Merge branch 'cli-improvements-1' with @reviq/utils password hashing

- Use executeBootstrap helper from @reviq/db for CLI bootstrap
- Update @reviq/db to use @reviq/utils for PBKDF2-SHA256 password hashing
  (Cloudflare Workers compatible)
- Keep @scure/base for base58 token encoding
- Remove redundant password.ts from @reviq/db (import directly from @reviq/utils)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

packages/api-contract/src/contract.ts

@@ -33,6 +33,7 @@ import {
   updateMemberRoleInputSchema,
 } from "./schemas/org.js";
 import {
+  authStatusOutputSchema,
   deviceOutputSchema,
   passkeyOutputSchema,
   sessionOutputSchema,
@@ -113,6 +114,9 @@ export const contract = oc.router({
     updateProfile: oc.input(updateProfileInputSchema).output(z.void()),
     delete: oc.input(z.object({ password: z.string() })).output(z.void()),
 
+    // Auth status (for CLI and debugging)
+    authStatus: oc.output(authStatusOutputSchema),
+
     // Authentication settings
     setPassword: oc.input(setPasswordInputSchema).output(z.void()),
 

packages/api-contract/src/schemas/user.ts

@@ -98,3 +98,37 @@ export const deviceOutputSchema = z.object({
 export const trustDeviceInputSchema = z.object({
   name: nonEmptyString(100),
 });
+
+/**
+ * Auth status output schema for API token authentication
+ */
+export const apiTokenAuthStatusSchema = z.object({
+  method: z.literal("api_token"),
+  tokenId: z.string(),
+  tokenName: z.string(),
+  expiresAt: z.date(),
+  lastUsedAt: z.date().nullable(),
+  createdAt: z.date(),
+});
+
+/**
+ * Auth status output schema for session authentication
+ */
+export const sessionAuthStatusSchema = z.object({
+  method: z.literal("session"),
+  sessionId: z.string(),
+  expiresAt: z.date(),
+  createdAt: z.date(),
+});
+
+/**
+ * Auth status output schema
+ * Returns information about the current authentication method
+ */
+export const authStatusOutputSchema = z.object({
+  user: userProfileSchema,
+  auth: z.discriminatedUnion("method", [
+    apiTokenAuthStatusSchema,
+    sessionAuthStatusSchema,
+  ]),
+});