spfn 0.2.0-beta.67 → 0.2.0-beta.68

package/dist/index.js

@@ -922,7 +922,7 @@ var init_deployment_config = __esm({
 
 // src/utils/version.ts
 function getCliVersion() {
-  return "0.2.0-beta.67";
+  return "0.2.0-beta.68";
 }
 function getTagFromVersion(version) {
   const match = version.match(/-([a-z]+)\./i);
@@ -955,19 +955,19 @@ async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManage
   packageJson.dependencies["pg"] = "^8.16.3";
   packageJson.dependencies["spfn"] = spfnTag;
   packageJson.dependencies["concurrently"] = "^9.2.1";
+  packageJson.engines = packageJson.engines || {};
+  const existingNodeRange = packageJson.engines.node;
+  if (!existingNodeRange || !requiresNode20OrNewer(existingNodeRange)) {
+    packageJson.engines.node = ">=20.0.0";
+    if (existingNodeRange) {
+      logger.warn(`Updated engines.node from "${existingNodeRange}" to ">=20.0.0" because @spfn/core requires Node 20`);
+    }
+  }
   if (mode === "full") {
     packageJson.dependencies["@spfn/auth"] = spfnTag;
     packageJson.dependencies["@spfn/i18n"] = spfnTag;
     packageJson.dependencies["@spfn/mcp"] = spfnTag;
     packageJson.dependencies["@spfn/notification"] = spfnTag;
-    packageJson.engines = packageJson.engines || {};
-    const existingNodeRange = packageJson.engines.node;
-    if (!existingNodeRange || !requiresNode20OrNewer(existingNodeRange)) {
-      packageJson.engines.node = ">=20.0.0";
-      if (existingNodeRange) {
-        logger.warn(`Updated engines.node from "${existingNodeRange}" to ">=20.0.0" because full mode includes @spfn/mcp`);
-      }
-    }
   }
   packageJson.devDependencies["@types/node"] = "^20.11.0";
   packageJson.devDependencies["tsx"] = "^4.20.6";
@@ -1515,6 +1515,82 @@ var init_init = __esm({
   }
 });
 
+// src/utils/migration-status.ts
+var migration_status_exports = {};
+__export(migration_status_exports, {
+  checkPendingMigrationsBeforeStart: () => checkPendingMigrationsBeforeStart,
+  filterPendingEntries: () => filterPendingEntries,
+  functionMigrationsTable: () => functionMigrationsTable,
+  getMigrationStatus: () => getMigrationStatus,
+  migrationTargets: () => migrationTargets,
+  pendingMigrationTargets: () => pendingMigrationTargets2
+});
+import chalk6 from "chalk";
+import {
+  collectMigrationStatus,
+  formatPendingMigrations,
+  pendingMigrationTargets,
+  pendingMigrationsSummary,
+  RUN_MIGRATIONS_HINT
+} from "@spfn/core/db";
+import { env } from "@spfn/core/config";
+import { loadEnv } from "@spfn/core/server";
+import {
+  filterPendingEntries,
+  functionMigrationsTable,
+  migrationTargets,
+  pendingMigrationTargets as pendingMigrationTargets2
+} from "@spfn/core/db";
+async function getMigrationStatus(cwd = process.cwd(), databaseUrl) {
+  loadEnv();
+  const url = databaseUrl ?? env.DATABASE_URL;
+  if (!url) {
+    throw new Error("DATABASE_URL not found in environment");
+  }
+  const { drizzle } = await import("drizzle-orm/postgres-js");
+  const postgres = await import("postgres");
+  const connection = postgres.default(url, { max: 1, connect_timeout: 5 });
+  try {
+    return await collectMigrationStatus(drizzle({ client: connection }), cwd);
+  } finally {
+    await connection.end();
+  }
+}
+async function checkPendingMigrationsBeforeStart(cwd, databaseUrl, flagAllowsPending) {
+  loadEnv();
+  const allowPending = flagAllowsPending || env.SPFN_ALLOW_PENDING_MIGRATIONS === true;
+  let status;
+  try {
+    status = await getMigrationStatus(cwd, databaseUrl);
+  } catch {
+    return { block: false, allowPending };
+  }
+  const targets = pendingMigrationTargets(status);
+  if (targets.length === 0) {
+    return { block: false, allowPending };
+  }
+  const lines = formatPendingMigrations(targets);
+  console.log("");
+  if (allowPending) {
+    console.warn(chalk6.yellow(`\u26A0\uFE0F  Starting with pending migrations \u2014 ${pendingMigrationsSummary(targets)}`));
+    lines.forEach((line) => console.warn(chalk6.yellow(`   ${line}`)));
+    console.warn(chalk6.yellow(`   Requests hitting the missing columns will fail. ${RUN_MIGRATIONS_HINT}
+`));
+    return { block: false, allowPending };
+  }
+  console.error(chalk6.red(`\u274C Refusing to start: ${pendingMigrationsSummary(targets)}`));
+  lines.forEach((line) => console.error(chalk6.red(`   ${line}`)));
+  console.error(chalk6.yellow(`
+   ${RUN_MIGRATIONS_HINT}`));
+  console.error(chalk6.dim("   To start anyway: --allow-pending-migrations, or SPFN_ALLOW_PENDING_MIGRATIONS=true\n"));
+  return { block: true, allowPending };
+}
+var init_migration_status = __esm({
+  "src/utils/migration-status.ts"() {
+    "use strict";
+  }
+});
+
 // src/utils/function-migrations.ts
 var function_migrations_exports = {};
 __export(function_migrations_exports, {
@@ -1524,120 +1600,20 @@ __export(function_migrations_exports, {
   loadFunctionMigrationPlans: () => loadFunctionMigrationPlans,
   readMigrationEntries: () => readMigrationEntries
 });
-import chalk6 from "chalk";
-import { createHash } from "crypto";
-import { join as join15 } from "path";
-import { env } from "@spfn/core/config";
-import { loadEnv } from "@spfn/core/server";
-import { existsSync as existsSync14, readdirSync, readFileSync as readFileSync7 } from "fs";
-function discoverFunctionMigrations(cwd = process.cwd()) {
-  const nodeModulesPath = join15(cwd, "node_modules");
-  if (!existsSync14(nodeModulesPath)) {
-    return [];
-  }
-  const functions = [];
-  const spfnDir = join15(nodeModulesPath, "@spfn");
-  if (!existsSync14(spfnDir)) {
-    return [];
-  }
-  const packages = readdirSync(spfnDir);
-  for (const pkg of packages) {
-    const packagePath = join15(spfnDir, pkg);
-    const packageJsonPath = join15(packagePath, "package.json");
-    if (!existsSync14(packageJsonPath)) {
-      continue;
-    }
-    try {
-      const packageJson = JSON.parse(readFileSync7(packageJsonPath, "utf-8"));
-      const spfnConfig = packageJson.spfn;
-      if (!spfnConfig?.migrations) {
-        continue;
-      }
-      const migrationsDir = join15(packagePath, spfnConfig.migrations.dir);
-      if (!existsSync14(migrationsDir)) {
-        console.warn(
-          chalk6.yellow(`\u26A0\uFE0F  Package @spfn/${pkg} specifies migrations but directory not found: ${migrationsDir}`)
-        );
-        continue;
-      }
-      functions.push({
-        packageName: `@spfn/${pkg}`,
-        migrationsDir,
-        packagePath
-      });
-    } catch (error) {
-      console.warn(chalk6.yellow(`\u26A0\uFE0F  Failed to parse package.json for @spfn/${pkg}`));
-    }
-  }
-  return functions;
-}
-function readMigrationEntries(migrationsDir, packageName) {
-  const journalPath = join15(migrationsDir, "meta", "_journal.json");
-  return existsSync14(journalPath) ? readJournalEntries(migrationsDir, journalPath, packageName) : readFolderEntries(migrationsDir, packageName);
-}
+import chalk15 from "chalk";
+import {
+  discoverFunctionMigrations,
+  functionMigrationsTable as functionMigrationsTable2,
+  readMigrationEntries
+} from "@spfn/core/db";
+import { env as env3 } from "@spfn/core/config";
+import { loadEnv as loadEnv3 } from "@spfn/core/server";
 function loadFunctionMigrationPlans(functionMigrations) {
   return functionMigrations.map((func) => ({
     ...func,
     entries: readMigrationEntries(func.migrationsDir, func.packageName)
   }));
 }
-function readJournalEntries(migrationsDir, journalPath, packageName) {
-  let journal;
-  try {
-    journal = JSON.parse(readFileSync7(journalPath, "utf-8"));
-  } catch {
-    journal = {};
-  }
-  if (!Array.isArray(journal.entries)) {
-    throw new Error(`${packageName}: invalid migration journal at ${journalPath}`);
-  }
-  const entries = [...journal.entries];
-  entries.sort((a, b) => a.idx - b.idx);
-  return entries.map((entry) => {
-    if (typeof entry?.tag !== "string" || typeof entry?.when !== "number") {
-      throw new Error(`${packageName}: invalid journal entry in ${journalPath}`);
-    }
-    const sqlPath = join15(migrationsDir, `${entry.tag}.sql`);
-    if (!existsSync14(sqlPath)) {
-      throw new Error(`${packageName}: migration file not found: ${entry.tag}.sql`);
-    }
-    return toEntry(entry.tag, readFileSync7(sqlPath, "utf-8"), entry.when);
-  });
-}
-function readFolderEntries(migrationsDir, packageName) {
-  const folders = readdirSync(migrationsDir, { withFileTypes: true }).filter((dirent) => dirent.isDirectory()).map((dirent) => dirent.name).filter((name) => existsSync14(join15(migrationsDir, name, "migration.sql"))).sort((a, b) => a.localeCompare(b));
-  return folders.map((name) => toEntry(
-    name,
-    readFileSync7(join15(migrationsDir, name, "migration.sql"), "utf-8"),
-    folderTimestampMillis(name, packageName)
-  ));
-}
-function folderTimestampMillis(name, packageName) {
-  const match = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})/.exec(name);
-  if (!match) {
-    throw new Error(`${packageName}: migration folder name must start with a YYYYMMDDHHMMSS timestamp: ${name}`);
-  }
-  const [, year, month, day, hour, minute, second] = match;
-  return Date.UTC(
-    Number(year),
-    Number(month) - 1,
-    Number(day),
-    Number(hour),
-    Number(minute),
-    Number(second)
-  );
-}
-function toEntry(name, content, millis) {
-  return {
-    name,
-    millis,
-    hash: createHash("sha256").update(content).digest("hex"),
-    statements: content.split("--> statement-breakpoint").map((statement) => statement.trim()).filter((statement) => statement.length > 0)
-  };
-}
-function functionMigrationsTable(packageName) {
-  return `__spfn_fn_${packageName.replace("@spfn/", "")}_migrations`;
-}
 async function migrateLegacyTable(db, plans) {
   const legacyCheck = await db.query(
     `SELECT EXISTS (
@@ -1648,7 +1624,7 @@ async function migrateLegacyTable(db, plans) {
   if (!legacyCheck[0]?.exists) {
     return;
   }
-  console.log(chalk6.dim("\n  Migrating legacy shared migration table to per-package tables..."));
+  console.log(chalk15.dim("\n  Migrating legacy shared migration table to per-package tables..."));
   const legacyRows = await db.query(
     `SELECT hash, created_at FROM drizzle."__spfn_fn_migrations" ORDER BY id`
   );
@@ -1658,7 +1634,7 @@ async function migrateLegacyTable(db, plans) {
   }
   const legacyHashes = new Set(legacyRows.map((row) => row.hash));
   for (const plan of plans) {
-    const tableName = functionMigrationsTable(plan.packageName);
+    const tableName = functionMigrationsTable2(plan.packageName);
     await ensureMigrationsTable(db, tableName);
     const existing = await db.query(
       `SELECT COUNT(*) AS "count" FROM drizzle."${tableName}"`
@@ -1678,11 +1654,11 @@ async function migrateLegacyTable(db, plans) {
       copied++;
     }
     if (copied > 0) {
-      console.log(chalk6.dim(`    \u2713 ${plan.packageName}: copied ${copied} migration record(s)`));
+      console.log(chalk15.dim(`    \u2713 ${plan.packageName}: copied ${copied} migration record(s)`));
     }
   }
   await db.query(`DROP TABLE drizzle."__spfn_fn_migrations"`);
-  console.log(chalk6.dim("    \u2713 Legacy migration table removed\n"));
+  console.log(chalk15.dim("    \u2713 Legacy migration table removed\n"));
 }
 async function ensureMigrationsTable(db, tableName) {
   await db.query(`CREATE SCHEMA IF NOT EXISTS drizzle`);
@@ -1695,7 +1671,7 @@ async function ensureMigrationsTable(db, tableName) {
   );
 }
 async function applyFunctionMigrationPlan(db, plan) {
-  const tableName = functionMigrationsTable(plan.packageName);
+  const tableName = functionMigrationsTable2(plan.packageName);
   await ensureMigrationsTable(db, tableName);
   const rows = await db.query(
     `SELECT created_at FROM drizzle."${tableName}" ORDER BY created_at DESC LIMIT 1`
@@ -1726,20 +1702,20 @@ function createPostgresJsMigrationDb(client) {
 }
 async function executeFunctionMigrations(plans) {
   const postgres = await import("postgres");
-  loadEnv();
-  if (!env.DATABASE_URL) {
+  loadEnv3();
+  if (!env3.DATABASE_URL) {
     throw new Error("DATABASE_URL not found in environment");
   }
-  const connection = postgres.default(env.DATABASE_URL, { max: 1 });
+  const connection = postgres.default(env3.DATABASE_URL, { max: 1 });
   const db = createPostgresJsMigrationDb(connection);
   let appliedCount = 0;
   try {
     await migrateLegacyTable(db, plans);
     for (const plan of plans) {
-      console.log(chalk6.blue(`
+      console.log(chalk15.blue(`
   \u{1F4E6} Running ${plan.packageName} migrations...`));
       const applied = await applyFunctionMigrationPlan(db, plan);
-      console.log(applied > 0 ? chalk6.green(`  \u2713 ${plan.packageName}: ${applied} migration(s) applied`) : chalk6.dim(`  \u2013 ${plan.packageName}: up to date`));
+      console.log(applied > 0 ? chalk15.green(`  \u2713 ${plan.packageName}: ${applied} migration(s) applied`) : chalk15.dim(`  \u2013 ${plan.packageName}: up to date`));
       appliedCount += applied;
     }
   } finally {
@@ -1753,112 +1729,6 @@ var init_function_migrations = __esm({
   }
 });
 
-// src/utils/migration-status.ts
-var migration_status_exports = {};
-__export(migration_status_exports, {
-  filterPendingEntries: () => filterPendingEntries,
-  functionMigrationsTable: () => functionMigrationsTable2,
-  getMigrationStatus: () => getMigrationStatus,
-  warnPendingMigrations: () => warnPendingMigrations
-});
-import { join as join16 } from "path";
-import { existsSync as existsSync15 } from "fs";
-import chalk7 from "chalk";
-import { env as env2 } from "@spfn/core/config";
-import { loadEnv as loadEnv2 } from "@spfn/core/server";
-function functionMigrationsTable2(packageName) {
-  return `__spfn_fn_${packageName.replace("@spfn/", "")}_migrations`;
-}
-function filterPendingEntries(entries, lastAppliedMillis, appliedNames) {
-  return entries.filter((entry) => entry.millis > lastAppliedMillis && !appliedNames.has(entry.name));
-}
-async function readAppliedNames(sql2, tableName) {
-  const columnCheck = await sql2`
-        SELECT EXISTS (
-            SELECT 1 FROM information_schema.columns
-            WHERE table_schema = 'drizzle' AND table_name = ${tableName} AND column_name = 'name'
-        ) AS "exists"`;
-  if (!columnCheck[0]?.exists) {
-    return /* @__PURE__ */ new Set();
-  }
-  const rows = await sql2`
-        SELECT name FROM drizzle.${sql2(tableName)} WHERE name IS NOT NULL`;
-  return new Set(rows.map((row) => row.name));
-}
-async function collectTargetStatus(sql2, name, migrationsDir, tableName) {
-  const entries = readMigrationEntries(migrationsDir, name);
-  const tableCheck = await sql2`
-        SELECT EXISTS (
-            SELECT 1 FROM information_schema.tables
-            WHERE table_schema = 'drizzle' AND table_name = ${tableName}
-        ) AS "exists"`;
-  let lastApplied = 0;
-  let appliedNames = /* @__PURE__ */ new Set();
-  if (tableCheck[0]?.exists) {
-    const rows = await sql2`
-            SELECT created_at FROM drizzle.${sql2(tableName)}
-            ORDER BY created_at DESC LIMIT 1`;
-    lastApplied = rows[0]?.created_at ? Number(rows[0].created_at) : 0;
-    appliedNames = await readAppliedNames(sql2, tableName);
-  }
-  const pendingEntries = filterPendingEntries(entries, lastApplied, appliedNames);
-  return {
-    name,
-    total: entries.length,
-    applied: entries.length - pendingEntries.length,
-    pending: pendingEntries.length,
-    pendingTags: pendingEntries.map((e) => e.name)
-  };
-}
-async function getMigrationStatus(cwd = process.cwd(), databaseUrl) {
-  loadEnv2();
-  const url = databaseUrl ?? env2.DATABASE_URL;
-  if (!url) {
-    throw new Error("DATABASE_URL not found in environment");
-  }
-  const postgres = await import("postgres");
-  const sql2 = postgres.default(url, { max: 1, connect_timeout: 5 });
-  try {
-    const packages = [];
-    for (const func of discoverFunctionMigrations(cwd)) {
-      packages.push(await collectTargetStatus(
-        sql2,
-        func.packageName,
-        func.migrationsDir,
-        functionMigrationsTable2(func.packageName)
-      ));
-    }
-    const projectDir = join16(cwd, "src", "server", "drizzle");
-    const project = existsSync15(projectDir) ? await collectTargetStatus(sql2, "project (src/server/drizzle)", projectDir, "__drizzle_migrations") : null;
-    return { packages, project: project && project.total > 0 ? project : null };
-  } finally {
-    await sql2.end();
-  }
-}
-async function warnPendingMigrations(cwd, databaseUrl) {
-  let status;
-  try {
-    status = await getMigrationStatus(cwd, databaseUrl);
-  } catch {
-    return;
-  }
-  const targets = [...status.packages, ...status.project ? [status.project] : []].filter((t) => t.pending > 0);
-  if (targets.length === 0) {
-    return;
-  }
-  console.warn("");
-  for (const target of targets) {
-    console.warn(chalk7.yellow(`\u26A0\uFE0F  ${target.name}: ${target.pending} pending migration(s)`));
-  }
-  console.warn(chalk7.yellow("   Missing tables will fail at request time \u2014 run: pnpm spfn db migrate\n"));
-}
-var init_migration_status = __esm({
-  "src/utils/migration-status.ts"() {
-    "use strict";
-    init_function_migrations();
-  }
-});
-
 // src/index.ts
 import { Command as Command15 } from "commander";
 
@@ -2057,8 +1927,8 @@ init_init();
 init_logger();
 init_package_manager();
 import { Command as Command4 } from "commander";
-import { existsSync as existsSync16, readFileSync as readFileSync8, writeFileSync as writeFileSync10, mkdirSync, unlinkSync, rmSync, watch } from "fs";
-import { join as join17, relative, sep as sep2 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync7, writeFileSync as writeFileSync10, mkdirSync, unlinkSync, rmSync, watch } from "fs";
+import { join as join15, relative, sep as sep2 } from "path";
 import { execa as execa6 } from "execa";
 import chokidar from "chokidar";
 
@@ -2257,32 +2127,32 @@ function ignoreDotfilesUnder(root) {
 }
 function waitForReadyFile(filePath, timeoutMs = 3e4) {
   return new Promise((resolve3, reject) => {
-    if (existsSync16(filePath)) {
+    if (existsSync14(filePath)) {
       unlinkSync(filePath);
     }
     const timer = setTimeout(() => {
       watcher.close();
       reject(new Error(`Server did not become ready within ${timeoutMs / 1e3}s`));
     }, timeoutMs);
-    const dir = join17(filePath, "..");
+    const dir = join15(filePath, "..");
     const fileName = filePath.split("/").pop();
     const watcher = watch(dir, (_event, name) => {
-      if (name === fileName && existsSync16(filePath)) {
+      if (name === fileName && existsSync14(filePath)) {
         watcher.close();
         clearTimeout(timer);
-        resolve3(readFileSync8(filePath, "utf-8").trim());
+        resolve3(readFileSync7(filePath, "utf-8").trim());
       }
     });
   });
 }
-var devCommand = new Command4("dev").description("Start SPFN development server (detects and runs Next.js + Hono)").option("-p, --port <port>", "Server port").option("-H, --host <host>", "Server host").option("--routes <path>", "Routes directory path").option("--server-only", "Run only Hono server (skip Next.js)").option("--watch", "Enable hot reload (watch mode)").action(async (options) => {
+var devCommand = new Command4("dev").description("Start SPFN development server (detects and runs Next.js + Hono)").option("-p, --port <port>", "Server port").option("-H, --host <host>", "Server host").option("--routes <path>", "Routes directory path").option("--server-only", "Run only Hono server (skip Next.js)").option("--watch", "Enable hot reload (watch mode)").option("--allow-pending-migrations", "Start even when migrations are pending (they are listed as a warning)").action(async (options) => {
   process.setMaxListeners(20);
   if (!process.env.NODE_ENV) {
     process.env.NODE_ENV = "development";
   }
   const cwd = process.cwd();
-  const serverDir = join17(cwd, "src", "server");
-  if (!existsSync16(serverDir)) {
+  const serverDir = join15(cwd, "src", "server");
+  if (!existsSync14(serverDir)) {
     logger.error("src/server directory not found.");
     logger.info('Run "spfn init" first to initialize SPFN in your project.');
     process.exit(1);
@@ -2296,25 +2166,35 @@ var devCommand = new Command4("dev").description("Start SPFN development server
     logger.warn(`[SPFN] Could not resolve keychain secret(s): ${keychainMissing.join(", ")} \u2014 run \`spfn secret set <KEY>\``);
   }
   const serverEnv = { ...process.env, ...keychainEnv };
-  const { warnPendingMigrations: warnPendingMigrations2 } = await Promise.resolve().then(() => (init_migration_status(), migration_status_exports));
-  await warnPendingMigrations2(cwd, serverEnv.DATABASE_URL);
-  const packageJsonPath = join17(cwd, "package.json");
+  const { checkPendingMigrationsBeforeStart: checkPendingMigrationsBeforeStart2 } = await Promise.resolve().then(() => (init_migration_status(), migration_status_exports));
+  const migrationCheck = await checkPendingMigrationsBeforeStart2(
+    cwd,
+    serverEnv.DATABASE_URL,
+    options.allowPendingMigrations === true
+  );
+  if (migrationCheck.block) {
+    process.exit(1);
+  }
+  if (migrationCheck.allowPending) {
+    serverEnv.SPFN_ALLOW_PENDING_MIGRATIONS = "true";
+  }
+  const packageJsonPath = join15(cwd, "package.json");
   let hasNext = false;
-  if (existsSync16(packageJsonPath)) {
-    const packageJson = JSON.parse(readFileSync8(packageJsonPath, "utf-8"));
+  if (existsSync14(packageJsonPath)) {
+    const packageJson = JSON.parse(readFileSync7(packageJsonPath, "utf-8"));
     hasNext = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
   }
-  const tempDir = join17(cwd, ".spfn");
-  const serverEntry = join17(tempDir, "server.mjs");
-  const watcherEntry = join17(tempDir, "watcher.mjs");
+  const tempDir = join15(cwd, ".spfn");
+  const serverEntry = join15(tempDir, "server.mjs");
+  const watcherEntry = join15(tempDir, "watcher.mjs");
   mkdirSync(tempDir, { recursive: true });
-  const serverBuildDir = join17(tempDir, "server");
-  if (existsSync16(serverBuildDir)) {
+  const serverBuildDir = join15(tempDir, "server");
+  if (existsSync14(serverBuildDir)) {
     rmSync(serverBuildDir, { recursive: true, force: true });
     logger.info("[SPFN] Cleaned stale build cache (.spfn/server)");
   }
-  const readySignal = join17(tempDir, "server-ready");
-  if (existsSync16(readySignal)) {
+  const readySignal = join15(tempDir, "server-ready");
+  if (existsSync14(readySignal)) {
     unlinkSync(readySignal);
   }
   const configParts = [];
@@ -2322,7 +2202,7 @@ var devCommand = new Command4("dev").description("Start SPFN development server
   if (options.host) configParts.push(`host: '${options.host}'`);
   if (options.routes) configParts.push(`routesPath: '${options.routes}'`);
   configParts.push("debug: true");
-  const readyFile = join17(tempDir, "server-ready");
+  const readyFile = join15(tempDir, "server-ready");
   writeFileSync10(serverEntry, `
 import { writeFileSync } from 'fs';
 
@@ -2612,11 +2492,11 @@ catch (error)
 init_logger();
 init_package_manager();
 import { Command as Command5 } from "commander";
-import { existsSync as existsSync17, writeFileSync as writeFileSync11, mkdirSync as mkdirSync2, readdirSync as readdirSync2 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync15, writeFileSync as writeFileSync11, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { join as join16 } from "path";
 import { execa as execa7 } from "execa";
 import ora5 from "ora";
-import chalk8 from "chalk";
+import chalk7 from "chalk";
 import { build } from "tsup";
 async function buildProject(options) {
   if (!process.env.NODE_ENV) {
@@ -2627,17 +2507,17 @@ async function buildProject(options) {
   }
   const cwd = process.cwd();
   const pm = detectPackageManager(cwd);
-  const packageJsonPath = join18(cwd, "package.json");
+  const packageJsonPath = join16(cwd, "package.json");
   let hasNext = false;
-  if (existsSync17(packageJsonPath)) {
+  if (existsSync15(packageJsonPath)) {
     const packageJson = JSON.parse(await import("fs").then(
       (fs5) => fs5.promises.readFile(packageJsonPath, "utf-8")
     ));
     hasNext = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
   }
-  const serverDir = join18(cwd, "src", "server");
-  const hasServer = existsSync17(serverDir);
-  console.log(chalk8.blue.bold("\n\u{1F3D7}\uFE0F  Building SPFN project for production...\n"));
+  const serverDir = join16(cwd, "src", "server");
+  const hasServer = existsSync15(serverDir);
+  console.log(chalk7.blue.bold("\n\u{1F3D7}\uFE0F  Building SPFN project for production...\n"));
   if (hasServer) {
     const spinner = ora5("Generating API client...").start();
     try {
@@ -2678,10 +2558,10 @@ async function buildProject(options) {
   if (hasServer && !options.nextOnly) {
     const spinner = ora5("Building SPFN server...").start();
     try {
-      const outputDir = join18(cwd, ".spfn", "server");
+      const outputDir = join16(cwd, ".spfn", "server");
       mkdirSync2(outputDir, { recursive: true });
-      const serverDir2 = join18(cwd, "src", "server");
-      if (!existsSync17(serverDir2)) {
+      const serverDir2 = join16(cwd, "src", "server");
+      if (!existsSync15(serverDir2)) {
         spinner.fail("SPFN server build failed");
         logger.error("src/server/ directory not found");
         logger.error('Please run "spfn init" to initialize the project.');
@@ -2709,7 +2589,7 @@ async function buildProject(options) {
         onSuccess: async () => {
         }
       });
-      const prodServerPath = join18(cwd, ".spfn", "prod-server.mjs");
+      const prodServerPath = join16(cwd, ".spfn", "prod-server.mjs");
       const prodServerContent = `// Load environment variables FIRST (before any imports that depend on them)
 // Use centralized environment loader for standard dotenv priority
 const { env } = await import('@spfn/core/config');
@@ -2735,25 +2615,25 @@ await startServer({
 `;
       writeFileSync11(prodServerPath, prodServerContent);
       spinner.succeed(`SPFN server build completed \u2192 .spfn/server`);
-      const routesDir = join18(cwd, ".spfn", "server", "routes");
-      if (existsSync17(routesDir)) {
+      const routesDir = join16(cwd, ".spfn", "server", "routes");
+      if (existsSync15(routesDir)) {
         console.log();
-        console.log(chalk8.bold("Route (api)"));
+        console.log(chalk7.bold("Route (api)"));
         try {
-          const routes = readdirSync2(routesDir, { withFileTypes: true }).filter((dirent) => dirent.isDirectory()).map((dirent) => dirent.name).sort();
+          const routes = readdirSync(routesDir, { withFileTypes: true }).filter((dirent) => dirent.isDirectory()).map((dirent) => dirent.name).sort();
           if (routes.length > 0) {
             routes.forEach((route, index) => {
               const isLast = index === routes.length - 1;
               const prefix = isLast ? "\u2514" : "\u251C";
               const routePath = `/api/${route}`;
               if (route === "health") {
-                console.log(`${prefix} ${chalk8.green("GET")}  ${routePath}`);
+                console.log(`${prefix} ${chalk7.green("GET")}  ${routePath}`);
               } else {
-                console.log(`${prefix} ${chalk8.cyan("*")}    ${routePath}`);
+                console.log(`${prefix} ${chalk7.cyan("*")}    ${routePath}`);
               }
             });
             console.log();
-            console.log(chalk8.cyan("*") + "  (Hono)  multiple methods supported");
+            console.log(chalk7.cyan("*") + "  (Hono)  multiple methods supported");
           }
         } catch (error) {
         }
@@ -2761,9 +2641,9 @@ await startServer({
     } catch (error) {
       spinner.fail("SPFN server build failed");
       if (error instanceof Error) {
-        console.error("\n" + chalk8.red(error.message));
+        console.error("\n" + chalk7.red(error.message));
         if (error.stack) {
-          console.error(chalk8.dim("\n" + error.stack));
+          console.error(chalk7.dim("\n" + error.stack));
         }
       } else {
         logger.error(String(error));
@@ -2775,13 +2655,13 @@ await startServer({
     logger.error("No Next.js or SPFN server found in this project.");
     process.exit(1);
   }
-  console.log("\n" + chalk8.green.bold("\u2713 Build completed successfully!\n"));
-  console.log(chalk8.bold("Next steps:\n"));
-  console.log("  " + chalk8.cyan("Start production server:"));
-  console.log(`    ${chalk8.cyan(getRunCommand(pm))} spfn:start  ${chalk8.gray("# Start SPFN + Next.js")}
+  console.log("\n" + chalk7.green.bold("\u2713 Build completed successfully!\n"));
+  console.log(chalk7.bold("Next steps:\n"));
+  console.log("  " + chalk7.cyan("Start production server:"));
+  console.log(`    ${chalk7.cyan(getRunCommand(pm))} spfn:start  ${chalk7.gray("# Start SPFN + Next.js")}
 `);
-  console.log("  " + chalk8.cyan("Or deploy with Docker:"));
-  console.log(`    ${chalk8.cyan("docker compose -f docker-compose.production.yml up --build -d")}
+  console.log("  " + chalk7.cyan("Or deploy with Docker:"));
+  console.log(`    ${chalk7.cyan("docker compose -f docker-compose.production.yml up --build -d")}
 `);
 }
 var buildCommand = new Command5("build").description("Build SPFN project for production (Next.js + Server)").option("--server-only", "Build only SPFN server (skip Next.js)").option("--next-only", "Build only Next.js (skip SPFN server)").option("--turbo", "Use Turbopack for Next.js build").action(async (options) => {
@@ -2792,25 +2672,25 @@ var buildCommand = new Command5("build").description("Build SPFN project for pro
 init_logger();
 init_package_manager();
 import { Command as Command6 } from "commander";
-import { existsSync as existsSync18, readFileSync as readFileSync9 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync8 } from "fs";
+import { join as join17 } from "path";
 import { execa as execa8 } from "execa";
-import chalk9 from "chalk";
-var startCommand = new Command6("start").description("Start SPFN production server (Next.js + Hono)").option("--server-only", "Run only SPFN server (skip Next.js)").option("--next-only", "Run only Next.js (skip SPFN server)").option("-p, --port <port>", "Server port", "8790").option("-h, --host <host>", "Server host", "0.0.0.0").action(async (options) => {
+import chalk8 from "chalk";
+var startCommand = new Command6("start").description("Start SPFN production server (Next.js + Hono)").option("--server-only", "Run only SPFN server (skip Next.js)").option("--next-only", "Run only Next.js (skip SPFN server)").option("-p, --port <port>", "Server port", "8790").option("-h, --host <host>", "Server host", "0.0.0.0").option("--allow-pending-migrations", "Start even when migrations are pending (they are listed as a warning)").action(async (options) => {
   if (!process.env.NODE_ENV) {
     process.env.NODE_ENV = "production";
   }
   const cwd = process.cwd();
-  const packageJsonPath = join19(cwd, "package.json");
+  const packageJsonPath = join17(cwd, "package.json");
   let hasNext = false;
-  if (existsSync18(packageJsonPath)) {
-    const packageJson = JSON.parse(readFileSync9(packageJsonPath, "utf-8"));
+  if (existsSync16(packageJsonPath)) {
+    const packageJson = JSON.parse(readFileSync8(packageJsonPath, "utf-8"));
     hasNext = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
   }
-  const builtServerDir = join19(cwd, ".spfn", "server");
-  const hasBuiltServer = existsSync18(builtServerDir);
-  const nextBuildDir = join19(cwd, ".next");
-  const hasNextBuild = existsSync18(nextBuildDir);
+  const builtServerDir = join17(cwd, ".spfn", "server");
+  const hasBuiltServer = existsSync16(builtServerDir);
+  const nextBuildDir = join17(cwd, ".next");
+  const hasNextBuild = existsSync16(nextBuildDir);
   if (!options.nextOnly && !hasBuiltServer) {
     logger.error('.spfn/server directory not found. Please run "spfn build" first.');
     process.exit(1);
@@ -2820,13 +2700,27 @@ var startCommand = new Command6("start").description("Start SPFN production serv
     process.exit(1);
   }
   const pm = detectPackageManager(cwd);
-  const serverEntry = join19(cwd, ".spfn", "prod-server.mjs");
-  if (!existsSync18(serverEntry)) {
+  const serverEntry = join17(cwd, ".spfn", "prod-server.mjs");
+  if (!existsSync16(serverEntry)) {
     logger.error('.spfn/prod-server.mjs not found. Please run "spfn build" first.');
     process.exit(1);
   }
   process.env.SPFN_PORT = options.port;
   process.env.SPFN_HOST = options.host;
+  if (!options.nextOnly) {
+    const { checkPendingMigrationsBeforeStart: checkPendingMigrationsBeforeStart2 } = await Promise.resolve().then(() => (init_migration_status(), migration_status_exports));
+    const migrationCheck = await checkPendingMigrationsBeforeStart2(
+      cwd,
+      process.env.DATABASE_URL,
+      options.allowPendingMigrations === true
+    );
+    if (migrationCheck.block) {
+      process.exit(1);
+    }
+    if (migrationCheck.allowPending) {
+      process.env.SPFN_ALLOW_PENDING_MIGRATIONS = "true";
+    }
+  }
   if (options.serverOnly || !hasNext) {
     logger.info(`Starting SPFN Server (production) on http://${options.host}:${options.port}
 `);
@@ -2857,7 +2751,7 @@ var startCommand = new Command6("start").description("Start SPFN production serv
   }
   const nextCmd = "next start -H 0.0.0.0 -p 3790";
   const serverCmd = `node "${serverEntry}"`;
-  console.log(chalk9.blue.bold("\n\u{1F680} Starting SPFN production server...\n"));
+  console.log(chalk8.blue.bold("\n\u{1F680} Starting SPFN production server...\n"));
   logger.info("Next.js: http://0.0.0.0:3790");
   logger.info(`SPFN API: http://${options.host}:${options.port}
 `);
@@ -2885,8 +2779,8 @@ var startCommand = new Command6("start").description("Start SPFN production serv
 init_logger();
 init_package_manager();
 import { Command as Command7 } from "commander";
-import { existsSync as existsSync19, mkdirSync as mkdirSync3, writeFileSync as writeFileSync12 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync3, writeFileSync as writeFileSync12 } from "fs";
+import { join as join18 } from "path";
 import { pathToFileURL } from "url";
 import { execa as execa9 } from "execa";
 var CONFIG_FILE_PATHS = [
@@ -2896,7 +2790,7 @@ var CONFIG_FILE_PATHS = [
   "src/server/server.config.js"
 ];
 function findServerConfig(cwd) {
-  return CONFIG_FILE_PATHS.map((path5) => join20(cwd, path5)).find(existsSync19);
+  return CONFIG_FILE_PATHS.map((path5) => join18(cwd, path5)).find(existsSync17);
 }
 var provisionCommand = new Command7("provision").description("Run deploy-time provisioning (seed/RBAC lifecycle hooks) \u2014 once per deploy, not per cold start").action(async () => {
   if (!process.env.NODE_ENV) {
@@ -2917,8 +2811,8 @@ var provisionCommand = new Command7("provision").description("Run deploy-time pr
   if (keychainMissing.length > 0) {
     logger.warn(`[SPFN] Could not resolve keychain secret(s): ${keychainMissing.join(", ")} \u2014 run \`spfn secret set <KEY>\``);
   }
-  const tempDir = join20(cwd, ".spfn");
-  const runnerEntry = join20(tempDir, "provision.mjs");
+  const tempDir = join18(cwd, ".spfn");
+  const runnerEntry = join18(tempDir, "provision.mjs");
   mkdirSync3(tempDir, { recursive: true });
   writeFileSync12(runnerEntry, `
 if (!process.env.NODE_ENV)
@@ -2963,13 +2857,13 @@ process.exit(0);
 // src/commands/codegen.ts
 init_logger();
 import { Command as Command8 } from "commander";
-import { existsSync as existsSync20, writeFileSync as writeFileSync13 } from "fs";
-import { join as join21 } from "path";
-import chalk10 from "chalk";
+import { existsSync as existsSync18, writeFileSync as writeFileSync13 } from "fs";
+import { join as join19 } from "path";
+import chalk9 from "chalk";
 async function initCodegen(options) {
   const cwd = process.cwd();
-  const rcPath = join21(cwd, ".spfnrc.ts");
-  if (existsSync20(rcPath)) {
+  const rcPath = join19(cwd, ".spfnrc.ts");
+  if (existsSync18(rcPath)) {
     logger.warn(".spfnrc.ts already exists");
     logger.info("Edit manually to add custom generators");
     process.exit(0);
@@ -2995,13 +2889,13 @@ export default defineConfig({
 });
 `;
   writeFileSync13(rcPath, content);
-  console.log("\n" + chalk10.green.bold("\u2713 Created .spfnrc.ts\n"));
-  console.log(chalk10.gray("Configured the @spfn/core:route-map generator."));
+  console.log("\n" + chalk9.green.bold("\u2713 Created .spfnrc.ts\n"));
+  console.log(chalk9.gray("Configured the @spfn/core:route-map generator."));
   if (options.withExample) {
-    console.log("\n" + chalk10.yellow("\u{1F4DD} To add custom generators:"));
+    console.log("\n" + chalk9.yellow("\u{1F4DD} To add custom generators:"));
     console.log("  1. Create your generator file (e.g., src/generators/my-generator.ts)");
     console.log("  2. Add to .spfnrc.ts:");
-    console.log(chalk10.gray(`
+    console.log(chalk9.gray(`
 {
   "codegen": {
     "generators": [
@@ -3011,11 +2905,11 @@ export default defineConfig({
   }
 }
         `));
-    console.log("  3. Run: " + chalk10.cyan("spfn dev") + " (generators run automatically)");
+    console.log("  3. Run: " + chalk9.cyan("spfn dev") + " (generators run automatically)");
   } else {
-    console.log("\n" + chalk10.yellow("\u{1F4DD} Next steps:"));
+    console.log("\n" + chalk9.yellow("\u{1F4DD} Next steps:"));
     console.log("  \u2022 Add custom generators to .spfnrc.ts");
-    console.log("  \u2022 Run: " + chalk10.cyan("spfn dev") + " to start development with code generation");
+    console.log("  \u2022 Run: " + chalk9.cyan("spfn dev") + " to start development with code generation");
   }
 }
 async function listGenerators() {
@@ -3028,10 +2922,10 @@ async function listGenerators() {
     logger.info('Run "spfn codegen init" to initialize configuration');
     return;
   }
-  console.log("\n" + chalk10.bold("Registered Generators:"));
+  console.log("\n" + chalk9.bold("Registered Generators:"));
   generators.forEach((gen, index) => {
-    console.log(`  ${index + 1}. ${chalk10.cyan(gen.name)}`);
-    console.log(`     Patterns: ${chalk10.gray(gen.watchPatterns.join(", "))}`);
+    console.log(`  ${index + 1}. ${chalk9.cyan(gen.name)}`);
+    console.log(`     Patterns: ${chalk9.gray(gen.watchPatterns.join(", "))}`);
   });
   console.log("");
 }
@@ -3052,7 +2946,7 @@ async function runGenerators() {
     debug: true
   });
   await orchestrator.generateAll();
-  console.log("\n" + chalk10.green.bold("\u2713 Code generation completed"));
+  console.log("\n" + chalk9.green.bold("\u2713 Code generation completed"));
 }
 var codegenCommand = new Command8("codegen").description("Code generation management");
 codegenCommand.command("init").description("Initialize .spfnrc.ts with codegen configuration").option("--with-example", "Show example custom generator usage").action(initCodegen);
@@ -3062,18 +2956,18 @@ codegenCommand.command("run").description("Run code generators once (no watch mo
 // src/commands/contract.ts
 init_logger();
 import { Command as Command9 } from "commander";
-import { join as join22 } from "path";
-import chalk11 from "chalk";
+import { join as join20 } from "path";
+import chalk10 from "chalk";
 async function resolveContractsDir(cwd, override) {
   if (override) {
-    return join22(cwd, override);
+    return join20(cwd, override);
   }
   const { loadCodegenConfig } = await import("@spfn/core/codegen");
   const config = loadCodegenConfig(cwd);
   const generator = config.generators?.find(
     (entry) => "name" in entry && entry.name === "@spfn/core:contract"
   );
-  return join22(cwd, generator?.outputDir ?? "./contracts");
+  return join20(cwd, generator?.outputDir ?? "./contracts");
 }
 async function regenerate(cwd) {
   const { loadCodegenConfig, createGeneratorsFromConfig, CodegenOrchestrator } = await import("@spfn/core/codegen");
@@ -3098,14 +2992,14 @@ async function checkContractCommand(options) {
       logger.warn(warning);
     }
     if (result.violations.length > 0) {
-      console.log("\n" + chalk11.red.bold(`\u2717 Breaks the contract released as ${result.baselineVersion}
+      console.log("\n" + chalk10.red.bold(`\u2717 Breaks the contract released as ${result.baselineVersion}
 `));
       console.log(formatViolations(result.violations));
       console.log("");
       process.exit(1);
     }
     const against = result.baselineVersion ? `backward compatible with released ${result.baselineVersion}` : "generated (nothing released to compare against yet)";
-    console.log("\n" + chalk11.green.bold(`\u2713 Contract ${against}
+    console.log("\n" + chalk10.green.bold(`\u2713 Contract ${against}
 `));
   } catch (error) {
     logger.error(error instanceof Error ? error.message : String(error));
@@ -3126,7 +3020,7 @@ async function releaseContractCommand(version, options) {
     const document = readCurrentDocument(contractsDir);
     const result = checkContract(contractsDir, document);
     if (result.violations.length > 0) {
-      console.log("\n" + chalk11.red.bold(`\u2717 Cannot release: breaks the contract released as ${result.baselineVersion}
+      console.log("\n" + chalk10.red.bold(`\u2717 Cannot release: breaks the contract released as ${result.baselineVersion}
 `));
       console.log(formatViolations(result.violations));
       console.log("");
@@ -3135,12 +3029,12 @@ async function releaseContractCommand(version, options) {
     for (const warning of result.warnings) {
       logger.warn(warning);
     }
-    const file = writeSnapshot(contractsDir, version, document);
-    console.log("\n" + chalk11.green.bold(`\u2713 Released contract ${version}
+    const file = writeSnapshot(contractsDir, document);
+    console.log("\n" + chalk10.green.bold(`\u2713 Released contract ${version}
 `));
-    console.log(chalk11.gray(`  ${file}`));
-    console.log(chalk11.gray(`  ${document.operations.length} operation(s)`));
-    console.log(chalk11.yellow("\n  Commit this snapshot. The gate compares every later build against it.\n"));
+    console.log(chalk10.gray(`  ${file}`));
+    console.log(chalk10.gray(`  ${document.operations.length} operation(s)`));
+    console.log(chalk10.yellow("\n  Commit this snapshot. The gate compares every later build against it.\n"));
   } catch (error) {
     logger.error(error instanceof Error ? error.message : String(error));
     process.exit(1);
@@ -3156,9 +3050,9 @@ async function listContractCommand(options) {
       logger.info("No released contract snapshot yet");
       return;
     }
-    console.log("\n" + chalk11.bold("Released contracts:"));
+    console.log("\n" + chalk10.bold("Released contracts:"));
     for (const snapshot of snapshots) {
-      console.log(`  ${chalk11.cyan(snapshot.version)}  ${chalk11.gray(snapshot.file)}`);
+      console.log(`  ${chalk10.cyan(snapshot.version)}  ${chalk10.gray(snapshot.file)}`);
     }
     console.log("");
   } catch (error) {
@@ -3175,7 +3069,7 @@ contractCommand.command("list").alias("ls").description("List released contract
 init_logger();
 import { Command as Command10 } from "commander";
 import { execSync } from "child_process";
-import chalk12 from "chalk";
+import chalk11 from "chalk";
 
 // src/utils/secret-gen.ts
 import { randomBytes as randomBytes2, randomUUID } from "crypto";
@@ -3250,41 +3144,41 @@ function copyToClipboard(text) {
 function generateSecret(bytes, preset, envVarName, copy) {
   const key = randomBase64Url(bytes);
   const config = preset ? PRESETS[preset] : null;
-  console.log("\n" + chalk12.green.bold("\u2713 Generated secret key:"));
+  console.log("\n" + chalk11.green.bold("\u2713 Generated secret key:"));
   if (config) {
-    console.log(chalk12.dim(`  ${config.description} (${bytes * 8} bits)`));
+    console.log(chalk11.dim(`  ${config.description} (${bytes * 8} bits)`));
   } else {
-    console.log(chalk12.dim(`  ${bytes * 8}-bit secret`));
+    console.log(chalk11.dim(`  ${bytes * 8}-bit secret`));
   }
-  console.log("\n" + chalk12.cyan(key) + "\n");
+  console.log("\n" + chalk11.cyan(key) + "\n");
   const varName = envVarName || config?.envVar || "SECRET_KEY";
-  console.log(chalk12.dim("Add to your .env file:"));
-  console.log(chalk12.yellow(`${varName}=${key}
+  console.log(chalk11.dim("Add to your .env file:"));
+  console.log(chalk11.yellow(`${varName}=${key}
 `));
   if (config?.usage) {
-    console.log(chalk12.dim("Usage:"));
-    console.log(chalk12.gray(`  ${config.usage}
+    console.log(chalk11.dim("Usage:"));
+    console.log(chalk11.gray(`  ${config.usage}
 `));
   }
   if (copy) {
     if (copyToClipboard(key)) {
-      console.log(chalk12.green("\u2713 Copied to clipboard!\n"));
+      console.log(chalk11.green("\u2713 Copied to clipboard!\n"));
     } else {
       logger.warn("Could not copy to clipboard");
     }
   }
 }
 function listPresets() {
-  console.log("\n" + chalk12.bold("Available presets:"));
+  console.log("\n" + chalk11.bold("Available presets:"));
   console.log();
   Object.entries(PRESETS).forEach(([name, config]) => {
-    console.log(`  ${chalk12.cyan(name.padEnd(20))} ${chalk12.dim(config.description)}`);
-    console.log(`  ${" ".repeat(20)} ${chalk12.gray(`\u2192 ${config.envVar} (${config.bytes * 8} bits)`)}`);
+    console.log(`  ${chalk11.cyan(name.padEnd(20))} ${chalk11.dim(config.description)}`);
+    console.log(`  ${" ".repeat(20)} ${chalk11.gray(`\u2192 ${config.envVar} (${config.bytes * 8} bits)`)}`);
     console.log();
   });
-  console.log(chalk12.dim("Usage:"));
-  console.log(chalk12.gray("  spfn key <preset>"));
-  console.log(chalk12.gray("  spfn key auth-encryption --copy"));
+  console.log(chalk11.dim("Usage:"));
+  console.log(chalk11.gray("  spfn key <preset>"));
+  console.log(chalk11.gray("  spfn key auth-encryption --copy"));
   console.log();
 }
 var generateValueCommand = new Command10("generate").alias("gen").description("Generate random value (simple output, no metadata)").option("-b, --bytes <number>", "Number of random bytes", "32").option("-c, --copy", "Copy to clipboard").action((options) => {
@@ -3297,9 +3191,9 @@ var generateValueCommand = new Command10("generate").alias("gen").description("G
   console.log(value);
   if (options.copy) {
     if (copyToClipboard(value)) {
-      console.error(chalk12.green("\u2713 Copied to clipboard"));
+      console.error(chalk11.green("\u2713 Copied to clipboard"));
     } else {
-      console.error(chalk12.yellow("\u26A0 Could not copy to clipboard"));
+      console.error(chalk11.yellow("\u26A0 Could not copy to clipboard"));
     }
   }
 });
@@ -3317,9 +3211,9 @@ var keyCommand = new Command10("key").alias("k").description("Generate secure ra
     logger.error(`Unknown preset: ${preset}`);
     console.log("\nAvailable presets:");
     Object.entries(PRESETS).forEach(([name, config]) => {
-      console.log(`  ${chalk12.cyan(name)}: ${config.description}`);
+      console.log(`  ${chalk11.cyan(name)}: ${config.description}`);
     });
-    console.log("\nUse " + chalk12.cyan("--list") + " to see detailed information");
+    console.log("\nUse " + chalk11.cyan("--list") + " to see detailed information");
     process.exit(1);
   }
   generateSecret(
@@ -3338,16 +3232,16 @@ init_setup();
 import { Command as Command11 } from "commander";
 
 // src/commands/db/generate.ts
-import chalk14 from "chalk";
+import chalk13 from "chalk";
 
 // src/commands/db/utils/drizzle.ts
-import { existsSync as existsSync21, writeFileSync as writeFileSync14, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync19, writeFileSync as writeFileSync14, unlinkSync as unlinkSync2 } from "fs";
 import { spawn } from "child_process";
 import { pathToFileURL as pathToFileURL2 } from "url";
-import chalk13 from "chalk";
+import chalk12 from "chalk";
 import ora6 from "ora";
-import { env as env3 } from "@spfn/core/config";
-import { loadEnv as loadEnv3 } from "@spfn/core/server";
+import { env as env2 } from "@spfn/core/config";
+import { loadEnv as loadEnv2 } from "@spfn/core/server";
 var TLS_SSL_MODES = /* @__PURE__ */ new Set(["no-verify", "prefer", "require", "verify-ca", "verify-full"]);
 function parseDatabaseUrl(databaseUrl) {
   if (!databaseUrl) {
@@ -3400,22 +3294,22 @@ function resolvePushConnectionConfig(databaseUrl) {
   return { connectionString: parsedUrl.toString() };
 }
 function validateDatabasePrerequisites() {
-  loadEnv3();
-  if (!env3.DATABASE_URL) {
-    console.error(chalk13.red("\u274C DATABASE_URL not found in environment"));
-    console.log(chalk13.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+  loadEnv2();
+  if (!env2.DATABASE_URL) {
+    console.error(chalk12.red("\u274C DATABASE_URL not found in environment"));
+    console.log(chalk12.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     throw new Error("DATABASE_URL is required for database operations");
   }
 }
 async function runDrizzleCommand(command) {
-  const hasUserConfig = existsSync21("./drizzle.config.ts");
+  const hasUserConfig = existsSync19("./drizzle.config.ts");
   const tempConfigPath = `./drizzle.config.${process.pid}.${Date.now()}.temp.ts`;
   const configPath = hasUserConfig ? "./drizzle.config.ts" : tempConfigPath;
   if (!hasUserConfig) {
-    loadEnv3();
-    if (!env3.DATABASE_URL) {
-      console.error(chalk13.red("\u274C DATABASE_URL not found in environment"));
-      console.log(chalk13.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
+    loadEnv2();
+    if (!env2.DATABASE_URL) {
+      console.error(chalk12.red("\u274C DATABASE_URL not found in environment"));
+      console.log(chalk12.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
       process.exit(1);
     }
     const { generateDrizzleConfigFile } = await import("@spfn/core/db");
@@ -3428,7 +3322,7 @@ async function runDrizzleCommand(command) {
       autoDetectSchemas: true
     });
     writeFileSync14(tempConfigPath, configContent);
-    console.log(chalk13.dim("Using auto-generated Drizzle config\n"));
+    console.log(chalk12.dim("Using auto-generated Drizzle config\n"));
   }
   const args = command.split(" ");
   args.push(`--config=${configPath}`);
@@ -3437,10 +3331,10 @@ async function runDrizzleCommand(command) {
       stdio: "inherit",
       // Allow interactive input
       shell: true,
-      env: shouldRelaxDbTls(env3.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
+      env: shouldRelaxDbTls(env2.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
     });
     const cleanup = () => {
-      if (!hasUserConfig && existsSync21(tempConfigPath)) {
+      if (!hasUserConfig && existsSync19(tempConfigPath)) {
         unlinkSync2(tempConfigPath);
       }
     };
@@ -3463,10 +3357,10 @@ async function runWithSpinner(spinnerText, command, successMessage, failMessage)
   try {
     spinner.stop();
     await runDrizzleCommand(command);
-    console.log(chalk13.green(`\u2705 ${successMessage}`));
+    console.log(chalk12.green(`\u2705 ${successMessage}`));
   } catch (error) {
     spinner.fail(failMessage);
-    console.error(chalk13.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk12.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
@@ -3490,13 +3384,13 @@ async function loadSchemaImports(schemaFiles) {
   return imports;
 }
 async function createPushConnection() {
-  loadEnv3();
-  if (!env3.DATABASE_URL) {
+  loadEnv2();
+  if (!env2.DATABASE_URL) {
     throw new Error("DATABASE_URL is required");
   }
   const pg = await import("pg");
   const { drizzle } = await import("drizzle-orm/node-postgres");
-  const connectionConfig = resolvePushConnectionConfig(env3.DATABASE_URL);
+  const connectionConfig = resolvePushConnectionConfig(env2.DATABASE_URL);
   const pool = new pg.default.Pool({
     ...connectionConfig,
     max: 1
@@ -3512,10 +3406,10 @@ async function createPushConnection() {
 async function dbGenerate() {
   try {
     await runDrizzleCommand("generate");
-    console.log(chalk14.green("\n\u2705 Migrations generated successfully"));
+    console.log(chalk13.green("\n\u2705 Migrations generated successfully"));
   } catch (error) {
-    console.error(chalk14.red("\n\u274C Failed to generate migrations"));
-    console.error(chalk14.red(error instanceof Error ? error.message : "Unknown error"));
+    console.error(chalk13.red("\n\u274C Failed to generate migrations"));
+    console.error(chalk13.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
 }
@@ -3568,7 +3462,7 @@ function classifyStatements(statements) {
 }
 
 // src/commands/db/utils/push-display.ts
-import chalk15 from "chalk";
+import chalk14 from "chalk";
 function formatSql(sql2) {
   return sql2.replace(/\s+/g, " ").trim();
 }
@@ -3576,30 +3470,30 @@ function printStatements(statements, color) {
   for (const stmt of statements) {
     console.log(color(`   ${formatSql(stmt.sql)}`));
     if (stmt.reason) {
-      console.log(chalk15.dim(`   \u2192 ${stmt.reason}`));
+      console.log(chalk14.dim(`   \u2192 ${stmt.reason}`));
     }
   }
 }
 function displayClassifiedStatements(result) {
   if (result.safe.length > 0) {
-    console.log(chalk15.green(`
+    console.log(chalk14.green(`
 \u2705 Safe changes (${result.safe.length}):`));
-    printStatements(result.safe, chalk15.green);
+    printStatements(result.safe, chalk14.green);
   }
   if (result.warning.length > 0) {
-    console.log(chalk15.yellow(`
+    console.log(chalk14.yellow(`
 \u26A0\uFE0F  Warnings (${result.warning.length}):`));
-    printStatements(result.warning, chalk15.yellow);
+    printStatements(result.warning, chalk14.yellow);
   }
   if (result.destructive.length > 0) {
-    console.log(chalk15.red(`
+    console.log(chalk14.red(`
 \u274C Destructive changes (${result.destructive.length}):`));
-    printStatements(result.destructive, chalk15.red);
+    printStatements(result.destructive, chalk14.red);
   }
 }
 function displayDryRunSummary(result) {
   const total = result.safe.length + result.warning.length + result.destructive.length;
-  console.log(chalk15.cyan(`
+  console.log(chalk14.cyan(`
 \u{1F50D} Dry-run: ${total} statement(s) detected
 `));
   displayClassifiedStatements(result);
@@ -3607,11 +3501,11 @@ function displayDryRunSummary(result) {
 }
 function displayApplySummary(applied, skipped) {
   if (applied > 0) {
-    console.log(chalk15.green(`
+    console.log(chalk14.green(`
 \u2705 Applied ${applied} statement(s)`));
   }
   if (skipped > 0) {
-    console.log(chalk15.yellow(`\u23ED\uFE0F  Skipped ${skipped} destructive statement(s)`));
+    console.log(chalk14.yellow(`\u23ED\uFE0F  Skipped ${skipped} destructive statement(s)`));
   }
   console.log("");
 }
@@ -3760,8 +3654,8 @@ async function applyFunctionMigrations(plans) {
 
 // src/commands/db/migrate.ts
 import chalk21 from "chalk";
-import { join as join23 } from "path";
-import { existsSync as existsSync23 } from "fs";
+import { join as join21 } from "path";
+import { existsSync as existsSync21 } from "fs";
 
 // src/commands/db/backup.ts
 import { promises as fs3 } from "fs";
@@ -3854,7 +3748,7 @@ function formatTimestamp() {
 
 // src/commands/db/utils/backup-files.ts
 import { promises as fs2 } from "fs";
-import { existsSync as existsSync22 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 import path2 from "path";
 import chalk19 from "chalk";
 
@@ -3954,7 +3848,7 @@ async function ensureBackupInGitignore() {
   const gitignorePath = path2.join(process.cwd(), ".gitignore");
   try {
     let content = "";
-    let exists = existsSync22(gitignorePath);
+    let exists = existsSync20(gitignorePath);
     if (exists) {
       content = await fs2.readFile(gitignorePath, "utf-8");
     }
@@ -3976,7 +3870,7 @@ async function ensureBackupDir() {
   try {
     await fs2.mkdir(backupDir, { recursive: true });
     const gitignorePath = path2.join(backupDir, ".gitignore");
-    const gitignoreExists = existsSync22(gitignorePath);
+    const gitignoreExists = existsSync20(gitignorePath);
     if (!gitignoreExists) {
       await fs2.writeFile(gitignorePath, "# Ignore all backup files\n*.sql\n*.dump\n*.meta.json\n");
     }
@@ -4170,8 +4064,8 @@ async function dbMigrate(options = {}) {
     await executeFunctionMigrations2(loadFunctionMigrationPlans2(functions));
     console.log(chalk21.green("\u2705 Function migrations applied\n"));
   }
-  const projectMigrationsDir = join23(process.cwd(), "src/server/drizzle");
-  if (existsSync23(projectMigrationsDir)) {
+  const projectMigrationsDir = join21(process.cwd(), "src/server/drizzle");
+  if (existsSync21(projectMigrationsDir)) {
     const projConn = postgres.default(env5.DATABASE_URL, { max: 1 });
     const projDb = drizzle({ client: projConn });
     try {
@@ -4206,7 +4100,7 @@ async function dbStatus() {
     console.error(chalk22.red(error instanceof Error ? error.message : "Unknown error"));
     process.exit(1);
   }
-  const targets = [...status.packages, ...status.project ? [status.project] : []];
+  const targets = migrationTargets(status);
   if (targets.length === 0) {
     console.log(chalk22.dim("No migrations found (no @spfn packages with migrations, no src/server/drizzle)."));
     return;
@@ -4231,7 +4125,7 @@ async function dbStatus() {
 
 // src/commands/db/studio.ts
 import chalk23 from "chalk";
-import { existsSync as existsSync24, writeFileSync as writeFileSync15, unlinkSync as unlinkSync3 } from "fs";
+import { existsSync as existsSync22, writeFileSync as writeFileSync15, unlinkSync as unlinkSync3 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { env as env6 } from "@spfn/core/config";
 async function dbStudio(requestedPort) {
@@ -4249,7 +4143,7 @@ async function dbStudio(requestedPort) {
     console.error(chalk23.red(error instanceof Error ? error.message : "Failed to find available port"));
     process.exit(1);
   }
-  const hasUserConfig = existsSync24("./drizzle.config.ts");
+  const hasUserConfig = existsSync22("./drizzle.config.ts");
   const tempConfigPath = `./drizzle.config.${process.pid}.${Date.now()}.temp.ts`;
   try {
     const configPath = hasUserConfig ? "./drizzle.config.ts" : tempConfigPath;
@@ -4275,7 +4169,7 @@ async function dbStudio(requestedPort) {
       env: shouldRelaxDbTls(env6.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
     });
     const cleanup = () => {
-      if (!hasUserConfig && existsSync24(tempConfigPath)) {
+      if (!hasUserConfig && existsSync22(tempConfigPath)) {
         unlinkSync3(tempConfigPath);
       }
     };
@@ -4305,7 +4199,7 @@ async function dbStudio(requestedPort) {
       process.exit(0);
     });
   } catch (error) {
-    if (!hasUserConfig && existsSync24(tempConfigPath)) {
+    if (!hasUserConfig && existsSync22(tempConfigPath)) {
       unlinkSync3(tempConfigPath);
     }
     console.error(chalk23.red("\u274C Failed to start Drizzle Studio"));
@@ -4692,8 +4586,8 @@ async function dbBackupClean(options) {
 }
 
 // src/commands/db/reindex.ts
-import { existsSync as existsSync25, readFileSync as readFileSync10, writeFileSync as writeFileSync16, renameSync, copyFileSync } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync9, writeFileSync as writeFileSync16, renameSync, copyFileSync } from "fs";
+import { join as join22 } from "path";
 import chalk29 from "chalk";
 import { loadEnv as loadEnv9 } from "@spfn/core/server";
 function isTimestampPrefix(tag) {
@@ -4715,13 +4609,13 @@ async function dbReindex(options = {}) {
   const { getDrizzleConfig } = await import("@spfn/core/db");
   const config = getDrizzleConfig({ disablePackageDiscovery: true });
   const outDir = config.out;
-  const journalPath = join24(outDir, "meta", "_journal.json");
-  if (!existsSync25(journalPath)) {
+  const journalPath = join22(outDir, "meta", "_journal.json");
+  if (!existsSync23(journalPath)) {
     console.error(chalk29.red("\u274C No _journal.json found at:"), journalPath);
     console.log(chalk29.yellow("\u{1F4A1} Run `spfn db generate` first to create migrations"));
     process.exit(1);
   }
-  const journal = JSON.parse(readFileSync10(journalPath, "utf-8"));
+  const journal = JSON.parse(readFileSync9(journalPath, "utf-8"));
   if (journal.entries.length === 0) {
     console.log(chalk29.yellow("No migration entries found \u2014 nothing to reindex."));
     return;
@@ -4737,14 +4631,14 @@ async function dbReindex(options = {}) {
     const { prefix: oldPrefix, suffix } = parseTag(entry.tag);
     const newPrefix = String(entry.when);
     const newTag = suffix ? `${newPrefix}_${suffix}` : newPrefix;
-    const oldSql = join24(outDir, `${entry.tag}.sql`);
-    const newSql = join24(outDir, `${newTag}.sql`);
-    if (existsSync25(oldSql)) {
+    const oldSql = join22(outDir, `${entry.tag}.sql`);
+    const newSql = join22(outDir, `${newTag}.sql`);
+    if (existsSync23(oldSql)) {
       renames.push({ type: "sql", from: oldSql, to: newSql });
     }
-    const oldSnapshot = join24(outDir, "meta", `${oldPrefix}_snapshot.json`);
-    const newSnapshot = join24(outDir, "meta", `${newPrefix}_snapshot.json`);
-    if (existsSync25(oldSnapshot)) {
+    const oldSnapshot = join22(outDir, "meta", `${oldPrefix}_snapshot.json`);
+    const newSnapshot = join22(outDir, "meta", `${newPrefix}_snapshot.json`);
+    if (existsSync23(oldSnapshot)) {
       renames.push({ type: "snapshot", from: oldSnapshot, to: newSnapshot });
     }
     tagUpdates.push({ idx: entry.idx, oldTag: entry.tag, newTag });
@@ -4810,21 +4704,21 @@ dbCommand.command("reindex").description("Convert migration files from sequentia
 // src/commands/add.ts
 init_package_manager();
 import { Command as Command12 } from "commander";
-import { existsSync as existsSync27, readFileSync as readFileSync11 } from "fs";
-import { join as join26 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync10 } from "fs";
+import { join as join24 } from "path";
 import { execa as execa10 } from "execa";
 import chalk31 from "chalk";
 import ora11 from "ora";
 
 // src/commands/add-vercel.ts
 init_templates();
-import { copyFileSync as copyFileSync2, existsSync as existsSync26, mkdirSync as mkdirSync4 } from "fs";
-import { dirname as dirname3, join as join25 } from "path";
+import { copyFileSync as copyFileSync2, existsSync as existsSync24, mkdirSync as mkdirSync4 } from "fs";
+import { dirname as dirname3, join as join23 } from "path";
 import chalk30 from "chalk";
 var FILES = [
   {
     template: "route.ts",
-    target: join25("src", "app", "api", "backend", "[[...route]]", "route.ts"),
+    target: join23("src", "app", "api", "backend", "[[...route]]", "route.ts"),
     description: "hono/vercel adapter (mounts the SPFN app under /api/backend)"
   },
   {
@@ -4841,15 +4735,15 @@ var FILES = [
 async function addVercel() {
   console.log(chalk30.blue("\n\u{1F4E6} Setting up the Vercel serverless target...\n"));
   const cwd = process.cwd();
-  const templatesDir = join25(findTemplatesPath(), "vercel");
+  const templatesDir = join23(findTemplatesPath(), "vercel");
   for (const file of FILES) {
-    const targetPath = join25(cwd, file.target);
-    if (existsSync26(targetPath)) {
+    const targetPath = join23(cwd, file.target);
+    if (existsSync24(targetPath)) {
       console.log(chalk30.yellow(`\u23ED\uFE0F  ${file.target} already exists \u2014 skipped (not overwritten)`));
       continue;
     }
     mkdirSync4(dirname3(targetPath), { recursive: true });
-    copyFileSync2(join25(templatesDir, file.template), targetPath);
+    copyFileSync2(join23(templatesDir, file.template), targetPath);
     console.log(chalk30.green(`\u2705 ${file.target}`) + chalk30.gray(` \u2014 ${file.description}`));
   }
   console.log(chalk30.green("\n\u2705 Vercel target ready!\n"));
@@ -4888,9 +4782,9 @@ async function addPackage(packageName) {
   console.log(chalk31.blue(`
 \u{1F4E6} Setting up ${packageName}...
 `));
-  const pkgPath = join26(process.cwd(), "node_modules", ...packageName.split("/"));
-  const pkgJsonPath = join26(pkgPath, "package.json");
-  if (!existsSync27(pkgJsonPath)) {
+  const pkgPath = join24(process.cwd(), "node_modules", ...packageName.split("/"));
+  const pkgJsonPath = join24(pkgPath, "package.json");
+  if (!existsSync25(pkgJsonPath)) {
     const pm = detectPackageManager(process.cwd());
     const installSpinner = ora11("Installing package...").start();
     try {
@@ -4904,11 +4798,11 @@ async function addPackage(packageName) {
   } else {
     console.log(chalk31.gray("\u2713 Package already installed (using local version)\n"));
   }
-  if (!existsSync27(pkgJsonPath)) {
+  if (!existsSync25(pkgJsonPath)) {
     console.error(chalk31.red(`\u274C Package ${packageName} not found after installation`));
     process.exit(1);
   }
-  const pkgJson = JSON.parse(readFileSync11(pkgJsonPath, "utf-8"));
+  const pkgJson = JSON.parse(readFileSync10(pkgJsonPath, "utf-8"));
   if (pkgJson.spfn?.migrations) {
     console.log(chalk31.blue(`
 \u{1F5C4}\uFE0F  Setting up database for ${packageName}...
@@ -4954,7 +4848,7 @@ var addCommand = new Command12("add").description("Add a capability to this proj
 // src/commands/env.ts
 import { Command as Command13 } from "commander";
 import chalk32 from "chalk";
-import { existsSync as existsSync28, readFileSync as readFileSync12, writeFileSync as writeFileSync17 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync11, writeFileSync as writeFileSync17 } from "fs";
 import { resolve as resolve2 } from "path";
 import { parse as parse2 } from "dotenv";
 
@@ -5245,7 +5139,7 @@ async function initEnvFiles(options) {
 }
 function writeEnvTemplate(cwd, file, vars, force) {
   const filePath = resolve2(cwd, file);
-  if (existsSync28(filePath) && !force) {
+  if (existsSync26(filePath) && !force) {
     console.log(chalk32.yellow(`  \u23ED\uFE0F  ${file} already exists (use --force to overwrite)`));
     return;
   }
@@ -5294,10 +5188,10 @@ async function checkEnvFiles(options) {
     const warnings = [];
     for (const file of filesToCheck) {
       const filePath = resolve2(cwd, file);
-      if (!existsSync28(filePath)) {
+      if (!existsSync26(filePath)) {
         continue;
       }
-      const content = readFileSync12(filePath, "utf-8");
+      const content = readFileSync11(filePath, "utf-8");
       const parsed = parse2(content);
       for (const [key, value] of Object.entries(parsed)) {
         loadedEnv[key] = { value: value || "", file };
@@ -5467,12 +5361,12 @@ function resolveEnv(env9) {
 
 // src/commands/secret/store-value.ts
 init_logger();
-import { join as join28 } from "path";
+import { join as join26 } from "path";
 init_env_file();
 
 // src/utils/sops.ts
 import { execa as execa11 } from "execa";
-import { existsSync as existsSync29, mkdirSync as mkdirSync5, writeFileSync as writeFileSync18 } from "fs";
+import { existsSync as existsSync27, mkdirSync as mkdirSync5, writeFileSync as writeFileSync18 } from "fs";
 import { dirname as dirname4 } from "path";
 async function ensureSopsInstalled() {
   try {
@@ -5482,14 +5376,14 @@ async function ensureSopsInstalled() {
   }
 }
 async function sopsDecrypt(absFile) {
-  if (!existsSync29(absFile)) {
+  if (!existsSync27(absFile)) {
     return {};
   }
   const { stdout } = await execa11("sops", ["--decrypt", "--output-type", "json", absFile]);
   return JSON.parse(stdout);
 }
 async function sopsSetValue(absFile, relFile, key, value) {
-  if (existsSync29(absFile)) {
+  if (existsSync27(absFile)) {
     await execa11("sops", ["set", absFile, `["${key}"]`, JSON.stringify(value)]);
     return;
   }
@@ -5515,20 +5409,20 @@ async function sopsUpdateKeys(absFile) {
 }
 
 // src/utils/secret-config.ts
-import { existsSync as existsSync30, readdirSync as readdirSync3 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync28, readdirSync as readdirSync2 } from "fs";
+import { join as join25 } from "path";
 var SECRETS_DIR = "secrets";
 function getSopsFile(cwd, env9) {
   const relFile = `${SECRETS_DIR}/${env9}.enc.json`;
-  return { absFile: join27(cwd, relFile), relFile };
+  return { absFile: join25(cwd, relFile), relFile };
 }
 function findUp(cwd, filename, maxDepth = 6) {
   let dir = cwd;
   for (let depth = 0; depth < maxDepth; depth++) {
-    if (existsSync30(join27(dir, filename))) {
+    if (existsSync28(join25(dir, filename))) {
       return dir;
     }
-    const parent = join27(dir, "..");
+    const parent = join25(dir, "..");
     if (parent === dir) {
       break;
     }
@@ -5538,17 +5432,17 @@ function findUp(cwd, filename, maxDepth = 6) {
 }
 function findSopsConfig(cwd) {
   const dir = findUp(cwd, ".sops.yaml");
-  return dir ? join27(dir, ".sops.yaml") : null;
+  return dir ? join25(dir, ".sops.yaml") : null;
 }
 function hasSopsConfig(cwd) {
   return findSopsConfig(cwd) !== null;
 }
 function listSopsFiles(cwd) {
-  const dir = join27(cwd, SECRETS_DIR);
-  if (!existsSync30(dir)) {
+  const dir = join25(cwd, SECRETS_DIR);
+  if (!existsSync28(dir)) {
     return [];
   }
-  return readdirSync3(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join27(dir, name));
+  return readdirSync2(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join25(dir, name));
 }
 
 // src/commands/secret/store-value.ts
@@ -5577,7 +5471,7 @@ async function storeSecret(cwd, env9, key, value) {
       );
     }
     await store.set(keychainName(key), value);
-    const serverEnvPath = join28(cwd, ".env.server");
+    const serverEnvPath = join26(cwd, ".env.server");
     const result = upsertEnvVar(serverEnvPath, key, keychainRef(key));
     restrictEnvFilePerms(serverEnvPath);
     ensureGitignored(cwd, [{ pattern: ".env.server", comment: "spfn server env (secrets)" }]);
@@ -5815,12 +5709,12 @@ function requireEntry(schema, key) {
 // src/commands/secret/keygen.ts
 init_logger();
 import { execa as execa12 } from "execa";
-import { existsSync as existsSync31, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync6 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname5, join as join29 } from "path";
+import { dirname as dirname5, join as join27 } from "path";
 import chalk37 from "chalk";
 function ageKeyFile() {
-  return process.env.SOPS_AGE_KEY_FILE ?? join29(homedir(), ".config", "sops", "age", "keys.txt");
+  return process.env.SOPS_AGE_KEY_FILE ?? join27(homedir(), ".config", "sops", "age", "keys.txt");
 }
 async function ensureAgeInstalled() {
   try {
@@ -5840,7 +5734,7 @@ async function secretKeygen() {
     process.exit(1);
   }
   const keyFile = ageKeyFile();
-  if (existsSync31(keyFile)) {
+  if (existsSync29(keyFile)) {
     const { stdout } = await execa12("age-keygen", ["-y", keyFile]);
     logger.warn(`age key file already exists: ${keyFile}`);
     printPublicKeys(publicKeys(stdout));
@@ -5867,8 +5761,8 @@ function printPublicKeys(keys) {
 
 // src/commands/secret/recipients.ts
 init_logger();
-import { existsSync as existsSync32, readFileSync as readFileSync13, writeFileSync as writeFileSync19 } from "fs";
-import { join as join30 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync12, writeFileSync as writeFileSync19 } from "fs";
+import { join as join28 } from "path";
 import { parse as parse3, stringify } from "yaml";
 import chalk38 from "chalk";
 var SOPS_CONFIG = ".sops.yaml";
@@ -5876,7 +5770,7 @@ var DEFAULT_PATH_REGEX = "secrets/.*\\.enc\\.json$";
 var AGE_RECIPIENT = /^age1[0-9a-z]+$/;
 async function secretRecipients(action, key, _options) {
   const cwd = process.cwd();
-  const configPath = join30(cwd, SOPS_CONFIG);
+  const configPath = join28(cwd, SOPS_CONFIG);
   if (action === "list") {
     listRecipients(configPath);
     return;
@@ -5908,7 +5802,7 @@ async function secretRecipients(action, key, _options) {
   await reencrypt(cwd);
 }
 function listRecipients(configPath) {
-  if (!existsSync32(configPath)) {
+  if (!existsSync30(configPath)) {
     logger.info(`No ${SOPS_CONFIG} found.`);
     return;
   }
@@ -5926,10 +5820,10 @@ function listRecipients(configPath) {
   console.log();
 }
 function loadConfig(configPath) {
-  if (!existsSync32(configPath)) {
+  if (!existsSync30(configPath)) {
     return { creation_rules: [] };
   }
-  return parse3(readFileSync13(configPath, "utf-8")) ?? { creation_rules: [] };
+  return parse3(readFileSync12(configPath, "utf-8")) ?? { creation_rules: [] };
 }
 function ensureRule(config) {
   if (!config.creation_rules) {
@@ -5961,7 +5855,7 @@ async function reencrypt(cwd) {
 
 // src/commands/secret/check.ts
 init_logger();
-import { join as join31 } from "path";
+import { join as join29 } from "path";
 import chalk39 from "chalk";
 init_env_file();
 var COMMITTED_FILES = [".env", ".env.example"];
@@ -5980,14 +5874,14 @@ async function secretCheck(options) {
   const issues = [];
   const warnings = [];
   for (const file of COMMITTED_FILES) {
-    const parsed = parseEnvFile(join31(cwd, file));
+    const parsed = parseEnvFile(join29(cwd, file));
     for (const [key, value] of Object.entries(parsed)) {
       if (secretKeys.has(key) && value.length > 0 && !PLACEHOLDER.test(value)) {
         issues.push(`${chalk39.cyan(key)} has a real value in committed ${chalk39.yellow(file)} \u2014 move it to the keychain/SOPS.`);
       }
     }
   }
-  const serverEnv = parseEnvFile(join31(cwd, ".env.server"));
+  const serverEnv = parseEnvFile(join29(cwd, ".env.server"));
   for (const key of secretKeys) {
     const value = serverEnv[key];
     if (value && !value.startsWith(KEYCHAIN_REF_PREFIX)) {