spfn 0.3.0-beta.12 → 0.3.0-beta.13

package/dist/index.js

@@ -949,7 +949,7 @@ import { dirname as dirname2, join as join10 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getCliVersion() {
   if (true) {
-    return "0.3.0-beta.12";
+    return "0.3.0-beta.13";
   }
   return fromPackageJson ?? (fromPackageJson = readPackageVersion());
 }
@@ -2381,7 +2381,7 @@ function writeAgentInstructions(cwd, agentFiles) {
   }
 }
 function waitForReadyFile(filePath, timeoutMs = 3e4) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve7, reject) => {
     if (existsSync16(filePath)) {
       unlinkSync(filePath);
     }
@@ -2395,7 +2395,7 @@ function waitForReadyFile(filePath, timeoutMs = 3e4) {
       if (name === fileName && existsSync16(filePath)) {
         watcher.close();
         clearTimeout(timer);
-        resolve4(readFileSync9(filePath, "utf-8").trim());
+        resolve7(readFileSync9(filePath, "utf-8").trim());
       }
     });
   });
@@ -2574,7 +2574,7 @@ catch (error)
           serverProcess2.kill("SIGTERM");
           await serverProcess2.catch(() => {
           });
-          await new Promise((resolve4) => setTimeout(resolve4, 500));
+          await new Promise((resolve7) => setTimeout(resolve7, 500));
         } catch (error) {
         }
       }
@@ -2617,12 +2617,12 @@ catch (error)
     process.on("SIGTERM", cleanup2);
     startWatcher2();
     startServer2();
-    await new Promise((resolve4) => {
+    await new Promise((resolve7) => {
       const keepAlive = setInterval(() => {
       }, 1e6);
       process.once("beforeExit", () => {
         clearInterval(keepAlive);
-        resolve4();
+        resolve7();
       });
     });
     return;
@@ -2683,7 +2683,7 @@ catch (error)
         serverProcess.kill("SIGTERM");
         await serverProcess.catch(() => {
         });
-        await new Promise((resolve4) => setTimeout(resolve4, 500));
+        await new Promise((resolve7) => setTimeout(resolve7, 500));
       } catch (error) {
       }
     }
@@ -2737,12 +2737,12 @@ catch (error)
     logger.warn(`[SPFN] Server readiness check timed out, starting Next.js anyway...`);
   }
   startNext();
-  await new Promise((resolve4) => {
+  await new Promise((resolve7) => {
     const keepAlive = setInterval(() => {
     }, 1e6);
     process.once("beforeExit", () => {
       clearInterval(keepAlive);
-      resolve4();
+      resolve7();
     });
   });
 });
@@ -3602,7 +3602,7 @@ async function runDrizzleCommand(command) {
   }
   const args = command.split(" ");
   args.push(`--config=${configPath}`);
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve7, reject) => {
     const drizzleProcess = spawn("drizzle-kit", args, {
       stdio: "inherit",
       // Allow interactive input
@@ -3617,7 +3617,7 @@ async function runDrizzleCommand(command) {
     drizzleProcess.on("close", (code) => {
       cleanup();
       if (code === 0) {
-        resolve4();
+        resolve7();
       } else {
         reject(new Error(`drizzle-kit ${command} exited with code ${code}`));
       }
@@ -4133,15 +4133,15 @@ async function confirmDangerousTarget(dbInfo) {
   }
 }
 async function isPortAvailable(port) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve7) => {
     const server = net.createServer();
     server.once("error", () => {
       server.close();
-      resolve4(false);
+      resolve7(false);
     });
     server.once("listening", () => {
       server.close();
-      resolve4(true);
+      resolve7(true);
     });
     server.listen(port, "127.0.0.1");
   });
@@ -4397,7 +4397,7 @@ async function dbBackup(options) {
   pgDump.stderr?.on("data", (data) => {
     errorOutput += data.toString();
   });
-  await new Promise((resolve4, reject) => {
+  await new Promise((resolve7, reject) => {
     pgDump.on("close", async (code) => {
       if (code === 0) {
         try {
@@ -4434,7 +4434,7 @@ async function dbBackup(options) {
             tags: tags.length > 0 ? tags : void 0
           };
           await saveBackupMetadata(metadata, filename);
-          resolve4();
+          resolve7();
         } catch (error) {
           reject(error);
         }
@@ -4913,7 +4913,7 @@ async function dbRestore(backupFile, options = {}) {
       spinner.start();
     }
   });
-  await new Promise((resolve4, reject) => {
+  await new Promise((resolve7, reject) => {
     restoreProcess.on("close", (code) => {
       if (code === 0) {
         const summary = objectCount > 0 ? ` (${objectCount} objects)` : "";
@@ -4927,7 +4927,7 @@ async function dbRestore(backupFile, options = {}) {
           }
         }
         console.log(chalk26.green("\n\u2705 Database restored successfully"));
-        resolve4();
+        resolve7();
       } else {
         spinner.fail("Restore failed");
         if (errors.length > 0) {
@@ -5334,25 +5334,32 @@ var addCommand = new Command12("add").description("Add a capability to this proj
 // src/commands/env.ts
 import { Command as Command13 } from "commander";
 import chalk32 from "chalk";
-import { existsSync as existsSync28, readFileSync as readFileSync14, writeFileSync as writeFileSync18 } from "fs";
-import { resolve as resolve2 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync16, writeFileSync as writeFileSync18 } from "fs";
+import { resolve as resolve4 } from "path";
 import { parse as parse2 } from "dotenv";
 
 // src/utils/env-schema.ts
+import { createRequire } from "module";
+import { join as join28 } from "path";
+import { pathToFileURL as pathToFileURL3 } from "url";
 var VALID_ENVS = ["local", "development", "staging", "production", "test"];
-async function loadEnvSchema(packageName) {
-  try {
-    const module = await import(`${packageName}/config`);
-    if (!module.envSchema) {
-      throw new Error(`Package ${packageName} does not export envSchema from config`);
-    }
-    return module.envSchema;
-  } catch (error) {
-    if (error instanceof Error && error.message.includes("does not export envSchema")) {
-      throw error;
-    }
+async function loadEnvSchema(packageName, cwd = process.cwd()) {
+  const specifier = `${packageName}/config`;
+  const path5 = resolveFrom(join28(cwd, "noop.js"), specifier);
+  const module = await (path5 ? import(pathToFileURL3(path5).href) : import(specifier)).catch((error) => {
     const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Failed to load package ${packageName}: ${message}`);
+    return Promise.reject(new Error(`Failed to load package ${packageName}: ${message}`));
+  });
+  if (!module.envSchema) {
+    throw new Error(`Package ${packageName} does not export envSchema from config`);
+  }
+  return module.envSchema;
+}
+function resolveFrom(parent, specifier) {
+  try {
+    return createRequire(parent).resolve(specifier);
+  } catch {
+    return void 0;
   }
 }
 function getTargetFile(schema) {
@@ -5368,6 +5375,416 @@ function secretEntries(schema) {
 function generatableSecrets(schema) {
   return secretEntries(schema).filter((entry) => !!entry.generate);
 }
+function layerOf(entry) {
+  return entry.layer ?? "environment";
+}
+
+// src/utils/env-list.ts
+import { existsSync as existsSync28, readFileSync as readFileSync14 } from "fs";
+import { join as join29, resolve as resolve2 } from "path";
+import { pathToFileURL as pathToFileURL4 } from "url";
+import { loadAppConfig as loadAppConfig3 } from "@spfn/core/app-config";
+var CORE_PACKAGE = "@spfn/core";
+var TYPESCRIPT_FILE = /\.[cm]?tsx?$/;
+async function loadEnvList(options, cwd = process.cwd()) {
+  if (options.package) {
+    return mergeEnvSources([{ name: options.package, schema: await loadEnvSchema(options.package, cwd) }]);
+  }
+  return mergeEnvSources([
+    ...await loadAppSchemas(cwd),
+    ...await loadPackageSchemas(cwd)
+  ]);
+}
+function mergeEnvSources(sources) {
+  const schema = {};
+  const declaredBy = {};
+  const conflicts = [];
+  for (const source of sources) {
+    for (const [key, entry] of Object.entries(source.schema)) {
+      const existing = schema[key];
+      const owners = declaredBy[key] ?? [];
+      declaredBy[key] = [...owners, source.name];
+      if (!existing) {
+        schema[key] = { ...entry, key };
+        continue;
+      }
+      if (describeRules(existing) !== describeRules(entry)) {
+        conflicts.push(`${key}: ${owners.join(", ")} declares ${describeRules(existing)}, ${source.name} declares ${describeRules(entry)}`);
+      }
+    }
+  }
+  if (conflicts.length > 0) {
+    throw new Error(`Env schemas declare a variable differently:
+  - ${conflicts.join("\n  - ")}`);
+  }
+  return { sources, schema, declaredBy };
+}
+function groupBySource(list, entries = Object.values(list.schema)) {
+  return list.sources.map((source) => ({
+    source: source.name,
+    entries: entries.filter((entry) => list.declaredBy[entry.key]?.[0] === source.name)
+  })).filter((group) => group.entries.length > 0);
+}
+function alsoDeclaredBy(list, key) {
+  return (list.declaredBy[key] ?? []).slice(1);
+}
+function describeEnvList(options) {
+  return options.package ?? "whole app";
+}
+function describeRules(entry) {
+  return `"${entry.type}" (${entry.required ? "required" : "optional"}${entry.sensitive ? ", sensitive" : ""}${layerOf(entry) === "instance" ? ", instance layer" : ""})`;
+}
+async function loadAppSchemas(cwd) {
+  const paths = (await loadAppConfig3(cwd)).env?.schemas ?? [];
+  if (!Array.isArray(paths) || paths.some((path5) => typeof path5 !== "string")) {
+    throw new Error("spfn.config.js: env.schemas must be an array of paths relative to the project root.");
+  }
+  const sources = [];
+  for (const path5 of paths) {
+    sources.push({ name: path5, schema: await loadSchemaModule(cwd, path5) });
+  }
+  return sources;
+}
+async function loadSchemaModule(cwd, path5) {
+  const fullPath = resolve2(cwd, path5);
+  if (!existsSync28(fullPath)) {
+    throw new Error(`spfn.config.js env.schemas: ${path5} does not exist.`);
+  }
+  const module = await importAppModule(cwd, fullPath).catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    return Promise.reject(new Error(`spfn.config.js env.schemas: ${path5} could not be loaded: ${message}`));
+  });
+  if (!module.envSchema) {
+    throw new Error(`spfn.config.js env.schemas: ${path5} does not export envSchema.`);
+  }
+  return module.envSchema;
+}
+async function importAppModule(cwd, fullPath) {
+  const url = pathToFileURL4(fullPath).href;
+  const tsx = await loadTsx(cwd);
+  if (tsx) {
+    const tsconfig = join29(cwd, "tsconfig.json");
+    return await tsx.tsImport(url, {
+      parentURL: pathToFileURL4(join29(cwd, "noop.js")).href,
+      tsconfig: existsSync28(tsconfig) ? tsconfig : false
+    });
+  }
+  if (TYPESCRIPT_FILE.test(fullPath)) {
+    throw new Error("tsx is not installed in this project, and it is what loads TypeScript. Add it: pnpm add -D tsx");
+  }
+  return await import(url);
+}
+async function loadTsx(cwd) {
+  const path5 = resolveFrom(join29(cwd, "noop.js"), "tsx/esm/api") ?? resolveFrom(import.meta.url, "tsx/esm/api");
+  return path5 ? await import(pathToFileURL4(path5).href) : void 0;
+}
+async function loadPackageSchemas(cwd) {
+  const sources = [];
+  for (const name of readSpfnDependencies(cwd)) {
+    const path5 = resolveFrom(join29(cwd, "noop.js"), `${name}/config`);
+    const module = path5 ? await importPackageConfig(name, path5) : void 0;
+    if (module?.envSchema) {
+      sources.push({ name, schema: module.envSchema });
+    }
+  }
+  return sources;
+}
+async function importPackageConfig(name, path5) {
+  return await import(pathToFileURL4(path5).href).catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    return Promise.reject(new Error(`Failed to load package ${name}: ${message}`));
+  });
+}
+function readSpfnDependencies(cwd) {
+  const packageJsonPath = join29(cwd, "package.json");
+  if (!existsSync28(packageJsonPath)) {
+    return [];
+  }
+  const packageJson = JSON.parse(readFileSync14(packageJsonPath, "utf-8"));
+  const names = Object.keys({ ...packageJson.dependencies, ...packageJson.devDependencies }).filter((name) => name.startsWith("@spfn/")).sort();
+  return names.includes(CORE_PACKAGE) ? [CORE_PACKAGE, ...names.filter((name) => name !== CORE_PACKAGE)] : names;
+}
+
+// src/utils/env-audit/index.ts
+import { existsSync as existsSync30, readFileSync as readFileSync15 } from "fs";
+import { join as join32, relative as relative2, resolve as resolve3 } from "path";
+import { loadAppConfig as loadAppConfig4 } from "@spfn/core/app-config";
+
+// src/utils/env-audit/files.ts
+import { existsSync as existsSync29, lstatSync, readdirSync as readdirSync2 } from "fs";
+import { join as join30 } from "path";
+var DEFAULT_INCLUDE = ["src"];
+var SKIPPED_DIRECTORIES = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "out",
+  "coverage",
+  ".next",
+  ".turbo",
+  ".vercel",
+  ".output",
+  ".spfn"
+]);
+var SOURCE_FILE = /\.(?:[cm]?[jt]s|[jt]sx)$/;
+var DECLARATION_FILE = /\.d\.[cm]?ts$/;
+var GLOB_CHARACTER = /[*?]/;
+function listAuditFiles(cwd, scope) {
+  const include = scope.include.map(globToRegExp);
+  const ignore = scope.ignore.map(globToRegExp);
+  const files = /* @__PURE__ */ new Set();
+  for (const root of new Set(scope.include.map(staticPrefix))) {
+    walk(cwd, root, ignore, files);
+  }
+  return [...files].filter((file) => matchesAny(file, include)).sort();
+}
+function matchesAny(path5, globs) {
+  const segments = path5.split("/");
+  return segments.some((_, index) => {
+    const prefix = segments.slice(0, index + 1).join("/");
+    return globs.some((glob) => glob.test(prefix));
+  });
+}
+function globToRegExp(glob) {
+  const body = normalizeGlob(glob).split(/(\*\*\/|\*\*|\*|\?)/).map((part) => {
+    switch (part) {
+      case "**/":
+        return "(?:.*/)?";
+      case "**":
+        return ".*";
+      case "*":
+        return "[^/]*";
+      case "?":
+        return "[^/]";
+      default:
+        return part.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }).join("");
+  return new RegExp(`^${body}$`);
+}
+function normalizeGlob(glob) {
+  const normalized = glob.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "").replace(/\/\*\*$/, "");
+  if (normalized.startsWith("/") || normalized.split("/").includes("..")) {
+    throw new Error(`spfn.config.js env.audit: "${glob}" must be relative to the project root and stay inside it.`);
+  }
+  return normalized === "." ? "**" : normalized;
+}
+function staticPrefix(glob) {
+  const segments = normalizeGlob(glob).split("/");
+  const firstWildcard = segments.findIndex((segment) => GLOB_CHARACTER.test(segment));
+  return (firstWildcard === -1 ? segments : segments.slice(0, firstWildcard)).join("/");
+}
+function walk(cwd, relPath, ignore, files) {
+  const fullPath = join30(cwd, relPath);
+  if (!existsSync29(fullPath) || relPath && matchesAny(relPath, ignore)) {
+    return;
+  }
+  const stats = lstatSync(fullPath);
+  if (stats.isFile()) {
+    addIfSource(relPath, files);
+  }
+  if (!stats.isDirectory()) {
+    return;
+  }
+  for (const entry of readdirSync2(fullPath, { withFileTypes: true })) {
+    const child = relPath ? `${relPath}/${entry.name}` : entry.name;
+    if (entry.isDirectory() && !SKIPPED_DIRECTORIES.has(entry.name)) {
+      walk(cwd, child, ignore, files);
+    } else if (entry.isFile() && !matchesAny(child, ignore)) {
+      addIfSource(child, files);
+    }
+  }
+}
+function addIfSource(relPath, files) {
+  if (SOURCE_FILE.test(relPath) && !DECLARATION_FILE.test(relPath)) {
+    files.add(relPath);
+  }
+}
+
+// src/utils/env-audit/parse.ts
+import { createRequire as createRequire2 } from "module";
+import { join as join31 } from "path";
+var ALWAYS_ALLOWED = "NODE_ENV";
+var MAX_KEY_TEXT = 40;
+var compiler;
+function loadTypeScript(cwd) {
+  if (compiler) {
+    return compiler;
+  }
+  const path5 = resolveFrom(join31(cwd, "noop.js"), "typescript") ?? resolveFrom(import.meta.url, "typescript") ?? resolveThroughCore();
+  if (!path5) {
+    throw new Error("spfn env audit parses sources with TypeScript, which is not installed. Add it: pnpm add -D typescript");
+  }
+  compiler = createRequire2(import.meta.url)(path5);
+  return compiler;
+}
+function resolveThroughCore() {
+  const core = resolveFrom(import.meta.url, "@spfn/core/app-config");
+  return core ? resolveFrom(core, "typescript") : void 0;
+}
+function readSourceFacts(ts, fileName, text) {
+  const source = ts.createSourceFile(fileName, text, ts.ScriptTarget.Latest, true, scriptKindOf(ts, fileName));
+  const facts = { directReads: [], names: /* @__PURE__ */ new Set() };
+  const visit = (node) => {
+    collectName(ts, node, facts.names);
+    collectDirectRead(ts, source, node, facts.directReads);
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  facts.directReads = facts.directReads.filter((read) => read.name !== ALWAYS_ALLOWED);
+  return facts;
+}
+function readPropertyLines(ts, fileName, text) {
+  const source = ts.createSourceFile(fileName, text, ts.ScriptTarget.Latest, true, scriptKindOf(ts, fileName));
+  const lines = /* @__PURE__ */ new Map();
+  const visit = (node) => {
+    const name = ts.isPropertyAssignment(node) || ts.isShorthandPropertyAssignment(node) ? propertyNameText(ts, node.name) : void 0;
+    if (name && !lines.has(name)) {
+      lines.set(name, lineOf(source, node));
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  return lines;
+}
+function scriptKindOf(ts, fileName) {
+  if (fileName.endsWith(".tsx")) {
+    return ts.ScriptKind.TSX;
+  }
+  return /\.[cm]?tsx?$/.test(fileName) ? ts.ScriptKind.TS : ts.ScriptKind.JSX;
+}
+function collectName(ts, node, names) {
+  if (ts.isPropertyAccessExpression(node)) {
+    names.add(node.name.text);
+  } else if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
+    names.add(node.text);
+  } else if (ts.isBindingElement(node) && ts.isObjectBindingPattern(node.parent)) {
+    const name = propertyNameText(ts, node.propertyName ?? node.name);
+    if (name) {
+      names.add(name);
+    }
+  }
+}
+function collectDirectRead(ts, source, node, reads) {
+  if (ts.isPropertyAccessExpression(node) && isProcessEnv(ts, node.expression)) {
+    reads.push({ line: lineOf(source, node), name: node.name.text, reason: "read from process.env" });
+  } else if (ts.isElementAccessExpression(node) && isProcessEnv(ts, node.expression)) {
+    reads.push({ line: lineOf(source, node), ...describeElementKey(ts, source, node.argumentExpression) });
+  } else if (ts.isVariableDeclaration(node) && node.initializer && isProcessEnv(ts, node.initializer) && ts.isObjectBindingPattern(node.name)) {
+    reads.push(...node.name.elements.map((element) => destructuredRead(ts, source, element)));
+  }
+}
+function describeElementKey(ts, source, key) {
+  if (ts.isStringLiteralLike(key)) {
+    return { name: key.text, reason: "read from process.env" };
+  }
+  const text = key.getText(source).replace(/\s+/g, " ");
+  return {
+    name: `[${text.length > MAX_KEY_TEXT ? `${text.slice(0, MAX_KEY_TEXT)}\u2026` : text}]`,
+    reason: "read from process.env under a computed key"
+  };
+}
+function destructuredRead(ts, source, element) {
+  const name = element.dotDotDotToken ? `...${element.name.getText(source)}` : propertyNameText(ts, element.propertyName ?? element.name) ?? `[${(element.propertyName ?? element.name).getText(source)}]`;
+  return { line: lineOf(source, element), name, reason: "destructured from process.env" };
+}
+function isProcessEnv(ts, node) {
+  const expression = skipWrappers(ts, node);
+  return ts.isPropertyAccessExpression(expression) && expression.name.text === "env" && isProcess(ts, skipWrappers(ts, expression.expression));
+}
+function isProcess(ts, node) {
+  if (ts.isIdentifier(node)) {
+    return node.text === "process";
+  }
+  return ts.isPropertyAccessExpression(node) && node.name.text === "process" && ts.isIdentifier(node.expression) && ["globalThis", "global", "window", "self"].includes(node.expression.text);
+}
+function skipWrappers(ts, node) {
+  let current = node;
+  while (ts.isParenthesizedExpression(current) || ts.isAsExpression(current) || ts.isNonNullExpression(current) || ts.isSatisfiesExpression(current)) {
+    current = current.expression;
+  }
+  return current;
+}
+function propertyNameText(ts, name) {
+  if (ts.isIdentifier(name) || ts.isStringLiteral(name) || ts.isNumericLiteral(name) || ts.isPrivateIdentifier(name)) {
+    return name.text;
+  }
+  return void 0;
+}
+function lineOf(source, node) {
+  return source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1;
+}
+
+// src/utils/env-audit/index.ts
+var ROOT_CONFIG_FILE = /^[^/]+\.config\.(?:js|cjs|mjs|ts)$/;
+async function runEnvAudit(cwd = process.cwd()) {
+  const scope = readScope((await loadAppConfig4(cwd)).env?.audit);
+  const appSources = await loadAppSchemas(cwd);
+  const list = mergeEnvSources([...appSources, ...await loadPackageSchemas(cwd)]);
+  const ts = loadTypeScript(cwd);
+  const files = listAuditFiles(cwd, scope);
+  const context = {
+    cwd,
+    ts,
+    list,
+    appSources,
+    schemaFiles: new Set(appSources.map((source) => toProjectPath(cwd, source.name))),
+    facts: new Map(files.map((file) => [file, readSourceFacts(ts, file, readFileSync15(join32(cwd, file), "utf-8"))]))
+  };
+  return {
+    fileCount: files.length,
+    directReads: findDirectReads(context),
+    declarations: appSources.length > 0 ? findUnusedDeclarations(context) : [],
+    notices: appSources.length > 0 ? [] : ["No env.schemas in spfn.config.js \u2014 the unused-declaration check is skipped."]
+  };
+}
+function readScope(audit) {
+  const include = audit?.include ?? DEFAULT_INCLUDE;
+  const ignore = audit?.ignore ?? [];
+  for (const [field, value] of [["include", include], ["ignore", ignore]]) {
+    if (!Array.isArray(value) || value.some((glob) => typeof glob !== "string")) {
+      throw new Error(`spfn.config.js: env.audit.${field} must be an array of globs relative to the project root.`);
+    }
+  }
+  return { include, ignore };
+}
+function findDirectReads({ facts, schemaFiles }) {
+  return [...facts].filter(([file]) => !schemaFiles.has(file) && !ROOT_CONFIG_FILE.test(file)).flatMap(([file, { directReads }]) => directReads.map((read) => ({ file, ...read })));
+}
+function findUnusedDeclarations(context) {
+  const readNames = new Set([...context.facts].filter(([file]) => !context.schemaFiles.has(file)).flatMap(([, { names }]) => [...names]));
+  return context.appSources.flatMap((source) => {
+    const file = toProjectPath(context.cwd, source.name);
+    const lines = readPropertyLines(context.ts, file, readFileSync15(join32(context.cwd, file), "utf-8"));
+    return Object.entries(source.schema).filter(([name]) => !isPackageName(context, name)).flatMap(([name, entry]) => checkEntry(context, readNames, name, entry).map((reason) => ({ file, line: lines.get(name) ?? 1, name, reason })));
+  });
+}
+function checkEntry(context, readNames, name, entry) {
+  if (entry.readBy === void 0) {
+    return readNames.has(name) ? [] : ["declared but read nowhere in scope (unused)"];
+  }
+  if (!Array.isArray(entry.readBy) || entry.readBy.some((path5) => typeof path5 !== "string")) {
+    return ["readBy must be an array of paths relative to the project root"];
+  }
+  return checkReadBy(context, entry.readBy);
+}
+function isPackageName({ list, appSources }, name) {
+  const appNames = new Set(appSources.map((source) => source.name));
+  return (list.declaredBy[name] ?? []).some((owner) => !appNames.has(owner));
+}
+function checkReadBy({ cwd, facts }, readBy) {
+  return readBy.flatMap((path5) => {
+    const file = toProjectPath(cwd, path5);
+    if (!existsSync30(join32(cwd, file))) {
+      return [`readBy file ${path5} does not exist`];
+    }
+    return facts.has(file) ? [] : [`readBy file ${path5} is not scanned (see env.audit)`];
+  });
+}
+function toProjectPath(cwd, path5) {
+  return relative2(cwd, resolve3(cwd, path5)).split("\\").join("/");
+}
 
 // src/commands/env.ts
 var BASE_ENV_FILES = {
@@ -5412,10 +5829,10 @@ function formatDefault(value, type) {
   return chalk32.cyan(String(value));
 }
 async function listEnvVars(options) {
-  const packageName = options.package || "@spfn/core";
+  const label = describeEnvList(options);
   try {
-    const envSchema = await loadEnvSchema(packageName);
-    const allVars = Object.entries(envSchema);
+    const list = await loadEnvList(options);
+    const allVars = orderedVars(list);
     if (options.group) {
       const grouped = allVars.reduce((acc, [key, schema]) => {
         const target = getTargetFile(schema);
@@ -5424,22 +5841,27 @@ async function listEnvVars(options) {
         return acc;
       }, {});
       console.log(chalk32.blue.bold(`
-\u{1F4CB} Environment Variables by File (${packageName})
+\u{1F4CB} Environment Variables by File (${label})
 `));
       for (const [file, vars] of Object.entries(grouped)) {
         console.log(chalk32.bold.magenta(`
 ${file}`));
         console.log(chalk32.dim("\u2500".repeat(50)));
         for (const [key, schema] of vars) {
-          printEnvVar(key, schema);
+          printEnvVar(key, schema, false, list.declaredBy[key]);
         }
       }
     } else {
       console.log(chalk32.blue.bold(`
-\u{1F4CB} Environment Variables (${packageName})
+\u{1F4CB} Environment Variables (${label})
 `));
-      for (const [key, schema] of allVars) {
-        printEnvVar(key, schema, true);
+      for (const group of groupBySource(list)) {
+        console.log(chalk32.bold.magenta(`
+${group.source}`));
+        console.log(chalk32.dim("\u2500".repeat(50)));
+        for (const entry of group.entries) {
+          printEnvVar(entry.key, entry, true, alsoDeclaredBy(list, entry.key));
+        }
       }
     }
     console.log(chalk32.dim("\n\u{1F4A1} Tip: Use `spfn env init` to generate .env template files\n"));
@@ -5450,13 +5872,19 @@ ${file}`));
     process.exit(1);
   }
 }
-function printEnvVar(key, schema, showFile = false) {
+function orderedVars(list) {
+  return groupBySource(list).flatMap((group) => group.entries.map((entry) => [entry.key, entry]));
+}
+function printEnvVar(key, schema, showFile = false, sources = []) {
   const typeStr = formatType(schema.type);
   const requiredStr = schema.required || schema.default !== void 0 ? chalk32.red("[required]") : chalk32.dim("[optional]");
   const sensitiveStr = schema.sensitive ? chalk32.yellow(" [sensitive]") : "";
   const fileStr = showFile ? chalk32.dim(` \u2192 ${getTargetFile(schema)}`) : "";
   console.log(`${chalk32.bold.cyan(key)} ${chalk32.dim("(")}${typeStr}${chalk32.dim(")")} ${requiredStr}${sensitiveStr}${fileStr}`);
   console.log(`  ${chalk32.dim(schema.description)}`);
+  if (sources.length > 0) {
+    console.log(`  ${chalk32.dim(showFile ? "Also declared by:" : "Declared by:")} ${chalk32.dim(sources.join(", "))}`);
+  }
   if (schema.default !== void 0) {
     console.log(`  ${chalk32.dim("Default:")} ${formatDefault(schema.default, schema.type)}`);
   }
@@ -5467,13 +5895,12 @@ function printEnvVar(key, schema, showFile = false) {
   console.log();
 }
 async function showEnvStats(options) {
-  const packageName = options.package || "@spfn/core";
   try {
-    const envSchema = await loadEnvSchema(packageName);
+    const list = await loadEnvList(options);
     console.log(chalk32.blue.bold(`
-\u{1F4CA} Environment Variable Statistics (${packageName})
+\u{1F4CA} Environment Variable Statistics (${describeEnvList(options)})
 `));
-    const allVars = Object.entries(envSchema);
+    const allVars = orderedVars(list);
     const required = allVars.filter(([_, schema]) => schema.required || schema.default !== void 0);
     const optional = allVars.filter(([_, schema]) => !schema.required && schema.default === void 0);
     const sensitive = allVars.filter(([_, schema]) => schema.sensitive);
@@ -5516,12 +5943,11 @@ async function showEnvStats(options) {
   }
 }
 async function searchEnvVars(query, options) {
-  const packageName = options.package || "@spfn/core";
   try {
-    const envSchema = await loadEnvSchema(packageName);
+    const list = await loadEnvList(options);
     const normalizedQuery = query.toLowerCase();
     const results = [];
-    for (const [key, schema] of Object.entries(envSchema)) {
+    for (const [key, schema] of orderedVars(list)) {
       const matchesKey = key.toLowerCase().includes(normalizedQuery);
       const matchesDescription = schema.description.toLowerCase().includes(normalizedQuery);
       if (matchesKey || matchesDescription) {
@@ -5554,10 +5980,11 @@ async function searchEnvVars(query, options) {
     process.exit(1);
   }
 }
+var PACKAGE_OPTION_HELP = "Read only this package's env schema (default: the whole app \u2014 spfn.config.js env.schemas + installed @spfn/* packages)";
 var envCommand = new Command13("env").description("Manage environment variables");
-envCommand.command("list").description("List all environment variables from schema").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").option("-g, --group", "Group variables by target file").action(listEnvVars);
-envCommand.command("stats").description("Show environment variable statistics").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").action(showEnvStats);
-envCommand.command("search").description("Search environment variables").argument("<query>", "Search query (matches key or description)").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").action(searchEnvVars);
+envCommand.command("list").description("List all environment variables from schema").option("-p, --package <package>", PACKAGE_OPTION_HELP).option("-g, --group", "Group variables by target file").action(listEnvVars);
+envCommand.command("stats").description("Show environment variable statistics").option("-p, --package <package>", PACKAGE_OPTION_HELP).action(showEnvStats);
+envCommand.command("search").description("Search environment variables").argument("<query>", "Search query (matches key or description)").option("-p, --package <package>", PACKAGE_OPTION_HELP).action(searchEnvVars);
 function validateEnvOption(envValue) {
   if (!VALID_ENVS.includes(envValue)) {
     console.error(chalk32.red(`
@@ -5569,12 +5996,11 @@ function validateEnvOption(envValue) {
   return envValue;
 }
 async function initEnvFiles(options) {
-  const packageName = options.package || "@spfn/core";
   const targetEnv = options.env ? validateEnvOption(options.env) : void 0;
   const cwd = process.cwd();
   try {
-    const envSchema = await loadEnvSchema(packageName);
-    const allVars = Object.entries(envSchema);
+    const list = await loadEnvList(options);
+    const allVars = orderedVars(list);
     const grouped = allVars.reduce((acc, [key, schema]) => {
       const target = getTargetFile(schema);
       const exampleFile = target + ".example";
@@ -5597,14 +6023,14 @@ async function initEnvFiles(options) {
       }
       const allGrouped = { ...grouped, ...envSpecificFiles };
       for (const [file, vars] of Object.entries(allGrouped)) {
-        writeEnvTemplate(cwd, file, vars, options.force ?? false);
+        writeEnvTemplate(cwd, file, vars, options.force ?? false, list);
       }
     } else {
       console.log(chalk32.blue.bold(`
 \u{1F680} Generating .env template files
 `));
       for (const [file, vars] of Object.entries(grouped)) {
-        writeEnvTemplate(cwd, file, vars, options.force ?? false);
+        writeEnvTemplate(cwd, file, vars, options.force ?? false, list);
       }
     }
     console.log(chalk32.dim("\n\u{1F4A1} Copy .example files to create your actual .env files:"));
@@ -5623,22 +6049,28 @@ async function initEnvFiles(options) {
     process.exit(1);
   }
 }
-function writeEnvTemplate(cwd, file, vars, force) {
-  const filePath = resolve2(cwd, file);
-  if (existsSync28(filePath) && !force) {
+function writeEnvTemplate(cwd, file, vars, force, list) {
+  const filePath = resolve4(cwd, file);
+  if (existsSync31(filePath) && !force) {
     console.log(chalk32.yellow(`  \u23ED\uFE0F  ${file} already exists (use --force to overwrite)`));
     return;
   }
-  writeFileSync18(filePath, generateEnvFileContent(vars), "utf-8");
+  writeFileSync18(filePath, generateEnvFileContent(vars, list), "utf-8");
   console.log(chalk32.green(`  \u2705 ${file} (${vars.length} variables)`));
 }
-function generateEnvFileContent(vars) {
+function generateEnvFileContent(vars, list) {
   const lines = [
     "# Auto-generated by spfn env init",
     "# Copy this file and fill in the values",
     ""
   ];
+  let section;
   for (const [key, schema] of vars) {
+    const source = list.declaredBy[key]?.[0];
+    if (list.sources.length > 1 && source !== section) {
+      section = source;
+      lines.push(`# \u2500\u2500 ${source} \u2500\u2500`, "");
+    }
     lines.push(`# ${schema.description}`);
     if (schema.required) {
       lines.push(`# [required]`);
@@ -5658,12 +6090,11 @@ function generateEnvFileContent(vars) {
   return lines.join("\n");
 }
 async function checkEnvFiles(options) {
-  const packageName = options.package || "@spfn/core";
   const targetEnv = options.env ? validateEnvOption(options.env) : void 0;
   const cwd = process.cwd();
   try {
-    const envSchema = await loadEnvSchema(packageName);
-    const allVars = Object.entries(envSchema);
+    const list = await loadEnvList(options);
+    const allVars = orderedVars(list);
     const envLabel = targetEnv ? ` (${targetEnv})` : "";
     console.log(chalk32.blue.bold(`
 \u{1F50D} Checking .env files against schema${envLabel}
@@ -5673,11 +6104,11 @@ async function checkEnvFiles(options) {
     const issues = [];
     const warnings = [];
     for (const file of filesToCheck) {
-      const filePath = resolve2(cwd, file);
-      if (!existsSync28(filePath)) {
+      const filePath = resolve4(cwd, file);
+      if (!existsSync31(filePath)) {
         continue;
       }
-      const content = readFileSync14(filePath, "utf-8");
+      const content = readFileSync16(filePath, "utf-8");
       const parsed = parse2(content);
       for (const [key, value] of Object.entries(parsed)) {
         loadedEnv[key] = { value: value || "", file };
@@ -5690,7 +6121,7 @@ async function checkEnvFiles(options) {
       const found = loadedEnv[key];
       if (!found) {
         if (schema.required && schema.default === void 0) {
-          issues.push(`${chalk32.red("\u2717")} ${chalk32.cyan(key)} is required but not found in any .env file`);
+          issues.push(sourced(list, key, `${chalk32.red("\u2717")} ${chalk32.cyan(key)} is required but not found in any .env file`));
         }
         continue;
       }
@@ -5699,34 +6130,33 @@ async function checkEnvFiles(options) {
       const shouldBeNextjs = schema.nextjs ?? key.startsWith("NEXT_PUBLIC_");
       if (!shouldBeNextjs && isNextjsFile && !isServerFile) {
         if (schema.sensitive) {
-          issues.push(
+          issues.push(sourced(
+            list,
+            key,
             `${chalk32.red("\u2717")} ${chalk32.cyan(key)} is sensitive and should be in ${chalk32.magenta(expectedFile)}, but found in ${chalk32.yellow(found.file)} (security risk!)`
-          );
+          ));
         } else {
-          warnings.push(
+          warnings.push(sourced(
+            list,
+            key,
             `${chalk32.yellow("\u26A0")} ${chalk32.cyan(key)} should be in ${chalk32.magenta(expectedFile)}, but found in ${chalk32.dim(found.file)}`
-          );
+          ));
         }
       }
     }
     for (const [key, { file }] of Object.entries(loadedEnv)) {
-      const inSchema = allVars.some(([k]) => k === key);
-      if (!inSchema) {
-        warnings.push(`${chalk32.yellow("\u26A0")} ${chalk32.cyan(key)} in ${chalk32.dim(file)} is not in schema`);
+      if (!list.schema[key]) {
+        warnings.push({ source: UNDECLARED, text: `${chalk32.yellow("\u26A0")} ${chalk32.cyan(key)} in ${chalk32.dim(file)} is not in schema` });
       }
     }
     if (issues.length > 0) {
       console.log(chalk32.red.bold("Issues:"));
-      for (const issue of issues) {
-        console.log(`  ${issue}`);
-      }
+      printBySource(issues);
       console.log("");
     }
     if (warnings.length > 0) {
       console.log(chalk32.yellow.bold("Warnings:"));
-      for (const warning of warnings) {
-        console.log(`  ${warning}`);
-      }
+      printBySource(warnings);
       console.log("");
     }
     if (issues.length === 0 && warnings.length === 0) {
@@ -5745,10 +6175,22 @@ async function checkEnvFiles(options) {
     process.exit(1);
   }
 }
-envCommand.command("init").description("Generate .env template files from schema").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").option("-e, --env <environment>", "Generate environment-specific templates (e.g. production, staging)").option("-f, --force", "Overwrite existing files").action(initEnvFiles);
-envCommand.command("check").description("Check .env files against schema").option("-p, --package <package>", "Package name to read env schema from", "@spfn/core").option("-e, --env <environment>", "Check files for a specific environment (e.g. production)").action(checkEnvFiles);
+var UNDECLARED = "(not declared by any schema)";
+function sourced(list, key, text) {
+  return { source: list.declaredBy[key]?.[0] ?? UNDECLARED, text };
+}
+function printBySource(lines) {
+  const sources = [...new Set(lines.map((line) => line.source))];
+  for (const source of sources) {
+    console.log(`  ${chalk32.bold.magenta(source)}`);
+    for (const line of lines.filter((candidate) => candidate.source === source)) {
+      console.log(`    ${line.text}`);
+    }
+  }
+}
+envCommand.command("init").description("Generate .env template files from schema").option("-p, --package <package>", PACKAGE_OPTION_HELP).option("-e, --env <environment>", "Generate environment-specific templates (e.g. production, staging)").option("-f, --force", "Overwrite existing files").action(initEnvFiles);
+envCommand.command("check").description("Check .env files against schema").option("-p, --package <package>", PACKAGE_OPTION_HELP).option("-e, --env <environment>", "Check files for a specific environment (e.g. production)").action(checkEnvFiles);
 async function validateEnvVars(options) {
-  const packages = options.packages || ["@spfn/core"];
   const targetEnv = options.env ? validateEnvOption(options.env) : void 0;
   if (targetEnv) {
     const { loadEnv: loadEnv10 } = await import("@spfn/core/env/loader");
@@ -5765,66 +6207,133 @@ async function validateEnvVars(options) {
 \u{1F50D} Validating environment variables
 `));
   }
-  const allErrors = [];
-  const allWarnings = [];
-  for (const packageName of packages) {
-    try {
-      console.log(chalk32.dim(`  \u{1F4E6} ${packageName}`));
-      const envSchema = await loadEnvSchema(packageName);
-      const { createEnvRegistry } = await import("@spfn/core/env");
-      const registry = createEnvRegistry(envSchema);
-      const result = registry.validateAll();
-      for (const error of result.errors) {
-        allErrors.push({ ...error, package: packageName });
-      }
-      for (const warning of result.warnings) {
-        allWarnings.push({ ...warning, package: packageName });
-      }
-    } catch (error) {
-      if (error instanceof Error && error.message.includes("does not export envSchema")) {
-        console.log(chalk32.dim(`    \u23ED\uFE0F  No envSchema exported, skipping`));
-        continue;
-      }
-      console.error(chalk32.red(`    \u274C Failed to load: ${error instanceof Error ? error.message : String(error)}`));
-      if (options.strict) {
-        process.exit(1);
-      }
-    }
-  }
+  const sources = options.packages ? await loadPackagesToValidate(options.packages, options.strict ?? false) : await loadWholeListToValidate();
+  const { errors, warnings } = await validateSources(sources);
   console.log("");
-  if (allErrors.length > 0) {
-    console.log(chalk32.red.bold(`\u274C Validation Errors (${allErrors.length}):
+  if (errors.length > 0) {
+    console.log(chalk32.red.bold(`\u274C Validation Errors (${errors.length}):
 `));
-    for (const error of allErrors) {
-      console.log(`  ${chalk32.red("\u2717")} ${chalk32.cyan(error.key)}`);
-      console.log(`    ${chalk32.dim(error.message)}`);
-      console.log(`    ${chalk32.dim(`from ${error.package}`)}`);
-      console.log("");
-    }
+    printFindingsBySource(errors, chalk32.red("\u2717"));
   }
-  if (allWarnings.length > 0) {
-    console.log(chalk32.yellow.bold(`\u26A0\uFE0F  Warnings (${allWarnings.length}):
+  if (warnings.length > 0) {
+    console.log(chalk32.yellow.bold(`\u26A0\uFE0F  Warnings (${warnings.length}):
 `));
-    for (const warning of allWarnings) {
-      console.log(`  ${chalk32.yellow("\u26A0")} ${chalk32.cyan(warning.key)}`);
-      console.log(`    ${chalk32.dim(warning.message)}`);
-      console.log("");
-    }
+    printFindingsBySource(warnings, chalk32.yellow("\u26A0"));
   }
-  if (allErrors.length === 0 && allWarnings.length === 0) {
+  if (errors.length === 0 && warnings.length === 0) {
     console.log(chalk32.green.bold("\u2705 All environment variables are valid!\n"));
-  } else if (allErrors.length === 0) {
+  } else if (errors.length === 0) {
     console.log(chalk32.green("\u2705 No errors found."));
-    console.log(chalk32.yellow(`\u26A0\uFE0F  ${allWarnings.length} warning(s) found.
+    console.log(chalk32.yellow(`\u26A0\uFE0F  ${warnings.length} warning(s) found.
 `));
   } else {
     console.log(chalk32.red(`
-\u274C Validation failed with ${allErrors.length} error(s)
+\u274C Validation failed with ${errors.length} error(s)
 `));
     process.exit(1);
   }
 }
-envCommand.command("validate").description("Validate environment variables against schema (for CI/CD)").option("-p, --packages <packages...>", "Packages to validate", ["@spfn/core"]).option("-e, --env <environment>", "Load env files for specific environment before validating").option("-s, --strict", "Exit on any error (including load failures)").action(validateEnvVars);
+async function loadPackagesToValidate(packages, strict) {
+  const sources = [];
+  for (const packageName of packages) {
+    console.log(chalk32.dim(`  \u{1F4E6} ${packageName}`));
+    const schema = await loadEnvSchema(packageName).catch((error) => {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.includes("does not export envSchema")) {
+        console.log(chalk32.dim(`    \u23ED\uFE0F  No envSchema exported, skipping`));
+      } else {
+        console.error(chalk32.red(`    \u274C Failed to load: ${message}`));
+        exitIf(strict);
+      }
+      return void 0;
+    });
+    if (schema) {
+      sources.push({ name: packageName, schema });
+    }
+  }
+  return sources;
+}
+async function loadWholeListToValidate() {
+  const list = await loadEnvList({}).catch((error) => {
+    console.error(chalk32.red(`  \u274C ${error instanceof Error ? error.message : String(error)}`));
+    return process.exit(1);
+  });
+  for (const source of list.sources) {
+    console.log(chalk32.dim(`  \u{1F4E6} ${source.name}`));
+  }
+  return list.sources;
+}
+function exitIf(condition) {
+  if (condition) {
+    process.exit(1);
+  }
+}
+async function validateSources(sources) {
+  const { createEnvRegistry } = await import("@spfn/core/env");
+  const errors = [];
+  const warnings = [];
+  for (const source of sources) {
+    const result = createEnvRegistry(source.schema).validateAll();
+    errors.push(...result.errors.map((error) => ({ ...error, source: source.name })));
+    warnings.push(...result.warnings.map((warning) => ({ ...warning, source: source.name })));
+  }
+  return { errors: uniqueFindings(errors), warnings: uniqueFindings(warnings) };
+}
+function uniqueFindings(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  return findings.filter((finding) => {
+    const id = `${finding.key}
+${finding.message}`;
+    const isNew = !seen.has(id);
+    seen.add(id);
+    return isNew;
+  });
+}
+function printFindingsBySource(findings, mark) {
+  printBySource(findings.map((finding) => ({
+    source: finding.source,
+    text: `${mark} ${chalk32.cyan(finding.key)}
+      ${chalk32.dim(finding.message)}`
+  })));
+  console.log("");
+}
+envCommand.command("validate").description("Validate environment variables against schema (for CI/CD)").option("-p, --packages <packages...>", "Validate only these packages (default: the whole app \u2014 spfn.config.js env.schemas + installed @spfn/* packages)").option("-e, --env <environment>", "Load env files for specific environment before validating").option("-s, --strict", "Exit on any error (including load failures)").action(validateEnvVars);
+async function auditEnv() {
+  const report2 = await runEnvAudit().catch((error) => {
+    console.error(chalk32.red(`
+\u274C ${error instanceof Error ? error.message : String(error)}
+`));
+    return process.exit(1);
+  });
+  console.log(chalk32.blue.bold(`
+\u{1F50D} Env audit \u2014 ${report2.fileCount} file(s) scanned
+`));
+  printAuditFindings("Direct reads of process.env", report2.directReads);
+  printAuditFindings("Declarations", report2.declarations);
+  for (const notice of report2.notices) {
+    console.log(chalk32.dim(`  \u2139 ${notice}
+`));
+  }
+  const count = report2.directReads.length + report2.declarations.length;
+  if (count === 0) {
+    console.log(chalk32.green("\u2705 The code reads the env list, and every app variable is read.\n"));
+    return;
+  }
+  console.log(chalk32.dim(`Found ${count} finding(s)
+`));
+  process.exit(1);
+}
+function printAuditFindings(heading, findings) {
+  if (findings.length === 0) {
+    return;
+  }
+  console.log(chalk32.bold(`${heading} (${findings.length}):`));
+  for (const finding of [...findings].sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line)) {
+    console.log(`  ${chalk32.yellow(`${finding.file}:${finding.line}`)}  ${chalk32.cyan(finding.name)}  ${chalk32.dim(finding.reason)}`);
+  }
+  console.log("");
+}
+envCommand.command("audit").description("Find direct process.env reads and app env variables nothing reads (spfn.config.js env.audit)").action(auditEnv);
 
 // src/commands/ops/index.ts
 import { Command as Command15 } from "commander";
@@ -6247,14 +6756,14 @@ function assertBatchSafe(label, value) {
 function storeOpsToken(account, token) {
   assertBatchSafe("Keychain account", account);
   assertBatchSafe("Token", token);
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve7, reject) => {
     const child = spawn5("security", ["-i"], { stdio: ["pipe", "ignore", "pipe"] });
     let stderr = "";
     child.stderr.on("data", (chunk) => stderr += String(chunk));
     child.on("error", reject);
     child.on("close", (code) => {
       if (code === 0) {
-        resolve4();
+        resolve7();
         return;
       }
       reject(new Error(`security exited with code ${code}: ${stderr.trim()}`));
@@ -6266,27 +6775,27 @@ function storeOpsToken(account, token) {
 }
 function loadOpsToken(account) {
   assertBatchSafe("Keychain account", account);
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve7, reject) => {
     execFile(
       "security",
       ["find-generic-password", "-s", KEYCHAIN_SERVICE2, "-a", account, "-w"],
       (error, stdout) => {
         if (error) {
           if (typeof error.code === "number" && error.code === 44) {
-            resolve4(null);
+            resolve7(null);
             return;
           }
           reject(error);
           return;
         }
-        resolve4(stdout.trim() || null);
+        resolve7(stdout.trim() || null);
       }
     );
   });
 }
 function deleteOpsToken(account) {
   assertBatchSafe("Keychain account", account);
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve7, reject) => {
     execFile(
       "security",
       ["delete-generic-password", "-s", KEYCHAIN_SERVICE2, "-a", account],
@@ -6295,7 +6804,7 @@ function deleteOpsToken(account) {
           reject(error);
           return;
         }
-        resolve4();
+        resolve7();
       }
     );
   });
@@ -6383,14 +6892,14 @@ import prompts9 from "prompts";
 import chalk34 from "chalk";
 
 // src/utils/ops/auth-crypto.ts
-import { createRequire } from "module";
-import { join as join28 } from "path";
-import { pathToFileURL as pathToFileURL3 } from "url";
+import { createRequire as createRequire3 } from "module";
+import { join as join33 } from "path";
+import { pathToFileURL as pathToFileURL5 } from "url";
 var CRYPTO_ENTRY_SINCE = "0.3.0-beta.2";
 var CRYPTO_ENTRY = "@spfn/auth/crypto";
 async function importFromApp(specifier) {
-  const requireFromApp = createRequire(join28(process.cwd(), "noop.js"));
-  return await import(pathToFileURL3(requireFromApp.resolve(specifier)).href);
+  const requireFromApp = createRequire3(join33(process.cwd(), "noop.js"));
+  return await import(pathToFileURL5(requireFromApp.resolve(specifier)).href);
 }
 async function loadAuthCrypto() {
   try {
@@ -6795,23 +7304,15 @@ import chalk37 from "chalk";
 
 // src/commands/secret/options.ts
 init_logger();
-function resolveEnv(env9) {
-  const value = env9 ?? "local";
-  if (!VALID_ENVS.includes(value)) {
-    logger.error(`Invalid environment: "${value}". Valid values: ${VALID_ENVS.join(", ")}`);
-    process.exit(1);
-  }
-  return value;
-}
 
 // src/commands/secret/store-value.ts
 init_logger();
-import { join as join30 } from "path";
+import { join as join35 } from "path";
 init_env_file();
 
 // src/utils/sops.ts
 import { execa as execa11 } from "execa";
-import { existsSync as existsSync29, mkdirSync as mkdirSync5, writeFileSync as writeFileSync19 } from "fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync5, readFileSync as readFileSync17, writeFileSync as writeFileSync19 } from "fs";
 import { dirname as dirname5 } from "path";
 async function ensureSopsInstalled() {
   try {
@@ -6821,53 +7322,89 @@ async function ensureSopsInstalled() {
   }
 }
 async function sopsDecrypt(absFile) {
-  if (!existsSync29(absFile)) {
+  if (!existsSync32(absFile)) {
     return {};
   }
-  const { stdout } = await execa11("sops", ["--decrypt", "--output-type", "json", absFile]);
-  return JSON.parse(stdout);
+  const { stdout } = await execa11("sops", ["--decrypt", "--output-type", "json", absFile]).catch((error) => {
+    const exitCode = error.exitCode ?? "unknown";
+    return Promise.reject(new Error(
+      `sops could not decrypt ${absFile} (exit code ${exitCode}). Check that this machine has key access for the backend .sops.yaml selects; \`sops --decrypt ${absFile} > /dev/null\` shows sops' reason.`
+    ));
+  });
+  return toStringRecord(absFile, parseJsonObject(absFile, stdout));
+}
+function sopsKeyNames(absFile) {
+  if (!existsSync32(absFile)) {
+    return [];
+  }
+  return Object.keys(parseJsonObject(absFile, readFileSync17(absFile, "utf-8"))).filter((key) => key !== "sops");
+}
+function parseJsonObject(absFile, text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    parsed = void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${absFile} is not a flat JSON object of secrets.`);
+  }
+  return parsed;
+}
+function toStringRecord(absFile, parsed) {
+  const record = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (typeof value === "object" && value !== null) {
+      throw new Error(`${absFile}: ${key} holds a nested value; secret files are flat KEY \u2192 string maps.`);
+    }
+    record[key] = String(value);
+  }
+  return record;
 }
 async function sopsSetValue(absFile, relFile, key, value) {
-  if (existsSync29(absFile)) {
-    await execa11("sops", ["set", absFile, `["${key}"]`, JSON.stringify(value)]);
+  if (existsSync32(absFile)) {
+    await execa11("sops", ["set", "--value-stdin", absFile, `["${key}"]`], { input: JSON.stringify(value) }).catch((error) => Promise.reject(sopsWriteError(relFile, key, error)));
     return;
   }
   mkdirSync5(dirname5(absFile), { recursive: true });
   const { stdout } = await execa11(
     "sops",
     [
-      "--encrypt",
+      "encrypt",
       "--input-type",
       "json",
       "--output-type",
       "json",
       "--filename-override",
-      relFile,
-      "/dev/stdin"
+      relFile
     ],
     { input: JSON.stringify({ [key]: value }) }
-  );
+  ).catch((error) => Promise.reject(sopsWriteError(relFile, key, error)));
   writeFileSync19(absFile, stdout);
 }
+function sopsWriteError(relFile, key, error) {
+  const exitCode = error.exitCode ?? "unknown";
+  return new Error(`sops could not write ${key} to ${relFile} (exit code ${exitCode}). Check .sops.yaml has a creation rule for the file and this machine has key access.`);
+}
 async function sopsUpdateKeys(absFile) {
   await execa11("sops", ["updatekeys", "-y", absFile]);
 }
 
 // src/utils/secret-config.ts
-import { existsSync as existsSync30, readdirSync as readdirSync2 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync33, readdirSync as readdirSync3 } from "fs";
+import { join as join34 } from "path";
 var SECRETS_DIR = "secrets";
-function getSopsFile(cwd, env9) {
-  const relFile = `${SECRETS_DIR}/${env9}.enc.json`;
-  return { absFile: join29(cwd, relFile), relFile };
+function getSopsFile(cwd, env9, instance) {
+  const relFile = `${SECRETS_DIR}/${instance ? `${env9}.${instance}` : env9}.enc.json`;
+  return { absFile: join34(cwd, relFile), relFile };
 }
 function findUp(cwd, filename, maxDepth = 6) {
   let dir = cwd;
   for (let depth = 0; depth < maxDepth; depth++) {
-    if (existsSync30(join29(dir, filename))) {
+    if (existsSync33(join34(dir, filename))) {
       return dir;
     }
-    const parent = join29(dir, "..");
+    const parent = join34(dir, "..");
     if (parent === dir) {
       break;
     }
@@ -6877,17 +7414,17 @@ function findUp(cwd, filename, maxDepth = 6) {
 }
 function findSopsConfig(cwd) {
   const dir = findUp(cwd, ".sops.yaml");
-  return dir ? join29(dir, ".sops.yaml") : null;
+  return dir ? join34(dir, ".sops.yaml") : null;
 }
 function hasSopsConfig(cwd) {
   return findSopsConfig(cwd) !== null;
 }
 function listSopsFiles(cwd) {
-  const dir = join29(cwd, SECRETS_DIR);
-  if (!existsSync30(dir)) {
+  const dir = join34(cwd, SECRETS_DIR);
+  if (!existsSync33(dir)) {
     return [];
   }
-  return readdirSync2(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join29(dir, name));
+  return readdirSync3(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join34(dir, name));
 }
 
 // src/commands/secret/store-value.ts
@@ -6900,15 +7437,15 @@ function assertValidKey(key) {
     throw new Error(`Invalid secret key "${key}". Use an env-var name: letters, digits, and underscores, not starting with a digit.`);
   }
 }
-async function describeTarget(env9) {
-  if (isLocalEnv(env9)) {
+async function describeTarget(target) {
+  if (isLocalEnv(target.env)) {
     return detectStore().label;
   }
-  return `SOPS (${getSopsFile(process.cwd(), env9).relFile})`;
+  return `SOPS (${getSopsFile(process.cwd(), target.env, target.instance).relFile})`;
 }
-async function storeSecret(cwd, env9, key, value) {
+async function storeSecret(cwd, target, key, value) {
   assertValidKey(key);
-  if (isLocalEnv(env9)) {
+  if (isLocalEnv(target.env)) {
     const store = detectStore();
     if (!await store.isAvailable()) {
       throw new Error(
@@ -6916,7 +7453,7 @@ async function storeSecret(cwd, env9, key, value) {
       );
     }
     await store.set(keychainName(key), value);
-    const serverEnvPath = join30(cwd, ".env.server");
+    const serverEnvPath = join35(cwd, ".env.server");
     const result = upsertEnvVar(serverEnvPath, key, keychainRef(key));
     restrictEnvFilePerms(serverEnvPath);
     ensureGitignored(cwd, [{ pattern: ".env.server", comment: "spfn server env (secrets)" }]);
@@ -6929,45 +7466,124 @@ async function storeSecret(cwd, env9, key, value) {
       ".sops.yaml not found \u2014 add a backend (run `spfn secret keygen` for age, or a KMS rule) so the file can be decrypted on deploy."
     );
   }
-  const { absFile, relFile } = getSopsFile(cwd, env9);
+  const { absFile, relFile } = getSopsFile(cwd, target.env, target.instance);
   await sopsSetValue(absFile, relFile, key, value);
   logger.success(`Set ${key} in ${relFile} (encrypted). Commit and deploy to apply.`);
 }
 
+// src/commands/secret/options.ts
+var INSTANCE_PATTERN = /^[a-z0-9-]+$/;
+async function loadSecretList(options) {
+  return await loadEnvList(options).catch((error) => {
+    logger.error(error instanceof Error ? error.message : String(error));
+    return process.exit(1);
+  });
+}
+function resolveEnv(env9) {
+  const value = env9 ?? "local";
+  if (!VALID_ENVS.includes(value)) {
+    logger.error(`Invalid environment: "${value}". Valid values: ${VALID_ENVS.join(", ")}`);
+    process.exit(1);
+  }
+  return value;
+}
+function isValidInstance(instance) {
+  return INSTANCE_PATTERN.test(instance);
+}
+function resolveTarget(options) {
+  const env9 = resolveEnv(options.env);
+  const instance = options.instance;
+  if (instance === void 0) {
+    return { env: env9 };
+  }
+  if (!isValidInstance(instance)) {
+    logger.error(`Invalid instance: "${instance}". Use lowercase letters, digits and dashes.`);
+    process.exit(1);
+  }
+  if (isLocalEnv(env9)) {
+    logger.error("--instance applies to a deployed environment; pass --env too.");
+    process.exit(1);
+  }
+  return { env: env9, instance };
+}
+function targetLayer(target) {
+  if (isLocalEnv(target.env)) {
+    return void 0;
+  }
+  return target.instance ? "instance" : "environment";
+}
+function entriesForTarget(entries, target) {
+  const layer = targetLayer(target);
+  return layer ? entries.filter((entry) => layerOf(entry) === layer) : entries;
+}
+function assertTargetLayer(entry, target) {
+  const layer = targetLayer(target);
+  if (!entry || !layer || layerOf(entry) === layer) {
+    return;
+  }
+  const hint = layer === "environment" ? "pass --instance <name>" : "drop --instance";
+  logger.error(`${entry.key} is declared with layer "${layerOf(entry)}" \u2014 ${hint}.`);
+  process.exit(1);
+}
+
 // src/commands/secret/set.ts
 async function secretSet(key, options) {
-  const env9 = resolveEnv(options.env);
-  const pkg = options.package ?? "@spfn/core";
-  const resolvedKey = key ?? await pickSecretKey(pkg);
+  const target = resolveTarget(options);
+  if (options.stdin && !key) {
+    logger.error("--stdin needs the KEY argument.");
+    process.exit(1);
+  }
+  const resolvedKey = key ?? await pickSecretKey(options);
   if (!resolvedKey) {
     logger.error("No secret key provided.");
     process.exit(1);
   }
-  await warnIfNotSecret(pkg, resolvedKey);
+  const entry = await findEntry(options, resolvedKey);
+  warnIfNotSecret(options, resolvedKey, entry);
+  assertTargetLayer(entry, target);
+  const value = options.stdin ? await readValueFromStdin(process.stdin) : await promptValue(resolvedKey, target);
+  logger.step(`Storing ${resolvedKey} \u2192 ${await describeTarget(target)}`);
+  try {
+    await storeSecret(process.cwd(), target, resolvedKey, value);
+  } catch (error) {
+    logger.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+}
+async function promptValue(key, target) {
   const { value } = await prompts11({
     type: "password",
     name: "value",
-    message: `Value for ${chalk37.cyan(resolvedKey)} (${env9})`
+    message: `Value for ${chalk37.cyan(key)} (${target.instance ? `${target.env}.${target.instance}` : target.env})`
   });
   if (!value) {
     logger.warn("Cancelled \u2014 no value entered.");
     process.exit(0);
   }
-  logger.step(`Storing ${resolvedKey} \u2192 ${await describeTarget(env9)}`);
-  try {
-    await storeSecret(process.cwd(), env9, resolvedKey, value);
-  } catch (error) {
-    logger.error(error instanceof Error ? error.message : String(error));
+  return value;
+}
+async function readValueFromStdin(stdin) {
+  if ("isTTY" in stdin && stdin.isTTY) {
+    logger.error("--stdin reads a piped value; stdin is a terminal. Pipe the value in, or drop --stdin to be prompted.");
     process.exit(1);
   }
-}
-async function pickSecretKey(pkg) {
-  let entries;
-  try {
-    entries = secretEntries(await loadEnvSchema(pkg));
-  } catch {
-    return void 0;
+  const chunks = [];
+  for await (const chunk of stdin) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  const value = stripTrailingNewline(Buffer.concat(chunks).toString("utf-8"));
+  if (value.length === 0) {
+    logger.error("--stdin received an empty value.");
+    process.exit(1);
   }
+  return value;
+}
+function stripTrailingNewline(value) {
+  return value.replace(/\r?\n$/, "");
+}
+async function pickSecretKey(options) {
+  const list = await loadEnvList(options).catch(() => void 0);
+  const entries = list ? secretEntries(list.schema) : [];
   if (entries.length === 0) {
     return void 0;
   }
@@ -6983,14 +7599,13 @@ async function pickSecretKey(pkg) {
   });
   return key;
 }
-async function warnIfNotSecret(pkg, key) {
-  try {
-    const schema = await loadEnvSchema(pkg);
-    const entry = schema[key];
-    if (entry && !entry.sensitive) {
-      logger.warn(`${key} is not marked as a secret in ${pkg}. Consider declaring it with envSecret().`);
-    }
-  } catch {
+async function findEntry(options, key) {
+  const list = await loadEnvList(options).catch(() => void 0);
+  return list?.schema[key];
+}
+function warnIfNotSecret(options, key, entry) {
+  if (entry && !entry.sensitive) {
+    logger.warn(`${key} is not marked as a secret in ${describeEnvList(options)}. Consider declaring it with envSecret().`);
   }
 }
 
@@ -6998,31 +7613,43 @@ async function warnIfNotSecret(pkg, key) {
 init_logger();
 import chalk38 from "chalk";
 async function secretList(options) {
-  const env9 = resolveEnv(options.env);
-  const pkg = options.package ?? "@spfn/core";
-  let entries;
-  try {
-    entries = secretEntries(await loadEnvSchema(pkg));
-  } catch (error) {
-    logger.error(error instanceof Error ? error.message : String(error));
-    process.exit(1);
-  }
-  if (entries.length === 0) {
-    logger.info(`No secrets declared in ${pkg}.`);
+  const target = resolveTarget(options);
+  const label = describeEnvList(options);
+  const list = await loadSecretList(options);
+  const entries = entriesForTarget(secretEntries(list.schema), target);
+  const present = await loadPresence(target, entries);
+  const unlisted = options.package ? [] : unlistedNames(list, present);
+  if (entries.length === 0 && unlisted.length === 0) {
+    logger.info(`No secrets declared in ${label}.`);
     return;
   }
-  const present = await loadPresence(env9, entries);
   console.log(chalk38.blue.bold(`
-\u{1F511} Secrets (${pkg}) \u2014 ${env9}
+\u{1F511} Secrets (${label}) \u2014 ${target.instance ? `${target.env}.${target.instance}` : target.env}
 `));
-  for (const entry of entries) {
-    const status = statusOf(entry, present.has(entry.key));
-    console.log(`  ${badge(status)} ${chalk38.cyan(entry.key)}${entry.generate ? chalk38.dim(" (generatable)") : ""}`);
+  for (const group of groupBySource(list, entries)) {
+    console.log(`  ${chalk38.bold.magenta(group.source)}`);
+    for (const entry of group.entries) {
+      const status = statusOf(entry, present.has(entry.key));
+      console.log(`    ${badge(status)} ${chalk38.cyan(entry.key)}${entry.generate ? chalk38.dim(" (generatable)") : ""}`);
+    }
   }
+  printUnlisted(unlisted);
   console.log();
 }
-async function loadPresence(env9, entries) {
-  if (isLocalEnv(env9)) {
+function unlistedNames(list, present) {
+  return [...present].filter((name) => !Object.hasOwn(list.schema, name)).sort();
+}
+function printUnlisted(names) {
+  if (names.length === 0) {
+    return;
+  }
+  console.log(`  ${chalk38.bold.magenta("(not in list)")}`);
+  for (const name of names) {
+    console.log(`    ${chalk38.yellow("?")} ${chalk38.cyan(name)} ${chalk38.dim("not in list")}`);
+  }
+}
+async function loadPresence(target, entries) {
+  if (isLocalEnv(target.env)) {
     const store = detectStore();
     if (!await store.isAvailable()) {
       logger.warn(`${store.label} unavailable \u2014 status shown as missing.`);
@@ -7036,10 +7663,7 @@ async function loadPresence(env9, entries) {
     }
     return present;
   }
-  await ensureSopsInstalled();
-  const { absFile } = getSopsFile(process.cwd(), env9);
-  const decrypted = await sopsDecrypt(absFile);
-  return new Set(Object.keys(decrypted));
+  return new Set(sopsKeyNames(getSopsFile(process.cwd(), target.env, target.instance).absFile));
 }
 function statusOf(entry, present) {
   if (present) {
@@ -7062,25 +7686,19 @@ function badge(status) {
 init_logger();
 import chalk39 from "chalk";
 async function secretGenerate(key, options) {
-  const env9 = resolveEnv(options.env);
-  const pkg = options.package ?? "@spfn/core";
-  let schema;
-  try {
-    schema = await loadEnvSchema(pkg);
-  } catch (error) {
-    logger.error(error instanceof Error ? error.message : String(error));
-    process.exit(1);
-  }
-  const targets = options.all ? generatableSecrets(schema) : [requireGeneratable(schema, key)];
+  const target = resolveTarget(options);
+  const schema = (await loadSecretList(options)).schema;
+  const targets = options.all ? entriesForTarget(generatableSecrets(schema), target) : [requireGeneratable(schema, key)];
+  targets.forEach((entry) => assertTargetLayer(entry, target));
   if (targets.length === 0) {
     logger.warn("No generatable secrets found (none declare a `generate` strategy).");
     return;
   }
-  logger.step(`Generating ${targets.length} secret(s) \u2192 ${await describeTarget(env9)}`);
+  logger.step(`Generating ${targets.length} secret(s) \u2192 ${await describeTarget(target)}`);
   for (const entry of targets) {
     const value = generateSecretValue(entry.generate);
     try {
-      await storeSecret(process.cwd(), env9, entry.key, value);
+      await storeSecret(process.cwd(), target, entry.key, value);
     } catch (error) {
       logger.error(`${entry.key}: ${error instanceof Error ? error.message : String(error)}`);
       process.exit(1);
@@ -7108,23 +7726,17 @@ function requireGeneratable(schema, key) {
 init_logger();
 import chalk40 from "chalk";
 async function secretRotate(key, options) {
-  const env9 = resolveEnv(options.env);
-  const pkg = options.package ?? "@spfn/core";
-  let schema;
-  try {
-    schema = await loadEnvSchema(pkg);
-  } catch (error) {
-    logger.error(error instanceof Error ? error.message : String(error));
-    process.exit(1);
-  }
-  const targets = options.all ? secretEntries(schema) : [requireEntry(schema, key)];
+  const target = resolveTarget(options);
+  const schema = (await loadSecretList(options)).schema;
+  const targets = options.all ? entriesForTarget(secretEntries(schema), target) : [requireEntry(schema, key)];
+  targets.forEach((entry) => assertTargetLayer(entry, target));
   const generatable = targets.filter((entry) => entry.generate);
   const external = targets.filter((entry) => !entry.generate);
   if (generatable.length > 0) {
-    logger.step(`Rotating ${generatable.length} secret(s) \u2192 ${await describeTarget(env9)}`);
+    logger.step(`Rotating ${generatable.length} secret(s) \u2192 ${await describeTarget(target)}`);
     for (const entry of generatable) {
       try {
-        await storeSecret(process.cwd(), env9, entry.key, generateSecretValue(entry.generate));
+        await storeSecret(process.cwd(), target, entry.key, generateSecretValue(entry.generate));
       } catch (error) {
         logger.error(`${entry.key}: ${error instanceof Error ? error.message : String(error)}`);
         process.exit(1);
@@ -7132,7 +7744,7 @@ async function secretRotate(key, options) {
     }
   }
   for (const entry of external) {
-    logger.warn(`${chalk40.cyan(entry.key)} is external \u2014 reissue it at the provider, then \`spfn secret set ${entry.key} --env ${env9}\`.`);
+    logger.warn(`${chalk40.cyan(entry.key)} is external \u2014 reissue it at the provider, then \`spfn secret set ${entry.key} --env ${target.env}${target.instance ? ` --instance ${target.instance}` : ""}\`.`);
   }
   if (generatable.length > 0) {
     logger.info("Rotation updates the source only \u2014 commit and deploy to apply.");
@@ -7154,12 +7766,12 @@ function requireEntry(schema, key) {
 // src/commands/secret/keygen.ts
 init_logger();
 import { execa as execa12 } from "execa";
-import { existsSync as existsSync31, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync34, mkdirSync as mkdirSync6 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname6, join as join31 } from "path";
+import { dirname as dirname6, join as join36 } from "path";
 import chalk41 from "chalk";
 function ageKeyFile() {
-  return process.env.SOPS_AGE_KEY_FILE ?? join31(homedir(), ".config", "sops", "age", "keys.txt");
+  return process.env.SOPS_AGE_KEY_FILE ?? join36(homedir(), ".config", "sops", "age", "keys.txt");
 }
 async function ensureAgeInstalled() {
   try {
@@ -7179,7 +7791,7 @@ async function secretKeygen() {
     process.exit(1);
   }
   const keyFile = ageKeyFile();
-  if (existsSync31(keyFile)) {
+  if (existsSync34(keyFile)) {
     const { stdout } = await execa12("age-keygen", ["-y", keyFile]);
     logger.warn(`age key file already exists: ${keyFile}`);
     printPublicKeys(publicKeys(stdout));
@@ -7206,8 +7818,8 @@ function printPublicKeys(keys) {
 
 // src/commands/secret/recipients.ts
 init_logger();
-import { existsSync as existsSync32, readFileSync as readFileSync15, writeFileSync as writeFileSync20 } from "fs";
-import { join as join32 } from "path";
+import { existsSync as existsSync35, readFileSync as readFileSync18, writeFileSync as writeFileSync20 } from "fs";
+import { join as join37 } from "path";
 import { parse as parse3, stringify } from "yaml";
 import chalk42 from "chalk";
 var SOPS_CONFIG = ".sops.yaml";
@@ -7215,7 +7827,7 @@ var DEFAULT_PATH_REGEX = "secrets/.*\\.enc\\.json$";
 var AGE_RECIPIENT = /^age1[0-9a-z]+$/;
 async function secretRecipients(action, key, _options) {
   const cwd = process.cwd();
-  const configPath = join32(cwd, SOPS_CONFIG);
+  const configPath = join37(cwd, SOPS_CONFIG);
   if (action === "list") {
     listRecipients(configPath);
     return;
@@ -7247,7 +7859,7 @@ async function secretRecipients(action, key, _options) {
   await reencrypt(cwd);
 }
 function listRecipients(configPath) {
-  if (!existsSync32(configPath)) {
+  if (!existsSync35(configPath)) {
     logger.info(`No ${SOPS_CONFIG} found.`);
     return;
   }
@@ -7265,10 +7877,10 @@ function listRecipients(configPath) {
   console.log();
 }
 function loadConfig(configPath) {
-  if (!existsSync32(configPath)) {
+  if (!existsSync35(configPath)) {
     return { creation_rules: [] };
   }
-  return parse3(readFileSync15(configPath, "utf-8")) ?? { creation_rules: [] };
+  return parse3(readFileSync18(configPath, "utf-8")) ?? { creation_rules: [] };
 }
 function ensureRule(config) {
   if (!config.creation_rules) {
@@ -7299,42 +7911,55 @@ async function reencrypt(cwd) {
 }
 
 // src/commands/secret/check.ts
-init_logger();
-import { join as join33 } from "path";
+import { join as join38 } from "path";
 import chalk43 from "chalk";
 init_env_file();
 var COMMITTED_FILES = [".env", ".env.example", ".env.local.example", ".env.server.example"];
 var PLACEHOLDER = /(your-|changeme|placeholder|example|<.*>)/i;
 async function secretCheck(options) {
   const cwd = process.cwd();
-  const pkg = options.package ?? "@spfn/core";
-  let entries;
-  try {
-    entries = secretEntries(await loadEnvSchema(pkg));
-  } catch (error) {
-    logger.error(error instanceof Error ? error.message : String(error));
-    process.exit(1);
-  }
+  const target = resolveTarget(options);
+  const schema = (await loadSecretList(options)).schema;
+  const entries = secretEntries(schema);
   const secretKeys = new Set(entries.map((entry) => entry.key));
   const issues = [];
   const warnings = [];
   for (const file of COMMITTED_FILES) {
-    const parsed = parseEnvFile(join33(cwd, file));
+    const parsed = parseEnvFile(join38(cwd, file));
     for (const [key, value] of Object.entries(parsed)) {
       if (secretKeys.has(key) && value.length > 0 && !PLACEHOLDER.test(value)) {
         issues.push(`${chalk43.cyan(key)} has a real value in committed ${chalk43.yellow(file)} \u2014 move it to the keychain/SOPS.`);
       }
     }
   }
-  const serverEnv = parseEnvFile(join33(cwd, ".env.server"));
+  const serverEnv = parseEnvFile(join38(cwd, ".env.server"));
   for (const key of secretKeys) {
     const value = serverEnv[key];
     if (value && !value.startsWith(KEYCHAIN_REF_PREFIX)) {
       warnings.push(`${chalk43.cyan(key)} is plaintext in .env.server \u2014 run \`spfn secret set ${key}\` to move it to the keychain.`);
     }
   }
+  if (!isLocalEnv(target.env)) {
+    checkPlacement(cwd, schema, target, issues, warnings);
+  }
   report(issues, warnings, cwd);
 }
+function checkPlacement(cwd, schema, target, issues, warnings) {
+  const files = [{ file: getSopsFile(cwd, target.env), layer: "environment" }];
+  if (target.instance) {
+    files.push({ file: getSopsFile(cwd, target.env, target.instance), layer: "instance" });
+  }
+  for (const { file, layer } of files) {
+    for (const name of sopsKeyNames(file.absFile)) {
+      const entry = Object.hasOwn(schema, name) ? schema[name] : void 0;
+      if (!entry) {
+        warnings.push(`${chalk43.cyan(name)} in ${chalk43.yellow(file.relFile)} is not in the env list \u2014 export skips it.`);
+      } else if (layerOf(entry) !== layer) {
+        issues.push(`${chalk43.cyan(name)} is declared with layer "${layerOf(entry)}" but is in ${chalk43.yellow(file.relFile)}.`);
+      }
+    }
+  }
+}
 function report(issues, warnings, cwd) {
   console.log(chalk43.blue.bold("\n\u{1F50D} Secret hygiene check\n"));
   for (const issue of issues) {
@@ -7355,26 +7980,229 @@ function report(issues, warnings, cwd) {
   }
 }
 
+// src/commands/secret/export.ts
+init_logger();
+init_env_file();
+import { existsSync as existsSync36, statSync } from "fs";
+import { dirname as dirname8, resolve as resolve5 } from "path";
+import chalk44 from "chalk";
+
+// src/utils/secret-layers.ts
+function mergeLayers(schema, sources) {
+  const merge = { values: {}, origins: {}, errors: [], warnings: [] };
+  for (const [name, found] of collectListed(schema, sources, merge.warnings)) {
+    const reason = placementError(schema[name], found) ?? valueError(schema[name], found[0].values[name]);
+    if (reason) {
+      merge.errors.push(`${name}: ${reason}`);
+      continue;
+    }
+    merge.values[name] = found[0].values[name];
+    merge.origins[name] = found[0].label;
+  }
+  for (const entry of Object.values(schema)) {
+    if (isRequired(entry) && !sources.some((source) => Object.hasOwn(source.values, entry.key))) {
+      merge.errors.push(`${entry.key}: required, and in none of the layers`);
+    }
+  }
+  return merge;
+}
+function collectListed(schema, sources, warnings) {
+  const found = /* @__PURE__ */ new Map();
+  for (const source of sources) {
+    for (const name of Object.keys(source.values)) {
+      if (!Object.hasOwn(schema, name)) {
+        warnings.push(`${name} (in ${source.label}) is not in the env list \u2014 not written`);
+        continue;
+      }
+      found.set(name, [...found.get(name) ?? [], source]);
+    }
+  }
+  return found;
+}
+function placementError(entry, found) {
+  if (found.length > 1) {
+    return `in more than one layer: ${found.map((source) => source.label).join(" and ")}`;
+  }
+  if (found[0].kind !== layerOf(entry)) {
+    return `declared with layer "${layerOf(entry)}", but found in ${found[0].label}`;
+  }
+  return void 0;
+}
+function valueError(entry, value) {
+  if (entry.minLength !== void 0 && value.length < entry.minLength) {
+    return `must be at least ${entry.minLength} characters long`;
+  }
+  if (!entry.validator) {
+    return void 0;
+  }
+  try {
+    entry.validator(value);
+    return void 0;
+  } catch (error) {
+    return withoutValue(error instanceof Error ? error.message : String(error), value);
+  }
+}
+function withoutValue(reason, value) {
+  if (value.length > 0 && reason.includes(value)) {
+    return "rejected by its validator (the message is withheld because it contains the value)";
+  }
+  return reason;
+}
+function isRequired(entry) {
+  return entry.required === true && entry.default === void 0;
+}
+
+// src/utils/dotenv-out.ts
+import { closeSync, fsyncSync, openSync, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync21 } from "fs";
+import { randomBytes as randomBytes3 } from "crypto";
+import { basename as basename2, dirname as dirname7, join as join39 } from "path";
+import { parse as parse4 } from "dotenv";
+var QUOTES = ["'", "`", '"'];
+function formatDotenv(values) {
+  const unrepresentable = [];
+  const lines = Object.entries(values).map(([name, value]) => {
+    const line = dotenvLine(name, value);
+    if (!line) {
+      unrepresentable.push(name);
+    }
+    return line;
+  });
+  const content = lines.join("\n") + "\n";
+  const mismatched = Object.keys(values).filter((name) => parse4(content)[name] !== values[name]);
+  const failed2 = [.../* @__PURE__ */ new Set([...unrepresentable, ...mismatched])];
+  if (failed2.length > 0) {
+    throw new Error(`Cannot write as dotenv without changing the value: ${failed2.join(", ")}`);
+  }
+  return content;
+}
+function dotenvLine(name, value) {
+  const quoted = value.endsWith("\\") ? [] : QUOTES.map((quote) => `${quote}${value}${quote}`);
+  return [...quoted, value].map((form) => `${name}=${form}`).find((line) => parse4(line)[name] === value);
+}
+function writePrivateFileAtomic(path5, content) {
+  const temp = join39(dirname7(path5), `.${basename2(path5)}.${randomBytes3(6).toString("hex")}.tmp`);
+  const fd = openSync(temp, "wx", 384);
+  try {
+    writeAndClose(fd, content);
+    renameSync2(temp, path5);
+  } finally {
+    rmSync2(temp, { force: true });
+  }
+}
+function writeAndClose(fd, content) {
+  try {
+    writeFileSync21(fd, content);
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+
+// src/commands/secret/export.ts
+async function secretExport(options) {
+  const target = resolveTarget(options);
+  if (!options.out) {
+    logger.error("--out <file> is required: export writes values to a file, never to the terminal.");
+    process.exit(1);
+  }
+  if (isLocalEnv(target.env)) {
+    logger.error("export reads the encrypted files of a deployed environment; pass --env <env>.");
+    process.exit(1);
+  }
+  await ensureSopsInstalled();
+  const request2 = {
+    cwd: process.cwd(),
+    target,
+    schema: (await loadSecretList({})).schema,
+    withFiles: options.with ?? [],
+    out: options.out
+  };
+  const report2 = await exportEnvFile(request2).catch((error) => {
+    logger.error(error instanceof Error ? error.message : String(error));
+    return process.exit(1);
+  });
+  printReport2(report2, request2.out);
+}
+async function exportEnvFile(request2) {
+  const out = resolve5(request2.cwd, request2.out);
+  assertDirectory(dirname8(out), "--out");
+  const merge = mergeLayers(request2.schema, await readLayers(request2));
+  const report2 = { written: false, origins: merge.origins, errors: merge.errors, warnings: merge.warnings };
+  if (merge.errors.length > 0) {
+    return report2;
+  }
+  writePrivateFileAtomic(out, formatDotenv(merge.values));
+  return { ...report2, written: true };
+}
+async function readLayers(request2) {
+  const { cwd, target } = request2;
+  const withFiles = request2.withFiles.map((file) => readWithFile(cwd, file));
+  const sources = [{
+    label: "environment",
+    kind: "environment",
+    values: await sopsDecrypt(getSopsFile(cwd, target.env).absFile)
+  }];
+  if (target.instance) {
+    sources.push({
+      label: "instance",
+      kind: "instance",
+      values: await sopsDecrypt(getSopsFile(cwd, target.env, target.instance).absFile)
+    });
+  }
+  return [...sources, ...withFiles];
+}
+function readWithFile(cwd, file) {
+  const path5 = resolve5(cwd, file);
+  if (!existsSync36(path5)) {
+    throw new Error(`--with file not found: ${path5}`);
+  }
+  return { label: `--with ${file}`, kind: "instance", values: parseEnvFile(path5) };
+}
+function assertDirectory(path5, option) {
+  if (!existsSync36(path5) || !statSync(path5).isDirectory()) {
+    throw new Error(`${option}: directory ${path5} does not exist. Create it first.`);
+  }
+}
+function printReport2(report2, out) {
+  for (const warning of report2.warnings) {
+    logger.warn(warning);
+  }
+  if (!report2.written) {
+    logger.error(`Nothing written \u2014 ${report2.errors.length} problem(s):`);
+    report2.errors.forEach((error) => console.log(`  ${chalk44.red("\u2717")} ${error}`));
+    process.exit(1);
+  }
+  for (const [name, layer] of Object.entries(report2.origins)) {
+    console.log(`  ${chalk44.cyan(name)} ${chalk44.dim(`\u2190 ${layer}`)}`);
+  }
+  logger.success(`Wrote ${Object.keys(report2.origins).length} name(s) to ${out} (mode 0600).`);
+}
+
 // src/commands/secret/index.ts
 var ENV_OPTION = ["-e, --env <env>", "Target environment (local | development | staging | production)", "local"];
-var PKG_OPTION = ["-p, --package <package>", "Package whose env schema to read", "@spfn/core"];
+var INSTANCE_OPTION = ["-i, --instance <name>", "Target one instance of the environment: secrets/<env>.<instance>.enc.json (lowercase letters, digits, dashes)"];
+var PKG_OPTION = ["-p, --package <package>", "Read only this package's env schema (default: the whole app \u2014 spfn.config.js env.schemas + installed @spfn/* packages)"];
 var secretCommand = new Command16("secret").description("Manage secrets: keychain locally, SOPS (age / GCP KMS / AWS KMS) for deployed environments");
-secretCommand.command("set [key]").description("Store a secret value (prompts for the value, masked)").option(...ENV_OPTION).option(...PKG_OPTION).action(secretSet);
-secretCommand.command("list").description("List declared secrets and their status (never prints values)").option(...ENV_OPTION).option(...PKG_OPTION).action(secretList);
-secretCommand.command("generate [key]").description("Generate value(s) for schema secrets that declare a generate strategy").option("-a, --all", "Generate every generatable secret").option(...ENV_OPTION).option(...PKG_OPTION).action(secretGenerate);
-secretCommand.command("rotate [key]").description("Rotate secret value(s); external secrets are flagged for manual reissue").option("-a, --all", "Rotate every secret").option(...ENV_OPTION).option(...PKG_OPTION).action(secretRotate);
+secretCommand.command("set [key]").description("Store a secret value (prompts for the value, masked; --stdin reads it from a pipe)").option(...ENV_OPTION).option(...INSTANCE_OPTION).option("--stdin", "Read the value from stdin (one trailing newline dropped); never prompts").option(...PKG_OPTION).action(secretSet);
+secretCommand.command("list").description("List declared secrets and their status (never prints values)").option(...ENV_OPTION).option(...INSTANCE_OPTION).option(...PKG_OPTION).action(secretList);
+secretCommand.command("generate [key]").description("Generate value(s) for schema secrets that declare a generate strategy").option("-a, --all", "Generate every generatable secret").option(...ENV_OPTION).option(...INSTANCE_OPTION).option(...PKG_OPTION).action(secretGenerate);
+secretCommand.command("rotate [key]").description("Rotate secret value(s); external secrets are flagged for manual reissue").option("-a, --all", "Rotate every secret").option(...ENV_OPTION).option(...INSTANCE_OPTION).option(...PKG_OPTION).action(secretRotate);
 secretCommand.command("keygen").description("Generate an age key pair for SOPS (no-cloud backend)").action(secretKeygen);
 secretCommand.command("recipients <action> [key]").description("Manage .sops.yaml age recipients: add | remove | list").action(secretRecipients);
-secretCommand.command("check").description("Static hygiene lint \u2014 flag plaintext secret leaks").option(...PKG_OPTION).action(secretCheck);
+secretCommand.command("check").description("Static hygiene lint \u2014 flag plaintext secret leaks; with a deployed --env, names in the wrong layer").option(...ENV_OPTION).option(...INSTANCE_OPTION).option(...PKG_OPTION).action(secretCheck);
+secretCommand.command("export").description("Decrypt and merge a deployment's layers into a 0600 dotenv file (prints names only)").requiredOption("-e, --env <env>", "Deployed environment (development | staging | production | test)").option(...INSTANCE_OPTION).option("-w, --with <file>", "Plaintext dotenv file of computed instance values (repeatable)", collect, []).option("-o, --out <file>", "Dotenv file to write (required; its directory must exist)").action(secretExport);
+function collect(value, previous) {
+  return [...previous, value];
+}
 
 // src/commands/cloud/index.ts
 import { Command as Command17 } from "commander";
 
 // src/commands/cloud/link.ts
 init_logger();
-import { basename as basename2 } from "path";
+import { basename as basename3 } from "path";
 import prompts12 from "prompts";
-import chalk44 from "chalk";
+import chalk45 from "chalk";
 
 // src/utils/cloud/tokens.ts
 var TOKEN_KEYS = {
@@ -7412,20 +8240,20 @@ async function deleteCloudToken(provider) {
 
 // src/utils/cloud/config.ts
 init_env_file();
-import { existsSync as existsSync33, mkdirSync as mkdirSync7, readFileSync as readFileSync16, writeFileSync as writeFileSync21 } from "fs";
-import { dirname as dirname7, join as join34 } from "path";
-var CONFIG_REL_PATH = join34(".spfn", "cloud.json");
+import { existsSync as existsSync37, mkdirSync as mkdirSync7, readFileSync as readFileSync19, writeFileSync as writeFileSync22 } from "fs";
+import { dirname as dirname9, join as join40 } from "path";
+var CONFIG_REL_PATH = join40(".spfn", "cloud.json");
 function cloudConfigPath(cwd) {
-  return join34(cwd, CONFIG_REL_PATH);
+  return join40(cwd, CONFIG_REL_PATH);
 }
 function readCloudConfig(cwd) {
   const path5 = cloudConfigPath(cwd);
-  if (!existsSync33(path5)) {
+  if (!existsSync37(path5)) {
     return {};
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync16(path5, "utf-8"));
+    parsed = JSON.parse(readFileSync19(path5, "utf-8"));
   } catch {
     throw new Error(`${path5} is not valid JSON \u2014 delete it and run \`spfn cloud link\` again.`);
   }
@@ -7436,8 +8264,8 @@ function readCloudConfig(cwd) {
 }
 function writeCloudConfig(cwd, config) {
   const path5 = cloudConfigPath(cwd);
-  mkdirSync7(dirname7(path5), { recursive: true });
-  writeFileSync21(path5, JSON.stringify(config, null, 4) + "\n", "utf-8");
+  mkdirSync7(dirname9(path5), { recursive: true });
+  writeFileSync22(path5, JSON.stringify(config, null, 4) + "\n", "utf-8");
   ensureGitignored(cwd, [{ pattern: ".spfn/cloud.json", comment: "spfn cloud link state (per-user accounts)" }]);
 }
 function requireLinked(config, provider) {
@@ -7666,7 +8494,7 @@ async function cloudLink(options) {
     logger.error(error instanceof Error ? error.message : String(error));
     process.exit(1);
   }
-  logger.success(`Link state saved to ${chalk44.cyan(cloudConfigPath(cwd))} (identifiers only \u2014 tokens stay in the keychain).`);
+  logger.success(`Link state saved to ${chalk45.cyan(cloudConfigPath(cwd))} (identifiers only \u2014 tokens stay in the keychain).`);
   logger.info("Next: `spfn cloud status` for limits vs usage, `spfn cloud env pull` for project keys.");
 }
 async function linkVercel(config, cwd, options) {
@@ -7686,7 +8514,7 @@ async function linkVercel(config, cwd, options) {
       throw new Error(`No Vercel project named "${options.vercelProject}" \u2014 available: ${projects.map((p) => p.name).join(", ")}.`);
     }
   } else {
-    const defaultIndex = Math.max(0, projects.findIndex((p) => p.name === basename2(cwd)));
+    const defaultIndex = Math.max(0, projects.findIndex((p) => p.name === basename3(cwd)));
     ({ projectId } = await prompts12({
       type: "select",
       name: "projectId",
@@ -7758,7 +8586,7 @@ async function obtainToken(provider, label, envVar, createUrl, replace) {
       return fromKeychain;
     }
   }
-  logger.info(`Create one at ${chalk44.cyan(createUrl)} if you don't have it yet.`);
+  logger.info(`Create one at ${chalk45.cyan(createUrl)} if you don't have it yet.`);
   const { token } = await prompts12({
     type: "password",
     name: "token",
@@ -7771,7 +8599,7 @@ async function obtainToken(provider, label, envVar, createUrl, replace) {
 }
 
 // src/commands/cloud/limits.ts
-import chalk46 from "chalk";
+import chalk47 from "chalk";
 
 // src/utils/cloud/limits-data.ts
 var VERCEL_HOBBY_LIMITS = [
@@ -7810,21 +8638,21 @@ var SUPABASE_FREE_NOTES = [
 var LIMITS_VERIFIED_ON = "2026-08-13";
 
 // src/utils/cloud/format.ts
-import chalk45 from "chalk";
+import chalk46 from "chalk";
 var MIGRATION_PROMPT_THRESHOLD = 0.8;
 function formatPercent(used, limit) {
   if (limit <= 0) {
-    return chalk45.dim("n/a");
+    return chalk46.dim("n/a");
   }
   const ratio = used / limit;
   const text = `${(ratio * 100).toFixed(1)}%`;
   if (ratio >= 1) {
-    return chalk45.red.bold(text);
+    return chalk46.red.bold(text);
   }
   if (ratio >= MIGRATION_PROMPT_THRESHOLD) {
-    return chalk45.yellow.bold(text);
+    return chalk46.yellow.bold(text);
   }
-  return chalk45.green(text);
+  return chalk46.green(text);
 }
 function isNearLimit(used, limit) {
   return limit > 0 && used / limit >= MIGRATION_PROMPT_THRESHOLD;
@@ -7861,25 +8689,25 @@ var PER_LABEL = {
 async function cloudLimits() {
   printPlan("Vercel Hobby", VERCEL_HOBBY_LIMITS, VERCEL_HOBBY_NOTES);
   printPlan("Supabase Free", SUPABASE_FREE_LIMITS, SUPABASE_FREE_NOTES);
-  console.log(chalk46.dim(`Numbers verified against the official docs on ${LIMITS_VERIFIED_ON}.`));
-  console.log(chalk46.dim("Live usage against these limits: `spfn cloud status`.\n"));
+  console.log(chalk47.dim(`Numbers verified against the official docs on ${LIMITS_VERIFIED_ON}.`));
+  console.log(chalk47.dim("Live usage against these limits: `spfn cloud status`.\n"));
 }
 function printPlan(title, limits, notes) {
-  console.log(chalk46.bold(`
+  console.log(chalk47.bold(`
 ${title}`));
   for (const limit of limits) {
     const amount = `${formatCount(limit.limit)} ${limit.unit}`;
-    console.log(`  ${limit.label.padEnd(34)} ${amount.padEnd(26)} ${chalk46.dim(PER_LABEL[limit.per])}`);
+    console.log(`  ${limit.label.padEnd(34)} ${amount.padEnd(26)} ${chalk47.dim(PER_LABEL[limit.per])}`);
   }
   for (const note of notes) {
-    console.log(chalk46.dim(`  \u2022 ${note}`));
+    console.log(chalk47.dim(`  \u2022 ${note}`));
   }
   console.log("");
 }
 
 // src/commands/cloud/usage.ts
 init_logger();
-import chalk47 from "chalk";
+import chalk48 from "chalk";
 
 // src/commands/cloud/collect.ts
 async function collectSnapshot(cwd) {
@@ -7972,10 +8800,10 @@ function printVercel(snapshot) {
   if (!snapshot.vercel) {
     return;
   }
-  console.log(chalk47.bold(`
+  console.log(chalk48.bold(`
 Vercel \u2014 account-wide usage, rolling 30 days (linked project: ${snapshot.vercel.projectName})`));
   if (snapshot.vercel.services.length === 0) {
-    console.log(chalk47.dim("  No usage recorded in the billing feed yet."));
+    console.log(chalk48.dim("  No usage recorded in the billing feed yet."));
   }
   for (const service of snapshot.vercel.services) {
     const amount = `${formatCount(service.consumed)} ${service.unit}`.trim();
@@ -7987,12 +8815,12 @@ function printSupabase(snapshot) {
     return;
   }
   const { projectName, status, dbSizeBytes, dailyApiCount } = snapshot.supabase;
-  console.log(chalk47.bold(`
+  console.log(chalk48.bold(`
 Supabase \u2014 ${projectName}`));
   console.log(`  ${"Project status".padEnd(34)} ${status}`);
-  console.log(`  ${"Database size".padEnd(34)} ${dbSizeBytes === null ? chalk47.dim("unavailable") : formatBytes2(dbSizeBytes)}`);
-  console.log(`  ${"API requests (last 24h)".padEnd(34)} ${dailyApiCount === null ? chalk47.dim("unavailable") : formatCount(dailyApiCount)}`);
-  console.log(chalk47.dim("  Org totals (egress, MAU) have no public API \u2014 exact numbers: supabase.com/dashboard \u2192 Usage."));
+  console.log(`  ${"Database size".padEnd(34)} ${dbSizeBytes === null ? chalk48.dim("unavailable") : formatBytes2(dbSizeBytes)}`);
+  console.log(`  ${"API requests (last 24h)".padEnd(34)} ${dailyApiCount === null ? chalk48.dim("unavailable") : formatCount(dailyApiCount)}`);
+  console.log(chalk48.dim("  Org totals (egress, MAU) have no public API \u2014 exact numbers: supabase.com/dashboard \u2192 Usage."));
 }
 function printProblems(snapshot) {
   console.log("");
@@ -8006,7 +8834,7 @@ function printProblems(snapshot) {
 
 // src/commands/cloud/status.ts
 init_logger();
-import chalk48 from "chalk";
+import chalk49 from "chalk";
 async function cloudStatus() {
   const snapshot = await collectSnapshot(process.cwd());
   const nearLimit = [];
@@ -8025,10 +8853,10 @@ function printVercel2(snapshot, nearLimit) {
   if (!snapshot.vercel) {
     return;
   }
-  console.log(chalk48.bold(`
+  console.log(chalk49.bold(`
 Vercel Hobby \u2014 account-wide usage, rolling 30 days (linked project: ${snapshot.vercel.projectName}; limits as of ${LIMITS_VERIFIED_ON})`));
   if (snapshot.vercel.services.length === 0) {
-    console.log(chalk48.dim("  No usage recorded in the billing feed yet."));
+    console.log(chalk49.dim("  No usage recorded in the billing feed yet."));
   }
   for (const service of snapshot.vercel.services) {
     const limit = matchVercelLimit(service.serviceName);
@@ -8047,12 +8875,12 @@ function printSupabase2(snapshot, nearLimit) {
     return;
   }
   const { projectName, status, dbSizeBytes, dailyApiCount } = snapshot.supabase;
-  console.log(chalk48.bold(`
+  console.log(chalk49.bold(`
 Supabase Free \u2014 ${projectName}`));
   if (isSupabasePaused(status)) {
-    console.log(`  ${"Project status".padEnd(34)} ${chalk48.red.bold(status)} \u2014 run \`spfn cloud keepalive\` after restoring it`);
+    console.log(`  ${"Project status".padEnd(34)} ${chalk49.red.bold(status)} \u2014 run \`spfn cloud keepalive\` after restoring it`);
   } else {
-    console.log(`  ${"Project status".padEnd(34)} ${chalk48.green(status)}`);
+    console.log(`  ${"Project status".padEnd(34)} ${chalk49.green(status)}`);
   }
   if (dbSizeBytes !== null) {
     const dbLimit = SUPABASE_FREE_LIMITS.find((l) => l.key === "db-size");
@@ -8062,25 +8890,25 @@ Supabase Free \u2014 ${projectName}`));
       nearLimit.push("Supabase database size");
     }
   } else {
-    console.log(`  ${"Database size".padEnd(34)} ${chalk48.dim("unavailable")}`);
+    console.log(`  ${"Database size".padEnd(34)} ${chalk49.dim("unavailable")}`);
   }
-  console.log(`  ${"API requests (last 24h)".padEnd(34)} ${dailyApiCount === null ? chalk48.dim("unavailable") : formatCount(dailyApiCount)}`);
-  console.log(chalk48.dim(`  DB size ${dbSizeBytes === null ? "unknown" : formatBytes2(dbSizeBytes)} counts per project; egress/MAU are org totals \u2014 exact numbers on the dashboard.`));
+  console.log(`  ${"API requests (last 24h)".padEnd(34)} ${dailyApiCount === null ? chalk49.dim("unavailable") : formatCount(dailyApiCount)}`);
+  console.log(chalk49.dim(`  DB size ${dbSizeBytes === null ? "unknown" : formatBytes2(dbSizeBytes)} counts per project; egress/MAU are org totals \u2014 exact numbers on the dashboard.`));
 }
 function printMigrationPrompt(nearLimit) {
   if (nearLimit.length === 0) {
     return;
   }
-  console.log(chalk48.yellow.bold(`\u26A0 Approaching free-tier limits: ${nearLimit.join(", ")}.`));
-  console.log(chalk48.yellow("  When a Vercel Hobby limit is hit, that capability pauses; Supabase over quota restricts the whole org."));
-  console.log(chalk48.yellow("  Migrating to your own cloud removes these ceilings \u2014 `spfn cloud migrate` (coming soon).\n"));
+  console.log(chalk49.yellow.bold(`\u26A0 Approaching free-tier limits: ${nearLimit.join(", ")}.`));
+  console.log(chalk49.yellow("  When a Vercel Hobby limit is hit, that capability pauses; Supabase over quota restricts the whole org."));
+  console.log(chalk49.yellow("  Migrating to your own cloud removes these ceilings \u2014 `spfn cloud migrate` (coming soon).\n"));
 }
 
 // src/commands/cloud/keepalive.ts
 init_logger();
-import { existsSync as existsSync34, mkdirSync as mkdirSync8, readFileSync as readFileSync17, writeFileSync as writeFileSync22 } from "fs";
-import { dirname as dirname8, join as join35 } from "path";
-import chalk49 from "chalk";
+import { existsSync as existsSync38, mkdirSync as mkdirSync8, readFileSync as readFileSync20, writeFileSync as writeFileSync23 } from "fs";
+import { dirname as dirname10, join as join41 } from "path";
+import chalk50 from "chalk";
 var DEFAULT_HEALTH_PATH = "/api/backend/_core/health?detailed=true";
 var DEFAULT_SCHEDULE = "0 3 * * *";
 async function cloudKeepalive(options) {
@@ -8105,12 +8933,12 @@ async function cloudKeepalive(options) {
   logger.info("The DB ping needs detailed health checks: keep `healthCheck: { detailed: true }` in your server config.");
 }
 function setupVercelCron(cwd, healthPath) {
-  const vercelJsonPath = join35(cwd, "vercel.json");
+  const vercelJsonPath = join41(cwd, "vercel.json");
   let vercelJson = {};
-  if (existsSync34(vercelJsonPath)) {
+  if (existsSync38(vercelJsonPath)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync17(vercelJsonPath, "utf-8"));
+      parsed = JSON.parse(readFileSync20(vercelJsonPath, "utf-8"));
     } catch {
       logger.error("vercel.json is not valid JSON (comments and trailing commas are not allowed) \u2014 fix it and re-run.");
       process.exit(1);
@@ -8128,10 +8956,10 @@ function setupVercelCron(cwd, healthPath) {
   }
   if (result === "occupied") {
     logger.error("vercel.json already has a cron job, and Vercel Hobby allows only one.");
-    logger.info(`Point the existing cron at ${chalk49.cyan(healthPath)} yourself, or use \`--github-actions --url <deployed-url>\`.`);
+    logger.info(`Point the existing cron at ${chalk50.cyan(healthPath)} yourself, or use \`--github-actions --url <deployed-url>\`.`);
     process.exit(1);
   }
-  writeFileSync22(vercelJsonPath, JSON.stringify(vercelJson, null, 4) + "\n", "utf-8");
+  writeFileSync23(vercelJsonPath, JSON.stringify(vercelJson, null, 4) + "\n", "utf-8");
   logger.success(`vercel.json: daily cron added (${DEFAULT_SCHEDULE} UTC \u2192 ${healthPath}). Deploy to activate.`);
   warnIfBackendRouteMissing(cwd);
 }
@@ -8151,8 +8979,8 @@ function setupGithubActions(cwd, healthPath, url) {
     logger.error("`--github-actions` needs `--url <deployed-url>` \u2014 the workflow runs outside your app and must know where it lives.");
     process.exit(1);
   }
-  const workflowPath = join35(cwd, ".github", "workflows", "spfn-keepalive.yml");
-  if (existsSync34(workflowPath)) {
+  const workflowPath = join41(cwd, ".github", "workflows", "spfn-keepalive.yml");
+  if (existsSync38(workflowPath)) {
     logger.success(`${workflowPath} already exists \u2014 nothing to do.`);
     return;
   }
@@ -8161,8 +8989,8 @@ function setupGithubActions(cwd, healthPath, url) {
     logger.error(`--url "${url}" is not a valid URL. Pass the deployed app origin, e.g. https://myapp.vercel.app.`);
     process.exit(1);
   }
-  mkdirSync8(dirname8(workflowPath), { recursive: true });
-  writeFileSync22(workflowPath, githubWorkflow(new URL(healthPath, base).toString()), "utf-8");
+  mkdirSync8(dirname10(workflowPath), { recursive: true });
+  writeFileSync23(workflowPath, githubWorkflow(new URL(healthPath, base).toString()), "utf-8");
   logger.success(".github/workflows/spfn-keepalive.yml: daily keep-alive workflow added. Commit and push to activate.");
 }
 function normalizeDeployUrl(url) {
@@ -8199,8 +9027,8 @@ jobs:
 `;
 }
 function warnIfBackendRouteMissing(cwd) {
-  const routePath = join35(cwd, "src", "app", "api", "backend", "[[...route]]", "route.ts");
-  if (!existsSync34(routePath)) {
+  const routePath = join41(cwd, "src", "app", "api", "backend", "[[...route]]", "route.ts");
+  if (!existsSync38(routePath)) {
     logger.warn("src/app/api/backend/[[...route]]/route.ts not found \u2014 the cron path answers only after `spfn add vercel`.");
   }
 }
@@ -8208,9 +9036,9 @@ function warnIfBackendRouteMissing(cwd) {
 // src/commands/cloud/env.ts
 init_logger();
 init_env_file();
-import { join as join36 } from "path";
+import { join as join42 } from "path";
 import prompts13 from "prompts";
-import chalk50 from "chalk";
+import chalk51 from "chalk";
 async function cloudEnvPull(options) {
   const cwd = process.cwd();
   try {
@@ -8229,7 +9057,7 @@ async function cloudEnvPull(options) {
   logger.info("Values were written to files/keychain only \u2014 none were displayed.");
 }
 function writePublicValues(cwd, projectRef2, keys) {
-  const envLocalPath = join36(cwd, ".env.local");
+  const envLocalPath = join42(cwd, ".env.local");
   ensureGitignored(cwd, [{ pattern: ".env.local", comment: "local env (per-machine values)" }]);
   upsertEnvVar(envLocalPath, "NEXT_PUBLIC_SUPABASE_URL", `https://${projectRef2}.supabase.co`);
   logger.success("NEXT_PUBLIC_SUPABASE_URL \u2192 .env.local");
@@ -8247,7 +9075,7 @@ async function storeServiceKey(cwd, keys) {
     logger.warn("No service_role/secret key found on the project \u2014 skipped SUPABASE_SERVICE_ROLE_KEY.");
     return;
   }
-  await storeSecret(cwd, "local", "SUPABASE_SERVICE_ROLE_KEY", service.api_key);
+  await storeSecret(cwd, { env: "local" }, "SUPABASE_SERVICE_ROLE_KEY", service.api_key);
 }
 function findKey(keys, candidates) {
   return keys.find((key) => candidates.includes(key.name)) ?? keys.find((key) => key.type !== void 0 && candidates.includes(key.type));
@@ -8268,7 +9096,7 @@ async function storeDatabaseUrl(cwd, token, projectRef2) {
     return;
   }
   const url = sessionPoolerUrl(template, password);
-  await storeSecret(cwd, "local", "DATABASE_URL", url);
+  await storeSecret(cwd, { env: "local" }, "DATABASE_URL", url);
   logger.info("This is the session-mode pooler connection (IPv4-safe, works for migrations). Serverless runtime can use the transaction pooler (port 6543) instead.");
 }
 async function poolerTemplate(token, projectRef2) {
@@ -8312,7 +9140,7 @@ async function cloudEnvPush(keys) {
       logger.error(`${failure.key}: rejected by Vercel \u2014 ${failure.message}`);
     }
     for (const envVar of vars.filter((v) => !failedKeys.has(v.key))) {
-      logger.success(`${envVar.key} \u2192 Vercel ${chalk50.cyan(linked.projectName)} (${envVar.type}, ${envVar.target.join("+")})`);
+      logger.success(`${envVar.key} \u2192 Vercel ${chalk51.cyan(linked.projectName)} (${envVar.type}, ${envVar.target.join("+")})`);
     }
     if (result.failed.length > 0) {
       process.exit(1);
@@ -8323,8 +9151,8 @@ async function cloudEnvPush(keys) {
   }
 }
 async function resolveLocalValues(cwd, keys) {
-  const publicEnv = { ...parseEnvFile(join36(cwd, ".env")), ...parseEnvFile(join36(cwd, ".env.local")) };
-  const serverEnv = parseEnvFile(join36(cwd, ".env.server"));
+  const publicEnv = { ...parseEnvFile(join42(cwd, ".env")), ...parseEnvFile(join42(cwd, ".env.local")) };
+  const serverEnv = parseEnvFile(join42(cwd, ".env.server"));
   const keychain = await resolveKeychainEnv(cwd);
   const vars = [];
   const missing = [];
@@ -8362,9 +9190,9 @@ envGroup.command("push").description("Push local env values to the Vercel projec
 
 // src/commands/kit/index.ts
 import { Command as Command18 } from "commander";
-import chalk52 from "chalk";
+import chalk53 from "chalk";
 import prompts14 from "prompts";
-import { resolve as resolve3 } from "path";
+import { resolve as resolve6 } from "path";
 
 // src/kit/errors.ts
 var KIT_EXIT = {
@@ -8480,11 +9308,11 @@ async function resolveKitAdapters(request2) {
 // src/kit/operations/install.ts
 import { createHash as createHash2 } from "crypto";
 import { hostname as hostname2, tmpdir } from "os";
-import { mkdtempSync, existsSync as existsSync46 } from "fs";
-import { join as join46 } from "path";
+import { mkdtempSync, existsSync as existsSync50 } from "fs";
+import { join as join52 } from "path";
 
 // src/kit/events.ts
-import chalk51 from "chalk";
+import chalk52 from "chalk";
 
 // src/kit/secret-scan.ts
 var SECRET_SHAPES = [
@@ -8536,30 +9364,30 @@ function redactEvent(event, knownSecrets) {
 function humanLine(event) {
   switch (event.status) {
     case "completed":
-      return `${chalk51.green("\u2713")} ${event.summary}`;
+      return `${chalk52.green("\u2713")} ${event.summary}`;
     case "waiting":
-      return `${chalk51.yellow("\u2026")} ${event.summary}${nextLine(event)}`;
+      return `${chalk52.yellow("\u2026")} ${event.summary}${nextLine(event)}`;
     case "failed":
-      return `${chalk51.red("\u2717")} ${event.summary}
-  ${chalk51.gray(event.code)}${nextLine(event)}`;
+      return `${chalk52.red("\u2717")} ${event.summary}
+  ${chalk52.gray(event.code)}${nextLine(event)}`;
     case "started":
-      return chalk51.gray(`\u2192 ${event.summary}`);
+      return chalk52.gray(`\u2192 ${event.summary}`);
     default:
-      return chalk51.gray(`  ${event.summary}`);
+      return chalk52.gray(`  ${event.summary}`);
   }
 }
 function nextLine(event) {
   if (!event.next) {
     return "";
   }
-  const approval = event.next.requiresHumanApproval ? chalk51.yellow(" (needs your approval)") : "";
+  const approval = event.next.requiresHumanApproval ? chalk52.yellow(" (needs your approval)") : "";
   return `
-  ${chalk51.gray("next:")} ${event.next.command}${approval}`;
+  ${chalk52.gray("next:")} ${event.next.command}${approval}`;
 }
 
 // src/kit/journal.ts
-import { mkdirSync as mkdirSync10, readdirSync as readdirSync3, readFileSync as readFileSync18, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync24, existsSync as existsSync36, statSync } from "fs";
-import { dirname as dirname9, join as join38 } from "path";
+import { mkdirSync as mkdirSync10, readdirSync as readdirSync4, readFileSync as readFileSync21, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync25, existsSync as existsSync40, statSync as statSync2 } from "fs";
+import { dirname as dirname11, join as join44 } from "path";
 
 // src/kit/digest.ts
 import { createHash } from "crypto";
@@ -8600,8 +9428,8 @@ function digestOfJson(value) {
 }
 
 // src/kit/paths.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync23, existsSync as existsSync35 } from "fs";
-import { join as join37 } from "path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync24, existsSync as existsSync39 } from "fs";
+import { join as join43 } from "path";
 var KIT_STATE_DIR = ".spfn";
 var OPERATIONS_IGNORE = [
   "# Written by `spfn kit`. One machine's run is not part of the project.",
@@ -8609,27 +9437,27 @@ var OPERATIONS_IGNORE = [
   ""
 ].join("\n");
 function kitPaths(root) {
-  const stateDir = join37(root, KIT_STATE_DIR);
-  const operationsDir = join37(stateDir, "operations");
-  const lockDir = join37(operationsDir, "operation.lock");
+  const stateDir = join43(root, KIT_STATE_DIR);
+  const operationsDir = join43(stateDir, "operations");
+  const lockDir = join43(operationsDir, "operation.lock");
   return {
     root,
     stateDir,
-    licenseFile: join37(stateDir, "license.json"),
-    lockFile: join37(stateDir, "kit-lock.json"),
+    licenseFile: join43(stateDir, "license.json"),
+    lockFile: join43(stateDir, "kit-lock.json"),
     operationsDir,
-    activeJournal: join37(operationsDir, "active.json"),
-    historyDir: join37(operationsDir, "history"),
+    activeJournal: join43(operationsDir, "active.json"),
+    historyDir: join43(operationsDir, "history"),
     lockDir,
-    lockOwnerFile: join37(lockDir, "owner.json")
+    lockOwnerFile: join43(lockDir, "owner.json")
   };
 }
 function ensureOperationsDir(root) {
   const paths = kitPaths(root);
-  const ignoreFile = join37(paths.stateDir, ".gitignore");
+  const ignoreFile = join43(paths.stateDir, ".gitignore");
   mkdirSync9(paths.stateDir, { recursive: true });
-  if (!existsSync35(ignoreFile)) {
-    writeFileSync23(ignoreFile, OPERATIONS_IGNORE, "utf8");
+  if (!existsSync39(ignoreFile)) {
+    writeFileSync24(ignoreFile, OPERATIONS_IGNORE, "utf8");
   }
   mkdirSync9(paths.operationsDir, { recursive: true });
   return paths.operationsDir;
@@ -8916,14 +9744,14 @@ var JournalStore = class {
     return readJournalFile(this.paths.activeJournal);
   }
   readHistory(operationId) {
-    return readJournalFile(join38(this.paths.historyDir, `${operationId}.json`));
+    return readJournalFile(join44(this.paths.historyDir, `${operationId}.json`));
   }
   /** Every journal this project still has, newest update first. */
   listHistory() {
-    if (!existsSync36(this.paths.historyDir)) {
+    if (!existsSync40(this.paths.historyDir)) {
       return [];
     }
-    return readdirSync3(this.paths.historyDir).filter((name) => name.endsWith(".json")).map((name) => readJournalFile(join38(this.paths.historyDir, name))).filter((journal) => journal !== null).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+    return readdirSync4(this.paths.historyDir).filter((name) => name.endsWith(".json")).map((name) => readJournalFile(join44(this.paths.historyDir, name))).filter((journal) => journal !== null).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
   }
   create(init) {
     const timestamp = this.now();
@@ -8982,17 +9810,17 @@ var JournalStore = class {
   }
   /** Move a finished operation into history and clear the active slot. */
   archive(journal) {
-    writeJsonAtomically(join38(this.paths.historyDir, `${journal.operationId}.json`), journal);
-    rmSync2(this.paths.activeJournal, { force: true });
+    writeJsonAtomically(join44(this.paths.historyDir, `${journal.operationId}.json`), journal);
+    rmSync3(this.paths.activeJournal, { force: true });
     this.pruneHistory();
   }
   pruneHistory() {
-    if (!existsSync36(this.paths.historyDir)) {
+    if (!existsSync40(this.paths.historyDir)) {
       return;
     }
-    const files = readdirSync3(this.paths.historyDir).filter((name) => name.endsWith(".json")).map((name) => join38(this.paths.historyDir, name)).sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs);
+    const files = readdirSync4(this.paths.historyDir).filter((name) => name.endsWith(".json")).map((name) => join44(this.paths.historyDir, name)).sort((left, right) => statSync2(right).mtimeMs - statSync2(left).mtimeMs);
     for (const file of files.slice(this.historyLimit)) {
-      rmSync2(file, { force: true });
+      rmSync3(file, { force: true });
     }
   }
 };
@@ -9012,26 +9840,26 @@ function upsertCheckpoint(checkpoints, entry) {
   return next;
 }
 function readJournalFile(file) {
-  if (!existsSync36(file)) {
+  if (!existsSync40(file)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(readFileSync18(file, "utf8"));
+    const parsed = JSON.parse(readFileSync21(file, "utf8"));
     return validateOperationJournal(parsed).valid ? parsed : null;
   } catch {
     return null;
   }
 }
 function writeJsonAtomically(file, value) {
-  mkdirSync10(dirname9(file), { recursive: true });
+  mkdirSync10(dirname11(file), { recursive: true });
   const temporary = `${file}.tmp`;
-  writeFileSync24(temporary, `${JSON.stringify(value, null, 4)}
+  writeFileSync25(temporary, `${JSON.stringify(value, null, 4)}
 `, { encoding: "utf8", mode: 384 });
-  renameSync2(temporary, file);
+  renameSync3(temporary, file);
 }
 
 // src/kit/lock.ts
-import { mkdirSync as mkdirSync11, readFileSync as readFileSync19, rmSync as rmSync3, writeFileSync as writeFileSync25, existsSync as existsSync37 } from "fs";
+import { mkdirSync as mkdirSync11, readFileSync as readFileSync22, rmSync as rmSync4, writeFileSync as writeFileSync26, existsSync as existsSync41 } from "fs";
 import { hostname } from "os";
 function defaultIsProcessAlive(pid) {
   try {
@@ -9055,7 +9883,7 @@ function acquireOperationLock(options) {
     return handle(paths, owner, false);
   }
   reconcileStaleLock(options);
-  rmSync3(paths.lockDir, { recursive: true, force: true });
+  rmSync4(paths.lockDir, { recursive: true, force: true });
   if (!tryCreateLockDir(paths)) {
     throw new KitError("KIT_OPERATION_ACTIVE", "Another spfn kit operation took the project lock first.", {
       evidence: { lockDir: paths.lockDir },
@@ -9067,11 +9895,11 @@ function acquireOperationLock(options) {
 }
 function readLockOwner(root) {
   const paths = kitPaths(root);
-  if (!existsSync37(paths.lockOwnerFile)) {
+  if (!existsSync41(paths.lockOwnerFile)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(readFileSync19(paths.lockOwnerFile, "utf8"));
+    const parsed = JSON.parse(readFileSync22(paths.lockOwnerFile, "utf8"));
     return typeof parsed?.pid === "number" && typeof parsed?.operationId === "string" ? parsed : null;
   } catch {
     return null;
@@ -9140,7 +9968,7 @@ function tryCreateLockDir(paths) {
   }
 }
 function writeOwner(paths, owner) {
-  writeFileSync25(paths.lockOwnerFile, `${JSON.stringify(owner, null, 4)}
+  writeFileSync26(paths.lockOwnerFile, `${JSON.stringify(owner, null, 4)}
 `, "utf8");
 }
 function handle(paths, owner, reclaimed) {
@@ -9148,24 +9976,24 @@ function handle(paths, owner, reclaimed) {
     owner,
     reclaimed,
     release() {
-      rmSync3(paths.lockDir, { recursive: true, force: true });
+      rmSync4(paths.lockDir, { recursive: true, force: true });
     }
   };
 }
 
 // src/kit/operation-context.ts
-import { mkdirSync as mkdirSync12, readFileSync as readFileSync20, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync26, existsSync as existsSync38 } from "fs";
-import { dirname as dirname10, join as join39 } from "path";
+import { mkdirSync as mkdirSync12, readFileSync as readFileSync23, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync27, existsSync as existsSync42 } from "fs";
+import { dirname as dirname12, join as join45 } from "path";
 function contextFile(root) {
-  return join39(kitPaths(root).operationsDir, "context.json");
+  return join45(kitPaths(root).operationsDir, "context.json");
 }
 function readOperationContext(root) {
   const file = contextFile(root);
-  if (!existsSync38(file)) {
+  if (!existsSync42(file)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(readFileSync20(file, "utf8"));
+    const parsed = JSON.parse(readFileSync23(file, "utf8"));
     return parsed?.schemaVersion === 1 && typeof parsed.operationId === "string" ? parsed : null;
   } catch {
     return null;
@@ -9173,14 +10001,14 @@ function readOperationContext(root) {
 }
 function writeOperationContext(root, context) {
   const file = contextFile(root);
-  mkdirSync12(dirname10(file), { recursive: true });
+  mkdirSync12(dirname12(file), { recursive: true });
   const temporary = `${file}.tmp`;
-  writeFileSync26(temporary, `${JSON.stringify(context, null, 4)}
+  writeFileSync27(temporary, `${JSON.stringify(context, null, 4)}
 `, "utf8");
-  renameSync3(temporary, file);
+  renameSync4(temporary, file);
 }
 function clearOperationContext(root) {
-  rmSync4(contextFile(root), { force: true });
+  rmSync5(contextFile(root), { force: true });
 }
 
 // src/kit/plan.ts
@@ -9725,7 +10553,7 @@ async function fetchThroughRedirects(start, fetcher, allowlist) {
 }
 
 // src/kit/credentials.ts
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 var KIT_KEYCHAIN_SERVICE = "superfunction.spfn.kit";
 var KIT_KEYCHAIN_NAMESPACE_ENV = "SPFN_KIT_KEYCHAIN_NAMESPACE";
 var NAMESPACE_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/;
@@ -9748,7 +10576,7 @@ function pendingAccount(kitId, installationId, localClientId) {
   return `${kitId}:pending:${installationId}:${localClientId}`;
 }
 function newCandidateCredential() {
-  return `spfnlc_${randomBytes3(8).toString("hex")}.${randomBytes3(32).toString("base64url")}`;
+  return `spfnlc_${randomBytes4(8).toString("hex")}.${randomBytes4(32).toString("base64url")}`;
 }
 function credentialPublicId(credential) {
   const match = /^spfn[a-z]*_([0-9a-f]{16})\./.exec(credential);
@@ -9810,8 +10638,8 @@ var KeychainKitCredentialStore = class {
 };
 
 // src/kit/tooling.ts
-import { cpSync, mkdirSync as mkdirSync13, readdirSync as readdirSync4, readFileSync as readFileSync21, rmSync as rmSync5, statSync as statSync2, existsSync as existsSync39 } from "fs";
-import { join as join40, relative as relative2, sep as sep3 } from "path";
+import { cpSync, mkdirSync as mkdirSync13, readdirSync as readdirSync5, readFileSync as readFileSync24, rmSync as rmSync6, statSync as statSync3, existsSync as existsSync43 } from "fs";
+import { join as join46, relative as relative3, sep as sep3 } from "path";
 
 // src/kit/manifest.ts
 var DEFAULT_AGENT_PACK_ROOT = ".spfn/agent-pack";
@@ -10117,27 +10945,27 @@ function assertSafeRelativePath(path5, refuse) {
 }
 function snapshotTree(root, ignore = ["node_modules", ".git"]) {
   const files = /* @__PURE__ */ new Map();
-  const walk = (directory) => {
-    for (const entry of readdirSync4(directory, { withFileTypes: true })) {
+  const walk2 = (directory) => {
+    for (const entry of readdirSync5(directory, { withFileTypes: true })) {
       if (ignore.includes(entry.name)) {
         continue;
       }
-      const absolute = join40(directory, entry.name);
+      const absolute = join46(directory, entry.name);
       if (entry.isDirectory()) {
-        walk(absolute);
+        walk2(absolute);
         continue;
       }
       if (!entry.isFile()) {
         continue;
       }
       files.set(
-        relative2(root, absolute).split(sep3).join("/"),
-        sha256Digest(readFileSync21(absolute))
+        relative3(root, absolute).split(sep3).join("/"),
+        sha256Digest(readFileSync24(absolute))
       );
     }
   };
-  if (existsSync39(root) && statSync2(root).isDirectory()) {
-    walk(root);
+  if (existsSync43(root) && statSync3(root).isDirectory()) {
+    walk2(root);
   }
   return { files };
 }
@@ -10163,7 +10991,7 @@ function diffTrees(before, after) {
 }
 var COPY_EXCLUDED = ["node_modules", ".git", ".spfn"];
 async function runIsolated(projectDir2, stagingDir, run2) {
-  rmSync5(stagingDir, { recursive: true, force: true });
+  rmSync6(stagingDir, { recursive: true, force: true });
   mkdirSync13(stagingDir, { recursive: true });
   cpSync(projectDir2, stagingDir, {
     recursive: true,
@@ -10175,7 +11003,7 @@ async function runIsolated(projectDir2, stagingDir, run2) {
     const diff = diffTrees(before, snapshotTree(stagingDir));
     return { value, diff };
   } finally {
-    rmSync5(stagingDir, { recursive: true, force: true });
+    rmSync6(stagingDir, { recursive: true, force: true });
   }
 }
 function assertWritesWithinAllowlist(diff, allowlist, context) {
@@ -10193,22 +11021,22 @@ function assertWritesWithinAllowlist(diff, allowlist, context) {
 }
 
 // src/kit/agent-pack.ts
-import { existsSync as existsSync40, mkdirSync as mkdirSync14, readFileSync as readFileSync22, writeFileSync as writeFileSync27 } from "fs";
-import { dirname as dirname11, join as join41 } from "path";
+import { existsSync as existsSync44, mkdirSync as mkdirSync14, readFileSync as readFileSync25, writeFileSync as writeFileSync28 } from "fs";
+import { dirname as dirname13, join as join47 } from "path";
 var AGENT_PACK_RECORD_PATH = ".spfn/agent-pack.json";
 function writeAgentPackRecord(projectDir2, record) {
-  const file = join41(projectDir2, AGENT_PACK_RECORD_PATH);
-  mkdirSync14(dirname11(file), { recursive: true });
-  writeFileSync27(file, `${JSON.stringify(record, null, 4)}
+  const file = join47(projectDir2, AGENT_PACK_RECORD_PATH);
+  mkdirSync14(dirname13(file), { recursive: true });
+  writeFileSync28(file, `${JSON.stringify(record, null, 4)}
 `, "utf8");
 }
 function readAgentPackRecord(projectDir2) {
-  const file = join41(projectDir2, AGENT_PACK_RECORD_PATH);
-  if (!existsSync40(file)) {
+  const file = join47(projectDir2, AGENT_PACK_RECORD_PATH);
+  if (!existsSync44(file)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(readFileSync22(file, "utf8"));
+    const parsed = JSON.parse(readFileSync25(file, "utf8"));
     return parsed.schemaVersion === 1 && typeof parsed.files === "object" && parsed.files !== null ? parsed : null;
   } catch {
     return null;
@@ -10216,8 +11044,8 @@ function readAgentPackRecord(projectDir2) {
 }
 
 // src/kit/installed-state.ts
-import { mkdirSync as mkdirSync15, readFileSync as readFileSync23, renameSync as renameSync4, writeFileSync as writeFileSync28, existsSync as existsSync41 } from "fs";
-import { dirname as dirname12 } from "path";
+import { mkdirSync as mkdirSync15, readFileSync as readFileSync26, renameSync as renameSync5, writeFileSync as writeFileSync29, existsSync as existsSync45 } from "fs";
+import { dirname as dirname14 } from "path";
 function readLicenseFile(file) {
   const parsed = readJson(file);
   if (parsed === null) {
@@ -10259,7 +11087,7 @@ function requireInstalledLock(file) {
   const lock = readInstalledLock(file);
   if (lock === null) {
     throw new KitError("KIT_LOCK_INVALID", "This project has no readable .spfn/kit-lock.json.", {
-      evidence: { file, exists: existsSync41(file) },
+      evidence: { file, exists: existsSync45(file) },
       next: { command: "spfn kit recover --json", requiresHumanApproval: false }
     });
   }
@@ -10294,29 +11122,29 @@ function lockFromManifest(manifest, context) {
   };
 }
 function readJson(file) {
-  if (!existsSync41(file)) {
+  if (!existsSync45(file)) {
     return null;
   }
   try {
-    return JSON.parse(readFileSync23(file, "utf8"));
+    return JSON.parse(readFileSync26(file, "utf8"));
   } catch {
     return null;
   }
 }
 function writeJsonAtomically2(file, value) {
-  mkdirSync15(dirname12(file), { recursive: true });
+  mkdirSync15(dirname14(file), { recursive: true });
   const temporary = `${file}.tmp`;
-  writeFileSync28(temporary, `${JSON.stringify(value, null, 4)}
+  writeFileSync29(temporary, `${JSON.stringify(value, null, 4)}
 `, "utf8");
-  renameSync4(temporary, file);
+  renameSync5(temporary, file);
 }
 
 // src/kit/drift.ts
-import { readFileSync as readFileSync24, existsSync as existsSync42 } from "fs";
-import { join as join42 } from "path";
+import { readFileSync as readFileSync27, existsSync as existsSync46 } from "fs";
+import { join as join48 } from "path";
 function fileDigest(root, relativePath) {
-  const file = join42(root, relativePath);
-  return existsSync42(file) ? sha256Digest(readFileSync24(file)) : null;
+  const file = join48(root, relativePath);
+  return existsSync46(file) ? sha256Digest(readFileSync27(file)) : null;
 }
 function agentPackTargets(root, lock) {
   if (lock.agentPack.root === void 0) {
@@ -10347,12 +11175,12 @@ function managedDigests(root, lock) {
 }
 
 // src/kit/operations/shared.ts
-import { mkdirSync as mkdirSync17, readdirSync as readdirSync5, readFileSync as readFileSync27, writeFileSync as writeFileSync31, existsSync as existsSync45 } from "fs";
-import { dirname as dirname14, join as join45 } from "path";
+import { mkdirSync as mkdirSync17, readdirSync as readdirSync6, readFileSync as readFileSync30, writeFileSync as writeFileSync32, existsSync as existsSync49 } from "fs";
+import { dirname as dirname16, join as join51 } from "path";
 
 // src/kit/expand.ts
-import { mkdirSync as mkdirSync16, existsSync as existsSync43, readFileSync as readFileSync25, writeFileSync as writeFileSync29 } from "fs";
-import { dirname as dirname13, join as join43 } from "path";
+import { mkdirSync as mkdirSync16, existsSync as existsSync47, readFileSync as readFileSync28, writeFileSync as writeFileSync30 } from "fs";
+import { dirname as dirname15, join as join49 } from "path";
 
 // src/kit/tar.ts
 var BLOCK = 512;
@@ -10453,32 +11281,32 @@ function expandArchive(bytes, request2) {
   let written = 0;
   let matched = 0;
   for (const entry of entries) {
-    const relative3 = request2.root === void 0 || request2.root.length === 0 ? entry.path : `${request2.root.replace(/\/+$/, "")}/${entry.path}`;
-    const destination = join43(request2.targetDir, relative3);
+    const relative4 = request2.root === void 0 || request2.root.length === 0 ? entry.path : `${request2.root.replace(/\/+$/, "")}/${entry.path}`;
+    const destination = join49(request2.targetDir, relative4);
     if (entry.kind === "directory") {
       mkdirSync16(destination, { recursive: true });
       continue;
     }
     const digest = sha256Digest(entry.bytes);
-    files[relative3] = digest;
-    if (existsSync43(destination) && request2.existing !== "replace") {
-      assertSameBytes(destination, relative3, digest);
+    files[relative4] = digest;
+    if (existsSync47(destination) && request2.existing !== "replace") {
+      assertSameBytes(destination, relative4, digest);
       matched += 1;
       continue;
     }
-    mkdirSync16(dirname13(destination), { recursive: true });
-    writeFileSync29(destination, entry.bytes, { mode: entry.mode === 0 ? 420 : entry.mode });
+    mkdirSync16(dirname15(destination), { recursive: true });
+    writeFileSync30(destination, entry.bytes, { mode: entry.mode === 0 ? 420 : entry.mode });
     written += 1;
   }
   return { files, written, matched };
 }
-function assertSameBytes(destination, relative3, expected) {
-  const actual = sha256Digest(readFileSync25(destination));
+function assertSameBytes(destination, relative4, expected) {
+  const actual = sha256Digest(readFileSync28(destination));
   if (actual === expected) {
     return;
   }
   throw new KitError("KIT_TARGET_NOT_EMPTY", "A file the release would write is already there with different contents.", {
-    evidence: { path: relative3, expected, actual },
+    evidence: { path: relative4, expected, actual },
     next: { command: "spfn kit status --json", requiresHumanApproval: false }
   });
 }
@@ -10581,15 +11409,15 @@ function registryNpmrc(scopes, registryUrl) {
 }
 
 // src/kit/package-graph.ts
-import { existsSync as existsSync44, readFileSync as readFileSync26, writeFileSync as writeFileSync30 } from "fs";
-import { join as join44 } from "path";
+import { existsSync as existsSync48, readFileSync as readFileSync29, writeFileSync as writeFileSync31 } from "fs";
+import { join as join50 } from "path";
 var DEPENDENCY_BLOCKS = ["dependencies", "devDependencies", "optionalDependencies"];
 function applyManifestVersions(projectDir2, manifest) {
-  const file = join44(projectDir2, "package.json");
-  if (!existsSync44(file)) {
+  const file = join50(projectDir2, "package.json");
+  if (!existsSync48(file)) {
     return [];
   }
-  const raw = readFileSync26(file, "utf8");
+  const raw = readFileSync29(file, "utf8");
   const document = JSON.parse(raw);
   const wanted = new Map(manifest.packages.map((entry) => [entry.name, entry.version]));
   const changes = [];
@@ -10608,7 +11436,7 @@ function applyManifestVersions(projectDir2, manifest) {
     }
   }
   if (changes.length > 0) {
-    writeFileSync30(file, `${JSON.stringify(document, null, indentationOf(raw))}${trailingNewline(raw)}`);
+    writeFileSync31(file, `${JSON.stringify(document, null, indentationOf(raw))}${trailingNewline(raw)}`);
   }
   return changes;
 }
@@ -10636,12 +11464,12 @@ function installedGraphMismatches(projectDir2, manifest, skip = () => false) {
   return mismatches;
 }
 function installedVersion(projectDir2, name) {
-  const file = join44(projectDir2, "node_modules", ...name.split("/"), "package.json");
-  if (!existsSync44(file)) {
+  const file = join50(projectDir2, "node_modules", ...name.split("/"), "package.json");
+  if (!existsSync48(file)) {
     return null;
   }
   try {
-    const version = JSON.parse(readFileSync26(file, "utf8")).version;
+    const version = JSON.parse(readFileSync29(file, "utf8")).version;
     return typeof version === "string" ? version : null;
   } catch {
     return null;
@@ -10728,10 +11556,10 @@ function latestActiveRelease(catalog) {
   return active[0];
 }
 function assertEmptyTarget(targetDir) {
-  if (!existsSync45(targetDir)) {
+  if (!existsSync49(targetDir)) {
     return;
   }
-  const entries = readdirSync5(targetDir).filter((name) => name !== ".DS_Store");
+  const entries = readdirSync6(targetDir).filter((name) => name !== ".DS_Store");
   if (entries.length > 0) {
     throw new KitError("KIT_TARGET_NOT_EMPTY", "A Kit install needs a new or empty directory.", {
       evidence: { targetDir, entries: entries.length }
@@ -10759,13 +11587,13 @@ async function materializeTargets(adapters, projectDir2, targets, options = {})
       continue;
     }
     written[target.path] = digest;
-    writeManagedFile(join45(projectDir2, target.path), target.path, bytes, digest, options.existing);
+    writeManagedFile(join51(projectDir2, target.path), target.path, bytes, digest, options.existing);
   }
   return written;
 }
 function writeManagedFile(file, path5, bytes, digest, existing = "verify") {
-  if (existsSync45(file) && existing !== "replace") {
-    const actual = sha256Digest(readFileSync27(file));
+  if (existsSync49(file) && existing !== "replace") {
+    const actual = sha256Digest(readFileSync30(file));
     if (actual === digest) {
       return;
     }
@@ -10774,8 +11602,8 @@ function writeManagedFile(file, path5, bytes, digest, existing = "verify") {
       next: { command: "spfn kit status --json", requiresHumanApproval: false }
     });
   }
-  mkdirSync17(dirname14(file), { recursive: true });
-  writeFileSync31(file, bytes);
+  mkdirSync17(dirname16(file), { recursive: true });
+  writeFileSync32(file, bytes);
 }
 async function installFrozenGraph(adapters, options) {
   const maxAttempts = options.allowSessionRetry === false ? 1 : 2;
@@ -10837,7 +11665,7 @@ function scopesOf(manifest) {
   return scopes.length === 0 ? ["@superfunction"] : [...new Set(scopes)];
 }
 function writeRegistryNpmrc(projectDir2, manifest, registryUrl) {
-  writeFileSync31(join45(projectDir2, ".npmrc"), registryNpmrc(scopesOf(manifest), registryUrl), "utf8");
+  writeFileSync32(join51(projectDir2, ".npmrc"), registryNpmrc(scopesOf(manifest), registryUrl), "utf8");
 }
 function assertGraphInstalled(options) {
   if (options.expect === void 0) {
@@ -11085,10 +11913,10 @@ function installSteps(options) {
         return { kind: "done", evidence: { attempts: evidence.attempts, tooling: tooling.specifier } };
       },
       async verify() {
-        if (!existsSync46(join46(projectDir2, "node_modules"))) {
+        if (!existsSync50(join52(projectDir2, "node_modules"))) {
           return { ok: false, reason: "dependencies-missing" };
         }
-        if (!existsSync46(paths.lockFile)) {
+        if (!existsSync50(paths.lockFile)) {
           writeLock(options, projectDir2, adapters.clock.now());
         }
         return { ok: true };
@@ -11187,7 +12015,7 @@ async function verifyToolingPlan(options, projectDir2, operationId) {
   });
   const isolated = await runIsolated(
     projectDir2,
-    join46(mkdtempSync(join46(tmpdir(), "spfn-kit-")), operationId),
+    join52(mkdtempSync(join52(tmpdir(), "spfn-kit-")), operationId),
     (workingCopy) => discovered.tooling.planInstall({
       projectDir: workingCopy,
       release: options.manifest.version
@@ -11495,8 +12323,8 @@ async function startRecovery(sink, adapters, activationId) {
 }
 
 // src/kit/customer-source.ts
-import { existsSync as existsSync47, mkdirSync as mkdirSync18, readFileSync as readFileSync28, writeFileSync as writeFileSync32 } from "fs";
-import { dirname as dirname15, join as join47 } from "path";
+import { existsSync as existsSync51, mkdirSync as mkdirSync18, readFileSync as readFileSync31, writeFileSync as writeFileSync33 } from "fs";
+import { dirname as dirname17, join as join53 } from "path";
 var IGNORED_DIRECTORIES = ["node_modules", ".git", ".next", ".turbo", ".vercel", "dist", "coverage"];
 var KIT_OWNED_FILES = ["pnpm-lock.yaml", "package.json", ".npmrc", "tsconfig.tsbuildinfo"];
 function declaredPaths(declaration) {
@@ -11541,21 +12369,21 @@ function compareCustomerSource(before, after) {
   return paths.filter((path5) => before[path5] !== after[path5]).map((path5) => ({ path: path5, before: before[path5] ?? null, after: after[path5] ?? null }));
 }
 function customerBaselinePath(projectDir2, operationId) {
-  return join47(projectDir2, ".spfn", "operations", `${operationId}.customer-source.json`);
+  return join53(projectDir2, ".spfn", "operations", `${operationId}.customer-source.json`);
 }
 function writeCustomerBaseline(projectDir2, baseline) {
   const path5 = customerBaselinePath(projectDir2, baseline.operationId);
-  mkdirSync18(dirname15(path5), { recursive: true });
-  writeFileSync32(path5, `${JSON.stringify(baseline, null, 4)}
+  mkdirSync18(dirname17(path5), { recursive: true });
+  writeFileSync33(path5, `${JSON.stringify(baseline, null, 4)}
 `);
 }
 function readCustomerBaseline(projectDir2, operationId) {
   const path5 = customerBaselinePath(projectDir2, operationId);
-  if (!existsSync47(path5)) {
+  if (!existsSync51(path5)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(readFileSync28(path5, "utf8"));
+    const parsed = JSON.parse(readFileSync31(path5, "utf8"));
     return parsed?.schemaVersion === 1 && typeof parsed.files === "object" ? parsed : null;
   } catch {
     return null;
@@ -11957,8 +12785,8 @@ function planResult(sink, plan, digest) {
 }
 
 // src/kit/operations/inspect.ts
-import { existsSync as existsSync48 } from "fs";
-import { join as join48 } from "path";
+import { existsSync as existsSync52 } from "fs";
+import { join as join54 } from "path";
 async function runStatus(request2, adapters) {
   const paths = kitPaths(request2.projectDir);
   const lock = readInstalledLock(paths.lockFile);
@@ -12071,7 +12899,7 @@ async function runCheck(request2, adapters) {
       fixCommand: `spfn kit resume ${journal.operationId} --json`
     });
   }
-  if (!existsSync48(join48(request2.projectDir, "node_modules"))) {
+  if (!existsSync52(join54(request2.projectDir, "node_modules"))) {
     diagnostics.push({
       code: "KIT_GATE_FAILED",
       severity: "warning",
@@ -12219,7 +13047,7 @@ async function runAbandon(request2, adapters) {
 
 // src/commands/kit/index.ts
 function projectDir(options) {
-  return resolve3(options.dir ?? process.cwd());
+  return resolve6(options.dir ?? process.cwd());
 }
 function licenseKeyReader(options) {
   return async () => {
@@ -12313,10 +13141,10 @@ function reportFailure(error, json) {
   if (json) {
     console.log(JSON.stringify(event));
   } else {
-    console.error(`${chalk52.red("\u2717")} ${error.message}`);
-    console.error(`  ${chalk52.gray(error.code)}`);
+    console.error(`${chalk53.red("\u2717")} ${error.message}`);
+    console.error(`  ${chalk53.gray(error.code)}`);
     if (error.next) {
-      console.error(`  ${chalk52.gray("next:")} ${error.next.command}`);
+      console.error(`  ${chalk53.gray("next:")} ${error.next.command}`);
     }
   }
   process.exitCode = error.exitCode;
@@ -12340,7 +13168,7 @@ async function readOnlyAdapters(projectDir2) {
 }
 var kitCommand = new Command18("kit").description("Install, verify and update a Superfunction Kit in this project");
 kitCommand.command("install <setup-url> <directory>").description("Install a Kit into a new, empty directory").option("--json", "newline-delimited JSON events and a machine-readable result").option("--license-key-stdin", "read the license key from stdin instead of prompting").action(async (setupUrl, directory, options) => {
-  const targetDir = resolve3(directory);
+  const targetDir = resolve6(directory);
   await withResult(options.json === true, async () => runInstall({
     setupUrl,
     targetDir,
@@ -12368,7 +13196,7 @@ kitCommand.command("status").description("Report what is installed, activated an
   try {
     const report2 = await runStatus({ projectDir: dir }, await readOnlyAdapters(dir));
     printJson(options.json === true, report2, () => {
-      console.log(chalk52.bold(report2.installed ? `${report2.kitId} ${report2.release}` : "No Kit installed here"));
+      console.log(chalk53.bold(report2.installed ? `${report2.kitId} ${report2.release}` : "No Kit installed here"));
       console.log(`  activation: ${report2.activationId ?? "-"}   credential: ${report2.credential}`);
       console.log(`  managed drift: ${report2.managedDrift}   update available: ${report2.updateAvailable ?? "none"}`);
       if (report2.operation) {
@@ -12385,15 +13213,15 @@ kitCommand.command("check").description("Check the installed release against its
     const report2 = await runCheck({ projectDir: dir }, await readOnlyAdapters(dir));
     printJson(options.json === true, report2, () => {
       if (report2.diagnostics.length === 0) {
-        console.log(`${chalk52.green("\u2713")} No problems found.`);
+        console.log(`${chalk53.green("\u2713")} No problems found.`);
         return;
       }
       for (const diagnostic of report2.diagnostics) {
-        const mark = diagnostic.severity === "error" ? chalk52.red("\u2717") : chalk52.yellow("!");
+        const mark = diagnostic.severity === "error" ? chalk53.red("\u2717") : chalk53.yellow("!");
         console.log(`${mark} ${diagnostic.summary}`);
-        console.log(`  ${chalk52.gray(diagnostic.code)}${diagnostic.path ? ` ${diagnostic.path}` : ""}`);
+        console.log(`  ${chalk53.gray(diagnostic.code)}${diagnostic.path ? ` ${diagnostic.path}` : ""}`);
         if (diagnostic.fixCommand) {
-          console.log(`  ${chalk52.gray("next:")} ${diagnostic.fixCommand}`);
+          console.log(`  ${chalk53.gray("next:")} ${diagnostic.fixCommand}`);
         }
       }
     });
@@ -12483,8 +13311,8 @@ function parseKeys(raw) {
 }
 
 // src/kit/scaffold.ts
-import { mkdirSync as mkdirSync19, existsSync as existsSync49, readFileSync as readFileSync29, writeFileSync as writeFileSync33 } from "fs";
-import { dirname as dirname16, join as join49 } from "path";
+import { mkdirSync as mkdirSync19, existsSync as existsSync53, readFileSync as readFileSync32, writeFileSync as writeFileSync34 } from "fs";
+import { dirname as dirname18, join as join55 } from "path";
 
 // src/kit/http/registry.ts
 import { createHash as createHash3 } from "crypto";
@@ -12672,9 +13500,9 @@ var KitRegistryProxyClient = class {
     return response.bytes;
   }
 };
-function registryEntitlementProbe(client, resolve4) {
+function registryEntitlementProbe(client, resolve7) {
   return async (request2) => {
-    const target = await resolve4(request2);
+    const target = await resolve7(request2);
     if (target === null) {
       return { entitled: false, reason: "unavailable" };
     }
@@ -12830,20 +13658,20 @@ var ArtifactScaffoldPort = class {
   }
 };
 function seedProjectName(targetDir, name) {
-  const file = join49(targetDir, "package.json");
-  if (!existsSync49(file)) {
+  const file = join55(targetDir, "package.json");
+  if (!existsSync53(file)) {
     return;
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync29(file, "utf8"));
+    parsed = JSON.parse(readFileSync32(file, "utf8"));
   } catch {
     throw new KitError("KIT_MANIFEST_INVALID", "The release scaffold's package.json is not readable JSON.", {
       evidence: { path: "package.json" }
     });
   }
   parsed.name = packageNameOf(name);
-  writeFileSync33(file, `${JSON.stringify(parsed, null, 4)}
+  writeFileSync34(file, `${JSON.stringify(parsed, null, 4)}
 `, "utf8");
 }
 function packageNameOf(name) {
@@ -12851,9 +13679,9 @@ function packageNameOf(name) {
   return cleaned.length === 0 ? "kit-project" : cleaned;
 }
 function writeScaffoldRecord(targetDir, record) {
-  const file = join49(targetDir, SCAFFOLD_RECORD_PATH);
-  mkdirSync19(dirname16(file), { recursive: true });
-  writeFileSync33(file, `${JSON.stringify(record, null, 4)}
+  const file = join55(targetDir, SCAFFOLD_RECORD_PATH);
+  mkdirSync19(dirname18(file), { recursive: true });
+  writeFileSync34(file, `${JSON.stringify(record, null, 4)}
 `, "utf8");
 }
 
@@ -13232,9 +14060,9 @@ function requireCatalogUrl(projectDir2) {
 }
 
 // src/kit/local/index.ts
-import { createRequire as createRequire2 } from "module";
-import { join as join53 } from "path";
-import { pathToFileURL as pathToFileURL4 } from "url";
+import { createRequire as createRequire4 } from "module";
+import { join as join59 } from "path";
+import { pathToFileURL as pathToFileURL6 } from "url";
 
 // src/kit/local/process.ts
 import { execa as execa13 } from "execa";
@@ -13382,8 +14210,8 @@ ${result.stdout}`;
 }
 
 // src/kit/local/database.ts
-import { existsSync as existsSync50 } from "fs";
-import { dirname as dirname17, join as join50 } from "path";
+import { existsSync as existsSync54 } from "fs";
+import { dirname as dirname19, join as join56 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var DEFAULT_DATABASE_TIMEOUT_MS = 9e5;
 var SpfnDatabasePort = class {
@@ -13466,13 +14294,13 @@ function spfnCommand() {
   return bin === null ? { file: "spfn", args: [] } : { file: process.execPath, args: [bin] };
 }
 function resolveSpfnBin(from = fileURLToPath3(import.meta.url)) {
-  let directory = dirname17(from);
+  let directory = dirname19(from);
   for (let depth = 0; depth < 8; depth += 1) {
-    const candidate = join50(directory, "bin", "spfn.js");
-    if (existsSync50(candidate)) {
+    const candidate = join56(directory, "bin", "spfn.js");
+    if (existsSync54(candidate)) {
       return candidate;
     }
-    const parent = dirname17(directory);
+    const parent = dirname19(directory);
     if (parent === directory) {
       break;
     }
@@ -13482,8 +14310,8 @@ function resolveSpfnBin(from = fileURLToPath3(import.meta.url)) {
 }
 
 // src/kit/local/gates.ts
-import { existsSync as existsSync51, readFileSync as readFileSync30 } from "fs";
-import { join as join51 } from "path";
+import { existsSync as existsSync55, readFileSync as readFileSync33 } from "fs";
+import { join as join57 } from "path";
 var DEFAULT_GATE_TIMEOUT_MS = 9e5;
 var GATE_PLANS = {
   "kit-check": { scripts: [], fallback: spfnFallback(["kit", "check", "--json"]) },
@@ -13534,12 +14362,12 @@ var CommandGatePort = class {
   }
 };
 function projectScripts(cwd) {
-  const file = join51(cwd, "package.json");
-  if (!existsSync51(file)) {
+  const file = join57(cwd, "package.json");
+  if (!existsSync55(file)) {
     return {};
   }
   try {
-    const parsed = JSON.parse(readFileSync30(file, "utf8"));
+    const parsed = JSON.parse(readFileSync33(file, "utf8"));
     return parsed.scripts ?? {};
   } catch {
     return {};
@@ -13551,8 +14379,8 @@ function spfnFallback(args) {
 }
 
 // src/kit/local/git.ts
-import { existsSync as existsSync52 } from "fs";
-import { join as join52 } from "path";
+import { existsSync as existsSync56 } from "fs";
+import { join as join58 } from "path";
 var FALLBACK_AUTHOR_NAME = "spfn kit";
 var FALLBACK_AUTHOR_EMAIL = "kit@superfunction.xyz";
 var DEFAULT_GIT_TIMEOUT_MS = 12e4;
@@ -13563,7 +14391,7 @@ var SystemGitPort = class {
   }
   /** Start a repository, or leave the one that is already there alone. */
   async init(request2) {
-    if (existsSync52(join52(request2.cwd, ".git"))) {
+    if (existsSync56(join58(request2.cwd, ".git"))) {
       return;
     }
     const result = await this.git(request2.cwd, ["init"]);
@@ -13680,8 +14508,8 @@ function createKitLocalPorts(options = {}) {
 }
 function createProjectModuleLoader() {
   return async (specifier, projectDir2) => {
-    const resolve4 = createRequire2(join53(projectDir2, "package.json"));
-    return import(pathToFileURL4(resolve4.resolve(specifier)).href);
+    const resolve7 = createRequire4(join59(projectDir2, "package.json"));
+    return import(pathToFileURL6(resolve7.resolve(specifier)).href);
   };
 }