@buildwithharbor/pier 0.1.7 → 0.1.9

package/dist/index.js

@@ -57019,6 +57019,143 @@ var dnsContract = {
   updateRecord: contractBuilder2.mutation().input(dnsRecordMutationInputSchema).output(dnsRecordOutputSchema)
 };
 
+// ../api-contract/src/env.ts
+init_zod();
+var envValueErrors = {
+  NO_APP_TARGETS_FOR_SECRET: {
+    message: "No app targets for secret",
+    status: 400
+  },
+  ENV_VALUE_RECORD_MISSING: {
+    data: exports_external.record(exports_external.string(), exports_external.unknown()),
+    message: "Environment value record missing",
+    status: 500
+  },
+  ENV_REPLACE_REQUIRES_FORCE: {
+    data: exports_external.record(exports_external.string(), exports_external.unknown()),
+    message: "Environment replacement requires --force",
+    status: 400
+  },
+  ENV_VALUE_NOT_FOUND: {
+    data: exports_external.record(exports_external.string(), exports_external.unknown()),
+    message: "Environment value was not found",
+    status: 404
+  }
+};
+var listEnvValuesInput = exports_external.object({
+  environment: exports_external.string().optional(),
+  manifest: pierManifestSchema
+});
+var envValuesInput = listEnvValuesInput.extend({
+  actor: exports_external.string().optional(),
+  app: exports_external.string().optional()
+});
+var getEnvValueInput = envValuesInput.extend({
+  name: exports_external.string()
+});
+var envDownloadFormatSchema = exports_external.enum(["env", "json", "shell", "yaml"]);
+var downloadEnvValuesInput = envValuesInput.extend({
+  format: envDownloadFormatSchema.default("env")
+});
+var resolveEnvValuesForRunInput = envValuesInput;
+var setEnvValueInput = exports_external.object({
+  actor: exports_external.string().optional(),
+  app: exports_external.string().optional(),
+  environment: exports_external.string().optional(),
+  manifest: pierManifestSchema,
+  name: exports_external.string(),
+  source: exports_external.string().optional(),
+  value: exports_external.string()
+});
+var uploadEnvValuesInput = envValuesInput.extend({
+  dryRun: exports_external.boolean().optional(),
+  force: exports_external.boolean().optional(),
+  replace: exports_external.boolean().optional(),
+  values: exports_external.record(exports_external.string(), exports_external.string())
+});
+var deleteEnvValueInput = setEnvValueInput.omit({ value: true });
+var envValueListItemSchema = exports_external.object({
+  app: exports_external.string().optional(),
+  environment: exports_external.string(),
+  kind: exports_external.enum(["boolean", "json", "number", "string"]),
+  name: exports_external.string(),
+  projectSlug: exports_external.string(),
+  sensitive: exports_external.boolean(),
+  updatedAt: exports_external.string(),
+  updatedBy: exports_external.string()
+});
+var listEnvValuesOutputSchema = exports_external.object({
+  values: exports_external.array(envValueListItemSchema)
+});
+var downloadEnvValuesOutputSchema = exports_external.object({
+  count: exports_external.number().int().nonnegative(),
+  environment: exports_external.string(),
+  format: envDownloadFormatSchema,
+  ok: exports_external.literal(true),
+  projectSlug: exports_external.string(),
+  value: exports_external.string()
+});
+var resolveEnvValuesForRunOutputSchema = exports_external.object({
+  environment: exports_external.string(),
+  ok: exports_external.literal(true),
+  projectSlug: exports_external.string(),
+  values: exports_external.record(exports_external.string(), exports_external.string())
+});
+var getEnvValueOutputSchema = exports_external.object({
+  environment: exports_external.string(),
+  name: exports_external.string(),
+  projectSlug: exports_external.string(),
+  value: exports_external.string()
+});
+var setEnvValueOutputSchema = exports_external.object({
+  name: exports_external.string(),
+  ok: exports_external.literal(true),
+  targets: exports_external.array(exports_external.string())
+});
+var envValueScopeOutputSchema = exports_external.object({
+  app: exports_external.string().optional(),
+  environment: exports_external.string(),
+  projectSlug: exports_external.string()
+});
+var envChangedValueSchema = exports_external.object({
+  action: exports_external.enum(["set", "delete"]),
+  app: exports_external.string().optional(),
+  kind: exports_external.enum(["boolean", "json", "number", "string"]).optional(),
+  name: exports_external.string(),
+  sensitive: exports_external.boolean().optional(),
+  targets: exports_external.array(exports_external.string()).optional()
+});
+var envValueWarningSchema = exports_external.object({
+  name: exports_external.string().optional(),
+  reason: exports_external.string()
+});
+var uploadEnvValuesOutputSchema = exports_external.object({
+  action: exports_external.literal("upload"),
+  auditPreview: exports_external.array(exports_external.string()),
+  changed: exports_external.array(envChangedValueSchema),
+  dryRun: exports_external.boolean(),
+  ok: exports_external.literal(true),
+  relatedCommands: exports_external.array(exports_external.string()),
+  removed: exports_external.array(envChangedValueSchema),
+  scope: envValueScopeOutputSchema,
+  unchanged: exports_external.array(exports_external.string()),
+  warnings: exports_external.array(envValueWarningSchema)
+});
+var deleteEnvValueOutputSchema = exports_external.object({
+  name: exports_external.string(),
+  ok: exports_external.literal(true),
+  targets: exports_external.array(exports_external.string())
+});
+var envContract = {
+  delete: contractBuilder2.mutation().input(deleteEnvValueInput).output(deleteEnvValueOutputSchema).errors(envValueErrors),
+  download: contractBuilder2.query().input(downloadEnvValuesInput).output(downloadEnvValuesOutputSchema),
+  get: contractBuilder2.query().input(getEnvValueInput).output(getEnvValueOutputSchema).errors(envValueErrors),
+  list: contractBuilder2.query().input(listEnvValuesInput).output(listEnvValuesOutputSchema),
+  resolveForRun: contractBuilder2.query().input(resolveEnvValuesForRunInput).output(resolveEnvValuesForRunOutputSchema),
+  set: contractBuilder2.mutation().input(setEnvValueInput).output(setEnvValueOutputSchema).errors(envValueErrors),
+  upload: contractBuilder2.mutation().input(uploadEnvValuesInput).output(uploadEnvValuesOutputSchema).errors(envValueErrors)
+};
+
 // ../api-contract/src/environments.ts
 init_zod();
 var createEnvironmentInput = exports_external.object({
@@ -57931,7 +58068,14 @@ var projectDeleteInputSchema = exports_external.object({
   confirmSlug: exports_external.string().min(1),
   projectSlug: exports_external.string().min(1)
 });
-var projectUpsertInputSchema = exports_external.object({
+var projectErrors = {
+  PROJECT_ALREADY_EXISTS: {
+    data: exports_external.object({ slug: exports_external.string() }),
+    message: "Project already exists",
+    status: 409
+  }
+};
+var projectCreateInputSchema = exports_external.object({
   actor: exports_external.string().optional(),
   manifest: pierManifestSchema
 });
@@ -57939,14 +58083,14 @@ var projectDeleteOutputSchema = exports_external.object({
   deletedProject: projectRecordSchema,
   ok: exports_external.literal(true)
 });
-var projectUpsertOutputSchema = exports_external.object({
+var projectCreateOutputSchema = exports_external.object({
   appCount: exports_external.number().int().nonnegative(),
   bindingCount: exports_external.number().int().nonnegative(),
   project: projectRecordSchema
 });
 var projectContract = {
   delete: contractBuilder2.mutation().input(projectDeleteInputSchema).output(projectDeleteOutputSchema),
-  upsert: contractBuilder2.mutation().input(projectUpsertInputSchema).output(projectUpsertOutputSchema)
+  create: contractBuilder2.mutation().input(projectCreateInputSchema).output(projectCreateOutputSchema).errors(projectErrors)
 };
 
 // ../api-contract/src/provider.ts
@@ -58227,148 +58371,6 @@ var providerContract = {
   cloudflareUsageSummary: contractBuilder2.query().input(cloudflareUsageSummaryInputSchema).output(cloudflareUsageSummaryOutputSchema)
 };
 
-// ../api-contract/src/secrets.ts
-init_zod();
-var secretErrors = {
-  NO_APP_TARGETS_FOR_SECRET: {
-    message: "No app targets for secret",
-    status: 400
-  },
-  SECRET_RECORD_MISSING: {
-    data: exports_external.record(exports_external.string(), exports_external.unknown()),
-    message: "Secret record missing",
-    status: 500
-  },
-  SECRET_REPLACE_REQUIRES_FORCE: {
-    data: exports_external.record(exports_external.string(), exports_external.unknown()),
-    message: "Secret replacement requires --force",
-    status: 400
-  },
-  SECRET_VALUE_NOT_FOUND: {
-    data: exports_external.record(exports_external.string(), exports_external.unknown()),
-    message: "Secret value was not found",
-    status: 404
-  }
-};
-var listSecretsInput = exports_external.object({
-  environment: exports_external.string().optional(),
-  manifest: pierManifestSchema
-});
-var secretValuesInput = listSecretsInput.extend({
-  actor: exports_external.string().optional(),
-  app: exports_external.string().optional()
-});
-var getSecretInput = secretValuesInput.extend({
-  name: exports_external.string()
-});
-var secretDownloadFormatSchema = exports_external.enum([
-  "env",
-  "json",
-  "shell",
-  "yaml"
-]);
-var downloadSecretsInput = secretValuesInput.extend({
-  format: secretDownloadFormatSchema.default("env")
-});
-var resolveSecretsForRunInput = secretValuesInput;
-var setSecretInput = exports_external.object({
-  actor: exports_external.string().optional(),
-  app: exports_external.string().optional(),
-  environment: exports_external.string().optional(),
-  manifest: pierManifestSchema,
-  name: exports_external.string(),
-  source: exports_external.string().optional(),
-  value: exports_external.string()
-});
-var uploadSecretsInput = secretValuesInput.extend({
-  dryRun: exports_external.boolean().optional(),
-  force: exports_external.boolean().optional(),
-  replace: exports_external.boolean().optional(),
-  values: exports_external.record(exports_external.string(), exports_external.string())
-});
-var unsetSecretInput = setSecretInput.omit({ value: true });
-var secretListItemSchema = exports_external.object({
-  app: exports_external.string().optional(),
-  environment: exports_external.string(),
-  kind: exports_external.enum(["boolean", "json", "number", "string"]),
-  name: exports_external.string(),
-  projectSlug: exports_external.string(),
-  sensitive: exports_external.boolean(),
-  updatedAt: exports_external.string(),
-  updatedBy: exports_external.string()
-});
-var listSecretsOutputSchema = exports_external.object({
-  values: exports_external.array(secretListItemSchema)
-});
-var downloadSecretsOutputSchema = exports_external.object({
-  count: exports_external.number().int().nonnegative(),
-  environment: exports_external.string(),
-  format: secretDownloadFormatSchema,
-  ok: exports_external.literal(true),
-  projectSlug: exports_external.string(),
-  value: exports_external.string()
-});
-var resolveSecretsForRunOutputSchema = exports_external.object({
-  environment: exports_external.string(),
-  ok: exports_external.literal(true),
-  projectSlug: exports_external.string(),
-  values: exports_external.record(exports_external.string(), exports_external.string())
-});
-var getSecretOutputSchema = exports_external.object({
-  environment: exports_external.string(),
-  name: exports_external.string(),
-  projectSlug: exports_external.string(),
-  value: exports_external.string()
-});
-var setSecretOutputSchema = exports_external.object({
-  name: exports_external.string(),
-  ok: exports_external.literal(true),
-  targets: exports_external.array(exports_external.string())
-});
-var secretScopeOutputSchema = exports_external.object({
-  app: exports_external.string().optional(),
-  environment: exports_external.string(),
-  projectSlug: exports_external.string()
-});
-var secretChangedValueSchema = exports_external.object({
-  action: exports_external.enum(["set", "delete"]),
-  app: exports_external.string().optional(),
-  kind: exports_external.enum(["boolean", "json", "number", "string"]).optional(),
-  name: exports_external.string(),
-  sensitive: exports_external.boolean().optional(),
-  targets: exports_external.array(exports_external.string()).optional()
-});
-var secretWarningSchema = exports_external.object({
-  name: exports_external.string().optional(),
-  reason: exports_external.string()
-});
-var uploadSecretsOutputSchema = exports_external.object({
-  action: exports_external.literal("upload"),
-  auditPreview: exports_external.array(exports_external.string()),
-  changed: exports_external.array(secretChangedValueSchema),
-  dryRun: exports_external.boolean(),
-  ok: exports_external.literal(true),
-  relatedCommands: exports_external.array(exports_external.string()),
-  removed: exports_external.array(secretChangedValueSchema),
-  scope: secretScopeOutputSchema,
-  unchanged: exports_external.array(exports_external.string()),
-  warnings: exports_external.array(secretWarningSchema)
-});
-var unsetSecretOutputSchema = exports_external.object({
-  name: exports_external.string(),
-  ok: exports_external.literal(true),
-  targets: exports_external.array(exports_external.string())
-});
-var secretsContract = {
-  download: contractBuilder2.query().input(downloadSecretsInput).output(downloadSecretsOutputSchema),
-  get: contractBuilder2.query().input(getSecretInput).output(getSecretOutputSchema).errors(secretErrors),
-  list: contractBuilder2.query().input(listSecretsInput).output(listSecretsOutputSchema),
-  resolveForRun: contractBuilder2.query().input(resolveSecretsForRunInput).output(resolveSecretsForRunOutputSchema),
-  set: contractBuilder2.mutation().input(setSecretInput).output(setSecretOutputSchema).errors(secretErrors),
-  upload: contractBuilder2.mutation().input(uploadSecretsInput).output(uploadSecretsOutputSchema).errors(secretErrors),
-  unset: contractBuilder2.mutation().input(unsetSecretInput).output(unsetSecretOutputSchema).errors(secretErrors)
-};
-
 // ../api-contract/src/contract.ts
 var contractModules = {
   account: accountContract,
@@ -58380,6 +58382,7 @@ var contractModules = {
   deployments: deploymentsContract,
   dns: dnsContract,
   domains: domainsContract,
+  env: envContract,
   environments: environmentsContract,
   integrations: integrationContract,
   observability: observabilityContract,
@@ -58389,7 +58392,6 @@ var contractModules = {
   planning: planningContract,
   provider: providerContract,
   projects: projectContract,
-  secrets: secretsContract,
   state: stateContract
 };
 var contract = contractBuilder2.router(contractModules);
@@ -58627,8 +58629,9 @@ Common commands:
   pier dev <app-name>
   pier deploy all --env prod
   pier project status <project-slug>
+  pier project create
   pier env types
-  pier secrets upload <dotenv-file> --env <env>
+  pier env upload <dotenv-file> --env <env>
   pier logs [search]
   pier dns zones
   pier connections cloudflare status
@@ -58638,7 +58641,7 @@ Common commands:
   pier doctor
 
 Command groups:
-  auth, org, package, project, dev, deploy, env, secrets, logs, dns, connections, sync, ops
+  auth, org, package, project, dev, deploy, env, logs, dns, connections, sync, ops
 
 Run:
   pier <command> -h
@@ -58773,7 +58776,9 @@ var helpPages = {
   connections: {
     title: "Connections",
     summary: "Inspect linked provider accounts and organization attachments.",
-    usage: ["pier connections cloudflare <status|list|inventory|attach> [flags]"],
+    usage: [
+      "pier connections cloudflare <status|list|inventory|attach> [flags]"
+    ],
     commands: [
       "cloudflare status [--organization-id <id>]",
       "cloudflare list [--organization-id <id>]",
@@ -58919,22 +58924,41 @@ var helpPages = {
   },
   env: {
     title: "Environment",
-    summary: "Inspect Pier runtime configuration and generate env types. Use `pier secrets` for cloud value changes.",
+    summary: "Manage Pier cloud env values and generate runtime env types.",
     usage: ["pier env <command> [args] [flags]"],
     commands: [
-      "list [config-path]",
+      "list [config-path] [--env <env>]",
+      "get <name> [config-path] [--env <env>]",
+      "set <NAME=value>... [config-path] [--env <env>]",
+      "delete <name> [config-path] [--env <env>]",
+      "upload <dotenv-file> [config-path] [--env <env>] [--force]",
+      "download [config-path] [--env <env>] [--format <env|json|yaml|shell>]",
+      "run [config-path] [--env <env>] -- <command...>",
+      "environments [config-path]",
       "create <name> [config-path]",
-      "values <env> [config-path]",
       "types [config-path]"
     ],
     flags: [
       "--app <app-name>",
       "--api <url|local>",
+      "--config <path>",
+      "--env <env>",
+      "--format <env|json|yaml|shell>",
+      "--force",
       "--json",
-      "--output <path>"
+      "--organization-id <id>",
+      "--output <path>",
+      "--project <slug>"
     ],
-    examples: ["pier env list", "pier env values prod", "pier env types"],
-    related: ["pier secrets list", "pier secrets upload", "pier secrets run"]
+    examples: [
+      "pier env list",
+      "pier env get PUBLIC_API_URL",
+      "pier env set API_TOKEN=secret --env prod",
+      "pier env delete API_TOKEN --env prod",
+      "pier env upload .env.production --env prod",
+      "pier env run --env dev -- bun test",
+      "pier env types"
+    ]
   },
   export: {
     title: "Export",
@@ -59109,11 +59133,15 @@ var helpPages = {
   project: {
     title: "Project",
     summary: "Inspect project readiness, deploy state, URLs, and next commands.",
-    usage: ["pier project status <project-slug> [flags]"],
-    commands: ["status <project-slug> [--env <env>]"],
+    usage: [
+      "pier project status <project-slug> [flags]",
+      "pier project create [config-path] [flags]"
+    ],
+    commands: ["status <project-slug> [--env <env>]", "create [config-path]"],
     flags: ["--project <slug>", "--env <env>", "--api <url|local>", "--json"],
     examples: [
       "pier project status pier",
+      "pier project create",
       "pier project status pier --env prod --json"
     ]
   },
@@ -59206,38 +59234,6 @@ var helpPages = {
     flags: ["--project <slug>", "--env <env>", "--api <url|local>"],
     examples: ["pier run -- turbo run build", "pier run -- bun test"]
   },
-  secrets: {
-    title: "Secrets",
-    summary: "Manage cloud Pier runtime values declared in platform.config.ts.",
-    usage: ["pier secrets <command> [args] [flags]"],
-    commands: [
-      "list [config-path] [--env <env>]",
-      "get <name> [config-path] [--env <env>]",
-      "set <NAME=value>... [config-path] [--env <env>]",
-      "upload <dotenv-file> [config-path] [--env <env>] [--replace --force]",
-      "download [config-path] [--env <env>] [--format <env|json|yaml|shell>]",
-      "run [config-path] [--env <env>] -- <command...>"
-    ],
-    flags: [
-      "--app <app-name>",
-      "--api <url|local>",
-      "--config <path>",
-      "--env <env>",
-      "--format <env|json|yaml|shell>",
-      "--force",
-      "--json",
-      "--output <path>",
-      "--replace"
-    ],
-    examples: [
-      "pier secrets list",
-      "pier secrets get PUBLIC_API_URL",
-      "pier secrets list --env prod",
-      "pier secrets set API_TOKEN=secret --env prod",
-      "pier secrets download --env prod --format env --output .env.prod",
-      "pier secrets run --env dev -- bun test"
-    ]
-  },
   "shared-postgres": {
     title: "Shared Postgres",
     summary: "Provision shared Postgres schema and role credentials.",
@@ -61635,7 +61631,7 @@ var formatEnvironmentExplainText = (explain, options = {}) => {
   ].join(`
 `);
 };
-var formatSecretsListText = (explain, options = {}) => {
+var formatEnvValuesListText = (explain, options = {}) => {
   const style = createStyle(options);
   const target = [explain.projectSlug, explain.environment, options.app].filter(Boolean).join("/");
   return [
@@ -61780,87 +61776,476 @@ function padVisibleEnd(value, width) {
   return `${value}${" ".repeat(padding)}`;
 }
 
-// src/commands/env-command.ts
-var runEnvCommand = async (runtime) => {
-  const action = runtime.positionals[0];
-  const configPath = envConfigPath(action, runtime.positionals);
-  const config2 = await runtime.loadConfig(runtime.resolveConfigPath(configPath));
-  const manifest = runtime.scopedManifest(config2);
-  const apiUrl = runtime.requireApiUrl();
-  const environments2 = runtime.clientFor(apiUrl).environments;
-  if (action === "types") {
-    runtime.writeText(await runtime.writeEnvTypes(config2));
-    return;
+// src/runtime/env-scope.ts
+function resolveEnvScope(manifest, flags) {
+  const project = resolveProject(manifest, flags);
+  const environment = clean(flags.environment) ?? defaultEnvironment;
+  return {
+    environment,
+    manifest: { ...manifest, project },
+    project
+  };
+}
+function resolveProject(manifest, flags) {
+  const explicitProject = clean(flags.project) ?? clean(flags.projectSlug);
+  if (explicitProject) {
+    return {
+      id: explicitProject,
+      organizationId: clean(flags.organizationId) ?? manifest.project?.organizationId ?? "resolved-by-api",
+      slug: explicitProject
+    };
   }
-  if (action === "create") {
-    const name = runtime.positionals[1];
-    if (!name) {
-      runtime.fail("Missing environment name.");
+  if (manifest.project) {
+    return manifest.project;
+  }
+  const repoProject = clean(manifest.name);
+  if (!repoProject) {
+    throw new Error("Could not resolve a project. Pass --project <slug> or run inside a Pier app repo.");
+  }
+  return {
+    id: repoProject,
+    organizationId: clean(flags.organizationId) ?? "resolved-by-api",
+    slug: repoProject
+  };
+}
+function clean(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+
+// src/support/cli-args.ts
+var valueFlags = new Set([
+  "--api",
+  "--app",
+  "--actor",
+  "--artifact-key",
+  "--actor-type",
+  "--access-key-id",
+  "--account-id",
+  "--alloc-id",
+  "--audit-label",
+  "--api-url",
+  "--before",
+  "--body",
+  "--bucket",
+  "--comment",
+  "--confirm",
+  "--checksum",
+  "--content",
+  "--current-role",
+  "--deployment",
+  "--email",
+  "--endpoint",
+  "--env",
+  "--expires-in-days",
+  "--from-env",
+  "--format",
+  "--id",
+  "--kind",
+  "--key-prefix",
+  "--limit",
+  "--linked-account-id",
+  "--name",
+  "--next-role",
+  "--operation",
+  "--operations",
+  "--organization-id",
+  "--out",
+  "--outpost",
+  "--outpost-id",
+  "--output",
+  "--package",
+  "--package-scope",
+  "--preset",
+  "--project",
+  "--project-id",
+  "--purpose",
+  "--q",
+  "--repo",
+  "--request",
+  "--retention-days",
+  "--r2-presign-url",
+  "--role",
+  "--schema",
+  "--secret-access-key",
+  "--since",
+  "--source",
+  "--state",
+  "--slug",
+  "--tail",
+  "--task",
+  "--ttl",
+  "--ttl-seconds",
+  "--type",
+  "--until",
+  "--web-url",
+  "--zero-url",
+  "--job-id",
+  "--lines",
+  "--stream",
+  "--target-id",
+  "--zone-id",
+  "--record-id"
+]);
+function parseCliArgs(tokens) {
+  const flags = new Map;
+  const positionals = [];
+  let command;
+  for (let index = 0;index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (!token)
+      continue;
+    if (token === "--") {
+      positionals.push(...tokens.slice(index + 1));
+      break;
+    }
+    if (token === "-h") {
+      flags.set("--help", true);
+      continue;
+    }
+    if (token === "-f" || token === "-n" || token === "-q") {
+      flags.set(token === "-q" ? "--quiet" : token, true);
+      continue;
+    }
+    if (token.startsWith("--")) {
+      const [name = token, inlineValue] = token.split("=", 2);
+      if (inlineValue !== undefined) {
+        flags.set(name, inlineValue);
+        continue;
+      }
+      const next = tokens[index + 1];
+      if (next && !next.startsWith("-") && valueFlags.has(name)) {
+        flags.set(name, next);
+        index += 1;
+        continue;
+      }
+      flags.set(name, true);
+      continue;
+    }
+    if (!command) {
+      command = token;
+      continue;
+    }
+    positionals.push(token);
+  }
+  return {
+    ...command ? { command } : {},
+    flags,
+    help: flags.has("--help"),
+    positionals
+  };
+}
+
+// src/commands/env-values-command.ts
+var runEnvValuesCommand = async (runtime) => {
+  const action = runtime.positionals[0] ?? "list";
+  const config2 = await runtime.loadConfig(runtime.resolveConfigPath(envValuesConfigPath(action, runtime.positionals, runtime.processArgv)));
+  const manifest = runtime.scopedManifest(config2);
+  const scope = resolveEnvScope(manifest, {
+    environment: runtime.readFlag("--env"),
+    organizationId: runtime.readFlag("--organization-id"),
+    project: runtime.readFlag("--project"),
+    projectSlug: runtime.readFlag("--project-slug")
+  });
+  const explicitApi = runtime.readFlag(apiFlag);
+  const apiUrl = resolveHostedApiTarget({
+    ...explicitApi ? { explicitApi } : {}
+  });
+  const { environment } = scope;
+  if (action === "list") {
+    const app = runtime.readFlag("--app");
+    const explanation = await runtime.clientFor(apiUrl).environments.explain({
+      ...app ? { app } : {},
+      environment,
+      manifest: scope.manifest
+    });
+    if (runtime.readBooleanFlag("--json")) {
+      runtime.writeData(explanation);
+    } else {
+      runtime.writeText(formatEnvValuesListText(explanation, {
+        app,
+        color: runtime.shouldColorHumanOutput()
+      }));
     }
-    runtime.writeData(await environments2.create({
-      actor: runtime.user ?? defaultDeploySource,
-      kind: runtime.environmentKindFor(name, runtime.readFlag("--kind")),
-      manifest: runtime.toManifest(config2),
-      name,
-      source: { id: name, type: "manual" }
-    }));
     return;
   }
-  if (action === "explain") {
+  if (action === "get") {
     const name = runtime.positionals[1];
     if (!name) {
-      runtime.fail("Missing environment name.");
+      runtime.fail(`Usage: pier env get <name> [config-path] [--env <env>] [--app <app-name>] [${apiFlag} <url|local>] [--json]`);
     }
-    const explanation = await environments2.explain({
-      environment: name,
-      manifest
+    const value = await runtime.clientFor(apiUrl).env.get({
+      actor: runtime.user ?? defaultDeploySource,
+      app: runtime.readFlag("--app"),
+      environment,
+      manifest: scope.manifest,
+      name
     });
-    writeFormattedExplanation(runtime, explanation);
+    if (runtime.readBooleanFlag("--json")) {
+      runtime.writeData({ ...value, revealed: true });
+    } else {
+      runtime.writeText(value.value);
+    }
     return;
   }
-  if (action === "readiness") {
+  if (action === "set") {
+    const pairs = envSetPairs(runtime.positionals);
+    if (pairs.length === 0) {
+      runtime.fail(`Usage: pier env set <NAME=value>... [config-path] [--env <env>] [--app <app-name>] [${apiFlag} <url|local>]`);
+    }
+    const values = [];
+    for (const [name, value] of pairs) {
+      values.push(await runtime.clientFor(apiUrl).env.set({
+        actor: runtime.user ?? defaultDeploySource,
+        app: runtime.readFlag("--app"),
+        environment,
+        manifest: scope.manifest,
+        name,
+        source: runtime.detectDeploySource(),
+        value
+      }));
+    }
+    writeEnvSetOutput(runtime, { environment, values });
+    return;
+  }
+  if (action === "delete") {
     const name = runtime.positionals[1];
     if (!name) {
-      runtime.fail("Missing environment name.");
+      runtime.fail(`Usage: pier env delete <name> [config-path] [--env <env>] [--app <app-name>] [${apiFlag} <url|local>] [--json]`);
     }
-    const readiness = await environments2.readiness({
-      environment: name,
-      manifest
+    const result = await runtime.clientFor(apiUrl).env.delete({
+      actor: runtime.user ?? defaultDeploySource,
+      app: runtime.readFlag("--app"),
+      environment,
+      manifest: scope.manifest,
+      name
     });
     if (runtime.readBooleanFlag("--json")) {
-      runtime.writeData(readiness);
+      runtime.writeData(result);
     } else {
-      runtime.writeText(formatEnvironmentReadinessText(readiness));
+      runtime.writeText(`Deleted ${result.name} from ${environment}${result.targets.length ? ` for ${result.targets.join(", ")}` : ""}.`);
     }
-    return readiness.ok ? 0 : 1;
+    return;
   }
-  if (action === "list") {
-    runtime.writeData(await environments2.list({ manifest }));
+  if (action === "upload") {
+    const file2 = runtime.positionals[1];
+    if (!file2) {
+      runtime.fail(`Usage: pier env upload <dotenv-file> [config-path] [--env <env>] [--app <app-name>] [--dry-run] [--force] [${apiFlag} <url|local>]`);
+    }
+    await uploadEnvironmentValues(runtime, {
+      apiUrl,
+      environment,
+      file: file2,
+      manifest: scope.manifest
+    });
+    return;
+  }
+  if (action === "download") {
+    await downloadEnvironmentValues(runtime, {
+      apiUrl,
+      environment,
+      manifest: scope.manifest
+    });
     return;
   }
-  if (action === "values") {
-    const environment = runtime.positionals[1];
-    if (!environment) {
-      runtime.fail(`Usage: pier env values <env> [config-path] [--json] [${apiFlag} <url|local>]`);
+  if (action === "run") {
+    const separatorIndex = runtime.processArgv.indexOf("--");
+    const commandArgs = separatorIndex === -1 ? [] : runtime.processArgv.slice(separatorIndex + 1);
+    if (commandArgs.length === 0) {
+      runtime.fail(`Usage: pier env run [config-path] [--env <env>] [${apiFlag} <url|local>] -- <command...>`);
     }
-    const explanation = await environments2.explain({
+    await runtime.runCommandWithPierValues({
+      commandArgs,
+      config: config2,
       environment,
-      manifest
+      manifest: scope.manifest
     });
-    writeFormattedExplanation(runtime, explanation);
     return;
   }
-  runtime.fail(`Unknown env action: ${action ?? ""}`);
+  runtime.fail(`Unknown env action: ${action}`);
 };
-var writeFormattedExplanation = (runtime, explanation) => {
-  if (runtime.readBooleanFlag("--json")) {
+var uploadEnvironmentValues = async (runtime, input) => {
+  const values = await runtime.readDotenv(input.file);
+  const app = runtime.readFlag("--app");
+  const result = await runtime.clientFor(input.apiUrl).env.upload({
+    actor: runtime.user ?? defaultDeploySource,
+    ...app ? { app } : {},
+    dryRun: runtime.readBooleanFlag("--dry-run"),
+    environment: input.environment,
+    force: runtime.readBooleanFlag("--force"),
+    manifest: input.manifest,
+    replace: true,
+    values
+  });
+  writeEnvUploadOutput(runtime, result, input.file);
+};
+var downloadEnvironmentValues = async (runtime, input) => {
+  const output = await runtime.clientFor(input.apiUrl).env.download({
+    actor: runtime.user ?? defaultDeploySource,
+    app: runtime.readFlag("--app"),
+    environment: input.environment,
+    format: envDownloadFormat(runtime),
+    manifest: input.manifest
+  });
+  if (runtime.readBooleanFlag("--json")) {
+    runtime.writeData(output);
+    return;
+  }
+  const outputPath = runtime.readFlag("--output") ?? runtime.readFlag("--out");
+  if (outputPath) {
+    await runtime.writeFile(outputPath, output.value);
+  } else {
+    runtime.writeText(output.value);
+  }
+};
+var writeEnvSetOutput = (runtime, input) => {
+  if (runtime.readBooleanFlag("--json")) {
+    runtime.writeData(input);
+    return;
+  }
+  runtime.writeText([
+    `Updated ${input.values.length} value${suffix(input.values.length)} in ${input.environment}.`,
+    ...input.values.map((value) => `- ${value.name}${value.targets.length ? ` -> ${value.targets.join(", ")}` : ""}`)
+  ].join(`
+`));
+};
+var writeEnvUploadOutput = (runtime, result, file2) => {
+  if (runtime.readBooleanFlag("--json")) {
+    runtime.writeData({ ...result, file: file2 });
+    return;
+  }
+  runtime.writeText([
+    `${result.dryRun ? "Would update" : "Updated"} ${result.changed.length} value${suffix(result.changed.length)} in ${result.scope.projectSlug}/${result.scope.environment}.`,
+    result.removed.length ? `${result.dryRun ? "Would remove" : "Removed"} ${result.removed.length} value${suffix(result.removed.length)}.` : undefined,
+    result.unchanged.length ? `${result.unchanged.length} unchanged.` : undefined,
+    ...result.changed.map((value) => `- ${value.name} (${value.sensitive ? "sensitive" : "plain"})`),
+    ...result.warnings.map((warning) => warning.name ? `- skipped ${warning.name}: ${warning.reason}` : `- warning: ${warning.reason}`)
+  ].filter((line) => Boolean(line)).join(`
+`));
+};
+var envValuesConfigPath = (action, positionals, argv) => {
+  const explicit = readFlagFromPositionals("--config", positionals);
+  if (explicit) {
+    return explicit;
+  }
+  if (action === "get") {
+    return positionals[2];
+  }
+  if (action === "delete") {
+    return positionals[2];
+  }
+  if (action === "upload") {
+    return positionals[2];
+  }
+  if (action === "set") {
+    return positionals.slice(1).find((value) => !value.includes("="));
+  }
+  if (action === "run") {
+    return configPathBeforeSeparator(2, argv);
+  }
+  return positionals[1];
+};
+var envSetPairs = (positionals) => positionals.slice(1).flatMap((entry) => {
+  const equalsIndex = entry.indexOf("=");
+  if (equalsIndex <= 0) {
+    return [];
+  }
+  return [[entry.slice(0, equalsIndex), entry.slice(equalsIndex + 1)]];
+});
+var readFlagFromPositionals = (name, positionals) => {
+  const index = positionals.indexOf(name);
+  if (index === -1) {
+    return;
+  }
+  return positionals[index + 1];
+};
+var configPathBeforeSeparator = (startIndex, argv) => {
+  const separatorIndex = argv.indexOf("--");
+  const beforeSeparator = argv.slice(startIndex, separatorIndex === -1 ? undefined : separatorIndex);
+  return parseCliArgs(beforeSeparator).positionals[0];
+};
+var envDownloadFormat = (runtime) => {
+  const format2 = runtime.readFlag("--format") ?? "env";
+  if (format2 === "env" || format2 === "json" || format2 === "yaml" || format2 === "shell") {
+    return format2;
+  }
+  runtime.fail("--format must be one of: env, json, yaml, shell.");
+};
+var suffix = (count) => count === 1 ? "" : "s";
+
+// src/commands/env-command.ts
+var runEnvCommand = async (runtime) => {
+  const action = runtime.positionals[0];
+  if (action === "get" || action === "list" || action === "set" || action === "delete" || action === "upload" || action === "download" || action === "run") {
+    await runEnvValuesCommand(runtime);
+    return;
+  }
+  const configPath = envConfigPath(action, runtime.positionals);
+  const config2 = await runtime.loadConfig(runtime.resolveConfigPath(configPath));
+  const manifest = runtime.scopedManifest(config2);
+  const apiUrl = runtime.requireApiUrl();
+  const environments2 = runtime.clientFor(apiUrl).environments;
+  if (action === "types") {
+    runtime.writeText(await runtime.writeEnvTypes(config2));
+    return;
+  }
+  if (action === "create") {
+    const name = runtime.positionals[1];
+    if (!name) {
+      runtime.fail("Missing environment name.");
+    }
+    runtime.writeData(await environments2.create({
+      actor: runtime.user ?? defaultDeploySource,
+      kind: runtime.environmentKindFor(name, runtime.readFlag("--kind")),
+      manifest: runtime.toManifest(config2),
+      name,
+      source: { id: name, type: "manual" }
+    }));
+    return;
+  }
+  if (action === "explain") {
+    const name = runtime.positionals[1];
+    if (!name) {
+      runtime.fail("Missing environment name.");
+    }
+    const explanation = await environments2.explain({
+      environment: name,
+      manifest
+    });
+    writeFormattedExplanation(runtime, explanation);
+    return;
+  }
+  if (action === "readiness") {
+    const name = runtime.positionals[1];
+    if (!name) {
+      runtime.fail("Missing environment name.");
+    }
+    const readiness = await environments2.readiness({
+      environment: name,
+      manifest
+    });
+    if (runtime.readBooleanFlag("--json")) {
+      runtime.writeData(readiness);
+    } else {
+      runtime.writeText(formatEnvironmentReadinessText(readiness));
+    }
+    return readiness.ok ? 0 : 1;
+  }
+  if (action === "environments") {
+    runtime.writeData(await environments2.list({ manifest }));
+    return;
+  }
+  runtime.fail(`Unknown env action: ${action ?? ""}`);
+};
+var writeFormattedExplanation = (runtime, explanation) => {
+  if (runtime.readBooleanFlag("--json")) {
     runtime.writeData(explanation);
   } else {
     runtime.writeText(formatEnvironmentExplainText(explanation));
   }
 };
 var envConfigPath = (action, positionals) => {
-  if (action === "create" || action === "explain" || action === "readiness" || action === "values") {
+  if (action === "create" || action === "explain" || action === "readiness") {
     return positionals[2];
   }
   return positionals[1];
@@ -62439,11 +62824,11 @@ function parseRequestLine(message) {
   };
 }
 function parseLogJson(message) {
-  const clean = stripAnsiText(message).trim();
-  if (!clean.startsWith("{"))
+  const clean2 = stripAnsiText(message).trim();
+  if (!clean2.startsWith("{"))
     return null;
   try {
-    const parsed = JSON.parse(clean);
+    const parsed = JSON.parse(clean2);
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -63137,11 +63522,11 @@ function messageFor(error51) {
 // src/commands/package-command.ts
 var runPackageCommand = async (action, positionals, tokens, runtime) => {
   if (action === "add" || action === "install") {
-    const apiKey = await readStoredPierApiKey();
+    const apiKey = await readPackageApiKey();
     if (!apiKey) {
-      runtime.fail("No Pier API key is stored. Run pier login or pier config api-key set first.");
+      runtime.fail("No Pier API key is available. Set PIER_API_KEY, run pier login, or run pier config api-key set.");
     }
-    await runPackageManagerCommand(action, packageManagerArgs(tokens, action), { PIER_REGISTRY_TOKEN: apiKey }, runtime);
+    await runPackageManagerCommand(action, packageManagerArgs(tokens, action), { PIER_API_KEY: apiKey }, runtime);
     return;
   }
   if (action === "config") {
@@ -63149,9 +63534,9 @@ var runPackageCommand = async (action, positionals, tokens, runtime) => {
     const scope = runtime.readFlag("--scope") ?? "@pier";
     const registryUrl = registryUrlFor(apiUrl, runtime.localDaemonUrl);
     if (runtime.readBooleanFlag("--npmrc")) {
-      const apiKey = await readStoredPierApiKey();
+      const apiKey = await readPackageApiKey();
       if (!apiKey) {
-        runtime.fail("No Pier API key is stored. Run pier login or pier config api-key set first.");
+        runtime.fail("No Pier API key is available. Set PIER_API_KEY, run pier login, or run pier config api-key set.");
       }
       runtime.writeText(npmrcRegistryConfig(scope, registryUrl, apiKey));
       return;
@@ -63169,12 +63554,13 @@ var runPublishCommand = async (packageDirectory, runtime) => {
   await publishPackageCommand(packageDirectory, "pier publish", runtime);
 };
 var packageApiUrl = (runtime) => runtime.configuredApiUrl();
+var readPackageApiKey = async () => process.env.PIER_API_KEY || readStoredPierApiKey();
 var registryUrlFor = (apiUrl, localDaemonUrl) => {
   const resolved = apiUrl === "local" ? localDaemonUrl() : apiUrl;
   return `${resolved.replace(/\/+$/, "")}/npm/`;
 };
 var bunRegistryConfig = (scope, registryUrl) => `[install.scopes]
-"${scope}" = { url = "${registryUrl}", token = "$PIER_REGISTRY_TOKEN" }`;
+"${scope}" = { url = "${registryUrl}", token = "$PIER_API_KEY" }`;
 var packageManagerArgs = (tokens, action) => {
   const packageIndex = tokens.indexOf("package");
   if (packageIndex === -1) {
@@ -63186,11 +63572,11 @@ var packageManagerArgs = (tokens, action) => {
   }
   return tokens.slice(actionIndex + 1);
 };
-var runPackageManagerCommand = async (action, args, env, runtime) => {
+var runPackageManagerCommand = async (action, args, env2, runtime) => {
   const bunArgs = [action, ...args];
   await runtime.runCommand(["bun", ...bunArgs], {
     ...process.env,
-    PIER_REGISTRY_TOKEN: env.PIER_REGISTRY_TOKEN
+    PIER_API_KEY: env2.PIER_API_KEY
   });
 };
 var npmrcRegistryConfig = (scope, registryUrl, apiKey) => {
@@ -63666,9 +64052,9 @@ var formatProfileText = (profile) => {
 // src/commands/project-command.ts
 var runProjectCommand = async (runtime) => {
   const action = runtime.positionals[0] ?? "status";
-  if (action === "upsert") {
+  if (action === "create") {
     const config2 = await runtime.loadConfig(runtime.resolveConfigPath(runtime.positionals[1] ?? runtime.readFlag("--config")));
-    const output2 = await runtime.clientFor(runtime.requireApiUrl()).projects.upsert({
+    const output2 = await runtime.clientFor(runtime.requireApiUrl()).projects.create({
       actor: runtime.user ?? "unknown",
       manifest: runtime.toManifest(config2)
     });
@@ -63676,7 +64062,7 @@ var runProjectCommand = async (runtime) => {
       runtime.writeData(output2);
     } else {
       runtime.writeText([
-        `Project ${output2.project.name} (${output2.project.slug}) recorded`,
+        `Created project ${output2.project.name} (${output2.project.slug})`,
         `org=${output2.project.organizationId}`,
         `apps=${output2.appCount} bindings=${output2.bindingCount}`
       ].join(`
@@ -63739,7 +64125,7 @@ var formatProjectStatus = (project, environment) => {
 var projectUsage = () => [
   "Usage:",
   `  pier project status <project-slug> [--env <env>] [${apiFlag} <url|local>] [--json]`,
-  `  pier project upsert [config-path] [${apiFlag} <url|local>] [--json]`
+  `  pier project create [config-path] [${apiFlag} <url|local>] [--json]`
 ].join(`
 `);
 
@@ -63926,489 +64312,114 @@ var runProviderCommand = async (runtime) => {
       runtime.writeText(formatCloudflareResourceSnapshotMarkdown(snapshot));
     } else {
       runtime.writeData(snapshot);
-    }
-    return;
-  }
-  if (provider2 === "cloudflare" && action === "drift") {
-    const output = await client.cloudflareResourceDrift({
-      projectSlug: runtime.readFlag("--project")
-    });
-    if (runtime.readBooleanFlag("--markdown")) {
-      runtime.writeText(formatCloudflareResourceDriftMarkdown(output));
-    } else {
-      runtime.writeData(output);
-    }
-    return;
-  }
-  if (provider2 === "cloudflare" && action === "usage-queries") {
-    const output = await client.cloudflareUsageQueries({
-      datetimeEnd: runtime.readFlag("--until"),
-      datetimeStart: runtime.readFlag("--since"),
-      projectSlug: runtime.readFlag("--project")
-    });
-    if (runtime.readBooleanFlag("--markdown")) {
-      runtime.writeText(formatCloudflareUsageQueriesMarkdown(output));
-    } else {
-      runtime.writeData(output);
-    }
-    return;
-  }
-  runtime.fail("Usage: pier provider cloudflare <plan|connection-plan|drift|resources|usage-queries> [--markdown] [--api <url|local>]");
-};
-
-// src/format/restore-format.ts
-var formatRestorePlanMarkdown = (plan) => {
-  const lines = [
-    "# Pier Restore Plan",
-    "",
-    `Risk: ${plan.risk}`,
-    `Backup: ${plan.backup.checksum}`,
-    `Generated: ${plan.backup.generatedAt}`,
-    "",
-    "## Summary",
-    "",
-    `- Changes: ${plan.summary.changeCount}`,
-    `- Records to restore: ${plan.summary.restoreRecords}`,
-    `- Records to remove: ${plan.summary.removeRecords}`,
-    "",
-    "## Counts",
-    "",
-    `- Projects: ${plan.counts.projects}`,
-    `- Apps: ${plan.counts.apps}`,
-    `- Deployments: ${plan.counts.deployments}`,
-    `- Resources: ${plan.counts.resources}`,
-    `- Artifacts: ${plan.counts.artifacts}`,
-    `- Secrets: ${plan.counts.secrets}`,
-    `- Variables: ${plan.counts.variables}`,
-    "",
-    "## Changes",
-    "",
-    ...plan.changes.length ? plan.changes.map((change) => `- ${change}`) : ["- none"],
-    "",
-    "## Warnings",
-    "",
-    ...plan.warnings.length ? plan.warnings.map((warning) => `- ${warning}`) : ["- none"]
-  ];
-  return lines.join(`
-`);
-};
-
-// src/commands/restore-command.ts
-var runRestoreCommand = async (runtime) => {
-  const action = runtime.positionals[0];
-  const backupPath = runtime.positionals[1];
-  const apiUrl = runtime.requireApiUrl();
-  const restore = runtime.clientFor(apiUrl).backups.restore;
-  if (action === "plan") {
-    if (!backupPath || backupPath.startsWith("--")) {
-      runtime.fail(`Usage: pier restore plan <backup-json> [${apiFlag} <url|local>]`);
-    }
-    const backup = backupExportSchema.parse(await runtime.readJsonFile(backupPath));
-    const plan = await restore.plan({ backup });
-    if (runtime.readBooleanFlag("--markdown")) {
-      runtime.writeText(formatRestorePlanMarkdown(plan));
-    } else {
-      runtime.writeData(plan);
-    }
-    return;
-  }
-  if (action === "apply") {
-    if (!backupPath || backupPath.startsWith("--")) {
-      runtime.fail(`Usage: pier restore apply <backup-json> --checkpoint <hash> --reason <reason> --confirm <token> [${apiFlag} <url|local>]`);
-    }
-    const checkpointHash = runtime.readFlag("--checkpoint");
-    const reason = runtime.readFlag("--reason");
-    const confirmation = runtime.readFlag("--confirm");
-    if (!checkpointHash || !reason || !confirmation) {
-      runtime.fail("Restore apply requires --checkpoint, --reason, and --confirm.");
-    }
-    const backup = backupExportSchema.parse(await runtime.readJsonFile(backupPath));
-    runtime.writeData(await restore.apply({
-      actor: runtime.user ?? defaultDeploySource,
-      checkpointHash,
-      confirmation,
-      reason,
-      restorePlan: { backup }
-    }));
-    return;
-  }
-  runtime.fail(`Unknown restore action: ${action ?? ""}`);
-};
-
-// src/runtime/secrets-scope.ts
-function resolveSecretsScope(manifest, flags) {
-  const project = resolveProject(manifest, flags);
-  const environment = clean(flags.environment) ?? defaultEnvironment;
-  return {
-    environment,
-    manifest: { ...manifest, project },
-    project
-  };
-}
-function resolveProject(manifest, flags) {
-  const explicitProject = clean(flags.project) ?? clean(flags.projectSlug);
-  if (explicitProject) {
-    return {
-      id: explicitProject,
-      organizationId: clean(flags.organizationId) ?? manifest.project?.organizationId ?? "resolved-by-api",
-      slug: explicitProject
-    };
-  }
-  if (manifest.project) {
-    return manifest.project;
-  }
-  const repoProject = clean(manifest.name);
-  if (!repoProject) {
-    throw new Error("Could not resolve a project. Pass --project <slug> or run inside a Pier app repo.");
-  }
-  return {
-    id: repoProject,
-    organizationId: clean(flags.organizationId) ?? "resolved-by-api",
-    slug: repoProject
-  };
-}
-function clean(value) {
-  const trimmed = value?.trim();
-  return trimmed ? trimmed : undefined;
-}
-
-// src/support/cli-args.ts
-var valueFlags = new Set([
-  "--api",
-  "--app",
-  "--actor",
-  "--artifact-key",
-  "--actor-type",
-  "--access-key-id",
-  "--account-id",
-  "--alloc-id",
-  "--audit-label",
-  "--api-url",
-  "--before",
-  "--body",
-  "--bucket",
-  "--comment",
-  "--confirm",
-  "--checksum",
-  "--content",
-  "--current-role",
-  "--deployment",
-  "--email",
-  "--endpoint",
-  "--env",
-  "--expires-in-days",
-  "--from-env",
-  "--format",
-  "--id",
-  "--kind",
-  "--key-prefix",
-  "--limit",
-  "--linked-account-id",
-  "--name",
-  "--next-role",
-  "--operation",
-  "--operations",
-  "--organization-id",
-  "--out",
-  "--outpost",
-  "--outpost-id",
-  "--output",
-  "--package",
-  "--package-scope",
-  "--preset",
-  "--project",
-  "--project-id",
-  "--purpose",
-  "--q",
-  "--repo",
-  "--request",
-  "--retention-days",
-  "--r2-presign-url",
-  "--role",
-  "--schema",
-  "--secret-access-key",
-  "--since",
-  "--source",
-  "--state",
-  "--slug",
-  "--tail",
-  "--task",
-  "--ttl",
-  "--ttl-seconds",
-  "--type",
-  "--until",
-  "--web-url",
-  "--zero-url",
-  "--job-id",
-  "--lines",
-  "--stream",
-  "--target-id",
-  "--zone-id",
-  "--record-id"
-]);
-function parseCliArgs(tokens) {
-  const flags = new Map;
-  const positionals = [];
-  let command;
-  for (let index = 0;index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (!token)
-      continue;
-    if (token === "--") {
-      positionals.push(...tokens.slice(index + 1));
-      break;
-    }
-    if (token === "-h") {
-      flags.set("--help", true);
-      continue;
-    }
-    if (token === "-f" || token === "-n" || token === "-q") {
-      flags.set(token === "-q" ? "--quiet" : token, true);
-      continue;
-    }
-    if (token.startsWith("--")) {
-      const [name = token, inlineValue] = token.split("=", 2);
-      if (inlineValue !== undefined) {
-        flags.set(name, inlineValue);
-        continue;
-      }
-      const next = tokens[index + 1];
-      if (next && !next.startsWith("-") && valueFlags.has(name)) {
-        flags.set(name, next);
-        index += 1;
-        continue;
-      }
-      flags.set(name, true);
-      continue;
-    }
-    if (!command) {
-      command = token;
-      continue;
-    }
-    positionals.push(token);
-  }
-  return {
-    ...command ? { command } : {},
-    flags,
-    help: flags.has("--help"),
-    positionals
-  };
-}
-
-// src/commands/secrets-command.ts
-var runSecretsCommand = async (runtime) => {
-  const action = runtime.positionals[0] ?? "list";
-  const config2 = await runtime.loadConfig(runtime.resolveConfigPath(secretsConfigPath(action, runtime.positionals, runtime.processArgv)));
-  const manifest = runtime.scopedManifest(config2);
-  const scope = resolveSecretsScope(manifest, {
-    environment: runtime.readFlag("--env"),
-    organizationId: runtime.readFlag("--organization-id"),
-    project: runtime.readFlag("--project"),
-    projectSlug: runtime.readFlag("--project-slug")
-  });
-  const explicitApi = runtime.readFlag(apiFlag);
-  const apiUrl = resolveHostedApiTarget({
-    ...explicitApi ? { explicitApi } : {}
-  });
-  const { environment } = scope;
-  if (action === "list") {
-    const app = runtime.readFlag("--app");
-    const explanation = await runtime.clientFor(apiUrl).environments.explain({
-      ...app ? { app } : {},
-      environment,
-      manifest: scope.manifest
-    });
-    if (runtime.readBooleanFlag("--json")) {
-      runtime.writeData(explanation);
-    } else {
-      runtime.writeText(formatSecretsListText(explanation, {
-        app,
-        color: runtime.shouldColorHumanOutput()
-      }));
-    }
-    return;
-  }
-  if (action === "get") {
-    const name = runtime.positionals[1];
-    if (!name) {
-      runtime.fail(`Usage: pier secrets get <name> [config-path] [--env <env>] [--app <app-name>] [${apiFlag} <url|local>] [--json]`);
-    }
-    const secret = await runtime.clientFor(apiUrl).secrets.get({
-      actor: runtime.user ?? defaultDeploySource,
-      app: runtime.readFlag("--app"),
-      environment,
-      manifest: scope.manifest,
-      name
-    });
-    if (runtime.readBooleanFlag("--json")) {
-      runtime.writeData({ ...secret, revealed: true });
-    } else {
-      runtime.writeText(secret.value);
-    }
-    return;
-  }
-  if (action === "set") {
-    const pairs = secretsSetPairs(runtime.positionals);
-    if (pairs.length === 0) {
-      runtime.fail(`Usage: pier secrets set <NAME=value>... [config-path] [--env <env>] [--app <app-name>] [${apiFlag} <url|local>]`);
-    }
-    const values = [];
-    for (const [name, value] of pairs) {
-      values.push(await runtime.clientFor(apiUrl).secrets.set({
-        actor: runtime.user ?? defaultDeploySource,
-        app: runtime.readFlag("--app"),
-        environment,
-        manifest: scope.manifest,
-        name,
-        source: runtime.detectDeploySource(),
-        value
-      }));
-    }
-    writeSensitiveValueSetOutput(runtime, { environment, values });
-    return;
-  }
-  if (action === "upload") {
-    const file2 = runtime.positionals[1];
-    if (!file2) {
-      runtime.fail(`Usage: pier secrets upload <dotenv-file> [config-path] [--env <env>] [--app <app-name>] [--dry-run] [--replace --force] [${apiFlag} <url|local>]`);
-    }
-    await uploadEnvironmentValues(runtime, {
-      apiUrl,
-      environment,
-      file: file2,
-      manifest: scope.manifest
-    });
-    return;
-  }
-  if (action === "download") {
-    await downloadEnvironmentValues(runtime, {
-      apiUrl,
-      environment,
-      manifest: scope.manifest
-    });
-    return;
-  }
-  if (action === "run") {
-    const separatorIndex = runtime.processArgv.indexOf("--");
-    const commandArgs = separatorIndex === -1 ? [] : runtime.processArgv.slice(separatorIndex + 1);
-    if (commandArgs.length === 0) {
-      runtime.fail(`Usage: pier secrets run [config-path] [--env <env>] [${apiFlag} <url|local>] -- <command...>`);
-    }
-    await runtime.runCommandWithPierValues({
-      commandArgs,
-      config: config2,
-      environment,
-      manifest: scope.manifest
-    });
-    return;
-  }
-  runtime.fail(`Unknown secrets action: ${action}`);
-};
-var uploadEnvironmentValues = async (runtime, input) => {
-  const values = await runtime.readDotenv(input.file);
-  const app = runtime.readFlag("--app");
-  const result = await runtime.clientFor(input.apiUrl).secrets.upload({
-    actor: runtime.user ?? defaultDeploySource,
-    ...app ? { app } : {},
-    dryRun: runtime.readBooleanFlag("--dry-run"),
-    environment: input.environment,
-    force: runtime.readBooleanFlag("--force"),
-    manifest: input.manifest,
-    replace: runtime.readBooleanFlag("--replace"),
-    values
-  });
-  writeSecretsUploadOutput(runtime, result, input.file);
-};
-var downloadEnvironmentValues = async (runtime, input) => {
-  const output = await runtime.clientFor(input.apiUrl).secrets.download({
-    actor: runtime.user ?? defaultDeploySource,
-    app: runtime.readFlag("--app"),
-    environment: input.environment,
-    format: secretDownloadFormat(runtime),
-    manifest: input.manifest
-  });
-  if (runtime.readBooleanFlag("--json")) {
-    runtime.writeData(output);
-    return;
-  }
-  const outputPath = runtime.readFlag("--output") ?? runtime.readFlag("--out");
-  if (outputPath) {
-    await runtime.writeFile(outputPath, output.value);
-  } else {
-    runtime.writeText(output.value);
-  }
-};
-var writeSensitiveValueSetOutput = (runtime, input) => {
-  if (runtime.readBooleanFlag("--json")) {
-    runtime.writeData(input);
-    return;
-  }
-  runtime.writeText([
-    `Updated ${input.values.length} value${suffix(input.values.length)} in ${input.environment}.`,
-    ...input.values.map((value) => `- ${value.name}${value.targets.length ? ` -> ${value.targets.join(", ")}` : ""}`)
-  ].join(`
-`));
-};
-var writeSecretsUploadOutput = (runtime, result, file2) => {
-  if (runtime.readBooleanFlag("--json")) {
-    runtime.writeData({ ...result, file: file2 });
-    return;
-  }
-  runtime.writeText([
-    `${result.dryRun ? "Would update" : "Updated"} ${result.changed.length} value${suffix(result.changed.length)} in ${result.scope.projectSlug}/${result.scope.environment}.`,
-    result.removed.length ? `${result.dryRun ? "Would remove" : "Removed"} ${result.removed.length} value${suffix(result.removed.length)}.` : undefined,
-    result.unchanged.length ? `${result.unchanged.length} unchanged.` : undefined,
-    ...result.changed.map((value) => `- ${value.name} (${value.sensitive ? "sensitive" : "plain"})`),
-    ...result.warnings.map((warning) => warning.name ? `- skipped ${warning.name}: ${warning.reason}` : `- warning: ${warning.reason}`)
-  ].filter((line) => Boolean(line)).join(`
-`));
-};
-var secretsConfigPath = (action, positionals, argv) => {
-  const explicit = readFlagFromPositionals("--config", positionals);
-  if (explicit) {
-    return explicit;
-  }
-  if (action === "get") {
-    return positionals[2];
-  }
-  if (action === "upload") {
-    return positionals[2];
-  }
-  if (action === "set") {
-    return positionals.slice(1).find((value) => !value.includes("="));
-  }
-  if (action === "run") {
-    return configPathBeforeSeparator(3, argv);
+    }
+    return;
   }
-  return positionals[1];
-};
-var secretsSetPairs = (positionals) => positionals.slice(1).flatMap((entry) => {
-  const equalsIndex = entry.indexOf("=");
-  if (equalsIndex <= 0) {
-    return [];
+  if (provider2 === "cloudflare" && action === "drift") {
+    const output = await client.cloudflareResourceDrift({
+      projectSlug: runtime.readFlag("--project")
+    });
+    if (runtime.readBooleanFlag("--markdown")) {
+      runtime.writeText(formatCloudflareResourceDriftMarkdown(output));
+    } else {
+      runtime.writeData(output);
+    }
+    return;
   }
-  return [[entry.slice(0, equalsIndex), entry.slice(equalsIndex + 1)]];
-});
-var readFlagFromPositionals = (name, positionals) => {
-  const index = positionals.indexOf(name);
-  if (index === -1) {
+  if (provider2 === "cloudflare" && action === "usage-queries") {
+    const output = await client.cloudflareUsageQueries({
+      datetimeEnd: runtime.readFlag("--until"),
+      datetimeStart: runtime.readFlag("--since"),
+      projectSlug: runtime.readFlag("--project")
+    });
+    if (runtime.readBooleanFlag("--markdown")) {
+      runtime.writeText(formatCloudflareUsageQueriesMarkdown(output));
+    } else {
+      runtime.writeData(output);
+    }
     return;
   }
-  return positionals[index + 1];
+  runtime.fail("Usage: pier provider cloudflare <plan|connection-plan|drift|resources|usage-queries> [--markdown] [--api <url|local>]");
 };
-var configPathBeforeSeparator = (startIndex, argv) => {
-  const separatorIndex = argv.indexOf("--");
-  const beforeSeparator = argv.slice(startIndex, separatorIndex === -1 ? undefined : separatorIndex);
-  return parseCliArgs(beforeSeparator).positionals[0];
+
+// src/format/restore-format.ts
+var formatRestorePlanMarkdown = (plan) => {
+  const lines = [
+    "# Pier Restore Plan",
+    "",
+    `Risk: ${plan.risk}`,
+    `Backup: ${plan.backup.checksum}`,
+    `Generated: ${plan.backup.generatedAt}`,
+    "",
+    "## Summary",
+    "",
+    `- Changes: ${plan.summary.changeCount}`,
+    `- Records to restore: ${plan.summary.restoreRecords}`,
+    `- Records to remove: ${plan.summary.removeRecords}`,
+    "",
+    "## Counts",
+    "",
+    `- Projects: ${plan.counts.projects}`,
+    `- Apps: ${plan.counts.apps}`,
+    `- Deployments: ${plan.counts.deployments}`,
+    `- Resources: ${plan.counts.resources}`,
+    `- Artifacts: ${plan.counts.artifacts}`,
+    `- Secrets: ${plan.counts.secrets}`,
+    `- Variables: ${plan.counts.variables}`,
+    "",
+    "## Changes",
+    "",
+    ...plan.changes.length ? plan.changes.map((change) => `- ${change}`) : ["- none"],
+    "",
+    "## Warnings",
+    "",
+    ...plan.warnings.length ? plan.warnings.map((warning) => `- ${warning}`) : ["- none"]
+  ];
+  return lines.join(`
+`);
 };
-var secretDownloadFormat = (runtime) => {
-  const format2 = runtime.readFlag("--format") ?? "env";
-  if (format2 === "env" || format2 === "json" || format2 === "yaml" || format2 === "shell") {
-    return format2;
+
+// src/commands/restore-command.ts
+var runRestoreCommand = async (runtime) => {
+  const action = runtime.positionals[0];
+  const backupPath = runtime.positionals[1];
+  const apiUrl = runtime.requireApiUrl();
+  const restore = runtime.clientFor(apiUrl).backups.restore;
+  if (action === "plan") {
+    if (!backupPath || backupPath.startsWith("--")) {
+      runtime.fail(`Usage: pier restore plan <backup-json> [${apiFlag} <url|local>]`);
+    }
+    const backup = backupExportSchema.parse(await runtime.readJsonFile(backupPath));
+    const plan = await restore.plan({ backup });
+    if (runtime.readBooleanFlag("--markdown")) {
+      runtime.writeText(formatRestorePlanMarkdown(plan));
+    } else {
+      runtime.writeData(plan);
+    }
+    return;
   }
-  runtime.fail("--format must be one of: env, json, yaml, shell.");
+  if (action === "apply") {
+    if (!backupPath || backupPath.startsWith("--")) {
+      runtime.fail(`Usage: pier restore apply <backup-json> --checkpoint <hash> --reason <reason> --confirm <token> [${apiFlag} <url|local>]`);
+    }
+    const checkpointHash = runtime.readFlag("--checkpoint");
+    const reason = runtime.readFlag("--reason");
+    const confirmation = runtime.readFlag("--confirm");
+    if (!checkpointHash || !reason || !confirmation) {
+      runtime.fail("Restore apply requires --checkpoint, --reason, and --confirm.");
+    }
+    const backup = backupExportSchema.parse(await runtime.readJsonFile(backupPath));
+    runtime.writeData(await restore.apply({
+      actor: runtime.user ?? defaultDeploySource,
+      checkpointHash,
+      confirmation,
+      reason,
+      restorePlan: { backup }
+    }));
+    return;
+  }
+  runtime.fail(`Unknown restore action: ${action ?? ""}`);
 };
-var suffix = (count) => count === 1 ? "" : "s";
 
 // src/format/agent-format.ts
 function formatAgentNextActionsMarkdown(summary) {
@@ -64886,7 +64897,7 @@ function stripOuterQuotes(value) {
 import { existsSync, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname3, resolve as resolve2 } from "path";
-var pierConfigPath = (env) => env.PIER_CONFIG ?? resolve2(env.XDG_CONFIG_HOME ?? resolve2(homedir2(), ".config"), "pier/config.toml");
+var pierConfigPath = (env2) => env2.PIER_CONFIG ?? resolve2(env2.XDG_CONFIG_HOME ?? resolve2(homedir2(), ".config"), "pier/config.toml");
 var pierConfigTemplate = `# Pier CLI config
 #
 # Path:
@@ -64908,16 +64919,16 @@ url = "https://api.pier.dev.dawson.gg"
 [api.profiles.prod]
 url = "${hostedApiUrl}"
 `;
-var readPierCliConfig = (env = process.env) => {
-  const path2 = pierConfigPath(env);
+var readPierCliConfig = (env2 = process.env) => {
+  const path2 = pierConfigPath(env2);
   if (!existsSync(path2)) {
     return {};
   }
   const parsed = Bun.TOML.parse(readFileSync2(path2, "utf8"));
   return normalizePierCliConfig(parsed);
 };
-var writePierCliConfigTemplate = (env = process.env, options = {}) => {
-  const path2 = pierConfigPath(env);
+var writePierCliConfigTemplate = (env2 = process.env, options = {}) => {
+  const path2 = pierConfigPath(env2);
   if (existsSync(path2) && !options.force) {
     return { created: false, path: path2 };
   }
@@ -65222,10 +65233,10 @@ var runDoctorReport = (input) => {
     requiredVariables
   };
 };
-var requiredVariableStatuses = (vars, env) => Object.entries(vars).filter(([, definition]) => !definition.isOptional).map(([name, definition]) => ({
+var requiredVariableStatuses = (vars, env2) => Object.entries(vars).filter(([, definition]) => !definition.isOptional).map(([name, definition]) => ({
   kind: definition.kind,
   name,
-  present: Boolean(env[name]),
+  present: Boolean(env2[name]),
   ...definition.isSensitive ? { sensitive: true } : {}
 }));
 var doctorFindings = (input, requiredVariables) => {
@@ -65378,8 +65389,8 @@ function generateVariableValue(definition) {
 function dotenvValue(value) {
   return /^[A-Za-z0-9_./:@-]+$/.test(value) ? value : JSON.stringify(value);
 }
-function applyEnv(env) {
-  for (const [name, value] of Object.entries(env)) {
+function applyEnv(env2) {
+  for (const [name, value] of Object.entries(env2)) {
     process.env[name] = value;
   }
 }
@@ -67269,7 +67280,7 @@ function Postgres(a, b2) {
 function parseOptions(a, b2) {
   if (a && a.shared)
     return a;
-  const env = process.env, o = (!a || typeof a === "string" ? b2 : a) || {}, { url: url2, multihost } = parseUrl(a), query = [...url2.searchParams].reduce((a2, [b3, c]) => (a2[b3] = c, a2), {}), host = o.hostname || o.host || multihost || url2.hostname || env.PGHOST || "localhost", port = o.port || url2.port || env.PGPORT || 5432, user = o.user || o.username || url2.username || env.PGUSERNAME || env.PGUSER || osUsername();
+  const env2 = process.env, o = (!a || typeof a === "string" ? b2 : a) || {}, { url: url2, multihost } = parseUrl(a), query = [...url2.searchParams].reduce((a2, [b3, c]) => (a2[b3] = c, a2), {}), host = o.hostname || o.host || multihost || url2.hostname || env2.PGHOST || "localhost", port = o.port || url2.port || env2.PGPORT || 5432, user = o.user || o.username || url2.username || env2.PGUSERNAME || env2.PGUSER || osUsername();
   o.no_prepare && (o.prepare = false);
   query.sslmode && (query.ssl = query.sslmode, delete query.sslmode);
   "timeout" in o && (console.log("The timeout option is deprecated, use idle_timeout instead"), o.idle_timeout = o.timeout);
@@ -67295,21 +67306,21 @@ function parseOptions(a, b2) {
     host: Array.isArray(host) ? host : host.split(",").map((x) => x.split(":")[0]),
     port: Array.isArray(port) ? port : host.split(",").map((x) => parseInt(x.split(":")[1] || port)),
     path: o.path || host.indexOf("/") > -1 && host + "/.s.PGSQL." + port,
-    database: o.database || o.db || (url2.pathname || "").slice(1) || env.PGDATABASE || user,
+    database: o.database || o.db || (url2.pathname || "").slice(1) || env2.PGDATABASE || user,
     user,
-    pass: o.pass || o.password || url2.password || env.PGPASSWORD || "",
+    pass: o.pass || o.password || url2.password || env2.PGPASSWORD || "",
     ...Object.entries(defaults2).reduce((acc, [k, d]) => {
-      const value = k in o ? o[k] : (k in query) ? query[k] === "disable" || query[k] === "false" ? false : query[k] : env["PG" + k.toUpperCase()] || d;
+      const value = k in o ? o[k] : (k in query) ? query[k] === "disable" || query[k] === "false" ? false : query[k] : env2["PG" + k.toUpperCase()] || d;
       acc[k] = typeof value === "string" && ints.includes(k) ? +value : value;
       return acc;
     }, {}),
     connection: {
-      application_name: env.PGAPPNAME || "postgres.js",
+      application_name: env2.PGAPPNAME || "postgres.js",
       ...o.connection,
       ...Object.entries(query).reduce((acc, [k, v]) => ((k in defaults2) || (acc[k] = v), acc), {})
     },
     types: o.types || {},
-    target_session_attrs: tsa(o, url2, env),
+    target_session_attrs: tsa(o, url2, env2),
     onnotice: o.onnotice,
     onnotify: o.onnotify,
     onclose: o.onclose,
@@ -67321,8 +67332,8 @@ function parseOptions(a, b2) {
     ...mergeUserTypes(o.types)
   };
 }
-function tsa(o, url2, env) {
-  const x = o.target_session_attrs || url2.searchParams.get("target_session_attrs") || env.PGTARGETSESSIONATTRS;
+function tsa(o, url2, env2) {
+  const x = o.target_session_attrs || url2.searchParams.get("target_session_attrs") || env2.PGTARGETSESSIONATTRS;
   if (!x || ["read-write", "read-only", "primary", "standby", "prefer-standby"].includes(x))
     return x;
   throw new Error("target_session_attrs " + x + " is not supported");
@@ -67923,45 +67934,29 @@ async function runPierCommand(tokens) {
     }
     if (command === "env") {
       const exitCode = await runEnvCommand({
-        clientFor,
-        environmentKindFor,
-        fail,
-        loadConfig,
-        positionals: cli.positionals,
-        readBooleanFlag,
-        readFlag,
-        requireApiUrl,
-        resolveConfigPath,
-        scopedManifest,
-        toManifest,
-        user: process.env.USER,
-        writeData,
-        writeEnvTypes,
-        writeText
-      });
-      process.exit(exitCode ?? 0);
-    }
-    if (command === "secrets") {
-      await runSecretsCommand({
         clientFor,
         detectDeploySource,
+        environmentKindFor,
         fail,
         loadConfig,
         positionals: cli.positionals,
-        processArgv: process.argv,
+        processArgv: cliTokens,
         readBooleanFlag,
         readDotenv,
         readFlag,
+        requireApiUrl,
         resolveConfigPath,
         runCommandWithPierValues,
         scopedManifest,
         shouldColorHumanOutput,
+        toManifest,
         user: process.env.USER,
         writeData,
+        writeEnvTypes,
         writeFile: writeFile5,
         writeText
       });
-      process.exit(0);
+      process.exit(exitCode ?? 0);
     }
     if (command === "domains") {
       await runDomainsCommand({
@@ -68299,18 +68294,18 @@ async function runCommandWithPierValues(input) {
     environment: input.environment,
     manifest: input.manifest
   });
-  const env = {
+  const env2 = {
     ...runtimeEnv,
     ...values2.values
   };
-  const missing = missingRequiredRunValues(input.manifest, env);
+  const missing = missingRequiredRunValues(input.manifest, env2);
   if (missing.length) {
     fail(`Missing required values for ${input.environment}: ${missing.join(", ")}`);
   }
-  await runCommand2([...input.commandArgs], devEnvForChild(env));
+  await runCommand2([...input.commandArgs], devEnvForChild(env2));
 }
 async function resolvePierRunValues(input) {
-  const client = clientFor(input.apiUrl).secrets;
+  const client = clientFor(input.apiUrl).env;
   if (input.app) {
     return client.resolveForRun({
       actor: input.actor,
@@ -68343,8 +68338,8 @@ async function resolvePierRunValues(input) {
     })
   };
 }
-function missingRequiredRunValues(manifest, env) {
-  return manifest.vars.filter((definition) => !definition.optional).map((definition) => definition.name).filter((name) => !env[name]).toSorted();
+function missingRequiredRunValues(manifest, env2) {
+  return manifest.vars.filter((definition) => !definition.optional).map((definition) => definition.name).filter((name) => !env2[name]).toSorted();
 }
 function configuredApiUrl() {
   const explicitApi = readFlag(apiFlag);
@@ -68507,9 +68502,9 @@ async function recordLocalDaemonResourceStatus(input) {
     projectSlug: input.projectSlug
   });
 }
-async function runDevCommand(args, env, config2, appName) {
+async function runDevCommand(args, env2, config2, appName) {
   const child = Bun.spawn(args, {
-    env,
+    env: env2,
     stderr: "pipe",
     stdin: "inherit",
     stdout: "pipe"
@@ -68525,9 +68520,9 @@ async function runDevCommand(args, env, config2, appName) {
   await recordDevSessionExit(config2, appName, exitCode);
   process.exit(exitCode);
 }
-async function runDevWorkerCommand(runtime, env, config2, appName) {
+async function runDevWorkerCommand(runtime, env2, config2, appName) {
   const child = Bun.spawn(["node", runtime.entrypoint, runtime.configPath], {
-    env,
+    env: env2,
     stderr: "pipe",
     stdin: "inherit",
     stdout: "pipe"
@@ -68625,18 +68620,18 @@ function ignoredWatchPath(path2) {
   const normalized = path2.replaceAll("\\", "/");
   return normalized === ".pier" || normalized.startsWith(".pier/") || normalized.includes("/.pier/") || normalized === "node_modules" || normalized.startsWith("node_modules/") || normalized.includes("/node_modules/") || normalized.endsWith(".map") || normalized.endsWith("~");
 }
-function devEnvForChild(env) {
-  if (!shouldForceColor(env)) {
-    return env;
+function devEnvForChild(env2) {
+  if (!shouldForceColor(env2)) {
+    return env2;
   }
   return {
-    ...env,
-    CLICOLOR_FORCE: env.CLICOLOR_FORCE ?? "1",
-    FORCE_COLOR: env.FORCE_COLOR ?? "1"
+    ...env2,
+    CLICOLOR_FORCE: env2.CLICOLOR_FORCE ?? "1",
+    FORCE_COLOR: env2.FORCE_COLOR ?? "1"
   };
 }
-function shouldForceColor(env) {
-  if (env.NO_COLOR) {
+function shouldForceColor(env2) {
+  if (env2.NO_COLOR) {
     return false;
   }
   return process.stdout.isTTY || process.stderr.isTTY;
@@ -68970,10 +68965,10 @@ async function deploySingleApp(config2, appName, options, deploymentGroup) {
     }
     stage = "env";
     writeStatus(formatDeployAppProgress(appName, "env"));
-    const env = await loadCliEnv(config2, { environment: options.environment });
+    const env2 = await loadCliEnv(config2, { environment: options.environment });
     stage = "artifact";
     writeStatus(formatDeployAppProgress(appName, "artifact"));
-    const artifact = deploymentArtifactSchema.parse(await buildDeploymentArtifact({ appName, config: config2, env }));
+    const artifact = deploymentArtifactSchema.parse(await buildDeploymentArtifact({ appName, config: config2, env: env2 }));
     writeStatus(formatDeploymentArtifactSummary(appName, artifact));
     stage = "variables";
     writeStatus(formatDeployAppProgress(appName, "variables"));
@@ -69048,14 +69043,14 @@ async function directDeployApp(config2, appName, options) {
   if (!isWorkerAppSlotKind2(app.kind) && app.kind !== "tanstack-start-app" && app.kind !== "astro-site") {
     fail(`Direct deploy is not implemented for app kind: ${app.kind}`);
   }
-  const env = await loadCliEnv(config2, { environment: options.environment });
-  const accountId = env.CLOUDFLARE_ACCOUNT_ID;
-  const apiToken = env.CLOUDFLARE_API_TOKEN;
+  const env2 = await loadCliEnv(config2, { environment: options.environment });
+  const accountId = env2.CLOUDFLARE_ACCOUNT_ID;
+  const apiToken = env2.CLOUDFLARE_API_TOKEN;
   if (!accountId || !apiToken) {
     fail("Direct deploy requires CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN.");
   }
   const cloudflare2 = createCloudflareApi({ accountId, apiToken });
-  const artifact = await buildDeploymentArtifact({ appName, config: config2, env });
+  const artifact = await buildDeploymentArtifact({ appName, config: config2, env: env2 });
   const variables = await collectDeploymentVars(config2, appName, {
     environment: options.environment
   });
@@ -69143,8 +69138,8 @@ async function exportCloudflareApp(config2, appName, options) {
   if (!isWorkerAppSlotKind2(app.kind) && app.kind !== "tanstack-start-app" && app.kind !== "astro-site") {
     fail(`Cloudflare export is not implemented for app kind: ${app.kind}`);
   }
-  const env = await loadCliEnv(config2, { environment: options.environment });
-  const artifact = await buildDeploymentArtifact({ appName, config: config2, env });
+  const env2 = await loadCliEnv(config2, { environment: options.environment });
+  const artifact = await buildDeploymentArtifact({ appName, config: config2, env: env2 });
   const variables = await collectDeploymentVars(config2, appName, {
     environment: options.environment
   });
@@ -69279,13 +69274,13 @@ async function collectDeploymentVars(config2, appName, options = {}) {
     fail(`Unknown app: ${appName}`);
   }
   const names = app.vars ?? Object.keys(config2.vars ?? {});
-  const env = await loadCliEnv(config2, options);
+  const env2 = await loadCliEnv(config2, options);
   return names.flatMap((name) => {
     const definition = config2.vars?.[name];
     if (!definition) {
       fail(`App "${appName}" references unknown var "${name}".`);
     }
-    const value = deploymentVariableValue(definition, env[name]);
+    const value = deploymentVariableValue(definition, env2[name]);
     if (value === undefined || value === "") {
       return [];
     }
@@ -69352,31 +69347,31 @@ function deploymentVariableValue(definition, value) {
   return;
 }
 async function loadCliEnv(config2, options = {}) {
-  const env = { ...process.env };
+  const env2 = { ...process.env };
   for (const path2 of cliEnvFiles(options.environment)) {
     const values2 = await readDotenv(path2);
     for (const [name, value] of Object.entries(values2)) {
-      if (!env[name]) {
-        env[name] = value;
+      if (!env2[name]) {
+        env2[name] = value;
       }
     }
   }
-  env.PIER_ENV = options.environment ?? env.PIER_ENV ?? defaultEnvironment;
+  env2.PIER_ENV = options.environment ?? env2.PIER_ENV ?? defaultEnvironment;
   if (config2) {
-    await materializeGeneratedEnv(config2, env);
-    applyDefaultEnvValues(config2, env);
-    expandPublicEnvAliases(config2, env);
+    await materializeGeneratedEnv(config2, env2);
+    applyDefaultEnvValues(config2, env2);
+    expandPublicEnvAliases(config2, env2);
   }
-  return env;
+  return env2;
 }
-function applyDefaultEnvValues(config2, env) {
+function applyDefaultEnvValues(config2, env2) {
   for (const [name, definition] of Object.entries(config2.vars ?? {})) {
-    if (env[name] || !definition.hasDefault) {
+    if (env2[name] || !definition.hasDefault) {
       continue;
     }
     const value = deploymentVariableValue(definition, undefined);
     if (value !== undefined && value !== "") {
-      env[name] = serializeDeploymentVariable(definition, value);
+      env2[name] = serializeDeploymentVariable(definition, value);
     }
   }
 }
@@ -69386,8 +69381,8 @@ function cliEnvFiles(environment) {
   }
   return [".env", ".env.dev", "apps/api/.env"];
 }
-function expandPublicEnvAliases(config2, env) {
-  const output = env;
+function expandPublicEnvAliases(config2, env2) {
+  const output = env2;
   for (const [name, definition] of Object.entries(config2.vars ?? {})) {
     if (!definition.isPublic) {
       continue;
@@ -69402,11 +69397,11 @@ function expandPublicEnvAliases(config2, env) {
       output[alias] = value;
     }
   }
-  return env;
+  return env2;
 }
-async function materializeGeneratedEnv(config2, env) {
+async function materializeGeneratedEnv(config2, env2) {
   const generated = Object.entries(config2.vars ?? {}).flatMap(([name, definition]) => {
-    if (!definition.generator || env[name]) {
+    if (!definition.generator || env2[name]) {
       return [];
     }
     return [[name, generateVariableValue(definition)]];
@@ -69423,7 +69418,7 @@ async function materializeGeneratedEnv(config2, env) {
 ${lines}
 `);
   for (const [name, value] of generated) {
-    env[name] = value;
+    env2[name] = value;
   }
 }
 function detectDeploySource() {
@@ -70066,12 +70061,12 @@ function resolveServiceBindings(config2, bindingNames) {
     service: workerName2(config2, binding.target ?? name.toLowerCase())
   }));
 }
-function resolveVars(config2, bindingNames, port, env = process.env) {
+function resolveVars(config2, bindingNames, port, env2 = process.env) {
   const values2 = {};
   const vars = config2.vars ?? {};
   for (const [name, definition] of Object.entries(vars)) {
-    if (env[name]) {
-      values2[name] = env[name];
+    if (env2[name]) {
+      values2[name] = env2[name];
       continue;
     }
     if (definition.hasDefault) {
@@ -70111,7 +70106,7 @@ function runAppFromContext(config2) {
   const appNames = Object.keys(config2.apps ?? {});
   return appNames.length === 1 ? appNames[0] : undefined;
 }
-async function runCommand2(args, env, options = {}) {
+async function runCommand2(args, env2, options = {}) {
   if (args.length === 0) {
     fail("Missing command.");
   }
@@ -70119,7 +70114,7 @@ async function runCommand2(args, env, options = {}) {
   const exitCode = await new Promise((resolve5, reject) => {
     const child = nodeSpawn(command2, commandArgs, {
       ...options.cwd ? { cwd: options.cwd } : {},
-      env,
+      env: env2,
       stdio: "inherit"
     });
     child.on("error", reject);
@@ -71006,10 +71001,13 @@ async function withApiAuth(init2) {
   };
 }
 async function optionalPierApiKey() {
-  const envApiKey = process.env.PIER_DEPLOY_TOKEN ?? process.env.PIER_PACKAGE_PUBLISH_TOKEN ?? process.env.PIER_API_KEY;
+  const envApiKey = process.env.PIER_API_KEY;
   if (envApiKey) {
     return envApiKey;
   }
+  if (process.env.PIER_DISABLE_STORED_API_KEY === "1") {
+    return;
+  }
   return readStoredPierApiKey().catch(() => {
     return;
   });
@@ -71185,169 +71183,6 @@ class HelpCommand2 extends Command {
   }
 }
 
-class SecretsListCommand extends Command {
-  static paths = [["secrets"], ["secrets", "list"]];
-  static usage = Command.Usage({
-    description: "List Pier cloud runtime values declared by platform.config.ts.",
-    examples: [
-      ["List dev values", "$0 secrets list"],
-      ["List prod values", "$0 secrets list --env prod"]
-    ]
-  });
-  config = exports_options.String({ name: "config", required: false });
-  env = exports_options.String("--env");
-  app = exports_options.String("--app");
-  api = exports_options.String("--api");
-  organizationId = exports_options.String("--organization-id");
-  project = exports_options.String("--project");
-  json = exports_options.Boolean("--json", false);
-  quiet = exports_options.Boolean("--quiet", false);
-  async execute() {
-    await this.context.runPierCommand([
-      "secrets",
-      "list",
-      ...optional2(this.config),
-      ...commonSecretFlags(this),
-      ...booleanFlag("--json", this.json),
-      ...booleanFlag("--quiet", this.quiet)
-    ]);
-  }
-}
-
-class SecretsGetCommand extends Command {
-  static paths = [["secrets", "get"]];
-  static usage = Command.Usage({
-    description: "Print one Pier cloud runtime value.",
-    examples: [
-      ["Read a dev value", "$0 secrets get API_URL"],
-      ["Read a prod app value", "$0 secrets get API_URL --env prod --app api"]
-    ]
-  });
-  name = exports_options.String({ name: "name" });
-  config = exports_options.String({ name: "config", required: false });
-  env = exports_options.String("--env");
-  app = exports_options.String("--app");
-  api = exports_options.String("--api");
-  organizationId = exports_options.String("--organization-id");
-  project = exports_options.String("--project");
-  json = exports_options.Boolean("--json", false);
-  quiet = exports_options.Boolean("--quiet", false);
-  async execute() {
-    await this.context.runPierCommand([
-      "secrets",
-      "get",
-      this.name,
-      ...optional2(this.config),
-      ...commonSecretFlags(this),
-      ...booleanFlag("--json", this.json),
-      ...booleanFlag("--quiet", this.quiet)
-    ]);
-  }
-}
-
-class SecretsSetCommand extends Command {
-  static paths = [["secrets", "set"]];
-  static usage = Command.Usage({
-    description: "Set one or more Pier cloud runtime values.",
-    examples: [
-      ["Set a prod secret", "$0 secrets set API_TOKEN=secret --env prod"]
-    ]
-  });
-  pairs = exports_options.Rest({ name: "NAME=value", required: 1 });
-  env = exports_options.String("--env");
-  app = exports_options.String("--app");
-  api = exports_options.String("--api");
-  organizationId = exports_options.String("--organization-id");
-  project = exports_options.String("--project");
-  json = exports_options.Boolean("--json", false);
-  quiet = exports_options.Boolean("--quiet", false);
-  async execute() {
-    await this.context.runPierCommand([
-      "secrets",
-      "set",
-      ...this.pairs,
-      ...commonSecretFlags(this),
-      ...booleanFlag("--json", this.json),
-      ...booleanFlag("--quiet", this.quiet)
-    ]);
-  }
-}
-
-class SecretsUploadCommand extends Command {
-  static paths = [["secrets", "upload"]];
-  static usage = Command.Usage({
-    description: "Upload Pier cloud runtime values from a dotenv file.",
-    examples: [
-      ["Preview an upload", "$0 secrets upload .env.prod --env prod --dry-run"],
-      ["Upload prod values", "$0 secrets upload .env.prod --env prod"]
-    ]
-  });
-  file = exports_options.String({ name: "dotenv-file" });
-  config = exports_options.String({ name: "config", required: false });
-  env = exports_options.String("--env");
-  app = exports_options.String("--app");
-  api = exports_options.String("--api");
-  organizationId = exports_options.String("--organization-id");
-  project = exports_options.String("--project");
-  dryRun = exports_options.Boolean("--dry-run", false);
-  force = exports_options.Boolean("-f,--force", false);
-  replace = exports_options.Boolean("--replace", false);
-  json = exports_options.Boolean("--json", false);
-  quiet = exports_options.Boolean("--quiet", false);
-  async execute() {
-    await this.context.runPierCommand([
-      "secrets",
-      "upload",
-      this.file,
-      ...optional2(this.config),
-      ...commonSecretFlags(this),
-      ...booleanFlag("--dry-run", this.dryRun),
-      ...booleanFlag("--replace", this.replace),
-      ...booleanFlag("--force", this.force),
-      ...booleanFlag("--json", this.json),
-      ...booleanFlag("--quiet", this.quiet)
-    ]);
-  }
-}
-
-class SecretsDownloadCommand extends Command {
-  static paths = [["secrets", "download"]];
-  static usage = Command.Usage({
-    description: "Download Pier cloud runtime values.",
-    examples: [
-      ["Print prod dotenv", "$0 secrets download --env prod"],
-      [
-        "Write prod dotenv",
-        "$0 secrets download --env prod --output .env.prod"
-      ]
-    ]
-  });
-  config = exports_options.String({ name: "config", required: false });
-  env = exports_options.String("--env");
-  app = exports_options.String("--app");
-  api = exports_options.String("--api");
-  organizationId = exports_options.String("--organization-id");
-  project = exports_options.String("--project");
-  format = exports_options.String("--format", "env");
-  output = exports_options.String("--output");
-  out = exports_options.String("--out");
-  json = exports_options.Boolean("--json", false);
-  quiet = exports_options.Boolean("--quiet", false);
-  async execute() {
-    await this.context.runPierCommand([
-      "secrets",
-      "download",
-      ...optional2(this.config),
-      ...commonSecretFlags(this),
-      "--format",
-      this.format,
-      ...optionalFlag("--output", this.output ?? this.out),
-      ...booleanFlag("--json", this.json),
-      ...booleanFlag("--quiet", this.quiet)
-    ]);
-  }
-}
-
 class DeployCommand extends Command {
   static paths = [["deploy"]];
   static usage = Command.Usage({
@@ -71383,7 +71218,7 @@ class EnvCommand extends Command {
     description: "Inspect, generate, and sync Pier runtime environment values.",
     examples: [
       ["Generate env types", "$0 env types"],
-      ["List prod API values", "$0 env values prod --app api"]
+      ["List prod API values", "$0 env list --env prod --app api"]
     ]
   });
   args = exports_options.Rest({ name: "args" });
@@ -71393,12 +71228,16 @@ class EnvCommand extends Command {
   env = exports_options.String("--env");
   format = exports_options.String("--format");
   kind = exports_options.String("--kind");
+  organizationId = exports_options.String("--organization-id");
   out = exports_options.String("--out");
   output = exports_options.String("--output");
+  project = exports_options.String("--project");
+  force = exports_options.Boolean("-f,--force", false);
   dryRun = exports_options.Boolean("--dry-run", false);
   json = exports_options.Boolean("--json", false);
+  quiet = exports_options.Boolean("--quiet", false);
   async execute() {
-    const args = this.args.length ? this.args : this.kind && ["list", "types", "values"].includes(this.kind) ? [this.kind] : [];
+    const args = this.args.length ? this.args : this.kind && ["list", "types"].includes(this.kind) ? [this.kind] : [];
     await this.context.runPierCommand([
       "env",
       ...args,
@@ -71561,11 +71400,6 @@ var createPierCli = () => {
   });
   cli2.register(RootCommand);
   cli2.register(HelpCommand2);
-  cli2.register(SecretsListCommand);
-  cli2.register(SecretsGetCommand);
-  cli2.register(SecretsSetCommand);
-  cli2.register(SecretsUploadCommand);
-  cli2.register(SecretsDownloadCommand);
   cli2.register(DeployCommand);
   cli2.register(EnvCommand);
   cli2.register(DomainsCommand);
@@ -71587,18 +71421,6 @@ var executePierCli = async (argv = process.argv.slice(2)) => {
     runPierCommand
   });
 };
-function commonSecretFlags(input) {
-  return [
-    ...optionalFlag("--env", input.env),
-    ...optionalFlag("--app", input.app),
-    ...optionalFlag("--api", input.api),
-    ...optionalFlag("--organization-id", input.organizationId),
-    ...optionalFlag("--project", input.project)
-  ];
-}
-function optional2(value) {
-  return value ? [value] : [];
-}
 function optionalFlag(name, value) {
   return value ? [name, value] : [];
 }
@@ -71630,7 +71452,7 @@ var allowedFlagsByCommand = {
   doctor: flags("api"),
   domains: flags("api", "markdown"),
   dns: flags("api", "comment", "content", "id", "json", "name", "organizationId", "priority", "proxied", "recordId", "ttl", "type", "zoneId"),
-  env: flags("api", "app", "dryRun", "env", "format", "json", "kind", "out", "output"),
+  env: flags("api", "app", "dryRun", "env", "force", "format", "json", "kind", "organizationId", "out", "output", "project", "quiet"),
   export: flags("env", "out"),
   inspect: flags("json"),
   lifecycle: flags("api", "env", "markdown", "project"),