spfn 0.3.0-beta.6 → 0.3.0-beta.7

package/dist/index.js

@@ -948,7 +948,7 @@ import { dirname as dirname2, join as join10 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getCliVersion() {
   if (true) {
-    return "0.3.0-beta.6";
+    return "0.3.0-beta.7";
   }
   return fromPackageJson ?? (fromPackageJson = readPackageVersion());
 }
@@ -1190,6 +1190,7 @@ function envLocalTemplate(mode) {
 # Full scaffold: auth session encryption (Next.js server only; never NEXT_PUBLIC_*)
 SPFN_AUTH_SESSION_SECRET=${randomSecret("base64url")}
 SPFN_AUTH_SESSION_TTL=7d
+${CSRF_ENV_LINES}
 NEXT_PUBLIC_SPFN_APP_URL=http://localhost:3790
 `;
 }
@@ -1386,7 +1387,7 @@ function updateTsconfig(cwd) {
     logger.warn('Could not update tsconfig.json (you can add "src/server" to exclude manually)');
   }
 }
-var writeFileSync8, ENV_LOCAL_TEMPLATE, FULL_ENV_LOCAL_EXAMPLE, ENV_SERVER_TEMPLATE, FULL_ENV_SERVER_EXAMPLE;
+var writeFileSync8, ENV_LOCAL_TEMPLATE, CSRF_ENV_LINES, FULL_ENV_LOCAL_EXAMPLE, ENV_SERVER_TEMPLATE, FULL_ENV_SERVER_EXAMPLE;
 var init_config_files = __esm({
   "src/commands/init/steps/config-files.ts"() {
     "use strict";
@@ -1404,10 +1405,13 @@ NEXT_PUBLIC_SPFN_API_URL=http://localhost:8790
 # Next.js app URL (used by the SPFN server for CORS/redirects)
 SPFN_APP_URL=http://localhost:3790
 `;
+    CSRF_ENV_LINES = `# CSRF for cookie-session mutations: off | warn | enforce (unset = warn)
+SPFN_AUTH_CSRF=enforce`;
     FULL_ENV_LOCAL_EXAMPLE = `
 # Full scaffold: auth session encryption (Next.js server only; never NEXT_PUBLIC_*)
 SPFN_AUTH_SESSION_SECRET=replace-with-a-random-secret-at-least-32-characters
 SPFN_AUTH_SESSION_TTL=7d
+${CSRF_ENV_LINES}
 NEXT_PUBLIC_SPFN_APP_URL=http://localhost:3790
 `;
     ENV_SERVER_TEMPLATE = `# SPFN backend environment
@@ -1981,16 +1985,182 @@ init_init();
 
 // src/commands/dev.ts
 init_logger();
-init_package_manager();
 import { Command as Command4 } from "commander";
-import { existsSync as existsSync15, readFileSync as readFileSync8, writeFileSync as writeFileSync10, mkdirSync, unlinkSync, rmSync, watch } from "fs";
-import { join as join16, relative, sep as sep2 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync9, writeFileSync as writeFileSync11, mkdirSync, unlinkSync, rmSync, watch } from "fs";
+import { join as join17, relative, sep as sep2 } from "path";
 import { execa as execa6 } from "execa";
 import chokidar from "chokidar";
 
+// src/lib/agent-instructions.ts
+import { existsSync as existsSync15, readFileSync as readFileSync8, writeFileSync as writeFileSync10 } from "fs";
+import { join as join15 } from "path";
+
+// src/lib/agent-instructions-template.ts
+init_version();
+var BEGIN_MARKER = "<!-- spfn:agent-instructions:begin \u2014 generated by spfn dev; edits inside are overwritten -->";
+var END_MARKER = "<!-- spfn:agent-instructions:end -->";
+function renderAgentInstructions(version = getCliVersion()) {
+  return `${BEGIN_MARKER}
+## SPFN conventions for coding agents
+
+This is not the stack you know. An SPFN app looks like Next.js plus Drizzle, but
+its idioms are not the ecosystem defaults, and code written from general priors
+is wrong here. Read the docs below before writing server, data or auth code.
+
+**Data access.** Every query goes through a repository extending
+\`BaseRepository\` \u2014 \`this.db\` writes, \`this.readDb\` reads. Handlers and
+services never import drizzle query builders directly.
+
+\`\`\`typescript
+import { BaseRepository } from '@spfn/core/db';
+import { orders } from '../entities/order.entity';
+
+export class OrderRepository extends BaseRepository
+{
+    async findByCustomer(customerId: bigint)
+    {
+        return this._findMany(orders, { where: { customerId } });
+    }
+}
+\`\`\`
+
+The scaffold's \`src/server/repositories/\` shows the shape.
+
+**Transactions.** Wrap the route in \`Transactional()\`, or call
+\`runInTransaction\` in a service or script. Never accept or pass a \`tx\`
+parameter: repositories pick the transaction up from the async context. Side
+effects that must not fire on a rollback go in \`onAfterCommit(...)\`.
+
+**Auth.** Read the principal with \`getAuth(c)\` from \`@spfn/auth/server\`.
+Authorization is declared route middleware \u2014
+\`.use([authenticate, requirePermissions('order:write')])\` \u2014 never an ad-hoc
+check inside the handler body.
+
+**Frontend data.** A page's initial data is awaited in a Server Component
+through the isomorphic \`api.\` client; cookies forward automatically. Fetching
+initial data from a \`'use client'\` component in \`useEffect\` is the
+anti-pattern. Mutations go through server actions, or the same \`api.\` client
+from a Client Component.
+
+**Generated files.** Route maps under \`src/generated/\` come from
+\`pnpm codegen\` \u2014 never hand-edit them. Migrations come from
+\`spfn db generate\` off the entities; never hand-write migration SQL.
+
+**Read before writing.** \`node_modules/@spfn/core/README.md\`,
+\`node_modules/@spfn/core/src/db/README.md\`, \`node_modules/@spfn/auth/README.md\`.
+Online: \`https://superfunction.xyz/docs/packages/core/<module>\` for cache,
+codegen, config, db, env, errors, event, job, logger, middleware, nextjs, route,
+security and server; \`https://superfunction.xyz/docs/guides/<guide>\` for
+authentication, custom-generators, deployment, file-upload, monitoring and
+websockets. Do not guess other paths \u2014 they 404.
+
+<!-- spfn CLI v${version} -->
+${END_MARKER}`;
+}
+
+// src/lib/agent-instructions.ts
+var AGENTS_FILE = "AGENTS.md";
+var CLAUDE_FILE = "CLAUDE.md";
+function syncAgentInstructions(projectRoot, options = {}) {
+  if (isOptedOut(options)) {
+    return { action: "skipped" };
+  }
+  const agentsPath = join15(projectRoot, AGENTS_FILE);
+  const block = renderAgentInstructions();
+  if (!existsSync15(agentsPath)) {
+    writeFileSync10(agentsPath, `${block}
+`, "utf8");
+    ensureClaudeReference(projectRoot);
+    return { action: "created" };
+  }
+  const content = withoutByteOrderMark(readFileSync8(agentsPath, "utf8"));
+  const lines = content.split("\n");
+  const location = locateBlock(lines);
+  if (location.kind === "malformed") {
+    return {
+      action: "skipped",
+      warning: `${AGENTS_FILE} has a malformed spfn block \u2014 expected exactly one "${BEGIN_MARKER}" line followed by one "${END_MARKER}" line. Fix or delete the markers; nothing was written.`
+    };
+  }
+  ensureClaudeReference(projectRoot);
+  if (location.kind === "absent") {
+    const eol = content.includes("\r\n") ? "\r\n" : "\n";
+    const existing = content.replace(/(\r?\n)+$/, "");
+    const separator = existing.length > 0 ? `${eol}${eol}` : "";
+    writeFileSync10(agentsPath, `${existing}${separator}${block.split("\n").join(eol)}${eol}`, "utf8");
+    return { action: "appended" };
+  }
+  const carriageReturn = lines[location.begin].endsWith("\r") ? "\r" : "";
+  const blockLines = block.split("\n").map((line) => line + carriageReturn);
+  const currentLines = lines.slice(location.begin, location.end + 1);
+  if (currentLines.length === blockLines.length && currentLines.every((line, index) => line === blockLines[index])) {
+    return { action: "unchanged" };
+  }
+  lines.splice(location.begin, location.end - location.begin + 1, ...blockLines);
+  writeFileSync10(agentsPath, lines.join("\n"), "utf8");
+  return { action: "replaced" };
+}
+function isOptedOut(options) {
+  const fromEnv = (process.env.SPFN_AGENT_FILES ?? "").toLowerCase();
+  return options.agentFiles === false || fromEnv === "0" || fromEnv === "false";
+}
+function locateBlock(lines) {
+  const fenced = fencedLines(lines);
+  const begins = lineIndicesOf(lines, BEGIN_MARKER, fenced);
+  const ends = lineIndicesOf(lines, END_MARKER, fenced);
+  if (begins.length === 0 && ends.length === 0) {
+    return { kind: "absent" };
+  }
+  if (begins.length !== 1 || ends.length !== 1 || ends[0] < begins[0]) {
+    return { kind: "malformed" };
+  }
+  return { kind: "found", begin: begins[0], end: ends[0] };
+}
+function lineIndicesOf(lines, marker, fenced) {
+  const found = [];
+  lines.forEach((line, index) => {
+    if (!fenced[index] && withoutCarriageReturn(line) === marker) {
+      found.push(index);
+    }
+  });
+  return found;
+}
+var FENCE_LINE = /^\s*(`{3,}|~{3,})(.*)$/;
+function fencedLines(lines) {
+  let open = null;
+  return lines.map((rawLine) => {
+    const fence = FENCE_LINE.exec(withoutCarriageReturn(rawLine));
+    if (open === null) {
+      open = fence ? { character: fence[1][0], length: fence[1].length } : null;
+      return false;
+    }
+    if (fence && fence[1][0] === open.character && fence[1].length >= open.length && fence[2].trim() === "") {
+      open = null;
+    }
+    return true;
+  });
+}
+function withoutCarriageReturn(line) {
+  return line.endsWith("\r") ? line.slice(0, -1) : line;
+}
+function withoutByteOrderMark(content) {
+  return content.startsWith("\uFEFF") ? content.slice(1) : content;
+}
+function ensureClaudeReference(projectRoot) {
+  const claudePath = join15(projectRoot, CLAUDE_FILE);
+  if (existsSync15(claudePath)) {
+    return;
+  }
+  writeFileSync10(claudePath, `@${AGENTS_FILE}
+`, "utf8");
+}
+
+// src/commands/dev.ts
+init_package_manager();
+
 // src/utils/secret-store/index.ts
 init_env_file();
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 
 // src/utils/secret-store/macos.ts
 import { execa as execa4 } from "execa";
@@ -2177,7 +2347,7 @@ function keychainRef(key) {
   return `${KEYCHAIN_REF_PREFIX}${keychainName(key)}`;
 }
 async function resolveKeychainEnv(cwd) {
-  const parsed = parseEnvFile(join15(cwd, ".env.server"));
+  const parsed = parseEnvFile(join16(cwd, ".env.server"));
   const refs = Object.entries(parsed).filter(([, value]) => value.startsWith(KEYCHAIN_REF_PREFIX));
   if (refs.length === 0) {
     return { env: {}, missing: [] };
@@ -2205,33 +2375,45 @@ import { loadAppConfig, resolvePorts, resolveHost } from "@spfn/core/app-config"
 function ignoreDotfilesUnder(root) {
   return (watchedPath) => relative(root, watchedPath).split(sep2).some((segment) => segment.startsWith(".") && segment !== "." && segment !== "..");
 }
+function writeAgentInstructions(cwd, agentFiles) {
+  try {
+    const { action, warning } = syncAgentInstructions(cwd, { agentFiles });
+    if (warning) {
+      logger.warn(`[SPFN] ${warning}`);
+    } else if (action !== "unchanged" && action !== "skipped") {
+      logger.info(`[SPFN] Agent instructions ${action} in AGENTS.md`);
+    }
+  } catch (error) {
+    logger.warn(`[SPFN] Could not write the agent instruction files (AGENTS.md, CLAUDE.md): ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
 function waitForReadyFile(filePath, timeoutMs = 3e4) {
   return new Promise((resolve4, reject) => {
-    if (existsSync15(filePath)) {
+    if (existsSync16(filePath)) {
       unlinkSync(filePath);
     }
     const timer = setTimeout(() => {
       watcher.close();
       reject(new Error(`Server did not become ready within ${timeoutMs / 1e3}s`));
     }, timeoutMs);
-    const dir = join16(filePath, "..");
+    const dir = join17(filePath, "..");
     const fileName = filePath.split("/").pop();
     const watcher = watch(dir, (_event, name) => {
-      if (name === fileName && existsSync15(filePath)) {
+      if (name === fileName && existsSync16(filePath)) {
         watcher.close();
         clearTimeout(timer);
-        resolve4(readFileSync8(filePath, "utf-8").trim());
+        resolve4(readFileSync9(filePath, "utf-8").trim());
       }
     });
   });
 }
-var devCommand = new Command4("dev").description("Start SPFN development server (detects and runs Next.js + Hono)").option("-p, --port <port>", "Server port").option("-H, --host <host>", "Server host").option("--server-only", "Run only Hono server (skip Next.js)").option("--watch", "Enable hot reload (watch mode)").option("--allow-pending-migrations", "Start even when migrations are pending (they are listed as a warning)").action(async (options) => {
+var devCommand = new Command4("dev").description("Start SPFN development server (detects and runs Next.js + Hono)").option("-p, --port <port>", "Server port").option("-H, --host <host>", "Server host").option("--server-only", "Run only Hono server (skip Next.js)").option("--watch", "Enable hot reload (watch mode)").option("--allow-pending-migrations", "Start even when migrations are pending (they are listed as a warning)").option("--no-agent-files", "Do not write the SPFN instruction block into AGENTS.md (same as SPFN_AGENT_FILES=0)").action(async (options) => {
   process.setMaxListeners(20);
   if (!process.env.NODE_ENV) {
     process.env.NODE_ENV = "development";
   }
   const cwd = process.cwd();
-  const serverDir = join16(cwd, "src", "server");
+  const serverDir = join17(cwd, "src", "server");
   if (options.port) {
     process.env.SPFN_PORT = String(options.port);
   }
@@ -2241,11 +2423,12 @@ var devCommand = new Command4("dev").description("Start SPFN development server
   const appConfig = await loadAppConfig(cwd);
   const { next: nextPort, server: serverPort } = resolvePorts(appConfig);
   const serverHost = resolveHost(appConfig);
-  if (!existsSync15(serverDir)) {
+  if (!existsSync16(serverDir)) {
     logger.error("src/server directory not found.");
     logger.info('Run "spfn init" first to initialize SPFN in your project.');
     process.exit(1);
   }
+  writeAgentInstructions(cwd, options.agentFiles !== false);
   const { env: keychainEnv, missing: keychainMissing } = await resolveKeychainEnv(cwd);
   const injectedCount = Object.keys(keychainEnv).length;
   if (injectedCount > 0) {
@@ -2267,28 +2450,28 @@ var devCommand = new Command4("dev").description("Start SPFN development server
   if (migrationCheck.allowPending) {
     serverEnv.SPFN_ALLOW_PENDING_MIGRATIONS = "true";
   }
-  const packageJsonPath = join16(cwd, "package.json");
+  const packageJsonPath = join17(cwd, "package.json");
   let hasNext = false;
-  if (existsSync15(packageJsonPath)) {
-    const packageJson = JSON.parse(readFileSync8(packageJsonPath, "utf-8"));
+  if (existsSync16(packageJsonPath)) {
+    const packageJson = JSON.parse(readFileSync9(packageJsonPath, "utf-8"));
     hasNext = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
   }
-  const tempDir = join16(cwd, ".spfn");
-  const serverEntry = join16(tempDir, "server.mjs");
-  const watcherEntry = join16(tempDir, "watcher.mjs");
+  const tempDir = join17(cwd, ".spfn");
+  const serverEntry = join17(tempDir, "server.mjs");
+  const watcherEntry = join17(tempDir, "watcher.mjs");
   mkdirSync(tempDir, { recursive: true });
-  const serverBuildDir = join16(tempDir, "server");
-  if (existsSync15(serverBuildDir)) {
+  const serverBuildDir = join17(tempDir, "server");
+  if (existsSync16(serverBuildDir)) {
     rmSync(serverBuildDir, { recursive: true, force: true });
     logger.info("[SPFN] Cleaned stale build cache (.spfn/server)");
   }
-  const readySignal = join16(tempDir, "server-ready");
-  if (existsSync15(readySignal)) {
+  const readySignal = join17(tempDir, "server-ready");
+  if (existsSync16(readySignal)) {
     unlinkSync(readySignal);
   }
   const configParts = ["debug: true"];
-  const readyFile = join16(tempDir, "server-ready");
-  writeFileSync10(serverEntry, `
+  const readyFile = join17(tempDir, "server-ready");
+  writeFileSync11(serverEntry, `
 import { writeFileSync } from 'fs';
 
 // Load environment variables FIRST (before any imports that depend on them)
@@ -2304,7 +2487,7 @@ const instance = await startServer({
 // Signal ready with actual port
 writeFileSync(${JSON.stringify(readyFile)}, String(instance.config.port));
 `);
-  writeFileSync10(watcherEntry, `
+  writeFileSync11(watcherEntry, `
 // Load environment variables
 // const { loadEnvFiles } = await import('@spfn/core/server');
 // loadEnvFiles();
@@ -2575,8 +2758,8 @@ catch (error)
 init_logger();
 init_package_manager();
 import { Command as Command5 } from "commander";
-import { existsSync as existsSync16, writeFileSync as writeFileSync11, mkdirSync as mkdirSync2, readdirSync } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync17, writeFileSync as writeFileSync12, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { join as join18 } from "path";
 import { execa as execa7 } from "execa";
 import ora5 from "ora";
 import chalk7 from "chalk";
@@ -2603,16 +2786,16 @@ async function buildProject(options) {
   }
   const cwd = process.cwd();
   const pm = detectPackageManager(cwd);
-  const packageJsonPath = join17(cwd, "package.json");
+  const packageJsonPath = join18(cwd, "package.json");
   let hasNext = false;
-  if (existsSync16(packageJsonPath)) {
+  if (existsSync17(packageJsonPath)) {
     const packageJson = JSON.parse(await import("fs").then(
       (fs5) => fs5.promises.readFile(packageJsonPath, "utf-8")
     ));
     hasNext = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
   }
-  const serverDir = join17(cwd, "src", "server");
-  const hasServer = existsSync16(serverDir);
+  const serverDir = join18(cwd, "src", "server");
+  const hasServer = existsSync17(serverDir);
   console.log(chalk7.blue.bold("\n\u{1F3D7}\uFE0F  Building SPFN project for production...\n"));
   if (hasServer) {
     const spinner = ora5("Generating API client...").start();
@@ -2654,10 +2837,10 @@ async function buildProject(options) {
   if (hasServer && !options.nextOnly) {
     const spinner = ora5("Building SPFN server...").start();
     try {
-      const outputDir = join17(cwd, ".spfn", "server");
+      const outputDir = join18(cwd, ".spfn", "server");
       mkdirSync2(outputDir, { recursive: true });
-      const serverDir2 = join17(cwd, "src", "server");
-      if (!existsSync16(serverDir2)) {
+      const serverDir2 = join18(cwd, "src", "server");
+      if (!existsSync17(serverDir2)) {
         spinner.fail("SPFN server build failed");
         logger.error("src/server/ directory not found");
         logger.error('Please run "spfn init" to initialize the project.');
@@ -2691,12 +2874,12 @@ async function buildProject(options) {
         onSuccess: async () => {
         }
       });
-      const prodServerPath = join17(cwd, ".spfn", "prod-server.mjs");
+      const prodServerPath = join18(cwd, ".spfn", "prod-server.mjs");
       const prodServerContent = renderProdServerEntry();
-      writeFileSync11(prodServerPath, prodServerContent);
+      writeFileSync12(prodServerPath, prodServerContent);
       spinner.succeed(`SPFN server build completed \u2192 .spfn/server`);
-      const routesDir = join17(cwd, ".spfn", "server", "routes");
-      if (existsSync16(routesDir)) {
+      const routesDir = join18(cwd, ".spfn", "server", "routes");
+      if (existsSync17(routesDir)) {
         console.log();
         console.log(chalk7.bold("Route (api)"));
         try {
@@ -2752,8 +2935,8 @@ var buildCommand = new Command5("build").description("Build SPFN project for pro
 init_logger();
 init_package_manager();
 import { Command as Command6 } from "commander";
-import { existsSync as existsSync17, readFileSync as readFileSync9 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync10 } from "fs";
+import { join as join19 } from "path";
 import { execa as execa8 } from "execa";
 import chalk8 from "chalk";
 import { loadAppConfig as loadAppConfig2, resolvePorts as resolvePorts2 } from "@spfn/core/app-config";
@@ -2762,16 +2945,16 @@ var startCommand = new Command6("start").description("Start SPFN production serv
     process.env.NODE_ENV = "production";
   }
   const cwd = process.cwd();
-  const packageJsonPath = join18(cwd, "package.json");
+  const packageJsonPath = join19(cwd, "package.json");
   let hasNext = false;
-  if (existsSync17(packageJsonPath)) {
-    const packageJson = JSON.parse(readFileSync9(packageJsonPath, "utf-8"));
+  if (existsSync18(packageJsonPath)) {
+    const packageJson = JSON.parse(readFileSync10(packageJsonPath, "utf-8"));
     hasNext = !!(packageJson.dependencies?.next || packageJson.devDependencies?.next);
   }
-  const builtServerDir = join18(cwd, ".spfn", "server");
-  const hasBuiltServer = existsSync17(builtServerDir);
-  const nextBuildDir = join18(cwd, ".next");
-  const hasNextBuild = existsSync17(nextBuildDir);
+  const builtServerDir = join19(cwd, ".spfn", "server");
+  const hasBuiltServer = existsSync18(builtServerDir);
+  const nextBuildDir = join19(cwd, ".next");
+  const hasNextBuild = existsSync18(nextBuildDir);
   if (!options.nextOnly && !hasBuiltServer) {
     logger.error('.spfn/server directory not found. Please run "spfn build" first.');
     process.exit(1);
@@ -2781,8 +2964,8 @@ var startCommand = new Command6("start").description("Start SPFN production serv
     process.exit(1);
   }
   const pm = detectPackageManager(cwd);
-  const serverEntry = join18(cwd, ".spfn", "prod-server.mjs");
-  if (!existsSync17(serverEntry)) {
+  const serverEntry = join19(cwd, ".spfn", "prod-server.mjs");
+  if (!existsSync18(serverEntry)) {
     logger.error('.spfn/prod-server.mjs not found. Please run "spfn build" first.');
     process.exit(1);
   }
@@ -2864,8 +3047,8 @@ var startCommand = new Command6("start").description("Start SPFN production serv
 init_logger();
 init_package_manager();
 import { Command as Command7 } from "commander";
-import { existsSync as existsSync18, mkdirSync as mkdirSync3, writeFileSync as writeFileSync12 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync3, writeFileSync as writeFileSync13 } from "fs";
+import { join as join20 } from "path";
 import { pathToFileURL } from "url";
 import { execa as execa9 } from "execa";
 var CONFIG_FILE_PATHS = [
@@ -2875,7 +3058,7 @@ var CONFIG_FILE_PATHS = [
   "src/server/server.config.js"
 ];
 function findServerConfig(cwd) {
-  return CONFIG_FILE_PATHS.map((path5) => join19(cwd, path5)).find(existsSync18);
+  return CONFIG_FILE_PATHS.map((path5) => join20(cwd, path5)).find(existsSync19);
 }
 var provisionCommand = new Command7("provision").description("Run deploy-time provisioning (seed/RBAC lifecycle hooks) \u2014 once per deploy, not per cold start").action(async () => {
   if (!process.env.NODE_ENV) {
@@ -2896,10 +3079,10 @@ var provisionCommand = new Command7("provision").description("Run deploy-time pr
   if (keychainMissing.length > 0) {
     logger.warn(`[SPFN] Could not resolve keychain secret(s): ${keychainMissing.join(", ")} \u2014 run \`spfn secret set <KEY>\``);
   }
-  const tempDir = join19(cwd, ".spfn");
-  const runnerEntry = join19(tempDir, "provision.mjs");
+  const tempDir = join20(cwd, ".spfn");
+  const runnerEntry = join20(tempDir, "provision.mjs");
   mkdirSync3(tempDir, { recursive: true });
-  writeFileSync12(runnerEntry, `
+  writeFileSync13(runnerEntry, `
 if (!process.env.NODE_ENV)
 {
     process.env.NODE_ENV = 'production';
@@ -2942,13 +3125,13 @@ process.exit(0);
 // src/commands/codegen.ts
 init_logger();
 import { Command as Command8 } from "commander";
-import { existsSync as existsSync19, writeFileSync as writeFileSync13 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync20, writeFileSync as writeFileSync14 } from "fs";
+import { join as join21 } from "path";
 import chalk9 from "chalk";
 async function initCodegen(options) {
   const cwd = process.cwd();
-  const rcPath = join20(cwd, ".spfnrc.ts");
-  if (existsSync19(rcPath)) {
+  const rcPath = join21(cwd, ".spfnrc.ts");
+  if (existsSync20(rcPath)) {
     logger.warn(".spfnrc.ts already exists");
     logger.info("Edit manually to add custom generators");
     process.exit(0);
@@ -2973,7 +3156,7 @@ export default defineConfig({
     ],
 });
 `;
-  writeFileSync13(rcPath, content);
+  writeFileSync14(rcPath, content);
   console.log("\n" + chalk9.green.bold("\u2713 Created .spfnrc.ts\n"));
   console.log(chalk9.gray("Configured the @spfn/core:route-map generator."));
   if (options.withExample) {
@@ -3041,18 +3224,18 @@ codegenCommand.command("run").description("Run code generators once (no watch mo
 // src/commands/contract.ts
 init_logger();
 import { Command as Command9 } from "commander";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 import chalk10 from "chalk";
 async function resolveContractsDir(cwd, override) {
   if (override) {
-    return join21(cwd, override);
+    return join22(cwd, override);
   }
   const { loadCodegenConfig } = await import("@spfn/core/codegen");
   const config = loadCodegenConfig(cwd);
   const generator = config.generators?.find(
     (entry) => "name" in entry && entry.name === "@spfn/core:contract"
   );
-  return join21(cwd, generator?.outputDir ?? "./contracts");
+  return join22(cwd, generator?.outputDir ?? "./contracts");
 }
 async function regenerate(cwd) {
   const { loadCodegenConfig, createGeneratorsFromConfig, CodegenOrchestrator } = await import("@spfn/core/codegen");
@@ -3320,7 +3503,7 @@ import { Command as Command11 } from "commander";
 import chalk13 from "chalk";
 
 // src/commands/db/utils/drizzle.ts
-import { existsSync as existsSync20, writeFileSync as writeFileSync14, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync21, writeFileSync as writeFileSync15, unlinkSync as unlinkSync2 } from "fs";
 import { spawn } from "child_process";
 import { pathToFileURL as pathToFileURL2 } from "url";
 import chalk12 from "chalk";
@@ -3387,7 +3570,7 @@ function validateDatabasePrerequisites() {
   }
 }
 async function runDrizzleCommand(command) {
-  const hasUserConfig = existsSync20("./drizzle.config.ts");
+  const hasUserConfig = existsSync21("./drizzle.config.ts");
   const tempConfigPath = `./drizzle.config.${process.pid}.${Date.now()}.temp.ts`;
   const configPath = hasUserConfig ? "./drizzle.config.ts" : tempConfigPath;
   if (!hasUserConfig) {
@@ -3406,7 +3589,7 @@ async function runDrizzleCommand(command) {
       expandGlobs: true,
       autoDetectSchemas: true
     });
-    writeFileSync14(tempConfigPath, configContent);
+    writeFileSync15(tempConfigPath, configContent);
     console.log(chalk12.dim("Using auto-generated Drizzle config\n"));
   }
   const args = command.split(" ");
@@ -3419,7 +3602,7 @@ async function runDrizzleCommand(command) {
       env: shouldRelaxDbTls(env2.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
     });
     const cleanup = () => {
-      if (!hasUserConfig && existsSync20(tempConfigPath)) {
+      if (!hasUserConfig && existsSync21(tempConfigPath)) {
         unlinkSync2(tempConfigPath);
       }
     };
@@ -3739,8 +3922,8 @@ async function applyFunctionMigrations(plans) {
 
 // src/commands/db/migrate.ts
 import chalk21 from "chalk";
-import { join as join22 } from "path";
-import { existsSync as existsSync22 } from "fs";
+import { join as join23 } from "path";
+import { existsSync as existsSync23 } from "fs";
 
 // src/commands/db/backup.ts
 import { promises as fs3 } from "fs";
@@ -3833,7 +4016,7 @@ function formatTimestamp() {
 
 // src/commands/db/utils/backup-files.ts
 import { promises as fs2 } from "fs";
-import { existsSync as existsSync21 } from "fs";
+import { existsSync as existsSync22 } from "fs";
 import path2 from "path";
 import chalk19 from "chalk";
 
@@ -3933,7 +4116,7 @@ async function ensureBackupInGitignore() {
   const gitignorePath = path2.join(process.cwd(), ".gitignore");
   try {
     let content = "";
-    let exists = existsSync21(gitignorePath);
+    let exists = existsSync22(gitignorePath);
     if (exists) {
       content = await fs2.readFile(gitignorePath, "utf-8");
     }
@@ -3955,7 +4138,7 @@ async function ensureBackupDir() {
   try {
     await fs2.mkdir(backupDir, { recursive: true });
     const gitignorePath = path2.join(backupDir, ".gitignore");
-    const gitignoreExists = existsSync21(gitignorePath);
+    const gitignoreExists = existsSync22(gitignorePath);
     if (!gitignoreExists) {
       await fs2.writeFile(gitignorePath, "# Ignore all backup files\n*.sql\n*.dump\n*.meta.json\n");
     }
@@ -4149,8 +4332,8 @@ async function dbMigrate(options = {}) {
     await executeFunctionMigrations2(loadFunctionMigrationPlans2(functions));
     console.log(chalk21.green("\u2705 Function migrations applied\n"));
   }
-  const projectMigrationsDir = join22(process.cwd(), "src/server/drizzle");
-  if (existsSync22(projectMigrationsDir)) {
+  const projectMigrationsDir = join23(process.cwd(), "src/server/drizzle");
+  if (existsSync23(projectMigrationsDir)) {
     const projConn = postgres.default(env5.DATABASE_URL, { max: 1 });
     const projDb = drizzle({ client: projConn });
     try {
@@ -4256,7 +4439,7 @@ function printReport(report2) {
 
 // src/commands/db/studio.ts
 import chalk23 from "chalk";
-import { existsSync as existsSync23, writeFileSync as writeFileSync15, unlinkSync as unlinkSync3 } from "fs";
+import { existsSync as existsSync24, writeFileSync as writeFileSync16, unlinkSync as unlinkSync3 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { env as env6 } from "@spfn/core/config";
 async function dbStudio(requestedPort) {
@@ -4274,7 +4457,7 @@ async function dbStudio(requestedPort) {
     console.error(chalk23.red(error instanceof Error ? error.message : "Failed to find available port"));
     process.exit(1);
   }
-  const hasUserConfig = existsSync23("./drizzle.config.ts");
+  const hasUserConfig = existsSync24("./drizzle.config.ts");
   const tempConfigPath = `./drizzle.config.${process.pid}.${Date.now()}.temp.ts`;
   try {
     const configPath = hasUserConfig ? "./drizzle.config.ts" : tempConfigPath;
@@ -4291,7 +4474,7 @@ async function dbStudio(requestedPort) {
         expandGlobs: true
         // Expand glob patterns for Studio compatibility
       });
-      writeFileSync15(tempConfigPath, configContent);
+      writeFileSync16(tempConfigPath, configContent);
       console.log(chalk23.dim("Using auto-generated Drizzle config\n"));
     }
     const studioProcess = spawn3("drizzle-kit", ["studio", `--port=${port}`, `--config=${configPath}`], {
@@ -4300,7 +4483,7 @@ async function dbStudio(requestedPort) {
       env: shouldRelaxDbTls(env6.DATABASE_URL) ? { ...process.env, NODE_TLS_REJECT_UNAUTHORIZED: "0" } : { ...process.env }
     });
     const cleanup = () => {
-      if (!hasUserConfig && existsSync23(tempConfigPath)) {
+      if (!hasUserConfig && existsSync24(tempConfigPath)) {
         unlinkSync3(tempConfigPath);
       }
     };
@@ -4330,7 +4513,7 @@ async function dbStudio(requestedPort) {
       process.exit(0);
     });
   } catch (error) {
-    if (!hasUserConfig && existsSync23(tempConfigPath)) {
+    if (!hasUserConfig && existsSync24(tempConfigPath)) {
       unlinkSync3(tempConfigPath);
     }
     console.error(chalk23.red("\u274C Failed to start Drizzle Studio"));
@@ -4717,8 +4900,8 @@ async function dbBackupClean(options) {
 }
 
 // src/commands/db/reindex.ts
-import { existsSync as existsSync24, readFileSync as readFileSync10, writeFileSync as writeFileSync16, renameSync, copyFileSync } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync11, writeFileSync as writeFileSync17, renameSync, copyFileSync } from "fs";
+import { join as join24 } from "path";
 import chalk29 from "chalk";
 import { loadEnv as loadEnv9 } from "@spfn/core/server";
 function isTimestampPrefix(tag) {
@@ -4740,13 +4923,13 @@ async function dbReindex(options = {}) {
   const { getDrizzleConfig } = await import("@spfn/core/db");
   const config = getDrizzleConfig({ disablePackageDiscovery: true });
   const outDir = config.out;
-  const journalPath = join23(outDir, "meta", "_journal.json");
-  if (!existsSync24(journalPath)) {
+  const journalPath = join24(outDir, "meta", "_journal.json");
+  if (!existsSync25(journalPath)) {
     console.error(chalk29.red("\u274C No _journal.json found at:"), journalPath);
     console.log(chalk29.yellow("\u{1F4A1} Run `spfn db generate` first to create migrations"));
     process.exit(1);
   }
-  const journal = JSON.parse(readFileSync10(journalPath, "utf-8"));
+  const journal = JSON.parse(readFileSync11(journalPath, "utf-8"));
   if (journal.entries.length === 0) {
     console.log(chalk29.yellow("No migration entries found \u2014 nothing to reindex."));
     return;
@@ -4762,14 +4945,14 @@ async function dbReindex(options = {}) {
     const { prefix: oldPrefix, suffix } = parseTag(entry.tag);
     const newPrefix = String(entry.when);
     const newTag = suffix ? `${newPrefix}_${suffix}` : newPrefix;
-    const oldSql = join23(outDir, `${entry.tag}.sql`);
-    const newSql = join23(outDir, `${newTag}.sql`);
-    if (existsSync24(oldSql)) {
+    const oldSql = join24(outDir, `${entry.tag}.sql`);
+    const newSql = join24(outDir, `${newTag}.sql`);
+    if (existsSync25(oldSql)) {
       renames.push({ type: "sql", from: oldSql, to: newSql });
     }
-    const oldSnapshot = join23(outDir, "meta", `${oldPrefix}_snapshot.json`);
-    const newSnapshot = join23(outDir, "meta", `${newPrefix}_snapshot.json`);
-    if (existsSync24(oldSnapshot)) {
+    const oldSnapshot = join24(outDir, "meta", `${oldPrefix}_snapshot.json`);
+    const newSnapshot = join24(outDir, "meta", `${newPrefix}_snapshot.json`);
+    if (existsSync25(oldSnapshot)) {
       renames.push({ type: "snapshot", from: oldSnapshot, to: newSnapshot });
     }
     tagUpdates.push({ idx: entry.idx, oldTag: entry.tag, newTag });
@@ -4812,7 +4995,7 @@ async function dbReindex(options = {}) {
       entry.tag = update.newTag;
     }
   }
-  writeFileSync16(journalPath, JSON.stringify(journal, null, 2) + "\n");
+  writeFileSync17(journalPath, JSON.stringify(journal, null, 2) + "\n");
   console.log(chalk29.green(`
 \u2705 Reindex complete \u2014 ${tagUpdates.length} migration(s) converted to timestamp prefix.`));
 }
@@ -4835,21 +5018,21 @@ dbCommand.command("reindex").description("Convert migration files from sequentia
 // src/commands/add.ts
 init_package_manager();
 import { Command as Command12 } from "commander";
-import { existsSync as existsSync26, readFileSync as readFileSync12 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync13 } from "fs";
+import { join as join26 } from "path";
 import { execa as execa10 } from "execa";
 import chalk31 from "chalk";
 import ora11 from "ora";
 
 // src/commands/add-vercel.ts
 init_templates();
-import { copyFileSync as copyFileSync2, existsSync as existsSync25, mkdirSync as mkdirSync4, readFileSync as readFileSync11 } from "fs";
-import { dirname as dirname4, join as join24 } from "path";
+import { copyFileSync as copyFileSync2, existsSync as existsSync26, mkdirSync as mkdirSync4, readFileSync as readFileSync12 } from "fs";
+import { dirname as dirname4, join as join25 } from "path";
 import chalk30 from "chalk";
 var FILES = [
   {
     template: "route.ts",
-    target: join24("src", "app", "api", "backend", "[[...route]]", "route.ts"),
+    target: join25("src", "app", "api", "backend", "[[...route]]", "route.ts"),
     description: "hono/vercel adapter (mounts the SPFN app under /api/backend)"
   },
   {
@@ -4864,7 +5047,7 @@ var FILES = [
   }
 ];
 function registryEnvValue(templatesDir) {
-  const scopeLines = readFileSync11(join24(templatesDir, "npmrc"), "utf8").trim();
+  const scopeLines = readFileSync12(join25(templatesDir, "npmrc"), "utf8").trim();
   const registryUrl = scopeLines.split("\n")[0].split("=")[1];
   const authKey = `${registryUrl.replace(/^https?:/, "").replace(/\/*$/, "/")}:_authToken`;
   return [
@@ -4877,15 +5060,15 @@ function registryEnvValue(templatesDir) {
 async function addVercel() {
   console.log(chalk30.blue("\n\u{1F4E6} Setting up the Vercel serverless target...\n"));
   const cwd = process.cwd();
-  const templatesDir = join24(findTemplatesPath(), "vercel");
+  const templatesDir = join25(findTemplatesPath(), "vercel");
   for (const file of FILES) {
-    const targetPath = join24(cwd, file.target);
-    if (existsSync25(targetPath)) {
+    const targetPath = join25(cwd, file.target);
+    if (existsSync26(targetPath)) {
       console.log(chalk30.yellow(`\u23ED\uFE0F  ${file.target} already exists \u2014 skipped (not overwritten)`));
       continue;
     }
     mkdirSync4(dirname4(targetPath), { recursive: true });
-    copyFileSync2(join24(templatesDir, file.template), targetPath);
+    copyFileSync2(join25(templatesDir, file.template), targetPath);
     console.log(chalk30.green(`\u2705 ${file.target}`) + chalk30.gray(` \u2014 ${file.description}`));
   }
   console.log(chalk30.green("\n\u2705 Vercel target ready!\n"));
@@ -4930,9 +5113,9 @@ async function addPackage(packageName) {
   console.log(chalk31.blue(`
 \u{1F4E6} Setting up ${packageName}...
 `));
-  const pkgPath = join25(process.cwd(), "node_modules", ...packageName.split("/"));
-  const pkgJsonPath = join25(pkgPath, "package.json");
-  if (!existsSync26(pkgJsonPath)) {
+  const pkgPath = join26(process.cwd(), "node_modules", ...packageName.split("/"));
+  const pkgJsonPath = join26(pkgPath, "package.json");
+  if (!existsSync27(pkgJsonPath)) {
     const pm = detectPackageManager(process.cwd());
     const installSpinner = ora11("Installing package...").start();
     try {
@@ -4946,11 +5129,11 @@ async function addPackage(packageName) {
   } else {
     console.log(chalk31.gray("\u2713 Package already installed (using local version)\n"));
   }
-  if (!existsSync26(pkgJsonPath)) {
+  if (!existsSync27(pkgJsonPath)) {
     console.error(chalk31.red(`\u274C Package ${packageName} not found after installation`));
     process.exit(1);
   }
-  const pkgJson = JSON.parse(readFileSync12(pkgJsonPath, "utf-8"));
+  const pkgJson = JSON.parse(readFileSync13(pkgJsonPath, "utf-8"));
   if (pkgJson.spfn?.migrations) {
     console.log(chalk31.blue(`
 \u{1F5C4}\uFE0F  Setting up database for ${packageName}...
@@ -4996,7 +5179,7 @@ var addCommand = new Command12("add").description("Add a capability to this proj
 // src/commands/env.ts
 import { Command as Command13 } from "commander";
 import chalk32 from "chalk";
-import { existsSync as existsSync27, readFileSync as readFileSync13, writeFileSync as writeFileSync17 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync14, writeFileSync as writeFileSync18 } from "fs";
 import { resolve as resolve2 } from "path";
 import { parse as parse2 } from "dotenv";
 
@@ -5287,11 +5470,11 @@ async function initEnvFiles(options) {
 }
 function writeEnvTemplate(cwd, file, vars, force) {
   const filePath = resolve2(cwd, file);
-  if (existsSync27(filePath) && !force) {
+  if (existsSync28(filePath) && !force) {
     console.log(chalk32.yellow(`  \u23ED\uFE0F  ${file} already exists (use --force to overwrite)`));
     return;
   }
-  writeFileSync17(filePath, generateEnvFileContent(vars), "utf-8");
+  writeFileSync18(filePath, generateEnvFileContent(vars), "utf-8");
   console.log(chalk32.green(`  \u2705 ${file} (${vars.length} variables)`));
 }
 function generateEnvFileContent(vars) {
@@ -5336,10 +5519,10 @@ async function checkEnvFiles(options) {
     const warnings = [];
     for (const file of filesToCheck) {
       const filePath = resolve2(cwd, file);
-      if (!existsSync27(filePath)) {
+      if (!existsSync28(filePath)) {
         continue;
       }
-      const content = readFileSync13(filePath, "utf-8");
+      const content = readFileSync14(filePath, "utf-8");
       const parsed = parse2(content);
       for (const [key, value] of Object.entries(parsed)) {
         loadedEnv[key] = { value: value || "", file };
@@ -6046,12 +6229,12 @@ import chalk34 from "chalk";
 
 // src/utils/ops/auth-crypto.ts
 import { createRequire } from "module";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 var CRYPTO_ENTRY_SINCE = "0.3.0-beta.2";
 var CRYPTO_ENTRY = "@spfn/auth/crypto";
 async function importFromApp(specifier) {
-  const requireFromApp = createRequire(join26(process.cwd(), "noop.js"));
+  const requireFromApp = createRequire(join27(process.cwd(), "noop.js"));
   return await import(pathToFileURL3(requireFromApp.resolve(specifier)).href);
 }
 async function loadAuthCrypto() {
@@ -6468,12 +6651,12 @@ function resolveEnv(env9) {
 
 // src/commands/secret/store-value.ts
 init_logger();
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 init_env_file();
 
 // src/utils/sops.ts
 import { execa as execa11 } from "execa";
-import { existsSync as existsSync28, mkdirSync as mkdirSync5, writeFileSync as writeFileSync18 } from "fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync5, writeFileSync as writeFileSync19 } from "fs";
 import { dirname as dirname5 } from "path";
 async function ensureSopsInstalled() {
   try {
@@ -6483,14 +6666,14 @@ async function ensureSopsInstalled() {
   }
 }
 async function sopsDecrypt(absFile) {
-  if (!existsSync28(absFile)) {
+  if (!existsSync29(absFile)) {
     return {};
   }
   const { stdout } = await execa11("sops", ["--decrypt", "--output-type", "json", absFile]);
   return JSON.parse(stdout);
 }
 async function sopsSetValue(absFile, relFile, key, value) {
-  if (existsSync28(absFile)) {
+  if (existsSync29(absFile)) {
     await execa11("sops", ["set", absFile, `["${key}"]`, JSON.stringify(value)]);
     return;
   }
@@ -6509,27 +6692,27 @@ async function sopsSetValue(absFile, relFile, key, value) {
     ],
     { input: JSON.stringify({ [key]: value }) }
   );
-  writeFileSync18(absFile, stdout);
+  writeFileSync19(absFile, stdout);
 }
 async function sopsUpdateKeys(absFile) {
   await execa11("sops", ["updatekeys", "-y", absFile]);
 }
 
 // src/utils/secret-config.ts
-import { existsSync as existsSync29, readdirSync as readdirSync2 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync30, readdirSync as readdirSync2 } from "fs";
+import { join as join28 } from "path";
 var SECRETS_DIR = "secrets";
 function getSopsFile(cwd, env9) {
   const relFile = `${SECRETS_DIR}/${env9}.enc.json`;
-  return { absFile: join27(cwd, relFile), relFile };
+  return { absFile: join28(cwd, relFile), relFile };
 }
 function findUp(cwd, filename, maxDepth = 6) {
   let dir = cwd;
   for (let depth = 0; depth < maxDepth; depth++) {
-    if (existsSync29(join27(dir, filename))) {
+    if (existsSync30(join28(dir, filename))) {
       return dir;
     }
-    const parent = join27(dir, "..");
+    const parent = join28(dir, "..");
     if (parent === dir) {
       break;
     }
@@ -6539,17 +6722,17 @@ function findUp(cwd, filename, maxDepth = 6) {
 }
 function findSopsConfig(cwd) {
   const dir = findUp(cwd, ".sops.yaml");
-  return dir ? join27(dir, ".sops.yaml") : null;
+  return dir ? join28(dir, ".sops.yaml") : null;
 }
 function hasSopsConfig(cwd) {
   return findSopsConfig(cwd) !== null;
 }
 function listSopsFiles(cwd) {
-  const dir = join27(cwd, SECRETS_DIR);
-  if (!existsSync29(dir)) {
+  const dir = join28(cwd, SECRETS_DIR);
+  if (!existsSync30(dir)) {
     return [];
   }
-  return readdirSync2(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join27(dir, name));
+  return readdirSync2(dir).filter((name) => name.endsWith(".enc.json")).map((name) => join28(dir, name));
 }
 
 // src/commands/secret/store-value.ts
@@ -6578,7 +6761,7 @@ async function storeSecret(cwd, env9, key, value) {
       );
     }
     await store.set(keychainName(key), value);
-    const serverEnvPath = join28(cwd, ".env.server");
+    const serverEnvPath = join29(cwd, ".env.server");
     const result = upsertEnvVar(serverEnvPath, key, keychainRef(key));
     restrictEnvFilePerms(serverEnvPath);
     ensureGitignored(cwd, [{ pattern: ".env.server", comment: "spfn server env (secrets)" }]);
@@ -6816,12 +6999,12 @@ function requireEntry(schema, key) {
 // src/commands/secret/keygen.ts
 init_logger();
 import { execa as execa12 } from "execa";
-import { existsSync as existsSync30, mkdirSync as mkdirSync6 } from "fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync6 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname6, join as join29 } from "path";
+import { dirname as dirname6, join as join30 } from "path";
 import chalk41 from "chalk";
 function ageKeyFile() {
-  return process.env.SOPS_AGE_KEY_FILE ?? join29(homedir(), ".config", "sops", "age", "keys.txt");
+  return process.env.SOPS_AGE_KEY_FILE ?? join30(homedir(), ".config", "sops", "age", "keys.txt");
 }
 async function ensureAgeInstalled() {
   try {
@@ -6841,7 +7024,7 @@ async function secretKeygen() {
     process.exit(1);
   }
   const keyFile = ageKeyFile();
-  if (existsSync30(keyFile)) {
+  if (existsSync31(keyFile)) {
     const { stdout } = await execa12("age-keygen", ["-y", keyFile]);
     logger.warn(`age key file already exists: ${keyFile}`);
     printPublicKeys(publicKeys(stdout));
@@ -6868,8 +7051,8 @@ function printPublicKeys(keys) {
 
 // src/commands/secret/recipients.ts
 init_logger();
-import { existsSync as existsSync31, readFileSync as readFileSync14, writeFileSync as writeFileSync19 } from "fs";
-import { join as join30 } from "path";
+import { existsSync as existsSync32, readFileSync as readFileSync15, writeFileSync as writeFileSync20 } from "fs";
+import { join as join31 } from "path";
 import { parse as parse3, stringify } from "yaml";
 import chalk42 from "chalk";
 var SOPS_CONFIG = ".sops.yaml";
@@ -6877,7 +7060,7 @@ var DEFAULT_PATH_REGEX = "secrets/.*\\.enc\\.json$";
 var AGE_RECIPIENT = /^age1[0-9a-z]+$/;
 async function secretRecipients(action, key, _options) {
   const cwd = process.cwd();
-  const configPath = join30(cwd, SOPS_CONFIG);
+  const configPath = join31(cwd, SOPS_CONFIG);
   if (action === "list") {
     listRecipients(configPath);
     return;
@@ -6904,12 +7087,12 @@ async function secretRecipients(action, key, _options) {
     logger.warn("Removing a recipient does not revoke values they already decrypted \u2014 rotate those values.");
   }
   rule.age = [...recipients].join(",");
-  writeFileSync19(configPath, stringify(config));
+  writeFileSync20(configPath, stringify(config));
   logger.success(`${action === "add" ? "Added" : "Removed"} recipient; updated ${SOPS_CONFIG}.`);
   await reencrypt(cwd);
 }
 function listRecipients(configPath) {
-  if (!existsSync31(configPath)) {
+  if (!existsSync32(configPath)) {
     logger.info(`No ${SOPS_CONFIG} found.`);
     return;
   }
@@ -6927,10 +7110,10 @@ function listRecipients(configPath) {
   console.log();
 }
 function loadConfig(configPath) {
-  if (!existsSync31(configPath)) {
+  if (!existsSync32(configPath)) {
     return { creation_rules: [] };
   }
-  return parse3(readFileSync14(configPath, "utf-8")) ?? { creation_rules: [] };
+  return parse3(readFileSync15(configPath, "utf-8")) ?? { creation_rules: [] };
 }
 function ensureRule(config) {
   if (!config.creation_rules) {
@@ -6962,7 +7145,7 @@ async function reencrypt(cwd) {
 
 // src/commands/secret/check.ts
 init_logger();
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 import chalk43 from "chalk";
 init_env_file();
 var COMMITTED_FILES = [".env", ".env.example"];
@@ -6981,14 +7164,14 @@ async function secretCheck(options) {
   const issues = [];
   const warnings = [];
   for (const file of COMMITTED_FILES) {
-    const parsed = parseEnvFile(join31(cwd, file));
+    const parsed = parseEnvFile(join32(cwd, file));
     for (const [key, value] of Object.entries(parsed)) {
       if (secretKeys.has(key) && value.length > 0 && !PLACEHOLDER.test(value)) {
         issues.push(`${chalk43.cyan(key)} has a real value in committed ${chalk43.yellow(file)} \u2014 move it to the keychain/SOPS.`);
       }
     }
   }
-  const serverEnv = parseEnvFile(join31(cwd, ".env.server"));
+  const serverEnv = parseEnvFile(join32(cwd, ".env.server"));
   for (const key of secretKeys) {
     const value = serverEnv[key];
     if (value && !value.startsWith(KEYCHAIN_REF_PREFIX)) {
@@ -7074,20 +7257,20 @@ async function deleteCloudToken(provider) {
 
 // src/utils/cloud/config.ts
 init_env_file();
-import { existsSync as existsSync32, mkdirSync as mkdirSync7, readFileSync as readFileSync15, writeFileSync as writeFileSync20 } from "fs";
-import { dirname as dirname7, join as join32 } from "path";
-var CONFIG_REL_PATH = join32(".spfn", "cloud.json");
+import { existsSync as existsSync33, mkdirSync as mkdirSync7, readFileSync as readFileSync16, writeFileSync as writeFileSync21 } from "fs";
+import { dirname as dirname7, join as join33 } from "path";
+var CONFIG_REL_PATH = join33(".spfn", "cloud.json");
 function cloudConfigPath(cwd) {
-  return join32(cwd, CONFIG_REL_PATH);
+  return join33(cwd, CONFIG_REL_PATH);
 }
 function readCloudConfig(cwd) {
   const path5 = cloudConfigPath(cwd);
-  if (!existsSync32(path5)) {
+  if (!existsSync33(path5)) {
     return {};
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync15(path5, "utf-8"));
+    parsed = JSON.parse(readFileSync16(path5, "utf-8"));
   } catch {
     throw new Error(`${path5} is not valid JSON \u2014 delete it and run \`spfn cloud link\` again.`);
   }
@@ -7099,7 +7282,7 @@ function readCloudConfig(cwd) {
 function writeCloudConfig(cwd, config) {
   const path5 = cloudConfigPath(cwd);
   mkdirSync7(dirname7(path5), { recursive: true });
-  writeFileSync20(path5, JSON.stringify(config, null, 4) + "\n", "utf-8");
+  writeFileSync21(path5, JSON.stringify(config, null, 4) + "\n", "utf-8");
   ensureGitignored(cwd, [{ pattern: ".spfn/cloud.json", comment: "spfn cloud link state (per-user accounts)" }]);
 }
 function requireLinked(config, provider) {
@@ -7740,8 +7923,8 @@ function printMigrationPrompt(nearLimit) {
 
 // src/commands/cloud/keepalive.ts
 init_logger();
-import { existsSync as existsSync33, mkdirSync as mkdirSync8, readFileSync as readFileSync16, writeFileSync as writeFileSync21 } from "fs";
-import { dirname as dirname8, join as join33 } from "path";
+import { existsSync as existsSync34, mkdirSync as mkdirSync8, readFileSync as readFileSync17, writeFileSync as writeFileSync22 } from "fs";
+import { dirname as dirname8, join as join34 } from "path";
 import chalk49 from "chalk";
 var DEFAULT_HEALTH_PATH = "/api/backend/_core/health?detailed=true";
 var DEFAULT_SCHEDULE = "0 3 * * *";
@@ -7767,12 +7950,12 @@ async function cloudKeepalive(options) {
   logger.info("The DB ping needs detailed health checks: keep `healthCheck: { detailed: true }` in your server config.");
 }
 function setupVercelCron(cwd, healthPath) {
-  const vercelJsonPath = join33(cwd, "vercel.json");
+  const vercelJsonPath = join34(cwd, "vercel.json");
   let vercelJson = {};
-  if (existsSync33(vercelJsonPath)) {
+  if (existsSync34(vercelJsonPath)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync16(vercelJsonPath, "utf-8"));
+      parsed = JSON.parse(readFileSync17(vercelJsonPath, "utf-8"));
     } catch {
       logger.error("vercel.json is not valid JSON (comments and trailing commas are not allowed) \u2014 fix it and re-run.");
       process.exit(1);
@@ -7793,7 +7976,7 @@ function setupVercelCron(cwd, healthPath) {
     logger.info(`Point the existing cron at ${chalk49.cyan(healthPath)} yourself, or use \`--github-actions --url <deployed-url>\`.`);
     process.exit(1);
   }
-  writeFileSync21(vercelJsonPath, JSON.stringify(vercelJson, null, 4) + "\n", "utf-8");
+  writeFileSync22(vercelJsonPath, JSON.stringify(vercelJson, null, 4) + "\n", "utf-8");
   logger.success(`vercel.json: daily cron added (${DEFAULT_SCHEDULE} UTC \u2192 ${healthPath}). Deploy to activate.`);
   warnIfBackendRouteMissing(cwd);
 }
@@ -7813,8 +7996,8 @@ function setupGithubActions(cwd, healthPath, url) {
     logger.error("`--github-actions` needs `--url <deployed-url>` \u2014 the workflow runs outside your app and must know where it lives.");
     process.exit(1);
   }
-  const workflowPath = join33(cwd, ".github", "workflows", "spfn-keepalive.yml");
-  if (existsSync33(workflowPath)) {
+  const workflowPath = join34(cwd, ".github", "workflows", "spfn-keepalive.yml");
+  if (existsSync34(workflowPath)) {
     logger.success(`${workflowPath} already exists \u2014 nothing to do.`);
     return;
   }
@@ -7824,7 +8007,7 @@ function setupGithubActions(cwd, healthPath, url) {
     process.exit(1);
   }
   mkdirSync8(dirname8(workflowPath), { recursive: true });
-  writeFileSync21(workflowPath, githubWorkflow(new URL(healthPath, base).toString()), "utf-8");
+  writeFileSync22(workflowPath, githubWorkflow(new URL(healthPath, base).toString()), "utf-8");
   logger.success(".github/workflows/spfn-keepalive.yml: daily keep-alive workflow added. Commit and push to activate.");
 }
 function normalizeDeployUrl(url) {
@@ -7861,8 +8044,8 @@ jobs:
 `;
 }
 function warnIfBackendRouteMissing(cwd) {
-  const routePath = join33(cwd, "src", "app", "api", "backend", "[[...route]]", "route.ts");
-  if (!existsSync33(routePath)) {
+  const routePath = join34(cwd, "src", "app", "api", "backend", "[[...route]]", "route.ts");
+  if (!existsSync34(routePath)) {
     logger.warn("src/app/api/backend/[[...route]]/route.ts not found \u2014 the cron path answers only after `spfn add vercel`.");
   }
 }
@@ -7870,7 +8053,7 @@ function warnIfBackendRouteMissing(cwd) {
 // src/commands/cloud/env.ts
 init_logger();
 init_env_file();
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 import prompts13 from "prompts";
 import chalk50 from "chalk";
 async function cloudEnvPull(options) {
@@ -7891,7 +8074,7 @@ async function cloudEnvPull(options) {
   logger.info("Values were written to files/keychain only \u2014 none were displayed.");
 }
 function writePublicValues(cwd, projectRef2, keys) {
-  const envLocalPath = join34(cwd, ".env.local");
+  const envLocalPath = join35(cwd, ".env.local");
   ensureGitignored(cwd, [{ pattern: ".env.local", comment: "local env (per-machine values)" }]);
   upsertEnvVar(envLocalPath, "NEXT_PUBLIC_SUPABASE_URL", `https://${projectRef2}.supabase.co`);
   logger.success("NEXT_PUBLIC_SUPABASE_URL \u2192 .env.local");
@@ -7985,8 +8168,8 @@ async function cloudEnvPush(keys) {
   }
 }
 async function resolveLocalValues(cwd, keys) {
-  const publicEnv = { ...parseEnvFile(join34(cwd, ".env")), ...parseEnvFile(join34(cwd, ".env.local")) };
-  const serverEnv = parseEnvFile(join34(cwd, ".env.server"));
+  const publicEnv = { ...parseEnvFile(join35(cwd, ".env")), ...parseEnvFile(join35(cwd, ".env.local")) };
+  const serverEnv = parseEnvFile(join35(cwd, ".env.server"));
   const keychain = await resolveKeychainEnv(cwd);
   const vars = [];
   const missing = [];
@@ -8142,8 +8325,8 @@ async function resolveKitAdapters(request2) {
 // src/kit/operations/install.ts
 import { createHash as createHash2 } from "crypto";
 import { hostname as hostname2, tmpdir } from "os";
-import { mkdtempSync, existsSync as existsSync45 } from "fs";
-import { join as join44 } from "path";
+import { mkdtempSync, existsSync as existsSync46 } from "fs";
+import { join as join45 } from "path";
 
 // src/kit/events.ts
 import chalk51 from "chalk";
@@ -8220,8 +8403,8 @@ function nextLine(event) {
 }
 
 // src/kit/journal.ts
-import { mkdirSync as mkdirSync10, readdirSync as readdirSync3, readFileSync as readFileSync17, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync23, existsSync as existsSync35, statSync } from "fs";
-import { dirname as dirname9, join as join36 } from "path";
+import { mkdirSync as mkdirSync10, readdirSync as readdirSync3, readFileSync as readFileSync18, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync24, existsSync as existsSync36, statSync } from "fs";
+import { dirname as dirname9, join as join37 } from "path";
 
 // src/kit/digest.ts
 import { createHash } from "crypto";
@@ -8262,8 +8445,8 @@ function digestOfJson(value) {
 }
 
 // src/kit/paths.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync22, existsSync as existsSync34 } from "fs";
-import { join as join35 } from "path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync23, existsSync as existsSync35 } from "fs";
+import { join as join36 } from "path";
 var KIT_STATE_DIR = ".spfn";
 var OPERATIONS_IGNORE = [
   "# Written by `spfn kit`. One machine's run is not part of the project.",
@@ -8271,27 +8454,27 @@ var OPERATIONS_IGNORE = [
   ""
 ].join("\n");
 function kitPaths(root) {
-  const stateDir = join35(root, KIT_STATE_DIR);
-  const operationsDir = join35(stateDir, "operations");
-  const lockDir = join35(operationsDir, "operation.lock");
+  const stateDir = join36(root, KIT_STATE_DIR);
+  const operationsDir = join36(stateDir, "operations");
+  const lockDir = join36(operationsDir, "operation.lock");
   return {
     root,
     stateDir,
-    licenseFile: join35(stateDir, "license.json"),
-    lockFile: join35(stateDir, "kit-lock.json"),
+    licenseFile: join36(stateDir, "license.json"),
+    lockFile: join36(stateDir, "kit-lock.json"),
     operationsDir,
-    activeJournal: join35(operationsDir, "active.json"),
-    historyDir: join35(operationsDir, "history"),
+    activeJournal: join36(operationsDir, "active.json"),
+    historyDir: join36(operationsDir, "history"),
     lockDir,
-    lockOwnerFile: join35(lockDir, "owner.json")
+    lockOwnerFile: join36(lockDir, "owner.json")
   };
 }
 function ensureOperationsDir(root) {
   const paths = kitPaths(root);
-  const ignoreFile = join35(paths.stateDir, ".gitignore");
+  const ignoreFile = join36(paths.stateDir, ".gitignore");
   mkdirSync9(paths.stateDir, { recursive: true });
-  if (!existsSync34(ignoreFile)) {
-    writeFileSync22(ignoreFile, OPERATIONS_IGNORE, "utf8");
+  if (!existsSync35(ignoreFile)) {
+    writeFileSync23(ignoreFile, OPERATIONS_IGNORE, "utf8");
   }
   mkdirSync9(paths.operationsDir, { recursive: true });
   return paths.operationsDir;
@@ -8578,14 +8761,14 @@ var JournalStore = class {
     return readJournalFile(this.paths.activeJournal);
   }
   readHistory(operationId) {
-    return readJournalFile(join36(this.paths.historyDir, `${operationId}.json`));
+    return readJournalFile(join37(this.paths.historyDir, `${operationId}.json`));
   }
   /** Every journal this project still has, newest update first. */
   listHistory() {
-    if (!existsSync35(this.paths.historyDir)) {
+    if (!existsSync36(this.paths.historyDir)) {
       return [];
     }
-    return readdirSync3(this.paths.historyDir).filter((name) => name.endsWith(".json")).map((name) => readJournalFile(join36(this.paths.historyDir, name))).filter((journal) => journal !== null).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+    return readdirSync3(this.paths.historyDir).filter((name) => name.endsWith(".json")).map((name) => readJournalFile(join37(this.paths.historyDir, name))).filter((journal) => journal !== null).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
   }
   create(init) {
     const timestamp = this.now();
@@ -8644,15 +8827,15 @@ var JournalStore = class {
   }
   /** Move a finished operation into history and clear the active slot. */
   archive(journal) {
-    writeJsonAtomically(join36(this.paths.historyDir, `${journal.operationId}.json`), journal);
+    writeJsonAtomically(join37(this.paths.historyDir, `${journal.operationId}.json`), journal);
     rmSync2(this.paths.activeJournal, { force: true });
     this.pruneHistory();
   }
   pruneHistory() {
-    if (!existsSync35(this.paths.historyDir)) {
+    if (!existsSync36(this.paths.historyDir)) {
       return;
     }
-    const files = readdirSync3(this.paths.historyDir).filter((name) => name.endsWith(".json")).map((name) => join36(this.paths.historyDir, name)).sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs);
+    const files = readdirSync3(this.paths.historyDir).filter((name) => name.endsWith(".json")).map((name) => join37(this.paths.historyDir, name)).sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs);
     for (const file of files.slice(this.historyLimit)) {
       rmSync2(file, { force: true });
     }
@@ -8674,11 +8857,11 @@ function upsertCheckpoint(checkpoints, entry) {
   return next;
 }
 function readJournalFile(file) {
-  if (!existsSync35(file)) {
+  if (!existsSync36(file)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(readFileSync17(file, "utf8"));
+    const parsed = JSON.parse(readFileSync18(file, "utf8"));
     return validateOperationJournal(parsed).valid ? parsed : null;
   } catch {
     return null;
@@ -8687,13 +8870,13 @@ function readJournalFile(file) {
 function writeJsonAtomically(file, value) {
   mkdirSync10(dirname9(file), { recursive: true });
   const temporary = `${file}.tmp`;
-  writeFileSync23(temporary, `${JSON.stringify(value, null, 4)}
+  writeFileSync24(temporary, `${JSON.stringify(value, null, 4)}
 `, { encoding: "utf8", mode: 384 });
   renameSync2(temporary, file);
 }
 
 // src/kit/lock.ts
-import { mkdirSync as mkdirSync11, readFileSync as readFileSync18, rmSync as rmSync3, writeFileSync as writeFileSync24, existsSync as existsSync36 } from "fs";
+import { mkdirSync as mkdirSync11, readFileSync as readFileSync19, rmSync as rmSync3, writeFileSync as writeFileSync25, existsSync as existsSync37 } from "fs";
 import { hostname } from "os";
 function defaultIsProcessAlive(pid) {
   try {
@@ -8729,11 +8912,11 @@ function acquireOperationLock(options) {
 }
 function readLockOwner(root) {
   const paths = kitPaths(root);
-  if (!existsSync36(paths.lockOwnerFile)) {
+  if (!existsSync37(paths.lockOwnerFile)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(readFileSync18(paths.lockOwnerFile, "utf8"));
+    const parsed = JSON.parse(readFileSync19(paths.lockOwnerFile, "utf8"));
     return typeof parsed?.pid === "number" && typeof parsed?.operationId === "string" ? parsed : null;
   } catch {
     return null;
@@ -8802,7 +8985,7 @@ function tryCreateLockDir(paths) {
   }
 }
 function writeOwner(paths, owner) {
-  writeFileSync24(paths.lockOwnerFile, `${JSON.stringify(owner, null, 4)}
+  writeFileSync25(paths.lockOwnerFile, `${JSON.stringify(owner, null, 4)}
 `, "utf8");
 }
 function handle(paths, owner, reclaimed) {
@@ -8816,18 +8999,18 @@ function handle(paths, owner, reclaimed) {
 }
 
 // src/kit/operation-context.ts
-import { mkdirSync as mkdirSync12, readFileSync as readFileSync19, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync25, existsSync as existsSync37 } from "fs";
-import { dirname as dirname10, join as join37 } from "path";
+import { mkdirSync as mkdirSync12, readFileSync as readFileSync20, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync26, existsSync as existsSync38 } from "fs";
+import { dirname as dirname10, join as join38 } from "path";
 function contextFile(root) {
-  return join37(kitPaths(root).operationsDir, "context.json");
+  return join38(kitPaths(root).operationsDir, "context.json");
 }
 function readOperationContext(root) {
   const file = contextFile(root);
-  if (!existsSync37(file)) {
+  if (!existsSync38(file)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(readFileSync19(file, "utf8"));
+    const parsed = JSON.parse(readFileSync20(file, "utf8"));
     return parsed?.schemaVersion === 1 && typeof parsed.operationId === "string" ? parsed : null;
   } catch {
     return null;
@@ -8837,7 +9020,7 @@ function writeOperationContext(root, context) {
   const file = contextFile(root);
   mkdirSync12(dirname10(file), { recursive: true });
   const temporary = `${file}.tmp`;
-  writeFileSync25(temporary, `${JSON.stringify(context, null, 4)}
+  writeFileSync26(temporary, `${JSON.stringify(context, null, 4)}
 `, "utf8");
   renameSync3(temporary, file);
 }
@@ -9472,8 +9655,8 @@ var KeychainKitCredentialStore = class {
 };
 
 // src/kit/tooling.ts
-import { cpSync, mkdirSync as mkdirSync13, readdirSync as readdirSync4, readFileSync as readFileSync20, rmSync as rmSync5, statSync as statSync2, existsSync as existsSync38 } from "fs";
-import { join as join38, relative as relative2, sep as sep3 } from "path";
+import { cpSync, mkdirSync as mkdirSync13, readdirSync as readdirSync4, readFileSync as readFileSync21, rmSync as rmSync5, statSync as statSync2, existsSync as existsSync39 } from "fs";
+import { join as join39, relative as relative2, sep as sep3 } from "path";
 
 // src/kit/manifest.ts
 var DEFAULT_AGENT_PACK_ROOT = ".spfn/agent-pack";
@@ -9784,7 +9967,7 @@ function snapshotTree(root, ignore = ["node_modules", ".git"]) {
       if (ignore.includes(entry.name)) {
         continue;
       }
-      const absolute = join38(directory, entry.name);
+      const absolute = join39(directory, entry.name);
       if (entry.isDirectory()) {
         walk(absolute);
         continue;
@@ -9794,11 +9977,11 @@ function snapshotTree(root, ignore = ["node_modules", ".git"]) {
       }
       files.set(
         relative2(root, absolute).split(sep3).join("/"),
-        sha256Digest(readFileSync20(absolute))
+        sha256Digest(readFileSync21(absolute))
       );
     }
   };
-  if (existsSync38(root) && statSync2(root).isDirectory()) {
+  if (existsSync39(root) && statSync2(root).isDirectory()) {
     walk(root);
   }
   return { files };
@@ -9855,22 +10038,22 @@ function assertWritesWithinAllowlist(diff, allowlist, context) {
 }
 
 // src/kit/agent-pack.ts
-import { existsSync as existsSync39, mkdirSync as mkdirSync14, readFileSync as readFileSync21, writeFileSync as writeFileSync26 } from "fs";
-import { dirname as dirname11, join as join39 } from "path";
+import { existsSync as existsSync40, mkdirSync as mkdirSync14, readFileSync as readFileSync22, writeFileSync as writeFileSync27 } from "fs";
+import { dirname as dirname11, join as join40 } from "path";
 var AGENT_PACK_RECORD_PATH = ".spfn/agent-pack.json";
 function writeAgentPackRecord(projectDir2, record) {
-  const file = join39(projectDir2, AGENT_PACK_RECORD_PATH);
+  const file = join40(projectDir2, AGENT_PACK_RECORD_PATH);
   mkdirSync14(dirname11(file), { recursive: true });
-  writeFileSync26(file, `${JSON.stringify(record, null, 4)}
+  writeFileSync27(file, `${JSON.stringify(record, null, 4)}
 `, "utf8");
 }
 function readAgentPackRecord(projectDir2) {
-  const file = join39(projectDir2, AGENT_PACK_RECORD_PATH);
-  if (!existsSync39(file)) {
+  const file = join40(projectDir2, AGENT_PACK_RECORD_PATH);
+  if (!existsSync40(file)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(readFileSync21(file, "utf8"));
+    const parsed = JSON.parse(readFileSync22(file, "utf8"));
     return parsed.schemaVersion === 1 && typeof parsed.files === "object" && parsed.files !== null ? parsed : null;
   } catch {
     return null;
@@ -9878,7 +10061,7 @@ function readAgentPackRecord(projectDir2) {
 }
 
 // src/kit/installed-state.ts
-import { mkdirSync as mkdirSync15, readFileSync as readFileSync22, renameSync as renameSync4, writeFileSync as writeFileSync27, existsSync as existsSync40 } from "fs";
+import { mkdirSync as mkdirSync15, readFileSync as readFileSync23, renameSync as renameSync4, writeFileSync as writeFileSync28, existsSync as existsSync41 } from "fs";
 import { dirname as dirname12 } from "path";
 function readLicenseFile(file) {
   const parsed = readJson(file);
@@ -9921,7 +10104,7 @@ function requireInstalledLock(file) {
   const lock = readInstalledLock(file);
   if (lock === null) {
     throw new KitError("KIT_LOCK_INVALID", "This project has no readable .spfn/kit-lock.json.", {
-      evidence: { file, exists: existsSync40(file) },
+      evidence: { file, exists: existsSync41(file) },
       next: { command: "spfn kit recover --json", requiresHumanApproval: false }
     });
   }
@@ -9956,11 +10139,11 @@ function lockFromManifest(manifest, context) {
   };
 }
 function readJson(file) {
-  if (!existsSync40(file)) {
+  if (!existsSync41(file)) {
     return null;
   }
   try {
-    return JSON.parse(readFileSync22(file, "utf8"));
+    return JSON.parse(readFileSync23(file, "utf8"));
   } catch {
     return null;
   }
@@ -9968,17 +10151,17 @@ function readJson(file) {
 function writeJsonAtomically2(file, value) {
   mkdirSync15(dirname12(file), { recursive: true });
   const temporary = `${file}.tmp`;
-  writeFileSync27(temporary, `${JSON.stringify(value, null, 4)}
+  writeFileSync28(temporary, `${JSON.stringify(value, null, 4)}
 `, "utf8");
   renameSync4(temporary, file);
 }
 
 // src/kit/drift.ts
-import { readFileSync as readFileSync23, existsSync as existsSync41 } from "fs";
-import { join as join40 } from "path";
+import { readFileSync as readFileSync24, existsSync as existsSync42 } from "fs";
+import { join as join41 } from "path";
 function fileDigest(root, relativePath) {
-  const file = join40(root, relativePath);
-  return existsSync41(file) ? sha256Digest(readFileSync23(file)) : null;
+  const file = join41(root, relativePath);
+  return existsSync42(file) ? sha256Digest(readFileSync24(file)) : null;
 }
 function agentPackTargets(root, lock) {
   if (lock.agentPack.root === void 0) {
@@ -10009,12 +10192,12 @@ function managedDigests(root, lock) {
 }
 
 // src/kit/operations/shared.ts
-import { mkdirSync as mkdirSync17, readdirSync as readdirSync5, readFileSync as readFileSync26, writeFileSync as writeFileSync30, existsSync as existsSync44 } from "fs";
-import { dirname as dirname14, join as join43 } from "path";
+import { mkdirSync as mkdirSync17, readdirSync as readdirSync5, readFileSync as readFileSync27, writeFileSync as writeFileSync31, existsSync as existsSync45 } from "fs";
+import { dirname as dirname14, join as join44 } from "path";
 
 // src/kit/expand.ts
-import { mkdirSync as mkdirSync16, existsSync as existsSync42, readFileSync as readFileSync24, writeFileSync as writeFileSync28 } from "fs";
-import { dirname as dirname13, join as join41 } from "path";
+import { mkdirSync as mkdirSync16, existsSync as existsSync43, readFileSync as readFileSync25, writeFileSync as writeFileSync29 } from "fs";
+import { dirname as dirname13, join as join42 } from "path";
 
 // src/kit/tar.ts
 var BLOCK = 512;
@@ -10116,26 +10299,26 @@ function expandArchive(bytes, request2) {
   let matched = 0;
   for (const entry of entries) {
     const relative3 = request2.root === void 0 || request2.root.length === 0 ? entry.path : `${request2.root.replace(/\/+$/, "")}/${entry.path}`;
-    const destination = join41(request2.targetDir, relative3);
+    const destination = join42(request2.targetDir, relative3);
     if (entry.kind === "directory") {
       mkdirSync16(destination, { recursive: true });
       continue;
     }
     const digest = sha256Digest(entry.bytes);
     files[relative3] = digest;
-    if (existsSync42(destination) && request2.existing !== "replace") {
+    if (existsSync43(destination) && request2.existing !== "replace") {
       assertSameBytes(destination, relative3, digest);
       matched += 1;
       continue;
     }
     mkdirSync16(dirname13(destination), { recursive: true });
-    writeFileSync28(destination, entry.bytes, { mode: entry.mode === 0 ? 420 : entry.mode });
+    writeFileSync29(destination, entry.bytes, { mode: entry.mode === 0 ? 420 : entry.mode });
     written += 1;
   }
   return { files, written, matched };
 }
 function assertSameBytes(destination, relative3, expected) {
-  const actual = sha256Digest(readFileSync24(destination));
+  const actual = sha256Digest(readFileSync25(destination));
   if (actual === expected) {
     return;
   }
@@ -10243,15 +10426,15 @@ function registryNpmrc(scopes, registryUrl) {
 }
 
 // src/kit/package-graph.ts
-import { existsSync as existsSync43, readFileSync as readFileSync25, writeFileSync as writeFileSync29 } from "fs";
-import { join as join42 } from "path";
+import { existsSync as existsSync44, readFileSync as readFileSync26, writeFileSync as writeFileSync30 } from "fs";
+import { join as join43 } from "path";
 var DEPENDENCY_BLOCKS = ["dependencies", "devDependencies", "optionalDependencies"];
 function applyManifestVersions(projectDir2, manifest) {
-  const file = join42(projectDir2, "package.json");
-  if (!existsSync43(file)) {
+  const file = join43(projectDir2, "package.json");
+  if (!existsSync44(file)) {
     return [];
   }
-  const raw = readFileSync25(file, "utf8");
+  const raw = readFileSync26(file, "utf8");
   const document = JSON.parse(raw);
   const wanted = new Map(manifest.packages.map((entry) => [entry.name, entry.version]));
   const changes = [];
@@ -10270,7 +10453,7 @@ function applyManifestVersions(projectDir2, manifest) {
     }
   }
   if (changes.length > 0) {
-    writeFileSync29(file, `${JSON.stringify(document, null, indentationOf(raw))}${trailingNewline(raw)}`);
+    writeFileSync30(file, `${JSON.stringify(document, null, indentationOf(raw))}${trailingNewline(raw)}`);
   }
   return changes;
 }
@@ -10298,12 +10481,12 @@ function installedGraphMismatches(projectDir2, manifest, skip = () => false) {
   return mismatches;
 }
 function installedVersion(projectDir2, name) {
-  const file = join42(projectDir2, "node_modules", ...name.split("/"), "package.json");
-  if (!existsSync43(file)) {
+  const file = join43(projectDir2, "node_modules", ...name.split("/"), "package.json");
+  if (!existsSync44(file)) {
     return null;
   }
   try {
-    const version = JSON.parse(readFileSync25(file, "utf8")).version;
+    const version = JSON.parse(readFileSync26(file, "utf8")).version;
     return typeof version === "string" ? version : null;
   } catch {
     return null;
@@ -10390,7 +10573,7 @@ function latestActiveRelease(catalog) {
   return active[0];
 }
 function assertEmptyTarget(targetDir) {
-  if (!existsSync44(targetDir)) {
+  if (!existsSync45(targetDir)) {
     return;
   }
   const entries = readdirSync5(targetDir).filter((name) => name !== ".DS_Store");
@@ -10421,13 +10604,13 @@ async function materializeTargets(adapters, projectDir2, targets, options = {})
       continue;
     }
     written[target.path] = digest;
-    writeManagedFile(join43(projectDir2, target.path), target.path, bytes, digest, options.existing);
+    writeManagedFile(join44(projectDir2, target.path), target.path, bytes, digest, options.existing);
   }
   return written;
 }
 function writeManagedFile(file, path5, bytes, digest, existing = "verify") {
-  if (existsSync44(file) && existing !== "replace") {
-    const actual = sha256Digest(readFileSync26(file));
+  if (existsSync45(file) && existing !== "replace") {
+    const actual = sha256Digest(readFileSync27(file));
     if (actual === digest) {
       return;
     }
@@ -10437,7 +10620,7 @@ function writeManagedFile(file, path5, bytes, digest, existing = "verify") {
     });
   }
   mkdirSync17(dirname14(file), { recursive: true });
-  writeFileSync30(file, bytes);
+  writeFileSync31(file, bytes);
 }
 async function installFrozenGraph(adapters, options) {
   const maxAttempts = options.allowSessionRetry === false ? 1 : 2;
@@ -10499,7 +10682,7 @@ function scopesOf(manifest) {
   return scopes.length === 0 ? ["@superfunction"] : [...new Set(scopes)];
 }
 function writeRegistryNpmrc(projectDir2, manifest, registryUrl) {
-  writeFileSync30(join43(projectDir2, ".npmrc"), registryNpmrc(scopesOf(manifest), registryUrl), "utf8");
+  writeFileSync31(join44(projectDir2, ".npmrc"), registryNpmrc(scopesOf(manifest), registryUrl), "utf8");
 }
 function assertGraphInstalled(options) {
   if (options.expect === void 0) {
@@ -10747,10 +10930,10 @@ function installSteps(options) {
         return { kind: "done", evidence: { attempts: evidence.attempts, tooling: tooling.specifier } };
       },
       async verify() {
-        if (!existsSync45(join44(projectDir2, "node_modules"))) {
+        if (!existsSync46(join45(projectDir2, "node_modules"))) {
           return { ok: false, reason: "dependencies-missing" };
         }
-        if (!existsSync45(paths.lockFile)) {
+        if (!existsSync46(paths.lockFile)) {
           writeLock(options, projectDir2, adapters.clock.now());
         }
         return { ok: true };
@@ -10849,7 +11032,7 @@ async function verifyToolingPlan(options, projectDir2, operationId) {
   });
   const isolated = await runIsolated(
     projectDir2,
-    join44(mkdtempSync(join44(tmpdir(), "spfn-kit-")), operationId),
+    join45(mkdtempSync(join45(tmpdir(), "spfn-kit-")), operationId),
     (workingCopy) => discovered.tooling.planInstall({
       projectDir: workingCopy,
       release: options.manifest.version
@@ -11157,8 +11340,8 @@ async function startRecovery(sink, adapters, activationId) {
 }
 
 // src/kit/customer-source.ts
-import { existsSync as existsSync46, mkdirSync as mkdirSync18, readFileSync as readFileSync27, writeFileSync as writeFileSync31 } from "fs";
-import { dirname as dirname15, join as join45 } from "path";
+import { existsSync as existsSync47, mkdirSync as mkdirSync18, readFileSync as readFileSync28, writeFileSync as writeFileSync32 } from "fs";
+import { dirname as dirname15, join as join46 } from "path";
 var IGNORED_DIRECTORIES = ["node_modules", ".git", ".next", ".turbo", ".vercel", "dist", "coverage"];
 var KIT_OWNED_FILES = ["pnpm-lock.yaml", "package.json", ".npmrc", "tsconfig.tsbuildinfo"];
 function declaredPaths(declaration) {
@@ -11203,21 +11386,21 @@ function compareCustomerSource(before, after) {
   return paths.filter((path5) => before[path5] !== after[path5]).map((path5) => ({ path: path5, before: before[path5] ?? null, after: after[path5] ?? null }));
 }
 function customerBaselinePath(projectDir2, operationId) {
-  return join45(projectDir2, ".spfn", "operations", `${operationId}.customer-source.json`);
+  return join46(projectDir2, ".spfn", "operations", `${operationId}.customer-source.json`);
 }
 function writeCustomerBaseline(projectDir2, baseline) {
   const path5 = customerBaselinePath(projectDir2, baseline.operationId);
   mkdirSync18(dirname15(path5), { recursive: true });
-  writeFileSync31(path5, `${JSON.stringify(baseline, null, 4)}
+  writeFileSync32(path5, `${JSON.stringify(baseline, null, 4)}
 `);
 }
 function readCustomerBaseline(projectDir2, operationId) {
   const path5 = customerBaselinePath(projectDir2, operationId);
-  if (!existsSync46(path5)) {
+  if (!existsSync47(path5)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(readFileSync27(path5, "utf8"));
+    const parsed = JSON.parse(readFileSync28(path5, "utf8"));
     return parsed?.schemaVersion === 1 && typeof parsed.files === "object" ? parsed : null;
   } catch {
     return null;
@@ -11619,8 +11802,8 @@ function planResult(sink, plan, digest) {
 }
 
 // src/kit/operations/inspect.ts
-import { existsSync as existsSync47 } from "fs";
-import { join as join46 } from "path";
+import { existsSync as existsSync48 } from "fs";
+import { join as join47 } from "path";
 async function runStatus(request2, adapters) {
   const paths = kitPaths(request2.projectDir);
   const lock = readInstalledLock(paths.lockFile);
@@ -11733,7 +11916,7 @@ async function runCheck(request2, adapters) {
       fixCommand: `spfn kit resume ${journal.operationId} --json`
     });
   }
-  if (!existsSync47(join46(request2.projectDir, "node_modules"))) {
+  if (!existsSync48(join47(request2.projectDir, "node_modules"))) {
     diagnostics.push({
       code: "KIT_GATE_FAILED",
       severity: "warning",
@@ -12145,8 +12328,8 @@ function parseKeys(raw) {
 }
 
 // src/kit/scaffold.ts
-import { mkdirSync as mkdirSync19, existsSync as existsSync48, readFileSync as readFileSync28, writeFileSync as writeFileSync32 } from "fs";
-import { dirname as dirname16, join as join47 } from "path";
+import { mkdirSync as mkdirSync19, existsSync as existsSync49, readFileSync as readFileSync29, writeFileSync as writeFileSync33 } from "fs";
+import { dirname as dirname16, join as join48 } from "path";
 
 // src/kit/http/registry.ts
 import { createHash as createHash3 } from "crypto";
@@ -12492,20 +12675,20 @@ var ArtifactScaffoldPort = class {
   }
 };
 function seedProjectName(targetDir, name) {
-  const file = join47(targetDir, "package.json");
-  if (!existsSync48(file)) {
+  const file = join48(targetDir, "package.json");
+  if (!existsSync49(file)) {
     return;
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync28(file, "utf8"));
+    parsed = JSON.parse(readFileSync29(file, "utf8"));
   } catch {
     throw new KitError("KIT_MANIFEST_INVALID", "The release scaffold's package.json is not readable JSON.", {
       evidence: { path: "package.json" }
     });
   }
   parsed.name = packageNameOf(name);
-  writeFileSync32(file, `${JSON.stringify(parsed, null, 4)}
+  writeFileSync33(file, `${JSON.stringify(parsed, null, 4)}
 `, "utf8");
 }
 function packageNameOf(name) {
@@ -12513,9 +12696,9 @@ function packageNameOf(name) {
   return cleaned.length === 0 ? "kit-project" : cleaned;
 }
 function writeScaffoldRecord(targetDir, record) {
-  const file = join47(targetDir, SCAFFOLD_RECORD_PATH);
+  const file = join48(targetDir, SCAFFOLD_RECORD_PATH);
   mkdirSync19(dirname16(file), { recursive: true });
-  writeFileSync32(file, `${JSON.stringify(record, null, 4)}
+  writeFileSync33(file, `${JSON.stringify(record, null, 4)}
 `, "utf8");
 }
 
@@ -12895,7 +13078,7 @@ function requireCatalogUrl(projectDir2) {
 
 // src/kit/local/index.ts
 import { createRequire as createRequire2 } from "module";
-import { join as join51 } from "path";
+import { join as join52 } from "path";
 import { pathToFileURL as pathToFileURL4 } from "url";
 
 // src/kit/local/process.ts
@@ -13044,8 +13227,8 @@ ${result.stdout}`;
 }
 
 // src/kit/local/database.ts
-import { existsSync as existsSync49 } from "fs";
-import { dirname as dirname17, join as join48 } from "path";
+import { existsSync as existsSync50 } from "fs";
+import { dirname as dirname17, join as join49 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var DEFAULT_DATABASE_TIMEOUT_MS = 9e5;
 var SpfnDatabasePort = class {
@@ -13130,8 +13313,8 @@ function spfnCommand() {
 function resolveSpfnBin(from = fileURLToPath3(import.meta.url)) {
   let directory = dirname17(from);
   for (let depth = 0; depth < 8; depth += 1) {
-    const candidate = join48(directory, "bin", "spfn.js");
-    if (existsSync49(candidate)) {
+    const candidate = join49(directory, "bin", "spfn.js");
+    if (existsSync50(candidate)) {
       return candidate;
     }
     const parent = dirname17(directory);
@@ -13144,8 +13327,8 @@ function resolveSpfnBin(from = fileURLToPath3(import.meta.url)) {
 }
 
 // src/kit/local/gates.ts
-import { existsSync as existsSync50, readFileSync as readFileSync29 } from "fs";
-import { join as join49 } from "path";
+import { existsSync as existsSync51, readFileSync as readFileSync30 } from "fs";
+import { join as join50 } from "path";
 var DEFAULT_GATE_TIMEOUT_MS = 9e5;
 var GATE_PLANS = {
   "kit-check": { scripts: [], fallback: spfnFallback(["kit", "check", "--json"]) },
@@ -13196,12 +13379,12 @@ var CommandGatePort = class {
   }
 };
 function projectScripts(cwd) {
-  const file = join49(cwd, "package.json");
-  if (!existsSync50(file)) {
+  const file = join50(cwd, "package.json");
+  if (!existsSync51(file)) {
     return {};
   }
   try {
-    const parsed = JSON.parse(readFileSync29(file, "utf8"));
+    const parsed = JSON.parse(readFileSync30(file, "utf8"));
     return parsed.scripts ?? {};
   } catch {
     return {};
@@ -13213,8 +13396,8 @@ function spfnFallback(args) {
 }
 
 // src/kit/local/git.ts
-import { existsSync as existsSync51 } from "fs";
-import { join as join50 } from "path";
+import { existsSync as existsSync52 } from "fs";
+import { join as join51 } from "path";
 var FALLBACK_AUTHOR_NAME = "spfn kit";
 var FALLBACK_AUTHOR_EMAIL = "kit@superfunction.xyz";
 var DEFAULT_GIT_TIMEOUT_MS = 12e4;
@@ -13225,7 +13408,7 @@ var SystemGitPort = class {
   }
   /** Start a repository, or leave the one that is already there alone. */
   async init(request2) {
-    if (existsSync51(join50(request2.cwd, ".git"))) {
+    if (existsSync52(join51(request2.cwd, ".git"))) {
       return;
     }
     const result = await this.git(request2.cwd, ["init"]);
@@ -13342,7 +13525,7 @@ function createKitLocalPorts(options = {}) {
 }
 function createProjectModuleLoader() {
   return async (specifier, projectDir2) => {
-    const resolve4 = createRequire2(join51(projectDir2, "package.json"));
+    const resolve4 = createRequire2(join52(projectDir2, "package.json"));
     return import(pathToFileURL4(resolve4.resolve(specifier)).href);
   };
 }