@cl3tus/planum 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Clement Osternaud
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,52 @@
+# @cl3tus/planum
+
+Sync `.env` files with your [Planum](https://planum.cl3tusdev.com) vault.
+
+## Installation
+
+```sh
+npm i -g @cl3tus/planum
+# or
+pnpm add -g @cl3tus/planum
+# or
+yarn global add @cl3tus/planum
+```
+
+Requires Node.js **20+**.
+
+## Quick start
+
+```sh
+planum login              # authenticate via the browser
+planum init --project my-app
+planum pull --env dev     # download .env from the vault
+planum push --env dev     # upload .env to the vault
+```
+
+## Commands
+
+| Command | Description |
+|---|---|
+| `planum login` | Authenticate via the web browser. |
+| `planum logout` | Forget the stored token. |
+| `planum init` | Create a `.planumrc` in the current directory. |
+| `planum pull` | Download a `.env` from a project + environment. |
+| `planum push` | Upload a `.env` to a project + environment. |
+
+Each command supports `--help` for full option listings.
+
+### Common flags
+
+- `--project <slug>` — project slug (read from `.planumrc` if omitted).
+- `--env <name>` — environment name (e.g. `dev`, `staging`, `prod`).
+- `--file <path>` — input/output file path (default: `.env`).
+
+## Configuration
+
+`planum init` writes a `.planumrc` file at the project root with the default project and environment so later commands can be run without flags.
+
+Credentials are stored in your OS user config directory after `planum login`.
+
+## License
+
+[MIT](./LICENSE) © Clement Osternaud

package/bin/planum.mjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import '../dist/index.js';

package/dist/index.js

@@ -0,0 +1,790 @@
+// src/index.ts
+import { defineCommand as defineCommand6, runMain } from "citty";
+
+// src/commands/init.ts
+import { existsSync } from "fs";
+import * as p2 from "@clack/prompts";
+import { defineCommand } from "citty";
+
+// src/lib/api.ts
+var ApiError = class extends Error {
+  constructor(status, statusText, data) {
+    super(`${status} ${statusText}`);
+    this.status = status;
+    this.statusText = statusText;
+    this.data = data;
+    this.name = "ApiError";
+  }
+  status;
+  statusText;
+  data;
+};
+var request = async (auth, path, options = {}) => {
+  const { body, searchParams, headers, ...rest } = options;
+  const url = new URL(path.replace(/^\//, ""), `${auth.apiUrl}/`);
+  if (searchParams) {
+    for (const [key, value] of Object.entries(searchParams)) {
+      if (value !== void 0) {
+        url.searchParams.set(key, String(value));
+      }
+    }
+  }
+  const res = await fetch(url, {
+    ...rest,
+    headers: {
+      ...body !== void 0 && { "Content-Type": "application/json" },
+      Authorization: `Bearer ${auth.token}`,
+      ...headers
+    },
+    body: body !== void 0 ? JSON.stringify(body) : void 0
+  });
+  const isJson = res.headers.get("content-type")?.includes("application/json");
+  const data = isJson ? await res.json() : await res.text();
+  if (!res.ok) {
+    throw new ApiError(res.status, res.statusText, data);
+  }
+  return data;
+};
+var createApi = (auth) => ({
+  get: (path, options) => request(auth, path, { ...options, method: "GET" }),
+  post: (path, body, options) => request(auth, path, { ...options, method: "POST", body })
+});
+
+// src/lib/auth-store.ts
+import { chmod, mkdir, readFile, rm, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var configDir = () => process.env.PLANUM_CONFIG_DIR ?? join(homedir(), ".config", "planum");
+var authFile = () => join(configDir(), "auth.json");
+var loadAuth = async () => {
+  try {
+    const raw = await readFile(authFile(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed.apiUrl || !parsed.token) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+};
+var saveAuth = async (data) => {
+  const file = authFile();
+  await mkdir(dirname(file), { recursive: true });
+  await writeFile(file, JSON.stringify(data, null, 2), "utf8");
+  await chmod(file, 384);
+};
+var clearAuth = async () => {
+  await rm(authFile(), { force: true });
+};
+var requireAuth = async () => {
+  const auth = await loadAuth();
+  if (!auth) {
+    throw new Error("Not logged in. Run `planum login` first.");
+  }
+  return auth;
+};
+
+// src/lib/config.ts
+import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2, resolve } from "path";
+var CONFIG_FILENAME = ".planumrc";
+var findConfigFile = async (startDir) => {
+  let dir = resolve(startDir);
+  const stop = resolve(homedir2());
+  while (true) {
+    const candidate = join2(dir, CONFIG_FILENAME);
+    try {
+      await readFile2(candidate, "utf8");
+      return candidate;
+    } catch {
+    }
+    const parent = dirname2(dir);
+    if (parent === dir || dir === stop) return null;
+    dir = parent;
+  }
+};
+var loadConfig = async (cwd = process.cwd()) => {
+  const path = await findConfigFile(cwd);
+  if (!path) return null;
+  try {
+    const raw = await readFile2(path, "utf8");
+    return { path, config: JSON.parse(raw) };
+  } catch {
+    return null;
+  }
+};
+var saveConfig = async (path, config) => {
+  await writeFile2(path, `${JSON.stringify(config, null, 2)}
+`, "utf8");
+};
+var defaultConfigPath = (cwd = process.cwd()) => join2(cwd, CONFIG_FILENAME);
+
+// src/lib/prompts.ts
+import * as p from "@clack/prompts";
+var exitOnCancel = (value) => {
+  if (p.isCancel(value)) {
+    p.cancel("Cancelled.");
+    process.exit(130);
+  }
+  return value;
+};
+var fetchProjects = async (api) => {
+  const res = await api.get("/projects", {
+    searchParams: { limit: 100 }
+  });
+  return res.data;
+};
+var resolveProject = async (api, preferredSlug) => {
+  const projects = await fetchProjects(api);
+  if (projects.length === 0) {
+    throw new Error("No projects found in your account.");
+  }
+  if (preferredSlug) {
+    const match = projects.find((p7) => p7.slug === preferredSlug);
+    if (match) return match;
+    p.log.warn(`Project "${preferredSlug}" not found \u2014 pick one below.`);
+  }
+  const choice = exitOnCancel(
+    await p.select({
+      message: "Pick a project",
+      options: projects.map((proj) => ({
+        value: proj.slug,
+        label: proj.name,
+        hint: proj.slug
+      }))
+    })
+  );
+  const found = projects.find((proj) => proj.slug === choice);
+  if (!found) throw new Error("Project not found");
+  return found;
+};
+var fetchProjectEnvItems = async (api, projectId) => {
+  const res = await api.get(
+    "/vault-items",
+    { searchParams: { projectId, category: "env" } }
+  );
+  return res.data;
+};
+var NEW_ENV = "__new__";
+var resolveEnvironment = async (api, projectId, preferred, options) => {
+  const items = await fetchProjectEnvItems(api, projectId);
+  const envs = [
+    ...new Set(
+      items.map((i) => i.environment).filter((e) => Boolean(e && e.length > 0))
+    )
+  ].sort();
+  if (preferred && (envs.includes(preferred) || options.allowCreate)) {
+    return preferred;
+  }
+  if (envs.length === 0 && !options.allowCreate) {
+    throw new Error(
+      "No environments found for this project. Run `planum push` first."
+    );
+  }
+  const selectOptions = envs.map(
+    (e) => ({ value: e, label: e })
+  );
+  if (options.allowCreate || selectOptions.length === 0) {
+    selectOptions.push({ value: NEW_ENV, label: "+ New environment\u2026" });
+  }
+  const choice = exitOnCancel(
+    await p.select({
+      message: "Pick an environment",
+      options: selectOptions
+    })
+  );
+  if (choice === NEW_ENV) {
+    const name = exitOnCancel(
+      await p.text({
+        message: "Environment name",
+        placeholder: "dev, staging, prod\u2026",
+        validate: (v) => !v || v.trim().length === 0 ? "Required" : void 0
+      })
+    );
+    return name.trim();
+  }
+  return choice;
+};
+var NEW_SCOPE = "__new__";
+var NONE_SCOPE = "__none__";
+var resolveScope = async (api, projectId, preferred, options) => {
+  const items = await fetchProjectEnvItems(api, projectId);
+  const scopes = [
+    ...new Set(
+      items.map((i) => i.scope).filter((s) => Boolean(s && s.length > 0))
+    )
+  ].sort();
+  if (preferred === null && options.allowNone) return null;
+  if (preferred && (scopes.includes(preferred) || options.allowCreate)) {
+    return preferred;
+  }
+  if (scopes.length === 0 && !options.allowCreate) {
+    return null;
+  }
+  const selectOptions = [];
+  if (options.allowNone) {
+    selectOptions.push({ value: NONE_SCOPE, label: "(no scope)" });
+  }
+  for (const s of scopes) selectOptions.push({ value: s, label: s });
+  if (options.allowCreate) {
+    selectOptions.push({ value: NEW_SCOPE, label: "+ New scope\u2026" });
+  }
+  if (selectOptions.length === 0) return null;
+  const choice = exitOnCancel(
+    await p.select({ message: "Pick a scope", options: selectOptions })
+  );
+  if (choice === NONE_SCOPE) return null;
+  if (choice === NEW_SCOPE) {
+    const name = exitOnCancel(
+      await p.text({
+        message: "Scope name",
+        placeholder: "web, api\u2026",
+        validate: (v) => !v || v.trim().length === 0 ? "Required" : void 0
+      })
+    );
+    return name.trim();
+  }
+  return choice;
+};
+var confirm2 = async (message) => {
+  const v = exitOnCancel(await p.confirm({ message }));
+  return Boolean(v);
+};
+
+// src/commands/init.ts
+var exitOnCancel2 = (value) => {
+  if (p2.isCancel(value)) {
+    p2.cancel("Cancelled.");
+    process.exit(130);
+  }
+  return value;
+};
+var promptScopes = async () => {
+  const entries = [];
+  while (true) {
+    const scope = exitOnCancel2(
+      await p2.text({
+        message: `Scope name #${entries.length + 1}`,
+        placeholder: "web, api, mobile\u2026",
+        validate: (v) => !v || v.trim().length === 0 ? "Required" : void 0
+      })
+    );
+    const file = exitOnCancel2(
+      await p2.text({
+        message: `File path for "${scope.trim()}" (relative to where you run planum)`,
+        placeholder: ".env",
+        initialValue: ".env",
+        validate: (v) => !v || v.trim().length === 0 ? "Required" : void 0
+      })
+    );
+    entries.push({ scope: scope.trim(), file: file.trim() });
+    const more = await confirm2("Add another scope?");
+    if (!more) break;
+  }
+  return entries;
+};
+var initCommand = defineCommand({
+  meta: {
+    name: "init",
+    description: "Create a .planumrc in the current directory"
+  },
+  args: {
+    project: { type: "string", description: "Project slug" }
+  },
+  run: async ({ args }) => {
+    const auth = await requireAuth();
+    const api = createApi(auth);
+    const path = defaultConfigPath();
+    if (existsSync(path)) {
+      const existing = await loadConfig();
+      const ok = await confirm2(
+        `.planumrc already exists${existing?.config.project ? ` (project: ${existing.config.project})` : ""}. Overwrite?`
+      );
+      if (!ok) {
+        p2.log.info("Aborted.");
+        return;
+      }
+    }
+    const project = await resolveProject(api, args.project);
+    const config = { project: project.slug };
+    const multiApp = await confirm2(
+      "Does this project have multiple apps with separate .env files (e.g. web, api)?"
+    );
+    if (multiApp) {
+      config.scopes = await promptScopes();
+    }
+    await saveConfig(path, config);
+    if (config.scopes?.length) {
+      p2.log.success(
+        `Wrote .planumrc \u2014 project: ${project.slug}, ${config.scopes.length} scope(s).`
+      );
+    } else {
+      p2.log.success(`Wrote .planumrc \u2014 project: ${project.slug}`);
+    }
+  }
+});
+
+// src/commands/login.ts
+import {
+  createServer
+} from "http";
+import { hostname } from "os";
+import * as p3 from "@clack/prompts";
+import { defineCommand as defineCommand2 } from "citty";
+import open from "open";
+var DEFAULT_API_URL = "http://localhost:9000";
+var DEFAULT_WEB_URL = "http://localhost:5173";
+var POLL_INTERVAL_MS = 2e3;
+var TIMEOUT_MS = 5 * 60 * 1e3;
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var startCallbackServer = () => new Promise((resolve4, reject) => {
+  const server = createServer(
+    (_req, res) => {
+      res.statusCode = 200;
+      res.setHeader("Content-Type", "text/html; charset=utf-8");
+      res.end(
+        '<html><body style="font-family:system-ui;padding:2rem"><h2>Planum CLI authorized</h2><p>You can close this tab and return to your terminal.</p></body></html>'
+      );
+    }
+  );
+  server.once("error", reject);
+  server.listen(0, "127.0.0.1", () => {
+    const address = server.address();
+    if (!address || typeof address === "string") {
+      reject(new Error("Failed to bind local server"));
+      return;
+    }
+    resolve4({
+      port: address.port,
+      close: () => server.close()
+    });
+  });
+});
+var loginCommand = defineCommand2({
+  meta: {
+    name: "login",
+    description: "Authenticate via the web browser"
+  },
+  args: {
+    label: {
+      type: "string",
+      description: "Friendly name for this token (default: hostname)"
+    },
+    apiUrl: {
+      type: "string",
+      description: "Override the API URL"
+    },
+    webUrl: {
+      type: "string",
+      description: "Override the web URL"
+    }
+  },
+  run: async ({ args }) => {
+    const apiUrl = args.apiUrl ?? process.env.PLANUM_API_URL ?? DEFAULT_API_URL;
+    const webUrl = args.webUrl ?? process.env.PLANUM_WEB_URL ?? DEFAULT_WEB_URL;
+    const label = args.label ?? hostname();
+    const spinner4 = p3.spinner();
+    spinner4.start("Starting local callback server\u2026");
+    const { port, close } = await startCallbackServer();
+    let sessionId;
+    let verifier;
+    try {
+      spinner4.message("Requesting a CLI session\u2026");
+      const res = await fetch(`${apiUrl}/cli-auth/sessions`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ callbackPort: port, label })
+      });
+      if (!res.ok) {
+        const text3 = await res.text();
+        throw new Error(`Failed to create session: ${res.status} ${text3}`);
+      }
+      const body = await res.json();
+      sessionId = body.data.sessionId;
+      verifier = body.data.verifier;
+    } catch (err) {
+      spinner4.stop("Failed to start login.");
+      close();
+      throw err;
+    }
+    const authUrl = `${webUrl}/cli-auth?session=${encodeURIComponent(
+      sessionId
+    )}&verifier=${encodeURIComponent(verifier)}`;
+    spinner4.stop("Opening browser\u2026");
+    p3.log.info(`If your browser does not open, visit:
+  ${authUrl}`);
+    try {
+      await open(authUrl);
+    } catch {
+    }
+    const pollSpinner = p3.spinner();
+    pollSpinner.start("Waiting for approval in the browser\u2026");
+    const deadline = Date.now() + TIMEOUT_MS;
+    let token = null;
+    try {
+      while (Date.now() < deadline) {
+        await sleep(POLL_INTERVAL_MS);
+        const url = new URL(`${apiUrl}/cli-auth/sessions/${sessionId}/poll`);
+        url.searchParams.set("verifier", verifier);
+        const res = await fetch(url);
+        if (!res.ok) {
+          if (res.status === 404) {
+            throw new Error("CLI session expired. Run `planum login` again.");
+          }
+          continue;
+        }
+        const body = await res.json();
+        if (body.data.status === "approved") {
+          token = body.data.token;
+          break;
+        }
+      }
+    } finally {
+      close();
+    }
+    if (!token) {
+      pollSpinner.stop("Login timed out.");
+      throw new Error("Did not receive approval within 5 minutes.");
+    }
+    await saveAuth({ apiUrl, token, label });
+    pollSpinner.stop(`Logged in as "${label}".`);
+  }
+});
+
+// src/commands/logout.ts
+import * as p4 from "@clack/prompts";
+import { defineCommand as defineCommand3 } from "citty";
+var logoutCommand = defineCommand3({
+  meta: {
+    name: "logout",
+    description: "Forget the stored token"
+  },
+  run: async () => {
+    const auth = await loadAuth();
+    if (!auth) {
+      p4.log.info("Not logged in.");
+      return;
+    }
+    await clearAuth();
+    p4.log.success("Logged out.");
+  }
+});
+
+// src/commands/pull.ts
+import { mkdir as mkdir2, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, resolve as resolve2 } from "path";
+import * as p5 from "@clack/prompts";
+import { defineCommand as defineCommand4 } from "citty";
+
+// src/lib/env-file.ts
+import dotenv from "dotenv";
+var parseEnv = (raw) => dotenv.parse(raw);
+var needsQuoting = (value) => /[\s"'`$\\#=]/.test(value) || value === "";
+var escapeValue = (value) => value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n");
+var serializeEnv = (entries) => {
+  const keys = Object.keys(entries).sort();
+  return `${keys.map((key) => {
+    const value = entries[key] ?? "";
+    const formatted = needsQuoting(value) ? `"${escapeValue(value)}"` : value;
+    return `${key}=${formatted}`;
+  }).join("\n")}
+`;
+};
+
+// src/commands/pull.ts
+var matchScope = (itemScope, want) => itemScope === want;
+var writeBundle = async (api, items, project, environment, scope, outPath) => {
+  const filtered = items.filter(
+    (i) => i.environment === environment && matchScope(i.scope, scope)
+  );
+  const label = `${project.name} / ${environment}${scope ? ` / ${scope}` : ""}`;
+  if (filtered.length === 0) {
+    p5.log.warn(`No env vars for ${label}.`);
+    return 0;
+  }
+  const entries = {};
+  for (const item of filtered) {
+    const res = await api.post(
+      `/vault-items/${item.id}/reveal`
+    );
+    entries[item.name] = res.data.value;
+  }
+  const absolute = resolve2(process.cwd(), outPath);
+  await mkdir2(dirname3(absolute), { recursive: true });
+  await writeFile3(absolute, serializeEnv(entries), "utf8");
+  p5.log.success(
+    `Wrote ${Object.keys(entries).length} keys \u2192 ${outPath} (${label})`
+  );
+  return Object.keys(entries).length;
+};
+var pullCommand = defineCommand4({
+  meta: {
+    name: "pull",
+    description: "Download a .env from a project + environment"
+  },
+  args: {
+    project: { type: "string", description: "Project slug" },
+    env: { type: "string", description: "Environment name" },
+    scope: { type: "string", description: "Scope name (sub-app)" },
+    out: {
+      type: "string",
+      description: "Output file path (default: .env)",
+      default: ".env"
+    }
+  },
+  run: async ({ args }) => {
+    const auth = await requireAuth();
+    const api = createApi(auth);
+    const existingConfig = await loadConfig();
+    const preferredProject = args.project ?? existingConfig?.config.project;
+    const preferredEnv = args.env ?? existingConfig?.config.environment;
+    const scopeArg = args.scope;
+    const scopes = existingConfig?.config.scopes ?? [];
+    const outArgProvided = process.argv.includes("--out");
+    const project = await resolveProject(api, preferredProject);
+    if (!scopeArg && scopes.length > 0 && !outArgProvided) {
+      const spinner5 = p5.spinner();
+      spinner5.start(`Fetching ${project.name}\u2026`);
+      const items2 = await fetchProjectEnvItems(api, project.id);
+      spinner5.stop(`Fetched ${items2.length} env items.`);
+      let total = 0;
+      for (const entry of scopes) {
+        const environment2 = await resolveEnvironment(
+          api,
+          project.id,
+          entry.environment ?? preferredEnv,
+          { allowCreate: false }
+        );
+        const scope2 = entry.scope ?? null;
+        total += await writeBundle(
+          api,
+          items2,
+          project,
+          environment2,
+          scope2,
+          entry.file
+        );
+      }
+      p5.log.success(`Done \u2014 ${total} keys across ${scopes.length} scope(s).`);
+      return;
+    }
+    const environment = await resolveEnvironment(
+      api,
+      project.id,
+      preferredEnv,
+      { allowCreate: false }
+    );
+    let scope = null;
+    if (scopeArg !== void 0) {
+      scope = scopeArg;
+    } else {
+      scope = await resolveScope(api, project.id, void 0, {
+        allowCreate: false,
+        allowNone: true
+      });
+    }
+    const spinner4 = p5.spinner();
+    const label = `${project.name} / ${environment}${scope ? ` / ${scope}` : ""}`;
+    spinner4.start(`Fetching ${label}\u2026`);
+    const items = await fetchProjectEnvItems(api, project.id);
+    spinner4.stop(`Fetched ${items.length} env items.`);
+    await writeBundle(api, items, project, environment, scope, args.out);
+    if (!existingConfig) {
+      const save = await confirm2(
+        "Save project & environment to .planumrc for next time?"
+      );
+      if (save) {
+        const cfg = {
+          project: project.slug,
+          environment
+        };
+        await saveConfig(defaultConfigPath(), cfg);
+        p5.log.success("Wrote .planumrc");
+      }
+    }
+  }
+});
+
+// src/commands/push.ts
+import { readFile as readFile3 } from "fs/promises";
+import { resolve as resolve3 } from "path";
+import * as p6 from "@clack/prompts";
+import { defineCommand as defineCommand5 } from "citty";
+var uploadFile = async (api, filePath, project, environment, scope, skipConfirm) => {
+  let raw;
+  try {
+    raw = await readFile3(filePath, "utf8");
+  } catch {
+    throw new Error(`Cannot read ${filePath}`);
+  }
+  const entries = parseEnv(raw);
+  const items = Object.entries(entries).map(([name, value]) => ({
+    name,
+    value
+  }));
+  if (items.length === 0) {
+    p6.log.warn(`No keys found in ${filePath}.`);
+    return;
+  }
+  const label = `${project.name} / ${environment}${scope ? ` / ${scope}` : ""}`;
+  if (!skipConfirm) {
+    const ok = await confirm2(`Push ${items.length} keys to ${label}?`);
+    if (!ok) {
+      p6.log.info(`Skipped ${filePath}.`);
+      return;
+    }
+  }
+  const spinner4 = p6.spinner();
+  spinner4.start(`Uploading ${filePath} \u2192 ${label}\u2026`);
+  const res = await api.post("/vault-items/bulk-upsert", {
+    projectId: project.id,
+    environment,
+    scope: scope ?? null,
+    items
+  });
+  spinner4.stop(
+    `${filePath} \u2192 created ${res.data.created}, updated ${res.data.updated}.`
+  );
+};
+var pushCommand = defineCommand5({
+  meta: {
+    name: "push",
+    description: "Upload a .env to a project + environment"
+  },
+  args: {
+    project: { type: "string", description: "Project slug" },
+    env: { type: "string", description: "Environment name" },
+    scope: { type: "string", description: "Scope name (sub-app)" },
+    file: {
+      type: "string",
+      description: "Input file path (default: .env)",
+      default: ".env"
+    }
+  },
+  run: async ({ args }) => {
+    const auth = await requireAuth();
+    const api = createApi(auth);
+    const existingConfig = await loadConfig();
+    const preferredProject = args.project ?? existingConfig?.config.project;
+    const preferredEnv = args.env ?? existingConfig?.config.environment;
+    const scopeArg = args.scope;
+    const scopes = existingConfig?.config.scopes ?? [];
+    const fileArgProvided = process.argv.includes("--file");
+    const project = await resolveProject(api, preferredProject);
+    if (!scopeArg && scopes.length > 0 && !fileArgProvided) {
+      for (const entry of scopes) {
+        const environment2 = await resolveEnvironment(
+          api,
+          project.id,
+          entry.environment ?? preferredEnv,
+          { allowCreate: true }
+        );
+        const scope2 = entry.scope ?? null;
+        const filePath2 = resolve3(process.cwd(), entry.file);
+        await uploadFile(api, filePath2, project, environment2, scope2, false);
+      }
+      return;
+    }
+    const environment = await resolveEnvironment(
+      api,
+      project.id,
+      preferredEnv,
+      { allowCreate: true }
+    );
+    let scope = null;
+    if (scopeArg !== void 0) {
+      scope = scopeArg;
+    } else {
+      scope = await resolveScope(api, project.id, void 0, {
+        allowCreate: true,
+        allowNone: true
+      });
+    }
+    const filePath = resolve3(process.cwd(), args.file);
+    await uploadFile(api, filePath, project, environment, scope, false);
+  }
+});
+
+// package.json
+var package_default = {
+  name: "@cl3tus/planum",
+  version: "1.0.0",
+  description: "Sync .env files with your Planum vault",
+  type: "module",
+  license: "MIT",
+  author: "Clement Osternaud <osternaud.clement@pm.me>",
+  homepage: "https://planum.cl3tusdev.com",
+  repository: {
+    type: "git",
+    url: "https://git.cl3tusdev.com/Cletus/planum.git",
+    directory: "apps/cli"
+  },
+  bugs: {
+    url: "https://git.cl3tusdev.com/Cletus/planum/issues"
+  },
+  keywords: [
+    "planum",
+    "env",
+    "dotenv",
+    "secrets",
+    "vault",
+    "cli",
+    "sync"
+  ],
+  engines: {
+    node: ">=20"
+  },
+  bin: {
+    planum: "./bin/planum.mjs"
+  },
+  files: [
+    "bin",
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  publishConfig: {
+    access: "public",
+    registry: "https://registry.npmjs.org/"
+  },
+  scripts: {
+    start: "tsx src/index.ts",
+    build: "tsup src/index.ts --format esm --target node20 --clean",
+    lint: "biome lint src",
+    "type-check": "tsc --noEmit -p tsconfig.json",
+    prepublishOnly: "pnpm build"
+  },
+  dependencies: {
+    "@clack/prompts": "^0.7.0",
+    citty: "^0.1.6",
+    dotenv: "^16.4.5",
+    open: "^10.1.0"
+  },
+  devDependencies: {
+    "@repo/typescript-config": "workspace:*",
+    "@types/node": "^22.10.2",
+    tsup: "^8.3.5",
+    tsx: "^4.21.0",
+    typescript: "5.9.2"
+  }
+};
+
+// src/index.ts
+if (process.env.INIT_CWD && process.env.INIT_CWD !== process.cwd()) {
+  process.chdir(process.env.INIT_CWD);
+}
+var main = defineCommand6({
+  meta: {
+    name: "planum",
+    version: package_default.version,
+    description: package_default.description
+  },
+  subCommands: {
+    login: loginCommand,
+    logout: logoutCommand,
+    init: initCommand,
+    pull: pullCommand,
+    push: pushCommand
+  }
+});
+runMain(main);

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@cl3tus/planum",
+  "version": "1.0.0",
+  "description": "Sync .env files with your Planum vault",
+  "type": "module",
+  "license": "MIT",
+  "author": "Clement Osternaud <osternaud.clement@pm.me>",
+  "homepage": "https://planum.cl3tusdev.com",
+  "repository": {
+    "type": "git",
+    "url": "https://git.cl3tusdev.com/Cletus/planum.git",
+    "directory": "apps/cli"
+  },
+  "bugs": {
+    "url": "https://git.cl3tusdev.com/Cletus/planum/issues"
+  },
+  "keywords": [
+    "planum",
+    "env",
+    "dotenv",
+    "secrets",
+    "vault",
+    "cli",
+    "sync"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "planum": "./bin/planum.mjs"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "scripts": {
+    "start": "tsx src/index.ts",
+    "build": "tsup src/index.ts --format esm --target node20 --clean",
+    "lint": "biome lint src",
+    "type-check": "tsc --noEmit -p tsconfig.json",
+    "prepublishOnly": "pnpm build"
+  },
+  "dependencies": {
+    "@clack/prompts": "^0.7.0",
+    "citty": "^0.1.6",
+    "dotenv": "^16.4.5",
+    "open": "^10.1.0"
+  },
+  "devDependencies": {
+    "@repo/typescript-config": "workspace:*",
+    "@types/node": "^22.10.2",
+    "tsup": "^8.3.5",
+    "tsx": "^4.21.0",
+    "typescript": "5.9.2"
+  }
+}