@envpilot/cli 1.6.0 → 1.7.2

package/dist/{chunk-RUYGAIH5.js → chunk-UVAK2D4O.js}

@@ -7,7 +7,7 @@ function initSentry() {
   Sentry.init({
     dsn,
     environment: "cli",
-    release: true ? "1.6.0" : "0.0.0",
+    release: true ? "1.11.0" : "0.0.0",
     // Free tier: disable performance monitoring
     tracesSampleRate: 0,
     beforeSend(event) {
@@ -49,6 +49,26 @@ async function flushSentry() {
 // src/lib/config.ts
 import Conf from "conf";
 var DEFAULT_API_URL = "https://www.envpilot.dev";
+var HOST_CANONICALIZATION = {
+  "envpilot.dev": "www.envpilot.dev"
+};
+function normalizeApiUrl(raw) {
+  let value = raw.trim();
+  if (!/^https?:\/\//i.test(value)) {
+    value = `https://${value}`;
+  }
+  try {
+    const parsed = new URL(value);
+    const canonicalHost = HOST_CANONICALIZATION[parsed.hostname.toLowerCase()];
+    if (canonicalHost) {
+      parsed.hostname = canonicalHost;
+    }
+    parsed.pathname = parsed.pathname.replace(/\/+$/, "");
+    return parsed.toString().replace(/\/$/, "");
+  } catch {
+    return value;
+  }
+}
 var config = new Conf({
   projectName: "envpilot",
   defaults: {
@@ -57,7 +77,7 @@ var config = new Conf({
 });
 function getConfig() {
   return {
-    apiUrl: config.get("apiUrl") ?? DEFAULT_API_URL,
+    apiUrl: normalizeApiUrl(config.get("apiUrl") ?? DEFAULT_API_URL),
     accessToken: config.get("accessToken"),
     refreshToken: config.get("refreshToken"),
     activeProjectId: config.get("activeProjectId"),
@@ -67,10 +87,12 @@ function getConfig() {
   };
 }
 function getApiUrl() {
-  return config.get("apiUrl") ?? DEFAULT_API_URL;
+  const stored = config.get("apiUrl");
+  const raw = stored ?? DEFAULT_API_URL;
+  return normalizeApiUrl(raw);
 }
 function setApiUrl(url) {
-  config.set("apiUrl", url);
+  config.set("apiUrl", normalizeApiUrl(url));
 }
 function getAccessToken() {
   return config.get("accessToken");
@@ -121,9 +143,6 @@ function getConfigPath() {
   return config.path;
 }
 
-// src/ui/render-tui.tsx
-import chalk from "chalk";
-
 // src/ui/execute-command.ts
 import { spawn } from "child_process";
 import { dirname, resolve } from "path";
@@ -155,9 +174,10 @@ async function executeCommand(argv) {
 // src/ui/render-tui.tsx
 import { jsx } from "react/jsx-runtime";
 async function openTUI() {
-  const [{ render }, { CLIApp }] = await Promise.all([
+  const [{ render }, { CLIApp }, { PressAnyKey }] = await Promise.all([
     import("ink"),
-    import("./app-UJRUWQKL.js")
+    import("./app-QG4JFCWP.js"),
+    import("./press-any-key-64XFP4O2.js")
   ]);
   while (true) {
     let selectedArgv = null;
@@ -179,24 +199,18 @@ async function openTUI() {
     if (code !== 0) {
       process.exitCode = code;
     }
-    console.log();
-    console.log(
-      chalk.dim("  Press any key to return to the TUI\u2026  (q to quit)")
-    );
-    const quit = await new Promise((resolve3) => {
-      if (process.stdin.isTTY) {
-        process.stdin.setRawMode(true);
-      }
-      process.stdin.resume();
-      process.stdin.once("data", (data) => {
-        const ch = data.toString();
-        if (process.stdin.isTTY) {
-          process.stdin.setRawMode(false);
+    let quit = false;
+    const prompt = render(
+      /* @__PURE__ */ jsx(
+        PressAnyKey,
+        {
+          onResolve: (q) => {
+            quit = q;
+          }
         }
-        process.stdin.pause();
-        resolve3(ch === "q" || ch === "Q");
-      });
-    });
+      )
+    );
+    await prompt.waitUntilExit();
     if (quit) {
       break;
     }
@@ -207,7 +221,7 @@ async function openTUI() {
 import { Command } from "commander";
 
 // src/lib/ui.ts
-import chalk2 from "chalk";
+import chalk from "chalk";
 import ora from "ora";
 function createSpinner(text) {
   return ora({
@@ -228,25 +242,25 @@ async function withSpinner(text, operation, options) {
   }
 }
 function success(message) {
-  console.log(chalk2.green("\u2713"), message);
+  console.log(chalk.green("\u2713"), message);
 }
 function info(message) {
-  console.log(chalk2.blue("\u2139"), message);
+  console.log(chalk.blue("\u2139"), message);
 }
 function warning(message) {
-  console.log(chalk2.yellow("\u26A0"), message);
+  console.log(chalk.yellow("\u26A0"), message);
 }
 function error(message) {
-  console.log(chalk2.red("\u2717"), message);
+  console.log(chalk.red("\u2717"), message);
 }
 function header(text) {
   console.log();
-  console.log(chalk2.bold(text));
-  console.log(chalk2.dim("\u2500".repeat(text.length)));
+  console.log(chalk.bold(text));
+  console.log(chalk.dim("\u2500".repeat(text.length)));
 }
 function table(data, columns) {
   if (data.length === 0) {
-    console.log(chalk2.dim("No data to display"));
+    console.log(chalk.dim("No data to display"));
     return;
   }
   const widths = columns.map((col) => {
@@ -257,8 +271,8 @@ function table(data, columns) {
     return col.width ?? Math.max(headerWidth, maxDataWidth);
   });
   const headerLine = columns.map((col, i) => col.header.padEnd(widths[i])).join("  ");
-  console.log(chalk2.bold(headerLine));
-  console.log(chalk2.dim("\u2500".repeat(headerLine.length)));
+  console.log(chalk.bold(headerLine));
+  console.log(chalk.dim("\u2500".repeat(headerLine.length)));
   for (const row of data) {
     const line2 = columns.map((col, i) => String(row[col.key] ?? "").padEnd(widths[i])).join("  ");
     console.log(line2);
@@ -268,23 +282,23 @@ function keyValue(pairs) {
   const maxKeyLength = Math.max(...pairs.map(([key]) => key.length));
   for (const [key, value] of pairs) {
     const paddedKey = key.padEnd(maxKeyLength);
-    console.log(`${chalk2.dim(paddedKey)}  ${value ?? chalk2.dim("(not set)")}`);
+    console.log(`${chalk.dim(paddedKey)}  ${value ?? chalk.dim("(not set)")}`);
   }
 }
 function diff(added, removed, changed) {
   if (Object.keys(added).length === 0 && Object.keys(removed).length === 0 && Object.keys(changed).length === 0) {
-    console.log(chalk2.dim("No changes"));
+    console.log(chalk.dim("No changes"));
     return;
   }
   for (const [key, value] of Object.entries(added)) {
-    console.log(chalk2.green(`+ ${key}=${maskValue(value)}`));
+    console.log(chalk.green(`+ ${key}=${maskValue(value)}`));
   }
   for (const [key, value] of Object.entries(removed)) {
-    console.log(chalk2.red(`- ${key}=${maskValue(value)}`));
+    console.log(chalk.red(`- ${key}=${maskValue(value)}`));
   }
   for (const [key, { local, remote }] of Object.entries(changed)) {
-    console.log(chalk2.red(`- ${key}=${maskValue(remote)}`));
-    console.log(chalk2.green(`+ ${key}=${maskValue(local)}`));
+    console.log(chalk.red(`- ${key}=${maskValue(remote)}`));
+    console.log(chalk.green(`+ ${key}=${maskValue(local)}`));
   }
 }
 function maskValue(value, showChars = 4) {
@@ -294,7 +308,7 @@ function maskValue(value, showChars = 4) {
   return value.slice(0, showChars) + "****" + value.slice(-showChars);
 }
 function line() {
-  console.log(chalk2.dim("\u2500".repeat(50)));
+  console.log(chalk.dim("\u2500".repeat(50)));
 }
 function blank() {
   console.log();
@@ -302,19 +316,19 @@ function blank() {
 function formatRole(role) {
   switch (role) {
     case "admin":
-      return chalk2.green("Admin");
+      return chalk.green("Admin");
     case "team_lead":
-      return chalk2.blue("Team Lead");
+      return chalk.blue("Team Lead");
     case "member":
-      return chalk2.yellow("Member");
+      return chalk.yellow("Member");
     default:
-      return chalk2.dim("Unknown");
+      return chalk.dim("Unknown");
   }
 }
 function roleNotice(role) {
   if (role === "member") {
     console.log(
-      chalk2.yellow(
+      chalk.yellow(
         "  You have Member access. Write operations will create pending requests for approval."
       )
     );
@@ -323,19 +337,19 @@ function roleNotice(role) {
 function formatProjectRole(role) {
   switch (role) {
     case "manager":
-      return chalk2.green("Manager");
+      return chalk.green("Manager");
     case "developer":
-      return chalk2.blue("Developer");
+      return chalk.blue("Developer");
     case "viewer":
-      return chalk2.yellow("Viewer");
+      return chalk.yellow("Viewer");
     default:
-      return chalk2.dim("-");
+      return chalk.dim("-");
   }
 }
 function projectRoleNotice(projectRole) {
   if (projectRole === "viewer") {
     console.log(
-      chalk2.yellow(
+      chalk.yellow(
         "  You have Viewer access to this project. You can only view variables you have been explicitly granted access to."
       )
     );
@@ -343,7 +357,7 @@ function projectRoleNotice(projectRole) {
 }
 
 // src/lib/errors.ts
-import chalk3 from "chalk";
+import chalk2 from "chalk";
 var CLIError = class extends Error {
   constructor(message, code, suggestion) {
     super(message);
@@ -368,17 +382,17 @@ var ErrorCodes = {
 };
 function formatError(error2) {
   if (error2 instanceof CLIError) {
-    let message = chalk3.red(`Error: ${error2.message}`);
+    let message = chalk2.red(`Error: ${error2.message}`);
     if (error2.suggestion) {
       message += `
-${chalk3.yellow("Suggestion:")} ${error2.suggestion}`;
+${chalk2.yellow("Suggestion:")} ${error2.suggestion}`;
     }
     return message;
   }
   if (error2 instanceof Error) {
-    return chalk3.red(`Error: ${error2.message}`);
+    return chalk2.red(`Error: ${error2.message}`);
   }
-  return chalk3.red(`Error: ${String(error2)}`);
+  return chalk2.red(`Error: ${String(error2)}`);
 }
 async function handleError(error2) {
   console.error(formatError(error2));
@@ -435,10 +449,16 @@ function invalidInput(message) {
 
 // src/lib/auth-flow.ts
 import open from "open";
-import chalk4 from "chalk";
+import chalk3 from "chalk";
 import { hostname } from "os";
 
 // src/lib/api.ts
+function registrableDomain(hostname2) {
+  const parts = hostname2.toLowerCase().split(".").filter(Boolean);
+  if (parts.length <= 2) return parts.join(".");
+  return parts.slice(-2).join(".");
+}
+var MAX_MANUAL_REDIRECTS = 5;
 var APIError = class extends Error {
   constructor(message, statusCode, code) {
     super(message);
@@ -474,7 +494,59 @@ var APIClient = class {
     const finalUrl = response.url || "";
     const contentType = response.headers.get("content-type") || "";
     const preview = (bodyText || "").slice(0, 512).toLowerCase();
-    return response.redirected || location.includes("authkit") || finalUrl.includes("authkit") || contentType.includes("text/html") && (preview.includes("authorization_session_id") || preview.includes("client_id=") || preview.includes("<!doctype html"));
+    return location.includes("authkit") || finalUrl.includes("authkit") || contentType.includes("text/html") && (preview.includes("authorization_session_id") || preview.includes("client_id=") || preview.includes("<!doctype html"));
+  }
+  /**
+   * Perform a fetch that follows 3xx redirects manually, re-attaching the
+   * Authorization header when the redirect stays inside the same registrable
+   * domain (eTLD+1). This defends against the apex→www redirect case where
+   * Node's default redirect follower drops the Authorization header on any
+   * hostname change and the resulting request comes back as a bogus 401 —
+   * which used to wipe the user's credentials.
+   *
+   * Cross-site redirects (different registrable domain) are followed without
+   * the Authorization header, matching browser/fetch security semantics.
+   */
+  async fetchWithSafeRedirects(initialUrl, init2) {
+    let currentUrl = initialUrl;
+    let currentInit = { ...init2, redirect: "manual" };
+    for (let hop = 0; hop < MAX_MANUAL_REDIRECTS; hop++) {
+      const response = await fetch(currentUrl, currentInit);
+      if (response.status < 300 || response.status >= 400) {
+        return response;
+      }
+      const location = response.headers.get("location");
+      if (!location) return response;
+      const nextUrl = new URL(location, currentUrl);
+      const prevHost = new URL(currentUrl).hostname;
+      const sameSite = registrableDomain(nextUrl.hostname) === registrableDomain(prevHost);
+      const headers = new Headers(currentInit.headers);
+      if (!sameSite) {
+        headers.delete("Authorization");
+      }
+      let nextMethod = (currentInit.method || "GET").toUpperCase();
+      let nextBody = currentInit.body;
+      if (response.status === 301 || response.status === 302 || response.status === 303) {
+        if (nextMethod !== "GET" && nextMethod !== "HEAD") {
+          nextMethod = "GET";
+          nextBody = void 0;
+          headers.delete("Content-Type");
+        }
+      }
+      currentUrl = nextUrl.toString();
+      currentInit = {
+        ...currentInit,
+        method: nextMethod,
+        headers,
+        body: nextBody,
+        redirect: "manual"
+      };
+    }
+    throw new APIError(
+      `Too many redirects while calling ${initialUrl}`,
+      0,
+      "TOO_MANY_REDIRECTS"
+    );
   }
   /**
    * Make a GET request
@@ -486,10 +558,9 @@ var APIClient = class {
         url.searchParams.set(key, value);
       }
     }
-    const response = await fetch(url.toString(), {
+    const response = await this.fetchWithSafeRedirects(url.toString(), {
       method: "GET",
-      headers: this.getHeaders(),
-      redirect: "follow"
+      headers: this.getHeaders()
     });
     return this.handleResponse(response);
   }
@@ -498,11 +569,10 @@ var APIClient = class {
    */
   async post(path, body) {
     const url = new URL(path, this.baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await this.fetchWithSafeRedirects(url.toString(), {
       method: "POST",
       headers: this.getHeaders(),
-      body: body ? JSON.stringify(body) : void 0,
-      redirect: "follow"
+      body: body ? JSON.stringify(body) : void 0
     });
     return this.handleResponse(response);
   }
@@ -511,11 +581,10 @@ var APIClient = class {
    */
   async put(path, body) {
     const url = new URL(path, this.baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await this.fetchWithSafeRedirects(url.toString(), {
       method: "PUT",
       headers: this.getHeaders(),
-      body: body ? JSON.stringify(body) : void 0,
-      redirect: "follow"
+      body: body ? JSON.stringify(body) : void 0
     });
     return this.handleResponse(response);
   }
@@ -524,11 +593,10 @@ var APIClient = class {
    */
   async patch(path, body) {
     const url = new URL(path, this.baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await this.fetchWithSafeRedirects(url.toString(), {
       method: "PATCH",
       headers: this.getHeaders(),
-      body: body ? JSON.stringify(body) : void 0,
-      redirect: "follow"
+      body: body ? JSON.stringify(body) : void 0
     });
     return this.handleResponse(response);
   }
@@ -537,10 +605,9 @@ var APIClient = class {
    */
   async delete(path) {
     const url = new URL(path, this.baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await this.fetchWithSafeRedirects(url.toString(), {
       method: "DELETE",
-      headers: this.getHeaders(),
-      redirect: "follow"
+      headers: this.getHeaders()
     });
     if (!response.ok) {
       await this.handleError(response);
@@ -557,7 +624,6 @@ var APIClient = class {
     if (!contentType.includes("application/json")) {
       const body2 = await response.text();
       if (this.isAuthRedirect(response, body2)) {
-        clearAuth();
         throw new APIError(
           "Your CLI session is not authorized for this endpoint. Please run `envpilot login` and try again.",
           401,
@@ -594,20 +660,12 @@ var APIClient = class {
       code = data.code;
     } catch {
     }
-    if (response.status >= 300 && response.status < 400 && this.isAuthRedirect(response)) {
-      clearAuth();
-      throw new APIError(
-        "Your CLI session expired or the server redirected this request to browser sign-in. Please run `envpilot login`.",
-        401,
-        "AUTH_REDIRECT"
-      );
-    }
     if (response.status === 401) {
       clearAuth();
       throw new APIError(
-        "Authentication required. Please run `envpilot login`.",
+        "Authentication failed. Please run `envpilot login`.",
         401,
-        "UNAUTHORIZED"
+        code || "UNAUTHORIZED"
       );
     }
     if (response.status === 403 && code === "TIER_LIMIT_REACHED") {
@@ -636,7 +694,7 @@ var APIClient = class {
    * Get current user info
    */
   async getCurrentUser() {
-    return this.get("/api/cli/auth/me");
+    return this.get("/api/cli/auth", { action: "me" });
   }
   /**
    * Get tier info for the active organization
@@ -752,25 +810,25 @@ var APIClient = class {
    * Initiate CLI authentication flow
    */
   async initiateAuth(deviceName) {
-    return this.post("/api/cli/auth/initiate", { deviceName });
+    return this.post("/api/cli/auth?action=initiate", { deviceName });
   }
   /**
    * Poll for authentication status
    */
   async pollAuth(code) {
-    return this.get("/api/cli/auth/poll", { code });
+    return this.get("/api/cli/auth", { action: "poll", code });
   }
   /**
    * Refresh access token
    */
   async refreshToken(refreshToken) {
-    return this.post("/api/cli/auth/refresh", { refreshToken });
+    return this.post("/api/cli/auth?action=refresh", { refreshToken });
   }
   /**
    * Revoke access token (logout)
    */
   async revokeToken() {
-    return this.post("/api/cli/auth/revoke", {});
+    return this.post("/api/cli/auth?action=revoke", {});
   }
 };
 function createAPIClient() {
@@ -792,19 +850,19 @@ async function performLogin(options) {
   spinner.start();
   let initResponse;
   try {
-    initResponse = await api.post("/api/cli/auth?action=initiate", { deviceName });
+    initResponse = await api.initiateAuth(deviceName);
   } catch (error2) {
     spinner.stop();
     throw error2;
   }
   spinner.stop();
   console.log();
-  console.log(chalk4.bold("Your authentication code:"));
+  console.log(chalk3.bold("Your authentication code:"));
   console.log();
-  console.log(chalk4.cyan.bold(`    ${initResponse.code}`));
+  console.log(chalk3.cyan.bold(`    ${initResponse.code}`));
   console.log();
   console.log(`Open this URL to authenticate:`);
-  console.log(chalk4.dim(initResponse.url));
+  console.log(chalk3.dim(initResponse.url));
   console.log();
   if (options?.browser !== false) {
     info("Opening browser...");
@@ -818,10 +876,7 @@ async function performLogin(options) {
       await sleep(POLL_INTERVAL_MS);
       let pollResponse;
       try {
-        pollResponse = await api.get("/api/cli/auth", {
-          action: "poll",
-          code: initResponse.code
-        });
+        pollResponse = await api.pollAuth(initResponse.code);
         consecutiveErrors = 0;
       } catch {
         consecutiveErrors++;
@@ -834,12 +889,13 @@ async function performLogin(options) {
       }
       if (pollResponse.status === "authenticated") {
         pollSpinner.stop();
-        if (pollResponse.accessToken) {
-          setAccessToken(pollResponse.accessToken);
-        }
-        if (pollResponse.refreshToken) {
-          setRefreshToken(pollResponse.refreshToken);
+        if (!pollResponse.accessToken || !pollResponse.refreshToken) {
+          throw new Error(
+            "Authentication succeeded but the server did not return session tokens. This is likely a server-side issue. Please try again or contact support."
+          );
         }
+        setAccessToken(pollResponse.accessToken);
+        setRefreshToken(pollResponse.refreshToken);
         if (pollResponse.user) {
           setUser({
             id: pollResponse.user.id,
@@ -848,7 +904,7 @@ async function performLogin(options) {
           });
         }
         console.log();
-        success(`Logged in as ${chalk4.bold(pollResponse.user?.email)}`);
+        success(`Logged in as ${chalk3.bold(pollResponse.user?.email)}`);
         return { email: pollResponse.user?.email || "" };
       }
       if (pollResponse.status === "expired" || pollResponse.status === "not_found") {
@@ -862,7 +918,7 @@ async function performLogin(options) {
 }
 
 // src/commands/login.ts
-var loginCommand = new Command("login").description("Authenticate with Envpilot").option("--api-url <url>", "API URL (default: http://localhost:3000)").option("--no-browser", "Do not automatically open the browser").action(async (options) => {
+var loginCommand = new Command("login").description("Authenticate with Envpilot").option("--api-url <url>", "API URL (default: https://www.envpilot.dev)").option("--no-browser", "Do not automatically open the browser").action(async (options) => {
   try {
     if (options.apiUrl) {
       setApiUrl(options.apiUrl);
@@ -883,7 +939,7 @@ var loginCommand = new Command("login").description("Authenticate with Envpilot"
 
 // src/commands/init.ts
 import { Command as Command2 } from "commander";
-import chalk5 from "chalk";
+import chalk4 from "chalk";
 import inquirer from "inquirer";
 
 // src/lib/project-config.ts
@@ -1388,18 +1444,18 @@ async function addProject(existingConfig, options) {
   console.log();
   success(`Added "${selectedProject.name}" to linked projects!`);
   console.log(
-    chalk5.dim(`  ${existingConfig.projects.length + 1} projects now linked`)
+    chalk4.dim(`  ${existingConfig.projects.length + 1} projects now linked`)
   );
   console.log();
   console.log("Next steps:");
   console.log(
-    `  ${chalk5.cyan("envpilot pull --all")}         Pull all projects`
+    `  ${chalk4.cyan("envpilot pull --all")}         Pull all projects`
   );
   console.log(
-    `  ${chalk5.cyan(`envpilot pull --project "${selectedProject.name}"`)}  Pull this project`
+    `  ${chalk4.cyan(`envpilot pull --project "${selectedProject.name}"`)}  Pull this project`
   );
   console.log(
-    `  ${chalk5.cyan("envpilot list linked")}        See all linked projects`
+    `  ${chalk4.cyan("envpilot list linked")}        See all linked projects`
   );
   console.log();
 }
@@ -1428,7 +1484,7 @@ async function selectOrgProjectEnv(options) {
     selectedOrg = org;
   } else if (organizations.length === 1) {
     selectedOrg = organizations[0];
-    info(`Using organization: ${chalk5.bold(selectedOrg.name)}`);
+    info(`Using organization: ${chalk4.bold(selectedOrg.name)}`);
   } else {
     const { orgId } = await inquirer.prompt([
       {
@@ -1436,7 +1492,7 @@ async function selectOrgProjectEnv(options) {
         name: "orgId",
         message: "Select an organization:",
         choices: organizations.map((org) => ({
-          name: `${org.name} ${org.tier === "pro" ? chalk5.green("(Pro)") : chalk5.dim("(Free)")}`,
+          name: `${org.name} ${org.tier === "pro" ? chalk4.green("(Pro)") : chalk4.dim("(Free)")}`,
           value: org._id
         }))
       }
@@ -1466,7 +1522,7 @@ async function selectOrgProjectEnv(options) {
     selectedProject = project;
   } else if (projects.length === 1) {
     selectedProject = projects[0];
-    info(`Using project: ${chalk5.bold(selectedProject.name)}`);
+    info(`Using project: ${chalk4.bold(selectedProject.name)}`);
   } else {
     const { projectId } = await inquirer.prompt([
       {
@@ -1517,29 +1573,29 @@ function warnTrackedFiles() {
     console.log();
     warning("Security risk: .env files are tracked by git!");
     for (const file of trackedFiles) {
-      console.log(chalk5.red(`  tracked: ${file}`));
+      console.log(chalk4.red(`  tracked: ${file}`));
     }
     console.log();
     console.log(
-      chalk5.yellow(
+      chalk4.yellow(
         "  Run the following to untrack them (without deleting the files):"
       )
     );
     for (const file of trackedFiles) {
-      console.log(chalk5.cyan(`    git rm --cached ${file}`));
+      console.log(chalk4.cyan(`    git rm --cached ${file}`));
     }
   }
 }
 function printPostInit(selectedOrg, selectedProject) {
   console.log();
-  console.log(chalk5.dim("Configuration saved to .envpilot"));
+  console.log(chalk4.dim("Configuration saved to .envpilot"));
   if (selectedOrg.role) {
-    console.log(chalk5.dim(`  Org role: ${formatRole(selectedOrg.role)}`));
+    console.log(chalk4.dim(`  Org role: ${formatRole(selectedOrg.role)}`));
     roleNotice(selectedOrg.role);
   }
   if (selectedProject.projectRole) {
     console.log(
-      chalk5.dim(
+      chalk4.dim(
         `  Project role: ${formatProjectRole(selectedProject.projectRole)}`
       )
     );
@@ -1548,17 +1604,17 @@ function printPostInit(selectedOrg, selectedProject) {
   console.log();
   console.log("Next steps:");
   console.log(
-    `  ${chalk5.cyan("envpilot pull")}     Download environment variables`
+    `  ${chalk4.cyan("envpilot pull")}     Download environment variables`
   );
   console.log(
-    `  ${chalk5.cyan("envpilot push")}     Upload local .env to cloud`
+    `  ${chalk4.cyan("envpilot push")}     Upload local .env to cloud`
   );
   console.log();
 }
 
 // src/commands/pull.ts
 import { Command as Command3 } from "commander";
-import chalk6 from "chalk";
+import chalk5 from "chalk";
 import inquirer2 from "inquirer";
 
 // src/lib/format-converter.ts
@@ -1972,7 +2028,7 @@ async function pullAllProjects(options) {
     const displayName = project.projectName || project.projectId;
     console.log();
     console.log(
-      chalk6.bold(
+      chalk5.bold(
         `Pulling "${displayName}" (${project.environment}) \u2192 ${outputPath}`
       )
     );
@@ -2022,7 +2078,7 @@ async function pullProject(project, outputPath, options) {
   const api = createAPIClient();
   let metaProjectRole;
   const variables = await withSpinner(
-    `Fetching ${chalk6.bold(project.environment)} variables...`,
+    `Fetching ${chalk5.bold(project.environment)} variables...`,
     async () => {
       const response = await api.get("/api/cli/variables", {
         projectId: project.projectId,
@@ -2051,7 +2107,7 @@ async function pullProject(project, outputPath, options) {
     return;
   }
   console.log();
-  console.log(chalk6.bold("Changes:"));
+  console.log(chalk5.bold("Changes:"));
   console.log();
   diff(diffResult.added, diffResult.removed, diffResult.changed);
   console.log();
@@ -2101,7 +2157,7 @@ async function pullProject(project, outputPath, options) {
   const role = getRole();
   applyFileProtection(outputPath, role, metaProjectRole);
   success(
-    `Downloaded ${variables.length} variables to ${chalk6.bold(outputPath)}`
+    `Downloaded ${variables.length} variables to ${chalk5.bold(outputPath)}`
   );
   if (metaProjectRole === "viewer") {
     info(
@@ -2115,12 +2171,12 @@ async function pullProject(project, outputPath, options) {
     );
   }
   console.log();
-  console.log(chalk6.dim(`  Added:   ${Object.keys(diffResult.added).length}`));
+  console.log(chalk5.dim(`  Added:   ${Object.keys(diffResult.added).length}`));
   console.log(
-    chalk6.dim(`  Changed: ${Object.keys(diffResult.changed).length}`)
+    chalk5.dim(`  Changed: ${Object.keys(diffResult.changed).length}`)
   );
   console.log(
-    chalk6.dim(`  Removed: ${Object.keys(diffResult.removed).length}`)
+    chalk5.dim(`  Removed: ${Object.keys(diffResult.removed).length}`)
   );
 }
 function checkTrackedFiles() {
@@ -2129,16 +2185,16 @@ function checkTrackedFiles() {
     error("Security risk: .env files are tracked by git!");
     console.log();
     for (const file of trackedFiles) {
-      console.log(chalk6.red(`  tracked: ${file}`));
+      console.log(chalk5.red(`  tracked: ${file}`));
     }
     console.log();
     console.log(
-      chalk6.yellow(
+      chalk5.yellow(
         "  Run the following to untrack them (without deleting the files):"
       )
     );
     for (const file of trackedFiles) {
-      console.log(chalk6.cyan(`    git rm --cached ${file}`));
+      console.log(chalk5.cyan(`    git rm --cached ${file}`));
     }
     console.log();
     process.exit(1);
@@ -2147,7 +2203,7 @@ function checkTrackedFiles() {
 
 // src/commands/push.ts
 import { Command as Command4 } from "commander";
-import chalk7 from "chalk";
+import chalk6 from "chalk";
 import inquirer3 from "inquirer";
 
 // src/lib/validators.ts
@@ -2235,16 +2291,16 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
       error("Security risk: .env files are tracked by git!");
       console.log();
       for (const file of trackedFiles) {
-        console.log(chalk7.red(`  tracked: ${file}`));
+        console.log(chalk6.red(`  tracked: ${file}`));
       }
       console.log();
       console.log(
-        chalk7.yellow(
+        chalk6.yellow(
           "  Run the following to untrack them (without deleting the files):"
         )
       );
       for (const file of trackedFiles) {
-        console.log(chalk7.cyan(`    git rm --cached ${file}`));
+        console.log(chalk6.cyan(`    git rm --cached ${file}`));
       }
       console.log();
       process.exit(1);
@@ -2311,7 +2367,7 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
     if (invalid.length > 0) {
       warning("Some variables have invalid keys and will be skipped:");
       for (const { key, error: err } of invalid) {
-        console.log(chalk7.red(`  ${key}: ${err}`));
+        console.log(chalk6.red(`  ${key}: ${err}`));
       }
       console.log();
     }
@@ -2344,14 +2400,14 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
       return;
     }
     console.log();
-    console.log(chalk7.bold("Changes to push:"));
+    console.log(chalk6.bold("Changes to push:"));
     console.log();
     const removedToShow = mode === "replace" ? diffResult.removed : {};
     diff(diffResult.added, removedToShow, diffResult.changed);
     if (mode === "merge" && Object.keys(diffResult.removed).length > 0) {
       console.log();
       console.log(
-        chalk7.dim(
+        chalk6.dim(
           `Note: ${Object.keys(diffResult.removed).length} remote variables not in local file will be preserved (use --replace to remove them)`
         )
       );
@@ -2388,7 +2444,7 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
       }
     }
     const result = await withSpinner(
-      `Pushing variables to ${chalk7.bold(environment)}...`,
+      `Pushing variables to ${chalk6.bold(environment)}...`,
       async () => {
         const response = await api.post("/api/cli/variables/bulk", {
           projectId,
@@ -2405,28 +2461,28 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
     );
     if (result?.requested && result.requested > 0) {
       success(
-        `Created ${result.requested} pending request(s) for ${chalk7.bold(environment)}`
+        `Created ${result.requested} pending request(s) for ${chalk6.bold(environment)}`
       );
       console.log();
       console.log(
-        chalk7.yellow(
+        chalk6.yellow(
           "  These changes require approval from an Admin or Team Lead."
         )
       );
       console.log();
-      console.log(chalk7.dim(`  Requested: ${result.requested}`));
+      console.log(chalk6.dim(`  Requested: ${result.requested}`));
       if (result?.skipped && result.skipped > 0) {
-        console.log(chalk7.dim(`  Skipped:   ${result.skipped}`));
+        console.log(chalk6.dim(`  Skipped:   ${result.skipped}`));
       }
     } else {
       success(
-        `Pushed ${result?.total || Object.keys(valid).length} variables to ${chalk7.bold(environment)}`
+        `Pushed ${result?.total || Object.keys(valid).length} variables to ${chalk6.bold(environment)}`
       );
       console.log();
-      console.log(chalk7.dim(`  Created: ${result?.created || 0}`));
-      console.log(chalk7.dim(`  Updated: ${result?.updated || 0}`));
+      console.log(chalk6.dim(`  Created: ${result?.created || 0}`));
+      console.log(chalk6.dim(`  Updated: ${result?.updated || 0}`));
       if (mode === "replace") {
-        console.log(chalk7.dim(`  Deleted: ${result?.deleted || 0}`));
+        console.log(chalk6.dim(`  Deleted: ${result?.deleted || 0}`));
       }
     }
   } catch (err) {
@@ -2436,7 +2492,7 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
 
 // src/commands/switch.ts
 import { Command as Command5 } from "commander";
-import chalk8 from "chalk";
+import chalk7 from "chalk";
 import inquirer4 from "inquirer";
 var switchCommand = new Command5("switch").description("Switch project, environment, or active linked project").argument("[target]", "project slug or environment name").option("-o, --organization <id>", "Switch organization").option("-p, --project <id>", "Switch project").option(
   "-e, --env <environment>",
@@ -2464,7 +2520,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
         console.log();
         console.log("Linked projects:");
         for (const p of configV2.projects) {
-          const mark = p.projectId === configV2.activeProjectId ? chalk8.green(" *") : "";
+          const mark = p.projectId === configV2.activeProjectId ? chalk7.green(" *") : "";
           console.log(
             `  ${p.projectName || p.projectId} (${p.environment})${mark}`
           );
@@ -2476,7 +2532,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
       setActiveProjectId(target2.projectId);
       setActiveOrganizationId(target2.organizationId);
       success(
-        `Active project: ${chalk8.bold(target2.projectName || target2.projectId)}`
+        `Active project: ${chalk7.bold(target2.projectName || target2.projectId)}`
       );
       return;
     }
@@ -2487,7 +2543,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
         process.exit(1);
       }
       updateProjectConfig({ environment });
-      success(`Switched to ${chalk8.bold(environment)} environment`);
+      success(`Switched to ${chalk7.bold(environment)} environment`);
       return;
     }
     if (options.organization) {
@@ -2512,9 +2568,9 @@ var switchCommand = new Command5("switch").description("Switch project, environm
       if (projectConfig) {
         updateProjectConfig({ organizationId: org._id });
       }
-      success(`Switched to organization: ${chalk8.bold(org.name)}`);
+      success(`Switched to organization: ${chalk7.bold(org.name)}`);
       if (org.role) {
-        console.log(chalk8.dim(`  Role: ${formatRole(org.role)}`));
+        console.log(chalk7.dim(`  Role: ${formatRole(org.role)}`));
         roleNotice(org.role);
       }
       return;
@@ -2535,7 +2591,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
           setActiveProjectId(linked.projectId);
           setActiveOrganizationId(linked.organizationId);
           success(
-            `Switched to project: ${chalk8.bold(linked.projectName || linked.projectId)}`
+            `Switched to project: ${chalk7.bold(linked.projectName || linked.projectId)}`
           );
           return;
         }
@@ -2565,7 +2621,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
               name: "orgId",
               message: "Select an organization:",
               choices: organizations.map((org) => ({
-                name: `${org.name} ${org.tier === "pro" ? chalk8.green("(Pro)") : chalk8.dim("(Free)")}`,
+                name: `${org.name} ${org.tier === "pro" ? chalk7.green("(Pro)") : chalk7.dim("(Free)")}`,
                 value: org._id
               }))
             }
@@ -2601,10 +2657,10 @@ var switchCommand = new Command5("switch").description("Switch project, environm
         organizationId,
         environment
       });
-      success(`Switched to project: ${chalk8.bold(project.name)}`);
+      success(`Switched to project: ${chalk7.bold(project.name)}`);
       if (project.projectRole) {
         console.log(
-          chalk8.dim(
+          chalk7.dim(
             `  Project role: ${formatProjectRole(project.projectRole)}`
           )
         );
@@ -2644,7 +2700,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
             choices: configV2.projects.map((p) => {
               const isActive = p.projectId === configV2.activeProjectId;
               return {
-                name: `${p.projectName || p.projectId} (${p.environment})${isActive ? chalk8.green(" *current") : ""}`,
+                name: `${p.projectName || p.projectId} (${p.environment})${isActive ? chalk7.green(" *current") : ""}`,
                 value: p.projectId
               };
             }),
@@ -2659,7 +2715,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
         setActiveProjectId(projectId);
         setActiveOrganizationId(selected.organizationId);
         success(
-          `Active project: ${chalk8.bold(selected.projectName || selected.projectId)}`
+          `Active project: ${chalk7.bold(selected.projectName || selected.projectId)}`
         );
         return;
       }
@@ -2682,7 +2738,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
           }
         ]);
         updateProjectConfig({ environment });
-        success(`Switched to ${chalk8.bold(environment)} environment`);
+        success(`Switched to ${chalk7.bold(environment)} environment`);
         return;
       }
       if (switchType === "organization" || switchType === "project") {
@@ -2703,7 +2759,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
             name: "orgId",
             message: "Select an organization:",
             choices: organizations.map((org) => ({
-              name: `${org.name} ${org.tier === "pro" ? chalk8.green("(Pro)") : chalk8.dim("(Free)")}`,
+              name: `${org.name} ${org.tier === "pro" ? chalk7.green("(Pro)") : chalk7.dim("(Free)")}`,
               value: org._id
             })),
             default: projectConfig?.organizationId
@@ -2715,9 +2771,9 @@ var switchCommand = new Command5("switch").description("Switch project, environm
           if (org.role) {
             setRole(org.role);
           }
-          success(`Switched to organization: ${chalk8.bold(org.name)}`);
+          success(`Switched to organization: ${chalk7.bold(org.name)}`);
           if (org.role) {
-            console.log(chalk8.dim(`  Role: ${formatRole(org.role)}`));
+            console.log(chalk7.dim(`  Role: ${formatRole(org.role)}`));
             roleNotice(org.role);
           }
           return;
@@ -2758,10 +2814,10 @@ var switchCommand = new Command5("switch").description("Switch project, environm
           organizationId: orgId,
           environment
         });
-        success(`Switched to project: ${chalk8.bold(project.name)}`);
+        success(`Switched to project: ${chalk7.bold(project.name)}`);
         if (project.projectRole) {
           console.log(
-            chalk8.dim(
+            chalk7.dim(
               `  Project role: ${formatProjectRole(project.projectRole)}`
             )
           );
@@ -2776,7 +2832,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
 
 // src/commands/list.ts
 import { Command as Command6 } from "commander";
-import chalk9 from "chalk";
+import chalk8 from "chalk";
 var listCommand = new Command6("list").description("List resources").argument(
   "[resource]",
   "Resource type: projects, organizations, variables, linked",
@@ -2831,19 +2887,19 @@ function listLinked() {
   console.log();
   for (const project of configV2.projects) {
     const isActive = project.projectId === configV2.activeProjectId;
-    const marker = isActive ? chalk9.green("*") : " ";
+    const marker = isActive ? chalk8.green("*") : " ";
     const envFile = getEnvPathForEnvironment(project.environment);
     console.log(
-      `  ${marker} ${chalk9.bold(project.projectName || project.projectId)} ${chalk9.dim(`(${project.organizationName || project.organizationId})`)}`
+      `  ${marker} ${chalk8.bold(project.projectName || project.projectId)} ${chalk8.dim(`(${project.organizationName || project.organizationId})`)}`
     );
-    console.log(`    ${project.environment} ${chalk9.dim("\u2192")} ${envFile}`);
+    console.log(`    ${project.environment} ${chalk8.dim("\u2192")} ${envFile}`);
     console.log();
   }
   if (configV2.projects.length > 1) {
-    console.log(chalk9.dim("  (* = active project)"));
+    console.log(chalk8.dim("  (* = active project)"));
     console.log();
     console.log(
-      chalk9.dim(
+      chalk8.dim(
         '  Use `envpilot switch --active "<name>"` to change the active project'
       )
     );
@@ -2871,7 +2927,7 @@ async function listOrganizations(api, options) {
     organizations.map((org) => ({
       name: org.name,
       slug: org.slug,
-      tier: org.tier === "pro" ? chalk9.green("Pro") : chalk9.dim("Free"),
+      tier: org.tier === "pro" ? chalk8.green("Pro") : chalk8.dim("Free"),
       role: org.role
     })),
     [
@@ -2929,9 +2985,9 @@ async function listProjects(api, projectConfig, options) {
       icon: project.icon || "\u{1F4E6}",
       name: project.name,
       slug: project.slug,
-      description: project.description || chalk9.dim("-"),
+      description: project.description || chalk8.dim("-"),
       role: project.userRole === "admin" ? formatRole("admin") : formatProjectRole(project.projectRole),
-      active: projectConfig?.projectId === project._id ? chalk9.green("\u2713") : ""
+      active: projectConfig?.projectId === project._id ? chalk8.green("\u2713") : ""
     })),
     [
       { key: "icon", header: "" },
@@ -2945,7 +3001,7 @@ async function listProjects(api, projectConfig, options) {
   const role = getRole();
   if (role) {
     console.log();
-    console.log(chalk9.dim(`Your org role: ${formatRole(role)}`));
+    console.log(chalk8.dim(`Your org role: ${formatRole(role)}`));
   }
 }
 async function listVariables(api, projectConfig, options) {
@@ -2992,8 +3048,8 @@ async function listVariables(api, projectConfig, options) {
     filtered.map((variable) => ({
       key: variable.key,
       value: options.showValues ? variable.value : maskValue(variable.value),
-      sensitive: variable.isSensitive ? chalk9.yellow("\u25CF") : "",
-      tags: hasTags ? variable.tags?.map((t) => t.name).join(", ") || chalk9.dim("-") : "",
+      sensitive: variable.isSensitive ? chalk8.yellow("\u25CF") : "",
+      tags: hasTags ? variable.tags?.map((t) => t.name).join(", ") || chalk8.dim("-") : "",
       version: `v${variable.version}`
     })),
     [
@@ -3005,29 +3061,29 @@ async function listVariables(api, projectConfig, options) {
     ]
   );
   console.log();
-  console.log(chalk9.dim(`Total: ${filtered.length} variables`));
+  console.log(chalk8.dim(`Total: ${filtered.length} variables`));
   const role = getRole();
   if (role) {
-    console.log(chalk9.dim(`Your org role: ${formatRole(role)}`));
+    console.log(chalk8.dim(`Your org role: ${formatRole(role)}`));
   }
   if (metaProjectRole) {
     console.log(
-      chalk9.dim(`Your project role: ${formatProjectRole(metaProjectRole)}`)
+      chalk8.dim(`Your project role: ${formatProjectRole(metaProjectRole)}`)
     );
   }
   if (role === "member" || metaProjectRole === "viewer") {
     console.log(
-      chalk9.dim("You may only see variables you have been granted access to.")
+      chalk8.dim("You may only see variables you have been granted access to.")
     );
   }
   if (!options.showValues) {
-    console.log(chalk9.dim("Use --show-values to see actual values"));
+    console.log(chalk8.dim("Use --show-values to see actual values"));
   }
 }
 
 // src/commands/config.ts
 import { Command as Command7 } from "commander";
-import chalk10 from "chalk";
+import chalk9 from "chalk";
 var configCommand = new Command7("config").description("Manage CLI configuration").argument("[action]", "Action: get, set, list, path, reset").argument("[key]", "Config key (for get/set)").argument("[value]", "Config value (for set)").action(async (action, key, value) => {
   try {
     switch (action) {
@@ -3082,14 +3138,14 @@ async function handleGet(key) {
       if (config2.user) {
         console.log(JSON.stringify(config2.user, null, 2));
       } else {
-        console.log(chalk10.dim("(not set)"));
+        console.log(chalk9.dim("(not set)"));
       }
       break;
     case "activeProjectId":
-      console.log(config2.activeProjectId || chalk10.dim("(not set)"));
+      console.log(config2.activeProjectId || chalk9.dim("(not set)"));
       break;
     case "activeOrganizationId":
-      console.log(config2.activeOrganizationId || chalk10.dim("(not set)"));
+      console.log(config2.activeOrganizationId || chalk9.dim("(not set)"));
       break;
     default:
       error(`Unknown key: ${key}`);
@@ -3105,16 +3161,18 @@ async function handleSet(key, value) {
     process.exit(1);
   }
   switch (key) {
-    case "apiUrl":
+    case "apiUrl": {
+      const normalized = normalizeApiUrl(value);
       try {
-        new URL(value);
+        new URL(normalized);
       } catch {
         error("Invalid URL format");
         process.exit(1);
       }
       setApiUrl(value);
-      success(`Set apiUrl to ${value}`);
+      success(`Set apiUrl to ${normalized}`);
       break;
+    }
     default:
       error(`Cannot set key: ${key}`);
       console.log();
@@ -3130,7 +3188,7 @@ async function handleList() {
   console.log();
   keyValue([
     ["API URL", config2.apiUrl],
-    ["Authenticated", isAuthenticated() ? chalk10.green("Yes") : chalk10.red("No")],
+    ["Authenticated", isAuthenticated() ? chalk9.green("Yes") : chalk9.red("No")],
     ["User", config2.user?.email],
     ["Active Organization", config2.activeOrganizationId],
     ["Active Project", config2.activeProjectId]
@@ -3199,7 +3257,7 @@ var logoutCommand = new Command8("logout").description("Log out from Envpilot").
 
 // src/commands/unlink.ts
 import { Command as Command9 } from "commander";
-import chalk11 from "chalk";
+import chalk10 from "chalk";
 import inquirer5 from "inquirer";
 var unlinkCommand = new Command9("unlink").description("Remove a linked project from this directory").argument("[project]", "Project name or ID to unlink").option("--force", "Skip confirmation").action(async (projectArg, options) => {
   try {
@@ -3234,7 +3292,7 @@ var unlinkCommand = new Command9("unlink").description("Remove a linked project
           choices: config2.projects.map((p) => {
             const isActive = p.projectId === config2.activeProjectId;
             return {
-              name: `${p.projectName || p.projectId} (${p.organizationName || p.organizationId})${isActive ? chalk11.green(" *active") : ""}`,
+              name: `${p.projectName || p.projectId} (${p.organizationName || p.organizationId})${isActive ? chalk10.green(" *active") : ""}`,
               value: p.projectId
             };
           })
@@ -3277,7 +3335,7 @@ var unlinkCommand = new Command9("unlink").description("Remove a linked project
         );
       }
       console.log(
-        chalk11.dim(
+        chalk10.dim(
           `  ${updated.projects.length} project${updated.projects.length !== 1 ? "s" : ""} remaining`
         )
       );
@@ -3289,7 +3347,7 @@ var unlinkCommand = new Command9("unlink").description("Remove a linked project
 
 // src/commands/sync.ts
 import { Command as Command10 } from "commander";
-import chalk12 from "chalk";
+import chalk11 from "chalk";
 
 // src/lib/commit-guard.ts
 import {
@@ -3467,7 +3525,7 @@ var syncCommand = new Command10("sync").description(
         projectName = active.projectName;
         organizationName = active.organizationName;
         info(
-          `Using project ${chalk12.bold(projectName || projectId)} (${environment})`
+          `Using project ${chalk11.bold(projectName || projectId)} (${environment})`
         );
       } else {
         const selection = await selectOrgProjectEnv(options);
@@ -3521,7 +3579,7 @@ var syncCommand = new Command10("sync").description(
     console.log();
     let metaProjectRole;
     const variables = await withSpinner(
-      `Fetching ${chalk12.bold(environment)} variables...`,
+      `Fetching ${chalk11.bold(environment)} variables...`,
       async () => {
         const api = createAPIClient();
         const response = await api.get("/api/cli/variables", {
@@ -3547,12 +3605,12 @@ var syncCommand = new Command10("sync").description(
     const diffResult = diffEnvVars(remoteVars, localVars);
     const hasChanges = Object.keys(diffResult.added).length > 0 || Object.keys(diffResult.removed).length > 0 || Object.keys(diffResult.changed).length > 0;
     if (!hasChanges) {
-      success(`${chalk12.bold(outputPath)} is up to date.`);
+      success(`${chalk11.bold(outputPath)} is up to date.`);
       console.log();
       return;
     }
     console.log();
-    console.log(chalk12.bold("Changes:"));
+    console.log(chalk11.bold("Changes:"));
     console.log();
     diff(diffResult.added, diffResult.removed, diffResult.changed);
     console.log();
@@ -3573,7 +3631,7 @@ var syncCommand = new Command10("sync").description(
     const role = getRole();
     applyFileProtection(outputPath, role, metaProjectRole);
     success(
-      `Synced ${variables.length} variables to ${chalk12.bold(outputPath)}`
+      `Synced ${variables.length} variables to ${chalk11.bold(outputPath)}`
     );
     const isProtected = role !== "admin" && role !== "team_lead" && metaProjectRole !== "manager";
     if (isProtected) {
@@ -3583,13 +3641,13 @@ var syncCommand = new Command10("sync").description(
     }
     console.log();
     console.log(
-      chalk12.dim(`  Added:   ${Object.keys(diffResult.added).length}`)
+      chalk11.dim(`  Added:   ${Object.keys(diffResult.added).length}`)
     );
     console.log(
-      chalk12.dim(`  Changed: ${Object.keys(diffResult.changed).length}`)
+      chalk11.dim(`  Changed: ${Object.keys(diffResult.changed).length}`)
     );
     console.log(
-      chalk12.dim(`  Removed: ${Object.keys(diffResult.removed).length}`)
+      chalk11.dim(`  Removed: ${Object.keys(diffResult.removed).length}`)
     );
     console.log();
   } catch (err) {
@@ -3599,17 +3657,17 @@ var syncCommand = new Command10("sync").description(
 
 // src/commands/usage.ts
 import { Command as Command11 } from "commander";
-import chalk13 from "chalk";
+import chalk12 from "chalk";
 function formatUsage(current, limit) {
   const limitStr = limit === null ? "unlimited" : String(limit);
   const ratio = `${current}/${limitStr}`;
-  if (limit === null) return chalk13.green(ratio);
-  if (current >= limit) return chalk13.red(ratio);
-  if (current >= limit * 0.8) return chalk13.yellow(ratio);
-  return chalk13.green(ratio);
+  if (limit === null) return chalk12.green(ratio);
+  if (current >= limit) return chalk12.red(ratio);
+  if (current >= limit * 0.8) return chalk12.yellow(ratio);
+  return chalk12.green(ratio);
 }
 function featureStatus(enabled) {
-  return enabled ? chalk13.green("Enabled") : chalk13.dim("Disabled (Pro)");
+  return enabled ? chalk12.green("Enabled") : chalk12.dim("Disabled (Pro)");
 }
 var usageCommand = new Command11("usage").description("Show plan usage and limits for the active organization").option("-o, --organization <id>", "Organization ID").option("--json", "Output as JSON").action(async (options) => {
   try {
@@ -3654,7 +3712,7 @@ var usageCommand = new Command11("usage").description("Show plan usage and limit
       console.log(JSON.stringify(usage, null, 2));
       return;
     }
-    const tierLabel = usage.tier === "pro" ? chalk13.green("Pro") : chalk13.white("Free");
+    const tierLabel = usage.tier === "pro" ? chalk12.green("Pro") : chalk12.white("Free");
     header(`Plan: ${tierLabel}`);
     blank();
     if (!usage.enforcementEnabled) {
@@ -3708,7 +3766,7 @@ var usageCommand = new Command11("usage").description("Show plan usage and limit
 
 // src/commands/whoami.ts
 import { Command as Command12 } from "commander";
-import chalk14 from "chalk";
+import chalk13 from "chalk";
 var whoamiCommand = new Command12("whoami").description("Show the current authenticated user and active CLI context").action(async () => {
   try {
     if (!isAuthenticated()) {
@@ -3734,7 +3792,7 @@ var whoamiCommand = new Command12("whoami").description("Show the current authen
       ["Environment", activeProject?.environment]
     ]);
     blank();
-    console.log(chalk14.dim("Token verified against the CLI auth endpoint."));
+    console.log(chalk13.dim("Token verified against the CLI auth endpoint."));
   } catch (err) {
     await handleError(err);
   }
@@ -3743,7 +3801,7 @@ var whoamiCommand = new Command12("whoami").description("Show the current authen
 // src/commands/run.ts
 import { Command as Command13 } from "commander";
 import { spawn as spawn2 } from "child_process";
-import chalk15 from "chalk";
+import chalk14 from "chalk";
 
 // src/lib/variables-cache.ts
 import { createHash } from "crypto";
@@ -3991,9 +4049,9 @@ var runCommand = new Command13("run").description(
     }
     if (!options.quiet) {
       const injectedCount = Object.keys(secrets).length;
-      const cacheTag = cacheHit ? chalk15.dim(` \u26A1 cache (${cacheAge})`) : "";
+      const cacheTag = cacheHit ? chalk14.dim(` \u26A1 cache (${cacheAge})`) : "";
       info(
-        `Injected ${chalk15.bold(injectedCount)} ${injectedCount === 1 ? "variable" : "variables"} from ${chalk15.bold(`${project.projectName || project.projectId}/${environment}`)}${cacheTag}`
+        `Injected ${chalk14.bold(injectedCount)} ${injectedCount === 1 ? "variable" : "variables"} from ${chalk14.bold(`${project.projectName || project.projectId}/${environment}`)}${cacheTag}`
       );
       if (overridden.length > 0) {
         warning(
@@ -4009,7 +4067,7 @@ var runCommand = new Command13("run").description(
   }
 });
 async function doFetch(project, environment, organizationId, quiet, labelPrefix = "Loading") {
-  const label = `${labelPrefix} ${chalk15.bold(environment)} secrets for ${chalk15.bold(project.projectName || project.projectId)}...`;
+  const label = `${labelPrefix} ${chalk14.bold(environment)} secrets for ${chalk14.bold(project.projectName || project.projectId)}...`;
   const api = createAPIClient();
   const { variables, decryptionFailures } = quiet ? await api.listVariables(project.projectId, environment, organizationId) : await withSpinner(
     label,
@@ -4018,7 +4076,7 @@ async function doFetch(project, environment, organizationId, quiet, labelPrefix
   if (decryptionFailures.length > 0) {
     for (const key of decryptionFailures) {
       warning(
-        `Could not decrypt ${chalk15.bold(key)} \u2014 skipped (vault error, check server logs)`
+        `Could not decrypt ${chalk14.bold(key)} \u2014 skipped (vault error, check server logs)`
       );
     }
   }
@@ -4028,18 +4086,18 @@ function printInjectionPreview(secrets, project, environment) {
   const keys = Object.keys(secrets).sort();
   console.log();
   console.log(
-    chalk15.bold(
-      `Would inject ${keys.length} ${keys.length === 1 ? "variable" : "variables"} from ${chalk15.cyan(`${project.projectName || project.projectId}/${environment}`)}:`
+    chalk14.bold(
+      `Would inject ${keys.length} ${keys.length === 1 ? "variable" : "variables"} from ${chalk14.cyan(`${project.projectName || project.projectId}/${environment}`)}:`
     )
   );
   console.log();
   if (keys.length === 0) {
-    console.log(chalk15.dim("  (no variables)"));
+    console.log(chalk14.dim("  (no variables)"));
   } else {
     for (const key of keys) {
       const value = secrets[key];
       const masked = maskForPreview(value);
-      console.log(`  ${chalk15.cyan(key)}=${chalk15.dim(masked)}`);
+      console.log(`  ${chalk14.cyan(key)}=${chalk14.dim(masked)}`);
     }
   }
   console.log();
@@ -4119,38 +4177,38 @@ function runChild(commandArgs, env, options) {
 
 // src/commands/man.ts
 import { Command as Command14 } from "commander";
-import chalk16 from "chalk";
+import chalk15 from "chalk";
 function printCommandManual(commandName) {
   const command = findCommandDefinition(commandName);
   if (!command) {
-    console.log(chalk16.red(`Unknown command reference: ${commandName}`));
+    console.log(chalk15.red(`Unknown command reference: ${commandName}`));
     console.log();
     console.log("Run `envpilot man` to see all supported commands.");
     process.exit(1);
   }
-  console.log(chalk16.bold(formatArgv(command.argv)));
+  console.log(chalk15.bold(formatArgv(command.argv)));
   if (command.args) {
-    console.log(chalk16.dim(command.args));
+    console.log(chalk15.dim(command.args));
   }
   blank();
   console.log(command.description);
   blank();
-  console.log(chalk16.green("Examples"));
+  console.log(chalk15.green("Examples"));
   for (const example of command.examples) {
-    console.log(`  ${chalk16.cyan(formatArgv(example))}`);
+    console.log(`  ${chalk15.cyan(formatArgv(example))}`);
   }
   blank();
-  console.log(chalk16.green("Notes"));
+  console.log(chalk15.green("Notes"));
   for (const note of command.notes) {
     console.log(`  - ${note}`);
   }
 }
 function printManualIndex(commands) {
-  console.log(chalk16.bold("ENVPILOT(1)"));
+  console.log(chalk15.bold("ENVPILOT(1)"));
   console.log("TypeScript CLI manual");
   blank();
   console.log(
-    `Total supported top-level commands: ${chalk16.green(String(CLI_COMMAND_COUNT))}`
+    `Total supported top-level commands: ${chalk15.green(String(CLI_COMMAND_COUNT))}`
   );
   blank();
   console.log(
@@ -4158,15 +4216,15 @@ function printManualIndex(commands) {
   );
   blank();
   line();
-  console.log(chalk16.green("Commands"));
+  console.log(chalk15.green("Commands"));
   for (const command of commands) {
     console.log(
-      `  ${chalk16.cyan(formatArgv(command.argv).padEnd(24))} ${chalk16.dim(command.description)}`
+      `  ${chalk15.cyan(formatArgv(command.argv).padEnd(24))} ${chalk15.dim(command.description)}`
     );
   }
   blank();
   line();
-  console.log(chalk16.green("Security"));
+  console.log(chalk15.green("Security"));
   console.log("  - `.env*` is ignored by the repository `.gitignore`.");
   console.log(
     "  - `envpilot init` and `envpilot sync` ensure env files are added to `.gitignore` locally."
@@ -4179,7 +4237,7 @@ function printManualIndex(commands) {
   );
   blank();
   line();
-  console.log(chalk16.green("Usage"));
+  console.log(chalk15.green("Usage"));
   console.log(
     "  - `envpilot` or `envpilot ui` opens the interactive terminal UI."
   );