@envpilot/cli 1.13.1 → 1.15.0

package/dist/{app-Q4OBTYMS.js → app-R4GNEYHB.js}

@@ -4,7 +4,7 @@ import {
   getTopLevelCommandCatalog,
   getUser,
   isAuthenticated
-} from "./chunk-XDPWQLB5.js";
+} from "./chunk-VYHEVPJQ.js";
 
 // src/ui/app.tsx
 import {

package/dist/{chunk-XDPWQLB5.js → chunk-VYHEVPJQ.js}

@@ -7,7 +7,7 @@ function initSentry() {
   Sentry.init({
     dsn,
     environment: "cli",
-    release: true ? "1.13.1" : "0.0.0",
+    release: true ? "1.15.0" : "0.0.0",
     // All EnvPilot surfaces report to one Sentry project; the surface tag
     // is how dashboards tell web / cli / extension events apart.
     initialScope: { tags: { surface: "cli" } },
@@ -463,7 +463,7 @@ import { jsx } from "react/jsx-runtime";
 async function openTUI() {
   const [{ render }, { CLIApp }, { PressAnyKey }] = await Promise.all([
     import("ink"),
-    import("./app-Q4OBTYMS.js"),
+    import("./app-R4GNEYHB.js"),
     import("./press-any-key-64XFP4O2.js")
   ]);
   while (true) {
@@ -1040,7 +1040,10 @@ var refs = {
   deviceSessionRecord: fnRef("deviceSessions:record"),
   deviceSessionRevoke: fnRef(
     "deviceSessions:revoke"
-  )
+  ),
+  pullValues: fnRef("variableValues:pullValues"),
+  pushBulk: fnRef("variableValues:pushBulk"),
+  createVariableRequest: fnRef("variableRequests:createWithValue")
 };
 async function convexQuery(ref, ...args) {
   const client = await getConvexClient();
@@ -1050,6 +1053,10 @@ async function convexMutation(ref, ...args) {
   const client = await getConvexClient();
   return client.mutation(ref, ...args);
 }
+async function convexAction(ref, ...args) {
+  const client = await getConvexClient();
+  return client.action(ref, ...args);
+}
 async function recordDeviceSession(deviceName, sessionId) {
   try {
     await convexMutation(refs.deviceSessionRecord, {
@@ -1074,161 +1081,7 @@ function booleanFeature(resolved, key, fallback = false) {
   const value = resolved?.features?.[key]?.value;
   return typeof value === "boolean" ? value : fallback;
 }
-function registrableDomain(hostname2) {
-  const parts = hostname2.toLowerCase().split(".").filter(Boolean);
-  if (parts.length <= 2) return parts.join(".");
-  return parts.slice(-2).join(".");
-}
-var MAX_MANUAL_REDIRECTS = 5;
 var APIClient = class {
-  baseUrl;
-  constructor(options) {
-    this.baseUrl = options?.baseUrl ?? getApiUrl();
-  }
-  // ── Vault HTTP path (decrypted secret values) ──────────────────────────
-  /**
-   * Follow 3xx redirects manually, re-attaching Authorization only within the
-   * same registrable domain (defends against the apex→www redirect that would
-   * otherwise drop the header and yield a bogus 401).
-   */
-  async fetchWithSafeRedirects(initialUrl, init2) {
-    let currentUrl = initialUrl;
-    let currentInit = { ...init2, redirect: "manual" };
-    for (let hop = 0; hop < MAX_MANUAL_REDIRECTS; hop++) {
-      const response = await fetch(currentUrl, currentInit);
-      if (response.status < 300 || response.status >= 400) {
-        return response;
-      }
-      const location = response.headers.get("location");
-      if (!location) return response;
-      const nextUrl = new URL(location, currentUrl);
-      const prevHost = new URL(currentUrl).hostname;
-      const sameSite = registrableDomain(nextUrl.hostname) === registrableDomain(prevHost);
-      const headers = new Headers(currentInit.headers);
-      if (!sameSite) headers.delete("Authorization");
-      let nextMethod = (currentInit.method || "GET").toUpperCase();
-      let nextBody = currentInit.body;
-      if (response.status === 301 || response.status === 302 || response.status === 303) {
-        if (nextMethod !== "GET" && nextMethod !== "HEAD") {
-          nextMethod = "GET";
-          nextBody = void 0;
-          headers.delete("Content-Type");
-        }
-      }
-      currentUrl = nextUrl.toString();
-      currentInit = {
-        ...currentInit,
-        method: nextMethod,
-        headers,
-        body: nextBody,
-        redirect: "manual"
-      };
-    }
-    throw new APIError(
-      `Too many redirects while calling ${initialUrl}`,
-      0,
-      "TOO_MANY_REDIRECTS"
-    );
-  }
-  /** Perform an authed vault request carrying a fresh WorkOS JWT bearer. */
-  async vaultRequest(method, path, options) {
-    const token = await ensureFreshAccessToken();
-    const url = new URL(path, this.baseUrl);
-    if (options?.params) {
-      for (const [key, value] of Object.entries(options.params)) {
-        url.searchParams.set(key, value);
-      }
-    }
-    const response = await this.fetchWithSafeRedirects(url.toString(), {
-      method,
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${token}`
-      },
-      body: options?.body ? JSON.stringify(options.body) : void 0
-    });
-    return this.handleResponse(response);
-  }
-  isAuthRedirect(response, bodyText) {
-    const location = response.headers.get("location") || "";
-    const finalUrl = response.url || "";
-    const contentType = response.headers.get("content-type") || "";
-    const preview = (bodyText || "").slice(0, 512).toLowerCase();
-    return location.includes("authkit") || finalUrl.includes("authkit") || contentType.includes("text/html") && (preview.includes("authorization_session_id") || preview.includes("client_id=") || preview.includes("<!doctype html"));
-  }
-  async handleResponse(response) {
-    if (!response.ok) {
-      await this.handleError(response);
-    }
-    const contentType = response.headers.get("content-type") || "";
-    const body = await response.text();
-    if (!contentType.includes("application/json")) {
-      if (this.isAuthRedirect(response, body)) {
-        throw new APIError(
-          "Your CLI session is not authorized for this endpoint. Please run `envpilot login` and try again.",
-          401,
-          "AUTH_REDIRECT"
-        );
-      }
-      const preview = body.replace(/\s+/g, " ").slice(0, 160);
-      throw new APIError(
-        `Expected JSON but got ${contentType || "unknown content type"} from ${response.url}. Response starts with: ${preview}`,
-        response.status || 500
-      );
-    }
-    try {
-      return JSON.parse(body);
-    } catch {
-      const preview = body.replace(/\s+/g, " ").slice(0, 160);
-      throw new APIError(
-        `Failed to parse JSON response from ${response.url}. Response starts with: ${preview}`,
-        response.status || 500
-      );
-    }
-  }
-  async handleError(response) {
-    const bodyText = await response.text();
-    let message = `Request failed with status ${response.status}`;
-    let code;
-    try {
-      const data = JSON.parse(bodyText);
-      message = data.error || data.message || message;
-      code = data.code;
-    } catch {
-    }
-    if (response.status === 401) {
-      if (this.isAuthRedirect(response, bodyText)) {
-        throw new APIError(
-          "Your CLI session is not authorized for this endpoint. Please run `envpilot login` and try again.",
-          401,
-          "AUTH_REDIRECT"
-        );
-      }
-      throw new APIError(
-        message || "Authentication failed. Please run `envpilot login`.",
-        401,
-        code || "UNAUTHORIZED"
-      );
-    }
-    if (response.status === 403 && code === "TIER_LIMIT_REACHED") {
-      throw new APIError(
-        message || "Tier limit reached. Run `envpilot usage` to see your plan limits.",
-        403,
-        "TIER_LIMIT_REACHED"
-      );
-    }
-    if (response.status === 403) {
-      throw new APIError(message || "Access denied.", 403, code || "FORBIDDEN");
-    }
-    if (response.status === 402) {
-      throw new APIError(
-        message || "Tier limit reached. Run `envpilot usage` to see your plan limits.",
-        402,
-        "PAYMENT_REQUIRED"
-      );
-    }
-    throw new APIError(message, response.status, code);
-  }
   // ============================================
   // High-level methods — DIRECT to Convex
   // ============================================
@@ -1405,24 +1258,53 @@ var APIClient = class {
    * Returns the variable list, the response meta (unified role / scope info),
    * and any keys that failed vault decryption (skipped server-side).
    */
-  async listVariables(projectId, environment, organizationId) {
-    const params = { projectId };
-    if (environment) params.environment = environment;
-    if (organizationId) params.organizationId = organizationId;
-    const response = await this.vaultRequest("GET", "/api/cli/variables", { params });
+  async listVariables(projectId, environment, _organizationId) {
+    const result = await convexAction(refs.pullValues, {
+      projectId,
+      ...environment ? { environment } : {}
+    });
+    const variables = result.variables.filter((row) => row.value !== "[DECRYPTION_FAILED]").map((row) => ({
+      _id: row._id,
+      key: row.key,
+      value: row.value,
+      // The CLI Variable type expects a single environment string. Echo the
+      // requested one, else the first the variable belongs to.
+      environment: environment ?? row.environments[0] ?? "development",
+      projectId: row.projectId,
+      description: row.description,
+      isSensitive: row.isSensitive,
+      version: row.version,
+      createdAt: row.createdAt,
+      updatedAt: row.updatedAt,
+      access: row.access
+    }));
+    const meta = {
+      total: variables.length,
+      environment: environment ?? "all",
+      role: result.meta.role,
+      projectRole: result.meta.projectRole,
+      unifiedRole: result.meta.unifiedRole,
+      assigned: result.meta.assigned,
+      grantOnly: result.meta.grantOnly,
+      environmentScope: result.meta.environmentScope,
+      hasWriteAccess: result.meta.hasWriteAccess,
+      scopeRestricted: result.meta.scopeRestricted,
+      decryptionFailures: result.meta.decryptionFailures
+    };
     return {
-      variables: response.data || [],
-      meta: response.meta,
-      decryptionFailures: response.meta?.decryptionFailures ?? []
+      variables,
+      meta,
+      decryptionFailures: result.meta.decryptionFailures ?? []
     };
   }
   /** Bulk create/update variables (vault path — encrypts values server-side). */
   async bulkUpsertVariables(data) {
-    const response = await this.vaultRequest("POST", "/api/cli/variables/bulk", { body: data });
-    if (!response.data) {
-      throw new APIError("No result returned by server", 500);
-    }
-    return response.data;
+    return convexAction(refs.pushBulk, {
+      projectId: data.projectId,
+      environment: data.environment,
+      variables: data.variables,
+      mode: data.mode
+    });
   }
   /**
    * Submit a variable request (developers only). Goes over the vault path
@@ -1430,11 +1312,18 @@ var APIClient = class {
    * owners/PMs/team leads get a 403 here and create variables directly.
    */
   async createVariableRequest(data) {
-    const response = await this.vaultRequest("POST", "/api/cli/variable-requests", { body: data });
-    if (!response.data) {
+    const created = await convexAction(refs.createVariableRequest, {
+      projectId: data.projectId,
+      key: data.key,
+      value: data.value,
+      environments: data.environments,
+      isSensitive: data.isSensitive,
+      description: data.description
+    });
+    if (!created) {
       throw new APIError("No variable request returned by server", 500);
     }
-    return response.data.request;
+    return created;
   }
 };
 function createAPIClient() {

package/dist/index.js

@@ -6,13 +6,13 @@ import {
   getTopLevelCommandCatalog,
   initSentry,
   openTUI
-} from "./chunk-XDPWQLB5.js";
+} from "./chunk-VYHEVPJQ.js";
 
 // src/lib/program.ts
 import { Command } from "commander";
 
 // src/lib/cli-version.ts
-var CLI_VERSION = true ? "1.13.1" : "0.0.0";
+var CLI_VERSION = true ? "1.15.0" : "0.0.0";
 
 // src/lib/version-check.ts
 import chalk from "chalk";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envpilot/cli",
-  "version": "1.13.1",
+  "version": "1.15.0",
   "description": "Envpilot CLI — sync and manage environment variables from the terminal",
   "type": "module",
   "bin": {