spfn 0.2.0-beta.65 → 0.2.0-beta.67

package/dist/index.js

@@ -922,7 +922,7 @@ var init_deployment_config = __esm({
 
 // src/utils/version.ts
 function getCliVersion() {
-  return "0.2.0-beta.65";
+  return "0.2.0-beta.67";
 }
 function getTagFromVersion(version) {
   const match = version.match(/-([a-z]+)\./i);
@@ -1860,7 +1860,7 @@ var init_migration_status = __esm({
 });
 
 // src/index.ts
-import { Command as Command14 } from "commander";
+import { Command as Command15 } from "commander";
 
 // src/commands/create.ts
 init_logger();
@@ -2647,13 +2647,18 @@ async function buildProject(options) {
       const orchestrator = new CodegenOrchestrator({
         generators,
         cwd,
-        debug: true
+        debug: true,
+        // A generator that refuses at build time — a broken route contract,
+        // a router that will not load — must reach the exit code rather
+        // than scroll past while the build ships anyway.
+        throwOnError: true
       });
-      await orchestrator.generateAll();
+      await orchestrator.generateAll("build");
       spinner.succeed("API client generated");
     } catch (error) {
-      spinner.warn("API client generation failed (non-critical)");
-      logger.warn(String(error));
+      spinner.fail("Code generation failed");
+      logger.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
     }
   }
   if (hasNext && !options.serverOnly) {
@@ -3054,11 +3059,123 @@ codegenCommand.command("init").description("Initialize .spfnrc.ts with codegen c
 codegenCommand.command("list").alias("ls").description("List registered code generators").action(listGenerators);
 codegenCommand.command("run").description("Run code generators once (no watch mode)").action(runGenerators);
 
-// src/commands/key.ts
+// src/commands/contract.ts
 init_logger();
 import { Command as Command9 } from "commander";
-import { execSync } from "child_process";
+import { join as join22 } from "path";
 import chalk11 from "chalk";
+async function resolveContractsDir(cwd, override) {
+  if (override) {
+    return join22(cwd, override);
+  }
+  const { loadCodegenConfig } = await import("@spfn/core/codegen");
+  const config = loadCodegenConfig(cwd);
+  const generator = config.generators?.find(
+    (entry) => "name" in entry && entry.name === "@spfn/core:contract"
+  );
+  return join22(cwd, generator?.outputDir ?? "./contracts");
+}
+async function regenerate(cwd) {
+  const { loadCodegenConfig, createGeneratorsFromConfig, CodegenOrchestrator } = await import("@spfn/core/codegen");
+  const config = loadCodegenConfig(cwd);
+  const generators = (await createGeneratorsFromConfig(config, cwd)).filter((generator) => generator.name === "@spfn/core:contract");
+  if (generators.length === 0) {
+    throw new Error(
+      "No @spfn/core:contract generator is configured in .spfnrc.ts.\nAdd one with the router path before using contract commands."
+    );
+  }
+  const orchestrator = new CodegenOrchestrator({ generators, cwd, throwOnError: true });
+  await orchestrator.generateAll("manual");
+}
+async function checkContractCommand(options) {
+  const cwd = process.cwd();
+  try {
+    await regenerate(cwd);
+    const { checkContract, formatViolations, readCurrentDocument } = await import("@spfn/core/contract");
+    const contractsDir = await resolveContractsDir(cwd, options.dir);
+    const result = checkContract(contractsDir, readCurrentDocument(contractsDir));
+    for (const warning of result.warnings) {
+      logger.warn(warning);
+    }
+    if (result.violations.length > 0) {
+      console.log("\n" + chalk11.red.bold(`\u2717 Breaks the contract released as ${result.baselineVersion}
+`));
+      console.log(formatViolations(result.violations));
+      console.log("");
+      process.exit(1);
+    }
+    const against = result.baselineVersion ? `backward compatible with released ${result.baselineVersion}` : "generated (nothing released to compare against yet)";
+    console.log("\n" + chalk11.green.bold(`\u2713 Contract ${against}
+`));
+  } catch (error) {
+    logger.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+}
+async function releaseContractCommand(version, options) {
+  const cwd = process.cwd();
+  try {
+    await regenerate(cwd);
+    const {
+      checkContract,
+      formatViolations,
+      readCurrentDocument,
+      writeSnapshot
+    } = await import("@spfn/core/contract");
+    const contractsDir = await resolveContractsDir(cwd, options.dir);
+    const document = readCurrentDocument(contractsDir);
+    const result = checkContract(contractsDir, document);
+    if (result.violations.length > 0) {
+      console.log("\n" + chalk11.red.bold(`\u2717 Cannot release: breaks the contract released as ${result.baselineVersion}
+`));
+      console.log(formatViolations(result.violations));
+      console.log("");
+      process.exit(1);
+    }
+    for (const warning of result.warnings) {
+      logger.warn(warning);
+    }
+    const file = writeSnapshot(contractsDir, version, document);
+    console.log("\n" + chalk11.green.bold(`\u2713 Released contract ${version}
+`));
+    console.log(chalk11.gray(`  ${file}`));
+    console.log(chalk11.gray(`  ${document.operations.length} operation(s)`));
+    console.log(chalk11.yellow("\n  Commit this snapshot. The gate compares every later build against it.\n"));
+  } catch (error) {
+    logger.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+}
+async function listContractCommand(options) {
+  const cwd = process.cwd();
+  try {
+    const { listSnapshots } = await import("@spfn/core/contract");
+    const contractsDir = await resolveContractsDir(cwd, options.dir);
+    const snapshots = listSnapshots(contractsDir);
+    if (snapshots.length === 0) {
+      logger.info("No released contract snapshot yet");
+      return;
+    }
+    console.log("\n" + chalk11.bold("Released contracts:"));
+    for (const snapshot of snapshots) {
+      console.log(`  ${chalk11.cyan(snapshot.version)}  ${chalk11.gray(snapshot.file)}`);
+    }
+    console.log("");
+  } catch (error) {
+    logger.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+}
+var contractCommand = new Command9("contract").description("Route contract management (what separately deployed clients are promised)");
+contractCommand.command("check").description("Regenerate the contract and compare it against the newest released snapshot").option("--dir <path>", "Contracts directory (default: from .spfnrc.ts)").action(checkContractCommand);
+contractCommand.command("release <version>").description("Write contracts/released/<version>.json \u2014 required for every release").option("--dir <path>", "Contracts directory (default: from .spfnrc.ts)").action(releaseContractCommand);
+contractCommand.command("list").alias("ls").description("List released contract snapshots").option("--dir <path>", "Contracts directory (default: from .spfnrc.ts)").action(listContractCommand);
+
+// src/commands/key.ts
+init_logger();
+import { Command as Command10 } from "commander";
+import { execSync } from "child_process";
+import chalk12 from "chalk";
 
 // src/utils/secret-gen.ts
 import { randomBytes as randomBytes2, randomUUID } from "crypto";
@@ -3133,44 +3250,44 @@ function copyToClipboard(text) {
 function generateSecret(bytes, preset, envVarName, copy) {
   const key = randomBase64Url(bytes);
   const config = preset ? PRESETS[preset] : null;
-  console.log("\n" + chalk11.green.bold("\u2713 Generated secret key:"));
+  console.log("\n" + chalk12.green.bold("\u2713 Generated secret key:"));
   if (config) {
-    console.log(chalk11.dim(`  ${config.description} (${bytes * 8} bits)`));
+    console.log(chalk12.dim(`  ${config.description} (${bytes * 8} bits)`));
   } else {
-    console.log(chalk11.dim(`  ${bytes * 8}-bit secret`));
+    console.log(chalk12.dim(`  ${bytes * 8}-bit secret`));
   }
-  console.log("\n" + chalk11.cyan(key) + "\n");
+  console.log("\n" + chalk12.cyan(key) + "\n");
   const varName = envVarName || config?.envVar || "SECRET_KEY";
-  console.log(chalk11.dim("Add to your .env file:"));
-  console.log(chalk11.yellow(`${varName}=${key}
+  console.log(chalk12.dim("Add to your .env file:"));
+  console.log(chalk12.yellow(`${varName}=${key}
 `));
   if (config?.usage) {
-    console.log(chalk11.dim("Usage:"));
-    console.log(chalk11.gray(`  ${config.usage}
+    console.log(chalk12.dim("Usage:"));
+    console.log(chalk12.gray(`  ${config.usage}
 `));
   }
   if (copy) {
     if (copyToClipboard(key)) {
-      console.log(chalk11.green("\u2713 Copied to clipboard!\n"));
+      console.log(chalk12.green("\u2713 Copied to clipboard!\n"));
     } else {
       logger.warn("Could not copy to clipboard");
     }
   }
 }
 function listPresets() {
-  console.log("\n" + chalk11.bold("Available presets:"));
+  console.log("\n" + chalk12.bold("Available presets:"));
   console.log();
   Object.entries(PRESETS).forEach(([name, config]) => {
-    console.log(`  ${chalk11.cyan(name.padEnd(20))} ${chalk11.dim(config.description)}`);
-    console.log(`  ${" ".repeat(20)} ${chalk11.gray(`\u2192 ${config.envVar} (${config.bytes * 8} bits)`)}`);
+    console.log(`  ${chalk12.cyan(name.padEnd(20))} ${chalk12.dim(config.description)}`);
+    console.log(`  ${" ".repeat(20)} ${chalk12.gray(`\u2192 ${config.envVar} (${config.bytes * 8} bits)`)}`);
     console.log();
   });
-  console.log(chalk11.dim("Usage:"));
-  console.log(chalk11.gray("  spfn key <preset>"));
-  console.log(chalk11.gray("  spfn key auth-encryption --copy"));
+  console.log(chalk12.dim("Usage:"));
+  console.log(chalk12.gray("  spfn key <preset>"));
+  console.log(chalk12.gray("  spfn key auth-encryption --copy"));
   console.log();
 }
-var generateValueCommand = new Command9("generate").alias("gen").description("Generate random value (simple output, no metadata)").option("-b, --bytes <number>", "Number of random bytes", "32").option("-c, --copy", "Copy to clipboard").action((options) => {
+var generateValueCommand = new Command10("generate").alias("gen").description("Generate random value (simple output, no metadata)").option("-b, --bytes <number>", "Number of random bytes", "32").option("-c, --copy", "Copy to clipboard").action((options) => {
   const bytes = parseInt(options.bytes, 10);
   if (isNaN(bytes) || bytes < 1 || bytes > 128) {
     logger.error("Invalid bytes value. Must be between 1 and 128.");
@@ -3180,13 +3297,13 @@ var generateValueCommand = new Command9("generate").alias("gen").description("Ge
   console.log(value);
   if (options.copy) {
     if (copyToClipboard(value)) {
-      console.error(chalk11.green("\u2713 Copied to clipboard"));
+      console.error(chalk12.green("\u2713 Copied to clipboard"));
     } else {
-      console.error(chalk11.yellow("\u26A0 Could not copy to clipboard"));
+      console.error(chalk12.yellow("\u26A0 Could not copy to clipboard"));
     }
   }
 });
-var keyCommand = new Command9("key").alias("k").description("Generate secure random keys and secrets").argument("[preset]", `Preset type (use --list to see all)`).option("-l, --list", "List all available presets").option("-b, --bytes <number>", "Number of random bytes to generate", "32").option("-e, --env <name>", "Environment variable name").option("-c, --copy", "Copy to clipboard").action((preset, options) => {
+var keyCommand = new Command10("key").alias("k").description("Generate secure random keys and secrets").argument("[preset]", `Preset type (use --list to see all)`).option("-l, --list", "List all available presets").option("-b, --bytes <number>", "Number of random bytes to generate", "32").option("-e, --env <name>", "Environment variable name").option("-c, --copy", "Copy to clipboard").action((preset, options) => {
   if (options.list) {
     listPresets();
     return;
@@ -3200,9 +3317,9 @@ var keyCommand = new Command9("key").alias("k").description("Generate secure ran
     logger.error(`Unknown preset: ${preset}`);
     console.log("\nAvailable presets:");
     Object.entries(PRESETS).forEach(([name, config]) => {
-      console.log(`  ${chalk11.cyan(name)}: ${config.description}`);
+      console.log(`  ${chalk12.cyan(name)}: ${config.description}`);
     });
-    console.log("\nUse " + chalk11.cyan("--list") + " to see detailed information");
+    console.log("\nUse " + chalk12.cyan("--list") + " to see detailed information");
     process.exit(1);
   }
   generateSecret(
@@ -3218,16 +3335,16 @@ keyCommand.addCommand(generateValueCommand);
 init_setup();
 
 // src/commands/db/index.ts
-import { Command as Command10 } from "commander";
+import { Command as Command11 } from "commander";
 
 // src/commands/db/generate.ts
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 
 // src/commands/db/utils/drizzle.ts
 import { existsSync as existsSync21, writeFileSync as writeFileSync14, unlinkSync as unlinkSync2 } from "fs";
 import { spawn } from "child_process";
 import { pathToFileURL as pathToFileURL2 } from "url";
-import chalk12 from "chalk";
+import chalk13 from "chalk";
 import ora6 from "ora";
 import { env as env3 } from "@spfn/core/config";
 import { loadEnv as loadEnv3 } from "@spfn/core/server";
@@ -3285,8 +3402,8 @@ function resolvePushConnectionConfig(databaseUrl) {
 function validateDatabasePrerequisites() {
   loadEnv3();
   if (!env3.DATABASE_URL) {
-    console.error(chalk12.red("\u274C DATABASE_URL not found in environment"));
-    console.log(chalk12.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+    console.error(chalk13.red("\u274C DATABASE_URL not found in environment"));
+    console.log(chalk13.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     throw new Error("DATABASE_URL is required for database operations");
   }
 }
@@ -3297,8 +3414,8 @@ async function runDrizzleCommand(command) {
   if (!hasUserConfig) {
     loadEnv3();
     if (!env3.DATABASE_URL) {
-      console.error(chalk12.red("\u274C DATABASE_URL not found in environment"));
-      console.log(chalk12.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+      console.error(chalk13.red("\u274C DATABASE_URL not found in environment"));
+      console.log(chalk13.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
       process.exit(1);
     }
     const { generateDrizzleConfigFile } = await import("@spfn/core/db");
@@ -3311,7 +3428,7 @@ async function runDrizzleCommand(command) {
       autoDetectSchemas: true
     });
     writeFileSync14(tempConfigPath, configContent);
-    console.log(chalk12.dim("Using auto-generated Drizzle config\n"));
+    console.log(chalk13.dim("Using auto-generated Drizzle config\n"));
   }
   const args = command.split(" ");
   args.push(`--config=${configPath}`);
@@ -3346,10 +3463,10 @@ async function runWithSpinner(spinnerText, command, successMessage, failMessage)
   try {
     spinner.stop();
     await runDrizzleCommand(command);
-    console.log(chalk12.green(`\u2705 ${successMessage}`));
+    console.log(chalk13.green(`\u2705 ${successMessage}`));
   } catch (error) {
     spinner.fail(failMessage);
-    console.error(chalk12.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk13.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
@@ -3395,16 +3512,16 @@ async function createPushConnection() {
 async function dbGenerate() {
   try {
     await runDrizzleCommand("generate");
-    console.log(chalk13.green("\n\u2705 Migrations generated successfully"));
+    console.log(chalk14.green("\n\u2705 Migrations generated successfully"));
   } catch (error) {
-    console.error(chalk13.red("\n\u274C Failed to generate migrations"));
-    console.error(chalk13.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk14.red("\n\u274C Failed to generate migrations"));
+    console.error(chalk14.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
 
 // src/commands/db/push.ts
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 import prompts4 from "prompts";
 import "@spfn/core/config";
 import { loadEnv as loadEnv4 } from "@spfn/core/server";
@@ -3451,7 +3568,7 @@ function classifyStatements(statements) {
 }
 
 // src/commands/db/utils/push-display.ts
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 function formatSql(sql2) {
   return sql2.replace(/\s+/g, " ").trim();
 }
@@ -3459,30 +3576,30 @@ function printStatements(statements, color) {
   for (const stmt of statements) {
     console.log(color(`   ${formatSql(stmt.sql)}`));
     if (stmt.reason) {
-      console.log(chalk14.dim(`   \u2192 ${stmt.reason}`));
+      console.log(chalk15.dim(`   \u2192 ${stmt.reason}`));
     }
   }
 }
 function displayClassifiedStatements(result) {
   if (result.safe.length > 0) {
-    console.log(chalk14.green(`
+    console.log(chalk15.green(`
 \u2705 Safe changes (${result.safe.length}):`));
-    printStatements(result.safe, chalk14.green);
+    printStatements(result.safe, chalk15.green);
   }
   if (result.warning.length > 0) {
-    console.log(chalk14.yellow(`
+    console.log(chalk15.yellow(`
 \u26A0\uFE0F  Warnings (${result.warning.length}):`));
-    printStatements(result.warning, chalk14.yellow);
+    printStatements(result.warning, chalk15.yellow);
   }
   if (result.destructive.length > 0) {
-    console.log(chalk14.red(`
+    console.log(chalk15.red(`
 \u274C Destructive changes (${result.destructive.length}):`));
-    printStatements(result.destructive, chalk14.red);
+    printStatements(result.destructive, chalk15.red);
   }
 }
 function displayDryRunSummary(result) {
   const total = result.safe.length + result.warning.length + result.destructive.length;
-  console.log(chalk14.cyan(`
+  console.log(chalk15.cyan(`
 \u{1F50D} Dry-run: ${total} statement(s) detected
 `));
   displayClassifiedStatements(result);
@@ -3490,11 +3607,11 @@ function displayDryRunSummary(result) {
 }
 function displayApplySummary(applied, skipped) {
   if (applied > 0) {
-    console.log(chalk14.green(`
+    console.log(chalk15.green(`
 \u2705 Applied ${applied} statement(s)`));
   }
   if (skipped > 0) {
-    console.log(chalk14.yellow(`\u23ED\uFE0F  Skipped ${skipped} destructive statement(s)`));
+    console.log(chalk15.yellow(`\u23ED\uFE0F  Skipped ${skipped} destructive statement(s)`));
   }
   console.log("");
 }
@@ -3539,10 +3656,10 @@ async function dbPush(options = {}) {
   });
   const schemaFiles = Array.isArray(config.schema) ? config.schema : [config.schema];
   if (schemaFiles.length === 0) {
-    console.log(chalk15.yellow("No schema files found."));
+    console.log(chalk16.yellow("No schema files found."));
     return;
   }
-  console.log(chalk15.dim(`Found ${schemaFiles.length} schema file(s)
+  console.log(chalk16.dim(`Found ${schemaFiles.length} schema file(s)
 `));
   const imports = await loadSchemaImports(schemaFiles);
   const detectedSchemas = new Set(config.schemaFilter ?? ["public"]);
@@ -3561,10 +3678,10 @@ async function dbPush(options = {}) {
   try {
     const { statements, hints } = await resolvePushPlan(imports, db, schemaFilter);
     for (const hint of hints) {
-      console.log(chalk15.yellow(`\u26A0\uFE0F  ${hint.hint}`));
+      console.log(chalk16.yellow(`\u26A0\uFE0F  ${hint.hint}`));
     }
     if (statements.length === 0) {
-      console.log(chalk15.green("\u2705 No changes detected \u2014 database is up to date\n"));
+      console.log(chalk16.green("\u2705 No changes detected \u2014 database is up to date\n"));
       await applyFunctionMigrations(functionPlans);
       return;
     }
@@ -3575,7 +3692,7 @@ async function dbPush(options = {}) {
     }
     displayClassifiedStatements(result);
     if (options.force) {
-      console.log(chalk15.dim("\n--force: applying all changes..."));
+      console.log(chalk16.dim("\n--force: applying all changes..."));
       await applyStatements(db, statements);
       displayApplySummary(statements.length, 0);
     } else if (result.destructive.length === 0) {
@@ -3584,11 +3701,11 @@ async function dbPush(options = {}) {
     } else {
       const destructiveSet = new Set(result.destructive.map((s) => s.sql));
       const nonDestructive = statements.filter((s) => !destructiveSet.has(s));
-      console.log(chalk15.red(`
+      console.log(chalk16.red(`
 \u274C ${result.destructive.length} destructive change(s) require confirmation:`));
       for (const stmt of result.destructive) {
-        console.log(chalk15.red(`   ${stmt.sql.replace(/\s+/g, " ").trim()}`));
-        console.log(chalk15.dim(`   \u2192 ${stmt.reason}`));
+        console.log(chalk16.red(`   ${stmt.sql.replace(/\s+/g, " ").trim()}`));
+        console.log(chalk16.dim(`   \u2192 ${stmt.reason}`));
       }
       const { confirm } = await prompts4({
         type: "confirm",
@@ -3604,7 +3721,7 @@ async function dbPush(options = {}) {
           await applyStatements(db, nonDestructive);
         }
         displayApplySummary(nonDestructive.length, result.destructive.length);
-        console.log(chalk15.dim("Tip: Use --force to apply all changes without prompting.\n"));
+        console.log(chalk16.dim("Tip: Use --force to apply all changes without prompting.\n"));
       }
     }
     await applyFunctionMigrations(functionPlans);
@@ -3617,8 +3734,8 @@ function loadFunctionPlansOrExit() {
   try {
     return loadFunctionMigrationPlans(functions);
   } catch (error) {
-    console.error(chalk15.red("\n\u274C Invalid function package migrations \u2014 nothing was applied"));
-    console.error(chalk15.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk16.red("\n\u274C Invalid function package migrations \u2014 nothing was applied"));
+    console.error(chalk16.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
@@ -3626,36 +3743,36 @@ async function applyFunctionMigrations(plans) {
   if (plans.length === 0) {
     return;
   }
-  console.log(chalk15.blue("\n\u{1F4E6} Applying function package migrations:"));
+  console.log(chalk16.blue("\n\u{1F4E6} Applying function package migrations:"));
   plans.forEach((plan) => {
-    console.log(chalk15.dim(`  - ${plan.packageName}`));
+    console.log(chalk16.dim(`  - ${plan.packageName}`));
   });
   try {
     await executeFunctionMigrations(plans);
-    console.log(chalk15.green("\n\u2705 All function migrations applied\n"));
+    console.log(chalk16.green("\n\u2705 All function migrations applied\n"));
   } catch (error) {
-    console.error(chalk15.red("\n\u274C Failed to apply function package migrations"));
-    console.error(chalk15.red(error instanceof Error ? error.message : "Unknown error"));
-    console.error(chalk15.yellow("Project schema changes (if any) were already applied \u2014 only function package migrations failed."));
+    console.error(chalk16.red("\n\u274C Failed to apply function package migrations"));
+    console.error(chalk16.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk16.yellow("Project schema changes (if any) were already applied \u2014 only function package migrations failed."));
     process.exit(1);
   }
 }
 
 // src/commands/db/migrate.ts
-import chalk20 from "chalk";
-import { join as join22 } from "path";
+import chalk21 from "chalk";
+import { join as join23 } from "path";
 import { existsSync as existsSync23 } from "fs";
 
 // src/commands/db/backup.ts
 import { promises as fs3 } from "fs";
 import path3 from "path";
 import { spawn as spawn2 } from "child_process";
-import chalk19 from "chalk";
+import chalk20 from "chalk";
 import ora7 from "ora";
 
 // src/commands/db/utils/database.ts
 import net from "net";
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 import prompts5 from "prompts";
 function parseDatabaseUrl2(dbUrl) {
   try {
@@ -3686,7 +3803,7 @@ async function confirmDangerousTarget(dbInfo) {
     message: `Remote/production database detected. Type the database name "${dbInfo.database}" to continue:`
   });
   if (typed !== dbInfo.database) {
-    console.log(chalk16.gray("Cancelled (database name mismatch)."));
+    console.log(chalk17.gray("Cancelled (database name mismatch)."));
     process.exit(0);
   }
 }
@@ -3739,14 +3856,14 @@ function formatTimestamp() {
 import { promises as fs2 } from "fs";
 import { existsSync as existsSync22 } from "fs";
 import path2 from "path";
-import chalk18 from "chalk";
+import chalk19 from "chalk";
 
 // src/commands/db/utils/metadata.ts
 import { promises as fs } from "fs";
 import path from "path";
 import { promisify } from "util";
 import { exec } from "child_process";
-import chalk17 from "chalk";
+import chalk18 from "chalk";
 var execAsync = promisify(exec);
 async function collectGitInfo() {
   try {
@@ -3809,7 +3926,7 @@ async function collectMigrationInfo(dbUrl) {
       await pool.end();
     }
   } catch (error) {
-    console.log(chalk17.dim("\u26A0\uFE0F  Could not fetch migration info"));
+    console.log(chalk18.dim("\u26A0\uFE0F  Could not fetch migration info"));
     return void 0;
   }
 }
@@ -3817,9 +3934,9 @@ async function saveBackupMetadata(metadata, backupFilename) {
   const metadataPath = backupFilename.replace(/\.(sql|dump)$/, ".meta.json");
   try {
     await fs.writeFile(metadataPath, JSON.stringify(metadata, null, 2));
-    console.log(chalk17.dim(`\u2713 Metadata saved: ${path.basename(metadataPath)}`));
+    console.log(chalk18.dim(`\u2713 Metadata saved: ${path.basename(metadataPath)}`));
   } catch (error) {
-    console.log(chalk17.dim("\u26A0\uFE0F  Could not save metadata"));
+    console.log(chalk18.dim("\u26A0\uFE0F  Could not save metadata"));
   }
 }
 async function loadBackupMetadata(backupFilename) {
@@ -3848,10 +3965,10 @@ async function ensureBackupInGitignore() {
     if (!hasBackupsIgnore) {
       const entry = exists && content && !content.endsWith("\n") ? "\n\n# Database backups\nbackups/\n" : "# Database backups\nbackups/\n";
       await fs2.appendFile(gitignorePath, entry);
-      console.log(chalk18.dim("\u2713 Added backups/ to .gitignore"));
+      console.log(chalk19.dim("\u2713 Added backups/ to .gitignore"));
     }
   } catch (error) {
-    console.log(chalk18.dim("\u26A0\uFE0F  Could not update .gitignore"));
+    console.log(chalk19.dim("\u26A0\uFE0F  Could not update .gitignore"));
   }
 }
 async function ensureBackupDir() {
@@ -3901,12 +4018,12 @@ async function listBackupFiles() {
 import { env as env4 } from "@spfn/core/config";
 import { loadEnv as loadEnv5 } from "@spfn/core/server";
 async function dbBackup(options) {
-  console.log(chalk19.blue("\u{1F4BE} Creating database backup...\n"));
+  console.log(chalk20.blue("\u{1F4BE} Creating database backup...\n"));
   loadEnv5();
   const dbUrl = env4.DATABASE_URL;
   if (!dbUrl) {
-    console.error(chalk19.red("\u274C DATABASE_URL not found in environment"));
-    console.log(chalk19.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+    console.error(chalk20.red("\u274C DATABASE_URL not found in environment"));
+    console.log(chalk20.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     process.exit(1);
   }
   const dbInfo = parseDatabaseUrl2(dbUrl);
@@ -3916,7 +4033,7 @@ async function dbBackup(options) {
   const ext = format === "sql" ? "sql" : "dump";
   const filename = options.output || path3.join(backupDir, `${dbInfo.database}_${timestamp}.${ext}`);
   if (options.dataOnly && options.schemaOnly) {
-    console.error(chalk19.red("\u274C Cannot use --data-only and --schema-only together"));
+    console.error(chalk20.red("\u274C Cannot use --data-only and --schema-only together"));
     process.exit(1);
   }
   const args = [
@@ -3962,11 +4079,11 @@ async function dbBackup(options) {
           const stats = await fs3.stat(filename);
           const size = formatBytes(stats.size);
           spinner.succeed("Backup created");
-          console.log(chalk19.green(`
+          console.log(chalk20.green(`
 \u2705 Backup created successfully`));
-          console.log(chalk19.gray(`   File: ${filename}`));
-          console.log(chalk19.gray(`   Size: ${size}`));
-          console.log(chalk19.dim("\n\u{1F4CB} Collecting metadata..."));
+          console.log(chalk20.gray(`   File: ${filename}`));
+          console.log(chalk20.gray(`   Size: ${size}`));
+          console.log(chalk20.dim("\n\u{1F4CB} Collecting metadata..."));
           const [gitInfo, migrationInfo] = await Promise.all([
             collectGitInfo(),
             collectMigrationInfo(dbUrl)
@@ -4006,11 +4123,11 @@ async function dbBackup(options) {
       reject(error);
     });
   }).catch((error) => {
-    console.error(chalk19.red("\n\u274C Failed to create backup"));
+    console.error(chalk20.red("\n\u274C Failed to create backup"));
     if (errorOutput.includes("pg_dump: command not found") || errorOutput.includes("not found")) {
-      console.error(chalk19.yellow("\n\u{1F4A1} pg_dump is not installed. Please install PostgreSQL client tools."));
+      console.error(chalk20.yellow("\n\u{1F4A1} pg_dump is not installed. Please install PostgreSQL client tools."));
     } else {
-      console.error(chalk19.red(error instanceof Error ? error.message : "Unknown error"));
+      console.error(chalk20.red(error instanceof Error ? error.message : "Unknown error"));
     }
     process.exit(1);
   });
@@ -4027,7 +4144,7 @@ async function dbMigrate(options = {}) {
     process.exit(1);
   }
   if (options.withBackup) {
-    console.log(chalk20.blue("\u{1F4E6} Creating pre-migration backup...\n"));
+    console.log(chalk21.blue("\u{1F4E6} Creating pre-migration backup...\n"));
     await dbBackup({
       format: "custom",
       tag: "pre-migration",
@@ -4040,40 +4157,40 @@ async function dbMigrate(options = {}) {
   const postgres = await import("postgres");
   loadEnv6();
   if (!env5.DATABASE_URL) {
-    console.error(chalk20.red("\u274C DATABASE_URL not found in environment"));
+    console.error(chalk21.red("\u274C DATABASE_URL not found in environment"));
     process.exit(1);
   }
   const { discoverFunctionMigrations: discoverFunctionMigrations2, loadFunctionMigrationPlans: loadFunctionMigrationPlans2, executeFunctionMigrations: executeFunctionMigrations2 } = await Promise.resolve().then(() => (init_function_migrations(), function_migrations_exports));
   const functions = discoverFunctionMigrations2(process.cwd());
   if (functions.length > 0) {
-    console.log(chalk20.blue("\u{1F4E6} Applying function package migrations:"));
+    console.log(chalk21.blue("\u{1F4E6} Applying function package migrations:"));
     functions.forEach((func) => {
-      console.log(chalk20.dim(`  - ${func.packageName}`));
+      console.log(chalk21.dim(`  - ${func.packageName}`));
     });
     await executeFunctionMigrations2(loadFunctionMigrationPlans2(functions));
-    console.log(chalk20.green("\u2705 Function migrations applied\n"));
+    console.log(chalk21.green("\u2705 Function migrations applied\n"));
   }
-  const projectMigrationsDir = join22(process.cwd(), "src/server/drizzle");
+  const projectMigrationsDir = join23(process.cwd(), "src/server/drizzle");
   if (existsSync23(projectMigrationsDir)) {
     const projConn = postgres.default(env5.DATABASE_URL, { max: 1 });
     const projDb = drizzle({ client: projConn });
     try {
-      console.log(chalk20.blue("\u{1F4E6} Running project migrations..."));
+      console.log(chalk21.blue("\u{1F4E6} Running project migrations..."));
       await migrate(projDb, {
         migrationsFolder: projectMigrationsDir,
         migrationsTable: PROJECT_MIGRATIONS_TABLE
       });
-      console.log(chalk20.green("\u2705 Project migrations applied successfully"));
+      console.log(chalk21.green("\u2705 Project migrations applied successfully"));
     } finally {
       await projConn.end();
     }
   } else {
-    console.log(chalk20.dim("No project migrations found (src/server/drizzle)"));
+    console.log(chalk21.dim("No project migrations found (src/server/drizzle)"));
   }
 }
 
 // src/commands/db/status.ts
-import chalk21 from "chalk";
+import chalk22 from "chalk";
 init_migration_status();
 async function dbStatus() {
   try {
@@ -4085,51 +4202,51 @@ async function dbStatus() {
   try {
     status = await getMigrationStatus(process.cwd());
   } catch (error) {
-    console.error(chalk21.red("\u274C Failed to read migration status"));
-    console.error(chalk21.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk22.red("\u274C Failed to read migration status"));
+    console.error(chalk22.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
   const targets = [...status.packages, ...status.project ? [status.project] : []];
   if (targets.length === 0) {
-    console.log(chalk21.dim("No migrations found (no @spfn packages with migrations, no src/server/drizzle)."));
+    console.log(chalk22.dim("No migrations found (no @spfn packages with migrations, no src/server/drizzle)."));
     return;
   }
-  console.log(chalk21.blue("\u{1F4E6} Migration status:\n"));
+  console.log(chalk22.blue("\u{1F4E6} Migration status:\n"));
   for (const target of targets) {
-    const state = target.pending === 0 ? chalk21.green(`${target.applied}/${target.total} applied`) : chalk21.yellow(`${target.applied}/${target.total} applied, ${target.pending} pending`);
+    const state = target.pending === 0 ? chalk22.green(`${target.applied}/${target.total} applied`) : chalk22.yellow(`${target.applied}/${target.total} applied, ${target.pending} pending`);
     console.log(`  ${target.name.padEnd(32)} ${state}`);
     for (const tag of target.pendingTags) {
-      console.log(chalk21.dim(`      - ${tag}`));
+      console.log(chalk22.dim(`      - ${tag}`));
     }
   }
   const pendingTotal = targets.reduce((sum, t) => sum + t.pending, 0);
   if (pendingTotal === 0) {
-    console.log(chalk21.green("\n\u2705 Database is up to date\n"));
+    console.log(chalk22.green("\n\u2705 Database is up to date\n"));
   } else {
-    console.log(chalk21.yellow(`
+    console.log(chalk22.yellow(`
 \u26A0\uFE0F  ${pendingTotal} pending migration(s) \u2014 run: pnpm spfn db migrate
 `));
   }
 }
 
 // src/commands/db/studio.ts
-import chalk22 from "chalk";
+import chalk23 from "chalk";
 import { existsSync as existsSync24, writeFileSync as writeFileSync15, unlinkSync as unlinkSync3 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { env as env6 } from "@spfn/core/config";
 async function dbStudio(requestedPort) {
-  console.log(chalk22.blue("\u{1F3A8} Opening Drizzle Studio...\n"));
+  console.log(chalk23.blue("\u{1F3A8} Opening Drizzle Studio...\n"));
   const defaultPort = 4983;
   const startPort = requestedPort || defaultPort;
   let port;
   try {
     port = await findAvailablePort(startPort);
     if (port !== startPort) {
-      console.log(chalk22.yellow(`\u26A0\uFE0F  Port ${startPort} is in use, using port ${port} instead
+      console.log(chalk23.yellow(`\u26A0\uFE0F  Port ${startPort} is in use, using port ${port} instead
 `));
     }
   } catch (error) {
-    console.error(chalk22.red(error instanceof Error ? error.message : "Failed to find available port"));
+    console.error(chalk23.red(error instanceof Error ? error.message : "Failed to find available port"));
     process.exit(1);
   }
   const hasUserConfig = existsSync24("./drizzle.config.ts");
@@ -4138,8 +4255,8 @@ async function dbStudio(requestedPort) {
     const configPath = hasUserConfig ? "./drizzle.config.ts" : tempConfigPath;
     if (!hasUserConfig) {
       if (!env6.DATABASE_URL) {
-        console.error(chalk22.red("\u274C DATABASE_URL not found in environment"));
-        console.log(chalk22.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+        console.error(chalk23.red("\u274C DATABASE_URL not found in environment"));
+        console.log(chalk23.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
         process.exit(1);
       }
       const { generateDrizzleConfigFile } = await import("@spfn/core/db");
@@ -4150,7 +4267,7 @@ async function dbStudio(requestedPort) {
         // Expand glob patterns for Studio compatibility
       });
       writeFileSync15(tempConfigPath, configContent);
-      console.log(chalk22.dim("Using auto-generated Drizzle config\n"));
+      console.log(chalk23.dim("Using auto-generated Drizzle config\n"));
     }
     const studioProcess = spawn3("drizzle-kit", ["studio", `--port=${port}`, `--config=${configPath}`], {
       stdio: "inherit",
@@ -4165,19 +4282,19 @@ async function dbStudio(requestedPort) {
     studioProcess.on("exit", (code) => {
       cleanup();
       if (code !== 0 && code !== null) {
-        console.error(chalk22.red(`
+        console.error(chalk23.red(`
 \u274C Drizzle Studio exited with code ${code}`));
         process.exit(code);
       }
     });
     studioProcess.on("error", (error) => {
       cleanup();
-      console.error(chalk22.red("\u274C Failed to start Drizzle Studio"));
-      console.error(chalk22.red(error.message));
+      console.error(chalk23.red("\u274C Failed to start Drizzle Studio"));
+      console.error(chalk23.red(error.message));
       process.exit(1);
     });
     process.on("SIGINT", () => {
-      console.log(chalk22.yellow("\n\n\u{1F44B} Shutting down Drizzle Studio..."));
+      console.log(chalk23.yellow("\n\n\u{1F44B} Shutting down Drizzle Studio..."));
       studioProcess.kill("SIGTERM");
       cleanup();
       process.exit(0);
@@ -4191,27 +4308,27 @@ async function dbStudio(requestedPort) {
     if (!hasUserConfig && existsSync24(tempConfigPath)) {
       unlinkSync3(tempConfigPath);
     }
-    console.error(chalk22.red("\u274C Failed to start Drizzle Studio"));
-    console.error(chalk22.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk23.red("\u274C Failed to start Drizzle Studio"));
+    console.error(chalk23.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
 
 // src/commands/db/drop.ts
-import chalk23 from "chalk";
+import chalk24 from "chalk";
 import prompts6 from "prompts";
 import { env as env7 } from "@spfn/core/config";
 import { loadEnv as loadEnv7 } from "@spfn/core/server";
 async function dbDrop() {
   loadEnv7();
   if (!env7.DATABASE_URL) {
-    console.error(chalk23.red("\u274C DATABASE_URL not found in environment"));
-    console.log(chalk23.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+    console.error(chalk24.red("\u274C DATABASE_URL not found in environment"));
+    console.log(chalk24.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     process.exit(1);
   }
   const dbInfo = parseDatabaseUrl2(env7.DATABASE_URL);
-  console.log(chalk23.yellow("\u26A0\uFE0F  WARNING: This will drop all tables in your database!"));
-  console.log(chalk23.dim(`   Target: ${dbInfo.database} @ ${dbInfo.host}:${dbInfo.port}
+  console.log(chalk24.yellow("\u26A0\uFE0F  WARNING: This will drop all tables in your database!"));
+  console.log(chalk24.dim(`   Target: ${dbInfo.database} @ ${dbInfo.host}:${dbInfo.port}
 `));
   const { confirm } = await prompts6({
     type: "confirm",
@@ -4220,7 +4337,7 @@ async function dbDrop() {
     initial: false
   });
   if (!confirm) {
-    console.log(chalk23.gray("Cancelled."));
+    console.log(chalk24.gray("Cancelled."));
     process.exit(0);
   }
   await confirmDangerousTarget(dbInfo);
@@ -4233,7 +4350,7 @@ async function dbDrop() {
 }
 
 // src/commands/db/check.ts
-import chalk24 from "chalk";
+import chalk25 from "chalk";
 import ora8 from "ora";
 async function dbCheck() {
   const spinner = ora8("Checking migration files...").start();
@@ -4242,7 +4359,7 @@ async function dbCheck() {
     spinner.succeed("Migration files consistent");
   } catch (error) {
     spinner.fail("Migration file check failed");
-    console.error(chalk24.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk25.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
@@ -4250,25 +4367,25 @@ async function dbCheck() {
 // src/commands/db/restore.ts
 import path4 from "path";
 import { spawn as spawn4 } from "child_process";
-import chalk25 from "chalk";
+import chalk26 from "chalk";
 import ora9 from "ora";
 import prompts7 from "prompts";
 import { env as env8 } from "@spfn/core/config";
 import { loadEnv as loadEnv8 } from "@spfn/core/server";
 async function dbRestore(backupFile, options = {}) {
-  console.log(chalk25.blue("\u267B\uFE0F  Restoring database from backup...\n"));
+  console.log(chalk26.blue("\u267B\uFE0F  Restoring database from backup...\n"));
   loadEnv8();
   const dbUrl = env8.DATABASE_URL;
   if (!dbUrl) {
-    console.error(chalk25.red("\u274C DATABASE_URL not found in environment"));
-    console.log(chalk25.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+    console.error(chalk26.red("\u274C DATABASE_URL not found in environment"));
+    console.log(chalk26.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     process.exit(1);
   }
   let file = backupFile;
   if (!file) {
     const backups = await listBackupFiles();
     if (backups.length === 0) {
-      console.log(chalk25.yellow("No backups found in ./backups directory"));
+      console.log(chalk26.yellow("No backups found in ./backups directory"));
       process.exit(0);
     }
     const { selected } = await prompts7({
@@ -4281,31 +4398,31 @@ async function dbRestore(backupFile, options = {}) {
       }))
     });
     if (!selected) {
-      console.log(chalk25.gray("Cancelled"));
+      console.log(chalk26.gray("Cancelled"));
       process.exit(0);
     }
     file = selected;
   }
   if (!file) {
-    console.error(chalk25.red("\u274C No backup file selected"));
+    console.error(chalk26.red("\u274C No backup file selected"));
     process.exit(1);
   }
   const metadata = await loadBackupMetadata(file);
   if (metadata) {
-    console.log(chalk25.blue("\n\u{1F4CB} Backup Information:\n"));
-    console.log(chalk25.dim(`  Database: ${metadata.database}`));
-    console.log(chalk25.dim(`  Created: ${new Date(metadata.timestamp).toLocaleString()}`));
+    console.log(chalk26.blue("\n\u{1F4CB} Backup Information:\n"));
+    console.log(chalk26.dim(`  Database: ${metadata.database}`));
+    console.log(chalk26.dim(`  Created: ${new Date(metadata.timestamp).toLocaleString()}`));
     if (metadata.environment) {
-      console.log(chalk25.dim(`  Environment: ${metadata.environment}`));
+      console.log(chalk26.dim(`  Environment: ${metadata.environment}`));
     }
     if (metadata.tags && metadata.tags.length > 0) {
-      console.log(chalk25.dim(`  Tags: ${metadata.tags.join(", ")}`));
+      console.log(chalk26.dim(`  Tags: ${metadata.tags.join(", ")}`));
     }
     if (metadata.backup.dataOnly) {
-      console.log(chalk25.yellow("  \u26A0\uFE0F  Data-only backup (no schema)"));
+      console.log(chalk26.yellow("  \u26A0\uFE0F  Data-only backup (no schema)"));
     }
     if (metadata.backup.schemaOnly) {
-      console.log(chalk25.yellow("  \u26A0\uFE0F  Schema-only backup (no data)"));
+      console.log(chalk26.yellow("  \u26A0\uFE0F  Schema-only backup (no data)"));
     }
     const warnings2 = [];
     const [currentGitInfo, currentMigrationInfo] = await Promise.all([
@@ -4328,8 +4445,8 @@ async function dbRestore(backupFile, options = {}) {
       }
     }
     if (warnings2.length > 0) {
-      console.log(chalk25.yellow("\n\u26A0\uFE0F  Version Warnings:\n"));
-      warnings2.forEach((warning) => console.log(chalk25.yellow(`  - ${warning}`)));
+      console.log(chalk26.yellow("\n\u26A0\uFE0F  Version Warnings:\n"));
+      warnings2.forEach((warning) => console.log(chalk26.yellow(`  - ${warning}`)));
       console.log("");
     }
   }
@@ -4337,16 +4454,16 @@ async function dbRestore(backupFile, options = {}) {
   const { confirm } = await prompts7({
     type: "confirm",
     name: "confirm",
-    message: chalk25.yellow(`\u26A0\uFE0F  This will replace all data in "${dbInfo.database}" @ ${dbInfo.host}:${dbInfo.port}. Continue?`),
+    message: chalk26.yellow(`\u26A0\uFE0F  This will replace all data in "${dbInfo.database}" @ ${dbInfo.host}:${dbInfo.port}. Continue?`),
     initial: false
   });
   if (!confirm) {
-    console.log(chalk25.gray("Cancelled"));
+    console.log(chalk26.gray("Cancelled"));
     process.exit(0);
   }
   await confirmDangerousTarget(dbInfo);
   if (options.dataOnly && options.schemaOnly) {
-    console.error(chalk25.red("\u274C Cannot use --data-only and --schema-only together"));
+    console.error(chalk26.red("\u274C Cannot use --data-only and --schema-only together"));
     process.exit(1);
   }
   const ext = path4.extname(file);
@@ -4374,11 +4491,11 @@ async function dbRestore(backupFile, options = {}) {
     args.push(file);
   } else {
     if (options.drop) {
-      console.log(chalk25.yellow("\u26A0\uFE0F  Note: --drop only works with custom format backups (.dump) and was ignored."));
+      console.log(chalk26.yellow("\u26A0\uFE0F  Note: --drop only works with custom format backups (.dump) and was ignored."));
     }
     if (options.dataOnly || options.schemaOnly) {
-      console.log(chalk25.yellow("\u26A0\uFE0F  Note: --data-only and --schema-only options only work with custom format backups (.dump)"));
-      console.log(chalk25.yellow("    For SQL files, the backup must have been created with the desired option.\n"));
+      console.log(chalk26.yellow("\u26A0\uFE0F  Note: --data-only and --schema-only options only work with custom format backups (.dump)"));
+      console.log(chalk26.yellow("    For SQL files, the backup must have been created with the desired option.\n"));
     }
     args.push("-h", dbInfo.host);
     args.push("-p", dbInfo.port);
@@ -4421,7 +4538,7 @@ async function dbRestore(backupFile, options = {}) {
       }
       if (verbose) {
         spinner.stop();
-        console.log(chalk25.dim(`  ${line.trim()}`));
+        console.log(chalk26.dim(`  ${line.trim()}`));
         spinner.start();
       }
     }
@@ -4429,7 +4546,7 @@ async function dbRestore(backupFile, options = {}) {
   restoreProcess.stdout?.on("data", (data) => {
     if (verbose) {
       spinner.stop();
-      console.log(chalk25.dim(`  ${data.toString().trim()}`));
+      console.log(chalk26.dim(`  ${data.toString().trim()}`));
       spinner.start();
     }
   });
@@ -4439,31 +4556,31 @@ async function dbRestore(backupFile, options = {}) {
         const summary = objectCount > 0 ? ` (${objectCount} objects)` : "";
         spinner.succeed(`Restore completed${summary}`);
         if (warnings.length > 0) {
-          console.log(chalk25.yellow(`
+          console.log(chalk26.yellow(`
 \u26A0\uFE0F  Warnings during restore (${warnings.length}):
 `));
           for (const w of warnings) {
-            console.log(chalk25.yellow(`  - ${w}`));
+            console.log(chalk26.yellow(`  - ${w}`));
           }
         }
-        console.log(chalk25.green("\n\u2705 Database restored successfully"));
+        console.log(chalk26.green("\n\u2705 Database restored successfully"));
         resolve3();
       } else {
         spinner.fail("Restore failed");
         if (errors.length > 0) {
-          console.error(chalk25.red(`
+          console.error(chalk26.red(`
 \u274C Errors (${errors.length}):
 `));
           for (const e of errors) {
-            console.error(chalk25.red(`  - ${e}`));
+            console.error(chalk26.red(`  - ${e}`));
           }
         }
         if (warnings.length > 0) {
-          console.log(chalk25.yellow(`
+          console.log(chalk26.yellow(`
 \u26A0\uFE0F  Warnings (${warnings.length}):
 `));
           for (const w of warnings) {
-            console.log(chalk25.yellow(`  - ${w}`));
+            console.log(chalk26.yellow(`  - ${w}`));
           }
         }
         const fallback = errors.length === 0 && warnings.length === 0 ? "Restore failed with no output" : "";
@@ -4477,7 +4594,7 @@ async function dbRestore(backupFile, options = {}) {
   }).catch((error) => {
     const msg = error instanceof Error ? error.message : "Unknown error";
     if (msg) {
-      console.error(chalk25.red(`
+      console.error(chalk26.red(`
 \u274C ${msg}`));
     }
     process.exit(1);
@@ -4485,17 +4602,17 @@ async function dbRestore(backupFile, options = {}) {
 }
 
 // src/commands/db/list.ts
-import chalk26 from "chalk";
+import chalk27 from "chalk";
 async function dbBackupList() {
-  console.log(chalk26.blue("\u{1F4CB} Database backups:\n"));
+  console.log(chalk27.blue("\u{1F4CB} Database backups:\n"));
   const backups = await listBackupFiles();
   if (backups.length === 0) {
-    console.log(chalk26.yellow("No backups found in ./backups directory"));
-    console.log(chalk26.gray("\n\u{1F4A1} Create a backup with: pnpm spfn db backup\n"));
+    console.log(chalk27.yellow("No backups found in ./backups directory"));
+    console.log(chalk27.gray("\n\u{1F4A1} Create a backup with: pnpm spfn db backup\n"));
     return;
   }
-  console.log(chalk26.bold("  Date                  Size        File"));
-  console.log(chalk26.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(chalk27.bold("  Date                  Size        File"));
+  console.log(chalk27.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   backups.forEach((backup) => {
     const date = backup.date.toLocaleString("en-US", {
       year: "numeric",
@@ -4506,23 +4623,23 @@ async function dbBackupList() {
       second: "2-digit"
     });
     const sizeStr = backup.size.padEnd(10);
-    console.log(chalk26.white(`  ${date}  ${sizeStr}  ${backup.name}`));
+    console.log(chalk27.white(`  ${date}  ${sizeStr}  ${backup.name}`));
   });
-  console.log(chalk26.gray(`
+  console.log(chalk27.gray(`
   Total: ${backups.length} backup(s)
 `));
 }
 
 // src/commands/db/clean.ts
 import { promises as fs4 } from "fs";
-import chalk27 from "chalk";
+import chalk28 from "chalk";
 import ora10 from "ora";
 import prompts8 from "prompts";
 async function dbBackupClean(options) {
-  console.log(chalk27.blue("\u{1F9F9} Cleaning old backups...\n"));
+  console.log(chalk28.blue("\u{1F9F9} Cleaning old backups...\n"));
   const backups = await listBackupFiles();
   if (backups.length === 0) {
-    console.log(chalk27.yellow("No backups found"));
+    console.log(chalk28.yellow("No backups found"));
     return;
   }
   let toDelete = [];
@@ -4539,13 +4656,13 @@ async function dbBackupClean(options) {
     toDelete = backups.slice(defaultKeep);
   }
   if (toDelete.length === 0) {
-    console.log(chalk27.green("\u2705 No backups to clean"));
+    console.log(chalk28.green("\u2705 No backups to clean"));
     return;
   }
-  console.log(chalk27.yellow(`The following ${toDelete.length} backup(s) will be deleted:
+  console.log(chalk28.yellow(`The following ${toDelete.length} backup(s) will be deleted:
 `));
   toDelete.forEach((backup) => {
-    console.log(chalk27.gray(`  - ${backup.name} (${backup.size})`));
+    console.log(chalk28.gray(`  - ${backup.name} (${backup.size})`));
   });
   const { confirm } = await prompts8({
     type: "confirm",
@@ -4554,7 +4671,7 @@ async function dbBackupClean(options) {
     initial: false
   });
   if (!confirm) {
-    console.log(chalk27.gray("Cancelled"));
+    console.log(chalk28.gray("Cancelled"));
     return;
   }
   const spinner = ora10("Deleting backups...").start();
@@ -4565,19 +4682,19 @@ async function dbBackupClean(options) {
       fs4.rm(backup.path.replace(/\.(sql|dump)$/, ".meta.json"), { force: true })
     ]));
     spinner.succeed("Backups deleted");
-    console.log(chalk27.green(`
+    console.log(chalk28.green(`
 \u2705 Deleted ${toDelete.length} backup(s)`));
   } catch (error) {
     spinner.fail("Failed to delete backups");
-    console.error(chalk27.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk28.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
 
 // src/commands/db/reindex.ts
 import { existsSync as existsSync25, readFileSync as readFileSync10, writeFileSync as writeFileSync16, renameSync, copyFileSync } from "fs";
-import { join as join23 } from "path";
-import chalk28 from "chalk";
+import { join as join24 } from "path";
+import chalk29 from "chalk";
 import { loadEnv as loadEnv9 } from "@spfn/core/server";
 function isTimestampPrefix(tag) {
   const prefix = tag.split("_")[0];
@@ -4598,15 +4715,15 @@ async function dbReindex(options = {}) {
   const { getDrizzleConfig } = await import("@spfn/core/db");
   const config = getDrizzleConfig({ disablePackageDiscovery: true });
   const outDir = config.out;
-  const journalPath = join23(outDir, "meta", "_journal.json");
+  const journalPath = join24(outDir, "meta", "_journal.json");
   if (!existsSync25(journalPath)) {
-    console.error(chalk28.red("\u274C No _journal.json found at:"), journalPath);
-    console.log(chalk28.yellow("\u{1F4A1} Run `spfn db generate` first to create migrations"));
+    console.error(chalk29.red("\u274C No _journal.json found at:"), journalPath);
+    console.log(chalk29.yellow("\u{1F4A1} Run `spfn db generate` first to create migrations"));
     process.exit(1);
   }
   const journal = JSON.parse(readFileSync10(journalPath, "utf-8"));
   if (journal.entries.length === 0) {
-    console.log(chalk28.yellow("No migration entries found \u2014 nothing to reindex."));
+    console.log(chalk29.yellow("No migration entries found \u2014 nothing to reindex."));
     return;
   }
   const renames = [];
@@ -4620,46 +4737,46 @@ async function dbReindex(options = {}) {
     const { prefix: oldPrefix, suffix } = parseTag(entry.tag);
     const newPrefix = String(entry.when);
     const newTag = suffix ? `${newPrefix}_${suffix}` : newPrefix;
-    const oldSql = join23(outDir, `${entry.tag}.sql`);
-    const newSql = join23(outDir, `${newTag}.sql`);
+    const oldSql = join24(outDir, `${entry.tag}.sql`);
+    const newSql = join24(outDir, `${newTag}.sql`);
     if (existsSync25(oldSql)) {
       renames.push({ type: "sql", from: oldSql, to: newSql });
     }
-    const oldSnapshot = join23(outDir, "meta", `${oldPrefix}_snapshot.json`);
-    const newSnapshot = join23(outDir, "meta", `${newPrefix}_snapshot.json`);
+    const oldSnapshot = join24(outDir, "meta", `${oldPrefix}_snapshot.json`);
+    const newSnapshot = join24(outDir, "meta", `${newPrefix}_snapshot.json`);
     if (existsSync25(oldSnapshot)) {
       renames.push({ type: "snapshot", from: oldSnapshot, to: newSnapshot });
     }
     tagUpdates.push({ idx: entry.idx, oldTag: entry.tag, newTag });
   }
   if (tagUpdates.length === 0) {
-    console.log(chalk28.green("\u2705 All migrations already use timestamp prefix \u2014 nothing to do."));
+    console.log(chalk29.green("\u2705 All migrations already use timestamp prefix \u2014 nothing to do."));
     if (skipped > 0) {
-      console.log(chalk28.dim(`   (${skipped} entries already timestamp-prefixed)`));
+      console.log(chalk29.dim(`   (${skipped} entries already timestamp-prefixed)`));
     }
     return;
   }
-  console.log(chalk28.bold("\n\u{1F4CB} Reindex plan:\n"));
+  console.log(chalk29.bold("\n\u{1F4CB} Reindex plan:\n"));
   for (const update of tagUpdates) {
     console.log(
-      chalk28.dim(`  [${update.idx}]`),
-      chalk28.red(update.oldTag),
-      chalk28.dim("\u2192"),
-      chalk28.green(update.newTag)
+      chalk29.dim(`  [${update.idx}]`),
+      chalk29.red(update.oldTag),
+      chalk29.dim("\u2192"),
+      chalk29.green(update.newTag)
     );
   }
-  console.log(chalk28.dim(`
+  console.log(chalk29.dim(`
   ${renames.length} file(s) to rename, ${tagUpdates.length} journal tag(s) to update`));
   if (skipped > 0) {
-    console.log(chalk28.dim(`  ${skipped} entry/entries already timestamp-prefixed (skipped)`));
+    console.log(chalk29.dim(`  ${skipped} entry/entries already timestamp-prefixed (skipped)`));
   }
   if (options.dryRun) {
-    console.log(chalk28.yellow("\n\u{1F50D} Dry run \u2014 no changes applied."));
+    console.log(chalk29.yellow("\n\u{1F50D} Dry run \u2014 no changes applied."));
     return;
   }
   const backupPath = journalPath + ".bak";
   copyFileSync(journalPath, backupPath);
-  console.log(chalk28.dim(`
+  console.log(chalk29.dim(`
   Backed up journal \u2192 ${backupPath}`));
   for (const rename of renames) {
     renameSync(rename.from, rename.to);
@@ -4671,12 +4788,12 @@ async function dbReindex(options = {}) {
     }
   }
   writeFileSync16(journalPath, JSON.stringify(journal, null, 2) + "\n");
-  console.log(chalk28.green(`
+  console.log(chalk29.green(`
 \u2705 Reindex complete \u2014 ${tagUpdates.length} migration(s) converted to timestamp prefix.`));
 }
 
 // src/commands/db/index.ts
-var dbCommand = new Command10("db").description("Database management commands (wraps Drizzle Kit)");
+var dbCommand = new Command11("db").description("Database management commands (wraps Drizzle Kit)");
 dbCommand.command("generate").alias("g").description("Generate database migrations from schema changes").action(dbGenerate);
 dbCommand.command("push").description("Push schema changes to database (safe mode by default)").option("--force", "Apply all changes including destructive ones").option("--dry-run", "Show changes without applying").action((options) => dbPush(options));
 dbCommand.command("migrate").alias("m").description("Run pending migrations").option("--with-backup", "Create backup before running migrations").action((options) => dbMigrate(options));
@@ -4692,22 +4809,22 @@ dbCommand.command("reindex").description("Convert migration files from sequentia
 
 // src/commands/add.ts
 init_package_manager();
-import { Command as Command11 } from "commander";
+import { Command as Command12 } from "commander";
 import { existsSync as existsSync27, readFileSync as readFileSync11 } from "fs";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 import { execa as execa10 } from "execa";
-import chalk30 from "chalk";
+import chalk31 from "chalk";
 import ora11 from "ora";
 
 // src/commands/add-vercel.ts
 init_templates();
 import { copyFileSync as copyFileSync2, existsSync as existsSync26, mkdirSync as mkdirSync4 } from "fs";
-import { dirname as dirname3, join as join24 } from "path";
-import chalk29 from "chalk";
+import { dirname as dirname3, join as join25 } from "path";
+import chalk30 from "chalk";
 var FILES = [
   {
     template: "route.ts",
-    target: join24("src", "app", "api", "backend", "[[...route]]", "route.ts"),
+    target: join25("src", "app", "api", "backend", "[[...route]]", "route.ts"),
     description: "hono/vercel adapter (mounts the SPFN app under /api/backend)"
   },
   {
@@ -4722,35 +4839,35 @@ var FILES = [
   }
 ];
 async function addVercel() {
-  console.log(chalk29.blue("\n\u{1F4E6} Setting up the Vercel serverless target...\n"));
+  console.log(chalk30.blue("\n\u{1F4E6} Setting up the Vercel serverless target...\n"));
   const cwd = process.cwd();
-  const templatesDir = join24(findTemplatesPath(), "vercel");
+  const templatesDir = join25(findTemplatesPath(), "vercel");
   for (const file of FILES) {
-    const targetPath = join24(cwd, file.target);
+    const targetPath = join25(cwd, file.target);
     if (existsSync26(targetPath)) {
-      console.log(chalk29.yellow(`\u23ED\uFE0F  ${file.target} already exists \u2014 skipped (not overwritten)`));
+      console.log(chalk30.yellow(`\u23ED\uFE0F  ${file.target} already exists \u2014 skipped (not overwritten)`));
       continue;
     }
     mkdirSync4(dirname3(targetPath), { recursive: true });
-    copyFileSync2(join24(templatesDir, file.template), targetPath);
-    console.log(chalk29.green(`\u2705 ${file.target}`) + chalk29.gray(` \u2014 ${file.description}`));
-  }
-  console.log(chalk29.green("\n\u2705 Vercel target ready!\n"));
-  console.log(chalk29.cyan("\u{1F4DA} Next steps:"));
-  console.log(chalk29.gray("  1. Make sure `hono` is a direct dependency (hono/vercel must resolve from the app):"));
-  console.log(chalk29.gray("       pnpm add hono"));
-  console.log(chalk29.gray("  2. Set Vercel project env vars:"));
-  console.log(chalk29.gray("       GITEA_NPM_TOKEN   \u2014 @spfn registry token (install step)"));
-  console.log(chalk29.gray("       SPFN_AUTH_*       \u2014 auth secrets (same as local .env.server)"));
-  console.log(chalk29.gray("       SPFN_API_URL      \u2014 https://<your-domain>/api/backend (RPC proxy origin)"));
-  console.log(chalk29.gray("       DATABASE_URL      \u2014 set automatically from POSTGRES_URL if you use the"));
-  console.log(chalk29.gray("                           Vercel Supabase integration (mapped in route.ts)"));
-  console.log(chalk29.gray("  3. Run migrations against the DIRECT (non-pooler) connection before deploying:"));
-  console.log(chalk29.gray("       DATABASE_URL=<direct-url> pnpm spfn db migrate"));
-  console.log(chalk29.gray("  4. Seed/RBAC provisioning runs once per deploy, not per cold start:"));
-  console.log(chalk29.gray("       pnpm spfn provision   (e.g. from the build step or a deploy hook)"));
-  console.log(chalk29.gray("  5. Jobs (config.jobs) are NOT processed on serverless \u2014 drain the queue from a"));
-  console.log(chalk29.gray("     scheduled endpoint (Vercel Cron) or run workers on an always-on target.\n"));
+    copyFileSync2(join25(templatesDir, file.template), targetPath);
+    console.log(chalk30.green(`\u2705 ${file.target}`) + chalk30.gray(` \u2014 ${file.description}`));
+  }
+  console.log(chalk30.green("\n\u2705 Vercel target ready!\n"));
+  console.log(chalk30.cyan("\u{1F4DA} Next steps:"));
+  console.log(chalk30.gray("  1. Make sure `hono` is a direct dependency (hono/vercel must resolve from the app):"));
+  console.log(chalk30.gray("       pnpm add hono"));
+  console.log(chalk30.gray("  2. Set Vercel project env vars:"));
+  console.log(chalk30.gray("       GITEA_NPM_TOKEN   \u2014 @spfn registry token (install step)"));
+  console.log(chalk30.gray("       SPFN_AUTH_*       \u2014 auth secrets (same as local .env.server)"));
+  console.log(chalk30.gray("       SPFN_API_URL      \u2014 https://<your-domain>/api/backend (RPC proxy origin)"));
+  console.log(chalk30.gray("       DATABASE_URL      \u2014 set automatically from POSTGRES_URL if you use the"));
+  console.log(chalk30.gray("                           Vercel Supabase integration (mapped in route.ts)"));
+  console.log(chalk30.gray("  3. Run migrations against the DIRECT (non-pooler) connection before deploying:"));
+  console.log(chalk30.gray("       DATABASE_URL=<direct-url> pnpm spfn db migrate"));
+  console.log(chalk30.gray("  4. Seed/RBAC provisioning runs once per deploy, not per cold start:"));
+  console.log(chalk30.gray("       pnpm spfn provision   (e.g. from the build step or a deploy hook)"));
+  console.log(chalk30.gray("  5. Jobs (config.jobs) are NOT processed on serverless \u2014 drain the queue from a"));
+  console.log(chalk30.gray("     scheduled endpoint (Vercel Cron) or run workers on an always-on target.\n"));
 }
 
 // src/commands/add.ts
@@ -4760,17 +4877,19 @@ async function addPackage(packageName) {
     return;
   }
   if (!packageName.includes("/")) {
-    console.error(chalk30.red("\u274C Please specify full package name"));
-    console.log(chalk30.yellow("\n\u{1F4A1} Examples:"));
-    console.log(chalk30.gray("  pnpm spfn add @spfn/cms"));
-    console.log(chalk30.gray("  pnpm spfn add @mycompany/spfn-analytics"));
+    console.error(chalk31.red("\u274C Please specify full package name"));
+    console.log(chalk31.yellow("\n\u{1F4A1} Examples:"));
+    console.log(chalk31.gray("  pnpm spfn add @spfn/cms"));
+    console.log(chalk31.gray("  pnpm spfn add @mycompany/spfn-analytics"));
+    console.log(chalk31.gray("\n  Deploy targets are unscoped. The only one today is:"));
+    console.log(chalk31.gray("  pnpm spfn add vercel"));
     process.exit(1);
   }
-  console.log(chalk30.blue(`
+  console.log(chalk31.blue(`
 \u{1F4E6} Setting up ${packageName}...
 `));
-  const pkgPath = join25(process.cwd(), "node_modules", ...packageName.split("/"));
-  const pkgJsonPath = join25(pkgPath, "package.json");
+  const pkgPath = join26(process.cwd(), "node_modules", ...packageName.split("/"));
+  const pkgJsonPath = join26(pkgPath, "package.json");
   if (!existsSync27(pkgJsonPath)) {
     const pm = detectPackageManager(process.cwd());
     const installSpinner = ora11("Installing package...").start();
@@ -4779,27 +4898,27 @@ async function addPackage(packageName) {
       installSpinner.succeed("Package installed");
     } catch (error) {
       installSpinner.fail("Failed to install package");
-      console.error(chalk30.red(error instanceof Error ? error.message : "Unknown error"));
+      console.error(chalk31.red(error instanceof Error ? error.message : "Unknown error"));
       process.exit(1);
     }
   } else {
-    console.log(chalk30.gray("\u2713 Package already installed (using local version)\n"));
+    console.log(chalk31.gray("\u2713 Package already installed (using local version)\n"));
   }
   if (!existsSync27(pkgJsonPath)) {
-    console.error(chalk30.red(`\u274C Package ${packageName} not found after installation`));
+    console.error(chalk31.red(`\u274C Package ${packageName} not found after installation`));
     process.exit(1);
   }
   const pkgJson = JSON.parse(readFileSync11(pkgJsonPath, "utf-8"));
   if (pkgJson.spfn?.migrations) {
-    console.log(chalk30.blue(`
+    console.log(chalk31.blue(`
 \u{1F5C4}\uFE0F  Setting up database for ${packageName}...
 `));
     const { env: env9 } = await import("@spfn/core/config");
     if (!env9.DATABASE_URL) {
-      console.log(chalk30.yellow("\u26A0\uFE0F  DATABASE_URL not found \u2014 skipping database setup."));
-      console.log(chalk30.yellow(`   ${packageName} tables are created by its bundled migrations, not by schema push.`));
-      console.log(chalk30.cyan("   Once DATABASE_URL is set, run: pnpm spfn db migrate"));
-      console.log(chalk30.gray("   (check state anytime with: pnpm spfn db status)\n"));
+      console.log(chalk31.yellow("\u26A0\uFE0F  DATABASE_URL not found \u2014 skipping database setup."));
+      console.log(chalk31.yellow(`   ${packageName} tables are created by its bundled migrations, not by schema push.`));
+      console.log(chalk31.cyan("   Once DATABASE_URL is set, run: pnpm spfn db migrate"));
+      console.log(chalk31.gray("   (check state anytime with: pnpm spfn db status)\n"));
     } else {
       const { discoverFunctionMigrations: discoverFunctionMigrations2, loadFunctionMigrationPlans: loadFunctionMigrationPlans2, executeFunctionMigrations: executeFunctionMigrations2 } = await Promise.resolve().then(() => (init_function_migrations(), function_migrations_exports));
       const functions = discoverFunctionMigrations2(process.cwd());
@@ -4811,30 +4930,30 @@ async function addPackage(packageName) {
           spinner.succeed("Migrations applied");
         } catch (error) {
           spinner.fail("Failed to apply migrations");
-          console.error(chalk30.red(error instanceof Error ? error.message : "Unknown error"));
+          console.error(chalk31.red(error instanceof Error ? error.message : "Unknown error"));
           process.exit(1);
         }
       } else {
-        console.log(chalk30.gray("\u2139\uFE0F  No migrations found for this package"));
+        console.log(chalk31.gray("\u2139\uFE0F  No migrations found for this package"));
       }
     }
   } else {
-    console.log(chalk30.gray("\n\u2139\uFE0F  No database migrations to apply"));
+    console.log(chalk31.gray("\n\u2139\uFE0F  No database migrations to apply"));
   }
-  console.log(chalk30.green(`
+  console.log(chalk31.green(`
 \u2705 ${packageName} installed successfully!
 `));
   if (pkgJson.spfn?.setupMessage) {
-    console.log(chalk30.cyan("\u{1F4DA} Setup Guide:"));
+    console.log(chalk31.cyan("\u{1F4DA} Setup Guide:"));
     console.log(pkgJson.spfn.setupMessage);
     console.log();
   }
 }
-var addCommand = new Command11("add").description("Install and set up SPFN ecosystem packages, or scaffold a deploy target (vercel)").argument("<package>", 'Package name (e.g., @spfn/cms, @mycompany/spfn-analytics) or "vercel"').action(addPackage);
+var addCommand = new Command12("add").description("Add a capability to this project: an SPFN ecosystem package, or a deploy target").argument("<package|target>", "Scoped package name (e.g., @spfn/cms, @mycompany/spfn-analytics), or a deploy target: vercel").action(addPackage);
 
 // src/commands/env.ts
-import { Command as Command12 } from "commander";
-import chalk31 from "chalk";
+import { Command as Command13 } from "commander";
+import chalk32 from "chalk";
 import { existsSync as existsSync28, readFileSync as readFileSync12, writeFileSync as writeFileSync17 } from "fs";
 import { resolve as resolve2 } from "path";
 import { parse as parse2 } from "dotenv";
@@ -4891,26 +5010,26 @@ function getEnvFilesForEnvironment(nodeEnv) {
 }
 function formatType(type) {
   const typeColors = {
-    string: chalk31.green,
-    number: chalk31.blue,
-    boolean: chalk31.yellow,
-    url: chalk31.cyan,
-    enum: chalk31.magenta,
-    json: chalk31.red
+    string: chalk32.green,
+    number: chalk32.blue,
+    boolean: chalk32.yellow,
+    url: chalk32.cyan,
+    enum: chalk32.magenta,
+    json: chalk32.red
   };
-  return (typeColors[type] || chalk31.white)(type);
+  return (typeColors[type] || chalk32.white)(type);
 }
 function formatDefault(value, type) {
   if (value === void 0) {
-    return chalk31.dim("(none)");
+    return chalk32.dim("(none)");
   }
   if (type === "string" || type === "url") {
-    return chalk31.green(`"${value}"`);
+    return chalk32.green(`"${value}"`);
   }
   if (type === "boolean") {
-    return value ? chalk31.green("true") : chalk31.red("false");
+    return value ? chalk32.green("true") : chalk32.red("false");
   }
-  return chalk31.cyan(String(value));
+  return chalk32.cyan(String(value));
 }
 async function listEnvVars(options) {
   const packageName = options.package || "@spfn/core";
@@ -4924,28 +5043,28 @@ async function listEnvVars(options) {
         acc[target].push([key, schema]);
         return acc;
       }, {});
-      console.log(chalk31.blue.bold(`
+      console.log(chalk32.blue.bold(`
 \u{1F4CB} Environment Variables by File (${packageName})
 `));
       for (const [file, vars] of Object.entries(grouped)) {
-        console.log(chalk31.bold.magenta(`
+        console.log(chalk32.bold.magenta(`
 ${file}`));
-        console.log(chalk31.dim("\u2500".repeat(50)));
+        console.log(chalk32.dim("\u2500".repeat(50)));
         for (const [key, schema] of vars) {
           printEnvVar(key, schema);
         }
       }
     } else {
-      console.log(chalk31.blue.bold(`
+      console.log(chalk32.blue.bold(`
 \u{1F4CB} Environment Variables (${packageName})
 `));
       for (const [key, schema] of allVars) {
         printEnvVar(key, schema, true);
       }
     }
-    console.log(chalk31.dim("\n\u{1F4A1} Tip: Use `spfn env init` to generate .env template files\n"));
+    console.log(chalk32.dim("\n\u{1F4A1} Tip: Use `spfn env init` to generate .env template files\n"));
   } catch (error) {
-    console.error(chalk31.red(`
+    console.error(chalk32.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -4953,17 +5072,17 @@ ${file}`));
 }
 function printEnvVar(key, schema, showFile = false) {
   const typeStr = formatType(schema.type);
-  const requiredStr = schema.required || schema.default !== void 0 ? chalk31.red("[required]") : chalk31.dim("[optional]");
-  const sensitiveStr = schema.sensitive ? chalk31.yellow(" [sensitive]") : "";
-  const fileStr = showFile ? chalk31.dim(` \u2192 ${getTargetFile(schema)}`) : "";
-  console.log(`${chalk31.bold.cyan(key)} ${chalk31.dim("(")}${typeStr}${chalk31.dim(")")} ${requiredStr}${sensitiveStr}${fileStr}`);
-  console.log(`  ${chalk31.dim(schema.description)}`);
+  const requiredStr = schema.required || schema.default !== void 0 ? chalk32.red("[required]") : chalk32.dim("[optional]");
+  const sensitiveStr = schema.sensitive ? chalk32.yellow(" [sensitive]") : "";
+  const fileStr = showFile ? chalk32.dim(` \u2192 ${getTargetFile(schema)}`) : "";
+  console.log(`${chalk32.bold.cyan(key)} ${chalk32.dim("(")}${typeStr}${chalk32.dim(")")} ${requiredStr}${sensitiveStr}${fileStr}`);
+  console.log(`  ${chalk32.dim(schema.description)}`);
   if (schema.default !== void 0) {
-    console.log(`  ${chalk31.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
+    console.log(`  ${chalk32.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
   }
   if (schema.examples && schema.examples.length > 0) {
     const exampleStr = schema.examples.map((ex) => formatDefault(ex, schema.type)).join(", ");
-    console.log(`  ${chalk31.dim("Examples:")} ${exampleStr}`);
+    console.log(`  ${chalk32.dim("Examples:")} ${exampleStr}`);
   }
   console.log();
 }
@@ -4971,7 +5090,7 @@ async function showEnvStats(options) {
   const packageName = options.package || "@spfn/core";
   try {
     const envSchema = await loadEnvSchema(packageName);
-    console.log(chalk31.blue.bold(`
+    console.log(chalk32.blue.bold(`
 \u{1F4CA} Environment Variable Statistics (${packageName})
 `));
     const allVars = Object.entries(envSchema);
@@ -4993,24 +5112,24 @@ async function showEnvStats(options) {
       acc[file] = (acc[file] || 0) + 1;
       return acc;
     }, {});
-    console.log(`${chalk31.bold("Total variables:")} ${chalk31.cyan(allVars.length)}`);
-    console.log(`${chalk31.bold("Required:")} ${chalk31.red(required.length)}`);
-    console.log(`${chalk31.bold("Optional:")} ${chalk31.dim(optional.length)}`);
-    console.log(`${chalk31.bold("Sensitive:")} ${chalk31.yellow(sensitive.length)}`);
-    console.log(chalk31.bold("\nBy Target:"));
-    console.log(`  ${chalk31.blue("Next.js accessible:")} ${chalk31.cyan(nextjsVars.length)}`);
-    console.log(`  ${chalk31.magenta("SPFN server only:")} ${chalk31.cyan(serverOnlyVars.length)}`);
-    console.log(chalk31.bold("\nBy File:"));
+    console.log(`${chalk32.bold("Total variables:")} ${chalk32.cyan(allVars.length)}`);
+    console.log(`${chalk32.bold("Required:")} ${chalk32.red(required.length)}`);
+    console.log(`${chalk32.bold("Optional:")} ${chalk32.dim(optional.length)}`);
+    console.log(`${chalk32.bold("Sensitive:")} ${chalk32.yellow(sensitive.length)}`);
+    console.log(chalk32.bold("\nBy Target:"));
+    console.log(`  ${chalk32.blue("Next.js accessible:")} ${chalk32.cyan(nextjsVars.length)}`);
+    console.log(`  ${chalk32.magenta("SPFN server only:")} ${chalk32.cyan(serverOnlyVars.length)}`);
+    console.log(chalk32.bold("\nBy File:"));
     for (const [file, count] of Object.entries(fileCount)) {
-      console.log(`  ${chalk31.dim(file)}: ${chalk31.cyan(count)}`);
+      console.log(`  ${chalk32.dim(file)}: ${chalk32.cyan(count)}`);
     }
-    console.log(chalk31.bold("\nBy Type:"));
+    console.log(chalk32.bold("\nBy Type:"));
     for (const [type, count] of Object.entries(typeCount)) {
-      console.log(`  ${formatType(type)}: ${chalk31.cyan(count)}`);
+      console.log(`  ${formatType(type)}: ${chalk32.cyan(count)}`);
     }
     console.log();
   } catch (error) {
-    console.error(chalk31.red(`
+    console.error(chalk32.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -5030,40 +5149,40 @@ async function searchEnvVars(query, options) {
       }
     }
     if (results.length === 0) {
-      console.log(chalk31.yellow(`
+      console.log(chalk32.yellow(`
 \u26A0\uFE0F  No environment variables found matching "${query}"
 `));
       return;
     }
-    console.log(chalk31.blue.bold(`
+    console.log(chalk32.blue.bold(`
 \u{1F50D} Found ${results.length} environment variable(s) matching "${query}"
 `));
     for (const [key, schema] of results) {
       const typeStr = formatType(schema.type);
-      const requiredStr = schema.required || schema.default !== void 0 ? chalk31.red("[required]") : chalk31.dim("[optional]");
-      console.log(`${chalk31.bold.cyan(key)} ${chalk31.dim("(")}${typeStr}${chalk31.dim(")")} ${requiredStr}`);
-      console.log(`  ${chalk31.dim(schema.description)}`);
+      const requiredStr = schema.required || schema.default !== void 0 ? chalk32.red("[required]") : chalk32.dim("[optional]");
+      console.log(`${chalk32.bold.cyan(key)} ${chalk32.dim("(")}${typeStr}${chalk32.dim(")")} ${requiredStr}`);
+      console.log(`  ${chalk32.dim(schema.description)}`);
       if (schema.default !== void 0) {
-        console.log(`  ${chalk31.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
+        console.log(`  ${chalk32.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
       }
       console.log();
     }
   } catch (error) {
-    console.error(chalk31.red(`
+    console.error(chalk32.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
   }
 }
-var envCommand = new Command12("env").description("Manage environment variables");
+var envCommand = new Command13("env").description("Manage environment variables");
 envCommand.command("list").description("List all environment variables from schema").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").option("-g, --group", "Group variables by target file").action(listEnvVars);
 envCommand.command("stats").description("Show environment variable statistics").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").action(showEnvStats);
 envCommand.command("search").description("Search environment variables").argument("<query>", "Search query (matches key or description)").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").action(searchEnvVars);
 function validateEnvOption(envValue) {
   if (!VALID_ENVS.includes(envValue)) {
-    console.error(chalk31.red(`
+    console.error(chalk32.red(`
 \u274C Invalid environment: "${envValue}"`));
-    console.log(chalk31.dim(`   Valid values: ${VALID_ENVS.join(", ")}
+    console.log(chalk32.dim(`   Valid values: ${VALID_ENVS.join(", ")}
 `));
     process.exit(1);
   }
@@ -5084,8 +5203,8 @@ async function initEnvFiles(options) {
       return acc;
     }, {});
     if (targetEnv) {
-      console.log(chalk31.blue.bold(`
-\u{1F680} Generating .env template files for ${chalk31.cyan(targetEnv)} environment
+      console.log(chalk32.blue.bold(`
+\u{1F680} Generating .env template files for ${chalk32.cyan(targetEnv)} environment
 `));
       const envSpecificFiles = {};
       const committedVars = allVars.filter(([_, schema]) => !schema.sensitive);
@@ -5101,24 +5220,24 @@ async function initEnvFiles(options) {
         writeEnvTemplate(cwd, file, vars, options.force ?? false);
       }
     } else {
-      console.log(chalk31.blue.bold(`
+      console.log(chalk32.blue.bold(`
 \u{1F680} Generating .env template files
 `));
       for (const [file, vars] of Object.entries(grouped)) {
         writeEnvTemplate(cwd, file, vars, options.force ?? false);
       }
     }
-    console.log(chalk31.dim("\n\u{1F4A1} Copy .example files to create your actual .env files:"));
-    console.log(chalk31.dim("   cp .env.example .env"));
-    console.log(chalk31.dim("   cp .env.local.example .env.local"));
-    console.log(chalk31.dim("   cp .env.server.example .env.server"));
+    console.log(chalk32.dim("\n\u{1F4A1} Copy .example files to create your actual .env files:"));
+    console.log(chalk32.dim("   cp .env.example .env"));
+    console.log(chalk32.dim("   cp .env.local.example .env.local"));
+    console.log(chalk32.dim("   cp .env.server.example .env.server"));
     if (targetEnv) {
-      console.log(chalk31.dim(`   cp .env.${targetEnv}.example .env.${targetEnv}`));
-      console.log(chalk31.dim(`   cp .env.${targetEnv}.local.example .env.${targetEnv}.local`));
+      console.log(chalk32.dim(`   cp .env.${targetEnv}.example .env.${targetEnv}`));
+      console.log(chalk32.dim(`   cp .env.${targetEnv}.local.example .env.${targetEnv}.local`));
     }
     console.log("");
   } catch (error) {
-    console.error(chalk31.red(`
+    console.error(chalk32.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -5127,11 +5246,11 @@ async function initEnvFiles(options) {
 function writeEnvTemplate(cwd, file, vars, force) {
   const filePath = resolve2(cwd, file);
   if (existsSync28(filePath) && !force) {
-    console.log(chalk31.yellow(`  \u23ED\uFE0F  ${file} already exists (use --force to overwrite)`));
+    console.log(chalk32.yellow(`  \u23ED\uFE0F  ${file} already exists (use --force to overwrite)`));
     return;
   }
   writeFileSync17(filePath, generateEnvFileContent(vars), "utf-8");
-  console.log(chalk31.green(`  \u2705 ${file} (${vars.length} variables)`));
+  console.log(chalk32.green(`  \u2705 ${file} (${vars.length} variables)`));
 }
 function generateEnvFileContent(vars) {
   const lines = [
@@ -5166,7 +5285,7 @@ async function checkEnvFiles(options) {
     const envSchema = await loadEnvSchema(packageName);
     const allVars = Object.entries(envSchema);
     const envLabel = targetEnv ? ` (${targetEnv})` : "";
-    console.log(chalk31.blue.bold(`
+    console.log(chalk32.blue.bold(`
 \u{1F50D} Checking .env files against schema${envLabel}
 `));
     const filesToCheck = targetEnv ? getEnvFilesForEnvironment(targetEnv) : [...BASE_ENV_FILES.nextjs, ...BASE_ENV_FILES.server];
@@ -5183,7 +5302,7 @@ async function checkEnvFiles(options) {
       for (const [key, value] of Object.entries(parsed)) {
         loadedEnv[key] = { value: value || "", file };
       }
-      console.log(chalk31.dim(`  \u{1F4C4} ${file} loaded`));
+      console.log(chalk32.dim(`  \u{1F4C4} ${file} loaded`));
     }
     console.log("");
     for (const [key, schema] of allVars) {
@@ -5191,7 +5310,7 @@ async function checkEnvFiles(options) {
       const found = loadedEnv[key];
       if (!found) {
         if (schema.required && schema.default === void 0) {
-          issues.push(`${chalk31.red("\u2717")} ${chalk31.cyan(key)} is required but not found in any .env file`);
+          issues.push(`${chalk32.red("\u2717")} ${chalk32.cyan(key)} is required but not found in any .env file`);
         }
         continue;
       }
@@ -5201,11 +5320,11 @@ async function checkEnvFiles(options) {
       if (!shouldBeNextjs && isNextjsFile && !isServerFile) {
         if (schema.sensitive) {
           issues.push(
-            `${chalk31.red("\u2717")} ${chalk31.cyan(key)} is sensitive and should be in ${chalk31.magenta(expectedFile)}, but found in ${chalk31.yellow(found.file)} (security risk!)`
+            `${chalk32.red("\u2717")} ${chalk32.cyan(key)} is sensitive and should be in ${chalk32.magenta(expectedFile)}, but found in ${chalk32.yellow(found.file)} (security risk!)`
           );
         } else {
           warnings.push(
-            `${chalk31.yellow("\u26A0")} ${chalk31.cyan(key)} should be in ${chalk31.magenta(expectedFile)}, but found in ${chalk31.dim(found.file)}`
+            `${chalk32.yellow("\u26A0")} ${chalk32.cyan(key)} should be in ${chalk32.magenta(expectedFile)}, but found in ${chalk32.dim(found.file)}`
           );
         }
       }
@@ -5213,34 +5332,34 @@ async function checkEnvFiles(options) {
     for (const [key, { file }] of Object.entries(loadedEnv)) {
       const inSchema = allVars.some(([k]) => k === key);
       if (!inSchema) {
-        warnings.push(`${chalk31.yellow("\u26A0")} ${chalk31.cyan(key)} in ${chalk31.dim(file)} is not in schema`);
+        warnings.push(`${chalk32.yellow("\u26A0")} ${chalk32.cyan(key)} in ${chalk32.dim(file)} is not in schema`);
       }
     }
     if (issues.length > 0) {
-      console.log(chalk31.red.bold("Issues:"));
+      console.log(chalk32.red.bold("Issues:"));
       for (const issue of issues) {
         console.log(`  ${issue}`);
       }
       console.log("");
     }
     if (warnings.length > 0) {
-      console.log(chalk31.yellow.bold("Warnings:"));
+      console.log(chalk32.yellow.bold("Warnings:"));
       for (const warning of warnings) {
         console.log(`  ${warning}`);
       }
       console.log("");
     }
     if (issues.length === 0 && warnings.length === 0) {
-      console.log(chalk31.green("\u2705 All environment variables are correctly configured!\n"));
+      console.log(chalk32.green("\u2705 All environment variables are correctly configured!\n"));
     } else {
-      console.log(chalk31.dim(`Found ${issues.length} issue(s) and ${warnings.length} warning(s)
+      console.log(chalk32.dim(`Found ${issues.length} issue(s) and ${warnings.length} warning(s)
 `));
       if (issues.length > 0) {
         process.exit(1);
       }
     }
   } catch (error) {
-    console.error(chalk31.red(`
+    console.error(chalk32.red(`
 \u274C ${error instanceof Error ? error.message : "Unknown error"}
 `));
     process.exit(1);
@@ -5254,15 +5373,15 @@ async function validateEnvVars(options) {
   if (targetEnv) {
     const { loadEnv: loadEnv10 } = await import("@spfn/core/env/loader");
     const result = loadEnv10({ nodeEnv: targetEnv });
-    console.log(chalk31.blue.bold(`
-\u{1F50D} Validating environment variables for ${chalk31.cyan(targetEnv)}
+    console.log(chalk32.blue.bold(`
+\u{1F50D} Validating environment variables for ${chalk32.cyan(targetEnv)}
 `));
     if (result.loadedFiles.length > 0) {
-      console.log(chalk31.dim(`  Loaded: ${result.loadedFiles.join(", ")}`));
+      console.log(chalk32.dim(`  Loaded: ${result.loadedFiles.join(", ")}`));
     }
     console.log("");
   } else {
-    console.log(chalk31.blue.bold(`
+    console.log(chalk32.blue.bold(`
 \u{1F50D} Validating environment variables
 `));
   }
@@ -5270,7 +5389,7 @@ async function validateEnvVars(options) {
   const allWarnings = [];
   for (const packageName of packages) {
     try {
-      console.log(chalk31.dim(`  \u{1F4E6} ${packageName}`));
+      console.log(chalk32.dim(`  \u{1F4E6} ${packageName}`));
       const envSchema = await loadEnvSchema(packageName);
       const { createEnvRegistry } = await import("@spfn/core/env");
       const registry = createEnvRegistry(envSchema);
@@ -5283,10 +5402,10 @@ async function validateEnvVars(options) {
       }
     } catch (error) {
       if (error instanceof Error && error.message.includes("does not export envSchema")) {
-        console.log(chalk31.dim(`    \u23ED\uFE0F  No envSchema exported, skipping`));
+        console.log(chalk32.dim(`    \u23ED\uFE0F  No envSchema exported, skipping`));
         continue;
       }
-      console.error(chalk31.red(`    \u274C Failed to load: ${error instanceof Error ? error.message : String(error)}`));
+      console.error(chalk32.red(`    \u274C Failed to load: ${error instanceof Error ? error.message : String(error)}`));
       if (options.strict) {
         process.exit(1);
       }
@@ -5294,32 +5413,32 @@ async function validateEnvVars(options) {
   }
   console.log("");
   if (allErrors.length > 0) {
-    console.log(chalk31.red.bold(`\u274C Validation Errors (${allErrors.length}):
+    console.log(chalk32.red.bold(`\u274C Validation Errors (${allErrors.length}):
 `));
     for (const error of allErrors) {
-      console.log(`  ${chalk31.red("\u2717")} ${chalk31.cyan(error.key)}`);
-      console.log(`    ${chalk31.dim(error.message)}`);
-      console.log(`    ${chalk31.dim(`from ${error.package}`)}`);
+      console.log(`  ${chalk32.red("\u2717")} ${chalk32.cyan(error.key)}`);
+      console.log(`    ${chalk32.dim(error.message)}`);
+      console.log(`    ${chalk32.dim(`from ${error.package}`)}`);
       console.log("");
     }
   }
   if (allWarnings.length > 0) {
-    console.log(chalk31.yellow.bold(`\u26A0\uFE0F  Warnings (${allWarnings.length}):
+    console.log(chalk32.yellow.bold(`\u26A0\uFE0F  Warnings (${allWarnings.length}):
 `));
     for (const warning of allWarnings) {
-      console.log(`  ${chalk31.yellow("\u26A0")} ${chalk31.cyan(warning.key)}`);
-      console.log(`    ${chalk31.dim(warning.message)}`);
+      console.log(`  ${chalk32.yellow("\u26A0")} ${chalk32.cyan(warning.key)}`);
+      console.log(`    ${chalk32.dim(warning.message)}`);
       console.log("");
     }
   }
   if (allErrors.length === 0 && allWarnings.length === 0) {
-    console.log(chalk31.green.bold("\u2705 All environment variables are valid!\n"));
+    console.log(chalk32.green.bold("\u2705 All environment variables are valid!\n"));
   } else if (allErrors.length === 0) {
-    console.log(chalk31.green("\u2705 No errors found."));
-    console.log(chalk31.yellow(`\u26A0\uFE0F  ${allWarnings.length} warning(s) found.
+    console.log(chalk32.green("\u2705 No errors found."));
+    console.log(chalk32.yellow(`\u26A0\uFE0F  ${allWarnings.length} warning(s) found.
 `));
   } else {
-    console.log(chalk31.red(`
+    console.log(chalk32.red(`
 \u274C Validation failed with ${allErrors.length} error(s)
 `));
     process.exit(1);
@@ -5328,12 +5447,12 @@ async function validateEnvVars(options) {
 envCommand.command("validate").description("Validate environment variables against schema (for CI/CD)").option("-p, --packages <packages...>", "Packages to validate", ["@spfn/core"]).option("-e, --env <environment>", "Load env files for specific environment before validating").option("-s, --strict", "Exit on any error (including load failures)").action(validateEnvVars);
 
 // src/commands/secret/index.ts
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 
 // src/commands/secret/set.ts
 init_logger();
 import prompts9 from "prompts";
-import chalk32 from "chalk";
+import chalk33 from "chalk";
 
 // src/commands/secret/options.ts
 init_logger();
@@ -5348,7 +5467,7 @@ function resolveEnv(env9) {
 
 // src/commands/secret/store-value.ts
 init_logger();
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 init_env_file();
 
 // src/utils/sops.ts
@@ -5397,19 +5516,19 @@ async function sopsUpdateKeys(absFile) {
 
 // src/utils/secret-config.ts
 import { existsSync as existsSync30, readdirSync as readdirSync3 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 var SECRETS_DIR = "secrets";
 function getSopsFile(cwd, env9) {
   const relFile = `${SECRETS_DIR}/${env9}.enc.json`;
-  return { absFile: join26(cwd, relFile), relFile };
+  return { absFile: join27(cwd, relFile), relFile };
 }
 function findUp(cwd, filename, maxDepth = 6) {
   let dir = cwd;
   for (let depth = 0; depth < maxDepth; depth++) {
-    if (existsSync30(join26(dir, filename))) {
+    if (existsSync30(join27(dir, filename))) {
       return dir;
     }
-    const parent = join26(dir, "..");
+    const parent = join27(dir, "..");
     if (parent === dir) {
       break;
     }
@@ -5419,17 +5538,17 @@ function findUp(cwd, filename, maxDepth = 6) {
 }
 function findSopsConfig(cwd) {
   const dir = findUp(cwd, ".sops.yaml");
-  return dir ? join26(dir, ".sops.yaml") : null;
+  return dir ? join27(dir, ".sops.yaml") : null;
 }
 function hasSopsConfig(cwd) {
   return findSopsConfig(cwd) !== null;
 }
 function listSopsFiles(cwd) {
-  const dir = join26(cwd, SECRETS_DIR);
+  const dir = join27(cwd, SECRETS_DIR);
   if (!existsSync30(dir)) {
     return [];
   }
-  return readdirSync3(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join26(dir, name));
+  return readdirSync3(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join27(dir, name));
 }
 
 // src/commands/secret/store-value.ts
@@ -5458,7 +5577,7 @@ async function storeSecret(cwd, env9, key, value) {
       );
     }
     await store.set(keychainName(key), value);
-    const serverEnvPath = join27(cwd, ".env.server");
+    const serverEnvPath = join28(cwd, ".env.server");
     const result = upsertEnvVar(serverEnvPath, key, keychainRef(key));
     restrictEnvFilePerms(serverEnvPath);
     ensureGitignored(cwd, [{ pattern: ".env.server", comment: "spfn server env (secrets)" }]);
@@ -5489,7 +5608,7 @@ async function secretSet(key, options) {
   const { value } = await prompts9({
     type: "password",
     name: "value",
-    message: `Value for ${chalk32.cyan(resolvedKey)} (${env9})`
+    message: `Value for ${chalk33.cyan(resolvedKey)} (${env9})`
   });
   if (!value) {
     logger.warn("Cancelled \u2014 no value entered.");
@@ -5538,7 +5657,7 @@ async function warnIfNotSecret(pkg, key) {
 
 // src/commands/secret/list.ts
 init_logger();
-import chalk33 from "chalk";
+import chalk34 from "chalk";
 async function secretList(options) {
   const env9 = resolveEnv(options.env);
   const pkg = options.package ?? "@spfn/core";
@@ -5554,12 +5673,12 @@ async function secretList(options) {
     return;
   }
   const present = await loadPresence(env9, entries);
-  console.log(chalk33.blue.bold(`
+  console.log(chalk34.blue.bold(`
 \u{1F511} Secrets (${pkg}) \u2014 ${env9}
 `));
   for (const entry of entries) {
     const status = statusOf(entry, present.has(entry.key));
-    console.log(`  ${badge(status)} ${chalk33.cyan(entry.key)}${entry.generate ? chalk33.dim(" (generatable)") : ""}`);
+    console.log(`  ${badge(status)} ${chalk34.cyan(entry.key)}${entry.generate ? chalk34.dim(" (generatable)") : ""}`);
   }
   console.log();
 }
@@ -5592,17 +5711,17 @@ function statusOf(entry, present) {
 function badge(status) {
   switch (status) {
     case "set":
-      return chalk33.green("\u25CF");
+      return chalk34.green("\u25CF");
     case "missing":
-      return chalk33.yellow("\u25CB");
+      return chalk34.yellow("\u25CB");
     case "awaiting-input":
-      return chalk33.red("\u25CB");
+      return chalk34.red("\u25CB");
   }
 }
 
 // src/commands/secret/generate.ts
 init_logger();
-import chalk34 from "chalk";
+import chalk35 from "chalk";
 async function secretGenerate(key, options) {
   const env9 = resolveEnv(options.env);
   const pkg = options.package ?? "@spfn/core";
@@ -5640,7 +5759,7 @@ function requireGeneratable(schema, key) {
     process.exit(1);
   }
   if (!entry.generate) {
-    logger.error(`${chalk34.cyan(key)} has no generate strategy \u2014 it's an external value. Use \`spfn secret set ${key}\`.`);
+    logger.error(`${chalk35.cyan(key)} has no generate strategy \u2014 it's an external value. Use \`spfn secret set ${key}\`.`);
     process.exit(1);
   }
   return entry;
@@ -5648,7 +5767,7 @@ function requireGeneratable(schema, key) {
 
 // src/commands/secret/rotate.ts
 init_logger();
-import chalk35 from "chalk";
+import chalk36 from "chalk";
 async function secretRotate(key, options) {
   const env9 = resolveEnv(options.env);
   const pkg = options.package ?? "@spfn/core";
@@ -5674,7 +5793,7 @@ async function secretRotate(key, options) {
     }
   }
   for (const entry of external) {
-    logger.warn(`${chalk35.cyan(entry.key)} is external \u2014 reissue it at the provider, then \`spfn secret set ${entry.key} --env ${env9}\`.`);
+    logger.warn(`${chalk36.cyan(entry.key)} is external \u2014 reissue it at the provider, then \`spfn secret set ${entry.key} --env ${env9}\`.`);
   }
   if (generatable.length > 0) {
     logger.info("Rotation updates the source only \u2014 commit and deploy to apply.");
@@ -5698,10 +5817,10 @@ init_logger();
 import { execa as execa12 } from "execa";
 import { existsSync as existsSync31, mkdirSync as mkdirSync6 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname5, join as join28 } from "path";
-import chalk36 from "chalk";
+import { dirname as dirname5, join as join29 } from "path";
+import chalk37 from "chalk";
 function ageKeyFile() {
-  return process.env.SOPS_AGE_KEY_FILE ?? join28(homedir(), ".config", "sops", "age", "keys.txt");
+  return process.env.SOPS_AGE_KEY_FILE ?? join29(homedir(), ".config", "sops", "age", "keys.txt");
 }
 async function ensureAgeInstalled() {
   try {
@@ -5737,27 +5856,27 @@ function printPublicKeys(keys) {
     logger.warn("Could not read the public key \u2014 run `age-keygen -y <file>` manually.");
     return;
   }
-  console.log(chalk36.bold("\nPublic key(s):"));
+  console.log(chalk37.bold("\nPublic key(s):"));
   for (const key of keys) {
-    console.log(`  ${chalk36.cyan(key)}`);
+    console.log(`  ${chalk37.cyan(key)}`);
   }
-  console.log(chalk36.dim("\nRegister it as a recipient:"));
-  console.log(chalk36.dim(`  spfn secret recipients add ${keys[0]}
+  console.log(chalk37.dim("\nRegister it as a recipient:"));
+  console.log(chalk37.dim(`  spfn secret recipients add ${keys[0]}
 `));
 }
 
 // src/commands/secret/recipients.ts
 init_logger();
 import { existsSync as existsSync32, readFileSync as readFileSync13, writeFileSync as writeFileSync19 } from "fs";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 import { parse as parse3, stringify } from "yaml";
-import chalk37 from "chalk";
+import chalk38 from "chalk";
 var SOPS_CONFIG = ".sops.yaml";
 var DEFAULT_PATH_REGEX = "secrets/.*\\.enc\\.json$";
 var AGE_RECIPIENT = /^age1[0-9a-z]+$/;
 async function secretRecipients(action, key, _options) {
   const cwd = process.cwd();
-  const configPath = join29(cwd, SOPS_CONFIG);
+  const configPath = join30(cwd, SOPS_CONFIG);
   if (action === "list") {
     listRecipients(configPath);
     return;
@@ -5795,13 +5914,13 @@ function listRecipients(configPath) {
   }
   const config = loadConfig(configPath);
   const rules = config.creation_rules ?? [];
-  console.log(chalk37.blue.bold(`
+  console.log(chalk38.blue.bold(`
 \u{1F465} Recipients (${SOPS_CONFIG})
 `));
   for (const rule of rules) {
-    console.log(chalk37.dim(`  ${rule.path_regex ?? "(any path)"}`));
+    console.log(chalk38.dim(`  ${rule.path_regex ?? "(any path)"}`));
     for (const recipient of parseRecipients(rule.age)) {
-      console.log(`    ${chalk37.cyan(recipient)}`);
+      console.log(`    ${chalk38.cyan(recipient)}`);
     }
   }
   console.log();
@@ -5842,8 +5961,8 @@ async function reencrypt(cwd) {
 
 // src/commands/secret/check.ts
 init_logger();
-import { join as join30 } from "path";
-import chalk38 from "chalk";
+import { join as join31 } from "path";
+import chalk39 from "chalk";
 init_env_file();
 var COMMITTED_FILES = [".env", ".env.example"];
 var PLACEHOLDER = /(your-|changeme|placeholder|example|<.*>)/i;
@@ -5861,35 +5980,35 @@ async function secretCheck(options) {
   const issues = [];
   const warnings = [];
   for (const file of COMMITTED_FILES) {
-    const parsed = parseEnvFile(join30(cwd, file));
+    const parsed = parseEnvFile(join31(cwd, file));
     for (const [key, value] of Object.entries(parsed)) {
       if (secretKeys.has(key) && value.length > 0 && !PLACEHOLDER.test(value)) {
-        issues.push(`${chalk38.cyan(key)} has a real value in committed ${chalk38.yellow(file)} \u2014 move it to the keychain/SOPS.`);
+        issues.push(`${chalk39.cyan(key)} has a real value in committed ${chalk39.yellow(file)} \u2014 move it to the keychain/SOPS.`);
       }
     }
   }
-  const serverEnv = parseEnvFile(join30(cwd, ".env.server"));
+  const serverEnv = parseEnvFile(join31(cwd, ".env.server"));
   for (const key of secretKeys) {
     const value = serverEnv[key];
     if (value && !value.startsWith(KEYCHAIN_REF_PREFIX)) {
-      warnings.push(`${chalk38.cyan(key)} is plaintext in .env.server \u2014 run \`spfn secret set ${key}\` to move it to the keychain.`);
+      warnings.push(`${chalk39.cyan(key)} is plaintext in .env.server \u2014 run \`spfn secret set ${key}\` to move it to the keychain.`);
     }
   }
   report(issues, warnings, cwd);
 }
 function report(issues, warnings, cwd) {
-  console.log(chalk38.blue.bold("\n\u{1F50D} Secret hygiene check\n"));
+  console.log(chalk39.blue.bold("\n\u{1F50D} Secret hygiene check\n"));
   for (const issue of issues) {
-    console.log(`  ${chalk38.red("\u2717")} ${issue}`);
+    console.log(`  ${chalk39.red("\u2717")} ${issue}`);
   }
   for (const warning of warnings) {
-    console.log(`  ${chalk38.yellow("\u26A0")} ${warning}`);
+    console.log(`  ${chalk39.yellow("\u26A0")} ${warning}`);
   }
   if (!hasSopsConfig(cwd)) {
-    console.log(`  ${chalk38.dim("\u2139 no .sops.yaml \u2014 prod secrets need a backend (spfn secret keygen, or add a KMS rule)")}`);
+    console.log(`  ${chalk39.dim("\u2139 no .sops.yaml \u2014 prod secrets need a backend (spfn secret keygen, or add a KMS rule)")}`);
   }
   if (issues.length === 0 && warnings.length === 0) {
-    console.log(chalk38.green("  \u2713 No plaintext secret leaks found."));
+    console.log(chalk39.green("  \u2713 No plaintext secret leaks found."));
   }
   console.log();
   if (issues.length > 0) {
@@ -5900,7 +6019,7 @@ function report(issues, warnings, cwd) {
 // src/commands/secret/index.ts
 var ENV_OPTION = ["-e, --env <env>", "Target environment (local | development | staging | production)", "local"];
 var PKG_OPTION = ["-p, --package <package>", "Package whose env schema to read", "@spfn/core"];
-var secretCommand = new Command13("secret").description("Manage secrets: keychain locally, SOPS (age / GCP KMS / AWS KMS) for deployed environments");
+var secretCommand = new Command14("secret").description("Manage secrets: keychain locally, SOPS (age / GCP KMS / AWS KMS) for deployed environments");
 secretCommand.command("set [key]").description("Store a secret value (prompts for the value, masked)").option(...ENV_OPTION).option(...PKG_OPTION).action(secretSet);
 secretCommand.command("list").description("List declared secrets and their status (never prints values)").option(...ENV_OPTION).option(...PKG_OPTION).action(secretList);
 secretCommand.command("generate [key]").description("Generate value(s) for schema secrets that declare a generate strategy").option("-a, --all", "Generate every generatable secret").option(...ENV_OPTION).option(...PKG_OPTION).action(secretGenerate);
@@ -5911,7 +6030,7 @@ secretCommand.command("check").description("Static hygiene lint \u2014 flag plai
 
 // src/index.ts
 init_version();
-var program = new Command14();
+var program = new Command15();
 program.name("spfn").description("SPFN CLI - The Missing Backend for Next.js").version(getCliVersion());
 program.addCommand(createCommand);
 program.addCommand(initCommand);
@@ -5921,6 +6040,7 @@ program.addCommand(buildCommand);
 program.addCommand(startCommand);
 program.addCommand(provisionCommand);
 program.addCommand(codegenCommand);
+program.addCommand(contractCommand);
 program.addCommand(keyCommand);
 program.addCommand(setupCommand);
 program.addCommand(dbCommand);