@envpilot/cli 1.4.1 → 1.6.0

package/dist/index.js

@@ -1,3550 +1,26 @@
 #!/usr/bin/env node
-
-// src/lib/sentry.ts
-import * as Sentry from "@sentry/node";
-var initialized = false;
-function initSentry() {
-  const dsn = true ? "" : "";
-  if (initialized || !dsn) return;
-  Sentry.init({
-    dsn,
-    environment: "cli",
-    release: true ? "1.4.1" : "0.0.0",
-    // Free tier: disable performance monitoring
-    tracesSampleRate: 0,
-    beforeSend(event) {
-      if (event.exception?.values) {
-        for (const exc of event.exception.values) {
-          if (exc.stacktrace?.frames) {
-            for (const frame of exc.stacktrace.frames) {
-              if (frame.filename) {
-                frame.filename = frame.filename.replace(
-                  /\/Users\/[^/]+/g,
-                  "/~"
-                );
-                frame.filename = frame.filename.replace(
-                  /C:\\Users\\[^\\]+/g,
-                  "C:\\~"
-                );
-              }
-            }
-          }
-        }
-      }
-      if (event.request?.data) {
-        event.request.data = "[REDACTED]";
-      }
-      return event;
-    }
-  });
-  initialized = true;
-}
-function captureError(error2, context) {
-  if (!initialized) return;
-  Sentry.captureException(error2, { tags: context });
-}
-async function flushSentry() {
-  if (!initialized) return;
-  await Sentry.flush(2e3);
-}
-
-// src/index.ts
-import { Command as Command12 } from "commander";
-
-// src/commands/login.ts
-import { Command } from "commander";
-
-// src/lib/ui.ts
-import chalk from "chalk";
-import ora from "ora";
-function createSpinner(text) {
-  return ora({
-    text,
-    color: "cyan"
-  });
-}
-async function withSpinner(text, operation, options) {
-  const spinner = createSpinner(text);
-  spinner.start();
-  try {
-    const result = await operation();
-    spinner.succeed(options?.successText ?? text);
-    return result;
-  } catch (error2) {
-    spinner.fail(options?.failText ?? text);
-    throw error2;
-  }
-}
-function success(message) {
-  console.log(chalk.green("\u2713"), message);
-}
-function info(message) {
-  console.log(chalk.blue("\u2139"), message);
-}
-function warning(message) {
-  console.log(chalk.yellow("\u26A0"), message);
-}
-function error(message) {
-  console.log(chalk.red("\u2717"), message);
-}
-function header(text) {
-  console.log();
-  console.log(chalk.bold(text));
-  console.log(chalk.dim("\u2500".repeat(text.length)));
-}
-function table(data, columns) {
-  if (data.length === 0) {
-    console.log(chalk.dim("No data to display"));
-    return;
-  }
-  const widths = columns.map((col) => {
-    const headerWidth = col.header.length;
-    const maxDataWidth = Math.max(
-      ...data.map((row) => String(row[col.key] ?? "").length)
-    );
-    return col.width ?? Math.max(headerWidth, maxDataWidth);
-  });
-  const headerLine = columns.map((col, i) => col.header.padEnd(widths[i])).join("  ");
-  console.log(chalk.bold(headerLine));
-  console.log(chalk.dim("\u2500".repeat(headerLine.length)));
-  for (const row of data) {
-    const line = columns.map((col, i) => String(row[col.key] ?? "").padEnd(widths[i])).join("  ");
-    console.log(line);
-  }
-}
-function keyValue(pairs) {
-  const maxKeyLength = Math.max(...pairs.map(([key]) => key.length));
-  for (const [key, value] of pairs) {
-    const paddedKey = key.padEnd(maxKeyLength);
-    console.log(`${chalk.dim(paddedKey)}  ${value ?? chalk.dim("(not set)")}`);
-  }
-}
-function diff(added, removed, changed) {
-  if (Object.keys(added).length === 0 && Object.keys(removed).length === 0 && Object.keys(changed).length === 0) {
-    console.log(chalk.dim("No changes"));
-    return;
-  }
-  for (const [key, value] of Object.entries(added)) {
-    console.log(chalk.green(`+ ${key}=${maskValue(value)}`));
-  }
-  for (const [key, value] of Object.entries(removed)) {
-    console.log(chalk.red(`- ${key}=${maskValue(value)}`));
-  }
-  for (const [key, { local, remote }] of Object.entries(changed)) {
-    console.log(chalk.red(`- ${key}=${maskValue(remote)}`));
-    console.log(chalk.green(`+ ${key}=${maskValue(local)}`));
-  }
-}
-function maskValue(value, showChars = 4) {
-  if (value.length <= showChars * 2) {
-    return "*".repeat(value.length);
-  }
-  return value.slice(0, showChars) + "****" + value.slice(-showChars);
-}
-function blank() {
-  console.log();
-}
-function formatRole(role) {
-  switch (role) {
-    case "admin":
-      return chalk.green("Admin");
-    case "team_lead":
-      return chalk.blue("Team Lead");
-    case "member":
-      return chalk.yellow("Member");
-    default:
-      return chalk.dim("Unknown");
-  }
-}
-function roleNotice(role) {
-  if (role === "member") {
-    console.log(
-      chalk.yellow(
-        "  You have Member access. Write operations will create pending requests for approval."
-      )
-    );
-  }
-}
-function formatProjectRole(role) {
-  switch (role) {
-    case "manager":
-      return chalk.green("Manager");
-    case "developer":
-      return chalk.blue("Developer");
-    case "viewer":
-      return chalk.yellow("Viewer");
-    default:
-      return chalk.dim("-");
-  }
-}
-function projectRoleNotice(projectRole) {
-  if (projectRole === "viewer") {
-    console.log(
-      chalk.yellow(
-        "  You have Viewer access to this project. You can only view variables you have been explicitly granted access to."
-      )
-    );
-  }
-}
-
-// src/lib/errors.ts
-import chalk2 from "chalk";
-var CLIError = class extends Error {
-  constructor(message, code, suggestion) {
-    super(message);
-    this.code = code;
-    this.suggestion = suggestion;
-    this.name = "CLIError";
-  }
-};
-var ErrorCodes = {
-  NOT_AUTHENTICATED: "NOT_AUTHENTICATED",
-  NOT_INITIALIZED: "NOT_INITIALIZED",
-  PROJECT_NOT_FOUND: "PROJECT_NOT_FOUND",
-  ORGANIZATION_NOT_FOUND: "ORGANIZATION_NOT_FOUND",
-  VARIABLE_NOT_FOUND: "VARIABLE_NOT_FOUND",
-  INVALID_CONFIG: "INVALID_CONFIG",
-  NETWORK_ERROR: "NETWORK_ERROR",
-  PERMISSION_DENIED: "PERMISSION_DENIED",
-  TIER_LIMIT_EXCEEDED: "TIER_LIMIT_EXCEEDED",
-  FILE_NOT_FOUND: "FILE_NOT_FOUND",
-  INVALID_INPUT: "INVALID_INPUT",
-  UNKNOWN_ERROR: "UNKNOWN_ERROR"
-};
-function formatError(error2) {
-  if (error2 instanceof CLIError) {
-    let message = chalk2.red(`Error: ${error2.message}`);
-    if (error2.suggestion) {
-      message += `
-${chalk2.yellow("Suggestion:")} ${error2.suggestion}`;
-    }
-    return message;
-  }
-  if (error2 instanceof Error) {
-    return chalk2.red(`Error: ${error2.message}`);
-  }
-  return chalk2.red(`Error: ${String(error2)}`);
-}
-async function handleError(error2) {
-  console.error(formatError(error2));
-  const skipCodes = /* @__PURE__ */ new Set([
-    ErrorCodes.NOT_AUTHENTICATED,
-    ErrorCodes.INVALID_INPUT,
-    ErrorCodes.NOT_INITIALIZED
-  ]);
-  if (error2 instanceof CLIError) {
-    if (!skipCodes.has(error2.code)) {
-      captureError(error2, { errorCode: error2.code });
-    }
-  } else {
-    captureError(error2);
-  }
-  await flushSentry();
-  if (error2 instanceof CLIError) {
-    switch (error2.code) {
-      case ErrorCodes.NOT_AUTHENTICATED:
-        process.exit(2);
-      case ErrorCodes.PERMISSION_DENIED:
-        process.exit(3);
-      case ErrorCodes.TIER_LIMIT_EXCEEDED:
-        process.exit(4);
-      default:
-        process.exit(1);
-    }
-  }
-  process.exit(1);
-}
-function notAuthenticated() {
-  return new CLIError(
-    "You are not authenticated.",
-    ErrorCodes.NOT_AUTHENTICATED,
-    "Run `envpilot login` to authenticate."
-  );
-}
-function notInitialized() {
-  return new CLIError(
-    "This directory is not initialized with Envpilot.",
-    ErrorCodes.NOT_INITIALIZED,
-    "Run `envpilot init` to initialize."
-  );
-}
-function fileNotFound(path) {
-  return new CLIError(`File not found: ${path}`, ErrorCodes.FILE_NOT_FOUND);
-}
-
-// src/lib/config.ts
-import Conf from "conf";
-var DEFAULT_API_URL = "https://www.envpilot.dev";
-var config = new Conf({
-  projectName: "envpilot",
-  defaults: {
-    apiUrl: DEFAULT_API_URL
-  }
-});
-function getConfig() {
-  return {
-    apiUrl: config.get("apiUrl") ?? DEFAULT_API_URL,
-    accessToken: config.get("accessToken"),
-    refreshToken: config.get("refreshToken"),
-    activeProjectId: config.get("activeProjectId"),
-    activeOrganizationId: config.get("activeOrganizationId"),
-    user: config.get("user"),
-    role: config.get("role")
-  };
-}
-function getApiUrl() {
-  return config.get("apiUrl") ?? DEFAULT_API_URL;
-}
-function setApiUrl(url) {
-  config.set("apiUrl", url);
-}
-function getAccessToken() {
-  return config.get("accessToken");
-}
-function setAccessToken(token) {
-  config.set("accessToken", token);
-}
-function setRefreshToken(token) {
-  config.set("refreshToken", token);
-}
-function setActiveProjectId(projectId) {
-  config.set("activeProjectId", projectId);
-}
-function getActiveOrganizationId() {
-  return config.get("activeOrganizationId");
-}
-function setActiveOrganizationId(organizationId) {
-  config.set("activeOrganizationId", organizationId);
-}
-function getUser() {
-  return config.get("user");
-}
-function setUser(user) {
-  config.set("user", user);
-}
-function getRole() {
-  return config.get("role");
-}
-function setRole(role) {
-  config.set("role", role);
-}
-function isAuthenticated() {
-  return !!config.get("accessToken");
-}
-function clearAuth() {
-  config.delete("accessToken");
-  config.delete("refreshToken");
-  config.delete("user");
-  config.delete("role");
-}
-function clearConfig() {
-  config.clear();
-}
-function getConfigPath() {
-  return config.path;
-}
-
-// src/lib/auth-flow.ts
-import open from "open";
-import chalk3 from "chalk";
-import { hostname } from "os";
-
-// src/lib/api.ts
-var APIError = class extends Error {
-  constructor(message, statusCode, code) {
-    super(message);
-    this.statusCode = statusCode;
-    this.code = code;
-    this.name = "APIError";
-  }
-};
-var APIClient = class {
-  baseUrl;
-  accessToken;
-  constructor(options) {
-    this.baseUrl = options?.baseUrl ?? getApiUrl();
-    this.accessToken = options?.accessToken ?? getAccessToken();
-  }
-  /**
-   * Get headers for API requests
-   */
-  getHeaders() {
-    const headers = {
-      "Content-Type": "application/json"
-    };
-    if (this.accessToken) {
-      headers["Authorization"] = `Bearer ${this.accessToken}`;
-    }
-    return headers;
-  }
-  /**
-   * Make a GET request
-   */
-  async get(path, params) {
-    const url = new URL(path, this.baseUrl);
-    if (params) {
-      for (const [key, value] of Object.entries(params)) {
-        url.searchParams.set(key, value);
-      }
-    }
-    const response = await fetch(url.toString(), {
-      method: "GET",
-      headers: this.getHeaders()
-    });
-    return this.handleResponse(response);
-  }
-  /**
-   * Make a POST request
-   */
-  async post(path, body) {
-    const url = new URL(path, this.baseUrl);
-    const response = await fetch(url.toString(), {
-      method: "POST",
-      headers: this.getHeaders(),
-      body: body ? JSON.stringify(body) : void 0
-    });
-    return this.handleResponse(response);
-  }
-  /**
-   * Make a PUT request
-   */
-  async put(path, body) {
-    const url = new URL(path, this.baseUrl);
-    const response = await fetch(url.toString(), {
-      method: "PUT",
-      headers: this.getHeaders(),
-      body: body ? JSON.stringify(body) : void 0
-    });
-    return this.handleResponse(response);
-  }
-  /**
-   * Make a PATCH request
-   */
-  async patch(path, body) {
-    const url = new URL(path, this.baseUrl);
-    const response = await fetch(url.toString(), {
-      method: "PATCH",
-      headers: this.getHeaders(),
-      body: body ? JSON.stringify(body) : void 0
-    });
-    return this.handleResponse(response);
-  }
-  /**
-   * Make a DELETE request
-   */
-  async delete(path) {
-    const url = new URL(path, this.baseUrl);
-    const response = await fetch(url.toString(), {
-      method: "DELETE",
-      headers: this.getHeaders()
-    });
-    if (!response.ok) {
-      await this.handleError(response);
-    }
-  }
-  /**
-   * Handle API response
-   */
-  async handleResponse(response) {
-    if (!response.ok) {
-      await this.handleError(response);
-    }
-    const contentType = response.headers.get("content-type") || "";
-    if (!contentType.includes("application/json")) {
-      const body2 = await response.text();
-      const preview = body2.replace(/\s+/g, " ").slice(0, 160);
-      throw new APIError(
-        `Expected JSON but got ${contentType || "unknown content type"} from ${response.url}. Response starts with: ${preview}`,
-        response.status || 500
-      );
-    }
-    const body = await response.text();
-    try {
-      const data = JSON.parse(body);
-      return data;
-    } catch {
-      const preview = body.replace(/\s+/g, " ").slice(0, 160);
-      throw new APIError(
-        `Failed to parse JSON response from ${response.url}. Response starts with: ${preview}`,
-        response.status || 500
-      );
-    }
-  }
-  /**
-   * Handle API errors
-   */
-  async handleError(response) {
-    let message = `Request failed with status ${response.status}`;
-    let code;
-    try {
-      const data = await response.json();
-      message = data.error || data.message || message;
-      code = data.code;
-    } catch {
-    }
-    if (response.status === 401) {
-      clearAuth();
-      throw new APIError(
-        "Authentication required. Please run `envpilot login`.",
-        401,
-        "UNAUTHORIZED"
-      );
-    }
-    if (response.status === 403 && code === "TIER_LIMIT_REACHED") {
-      throw new APIError(
-        message || "Tier limit reached. Run `envpilot usage` to see your plan limits.",
-        403,
-        "TIER_LIMIT_REACHED"
-      );
-    }
-    if (response.status === 403) {
-      throw new APIError(message || "Access denied.", 403, code || "FORBIDDEN");
-    }
-    if (response.status === 402) {
-      throw new APIError(
-        message || "Tier limit reached. Run `envpilot usage` to see your plan limits.",
-        402,
-        "PAYMENT_REQUIRED"
-      );
-    }
-    throw new APIError(message, response.status, code);
-  }
-  // ============================================
-  // High-level API methods
-  // ============================================
-  /**
-   * Get current user info
-   */
-  async getCurrentUser() {
-    return this.get("/api/cli/auth/me");
-  }
-  /**
-   * Get tier info for the active organization
-   */
-  async getTierInfo(organizationId) {
-    return this.get("/api/cli/tier", { organizationId });
-  }
-  /**
-   * Get usage info for the active organization
-   */
-  async getUsage(organizationId) {
-    return this.get("/api/cli/usage", { organizationId });
-  }
-  /**
-   * List organizations the user has access to
-   */
-  async listOrganizations() {
-    const response = await this.get(
-      "/api/cli/organizations"
-    );
-    return response.data || [];
-  }
-  /**
-   * List projects in an organization
-   */
-  async listProjects(organizationId) {
-    const response = await this.get(
-      "/api/cli/projects",
-      { organizationId }
-    );
-    return response.data || [];
-  }
-  /**
-   * Get a project by ID
-   */
-  async getProject(projectId) {
-    return this.get(`/api/cli/projects/${projectId}`);
-  }
-  /**
-   * List variables in a project
-   */
-  async listVariables(projectId, environment, organizationId) {
-    const params = { projectId };
-    if (environment) {
-      params.environment = environment;
-    }
-    if (organizationId) {
-      params.organizationId = organizationId;
-    }
-    const response = await this.get(
-      "/api/cli/variables",
-      params
-    );
-    return response.data || [];
-  }
-  /**
-   * Get a variable by ID (with decrypted value)
-   */
-  async getVariable(variableId) {
-    return this.get(`/api/cli/variables/${variableId}`);
-  }
-  /**
-   * Create a new variable
-   */
-  async createVariable(data) {
-    return this.post("/api/cli/variables", data);
-  }
-  /**
-   * Update a variable
-   */
-  async updateVariable(variableId, data) {
-    return this.patch(`/api/cli/variables/${variableId}`, data);
-  }
-  /**
-   * Delete a variable
-   */
-  async deleteVariable(variableId) {
-    return this.delete(`/api/cli/variables/${variableId}`);
-  }
-  /**
-   * Bulk create/update variables
-   */
-  async bulkUpsertVariables(data) {
-    return this.post("/api/cli/variables/bulk", data);
-  }
-  // ============================================
-  // Authentication methods
-  // ============================================
-  /**
-   * Initiate CLI authentication flow
-   */
-  async initiateAuth(deviceName) {
-    return this.post("/api/cli/auth/initiate", { deviceName });
-  }
-  /**
-   * Poll for authentication status
-   */
-  async pollAuth(code) {
-    return this.get("/api/cli/auth/poll", { code });
-  }
-  /**
-   * Refresh access token
-   */
-  async refreshToken(refreshToken) {
-    return this.post("/api/cli/auth/refresh", { refreshToken });
-  }
-  /**
-   * Revoke access token (logout)
-   */
-  async revokeToken() {
-    return this.post("/api/cli/auth/revoke", {});
-  }
-};
-function createAPIClient() {
-  return new APIClient();
-}
-
-// src/lib/auth-flow.ts
-var POLL_INTERVAL_MS = 2e3;
-var MAX_POLL_ATTEMPTS = 150;
-function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
-}
-async function performLogin(options) {
-  const api = createAPIClient();
-  const deviceName = `CLI - ${hostname()}`;
-  info("Starting authentication flow...");
-  const spinner = createSpinner("Generating authentication code...");
-  spinner.start();
-  const initResponse = await api.post("/api/cli/auth?action=initiate", { deviceName });
-  spinner.stop();
-  console.log();
-  console.log(chalk3.bold("Your authentication code:"));
-  console.log();
-  console.log(chalk3.cyan.bold(`    ${initResponse.code}`));
-  console.log();
-  console.log(`Open this URL to authenticate:`);
-  console.log(chalk3.dim(initResponse.url));
-  console.log();
-  if (options?.browser !== false) {
-    info("Opening browser...");
-    await open(initResponse.url);
-  }
-  const pollSpinner = createSpinner("Waiting for authentication...");
-  pollSpinner.start();
-  for (let attempts = 0; attempts < MAX_POLL_ATTEMPTS; attempts++) {
-    await sleep(POLL_INTERVAL_MS);
-    const pollResponse = await api.get("/api/cli/auth", { action: "poll", code: initResponse.code });
-    if (pollResponse.status === "authenticated") {
-      pollSpinner.stop();
-      if (pollResponse.accessToken) {
-        setAccessToken(pollResponse.accessToken);
-      }
-      if (pollResponse.refreshToken) {
-        setRefreshToken(pollResponse.refreshToken);
-      }
-      if (pollResponse.user) {
-        setUser({
-          id: pollResponse.user.id,
-          email: pollResponse.user.email,
-          name: pollResponse.user.name
-        });
-      }
-      console.log();
-      success(`Logged in as ${chalk3.bold(pollResponse.user?.email)}`);
-      return { email: pollResponse.user?.email || "" };
-    }
-    if (pollResponse.status === "expired" || pollResponse.status === "not_found") {
-      pollSpinner.stop();
-      throw new Error("Authentication code expired. Please try again.");
-    }
-  }
-  pollSpinner.stop();
-  throw new Error("Authentication timed out. Please try again.");
-}
-
-// src/commands/login.ts
-var loginCommand = new Command("login").description("Authenticate with Envpilot").option("--api-url <url>", "API URL (default: http://localhost:3000)").option("--no-browser", "Do not automatically open the browser").action(async (options) => {
-  try {
-    if (options.apiUrl) {
-      setApiUrl(options.apiUrl);
-    }
-    await performLogin({
-      browser: options.browser !== false
-    });
-    console.log();
-    console.log("Next steps:");
-    info("  envpilot init     Initialize a project in the current directory");
-    info("  envpilot list     List your projects and organizations");
-    info("  envpilot sync     Login, select project, and pull \u2014 all at once");
-    console.log();
-  } catch (err) {
-    await handleError(err);
-  }
-});
-
-// src/commands/init.ts
-import { Command as Command2 } from "commander";
-import chalk4 from "chalk";
-import inquirer from "inquirer";
-
-// src/lib/project-config.ts
-import { readFileSync, writeFileSync, existsSync, unlinkSync } from "fs";
-import { execSync } from "child_process";
-import { join } from "path";
-
-// src/types/index.ts
-import { z } from "zod";
-var userSchema = z.object({
-  id: z.string(),
-  email: z.string().email(),
-  name: z.string().optional()
-});
-var organizationSchema = z.object({
-  _id: z.string(),
-  name: z.string(),
-  slug: z.string(),
-  tier: z.enum(["free", "pro"]),
-  role: z.string().optional()
-});
-var projectSchema = z.object({
-  _id: z.string(),
-  name: z.string(),
-  slug: z.string(),
-  organizationId: z.string(),
-  description: z.string().optional(),
-  icon: z.string().optional(),
-  color: z.string().optional(),
-  userRole: z.string().nullable().optional(),
-  projectRole: z.string().nullable().optional()
-});
-var variableTagSchema = z.object({
-  _id: z.string(),
-  name: z.string(),
-  color: z.string()
-});
-var variableSchema = z.object({
-  _id: z.string(),
-  key: z.string(),
-  value: z.string(),
-  environment: z.enum(["development", "staging", "production"]),
-  projectId: z.string(),
-  description: z.string().optional(),
-  isSensitive: z.boolean().optional(),
-  version: z.number().optional(),
-  tags: z.array(variableTagSchema).optional()
-});
-var environmentSchema = z.enum([
-  "development",
-  "staging",
-  "production"
-]);
-var cliConfigSchema = z.object({
-  apiUrl: z.string().url(),
-  accessToken: z.string().optional(),
-  refreshToken: z.string().optional(),
-  activeProjectId: z.string().optional(),
-  activeOrganizationId: z.string().optional(),
-  user: userSchema.optional(),
-  role: z.enum(["admin", "team_lead", "member"]).optional()
-});
-var projectConfigSchema = z.object({
-  projectId: z.string(),
-  organizationId: z.string(),
-  environment: environmentSchema.default("development")
-});
-var projectEntrySchema = z.object({
-  projectId: z.string(),
-  organizationId: z.string(),
-  projectName: z.string().default(""),
-  organizationName: z.string().default(""),
-  environment: environmentSchema.default("development")
-});
-var projectConfigV2Schema = z.object({
-  version: z.literal(1),
-  activeProjectId: z.string(),
-  projects: z.array(projectEntrySchema).min(1)
-});
-
-// src/lib/project-config.ts
-var CONFIG_FILE_NAME = ".envpilot";
-function getProjectConfigPath(directory = process.cwd()) {
-  return join(directory, CONFIG_FILE_NAME);
-}
-function hasProjectConfig(directory = process.cwd()) {
-  return existsSync(getProjectConfigPath(directory));
-}
-function readRawConfig(directory = process.cwd()) {
-  const configPath = getProjectConfigPath(directory);
-  if (!existsSync(configPath)) return null;
-  try {
-    return JSON.parse(readFileSync(configPath, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function migrateV1toV2(v1) {
-  return {
-    version: 1,
-    activeProjectId: v1.projectId,
-    projects: [
-      {
-        projectId: v1.projectId,
-        organizationId: v1.organizationId,
-        projectName: "",
-        organizationName: "",
-        environment: v1.environment
-      }
-    ]
-  };
-}
-function readProjectConfigV2(directory = process.cwd()) {
-  const raw = readRawConfig(directory);
-  if (!raw || typeof raw !== "object") return null;
-  const rawVersion = raw.version;
-  if (rawVersion === 1 || rawVersion === 2) {
-    try {
-      const normalized = { ...raw, version: 1 };
-      const parsed = projectConfigV2Schema.parse(normalized);
-      if (rawVersion === 2) {
-        writeProjectConfigV2(parsed, directory);
-      }
-      return parsed;
-    } catch {
-      return null;
-    }
-  }
-  try {
-    const v1 = projectConfigSchema.parse(raw);
-    const v2 = migrateV1toV2(v1);
-    writeProjectConfigV2(v2, directory);
-    return v2;
-  } catch {
-    return null;
-  }
-}
-function writeProjectConfigV2(config2, directory = process.cwd()) {
-  const configPath = getProjectConfigPath(directory);
-  writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
-}
-function getActiveProject(config2) {
-  return config2.projects.find((p) => p.projectId === config2.activeProjectId) || config2.projects[0] || null;
-}
-function resolveProject(config2, identifier) {
-  if (!identifier) return getActiveProject(config2);
-  return config2.projects.find(
-    (p) => p.projectId === identifier || p.projectName.toLowerCase() === identifier.toLowerCase()
-  ) || null;
-}
-function addProjectToConfig(config2, entry) {
-  if (config2.projects.some((p) => p.projectId === entry.projectId)) {
-    throw new Error("Project already linked");
-  }
-  return { ...config2, projects: [...config2.projects, entry] };
-}
-function removeProjectFromConfig(config2, projectId) {
-  const filtered = config2.projects.filter((p) => p.projectId !== projectId);
-  if (filtered.length === 0) return null;
-  const activeId = config2.activeProjectId === projectId ? filtered[0].projectId : config2.activeProjectId;
-  return { ...config2, activeProjectId: activeId, projects: filtered };
-}
-function setActiveProjectInConfig(config2, projectId) {
-  if (!config2.projects.some((p) => p.projectId === projectId)) {
-    throw new Error("Project not found in config");
-  }
-  return { ...config2, activeProjectId: projectId };
-}
-function updateProjectInConfig(config2, projectId, updates) {
-  return {
-    ...config2,
-    projects: config2.projects.map(
-      (p) => p.projectId === projectId ? { ...p, ...updates } : p
-    )
-  };
-}
-function readProjectConfig(directory = process.cwd()) {
-  const v2 = readProjectConfigV2(directory);
-  if (!v2) return null;
-  const active = getActiveProject(v2);
-  if (!active) return null;
-  return {
-    projectId: active.projectId,
-    organizationId: active.organizationId,
-    environment: active.environment
-  };
-}
-function writeProjectConfig(config2, directory = process.cwd()) {
-  const existing = readProjectConfigV2(directory);
-  if (existing) {
-    const updated = updateProjectInConfig(existing, existing.activeProjectId, {
-      projectId: config2.projectId,
-      organizationId: config2.organizationId,
-      environment: config2.environment
-    });
-    writeProjectConfigV2(
-      { ...updated, activeProjectId: config2.projectId },
-      directory
-    );
-  } else {
-    writeProjectConfigV2(
-      {
-        version: 1,
-        activeProjectId: config2.projectId,
-        projects: [
-          {
-            projectId: config2.projectId,
-            organizationId: config2.organizationId,
-            projectName: "",
-            organizationName: "",
-            environment: config2.environment
-          }
-        ]
-      },
-      directory
-    );
-  }
-}
-function updateProjectConfig(updates, directory = process.cwd()) {
-  const v2 = readProjectConfigV2(directory);
-  if (!v2) {
-    throw new Error("No project config found. Run `envpilot init` first.");
-  }
-  const active = getActiveProject(v2);
-  if (!active) {
-    throw new Error("No active project found.");
-  }
-  const updated = updateProjectInConfig(v2, active.projectId, updates);
-  writeProjectConfigV2(updated, directory);
-}
-function deleteProjectConfig(directory = process.cwd()) {
-  const configPath = getProjectConfigPath(directory);
-  if (!existsSync(configPath)) return false;
-  unlinkSync(configPath);
-  return true;
-}
-function ensureEnvInGitignore(directory = process.cwd()) {
-  const gitignorePath = join(directory, ".gitignore");
-  if (!existsSync(gitignorePath)) {
-    writeFileSync(gitignorePath, ".env\n.env.local\n", "utf-8");
-    return;
-  }
-  const content = readFileSync(gitignorePath, "utf-8");
-  const lines = content.split("\n");
-  if (lines.some((line) => line.trim() === ".env")) {
-    return;
-  }
-  const newContent = content.endsWith("\n") ? content + ".env\n" : content + "\n.env\n";
-  writeFileSync(gitignorePath, newContent, "utf-8");
-}
-function getTrackedEnvFiles(directory = process.cwd()) {
-  try {
-    const result = execSync("git ls-files --cached .env .env.* .env.local", {
-      cwd: directory,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    return result.trim().split("\n").filter((f) => f.length > 0);
-  } catch {
-    return [];
-  }
-}
-
-// src/lib/env-file.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, chmodSync } from "fs";
-import { join as join2 } from "path";
-function parseEnvFile(content) {
-  const result = {};
-  const lines = content.split("\n");
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) {
-      continue;
-    }
-    const equalsIndex = line.indexOf("=");
-    if (equalsIndex === -1) {
-      continue;
-    }
-    const key = line.substring(0, equalsIndex).trim();
-    let value = line.substring(equalsIndex + 1);
-    value = parseValue(value);
-    if (isValidEnvKey(key)) {
-      result[key] = value;
-    }
-  }
-  return result;
-}
-function parseValue(value) {
-  value = value.trim();
-  if (value.startsWith('"') && value.endsWith('"')) {
-    value = value.slice(1, -1);
-    value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
-  } else if (value.startsWith("'") && value.endsWith("'")) {
-    value = value.slice(1, -1);
-  } else {
-    const commentIndex = value.indexOf(" #");
-    if (commentIndex !== -1) {
-      value = value.substring(0, commentIndex).trim();
-    }
-  }
-  return value;
-}
-function isValidEnvKey(key) {
-  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);
-}
-function stringifyEnv(vars, options) {
-  let keys = Object.keys(vars);
-  if (options?.sort) {
-    keys = keys.sort();
-  }
-  const lines = [];
-  for (const key of keys) {
-    const value = vars[key];
-    if (options?.comments?.[key]) {
-      lines.push(`# ${options.comments[key]}`);
-    }
-    const formattedValue = formatValue(value);
-    lines.push(`${key}=${formattedValue}`);
-  }
-  return lines.join("\n") + "\n";
-}
-function formatValue(value) {
-  const needsQuotes = value.includes("\n") || value.includes("\r") || value.includes('"') || value.includes("'") || value.includes(" ") || value.includes("#") || value.startsWith(" ") || value.endsWith(" ");
-  if (!needsQuotes) {
-    return value;
-  }
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
-  return `"${escaped}"`;
-}
-function diffEnvVars(local, remote) {
-  const added = {};
-  const removed = {};
-  const changed = {};
-  const unchanged = [];
-  for (const [key, value] of Object.entries(local)) {
-    if (!(key in remote)) {
-      added[key] = value;
-    } else if (remote[key] !== value) {
-      changed[key] = { local: value, remote: remote[key] };
-    } else {
-      unchanged.push(key);
-    }
-  }
-  for (const [key, value] of Object.entries(remote)) {
-    if (!(key in local)) {
-      removed[key] = value;
-    }
-  }
-  return { added, removed, changed, unchanged };
-}
-function readEnvFile(filePath) {
-  if (!existsSync2(filePath)) {
-    return null;
-  }
-  const content = readFileSync2(filePath, "utf-8");
-  return parseEnvFile(content);
-}
-function writeEnvFile(filePath, vars, options) {
-  const content = stringifyEnv(vars, options);
-  writeFileSync2(filePath, content, "utf-8");
-}
-function getEnvPathForEnvironment(environment, directory = process.cwd()) {
-  if (environment === "development") {
-    return join2(directory, ".env.local");
-  }
-  return join2(directory, `.env.${environment}`);
-}
-function applyFileProtection(filePath, role, projectRole) {
-  if (!existsSync2(filePath)) return;
-  const isWritable = role === "admin" || role === "team_lead" || projectRole === "manager";
-  if (isWritable) {
-    chmodSync(filePath, 420);
-  } else {
-    chmodSync(filePath, 292);
-  }
-}
-
-// src/commands/init.ts
-var initCommand = new Command2("init").description("Initialize Envpilot in the current directory").option("-o, --organization <id>", "Organization ID").option("-p, --project <id>", "Project ID").option(
-  "-e, --environment <env>",
-  "Default environment (development, staging, production)"
-).option("-f, --force", "Overwrite existing configuration").option("--add", "Add another project to existing config").action(async (options) => {
-  try {
-    if (!isAuthenticated()) {
-      throw notAuthenticated();
-    }
-    const existingConfig = readProjectConfigV2();
-    if (options.add) {
-      if (!existingConfig) {
-        error("No existing config. Run `envpilot init` first.");
-        process.exit(1);
-      }
-      await addProject(existingConfig, options);
-      return;
-    }
-    if (hasProjectConfig() && !options.force) {
-      warning("This directory is already initialized with Envpilot.");
-      const { proceed } = await inquirer.prompt([
-        {
-          type: "confirm",
-          name: "proceed",
-          message: "Do you want to reinitialize?",
-          default: false
-        }
-      ]);
-      if (!proceed) {
-        info("Initialization cancelled.");
-        return;
-      }
-    }
-    const { selectedOrg, selectedProject, selectedEnvironment } = await selectOrgProjectEnv(options);
-    writeProjectConfigV2({
-      version: 1,
-      activeProjectId: selectedProject._id,
-      projects: [
-        {
-          projectId: selectedProject._id,
-          organizationId: selectedOrg._id,
-          projectName: selectedProject.name,
-          organizationName: selectedOrg.name,
-          environment: selectedEnvironment
-        }
-      ]
-    });
-    setActiveOrganizationId(selectedOrg._id);
-    setActiveProjectId(selectedProject._id);
-    if (selectedOrg.role) {
-      setRole(selectedOrg.role);
-    }
-    ensureEnvInGitignore();
-    warnTrackedFiles();
-    console.log();
-    success("Project initialized!");
-    printPostInit(selectedOrg, selectedProject);
-  } catch (err) {
-    await handleError(err);
-  }
-});
-async function addProject(existingConfig, options) {
-  const api = createAPIClient();
-  let role = getRole();
-  if (role !== "admin" && role !== "team_lead") {
-    const orgs = await withSpinner("Checking permissions...", async () => {
-      const response = await api.get("/api/cli/organizations");
-      return response.data || [];
-    });
-    const freshRole = orgs.find(
-      (o) => o._id === existingConfig.projects[0]?.organizationId
-    )?.role;
-    if (freshRole) {
-      setRole(freshRole);
-      role = freshRole;
-    }
-    if (role !== "admin" && role !== "team_lead") {
-      error("Only admins and team leads can link multiple projects.");
-      info("Unlink the current project first with `envpilot unlink`.");
-      process.exit(1);
-    }
-  }
-  const { selectedOrg, selectedProject, selectedEnvironment } = await selectOrgProjectEnv(options);
-  if (existingConfig.projects.some((p) => p.projectId === selectedProject._id)) {
-    error(`"${selectedProject.name}" is already linked.`);
-    process.exit(1);
-  }
-  const envFile = getEnvPathForEnvironment(selectedEnvironment);
-  const conflicting = existingConfig.projects.find(
-    (p) => p.environment === selectedEnvironment
-  );
-  if (conflicting) {
-    warning(
-      `"${conflicting.projectName || conflicting.projectId}" already syncs to ${envFile} (${selectedEnvironment}). Both projects will write to the same file \u2014 consider using a different environment.`
-    );
-  }
-  const newEntry = {
-    projectId: selectedProject._id,
-    organizationId: selectedOrg._id,
-    projectName: selectedProject.name,
-    organizationName: selectedOrg.name,
-    environment: selectedEnvironment
-  };
-  let updatedConfig = addProjectToConfig(existingConfig, newEntry);
-  const { setActive } = await inquirer.prompt([
-    {
-      type: "confirm",
-      name: "setActive",
-      message: `Set "${selectedProject.name}" as the active project?`,
-      default: false
-    }
-  ]);
-  if (setActive) {
-    updatedConfig = {
-      ...updatedConfig,
-      activeProjectId: selectedProject._id
-    };
-    setActiveProjectId(selectedProject._id);
-    setActiveOrganizationId(selectedOrg._id);
-  }
-  updatedConfig = backfillNames(updatedConfig);
-  writeProjectConfigV2(updatedConfig);
-  console.log();
-  success(`Added "${selectedProject.name}" to linked projects!`);
-  console.log(
-    chalk4.dim(`  ${existingConfig.projects.length + 1} projects now linked`)
-  );
-  console.log();
-  console.log("Next steps:");
-  console.log(
-    `  ${chalk4.cyan("envpilot pull --all")}         Pull all projects`
-  );
-  console.log(
-    `  ${chalk4.cyan(`envpilot pull --project "${selectedProject.name}"`)}  Pull this project`
-  );
-  console.log(
-    `  ${chalk4.cyan("envpilot list linked")}        See all linked projects`
-  );
-  console.log();
-}
-async function selectOrgProjectEnv(options) {
-  const api = createAPIClient();
-  const organizations = await withSpinner(
-    "Fetching organizations...",
-    async () => {
-      const response = await api.get("/api/cli/organizations");
-      return response.data || [];
-    }
-  );
-  if (organizations.length === 0) {
-    error("No organizations found. Please create an organization first.");
-    process.exit(1);
-  }
-  let selectedOrg;
-  if (options.organization) {
-    const org = organizations.find(
-      (o) => o._id === options.organization || o.slug === options.organization
-    );
-    if (!org) {
-      error(`Organization not found: ${options.organization}`);
-      process.exit(1);
-    }
-    selectedOrg = org;
-  } else if (organizations.length === 1) {
-    selectedOrg = organizations[0];
-    info(`Using organization: ${chalk4.bold(selectedOrg.name)}`);
-  } else {
-    const { orgId } = await inquirer.prompt([
-      {
-        type: "list",
-        name: "orgId",
-        message: "Select an organization:",
-        choices: organizations.map((org) => ({
-          name: `${org.name} ${org.tier === "pro" ? chalk4.green("(Pro)") : chalk4.dim("(Free)")}`,
-          value: org._id
-        }))
-      }
-    ]);
-    selectedOrg = organizations.find((o) => o._id === orgId);
-  }
-  const projects = await withSpinner("Fetching projects...", async () => {
-    const response = await api.get(
-      "/api/cli/projects",
-      { organizationId: selectedOrg._id }
-    );
-    return response.data || [];
-  });
-  if (projects.length === 0) {
-    error("No projects found. Please create a project first.");
-    process.exit(1);
-  }
-  let selectedProject;
-  if (options.project) {
-    const project = projects.find(
-      (p) => p._id === options.project || p.slug === options.project
-    );
-    if (!project) {
-      error(`Project not found: ${options.project}`);
-      process.exit(1);
-    }
-    selectedProject = project;
-  } else if (projects.length === 1) {
-    selectedProject = projects[0];
-    info(`Using project: ${chalk4.bold(selectedProject.name)}`);
-  } else {
-    const { projectId } = await inquirer.prompt([
-      {
-        type: "list",
-        name: "projectId",
-        message: "Select a project:",
-        choices: projects.map((project) => ({
-          name: `${project.icon || "\u{1F4E6}"} ${project.name}`,
-          value: project._id
-        }))
-      }
-    ]);
-    selectedProject = projects.find((p) => p._id === projectId);
-  }
-  let selectedEnvironment = "development";
-  if (options.environment) {
-    if (!["development", "staging", "production"].includes(options.environment)) {
-      error(
-        "Invalid environment. Must be: development, staging, or production"
-      );
-      process.exit(1);
-    }
-    selectedEnvironment = options.environment;
-  } else {
-    const { environment } = await inquirer.prompt([
-      {
-        type: "list",
-        name: "environment",
-        message: "Select default environment:",
-        choices: [
-          { name: "Development", value: "development" },
-          { name: "Staging", value: "staging" },
-          { name: "Production", value: "production" }
-        ],
-        default: "development"
-      }
-    ]);
-    selectedEnvironment = environment;
-  }
-  return { selectedOrg, selectedProject, selectedEnvironment };
-}
-function backfillNames(config2) {
-  return config2;
-}
-function warnTrackedFiles() {
-  const trackedFiles = getTrackedEnvFiles();
-  if (trackedFiles.length > 0) {
-    console.log();
-    warning("Security risk: .env files are tracked by git!");
-    for (const file of trackedFiles) {
-      console.log(chalk4.red(`  tracked: ${file}`));
-    }
-    console.log();
-    console.log(
-      chalk4.yellow(
-        "  Run the following to untrack them (without deleting the files):"
-      )
-    );
-    for (const file of trackedFiles) {
-      console.log(chalk4.cyan(`    git rm --cached ${file}`));
-    }
-  }
-}
-function printPostInit(selectedOrg, selectedProject) {
-  console.log();
-  console.log(chalk4.dim("Configuration saved to .envpilot"));
-  if (selectedOrg.role) {
-    console.log(chalk4.dim(`  Org role: ${formatRole(selectedOrg.role)}`));
-    roleNotice(selectedOrg.role);
-  }
-  if (selectedProject.projectRole) {
-    console.log(
-      chalk4.dim(
-        `  Project role: ${formatProjectRole(selectedProject.projectRole)}`
-      )
-    );
-    projectRoleNotice(selectedProject.projectRole);
-  }
-  console.log();
-  console.log("Next steps:");
-  console.log(
-    `  ${chalk4.cyan("envpilot pull")}     Download environment variables`
-  );
-  console.log(
-    `  ${chalk4.cyan("envpilot push")}     Upload local .env to cloud`
-  );
-  console.log();
-}
-
-// src/commands/pull.ts
-import { Command as Command3 } from "commander";
-import chalk5 from "chalk";
-import inquirer2 from "inquirer";
-
-// src/lib/format-converter.ts
-var ALL_FORMATS = [
-  "env",
-  "json",
-  "yaml",
-  "docker-compose",
-  "aws",
-  "vercel",
-  "netlify"
-];
-function serialize(vars, format, meta) {
-  switch (format) {
-    case "env":
-      return serializeEnv(vars, meta);
-    case "json":
-      return serializeJson(vars);
-    case "yaml":
-      return serializeYaml(vars, meta);
-    case "docker-compose":
-      return serializeDockerCompose(vars, meta);
-    case "aws":
-      return serializeAws(vars, meta);
-    case "vercel":
-      return serializeVercel(vars);
-    case "netlify":
-      return serializeNetlify(vars, meta);
-  }
-}
-function parse(content, format, options) {
-  switch (format) {
-    case "env":
-      return parseEnvFile(content);
-    case "json":
-      return parseJson(content);
-    case "yaml":
-      return parseYaml(content);
-    case "docker-compose":
-      return parseDockerCompose(content);
-    case "aws":
-      return parseAws(content, options?.prefix);
-    case "vercel":
-      return parseVercel(content);
-    case "netlify":
-      return parseNetlify(content);
-  }
-}
-function getDefaultFilename(format, environment) {
-  const env = environment || "development";
-  switch (format) {
-    case "env":
-      return env === "development" ? ".env.local" : `.env.${env}`;
-    case "json":
-      return `${env}.json`;
-    case "yaml":
-      return `${env}.yaml`;
-    case "docker-compose":
-      return "docker-compose.yml";
-    case "aws":
-      return `${env}.aws.json`;
-    case "vercel":
-      return `${env}.vercel.json`;
-    case "netlify":
-      return "netlify.toml";
-  }
-}
-function serializeEnv(vars, meta) {
-  const lines = [];
-  if (meta?.environment) {
-    lines.push(`# Environment: ${meta.environment}`);
-  }
-  if (meta?.projectName) {
-    lines.push(`# Project: ${meta.projectName}`);
-  }
-  if (lines.length > 0) {
-    lines.push(`# Exported: ${(/* @__PURE__ */ new Date()).toISOString()}`);
-    lines.push("");
-  }
-  return lines.join("\n") + stringifyEnv(vars, { sort: true });
-}
-function serializeJson(vars) {
-  const sorted = Object.keys(vars).sort().reduce(
-    (obj, key) => {
-      obj[key] = vars[key];
-      return obj;
-    },
-    {}
-  );
-  return JSON.stringify(sorted, null, 2) + "\n";
-}
-function parseJson(content) {
-  const data = JSON.parse(content);
-  if (typeof data !== "object" || data === null || Array.isArray(data)) {
-    throw new Error("Expected a JSON object with string key-value pairs");
-  }
-  const result = {};
-  for (const [key, value] of Object.entries(data)) {
-    if (typeof value === "string") {
-      result[key] = value;
-    } else if (value !== null && value !== void 0) {
-      result[key] = String(value);
-    }
-  }
-  return result;
-}
-function yamlQuote(value) {
-  if (value === "" || value === "true" || value === "false" || value === "null" || value === "~" || /^[0-9]/.test(value) || /[:#\[\]{}&*!|>'"%@`]/.test(value) || value.includes("\n") || value.startsWith(" ") || value.endsWith(" ")) {
-    const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
-    return `"${escaped}"`;
-  }
-  return value;
-}
-function serializeYaml(vars, meta) {
-  const lines = [];
-  if (meta?.environment) {
-    lines.push(`# Environment: ${meta.environment}`);
-  }
-  if (meta?.projectName) {
-    lines.push(`# Project: ${meta.projectName}`);
-  }
-  if (lines.length > 0) {
-    lines.push("");
-  }
-  for (const key of Object.keys(vars).sort()) {
-    lines.push(`${key}: ${yamlQuote(vars[key])}`);
-  }
-  return lines.join("\n") + "\n";
-}
-function parseYaml(content) {
-  const result = {};
-  for (const line of content.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const colonIndex = trimmed.indexOf(": ");
-    if (colonIndex === -1) {
-      if (trimmed.endsWith(":")) {
-        const key2 = trimmed.slice(0, -1).trim();
-        if (key2 && /^[A-Za-z_][A-Za-z0-9_]*$/.test(key2)) {
-          result[key2] = "";
-        }
-      }
-      continue;
-    }
-    const key = trimmed.substring(0, colonIndex).trim();
-    let value = trimmed.substring(colonIndex + 2).trim();
-    if (line.startsWith(" ") || line.startsWith("	")) continue;
-    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-      value = value.slice(1, -1);
-      if (value.includes("\\")) {
-        value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
-      }
-    }
-    if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
-      result[key] = value;
-    }
-  }
-  return result;
-}
-function serializeDockerCompose(vars, meta) {
-  const lines = [];
-  if (meta?.environment || meta?.projectName) {
-    lines.push("# Docker Compose environment variables");
-    if (meta.projectName) lines.push(`# Project: ${meta.projectName}`);
-    if (meta.environment) lines.push(`# Environment: ${meta.environment}`);
-    lines.push("");
-  }
-  lines.push("services:");
-  lines.push("  app:");
-  lines.push("    environment:");
-  for (const key of Object.keys(vars).sort()) {
-    lines.push(`      ${key}: ${yamlQuote(vars[key])}`);
-  }
-  return lines.join("\n") + "\n";
-}
-function parseDockerCompose(content) {
-  const result = {};
-  const lines = content.split("\n");
-  let inEnvironment = false;
-  let environmentIndent = -1;
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const indent = line.length - line.trimStart().length;
-    if (trimmed === "environment:") {
-      inEnvironment = true;
-      environmentIndent = indent;
-      continue;
-    }
-    if (inEnvironment) {
-      if (indent <= environmentIndent && trimmed !== "") {
-        inEnvironment = false;
-        environmentIndent = -1;
-        continue;
-      }
-      if (trimmed.startsWith("- ")) {
-        const entry = trimmed.slice(2);
-        const eqIdx = entry.indexOf("=");
-        if (eqIdx !== -1) {
-          const key = entry.substring(0, eqIdx).trim();
-          let value = entry.substring(eqIdx + 1).trim();
-          if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-            value = value.slice(1, -1);
-          }
-          if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
-            result[key] = value;
-          }
-        }
-        continue;
-      }
-      const colonIndex = trimmed.indexOf(": ");
-      if (colonIndex !== -1) {
-        const key = trimmed.substring(0, colonIndex).trim();
-        let value = trimmed.substring(colonIndex + 2).trim();
-        if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-          value = value.slice(1, -1);
-          if (value.includes("\\")) {
-            value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
-          }
-        }
-        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
-          result[key] = value;
-        }
-      } else if (trimmed.endsWith(":")) {
-        const key = trimmed.slice(0, -1).trim();
-        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
-          result[key] = "";
-        }
-      }
-    }
-  }
-  return result;
-}
-function serializeAws(vars, meta) {
-  const prefix = meta?.prefix || `/${meta?.projectName || "app"}`;
-  const parameters = Object.keys(vars).sort().map((key) => ({
-    name: `${prefix}/${key}`,
-    value: vars[key],
-    type: "SecureString"
-  }));
-  return JSON.stringify({ parameters }, null, 2) + "\n";
-}
-function parseAws(content, prefix) {
-  const data = JSON.parse(content);
-  const result = {};
-  const params = data.parameters || data.Parameters || [];
-  if (!Array.isArray(params)) {
-    throw new Error(
-      "Expected AWS Parameter Store format with 'parameters' array"
-    );
-  }
-  for (const param of params) {
-    const name = param.name || param.Name || "";
-    const value = param.value || param.Value || "";
-    let key;
-    if (prefix && name.startsWith(prefix + "/")) {
-      key = name.substring(prefix.length + 1);
-    } else {
-      const lastSlash = name.lastIndexOf("/");
-      key = lastSlash !== -1 ? name.substring(lastSlash + 1) : name;
-    }
-    if (key && /^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
-      result[key] = value;
-    }
-  }
-  return result;
-}
-function serializeVercel(vars) {
-  const sorted = Object.keys(vars).sort().reduce(
-    (obj, key) => {
-      obj[key] = vars[key];
-      return obj;
-    },
-    {}
-  );
-  return JSON.stringify({ env: sorted }, null, 2) + "\n";
-}
-function parseVercel(content) {
-  const data = JSON.parse(content);
-  const result = {};
-  const env = data.env;
-  if (!env || typeof env !== "object" || Array.isArray(env)) {
-    throw new Error("Expected Vercel format with 'env' object");
-  }
-  for (const [key, value] of Object.entries(env)) {
-    if (typeof value === "string") {
-      result[key] = value;
-    } else if (value !== null && value !== void 0) {
-      result[key] = String(value);
-    }
-  }
-  return result;
-}
-function tomlQuote(value) {
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
-  return `"${escaped}"`;
-}
-function serializeNetlify(vars, meta) {
-  const lines = [];
-  if (meta?.environment || meta?.projectName) {
-    if (meta.projectName) lines.push(`# Project: ${meta.projectName}`);
-    if (meta.environment) lines.push(`# Environment: ${meta.environment}`);
-    lines.push("");
-  }
-  lines.push("[build.environment]");
-  for (const key of Object.keys(vars).sort()) {
-    lines.push(`  ${key} = ${tomlQuote(vars[key])}`);
-  }
-  return lines.join("\n") + "\n";
-}
-function parseNetlify(content) {
-  const result = {};
-  const lines = content.split("\n");
-  let inBuildEnv = false;
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (trimmed.startsWith("[")) {
-      inBuildEnv = trimmed === "[build.environment]" || trimmed === "[build.environment]";
-      continue;
-    }
-    if (!inBuildEnv) continue;
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eqIndex = trimmed.indexOf("=");
-    if (eqIndex === -1) continue;
-    const key = trimmed.substring(0, eqIndex).trim();
-    let value = trimmed.substring(eqIndex + 1).trim();
-    if (value.startsWith('"') && value.endsWith('"')) {
-      value = value.slice(1, -1);
-      value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
-    } else if (value.startsWith("'") && value.endsWith("'")) {
-      value = value.slice(1, -1);
-    }
-    if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
-      result[key] = value;
-    }
-  }
-  return result;
-}
-
-// src/commands/pull.ts
-var pullCommand = new Command3("pull").description("Download environment variables to local .env file").option(
-  "-e, --env <environment>",
-  "Environment (development, staging, production)"
-).option("-f, --file <path>", "Output file path (default: .env)").option("--force", "Overwrite without confirmation").option(
-  "--format <format>",
-  "Output format: env, json, yaml, docker-compose, aws, vercel, netlify",
-  "env"
-).option(
-  "--prefix <prefix>",
-  "AWS Parameter Store path prefix (default: /project-name)"
-).option("--dry-run", "Show what would be downloaded without writing").option("--project <name-or-id>", "Pull a specific linked project").option("--all", "Pull all linked projects").action(async (options) => {
-  try {
-    if (!isAuthenticated()) {
-      throw notAuthenticated();
-    }
-    if (options.all) {
-      if (options.env || options.file) {
-        error("Cannot use --env or --file with --all.");
-        process.exit(1);
-      }
-      await pullAllProjects(options);
-      return;
-    }
-    if (options.project) {
-      const configV2 = readProjectConfigV2();
-      if (!configV2) throw notInitialized();
-      const project = resolveProject(configV2, options.project);
-      if (!project) {
-        error(`Project not found: ${options.project}`);
-        console.log();
-        console.log("Linked projects:");
-        for (const p of configV2.projects) {
-          console.log(`  ${p.projectName || p.projectId} (${p.environment})`);
-        }
-        process.exit(1);
-      }
-      await pullSingleProject(project, options);
-      return;
-    }
-    const projectConfig = readProjectConfig();
-    if (!projectConfig) throw notInitialized();
-    checkTrackedFiles();
-    const environment = options.env || projectConfig.environment || "development";
-    const fmt = options.format || "env";
-    if (!ALL_FORMATS.includes(fmt)) {
-      error(`Unknown format: ${fmt}. Supported: ${ALL_FORMATS.join(", ")}`);
-      process.exit(1);
-    }
-    const outputPath = options.file || (fmt === "env" ? getEnvPathForEnvironment(environment) : getDefaultFilename(fmt, environment));
-    await pullProject(
-      {
-        projectId: projectConfig.projectId,
-        organizationId: projectConfig.organizationId,
-        environment
-      },
-      outputPath,
-      options
-    );
-  } catch (err) {
-    await handleError(err);
-  }
-});
-async function pullAllProjects(options) {
-  const configV2 = readProjectConfigV2();
-  if (!configV2) throw notInitialized();
-  checkTrackedFiles();
-  let totalPulled = 0;
-  let totalFailed = 0;
-  for (const project of configV2.projects) {
-    const outputPath = getEnvPathForEnvironment(project.environment);
-    const displayName = project.projectName || project.projectId;
-    console.log();
-    console.log(
-      chalk5.bold(
-        `Pulling "${displayName}" (${project.environment}) \u2192 ${outputPath}`
-      )
-    );
-    try {
-      await pullProject(
-        {
-          projectId: project.projectId,
-          organizationId: project.organizationId,
-          environment: project.environment
-        },
-        outputPath,
-        options
-      );
-      totalPulled++;
-    } catch (err) {
-      totalFailed++;
-      if (err instanceof Error) {
-        error(`  Failed: ${err.message}`);
-      }
-    }
-  }
-  console.log();
-  if (totalFailed === 0) {
-    success(`Pulled ${totalPulled} project${totalPulled !== 1 ? "s" : ""}`);
-  } else {
-    warning(
-      `Pulled ${totalPulled}/${totalPulled + totalFailed} projects. ${totalFailed} failed.`
-    );
-  }
-}
-async function pullSingleProject(project, options) {
-  checkTrackedFiles();
-  const environment = options.env || project.environment;
-  const fmt = options.format || "env";
-  const outputPath = options.file || (fmt === "env" ? getEnvPathForEnvironment(environment) : getDefaultFilename(fmt, environment));
-  await pullProject(
-    {
-      projectId: project.projectId,
-      organizationId: project.organizationId,
-      environment
-    },
-    outputPath,
-    options
-  );
-}
-async function pullProject(project, outputPath, options) {
-  const api = createAPIClient();
-  let metaProjectRole;
-  const variables = await withSpinner(
-    `Fetching ${chalk5.bold(project.environment)} variables...`,
-    async () => {
-      const response = await api.get("/api/cli/variables", {
-        projectId: project.projectId,
-        environment: project.environment,
-        ...project.organizationId && {
-          organizationId: project.organizationId
-        }
-      });
-      metaProjectRole = response.meta?.projectRole;
-      return response.data || [];
-    }
-  );
-  if (variables.length === 0) {
-    warning(`No variables found for ${project.environment} environment.`);
-    return;
-  }
-  const remoteVars = {};
-  for (const variable of variables) {
-    remoteVars[variable.key] = variable.value;
-  }
-  const localVars = readEnvFile(outputPath) || {};
-  const diffResult = diffEnvVars(remoteVars, localVars);
-  const hasChanges = Object.keys(diffResult.added).length > 0 || Object.keys(diffResult.removed).length > 0 || Object.keys(diffResult.changed).length > 0;
-  if (!hasChanges) {
-    success("Local file is up to date.");
-    return;
-  }
-  console.log();
-  console.log(chalk5.bold("Changes:"));
-  console.log();
-  diff(diffResult.added, diffResult.removed, diffResult.changed);
-  console.log();
-  if (options.dryRun) {
-    info("Dry run - no changes written.");
-    return;
-  }
-  if (!options.force && Object.keys(localVars).length > 0) {
-    const { proceed } = await inquirer2.prompt([
-      {
-        type: "confirm",
-        name: "proceed",
-        message: `Overwrite ${outputPath}?`,
-        default: true
-      }
-    ]);
-    if (!proceed) {
-      info("Pull cancelled.");
-      return;
-    }
-  }
-  try {
-    const fs = await import("fs");
-    if (fs.existsSync(outputPath)) {
-      fs.chmodSync(outputPath, 420);
-    }
-  } catch {
-  }
-  const fmt = options.format || "env";
-  if (fmt === "env") {
-    const comments = {};
-    for (const variable of variables) {
-      if (variable.description) {
-        comments[variable.key] = variable.description;
-      }
-    }
-    writeEnvFile(outputPath, remoteVars, { sort: true, comments });
-  } else {
-    const fs = await import("fs");
-    const output = serialize(remoteVars, fmt, {
-      projectName: project.projectId,
-      environment: project.environment,
-      prefix: options.prefix
-    });
-    fs.writeFileSync(outputPath, output, "utf-8");
-  }
-  const role = getRole();
-  applyFileProtection(outputPath, role, metaProjectRole);
-  success(
-    `Downloaded ${variables.length} variables to ${chalk5.bold(outputPath)}`
-  );
-  if (metaProjectRole === "viewer") {
-    info(
-      "You have Viewer access to this project. You may only see variables you have been explicitly granted access to."
-    );
-  }
-  const isProtected = role !== "admin" && role !== "team_lead" && metaProjectRole !== "manager";
-  if (isProtected) {
-    info(
-      `File is read-only (your role: ${role || metaProjectRole || "member"}).`
-    );
-  }
-  console.log();
-  console.log(chalk5.dim(`  Added:   ${Object.keys(diffResult.added).length}`));
-  console.log(
-    chalk5.dim(`  Changed: ${Object.keys(diffResult.changed).length}`)
-  );
-  console.log(
-    chalk5.dim(`  Removed: ${Object.keys(diffResult.removed).length}`)
-  );
-}
-function checkTrackedFiles() {
-  const trackedFiles = getTrackedEnvFiles();
-  if (trackedFiles.length > 0) {
-    error("Security risk: .env files are tracked by git!");
-    console.log();
-    for (const file of trackedFiles) {
-      console.log(chalk5.red(`  tracked: ${file}`));
-    }
-    console.log();
-    console.log(
-      chalk5.yellow(
-        "  Run the following to untrack them (without deleting the files):"
-      )
-    );
-    for (const file of trackedFiles) {
-      console.log(chalk5.cyan(`    git rm --cached ${file}`));
-    }
-    console.log();
-    process.exit(1);
-  }
-}
-
-// src/commands/push.ts
-import { Command as Command4 } from "commander";
-import chalk6 from "chalk";
-import inquirer3 from "inquirer";
-
-// src/lib/validators.ts
-import { z as z2 } from "zod";
-var envKeySchema = z2.string().min(1, "Key cannot be empty").max(256, "Key cannot exceed 256 characters").regex(
-  /^[A-Za-z_][A-Za-z0-9_]*$/,
-  "Key must start with a letter or underscore, followed by letters, numbers, or underscores"
-);
-var envValueSchema = z2.string().max(65536, "Value cannot exceed 64KB");
-var environmentSchema2 = z2.enum([
-  "development",
-  "staging",
-  "production"
-]);
-var projectSlugSchema = z2.string().min(1, "Slug cannot be empty").max(128, "Slug cannot exceed 128 characters").regex(
-  /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/,
-  "Slug must be lowercase alphanumeric with hyphens, cannot start or end with hyphen"
-);
-var urlSchema = z2.string().url("Must be a valid URL");
-var tokenSchema = z2.string().min(1, "Token cannot be empty").regex(/^env_[A-Za-z0-9]{48}$/, "Invalid token format");
-var filePathSchema = z2.string().min(1, "File path cannot be empty");
-function validateEnvVars(vars) {
-  const valid = {};
-  const invalid = [];
-  for (const [key, value] of Object.entries(vars)) {
-    const keyResult = envKeySchema.safeParse(key);
-    const valueResult = envValueSchema.safeParse(value);
-    if (!keyResult.success) {
-      invalid.push({ key, error: keyResult.error.issues[0].message });
-      continue;
-    }
-    if (!valueResult.success) {
-      invalid.push({ key, error: valueResult.error.issues[0].message });
-      continue;
-    }
-    valid[key] = value;
-  }
-  return { valid, invalid };
-}
-
-// src/commands/push.ts
-var pushCommand = new Command4("push").description("Upload local .env file to cloud").option(
-  "-e, --env <environment>",
-  "Target environment (development, staging, production)"
-).option("-f, --file <path>", "Input file path (default: .env)").option("--merge", "Merge with existing variables (default)").option("--replace", "Replace all existing variables").option(
-  "--format <format>",
-  "Input format: env, json, yaml, docker-compose, aws, vercel, netlify",
-  "env"
-).option(
-  "--prefix <prefix>",
-  "AWS Parameter Store path prefix (default: /project-name)"
-).option("--dry-run", "Show what would be uploaded without making changes").option("--force", "Skip confirmation").option("--project <name-or-id>", "Push to a specific linked project").action(async (options) => {
-  try {
-    if (!isAuthenticated()) {
-      throw notAuthenticated();
-    }
-    let projectId;
-    let organizationId;
-    let defaultEnvironment;
-    if (options.project) {
-      const configV2 = readProjectConfigV2();
-      if (!configV2) throw notInitialized();
-      const resolved = resolveProject(configV2, options.project);
-      if (!resolved) {
-        error(`Project not found: ${options.project}`);
-        console.log();
-        console.log("Linked projects:");
-        for (const p of configV2.projects) {
-          console.log(`  ${p.projectName || p.projectId} (${p.environment})`);
-        }
-        process.exit(1);
-      }
-      projectId = resolved.projectId;
-      organizationId = resolved.organizationId;
-      defaultEnvironment = resolved.environment;
-    } else {
-      const projectConfig = readProjectConfig();
-      if (!projectConfig) throw notInitialized();
-      projectId = projectConfig.projectId;
-      organizationId = projectConfig.organizationId;
-      defaultEnvironment = projectConfig.environment;
-    }
-    const trackedFiles = getTrackedEnvFiles();
-    if (trackedFiles.length > 0) {
-      error("Security risk: .env files are tracked by git!");
-      console.log();
-      for (const file of trackedFiles) {
-        console.log(chalk6.red(`  tracked: ${file}`));
-      }
-      console.log();
-      console.log(
-        chalk6.yellow(
-          "  Run the following to untrack them (without deleting the files):"
-        )
-      );
-      for (const file of trackedFiles) {
-        console.log(chalk6.cyan(`    git rm --cached ${file}`));
-      }
-      console.log();
-      process.exit(1);
-    }
-    const api = createAPIClient();
-    const projects = await api.get("/api/cli/projects", { organizationId });
-    const currentProject = projects.data?.find((p) => p._id === projectId);
-    const projectRole = currentProject?.projectRole;
-    if (projectRole === "viewer") {
-      error(
-        "Unfortunately, as a member, you cannot push in any environment. Please access or request access to your team lead."
-      );
-      process.exit(1);
-    }
-    const role = getRole();
-    if (role === "member") {
-      warning(
-        "You have Member access. Push will create pending requests that require Admin or Team Lead approval."
-      );
-      console.log();
-      if (!options.force) {
-        const { proceed } = await inquirer3.prompt([
-          {
-            type: "confirm",
-            name: "proceed",
-            message: "Continue with creating approval requests?",
-            default: true
-          }
-        ]);
-        if (!proceed) {
-          info("Push cancelled.");
-          return;
-        }
-      }
-    }
-    const environment = options.env || defaultEnvironment || "development";
-    const fmt = options.format || "env";
-    if (!ALL_FORMATS.includes(fmt)) {
-      error(`Unknown format: ${fmt}. Supported: ${ALL_FORMATS.join(", ")}`);
-      process.exit(1);
-    }
-    const inputPath = options.file || (fmt === "env" ? getEnvPathForEnvironment(environment) : getDefaultFilename(fmt, environment));
-    const mode = options.replace ? "replace" : "merge";
-    let localVars;
-    if (fmt === "env") {
-      localVars = readEnvFile(inputPath);
-    } else {
-      const { readFileSync: readFileSync4, existsSync: existsSync4 } = await import("fs");
-      if (!existsSync4(inputPath)) {
-        localVars = null;
-      } else {
-        const content = readFileSync4(inputPath, "utf-8");
-        localVars = parse(content, fmt, { prefix: options.prefix });
-      }
-    }
-    if (!localVars) {
-      throw fileNotFound(inputPath);
-    }
-    if (Object.keys(localVars).length === 0) {
-      warning(`No variables found in ${inputPath}`);
-      return;
-    }
-    const { valid, invalid } = validateEnvVars(localVars);
-    if (invalid.length > 0) {
-      warning("Some variables have invalid keys and will be skipped:");
-      for (const { key, error: err } of invalid) {
-        console.log(chalk6.red(`  ${key}: ${err}`));
-      }
-      console.log();
-    }
-    if (Object.keys(valid).length === 0) {
-      error("No valid variables to push.");
-      return;
-    }
-    const remoteVariables = await withSpinner(
-      "Fetching current variables...",
-      async () => {
-        const params = {
-          projectId,
-          environment
-        };
-        if (organizationId) {
-          params.organizationId = organizationId;
-        }
-        const response = await api.get("/api/cli/variables", params);
-        return response.data || [];
-      }
-    );
-    const remoteVars = {};
-    for (const variable of remoteVariables) {
-      remoteVars[variable.key] = variable.value;
-    }
-    const diffResult = diffEnvVars(valid, remoteVars);
-    const hasChanges = Object.keys(diffResult.added).length > 0 || Object.keys(diffResult.changed).length > 0 || mode === "replace" && Object.keys(diffResult.removed).length > 0;
-    if (!hasChanges) {
-      success("Remote is up to date.");
-      return;
-    }
-    console.log();
-    console.log(chalk6.bold("Changes to push:"));
-    console.log();
-    const removedToShow = mode === "replace" ? diffResult.removed : {};
-    diff(diffResult.added, removedToShow, diffResult.changed);
-    if (mode === "merge" && Object.keys(diffResult.removed).length > 0) {
-      console.log();
-      console.log(
-        chalk6.dim(
-          `Note: ${Object.keys(diffResult.removed).length} remote variables not in local file will be preserved (use --replace to remove them)`
-        )
-      );
-    }
-    console.log();
-    if (options.dryRun) {
-      info("Dry run - no changes made.");
-      console.log();
-      console.log("Summary:");
-      console.log(`  Would add:    ${Object.keys(diffResult.added).length}`);
-      console.log(
-        `  Would update: ${Object.keys(diffResult.changed).length}`
-      );
-      if (mode === "replace") {
-        console.log(
-          `  Would delete: ${Object.keys(diffResult.removed).length}`
-        );
-      }
-      return;
-    }
-    if (!options.force) {
-      const confirmMessage = mode === "replace" ? `Push ${Object.keys(valid).length} variables and delete ${Object.keys(diffResult.removed).length} remote-only variables?` : `Push ${Object.keys(valid).length} variables to ${environment}?`;
-      const { proceed } = await inquirer3.prompt([
-        {
-          type: "confirm",
-          name: "proceed",
-          message: confirmMessage,
-          default: true
-        }
-      ]);
-      if (!proceed) {
-        info("Push cancelled.");
-        return;
-      }
-    }
-    const result = await withSpinner(
-      `Pushing variables to ${chalk6.bold(environment)}...`,
-      async () => {
-        const response = await api.post("/api/cli/variables/bulk", {
-          projectId,
-          environment,
-          variables: Object.entries(valid).map(([key, value]) => ({
-            key,
-            value
-          })),
-          mode,
-          ...organizationId && { organizationId }
-        });
-        return response.data;
-      }
-    );
-    if (result?.requested && result.requested > 0) {
-      success(
-        `Created ${result.requested} pending request(s) for ${chalk6.bold(environment)}`
-      );
-      console.log();
-      console.log(
-        chalk6.yellow(
-          "  These changes require approval from an Admin or Team Lead."
-        )
-      );
-      console.log();
-      console.log(chalk6.dim(`  Requested: ${result.requested}`));
-      if (result?.skipped && result.skipped > 0) {
-        console.log(chalk6.dim(`  Skipped:   ${result.skipped}`));
-      }
-    } else {
-      success(
-        `Pushed ${result?.total || Object.keys(valid).length} variables to ${chalk6.bold(environment)}`
-      );
-      console.log();
-      console.log(chalk6.dim(`  Created: ${result?.created || 0}`));
-      console.log(chalk6.dim(`  Updated: ${result?.updated || 0}`));
-      if (mode === "replace") {
-        console.log(chalk6.dim(`  Deleted: ${result?.deleted || 0}`));
-      }
-    }
-  } catch (err) {
-    await handleError(err);
-  }
-});
-
-// src/commands/switch.ts
-import { Command as Command5 } from "commander";
-import chalk7 from "chalk";
-import inquirer4 from "inquirer";
-var switchCommand = new Command5("switch").description("Switch project, environment, or active linked project").argument("[target]", "project slug or environment name").option("-o, --organization <id>", "Switch organization").option("-p, --project <id>", "Switch project").option(
-  "-e, --env <environment>",
-  "Switch environment (development, staging, production)"
-).option("--active <name-or-id>", "Set a linked project as active").action(async (target, options) => {
-  try {
-    if (!isAuthenticated()) {
-      throw notAuthenticated();
-    }
-    const api = createAPIClient();
-    const projectConfig = readProjectConfig();
-    if (options.active) {
-      const configV2 = readProjectConfigV2();
-      if (!configV2 || configV2.projects.length < 2) {
-        error(
-          "No multiple projects linked. Use `envpilot init --add` to link another project."
-        );
-        process.exit(1);
-      }
-      const target2 = configV2.projects.find(
-        (p) => p.projectId === options.active || p.projectName.toLowerCase() === options.active.toLowerCase()
-      );
-      if (!target2) {
-        error(`Project not found: ${options.active}`);
-        console.log();
-        console.log("Linked projects:");
-        for (const p of configV2.projects) {
-          const mark = p.projectId === configV2.activeProjectId ? chalk7.green(" *") : "";
-          console.log(
-            `  ${p.projectName || p.projectId} (${p.environment})${mark}`
-          );
-        }
-        process.exit(1);
-      }
-      const updated = setActiveProjectInConfig(configV2, target2.projectId);
-      writeProjectConfigV2(updated);
-      setActiveProjectId(target2.projectId);
-      setActiveOrganizationId(target2.organizationId);
-      success(
-        `Active project: ${chalk7.bold(target2.projectName || target2.projectId)}`
-      );
-      return;
-    }
-    if (options.env || target && ["development", "staging", "production"].includes(target)) {
-      const environment = options.env || target;
-      if (!projectConfig) {
-        error("No project initialized. Run `envpilot init` first.");
-        process.exit(1);
-      }
-      updateProjectConfig({ environment });
-      success(`Switched to ${chalk7.bold(environment)} environment`);
-      return;
-    }
-    if (options.organization) {
-      const organizations = await withSpinner(
-        "Fetching organizations...",
-        async () => {
-          const response = await api.get("/api/cli/organizations");
-          return response.data || [];
-        }
-      );
-      const org = organizations.find(
-        (o) => o._id === options.organization || o.slug === options.organization
-      );
-      if (!org) {
-        error(`Organization not found: ${options.organization}`);
-        process.exit(1);
-      }
-      setActiveOrganizationId(org._id);
-      if (org.role) {
-        setRole(org.role);
-      }
-      if (projectConfig) {
-        updateProjectConfig({ organizationId: org._id });
-      }
-      success(`Switched to organization: ${chalk7.bold(org.name)}`);
-      if (org.role) {
-        console.log(chalk7.dim(`  Role: ${formatRole(org.role)}`));
-        roleNotice(org.role);
-      }
-      return;
-    }
-    if (options.project || target) {
-      const projectIdentifier = options.project || target;
-      const configV2 = readProjectConfigV2();
-      if (configV2) {
-        const linked = configV2.projects.find(
-          (p) => p.projectId === projectIdentifier || p.projectName.toLowerCase() === projectIdentifier.toLowerCase()
-        );
-        if (linked) {
-          const updated = setActiveProjectInConfig(
-            configV2,
-            linked.projectId
-          );
-          writeProjectConfigV2(updated);
-          setActiveProjectId(linked.projectId);
-          setActiveOrganizationId(linked.organizationId);
-          success(
-            `Switched to project: ${chalk7.bold(linked.projectName || linked.projectId)}`
-          );
-          return;
-        }
-      }
-      let organizationId = projectConfig?.organizationId;
-      if (!organizationId) {
-        const organizations = await withSpinner(
-          "Fetching organizations...",
-          async () => {
-            const response = await api.get("/api/cli/organizations");
-            return response.data || [];
-          }
-        );
-        if (organizations.length === 0) {
-          error("No organizations found.");
-          process.exit(1);
-        }
-        if (organizations.length === 1) {
-          organizationId = organizations[0]._id;
-          if (organizations[0].role) {
-            setRole(organizations[0].role);
-          }
-        } else {
-          const { orgId } = await inquirer4.prompt([
-            {
-              type: "list",
-              name: "orgId",
-              message: "Select an organization:",
-              choices: organizations.map((org) => ({
-                name: `${org.name} ${org.tier === "pro" ? chalk7.green("(Pro)") : chalk7.dim("(Free)")}`,
-                value: org._id
-              }))
-            }
-          ]);
-          organizationId = orgId;
-          const selectedOrg = organizations.find((o) => o._id === orgId);
-          if (selectedOrg?.role) {
-            setRole(selectedOrg.role);
-          }
-        }
-      }
-      const projects = await withSpinner("Fetching projects...", async () => {
-        const response = await api.get("/api/cli/projects", { organizationId });
-        return response.data || [];
-      });
-      const project = projects.find(
-        (p) => p._id === projectIdentifier || p.slug === projectIdentifier
-      );
-      if (!project) {
-        error(`Project not found: ${projectIdentifier}`);
-        console.log();
-        console.log("Available projects:");
-        for (const p of projects) {
-          console.log(`  ${p.icon || "\u{1F4E6}"} ${p.name} (${p.slug})`);
-        }
-        process.exit(1);
-      }
-      setActiveProjectId(project._id);
-      setActiveOrganizationId(organizationId);
-      const environment = projectConfig?.environment || "development";
-      writeProjectConfig({
-        projectId: project._id,
-        organizationId,
-        environment
-      });
-      success(`Switched to project: ${chalk7.bold(project.name)}`);
-      if (project.projectRole) {
-        console.log(
-          chalk7.dim(
-            `  Project role: ${formatProjectRole(project.projectRole)}`
-          )
-        );
-        projectRoleNotice(project.projectRole);
-      }
-      return;
-    }
-    if (!target && !options.project && !options.organization && !options.env && !options.active) {
-      const configV2 = readProjectConfigV2();
-      const hasMultipleProjects = configV2 && configV2.projects.length > 1;
-      const choices = [];
-      if (hasMultipleProjects) {
-        choices.push({
-          name: "Active project",
-          value: "active"
-        });
-      }
-      choices.push(
-        { name: "Environment", value: "environment" },
-        { name: "Project", value: "project" },
-        { name: "Organization", value: "organization" }
-      );
-      const { switchType } = await inquirer4.prompt([
-        {
-          type: "list",
-          name: "switchType",
-          message: "What would you like to switch?",
-          choices
-        }
-      ]);
-      if (switchType === "active" && configV2) {
-        const { projectId } = await inquirer4.prompt([
-          {
-            type: "list",
-            name: "projectId",
-            message: "Select active project:",
-            choices: configV2.projects.map((p) => {
-              const isActive = p.projectId === configV2.activeProjectId;
-              return {
-                name: `${p.projectName || p.projectId} (${p.environment})${isActive ? chalk7.green(" *current") : ""}`,
-                value: p.projectId
-              };
-            }),
-            default: configV2.activeProjectId
-          }
-        ]);
-        const selected = configV2.projects.find(
-          (p) => p.projectId === projectId
-        );
-        const updated = setActiveProjectInConfig(configV2, projectId);
-        writeProjectConfigV2(updated);
-        setActiveProjectId(projectId);
-        setActiveOrganizationId(selected.organizationId);
-        success(
-          `Active project: ${chalk7.bold(selected.projectName || selected.projectId)}`
-        );
-        return;
-      }
-      if (switchType === "environment") {
-        if (!projectConfig) {
-          error("No project initialized. Run `envpilot init` first.");
-          process.exit(1);
-        }
-        const { environment } = await inquirer4.prompt([
-          {
-            type: "list",
-            name: "environment",
-            message: "Select environment:",
-            choices: [
-              { name: "Development", value: "development" },
-              { name: "Staging", value: "staging" },
-              { name: "Production", value: "production" }
-            ],
-            default: projectConfig.environment
-          }
-        ]);
-        updateProjectConfig({ environment });
-        success(`Switched to ${chalk7.bold(environment)} environment`);
-        return;
-      }
-      if (switchType === "organization" || switchType === "project") {
-        const organizations = await withSpinner(
-          "Fetching organizations...",
-          async () => {
-            const response = await api.get("/api/cli/organizations");
-            return response.data || [];
-          }
-        );
-        if (organizations.length === 0) {
-          error("No organizations found.");
-          process.exit(1);
-        }
-        const { orgId } = await inquirer4.prompt([
-          {
-            type: "list",
-            name: "orgId",
-            message: "Select an organization:",
-            choices: organizations.map((org) => ({
-              name: `${org.name} ${org.tier === "pro" ? chalk7.green("(Pro)") : chalk7.dim("(Free)")}`,
-              value: org._id
-            })),
-            default: projectConfig?.organizationId
-          }
-        ]);
-        if (switchType === "organization") {
-          setActiveOrganizationId(orgId);
-          const org = organizations.find((o) => o._id === orgId);
-          if (org.role) {
-            setRole(org.role);
-          }
-          success(`Switched to organization: ${chalk7.bold(org.name)}`);
-          if (org.role) {
-            console.log(chalk7.dim(`  Role: ${formatRole(org.role)}`));
-            roleNotice(org.role);
-          }
-          return;
-        }
-        const selectedOrg = organizations.find((o) => o._id === orgId);
-        if (selectedOrg?.role) {
-          setRole(selectedOrg.role);
-        }
-        const projects = await withSpinner(
-          "Fetching projects...",
-          async () => {
-            const response = await api.get("/api/cli/projects", { organizationId: orgId });
-            return response.data || [];
-          }
-        );
-        if (projects.length === 0) {
-          error("No projects found in this organization.");
-          process.exit(1);
-        }
-        const { projectId } = await inquirer4.prompt([
-          {
-            type: "list",
-            name: "projectId",
-            message: "Select a project:",
-            choices: projects.map((project2) => ({
-              name: `${project2.icon || "\u{1F4E6}"} ${project2.name}`,
-              value: project2._id
-            })),
-            default: projectConfig?.projectId
-          }
-        ]);
-        const project = projects.find((p) => p._id === projectId);
-        const environment = projectConfig?.environment || "development";
-        setActiveProjectId(projectId);
-        setActiveOrganizationId(orgId);
-        writeProjectConfig({
-          projectId,
-          organizationId: orgId,
-          environment
-        });
-        success(`Switched to project: ${chalk7.bold(project.name)}`);
-        if (project.projectRole) {
-          console.log(
-            chalk7.dim(
-              `  Project role: ${formatProjectRole(project.projectRole)}`
-            )
-          );
-          projectRoleNotice(project.projectRole);
-        }
-      }
-    }
-  } catch (err) {
-    await handleError(err);
-  }
-});
-
-// src/commands/list.ts
-import { Command as Command6 } from "commander";
-import chalk8 from "chalk";
-var listCommand = new Command6("list").description("List resources").argument(
-  "[resource]",
-  "Resource type: projects, organizations, variables, linked",
-  "projects"
-).option("-o, --organization <id>", "Organization ID (for projects/variables)").option("-p, --project <id>", "Project ID (for variables)").option("-e, --env <environment>", "Environment filter (for variables)").option("-t, --tag <name>", "Filter by tag name (for variables)").option("--show-values", "Show actual variable values (masked by default)").option("--json", "Output as JSON").action(async (resource, options) => {
-  try {
-    if (!isAuthenticated()) {
-      throw notAuthenticated();
-    }
-    const api = createAPIClient();
-    const projectConfig = readProjectConfig();
-    switch (resource) {
-      case "orgs":
-      case "organizations":
-        await listOrganizations(api, options);
-        break;
-      case "projects":
-        await listProjects(api, projectConfig, options);
-        break;
-      case "vars":
-      case "variables":
-        await listVariables(api, projectConfig, options);
-        break;
-      case "linked":
-        listLinked();
-        break;
-      default:
-        error(`Unknown resource: ${resource}`);
-        console.log();
-        console.log("Available resources:");
-        console.log("  organizations (orgs)  List your organizations");
-        console.log(
-          "  projects              List projects in an organization"
-        );
-        console.log("  variables (vars)      List variables in a project");
-        console.log(
-          "  linked                List projects linked in this directory"
-        );
-        process.exit(1);
-    }
-  } catch (err) {
-    await handleError(err);
-  }
-});
-function listLinked() {
-  const configV2 = readProjectConfigV2();
-  if (!configV2) {
-    info("No projects linked. Run `envpilot init` to get started.");
-    return;
-  }
-  header(`Linked Projects (${configV2.projects.length})`);
-  console.log();
-  for (const project of configV2.projects) {
-    const isActive = project.projectId === configV2.activeProjectId;
-    const marker = isActive ? chalk8.green("*") : " ";
-    const envFile = getEnvPathForEnvironment(project.environment);
-    console.log(
-      `  ${marker} ${chalk8.bold(project.projectName || project.projectId)} ${chalk8.dim(`(${project.organizationName || project.organizationId})`)}`
-    );
-    console.log(`    ${project.environment} ${chalk8.dim("\u2192")} ${envFile}`);
-    console.log();
-  }
-  if (configV2.projects.length > 1) {
-    console.log(chalk8.dim("  (* = active project)"));
-    console.log();
-    console.log(
-      chalk8.dim(
-        '  Use `envpilot switch --active "<name>"` to change the active project'
-      )
-    );
-  }
-}
-async function listOrganizations(api, options) {
-  const organizations = await withSpinner(
-    "Fetching organizations...",
-    async () => {
-      const response = await api.get("/api/cli/organizations");
-      return response.data || [];
-    }
-  );
-  if (organizations.length === 0) {
-    info("No organizations found.");
-    return;
-  }
-  if (options.json) {
-    console.log(JSON.stringify(organizations, null, 2));
-    return;
-  }
-  header("Organizations");
-  console.log();
-  table(
-    organizations.map((org) => ({
-      name: org.name,
-      slug: org.slug,
-      tier: org.tier === "pro" ? chalk8.green("Pro") : chalk8.dim("Free"),
-      role: org.role
-    })),
-    [
-      { key: "name", header: "Name" },
-      { key: "slug", header: "Slug" },
-      { key: "tier", header: "Tier" },
-      { key: "role", header: "Role" }
-    ]
-  );
-}
-async function listProjects(api, projectConfig, options) {
-  let organizationId = options.organization || projectConfig?.organizationId;
-  if (!organizationId) {
-    const organizations = await withSpinner(
-      "Fetching organizations...",
-      async () => {
-        const response = await api.get("/api/cli/organizations");
-        return response.data || [];
-      }
-    );
-    if (organizations.length === 0) {
-      info("No organizations found.");
-      return;
-    }
-    if (organizations.length === 1) {
-      organizationId = organizations[0]._id;
-    } else {
-      info("Multiple organizations found. Use --organization to specify one.");
-      console.log();
-      for (const org of organizations) {
-        console.log(`  ${org.name} (${org.slug}): --organization ${org._id}`);
-      }
-      return;
-    }
-  }
-  const projects = await withSpinner("Fetching projects...", async () => {
-    const response = await api.get(
-      "/api/cli/projects",
-      { organizationId }
-    );
-    return response.data || [];
-  });
-  if (projects.length === 0) {
-    info("No projects found.");
-    return;
-  }
-  if (options.json) {
-    console.log(JSON.stringify(projects, null, 2));
-    return;
-  }
-  header("Projects");
-  console.log();
-  table(
-    projects.map((project) => ({
-      icon: project.icon || "\u{1F4E6}",
-      name: project.name,
-      slug: project.slug,
-      description: project.description || chalk8.dim("-"),
-      role: project.userRole === "admin" ? formatRole("admin") : formatProjectRole(project.projectRole),
-      active: projectConfig?.projectId === project._id ? chalk8.green("\u2713") : ""
-    })),
-    [
-      { key: "icon", header: "" },
-      { key: "name", header: "Name" },
-      { key: "slug", header: "Slug" },
-      { key: "description", header: "Description", width: 30 },
-      { key: "role", header: "Role" },
-      { key: "active", header: "" }
-    ]
-  );
-  const role = getRole();
-  if (role) {
-    console.log();
-    console.log(chalk8.dim(`Your org role: ${formatRole(role)}`));
-  }
-}
-async function listVariables(api, projectConfig, options) {
-  const projectId = options.project || projectConfig?.projectId;
-  const environment = options.env || projectConfig?.environment;
-  if (!projectId) {
-    error("No project specified. Use --project or run `envpilot init` first.");
-    process.exit(1);
-  }
-  let metaProjectRole;
-  const variables = await withSpinner("Fetching variables...", async () => {
-    const params = { projectId };
-    if (environment) {
-      params.environment = environment;
-    }
-    const response = await api.get("/api/cli/variables", params);
-    metaProjectRole = response.meta?.projectRole;
-    return response.data || [];
-  });
-  const tagFilter = options.tag?.toLowerCase();
-  const filtered = tagFilter ? variables.filter(
-    (v) => v.tags?.some((t) => t.name.toLowerCase() === tagFilter)
-  ) : variables;
-  if (filtered.length === 0) {
-    info(
-      `No variables found${environment ? ` for ${environment}` : ""}${tagFilter ? ` with tag "${options.tag}"` : ""}.`
-    );
-    return;
-  }
-  if (options.json) {
-    const output = filtered.map((v) => ({
-      ...v,
-      value: options.showValues ? v.value : maskValue(v.value)
-    }));
-    console.log(JSON.stringify(output, null, 2));
-    return;
-  }
-  header(
-    `Variables${environment ? ` (${environment})` : ""}${tagFilter ? ` [tag: ${options.tag}]` : ""}`
-  );
-  console.log();
-  const hasTags = filtered.some((v) => v.tags && v.tags.length > 0);
-  table(
-    filtered.map((variable) => ({
-      key: variable.key,
-      value: options.showValues ? variable.value : maskValue(variable.value),
-      sensitive: variable.isSensitive ? chalk8.yellow("\u25CF") : "",
-      tags: hasTags ? variable.tags?.map((t) => t.name).join(", ") || chalk8.dim("-") : "",
-      version: `v${variable.version}`
-    })),
-    [
-      { key: "key", header: "Key" },
-      { key: "value", header: "Value", width: 40 },
-      { key: "sensitive", header: "" },
-      ...hasTags ? [{ key: "tags", header: "Tags", width: 25 }] : [],
-      { key: "version", header: "Ver" }
-    ]
-  );
-  console.log();
-  console.log(chalk8.dim(`Total: ${filtered.length} variables`));
-  const role = getRole();
-  if (role) {
-    console.log(chalk8.dim(`Your org role: ${formatRole(role)}`));
-  }
-  if (metaProjectRole) {
-    console.log(
-      chalk8.dim(`Your project role: ${formatProjectRole(metaProjectRole)}`)
-    );
-  }
-  if (role === "member" || metaProjectRole === "viewer") {
-    console.log(
-      chalk8.dim("You may only see variables you have been granted access to.")
-    );
-  }
-  if (!options.showValues) {
-    console.log(chalk8.dim("Use --show-values to see actual values"));
-  }
-}
-
-// src/commands/config.ts
-import { Command as Command7 } from "commander";
-import chalk9 from "chalk";
-var configCommand = new Command7("config").description("Manage CLI configuration").argument("[action]", "Action: get, set, list, path, reset").argument("[key]", "Config key (for get/set)").argument("[value]", "Config value (for set)").action(async (action, key, value) => {
-  try {
-    switch (action) {
-      case "get":
-        await handleGet(key);
-        break;
-      case "set":
-        await handleSet(key, value);
-        break;
-      case "list":
-      case void 0:
-        await handleList();
-        break;
-      case "path":
-        await handlePath();
-        break;
-      case "reset":
-        await handleReset();
-        break;
-      default:
-        error(`Unknown action: ${action}`);
-        console.log();
-        console.log("Available actions:");
-        console.log("  list          Show all configuration");
-        console.log("  get <key>     Get a specific config value");
-        console.log("  set <key> <value>  Set a config value");
-        console.log("  path          Show config file locations");
-        console.log("  reset         Reset all configuration");
-        process.exit(1);
-    }
-  } catch (err) {
-    await handleError(err);
-  }
-});
-async function handleGet(key) {
-  if (!key) {
-    error("Missing key. Usage: envpilot config get <key>");
-    console.log();
-    console.log("Available keys:");
-    console.log("  apiUrl              API endpoint URL");
-    console.log("  user                Current authenticated user");
-    console.log("  activeProjectId     Currently active project");
-    console.log("  activeOrganizationId Currently active organization");
-    process.exit(1);
-  }
-  const config2 = getConfig();
-  switch (key) {
-    case "apiUrl":
-      console.log(config2.apiUrl);
-      break;
-    case "user":
-      if (config2.user) {
-        console.log(JSON.stringify(config2.user, null, 2));
-      } else {
-        console.log(chalk9.dim("(not set)"));
-      }
-      break;
-    case "activeProjectId":
-      console.log(config2.activeProjectId || chalk9.dim("(not set)"));
-      break;
-    case "activeOrganizationId":
-      console.log(config2.activeOrganizationId || chalk9.dim("(not set)"));
-      break;
-    default:
-      error(`Unknown key: ${key}`);
-      process.exit(1);
-  }
-}
-async function handleSet(key, value) {
-  if (!key || value === void 0) {
-    error("Missing key or value. Usage: envpilot config set <key> <value>");
-    console.log();
-    console.log("Settable keys:");
-    console.log("  apiUrl    API endpoint URL");
-    process.exit(1);
-  }
-  switch (key) {
-    case "apiUrl":
-      try {
-        new URL(value);
-      } catch {
-        error("Invalid URL format");
-        process.exit(1);
-      }
-      setApiUrl(value);
-      success(`Set apiUrl to ${value}`);
-      break;
-    default:
-      error(`Cannot set key: ${key}`);
-      console.log();
-      console.log("Settable keys:");
-      console.log("  apiUrl    API endpoint URL");
-      process.exit(1);
-  }
-}
-async function handleList() {
-  const config2 = getConfig();
-  const projectConfig = readProjectConfig();
-  header("Global Configuration");
-  console.log();
-  keyValue([
-    ["API URL", config2.apiUrl],
-    ["Authenticated", isAuthenticated() ? chalk9.green("Yes") : chalk9.red("No")],
-    ["User", config2.user?.email],
-    ["Active Organization", config2.activeOrganizationId],
-    ["Active Project", config2.activeProjectId]
-  ]);
-  console.log();
-  if (projectConfig) {
-    header("Project Configuration (.envpilot)");
-    console.log();
-    keyValue([
-      ["Project ID", projectConfig.projectId],
-      ["Organization ID", projectConfig.organizationId],
-      ["Environment", projectConfig.environment]
-    ]);
-    console.log();
-  } else {
-    info("No project configuration found in current directory.");
-    console.log();
-  }
-}
-async function handlePath() {
-  header("Configuration Paths");
-  console.log();
-  keyValue([
-    ["Global config", getConfigPath()],
-    ["Project config", getProjectConfigPath()]
-  ]);
-}
-async function handleReset() {
-  const inquirer6 = await import("inquirer");
-  const { confirm } = await inquirer6.default.prompt([
-    {
-      type: "confirm",
-      name: "confirm",
-      message: "Are you sure you want to reset all configuration? This will log you out.",
-      default: false
-    }
-  ]);
-  if (!confirm) {
-    info("Reset cancelled.");
-    return;
-  }
-  clearConfig();
-  success("Configuration reset.");
-}
-
-// src/commands/logout.ts
-import { Command as Command8 } from "commander";
-var logoutCommand = new Command8("logout").description("Log out from Envpilot").action(async () => {
-  try {
-    if (!isAuthenticated()) {
-      info("You are not logged in.");
-      return;
-    }
-    const user = getUser();
-    const api = createAPIClient();
-    try {
-      await api.post("/api/cli/auth?action=revoke", {});
-    } catch {
-    }
-    clearAuth();
-    success(`Logged out${user?.email ? ` from ${user.email}` : ""}`);
-  } catch (err) {
-    await handleError(err);
-  }
-});
-
-// src/commands/unlink.ts
-import { Command as Command9 } from "commander";
-import chalk10 from "chalk";
-import inquirer5 from "inquirer";
-var unlinkCommand = new Command9("unlink").description("Remove a linked project from this directory").argument("[project]", "Project name or ID to unlink").option("--force", "Skip confirmation").action(async (projectArg, options) => {
-  try {
-    if (!isAuthenticated()) {
-      throw notAuthenticated();
-    }
-    const config2 = readProjectConfigV2();
-    if (!config2 || config2.projects.length === 0) {
-      error("No projects linked. Run `envpilot init` first.");
-      process.exit(1);
-    }
-    let targetProject;
-    if (projectArg) {
-      targetProject = resolveProject(config2, projectArg);
-      if (!targetProject) {
-        error(`Project not found: ${projectArg}`);
-        console.log();
-        console.log("Linked projects:");
-        for (const p of config2.projects) {
-          console.log(
-            `  ${p.projectName || p.projectId} (${p.organizationName || p.organizationId})`
-          );
-        }
-        process.exit(1);
-      }
-    } else if (config2.projects.length > 1) {
-      const { projectId } = await inquirer5.prompt([
-        {
-          type: "list",
-          name: "projectId",
-          message: "Select a project to unlink:",
-          choices: config2.projects.map((p) => {
-            const isActive = p.projectId === config2.activeProjectId;
-            return {
-              name: `${p.projectName || p.projectId} (${p.organizationName || p.organizationId})${isActive ? chalk10.green(" *active") : ""}`,
-              value: p.projectId
-            };
-          })
-        }
-      ]);
-      targetProject = config2.projects.find((p) => p.projectId === projectId);
-    } else {
-      targetProject = config2.projects[0];
-    }
-    const displayName = targetProject.projectName || targetProject.projectId;
-    if (!options.force) {
-      const { proceed } = await inquirer5.prompt([
-        {
-          type: "confirm",
-          name: "proceed",
-          message: `Unlink "${displayName}"? Your .env files won't be deleted.`,
-          default: false
-        }
-      ]);
-      if (!proceed) {
-        info("Unlink cancelled.");
-        return;
-      }
-    }
-    const updated = removeProjectFromConfig(config2, targetProject.projectId);
-    if (!updated) {
-      deleteProjectConfig();
-      success(`Unlinked "${displayName}". No projects remaining.`);
-      info("Run `envpilot init` to link a new project.");
-    } else {
-      writeProjectConfigV2(updated);
-      const newActive = getActiveProject(updated);
-      if (newActive) {
-        setActiveProjectId(newActive.projectId);
-      }
-      success(`Unlinked "${displayName}".`);
-      if (config2.activeProjectId === targetProject.projectId && newActive) {
-        info(
-          `Active project switched to "${newActive.projectName || newActive.projectId}".`
-        );
-      }
-      console.log(
-        chalk10.dim(
-          `  ${updated.projects.length} project${updated.projects.length !== 1 ? "s" : ""} remaining`
-        )
-      );
-    }
-  } catch (err) {
-    await handleError(err);
-  }
-});
-
-// src/commands/sync.ts
-import { Command as Command10 } from "commander";
-import chalk11 from "chalk";
-
-// src/lib/commit-guard.ts
 import {
-  existsSync as existsSync3,
-  readFileSync as readFileSync3,
-  writeFileSync as writeFileSync3,
-  mkdirSync,
-  chmodSync as chmodSync2,
-  unlinkSync as unlinkSync2,
-  statSync
-} from "fs";
-import { join as join3, resolve } from "path";
-import { execSync as execSync2 } from "child_process";
-var HOOK_START_MARKER = "# ENVPILOT_GUARD_START";
-var HOOK_END_MARKER = "# ENVPILOT_GUARD_END";
-var HOOK_BLOCK = `${HOOK_START_MARKER} - Do not remove. Installed by Envpilot CLI.
-ENV_FILES=$(git diff --cached --name-only | grep -E '(^|/)\\.env($|\\.)' || true)
-if [ -n "$ENV_FILES" ]; then
-  echo ""
-  echo "\\033[1;31mERROR:\\033[0m Envpilot commit guard blocked this commit."
-  echo ""
-  echo "The following .env files were staged:"
-  echo "$ENV_FILES" | while IFS= read -r f; do echo "  - $f"; done
-  echo ""
-  echo "Remove them with: git reset HEAD <file>"
-  echo "To bypass (not recommended): git commit --no-verify"
-  exit 1
-fi
-${HOOK_END_MARKER}`;
-function findGitRoot(startDir) {
-  let dir = startDir || process.cwd();
-  while (true) {
-    if (existsSync3(join3(dir, ".git"))) {
-      return dir;
-    }
-    const parent = resolve(dir, "..");
-    if (parent === dir) {
-      return null;
-    }
-    dir = parent;
-  }
-}
-function resolveGitDir(repoRoot) {
-  const gitPath = join3(repoRoot, ".git");
-  try {
-    const stat = statSync(gitPath);
-    if (stat.isDirectory()) {
-      return gitPath;
-    }
-  } catch {
-    return gitPath;
-  }
-  try {
-    const content = readFileSync3(gitPath, "utf-8").trim();
-    const match = content.match(/^gitdir:\s*(.+)$/);
-    if (match) {
-      const gitdir = resolve(repoRoot, match[1]);
-      const commonDir = resolve(gitdir, "..", "..");
-      if (existsSync3(join3(commonDir, "hooks")) || existsSync3(commonDir)) {
-        return commonDir;
-      }
-      return gitdir;
-    }
-  } catch {
-  }
-  return gitPath;
-}
-function getHooksDir(repoRoot) {
-  try {
-    const customPath = execSync2("git config core.hooksPath", {
-      cwd: repoRoot,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-    if (customPath) {
-      return resolve(repoRoot, customPath);
-    }
-  } catch {
-  }
-  const gitDir = resolveGitDir(repoRoot);
-  return join3(gitDir, "hooks");
-}
-function installCommitGuard(repoRoot) {
-  const root = repoRoot || findGitRoot();
-  if (!root) {
-    return {
-      installed: false,
-      hookPath: null,
-      message: "Not a git repository"
-    };
-  }
-  try {
-    const hooksDir = getHooksDir(root);
-    const hookPath = join3(hooksDir, "pre-commit");
-    mkdirSync(hooksDir, { recursive: true });
-    let existingContent = "";
-    try {
-      existingContent = readFileSync3(hookPath, "utf-8");
-    } catch {
-    }
-    if (existingContent.includes(HOOK_START_MARKER)) {
-      const startIdx = existingContent.indexOf(HOOK_START_MARKER);
-      const endIdx = existingContent.indexOf(HOOK_END_MARKER) + HOOK_END_MARKER.length;
-      const updated = existingContent.substring(0, startIdx) + HOOK_BLOCK + existingContent.substring(endIdx);
-      writeFileSync3(hookPath, updated, "utf-8");
-      chmodSync2(hookPath, 493);
-      return {
-        installed: true,
-        hookPath,
-        message: "Pre-commit hook updated"
-      };
-    }
-    let newContent;
-    if (existingContent.trim()) {
-      newContent = existingContent.trimEnd() + "\n\n" + HOOK_BLOCK + "\n";
-    } else {
-      newContent = "#!/bin/sh\n\n" + HOOK_BLOCK + "\n";
-    }
-    writeFileSync3(hookPath, newContent, "utf-8");
-    chmodSync2(hookPath, 493);
-    return {
-      installed: true,
-      hookPath,
-      message: "Pre-commit hook installed"
-    };
-  } catch (err) {
-    return {
-      installed: false,
-      hookPath: null,
-      message: `Failed to install hook: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-}
+  getApiUrl,
+  getTopLevelCommandCatalog,
+  initSentry,
+  openTUI
+} from "./chunk-RUYGAIH5.js";
 
-// src/commands/sync.ts
-var syncCommand = new Command10("sync").description(
-  "Login, select project, pull variables, and protect files \u2014 all in one command"
-).option("-o, --organization <id>", "Organization ID").option("-p, --project <id>", "Project ID or name").option(
-  "-e, --env <environment>",
-  "Environment (development, staging, production)"
-).option("--force", "Overwrite without confirmation").option("--no-guard", "Skip pre-commit hook installation").action(async (options) => {
-  try {
-    if (!isAuthenticated()) {
-      console.log();
-      info("Not logged in. Starting authentication...");
-      console.log();
-      await performLogin();
-      console.log();
-    } else {
-      info("Already authenticated.");
-    }
-    ensureEnvInGitignore();
-    if (options.guard !== false) {
-      const guardResult = installCommitGuard();
-      if (guardResult.installed) {
-        success(guardResult.message);
-        info("Staged .env files will be blocked from commits.");
-      } else if (guardResult.message !== "Not a git repository") {
-        warning(guardResult.message);
-      }
-    }
-    console.log();
-    let projectId;
-    let organizationId;
-    let environment;
-    let projectName;
-    let organizationName;
-    const existingConfig = readProjectConfigV2();
-    if (existingConfig && !options.organization && !options.project && !options.env) {
-      const active = getActiveProject(existingConfig);
-      if (active) {
-        projectId = active.projectId;
-        organizationId = active.organizationId;
-        environment = active.environment;
-        projectName = active.projectName;
-        organizationName = active.organizationName;
-        info(
-          `Using project ${chalk11.bold(projectName || projectId)} (${environment})`
-        );
-      } else {
-        const selection = await selectOrgProjectEnv(options);
-        projectId = selection.selectedProject._id;
-        organizationId = selection.selectedOrg._id;
-        environment = selection.selectedEnvironment;
-        projectName = selection.selectedProject.name;
-        organizationName = selection.selectedOrg.name;
-      }
-    } else {
-      const selection = await selectOrgProjectEnv({
-        organization: options.organization,
-        project: options.project,
-        environment: options.env
-      });
-      projectId = selection.selectedProject._id;
-      organizationId = selection.selectedOrg._id;
-      environment = selection.selectedEnvironment;
-      projectName = selection.selectedProject.name;
-      organizationName = selection.selectedOrg.name;
-      if (selection.selectedOrg.role) {
-        setRole(selection.selectedOrg.role);
-      }
-      writeProjectConfigV2({
-        version: 1,
-        activeProjectId: projectId,
-        projects: existingConfig ? [
-          ...existingConfig.projects.filter(
-            (p) => p.projectId !== projectId
-          ),
-          {
-            projectId,
-            organizationId,
-            projectName,
-            organizationName,
-            environment
-          }
-        ] : [
-          {
-            projectId,
-            organizationId,
-            projectName,
-            organizationName,
-            environment
-          }
-        ]
-      });
-      setActiveOrganizationId(organizationId);
-      setActiveProjectId(projectId);
-    }
-    console.log();
-    let metaProjectRole;
-    const variables = await withSpinner(
-      `Fetching ${chalk11.bold(environment)} variables...`,
-      async () => {
-        const api = createAPIClient();
-        const response = await api.get("/api/cli/variables", {
-          projectId,
-          environment,
-          ...organizationId && { organizationId }
-        });
-        metaProjectRole = response.meta?.projectRole;
-        return response.data || [];
-      }
-    );
-    const outputPath = getEnvPathForEnvironment(environment);
-    if (variables.length === 0) {
-      warning(`No variables found for ${environment} environment.`);
-      console.log();
-      return;
-    }
-    const remoteVars = {};
-    for (const variable of variables) {
-      remoteVars[variable.key] = variable.value;
-    }
-    const localVars = readEnvFile(outputPath) || {};
-    const diffResult = diffEnvVars(remoteVars, localVars);
-    const hasChanges = Object.keys(diffResult.added).length > 0 || Object.keys(diffResult.removed).length > 0 || Object.keys(diffResult.changed).length > 0;
-    if (!hasChanges) {
-      success(`${chalk11.bold(outputPath)} is up to date.`);
-      console.log();
-      return;
-    }
-    console.log();
-    console.log(chalk11.bold("Changes:"));
-    console.log();
-    diff(diffResult.added, diffResult.removed, diffResult.changed);
-    console.log();
-    try {
-      const fs = await import("fs");
-      if (fs.existsSync(outputPath)) {
-        fs.chmodSync(outputPath, 420);
-      }
-    } catch {
-    }
-    const comments = {};
-    for (const variable of variables) {
-      if (variable.description) {
-        comments[variable.key] = variable.description;
-      }
-    }
-    writeEnvFile(outputPath, remoteVars, { sort: true, comments });
-    const role = getRole();
-    applyFileProtection(outputPath, role, metaProjectRole);
-    success(
-      `Synced ${variables.length} variables to ${chalk11.bold(outputPath)}`
-    );
-    const isProtected = role !== "admin" && role !== "team_lead" && metaProjectRole !== "manager";
-    if (isProtected) {
-      info(
-        `File is read-only (your role: ${role || metaProjectRole || "member"}).`
-      );
-    }
-    console.log();
-    console.log(
-      chalk11.dim(`  Added:   ${Object.keys(diffResult.added).length}`)
-    );
-    console.log(
-      chalk11.dim(`  Changed: ${Object.keys(diffResult.changed).length}`)
-    );
-    console.log(
-      chalk11.dim(`  Removed: ${Object.keys(diffResult.removed).length}`)
-    );
-    console.log();
-  } catch (err) {
-    await handleError(err);
-  }
-});
+// src/lib/program.ts
+import { Command } from "commander";
 
-// src/commands/usage.ts
-import { Command as Command11 } from "commander";
-import chalk12 from "chalk";
-function formatUsage(current, limit) {
-  const limitStr = limit === null ? "unlimited" : String(limit);
-  const ratio = `${current}/${limitStr}`;
-  if (limit === null) return chalk12.green(ratio);
-  if (current >= limit) return chalk12.red(ratio);
-  if (current >= limit * 0.8) return chalk12.yellow(ratio);
-  return chalk12.green(ratio);
-}
-function featureStatus(enabled) {
-  return enabled ? chalk12.green("Enabled") : chalk12.dim("Disabled (Pro)");
-}
-var usageCommand = new Command11("usage").description("Show plan usage and limits for the active organization").option("-o, --organization <id>", "Organization ID").option("--json", "Output as JSON").action(async (options) => {
-  try {
-    if (!isAuthenticated()) {
-      throw notAuthenticated();
-    }
-    const api = createAPIClient();
-    const projectConfig = readProjectConfig();
-    let organizationId = options.organization || projectConfig?.organizationId || getActiveOrganizationId();
-    if (!organizationId) {
-      const orgs = await withSpinner(
-        "Fetching organizations...",
-        async () => {
-          const response = await api.get("/api/cli/organizations");
-          return response.data || [];
-        }
-      );
-      if (orgs.length === 0) {
-        error("No organizations found.");
-        process.exit(1);
-      }
-      if (orgs.length === 1) {
-        organizationId = orgs[0]._id;
-      } else {
-        error(
-          "Multiple organizations found. Use --organization to specify one."
-        );
-        console.log();
-        for (const org of orgs) {
-          console.log(
-            `  ${org.name} (${org.slug}): --organization ${org._id}`
-          );
-        }
-        process.exit(1);
-      }
-    }
-    const usage = await withSpinner(
-      "Fetching usage...",
-      () => api.getUsage(organizationId)
-    );
-    if (options.json) {
-      console.log(JSON.stringify(usage, null, 2));
-      return;
-    }
-    const tierLabel = usage.tier === "pro" ? chalk12.green("Pro") : chalk12.white("Free");
-    header(`Plan: ${tierLabel}`);
-    blank();
-    if (!usage.enforcementEnabled) {
-      info("Pre-alpha mode \u2014 all limits are bypassed. Billing coming soon.");
-      blank();
-    }
-    header("Resource Usage");
-    blank();
-    keyValue([
-      ["Projects", formatUsage(usage.usage.projects, usage.limits.projects)],
-      [
-        "Team Members",
-        formatUsage(usage.usage.teamMembers, usage.limits.teamMembers)
-      ],
-      ["Pending Invitations", String(usage.usage.pendingInvitations)],
-      ["Total Variables", String(usage.usage.totalVariables)]
-    ]);
-    blank();
-    if (usage.usage.variablesPerProject.length > 0) {
-      header("Variables per Project");
-      blank();
-      table(
-        usage.usage.variablesPerProject.map((p) => ({
-          project: p.projectName,
-          variables: formatUsage(p.count, usage.limits.variablesPerProject)
-        })),
-        [
-          { key: "project", header: "Project" },
-          { key: "variables", header: "Variables" }
-        ]
-      );
-      blank();
-    }
-    header("Features");
-    blank();
-    keyValue([
-      ["Version History", featureStatus(usage.features.versionHistory)],
-      ["Bulk Import", featureStatus(usage.features.bulkImport)],
-      [
-        "Granular Permissions",
-        featureStatus(usage.features.granularPermissions)
-      ],
-      ["Extension Access", featureStatus(usage.features.extensionAccess)],
-      ["Audit Log Retention", `${usage.features.auditLogRetentionDays} days`]
-    ]);
-    blank();
-  } catch (err) {
-    await handleError(err);
-  }
-});
+// src/lib/cli-version.ts
+var CLI_VERSION = true ? "1.6.0" : "0.0.0";
 
 // src/lib/version-check.ts
-import chalk13 from "chalk";
-import Conf2 from "conf";
-var CLI_VERSION = true ? "1.4.1" : "0.0.0";
+import chalk from "chalk";
+import Conf from "conf";
+var CLI_VERSION2 = true ? "1.6.0" : "0.0.0";
 var CHECK_INTERVAL = 60 * 60 * 1e3;
 var _cache = null;
 function getCache() {
   if (!_cache) {
-    _cache = new Conf2({
+    _cache = new Conf({
       projectName: "envpilot",
       configName: "version-cache"
     });
@@ -3562,18 +38,18 @@ function checkForUpdate() {
   }).then((data) => {
     if (!data?.cli) return;
     cache.set("lastVersionCheck", Date.now());
-    if (data.cli !== CLI_VERSION) {
+    if (data.cli !== CLI_VERSION2) {
       console.log();
       console.log(
-        chalk13.yellow("  Update available:"),
-        chalk13.dim(CLI_VERSION),
-        chalk13.yellow("\u2192"),
-        chalk13.green(data.cli)
+        chalk.yellow("  Update available:"),
+        chalk.dim(CLI_VERSION2),
+        chalk.yellow("\u2192"),
+        chalk.green(data.cli)
       );
       console.log(
-        chalk13.dim("  Run"),
-        chalk13.cyan("npm update -g @envpilot/cli"),
-        chalk13.dim("to update")
+        chalk.dim("  Run"),
+        chalk.cyan("npm update -g @envpilot/cli"),
+        chalk.dim("to update")
       );
       console.log();
     }
@@ -3581,22 +57,28 @@ function checkForUpdate() {
   });
 }
 
-// src/index.ts
+// src/lib/program.ts
+function createProgram() {
+  const program = new Command();
+  program.name("envpilot").description("Envpilot CLI - Sync, secure, and share environment variables").version(CLI_VERSION).enablePositionalOptions();
+  for (const command of getTopLevelCommandCatalog()) {
+    if (command.createCommand) {
+      program.addCommand(command.createCommand());
+    }
+  }
+  program.hook("postAction", () => {
+    checkForUpdate();
+  });
+  return program;
+}
+
+// src/index.tsx
 initSentry();
-var program = new Command12();
-program.name("envpilot").description("Envpilot CLI - Sync, secure, and share environment variables").version("1.3.2");
-program.addCommand(loginCommand);
-program.addCommand(logoutCommand);
-program.addCommand(initCommand);
-program.addCommand(pullCommand);
-program.addCommand(pushCommand);
-program.addCommand(switchCommand);
-program.addCommand(listCommand);
-program.addCommand(configCommand);
-program.addCommand(unlinkCommand);
-program.addCommand(syncCommand);
-program.addCommand(usageCommand);
-program.hook("postAction", () => {
-  checkForUpdate();
-});
-program.parse();
+var args = process.argv.slice(2);
+var shouldOpenTUI = process.env.ENVPILOT_TUI_CHILD !== "1" && args.length === 0;
+if (shouldOpenTUI) {
+  await openTUI();
+} else {
+  const program = createProgram();
+  await program.parseAsync();
+}