@envmanager-cli/cli 0.1.1 → 0.1.3

package/dist/bin/envmanager.js

@@ -339,7 +339,7 @@ import ora2 from "ora";
 // src/lib/client.ts
 import { createClient as createSupabaseClient } from "@supabase/supabase-js";
 var DEFAULT_API_URL2 = "https://rhopfaburfflrdwpowcd.supabase.co";
-var DEFAULT_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InJob3BmYWJ1cmZmbHJkd3Bvd2NkIiwicm9sZSI6ImFub24iLCJpYXQiOjE3Mjk0NjkxNzMsImV4cCI6MjA0NTA0NTE3M30.hpEuNqNRJcbCQ_F5u_u8SYABC0Zr_pKCdHMn3lPXn4M";
+var DEFAULT_ANON_KEY = "sb_publishable_Y2EpPiIN3KPjQMc1GLVXjw__ghRVLC4";
 var LOCAL_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24iLCJleHAiOjE5ODM4MTI5OTZ9.CRXP1A7WOeoJeXxjNni43kdQwgnWNReilDMblYTn_I0";
 function getApiUrl2() {
   return process.env.ENVMANAGER_API_URL || getStoredApiUrl() || DEFAULT_API_URL2;
@@ -506,12 +506,16 @@ function getConfigPath() {
 
 // src/lib/resolve.ts
 var UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function cleanProjectInput(input) {
+  return input.startsWith("#") ? input.slice(1) : input;
+}
 async function resolveProjectId(input, client, organizationId) {
-  if (UUID_REGEX.test(input)) {
-    return input;
+  const cleaned = cleanProjectInput(input);
+  if (UUID_REGEX.test(cleaned)) {
+    return cleaned;
   }
-  if (/^\d+$/.test(input)) {
-    const friendlyId = parseInt(input, 10);
+  if (/^\d+$/.test(cleaned)) {
+    const friendlyId = parseInt(cleaned, 10);
     if (friendlyId < 1) {
       throw new Error("Project ID must be 1 or greater");
     }
@@ -521,13 +525,13 @@ async function resolveProjectId(input, client, organizationId) {
     }
     return data2.id;
   }
-  const { data, error } = await client.from("projects").select("id").eq("organization_id", organizationId).ilike("name", input).single();
+  const { data, error } = await client.from("projects").select("id").eq("organization_id", organizationId).ilike("name", cleaned).single();
   if (error || !data) {
     throw new Error(`Project "${input}" not found in this organization`);
   }
   return data.id;
 }
-async function resolveOrganizationId(input, client) {
+async function resolveOrganizationId(input, client, projectHint) {
   const { data: memberships, error: memberError } = await client.from("organization_members").select("organization_id, organizations(id, name)");
   if (memberError || !memberships || memberships.length === 0) {
     throw new Error("No organizations found. Create one at envmanager.dev");
@@ -535,25 +539,204 @@ async function resolveOrganizationId(input, client) {
   if (memberships.length === 1 && !input) {
     return memberships[0].organization_id;
   }
-  if (!input) {
-    const orgList = memberships.map((m) => {
+  if (input) {
+    const match = memberships.find((m) => {
       const org = m.organizations;
-      return org?.name || "Unknown";
-    }).join(", ");
-    throw new Error(`Multiple organizations found. Use --org to specify: ${orgList}`);
+      return org?.name?.toLowerCase() === input.toLowerCase();
+    });
+    if (!match) {
+      throw new Error(`Organization "${input}" not found or you don't have access`);
+    }
+    return match.organization_id;
+  }
+  if (projectHint) {
+    const orgId = await detectOrgFromProject(projectHint, client, memberships);
+    if (orgId) return orgId;
   }
-  const match = memberships.find((m) => {
+  const orgList = memberships.map((m) => {
     const org = m.organizations;
-    return org?.name?.toLowerCase() === input.toLowerCase();
+    return org?.name || "Unknown";
+  }).join(", ");
+  throw new Error(`Multiple organizations found. Use --org to specify: ${orgList}`);
+}
+async function detectOrgFromProject(projectInput, client, memberships) {
+  const cleaned = cleanProjectInput(projectInput);
+  const orgIds = memberships.map((m) => m.organization_id);
+  if (UUID_REGEX.test(cleaned)) {
+    const { data: data2 } = await client.from("projects").select("organization_id").eq("id", cleaned).in("organization_id", orgIds).single();
+    return data2?.organization_id ?? null;
+  }
+  if (/^\d+$/.test(cleaned)) {
+    const friendlyId = parseInt(cleaned, 10);
+    const { data: data2 } = await client.from("projects").select("organization_id").in("organization_id", orgIds).eq("friendly_id", friendlyId);
+    if (data2 && data2.length === 1) return data2[0].organization_id;
+    return null;
+  }
+  const { data } = await client.from("projects").select("organization_id").in("organization_id", orgIds).ilike("name", cleaned);
+  if (data && data.length === 1) return data[0].organization_id;
+  return null;
+}
+
+// src/lib/variable-references.ts
+var REFERENCE_PATTERN = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
+var MAX_DEPTH = 10;
+function parseReferences(value) {
+  const cleaned = value.replace(/\\\$\{/g, "___ESCAPED___");
+  const refs = [];
+  const pattern = new RegExp(REFERENCE_PATTERN.source, "g");
+  let match;
+  while ((match = pattern.exec(cleaned)) !== null) {
+    refs.push(match[1]);
+  }
+  return refs;
+}
+function detectCircularReferences(variables) {
+  const graph = /* @__PURE__ */ new Map();
+  for (const v of variables) {
+    const base = v.value || v.fallbackValue || "";
+    graph.set(v.key, parseReferences(base));
+  }
+  const cycles = [];
+  const visited = /* @__PURE__ */ new Set();
+  const inStack = /* @__PURE__ */ new Set();
+  function dfs(key, stack) {
+    if (inStack.has(key)) {
+      const cycleStart = stack.indexOf(key);
+      cycles.push(stack.slice(cycleStart));
+      return;
+    }
+    if (visited.has(key)) return;
+    visited.add(key);
+    inStack.add(key);
+    stack.push(key);
+    const deps = graph.get(key) || [];
+    for (const dep of deps) {
+      if (graph.has(dep)) {
+        dfs(dep, stack);
+      }
+    }
+    stack.pop();
+    inStack.delete(key);
+  }
+  for (const key of graph.keys()) {
+    dfs(key, []);
+  }
+  return cycles;
+}
+function resolveValue(key, variables, depth = 0, _stack = /* @__PURE__ */ new Set()) {
+  const variable = variables.get(key);
+  if (!variable) {
+    return {
+      key,
+      rawValue: null,
+      resolvedValue: "",
+      source: "empty",
+      references: [],
+      referencedBy: [],
+      unresolvedRefs: [key],
+      hasCircularRef: false
+    };
+  }
+  if (variable.isSecret) {
+    const base2 = variable.value ?? variable.fallbackValue ?? "";
+    const source2 = variable.value ? "explicit" : variable.fallbackValue ? "fallback" : "empty";
+    return {
+      key,
+      rawValue: variable.value,
+      resolvedValue: base2,
+      source: source2,
+      references: parseReferences(base2),
+      referencedBy: [],
+      unresolvedRefs: [],
+      hasCircularRef: false
+    };
+  }
+  let base;
+  let source;
+  if (variable.value !== null && variable.value !== void 0 && variable.value !== "") {
+    base = variable.value;
+    source = "explicit";
+  } else if (variable.fallbackValue !== null && variable.fallbackValue !== void 0 && variable.fallbackValue !== "") {
+    base = variable.fallbackValue;
+    source = "fallback";
+  } else {
+    return {
+      key,
+      rawValue: variable.value,
+      resolvedValue: "",
+      source: "empty",
+      references: [],
+      referencedBy: [],
+      unresolvedRefs: [],
+      hasCircularRef: false
+    };
+  }
+  const references = parseReferences(base);
+  const unresolvedRefs = [];
+  let hasCircularRef = false;
+  let resolved = base.replace(/\\\$\{/g, "___ESCAPED___");
+  const pattern = new RegExp(REFERENCE_PATTERN.source, "g");
+  resolved = resolved.replace(pattern, (fullMatch, refKey) => {
+    if (_stack.has(refKey)) {
+      hasCircularRef = true;
+      unresolvedRefs.push(refKey);
+      return fullMatch;
+    }
+    if (depth >= MAX_DEPTH) {
+      unresolvedRefs.push(refKey);
+      return fullMatch;
+    }
+    if (!variables.has(refKey)) {
+      unresolvedRefs.push(refKey);
+      return fullMatch;
+    }
+    const newStack = new Set(_stack);
+    newStack.add(key);
+    const inner = resolveValue(refKey, variables, depth + 1, newStack);
+    if (inner.hasCircularRef) {
+      hasCircularRef = true;
+    }
+    unresolvedRefs.push(...inner.unresolvedRefs);
+    return inner.resolvedValue;
   });
-  if (!match) {
-    throw new Error(`Organization "${input}" not found or you don't have access`);
+  resolved = resolved.replace(/___ESCAPED___/g, "${");
+  return {
+    key,
+    rawValue: variable.value,
+    resolvedValue: resolved,
+    source,
+    references,
+    referencedBy: [],
+    unresolvedRefs: [...new Set(unresolvedRefs)],
+    hasCircularRef
+  };
+}
+function resolveAll(variables) {
+  const varMap = /* @__PURE__ */ new Map();
+  for (const v of variables) {
+    varMap.set(v.key, v);
+  }
+  const results = variables.map((v) => resolveValue(v.key, varMap));
+  const referencedByMap = /* @__PURE__ */ new Map();
+  for (const v of variables) {
+    referencedByMap.set(v.key, []);
+  }
+  for (const result of results) {
+    for (const ref of result.references) {
+      const existing = referencedByMap.get(ref);
+      if (existing) {
+        existing.push(result.key);
+      }
+    }
   }
-  return match.organization_id;
+  for (const result of results) {
+    result.referencedBy = referencedByMap.get(result.key) || [];
+  }
+  return results;
 }
 
 // src/commands/pull.ts
-var pullCommand = new Command4("pull").description("Pull environment variables from EnvManager to local .env file").option("--org <name>", "Organization name (required if you belong to multiple)").option("-e, --environment <name>", 'Environment name (default: from config or "development")').option("-p, --project <id>", "Project ID (default: from config)").option("-o, --output <file>", "Output file path (default: .env)").option("--no-secrets", "Exclude secret values (will be empty)").option("-f, --force", "Overwrite existing file without prompting").action(async (options) => {
+var pullCommand = new Command4("pull").description("Pull environment variables from EnvManager to local .env file").option("--org <name>", "Organization name (required if you belong to multiple)").option("-e, --environment <name>", 'Environment name (default: from config or "development")').option("-p, --project <id>", "Project ID (default: from config)").option("-o, --output <file>", "Output file path (default: .env)").option("--no-secrets", "Exclude secret values (will be empty)").option("-f, --force", "Overwrite existing file without prompting").option("-r, --resolve-references", "Resolve ${VAR} references to their values").option("-F, --include-fallbacks", "Include fallback values for empty variables").option("-s, --show-sources", "Show value source as inline comments").action(async (options) => {
   const spinner = ora3("Connecting to EnvManager...").start();
   try {
     const config = loadConfig();
@@ -561,6 +744,9 @@ var pullCommand = new Command4("pull").description("Pull environment variables f
     const envName = options.environment || config?.environment || "development";
     const outputFile = resolve(options.output || ".env");
     const includeSecrets = options.secrets !== false;
+    const shouldResolve = options.resolveReferences === true;
+    const shouldFallback = options.includeFallbacks === true;
+    const shouldShowSources = options.showSources === true;
     if (!projectInput) {
       spinner.fail("No project specified");
       console.log(chalk4.yellow("\nSpecify a project with --project <id-or-name> or create envmanager.json"));
@@ -570,7 +756,7 @@ var pullCommand = new Command4("pull").description("Pull environment variables f
     const client = await createClient();
     let organizationId;
     try {
-      organizationId = await resolveOrganizationId(options.org, client);
+      organizationId = await resolveOrganizationId(options.org, client, projectInput);
     } catch (error) {
       spinner.fail(error instanceof Error ? error.message : "Failed to resolve organization");
       process.exit(1);
@@ -593,11 +779,13 @@ var pullCommand = new Command4("pull").description("Pull environment variables f
     }
     const environmentId = environments.id;
     spinner.text = "Fetching variables...";
-    const { data: variables, error: varError } = await client.rpc("get_variables_for_sync", {
+    const rpcParams = {
       p_environment_id: environmentId,
       p_sync_secrets: includeSecrets,
-      p_sync_variables: true
-    });
+      p_sync_variables: true,
+      p_include_fallbacks: shouldFallback || false
+    };
+    const { data: variables, error: varError } = await client.rpc("get_variables_for_sync", rpcParams);
     if (varError) {
       spinner.fail("Failed to fetch variables");
       console.error(chalk4.red(varError.message));
@@ -614,18 +802,68 @@ File ${outputFile} already exists.`));
       console.log(chalk4.gray("Use --force to overwrite."));
       process.exit(1);
     }
+    const vars = variables.sort((a, b) => a.key.localeCompare(b.key));
+    let resolvedMap = null;
+    if (shouldResolve) {
+      spinner.text = "Resolving variable references...";
+      const inputs = vars.map((v) => ({
+        key: v.key,
+        value: v.value,
+        fallbackValue: v.fallback_value ?? null,
+        isSecret: v.is_secret
+      }));
+      const cycles = detectCircularReferences(inputs);
+      if (cycles.length > 0) {
+        spinner.stop();
+        for (const cycle of cycles) {
+          console.log(chalk4.yellow(`Warning: circular reference detected: ${cycle.join(" -> ")} -> ${cycle[0]}`));
+        }
+        spinner.start("Resolving variable references...");
+      }
+      const resolved = resolveAll(inputs);
+      resolvedMap = new Map(resolved.map((r) => [r.key, r]));
+    }
     spinner.text = "Writing .env file...";
-    const envContent = variables.sort((a, b) => a.key.localeCompare(b.key)).map((v) => {
-      const value = v.value || "";
+    const envContent = vars.map((v) => {
+      let value;
+      let source = null;
+      if (resolvedMap) {
+        const resolved = resolvedMap.get(v.key);
+        value = resolved.resolvedValue;
+        source = resolved.source;
+      } else if (shouldFallback && (!v.value || v.value === "") && v.fallback_value) {
+        value = v.fallback_value;
+        source = "fallback";
+      } else {
+        value = v.value || "";
+      }
       const needsQuotes = value.includes(" ") || value.includes("\n") || value.includes('"');
       const formattedValue = needsQuotes ? `"${value.replace(/"/g, '\\"')}"` : value;
-      return `${v.key}=${formattedValue}`;
+      let line = `${v.key}=${formattedValue}`;
+      if (shouldShowSources && resolvedMap) {
+        const resolved = resolvedMap.get(v.key);
+        if (resolved.references.length > 0 && resolved.source !== "empty") {
+          line += `  # resolved from ${resolved.rawValue ?? v.value ?? ""}`;
+        } else if (resolved.source === "fallback") {
+          line += `  # fallback value`;
+        }
+      } else if (shouldShowSources && source === "fallback") {
+        line += `  # fallback value`;
+      }
+      return line;
     }).join("\n");
     writeFileSync2(outputFile, envContent + "\n");
-    const secretCount = variables.filter((v) => v.is_secret).length;
-    const plainCount = variables.length - secretCount;
+    const secretCount = vars.filter((v) => v.is_secret).length;
+    const plainCount = vars.length - secretCount;
     spinner.succeed(`Pulled ${variables.length} variables to ${outputFile}`);
     console.log(chalk4.gray(`  ${plainCount} plain, ${secretCount} secrets`));
+    client.rpc("log_variable_access", {
+      p_environment_id: environmentId,
+      p_access_type: "cli_pull",
+      p_metadata: { cli_version: "0.1.1" }
+    }).then(() => {
+    }, () => {
+    });
   } catch (error) {
     spinner.fail("Pull failed");
     console.error(chalk4.red(error instanceof Error ? error.message : "Unknown error"));
@@ -669,6 +907,110 @@ function parseEnvFileAsArray(content) {
   return Array.from(map.entries()).map(([key, value]) => ({ key, value }));
 }
 
+// src/lib/naming-conventions.ts
+function isScreamingSnakeCase(name) {
+  return /^[A-Z][A-Z0-9]*(_[A-Z0-9]+)*$/.test(name);
+}
+function isSnakeCase(name) {
+  return /^[a-z][a-z0-9]*(_[a-z0-9]+)*$/.test(name);
+}
+function isPascalCase(name) {
+  return /^[A-Z][a-zA-Z0-9]*$/.test(name);
+}
+function isCamelCase(name) {
+  return /^[a-z][a-zA-Z0-9]*$/.test(name);
+}
+function splitIntoWords(name) {
+  if (name.includes("_")) {
+    return name.split("_").filter(Boolean);
+  }
+  return name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").split("_").filter(Boolean);
+}
+function convertToCase(name, targetCase) {
+  const words = splitIntoWords(name);
+  if (words.length === 0) return name;
+  switch (targetCase) {
+    case "SCREAMING_SNAKE_CASE":
+      return words.map((w) => w.toUpperCase()).join("_");
+    case "snake_case":
+      return words.map((w) => w.toLowerCase()).join("_");
+    case "PascalCase":
+      return words.map((w) => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase()).join("");
+    case "camelCase":
+      return words.map((w, i) => {
+        if (i === 0) return w.toLowerCase();
+        return w.charAt(0).toUpperCase() + w.slice(1).toLowerCase();
+      }).join("");
+    default:
+      return name;
+  }
+}
+function validateVariableName(name, config) {
+  const issues = [];
+  if (config.rules.case) {
+    let caseValid = false;
+    switch (config.rules.case) {
+      case "SCREAMING_SNAKE_CASE":
+        caseValid = isScreamingSnakeCase(name);
+        break;
+      case "snake_case":
+        caseValid = isSnakeCase(name);
+        break;
+      case "PascalCase":
+        caseValid = isPascalCase(name);
+        break;
+      case "camelCase":
+        caseValid = isCamelCase(name);
+        break;
+    }
+    if (!caseValid) {
+      const suggestion = convertToCase(name, config.rules.case);
+      issues.push({
+        type: "case",
+        message: `Must be ${config.rules.case}`,
+        suggestion
+      });
+    }
+  }
+  if (config.rules.patterns) {
+    for (const pattern of config.rules.patterns) {
+      try {
+        const regex = new RegExp(pattern.match);
+        if (!regex.test(name)) {
+          issues.push({
+            type: "pattern",
+            message: pattern.description,
+            suggestion: pattern.example
+          });
+        }
+      } catch {
+      }
+    }
+  }
+  if (config.rules.forbidden) {
+    for (const rule of config.rules.forbidden) {
+      try {
+        const regex = new RegExp(rule.match, "i");
+        if (regex.test(name)) {
+          issues.push({
+            type: "forbidden",
+            message: rule.reason
+          });
+        }
+      } catch {
+      }
+    }
+  }
+  const isBlock = config.enforcement_mode === "block";
+  const suggestions = issues.map((i) => i.suggestion).filter((s) => !!s);
+  return {
+    valid: isBlock ? issues.length === 0 : true,
+    errors: isBlock ? issues : [],
+    warnings: isBlock ? [] : issues,
+    suggestions: [...new Set(suggestions)]
+  };
+}
+
 // src/commands/push.ts
 var pushCommand = new Command5("push").description("Push local .env file to EnvManager").option("--org <name>", "Organization name (required if you belong to multiple)").option("-e, --environment <name>", 'Environment name (default: from config or "development")').option("-p, --project <id>", "Project ID (default: from config)").option("-i, --input <file>", "Input file path (default: .env)").option("--secrets <keys>", "Comma-separated list of keys to mark as secrets").option("--all-secrets", "Mark all variables as secrets").option("--dry-run", "Show what would be pushed without making changes").action(async (options) => {
   const spinner = ora4("Reading .env file...").start();
@@ -709,7 +1051,7 @@ var pushCommand = new Command5("push").description("Push local .env file to EnvM
     const client = await createClient();
     let organizationId;
     try {
-      organizationId = await resolveOrganizationId(options.org, client);
+      organizationId = await resolveOrganizationId(options.org, client, projectInput);
     } catch (error) {
       spinner.fail(error instanceof Error ? error.message : "Failed to resolve organization");
       process.exit(1);
@@ -727,32 +1069,84 @@ var pushCommand = new Command5("push").description("Push local .env file to EnvM
       spinner.fail(`Environment "${envName}" not found in project`);
       process.exit(1);
     }
+    spinner.text = "Checking naming conventions...";
+    const { data: namingRules } = await client.from("naming_conventions").select("*").eq("organization_id", organizationId).eq("project_id", projectId).maybeSingle();
+    let namingConfig = null;
+    if (namingRules) {
+      namingConfig = {
+        rules: namingRules.rules,
+        enforcement_mode: namingRules.enforcement_mode,
+        template_name: namingRules.template_name || void 0
+      };
+    } else {
+      const { data: orgRules } = await client.from("naming_conventions").select("*").eq("organization_id", organizationId).is("project_id", null).maybeSingle();
+      if (orgRules) {
+        namingConfig = {
+          rules: orgRules.rules,
+          enforcement_mode: orgRules.enforcement_mode,
+          template_name: orgRules.template_name || void 0
+        };
+      }
+    }
+    if (namingConfig) {
+      const issues = [];
+      for (const v of vars) {
+        const result = validateVariableName(v.key, namingConfig);
+        const allIssues = [...result.errors, ...result.warnings];
+        for (const issue of allIssues) {
+          issues.push({ key: v.key, message: issue.message, suggestion: issue.suggestion });
+        }
+      }
+      if (issues.length > 0) {
+        const isBlock = namingConfig.enforcement_mode === "block";
+        console.log("");
+        console.log(chalk6[isBlock ? "red" : "yellow"](`  Naming convention ${isBlock ? "errors" : "warnings"}:`));
+        for (const issue of issues) {
+          const suggestion = issue.suggestion ? chalk6.gray(` \u2192 ${issue.suggestion}`) : "";
+          console.log(chalk6[isBlock ? "red" : "yellow"](`    ${issue.key}: ${issue.message}${suggestion}`));
+        }
+        console.log("");
+        if (isBlock) {
+          spinner.fail("Push blocked by naming convention errors");
+          process.exit(1);
+        }
+      }
+    }
     spinner.text = "Pushing variables...";
-    const variablesToInsert = vars.map((v) => ({
+    const markAsSecrets = allSecrets || secretKeys.length > 0;
+    const variablesData = vars.map((v) => ({
       key: v.key,
-      value: v.value,
-      is_secret: allSecrets || secretKeys.includes(v.key)
+      value: v.value
     }));
-    const { data: result, error: pushError } = await client.rpc("bulk_insert_variables", {
-      p_environment_id: environment.id,
-      p_organization_id: organizationId,
-      p_variables: variablesToInsert,
-      p_overwrite: true
+    const { data: existingVars } = await client.from("variables").select("key").eq("environment_id", environment.id);
+    const existingKeys = new Set((existingVars || []).map((v) => v.key));
+    const keysToUpdate = variablesData.filter((v) => existingKeys.has(v.key));
+    const keysToInsert = variablesData.filter((v) => !existingKeys.has(v.key));
+    if (keysToUpdate.length > 0) {
+      const { error: deleteError } = await client.from("variables").delete().eq("environment_id", environment.id).in("key", keysToUpdate.map((v) => v.key));
+      if (deleteError) {
+        spinner.fail("Failed to update existing variables");
+        console.error(chalk6.red(deleteError.message));
+        process.exit(1);
+      }
+    }
+    const { error: pushError } = await client.rpc("bulk_insert_variables", {
+      variables_data: variablesData,
+      environment_id_param: environment.id,
+      organization_id_param: organizationId,
+      import_as_secrets: markAsSecrets
     });
     if (pushError) {
       spinner.fail("Push failed");
       console.error(chalk6.red(pushError.message));
       process.exit(1);
     }
-    const insertedCount = result?.inserted || vars.length;
-    const updatedCount = result?.updated || 0;
-    const secretCount = variablesToInsert.filter((v) => v.is_secret).length;
     spinner.succeed(`Pushed ${vars.length} variables to ${envName}`);
-    if (updatedCount > 0) {
-      console.log(chalk6.gray(`  ${insertedCount} inserted, ${updatedCount} updated`));
+    if (keysToUpdate.length > 0) {
+      console.log(chalk6.gray(`  ${keysToInsert.length} inserted, ${keysToUpdate.length} updated`));
     }
-    if (secretCount > 0) {
-      console.log(chalk6.gray(`  ${secretCount} marked as secrets`));
+    if (markAsSecrets) {
+      console.log(chalk6.gray(`  All marked as secrets`));
     }
   } catch (error) {
     spinner.fail("Push failed");
@@ -789,7 +1183,7 @@ var diffCommand = new Command6("diff").description("Show differences between loc
     const client = await createClient();
     let organizationId;
     try {
-      organizationId = await resolveOrganizationId(options.org, client);
+      organizationId = await resolveOrganizationId(options.org, client, projectInput);
     } catch (error) {
       spinner.fail(error instanceof Error ? error.message : "Failed to resolve organization");
       process.exit(1);
@@ -811,7 +1205,8 @@ var diffCommand = new Command6("diff").description("Show differences between loc
     const { data: remoteVarsData, error: varError } = await client.rpc("get_variables_for_sync", {
       p_environment_id: environment.id,
       p_sync_secrets: true,
-      p_sync_variables: true
+      p_sync_variables: true,
+      p_include_fallbacks: false
     });
     if (varError) {
       spinner.fail("Failed to fetch remote variables");
@@ -940,7 +1335,7 @@ var listCommand = new Command7("list").description("List projects, environments,
         }
         let organizationId;
         try {
-          organizationId = await resolveOrganizationId(options.org, client);
+          organizationId = await resolveOrganizationId(options.org, client, projectInput);
         } catch (error) {
           spinner.fail(error instanceof Error ? error.message : "Failed to resolve organization");
           process.exit(1);
@@ -984,7 +1379,7 @@ var listCommand = new Command7("list").description("List projects, environments,
         }
         let organizationId;
         try {
-          organizationId = await resolveOrganizationId(options.org, client);
+          organizationId = await resolveOrganizationId(options.org, client, projectInput);
         } catch (error) {
           spinner.fail(error instanceof Error ? error.message : "Failed to resolve organization");
           process.exit(1);
@@ -1150,7 +1545,8 @@ async function fetchAllVariables(environmentId, includeSecrets = true) {
   const { data: variables, error } = await client.rpc("get_variables_for_sync", {
     p_environment_id: environmentId,
     p_sync_secrets: includeSecrets,
-    p_sync_variables: true
+    p_sync_variables: true,
+    p_include_fallbacks: false
   });
   if (error) {
     throw new Error(`Failed to fetch variables: ${error.message}`);
@@ -1307,7 +1703,7 @@ var devCommand = new Command9("dev").description("Start real-time sync daemon -
     const client = await createClient();
     let organizationId;
     try {
-      organizationId = await resolveOrganizationId(options.org, client);
+      organizationId = await resolveOrganizationId(options.org, client, projectInput);
     } catch (error) {
       spinner.fail(error instanceof Error ? error.message : "Failed to resolve organization");
       process.exit(1);
@@ -1770,7 +2166,8 @@ Environment "${envName}" not found. Available:`));
     const { data: variables, error: varError } = await client.rpc("get_variables_for_sync", {
       p_environment_id: environment.id,
       p_sync_secrets: false,
-      p_sync_variables: true
+      p_sync_variables: true,
+      p_include_fallbacks: false
     });
     if (varError) {
       spinner.fail("Failed to fetch variables");
@@ -1884,7 +2281,8 @@ File ${outputPath} already exists. Use --force to overwrite.`));
     const { data: variables, error: varError } = await client.rpc("get_variables_for_sync", {
       p_environment_id: environment.id,
       p_sync_secrets: true,
-      p_sync_variables: true
+      p_sync_variables: true,
+      p_include_fallbacks: false
     });
     if (varError) {
       spinner.fail("Failed to fetch variables");
@@ -1975,7 +2373,8 @@ templateCommand.command("sync").description("Compare template with EnvManager an
     const { data: variables, error: varError } = await client.rpc("get_variables_for_sync", {
       p_environment_id: environment.id,
       p_sync_secrets: false,
-      p_sync_variables: true
+      p_sync_variables: true,
+      p_include_fallbacks: false
     });
     if (varError) {
       spinner.fail("Failed to fetch variables");
@@ -2283,7 +2682,7 @@ var validateCommand = new Command12("validate").description("Validate local .env
       const client = await createClient();
       let organizationId;
       try {
-        organizationId = await resolveOrganizationId(options.org, client);
+        organizationId = await resolveOrganizationId(options.org, client, projectInput);
       } catch (error) {
         spinner.fail(error instanceof Error ? error.message : "Failed to resolve organization");
         process.exit(1);