spfn 0.2.0-beta.63 → 0.2.0-beta.65

package/dist/index.js

@@ -922,7 +922,7 @@ var init_deployment_config = __esm({
 
 // src/utils/version.ts
 function getCliVersion() {
-  return "0.2.0-beta.63";
+  return "0.2.0-beta.65";
 }
 function getTagFromVersion(version) {
   const match = version.match(/-([a-z]+)\./i);
@@ -1860,7 +1860,7 @@ var init_migration_status = __esm({
 });
 
 // src/index.ts
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 
 // src/commands/create.ts
 init_logger();
@@ -2876,16 +2876,95 @@ var startCommand = new Command6("start").description("Start SPFN production serv
   }
 });
 
-// src/commands/codegen.ts
+// src/commands/provision.ts
 init_logger();
+init_package_manager();
 import { Command as Command7 } from "commander";
-import { existsSync as existsSync19, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync3, writeFileSync as writeFileSync12 } from "fs";
 import { join as join20 } from "path";
+import { pathToFileURL } from "url";
+import { execa as execa9 } from "execa";
+var CONFIG_FILE_PATHS = [
+  ".spfn/server/server.config.mjs",
+  ".spfn/server/server.config.js",
+  "src/server/server.config.ts",
+  "src/server/server.config.js"
+];
+function findServerConfig(cwd) {
+  return CONFIG_FILE_PATHS.map((path5) => join20(cwd, path5)).find(existsSync19);
+}
+var provisionCommand = new Command7("provision").description("Run deploy-time provisioning (seed/RBAC lifecycle hooks) \u2014 once per deploy, not per cold start").action(async () => {
+  if (!process.env.NODE_ENV) {
+    process.env.NODE_ENV = "production";
+  }
+  const cwd = process.cwd();
+  const configPath = findServerConfig(cwd);
+  if (!configPath) {
+    logger.error("server.config not found.");
+    logger.info(`Looked for: ${CONFIG_FILE_PATHS.join(", ")}`);
+    logger.info('Run "spfn init" first, or run this command from the app root.');
+    process.exit(1);
+  }
+  const { env: keychainEnv, missing: keychainMissing } = await resolveKeychainEnv(cwd);
+  if (Object.keys(keychainEnv).length > 0) {
+    logger.info(`[SPFN] Injecting ${Object.keys(keychainEnv).length} secret(s) from the keychain`);
+  }
+  if (keychainMissing.length > 0) {
+    logger.warn(`[SPFN] Could not resolve keychain secret(s): ${keychainMissing.join(", ")} \u2014 run \`spfn secret set <KEY>\``);
+  }
+  const tempDir = join20(cwd, ".spfn");
+  const runnerEntry = join20(tempDir, "provision.mjs");
+  mkdirSync3(tempDir, { recursive: true });
+  writeFileSync12(runnerEntry, `
+if (!process.env.NODE_ENV)
+{
+    process.env.NODE_ENV = 'production';
+}
+
+// The Vercel Supabase integration injects POSTGRES_URL but not DATABASE_URL,
+// which is what SPFN reads. Map it so build-step provisioning connects too.
+process.env.DATABASE_URL ??= process.env.POSTGRES_URL;
+
+// Load environment variables FIRST (before any imports that depend on them)
+await import('@spfn/core/config');
+
+const { provisionInfrastructure } = await import('@spfn/core/server');
+
+const config = (await import(${JSON.stringify(pathToFileURL(configPath).href)})).default;
+
+await provisionInfrastructure(config);
+
+// provisionInfrastructure leaves the DB pool open \u2014 exit explicitly.
+process.exit(0);
+`);
+  logger.info(`[SPFN] Provisioning with config: ${configPath.replace(cwd + "/", "")}
+`);
+  const pm = detectPackageManager(cwd);
+  const runnerCmd = pm === "npm" ? "npx" : pm;
+  const runnerArgs = pm === "npm" ? ["tsx", runnerEntry] : ["exec", "tsx", runnerEntry];
+  const result = await execa9(runnerCmd, runnerArgs, {
+    cwd,
+    stdio: "inherit",
+    reject: false,
+    env: { ...process.env, ...keychainEnv }
+  });
+  if (result.exitCode !== 0) {
+    logger.error(`Provisioning failed (exit code ${result.exitCode})`);
+    process.exit(result.exitCode ?? 1);
+  }
+  logger.info("[SPFN] Provisioning complete");
+});
+
+// src/commands/codegen.ts
+init_logger();
+import { Command as Command8 } from "commander";
+import { existsSync as existsSync20, writeFileSync as writeFileSync13 } from "fs";
+import { join as join21 } from "path";
 import chalk10 from "chalk";
 async function initCodegen(options) {
   const cwd = process.cwd();
-  const rcPath = join20(cwd, ".spfnrc.ts");
-  if (existsSync19(rcPath)) {
+  const rcPath = join21(cwd, ".spfnrc.ts");
+  if (existsSync20(rcPath)) {
     logger.warn(".spfnrc.ts already exists");
     logger.info("Edit manually to add custom generators");
     process.exit(0);
@@ -2910,7 +2989,7 @@ export default defineConfig({
     ],
 });
 `;
-  writeFileSync12(rcPath, content);
+  writeFileSync13(rcPath, content);
   console.log("\n" + chalk10.green.bold("\u2713 Created .spfnrc.ts\n"));
   console.log(chalk10.gray("Configured the @spfn/core:route-map generator."));
   if (options.withExample) {
@@ -2970,14 +3049,14 @@ async function runGenerators() {
   await orchestrator.generateAll();
   console.log("\n" + chalk10.green.bold("\u2713 Code generation completed"));
 }
-var codegenCommand = new Command7("codegen").description("Code generation management");
+var codegenCommand = new Command8("codegen").description("Code generation management");
 codegenCommand.command("init").description("Initialize .spfnrc.ts with codegen configuration").option("--with-example", "Show example custom generator usage").action(initCodegen);
 codegenCommand.command("list").alias("ls").description("List registered code generators").action(listGenerators);
 codegenCommand.command("run").description("Run code generators once (no watch mode)").action(runGenerators);
 
 // src/commands/key.ts
 init_logger();
-import { Command as Command8 } from "commander";
+import { Command as Command9 } from "commander";
 import { execSync } from "child_process";
 import chalk11 from "chalk";
 
@@ -3091,7 +3170,7 @@ function listPresets() {
   console.log(chalk11.gray("  spfn key auth-encryption --copy"));
   console.log();
 }
-var generateValueCommand = new Command8("generate").alias("gen").description("Generate random value (simple output, no metadata)").option("-b, --bytes <number>", "Number of random bytes", "32").option("-c, --copy", "Copy to clipboard").action((options) => {
+var generateValueCommand = new Command9("generate").alias("gen").description("Generate random value (simple output, no metadata)").option("-b, --bytes <number>", "Number of random bytes", "32").option("-c, --copy", "Copy to clipboard").action((options) => {
   const bytes = parseInt(options.bytes, 10);
   if (isNaN(bytes) || bytes < 1 || bytes > 128) {
     logger.error("Invalid bytes value. Must be between 1 and 128.");
@@ -3107,7 +3186,7 @@ var generateValueCommand = new Command8("generate").alias("gen").description("Ge
     }
   }
 });
-var keyCommand = new Command8("key").alias("k").description("Generate secure random keys and secrets").argument("[preset]", `Preset type (use --list to see all)`).option("-l, --list", "List all available presets").option("-b, --bytes <number>", "Number of random bytes to generate", "32").option("-e, --env <name>", "Environment variable name").option("-c, --copy", "Copy to clipboard").action((preset, options) => {
+var keyCommand = new Command9("key").alias("k").description("Generate secure random keys and secrets").argument("[preset]", `Preset type (use --list to see all)`).option("-l, --list", "List all available presets").option("-b, --bytes <number>", "Number of random bytes to generate", "32").option("-e, --env <name>", "Environment variable name").option("-c, --copy", "Copy to clipboard").action((preset, options) => {
   if (options.list) {
     listPresets();
     return;
@@ -3139,15 +3218,15 @@ keyCommand.addCommand(generateValueCommand);
 init_setup();
 
 // src/commands/db/index.ts
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 
 // src/commands/db/generate.ts
 import chalk13 from "chalk";
 
 // src/commands/db/utils/drizzle.ts
-import { existsSync as existsSync20, writeFileSync as writeFileSync13, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync21, writeFileSync as writeFileSync14, unlinkSync as unlinkSync2 } from "fs";
 import { spawn } from "child_process";
-import { pathToFileURL } from "url";
+import { pathToFileURL as pathToFileURL2 } from "url";
 import chalk12 from "chalk";
 import ora6 from "ora";
 import { env as env3 } from "@spfn/core/config";
@@ -3212,7 +3291,7 @@ function validateDatabasePrerequisites() {
   }
 }
 async function runDrizzleCommand(command) {
-  const hasUserConfig = existsSync20("./drizzle.config.ts");
+  const hasUserConfig = existsSync21("./drizzle.config.ts");
   const tempConfigPath = `./drizzle.config.${process.pid}.${Date.now()}.temp.ts`;
   const configPath = hasUserConfig ? "./drizzle.config.ts" : tempConfigPath;
   if (!hasUserConfig) {
@@ -3231,7 +3310,7 @@ async function runDrizzleCommand(command) {
       expandGlobs: true,
       autoDetectSchemas: true
     });
-    writeFileSync13(tempConfigPath, configContent);
+    writeFileSync14(tempConfigPath, configContent);
     console.log(chalk12.dim("Using auto-generated Drizzle config\n"));
   }
   const args = command.split(" ");
@@ -3244,7 +3323,7 @@ async function runDrizzleCommand(command) {
       env: shouldRelaxDbTls(env3.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
     });
     const cleanup = () => {
-      if (!hasUserConfig && existsSync20(tempConfigPath)) {
+      if (!hasUserConfig && existsSync21(tempConfigPath)) {
         unlinkSync2(tempConfigPath);
       }
     };
@@ -3283,7 +3362,7 @@ async function loadSchemaImports(schemaFiles) {
   }
   const imports = {};
   for (const file of schemaFiles) {
-    const moduleUrl = pathToFileURL(file).href;
+    const moduleUrl = pathToFileURL2(file).href;
     const mod = await import(moduleUrl);
     for (const [key, value] of Object.entries(mod)) {
       if (key !== "default") {
@@ -3564,8 +3643,8 @@ async function applyFunctionMigrations(plans) {
 
 // src/commands/db/migrate.ts
 import chalk20 from "chalk";
-import { join as join21 } from "path";
-import { existsSync as existsSync22 } from "fs";
+import { join as join22 } from "path";
+import { existsSync as existsSync23 } from "fs";
 
 // src/commands/db/backup.ts
 import { promises as fs3 } from "fs";
@@ -3658,7 +3737,7 @@ function formatTimestamp() {
 
 // src/commands/db/utils/backup-files.ts
 import { promises as fs2 } from "fs";
-import { existsSync as existsSync21 } from "fs";
+import { existsSync as existsSync22 } from "fs";
 import path2 from "path";
 import chalk18 from "chalk";
 
@@ -3758,7 +3837,7 @@ async function ensureBackupInGitignore() {
   const gitignorePath = path2.join(process.cwd(), ".gitignore");
   try {
     let content = "";
-    let exists = existsSync21(gitignorePath);
+    let exists = existsSync22(gitignorePath);
     if (exists) {
       content = await fs2.readFile(gitignorePath, "utf-8");
     }
@@ -3780,7 +3859,7 @@ async function ensureBackupDir() {
   try {
     await fs2.mkdir(backupDir, { recursive: true });
     const gitignorePath = path2.join(backupDir, ".gitignore");
-    const gitignoreExists = existsSync21(gitignorePath);
+    const gitignoreExists = existsSync22(gitignorePath);
     if (!gitignoreExists) {
       await fs2.writeFile(gitignorePath, "# Ignore all backup files\n*.sql\n*.dump\n*.meta.json\n");
     }
@@ -3974,8 +4053,8 @@ async function dbMigrate(options = {}) {
     await executeFunctionMigrations2(loadFunctionMigrationPlans2(functions));
     console.log(chalk20.green("\u2705 Function migrations applied\n"));
   }
-  const projectMigrationsDir = join21(process.cwd(), "src/server/drizzle");
-  if (existsSync22(projectMigrationsDir)) {
+  const projectMigrationsDir = join22(process.cwd(), "src/server/drizzle");
+  if (existsSync23(projectMigrationsDir)) {
     const projConn = postgres.default(env5.DATABASE_URL, { max: 1 });
     const projDb = drizzle({ client: projConn });
     try {
@@ -4035,7 +4114,7 @@ async function dbStatus() {
 
 // src/commands/db/studio.ts
 import chalk22 from "chalk";
-import { existsSync as existsSync23, writeFileSync as writeFileSync14, unlinkSync as unlinkSync3 } from "fs";
+import { existsSync as existsSync24, writeFileSync as writeFileSync15, unlinkSync as unlinkSync3 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { env as env6 } from "@spfn/core/config";
 async function dbStudio(requestedPort) {
@@ -4053,7 +4132,7 @@ async function dbStudio(requestedPort) {
     console.error(chalk22.red(error instanceof Error ? error.message : "Failed to find available port"));
     process.exit(1);
   }
-  const hasUserConfig = existsSync23("./drizzle.config.ts");
+  const hasUserConfig = existsSync24("./drizzle.config.ts");
   const tempConfigPath = `./drizzle.config.${process.pid}.${Date.now()}.temp.ts`;
   try {
     const configPath = hasUserConfig ? "./drizzle.config.ts" : tempConfigPath;
@@ -4070,7 +4149,7 @@ async function dbStudio(requestedPort) {
         expandGlobs: true
         // Expand glob patterns for Studio compatibility
       });
-      writeFileSync14(tempConfigPath, configContent);
+      writeFileSync15(tempConfigPath, configContent);
       console.log(chalk22.dim("Using auto-generated Drizzle config\n"));
     }
     const studioProcess = spawn3("drizzle-kit", ["studio", `--port=${port}`, `--config=${configPath}`], {
@@ -4079,7 +4158,7 @@ async function dbStudio(requestedPort) {
       env: shouldRelaxDbTls(env6.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
     });
     const cleanup = () => {
-      if (!hasUserConfig && existsSync23(tempConfigPath)) {
+      if (!hasUserConfig && existsSync24(tempConfigPath)) {
         unlinkSync3(tempConfigPath);
       }
     };
@@ -4109,7 +4188,7 @@ async function dbStudio(requestedPort) {
       process.exit(0);
     });
   } catch (error) {
-    if (!hasUserConfig && existsSync23(tempConfigPath)) {
+    if (!hasUserConfig && existsSync24(tempConfigPath)) {
       unlinkSync3(tempConfigPath);
     }
     console.error(chalk22.red("\u274C Failed to start Drizzle Studio"));
@@ -4496,8 +4575,8 @@ async function dbBackupClean(options) {
 }
 
 // src/commands/db/reindex.ts
-import { existsSync as existsSync24, readFileSync as readFileSync10, writeFileSync as writeFileSync15, renameSync, copyFileSync } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync10, writeFileSync as writeFileSync16, renameSync, copyFileSync } from "fs";
+import { join as join23 } from "path";
 import chalk28 from "chalk";
 import { loadEnv as loadEnv9 } from "@spfn/core/server";
 function isTimestampPrefix(tag) {
@@ -4519,8 +4598,8 @@ async function dbReindex(options = {}) {
   const { getDrizzleConfig } = await import("@spfn/core/db");
   const config = getDrizzleConfig({ disablePackageDiscovery: true });
   const outDir = config.out;
-  const journalPath = join22(outDir, "meta", "_journal.json");
-  if (!existsSync24(journalPath)) {
+  const journalPath = join23(outDir, "meta", "_journal.json");
+  if (!existsSync25(journalPath)) {
     console.error(chalk28.red("\u274C No _journal.json found at:"), journalPath);
     console.log(chalk28.yellow("\u{1F4A1} Run `spfn db generate` first to create migrations"));
     process.exit(1);
@@ -4541,14 +4620,14 @@ async function dbReindex(options = {}) {
     const { prefix: oldPrefix, suffix } = parseTag(entry.tag);
     const newPrefix = String(entry.when);
     const newTag = suffix ? `${newPrefix}_${suffix}` : newPrefix;
-    const oldSql = join22(outDir, `${entry.tag}.sql`);
-    const newSql = join22(outDir, `${newTag}.sql`);
-    if (existsSync24(oldSql)) {
+    const oldSql = join23(outDir, `${entry.tag}.sql`);
+    const newSql = join23(outDir, `${newTag}.sql`);
+    if (existsSync25(oldSql)) {
       renames.push({ type: "sql", from: oldSql, to: newSql });
     }
-    const oldSnapshot = join22(outDir, "meta", `${oldPrefix}_snapshot.json`);
-    const newSnapshot = join22(outDir, "meta", `${newPrefix}_snapshot.json`);
-    if (existsSync24(oldSnapshot)) {
+    const oldSnapshot = join23(outDir, "meta", `${oldPrefix}_snapshot.json`);
+    const newSnapshot = join23(outDir, "meta", `${newPrefix}_snapshot.json`);
+    if (existsSync25(oldSnapshot)) {
       renames.push({ type: "snapshot", from: oldSnapshot, to: newSnapshot });
     }
     tagUpdates.push({ idx: entry.idx, oldTag: entry.tag, newTag });
@@ -4591,13 +4670,13 @@ async function dbReindex(options = {}) {
       entry.tag = update.newTag;
     }
   }
-  writeFileSync15(journalPath, JSON.stringify(journal, null, 2) + "\n");
+  writeFileSync16(journalPath, JSON.stringify(journal, null, 2) + "\n");
   console.log(chalk28.green(`
 \u2705 Reindex complete \u2014 ${tagUpdates.length} migration(s) converted to timestamp prefix.`));
 }
 
 // src/commands/db/index.ts
-var dbCommand = new Command9("db").description("Database management commands (wraps Drizzle Kit)");
+var dbCommand = new Command10("db").description("Database management commands (wraps Drizzle Kit)");
 dbCommand.command("generate").alias("g").description("Generate database migrations from schema changes").action(dbGenerate);
 dbCommand.command("push").description("Push schema changes to database (safe mode by default)").option("--force", "Apply all changes including destructive ones").option("--dry-run", "Show changes without applying").action((options) => dbPush(options));
 dbCommand.command("migrate").alias("m").description("Run pending migrations").option("--with-backup", "Create backup before running migrations").action((options) => dbMigrate(options));
@@ -4613,54 +4692,114 @@ dbCommand.command("reindex").description("Convert migration files from sequentia
 
 // src/commands/add.ts
 init_package_manager();
-import { Command as Command10 } from "commander";
-import { existsSync as existsSync25, readFileSync as readFileSync11 } from "fs";
-import { join as join23 } from "path";
-import { execa as execa9 } from "execa";
-import chalk29 from "chalk";
+import { Command as Command11 } from "commander";
+import { existsSync as existsSync27, readFileSync as readFileSync11 } from "fs";
+import { join as join25 } from "path";
+import { execa as execa10 } from "execa";
+import chalk30 from "chalk";
 import ora11 from "ora";
+
+// src/commands/add-vercel.ts
+init_templates();
+import { copyFileSync as copyFileSync2, existsSync as existsSync26, mkdirSync as mkdirSync4 } from "fs";
+import { dirname as dirname3, join as join24 } from "path";
+import chalk29 from "chalk";
+var FILES = [
+  {
+    template: "route.ts",
+    target: join24("src", "app", "api", "backend", "[[...route]]", "route.ts"),
+    description: "hono/vercel adapter (mounts the SPFN app under /api/backend)"
+  },
+  {
+    template: "vercel.json",
+    target: "vercel.json",
+    description: "Vercel build config (pnpm spfn:build)"
+  },
+  {
+    template: "npmrc",
+    target: ".npmrc",
+    description: "@spfn registry auth (reads GITEA_NPM_TOKEN from env)"
+  }
+];
+async function addVercel() {
+  console.log(chalk29.blue("\n\u{1F4E6} Setting up the Vercel serverless target...\n"));
+  const cwd = process.cwd();
+  const templatesDir = join24(findTemplatesPath(), "vercel");
+  for (const file of FILES) {
+    const targetPath = join24(cwd, file.target);
+    if (existsSync26(targetPath)) {
+      console.log(chalk29.yellow(`\u23ED\uFE0F  ${file.target} already exists \u2014 skipped (not overwritten)`));
+      continue;
+    }
+    mkdirSync4(dirname3(targetPath), { recursive: true });
+    copyFileSync2(join24(templatesDir, file.template), targetPath);
+    console.log(chalk29.green(`\u2705 ${file.target}`) + chalk29.gray(` \u2014 ${file.description}`));
+  }
+  console.log(chalk29.green("\n\u2705 Vercel target ready!\n"));
+  console.log(chalk29.cyan("\u{1F4DA} Next steps:"));
+  console.log(chalk29.gray("  1. Make sure `hono` is a direct dependency (hono/vercel must resolve from the app):"));
+  console.log(chalk29.gray("       pnpm add hono"));
+  console.log(chalk29.gray("  2. Set Vercel project env vars:"));
+  console.log(chalk29.gray("       GITEA_NPM_TOKEN   \u2014 @spfn registry token (install step)"));
+  console.log(chalk29.gray("       SPFN_AUTH_*       \u2014 auth secrets (same as local .env.server)"));
+  console.log(chalk29.gray("       SPFN_API_URL      \u2014 https://<your-domain>/api/backend (RPC proxy origin)"));
+  console.log(chalk29.gray("       DATABASE_URL      \u2014 set automatically from POSTGRES_URL if you use the"));
+  console.log(chalk29.gray("                           Vercel Supabase integration (mapped in route.ts)"));
+  console.log(chalk29.gray("  3. Run migrations against the DIRECT (non-pooler) connection before deploying:"));
+  console.log(chalk29.gray("       DATABASE_URL=<direct-url> pnpm spfn db migrate"));
+  console.log(chalk29.gray("  4. Seed/RBAC provisioning runs once per deploy, not per cold start:"));
+  console.log(chalk29.gray("       pnpm spfn provision   (e.g. from the build step or a deploy hook)"));
+  console.log(chalk29.gray("  5. Jobs (config.jobs) are NOT processed on serverless \u2014 drain the queue from a"));
+  console.log(chalk29.gray("     scheduled endpoint (Vercel Cron) or run workers on an always-on target.\n"));
+}
+
+// src/commands/add.ts
 async function addPackage(packageName) {
+  if (packageName === "vercel") {
+    await addVercel();
+    return;
+  }
   if (!packageName.includes("/")) {
-    console.error(chalk29.red("\u274C Please specify full package name"));
-    console.log(chalk29.yellow("\n\u{1F4A1} Examples:"));
-    console.log(chalk29.gray("  pnpm spfn add @spfn/cms"));
-    console.log(chalk29.gray("  pnpm spfn add @mycompany/spfn-analytics"));
+    console.error(chalk30.red("\u274C Please specify full package name"));
+    console.log(chalk30.yellow("\n\u{1F4A1} Examples:"));
+    console.log(chalk30.gray("  pnpm spfn add @spfn/cms"));
+    console.log(chalk30.gray("  pnpm spfn add @mycompany/spfn-analytics"));
     process.exit(1);
   }
-  console.log(chalk29.blue(`
+  console.log(chalk30.blue(`
 \u{1F4E6} Setting up ${packageName}...
 `));
-  const pkgPath = join23(process.cwd(), "node_modules", ...packageName.split("/"));
-  const pkgJsonPath = join23(pkgPath, "package.json");
-  if (!existsSync25(pkgJsonPath)) {
+  const pkgPath = join25(process.cwd(), "node_modules", ...packageName.split("/"));
+  const pkgJsonPath = join25(pkgPath, "package.json");
+  if (!existsSync27(pkgJsonPath)) {
     const pm = detectPackageManager(process.cwd());
     const installSpinner = ora11("Installing package...").start();
     try {
-      await execa9(pm, ["add", packageName]);
+      await execa10(pm, ["add", packageName]);
       installSpinner.succeed("Package installed");
     } catch (error) {
       installSpinner.fail("Failed to install package");
-      console.error(chalk29.red(error instanceof Error ? error.message : "Unknown error"));
+      console.error(chalk30.red(error instanceof Error ? error.message : "Unknown error"));
       process.exit(1);
     }
   } else {
-    console.log(chalk29.gray("\u2713 Package already installed (using local version)\n"));
+    console.log(chalk30.gray("\u2713 Package already installed (using local version)\n"));
   }
-  if (!existsSync25(pkgJsonPath)) {
-    console.error(chalk29.red(`\u274C Package ${packageName} not found after installation`));
+  if (!existsSync27(pkgJsonPath)) {
+    console.error(chalk30.red(`\u274C Package ${packageName} not found after installation`));
     process.exit(1);
   }
   const pkgJson = JSON.parse(readFileSync11(pkgJsonPath, "utf-8"));
   if (pkgJson.spfn?.migrations) {
-    console.log(chalk29.blue(`
+    console.log(chalk30.blue(`
 \u{1F5C4}\uFE0F  Setting up database for ${packageName}...
 `));
     const { env: env9 } = await import("@spfn/core/config");
     if (!env9.DATABASE_URL) {
-      console.log(chalk29.yellow("\u26A0\uFE0F  DATABASE_URL not found \u2014 skipping database setup."));
-      console.log(chalk29.yellow(`   ${packageName} tables are created by its bundled migrations, not by schema push.`));
-      console.log(chalk29.cyan("   Once DATABASE_URL is set, run: pnpm spfn db migrate"));
-      console.log(chalk29.gray("   (check state anytime with: pnpm spfn db status)\n"));
+      console.log(chalk30.yellow("\u26A0\uFE0F  DATABASE_URL not found \u2014 skipping database setup."));
+      console.log(chalk30.yellow(`   ${packageName} tables are created by its bundled migrations, not by schema push.`));
+      console.log(chalk30.cyan("   Once DATABASE_URL is set, run: pnpm spfn db migrate"));
+      console.log(chalk30.gray("   (check state anytime with: pnpm spfn db status)\n"));
     } else {
       const { discoverFunctionMigrations: discoverFunctionMigrations2, loadFunctionMigrationPlans: loadFunctionMigrationPlans2, executeFunctionMigrations: executeFunctionMigrations2 } = await Promise.resolve().then(() => (init_function_migrations(), function_migrations_exports));
       const functions = discoverFunctionMigrations2(process.cwd());
@@ -4672,31 +4811,31 @@ async function addPackage(packageName) {
           spinner.succeed("Migrations applied");
         } catch (error) {
           spinner.fail("Failed to apply migrations");
-          console.error(chalk29.red(error instanceof Error ? error.message : "Unknown error"));
+          console.error(chalk30.red(error instanceof Error ? error.message : "Unknown error"));
           process.exit(1);
         }
       } else {
-        console.log(chalk29.gray("\u2139\uFE0F  No migrations found for this package"));
+        console.log(chalk30.gray("\u2139\uFE0F  No migrations found for this package"));
       }
     }
   } else {
-    console.log(chalk29.gray("\n\u2139\uFE0F  No database migrations to apply"));
+    console.log(chalk30.gray("\n\u2139\uFE0F  No database migrations to apply"));
   }
-  console.log(chalk29.green(`
+  console.log(chalk30.green(`
 \u2705 ${packageName} installed successfully!
 `));
   if (pkgJson.spfn?.setupMessage) {
-    console.log(chalk29.cyan("\u{1F4DA} Setup Guide:"));
+    console.log(chalk30.cyan("\u{1F4DA} Setup Guide:"));
     console.log(pkgJson.spfn.setupMessage);
     console.log();
   }
 }
-var addCommand = new Command10("add").description("Install and set up SPFN ecosystem packages").argument("<package>", "Package name (e.g., @spfn/cms, @mycompany/spfn-analytics)").action(addPackage);
+var addCommand = new Command11("add").description("Install and set up SPFN ecosystem packages, or scaffold a deploy target (vercel)").argument("<package>", 'Package name (e.g., @spfn/cms, @mycompany/spfn-analytics) or "vercel"').action(addPackage);
 
 // src/commands/env.ts
-import { Command as Command11 } from "commander";
-import chalk30 from "chalk";
-import { existsSync as existsSync26, readFileSync as readFileSync12, writeFileSync as writeFileSync16 } from "fs";
+import { Command as Command12 } from "commander";
+import chalk31 from "chalk";
+import { existsSync as existsSync28, readFileSync as readFileSync12, writeFileSync as writeFileSync17 } from "fs";
 import { resolve as resolve2 } from "path";
 import { parse as parse2 } from "dotenv";
 
@@ -4752,26 +4891,26 @@ function getEnvFilesForEnvironment(nodeEnv) {
 }
 function formatType(type) {
   const typeColors = {
-    string: chalk30.green,
-    number: chalk30.blue,
-    boolean: chalk30.yellow,
-    url: chalk30.cyan,
-    enum: chalk30.magenta,
-    json: chalk30.red
+    string: chalk31.green,
+    number: chalk31.blue,
+    boolean: chalk31.yellow,
+    url: chalk31.cyan,
+    enum: chalk31.magenta,
+    json: chalk31.red
   };
-  return (typeColors[type] || chalk30.white)(type);
+  return (typeColors[type] || chalk31.white)(type);
 }
 function formatDefault(value, type) {
   if (value === void 0) {
-    return chalk30.dim("(none)");
+    return chalk31.dim("(none)");
   }
   if (type === "string" || type === "url") {
-    return chalk30.green(`"${value}"`);
+    return chalk31.green(`"${value}"`);
   }
   if (type === "boolean") {
-    return value ? chalk30.green("true") : chalk30.red("false");
+    return value ? chalk31.green("true") : chalk31.red("false");
   }
-  return chalk30.cyan(String(value));
+  return chalk31.cyan(String(value));
 }
 async function listEnvVars(options) {
   const packageName = options.package || "@spfn/core";
@@ -4785,28 +4924,28 @@ async function listEnvVars(options) {
         acc[target].push([key, schema]);
         return acc;
       }, {});
-      console.log(chalk30.blue.bold(`
+      console.log(chalk31.blue.bold(`
 \u{1F4CB} Environment Variables by File (${packageName})
 `));
       for (const [file, vars] of Object.entries(grouped)) {
-        console.log(chalk30.bold.magenta(`
+        console.log(chalk31.bold.magenta(`
 ${file}`));
-        console.log(chalk30.dim("\u2500".repeat(50)));
+        console.log(chalk31.dim("\u2500".repeat(50)));
         for (const [key, schema] of vars) {
           printEnvVar(key, schema);
         }
       }
     } else {
-      console.log(chalk30.blue.bold(`
+      console.log(chalk31.blue.bold(`
 \u{1F4CB} Environment Variables (${packageName})
 `));
       for (const [key, schema] of allVars) {
         printEnvVar(key, schema, true);
       }
     }
-    console.log(chalk30.dim("\n\u{1F4A1} Tip: Use `spfn env init` to generate .env template files\n"));
+    console.log(chalk31.dim("\n\u{1F4A1} Tip: Use `spfn env init` to generate .env template files\n"));
   } catch (error) {
-    console.error(chalk30.red(`
+    console.error(chalk31.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4814,17 +4953,17 @@ ${file}`));
 }
 function printEnvVar(key, schema, showFile = false) {
   const typeStr = formatType(schema.type);
-  const requiredStr = schema.required || schema.default !== void 0 ? chalk30.red("[required]") : chalk30.dim("[optional]");
-  const sensitiveStr = schema.sensitive ? chalk30.yellow(" [sensitive]") : "";
-  const fileStr = showFile ? chalk30.dim(` \u2192 ${getTargetFile(schema)}`) : "";
-  console.log(`${chalk30.bold.cyan(key)} ${chalk30.dim("(")}${typeStr}${chalk30.dim(")")} ${requiredStr}${sensitiveStr}${fileStr}`);
-  console.log(`  ${chalk30.dim(schema.description)}`);
+  const requiredStr = schema.required || schema.default !== void 0 ? chalk31.red("[required]") : chalk31.dim("[optional]");
+  const sensitiveStr = schema.sensitive ? chalk31.yellow(" [sensitive]") : "";
+  const fileStr = showFile ? chalk31.dim(` \u2192 ${getTargetFile(schema)}`) : "";
+  console.log(`${chalk31.bold.cyan(key)} ${chalk31.dim("(")}${typeStr}${chalk31.dim(")")} ${requiredStr}${sensitiveStr}${fileStr}`);
+  console.log(`  ${chalk31.dim(schema.description)}`);
   if (schema.default !== void 0) {
-    console.log(`  ${chalk30.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
+    console.log(`  ${chalk31.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
   }
   if (schema.examples && schema.examples.length > 0) {
     const exampleStr = schema.examples.map((ex) => formatDefault(ex, schema.type)).join(", ");
-    console.log(`  ${chalk30.dim("Examples:")} ${exampleStr}`);
+    console.log(`  ${chalk31.dim("Examples:")} ${exampleStr}`);
   }
   console.log();
 }
@@ -4832,7 +4971,7 @@ async function showEnvStats(options) {
   const packageName = options.package || "@spfn/core";
   try {
     const envSchema = await loadEnvSchema(packageName);
-    console.log(chalk30.blue.bold(`
+    console.log(chalk31.blue.bold(`
 \u{1F4CA} Environment Variable Statistics (${packageName})
 `));
     const allVars = Object.entries(envSchema);
@@ -4854,24 +4993,24 @@ async function showEnvStats(options) {
       acc[file] = (acc[file] || 0) + 1;
       return acc;
     }, {});
-    console.log(`${chalk30.bold("Total variables:")} ${chalk30.cyan(allVars.length)}`);
-    console.log(`${chalk30.bold("Required:")} ${chalk30.red(required.length)}`);
-    console.log(`${chalk30.bold("Optional:")} ${chalk30.dim(optional.length)}`);
-    console.log(`${chalk30.bold("Sensitive:")} ${chalk30.yellow(sensitive.length)}`);
-    console.log(chalk30.bold("\nBy Target:"));
-    console.log(`  ${chalk30.blue("Next.js accessible:")} ${chalk30.cyan(nextjsVars.length)}`);
-    console.log(`  ${chalk30.magenta("SPFN server only:")} ${chalk30.cyan(serverOnlyVars.length)}`);
-    console.log(chalk30.bold("\nBy File:"));
+    console.log(`${chalk31.bold("Total variables:")} ${chalk31.cyan(allVars.length)}`);
+    console.log(`${chalk31.bold("Required:")} ${chalk31.red(required.length)}`);
+    console.log(`${chalk31.bold("Optional:")} ${chalk31.dim(optional.length)}`);
+    console.log(`${chalk31.bold("Sensitive:")} ${chalk31.yellow(sensitive.length)}`);
+    console.log(chalk31.bold("\nBy Target:"));
+    console.log(`  ${chalk31.blue("Next.js accessible:")} ${chalk31.cyan(nextjsVars.length)}`);
+    console.log(`  ${chalk31.magenta("SPFN server only:")} ${chalk31.cyan(serverOnlyVars.length)}`);
+    console.log(chalk31.bold("\nBy File:"));
     for (const [file, count] of Object.entries(fileCount)) {
-      console.log(`  ${chalk30.dim(file)}: ${chalk30.cyan(count)}`);
+      console.log(`  ${chalk31.dim(file)}: ${chalk31.cyan(count)}`);
     }
-    console.log(chalk30.bold("\nBy Type:"));
+    console.log(chalk31.bold("\nBy Type:"));
     for (const [type, count] of Object.entries(typeCount)) {
-      console.log(`  ${formatType(type)}: ${chalk30.cyan(count)}`);
+      console.log(`  ${formatType(type)}: ${chalk31.cyan(count)}`);
     }
     console.log();
   } catch (error) {
-    console.error(chalk30.red(`
+    console.error(chalk31.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4891,40 +5030,40 @@ async function searchEnvVars(query, options) {
       }
     }
     if (results.length === 0) {
-      console.log(chalk30.yellow(`
+      console.log(chalk31.yellow(`
 \u26A0\uFE0F  No environment variables found matching "${query}"
 `));
       return;
     }
-    console.log(chalk30.blue.bold(`
+    console.log(chalk31.blue.bold(`
 \u{1F50D} Found ${results.length} environment variable(s) matching "${query}"
 `));
     for (const [key, schema] of results) {
       const typeStr = formatType(schema.type);
-      const requiredStr = schema.required || schema.default !== void 0 ? chalk30.red("[required]") : chalk30.dim("[optional]");
-      console.log(`${chalk30.bold.cyan(key)} ${chalk30.dim("(")}${typeStr}${chalk30.dim(")")} ${requiredStr}`);
-      console.log(`  ${chalk30.dim(schema.description)}`);
+      const requiredStr = schema.required || schema.default !== void 0 ? chalk31.red("[required]") : chalk31.dim("[optional]");
+      console.log(`${chalk31.bold.cyan(key)} ${chalk31.dim("(")}${typeStr}${chalk31.dim(")")} ${requiredStr}`);
+      console.log(`  ${chalk31.dim(schema.description)}`);
       if (schema.default !== void 0) {
-        console.log(`  ${chalk30.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
+        console.log(`  ${chalk31.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
       }
       console.log();
     }
   } catch (error) {
-    console.error(chalk30.red(`
+    console.error(chalk31.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
   }
 }
-var envCommand = new Command11("env").description("Manage environment variables");
+var envCommand = new Command12("env").description("Manage environment variables");
 envCommand.command("list").description("List all environment variables from schema").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").option("-g, --group", "Group variables by target file").action(listEnvVars);
 envCommand.command("stats").description("Show environment variable statistics").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").action(showEnvStats);
 envCommand.command("search").description("Search environment variables").argument("<query>", "Search query (matches key or description)").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").action(searchEnvVars);
 function validateEnvOption(envValue) {
   if (!VALID_ENVS.includes(envValue)) {
-    console.error(chalk30.red(`
+    console.error(chalk31.red(`
 \u274C Invalid environment: "${envValue}"`));
-    console.log(chalk30.dim(`   Valid values: ${VALID_ENVS.join(", ")}
+    console.log(chalk31.dim(`   Valid values: ${VALID_ENVS.join(", ")}
 `));
     process.exit(1);
   }
@@ -4945,8 +5084,8 @@ async function initEnvFiles(options) {
       return acc;
     }, {});
     if (targetEnv) {
-      console.log(chalk30.blue.bold(`
-\u{1F680} Generating .env template files for ${chalk30.cyan(targetEnv)} environment
+      console.log(chalk31.blue.bold(`
+\u{1F680} Generating .env template files for ${chalk31.cyan(targetEnv)} environment
 `));
       const envSpecificFiles = {};
       const committedVars = allVars.filter(([_, schema]) => !schema.sensitive);
@@ -4962,24 +5101,24 @@ async function initEnvFiles(options) {
         writeEnvTemplate(cwd, file, vars, options.force ?? false);
       }
     } else {
-      console.log(chalk30.blue.bold(`
+      console.log(chalk31.blue.bold(`
 \u{1F680} Generating .env template files
 `));
       for (const [file, vars] of Object.entries(grouped)) {
         writeEnvTemplate(cwd, file, vars, options.force ?? false);
       }
     }
-    console.log(chalk30.dim("\n\u{1F4A1} Copy .example files to create your actual .env files:"));
-    console.log(chalk30.dim("   cp .env.example .env"));
-    console.log(chalk30.dim("   cp .env.local.example .env.local"));
-    console.log(chalk30.dim("   cp .env.server.example .env.server"));
+    console.log(chalk31.dim("\n\u{1F4A1} Copy .example files to create your actual .env files:"));
+    console.log(chalk31.dim("   cp .env.example .env"));
+    console.log(chalk31.dim("   cp .env.local.example .env.local"));
+    console.log(chalk31.dim("   cp .env.server.example .env.server"));
     if (targetEnv) {
-      console.log(chalk30.dim(`   cp .env.${targetEnv}.example .env.${targetEnv}`));
-      console.log(chalk30.dim(`   cp .env.${targetEnv}.local.example .env.${targetEnv}.local`));
+      console.log(chalk31.dim(`   cp .env.${targetEnv}.example .env.${targetEnv}`));
+      console.log(chalk31.dim(`   cp .env.${targetEnv}.local.example .env.${targetEnv}.local`));
     }
     console.log("");
   } catch (error) {
-    console.error(chalk30.red(`
+    console.error(chalk31.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4987,12 +5126,12 @@ async function initEnvFiles(options) {
 }
 function writeEnvTemplate(cwd, file, vars, force) {
   const filePath = resolve2(cwd, file);
-  if (existsSync26(filePath) && !force) {
-    console.log(chalk30.yellow(`  \u23ED\uFE0F  ${file} already exists (use --force to overwrite)`));
+  if (existsSync28(filePath) && !force) {
+    console.log(chalk31.yellow(`  \u23ED\uFE0F  ${file} already exists (use --force to overwrite)`));
     return;
   }
-  writeFileSync16(filePath, generateEnvFileContent(vars), "utf-8");
-  console.log(chalk30.green(`  \u2705 ${file} (${vars.length} variables)`));
+  writeFileSync17(filePath, generateEnvFileContent(vars), "utf-8");
+  console.log(chalk31.green(`  \u2705 ${file} (${vars.length} variables)`));
 }
 function generateEnvFileContent(vars) {
   const lines = [
@@ -5027,7 +5166,7 @@ async function checkEnvFiles(options) {
     const envSchema = await loadEnvSchema(packageName);
     const allVars = Object.entries(envSchema);
     const envLabel = targetEnv ? ` (${targetEnv})` : "";
-    console.log(chalk30.blue.bold(`
+    console.log(chalk31.blue.bold(`
 \u{1F50D} Checking .env files against schema${envLabel}
 `));
     const filesToCheck = targetEnv ? getEnvFilesForEnvironment(targetEnv) : [...BASE_ENV_FILES.nextjs, ...BASE_ENV_FILES.server];
@@ -5036,7 +5175,7 @@ async function checkEnvFiles(options) {
     const warnings = [];
     for (const file of filesToCheck) {
       const filePath = resolve2(cwd, file);
-      if (!existsSync26(filePath)) {
+      if (!existsSync28(filePath)) {
         continue;
       }
       const content = readFileSync12(filePath, "utf-8");
@@ -5044,7 +5183,7 @@ async function checkEnvFiles(options) {
       for (const [key, value] of Object.entries(parsed)) {
         loadedEnv[key] = { value: value || "", file };
       }
-      console.log(chalk30.dim(`  \u{1F4C4} ${file} loaded`));
+      console.log(chalk31.dim(`  \u{1F4C4} ${file} loaded`));
     }
     console.log("");
     for (const [key, schema] of allVars) {
@@ -5052,7 +5191,7 @@ async function checkEnvFiles(options) {
       const found = loadedEnv[key];
       if (!found) {
         if (schema.required && schema.default === void 0) {
-          issues.push(`${chalk30.red("\u2717")} ${chalk30.cyan(key)} is required but not found in any .env file`);
+          issues.push(`${chalk31.red("\u2717")} ${chalk31.cyan(key)} is required but not found in any .env file`);
         }
         continue;
       }
@@ -5062,11 +5201,11 @@ async function checkEnvFiles(options) {
       if (!shouldBeNextjs && isNextjsFile && !isServerFile) {
         if (schema.sensitive) {
           issues.push(
-            `${chalk30.red("\u2717")} ${chalk30.cyan(key)} is sensitive and should be in ${chalk30.magenta(expectedFile)}, but found in ${chalk30.yellow(found.file)} (security risk!)`
+            `${chalk31.red("\u2717")} ${chalk31.cyan(key)} is sensitive and should be in ${chalk31.magenta(expectedFile)}, but found in ${chalk31.yellow(found.file)} (security risk!)`
           );
         } else {
           warnings.push(
-            `${chalk30.yellow("\u26A0")} ${chalk30.cyan(key)} should be in ${chalk30.magenta(expectedFile)}, but found in ${chalk30.dim(found.file)}`
+            `${chalk31.yellow("\u26A0")} ${chalk31.cyan(key)} should be in ${chalk31.magenta(expectedFile)}, but found in ${chalk31.dim(found.file)}`
           );
         }
       }
@@ -5074,34 +5213,34 @@ async function checkEnvFiles(options) {
     for (const [key, { file }] of Object.entries(loadedEnv)) {
       const inSchema = allVars.some(([k]) => k === key);
       if (!inSchema) {
-        warnings.push(`${chalk30.yellow("\u26A0")} ${chalk30.cyan(key)} in ${chalk30.dim(file)} is not in schema`);
+        warnings.push(`${chalk31.yellow("\u26A0")} ${chalk31.cyan(key)} in ${chalk31.dim(file)} is not in schema`);
       }
     }
     if (issues.length > 0) {
-      console.log(chalk30.red.bold("Issues:"));
+      console.log(chalk31.red.bold("Issues:"));
       for (const issue of issues) {
         console.log(`  ${issue}`);
       }
       console.log("");
     }
     if (warnings.length > 0) {
-      console.log(chalk30.yellow.bold("Warnings:"));
+      console.log(chalk31.yellow.bold("Warnings:"));
       for (const warning of warnings) {
         console.log(`  ${warning}`);
       }
       console.log("");
     }
     if (issues.length === 0 && warnings.length === 0) {
-      console.log(chalk30.green("\u2705 All environment variables are correctly configured!\n"));
+      console.log(chalk31.green("\u2705 All environment variables are correctly configured!\n"));
     } else {
-      console.log(chalk30.dim(`Found ${issues.length} issue(s) and ${warnings.length} warning(s)
+      console.log(chalk31.dim(`Found ${issues.length} issue(s) and ${warnings.length} warning(s)
 `));
       if (issues.length > 0) {
         process.exit(1);
       }
     }
   } catch (error) {
-    console.error(chalk30.red(`
+    console.error(chalk31.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -5115,15 +5254,15 @@ async function validateEnvVars(options) {
   if (targetEnv) {
     const { loadEnv: loadEnv10 } = await import("@spfn/core/env/loader");
     const result = loadEnv10({ nodeEnv: targetEnv });
-    console.log(chalk30.blue.bold(`
-\u{1F50D} Validating environment variables for ${chalk30.cyan(targetEnv)}
+    console.log(chalk31.blue.bold(`
+\u{1F50D} Validating environment variables for ${chalk31.cyan(targetEnv)}
 `));
     if (result.loadedFiles.length > 0) {
-      console.log(chalk30.dim(`  Loaded: ${result.loadedFiles.join(", ")}`));
+      console.log(chalk31.dim(`  Loaded: ${result.loadedFiles.join(", ")}`));
     }
     console.log("");
   } else {
-    console.log(chalk30.blue.bold(`
+    console.log(chalk31.blue.bold(`
 \u{1F50D} Validating environment variables
 `));
   }
@@ -5131,7 +5270,7 @@ async function validateEnvVars(options) {
   const allWarnings = [];
   for (const packageName of packages) {
     try {
-      console.log(chalk30.dim(`  \u{1F4E6} ${packageName}`));
+      console.log(chalk31.dim(`  \u{1F4E6} ${packageName}`));
       const envSchema = await loadEnvSchema(packageName);
       const { createEnvRegistry } = await import("@spfn/core/env");
       const registry = createEnvRegistry(envSchema);
@@ -5144,10 +5283,10 @@ async function validateEnvVars(options) {
       }
     } catch (error) {
       if (error instanceof Error && error.message.includes("does not export envSchema")) {
-        console.log(chalk30.dim(`    \u23ED\uFE0F  No envSchema exported, skipping`));
+        console.log(chalk31.dim(`    \u23ED\uFE0F  No envSchema exported, skipping`));
         continue;
       }
-      console.error(chalk30.red(`    \u274C Failed to load: ${error instanceof Error ? error.message : String(error)}`));
+      console.error(chalk31.red(`    \u274C Failed to load: ${error instanceof Error ? error.message : String(error)}`));
       if (options.strict) {
         process.exit(1);
       }
@@ -5155,32 +5294,32 @@ async function validateEnvVars(options) {
   }
   console.log("");
   if (allErrors.length > 0) {
-    console.log(chalk30.red.bold(`\u274C Validation Errors (${allErrors.length}):
+    console.log(chalk31.red.bold(`\u274C Validation Errors (${allErrors.length}):
 `));
     for (const error of allErrors) {
-      console.log(`  ${chalk30.red("\u2717")} ${chalk30.cyan(error.key)}`);
-      console.log(`    ${chalk30.dim(error.message)}`);
-      console.log(`    ${chalk30.dim(`from ${error.package}`)}`);
+      console.log(`  ${chalk31.red("\u2717")} ${chalk31.cyan(error.key)}`);
+      console.log(`    ${chalk31.dim(error.message)}`);
+      console.log(`    ${chalk31.dim(`from ${error.package}`)}`);
       console.log("");
     }
   }
   if (allWarnings.length > 0) {
-    console.log(chalk30.yellow.bold(`\u26A0\uFE0F  Warnings (${allWarnings.length}):
+    console.log(chalk31.yellow.bold(`\u26A0\uFE0F  Warnings (${allWarnings.length}):
 `));
     for (const warning of allWarnings) {
-      console.log(`  ${chalk30.yellow("\u26A0")} ${chalk30.cyan(warning.key)}`);
-      console.log(`    ${chalk30.dim(warning.message)}`);
+      console.log(`  ${chalk31.yellow("\u26A0")} ${chalk31.cyan(warning.key)}`);
+      console.log(`    ${chalk31.dim(warning.message)}`);
       console.log("");
     }
   }
   if (allErrors.length === 0 && allWarnings.length === 0) {
-    console.log(chalk30.green.bold("\u2705 All environment variables are valid!\n"));
+    console.log(chalk31.green.bold("\u2705 All environment variables are valid!\n"));
   } else if (allErrors.length === 0) {
-    console.log(chalk30.green("\u2705 No errors found."));
-    console.log(chalk30.yellow(`\u26A0\uFE0F  ${allWarnings.length} warning(s) found.
+    console.log(chalk31.green("\u2705 No errors found."));
+    console.log(chalk31.yellow(`\u26A0\uFE0F  ${allWarnings.length} warning(s) found.
 `));
   } else {
-    console.log(chalk30.red(`
+    console.log(chalk31.red(`
 \u274C Validation failed with ${allErrors.length} error(s)
 `));
     process.exit(1);
@@ -5189,12 +5328,12 @@ async function validateEnvVars(options) {
 envCommand.command("validate").description("Validate environment variables against schema (for CI/CD)").option("-p, --packages <packages...>", "Packages to validate", ["@spfn/core"]).option("-e, --env <environment>", "Load env files for specific environment before validating").option("-s, --strict", "Exit on any error (including load failures)").action(validateEnvVars);
 
 // src/commands/secret/index.ts
-import { Command as Command12 } from "commander";
+import { Command as Command13 } from "commander";
 
 // src/commands/secret/set.ts
 init_logger();
 import prompts9 from "prompts";
-import chalk31 from "chalk";
+import chalk32 from "chalk";
 
 // src/commands/secret/options.ts
 init_logger();
@@ -5209,34 +5348,34 @@ function resolveEnv(env9) {
 
 // src/commands/secret/store-value.ts
 init_logger();
-import { join as join25 } from "path";
+import { join as join27 } from "path";
 init_env_file();
 
 // src/utils/sops.ts
-import { execa as execa10 } from "execa";
-import { existsSync as existsSync27, mkdirSync as mkdirSync3, writeFileSync as writeFileSync17 } from "fs";
-import { dirname as dirname3 } from "path";
+import { execa as execa11 } from "execa";
+import { existsSync as existsSync29, mkdirSync as mkdirSync5, writeFileSync as writeFileSync18 } from "fs";
+import { dirname as dirname4 } from "path";
 async function ensureSopsInstalled() {
   try {
-    await execa10("sops", ["--version"]);
+    await execa11("sops", ["--version"]);
   } catch {
     throw new Error("`sops` not found on PATH. Install it: https://github.com/getsops/sops");
   }
 }
 async function sopsDecrypt(absFile) {
-  if (!existsSync27(absFile)) {
+  if (!existsSync29(absFile)) {
     return {};
   }
-  const { stdout } = await execa10("sops", ["--decrypt", "--output-type", "json", absFile]);
+  const { stdout } = await execa11("sops", ["--decrypt", "--output-type", "json", absFile]);
   return JSON.parse(stdout);
 }
 async function sopsSetValue(absFile, relFile, key, value) {
-  if (existsSync27(absFile)) {
-    await execa10("sops", ["set", absFile, `["${key}"]`, JSON.stringify(value)]);
+  if (existsSync29(absFile)) {
+    await execa11("sops", ["set", absFile, `["${key}"]`, JSON.stringify(value)]);
     return;
   }
-  mkdirSync3(dirname3(absFile), { recursive: true });
-  const { stdout } = await execa10(
+  mkdirSync5(dirname4(absFile), { recursive: true });
+  const { stdout } = await execa11(
     "sops",
     [
       "--encrypt",
@@ -5250,27 +5389,27 @@ async function sopsSetValue(absFile, relFile, key, value) {
     ],
     { input: JSON.stringify({ [key]: value }) }
   );
-  writeFileSync17(absFile, stdout);
+  writeFileSync18(absFile, stdout);
 }
 async function sopsUpdateKeys(absFile) {
-  await execa10("sops", ["updatekeys", "-y", absFile]);
+  await execa11("sops", ["updatekeys", "-y", absFile]);
 }
 
 // src/utils/secret-config.ts
-import { existsSync as existsSync28, readdirSync as readdirSync3 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync30, readdirSync as readdirSync3 } from "fs";
+import { join as join26 } from "path";
 var SECRETS_DIR = "secrets";
 function getSopsFile(cwd, env9) {
   const relFile = `${SECRETS_DIR}/${env9}.enc.json`;
-  return { absFile: join24(cwd, relFile), relFile };
+  return { absFile: join26(cwd, relFile), relFile };
 }
 function findUp(cwd, filename, maxDepth = 6) {
   let dir = cwd;
   for (let depth = 0; depth < maxDepth; depth++) {
-    if (existsSync28(join24(dir, filename))) {
+    if (existsSync30(join26(dir, filename))) {
       return dir;
     }
-    const parent = join24(dir, "..");
+    const parent = join26(dir, "..");
     if (parent === dir) {
       break;
     }
@@ -5280,17 +5419,17 @@ function findUp(cwd, filename, maxDepth = 6) {
 }
 function findSopsConfig(cwd) {
   const dir = findUp(cwd, ".sops.yaml");
-  return dir ? join24(dir, ".sops.yaml") : null;
+  return dir ? join26(dir, ".sops.yaml") : null;
 }
 function hasSopsConfig(cwd) {
   return findSopsConfig(cwd) !== null;
 }
 function listSopsFiles(cwd) {
-  const dir = join24(cwd, SECRETS_DIR);
-  if (!existsSync28(dir)) {
+  const dir = join26(cwd, SECRETS_DIR);
+  if (!existsSync30(dir)) {
     return [];
   }
-  return readdirSync3(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join24(dir, name));
+  return readdirSync3(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join26(dir, name));
 }
 
 // src/commands/secret/store-value.ts
@@ -5319,7 +5458,7 @@ async function storeSecret(cwd, env9, key, value) {
       );
     }
     await store.set(keychainName(key), value);
-    const serverEnvPath = join25(cwd, ".env.server");
+    const serverEnvPath = join27(cwd, ".env.server");
     const result = upsertEnvVar(serverEnvPath, key, keychainRef(key));
     restrictEnvFilePerms(serverEnvPath);
     ensureGitignored(cwd, [{ pattern: ".env.server", comment: "spfn server env (secrets)" }]);
@@ -5350,7 +5489,7 @@ async function secretSet(key, options) {
   const { value } = await prompts9({
     type: "password",
     name: "value",
-    message: `Value for ${chalk31.cyan(resolvedKey)} (${env9})`
+    message: `Value for ${chalk32.cyan(resolvedKey)} (${env9})`
   });
   if (!value) {
     logger.warn("Cancelled \u2014 no value entered.");
@@ -5399,7 +5538,7 @@ async function warnIfNotSecret(pkg, key) {
 
 // src/commands/secret/list.ts
 init_logger();
-import chalk32 from "chalk";
+import chalk33 from "chalk";
 async function secretList(options) {
   const env9 = resolveEnv(options.env);
   const pkg = options.package ?? "@spfn/core";
@@ -5415,12 +5554,12 @@ async function secretList(options) {
     return;
   }
   const present = await loadPresence(env9, entries);
-  console.log(chalk32.blue.bold(`
+  console.log(chalk33.blue.bold(`
 \u{1F511} Secrets (${pkg}) \u2014 ${env9}
 `));
   for (const entry of entries) {
     const status = statusOf(entry, present.has(entry.key));
-    console.log(`  ${badge(status)} ${chalk32.cyan(entry.key)}${entry.generate ? chalk32.dim(" (generatable)") : ""}`);
+    console.log(`  ${badge(status)} ${chalk33.cyan(entry.key)}${entry.generate ? chalk33.dim(" (generatable)") : ""}`);
   }
   console.log();
 }
@@ -5453,17 +5592,17 @@ function statusOf(entry, present) {
 function badge(status) {
   switch (status) {
     case "set":
-      return chalk32.green("\u25CF");
+      return chalk33.green("\u25CF");
     case "missing":
-      return chalk32.yellow("\u25CB");
+      return chalk33.yellow("\u25CB");
     case "awaiting-input":
-      return chalk32.red("\u25CB");
+      return chalk33.red("\u25CB");
   }
 }
 
 // src/commands/secret/generate.ts
 init_logger();
-import chalk33 from "chalk";
+import chalk34 from "chalk";
 async function secretGenerate(key, options) {
   const env9 = resolveEnv(options.env);
   const pkg = options.package ?? "@spfn/core";
@@ -5501,7 +5640,7 @@ function requireGeneratable(schema, key) {
     process.exit(1);
   }
   if (!entry.generate) {
-    logger.error(`${chalk33.cyan(key)} has no generate strategy \u2014 it's an external value. Use \`spfn secret set ${key}\`.`);
+    logger.error(`${chalk34.cyan(key)} has no generate strategy \u2014 it's an external value. Use \`spfn secret set ${key}\`.`);
     process.exit(1);
   }
   return entry;
@@ -5509,7 +5648,7 @@ function requireGeneratable(schema, key) {
 
 // src/commands/secret/rotate.ts
 init_logger();
-import chalk34 from "chalk";
+import chalk35 from "chalk";
 async function secretRotate(key, options) {
   const env9 = resolveEnv(options.env);
   const pkg = options.package ?? "@spfn/core";
@@ -5535,7 +5674,7 @@ async function secretRotate(key, options) {
     }
   }
   for (const entry of external) {
-    logger.warn(`${chalk34.cyan(entry.key)} is external \u2014 reissue it at the provider, then \`spfn secret set ${entry.key} --env ${env9}\`.`);
+    logger.warn(`${chalk35.cyan(entry.key)} is external \u2014 reissue it at the provider, then \`spfn secret set ${entry.key} --env ${env9}\`.`);
   }
   if (generatable.length > 0) {
     logger.info("Rotation updates the source only \u2014 commit and deploy to apply.");
@@ -5556,17 +5695,17 @@ function requireEntry(schema, key) {
 
 // src/commands/secret/keygen.ts
 init_logger();
-import { execa as execa11 } from "execa";
-import { existsSync as existsSync29, mkdirSync as mkdirSync4 } from "fs";
+import { execa as execa12 } from "execa";
+import { existsSync as existsSync31, mkdirSync as mkdirSync6 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname4, join as join26 } from "path";
-import chalk35 from "chalk";
+import { dirname as dirname5, join as join28 } from "path";
+import chalk36 from "chalk";
 function ageKeyFile() {
-  return process.env.SOPS_AGE_KEY_FILE ?? join26(homedir(), ".config", "sops", "age", "keys.txt");
+  return process.env.SOPS_AGE_KEY_FILE ?? join28(homedir(), ".config", "sops", "age", "keys.txt");
 }
 async function ensureAgeInstalled() {
   try {
-    await execa11("age-keygen", ["--version"]);
+    await execa12("age-keygen", ["--version"]);
   } catch {
     throw new Error("`age-keygen` not found on PATH. Install age: https://github.com/FiloSottile/age");
   }
@@ -5582,14 +5721,14 @@ async function secretKeygen() {
     process.exit(1);
   }
   const keyFile = ageKeyFile();
-  if (existsSync29(keyFile)) {
-    const { stdout } = await execa11("age-keygen", ["-y", keyFile]);
+  if (existsSync31(keyFile)) {
+    const { stdout } = await execa12("age-keygen", ["-y", keyFile]);
     logger.warn(`age key file already exists: ${keyFile}`);
     printPublicKeys(publicKeys(stdout));
     return;
   }
-  mkdirSync4(dirname4(keyFile), { recursive: true });
-  const { stderr } = await execa11("age-keygen", ["-o", keyFile]);
+  mkdirSync6(dirname5(keyFile), { recursive: true });
+  const { stderr } = await execa12("age-keygen", ["-o", keyFile]);
   logger.success(`Created age key: ${keyFile}`);
   printPublicKeys(publicKeys(stderr));
 }
@@ -5598,27 +5737,27 @@ function printPublicKeys(keys) {
     logger.warn("Could not read the public key \u2014 run `age-keygen -y <file>` manually.");
     return;
   }
-  console.log(chalk35.bold("\nPublic key(s):"));
+  console.log(chalk36.bold("\nPublic key(s):"));
   for (const key of keys) {
-    console.log(`  ${chalk35.cyan(key)}`);
+    console.log(`  ${chalk36.cyan(key)}`);
   }
-  console.log(chalk35.dim("\nRegister it as a recipient:"));
-  console.log(chalk35.dim(`  spfn secret recipients add ${keys[0]}
+  console.log(chalk36.dim("\nRegister it as a recipient:"));
+  console.log(chalk36.dim(`  spfn secret recipients add ${keys[0]}
 `));
 }
 
 // src/commands/secret/recipients.ts
 init_logger();
-import { existsSync as existsSync30, readFileSync as readFileSync13, writeFileSync as writeFileSync18 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync32, readFileSync as readFileSync13, writeFileSync as writeFileSync19 } from "fs";
+import { join as join29 } from "path";
 import { parse as parse3, stringify } from "yaml";
-import chalk36 from "chalk";
+import chalk37 from "chalk";
 var SOPS_CONFIG = ".sops.yaml";
 var DEFAULT_PATH_REGEX = "secrets/.*\\.enc\\.json$";
 var AGE_RECIPIENT = /^age1[0-9a-z]+$/;
 async function secretRecipients(action, key, _options) {
   const cwd = process.cwd();
-  const configPath = join27(cwd, SOPS_CONFIG);
+  const configPath = join29(cwd, SOPS_CONFIG);
   if (action === "list") {
     listRecipients(configPath);
     return;
@@ -5645,30 +5784,30 @@ async function secretRecipients(action, key, _options) {
     logger.warn("Removing a recipient does not revoke values they already decrypted \u2014 rotate those values.");
   }
   rule.age = [...recipients].join(",");
-  writeFileSync18(configPath, stringify(config));
+  writeFileSync19(configPath, stringify(config));
   logger.success(`${action === "add" ? "Added" : "Removed"} recipient; updated ${SOPS_CONFIG}.`);
   await reencrypt(cwd);
 }
 function listRecipients(configPath) {
-  if (!existsSync30(configPath)) {
+  if (!existsSync32(configPath)) {
     logger.info(`No ${SOPS_CONFIG} found.`);
     return;
   }
   const config = loadConfig(configPath);
   const rules = config.creation_rules ?? [];
-  console.log(chalk36.blue.bold(`
+  console.log(chalk37.blue.bold(`
 \u{1F465} Recipients (${SOPS_CONFIG})
 `));
   for (const rule of rules) {
-    console.log(chalk36.dim(`  ${rule.path_regex ?? "(any path)"}`));
+    console.log(chalk37.dim(`  ${rule.path_regex ?? "(any path)"}`));
     for (const recipient of parseRecipients(rule.age)) {
-      console.log(`    ${chalk36.cyan(recipient)}`);
+      console.log(`    ${chalk37.cyan(recipient)}`);
     }
   }
   console.log();
 }
 function loadConfig(configPath) {
-  if (!existsSync30(configPath)) {
+  if (!existsSync32(configPath)) {
     return { creation_rules: [] };
   }
   return parse3(readFileSync13(configPath, "utf-8")) ?? { creation_rules: [] };
@@ -5703,8 +5842,8 @@ async function reencrypt(cwd) {
 
 // src/commands/secret/check.ts
 init_logger();
-import { join as join28 } from "path";
-import chalk37 from "chalk";
+import { join as join30 } from "path";
+import chalk38 from "chalk";
 init_env_file();
 var COMMITTED_FILES = [".env", ".env.example"];
 var PLACEHOLDER = /(your-|changeme|placeholder|example|<.*>)/i;
@@ -5722,35 +5861,35 @@ async function secretCheck(options) {
   const issues = [];
   const warnings = [];
   for (const file of COMMITTED_FILES) {
-    const parsed = parseEnvFile(join28(cwd, file));
+    const parsed = parseEnvFile(join30(cwd, file));
     for (const [key, value] of Object.entries(parsed)) {
       if (secretKeys.has(key) && value.length > 0 && !PLACEHOLDER.test(value)) {
-        issues.push(`${chalk37.cyan(key)} has a real value in committed ${chalk37.yellow(file)} \u2014 move it to the keychain/SOPS.`);
+        issues.push(`${chalk38.cyan(key)} has a real value in committed ${chalk38.yellow(file)} \u2014 move it to the keychain/SOPS.`);
       }
     }
   }
-  const serverEnv = parseEnvFile(join28(cwd, ".env.server"));
+  const serverEnv = parseEnvFile(join30(cwd, ".env.server"));
   for (const key of secretKeys) {
     const value = serverEnv[key];
     if (value && !value.startsWith(KEYCHAIN_REF_PREFIX)) {
-      warnings.push(`${chalk37.cyan(key)} is plaintext in .env.server \u2014 run \`spfn secret set ${key}\` to move it to the keychain.`);
+      warnings.push(`${chalk38.cyan(key)} is plaintext in .env.server \u2014 run \`spfn secret set ${key}\` to move it to the keychain.`);
     }
   }
   report(issues, warnings, cwd);
 }
 function report(issues, warnings, cwd) {
-  console.log(chalk37.blue.bold("\n\u{1F50D} Secret hygiene check\n"));
+  console.log(chalk38.blue.bold("\n\u{1F50D} Secret hygiene check\n"));
   for (const issue of issues) {
-    console.log(`  ${chalk37.red("\u2717")} ${issue}`);
+    console.log(`  ${chalk38.red("\u2717")} ${issue}`);
   }
   for (const warning of warnings) {
-    console.log(`  ${chalk37.yellow("\u26A0")} ${warning}`);
+    console.log(`  ${chalk38.yellow("\u26A0")} ${warning}`);
   }
   if (!hasSopsConfig(cwd)) {
-    console.log(`  ${chalk37.dim("\u2139 no .sops.yaml \u2014 prod secrets need a backend (spfn secret keygen, or add a KMS rule)")}`);
+    console.log(`  ${chalk38.dim("\u2139 no .sops.yaml \u2014 prod secrets need a backend (spfn secret keygen, or add a KMS rule)")}`);
   }
   if (issues.length === 0 && warnings.length === 0) {
-    console.log(chalk37.green("  \u2713 No plaintext secret leaks found."));
+    console.log(chalk38.green("  \u2713 No plaintext secret leaks found."));
   }
   console.log();
   if (issues.length > 0) {
@@ -5761,7 +5900,7 @@ function report(issues, warnings, cwd) {
 // src/commands/secret/index.ts
 var ENV_OPTION = ["-e, --env <env>", "Target environment (local | development | staging | production)", "local"];
 var PKG_OPTION = ["-p, --package <package>", "Package whose env schema to read", "@spfn/core"];
-var secretCommand = new Command12("secret").description("Manage secrets: keychain locally, SOPS (age / GCP KMS / AWS KMS) for deployed environments");
+var secretCommand = new Command13("secret").description("Manage secrets: keychain locally, SOPS (age / GCP KMS / AWS KMS) for deployed environments");
 secretCommand.command("set [key]").description("Store a secret value (prompts for the value, masked)").option(...ENV_OPTION).option(...PKG_OPTION).action(secretSet);
 secretCommand.command("list").description("List declared secrets and their status (never prints values)").option(...ENV_OPTION).option(...PKG_OPTION).action(secretList);
 secretCommand.command("generate [key]").description("Generate value(s) for schema secrets that declare a generate strategy").option("-a, --all", "Generate every generatable secret").option(...ENV_OPTION).option(...PKG_OPTION).action(secretGenerate);
@@ -5772,7 +5911,7 @@ secretCommand.command("check").description("Static hygiene lint \u2014 flag plai
 
 // src/index.ts
 init_version();
-var program = new Command13();
+var program = new Command14();
 program.name("spfn").description("SPFN CLI - The Missing Backend for Next.js").version(getCliVersion());
 program.addCommand(createCommand);
 program.addCommand(initCommand);
@@ -5780,6 +5919,7 @@ program.addCommand(addCommand);
 program.addCommand(devCommand);
 program.addCommand(buildCommand);
 program.addCommand(startCommand);
+program.addCommand(provisionCommand);
 program.addCommand(codegenCommand);
 program.addCommand(keyCommand);
 program.addCommand(setupCommand);