@envpilot/cli 1.11.0 → 1.12.1

package/dist/{chunk-AS4NIUYS.js → chunk-ETTIRMJX.js}

@@ -7,7 +7,7 @@ function initSentry() {
   Sentry.init({
     dsn,
     environment: "cli",
-    release: true ? "1.11.0" : "0.0.0",
+    release: true ? "1.12.1" : "0.0.0",
     // All EnvPilot surfaces report to one Sentry project; the surface tag
     // is how dashboards tell web / cli / extension events apart.
     initialScope: { tags: { surface: "cli" } },
@@ -390,15 +390,6 @@ function setApiUrl(url) {
 function getAccessToken() {
   return getActiveAccount()?.accessToken;
 }
-function setAccessToken(token) {
-  updateActiveAccount({ accessToken: token });
-}
-function getRefreshToken() {
-  return getActiveAccount()?.refreshToken;
-}
-function setRefreshToken(token) {
-  updateActiveAccount({ refreshToken: token });
-}
 function getActiveProjectId() {
   return getActiveAccount()?.activeProjectId;
 }
@@ -472,7 +463,7 @@ import { jsx } from "react/jsx-runtime";
 async function openTUI() {
   const [{ render }, { CLIApp }, { PressAnyKey }] = await Promise.all([
     import("ink"),
-    import("./app-SRLCVHPE.js"),
+    import("./app-KEDPMGXA.js"),
     import("./press-any-key-64XFP4O2.js")
   ]);
   while (true) {
@@ -743,13 +734,221 @@ import open from "open";
 import chalk3 from "chalk";
 import { hostname } from "os";
 
-// src/lib/api.ts
-function registrableDomain(hostname2) {
-  const parts = hostname2.toLowerCase().split(".").filter(Boolean);
-  if (parts.length <= 2) return parts.join(".");
-  return parts.slice(-2).join(".");
+// src/lib/workos.ts
+import { z } from "zod";
+
+// src/lib/env.ts
+var WORKOS_CLIENT_ID = "" ? "" : process.env.WORKOS_CLIENT_ID ?? "";
+var CONVEX_URL = "" ? "" : process.env.NEXT_PUBLIC_CONVEX_URL ?? "";
+
+// src/lib/workos.ts
+var WORKOS_BASE = "https://api.workos.com";
+var DEVICE_AUTHORIZE_URL = `${WORKOS_BASE}/user_management/authorize/device`;
+var AUTHENTICATE_URL = `${WORKOS_BASE}/user_management/authenticate`;
+var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+var deviceCodeSchema = z.object({
+  device_code: z.string(),
+  user_code: z.string(),
+  verification_uri: z.string(),
+  verification_uri_complete: z.string(),
+  expires_in: z.number().default(300),
+  interval: z.number().default(5)
+});
+var workosUserSchema = z.object({
+  id: z.string(),
+  email: z.string(),
+  first_name: z.string().nullish(),
+  last_name: z.string().nullish()
+});
+var tokenSchema = z.object({
+  access_token: z.string(),
+  refresh_token: z.string(),
+  user: workosUserSchema.optional(),
+  organization_id: z.string().nullish()
+});
+var refreshSchema = z.object({
+  access_token: z.string(),
+  // WorkOS MAY rotate the refresh token — persist whichever it returns.
+  refresh_token: z.string()
+});
+var WorkosAuthError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "WorkosAuthError";
+  }
+};
+function assertConfigured() {
+  if (!WORKOS_CLIENT_ID) {
+    throw new WorkosAuthError(
+      "This CLI build has no WorkOS client id embedded. Rebuild with WORKOS_CLIENT_ID set.",
+      "not_configured"
+    );
+  }
 }
-var MAX_MANUAL_REDIRECTS = 5;
+async function postForm(url, form) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams(form).toString()
+  });
+  let body = null;
+  try {
+    body = await res.json();
+  } catch {
+    body = null;
+  }
+  return { status: res.status, body };
+}
+async function requestDeviceCode() {
+  assertConfigured();
+  let result;
+  try {
+    result = await postForm(DEVICE_AUTHORIZE_URL, {
+      client_id: WORKOS_CLIENT_ID
+    });
+  } catch (err) {
+    throw new WorkosAuthError(
+      `Could not reach WorkOS to start authentication: ${err.message}`,
+      "network"
+    );
+  }
+  if (result.status >= 400) {
+    const message = extractErrorMessage(result.body);
+    throw new WorkosAuthError(
+      `WorkOS rejected the device-code request${message ? `: ${message}` : ""}.`,
+      "invalid_response"
+    );
+  }
+  const parsed = deviceCodeSchema.safeParse(result.body);
+  if (!parsed.success) {
+    throw new WorkosAuthError(
+      "WorkOS returned an unexpected device-code response.",
+      "invalid_response"
+    );
+  }
+  return parsed.data;
+}
+async function pollForToken(deviceCode) {
+  assertConfigured();
+  let result;
+  try {
+    result = await postForm(AUTHENTICATE_URL, {
+      client_id: WORKOS_CLIENT_ID,
+      grant_type: DEVICE_CODE_GRANT,
+      device_code: deviceCode
+    });
+  } catch {
+    return { status: "network" };
+  }
+  if (result.status === 200) {
+    const parsed = tokenSchema.safeParse(result.body);
+    if (!parsed.success) {
+      throw new WorkosAuthError(
+        "WorkOS returned an unexpected token response.",
+        "invalid_response"
+      );
+    }
+    return { status: "complete", token: parsed.data };
+  }
+  const errorCode = extractOauthError(result.body);
+  switch (errorCode) {
+    case "authorization_pending":
+      return { status: "pending" };
+    case "slow_down":
+      return { status: "slow_down" };
+    case "access_denied":
+      return { status: "denied" };
+    case "expired_token":
+      return { status: "expired" };
+    default:
+      return { status: "network" };
+  }
+}
+async function refreshAccessToken(refreshToken) {
+  assertConfigured();
+  let result;
+  try {
+    result = await postForm(AUTHENTICATE_URL, {
+      client_id: WORKOS_CLIENT_ID,
+      grant_type: "refresh_token",
+      refresh_token: refreshToken
+    });
+  } catch (err) {
+    throw new WorkosAuthError(
+      `Could not reach WorkOS to refresh the session: ${err.message}`,
+      "network"
+    );
+  }
+  if (result.status >= 400) {
+    const message = extractOauthError(result.body) ?? extractErrorMessage(result.body);
+    const transient = result.status >= 500 || result.status === 429;
+    throw new WorkosAuthError(
+      `Session refresh failed${message ? `: ${message}` : ""}.`,
+      transient ? "network" : "access_denied"
+    );
+  }
+  const parsed = refreshSchema.safeParse(result.body);
+  if (!parsed.success) {
+    throw new WorkosAuthError(
+      "WorkOS returned an unexpected refresh response.",
+      "invalid_response"
+    );
+  }
+  return parsed.data;
+}
+function extractOauthError(body) {
+  if (body && typeof body === "object" && "error" in body) {
+    const e = body.error;
+    return typeof e === "string" ? e : null;
+  }
+  return null;
+}
+function extractErrorMessage(body) {
+  if (body && typeof body === "object") {
+    const obj = body;
+    const msg = obj.error_description ?? obj.message ?? obj.error;
+    return typeof msg === "string" ? msg : null;
+  }
+  return null;
+}
+
+// src/lib/jwt.ts
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length < 2) return null;
+    const payload = parts[1];
+    const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const json = Buffer.from(base64, "base64").toString("utf-8");
+    const parsed = JSON.parse(json);
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function getJwtExp(token) {
+  const payload = decodeJwtPayload(token);
+  const exp = payload?.exp;
+  return typeof exp === "number" ? exp : null;
+}
+function getJwtSessionId(token) {
+  const payload = decodeJwtPayload(token);
+  const sid = payload?.sid;
+  return typeof sid === "string" ? sid : null;
+}
+function isTokenExpiring(token, skewSeconds = 60) {
+  const exp = getJwtExp(token);
+  if (exp === null) return true;
+  const nowSeconds = Date.now() / 1e3;
+  return exp - nowSeconds <= skewSeconds;
+}
+
+// src/lib/api.ts
+import { ConvexHttpClient } from "convex/browser";
+import {
+  makeFunctionReference
+} from "convex/server";
 var APIError = class extends Error {
   constructor(message, statusCode, code) {
     super(message);
@@ -758,48 +957,139 @@ var APIError = class extends Error {
     this.name = "APIError";
   }
 };
+var refreshInFlight = null;
+async function ensureFreshAccessToken() {
+  const account = getActiveAccount();
+  if (!account?.accessToken) {
+    throw new APIError(
+      "You are not logged in. Run `envpilot login`.",
+      401,
+      "NOT_AUTHENTICATED"
+    );
+  }
+  if (!isTokenExpiring(account.accessToken)) {
+    return account.accessToken;
+  }
+  if (refreshInFlight) return refreshInFlight;
+  const refreshToken = account.refreshToken;
+  if (!refreshToken) {
+    throw new APIError(
+      "Your session has expired. Run `envpilot login`.",
+      401,
+      "SESSION_EXPIRED"
+    );
+  }
+  refreshInFlight = (async () => {
+    try {
+      const result = await refreshAccessToken(refreshToken);
+      updateActiveAccount({
+        accessToken: result.access_token,
+        refreshToken: result.refresh_token
+      });
+      return result.access_token;
+    } catch (err) {
+      if (err instanceof WorkosAuthError && err.code === "access_denied") {
+        clearAuth();
+        throw new APIError(
+          "Your session has expired. Run `envpilot login`.",
+          401,
+          "SESSION_EXPIRED"
+        );
+      }
+      throw err;
+    } finally {
+      refreshInFlight = null;
+    }
+  })();
+  return refreshInFlight;
+}
+async function getConvexClient() {
+  if (!CONVEX_URL) {
+    throw new APIError(
+      "This CLI build has no Convex URL embedded. Rebuild with NEXT_PUBLIC_CONVEX_URL set.",
+      0,
+      "NOT_CONFIGURED"
+    );
+  }
+  const token = await ensureFreshAccessToken();
+  const client = new ConvexHttpClient(CONVEX_URL);
+  client.setAuth(token);
+  return client;
+}
+var fnRef = makeFunctionReference;
+var refs = {
+  listOrganizations: fnRef(
+    "organizations:listForUser"
+  ),
+  getMembership: fnRef(
+    "organizations:getMembership"
+  ),
+  listProjectsWithStats: fnRef("projects:listWithStats"),
+  getProject: fnRef(
+    "projects:getById"
+  ),
+  getProjectMembership: fnRef("projectMembers:getProjectMembership"),
+  listVariablesWithAccess: fnRef("variables:listWithAccess"),
+  listVariableRequests: fnRef("variableRequests:listForProject"),
+  getResolvedFeatures: fnRef("featureRegistry:getResolvedFeatures"),
+  getResolvedFeaturesBatch: fnRef("featureRegistry:getResolvedFeaturesBatch"),
+  getOrganizationUsage: fnRef("tierLimits:getOrganizationUsage"),
+  isEnforcementEnabled: fnRef(
+    "tierLimits:isEnforcementEnabled"
+  ),
+  deviceSessionRecord: fnRef("deviceSessions:record"),
+  deviceSessionRevoke: fnRef(
+    "deviceSessions:revoke"
+  )
+};
+async function convexQuery(ref, ...args) {
+  const client = await getConvexClient();
+  return client.query(ref, ...args);
+}
+async function convexMutation(ref, ...args) {
+  const client = await getConvexClient();
+  return client.mutation(ref, ...args);
+}
+async function recordDeviceSession(deviceName, sessionId) {
+  try {
+    await convexMutation(refs.deviceSessionRecord, {
+      deviceName,
+      clientType: "cli",
+      sessionId
+    });
+  } catch {
+  }
+}
+async function revokeDeviceSession(sessionId) {
+  try {
+    await convexMutation(refs.deviceSessionRevoke, { sessionId });
+  } catch {
+  }
+}
+function numericFeature(resolved, key, fallback = null) {
+  const value = resolved?.features?.[key]?.value;
+  return typeof value === "number" ? value : fallback;
+}
+function booleanFeature(resolved, key, fallback = false) {
+  const value = resolved?.features?.[key]?.value;
+  return typeof value === "boolean" ? value : fallback;
+}
+function registrableDomain(hostname2) {
+  const parts = hostname2.toLowerCase().split(".").filter(Boolean);
+  if (parts.length <= 2) return parts.join(".");
+  return parts.slice(-2).join(".");
+}
+var MAX_MANUAL_REDIRECTS = 5;
 var APIClient = class {
   baseUrl;
-  accessToken;
-  // Re-entrancy guard: true while a token refresh is in flight so a 401 from
-  // the refresh endpoint itself can never trigger another refresh (no loops).
-  refreshing = false;
   constructor(options) {
     this.baseUrl = options?.baseUrl ?? getApiUrl();
-    this.accessToken = options?.accessToken ?? getAccessToken();
-  }
-  /**
-   * Get headers for API requests
-   */
-  getHeaders() {
-    const headers = {
-      "Content-Type": "application/json"
-    };
-    if (this.accessToken) {
-      headers["Authorization"] = `Bearer ${this.accessToken}`;
-    }
-    return headers;
-  }
-  /**
-   * Detect auth middleware redirects that returned HTML instead of CLI JSON.
-   */
-  isAuthRedirect(response, bodyText) {
-    const location = response.headers.get("location") || "";
-    const finalUrl = response.url || "";
-    const contentType = response.headers.get("content-type") || "";
-    const preview = (bodyText || "").slice(0, 512).toLowerCase();
-    return location.includes("authkit") || finalUrl.includes("authkit") || contentType.includes("text/html") && (preview.includes("authorization_session_id") || preview.includes("client_id=") || preview.includes("<!doctype html"));
   }
+  // ── Vault HTTP path (decrypted secret values) ──────────────────────────
   /**
-   * Perform a fetch that follows 3xx redirects manually, re-attaching the
-   * Authorization header when the redirect stays inside the same registrable
-   * domain (eTLD+1). This defends against the apex→www redirect case where
-   * Node's default redirect follower drops the Authorization header on any
-   * hostname change and the resulting request comes back as a bogus 401 —
-   * which used to wipe the user's credentials.
-   *
-   * Cross-site redirects (different registrable domain) are followed without
-   * the Authorization header, matching browser/fetch security semantics.
+   * Follow 3xx redirects manually, re-attaching Authorization only within the
+   * same registrable domain (defends against the apex→www redirect that would
+   * otherwise drop the header and yield a bogus 401).
    */
   async fetchWithSafeRedirects(initialUrl, init2) {
     let currentUrl = initialUrl;
@@ -815,9 +1105,7 @@ var APIClient = class {
       const prevHost = new URL(currentUrl).hostname;
       const sameSite = registrableDomain(nextUrl.hostname) === registrableDomain(prevHost);
       const headers = new Headers(currentInit.headers);
-      if (!sameSite) {
-        headers.delete("Authorization");
-      }
+      if (!sameSite) headers.delete("Authorization");
       let nextMethod = (currentInit.method || "GET").toUpperCase();
       let nextBody = currentInit.body;
       if (response.status === 301 || response.status === 302 || response.status === 303) {
@@ -842,166 +1130,54 @@ var APIClient = class {
       "TOO_MANY_REDIRECTS"
     );
   }
-  /**
-   * Attempt a one-shot access-token refresh using the stored refresh token.
-   * Persists the rotated tokens and updates this client's in-memory token on
-   * success. Returns false (without throwing) when there is no refresh token,
-   * a refresh is already in flight, or the refresh call fails — the caller
-   * then treats the session as dead.
-   */
-  async tryRefreshToken() {
-    if (this.refreshing) return false;
-    const refreshToken = getRefreshToken();
-    if (!refreshToken) return false;
-    this.refreshing = true;
-    try {
-      const result = await this.refreshToken(refreshToken);
-      setAccessToken(result.accessToken);
-      setRefreshToken(result.refreshToken);
-      this.accessToken = result.accessToken;
-      return true;
-    } catch {
-      return false;
-    } finally {
-      this.refreshing = false;
-    }
-  }
-  /**
-   * Run a request thunk with automatic one-shot token refresh on a genuine 401.
-   *
-   * - An AUTH_REDIRECT (HTML sign-in page) is NOT a rejected token — rethrow
-   *   without clearing creds or refreshing.
-   * - A genuine 401 triggers a single refresh attempt. On success the request
-   *   is retried once with the rotated token; on failure (or a second 401) the
-   *   local credentials are cleared so the user is prompted to log in again.
-   *
-   * The thunk rebuilds its headers on each call, so the retry automatically
-   * picks up the refreshed access token.
-   */
-  async withAuthRetry(exec) {
-    try {
-      return await exec();
-    } catch (err) {
-      if (!(err instanceof APIError) || err.statusCode !== 401 || err.code === "AUTH_REDIRECT" || this.refreshing) {
-        throw err;
-      }
-      const refreshed = await this.tryRefreshToken();
-      if (!refreshed) {
-        clearAuth();
-        throw err;
-      }
-      try {
-        return await exec();
-      } catch (retryErr) {
-        if (retryErr instanceof APIError && retryErr.statusCode === 401 && retryErr.code !== "AUTH_REDIRECT") {
-          clearAuth();
-        }
-        throw retryErr;
+  /** Perform an authed vault request carrying a fresh WorkOS JWT bearer. */
+  async vaultRequest(method, path, options) {
+    const token = await ensureFreshAccessToken();
+    const url = new URL(path, this.baseUrl);
+    if (options?.params) {
+      for (const [key, value] of Object.entries(options.params)) {
+        url.searchParams.set(key, value);
       }
     }
-  }
-  /**
-   * Make a GET request
-   */
-  async get(path, params) {
-    return this.withAuthRetry(async () => {
-      const url = new URL(path, this.baseUrl);
-      if (params) {
-        for (const [key, value] of Object.entries(params)) {
-          url.searchParams.set(key, value);
-        }
-      }
-      const response = await this.fetchWithSafeRedirects(url.toString(), {
-        method: "GET",
-        headers: this.getHeaders()
-      });
-      return this.handleResponse(response);
-    });
-  }
-  /**
-   * Make a POST request
-   */
-  async post(path, body) {
-    return this.withAuthRetry(async () => {
-      const url = new URL(path, this.baseUrl);
-      const response = await this.fetchWithSafeRedirects(url.toString(), {
-        method: "POST",
-        headers: this.getHeaders(),
-        body: body ? JSON.stringify(body) : void 0
-      });
-      return this.handleResponse(response);
-    });
-  }
-  /**
-   * Make a PUT request
-   */
-  async put(path, body) {
-    return this.withAuthRetry(async () => {
-      const url = new URL(path, this.baseUrl);
-      const response = await this.fetchWithSafeRedirects(url.toString(), {
-        method: "PUT",
-        headers: this.getHeaders(),
-        body: body ? JSON.stringify(body) : void 0
-      });
-      return this.handleResponse(response);
-    });
-  }
-  /**
-   * Make a PATCH request
-   */
-  async patch(path, body) {
-    return this.withAuthRetry(async () => {
-      const url = new URL(path, this.baseUrl);
-      const response = await this.fetchWithSafeRedirects(url.toString(), {
-        method: "PATCH",
-        headers: this.getHeaders(),
-        body: body ? JSON.stringify(body) : void 0
-      });
-      return this.handleResponse(response);
+    const response = await this.fetchWithSafeRedirects(url.toString(), {
+      method,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`
+      },
+      body: options?.body ? JSON.stringify(options.body) : void 0
     });
+    return this.handleResponse(response);
   }
-  /**
-   * Make a DELETE request
-   */
-  async delete(path) {
-    return this.withAuthRetry(async () => {
-      const url = new URL(path, this.baseUrl);
-      const response = await this.fetchWithSafeRedirects(url.toString(), {
-        method: "DELETE",
-        headers: this.getHeaders()
-      });
-      if (!response.ok) {
-        await this.handleError(response);
-      }
-    });
+  isAuthRedirect(response, bodyText) {
+    const location = response.headers.get("location") || "";
+    const finalUrl = response.url || "";
+    const contentType = response.headers.get("content-type") || "";
+    const preview = (bodyText || "").slice(0, 512).toLowerCase();
+    return location.includes("authkit") || finalUrl.includes("authkit") || contentType.includes("text/html") && (preview.includes("authorization_session_id") || preview.includes("client_id=") || preview.includes("<!doctype html"));
   }
-  /**
-   * Handle API response
-   */
   async handleResponse(response) {
     if (!response.ok) {
       await this.handleError(response);
     }
     const contentType = response.headers.get("content-type") || "";
+    const body = await response.text();
     if (!contentType.includes("application/json")) {
-      const body2 = await response.text();
-      if (this.isAuthRedirect(response, body2)) {
+      if (this.isAuthRedirect(response, body)) {
         throw new APIError(
           "Your CLI session is not authorized for this endpoint. Please run `envpilot login` and try again.",
           401,
           "AUTH_REDIRECT"
         );
       }
-      const preview = body2.replace(/\s+/g, " ").slice(0, 160);
+      const preview = body.replace(/\s+/g, " ").slice(0, 160);
       throw new APIError(
         `Expected JSON but got ${contentType || "unknown content type"} from ${response.url}. Response starts with: ${preview}`,
         response.status || 500
       );
     }
-    const body = await response.text();
     try {
-      const data = JSON.parse(body);
-      return data;
+      return JSON.parse(body);
     } catch {
       const preview = body.replace(/\s+/g, " ").slice(0, 160);
       throw new APIError(
@@ -1010,9 +1186,6 @@ var APIClient = class {
       );
     }
   }
-  /**
-   * Handle API errors
-   */
   async handleError(response) {
     const bodyText = await response.text();
     let message = `Request failed with status ${response.status}`;
@@ -1057,192 +1230,230 @@ var APIClient = class {
     throw new APIError(message, response.status, code);
   }
   // ============================================
-  // High-level API methods
+  // High-level methods — DIRECT to Convex
   // ============================================
   /**
-   * Get current user info
+   * Current authenticated user. Verifies the session is live server-side (an
+   * authed Convex query) and returns the identity captured at login.
    */
   async getCurrentUser() {
-    return this.get("/api/cli/auth", { action: "me" });
-  }
-  /**
-   * Get tier info for the active organization
-   */
-  async getTierInfo(organizationId) {
-    return this.get("/api/cli/tier", { organizationId });
-  }
-  /**
-   * Get usage info for the active organization
-   */
-  async getUsage(organizationId) {
-    return this.get("/api/cli/usage", { organizationId });
+    const account = getActiveAccount();
+    if (!account) {
+      throw new APIError(
+        "You are not logged in. Run `envpilot login`.",
+        401,
+        "NOT_AUTHENTICATED"
+      );
+    }
+    await convexQuery(refs.listOrganizations, {});
+    return account.user;
   }
-  /**
-   * List organizations the user has access to
-   */
+  /** List organizations the user belongs to (with tier + role). */
   async listOrganizations() {
-    const response = await this.get(
-      "/api/cli/organizations"
-    );
-    return response.data || [];
+    const orgs = await convexQuery(refs.listOrganizations, {});
+    const orgIds = orgs.map((o) => o._id);
+    let tiers = [];
+    if (orgIds.length > 0) {
+      try {
+        tiers = await convexQuery(refs.getResolvedFeaturesBatch, {
+          organizationIds: orgIds
+        });
+      } catch {
+        tiers = [];
+      }
+    }
+    return orgs.map((org, index) => ({
+      _id: org._id,
+      name: org.name,
+      slug: org.slug,
+      tier: tiers[index]?.tierName ?? "free",
+      role: org.role,
+      unifiedRole: normalizeOrgRole(org.role),
+      description: org.description,
+      logoUrl: org.logoUrl
+    }));
   }
-  /**
-   * List projects in an organization
-   */
+  /** List projects in an organization, with unified-role + assignment info. */
   async listProjects(organizationId) {
-    const response = await this.get(
-      "/api/cli/projects",
-      { organizationId }
+    const [projects, membership] = await Promise.all([
+      convexQuery(refs.listProjectsWithStats, { organizationId }),
+      convexQuery(refs.getMembership, { organizationId })
+    ]);
+    const unifiedRole = normalizeOrgRole(membership?.role);
+    const isOwner = unifiedRole === "owner";
+    const isDeveloper = unifiedRole === "developer";
+    const legacyProjectRole = isOwner ? null : isDeveloper ? "developer" : "manager";
+    return Promise.all(
+      projects.map(async (project) => {
+        let assigned = isOwner;
+        let environmentScope = null;
+        if (!isOwner) {
+          const projectMembership = await convexQuery(
+            refs.getProjectMembership,
+            { projectId: project._id }
+          );
+          assigned = projectMembership !== null;
+          environmentScope = isDeveloper ? projectMembership?.environments ?? null : null;
+        }
+        return {
+          _id: project._id,
+          name: project.name,
+          slug: project.slug,
+          description: project.description,
+          icon: project.icon,
+          color: project.color,
+          organizationId: project.organizationId,
+          userRole: unifiedRole,
+          projectRole: legacyProjectRole,
+          unifiedRole,
+          assigned,
+          environmentScope
+        };
+      })
     );
-    return response.data || [];
   }
-  /**
-   * Get a project by ID
-   */
+  /** Get a single project (metadata) by id. */
   async getProject(projectId) {
-    return this.get(`/api/cli/projects/${projectId}`);
+    const project = await convexQuery(refs.getProject, { projectId });
+    if (!project) {
+      throw new APIError("Project not found", 404, "PROJECT_NOT_FOUND");
+    }
+    return {
+      _id: project._id,
+      name: project.name,
+      slug: project.slug,
+      organizationId: project.organizationId,
+      description: project.description,
+      icon: project.icon,
+      color: project.color
+    };
   }
   /**
-   * List variables in a project (with decrypted values).
-   *
-   * Returns both the variable list and any keys that failed vault decryption.
-   * Decryption failures are skipped server-side — they will NOT appear in
-   * `variables`. Callers should warn the user about `decryptionFailures`
-   * so they know those secrets weren't injected.
+   * Compute the variable fingerprint from Convex METADATA (no vault decryption).
+   * Byte-compatible with the fingerprint writeCache stores from a full fetch:
+   * both hash `${_id}:${version}:${updatedAt}` over the accessible variables in
+   * the requested environment.
    */
-  async listVariables(projectId, environment, organizationId) {
-    const params = { projectId };
-    if (environment) {
-      params.environment = environment;
+  async checkFingerprint(projectId, environment, _organizationId) {
+    const rows = await convexQuery(refs.listVariablesWithAccess, { projectId });
+    const filtered = rows.filter(
+      (row) => row.hasAccess && (!environment || row.environments.includes(environment))
+    );
+    const asVariables = filtered.map(
+      (row) => ({
+        _id: row._id,
+        version: row.version,
+        updatedAt: row.updatedAt
+      })
+    );
+    return computeFingerprint(asVariables);
+  }
+  /** List variable requests for a project (Convex). */
+  async listVariableRequests(projectId, status) {
+    return convexQuery(refs.listVariableRequests, { projectId, status });
+  }
+  /** Tier + usage snapshot for an organization (Convex). */
+  async getUsage(organizationId) {
+    const membership = await convexQuery(refs.getMembership, {
+      organizationId
+    });
+    if (!membership) {
+      throw new APIError(
+        "You are not a member of this organization",
+        403,
+        "FORBIDDEN"
+      );
     }
-    if (organizationId) {
-      params.organizationId = organizationId;
+    const [usageData, enforcementEnabled, resolved] = await Promise.all([
+      convexQuery(refs.getOrganizationUsage, { organizationId }),
+      convexQuery(refs.isEnforcementEnabled, {}),
+      convexQuery(refs.getResolvedFeatures, { organizationId })
+    ]);
+    if (!usageData) {
+      throw new APIError(
+        "Organization not found",
+        404,
+        "ORGANIZATION_NOT_FOUND"
+      );
     }
-    const response = await this.get("/api/cli/variables", params);
     return {
-      variables: response.data || [],
-      decryptionFailures: response.meta?.decryptionFailures ?? []
+      tier: resolved?.tierName ?? usageData.tier,
+      enforcementEnabled,
+      limits: {
+        projects: numericFeature(resolved, "max_projects"),
+        variablesPerProject: numericFeature(
+          resolved,
+          "max_variables_per_project"
+        ),
+        teamMembers: numericFeature(resolved, "max_team_members")
+      },
+      usage: usageData.usage,
+      features: {
+        versionHistory: booleanFeature(resolved, "variable_version_history"),
+        bulkImport: booleanFeature(resolved, "bulk_import"),
+        extensionAccess: booleanFeature(resolved, "extension_access", true),
+        granularPermissions: booleanFeature(resolved, "granular_permissions"),
+        auditLogRetentionDays: numericFeature(resolved, "audit_log_retention_days") ?? 7
+      }
     };
   }
+  // ============================================
+  // High-level methods — VAULT (over HTTP)
+  // ============================================
   /**
-   * Check the variable fingerprint for a project/environment.
-   *
-   * Returns a short hash of variable metadata (id + version + updatedAt)
-   * WITHOUT decrypting vault secrets. The CLI uses this to decide whether
-   * a cached variable set is still current before doing a full (expensive)
-   * fetch. If the fingerprint matches, the cache can be extended for free.
+   * List variables in a project WITH decrypted values (vault path).
+   * Returns the variable list, the response meta (unified role / scope info),
+   * and any keys that failed vault decryption (skipped server-side).
    */
-  async checkFingerprint(projectId, environment, organizationId) {
+  async listVariables(projectId, environment, organizationId) {
     const params = { projectId };
     if (environment) params.environment = environment;
     if (organizationId) params.organizationId = organizationId;
-    const response = await this.get(
-      "/api/cli/variables/fingerprint",
-      params
-    );
-    return response.fingerprint;
-  }
-  /**
-   * Get a variable by ID (with decrypted value)
-   */
-  async getVariable(variableId) {
-    return this.get(`/api/cli/variables/${variableId}`);
-  }
-  /**
-   * Create a new variable
-   */
-  async createVariable(data) {
-    return this.post("/api/cli/variables", data);
-  }
-  /**
-   * Update a variable
-   */
-  async updateVariable(variableId, data) {
-    return this.patch(`/api/cli/variables/${variableId}`, data);
-  }
-  /**
-   * Delete a variable
-   */
-  async deleteVariable(variableId) {
-    return this.delete(`/api/cli/variables/${variableId}`);
+    const response = await this.vaultRequest("GET", "/api/cli/variables", { params });
+    return {
+      variables: response.data || [],
+      meta: response.meta,
+      decryptionFailures: response.meta?.decryptionFailures ?? []
+    };
   }
-  /**
-   * Bulk create/update variables
-   */
+  /** Bulk create/update variables (vault path — encrypts values server-side). */
   async bulkUpsertVariables(data) {
-    return this.post("/api/cli/variables/bulk", data);
+    const response = await this.vaultRequest("POST", "/api/cli/variables/bulk", { body: data });
+    if (!response.data) {
+      throw new APIError("No result returned by server", 500);
+    }
+    return response.data;
   }
   /**
-   * Submit a variable request (developers only — owners/PMs/team leads
-   * create variables directly and get a 403 from the server here).
+   * Submit a variable request (developers only). Goes over the vault path
+   * because the requested value is encrypted into WorkOS Vault server-side;
+   * owners/PMs/team leads get a 403 here and create variables directly.
    */
   async createVariableRequest(data) {
-    const response = await this.post(
-      "/api/cli/variable-requests",
-      data
-    );
+    const response = await this.vaultRequest("POST", "/api/cli/variable-requests", { body: data });
     if (!response.data) {
       throw new APIError("No variable request returned by server", 500);
     }
     return response.data.request;
   }
-  /**
-   * List variable requests for a project, optionally filtered by status.
-   */
-  async listVariableRequests(projectId, status) {
-    const params = { projectId };
-    if (status) params.status = status;
-    const response = await this.get("/api/cli/variable-requests", params);
-    return response.data?.requests ?? [];
-  }
-  // ============================================
-  // Authentication methods
-  // ============================================
-  /**
-   * Initiate CLI authentication flow
-   */
-  async initiateAuth(deviceName) {
-    return this.post("/api/cli/auth?action=initiate", { deviceName });
-  }
-  /**
-   * Poll for authentication status
-   */
-  async pollAuth(code) {
-    return this.get("/api/cli/auth", { action: "poll", code });
-  }
-  /**
-   * Refresh access token
-   */
-  async refreshToken(refreshToken) {
-    return this.post("/api/cli/auth?action=refresh", { refreshToken });
-  }
-  /**
-   * Revoke access token (logout)
-   */
-  async revokeToken() {
-    return this.post("/api/cli/auth?action=revoke", {});
-  }
 };
 function createAPIClient() {
   return new APIClient();
 }
 
 // src/lib/auth-flow.ts
-var POLL_INTERVAL_MS = 2e3;
-var MAX_POLL_ATTEMPTS = 150;
 var MAX_CONSECUTIVE_ERRORS = 5;
 function sleep(ms) {
   return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function performLogin(options) {
-  const api = createAPIClient();
   const deviceName = `CLI - ${hostname()}`;
   info("Starting authentication flow...");
-  const spinner = createSpinner("Generating authentication code...");
+  const spinner = createSpinner("Requesting device code...");
   spinner.start();
-  let initResponse;
+  let device;
   try {
-    initResponse = await api.initiateAuth(deviceName);
+    device = await requestDeviceCode();
   } catch (error2) {
     spinner.stop();
     throw error2;
@@ -1251,60 +1462,77 @@ async function performLogin(options) {
   console.log();
   console.log(chalk3.bold("Your authentication code:"));
   console.log();
-  console.log(chalk3.cyan.bold(`    ${initResponse.code}`));
+  console.log(chalk3.cyan.bold(`    ${device.user_code}`));
   console.log();
-  console.log(`Open this URL to authenticate:`);
-  console.log(chalk3.dim(initResponse.url));
+  console.log("Open this URL to authenticate:");
+  console.log(chalk3.dim(device.verification_uri_complete));
   console.log();
   if (options?.browser !== false) {
     info("Opening browser...");
-    await open(initResponse.url);
+    try {
+      await open(device.verification_uri_complete);
+    } catch {
+    }
   }
   const pollSpinner = createSpinner("Waiting for authentication...");
   pollSpinner.start();
+  let intervalMs = device.interval * 1e3;
+  const deadline = Date.now() + device.expires_in * 1e3;
   let consecutiveErrors = 0;
   try {
-    for (let attempts = 0; attempts < MAX_POLL_ATTEMPTS; attempts++) {
-      await sleep(POLL_INTERVAL_MS);
-      let pollResponse;
-      try {
-        pollResponse = await api.pollAuth(initResponse.code);
-        consecutiveErrors = 0;
-      } catch {
-        consecutiveErrors++;
-        if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
-          throw new Error(
-            "Too many consecutive network errors while polling. Please check your connection and try again."
-          );
-        }
-        continue;
-      }
-      if (pollResponse.status === "authenticated") {
+    while (Date.now() < deadline) {
+      await sleep(intervalMs);
+      const result = await pollForToken(device.device_code);
+      if (result.status === "complete") {
         pollSpinner.stop();
-        if (!pollResponse.accessToken || !pollResponse.refreshToken) {
-          throw new Error(
-            "Authentication succeeded but the server did not return session tokens. This is likely a server-side issue. Please try again or contact support."
-          );
-        }
-        const accountId = pollResponse.user?.id ?? `session-${pollResponse.accessToken.slice(0, 8)}`;
+        const token = result.token;
+        const email = token.user?.email ?? "";
+        const userId = token.user?.id ?? `session-${token.access_token.slice(0, 8)}`;
+        const name = [token.user?.first_name, token.user?.last_name].filter(Boolean).join(" ") || void 0;
+        const sessionId = getJwtSessionId(token.access_token) ?? void 0;
         const account = {
-          id: accountId,
-          user: pollResponse.user ? {
-            id: pollResponse.user.id,
-            email: pollResponse.user.email,
-            name: pollResponse.user.name
-          } : { id: accountId, email: `${accountId}@cli.local` },
-          accessToken: pollResponse.accessToken,
-          refreshToken: pollResponse.refreshToken
+          id: userId,
+          user: {
+            id: userId,
+            email: email || `${userId}@cli.local`,
+            name
+          },
+          accessToken: token.access_token,
+          refreshToken: token.refresh_token,
+          sessionId,
+          deviceName
         };
         upsertAccount(account);
         setActiveAccount(account.id);
+        if (sessionId) {
+          await recordDeviceSession(deviceName, sessionId);
+        }
         console.log();
-        success(`Logged in as ${chalk3.bold(pollResponse.user?.email)}`);
-        return { email: pollResponse.user?.email || "" };
+        success(`Logged in as ${chalk3.bold(email || userId)}`);
+        return { email };
       }
-      if (pollResponse.status === "expired" || pollResponse.status === "not_found") {
-        throw new Error("Authentication code expired. Please try again.");
+      switch (result.status) {
+        case "pending":
+          consecutiveErrors = 0;
+          break;
+        case "slow_down":
+          consecutiveErrors = 0;
+          intervalMs += 5e3;
+          break;
+        case "network":
+          consecutiveErrors++;
+          if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
+            throw new Error(
+              "Too many consecutive network errors while polling. Please check your connection and try again."
+            );
+          }
+          break;
+        case "denied":
+          throw new Error("Authentication was denied. Please try again.");
+        case "expired":
+          throw new Error(
+            "Authentication code expired. Please run `envpilot login` again."
+          );
       }
     }
     throw new Error("Authentication timed out. Please try again.");
@@ -1360,152 +1588,161 @@ import { execSync } from "child_process";
 import { join as join2 } from "path";
 
 // src/types/index.ts
-import { z } from "zod";
-var userSchema = z.object({
-  id: z.string(),
-  email: z.string().email(),
-  name: z.string().optional()
+import { z as z2 } from "zod";
+var userSchema = z2.object({
+  id: z2.string(),
+  email: z2.string().email(),
+  name: z2.string().optional()
 });
-var accountSchema = z.object({
-  id: z.string(),
+var accountSchema = z2.object({
+  id: z2.string(),
   user: userSchema,
-  accessToken: z.string(),
-  refreshToken: z.string().optional(),
+  // WorkOS AuthKit tokens. accessToken is a short-lived (5 min) JWT refreshed
+  // on demand via the WorkOS refresh token. The JWT itself is never stored
+  // server-side — identity is proven per-request.
+  accessToken: z2.string(),
+  refreshToken: z2.string().optional(),
+  // WorkOS session id (`sid` claim), decoded from the access token at login.
+  // Recorded server-side (deviceSessions.record) so the session appears in the
+  // active-sessions UI and can be remotely revoked.
+  sessionId: z2.string().optional(),
+  // Human-friendly device label shown in the sessions UI (e.g. "CLI - host").
+  deviceName: z2.string().optional(),
   // Stored role string (legacy or unified); normalized on read.
-  role: z.string().optional(),
+  role: z2.string().optional(),
   // Per-account active org/project selection.
-  activeOrganizationId: z.string().optional(),
-  activeProjectId: z.string().optional()
+  activeOrganizationId: z2.string().optional(),
+  activeProjectId: z2.string().optional()
 });
-var organizationSchema = z.object({
-  _id: z.string(),
-  name: z.string(),
-  slug: z.string(),
-  tier: z.enum(["free", "pro"]),
-  role: z.string().optional(),
+var organizationSchema = z2.object({
+  _id: z2.string(),
+  name: z2.string(),
+  slug: z2.string(),
+  tier: z2.enum(["free", "pro"]),
+  role: z2.string().optional(),
   // Unified org role (additive; legacy responses omit it and fall back to role).
-  unifiedRole: z.string().nullable().optional()
+  unifiedRole: z2.string().nullable().optional()
 });
-var projectSchema = z.object({
-  _id: z.string(),
-  name: z.string(),
-  slug: z.string(),
-  organizationId: z.string(),
-  description: z.string().optional(),
-  icon: z.string().optional(),
-  color: z.string().optional(),
-  userRole: z.string().nullable().optional(),
-  projectRole: z.string().nullable().optional(),
+var projectSchema = z2.object({
+  _id: z2.string(),
+  name: z2.string(),
+  slug: z2.string(),
+  organizationId: z2.string(),
+  description: z2.string().optional(),
+  icon: z2.string().optional(),
+  color: z2.string().optional(),
+  userRole: z2.string().nullable().optional(),
+  projectRole: z2.string().nullable().optional(),
   // Unified-role fields (optional so legacy server responses still parse)
-  unifiedRole: z.string().nullable().optional(),
-  assigned: z.boolean().optional(),
-  environmentScope: z.array(z.string()).nullable().optional()
+  unifiedRole: z2.string().nullable().optional(),
+  assigned: z2.boolean().optional(),
+  environmentScope: z2.array(z2.string()).nullable().optional()
 });
-var variableTagSchema = z.object({
-  _id: z.string(),
-  name: z.string(),
-  color: z.string()
+var variableTagSchema = z2.object({
+  _id: z2.string(),
+  name: z2.string(),
+  color: z2.string()
 });
-var variableSchema = z.object({
-  _id: z.string(),
-  key: z.string(),
-  value: z.string(),
-  environment: z.enum(["development", "staging", "production"]),
-  projectId: z.string(),
-  description: z.string().optional(),
-  isSensitive: z.boolean().optional(),
-  version: z.number().optional(),
-  updatedAt: z.number().optional(),
-  createdAt: z.number().optional(),
-  tags: z.array(variableTagSchema).optional(),
+var variableSchema = z2.object({
+  _id: z2.string(),
+  key: z2.string(),
+  value: z2.string(),
+  environment: z2.enum(["development", "staging", "production"]),
+  projectId: z2.string(),
+  description: z2.string().optional(),
+  isSensitive: z2.boolean().optional(),
+  version: z2.number().optional(),
+  updatedAt: z2.number().optional(),
+  createdAt: z2.number().optional(),
+  tags: z2.array(variableTagSchema).optional(),
   // Per-variable effective access under the unified model. Optional so older
   // server responses (which omit it) still parse.
-  access: z.enum(["read", "write"]).optional()
+  access: z2.enum(["read", "write"]).optional()
 });
-var variablesMetaSchema = z.object({
-  total: z.number().optional(),
-  page: z.number().optional(),
-  limit: z.number().optional(),
-  decryptionFailures: z.array(z.string()).optional(),
-  unifiedRole: z.string().nullable().optional(),
-  assigned: z.boolean().optional(),
-  grantOnly: z.boolean().optional(),
-  environmentScope: z.array(z.string()).nullable().optional(),
-  hasWriteAccess: z.boolean().optional(),
-  scopeRestricted: z.boolean().optional()
+var variablesMetaSchema = z2.object({
+  total: z2.number().optional(),
+  page: z2.number().optional(),
+  limit: z2.number().optional(),
+  decryptionFailures: z2.array(z2.string()).optional(),
+  unifiedRole: z2.string().nullable().optional(),
+  assigned: z2.boolean().optional(),
+  grantOnly: z2.boolean().optional(),
+  environmentScope: z2.array(z2.string()).nullable().optional(),
+  hasWriteAccess: z2.boolean().optional(),
+  scopeRestricted: z2.boolean().optional()
 }).passthrough();
-var environmentSchema = z.enum([
+var environmentSchema = z2.enum([
   "development",
   "staging",
   "production"
 ]);
-var cliConfigSchema = z.object({
+var cliConfigSchema = z2.object({
   // Global CLI setting — shared across all accounts.
-  apiUrl: z.string().url(),
+  apiUrl: z2.string().url(),
   // Multi-account store. Keyed by account id (== user id).
-  accounts: z.record(z.string(), accountSchema).optional(),
+  accounts: z2.record(z2.string(), accountSchema).optional(),
   // The currently active account id.
-  activeAccountId: z.string().optional(),
+  activeAccountId: z2.string().optional(),
   // --- Legacy single-account fields ---
   // Retained ONLY so pre-multi-account configs still parse and can be migrated
   // into `accounts` by migrateLegacyConfig(). After migration these are deleted
   // so `accounts` is the single source of truth. Do not read/write directly.
-  accessToken: z.string().optional(),
-  refreshToken: z.string().optional(),
-  activeProjectId: z.string().optional(),
-  activeOrganizationId: z.string().optional(),
+  accessToken: z2.string().optional(),
+  refreshToken: z2.string().optional(),
+  activeProjectId: z2.string().optional(),
+  activeOrganizationId: z2.string().optional(),
   user: userSchema.optional(),
   // Stored role string. Kept as a free-form string so both legacy
   // ("admin"/"team_lead"/"member") and unified
   // ("owner"/"project_manager"/"team_lead"/"developer") values round-trip.
   // Normalized on read via getUnifiedRole(); no longer enum-enforced.
-  role: z.string().optional()
+  role: z2.string().optional()
 });
-var projectConfigSchema = z.object({
-  projectId: z.string(),
-  organizationId: z.string(),
+var projectConfigSchema = z2.object({
+  projectId: z2.string(),
+  organizationId: z2.string(),
   environment: environmentSchema.default("development")
 });
-var projectEntrySchema = z.object({
-  projectId: z.string(),
-  organizationId: z.string(),
-  projectName: z.string().default(""),
-  organizationName: z.string().default(""),
+var projectEntrySchema = z2.object({
+  projectId: z2.string(),
+  organizationId: z2.string(),
+  projectName: z2.string().default(""),
+  organizationName: z2.string().default(""),
   environment: environmentSchema.default("development"),
   // How the pulled .env file's permissions are managed for this project:
   //   auto   → derive from the caller's resolved access (default)
   //   always → force read-only (0o400)
   //   never  → force writable (0o600)
-  fileProtection: z.enum(["auto", "always", "never"]).optional()
+  fileProtection: z2.enum(["auto", "always", "never"]).optional()
 });
-var projectConfigV2Schema = z.object({
-  version: z.literal(1),
-  activeProjectId: z.string(),
-  projects: z.array(projectEntrySchema).min(1)
+var projectConfigV2Schema = z2.object({
+  version: z2.literal(1),
+  activeProjectId: z2.string(),
+  projects: z2.array(projectEntrySchema).min(1)
 });
-var variableRequestStatusSchema = z.enum([
+var variableRequestStatusSchema = z2.enum([
   "pending",
   "approved",
   "rejected",
   "canceled"
 ]);
-var variableRequestUserSchema = z.object({
-  _id: z.string(),
-  email: z.string().optional(),
-  name: z.string().optional()
+var variableRequestUserSchema = z2.object({
+  _id: z2.string(),
+  email: z2.string().optional(),
+  name: z2.string().optional()
 }).nullable().optional();
-var variableRequestSchema = z.object({
-  _id: z.string(),
-  key: z.string(),
-  description: z.string().optional(),
-  environments: z.array(z.string()),
-  projectId: z.string(),
-  organizationId: z.string().optional(),
-  isSensitive: z.boolean().optional(),
+var variableRequestSchema = z2.object({
+  _id: z2.string(),
+  key: z2.string(),
+  description: z2.string().optional(),
+  environments: z2.array(z2.string()),
+  projectId: z2.string(),
+  organizationId: z2.string().optional(),
+  isSensitive: z2.boolean().optional(),
   status: variableRequestStatusSchema,
-  reviewReason: z.string().optional(),
-  createdAt: z.number(),
-  updatedAt: z.number().optional(),
+  reviewReason: z2.string().optional(),
+  createdAt: z2.number(),
+  updatedAt: z2.number().optional(),
   requester: variableRequestUserSchema,
   reviewer: variableRequestUserSchema
 });
@@ -1914,8 +2151,7 @@ async function addProject(existingConfig, options) {
   let role = getUnifiedRole();
   if (roleLevel(role) < ROLE_LEVEL.team_lead) {
     const orgs = await withSpinner("Checking permissions...", async () => {
-      const response = await api.get("/api/cli/organizations");
-      return response.data || [];
+      return api.listOrganizations();
     });
     const freshOrg = orgs.find(
       (o) => o._id === existingConfig.projects[0]?.organizationId
@@ -1995,8 +2231,7 @@ async function selectOrgProjectEnv(options) {
   const organizations = await withSpinner(
     "Fetching organizations...",
     async () => {
-      const response = await api.get("/api/cli/organizations");
-      return response.data || [];
+      return api.listOrganizations();
     }
   );
   if (organizations.length === 0) {
@@ -2031,11 +2266,7 @@ async function selectOrgProjectEnv(options) {
     selectedOrg = organizations.find((o) => o._id === orgId);
   }
   const projects = await withSpinner("Fetching projects...", async () => {
-    const response = await api.get(
-      "/api/cli/projects",
-      { organizationId: selectedOrg._id }
-    );
-    return response.data || [];
+    return api.listProjects(selectedOrg._id);
   });
   if (projects.length === 0) {
     error("No projects found. Please create a project first.");
@@ -2622,15 +2853,13 @@ async function pullProject(project, outputPath, options) {
   const variables = await withSpinner(
     `Fetching ${chalk5.bold(project.environment)} variables...`,
     async () => {
-      const response = await api.get("/api/cli/variables", {
-        projectId: project.projectId,
-        environment: project.environment,
-        ...project.organizationId && {
-          organizationId: project.organizationId
-        }
-      });
+      const response = await api.listVariables(
+        project.projectId,
+        project.environment,
+        project.organizationId
+      );
       meta = response.meta;
-      return response.data || [];
+      return response.variables;
     }
   );
   if (meta?.scopeRestricted && meta.environmentScope?.length) {
@@ -2755,24 +2984,24 @@ import chalk6 from "chalk";
 import inquirer3 from "inquirer";
 
 // src/lib/validators.ts
-import { z as z2 } from "zod";
-var envKeySchema = z2.string().min(1, "Key cannot be empty").max(256, "Key cannot exceed 256 characters").regex(
+import { z as z3 } from "zod";
+var envKeySchema = z3.string().min(1, "Key cannot be empty").max(256, "Key cannot exceed 256 characters").regex(
   /^[A-Za-z_][A-Za-z0-9_]*$/,
   "Key must start with a letter or underscore, followed by letters, numbers, or underscores"
 );
-var envValueSchema = z2.string().max(65536, "Value cannot exceed 64KB");
-var environmentSchema2 = z2.enum([
+var envValueSchema = z3.string().max(65536, "Value cannot exceed 64KB");
+var environmentSchema2 = z3.enum([
   "development",
   "staging",
   "production"
 ]);
-var projectSlugSchema = z2.string().min(1, "Slug cannot be empty").max(128, "Slug cannot exceed 128 characters").regex(
+var projectSlugSchema = z3.string().min(1, "Slug cannot be empty").max(128, "Slug cannot exceed 128 characters").regex(
   /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/,
   "Slug must be lowercase alphanumeric with hyphens, cannot start or end with hyphen"
 );
-var urlSchema = z2.string().url("Must be a valid URL");
-var tokenSchema = z2.string().min(1, "Token cannot be empty").regex(/^env_[A-Za-z0-9]{48}$/, "Invalid token format");
-var filePathSchema = z2.string().min(1, "File path cannot be empty");
+var urlSchema = z3.string().url("Must be a valid URL");
+var tokenSchema2 = z3.string().min(1, "Token cannot be empty").regex(/^env_[A-Za-z0-9]{48}$/, "Invalid token format");
+var filePathSchema = z3.string().min(1, "File path cannot be empty");
 function validateEnvVars(vars) {
   const valid = {};
   const invalid = [];
@@ -2897,16 +3126,13 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
     const remoteVariables = await withSpinner(
       "Fetching current variables...",
       async () => {
-        const params = {
+        const response = await api.listVariables(
           projectId,
-          environment
-        };
-        if (organizationId) {
-          params.organizationId = organizationId;
-        }
-        const response = await api.get("/api/cli/variables", params);
+          environment,
+          organizationId
+        );
         meta = response.meta;
-        return response.data || [];
+        return response.variables;
       }
     );
     const scope = meta?.environmentScope;
@@ -2977,7 +3203,7 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
     const result = await withSpinner(
       `Pushing variables to ${chalk6.bold(environment)}...`,
       async () => {
-        const response = await api.post("/api/cli/variables/bulk", {
+        return api.bulkUpsertVariables({
           projectId,
           environment,
           variables: Object.entries(valid).map(([key, value]) => ({
@@ -2987,7 +3213,6 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
           mode,
           ...organizationId && { organizationId }
         });
-        return response.data;
       }
     );
     success(
@@ -3080,8 +3305,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
       const organizations = await withSpinner(
         "Fetching organizations...",
         async () => {
-          const response = await api.get("/api/cli/organizations");
-          return response.data || [];
+          return api.listOrganizations();
         }
       );
       const org = organizations.find(
@@ -3129,8 +3353,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
         const organizations = await withSpinner(
           "Fetching organizations...",
           async () => {
-            const response = await api.get("/api/cli/organizations");
-            return response.data || [];
+            return api.listOrganizations();
           }
         );
         if (organizations.length === 0) {
@@ -3160,8 +3383,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
         }
       }
       const projects = await withSpinner("Fetching projects...", async () => {
-        const response = await api.get("/api/cli/projects", { organizationId });
-        return response.data || [];
+        return api.listProjects(organizationId);
       });
       const project = projects.find(
         (p) => p._id === projectIdentifier || p.slug === projectIdentifier
@@ -3271,8 +3493,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
         const organizations = await withSpinner(
           "Fetching organizations...",
           async () => {
-            const response = await api.get("/api/cli/organizations");
-            return response.data || [];
+            return api.listOrganizations();
           }
         );
         if (organizations.length === 0) {
@@ -3309,8 +3530,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
         const projects = await withSpinner(
           "Fetching projects...",
           async () => {
-            const response = await api.get("/api/cli/projects", { organizationId: orgId });
-            return response.data || [];
+            return api.listProjects(orgId);
           }
         );
         if (projects.length === 0) {
@@ -3433,8 +3653,7 @@ async function listOrganizations(api, options) {
   const organizations = await withSpinner(
     "Fetching organizations...",
     async () => {
-      const response = await api.get("/api/cli/organizations");
-      return response.data || [];
+      return api.listOrganizations();
     }
   );
   if (organizations.length === 0) {
@@ -3468,8 +3687,7 @@ async function listProjects(api, projectConfig, options) {
     const organizations = await withSpinner(
       "Fetching organizations...",
       async () => {
-        const response = await api.get("/api/cli/organizations");
-        return response.data || [];
+        return api.listOrganizations();
       }
     );
     if (organizations.length === 0) {
@@ -3488,11 +3706,7 @@ async function listProjects(api, projectConfig, options) {
     }
   }
   const projects = await withSpinner("Fetching projects...", async () => {
-    const response = await api.get(
-      "/api/cli/projects",
-      { organizationId }
-    );
-    return response.data || [];
+    return api.listProjects(organizationId);
   });
   if (projects.length === 0) {
     info("No projects found.");
@@ -3536,13 +3750,9 @@ async function listVariables(api, projectConfig, options) {
   }
   let meta;
   const variables = await withSpinner("Fetching variables...", async () => {
-    const params = { projectId };
-    if (environment) {
-      params.environment = environment;
-    }
-    const response = await api.get("/api/cli/variables", params);
+    const response = await api.listVariables(projectId, environment);
     meta = response.meta;
-    return response.data || [];
+    return response.variables;
   });
   const tagFilter = options.tag?.toLowerCase();
   const filtered = tagFilter ? variables.filter(
@@ -3837,10 +4047,9 @@ var logoutCommand = new Command8("logout").description("Log out from Envpilot").
     if (options.all) {
       const accounts = listAccounts();
       for (const account of accounts) {
-        try {
-          const api2 = new APIClient({ accessToken: account.accessToken });
-          await api2.post("/api/cli/auth?action=revoke", {});
-        } catch {
+        if (account.sessionId) {
+          setActiveAccount(account.id);
+          await revokeDeviceSession(account.sessionId);
         }
         removeAccount(account.id);
       }
@@ -3849,10 +4058,8 @@ var logoutCommand = new Command8("logout").description("Log out from Envpilot").
       return;
     }
     const activeAccount = getActiveAccount();
-    const api = createAPIClient();
-    try {
-      await api.post("/api/cli/auth?action=revoke", {});
-    } catch {
+    if (activeAccount?.sessionId) {
+      await revokeDeviceSession(activeAccount.sessionId);
     }
     const { newActiveId } = clearAuth();
     success(
@@ -4223,13 +4430,13 @@ var syncCommand = new Command10("sync").description(
       `Fetching ${chalk11.bold(environment)} variables...`,
       async () => {
         const api = createAPIClient();
-        const response = await api.get("/api/cli/variables", {
+        const response = await api.listVariables(
           projectId,
           environment,
-          ...organizationId && { organizationId }
-        });
+          organizationId
+        );
         meta = response.meta;
-        return response.data || [];
+        return response.variables;
       }
     );
     const outputPath = getEnvPathForEnvironment(environment);
@@ -4333,8 +4540,7 @@ var usageCommand = new Command11("usage").description("Show plan usage and limit
       const orgs = await withSpinner(
         "Fetching organizations...",
         async () => {
-          const response = await api.get("/api/cli/organizations");
-          return response.data || [];
+          return api.listOrganizations();
         }
       );
       if (orgs.length === 0) {
@@ -4454,7 +4660,7 @@ var whoamiCommand = new Command12("whoami").description("Show the current authen
       );
     }
     blank();
-    console.log(chalk13.dim("Token verified against the CLI auth endpoint."));
+    console.log(chalk13.dim("Session verified against Convex."));
   } catch (err) {
     await handleError(err);
   }
@@ -4953,18 +5159,18 @@ import chalk17 from "chalk";
 import inquirer6 from "inquirer";
 
 // src/lib/variable-requests.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var ALL_REQUEST_ENVIRONMENTS = [
   "development",
   "staging",
   "production"
 ];
-var requestKeySchema = z3.string().min(1, "Key is required").max(100, "Key must be 100 characters or less").regex(
+var requestKeySchema = z4.string().min(1, "Key is required").max(100, "Key must be 100 characters or less").regex(
   /^[A-Z][A-Z0-9_]*$/,
   "Key must be uppercase, start with a letter, and contain only letters, numbers, and underscores"
 );
-var requestValueSchema = z3.string().min(1, "Value is required");
-var requestDescriptionSchema = z3.string().max(500, "Description must be 500 characters or less");
+var requestValueSchema = z4.string().min(1, "Value is required");
+var requestDescriptionSchema = z4.string().max(500, "Description must be 500 characters or less");
 function validateRequestKey(key) {
   const result = requestKeySchema.safeParse(key);
   if (result.success) return { valid: true };
@@ -5289,10 +5495,11 @@ async function resolveEntryNames(api, entry) {
   };
 }
 async function fetchProjectMeta(api, entry) {
-  const response = await api.get("/api/cli/variables", {
-    projectId: entry.projectId,
-    ...entry.organizationId && { organizationId: entry.organizationId }
-  });
+  const response = await api.listVariables(
+    entry.projectId,
+    void 0,
+    entry.organizationId
+  );
   return response.meta;
 }
 async function pickRequestTarget(api) {