@cimplify/cli 0.2.0

package/dist/domains-3RJ4T5IX.mjs

@@ -0,0 +1,387 @@
+#!/usr/bin/env node
+import { promptYesNo } from './chunk-L6474RPL.mjs';
+import { ENV_SCOPE, DOMAIN_TYPE } from './chunk-MQMNWLMU.mjs';
+import { parseArgs, flagBool, flagString } from './chunk-D7D75ONX.mjs';
+import { ApiClient } from './chunk-4ZVTPMUZ.mjs';
+import { readAuth, readProjectLink } from './chunk-JJYWETGA.mjs';
+import { CliError, CLI_ERROR_CODE, info, dim, result, bold, success } from './chunk-NZ4RG62Z.mjs';
+
+// src/commands/domains.ts
+var SUB_LS = "ls";
+var SUB_LIST = "list";
+var SUB_ADD = "add";
+var SUB_VERIFY = "verify";
+var SUB_RM = "rm";
+var SUB_REMOVE = "remove";
+var SUB_ATTACH = "attach";
+var SUB_DETACH = "detach";
+var SUB_PRIMARY = "primary";
+var FLAG_TYPE = "type";
+var FLAG_YES = "yes";
+var FLAG_ENV = "env";
+var FLAG_PRIMARY = "primary";
+var FLAG_ATTACHED = "attached";
+var ENV_SCOPE_VALUES = new Set(Object.values(ENV_SCOPE));
+function resolveEnvScope(value, fallback = ENV_SCOPE.PRODUCTION) {
+  if (value === void 0) return fallback;
+  if (!ENV_SCOPE_VALUES.has(value)) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Invalid env "${value}". Choose: ${[...ENV_SCOPE_VALUES].join(", ")}.`
+    );
+  }
+  return value;
+}
+function projectDomainsEndpoint(businessId, projectId) {
+  return `/v1/businesses/${encodeURIComponent(businessId)}/projects/${encodeURIComponent(projectId)}/domains`;
+}
+function projectDomainItemEndpoint(businessId, projectId, attachmentId) {
+  return `${projectDomainsEndpoint(businessId, projectId)}/${encodeURIComponent(attachmentId)}`;
+}
+function projectDomainPrimaryEndpoint(businessId, projectId, attachmentId) {
+  return `${projectDomainItemEndpoint(businessId, projectId, attachmentId)}/primary`;
+}
+var COL_GAP = "  ";
+var COL_DOMAIN = "DOMAIN";
+var COL_TYPE = "TYPE";
+var COL_VERIFIED = "VERIFIED";
+var COL_PRIMARY = "PRIMARY";
+var COL_CREATED = "CREATED";
+var DNS_COL_TYPE = "Type";
+var DNS_COL_NAME = "Name";
+var DNS_COL_VALUE = "Value";
+var VALID_DOMAIN_TYPES = new Set(Object.values(DOMAIN_TYPE));
+function domainsEndpoint(businessId) {
+  return `/v1/businesses/${encodeURIComponent(businessId)}/domains`;
+}
+function domainItemEndpoint(businessId, id) {
+  return `${domainsEndpoint(businessId)}/${encodeURIComponent(id)}`;
+}
+function domainVerifyEndpoint(businessId, id) {
+  return `${domainItemEndpoint(businessId, id)}/verify`;
+}
+function dnsRecordsEndpoint(domain) {
+  return `/v1/hosting/domains/${encodeURIComponent(domain)}/dns-records`;
+}
+function resolveDomainType(value) {
+  if (value === void 0) return DOMAIN_TYPE.CUSTOM;
+  if (!VALID_DOMAIN_TYPES.has(value)) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Invalid domain type "${value}". Choose: ${[...VALID_DOMAIN_TYPES].join(", ")}.`
+    );
+  }
+  return value;
+}
+async function run(argv) {
+  const args = parseArgs(argv);
+  const sub = args.positional[0];
+  if (!sub) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Usage: cimplify domains <${SUB_LS}|${SUB_ADD}|${SUB_VERIFY}|${SUB_RM}|${SUB_ATTACH}|${SUB_DETACH}|${SUB_PRIMARY}>`
+    );
+  }
+  const auth = await readAuth();
+  const client = ApiClient.fromAuth(auth);
+  if (sub === SUB_LS || sub === SUB_LIST) {
+    if (flagBool(args, FLAG_ATTACHED)) {
+      await listAttachedForCurrentProject(client, auth.businessId);
+    } else {
+      await listDomains(client, auth.businessId);
+    }
+    return;
+  }
+  if (sub === SUB_ADD) {
+    await addDomain(client, auth.businessId, args);
+    return;
+  }
+  if (sub === SUB_VERIFY) {
+    await verifyDomain(client, auth.businessId, args);
+    return;
+  }
+  if (sub === SUB_RM || sub === SUB_REMOVE) {
+    await removeDomain(client, auth.businessId, args);
+    return;
+  }
+  if (sub === SUB_ATTACH) {
+    await attachDomain(client, auth.businessId, args);
+    return;
+  }
+  if (sub === SUB_DETACH) {
+    await detachDomain(client, auth.businessId, args);
+    return;
+  }
+  if (sub === SUB_PRIMARY) {
+    await setPrimaryAttachment(client, auth.businessId, args);
+    return;
+  }
+  throw new CliError(CLI_ERROR_CODE.INVALID_INPUT, `Unknown domains subcommand "${sub}"`);
+}
+async function listDomains(client, businessId) {
+  const domains = await client.get(domainsEndpoint(businessId));
+  if (domains.length === 0) {
+    info(dim("No domains. Add one: cimplify domains add <domain>"));
+    result({ domains: [] });
+    return;
+  }
+  const domainWidth = Math.max(COL_DOMAIN.length, ...domains.map((d) => d.domain.length));
+  const typeWidth = Math.max(COL_TYPE.length, ...domains.map((d) => String(d.domain_type).length));
+  const verifiedWidth = COL_VERIFIED.length;
+  const primaryWidth = COL_PRIMARY.length;
+  info(
+    bold(
+      [
+        COL_DOMAIN.padEnd(domainWidth),
+        COL_TYPE.padEnd(typeWidth),
+        COL_VERIFIED.padEnd(verifiedWidth),
+        COL_PRIMARY.padEnd(primaryWidth),
+        COL_CREATED
+      ].join(COL_GAP)
+    )
+  );
+  for (const d of domains) {
+    info(
+      [
+        d.domain.padEnd(domainWidth),
+        String(d.domain_type).padEnd(typeWidth),
+        (d.is_verified ? "yes" : "no").padEnd(verifiedWidth),
+        (d.is_primary ? "yes" : "no").padEnd(primaryWidth),
+        d.created_at ?? ""
+      ].join(COL_GAP)
+    );
+  }
+  result({
+    domains: domains.map((d) => ({
+      id: d.id,
+      domain: d.domain,
+      domain_type: d.domain_type,
+      is_verified: d.is_verified,
+      is_primary: d.is_primary,
+      created_at: d.created_at ?? null
+    }))
+  });
+}
+async function addDomain(client, businessId, args) {
+  const domain = args.positional[1];
+  if (!domain) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Usage: cimplify domains add <domain> [--type=custom|cimplify]`
+    );
+  }
+  const domainType = resolveDomainType(flagString(args, FLAG_TYPE));
+  const body = { domain, domain_type: domainType };
+  const created = await client.post(domainsEndpoint(businessId), body);
+  success(`Added ${created.domain} (${created.domain_type})`);
+  let dnsRecords = null;
+  if (domainType === DOMAIN_TYPE.CUSTOM) {
+    try {
+      const dns = await client.get(dnsRecordsEndpoint(domain));
+      dnsRecords = Array.isArray(dns) ? dns : dns.records;
+      printDnsRecords(domain, dnsRecords);
+    } catch (err) {
+      info(dim(`(Could not fetch DNS records: ${err instanceof Error ? err.message : String(err)})`));
+    }
+  }
+  result({
+    domain: {
+      id: created.id,
+      domain: created.domain,
+      domain_type: created.domain_type,
+      is_verified: created.is_verified
+    },
+    dns_records: dnsRecords
+  });
+}
+function printDnsRecords(domain, records) {
+  if (!records || records.length === 0) {
+    info(dim("No DNS records returned."));
+    return;
+  }
+  const typeWidth = Math.max(DNS_COL_TYPE.length, ...records.map((r) => r.type.length));
+  const nameWidth = Math.max(DNS_COL_NAME.length, ...records.map((r) => r.name.length));
+  const valueWidth = Math.max(DNS_COL_VALUE.length, ...records.map((r) => r.value.length));
+  info("");
+  info("Add the following DNS records:");
+  info("");
+  info(
+    `  ${bold(DNS_COL_TYPE.padEnd(typeWidth))}   ${bold(DNS_COL_NAME.padEnd(nameWidth))}   ${bold(DNS_COL_VALUE)}`
+  );
+  info(
+    `  ${"\u2500".repeat(typeWidth)}   ${"\u2500".repeat(nameWidth)}   ${"\u2500".repeat(Math.min(valueWidth, 40))}`
+  );
+  for (const r of records) {
+    info(`  ${r.type.padEnd(typeWidth)}   ${r.name.padEnd(nameWidth)}   ${r.value}`);
+  }
+  info("");
+  info(`Then run: ${bold(`cimplify domains verify ${domain}`)}`);
+}
+async function verifyDomain(client, businessId, args) {
+  const domain = args.positional[1];
+  if (!domain) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Usage: cimplify domains verify <domain>`
+    );
+  }
+  const target = await findDomain(client, businessId, domain);
+  const verified = await client.post(domainVerifyEndpoint(businessId, target.id));
+  if (verified.is_verified) {
+    success(`Verified ${verified.domain}`);
+  } else {
+    info(dim(`Not yet verified \u2014 DNS may still be propagating. Try again in a few minutes.`));
+  }
+  result({ domain: verified.domain, verified: verified.is_verified });
+}
+async function removeDomain(client, businessId, args) {
+  const domain = args.positional[1];
+  if (!domain) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Usage: cimplify domains rm <domain> [--yes]`
+    );
+  }
+  const target = await findDomain(client, businessId, domain);
+  if (!flagBool(args, FLAG_YES)) {
+    const confirmed = await promptYesNo(`Remove ${domain}?`, true);
+    if (!confirmed) {
+      throw new CliError(CLI_ERROR_CODE.ABORTED, "Aborted by user.");
+    }
+  }
+  await client.delete(domainItemEndpoint(businessId, target.id));
+  success(`Removed ${domain}`);
+  result({ removed: true, domain });
+}
+async function findDomain(client, businessId, domain) {
+  const domains = await client.get(domainsEndpoint(businessId));
+  const match = domains.find((d) => d.domain === domain);
+  if (!match) {
+    throw new CliError(
+      CLI_ERROR_CODE.PROJECT_NOT_FOUND,
+      `Domain "${domain}" not found. List domains: cimplify domains ls`
+    );
+  }
+  return match;
+}
+async function attachDomain(client, businessId, args) {
+  const domain = args.positional[1];
+  if (!domain) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Usage: cimplify domains ${SUB_ATTACH} <domain> [--env=preview|production] [--primary]`
+    );
+  }
+  const link = await readProjectLink();
+  const target = await findDomain(client, businessId, domain);
+  if (!target.is_verified) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Domain "${domain}" is not verified. Run: cimplify domains verify ${domain}`
+    );
+  }
+  const envScope = resolveEnvScope(flagString(args, FLAG_ENV));
+  const isPrimary = flagBool(args, FLAG_PRIMARY);
+  const body = {
+    business_domain_id: target.id,
+    env_scope: envScope,
+    is_primary: isPrimary
+  };
+  await client.post(
+    projectDomainsEndpoint(businessId, link.projectId),
+    body
+  );
+  success(`Attached ${domain} to project for ${envScope}${isPrimary ? " (primary)" : ""}`);
+  info(dim("Next deploy will bind this domain. Run: cimplify deploy"));
+  result({ attached: true, domain, env: envScope, primary: isPrimary });
+}
+async function detachDomain(client, businessId, args) {
+  const domain = args.positional[1];
+  if (!domain) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Usage: cimplify domains ${SUB_DETACH} <domain> [--env=preview|production] [--yes]`
+    );
+  }
+  const link = await readProjectLink();
+  const envScope = resolveEnvScope(flagString(args, FLAG_ENV));
+  const attachment = await findAttachmentForCurrentProject(client, businessId, link.projectId, domain, envScope);
+  if (!flagBool(args, FLAG_YES)) {
+    const confirmed = await promptYesNo(`Detach ${domain} from this project (${envScope})?`, true);
+    if (!confirmed) {
+      throw new CliError(CLI_ERROR_CODE.ABORTED, "Aborted by user.");
+    }
+  }
+  await client.delete(projectDomainItemEndpoint(businessId, link.projectId, attachment.id));
+  success(`Detached ${domain} (${envScope})`);
+  info(dim("Next deploy will not bind this domain. Existing deployments continue serving until redeploy."));
+  result({ detached: true, domain, env: envScope });
+}
+async function setPrimaryAttachment(client, businessId, args) {
+  const domain = args.positional[1];
+  if (!domain) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Usage: cimplify domains ${SUB_PRIMARY} <domain> [--env=preview|production]`
+    );
+  }
+  const link = await readProjectLink();
+  const envScope = resolveEnvScope(flagString(args, FLAG_ENV));
+  const attachment = await findAttachmentForCurrentProject(client, businessId, link.projectId, domain, envScope);
+  await client.post(
+    projectDomainPrimaryEndpoint(businessId, link.projectId, attachment.id)
+  );
+  success(`Set ${domain} as primary for ${envScope}`);
+  result({ primary: true, domain, env: envScope });
+}
+async function listAttachedForCurrentProject(client, businessId) {
+  const link = await readProjectLink();
+  const attachments = await client.get(
+    projectDomainsEndpoint(businessId, link.projectId)
+  );
+  if (attachments.length === 0) {
+    info(dim("No domains attached to this project. Attach one: cimplify domains attach <domain>"));
+    result({ attached: [] });
+    return;
+  }
+  const domains = await client.get(domainsEndpoint(businessId));
+  const domainById = new Map(domains.map((d) => [d.id, d]));
+  info(bold(["DOMAIN", "ENV", "PRIMARY", "ATTACHED"].join(COL_GAP)));
+  for (const a of attachments) {
+    const bd = domainById.get(a.business_domain_id);
+    info(
+      [
+        bd?.domain ?? `<unknown:${a.business_domain_id}>`,
+        String(a.env_scope),
+        a.is_primary ? "yes" : "no",
+        a.attached_at
+      ].join(COL_GAP)
+    );
+  }
+  result({
+    attached: attachments.map((a) => ({
+      attachment_id: a.id,
+      business_domain_id: a.business_domain_id,
+      domain: domainById.get(a.business_domain_id)?.domain ?? null,
+      env: a.env_scope,
+      primary: a.is_primary,
+      attached_at: a.attached_at
+    }))
+  });
+}
+async function findAttachmentForCurrentProject(client, businessId, projectId, domain, envScope) {
+  const target = await findDomain(client, businessId, domain);
+  const attachments = await client.get(projectDomainsEndpoint(businessId, projectId));
+  const match = attachments.find(
+    (a) => a.business_domain_id === target.id && a.env_scope === envScope
+  );
+  if (!match) {
+    throw new CliError(
+      CLI_ERROR_CODE.PROJECT_NOT_FOUND,
+      `${domain} is not attached to this project for env "${envScope}". List attached: cimplify domains ls --attached`
+    );
+  }
+  return match;
+}
+
+export { run as default, printDnsRecords };

package/dist/env-LBYBCBWV.mjs

@@ -0,0 +1,268 @@
+#!/usr/bin/env node
+import { formatEnvFile, parseEnvFile, parseKeyValueArg } from './chunk-4YSOZ6LY.mjs';
+import { promptYesNo } from './chunk-L6474RPL.mjs';
+import { ENV_SCOPE, PUBLIC_ENV_PREFIX, SECRET_MASK } from './chunk-MQMNWLMU.mjs';
+import { parseArgs, flagString, flagBool } from './chunk-D7D75ONX.mjs';
+import { ApiClient } from './chunk-4ZVTPMUZ.mjs';
+import { readAuth, readProjectLink } from './chunk-JJYWETGA.mjs';
+import { CliError, CLI_ERROR_CODE, info, dim, result, bold, success } from './chunk-NZ4RG62Z.mjs';
+import { promises } from 'fs';
+import path from 'path';
+
+var SUB_LS = "ls";
+var SUB_LIST = "list";
+var SUB_PULL = "pull";
+var SUB_PUSH = "push";
+var SUB_ADD = "add";
+var SUB_RM = "rm";
+var SUB_REMOVE = "remove";
+var FLAG_SCOPE = "scope";
+var FLAG_SHOW = "show";
+var FLAG_OUT = "out";
+var FLAG_FILE = "file";
+var FLAG_OVERWRITE = "overwrite";
+var FLAG_SECRET = "secret";
+var FLAG_PUBLIC = "public";
+var FLAG_YES = "yes";
+var DEFAULT_PULL_PATH = ".env.local";
+var PULL_BACKUP_SUFFIX = ".bak";
+var COL_GAP = "  ";
+var COL_KEY = "KEY";
+var COL_SCOPE = "SCOPE";
+var COL_SECRET = "SECRET";
+var COL_VALUE = "VALUE";
+var VALID_SCOPES = new Set(Object.values(ENV_SCOPE));
+function envEndpoint(businessId, projectId) {
+  return `/v1/businesses/${encodeURIComponent(businessId)}/projects/${encodeURIComponent(projectId)}/env-vars`;
+}
+function envItemEndpoint(businessId, projectId, id) {
+  return `${envEndpoint(businessId, projectId)}/${encodeURIComponent(id)}`;
+}
+function bulkSetEndpoint(businessId, projectId) {
+  return `${envEndpoint(businessId, projectId)}/bulk-set`;
+}
+function resolveScope(value, fallback = ENV_SCOPE.PREVIEW) {
+  if (value === void 0) return fallback;
+  if (!VALID_SCOPES.has(value)) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Invalid scope "${value}". Choose one of: ${[...VALID_SCOPES].join(", ")}.`
+    );
+  }
+  return value;
+}
+function classifyIsSecret(key, override) {
+  if (override.secret && override.public) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      "Cannot pass both --secret and --public."
+    );
+  }
+  if (override.secret) return true;
+  if (override.public) return false;
+  return !key.startsWith(PUBLIC_ENV_PREFIX);
+}
+async function run(argv) {
+  const args = parseArgs(argv);
+  const sub = args.positional[0];
+  if (!sub) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Usage: cimplify env <${SUB_LS}|${SUB_PULL}|${SUB_PUSH}|${SUB_ADD}|${SUB_RM}>`
+    );
+  }
+  const auth = await readAuth();
+  const link = await readProjectLink();
+  const client = ApiClient.fromAuth(auth);
+  if (sub === SUB_LS || sub === SUB_LIST) {
+    await listEnv(client, link.businessId, link.projectId, args);
+    return;
+  }
+  if (sub === SUB_PULL) {
+    await pullEnv(client, link.businessId, link.projectId, args);
+    return;
+  }
+  if (sub === SUB_PUSH) {
+    await pushEnv(client, link.businessId, link.projectId, args);
+    return;
+  }
+  if (sub === SUB_ADD) {
+    await addEnv(client, link.businessId, link.projectId, args);
+    return;
+  }
+  if (sub === SUB_RM || sub === SUB_REMOVE) {
+    await removeEnv(client, link.businessId, link.projectId, args);
+    return;
+  }
+  throw new CliError(CLI_ERROR_CODE.INVALID_INPUT, `Unknown env subcommand "${sub}"`);
+}
+async function listEnv(client, businessId, projectId, args) {
+  const scope = resolveScope(flagString(args, FLAG_SCOPE));
+  const show = flagBool(args, FLAG_SHOW);
+  const records = await client.get(envEndpoint(businessId, projectId), {
+    query: { scope }
+  });
+  if (records.length === 0) {
+    info(dim(`No env vars in scope "${scope}". Add one: cimplify env add KEY=VALUE`));
+    result({ scope, vars: [] });
+    return;
+  }
+  const keyWidth = Math.max(COL_KEY.length, ...records.map((r) => r.key.length));
+  const scopeWidth = Math.max(COL_SCOPE.length, ...records.map((r) => String(r.scope).length));
+  const secretWidth = Math.max(COL_SECRET.length, "yes".length);
+  info(
+    bold(
+      [
+        COL_KEY.padEnd(keyWidth),
+        COL_SCOPE.padEnd(scopeWidth),
+        COL_SECRET.padEnd(secretWidth),
+        COL_VALUE
+      ].join(COL_GAP)
+    )
+  );
+  for (const r of records) {
+    const value = renderValue(r, show);
+    info(
+      [
+        r.key.padEnd(keyWidth),
+        String(r.scope).padEnd(scopeWidth),
+        (r.is_secret ? "yes" : "no").padEnd(secretWidth),
+        value
+      ].join(COL_GAP)
+    );
+  }
+  result({
+    scope,
+    vars: records.map((r) => ({
+      key: r.key,
+      scope: r.scope,
+      is_secret: r.is_secret,
+      value: r.is_secret ? null : r.value ?? null
+    }))
+  });
+}
+function renderValue(r, show) {
+  if (r.is_secret) return SECRET_MASK;
+  if (r.value === null) return SECRET_MASK;
+  if (!show) return r.value;
+  return r.value;
+}
+async function pullEnv(client, businessId, projectId, args) {
+  const scope = resolveScope(flagString(args, FLAG_SCOPE));
+  const outPath = path.resolve(process.cwd(), flagString(args, FLAG_OUT) ?? DEFAULT_PULL_PATH);
+  const records = await client.get(envEndpoint(businessId, projectId), {
+    query: { scope }
+  });
+  const blockedSecrets = records.filter((r) => r.is_secret).map((r) => r.key);
+  if (blockedSecrets.length > 0) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Cannot pull secret values: ${blockedSecrets.join(", ")}.
+Secrets are never returned in plaintext to the CLI; use the dashboard to copy them.`
+    );
+  }
+  const entries = records.filter((r) => r.value !== null).map((r) => ({ key: r.key, value: r.value }));
+  await backupIfExists(outPath);
+  await promises.mkdir(path.dirname(outPath), { recursive: true });
+  await promises.writeFile(outPath, formatEnvFile(entries), "utf8");
+  success(`Pulled ${entries.length} var${entries.length === 1 ? "" : "s"} to ${path.relative(process.cwd(), outPath) || outPath}`);
+  result({ scope, count: entries.length, file: outPath });
+}
+async function backupIfExists(target) {
+  try {
+    await promises.stat(target);
+  } catch (err) {
+    if (err.code === "ENOENT") return;
+    throw err;
+  }
+  await promises.copyFile(target, `${target}${PULL_BACKUP_SUFFIX}`);
+}
+async function pushEnv(client, businessId, projectId, args) {
+  const scope = resolveScope(flagString(args, FLAG_SCOPE));
+  const filePath = path.resolve(process.cwd(), flagString(args, FLAG_FILE) ?? DEFAULT_PULL_PATH);
+  const overwrite = flagBool(args, FLAG_OVERWRITE);
+  let raw;
+  try {
+    raw = await promises.readFile(filePath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      throw new CliError(
+        CLI_ERROR_CODE.INVALID_INPUT,
+        `Env file not found: ${filePath}.
+Use --file to point at a different path.`
+      );
+    }
+    throw err;
+  }
+  const entries = parseEnvFile(raw);
+  if (entries.length === 0) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `No env vars found in ${filePath}.`
+    );
+  }
+  const body = {
+    scope,
+    vars: entries.map((e) => ({
+      key: e.key,
+      value: e.value,
+      is_secret: classifyIsSecret(e.key, { secret: false, public: false })
+    })),
+    overwrite
+  };
+  await client.post(bulkSetEndpoint(businessId, projectId), body);
+  success(`Pushed ${entries.length} var${entries.length === 1 ? "" : "s"} to ${scope}${overwrite ? " (overwrite)" : ""}`);
+  result({ scope, count: entries.length, overwrite });
+}
+async function addEnv(client, businessId, projectId, args) {
+  const positional = args.positional[1];
+  if (!positional) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Usage: cimplify env ${SUB_ADD} KEY=VALUE [--scope=<scope>] [--secret|--public]`
+    );
+  }
+  const { key, value } = parseKeyValueArg(positional);
+  const scope = resolveScope(flagString(args, FLAG_SCOPE));
+  const isSecret = classifyIsSecret(key, {
+    secret: flagBool(args, FLAG_SECRET),
+    public: flagBool(args, FLAG_PUBLIC)
+  });
+  const body = { key, value, scope, is_secret: isSecret };
+  const created = await client.post(envEndpoint(businessId, projectId), body);
+  success(`Added ${created.key} (${scope}, ${isSecret ? "secret" : "public"})`);
+  result({
+    var: { key: created.key, scope: created.scope, is_secret: created.is_secret }
+  });
+}
+async function removeEnv(client, businessId, projectId, args) {
+  const key = args.positional[1];
+  if (!key) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Usage: cimplify env ${SUB_RM} <KEY> [--scope=<scope>]`
+    );
+  }
+  const scope = resolveScope(flagString(args, FLAG_SCOPE));
+  const records = await client.get(envEndpoint(businessId, projectId), {
+    query: { scope }
+  });
+  const target = records.find((r) => r.key === key);
+  if (!target) {
+    throw new CliError(
+      CLI_ERROR_CODE.PROJECT_NOT_FOUND,
+      `No env var "${key}" in scope "${scope}".`
+    );
+  }
+  if (!flagBool(args, FLAG_YES)) {
+    const confirmed = await promptYesNo(`Delete ${key} from ${scope}?`, true);
+    if (!confirmed) {
+      throw new CliError(CLI_ERROR_CODE.ABORTED, "Aborted by user.");
+    }
+  }
+  await client.delete(envItemEndpoint(businessId, projectId, target.id));
+  success(`Removed ${key} from ${scope}`);
+  result({ removed: true, key, scope });
+}
+
+export { classifyIsSecret, run as default };

package/dist/link-SEJNW7JS.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import { parseArgs } from './chunk-D7D75ONX.mjs';
+import { ApiClient } from './chunk-4ZVTPMUZ.mjs';
+import { readAuth, writeProjectLink } from './chunk-JJYWETGA.mjs';
+import { CliError, CLI_ERROR_CODE, success, info, dim, result } from './chunk-NZ4RG62Z.mjs';
+
+// src/commands/link.ts
+function projectEndpoint(businessId, projectId) {
+  return `/v1/businesses/${encodeURIComponent(businessId)}/projects/${encodeURIComponent(projectId)}`;
+}
+async function run(argv) {
+  const args = parseArgs(argv);
+  const projectId = args.positional[0];
+  if (!projectId) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      "Usage: cimplify link <project-id>\nList projects with `cimplify projects ls`."
+    );
+  }
+  const auth = await readAuth();
+  const client = ApiClient.fromAuth(auth);
+  const project = await client.get(
+    projectEndpoint(auth.businessId, projectId)
+  );
+  const link = {
+    projectId: project.id,
+    businessId: project.business_id,
+    businessHandle: auth.businessHandle ?? project.business_handle ?? void 0,
+    remoteUrl: project.metadata?.repo?.url,
+    defaultBranch: project.metadata?.repo?.default_branch,
+    framework: project.metadata?.framework ?? project.project_type,
+    linkedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeProjectLink(link);
+  success(`Linked to ${project.name} (${project.id})`);
+  if (link.remoteUrl) info(dim(`remote: ${link.remoteUrl}`));
+  result({
+    project: { id: project.id, name: project.name },
+    business: { id: project.business_id },
+    remote_url: link.remoteUrl ?? null,
+    default_branch: link.defaultBranch ?? null
+  });
+}
+
+export { run as default };