@envpilot/cli 1.4.0 → 1.5.0

package/dist/chunk-CIIQSYAS.js

@@ -0,0 +1,4164 @@
+// src/lib/sentry.ts
+import * as Sentry from "@sentry/node";
+var initialized = false;
+function initSentry() {
+  const dsn = true ? "" : "";
+  if (initialized || !dsn) return;
+  Sentry.init({
+    dsn,
+    environment: "cli",
+    release: true ? "1.5.0" : "0.0.0",
+    // Free tier: disable performance monitoring
+    tracesSampleRate: 0,
+    beforeSend(event) {
+      if (event.exception?.values) {
+        for (const exc of event.exception.values) {
+          if (exc.stacktrace?.frames) {
+            for (const frame of exc.stacktrace.frames) {
+              if (frame.filename) {
+                frame.filename = frame.filename.replace(
+                  /\/Users\/[^/]+/g,
+                  "/~"
+                );
+                frame.filename = frame.filename.replace(
+                  /C:\\Users\\[^\\]+/g,
+                  "C:\\~"
+                );
+              }
+            }
+          }
+        }
+      }
+      if (event.request?.data) {
+        event.request.data = "[REDACTED]";
+      }
+      return event;
+    }
+  });
+  initialized = true;
+}
+function captureError(error2, context) {
+  if (!initialized) return;
+  Sentry.captureException(error2, { tags: context });
+}
+async function flushSentry() {
+  if (!initialized) return;
+  await Sentry.flush(2e3);
+}
+
+// src/lib/config.ts
+import Conf from "conf";
+var DEFAULT_API_URL = "https://www.envpilot.dev";
+var config = new Conf({
+  projectName: "envpilot",
+  defaults: {
+    apiUrl: DEFAULT_API_URL
+  }
+});
+function getConfig() {
+  return {
+    apiUrl: config.get("apiUrl") ?? DEFAULT_API_URL,
+    accessToken: config.get("accessToken"),
+    refreshToken: config.get("refreshToken"),
+    activeProjectId: config.get("activeProjectId"),
+    activeOrganizationId: config.get("activeOrganizationId"),
+    user: config.get("user"),
+    role: config.get("role")
+  };
+}
+function getApiUrl() {
+  return config.get("apiUrl") ?? DEFAULT_API_URL;
+}
+function setApiUrl(url) {
+  config.set("apiUrl", url);
+}
+function getAccessToken() {
+  return config.get("accessToken");
+}
+function setAccessToken(token) {
+  config.set("accessToken", token);
+}
+function setRefreshToken(token) {
+  config.set("refreshToken", token);
+}
+function getActiveProjectId() {
+  return config.get("activeProjectId");
+}
+function setActiveProjectId(projectId) {
+  config.set("activeProjectId", projectId);
+}
+function getActiveOrganizationId() {
+  return config.get("activeOrganizationId");
+}
+function setActiveOrganizationId(organizationId) {
+  config.set("activeOrganizationId", organizationId);
+}
+function getUser() {
+  return config.get("user");
+}
+function setUser(user) {
+  config.set("user", user);
+}
+function getRole() {
+  return config.get("role");
+}
+function setRole(role) {
+  config.set("role", role);
+}
+function isAuthenticated() {
+  return !!config.get("accessToken");
+}
+function clearAuth() {
+  config.delete("accessToken");
+  config.delete("refreshToken");
+  config.delete("user");
+  config.delete("role");
+}
+function clearConfig() {
+  config.clear();
+}
+function getConfigPath() {
+  return config.path;
+}
+
+// src/ui/render-tui.tsx
+import chalk from "chalk";
+
+// src/ui/execute-command.ts
+import { spawn } from "child_process";
+import { dirname, resolve } from "path";
+import { fileURLToPath } from "url";
+async function executeCommand(argv) {
+  const scriptPath = resolve(
+    dirname(fileURLToPath(import.meta.url)),
+    "index.js"
+  );
+  if (process.stdin.isTTY && process.stdin.isRaw) {
+    process.stdin.setRawMode(false);
+  }
+  process.stdin.pause();
+  return new Promise((resolve3, reject) => {
+    const child = spawn(process.execPath, [scriptPath, ...argv], {
+      stdio: "inherit",
+      env: {
+        ...process.env,
+        ENVPILOT_TUI_CHILD: "1"
+      }
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => {
+      resolve3(code ?? 0);
+    });
+  });
+}
+
+// src/ui/render-tui.tsx
+import { jsx } from "react/jsx-runtime";
+async function openTUI() {
+  const [{ render }, { CLIApp }] = await Promise.all([
+    import("ink"),
+    import("./app-KHDRTCOB.js")
+  ]);
+  while (true) {
+    let selectedArgv = null;
+    const app = render(
+      /* @__PURE__ */ jsx(
+        CLIApp,
+        {
+          onSelectCommand: (argv) => {
+            selectedArgv = argv;
+          }
+        }
+      )
+    );
+    await app.waitUntilExit();
+    if (!selectedArgv) {
+      break;
+    }
+    const code = await executeCommand(selectedArgv);
+    if (code !== 0) {
+      process.exitCode = code;
+    }
+    console.log();
+    console.log(
+      chalk.dim("  Press any key to return to the TUI\u2026  (q to quit)")
+    );
+    const quit = await new Promise((resolve3) => {
+      if (process.stdin.isTTY) {
+        process.stdin.setRawMode(true);
+      }
+      process.stdin.resume();
+      process.stdin.once("data", (data) => {
+        const ch = data.toString();
+        if (process.stdin.isTTY) {
+          process.stdin.setRawMode(false);
+        }
+        process.stdin.pause();
+        resolve3(ch === "q" || ch === "Q");
+      });
+    });
+    if (quit) {
+      break;
+    }
+  }
+}
+
+// src/commands/login.ts
+import { Command } from "commander";
+
+// src/lib/ui.ts
+import chalk2 from "chalk";
+import ora from "ora";
+function createSpinner(text) {
+  return ora({
+    text,
+    color: "cyan"
+  });
+}
+async function withSpinner(text, operation, options) {
+  const spinner = createSpinner(text);
+  spinner.start();
+  try {
+    const result = await operation();
+    spinner.succeed(options?.successText ?? text);
+    return result;
+  } catch (error2) {
+    spinner.fail(options?.failText ?? text);
+    throw error2;
+  }
+}
+function success(message) {
+  console.log(chalk2.green("\u2713"), message);
+}
+function info(message) {
+  console.log(chalk2.blue("\u2139"), message);
+}
+function warning(message) {
+  console.log(chalk2.yellow("\u26A0"), message);
+}
+function error(message) {
+  console.log(chalk2.red("\u2717"), message);
+}
+function header(text) {
+  console.log();
+  console.log(chalk2.bold(text));
+  console.log(chalk2.dim("\u2500".repeat(text.length)));
+}
+function table(data, columns) {
+  if (data.length === 0) {
+    console.log(chalk2.dim("No data to display"));
+    return;
+  }
+  const widths = columns.map((col) => {
+    const headerWidth = col.header.length;
+    const maxDataWidth = Math.max(
+      ...data.map((row) => String(row[col.key] ?? "").length)
+    );
+    return col.width ?? Math.max(headerWidth, maxDataWidth);
+  });
+  const headerLine = columns.map((col, i) => col.header.padEnd(widths[i])).join("  ");
+  console.log(chalk2.bold(headerLine));
+  console.log(chalk2.dim("\u2500".repeat(headerLine.length)));
+  for (const row of data) {
+    const line2 = columns.map((col, i) => String(row[col.key] ?? "").padEnd(widths[i])).join("  ");
+    console.log(line2);
+  }
+}
+function keyValue(pairs) {
+  const maxKeyLength = Math.max(...pairs.map(([key]) => key.length));
+  for (const [key, value] of pairs) {
+    const paddedKey = key.padEnd(maxKeyLength);
+    console.log(`${chalk2.dim(paddedKey)}  ${value ?? chalk2.dim("(not set)")}`);
+  }
+}
+function diff(added, removed, changed) {
+  if (Object.keys(added).length === 0 && Object.keys(removed).length === 0 && Object.keys(changed).length === 0) {
+    console.log(chalk2.dim("No changes"));
+    return;
+  }
+  for (const [key, value] of Object.entries(added)) {
+    console.log(chalk2.green(`+ ${key}=${maskValue(value)}`));
+  }
+  for (const [key, value] of Object.entries(removed)) {
+    console.log(chalk2.red(`- ${key}=${maskValue(value)}`));
+  }
+  for (const [key, { local, remote }] of Object.entries(changed)) {
+    console.log(chalk2.red(`- ${key}=${maskValue(remote)}`));
+    console.log(chalk2.green(`+ ${key}=${maskValue(local)}`));
+  }
+}
+function maskValue(value, showChars = 4) {
+  if (value.length <= showChars * 2) {
+    return "*".repeat(value.length);
+  }
+  return value.slice(0, showChars) + "****" + value.slice(-showChars);
+}
+function line() {
+  console.log(chalk2.dim("\u2500".repeat(50)));
+}
+function blank() {
+  console.log();
+}
+function formatRole(role) {
+  switch (role) {
+    case "admin":
+      return chalk2.green("Admin");
+    case "team_lead":
+      return chalk2.blue("Team Lead");
+    case "member":
+      return chalk2.yellow("Member");
+    default:
+      return chalk2.dim("Unknown");
+  }
+}
+function roleNotice(role) {
+  if (role === "member") {
+    console.log(
+      chalk2.yellow(
+        "  You have Member access. Write operations will create pending requests for approval."
+      )
+    );
+  }
+}
+function formatProjectRole(role) {
+  switch (role) {
+    case "manager":
+      return chalk2.green("Manager");
+    case "developer":
+      return chalk2.blue("Developer");
+    case "viewer":
+      return chalk2.yellow("Viewer");
+    default:
+      return chalk2.dim("-");
+  }
+}
+function projectRoleNotice(projectRole) {
+  if (projectRole === "viewer") {
+    console.log(
+      chalk2.yellow(
+        "  You have Viewer access to this project. You can only view variables you have been explicitly granted access to."
+      )
+    );
+  }
+}
+
+// src/lib/errors.ts
+import chalk3 from "chalk";
+var CLIError = class extends Error {
+  constructor(message, code, suggestion) {
+    super(message);
+    this.code = code;
+    this.suggestion = suggestion;
+    this.name = "CLIError";
+  }
+};
+var ErrorCodes = {
+  NOT_AUTHENTICATED: "NOT_AUTHENTICATED",
+  NOT_INITIALIZED: "NOT_INITIALIZED",
+  PROJECT_NOT_FOUND: "PROJECT_NOT_FOUND",
+  ORGANIZATION_NOT_FOUND: "ORGANIZATION_NOT_FOUND",
+  VARIABLE_NOT_FOUND: "VARIABLE_NOT_FOUND",
+  INVALID_CONFIG: "INVALID_CONFIG",
+  NETWORK_ERROR: "NETWORK_ERROR",
+  PERMISSION_DENIED: "PERMISSION_DENIED",
+  TIER_LIMIT_EXCEEDED: "TIER_LIMIT_EXCEEDED",
+  FILE_NOT_FOUND: "FILE_NOT_FOUND",
+  INVALID_INPUT: "INVALID_INPUT",
+  UNKNOWN_ERROR: "UNKNOWN_ERROR"
+};
+function formatError(error2) {
+  if (error2 instanceof CLIError) {
+    let message = chalk3.red(`Error: ${error2.message}`);
+    if (error2.suggestion) {
+      message += `
+${chalk3.yellow("Suggestion:")} ${error2.suggestion}`;
+    }
+    return message;
+  }
+  if (error2 instanceof Error) {
+    return chalk3.red(`Error: ${error2.message}`);
+  }
+  return chalk3.red(`Error: ${String(error2)}`);
+}
+async function handleError(error2) {
+  console.error(formatError(error2));
+  const skipCodes = /* @__PURE__ */ new Set([
+    ErrorCodes.NOT_AUTHENTICATED,
+    ErrorCodes.INVALID_INPUT,
+    ErrorCodes.NOT_INITIALIZED
+  ]);
+  if (error2 instanceof CLIError) {
+    if (!skipCodes.has(error2.code)) {
+      captureError(error2, { errorCode: error2.code });
+    }
+  } else {
+    captureError(error2);
+  }
+  await flushSentry();
+  if (error2 instanceof CLIError) {
+    switch (error2.code) {
+      case ErrorCodes.NOT_AUTHENTICATED:
+        process.exit(2);
+        break;
+      case ErrorCodes.PERMISSION_DENIED:
+        process.exit(3);
+        break;
+      case ErrorCodes.TIER_LIMIT_EXCEEDED:
+        process.exit(4);
+        break;
+      default:
+        process.exit(1);
+    }
+  }
+  process.exit(1);
+}
+function notAuthenticated() {
+  return new CLIError(
+    "You are not authenticated.",
+    ErrorCodes.NOT_AUTHENTICATED,
+    "Run `envpilot login` to authenticate."
+  );
+}
+function notInitialized() {
+  return new CLIError(
+    "This directory is not initialized with Envpilot.",
+    ErrorCodes.NOT_INITIALIZED,
+    "Run `envpilot init` to initialize."
+  );
+}
+function fileNotFound(path) {
+  return new CLIError(`File not found: ${path}`, ErrorCodes.FILE_NOT_FOUND);
+}
+
+// src/lib/auth-flow.ts
+import open from "open";
+import chalk4 from "chalk";
+import { hostname } from "os";
+
+// src/lib/api.ts
+var APIError = class extends Error {
+  constructor(message, statusCode, code) {
+    super(message);
+    this.statusCode = statusCode;
+    this.code = code;
+    this.name = "APIError";
+  }
+};
+var APIClient = class {
+  baseUrl;
+  accessToken;
+  constructor(options) {
+    this.baseUrl = options?.baseUrl ?? getApiUrl();
+    this.accessToken = options?.accessToken ?? getAccessToken();
+  }
+  /**
+   * Get headers for API requests
+   */
+  getHeaders() {
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    if (this.accessToken) {
+      headers["Authorization"] = `Bearer ${this.accessToken}`;
+    }
+    return headers;
+  }
+  /**
+   * Detect auth middleware redirects that returned HTML instead of CLI JSON.
+   */
+  isAuthRedirect(response, bodyText) {
+    const location = response.headers.get("location") || "";
+    const finalUrl = response.url || "";
+    const contentType = response.headers.get("content-type") || "";
+    const preview = (bodyText || "").slice(0, 512).toLowerCase();
+    return response.redirected || location.includes("authkit") || finalUrl.includes("authkit") || contentType.includes("text/html") && (preview.includes("authorization_session_id") || preview.includes("client_id=") || preview.includes("<!doctype html"));
+  }
+  /**
+   * Make a GET request
+   */
+  async get(path, params) {
+    const url = new URL(path, this.baseUrl);
+    if (params) {
+      for (const [key, value] of Object.entries(params)) {
+        url.searchParams.set(key, value);
+      }
+    }
+    const response = await fetch(url.toString(), {
+      method: "GET",
+      headers: this.getHeaders(),
+      redirect: "follow"
+    });
+    return this.handleResponse(response);
+  }
+  /**
+   * Make a POST request
+   */
+  async post(path, body) {
+    const url = new URL(path, this.baseUrl);
+    const response = await fetch(url.toString(), {
+      method: "POST",
+      headers: this.getHeaders(),
+      body: body ? JSON.stringify(body) : void 0,
+      redirect: "follow"
+    });
+    return this.handleResponse(response);
+  }
+  /**
+   * Make a PUT request
+   */
+  async put(path, body) {
+    const url = new URL(path, this.baseUrl);
+    const response = await fetch(url.toString(), {
+      method: "PUT",
+      headers: this.getHeaders(),
+      body: body ? JSON.stringify(body) : void 0,
+      redirect: "follow"
+    });
+    return this.handleResponse(response);
+  }
+  /**
+   * Make a PATCH request
+   */
+  async patch(path, body) {
+    const url = new URL(path, this.baseUrl);
+    const response = await fetch(url.toString(), {
+      method: "PATCH",
+      headers: this.getHeaders(),
+      body: body ? JSON.stringify(body) : void 0,
+      redirect: "follow"
+    });
+    return this.handleResponse(response);
+  }
+  /**
+   * Make a DELETE request
+   */
+  async delete(path) {
+    const url = new URL(path, this.baseUrl);
+    const response = await fetch(url.toString(), {
+      method: "DELETE",
+      headers: this.getHeaders(),
+      redirect: "follow"
+    });
+    if (!response.ok) {
+      await this.handleError(response);
+    }
+  }
+  /**
+   * Handle API response
+   */
+  async handleResponse(response) {
+    if (!response.ok) {
+      await this.handleError(response);
+    }
+    const contentType = response.headers.get("content-type") || "";
+    if (!contentType.includes("application/json")) {
+      const body2 = await response.text();
+      if (this.isAuthRedirect(response, body2)) {
+        clearAuth();
+        throw new APIError(
+          "Your CLI session is not authorized for this endpoint. Please run `envpilot login` and try again.",
+          401,
+          "AUTH_REDIRECT"
+        );
+      }
+      const preview = body2.replace(/\s+/g, " ").slice(0, 160);
+      throw new APIError(
+        `Expected JSON but got ${contentType || "unknown content type"} from ${response.url}. Response starts with: ${preview}`,
+        response.status || 500
+      );
+    }
+    const body = await response.text();
+    try {
+      const data = JSON.parse(body);
+      return data;
+    } catch {
+      const preview = body.replace(/\s+/g, " ").slice(0, 160);
+      throw new APIError(
+        `Failed to parse JSON response from ${response.url}. Response starts with: ${preview}`,
+        response.status || 500
+      );
+    }
+  }
+  /**
+   * Handle API errors
+   */
+  async handleError(response) {
+    let message = `Request failed with status ${response.status}`;
+    let code;
+    try {
+      const data = await response.json();
+      message = data.error || data.message || message;
+      code = data.code;
+    } catch {
+    }
+    if (response.status >= 300 && response.status < 400 && this.isAuthRedirect(response)) {
+      clearAuth();
+      throw new APIError(
+        "Your CLI session expired or the server redirected this request to browser sign-in. Please run `envpilot login`.",
+        401,
+        "AUTH_REDIRECT"
+      );
+    }
+    if (response.status === 401) {
+      clearAuth();
+      throw new APIError(
+        "Authentication required. Please run `envpilot login`.",
+        401,
+        "UNAUTHORIZED"
+      );
+    }
+    if (response.status === 403 && code === "TIER_LIMIT_REACHED") {
+      throw new APIError(
+        message || "Tier limit reached. Run `envpilot usage` to see your plan limits.",
+        403,
+        "TIER_LIMIT_REACHED"
+      );
+    }
+    if (response.status === 403) {
+      throw new APIError(message || "Access denied.", 403, code || "FORBIDDEN");
+    }
+    if (response.status === 402) {
+      throw new APIError(
+        message || "Tier limit reached. Run `envpilot usage` to see your plan limits.",
+        402,
+        "PAYMENT_REQUIRED"
+      );
+    }
+    throw new APIError(message, response.status, code);
+  }
+  // ============================================
+  // High-level API methods
+  // ============================================
+  /**
+   * Get current user info
+   */
+  async getCurrentUser() {
+    return this.get("/api/cli/auth/me");
+  }
+  /**
+   * Get tier info for the active organization
+   */
+  async getTierInfo(organizationId) {
+    return this.get("/api/cli/tier", { organizationId });
+  }
+  /**
+   * Get usage info for the active organization
+   */
+  async getUsage(organizationId) {
+    return this.get("/api/cli/usage", { organizationId });
+  }
+  /**
+   * List organizations the user has access to
+   */
+  async listOrganizations() {
+    const response = await this.get(
+      "/api/cli/organizations"
+    );
+    return response.data || [];
+  }
+  /**
+   * List projects in an organization
+   */
+  async listProjects(organizationId) {
+    const response = await this.get(
+      "/api/cli/projects",
+      { organizationId }
+    );
+    return response.data || [];
+  }
+  /**
+   * Get a project by ID
+   */
+  async getProject(projectId) {
+    return this.get(`/api/cli/projects/${projectId}`);
+  }
+  /**
+   * List variables in a project
+   */
+  async listVariables(projectId, environment, organizationId) {
+    const params = { projectId };
+    if (environment) {
+      params.environment = environment;
+    }
+    if (organizationId) {
+      params.organizationId = organizationId;
+    }
+    const response = await this.get(
+      "/api/cli/variables",
+      params
+    );
+    return response.data || [];
+  }
+  /**
+   * Get a variable by ID (with decrypted value)
+   */
+  async getVariable(variableId) {
+    return this.get(`/api/cli/variables/${variableId}`);
+  }
+  /**
+   * Create a new variable
+   */
+  async createVariable(data) {
+    return this.post("/api/cli/variables", data);
+  }
+  /**
+   * Update a variable
+   */
+  async updateVariable(variableId, data) {
+    return this.patch(`/api/cli/variables/${variableId}`, data);
+  }
+  /**
+   * Delete a variable
+   */
+  async deleteVariable(variableId) {
+    return this.delete(`/api/cli/variables/${variableId}`);
+  }
+  /**
+   * Bulk create/update variables
+   */
+  async bulkUpsertVariables(data) {
+    return this.post("/api/cli/variables/bulk", data);
+  }
+  // ============================================
+  // Authentication methods
+  // ============================================
+  /**
+   * Initiate CLI authentication flow
+   */
+  async initiateAuth(deviceName) {
+    return this.post("/api/cli/auth/initiate", { deviceName });
+  }
+  /**
+   * Poll for authentication status
+   */
+  async pollAuth(code) {
+    return this.get("/api/cli/auth/poll", { code });
+  }
+  /**
+   * Refresh access token
+   */
+  async refreshToken(refreshToken) {
+    return this.post("/api/cli/auth/refresh", { refreshToken });
+  }
+  /**
+   * Revoke access token (logout)
+   */
+  async revokeToken() {
+    return this.post("/api/cli/auth/revoke", {});
+  }
+};
+function createAPIClient() {
+  return new APIClient();
+}
+
+// src/lib/auth-flow.ts
+var POLL_INTERVAL_MS = 2e3;
+var MAX_POLL_ATTEMPTS = 150;
+var MAX_CONSECUTIVE_ERRORS = 5;
+function sleep(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+async function performLogin(options) {
+  const api = createAPIClient();
+  const deviceName = `CLI - ${hostname()}`;
+  info("Starting authentication flow...");
+  const spinner = createSpinner("Generating authentication code...");
+  spinner.start();
+  let initResponse;
+  try {
+    initResponse = await api.post("/api/cli/auth?action=initiate", { deviceName });
+  } catch (error2) {
+    spinner.stop();
+    throw error2;
+  }
+  spinner.stop();
+  console.log();
+  console.log(chalk4.bold("Your authentication code:"));
+  console.log();
+  console.log(chalk4.cyan.bold(`    ${initResponse.code}`));
+  console.log();
+  console.log(`Open this URL to authenticate:`);
+  console.log(chalk4.dim(initResponse.url));
+  console.log();
+  if (options?.browser !== false) {
+    info("Opening browser...");
+    await open(initResponse.url);
+  }
+  const pollSpinner = createSpinner("Waiting for authentication...");
+  pollSpinner.start();
+  let consecutiveErrors = 0;
+  try {
+    for (let attempts = 0; attempts < MAX_POLL_ATTEMPTS; attempts++) {
+      await sleep(POLL_INTERVAL_MS);
+      let pollResponse;
+      try {
+        pollResponse = await api.get("/api/cli/auth", {
+          action: "poll",
+          code: initResponse.code
+        });
+        consecutiveErrors = 0;
+      } catch {
+        consecutiveErrors++;
+        if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
+          throw new Error(
+            "Too many consecutive network errors while polling. Please check your connection and try again."
+          );
+        }
+        continue;
+      }
+      if (pollResponse.status === "authenticated") {
+        pollSpinner.stop();
+        if (pollResponse.accessToken) {
+          setAccessToken(pollResponse.accessToken);
+        }
+        if (pollResponse.refreshToken) {
+          setRefreshToken(pollResponse.refreshToken);
+        }
+        if (pollResponse.user) {
+          setUser({
+            id: pollResponse.user.id,
+            email: pollResponse.user.email,
+            name: pollResponse.user.name
+          });
+        }
+        console.log();
+        success(`Logged in as ${chalk4.bold(pollResponse.user?.email)}`);
+        return { email: pollResponse.user?.email || "" };
+      }
+      if (pollResponse.status === "expired" || pollResponse.status === "not_found") {
+        throw new Error("Authentication code expired. Please try again.");
+      }
+    }
+    throw new Error("Authentication timed out. Please try again.");
+  } finally {
+    pollSpinner.stop();
+  }
+}
+
+// src/commands/login.ts
+var loginCommand = new Command("login").description("Authenticate with Envpilot").option("--api-url <url>", "API URL (default: http://localhost:3000)").option("--no-browser", "Do not automatically open the browser").action(async (options) => {
+  try {
+    if (options.apiUrl) {
+      setApiUrl(options.apiUrl);
+    }
+    await performLogin({
+      browser: options.browser !== false
+    });
+    console.log();
+    console.log("Next steps:");
+    info("  envpilot init     Initialize a project in the current directory");
+    info("  envpilot list     List your projects and organizations");
+    info("  envpilot sync     Login, select project, and pull \u2014 all at once");
+    console.log();
+  } catch (err) {
+    await handleError(err);
+  }
+});
+
+// src/commands/init.ts
+import { Command as Command2 } from "commander";
+import chalk5 from "chalk";
+import inquirer from "inquirer";
+
+// src/lib/project-config.ts
+import { readFileSync, writeFileSync, existsSync, unlinkSync } from "fs";
+import { execSync } from "child_process";
+import { join } from "path";
+
+// src/types/index.ts
+import { z } from "zod";
+var userSchema = z.object({
+  id: z.string(),
+  email: z.string().email(),
+  name: z.string().optional()
+});
+var organizationSchema = z.object({
+  _id: z.string(),
+  name: z.string(),
+  slug: z.string(),
+  tier: z.enum(["free", "pro"]),
+  role: z.string().optional()
+});
+var projectSchema = z.object({
+  _id: z.string(),
+  name: z.string(),
+  slug: z.string(),
+  organizationId: z.string(),
+  description: z.string().optional(),
+  icon: z.string().optional(),
+  color: z.string().optional(),
+  userRole: z.string().nullable().optional(),
+  projectRole: z.string().nullable().optional()
+});
+var variableTagSchema = z.object({
+  _id: z.string(),
+  name: z.string(),
+  color: z.string()
+});
+var variableSchema = z.object({
+  _id: z.string(),
+  key: z.string(),
+  value: z.string(),
+  environment: z.enum(["development", "staging", "production"]),
+  projectId: z.string(),
+  description: z.string().optional(),
+  isSensitive: z.boolean().optional(),
+  version: z.number().optional(),
+  tags: z.array(variableTagSchema).optional()
+});
+var environmentSchema = z.enum([
+  "development",
+  "staging",
+  "production"
+]);
+var cliConfigSchema = z.object({
+  apiUrl: z.string().url(),
+  accessToken: z.string().optional(),
+  refreshToken: z.string().optional(),
+  activeProjectId: z.string().optional(),
+  activeOrganizationId: z.string().optional(),
+  user: userSchema.optional(),
+  role: z.enum(["admin", "team_lead", "member"]).optional()
+});
+var projectConfigSchema = z.object({
+  projectId: z.string(),
+  organizationId: z.string(),
+  environment: environmentSchema.default("development")
+});
+var projectEntrySchema = z.object({
+  projectId: z.string(),
+  organizationId: z.string(),
+  projectName: z.string().default(""),
+  organizationName: z.string().default(""),
+  environment: environmentSchema.default("development")
+});
+var projectConfigV2Schema = z.object({
+  version: z.literal(1),
+  activeProjectId: z.string(),
+  projects: z.array(projectEntrySchema).min(1)
+});
+
+// src/lib/project-config.ts
+var CONFIG_FILE_NAME = ".envpilot";
+function getProjectConfigPath(directory = process.cwd()) {
+  return join(directory, CONFIG_FILE_NAME);
+}
+function hasProjectConfig(directory = process.cwd()) {
+  return existsSync(getProjectConfigPath(directory));
+}
+function readRawConfig(directory = process.cwd()) {
+  const configPath = getProjectConfigPath(directory);
+  if (!existsSync(configPath)) return null;
+  try {
+    return JSON.parse(readFileSync(configPath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function migrateV1toV2(v1) {
+  return {
+    version: 1,
+    activeProjectId: v1.projectId,
+    projects: [
+      {
+        projectId: v1.projectId,
+        organizationId: v1.organizationId,
+        projectName: "",
+        organizationName: "",
+        environment: v1.environment
+      }
+    ]
+  };
+}
+function readProjectConfigV2(directory = process.cwd()) {
+  const raw = readRawConfig(directory);
+  if (!raw || typeof raw !== "object") return null;
+  const rawVersion = raw.version;
+  if (rawVersion === 1 || rawVersion === 2) {
+    try {
+      const normalized = { ...raw, version: 1 };
+      const parsed = projectConfigV2Schema.parse(normalized);
+      if (rawVersion === 2) {
+        writeProjectConfigV2(parsed, directory);
+      }
+      return parsed;
+    } catch {
+      return null;
+    }
+  }
+  try {
+    const v1 = projectConfigSchema.parse(raw);
+    const v2 = migrateV1toV2(v1);
+    writeProjectConfigV2(v2, directory);
+    return v2;
+  } catch {
+    return null;
+  }
+}
+function writeProjectConfigV2(config2, directory = process.cwd()) {
+  const configPath = getProjectConfigPath(directory);
+  writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
+}
+function getActiveProject(config2) {
+  return config2.projects.find((p) => p.projectId === config2.activeProjectId) || config2.projects[0] || null;
+}
+function resolveProject(config2, identifier) {
+  if (!identifier) return getActiveProject(config2);
+  return config2.projects.find(
+    (p) => p.projectId === identifier || p.projectName.toLowerCase() === identifier.toLowerCase()
+  ) || null;
+}
+function addProjectToConfig(config2, entry) {
+  if (config2.projects.some((p) => p.projectId === entry.projectId)) {
+    throw new Error("Project already linked");
+  }
+  return { ...config2, projects: [...config2.projects, entry] };
+}
+function removeProjectFromConfig(config2, projectId) {
+  const filtered = config2.projects.filter((p) => p.projectId !== projectId);
+  if (filtered.length === 0) return null;
+  const activeId = config2.activeProjectId === projectId ? filtered[0].projectId : config2.activeProjectId;
+  return { ...config2, activeProjectId: activeId, projects: filtered };
+}
+function setActiveProjectInConfig(config2, projectId) {
+  if (!config2.projects.some((p) => p.projectId === projectId)) {
+    throw new Error("Project not found in config");
+  }
+  return { ...config2, activeProjectId: projectId };
+}
+function updateProjectInConfig(config2, projectId, updates) {
+  return {
+    ...config2,
+    projects: config2.projects.map(
+      (p) => p.projectId === projectId ? { ...p, ...updates } : p
+    )
+  };
+}
+function readProjectConfig(directory = process.cwd()) {
+  const v2 = readProjectConfigV2(directory);
+  if (!v2) return null;
+  const active = getActiveProject(v2);
+  if (!active) return null;
+  return {
+    projectId: active.projectId,
+    organizationId: active.organizationId,
+    environment: active.environment
+  };
+}
+function writeProjectConfig(config2, directory = process.cwd()) {
+  const existing = readProjectConfigV2(directory);
+  if (existing) {
+    const updated = updateProjectInConfig(existing, existing.activeProjectId, {
+      projectId: config2.projectId,
+      organizationId: config2.organizationId,
+      environment: config2.environment
+    });
+    writeProjectConfigV2(
+      { ...updated, activeProjectId: config2.projectId },
+      directory
+    );
+  } else {
+    writeProjectConfigV2(
+      {
+        version: 1,
+        activeProjectId: config2.projectId,
+        projects: [
+          {
+            projectId: config2.projectId,
+            organizationId: config2.organizationId,
+            projectName: "",
+            organizationName: "",
+            environment: config2.environment
+          }
+        ]
+      },
+      directory
+    );
+  }
+}
+function updateProjectConfig(updates, directory = process.cwd()) {
+  const v2 = readProjectConfigV2(directory);
+  if (!v2) {
+    throw new Error("No project config found. Run `envpilot init` first.");
+  }
+  const active = getActiveProject(v2);
+  if (!active) {
+    throw new Error("No active project found.");
+  }
+  const updated = updateProjectInConfig(v2, active.projectId, updates);
+  writeProjectConfigV2(updated, directory);
+}
+function deleteProjectConfig(directory = process.cwd()) {
+  const configPath = getProjectConfigPath(directory);
+  if (!existsSync(configPath)) return false;
+  unlinkSync(configPath);
+  return true;
+}
+function ensureEnvInGitignore(directory = process.cwd()) {
+  const gitignorePath = join(directory, ".gitignore");
+  if (!existsSync(gitignorePath)) {
+    writeFileSync(gitignorePath, ".env\n.env.local\n", "utf-8");
+    return;
+  }
+  const content = readFileSync(gitignorePath, "utf-8");
+  const lines = content.split("\n");
+  if (lines.some((line2) => line2.trim() === ".env")) {
+    return;
+  }
+  const newContent = content.endsWith("\n") ? content + ".env\n" : content + "\n.env\n";
+  writeFileSync(gitignorePath, newContent, "utf-8");
+}
+function getTrackedEnvFiles(directory = process.cwd()) {
+  try {
+    const result = execSync("git ls-files --cached .env .env.* .env.local", {
+      cwd: directory,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return result.trim().split("\n").filter((f) => f.length > 0);
+  } catch {
+    return [];
+  }
+}
+
+// src/lib/env-file.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, chmodSync } from "fs";
+import { join as join2 } from "path";
+function parseEnvFile(content) {
+  const result = {};
+  const lines = content.split("\n");
+  for (const line2 of lines) {
+    const trimmed = line2.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    const equalsIndex = line2.indexOf("=");
+    if (equalsIndex === -1) {
+      continue;
+    }
+    const key = line2.substring(0, equalsIndex).trim();
+    let value = line2.substring(equalsIndex + 1);
+    value = parseValue(value);
+    if (isValidEnvKey(key)) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function parseValue(value) {
+  value = value.trim();
+  if (value.startsWith('"') && value.endsWith('"')) {
+    value = value.slice(1, -1);
+    value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+  } else if (value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  } else {
+    const commentIndex = value.indexOf(" #");
+    if (commentIndex !== -1) {
+      value = value.substring(0, commentIndex).trim();
+    }
+  }
+  return value;
+}
+function isValidEnvKey(key) {
+  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);
+}
+function stringifyEnv(vars, options) {
+  let keys = Object.keys(vars);
+  if (options?.sort) {
+    keys = keys.sort();
+  }
+  const lines = [];
+  for (const key of keys) {
+    const value = vars[key];
+    if (options?.comments?.[key]) {
+      lines.push(`# ${options.comments[key]}`);
+    }
+    const formattedValue = formatValue(value);
+    lines.push(`${key}=${formattedValue}`);
+  }
+  return lines.join("\n") + "\n";
+}
+function formatValue(value) {
+  const needsQuotes = value.includes("\n") || value.includes("\r") || value.includes('"') || value.includes("'") || value.includes(" ") || value.includes("#") || value.startsWith(" ") || value.endsWith(" ");
+  if (!needsQuotes) {
+    return value;
+  }
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+  return `"${escaped}"`;
+}
+function diffEnvVars(local, remote) {
+  const added = {};
+  const removed = {};
+  const changed = {};
+  const unchanged = [];
+  for (const [key, value] of Object.entries(local)) {
+    if (!(key in remote)) {
+      added[key] = value;
+    } else if (remote[key] !== value) {
+      changed[key] = { local: value, remote: remote[key] };
+    } else {
+      unchanged.push(key);
+    }
+  }
+  for (const [key, value] of Object.entries(remote)) {
+    if (!(key in local)) {
+      removed[key] = value;
+    }
+  }
+  return { added, removed, changed, unchanged };
+}
+function readEnvFile(filePath) {
+  if (!existsSync2(filePath)) {
+    return null;
+  }
+  const content = readFileSync2(filePath, "utf-8");
+  return parseEnvFile(content);
+}
+function writeEnvFile(filePath, vars, options) {
+  const content = stringifyEnv(vars, options);
+  writeFileSync2(filePath, content, "utf-8");
+}
+function getEnvPathForEnvironment(environment, directory = process.cwd()) {
+  if (environment === "development") {
+    return join2(directory, ".env.local");
+  }
+  return join2(directory, `.env.${environment}`);
+}
+function applyFileProtection(filePath, role, projectRole) {
+  if (!existsSync2(filePath)) return;
+  const isWritable = role === "admin" || role === "team_lead" || projectRole === "manager";
+  if (isWritable) {
+    chmodSync(filePath, 420);
+  } else {
+    chmodSync(filePath, 292);
+  }
+}
+
+// src/commands/init.ts
+var initCommand = new Command2("init").description("Initialize Envpilot in the current directory").option("-o, --organization <id>", "Organization ID").option("-p, --project <id>", "Project ID").option(
+  "-e, --environment <env>",
+  "Default environment (development, staging, production)"
+).option("-f, --force", "Overwrite existing configuration").option("--add", "Add another project to existing config").action(async (options) => {
+  try {
+    if (!isAuthenticated()) {
+      throw notAuthenticated();
+    }
+    const existingConfig = readProjectConfigV2();
+    if (options.add) {
+      if (!existingConfig) {
+        error("No existing config. Run `envpilot init` first.");
+        process.exit(1);
+      }
+      await addProject(existingConfig, options);
+      return;
+    }
+    if (hasProjectConfig() && !options.force) {
+      warning("This directory is already initialized with Envpilot.");
+      const { proceed } = await inquirer.prompt([
+        {
+          type: "confirm",
+          name: "proceed",
+          message: "Do you want to reinitialize?",
+          default: false
+        }
+      ]);
+      if (!proceed) {
+        info("Initialization cancelled.");
+        return;
+      }
+    }
+    const { selectedOrg, selectedProject, selectedEnvironment } = await selectOrgProjectEnv(options);
+    writeProjectConfigV2({
+      version: 1,
+      activeProjectId: selectedProject._id,
+      projects: [
+        {
+          projectId: selectedProject._id,
+          organizationId: selectedOrg._id,
+          projectName: selectedProject.name,
+          organizationName: selectedOrg.name,
+          environment: selectedEnvironment
+        }
+      ]
+    });
+    setActiveOrganizationId(selectedOrg._id);
+    setActiveProjectId(selectedProject._id);
+    if (selectedOrg.role) {
+      setRole(selectedOrg.role);
+    }
+    ensureEnvInGitignore();
+    warnTrackedFiles();
+    console.log();
+    success("Project initialized!");
+    printPostInit(selectedOrg, selectedProject);
+  } catch (err) {
+    await handleError(err);
+  }
+});
+async function addProject(existingConfig, options) {
+  const api = createAPIClient();
+  let role = getRole();
+  if (role !== "admin" && role !== "team_lead") {
+    const orgs = await withSpinner("Checking permissions...", async () => {
+      const response = await api.get("/api/cli/organizations");
+      return response.data || [];
+    });
+    const freshRole = orgs.find(
+      (o) => o._id === existingConfig.projects[0]?.organizationId
+    )?.role;
+    if (freshRole) {
+      setRole(freshRole);
+      role = freshRole;
+    }
+    if (role !== "admin" && role !== "team_lead") {
+      error("Only admins and team leads can link multiple projects.");
+      info("Unlink the current project first with `envpilot unlink`.");
+      process.exit(1);
+    }
+  }
+  const { selectedOrg, selectedProject, selectedEnvironment } = await selectOrgProjectEnv(options);
+  if (existingConfig.projects.some((p) => p.projectId === selectedProject._id)) {
+    error(`"${selectedProject.name}" is already linked.`);
+    process.exit(1);
+  }
+  const envFile = getEnvPathForEnvironment(selectedEnvironment);
+  const conflicting = existingConfig.projects.find(
+    (p) => p.environment === selectedEnvironment
+  );
+  if (conflicting) {
+    warning(
+      `"${conflicting.projectName || conflicting.projectId}" already syncs to ${envFile} (${selectedEnvironment}). Both projects will write to the same file \u2014 consider using a different environment.`
+    );
+  }
+  const newEntry = {
+    projectId: selectedProject._id,
+    organizationId: selectedOrg._id,
+    projectName: selectedProject.name,
+    organizationName: selectedOrg.name,
+    environment: selectedEnvironment
+  };
+  let updatedConfig = addProjectToConfig(existingConfig, newEntry);
+  const { setActive } = await inquirer.prompt([
+    {
+      type: "confirm",
+      name: "setActive",
+      message: `Set "${selectedProject.name}" as the active project?`,
+      default: false
+    }
+  ]);
+  if (setActive) {
+    updatedConfig = {
+      ...updatedConfig,
+      activeProjectId: selectedProject._id
+    };
+    setActiveProjectId(selectedProject._id);
+    setActiveOrganizationId(selectedOrg._id);
+  }
+  updatedConfig = backfillNames(updatedConfig);
+  writeProjectConfigV2(updatedConfig);
+  console.log();
+  success(`Added "${selectedProject.name}" to linked projects!`);
+  console.log(
+    chalk5.dim(`  ${existingConfig.projects.length + 1} projects now linked`)
+  );
+  console.log();
+  console.log("Next steps:");
+  console.log(
+    `  ${chalk5.cyan("envpilot pull --all")}         Pull all projects`
+  );
+  console.log(
+    `  ${chalk5.cyan(`envpilot pull --project "${selectedProject.name}"`)}  Pull this project`
+  );
+  console.log(
+    `  ${chalk5.cyan("envpilot list linked")}        See all linked projects`
+  );
+  console.log();
+}
+async function selectOrgProjectEnv(options) {
+  const api = createAPIClient();
+  const organizations = await withSpinner(
+    "Fetching organizations...",
+    async () => {
+      const response = await api.get("/api/cli/organizations");
+      return response.data || [];
+    }
+  );
+  if (organizations.length === 0) {
+    error("No organizations found. Please create an organization first.");
+    process.exit(1);
+  }
+  let selectedOrg;
+  if (options.organization) {
+    const org = organizations.find(
+      (o) => o._id === options.organization || o.slug === options.organization
+    );
+    if (!org) {
+      error(`Organization not found: ${options.organization}`);
+      process.exit(1);
+    }
+    selectedOrg = org;
+  } else if (organizations.length === 1) {
+    selectedOrg = organizations[0];
+    info(`Using organization: ${chalk5.bold(selectedOrg.name)}`);
+  } else {
+    const { orgId } = await inquirer.prompt([
+      {
+        type: "list",
+        name: "orgId",
+        message: "Select an organization:",
+        choices: organizations.map((org) => ({
+          name: `${org.name} ${org.tier === "pro" ? chalk5.green("(Pro)") : chalk5.dim("(Free)")}`,
+          value: org._id
+        }))
+      }
+    ]);
+    selectedOrg = organizations.find((o) => o._id === orgId);
+  }
+  const projects = await withSpinner("Fetching projects...", async () => {
+    const response = await api.get(
+      "/api/cli/projects",
+      { organizationId: selectedOrg._id }
+    );
+    return response.data || [];
+  });
+  if (projects.length === 0) {
+    error("No projects found. Please create a project first.");
+    process.exit(1);
+  }
+  let selectedProject;
+  if (options.project) {
+    const project = projects.find(
+      (p) => p._id === options.project || p.slug === options.project
+    );
+    if (!project) {
+      error(`Project not found: ${options.project}`);
+      process.exit(1);
+    }
+    selectedProject = project;
+  } else if (projects.length === 1) {
+    selectedProject = projects[0];
+    info(`Using project: ${chalk5.bold(selectedProject.name)}`);
+  } else {
+    const { projectId } = await inquirer.prompt([
+      {
+        type: "list",
+        name: "projectId",
+        message: "Select a project:",
+        choices: projects.map((project) => ({
+          name: `${project.icon || "\u{1F4E6}"} ${project.name}`,
+          value: project._id
+        }))
+      }
+    ]);
+    selectedProject = projects.find((p) => p._id === projectId);
+  }
+  let selectedEnvironment = "development";
+  if (options.environment) {
+    if (!["development", "staging", "production"].includes(options.environment)) {
+      error(
+        "Invalid environment. Must be: development, staging, or production"
+      );
+      process.exit(1);
+    }
+    selectedEnvironment = options.environment;
+  } else {
+    const { environment } = await inquirer.prompt([
+      {
+        type: "list",
+        name: "environment",
+        message: "Select default environment:",
+        choices: [
+          { name: "Development", value: "development" },
+          { name: "Staging", value: "staging" },
+          { name: "Production", value: "production" }
+        ],
+        default: "development"
+      }
+    ]);
+    selectedEnvironment = environment;
+  }
+  return { selectedOrg, selectedProject, selectedEnvironment };
+}
+function backfillNames(config2) {
+  return config2;
+}
+function warnTrackedFiles() {
+  const trackedFiles = getTrackedEnvFiles();
+  if (trackedFiles.length > 0) {
+    console.log();
+    warning("Security risk: .env files are tracked by git!");
+    for (const file of trackedFiles) {
+      console.log(chalk5.red(`  tracked: ${file}`));
+    }
+    console.log();
+    console.log(
+      chalk5.yellow(
+        "  Run the following to untrack them (without deleting the files):"
+      )
+    );
+    for (const file of trackedFiles) {
+      console.log(chalk5.cyan(`    git rm --cached ${file}`));
+    }
+  }
+}
+function printPostInit(selectedOrg, selectedProject) {
+  console.log();
+  console.log(chalk5.dim("Configuration saved to .envpilot"));
+  if (selectedOrg.role) {
+    console.log(chalk5.dim(`  Org role: ${formatRole(selectedOrg.role)}`));
+    roleNotice(selectedOrg.role);
+  }
+  if (selectedProject.projectRole) {
+    console.log(
+      chalk5.dim(
+        `  Project role: ${formatProjectRole(selectedProject.projectRole)}`
+      )
+    );
+    projectRoleNotice(selectedProject.projectRole);
+  }
+  console.log();
+  console.log("Next steps:");
+  console.log(
+    `  ${chalk5.cyan("envpilot pull")}     Download environment variables`
+  );
+  console.log(
+    `  ${chalk5.cyan("envpilot push")}     Upload local .env to cloud`
+  );
+  console.log();
+}
+
+// src/commands/pull.ts
+import { Command as Command3 } from "commander";
+import chalk6 from "chalk";
+import inquirer2 from "inquirer";
+
+// src/lib/format-converter.ts
+var ALL_FORMATS = [
+  "env",
+  "json",
+  "yaml",
+  "docker-compose",
+  "aws",
+  "vercel",
+  "netlify"
+];
+function serialize(vars, format, meta) {
+  switch (format) {
+    case "env":
+      return serializeEnv(vars, meta);
+    case "json":
+      return serializeJson(vars);
+    case "yaml":
+      return serializeYaml(vars, meta);
+    case "docker-compose":
+      return serializeDockerCompose(vars, meta);
+    case "aws":
+      return serializeAws(vars, meta);
+    case "vercel":
+      return serializeVercel(vars);
+    case "netlify":
+      return serializeNetlify(vars, meta);
+  }
+}
+function parse(content, format, options) {
+  switch (format) {
+    case "env":
+      return parseEnvFile(content);
+    case "json":
+      return parseJson(content);
+    case "yaml":
+      return parseYaml(content);
+    case "docker-compose":
+      return parseDockerCompose(content);
+    case "aws":
+      return parseAws(content, options?.prefix);
+    case "vercel":
+      return parseVercel(content);
+    case "netlify":
+      return parseNetlify(content);
+  }
+}
+function getDefaultFilename(format, environment) {
+  const env = environment || "development";
+  switch (format) {
+    case "env":
+      return env === "development" ? ".env.local" : `.env.${env}`;
+    case "json":
+      return `${env}.json`;
+    case "yaml":
+      return `${env}.yaml`;
+    case "docker-compose":
+      return "docker-compose.yml";
+    case "aws":
+      return `${env}.aws.json`;
+    case "vercel":
+      return `${env}.vercel.json`;
+    case "netlify":
+      return "netlify.toml";
+  }
+}
+function serializeEnv(vars, meta) {
+  const lines = [];
+  if (meta?.environment) {
+    lines.push(`# Environment: ${meta.environment}`);
+  }
+  if (meta?.projectName) {
+    lines.push(`# Project: ${meta.projectName}`);
+  }
+  if (lines.length > 0) {
+    lines.push(`# Exported: ${(/* @__PURE__ */ new Date()).toISOString()}`);
+    lines.push("");
+  }
+  return lines.join("\n") + stringifyEnv(vars, { sort: true });
+}
+function serializeJson(vars) {
+  const sorted = Object.keys(vars).sort().reduce(
+    (obj, key) => {
+      obj[key] = vars[key];
+      return obj;
+    },
+    {}
+  );
+  return JSON.stringify(sorted, null, 2) + "\n";
+}
+function parseJson(content) {
+  const data = JSON.parse(content);
+  if (typeof data !== "object" || data === null || Array.isArray(data)) {
+    throw new Error("Expected a JSON object with string key-value pairs");
+  }
+  const result = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (typeof value === "string") {
+      result[key] = value;
+    } else if (value !== null && value !== void 0) {
+      result[key] = String(value);
+    }
+  }
+  return result;
+}
+function yamlQuote(value) {
+  if (value === "" || value === "true" || value === "false" || value === "null" || value === "~" || /^[0-9]/.test(value) || /[:#\[\]{}&*!|>'"%@`]/.test(value) || value.includes("\n") || value.startsWith(" ") || value.endsWith(" ")) {
+    const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+    return `"${escaped}"`;
+  }
+  return value;
+}
+function serializeYaml(vars, meta) {
+  const lines = [];
+  if (meta?.environment) {
+    lines.push(`# Environment: ${meta.environment}`);
+  }
+  if (meta?.projectName) {
+    lines.push(`# Project: ${meta.projectName}`);
+  }
+  if (lines.length > 0) {
+    lines.push("");
+  }
+  for (const key of Object.keys(vars).sort()) {
+    lines.push(`${key}: ${yamlQuote(vars[key])}`);
+  }
+  return lines.join("\n") + "\n";
+}
+function parseYaml(content) {
+  const result = {};
+  for (const line2 of content.split("\n")) {
+    const trimmed = line2.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const colonIndex = trimmed.indexOf(": ");
+    if (colonIndex === -1) {
+      if (trimmed.endsWith(":")) {
+        const key2 = trimmed.slice(0, -1).trim();
+        if (key2 && /^[A-Za-z_][A-Za-z0-9_]*$/.test(key2)) {
+          result[key2] = "";
+        }
+      }
+      continue;
+    }
+    const key = trimmed.substring(0, colonIndex).trim();
+    let value = trimmed.substring(colonIndex + 2).trim();
+    if (line2.startsWith(" ") || line2.startsWith("	")) continue;
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+      if (value.includes("\\")) {
+        value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+      }
+    }
+    if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function serializeDockerCompose(vars, meta) {
+  const lines = [];
+  if (meta?.environment || meta?.projectName) {
+    lines.push("# Docker Compose environment variables");
+    if (meta.projectName) lines.push(`# Project: ${meta.projectName}`);
+    if (meta.environment) lines.push(`# Environment: ${meta.environment}`);
+    lines.push("");
+  }
+  lines.push("services:");
+  lines.push("  app:");
+  lines.push("    environment:");
+  for (const key of Object.keys(vars).sort()) {
+    lines.push(`      ${key}: ${yamlQuote(vars[key])}`);
+  }
+  return lines.join("\n") + "\n";
+}
+function parseDockerCompose(content) {
+  const result = {};
+  const lines = content.split("\n");
+  let inEnvironment = false;
+  let environmentIndent = -1;
+  for (const line2 of lines) {
+    const trimmed = line2.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const indent = line2.length - line2.trimStart().length;
+    if (trimmed === "environment:") {
+      inEnvironment = true;
+      environmentIndent = indent;
+      continue;
+    }
+    if (inEnvironment) {
+      if (indent <= environmentIndent && trimmed !== "") {
+        inEnvironment = false;
+        environmentIndent = -1;
+        continue;
+      }
+      if (trimmed.startsWith("- ")) {
+        const entry = trimmed.slice(2);
+        const eqIdx = entry.indexOf("=");
+        if (eqIdx !== -1) {
+          const key = entry.substring(0, eqIdx).trim();
+          let value = entry.substring(eqIdx + 1).trim();
+          if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+            value = value.slice(1, -1);
+          }
+          if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+            result[key] = value;
+          }
+        }
+        continue;
+      }
+      const colonIndex = trimmed.indexOf(": ");
+      if (colonIndex !== -1) {
+        const key = trimmed.substring(0, colonIndex).trim();
+        let value = trimmed.substring(colonIndex + 2).trim();
+        if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+          value = value.slice(1, -1);
+          if (value.includes("\\")) {
+            value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+          }
+        }
+        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+          result[key] = value;
+        }
+      } else if (trimmed.endsWith(":")) {
+        const key = trimmed.slice(0, -1).trim();
+        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+          result[key] = "";
+        }
+      }
+    }
+  }
+  return result;
+}
+function serializeAws(vars, meta) {
+  const prefix = meta?.prefix || `/${meta?.projectName || "app"}`;
+  const parameters = Object.keys(vars).sort().map((key) => ({
+    name: `${prefix}/${key}`,
+    value: vars[key],
+    type: "SecureString"
+  }));
+  return JSON.stringify({ parameters }, null, 2) + "\n";
+}
+function parseAws(content, prefix) {
+  const data = JSON.parse(content);
+  const result = {};
+  const params = data.parameters || data.Parameters || [];
+  if (!Array.isArray(params)) {
+    throw new Error(
+      "Expected AWS Parameter Store format with 'parameters' array"
+    );
+  }
+  for (const param of params) {
+    const name = param.name || param.Name || "";
+    const value = param.value || param.Value || "";
+    let key;
+    if (prefix && name.startsWith(prefix + "/")) {
+      key = name.substring(prefix.length + 1);
+    } else {
+      const lastSlash = name.lastIndexOf("/");
+      key = lastSlash !== -1 ? name.substring(lastSlash + 1) : name;
+    }
+    if (key && /^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+function serializeVercel(vars) {
+  const sorted = Object.keys(vars).sort().reduce(
+    (obj, key) => {
+      obj[key] = vars[key];
+      return obj;
+    },
+    {}
+  );
+  return JSON.stringify({ env: sorted }, null, 2) + "\n";
+}
+function parseVercel(content) {
+  const data = JSON.parse(content);
+  const result = {};
+  const env = data.env;
+  if (!env || typeof env !== "object" || Array.isArray(env)) {
+    throw new Error("Expected Vercel format with 'env' object");
+  }
+  for (const [key, value] of Object.entries(env)) {
+    if (typeof value === "string") {
+      result[key] = value;
+    } else if (value !== null && value !== void 0) {
+      result[key] = String(value);
+    }
+  }
+  return result;
+}
+function tomlQuote(value) {
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+  return `"${escaped}"`;
+}
+function serializeNetlify(vars, meta) {
+  const lines = [];
+  if (meta?.environment || meta?.projectName) {
+    if (meta.projectName) lines.push(`# Project: ${meta.projectName}`);
+    if (meta.environment) lines.push(`# Environment: ${meta.environment}`);
+    lines.push("");
+  }
+  lines.push("[build.environment]");
+  for (const key of Object.keys(vars).sort()) {
+    lines.push(`  ${key} = ${tomlQuote(vars[key])}`);
+  }
+  return lines.join("\n") + "\n";
+}
+function parseNetlify(content) {
+  const result = {};
+  const lines = content.split("\n");
+  let inBuildEnv = false;
+  for (const line2 of lines) {
+    const trimmed = line2.trim();
+    if (trimmed.startsWith("[")) {
+      inBuildEnv = trimmed === "[build.environment]" || trimmed === "[build.environment]";
+      continue;
+    }
+    if (!inBuildEnv) continue;
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eqIndex = trimmed.indexOf("=");
+    if (eqIndex === -1) continue;
+    const key = trimmed.substring(0, eqIndex).trim();
+    let value = trimmed.substring(eqIndex + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"')) {
+      value = value.slice(1, -1);
+      value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+    } else if (value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+
+// src/commands/pull.ts
+var pullCommand = new Command3("pull").description("Download environment variables to local .env file").option(
+  "-e, --env <environment>",
+  "Environment (development, staging, production)"
+).option("-f, --file <path>", "Output file path (default: .env)").option("--force", "Overwrite without confirmation").option(
+  "--format <format>",
+  "Output format: env, json, yaml, docker-compose, aws, vercel, netlify",
+  "env"
+).option(
+  "--prefix <prefix>",
+  "AWS Parameter Store path prefix (default: /project-name)"
+).option("--dry-run", "Show what would be downloaded without writing").option("--project <name-or-id>", "Pull a specific linked project").option("--all", "Pull all linked projects").action(async (options) => {
+  try {
+    if (!isAuthenticated()) {
+      throw notAuthenticated();
+    }
+    if (options.all) {
+      if (options.env || options.file) {
+        error("Cannot use --env or --file with --all.");
+        process.exit(1);
+      }
+      await pullAllProjects(options);
+      return;
+    }
+    if (options.project) {
+      const configV2 = readProjectConfigV2();
+      if (!configV2) throw notInitialized();
+      const project = resolveProject(configV2, options.project);
+      if (!project) {
+        error(`Project not found: ${options.project}`);
+        console.log();
+        console.log("Linked projects:");
+        for (const p of configV2.projects) {
+          console.log(`  ${p.projectName || p.projectId} (${p.environment})`);
+        }
+        process.exit(1);
+      }
+      await pullSingleProject(project, options);
+      return;
+    }
+    const projectConfig = readProjectConfig();
+    if (!projectConfig) throw notInitialized();
+    checkTrackedFiles();
+    const environment = options.env || projectConfig.environment || "development";
+    const fmt = options.format || "env";
+    if (!ALL_FORMATS.includes(fmt)) {
+      error(`Unknown format: ${fmt}. Supported: ${ALL_FORMATS.join(", ")}`);
+      process.exit(1);
+    }
+    const outputPath = options.file || (fmt === "env" ? getEnvPathForEnvironment(environment) : getDefaultFilename(fmt, environment));
+    await pullProject(
+      {
+        projectId: projectConfig.projectId,
+        organizationId: projectConfig.organizationId,
+        environment
+      },
+      outputPath,
+      options
+    );
+  } catch (err) {
+    await handleError(err);
+  }
+});
+async function pullAllProjects(options) {
+  const configV2 = readProjectConfigV2();
+  if (!configV2) throw notInitialized();
+  checkTrackedFiles();
+  let totalPulled = 0;
+  let totalFailed = 0;
+  for (const project of configV2.projects) {
+    const outputPath = getEnvPathForEnvironment(project.environment);
+    const displayName = project.projectName || project.projectId;
+    console.log();
+    console.log(
+      chalk6.bold(
+        `Pulling "${displayName}" (${project.environment}) \u2192 ${outputPath}`
+      )
+    );
+    try {
+      await pullProject(
+        {
+          projectId: project.projectId,
+          organizationId: project.organizationId,
+          environment: project.environment
+        },
+        outputPath,
+        options
+      );
+      totalPulled++;
+    } catch (err) {
+      totalFailed++;
+      if (err instanceof Error) {
+        error(`  Failed: ${err.message}`);
+      }
+    }
+  }
+  console.log();
+  if (totalFailed === 0) {
+    success(`Pulled ${totalPulled} project${totalPulled !== 1 ? "s" : ""}`);
+  } else {
+    warning(
+      `Pulled ${totalPulled}/${totalPulled + totalFailed} projects. ${totalFailed} failed.`
+    );
+  }
+}
+async function pullSingleProject(project, options) {
+  checkTrackedFiles();
+  const environment = options.env || project.environment;
+  const fmt = options.format || "env";
+  const outputPath = options.file || (fmt === "env" ? getEnvPathForEnvironment(environment) : getDefaultFilename(fmt, environment));
+  await pullProject(
+    {
+      projectId: project.projectId,
+      organizationId: project.organizationId,
+      environment
+    },
+    outputPath,
+    options
+  );
+}
+async function pullProject(project, outputPath, options) {
+  const api = createAPIClient();
+  let metaProjectRole;
+  const variables = await withSpinner(
+    `Fetching ${chalk6.bold(project.environment)} variables...`,
+    async () => {
+      const response = await api.get("/api/cli/variables", {
+        projectId: project.projectId,
+        environment: project.environment,
+        ...project.organizationId && {
+          organizationId: project.organizationId
+        }
+      });
+      metaProjectRole = response.meta?.projectRole;
+      return response.data || [];
+    }
+  );
+  if (variables.length === 0) {
+    warning(`No variables found for ${project.environment} environment.`);
+    return;
+  }
+  const remoteVars = {};
+  for (const variable of variables) {
+    remoteVars[variable.key] = variable.value;
+  }
+  const localVars = readEnvFile(outputPath) || {};
+  const diffResult = diffEnvVars(remoteVars, localVars);
+  const hasChanges = Object.keys(diffResult.added).length > 0 || Object.keys(diffResult.removed).length > 0 || Object.keys(diffResult.changed).length > 0;
+  if (!hasChanges) {
+    success("Local file is up to date.");
+    return;
+  }
+  console.log();
+  console.log(chalk6.bold("Changes:"));
+  console.log();
+  diff(diffResult.added, diffResult.removed, diffResult.changed);
+  console.log();
+  if (options.dryRun) {
+    info("Dry run - no changes written.");
+    return;
+  }
+  if (!options.force && Object.keys(localVars).length > 0) {
+    const { proceed } = await inquirer2.prompt([
+      {
+        type: "confirm",
+        name: "proceed",
+        message: `Overwrite ${outputPath}?`,
+        default: true
+      }
+    ]);
+    if (!proceed) {
+      info("Pull cancelled.");
+      return;
+    }
+  }
+  try {
+    const fs = await import("fs");
+    if (fs.existsSync(outputPath)) {
+      fs.chmodSync(outputPath, 420);
+    }
+  } catch {
+  }
+  const fmt = options.format || "env";
+  if (fmt === "env") {
+    const comments = {};
+    for (const variable of variables) {
+      if (variable.description) {
+        comments[variable.key] = variable.description;
+      }
+    }
+    writeEnvFile(outputPath, remoteVars, { sort: true, comments });
+  } else {
+    const fs = await import("fs");
+    const output = serialize(remoteVars, fmt, {
+      projectName: project.projectId,
+      environment: project.environment,
+      prefix: options.prefix
+    });
+    fs.writeFileSync(outputPath, output, "utf-8");
+  }
+  const role = getRole();
+  applyFileProtection(outputPath, role, metaProjectRole);
+  success(
+    `Downloaded ${variables.length} variables to ${chalk6.bold(outputPath)}`
+  );
+  if (metaProjectRole === "viewer") {
+    info(
+      "You have Viewer access to this project. You may only see variables you have been explicitly granted access to."
+    );
+  }
+  const isProtected = role !== "admin" && role !== "team_lead" && metaProjectRole !== "manager";
+  if (isProtected) {
+    info(
+      `File is read-only (your role: ${role || metaProjectRole || "member"}).`
+    );
+  }
+  console.log();
+  console.log(chalk6.dim(`  Added:   ${Object.keys(diffResult.added).length}`));
+  console.log(
+    chalk6.dim(`  Changed: ${Object.keys(diffResult.changed).length}`)
+  );
+  console.log(
+    chalk6.dim(`  Removed: ${Object.keys(diffResult.removed).length}`)
+  );
+}
+function checkTrackedFiles() {
+  const trackedFiles = getTrackedEnvFiles();
+  if (trackedFiles.length > 0) {
+    error("Security risk: .env files are tracked by git!");
+    console.log();
+    for (const file of trackedFiles) {
+      console.log(chalk6.red(`  tracked: ${file}`));
+    }
+    console.log();
+    console.log(
+      chalk6.yellow(
+        "  Run the following to untrack them (without deleting the files):"
+      )
+    );
+    for (const file of trackedFiles) {
+      console.log(chalk6.cyan(`    git rm --cached ${file}`));
+    }
+    console.log();
+    process.exit(1);
+  }
+}
+
+// src/commands/push.ts
+import { Command as Command4 } from "commander";
+import chalk7 from "chalk";
+import inquirer3 from "inquirer";
+
+// src/lib/validators.ts
+import { z as z2 } from "zod";
+var envKeySchema = z2.string().min(1, "Key cannot be empty").max(256, "Key cannot exceed 256 characters").regex(
+  /^[A-Za-z_][A-Za-z0-9_]*$/,
+  "Key must start with a letter or underscore, followed by letters, numbers, or underscores"
+);
+var envValueSchema = z2.string().max(65536, "Value cannot exceed 64KB");
+var environmentSchema2 = z2.enum([
+  "development",
+  "staging",
+  "production"
+]);
+var projectSlugSchema = z2.string().min(1, "Slug cannot be empty").max(128, "Slug cannot exceed 128 characters").regex(
+  /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/,
+  "Slug must be lowercase alphanumeric with hyphens, cannot start or end with hyphen"
+);
+var urlSchema = z2.string().url("Must be a valid URL");
+var tokenSchema = z2.string().min(1, "Token cannot be empty").regex(/^env_[A-Za-z0-9]{48}$/, "Invalid token format");
+var filePathSchema = z2.string().min(1, "File path cannot be empty");
+function validateEnvVars(vars) {
+  const valid = {};
+  const invalid = [];
+  for (const [key, value] of Object.entries(vars)) {
+    const keyResult = envKeySchema.safeParse(key);
+    const valueResult = envValueSchema.safeParse(value);
+    if (!keyResult.success) {
+      invalid.push({ key, error: keyResult.error.issues[0].message });
+      continue;
+    }
+    if (!valueResult.success) {
+      invalid.push({ key, error: valueResult.error.issues[0].message });
+      continue;
+    }
+    valid[key] = value;
+  }
+  return { valid, invalid };
+}
+
+// src/commands/push.ts
+var pushCommand = new Command4("push").description("Upload local .env file to cloud").option(
+  "-e, --env <environment>",
+  "Target environment (development, staging, production)"
+).option("-f, --file <path>", "Input file path (default: .env)").option("--merge", "Merge with existing variables (default)").option("--replace", "Replace all existing variables").option(
+  "--format <format>",
+  "Input format: env, json, yaml, docker-compose, aws, vercel, netlify",
+  "env"
+).option(
+  "--prefix <prefix>",
+  "AWS Parameter Store path prefix (default: /project-name)"
+).option("--dry-run", "Show what would be uploaded without making changes").option("--force", "Skip confirmation").option("--project <name-or-id>", "Push to a specific linked project").action(async (options) => {
+  try {
+    if (!isAuthenticated()) {
+      throw notAuthenticated();
+    }
+    let projectId;
+    let organizationId;
+    let defaultEnvironment;
+    if (options.project) {
+      const configV2 = readProjectConfigV2();
+      if (!configV2) throw notInitialized();
+      const resolved = resolveProject(configV2, options.project);
+      if (!resolved) {
+        error(`Project not found: ${options.project}`);
+        console.log();
+        console.log("Linked projects:");
+        for (const p of configV2.projects) {
+          console.log(`  ${p.projectName || p.projectId} (${p.environment})`);
+        }
+        process.exit(1);
+      }
+      projectId = resolved.projectId;
+      organizationId = resolved.organizationId;
+      defaultEnvironment = resolved.environment;
+    } else {
+      const projectConfig = readProjectConfig();
+      if (!projectConfig) throw notInitialized();
+      projectId = projectConfig.projectId;
+      organizationId = projectConfig.organizationId;
+      defaultEnvironment = projectConfig.environment;
+    }
+    const trackedFiles = getTrackedEnvFiles();
+    if (trackedFiles.length > 0) {
+      error("Security risk: .env files are tracked by git!");
+      console.log();
+      for (const file of trackedFiles) {
+        console.log(chalk7.red(`  tracked: ${file}`));
+      }
+      console.log();
+      console.log(
+        chalk7.yellow(
+          "  Run the following to untrack them (without deleting the files):"
+        )
+      );
+      for (const file of trackedFiles) {
+        console.log(chalk7.cyan(`    git rm --cached ${file}`));
+      }
+      console.log();
+      process.exit(1);
+    }
+    const api = createAPIClient();
+    const projects = await api.get("/api/cli/projects", { organizationId });
+    const currentProject = projects.data?.find((p) => p._id === projectId);
+    const projectRole = currentProject?.projectRole;
+    if (projectRole === "viewer") {
+      error(
+        "Unfortunately, as a member, you cannot push in any environment. Please access or request access to your team lead."
+      );
+      process.exit(1);
+    }
+    const role = getRole();
+    if (role === "member") {
+      warning(
+        "You have Member access. Push will create pending requests that require Admin or Team Lead approval."
+      );
+      console.log();
+      if (!options.force) {
+        const { proceed } = await inquirer3.prompt([
+          {
+            type: "confirm",
+            name: "proceed",
+            message: "Continue with creating approval requests?",
+            default: true
+          }
+        ]);
+        if (!proceed) {
+          info("Push cancelled.");
+          return;
+        }
+      }
+    }
+    const environment = options.env || defaultEnvironment || "development";
+    const fmt = options.format || "env";
+    if (!ALL_FORMATS.includes(fmt)) {
+      error(`Unknown format: ${fmt}. Supported: ${ALL_FORMATS.join(", ")}`);
+      process.exit(1);
+    }
+    const inputPath = options.file || (fmt === "env" ? getEnvPathForEnvironment(environment) : getDefaultFilename(fmt, environment));
+    const mode = options.replace ? "replace" : "merge";
+    let localVars;
+    if (fmt === "env") {
+      localVars = readEnvFile(inputPath);
+    } else {
+      const { readFileSync: readFileSync4, existsSync: existsSync4 } = await import("fs");
+      if (!existsSync4(inputPath)) {
+        localVars = null;
+      } else {
+        const content = readFileSync4(inputPath, "utf-8");
+        localVars = parse(content, fmt, { prefix: options.prefix });
+      }
+    }
+    if (!localVars) {
+      throw fileNotFound(inputPath);
+    }
+    if (Object.keys(localVars).length === 0) {
+      warning(`No variables found in ${inputPath}`);
+      return;
+    }
+    const { valid, invalid } = validateEnvVars(localVars);
+    if (invalid.length > 0) {
+      warning("Some variables have invalid keys and will be skipped:");
+      for (const { key, error: err } of invalid) {
+        console.log(chalk7.red(`  ${key}: ${err}`));
+      }
+      console.log();
+    }
+    if (Object.keys(valid).length === 0) {
+      error("No valid variables to push.");
+      return;
+    }
+    const remoteVariables = await withSpinner(
+      "Fetching current variables...",
+      async () => {
+        const params = {
+          projectId,
+          environment
+        };
+        if (organizationId) {
+          params.organizationId = organizationId;
+        }
+        const response = await api.get("/api/cli/variables", params);
+        return response.data || [];
+      }
+    );
+    const remoteVars = {};
+    for (const variable of remoteVariables) {
+      remoteVars[variable.key] = variable.value;
+    }
+    const diffResult = diffEnvVars(valid, remoteVars);
+    const hasChanges = Object.keys(diffResult.added).length > 0 || Object.keys(diffResult.changed).length > 0 || mode === "replace" && Object.keys(diffResult.removed).length > 0;
+    if (!hasChanges) {
+      success("Remote is up to date.");
+      return;
+    }
+    console.log();
+    console.log(chalk7.bold("Changes to push:"));
+    console.log();
+    const removedToShow = mode === "replace" ? diffResult.removed : {};
+    diff(diffResult.added, removedToShow, diffResult.changed);
+    if (mode === "merge" && Object.keys(diffResult.removed).length > 0) {
+      console.log();
+      console.log(
+        chalk7.dim(
+          `Note: ${Object.keys(diffResult.removed).length} remote variables not in local file will be preserved (use --replace to remove them)`
+        )
+      );
+    }
+    console.log();
+    if (options.dryRun) {
+      info("Dry run - no changes made.");
+      console.log();
+      console.log("Summary:");
+      console.log(`  Would add:    ${Object.keys(diffResult.added).length}`);
+      console.log(
+        `  Would update: ${Object.keys(diffResult.changed).length}`
+      );
+      if (mode === "replace") {
+        console.log(
+          `  Would delete: ${Object.keys(diffResult.removed).length}`
+        );
+      }
+      return;
+    }
+    if (!options.force) {
+      const confirmMessage = mode === "replace" ? `Push ${Object.keys(valid).length} variables and delete ${Object.keys(diffResult.removed).length} remote-only variables?` : `Push ${Object.keys(valid).length} variables to ${environment}?`;
+      const { proceed } = await inquirer3.prompt([
+        {
+          type: "confirm",
+          name: "proceed",
+          message: confirmMessage,
+          default: true
+        }
+      ]);
+      if (!proceed) {
+        info("Push cancelled.");
+        return;
+      }
+    }
+    const result = await withSpinner(
+      `Pushing variables to ${chalk7.bold(environment)}...`,
+      async () => {
+        const response = await api.post("/api/cli/variables/bulk", {
+          projectId,
+          environment,
+          variables: Object.entries(valid).map(([key, value]) => ({
+            key,
+            value
+          })),
+          mode,
+          ...organizationId && { organizationId }
+        });
+        return response.data;
+      }
+    );
+    if (result?.requested && result.requested > 0) {
+      success(
+        `Created ${result.requested} pending request(s) for ${chalk7.bold(environment)}`
+      );
+      console.log();
+      console.log(
+        chalk7.yellow(
+          "  These changes require approval from an Admin or Team Lead."
+        )
+      );
+      console.log();
+      console.log(chalk7.dim(`  Requested: ${result.requested}`));
+      if (result?.skipped && result.skipped > 0) {
+        console.log(chalk7.dim(`  Skipped:   ${result.skipped}`));
+      }
+    } else {
+      success(
+        `Pushed ${result?.total || Object.keys(valid).length} variables to ${chalk7.bold(environment)}`
+      );
+      console.log();
+      console.log(chalk7.dim(`  Created: ${result?.created || 0}`));
+      console.log(chalk7.dim(`  Updated: ${result?.updated || 0}`));
+      if (mode === "replace") {
+        console.log(chalk7.dim(`  Deleted: ${result?.deleted || 0}`));
+      }
+    }
+  } catch (err) {
+    await handleError(err);
+  }
+});
+
+// src/commands/switch.ts
+import { Command as Command5 } from "commander";
+import chalk8 from "chalk";
+import inquirer4 from "inquirer";
+var switchCommand = new Command5("switch").description("Switch project, environment, or active linked project").argument("[target]", "project slug or environment name").option("-o, --organization <id>", "Switch organization").option("-p, --project <id>", "Switch project").option(
+  "-e, --env <environment>",
+  "Switch environment (development, staging, production)"
+).option("--active <name-or-id>", "Set a linked project as active").action(async (target, options) => {
+  try {
+    if (!isAuthenticated()) {
+      throw notAuthenticated();
+    }
+    const api = createAPIClient();
+    const projectConfig = readProjectConfig();
+    if (options.active) {
+      const configV2 = readProjectConfigV2();
+      if (!configV2 || configV2.projects.length < 2) {
+        error(
+          "No multiple projects linked. Use `envpilot init --add` to link another project."
+        );
+        process.exit(1);
+      }
+      const target2 = configV2.projects.find(
+        (p) => p.projectId === options.active || p.projectName.toLowerCase() === options.active.toLowerCase()
+      );
+      if (!target2) {
+        error(`Project not found: ${options.active}`);
+        console.log();
+        console.log("Linked projects:");
+        for (const p of configV2.projects) {
+          const mark = p.projectId === configV2.activeProjectId ? chalk8.green(" *") : "";
+          console.log(
+            `  ${p.projectName || p.projectId} (${p.environment})${mark}`
+          );
+        }
+        process.exit(1);
+      }
+      const updated = setActiveProjectInConfig(configV2, target2.projectId);
+      writeProjectConfigV2(updated);
+      setActiveProjectId(target2.projectId);
+      setActiveOrganizationId(target2.organizationId);
+      success(
+        `Active project: ${chalk8.bold(target2.projectName || target2.projectId)}`
+      );
+      return;
+    }
+    if (options.env || target && ["development", "staging", "production"].includes(target)) {
+      const environment = options.env || target;
+      if (!projectConfig) {
+        error("No project initialized. Run `envpilot init` first.");
+        process.exit(1);
+      }
+      updateProjectConfig({ environment });
+      success(`Switched to ${chalk8.bold(environment)} environment`);
+      return;
+    }
+    if (options.organization) {
+      const organizations = await withSpinner(
+        "Fetching organizations...",
+        async () => {
+          const response = await api.get("/api/cli/organizations");
+          return response.data || [];
+        }
+      );
+      const org = organizations.find(
+        (o) => o._id === options.organization || o.slug === options.organization
+      );
+      if (!org) {
+        error(`Organization not found: ${options.organization}`);
+        process.exit(1);
+      }
+      setActiveOrganizationId(org._id);
+      if (org.role) {
+        setRole(org.role);
+      }
+      if (projectConfig) {
+        updateProjectConfig({ organizationId: org._id });
+      }
+      success(`Switched to organization: ${chalk8.bold(org.name)}`);
+      if (org.role) {
+        console.log(chalk8.dim(`  Role: ${formatRole(org.role)}`));
+        roleNotice(org.role);
+      }
+      return;
+    }
+    if (options.project || target) {
+      const projectIdentifier = options.project || target;
+      const configV2 = readProjectConfigV2();
+      if (configV2) {
+        const linked = configV2.projects.find(
+          (p) => p.projectId === projectIdentifier || p.projectName.toLowerCase() === projectIdentifier.toLowerCase()
+        );
+        if (linked) {
+          const updated = setActiveProjectInConfig(
+            configV2,
+            linked.projectId
+          );
+          writeProjectConfigV2(updated);
+          setActiveProjectId(linked.projectId);
+          setActiveOrganizationId(linked.organizationId);
+          success(
+            `Switched to project: ${chalk8.bold(linked.projectName || linked.projectId)}`
+          );
+          return;
+        }
+      }
+      let organizationId = projectConfig?.organizationId;
+      if (!organizationId) {
+        const organizations = await withSpinner(
+          "Fetching organizations...",
+          async () => {
+            const response = await api.get("/api/cli/organizations");
+            return response.data || [];
+          }
+        );
+        if (organizations.length === 0) {
+          error("No organizations found.");
+          process.exit(1);
+        }
+        if (organizations.length === 1) {
+          organizationId = organizations[0]._id;
+          if (organizations[0].role) {
+            setRole(organizations[0].role);
+          }
+        } else {
+          const { orgId } = await inquirer4.prompt([
+            {
+              type: "list",
+              name: "orgId",
+              message: "Select an organization:",
+              choices: organizations.map((org) => ({
+                name: `${org.name} ${org.tier === "pro" ? chalk8.green("(Pro)") : chalk8.dim("(Free)")}`,
+                value: org._id
+              }))
+            }
+          ]);
+          organizationId = orgId;
+          const selectedOrg = organizations.find((o) => o._id === orgId);
+          if (selectedOrg?.role) {
+            setRole(selectedOrg.role);
+          }
+        }
+      }
+      const projects = await withSpinner("Fetching projects...", async () => {
+        const response = await api.get("/api/cli/projects", { organizationId });
+        return response.data || [];
+      });
+      const project = projects.find(
+        (p) => p._id === projectIdentifier || p.slug === projectIdentifier
+      );
+      if (!project) {
+        error(`Project not found: ${projectIdentifier}`);
+        console.log();
+        console.log("Available projects:");
+        for (const p of projects) {
+          console.log(`  ${p.icon || "\u{1F4E6}"} ${p.name} (${p.slug})`);
+        }
+        process.exit(1);
+      }
+      setActiveProjectId(project._id);
+      setActiveOrganizationId(organizationId);
+      const environment = projectConfig?.environment || "development";
+      writeProjectConfig({
+        projectId: project._id,
+        organizationId,
+        environment
+      });
+      success(`Switched to project: ${chalk8.bold(project.name)}`);
+      if (project.projectRole) {
+        console.log(
+          chalk8.dim(
+            `  Project role: ${formatProjectRole(project.projectRole)}`
+          )
+        );
+        projectRoleNotice(project.projectRole);
+      }
+      return;
+    }
+    if (!target && !options.project && !options.organization && !options.env && !options.active) {
+      const configV2 = readProjectConfigV2();
+      const hasMultipleProjects = configV2 && configV2.projects.length > 1;
+      const choices = [];
+      if (hasMultipleProjects) {
+        choices.push({
+          name: "Active project",
+          value: "active"
+        });
+      }
+      choices.push(
+        { name: "Environment", value: "environment" },
+        { name: "Project", value: "project" },
+        { name: "Organization", value: "organization" }
+      );
+      const { switchType } = await inquirer4.prompt([
+        {
+          type: "list",
+          name: "switchType",
+          message: "What would you like to switch?",
+          choices
+        }
+      ]);
+      if (switchType === "active" && configV2) {
+        const { projectId } = await inquirer4.prompt([
+          {
+            type: "list",
+            name: "projectId",
+            message: "Select active project:",
+            choices: configV2.projects.map((p) => {
+              const isActive = p.projectId === configV2.activeProjectId;
+              return {
+                name: `${p.projectName || p.projectId} (${p.environment})${isActive ? chalk8.green(" *current") : ""}`,
+                value: p.projectId
+              };
+            }),
+            default: configV2.activeProjectId
+          }
+        ]);
+        const selected = configV2.projects.find(
+          (p) => p.projectId === projectId
+        );
+        const updated = setActiveProjectInConfig(configV2, projectId);
+        writeProjectConfigV2(updated);
+        setActiveProjectId(projectId);
+        setActiveOrganizationId(selected.organizationId);
+        success(
+          `Active project: ${chalk8.bold(selected.projectName || selected.projectId)}`
+        );
+        return;
+      }
+      if (switchType === "environment") {
+        if (!projectConfig) {
+          error("No project initialized. Run `envpilot init` first.");
+          process.exit(1);
+        }
+        const { environment } = await inquirer4.prompt([
+          {
+            type: "list",
+            name: "environment",
+            message: "Select environment:",
+            choices: [
+              { name: "Development", value: "development" },
+              { name: "Staging", value: "staging" },
+              { name: "Production", value: "production" }
+            ],
+            default: projectConfig.environment
+          }
+        ]);
+        updateProjectConfig({ environment });
+        success(`Switched to ${chalk8.bold(environment)} environment`);
+        return;
+      }
+      if (switchType === "organization" || switchType === "project") {
+        const organizations = await withSpinner(
+          "Fetching organizations...",
+          async () => {
+            const response = await api.get("/api/cli/organizations");
+            return response.data || [];
+          }
+        );
+        if (organizations.length === 0) {
+          error("No organizations found.");
+          process.exit(1);
+        }
+        const { orgId } = await inquirer4.prompt([
+          {
+            type: "list",
+            name: "orgId",
+            message: "Select an organization:",
+            choices: organizations.map((org) => ({
+              name: `${org.name} ${org.tier === "pro" ? chalk8.green("(Pro)") : chalk8.dim("(Free)")}`,
+              value: org._id
+            })),
+            default: projectConfig?.organizationId
+          }
+        ]);
+        if (switchType === "organization") {
+          setActiveOrganizationId(orgId);
+          const org = organizations.find((o) => o._id === orgId);
+          if (org.role) {
+            setRole(org.role);
+          }
+          success(`Switched to organization: ${chalk8.bold(org.name)}`);
+          if (org.role) {
+            console.log(chalk8.dim(`  Role: ${formatRole(org.role)}`));
+            roleNotice(org.role);
+          }
+          return;
+        }
+        const selectedOrg = organizations.find((o) => o._id === orgId);
+        if (selectedOrg?.role) {
+          setRole(selectedOrg.role);
+        }
+        const projects = await withSpinner(
+          "Fetching projects...",
+          async () => {
+            const response = await api.get("/api/cli/projects", { organizationId: orgId });
+            return response.data || [];
+          }
+        );
+        if (projects.length === 0) {
+          error("No projects found in this organization.");
+          process.exit(1);
+        }
+        const { projectId } = await inquirer4.prompt([
+          {
+            type: "list",
+            name: "projectId",
+            message: "Select a project:",
+            choices: projects.map((project2) => ({
+              name: `${project2.icon || "\u{1F4E6}"} ${project2.name}`,
+              value: project2._id
+            })),
+            default: projectConfig?.projectId
+          }
+        ]);
+        const project = projects.find((p) => p._id === projectId);
+        const environment = projectConfig?.environment || "development";
+        setActiveProjectId(projectId);
+        setActiveOrganizationId(orgId);
+        writeProjectConfig({
+          projectId,
+          organizationId: orgId,
+          environment
+        });
+        success(`Switched to project: ${chalk8.bold(project.name)}`);
+        if (project.projectRole) {
+          console.log(
+            chalk8.dim(
+              `  Project role: ${formatProjectRole(project.projectRole)}`
+            )
+          );
+          projectRoleNotice(project.projectRole);
+        }
+      }
+    }
+  } catch (err) {
+    await handleError(err);
+  }
+});
+
+// src/commands/list.ts
+import { Command as Command6 } from "commander";
+import chalk9 from "chalk";
+var listCommand = new Command6("list").description("List resources").argument(
+  "[resource]",
+  "Resource type: projects, organizations, variables, linked",
+  "projects"
+).option("-o, --organization <id>", "Organization ID (for projects/variables)").option("-p, --project <id>", "Project ID (for variables)").option("-e, --env <environment>", "Environment filter (for variables)").option("-t, --tag <name>", "Filter by tag name (for variables)").option("--show-values", "Show actual variable values (masked by default)").option("--json", "Output as JSON").action(async (resource, options) => {
+  try {
+    if (!isAuthenticated()) {
+      throw notAuthenticated();
+    }
+    const api = createAPIClient();
+    const projectConfig = readProjectConfig();
+    switch (resource) {
+      case "orgs":
+      case "organizations":
+        await listOrganizations(api, options);
+        break;
+      case "projects":
+        await listProjects(api, projectConfig, options);
+        break;
+      case "vars":
+      case "variables":
+        await listVariables(api, projectConfig, options);
+        break;
+      case "linked":
+        listLinked();
+        break;
+      default:
+        error(`Unknown resource: ${resource}`);
+        console.log();
+        console.log("Available resources:");
+        console.log("  organizations (orgs)  List your organizations");
+        console.log(
+          "  projects              List projects in an organization"
+        );
+        console.log("  variables (vars)      List variables in a project");
+        console.log(
+          "  linked                List projects linked in this directory"
+        );
+        process.exit(1);
+    }
+  } catch (err) {
+    await handleError(err);
+  }
+});
+function listLinked() {
+  const configV2 = readProjectConfigV2();
+  if (!configV2) {
+    info("No projects linked. Run `envpilot init` to get started.");
+    return;
+  }
+  header(`Linked Projects (${configV2.projects.length})`);
+  console.log();
+  for (const project of configV2.projects) {
+    const isActive = project.projectId === configV2.activeProjectId;
+    const marker = isActive ? chalk9.green("*") : " ";
+    const envFile = getEnvPathForEnvironment(project.environment);
+    console.log(
+      `  ${marker} ${chalk9.bold(project.projectName || project.projectId)} ${chalk9.dim(`(${project.organizationName || project.organizationId})`)}`
+    );
+    console.log(`    ${project.environment} ${chalk9.dim("\u2192")} ${envFile}`);
+    console.log();
+  }
+  if (configV2.projects.length > 1) {
+    console.log(chalk9.dim("  (* = active project)"));
+    console.log();
+    console.log(
+      chalk9.dim(
+        '  Use `envpilot switch --active "<name>"` to change the active project'
+      )
+    );
+  }
+}
+async function listOrganizations(api, options) {
+  const organizations = await withSpinner(
+    "Fetching organizations...",
+    async () => {
+      const response = await api.get("/api/cli/organizations");
+      return response.data || [];
+    }
+  );
+  if (organizations.length === 0) {
+    info("No organizations found.");
+    return;
+  }
+  if (options.json) {
+    console.log(JSON.stringify(organizations, null, 2));
+    return;
+  }
+  header("Organizations");
+  console.log();
+  table(
+    organizations.map((org) => ({
+      name: org.name,
+      slug: org.slug,
+      tier: org.tier === "pro" ? chalk9.green("Pro") : chalk9.dim("Free"),
+      role: org.role
+    })),
+    [
+      { key: "name", header: "Name" },
+      { key: "slug", header: "Slug" },
+      { key: "tier", header: "Tier" },
+      { key: "role", header: "Role" }
+    ]
+  );
+}
+async function listProjects(api, projectConfig, options) {
+  let organizationId = options.organization || projectConfig?.organizationId;
+  if (!organizationId) {
+    const organizations = await withSpinner(
+      "Fetching organizations...",
+      async () => {
+        const response = await api.get("/api/cli/organizations");
+        return response.data || [];
+      }
+    );
+    if (organizations.length === 0) {
+      info("No organizations found.");
+      return;
+    }
+    if (organizations.length === 1) {
+      organizationId = organizations[0]._id;
+    } else {
+      info("Multiple organizations found. Use --organization to specify one.");
+      console.log();
+      for (const org of organizations) {
+        console.log(`  ${org.name} (${org.slug}): --organization ${org._id}`);
+      }
+      return;
+    }
+  }
+  const projects = await withSpinner("Fetching projects...", async () => {
+    const response = await api.get(
+      "/api/cli/projects",
+      { organizationId }
+    );
+    return response.data || [];
+  });
+  if (projects.length === 0) {
+    info("No projects found.");
+    return;
+  }
+  if (options.json) {
+    console.log(JSON.stringify(projects, null, 2));
+    return;
+  }
+  header("Projects");
+  console.log();
+  table(
+    projects.map((project) => ({
+      icon: project.icon || "\u{1F4E6}",
+      name: project.name,
+      slug: project.slug,
+      description: project.description || chalk9.dim("-"),
+      role: project.userRole === "admin" ? formatRole("admin") : formatProjectRole(project.projectRole),
+      active: projectConfig?.projectId === project._id ? chalk9.green("\u2713") : ""
+    })),
+    [
+      { key: "icon", header: "" },
+      { key: "name", header: "Name" },
+      { key: "slug", header: "Slug" },
+      { key: "description", header: "Description", width: 30 },
+      { key: "role", header: "Role" },
+      { key: "active", header: "" }
+    ]
+  );
+  const role = getRole();
+  if (role) {
+    console.log();
+    console.log(chalk9.dim(`Your org role: ${formatRole(role)}`));
+  }
+}
+async function listVariables(api, projectConfig, options) {
+  const projectId = options.project || projectConfig?.projectId;
+  const environment = options.env || projectConfig?.environment;
+  if (!projectId) {
+    error("No project specified. Use --project or run `envpilot init` first.");
+    process.exit(1);
+  }
+  let metaProjectRole;
+  const variables = await withSpinner("Fetching variables...", async () => {
+    const params = { projectId };
+    if (environment) {
+      params.environment = environment;
+    }
+    const response = await api.get("/api/cli/variables", params);
+    metaProjectRole = response.meta?.projectRole;
+    return response.data || [];
+  });
+  const tagFilter = options.tag?.toLowerCase();
+  const filtered = tagFilter ? variables.filter(
+    (v) => v.tags?.some((t) => t.name.toLowerCase() === tagFilter)
+  ) : variables;
+  if (filtered.length === 0) {
+    info(
+      `No variables found${environment ? ` for ${environment}` : ""}${tagFilter ? ` with tag "${options.tag}"` : ""}.`
+    );
+    return;
+  }
+  if (options.json) {
+    const output = filtered.map((v) => ({
+      ...v,
+      value: options.showValues ? v.value : maskValue(v.value)
+    }));
+    console.log(JSON.stringify(output, null, 2));
+    return;
+  }
+  header(
+    `Variables${environment ? ` (${environment})` : ""}${tagFilter ? ` [tag: ${options.tag}]` : ""}`
+  );
+  console.log();
+  const hasTags = filtered.some((v) => v.tags && v.tags.length > 0);
+  table(
+    filtered.map((variable) => ({
+      key: variable.key,
+      value: options.showValues ? variable.value : maskValue(variable.value),
+      sensitive: variable.isSensitive ? chalk9.yellow("\u25CF") : "",
+      tags: hasTags ? variable.tags?.map((t) => t.name).join(", ") || chalk9.dim("-") : "",
+      version: `v${variable.version}`
+    })),
+    [
+      { key: "key", header: "Key" },
+      { key: "value", header: "Value", width: 40 },
+      { key: "sensitive", header: "" },
+      ...hasTags ? [{ key: "tags", header: "Tags", width: 25 }] : [],
+      { key: "version", header: "Ver" }
+    ]
+  );
+  console.log();
+  console.log(chalk9.dim(`Total: ${filtered.length} variables`));
+  const role = getRole();
+  if (role) {
+    console.log(chalk9.dim(`Your org role: ${formatRole(role)}`));
+  }
+  if (metaProjectRole) {
+    console.log(
+      chalk9.dim(`Your project role: ${formatProjectRole(metaProjectRole)}`)
+    );
+  }
+  if (role === "member" || metaProjectRole === "viewer") {
+    console.log(
+      chalk9.dim("You may only see variables you have been granted access to.")
+    );
+  }
+  if (!options.showValues) {
+    console.log(chalk9.dim("Use --show-values to see actual values"));
+  }
+}
+
+// src/commands/config.ts
+import { Command as Command7 } from "commander";
+import chalk10 from "chalk";
+var configCommand = new Command7("config").description("Manage CLI configuration").argument("[action]", "Action: get, set, list, path, reset").argument("[key]", "Config key (for get/set)").argument("[value]", "Config value (for set)").action(async (action, key, value) => {
+  try {
+    switch (action) {
+      case "get":
+        await handleGet(key);
+        break;
+      case "set":
+        await handleSet(key, value);
+        break;
+      case "list":
+      case void 0:
+        await handleList();
+        break;
+      case "path":
+        await handlePath();
+        break;
+      case "reset":
+        await handleReset();
+        break;
+      default:
+        error(`Unknown action: ${action}`);
+        console.log();
+        console.log("Available actions:");
+        console.log("  list          Show all configuration");
+        console.log("  get <key>     Get a specific config value");
+        console.log("  set <key> <value>  Set a config value");
+        console.log("  path          Show config file locations");
+        console.log("  reset         Reset all configuration");
+        process.exit(1);
+    }
+  } catch (err) {
+    await handleError(err);
+  }
+});
+async function handleGet(key) {
+  if (!key) {
+    error("Missing key. Usage: envpilot config get <key>");
+    console.log();
+    console.log("Available keys:");
+    console.log("  apiUrl              API endpoint URL");
+    console.log("  user                Current authenticated user");
+    console.log("  activeProjectId     Currently active project");
+    console.log("  activeOrganizationId Currently active organization");
+    process.exit(1);
+  }
+  const config2 = getConfig();
+  switch (key) {
+    case "apiUrl":
+      console.log(config2.apiUrl);
+      break;
+    case "user":
+      if (config2.user) {
+        console.log(JSON.stringify(config2.user, null, 2));
+      } else {
+        console.log(chalk10.dim("(not set)"));
+      }
+      break;
+    case "activeProjectId":
+      console.log(config2.activeProjectId || chalk10.dim("(not set)"));
+      break;
+    case "activeOrganizationId":
+      console.log(config2.activeOrganizationId || chalk10.dim("(not set)"));
+      break;
+    default:
+      error(`Unknown key: ${key}`);
+      process.exit(1);
+  }
+}
+async function handleSet(key, value) {
+  if (!key || value === void 0) {
+    error("Missing key or value. Usage: envpilot config set <key> <value>");
+    console.log();
+    console.log("Settable keys:");
+    console.log("  apiUrl    API endpoint URL");
+    process.exit(1);
+  }
+  switch (key) {
+    case "apiUrl":
+      try {
+        new URL(value);
+      } catch {
+        error("Invalid URL format");
+        process.exit(1);
+      }
+      setApiUrl(value);
+      success(`Set apiUrl to ${value}`);
+      break;
+    default:
+      error(`Cannot set key: ${key}`);
+      console.log();
+      console.log("Settable keys:");
+      console.log("  apiUrl    API endpoint URL");
+      process.exit(1);
+  }
+}
+async function handleList() {
+  const config2 = getConfig();
+  const projectConfig = readProjectConfig();
+  header("Global Configuration");
+  console.log();
+  keyValue([
+    ["API URL", config2.apiUrl],
+    ["Authenticated", isAuthenticated() ? chalk10.green("Yes") : chalk10.red("No")],
+    ["User", config2.user?.email],
+    ["Active Organization", config2.activeOrganizationId],
+    ["Active Project", config2.activeProjectId]
+  ]);
+  console.log();
+  if (projectConfig) {
+    header("Project Configuration (.envpilot)");
+    console.log();
+    keyValue([
+      ["Project ID", projectConfig.projectId],
+      ["Organization ID", projectConfig.organizationId],
+      ["Environment", projectConfig.environment]
+    ]);
+    console.log();
+  } else {
+    info("No project configuration found in current directory.");
+    console.log();
+  }
+}
+async function handlePath() {
+  header("Configuration Paths");
+  console.log();
+  keyValue([
+    ["Global config", getConfigPath()],
+    ["Project config", getProjectConfigPath()]
+  ]);
+}
+async function handleReset() {
+  const inquirer6 = await import("inquirer");
+  const { confirm } = await inquirer6.default.prompt([
+    {
+      type: "confirm",
+      name: "confirm",
+      message: "Are you sure you want to reset all configuration? This will log you out.",
+      default: false
+    }
+  ]);
+  if (!confirm) {
+    info("Reset cancelled.");
+    return;
+  }
+  clearConfig();
+  success("Configuration reset.");
+}
+
+// src/commands/logout.ts
+import { Command as Command8 } from "commander";
+var logoutCommand = new Command8("logout").description("Log out from Envpilot").action(async () => {
+  try {
+    if (!isAuthenticated()) {
+      info("You are not logged in.");
+      return;
+    }
+    const user = getUser();
+    const api = createAPIClient();
+    try {
+      await api.post("/api/cli/auth?action=revoke", {});
+    } catch {
+    }
+    clearAuth();
+    success(`Logged out${user?.email ? ` from ${user.email}` : ""}`);
+  } catch (err) {
+    await handleError(err);
+  }
+});
+
+// src/commands/unlink.ts
+import { Command as Command9 } from "commander";
+import chalk11 from "chalk";
+import inquirer5 from "inquirer";
+var unlinkCommand = new Command9("unlink").description("Remove a linked project from this directory").argument("[project]", "Project name or ID to unlink").option("--force", "Skip confirmation").action(async (projectArg, options) => {
+  try {
+    if (!isAuthenticated()) {
+      throw notAuthenticated();
+    }
+    const config2 = readProjectConfigV2();
+    if (!config2 || config2.projects.length === 0) {
+      error("No projects linked. Run `envpilot init` first.");
+      process.exit(1);
+    }
+    let targetProject;
+    if (projectArg) {
+      targetProject = resolveProject(config2, projectArg);
+      if (!targetProject) {
+        error(`Project not found: ${projectArg}`);
+        console.log();
+        console.log("Linked projects:");
+        for (const p of config2.projects) {
+          console.log(
+            `  ${p.projectName || p.projectId} (${p.organizationName || p.organizationId})`
+          );
+        }
+        process.exit(1);
+      }
+    } else if (config2.projects.length > 1) {
+      const { projectId } = await inquirer5.prompt([
+        {
+          type: "list",
+          name: "projectId",
+          message: "Select a project to unlink:",
+          choices: config2.projects.map((p) => {
+            const isActive = p.projectId === config2.activeProjectId;
+            return {
+              name: `${p.projectName || p.projectId} (${p.organizationName || p.organizationId})${isActive ? chalk11.green(" *active") : ""}`,
+              value: p.projectId
+            };
+          })
+        }
+      ]);
+      targetProject = config2.projects.find((p) => p.projectId === projectId);
+    } else {
+      targetProject = config2.projects[0];
+    }
+    const displayName = targetProject.projectName || targetProject.projectId;
+    if (!options.force) {
+      const { proceed } = await inquirer5.prompt([
+        {
+          type: "confirm",
+          name: "proceed",
+          message: `Unlink "${displayName}"? Your .env files won't be deleted.`,
+          default: false
+        }
+      ]);
+      if (!proceed) {
+        info("Unlink cancelled.");
+        return;
+      }
+    }
+    const updated = removeProjectFromConfig(config2, targetProject.projectId);
+    if (!updated) {
+      deleteProjectConfig();
+      success(`Unlinked "${displayName}". No projects remaining.`);
+      info("Run `envpilot init` to link a new project.");
+    } else {
+      writeProjectConfigV2(updated);
+      const newActive = getActiveProject(updated);
+      if (newActive) {
+        setActiveProjectId(newActive.projectId);
+      }
+      success(`Unlinked "${displayName}".`);
+      if (config2.activeProjectId === targetProject.projectId && newActive) {
+        info(
+          `Active project switched to "${newActive.projectName || newActive.projectId}".`
+        );
+      }
+      console.log(
+        chalk11.dim(
+          `  ${updated.projects.length} project${updated.projects.length !== 1 ? "s" : ""} remaining`
+        )
+      );
+    }
+  } catch (err) {
+    await handleError(err);
+  }
+});
+
+// src/commands/sync.ts
+import { Command as Command10 } from "commander";
+import chalk12 from "chalk";
+
+// src/lib/commit-guard.ts
+import {
+  existsSync as existsSync3,
+  readFileSync as readFileSync3,
+  writeFileSync as writeFileSync3,
+  mkdirSync,
+  chmodSync as chmodSync2,
+  unlinkSync as unlinkSync2,
+  statSync
+} from "fs";
+import { join as join3, resolve as resolve2 } from "path";
+import { execSync as execSync2 } from "child_process";
+var HOOK_START_MARKER = "# ENVPILOT_GUARD_START";
+var HOOK_END_MARKER = "# ENVPILOT_GUARD_END";
+var HOOK_BLOCK = `${HOOK_START_MARKER} - Do not remove. Installed by Envpilot CLI.
+ENV_FILES=$(git diff --cached --name-only | grep -E '(^|/)\\.env($|\\.)' || true)
+if [ -n "$ENV_FILES" ]; then
+  echo ""
+  echo "\\033[1;31mERROR:\\033[0m Envpilot commit guard blocked this commit."
+  echo ""
+  echo "The following .env files were staged:"
+  echo "$ENV_FILES" | while IFS= read -r f; do echo "  - $f"; done
+  echo ""
+  echo "Remove them with: git reset HEAD <file>"
+  echo "To bypass (not recommended): git commit --no-verify"
+  exit 1
+fi
+${HOOK_END_MARKER}`;
+function findGitRoot(startDir) {
+  let dir = startDir || process.cwd();
+  while (true) {
+    if (existsSync3(join3(dir, ".git"))) {
+      return dir;
+    }
+    const parent = resolve2(dir, "..");
+    if (parent === dir) {
+      return null;
+    }
+    dir = parent;
+  }
+}
+function resolveGitDir(repoRoot) {
+  const gitPath = join3(repoRoot, ".git");
+  try {
+    const stat = statSync(gitPath);
+    if (stat.isDirectory()) {
+      return gitPath;
+    }
+  } catch {
+    return gitPath;
+  }
+  try {
+    const content = readFileSync3(gitPath, "utf-8").trim();
+    const match = content.match(/^gitdir:\s*(.+)$/);
+    if (match) {
+      const gitdir = resolve2(repoRoot, match[1]);
+      const commonDir = resolve2(gitdir, "..", "..");
+      if (existsSync3(join3(commonDir, "hooks")) || existsSync3(commonDir)) {
+        return commonDir;
+      }
+      return gitdir;
+    }
+  } catch {
+  }
+  return gitPath;
+}
+function getHooksDir(repoRoot) {
+  try {
+    const customPath = execSync2("git config core.hooksPath", {
+      cwd: repoRoot,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    if (customPath) {
+      return resolve2(repoRoot, customPath);
+    }
+  } catch {
+  }
+  const gitDir = resolveGitDir(repoRoot);
+  return join3(gitDir, "hooks");
+}
+function installCommitGuard(repoRoot) {
+  const root = repoRoot || findGitRoot();
+  if (!root) {
+    return {
+      installed: false,
+      hookPath: null,
+      message: "Not a git repository"
+    };
+  }
+  try {
+    const hooksDir = getHooksDir(root);
+    const hookPath = join3(hooksDir, "pre-commit");
+    mkdirSync(hooksDir, { recursive: true });
+    let existingContent = "";
+    try {
+      existingContent = readFileSync3(hookPath, "utf-8");
+    } catch {
+    }
+    if (existingContent.includes(HOOK_START_MARKER)) {
+      const startIdx = existingContent.indexOf(HOOK_START_MARKER);
+      const endIdx = existingContent.indexOf(HOOK_END_MARKER) + HOOK_END_MARKER.length;
+      const updated = existingContent.substring(0, startIdx) + HOOK_BLOCK + existingContent.substring(endIdx);
+      writeFileSync3(hookPath, updated, "utf-8");
+      chmodSync2(hookPath, 493);
+      return {
+        installed: true,
+        hookPath,
+        message: "Pre-commit hook updated"
+      };
+    }
+    let newContent;
+    if (existingContent.trim()) {
+      newContent = existingContent.trimEnd() + "\n\n" + HOOK_BLOCK + "\n";
+    } else {
+      newContent = "#!/bin/sh\n\n" + HOOK_BLOCK + "\n";
+    }
+    writeFileSync3(hookPath, newContent, "utf-8");
+    chmodSync2(hookPath, 493);
+    return {
+      installed: true,
+      hookPath,
+      message: "Pre-commit hook installed"
+    };
+  } catch (err) {
+    return {
+      installed: false,
+      hookPath: null,
+      message: `Failed to install hook: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+}
+
+// src/commands/sync.ts
+var syncCommand = new Command10("sync").description(
+  "Login, select project, pull variables, and protect files \u2014 all in one command"
+).option("-o, --organization <id>", "Organization ID").option("-p, --project <id>", "Project ID or name").option(
+  "-e, --env <environment>",
+  "Environment (development, staging, production)"
+).option("--force", "Overwrite without confirmation").option("--no-guard", "Skip pre-commit hook installation").action(async (options) => {
+  try {
+    if (!isAuthenticated()) {
+      console.log();
+      info("Not logged in. Starting authentication...");
+      console.log();
+      await performLogin();
+      console.log();
+    } else {
+      info("Already authenticated.");
+    }
+    ensureEnvInGitignore();
+    if (options.guard !== false) {
+      const guardResult = installCommitGuard();
+      if (guardResult.installed) {
+        success(guardResult.message);
+        info("Staged .env files will be blocked from commits.");
+      } else if (guardResult.message !== "Not a git repository") {
+        warning(guardResult.message);
+      }
+    }
+    console.log();
+    let projectId;
+    let organizationId;
+    let environment;
+    let projectName;
+    let organizationName;
+    const existingConfig = readProjectConfigV2();
+    if (existingConfig && !options.organization && !options.project && !options.env) {
+      const active = getActiveProject(existingConfig);
+      if (active) {
+        projectId = active.projectId;
+        organizationId = active.organizationId;
+        environment = active.environment;
+        projectName = active.projectName;
+        organizationName = active.organizationName;
+        info(
+          `Using project ${chalk12.bold(projectName || projectId)} (${environment})`
+        );
+      } else {
+        const selection = await selectOrgProjectEnv(options);
+        projectId = selection.selectedProject._id;
+        organizationId = selection.selectedOrg._id;
+        environment = selection.selectedEnvironment;
+        projectName = selection.selectedProject.name;
+        organizationName = selection.selectedOrg.name;
+      }
+    } else {
+      const selection = await selectOrgProjectEnv({
+        organization: options.organization,
+        project: options.project,
+        environment: options.env
+      });
+      projectId = selection.selectedProject._id;
+      organizationId = selection.selectedOrg._id;
+      environment = selection.selectedEnvironment;
+      projectName = selection.selectedProject.name;
+      organizationName = selection.selectedOrg.name;
+      if (selection.selectedOrg.role) {
+        setRole(selection.selectedOrg.role);
+      }
+      writeProjectConfigV2({
+        version: 1,
+        activeProjectId: projectId,
+        projects: existingConfig ? [
+          ...existingConfig.projects.filter(
+            (p) => p.projectId !== projectId
+          ),
+          {
+            projectId,
+            organizationId,
+            projectName,
+            organizationName,
+            environment
+          }
+        ] : [
+          {
+            projectId,
+            organizationId,
+            projectName,
+            organizationName,
+            environment
+          }
+        ]
+      });
+      setActiveOrganizationId(organizationId);
+      setActiveProjectId(projectId);
+    }
+    console.log();
+    let metaProjectRole;
+    const variables = await withSpinner(
+      `Fetching ${chalk12.bold(environment)} variables...`,
+      async () => {
+        const api = createAPIClient();
+        const response = await api.get("/api/cli/variables", {
+          projectId,
+          environment,
+          ...organizationId && { organizationId }
+        });
+        metaProjectRole = response.meta?.projectRole;
+        return response.data || [];
+      }
+    );
+    const outputPath = getEnvPathForEnvironment(environment);
+    if (variables.length === 0) {
+      warning(`No variables found for ${environment} environment.`);
+      console.log();
+      return;
+    }
+    const remoteVars = {};
+    for (const variable of variables) {
+      remoteVars[variable.key] = variable.value;
+    }
+    const localVars = readEnvFile(outputPath) || {};
+    const diffResult = diffEnvVars(remoteVars, localVars);
+    const hasChanges = Object.keys(diffResult.added).length > 0 || Object.keys(diffResult.removed).length > 0 || Object.keys(diffResult.changed).length > 0;
+    if (!hasChanges) {
+      success(`${chalk12.bold(outputPath)} is up to date.`);
+      console.log();
+      return;
+    }
+    console.log();
+    console.log(chalk12.bold("Changes:"));
+    console.log();
+    diff(diffResult.added, diffResult.removed, diffResult.changed);
+    console.log();
+    try {
+      const fs = await import("fs");
+      if (fs.existsSync(outputPath)) {
+        fs.chmodSync(outputPath, 420);
+      }
+    } catch {
+    }
+    const comments = {};
+    for (const variable of variables) {
+      if (variable.description) {
+        comments[variable.key] = variable.description;
+      }
+    }
+    writeEnvFile(outputPath, remoteVars, { sort: true, comments });
+    const role = getRole();
+    applyFileProtection(outputPath, role, metaProjectRole);
+    success(
+      `Synced ${variables.length} variables to ${chalk12.bold(outputPath)}`
+    );
+    const isProtected = role !== "admin" && role !== "team_lead" && metaProjectRole !== "manager";
+    if (isProtected) {
+      info(
+        `File is read-only (your role: ${role || metaProjectRole || "member"}).`
+      );
+    }
+    console.log();
+    console.log(
+      chalk12.dim(`  Added:   ${Object.keys(diffResult.added).length}`)
+    );
+    console.log(
+      chalk12.dim(`  Changed: ${Object.keys(diffResult.changed).length}`)
+    );
+    console.log(
+      chalk12.dim(`  Removed: ${Object.keys(diffResult.removed).length}`)
+    );
+    console.log();
+  } catch (err) {
+    await handleError(err);
+  }
+});
+
+// src/commands/usage.ts
+import { Command as Command11 } from "commander";
+import chalk13 from "chalk";
+function formatUsage(current, limit) {
+  const limitStr = limit === null ? "unlimited" : String(limit);
+  const ratio = `${current}/${limitStr}`;
+  if (limit === null) return chalk13.green(ratio);
+  if (current >= limit) return chalk13.red(ratio);
+  if (current >= limit * 0.8) return chalk13.yellow(ratio);
+  return chalk13.green(ratio);
+}
+function featureStatus(enabled) {
+  return enabled ? chalk13.green("Enabled") : chalk13.dim("Disabled (Pro)");
+}
+var usageCommand = new Command11("usage").description("Show plan usage and limits for the active organization").option("-o, --organization <id>", "Organization ID").option("--json", "Output as JSON").action(async (options) => {
+  try {
+    if (!isAuthenticated()) {
+      throw notAuthenticated();
+    }
+    const api = createAPIClient();
+    const projectConfig = readProjectConfig();
+    let organizationId = options.organization || projectConfig?.organizationId || getActiveOrganizationId();
+    if (!organizationId) {
+      const orgs = await withSpinner(
+        "Fetching organizations...",
+        async () => {
+          const response = await api.get("/api/cli/organizations");
+          return response.data || [];
+        }
+      );
+      if (orgs.length === 0) {
+        error("No organizations found.");
+        process.exit(1);
+      }
+      if (orgs.length === 1) {
+        organizationId = orgs[0]._id;
+      } else {
+        error(
+          "Multiple organizations found. Use --organization to specify one."
+        );
+        console.log();
+        for (const org of orgs) {
+          console.log(
+            `  ${org.name} (${org.slug}): --organization ${org._id}`
+          );
+        }
+        process.exit(1);
+      }
+    }
+    const usage = await withSpinner(
+      "Fetching usage...",
+      () => api.getUsage(organizationId)
+    );
+    if (options.json) {
+      console.log(JSON.stringify(usage, null, 2));
+      return;
+    }
+    const tierLabel = usage.tier === "pro" ? chalk13.green("Pro") : chalk13.white("Free");
+    header(`Plan: ${tierLabel}`);
+    blank();
+    if (!usage.enforcementEnabled) {
+      info("Pre-alpha mode \u2014 all limits are bypassed. Billing coming soon.");
+      blank();
+    }
+    header("Resource Usage");
+    blank();
+    keyValue([
+      ["Projects", formatUsage(usage.usage.projects, usage.limits.projects)],
+      [
+        "Team Members",
+        formatUsage(usage.usage.teamMembers, usage.limits.teamMembers)
+      ],
+      ["Pending Invitations", String(usage.usage.pendingInvitations)],
+      ["Total Variables", String(usage.usage.totalVariables)]
+    ]);
+    blank();
+    if (usage.usage.variablesPerProject.length > 0) {
+      header("Variables per Project");
+      blank();
+      table(
+        usage.usage.variablesPerProject.map((p) => ({
+          project: p.projectName,
+          variables: formatUsage(p.count, usage.limits.variablesPerProject)
+        })),
+        [
+          { key: "project", header: "Project" },
+          { key: "variables", header: "Variables" }
+        ]
+      );
+      blank();
+    }
+    header("Features");
+    blank();
+    keyValue([
+      ["Version History", featureStatus(usage.features.versionHistory)],
+      ["Bulk Import", featureStatus(usage.features.bulkImport)],
+      [
+        "Granular Permissions",
+        featureStatus(usage.features.granularPermissions)
+      ],
+      ["Extension Access", featureStatus(usage.features.extensionAccess)],
+      ["Audit Log Retention", `${usage.features.auditLogRetentionDays} days`]
+    ]);
+    blank();
+  } catch (err) {
+    await handleError(err);
+  }
+});
+
+// src/commands/whoami.ts
+import { Command as Command12 } from "commander";
+import chalk14 from "chalk";
+var whoamiCommand = new Command12("whoami").description("Show the current authenticated user and active CLI context").action(async () => {
+  try {
+    if (!isAuthenticated()) {
+      throw notAuthenticated();
+    }
+    const api = createAPIClient();
+    const remoteUser = await api.getCurrentUser();
+    const localUser = getUser();
+    const linkedConfig = readProjectConfigV2();
+    const activeProject = linkedConfig ? getActiveProject(linkedConfig) : null;
+    header("Current Session");
+    blank();
+    keyValue([
+      ["Email", remoteUser.email],
+      ["Name", remoteUser.name || localUser?.name],
+      ["API URL", getApiUrl()],
+      ["Active Organization", getActiveOrganizationId()],
+      ["Active Project", getActiveProjectId()],
+      [
+        "Linked Project",
+        activeProject?.projectName || activeProject?.projectId
+      ],
+      ["Environment", activeProject?.environment]
+    ]);
+    blank();
+    console.log(chalk14.dim("Token verified against the CLI auth endpoint."));
+  } catch (err) {
+    await handleError(err);
+  }
+});
+
+// src/commands/man.ts
+import { Command as Command13 } from "commander";
+import chalk15 from "chalk";
+function printCommandManual(commandName) {
+  const command = findCommandDefinition(commandName);
+  if (!command) {
+    console.log(chalk15.red(`Unknown command reference: ${commandName}`));
+    console.log();
+    console.log("Run `envpilot man` to see all supported commands.");
+    process.exit(1);
+  }
+  console.log(chalk15.bold(formatArgv(command.argv)));
+  if (command.args) {
+    console.log(chalk15.dim(command.args));
+  }
+  blank();
+  console.log(command.description);
+  blank();
+  console.log(chalk15.green("Examples"));
+  for (const example of command.examples) {
+    console.log(`  ${chalk15.cyan(formatArgv(example))}`);
+  }
+  blank();
+  console.log(chalk15.green("Notes"));
+  for (const note of command.notes) {
+    console.log(`  - ${note}`);
+  }
+}
+function printManualIndex(commands) {
+  console.log(chalk15.bold("ENVPILOT(1)"));
+  console.log("TypeScript CLI manual");
+  blank();
+  console.log(
+    `Total supported top-level commands: ${chalk15.green(String(CLI_COMMAND_COUNT))}`
+  );
+  blank();
+  console.log(
+    "The CLI is implemented in TypeScript, uses an Ink terminal UI, and keeps env files out of git with both `.gitignore` and an optional pre-commit guard."
+  );
+  blank();
+  line();
+  console.log(chalk15.green("Commands"));
+  for (const command of commands) {
+    console.log(
+      `  ${chalk15.cyan(formatArgv(command.argv).padEnd(24))} ${chalk15.dim(command.description)}`
+    );
+  }
+  blank();
+  line();
+  console.log(chalk15.green("Security"));
+  console.log("  - `.env*` is ignored by the repository `.gitignore`.");
+  console.log(
+    "  - `envpilot init` and `envpilot sync` ensure env files are added to `.gitignore` locally."
+  );
+  console.log(
+    "  - `envpilot push` hard-blocks if tracked `.env` files are detected in git."
+  );
+  console.log(
+    "  - The CLI can install a pre-commit hook to stop staged env files from being committed."
+  );
+  blank();
+  line();
+  console.log(chalk15.green("Usage"));
+  console.log(
+    "  - `envpilot` or `envpilot ui` opens the interactive terminal UI."
+  );
+  console.log(
+    "  - `envpilot man <command>` shows details for a single command."
+  );
+}
+function createManCommand(commands) {
+  return new Command13("man").description("Show the CLI manual page").argument("[command]", "Optional command to show detailed manual for").action((command) => {
+    if (command) {
+      printCommandManual(command);
+      return;
+    }
+    printManualIndex(commands);
+  });
+}
+
+// src/commands/ui.ts
+import { Command as Command14 } from "commander";
+function createUICommand() {
+  return new Command14("ui").alias("dashboard").description("Open the interactive Ink-powered terminal UI").action(async () => {
+    if (process.env.ENVPILOT_TUI_CHILD === "1") {
+      return;
+    }
+    await openTUI();
+  });
+}
+
+// src/lib/command-catalog.ts
+function formatArgv(argv) {
+  return ["envpilot", ...argv].join(" ").trim();
+}
+function matchesArgv(argv, normalized) {
+  return formatArgv(argv).toLowerCase() === normalized || argv.join(" ").toLowerCase() === normalized;
+}
+var COMMAND_CATALOG = [
+  {
+    id: "open",
+    title: "Open interactive UI",
+    category: "Get Started",
+    description: "Open the Ink-powered terminal dashboard for discovering and running commands.",
+    argv: [],
+    aliases: [["ui"], ["dashboard"]],
+    examples: [[], ["ui"], ["dashboard"]],
+    websiteSurface: "Terminal-first dashboard aligned with the same auth, project, and variable surfaces as the website.",
+    notes: [
+      "This is the default when you run `envpilot` with no subcommand.",
+      "Supports search, keyboard navigation, and command launch."
+    ],
+    keywords: ["dashboard", "tui", "ink", "interactive"],
+    topLevel: true
+  },
+  {
+    id: "ui",
+    title: "Interactive UI command",
+    category: "Get Started",
+    description: "Open the interactive Ink-powered terminal UI.",
+    argv: ["ui"],
+    aliases: [["dashboard"]],
+    examples: [["ui"], ["dashboard"]],
+    websiteSurface: "First-class parsed command that launches the same Ink dashboard as bare `envpilot`.",
+    notes: [
+      "Use this when you want the UI explicitly instead of relying on the default no-arg launcher."
+    ],
+    keywords: ["dashboard", "tui", "ink"],
+    topLevel: true,
+    createCommand: createUICommand
+  },
+  {
+    id: "sync",
+    title: "Sync project",
+    category: "Sync",
+    description: "Authenticate, select a project, pull variables, and set up local protection in one flow.",
+    argv: ["sync"],
+    args: "[--organization <id>] [--project <id>] [--env <environment>]",
+    examples: [["sync"], ["sync", "--env", "production"]],
+    websiteSurface: "Uses the website CLI auth, organizations, projects, and variables endpoints.",
+    notes: [
+      "Best first-run workflow for local setup.",
+      "Reuses the existing login, init, and pull logic under the hood."
+    ],
+    keywords: ["login", "auth", "pull", "setup", "bootstrap"],
+    topLevel: true,
+    createCommand: () => syncCommand
+  },
+  {
+    id: "man",
+    title: "Manual page",
+    category: "Get Started",
+    description: "Show the CLI manual page with commands, workflows, and security guidance.",
+    argv: ["man"],
+    args: "[command]",
+    examples: [["man"], ["man", "pull"]],
+    websiteSurface: "Documents the implemented CLI surface from the same catalog used by the TUI and command registration.",
+    notes: [
+      "Use this to see the supported command set.",
+      "Supports per-command manual sections."
+    ],
+    keywords: ["manual", "docs", "help", "reference"],
+    topLevel: true,
+    createCommand: () => createManCommand(getTopLevelCommandCatalog())
+  },
+  {
+    id: "login",
+    title: "Login",
+    category: "Get Started",
+    description: "Authenticate the CLI against the Envpilot web app.",
+    argv: ["login"],
+    args: "[--api-url <url>] [--no-browser]",
+    examples: [["login"], ["login", "--no-browser"]],
+    websiteSurface: "Maps to `/api/cli/auth` and the `/cli/auth` browser flow.",
+    notes: [
+      "Opens the web authentication page by default.",
+      "Required before organization or project commands will work."
+    ],
+    keywords: ["signin", "authenticate", "browser"],
+    topLevel: true,
+    createCommand: () => loginCommand
+  },
+  {
+    id: "init",
+    title: "Initialize directory",
+    category: "Get Started",
+    description: "Link the current directory to a project and choose a default environment.",
+    argv: ["init"],
+    args: "[--organization <id>] [--project <id>] [--env <environment>]",
+    examples: [["init"], ["init", "--add"]],
+    websiteSurface: "Uses website-backed organization and project selection before writing local config.",
+    notes: [
+      "Creates or updates the local `.envpilot` file.",
+      "Supports linking multiple projects with `--add`."
+    ],
+    keywords: ["link", "directory", "project", "environment"],
+    topLevel: true,
+    createCommand: () => initCommand
+  },
+  {
+    id: "pull",
+    title: "Pull variables",
+    category: "Sync",
+    description: "Download project variables into a local file or export format.",
+    argv: ["pull"],
+    args: "[--env <environment>] [--file <path>] [--format <format>]",
+    examples: [["pull"], ["pull", "--env", "staging", "--dry-run"]],
+    websiteSurface: "Maps to `/api/cli/variables` for read access.",
+    notes: [
+      "Supports `.env`, JSON, YAML, Vercel, Netlify, AWS, and Docker Compose formats.",
+      "Can pull the active linked project or all linked projects."
+    ],
+    keywords: ["download", "export", "variables", "env"],
+    topLevel: true,
+    createCommand: () => pullCommand
+  },
+  {
+    id: "push",
+    title: "Push variables",
+    category: "Sync",
+    description: "Upload local variables back to Envpilot with approval-aware write behavior.",
+    argv: ["push"],
+    args: "[--env <environment>] [--file <path>] [--merge|--replace]",
+    examples: [["push"], ["push", "--replace"]],
+    websiteSurface: "Maps to `/api/cli/variables` and `/api/cli/variables/bulk` for writes.",
+    notes: [
+      "Managers/admins write directly; lower roles create requests for approval.",
+      "Compares local and remote variables before applying changes."
+    ],
+    keywords: ["upload", "bulk", "merge", "replace"],
+    topLevel: true,
+    createCommand: () => pushCommand
+  },
+  {
+    id: "list",
+    title: "List resources",
+    category: "Browse",
+    description: "List organizations, projects, variables, or linked projects from the terminal.",
+    argv: ["list"],
+    args: "[resource]",
+    examples: [["list"], ["list", "projects"], ["list", "variables"]],
+    websiteSurface: "Uses the CLI organizations, projects, and variables endpoints depending on the selected resource.",
+    notes: [
+      "Default resource is `projects`.",
+      "Use `linked` to inspect local `.envpilot` project links."
+    ],
+    keywords: ["browse", "organizations", "projects", "variables", "linked"],
+    topLevel: true,
+    createCommand: () => listCommand
+  },
+  {
+    id: "list-organizations",
+    title: "List organizations",
+    category: "Browse",
+    description: "List organizations available to the current user.",
+    argv: ["list", "organizations"],
+    aliases: [["list", "orgs"]],
+    examples: [
+      ["list", "organizations"],
+      ["list", "orgs", "--json"]
+    ],
+    websiteSurface: "Maps to `/api/cli/organizations`.",
+    notes: ["Useful for discovering organization IDs and roles."],
+    keywords: ["orgs", "organizations", "roles"]
+  },
+  {
+    id: "list-projects",
+    title: "List projects",
+    category: "Browse",
+    description: "Browse projects in the active organization.",
+    argv: ["list", "projects"],
+    args: "[--organization <id>] [--json]",
+    examples: [
+      ["list", "projects"],
+      ["list", "projects", "--json"]
+    ],
+    websiteSurface: "Maps to `/api/cli/projects`.",
+    notes: [
+      "Shows project roles when available.",
+      "Useful for selecting project IDs for automation and scripts."
+    ],
+    keywords: ["browse", "projects", "organization"]
+  },
+  {
+    id: "list-variables",
+    title: "List variables",
+    category: "Browse",
+    description: "Inspect variables for a project with environment and tag filtering.",
+    argv: ["list", "variables"],
+    aliases: [["list", "vars"]],
+    args: "[--project <id>] [--env <environment>] [--tag <name>]",
+    examples: [
+      ["list", "variables"],
+      ["list", "variables", "--env", "production", "--show-values"]
+    ],
+    websiteSurface: "Maps to `/api/cli/variables`.",
+    notes: [
+      "Values are masked by default.",
+      "Designed to mirror the web app\u2019s searchable variable surface."
+    ],
+    keywords: ["vars", "keys", "filter", "tags"]
+  },
+  {
+    id: "list-linked",
+    title: "List linked projects",
+    category: "Browse",
+    description: "Show projects linked in the current directory.",
+    argv: ["list", "linked"],
+    examples: [["list", "linked"]],
+    websiteSurface: "Local `.envpilot` configuration inspection.",
+    notes: ["Shows the active linked project and environment mapping."],
+    keywords: ["linked", "local", "project-config"]
+  },
+  {
+    id: "switch",
+    title: "Switch active target",
+    category: "Project",
+    description: "Switch the active organization, project, environment, or linked project.",
+    argv: ["switch"],
+    args: "[--organization <id>] [--project <id>] [--env <environment>] [--active <name-or-id>]",
+    examples: [
+      ["switch", "--env", "production"],
+      ["switch", "--active", "api"]
+    ],
+    websiteSurface: "Works against the same organization/project inventory returned by website APIs.",
+    notes: [
+      "Updates local CLI state without rewriting the whole project config.",
+      "Supports both linked projects and remote project lookup."
+    ],
+    keywords: ["active", "target", "environment", "organization"],
+    topLevel: true,
+    createCommand: () => switchCommand
+  },
+  {
+    id: "usage",
+    title: "Usage and limits",
+    category: "Browse",
+    description: "Inspect current plan usage and feature availability for the active organization.",
+    argv: ["usage"],
+    args: "[--organization <id>] [--json]",
+    examples: [["usage"], ["usage", "--json"]],
+    websiteSurface: "Maps to `/api/cli/usage` and `/api/cli/tier`.",
+    notes: [
+      "Shows project, member, and variable limits.",
+      "Useful for CLI feature-gate troubleshooting."
+    ],
+    keywords: ["plan", "limits", "billing", "tier"],
+    topLevel: true,
+    createCommand: () => usageCommand
+  },
+  {
+    id: "whoami",
+    title: "Current identity",
+    category: "Account",
+    description: "Show the authenticated user, API target, and current active CLI context.",
+    argv: ["whoami"],
+    examples: [["whoami"]],
+    websiteSurface: "Uses the same website CLI auth identity endpoint exposed to the terminal client.",
+    notes: [
+      "Validates the current access token against the website.",
+      "Useful for debugging stale auth or wrong API URL targets."
+    ],
+    keywords: ["user", "identity", "session", "auth"],
+    topLevel: true,
+    createCommand: () => whoamiCommand
+  },
+  {
+    id: "config",
+    title: "Config",
+    category: "Account",
+    description: "Inspect or update local CLI configuration such as the active API URL.",
+    argv: ["config"],
+    args: "[list|get|set|path|reset]",
+    examples: [["config"], ["config", "path"]],
+    websiteSurface: "Local-only state for the CLI shell, pointing at the same website backend.",
+    notes: [
+      "Useful for local development against non-production API URLs.",
+      "Shows both global and project-level config paths."
+    ],
+    keywords: ["settings", "path", "api", "state"],
+    topLevel: true,
+    createCommand: () => configCommand
+  },
+  {
+    id: "logout",
+    title: "Logout",
+    category: "Account",
+    description: "Revoke the current CLI session and clear local auth state.",
+    argv: ["logout"],
+    examples: [["logout"]],
+    websiteSurface: "Maps to `/api/cli/auth?action=revoke`.",
+    notes: [
+      "Best way to reset a stale CLI session cleanly.",
+      "Clears local tokens even if the revoke call fails."
+    ],
+    keywords: ["signout", "revoke", "session"],
+    topLevel: true,
+    createCommand: () => logoutCommand
+  },
+  {
+    id: "unlink",
+    title: "Unlink project",
+    category: "Project",
+    description: "Remove a linked project from the current directory without deleting local env files.",
+    argv: ["unlink"],
+    args: "[project] [--force]",
+    examples: [["unlink"], ["unlink", "api", "--force"]],
+    websiteSurface: "Local project-link management for website-backed projects.",
+    notes: [
+      "Updates `.envpilot` and active-project state.",
+      "Leaves existing `.env` files on disk."
+    ],
+    keywords: ["remove", "disconnect", "local"],
+    topLevel: true,
+    createCommand: () => unlinkCommand
+  }
+];
+var _topLevelCache = null;
+function getTopLevelCommandCatalog() {
+  if (!_topLevelCache) {
+    _topLevelCache = COMMAND_CATALOG.filter((command) => command.topLevel);
+  }
+  return _topLevelCache;
+}
+var CLI_COMMAND_COUNT = getTopLevelCommandCatalog().length;
+function findCommandDefinition(commandIdOrName) {
+  if (!commandIdOrName) {
+    return void 0;
+  }
+  const normalized = commandIdOrName.trim().toLowerCase();
+  return COMMAND_CATALOG.find((command) => {
+    if (command.id.toLowerCase() === normalized) {
+      return true;
+    }
+    if (matchesArgv(command.argv, normalized)) {
+      return true;
+    }
+    return command.aliases?.some((alias) => matchesArgv(alias, normalized));
+  });
+}
+
+export {
+  initSentry,
+  getApiUrl,
+  getUser,
+  isAuthenticated,
+  openTUI,
+  formatArgv,
+  getTopLevelCommandCatalog
+};