensitiveStr = schema.sensitive ? chalk31.yellow(" [sensitive]") : "";
+  const fileStr = showFile ? chalk31.dim(` \u2192 ${getTargetFile(schema)}`) : "";
+  console.log(`${chalk31.bold.cyan(key)} ${chalk31.dim("(")}${typeStr}${chalk31.dim(")")} ${requiredStr}${sensitiveStr}${fileStr}`);
+  console.log(`  ${chalk31.dim(schema.description)}`);
   if (schema.default !== void 0) {
-    console.log(`  ${chalk30.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
+    console.log(`  ${chalk31.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
   }
   if (schema.examples && schema.examples.length > 0) {
     const exampleStr = schema.examples.map((ex) => formatDefault(ex, schema.type)).join(", ");
-    console.log(`  ${chalk30.dim("Examples:")} ${exampleStr}`);
+    console.log(`  ${chalk31.dim("Examples:")} ${exampleStr}`);
   }
   console.log();
 }
@@ -4643,7 +4971,7 @@ async function showEnvStats(options) {
   const packageName = options.package || "@spfn/core";
   try {
     const envSchema = await loadEnvSchema(packageName);
-    console.log(chalk30.blue.bold(`
+    console.log(chalk31.blue.bold(`
 \u{1F4CA} Environment Variable Statistics (${packageName})
 `));
     const allVars = Object.entries(envSchema);
@@ -4665,24 +4993,24 @@ async function showEnvStats(options) {
       acc[file] = (acc[file] || 0) + 1;
       return acc;
     }, {});
-    console.log(`${chalk30.bold("Total variables:")} ${chalk30.cyan(allVars.length)}`);
-    console.log(`${chalk30.bold("Required:")} ${chalk30.red(required.length)}`);
-    console.log(`${chalk30.bold("Optional:")} ${chalk30.dim(optional.length)}`);
-    console.log(`${chalk30.bold("Sensitive:")} ${chalk30.yellow(sensitive.length)}`);
-    console.log(chalk30.bold("\nBy Target:"));
-    console.log(`  ${chalk30.blue("Next.js accessible:")} ${chalk30.cyan(nextjsVars.length)}`);
-    console.log(`  ${chalk30.magenta("SPFN server only:")} ${chalk30.cyan(serverOnlyVars.length)}`);
-    console.log(chalk30.bold("\nBy File:"));
+    console.log(`${chalk31.bold("Total variables:")} ${chalk31.cyan(allVars.length)}`);
+    console.log(`${chalk31.bold("Required:")} ${chalk31.red(required.length)}`);
+    console.log(`${chalk31.bold("Optional:")} ${chalk31.dim(optional.length)}`);
+    console.log(`${chalk31.bold("Sensitive:")} ${chalk31.yellow(sensitive.length)}`);
+    console.log(chalk31.bold("\nBy Target:"));
+    console.log(`  ${chalk31.blue("Next.js accessible:")} ${chalk31.cyan(nextjsVars.length)}`);
+    console.log(`  ${chalk31.magenta("SPFN server only:")} ${chalk31.cyan(serverOnlyVars.length)}`);
+    console.log(chalk31.bold("\nBy File:"));
     for (const [file, count] of Object.entries(fileCount)) {
-      console.log(`  ${chalk30.dim(file)}: ${chalk30.cyan(count)}`);
+      console.log(`  ${chalk31.dim(file)}: ${chalk31.cyan(count)}`);
     }
-    console.log(chalk30.bold("\nBy Type:"));
+    console.log(chalk31.bold("\nBy Type:"));
     for (const [type, count] of Object.entries(typeCount)) {
-      console.log(`  ${formatType(type)}: ${chalk30.cyan(count)}`);
+      console.log(`  ${formatType(type)}: ${chalk31.cyan(count)}`);
     }
     console.log();
   } catch (error) {
-    console.error(chalk30.red(`
+    console.error(chalk31.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4702,40 +5030,40 @@ async function searchEnvVars(query, options) {
       }
     }
     if (results.length === 0) {
-      console.log(chalk30.yellow(`
+      console.log(chalk31.yellow(`
 \u26A0\uFE0F  No environment variables found matching "${query}"
 `));
       return;
     }
-    console.log(chalk30.blue.bold(`
+    console.log(chalk31.blue.bold(`
 \u{1F50D} Found ${results.length} environment variable(s) matching "${query}"
 `));
     for (const [key, schema] of results) {
       const typeStr = formatType(schema.type);
-      const requiredStr = schema.required || schema.default !== void 0 ? chalk30.red("[required]") : chalk30.dim("[optional]");
-      console.log(`${chalk30.bold.cyan(key)} ${chalk30.dim("(")}${typeStr}${chalk30.dim(")")} ${requiredStr}`);
-      console.log(`  ${chalk30.dim(schema.description)}`);
+      const requiredStr = schema.required || schema.default !== void 0 ? chalk31.red("[required]") : chalk31.dim("[optional]");
+      console.log(`${chalk31.bold.cyan(key)} ${chalk31.dim("(")}${typeStr}${chalk31.dim(")")} ${requiredStr}`);
+      console.log(`  ${chalk31.dim(schema.description)}`);
       if (schema.default !== void 0) {
-        console.log(`  ${chalk30.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
+        console.log(`  ${chalk31.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
       }
       console.log();
     }
   } catch (error) {
-    console.error(chalk30.red(`
+    console.error(chalk31.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
   }
 }
-var envCommand = new Command11("env").description("Manage environment variables");
+var envCommand = new Command12("env").description("Manage environment variables");
 envCommand.command("list").description("List all environment variables from schema").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").option("-g, --group", "Group variables by target file").action(listEnvVars);
 envCommand.command("stats").description("Show environment variable statistics").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").action(showEnvStats);
 envCommand.command("search").description("Search environment variables").argument("<query>", "Search query (matches key or description)").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").action(searchEnvVars);
 function validateEnvOption(envValue) {
   if (!VALID_ENVS.includes(envValue)) {
-    console.error(chalk30.red(`
+    console.error(chalk31.red(`
 \u274C Invalid environment: "${envValue}"`));
-    console.log(chalk30.dim(`   Valid values: ${VALID_ENVS.join(", ")}
+    console.log(chalk31.dim(`   Valid values: ${VALID_ENVS.join(", ")}
 `));
     process.exit(1);
   }
@@ -4756,8 +5084,8 @@ async function initEnvFiles(options) {
       return acc;
     }, {});
     if (targetEnv) {
-      console.log(chalk30.blue.bold(`
-\u{1F680} Generating .env template files for ${chalk30.cyan(targetEnv)} environment
+      console.log(chalk31.blue.bold(`
+\u{1F680} Generating .env template files for ${chalk31.cyan(targetEnv)} environment
 `));
       const envSpecificFiles = {};
       const committedVars = allVars.filter(([_, schema]) => !schema.sensitive);
@@ -4773,24 +5101,24 @@ async function initEnvFiles(options) {
         writeEnvTemplate(cwd, file, vars, options.force ?? false);
       }
     } else {
-      console.log(chalk30.blue.bold(`
+      console.log(chalk31.blue.bold(`
 \u{1F680} Generating .env template files
 `));
       for (const [file, vars] of Object.entries(grouped)) {
         writeEnvTemplate(cwd, file, vars, options.force ?? false);
       }
     }
-    console.log(chalk30.dim("\n\u{1F4A1} Copy .example files to create your actual .env files:"));
-    console.log(chalk30.dim("   cp .env.example .env"));
-    console.log(chalk30.dim("   cp .env.local.example .env.local"));
-    console.log(chalk30.dim("   cp .env.server.example .env.server"));
+    console.log(chalk31.dim("\n\u{1F4A1} Copy .example files to create your actual .env files:"));
+    console.log(chalk31.dim("   cp .env.example .env"));
+    console.log(chalk31.dim("   cp .env.local.example .env.local"));
+    console.log(chalk31.dim("   cp .env.server.example .env.server"));
     if (targetEnv) {
-      console.log(chalk30.dim(`   cp .env.${targetEnv}.example .env.${targetEnv}`));
-      console.log(chalk30.dim(`   cp .env.${targetEnv}.local.example .env.${targetEnv}.local`));
+      console.log(chalk31.dim(`   cp .env.${targetEnv}.example .env.${targetEnv}`));
+      console.log(chalk31.dim(`   cp .env.${targetEnv}.local.example .env.${targetEnv}.local`));
     }
     console.log("");
   } catch (error) {
-    console.error(chalk30.red(`
+    console.error(chalk31.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4798,12 +5126,12 @@ async function initEnvFiles(options) {
 }
 function writeEnvTemplate(cwd, file, vars, force) {
   const filePath = resolve2(cwd, file);
-  if (existsSync26(filePath) && !force) {
-    console.log(chalk30.yellow(`  \u23ED\uFE0F  ${file} already exists (use --force to overwrite)`));
+  if (existsSync28(filePath) && !force) {
+    console.log(chalk31.yellow(`  \u23ED\uFE0F  ${file} already exists (use --force to overwrite)`));
     return;
   }
-  writeFileSync16(filePath, generateEnvFileContent(vars), "utf-8");
-  console.log(chalk30.green(`  \u2705 ${file} (${vars.length} variables)`));
+  writeFileSync17(filePath, generateEnvFileContent(vars), "utf-8");
+  console.log(chalk31.green(`  \u2705 ${file} (${vars.length} variables)`));
 }
 function generateEnvFileContent(vars) {
   const lines = [
@@ -4838,7 +5166,7 @@ async function checkEnvFiles(options) {
     const envSchema = await loadEnvSchema(packageName);
     const allVars = Object.entries(envSchema);
     const envLabel = targetEnv ? ` (${targetEnv})` : "";
-    console.log(chalk30.blue.bold(`
+    console.log(chalk31.blue.bold(`
 \u{1F50D} Checking .env files against schema${envLabel}
 `));
     const filesToCheck = targetEnv ? getEnvFilesForEnvironment(targetEnv) : [...BASE_ENV_FILES.nextjs, ...BASE_ENV_FILES.server];
@@ -4847,7 +5175,7 @@ async function checkEnvFiles(options) {
     const warnings = [];
     for (const file of filesToCheck) {
       const filePath = resolve2(cwd, file);
-      if (!existsSync26(filePath)) {
+      if (!existsSync28(filePath)) {
         continue;
       }
       const content = readFileSync12(filePath, "utf-8");
@@ -4855,7 +5183,7 @@ async function checkEnvFiles(options) {
       for (const [key, value] of Object.entries(parsed)) {
         loadedEnv[key] = { value: value || "", file };
       }
-      console.log(chalk30.dim(`  \u{1F4C4} ${file} loaded`));
+      console.log(chalk31.dim(`  \u{1F4C4} ${file} loaded`));
     }
     console.log("");
     for (const [key, schema] of allVars) {
@@ -4863,7 +5191,7 @@ async function checkEnvFiles(options) {
       const found = loadedEnv[key];
       if (!found) {
         if (schema.required && schema.default === void 0) {
-          issues.push(`${chalk30.red("\u2717")} ${chalk30.cyan(key)} is required but not found in any .env file`);
+          issues.push(`${chalk31.red("\u2717")} ${chalk31.cyan(key)} is required but not found in any .env file`);
         }
         continue;
       }
@@ -4873,11 +5201,11 @@ async function checkEnvFiles(options) {
       if (!shouldBeNextjs && isNextjsFile && !isServerFile) {
         if (schema.sensitive) {
           issues.push(
-            `${chalk30.red("\u2717")} ${chalk30.cyan(key)} is sensitive and should be in ${chalk30.magenta(expectedFile)}, but found in ${chalk30.yellow(found.file)} (security risk!)`
+            `${chalk31.red("\u2717")} ${chalk31.cyan(key)} is sensitive and should be in ${chalk31.magenta(expectedFile)}, but found in ${chalk31.yellow(found.file)} (security risk!)`
           );
         } else {
           warnings.push(
-            `${chalk30.yellow("\u26A0")} ${chalk30.cyan(key)} should be in ${chalk30.magenta(expectedFile)}, but found in ${chalk30.dim(found.file)}`
+            `${chalk31.yellow("\u26A0")} ${chalk31.cyan(key)} should be in ${chalk31.magenta(expectedFile)}, but found in ${chalk31.dim(found.file)}`
           );
         }
       }
@@ -4885,34 +5213,34 @@ async function checkEnvFiles(options) {
     for (const [key, { file }] of Object.entries(loadedEnv)) {
       const inSchema = allVars.some(([k]) => k === key);
       if (!inSchema) {
-        warnings.push(`${chalk30.yellow("\u26A0")} ${chalk30.cyan(key)} in ${chalk30.dim(file)} is not in schema`);
+        warnings.push(`${chalk31.yellow("\u26A0")} ${chalk31.cyan(key)} in ${chalk31.dim(file)} is not in schema`);
       }
     }
     if (issues.length > 0) {
-      console.log(chalk30.red.bold("Issues:"));
+      console.log(chalk31.red.bold("Issues:"));
       for (const issue of issues) {
         console.log(`  ${issue}`);
       }
       console.log("");
     }
     if (warnings.length > 0) {
-      console.log(chalk30.yellow.bold("Warnings:"));
+      console.log(chalk31.yellow.bold("Warnings:"));
       for (const warning of warnings) {
         console.log(`  ${warning}`);
       }
       console.log("");
     }
     if (issues.length === 0 && warnings.length === 0) {
-      console.log(chalk30.green("\u2705 All environment variables are correctly configured!\n"));
+      console.log(chalk31.green("\u2705 All environment variables are correctly configured!\n"));
     } else {
-      console.log(chalk30.dim(`Found ${issues.length} issue(s) and ${warnings.length} warning(s)
+      console.log(chalk31.dim(`Found ${issues.length} issue(s) and ${warnings.length} warning(s)
 `));
       if (issues.length > 0) {
         process.exit(1);
       }
     }
   } catch (error) {
-    console.error(chalk30.red(`
+    console.error(chalk31.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4926,15 +5254,15 @@ async function validateEnvVars(options) {
   if (targetEnv) {
     const { loadEnv: loadEnv10 } = await import("@spfn/core/env/loader");
     const result = loadEnv10({ nodeEnv: targetEnv });
-    console.log(chalk30.blue.bold(`
-\u{1F50D} Validating environment variables for ${chalk30.cyan(targetEnv)}
+    console.log(chalk31.blue.bold(`
+\u{1F50D} Validating environment variables for ${chalk31.cyan(targetEnv)}
 `));
     if (result.loadedFiles.length > 0) {
-      console.log(chalk30.dim(`  Loaded: ${result.loadedFiles.join(", ")}`));
+      console.log(chalk31.dim(`  Loaded: ${result.loadedFiles.join(", ")}`));
     }
     console.log("");
   } else {
-    console.log(chalk30.blue.bold(`
+    console.log(chalk31.blue.bold(`
 \u{1F50D} Validating environment variables
 `));
   }
@@ -4942,7 +5270,7 @@ async function validateEnvVars(options) {
   const allWarnings = [];
   for (const packageName of packages) {
     try {
-      console.log(chalk30.dim(`  \u{1F4E6} ${packageName}`));
+      console.log(chalk31.dim(`  \u{1F4E6} ${packageName}`));
       const envSchema = await loadEnvSchema(packageName);
       const { createEnvRegistry } = await import("@spfn/core/env");
       const registry = createEnvRegistry(envSchema);
@@ -4955,10 +5283,10 @@ async function validateEnvVars(options) {
       }
     } catch (error) {
       if (error instanceof Error && error.message.includes("does not export envSchema")) {
-        console.log(chalk30.dim(`    \u23ED\uFE0F  No envSchema exported, skipping`));
+        console.log(chalk31.dim(`    \u23ED\uFE0F  No envSchema exported, skipping`));
         continue;
       }
-      console.error(chalk30.red(`    \u274C Failed to load: ${error instanceof Error ? error.message : String(error)}`));
+      console.error(chalk31.red(`    \u274C Failed to load: ${error instanceof Error ? error.message : String(error)}`));
       if (options.strict) {
         process.exit(1);
       }
@@ -4966,32 +5294,32 @@ async function validateEnvVars(options) {
   }
   console.log("");
   if (allErrors.length > 0) {
-    console.log(chalk30.red.bold(`\u274C Validation Errors (${allErrors.length}):
+    console.log(chalk31.red.bold(`\u274C Validation Errors (${allErrors.length}):
 `));
     for (const error of allErrors) {
-      console.log(`  ${chalk30.red("\u2717")} ${chalk30.cyan(error.key)}`);
-      console.log(`    ${chalk30.dim(error.message)}`);
-      console.log(`    ${chalk30.dim(`from ${error.package}`)}`);
+      console.log(`  ${chalk31.red("\u2717")} ${chalk31.cyan(error.key)}`);
+      console.log(`    ${chalk31.dim(error.message)}`);
+      console.log(`    ${chalk31.dim(`from ${error.package}`)}`);
       console.log("");
     }
   }
   if (allWarnings.length > 0) {
-    console.log(chalk30.yellow.bold(`\u26A0\uFE0F  Warnings (${allWarnings.length}):
+    console.log(chalk31.yellow.bold(`\u26A0\uFE0F  Warnings (${allWarnings.length}):
 `));
     for (const warning of allWarnings) {
-      console.log(`  ${chalk30.yellow("\u26A0")} ${chalk30.cyan(warning.key)}`);
-      console.log(`    ${chalk30.dim(warning.message)}`);
+      console.log(`  ${chalk31.yellow("\u26A0")} ${chalk31.cyan(warning.key)}`);
+      console.log(`    ${chalk31.dim(warning.message)}`);
       console.log("");
     }
   }
   if (allErrors.length === 0 && allWarnings.length === 0) {
-    console.log(chalk30.green.bold("\u2705 All environment variables are valid!\n"));
+    console.log(chalk31.green.bold("\u2705 All environment variables are valid!\n"));
   } else if (allErrors.length === 0) {
-    console.log(chalk30.green("\u2705 No errors found."));
-    console.log(chalk30.yellow(`\u26A0\uFE0F  ${allWarnings.length} warning(s) found.
+    console.log(chalk31.green("\u2705 No errors found."));
+    console.log(chalk31.yellow(`\u26A0\uFE0F  ${allWarnings.length} warning(s) found.
 `));
   } else {
-    console.log(chalk30.red(`
+    console.log(chalk31.red(`
 \u274C Validation failed with ${allErrors.length} error(s)
 `));
     process.exit(1);
@@ -5000,12 +5328,12 @@ async function validateEnvVars(options) {
 envCommand.command("validate").description("Validate environment variables against schema (for CI/CD)").option("-p, --packages <packages...>", "Packages to validate", ["@spfn/core"]).option("-e, --env <environment>", "Load env files for specific environment before validating").option("-s, --strict", "Exit on any error (including load failures)").action(validateEnvVars);
 
 // src/commands/secret/index.ts
-import { Command as Command12 } from "commander";
+import { Command as Command13 } from "commander";
 
 // src/commands/secret/set.ts
 init_logger();
-import prompts8 from "prompts";
-import chalk31 from "chalk";
+import prompts9 from "prompts";
+import chalk32 from "chalk";
 
 // src/commands/secret/options.ts
 init_logger();
@@ -5020,34 +5348,34 @@ function resolveEnv(env9) {
 
 // src/commands/secret/store-value.ts
 init_logger();
-import { join as join25 } from "path";
+import { join as join27 } from "path";
 init_env_file();
 
 // src/utils/sops.ts
-import { execa as execa10 } from "execa";
-import { existsSync as existsSync27, mkdirSync as mkdirSync3, writeFileSync as writeFileSync17 } from "fs";
-import { dirname as dirname3 } from "path";
+import { execa as execa11 } from "execa";
+import { existsSync as existsSync29, mkdirSync as mkdirSync5, writeFileSync as writeFileSync18 } from "fs";
+import { dirname as dirname4 } from "path";
 async function ensureSopsInstalled() {
   try {
-    await execa10("sops", ["--version"]);
+    await execa11("sops", ["--version"]);
   } catch {
     throw new Error("`sops` not found on PATH. Install it: https://github.com/getsops/sops");
   }
 }
 async function sopsDecrypt(absFile) {
-  if (!existsSync27(absFile)) {
+  if (!existsSync29(absFile)) {
     return {};
   }
-  const { stdout } = await execa10("sops", ["--decrypt", "--output-type", "json", absFile]);
+  const { stdout } = await execa11("sops", ["--decrypt", "--output-type", "json", absFile]);
   return JSON.parse(stdout);
 }
 async function sopsSetValue(absFile, relFile, key, value) {
-  if (existsSync27(absFile)) {
-    await execa10("sops", ["set", absFile, `["${key}"]`, JSON.stringify(value)]);
+  if (existsSync29(absFile)) {
+    await execa11("sops", ["set", absFile, `["${key}"]`, JSON.stringify(value)]);
     return;
   }
-  mkdirSync3(dirname3(absFile), { recursive: true });
-  const { stdout } = await execa10(
+  mkdirSync5(dirname4(absFile), { recursive: true });
+  const { stdout } = await execa11(
     "sops",
     [
       "--encrypt",
@@ -5061,27 +5389,27 @@ async function sopsSetValue(absFile, relFile, key, value) {
     ],
     { input: JSON.stringify({ [key]: value }) }
   );
-  writeFileSync17(absFile, stdout);
+  writeFileSync18(absFile, stdout);
 }
 async function sopsUpdateKeys(absFile) {
-  await execa10("sops", ["updatekeys", "-y", absFile]);
+  await execa11("sops", ["updatekeys", "-y", absFile]);
 }
 
 // src/utils/secret-config.ts
-import { existsSync as existsSync28, readdirSync as readdirSync3 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync30, readdirSync as readdirSync3 } from "fs";
+import { join as join26 } from "path";
 var SECRETS_DIR = "secrets";
 function getSopsFile(cwd, env9) {
   const relFile = `${SECRETS_DIR}/${env9}.enc.json`;
-  return { absFile: join24(cwd, relFile), relFile };
+  return { absFile: join26(cwd, relFile), relFile };
 }
 function findUp(cwd, filename, maxDepth = 6) {
   let dir = cwd;
   for (let depth = 0; depth < maxDepth; depth++) {
-    if (existsSync28(join24(dir, filename))) {
+    if (existsSync30(join26(dir, filename))) {
       return dir;
     }
-    const parent = join24(dir, "..");
+    const parent = join26(dir, "..");
     if (parent === dir) {
       break;
     }
@@ -5091,17 +5419,17 @@ function findUp(cwd, filename, maxDepth = 6) {
 }
 function findSopsConfig(cwd) {
   const dir = findUp(cwd, ".sops.yaml");
-  return dir ? join24(dir, ".sops.yaml") : null;
+  return dir ? join26(dir, ".sops.yaml") : null;
 }
 function hasSopsConfig(cwd) {
   return findSopsConfig(cwd) !== null;
 }
 function listSopsFiles(cwd) {
-  const dir = join24(cwd, SECRETS_DIR);
-  if (!existsSync28(dir)) {
+  const dir = join26(cwd, SECRETS_DIR);
+  if (!existsSync30(dir)) {
     return [];
   }
-  return readdirSync3(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join24(dir, name));
+  return readdirSync3(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join26(dir, name));
 }
 
 // src/commands/secret/store-value.ts
@@ -5130,7 +5458,7 @@ async function storeSecret(cwd, env9, key, value) {
       );
     }
     await store.set(keychainName(key), value);
-    const serverEnvPath = join25(cwd, ".env.server");
+    const serverEnvPath = join27(cwd, ".env.server");
     const result = upsertEnvVar(serverEnvPath, key, keychainRef(key));
     restrictEnvFilePerms(serverEnvPath);
     ensureGitignored(cwd, [{ pattern: ".env.server", comment: "spfn server env (secrets)" }]);
@@ -5158,10 +5486,10 @@ async function secretSet(key, options) {
     process.exit(1);
   }
   await warnIfNotSecret(pkg, resolvedKey);
-  const { value } = await prompts8({
+  const { value } = await prompts9({
     type: "password",
     name: "value",
-    message: `Value for ${chalk31.cyan(resolvedKey)} (${env9})`
+    message: `Value for ${chalk32.cyan(resolvedKey)} (${env9})`
   });
   if (!value) {
     logger.warn("Cancelled \u2014 no value entered.");
@@ -5185,7 +5513,7 @@ async function pickSecretKey(pkg) {
   if (entries.length === 0) {
     return void 0;
   }
-  const { key } = await prompts8({
+  const { key } = await prompts9({
     type: "select",
     name: "key",
     message: "Which secret?",
@@ -5210,7 +5538,7 @@ async function warnIfNotSecret(pkg, key) {
 
 // src/commands/secret/list.ts
 init_logger();
-import chalk32 from "chalk";
+import chalk33 from "chalk";
 async function secretList(options) {
   const env9 = resolveEnv(options.env);
   const pkg = options.package ?? "@spfn/core";
@@ -5226,12 +5554,12 @@ async function secretList(options) {
     return;
   }
   const present = await loadPresence(env9, entries);
-  console.log(chalk32.blue.bold(`
+  console.log(chalk33.blue.bold(`
 \u{1F511} Secrets (${pkg}) \u2014 ${env9}
 `));
   for (const entry of entries) {
     const status = statusOf(entry, present.has(entry.key));
-    console.log(`  ${badge(status)} ${chalk32.cyan(entry.key)}${entry.generate ? chalk32.dim(" (generatable)") : ""}`);
+    console.log(`  ${badge(status)} ${chalk33.cyan(entry.key)}${entry.generate ? chalk33.dim(" (generatable)") : ""}`);
   }
   console.log();
 }
@@ -5264,17 +5592,17 @@ function statusOf(entry, present) {
 function badge(status) {
   switch (status) {
     case "set":
-      return chalk32.green("\u25CF");
+      return chalk33.green("\u25CF");
     case "missing":
-      return chalk32.yellow("\u25CB");
+      return chalk33.yellow("\u25CB");
     case "awaiting-input":
-      return chalk32.red("\u25CB");
+      return chalk33.red("\u25CB");
   }
 }
 
 // src/commands/secret/generate.ts
 init_logger();
-import chalk33 from "chalk";
+import chalk34 from "chalk";
 async function secretGenerate(key, options) {
   const env9 = resolveEnv(options.env);
   const pkg = options.package ?? "@spfn/core";
@@ -5312,7 +5640,7 @@ function requireGeneratable(schema, key) {
     process.exit(1);
   }
   if (!entry.generate) {
-    logger.error(`${chalk33.cyan(key)} has no generate strategy \u2014 it's an external value. Use \`spfn secret set ${key}\`.`);
+    logger.error(`${chalk34.cyan(key)} has no generate strategy \u2014 it's an external value. Use \`spfn secret set ${key}\`.`);
     process.exit(1);
   }
   return entry;
@@ -5320,7 +5648,7 @@ function requireGeneratable(schema, key) {
 
 // src/commands/secret/rotate.ts
 init_logger();
-import chalk34 from "chalk";
+import chalk35 from "chalk";
 async function secretRotate(key, options) {
   const env9 = resolveEnv(options.env);
   const pkg = options.package ?? "@spfn/core";
@@ -5346,7 +5674,7 @@ async function secretRotate(key, options) {
     }
   }
   for (const entry of external) {
-    logger.warn(`${chalk34.cyan(entry.key)} is external \u2014 reissue it at the provider, then \`spfn secret set ${entry.key} --env ${env9}\`.`);
+    logger.warn(`${chalk35.cyan(entry.key)} is external \u2014 reissue it at the provider, then \`spfn secret set ${entry.key} --env ${env9}\`.`);
   }
   if (generatable.length > 0) {
     logger.info("Rotation updates the source only \u2014 commit and deploy to apply.");
@@ -5367,17 +5695,17 @@ function requireEntry(schema, key) {
 
 // src/commands/secret/keygen.ts
 init_logger();
-import { execa as execa11 } from "execa";
-import { existsSync as existsSync29, mkdirSync as mkdirSync4 } from "fs";
+import { execa as execa12 } from "execa";
+import { existsSync as existsSync31, mkdirSync as mkdirSync6 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname4, join as join26 } from "path";
-import chalk35 from "chalk";
+import { dirname as dirname5, join as join28 } from "path";
+import chalk36 from "chalk";
 function ageKeyFile() {
-  return process.env.SOPS_AGE_KEY_FILE ?? join26(homedir(), ".config", "sops", "age", "keys.txt");
+  return process.env.SOPS_AGE_KEY_FILE ?? join28(homedir(), ".config", "sops", "age", "keys.txt");
 }
 async function ensureAgeInstalled() {
   try {
-    await execa11("age-keygen", ["--version"]);
+    await execa12("age-keygen", ["--version"]);
   } catch {
     throw new Error("`age-keygen` not found on PATH. Install age: https://github.com/FiloSottile/age");
   }
@@ -5393,14 +5721,14 @@ async function secretKeygen() {
     process.exit(1);
   }
   const keyFile = ageKeyFile();
-  if (existsSync29(keyFile)) {
-    const { stdout } = await execa11("age-keygen", ["-y", keyFile]);
+  if (existsSync31(keyFile)) {
+    const { stdout } = await execa12("age-keygen", ["-y", keyFile]);
     logger.warn(`age key file already exists: ${keyFile}`);
     printPublicKeys(publicKeys(stdout));
     return;
   }
-  mkdirSync4(dirname4(keyFile), { recursive: true });
-  const { stderr } = await execa11("age-keygen", ["-o", keyFile]);
+  mkdirSync6(dirname5(keyFile), { recursive: true });
+  const { stderr } = await execa12("age-keygen", ["-o", keyFile]);
   logger.success(`Created age key: ${keyFile}`);
   printPublicKeys(publicKeys(stderr));
 }
@@ -5409,27 +5737,27 @@ function printPublicKeys(keys) {
     logger.warn("Could not read the public key \u2014 run `age-keygen -y <file>` manually.");
     return;
   }
-  console.log(chalk35.bold("\nPublic key(s):"));
+  console.log(chalk36.bold("\nPublic key(s):"));
   for (const key of keys) {
-    console.log(`  ${chalk35.cyan(key)}`);
+    console.log(`  ${chalk36.cyan(key)}`);
   }
-  console.log(chalk35.dim("\nRegister it as a recipient:"));
-  console.log(chalk35.dim(`  spfn secret recipients add ${keys[0]}
+  console.log(chalk36.dim("\nRegister it as a recipient:"));
+  console.log(chalk36.dim(`  spfn secret recipients add ${keys[0]}
 `));
 }
 
 // src/commands/secret/recipients.ts
 init_logger();
-import { existsSync as existsSync30, readFileSync as readFileSync13, writeFileSync as writeFileSync18 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync32, readFileSync as readFileSync13, writeFileSync as writeFileSync19 } from "fs";
+import { join as join29 } from "path";
 import { parse as parse3, stringify } from "yaml";
-import chalk36 from "chalk";
+import chalk37 from "chalk";
 var SOPS_CONFIG = ".sops.yaml";
 var DEFAULT_PATH_REGEX = "secrets/.*\\.enc\\.json$";
 var AGE_RECIPIENT = /^age1[0-9a-z]+$/;
 async function secretRecipients(action, key, _options) {
   const cwd = process.cwd();
-  const configPath = join27(cwd, SOPS_CONFIG);
+  const configPath = join29(cwd, SOPS_CONFIG);
   if (action === "list") {
     listRecipients(configPath);
     return;
@@ -5456,30 +5784,30 @@ async function secretRecipients(action, key, _options) {
     logger.warn("Removing a recipient does not revoke values they already decrypted \u2014 rotate those values.");
   }
   rule.age = [...recipients].join(",");
-  writeFileSync18(configPath, stringify(config));
+  writeFileSync19(configPath, stringify(config));
   logger.success(`${action === "add" ? "Added" : "Removed"} recipient; updated ${SOPS_CONFIG}.`);
   await reencrypt(cwd);
 }
 function listRecipients(configPath) {
-  if (!existsSync30(configPath)) {
+  if (!existsSync32(configPath)) {
     logger.info(`No ${SOPS_CONFIG} found.`);
     return;
   }
   const config = loadConfig(configPath);
   const rules = config.creation_rules ?? [];
-  console.log(chalk36.blue.bold(`
+  console.log(chalk37.blue.bold(`
 \u{1F465} Recipients (${SOPS_CONFIG})
 `));
   for (const rule of rules) {
-    console.log(chalk36.dim(`  ${rule.path_regex ?? "(any path)"}`));
+    console.log(chalk37.dim(`  ${rule.path_regex ?? "(any path)"}`));
     for (const recipient of parseRecipients(rule.age)) {
-      console.log(`    ${chalk36.cyan(recipient)}`);
+      console.log(`    ${chalk37.cyan(recipient)}`);
     }
   }
   console.log();
 }
 function loadConfig(configPath) {
-  if (!existsSync30(configPath)) {
+  if (!existsSync32(configPath)) {
     return { creation_rules: [] };
   }
   return parse3(readFileSync13(configPath, "utf-8")) ?? { creation_rules: [] };
@@ -5514,8 +5842,8 @@ async function reencrypt(cwd) {
 
 // src/commands/secret/check.ts
 init_logger();
-import { join as join28 } from "path";
-import chalk37 from "chalk";
+import { join as join30 } from "path";
+import chalk38 from "chalk";
 init_env_file();
 var COMMITTED_FILES = [".env", ".env.example"];
 var PLACEHOLDER = /(your-|changeme|placeholder|example|<.*>)/i;
@@ -5533,35 +5861,35 @@ async function secretCheck(options) {
   const issues = [];
   const warnings = [];
   for (const file of COMMITTED_FILES) {
-    const parsed = parseEnvFile(join28(cwd, file));
+    const parsed = parseEnvFile(join30(cwd, file));
     for (const [key, value] of Object.entries(parsed)) {
       if (secretKeys.has(key) && value.length > 0 && !PLACEHOLDER.test(value)) {
-        issues.push(`${chalk37.cyan(key)} has a real value in committed ${chalk37.yellow(file)} \u2014 move it to the keychain/SOPS.`);
+        issues.push(`${chalk38.cyan(key)} has a real value in committed ${chalk38.yellow(file)} \u2014 move it to the keychain/SOPS.`);
       }
     }
   }
-  const serverEnv = parseEnvFile(join28(cwd, ".env.server"));
+  const serverEnv = parseEnvFile(join30(cwd, ".env.server"));
   for (const key of secretKeys) {
     const value = serverEnv[key];
     if (value && !value.startsWith(KEYCHAIN_REF_PREFIX)) {
-      warnings.push(`${chalk37.cyan(key)} is plaintext in .env.server \u2014 run \`spfn secret set ${key}\` to move it to the keychain.`);
+      warnings.push(`${chalk38.cyan(key)} is plaintext in .env.server \u2014 run \`spfn secret set ${key}\` to move it to the keychain.`);
     }
   }
   report(issues, warnings, cwd);
 }
 function report(issues, warnings, cwd) {
-  console.log(chalk37.blue.bold("\n\u{1F50D} Secret hygiene check\n"));
+  console.log(chalk38.blue.bold("\n\u{1F50D} Secret hygiene check\n"));
   for (const issue of issues) {
-    console.log(`  ${chalk37.red("\u2717")} ${issue}`);
+    console.log(`  ${chalk38.red("\u2717")} ${issue}`);
   }
   for (const warning of warnings) {
-    console.log(`  ${chalk37.yellow("\u26A0")} ${warning}`);
+    console.log(`  ${chalk38.yellow("\u26A0")} ${warning}`);
   }
   if (!hasSopsConfig(cwd)) {
-    console.log(`  ${chalk37.dim("\u2139 no .sops.yaml \u2014 prod secrets need a backend (spfn secret keygen, or add a KMS rule)")}`);
+    console.log(`  ${chalk38.dim("\u2139 no .sops.yaml \u2014 prod secrets need a backend (spfn secret keygen, or add a KMS rule)")}`);
   }
   if (issues.length === 0 && warnings.length === 0) {
-    console.log(chalk37.green("  \u2713 No plaintext secret leaks found."));
+    console.log(chalk38.green("  \u2713 No plaintext secret leaks found."));
   }
   console.log();
   if (issues.length > 0) {
@@ -5572,7 +5900,7 @@ function report(issues, warnings, cwd) {
 // src/commands/secret/index.ts
 var ENV_OPTION = ["-e, --env <env>", "Target environment (local | development | staging | production)", "local"];
 var PKG_OPTION = ["-p, --package <package>", "Package whose env schema to read", "@spfn/core"];
-var secretCommand = new Command12("secret").description("Manage secrets: keychain locally, SOPS (age / GCP KMS / AWS KMS) for deployed environments");
+var secretCommand = new Command13("secret").description("Manage secrets: keychain locally, SOPS (age / GCP KMS / AWS KMS) for deployed environments");
 secretCommand.command("set [key]").description("Store a secret value (prompts for the value, masked)").option(...ENV_OPTION).option(...PKG_OPTION).action(secretSet);
 secretCommand.command("list").description("List declared secrets and their status (never prints values)").option(...ENV_OPTION).option(...PKG_OPTION).action(secretList);
 secretCommand.command("generate [key]").description("Generate value(s) for schema secrets that declare a generate strategy").option("-a, --all", "Generate every generatable secret").option(...ENV_OPTION).option(...PKG_OPTION).action(secretGenerate);
@@ -5583,7 +5911,7 @@ secretCommand.command("check").description("Static hygiene lint \u2014 flag plai
 
 // src/index.ts
 init_version();
-var program = new Command13();
+var program = new Command14();
 program.name("spfn").description("SPFN CLI - The Missing Backend for Next.js").version(getCliVersion());
 program.addCommand(createCommand);
 program.addCommand(initCommand);
@@ -5591,6 +5919,7 @@ program.addCommand(addCommand);
 program.addCommand(devCommand);
 program.addCommand(buildCommand);
 program.addCommand(startCommand);
+program.addCommand(provisionCommand);
 program.addCommand(codegenCommand);
 program.addCommand(keyCommand);
 program.addCommand(setupCommand);