@linguanahq/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,1543 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { spawn } from "node:child_process";
+import { join as join5, resolve as resolve4 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { group } from "@clack/prompts";
+
+// ../templates/src/deployments.json
+var deployments_default = {};
+
+// ../templates/src/registry.ts
+var templateVersion = "0.1.0";
+var templateSourcePackageVersion = "0.1.0";
+var sdkVersion = "0.1.1";
+var defaultApiUrl = "https://linguana-api.mohammedibrahim.dev";
+var frameworks = [
+  "react",
+  "vue",
+  "svelte",
+  "solidjs",
+  "tanstack-start"
+];
+var frameworkLabels = {
+  react: "React",
+  vue: "Vue",
+  svelte: "Svelte",
+  solidjs: "SolidJS",
+  "tanstack-start": "TanStack Start"
+};
+var templateIds = ["blog", "saas", "storefront"];
+var templates = [
+  {
+    id: "blog",
+    name: "Elsewhere",
+    category: "Blog",
+    description: "A journal for the places worth taking your time in. Articles, search, and thoughtful reading layouts.",
+    color: "#244d64",
+    features: [
+      "Six complete articles",
+      "Search and categories",
+      "Localized dates"
+    ]
+  },
+  {
+    id: "saas",
+    name: "Relay",
+    category: "SaaS landing page",
+    description: "A home for your next product. Interactive handovers, clear pricing, and a useful first impression.",
+    color: "#4458c5",
+    features: [
+      "Interactive product preview",
+      "Monthly and annual pricing",
+      "Accessible demo forms"
+    ]
+  },
+  {
+    id: "storefront",
+    name: "Common Goods",
+    category: "Storefront",
+    description: "Everyday essentials, considered carefully. Product browsing, a persistent cart, and room to make it yours.",
+    color: "#234f45",
+    features: [
+      "Eight original products",
+      "Search, sort, and filters",
+      "Persistent shopping cart"
+    ]
+  }
+];
+var deployments = deployments_default;
+var variants = templates.flatMap(
+  (template) => frameworks.map((framework) => {
+    const id = `${template.id}/${framework}`;
+    return {
+      schemaVersion: 1,
+      id,
+      template: template.id,
+      framework,
+      version: templateVersion,
+      sdkVersion,
+      sourceDirectory: id,
+      rendering: framework === "tanstack-start" ? "ssr" : "spa",
+      locales: ["en", "fr", "es", "ar"],
+      sourceUrl: `https://unpkg.com/@linguanahq/cli@${templateSourcePackageVersion}/dist/templates/${id}/`,
+      demoUrl: deployments[id]?.version === templateVersion ? deployments[id]?.url : void 0,
+      screenshot: `/templates/${template.id}-${framework}.png`,
+      deploymentTargets: framework === "tanstack-start" ? ["cloudflare", "node"] : ["cloudflare", "static"]
+    };
+  })
+);
+function normalizeFramework(value) {
+  const normalized = value === "solid" ? "solidjs" : value;
+  return frameworks.includes(normalized) ? normalized : void 0;
+}
+
+// ../templates/src/scaffold.ts
+import {
+  cp,
+  lstat,
+  mkdir,
+  readdir,
+  readFile,
+  realpath,
+  writeFile
+} from "node:fs/promises";
+import { basename, dirname, resolve } from "node:path";
+async function validateDestination(directory) {
+  const target = resolve(directory);
+  if (target === dirname(target))
+    throw new Error("Choose an application directory, not a filesystem root.");
+  let current = target;
+  while (current !== dirname(current)) {
+    const stat2 = await lstat(current).catch(() => void 0);
+    if (stat2?.isSymbolicLink())
+      throw new Error(
+        "Application directories must not pass through symbolic links."
+      );
+    current = dirname(current);
+  }
+  const stat = await lstat(target).catch(() => void 0);
+  if (stat && !stat.isDirectory())
+    throw new Error("The destination is not a directory.");
+  if (stat && (await readdir(target)).some((name) => name !== ".git"))
+    throw new Error(
+      "The destination is not empty. Choose a new directory, or use linguana link for an existing app."
+    );
+  return target;
+}
+async function scaffold(input) {
+  const target = await validateDestination(input.directory);
+  const variant = variants.find(
+    (item) => item.framework === input.framework && item.template === input.template
+  );
+  if (!variant) throw new Error("Unsupported framework/template combination.");
+  const sourceRoot = resolve(
+    input.sourceRoot ?? resolve(import.meta.dirname, "../sources")
+  );
+  const source = resolve(sourceRoot, variant.sourceDirectory);
+  if (!(await realpath(source)).startsWith(`${await realpath(sourceRoot)}/`))
+    throw new Error("Invalid template source path.");
+  await mkdir(target, { recursive: true });
+  for (const entry of await readdir(source)) {
+    if (["node_modules", ".output", "dist", ".linguana", ".env.local"].includes(
+      entry
+    ))
+      continue;
+    await cp(
+      resolve(source, entry),
+      resolve(target, entry === "_gitignore" ? ".gitignore" : entry),
+      {
+        recursive: true,
+        errorOnExist: true,
+        force: false,
+        dereference: true
+      }
+    );
+  }
+  const manifestPath = resolve(target, "package.json");
+  const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+  manifest.name = basename(target).toLowerCase().replace(/[^a-z0-9._-]/g, "-").replace(/^[._-]+/, "") || "linguana-app";
+  await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}
+`);
+  return { directory: target, variant };
+}
+
+// src/index.ts
+import { Command, CommanderError } from "commander";
+
+// src/cancellation.ts
+var cancellation = new AbortController();
+
+// src/errors.ts
+var CliError = class extends Error {
+  constructor(message, code = "COMMAND_FAILED", exitCode = 1) {
+    super(message);
+    this.code = code;
+    this.exitCode = exitCode;
+    this.name = "CliError";
+  }
+  code;
+  exitCode;
+};
+function safeMessage(error) {
+  const text2 = error instanceof Error ? error.message : "The command failed.";
+  return text2.replace(/\blna_[\w.-]+/g, "[REDACTED]").replace(/Bearer\s+\S+/gi, "Bearer [REDACTED]");
+}
+
+// src/api.ts
+function apiOrigin(value = defaultApiUrl) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new CliError("Enter a valid API origin.", "INVALID_API_URL", 2);
+  }
+  const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  if (url.protocol !== "https:" && !(local && url.protocol === "http:") || url.username || url.password || url.search || url.hash || url.pathname !== "/")
+    throw new CliError(
+      "The API must be an HTTPS origin, or an HTTP loopback origin for development.",
+      "INVALID_API_URL",
+      2
+    );
+  return url.origin;
+}
+var ApiError = class extends CliError {
+  constructor(status, code, message, requestId) {
+    super(`${message}${requestId ? ` (request ${requestId})` : ""}`, code);
+    this.status = status;
+    this.requestId = requestId;
+  }
+  status;
+  requestId;
+};
+var Api = class {
+  constructor(origin, token, fetcher = fetch) {
+    this.token = token;
+    this.fetcher = fetcher;
+    this.origin = apiOrigin(origin);
+  }
+  token;
+  fetcher;
+  origin;
+  async request(path, options = {}) {
+    if (!path.startsWith("/") || path.startsWith("//") || new URL(path, this.origin).origin !== this.origin)
+      throw new CliError("Invalid API request path.", "INVALID_API_PATH", 2);
+    const response = await this.fetcher(new URL(path, this.origin), {
+      method: options.method ?? "GET",
+      redirect: "error",
+      signal: AbortSignal.any([
+        cancellation.signal,
+        AbortSignal.timeout(3e4),
+        ...options.signal ? [options.signal] : []
+      ]),
+      headers: {
+        "content-type": "application/json",
+        "user-agent": "linguana-cli/0.1.0",
+        ...this.token ? { authorization: `Bearer ${this.token}` } : {},
+        ...options.key ? { "idempotency-key": options.key } : {}
+      },
+      body: options.body === void 0 ? void 0 : JSON.stringify(options.body)
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok)
+      throw new ApiError(
+        response.status,
+        String(body.code ?? body.error ?? `HTTP_${response.status}`),
+        String(
+          body.message ?? body.error_description ?? (response.status === 401 ? "Your login has expired. Run linguana login." : `Linguana returned HTTP ${response.status}.`)
+        ),
+        typeof body.requestId === "string" ? body.requestId : void 0
+      );
+    return body;
+  }
+};
+
+// src/auth.ts
+import { createHash } from "node:crypto";
+import { rm as rm2 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import open from "open";
+
+// src/files.ts
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import {
+  chmod,
+  lstat as lstat2,
+  mkdir as mkdir2,
+  readFile as readFile2,
+  rename,
+  rm,
+  writeFile as writeFile2
+} from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname as dirname2, join, resolve as resolve2 } from "node:path";
+function configDirectory() {
+  if (process.env.LINGUANA_CONFIG_DIR)
+    return resolve2(process.env.LINGUANA_CONFIG_DIR);
+  if (process.platform === "win32")
+    return join(
+      process.env.APPDATA ?? join(homedir(), "AppData/Roaming"),
+      "Linguana"
+    );
+  if (process.platform === "darwin")
+    return join(homedir(), "Library/Application Support/Linguana");
+  return join(
+    process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"),
+    "linguana"
+  );
+}
+async function assertNoSymlink(path) {
+  let current = resolve2(path);
+  while (current !== dirname2(current)) {
+    if ((await lstat2(current).catch(() => void 0))?.isSymbolicLink())
+      throw new CliError(
+        `Refusing to write through a symbolic link: ${current}`,
+        "UNSAFE_PATH",
+        2
+      );
+    current = dirname2(current);
+  }
+}
+async function atomicWrite(path, contents, secret = false) {
+  await assertNoSymlink(path);
+  await mkdir2(dirname2(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile2(temporary, contents, {
+      flag: "wx",
+      mode: secret ? 384 : 420
+    });
+    await rename(temporary, path);
+    if (secret) await chmod(path, 384);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+async function readJson(path) {
+  try {
+    return JSON.parse(await readFile2(path, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw new CliError(
+      `Cannot read ${path}. Repair the file before continuing.`,
+      "INVALID_CONFIG",
+      2
+    );
+  }
+}
+var writeJson = (path, value, secret = false) => atomicWrite(path, `${JSON.stringify(value, null, 2)}
+`, secret);
+function isGitTracked(directory, file) {
+  try {
+    return execFileSync("git", ["ls-files", "--error-unmatch", "--", file], {
+      cwd: directory,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).length > 0;
+  } catch {
+    return false;
+  }
+}
+function parseEnv(source) {
+  const values = {};
+  for (const line of source.split(/\r?\n/)) {
+    const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(
+      line
+    );
+    if (!match?.[1]) continue;
+    let value = (match[2] ?? "").trim();
+    const quoted = /^("(?:\\.|[^"\\])*"|'[^']*')\s*(?:#.*)?$/.exec(value)?.[1];
+    if (quoted) value = quoted;
+    if (quoted?.startsWith('"')) {
+      try {
+        value = JSON.parse(value);
+      } catch {
+        value = value.slice(1, -1).replace(/\\n/g, "\n").replace(/\\r/g, "\r");
+      }
+    } else if (quoted?.startsWith("'")) value = value.slice(1, -1);
+    else value = value.replace(/#.*$/, "").trim();
+    values[match[1]] = value;
+  }
+  return values;
+}
+function mergeEnv(source, updates) {
+  const newline = source.includes("\r\n") ? "\r\n" : "\n";
+  const seen = /* @__PURE__ */ new Set();
+  const lines = source.split(/\r?\n/).map((line) => {
+    const match = /^(\s*(?:export\s+)?)([A-Za-z_][A-Za-z0-9_]*)(\s*=).*?$/.exec(
+      line
+    );
+    const key = match?.[2];
+    if (!key || !(key in updates)) return line;
+    if (seen.has(key))
+      throw new CliError(
+        `Duplicate environment variable ${key}; remove the duplicate before continuing.`,
+        "DUPLICATE_ENV",
+        2
+      );
+    seen.add(key);
+    const comment = /\s+(#.*)$/.exec(line)?.[1];
+    return `${match?.[1] ?? ""}${key}=${JSON.stringify(updates[key])}${comment ? ` ${comment}` : ""}`;
+  });
+  while (lines.at(-1) === "") lines.pop();
+  for (const [key, value] of Object.entries(updates))
+    if (!seen.has(key)) lines.push(`${key}=${JSON.stringify(value)}`);
+  return `${lines.join(newline)}${newline}`;
+}
+async function ensureGitignore(directory) {
+  const path = join(directory, ".gitignore");
+  const source = await readFile2(path, "utf8").catch(() => "");
+  const additions = [".env.local", ".env.*.local", ".linguana/"].filter(
+    (line) => !source.split(/\r?\n/).includes(line)
+  );
+  if (additions.length)
+    await atomicWrite(
+      path,
+      `${source}${source.endsWith("\n") || !source ? "" : "\n"}${additions.join("\n")}
+`
+    );
+}
+
+// src/auth.ts
+var credentialPath = (origin) => join2(
+  configDirectory(),
+  `${createHash("sha256").update(origin).digest("hex")}.json`
+);
+async function savedToken(origin) {
+  const supplied = process.env.LINGUANA_AUTH_TOKEN;
+  if (supplied) {
+    if (supplied.startsWith("lna_"))
+      throw new CliError(
+        "LINGUANA_AUTH_TOKEN expects an account session, not a project build token.",
+        "WRONG_TOKEN_TYPE",
+        2
+      );
+    return supplied;
+  }
+  const value = await readJson(credentialPath(origin));
+  if (!value) return void 0;
+  if (value.schemaVersion !== 1 || value.origin !== origin || typeof value.token !== "string" || !Number.isFinite(Date.parse(value.expiresAt)))
+    throw new CliError(
+      "Saved login is invalid. Run linguana login.",
+      "INVALID_CREDENTIALS"
+    );
+  if (Date.parse(value.expiresAt) <= Date.now()) {
+    await rm2(credentialPath(origin), { force: true });
+    return void 0;
+  }
+  return value.token;
+}
+async function login(origin, ui, options = {}) {
+  const api = options.api ?? new Api(origin);
+  const data = await api.request("/api/auth/device/code", {
+    method: "POST",
+    body: { client_id: "linguana-cli" },
+    signal: options.signal ?? cancellation.signal
+  });
+  const verification = new URL(
+    data.verification_uri_complete ?? data.verification_uri
+  );
+  apiOrigin(verification.origin);
+  if (!data.device_code || !data.user_code || !Number.isFinite(data.expires_in) || !Number.isFinite(data.interval))
+    throw new CliError(
+      "The server returned an invalid device authorization response.",
+      "INVALID_AUTH_RESPONSE"
+    );
+  ui.notice(
+    `Open ${verification.href}
+Confirm code: ${data.user_code}
+Sign in or create an account, then authorize your terminal.`
+  );
+  if (options.browser !== false)
+    await (options.openBrowser ?? open)(verification.href).catch(
+      () => ui.notice("Could not open a browser. Open the address above manually.")
+    );
+  const deadline = Date.now() + Math.min(data.expires_in, 600) * 1e3;
+  let interval = Math.max(5, data.interval);
+  while (Date.now() < deadline) {
+    await delay(interval * 1e3, void 0, {
+      signal: options.signal ?? cancellation.signal
+    });
+    try {
+      const result = await api.request("/api/auth/device/token", {
+        method: "POST",
+        body: {
+          client_id: "linguana-cli",
+          device_code: data.device_code,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        },
+        signal: options.signal ?? cancellation.signal
+      });
+      if (!result.access_token || !Number.isFinite(result.expires_in) || result.expires_in <= 0)
+        throw new CliError(
+          "The server returned an invalid CLI session.",
+          "INVALID_AUTH_RESPONSE"
+        );
+      await writeJson(
+        credentialPath(origin),
+        {
+          schemaVersion: 1,
+          origin,
+          token: result.access_token,
+          expiresAt: new Date(
+            Date.now() + result.expires_in * 1e3
+          ).toISOString()
+        },
+        true
+      );
+      return new Api(origin, result.access_token, api.fetcher);
+    } catch (error) {
+      if (!(error instanceof ApiError)) throw error;
+      if (error.code === "authorization_pending") continue;
+      if (error.code === "slow_down" || error.status === 429) {
+        interval += 5;
+        continue;
+      }
+      if (error.code === "access_denied")
+        throw new CliError(
+          "Authorization was denied. Run linguana login to try again.",
+          "ACCESS_DENIED"
+        );
+      if (error.code === "expired_token")
+        throw new CliError(
+          "The login code expired. Run linguana login again.",
+          "LOGIN_EXPIRED"
+        );
+      throw error;
+    }
+  }
+  throw new CliError(
+    "The login code expired. Run linguana login again.",
+    "LOGIN_EXPIRED"
+  );
+}
+async function authenticatedApi(origin, ui) {
+  const token = await savedToken(origin);
+  if (!token) {
+    if (ui.interactive) return login(origin, ui);
+    throw new CliError(
+      "Sign in with linguana login first, or use --demo to create an app without an account.",
+      "LOGIN_REQUIRED"
+    );
+  }
+  const api = new Api(origin, token);
+  const session = await api.request("/api/auth/get-session");
+  if (!session?.user)
+    throw new CliError(
+      "Your session has expired or was revoked. Run linguana login.",
+      "LOGIN_REQUIRED"
+    );
+  return api;
+}
+async function logout(origin) {
+  const token = await savedToken(origin);
+  let failure;
+  try {
+    if (token)
+      await new Api(origin, token).request("/api/auth/sign-out", {
+        method: "POST",
+        body: {}
+      });
+  } catch (error) {
+    failure = error;
+  }
+  await rm2(credentialPath(origin), { force: true });
+  if (failure)
+    throw new CliError(
+      "Local login removed, but the server could not revoke the session. Revoke it in account settings when the server is available.",
+      "REMOTE_LOGOUT_FAILED"
+    );
+}
+
+// src/doctor.ts
+import { readFile as readFile4 } from "node:fs/promises";
+import { join as join4 } from "node:path";
+
+// src/project.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { constants } from "node:fs";
+import { access, mkdir as mkdir3, open as open2, readFile as readFile3, rm as rm3 } from "node:fs/promises";
+import { hostname } from "node:os";
+import { basename as basename2, join as join3, resolve as resolve3 } from "node:path";
+async function readProject(directory) {
+  const config = await readJson(
+    join3(directory, "linguana.json")
+  );
+  if (config && (config.schemaVersion !== 1 || !normalizeFramework(config.framework) || !["demo", "connected"].includes(config.mode) || !config.sourceLocale || !config.defaultEnvironment))
+    throw new CliError(
+      "linguana.json is invalid or uses an unsupported schema version.",
+      "INVALID_PROJECT_CONFIG",
+      2
+    );
+  return config;
+}
+async function detectFramework(directory, provided) {
+  if (provided) {
+    const value = normalizeFramework(provided);
+    if (value) return value;
+    throw new CliError("Unsupported framework.", "INVALID_FRAMEWORK", 2);
+  }
+  const manifest = await readJson(join3(directory, "package.json"));
+  if (!manifest)
+    throw new CliError(
+      "No package.json found. Run this command in an app directory.",
+      "APP_NOT_FOUND",
+      2
+    );
+  const dependencies = {
+    ...manifest.dependencies,
+    ...manifest.devDependencies
+  };
+  if (dependencies["@tanstack/react-start"]) return "tanstack-start";
+  const candidates = [
+    ["react", "react"],
+    ["vue", "vue"],
+    ["svelte", "svelte"],
+    ["solid-js", "solidjs"]
+  ].filter(([dependency]) => dependencies[dependency]);
+  const candidate = candidates[0];
+  if (candidates.length !== 1 || !candidate)
+    throw new CliError(
+      "Could not identify one framework. Pass --framework explicitly.",
+      "FRAMEWORK_REQUIRED",
+      2
+    );
+  return candidate[1];
+}
+function environmentFile(environment) {
+  if (!/^[a-z][a-z0-9-]{0,39}$/.test(environment))
+    throw new CliError("Invalid environment name.", "INVALID_ENVIRONMENT", 2);
+  return environment === "development" ? ".env.local" : `.env.${environment}.local`;
+}
+function slug(value) {
+  const result = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 55).replace(/-$/, "");
+  if (!result)
+    throw new CliError(
+      "The name needs at least one letter or number.",
+      "INVALID_NAME",
+      2
+    );
+  return result;
+}
+async function connectProject(directory, options, ui, suppliedApi) {
+  const root = resolve3(directory);
+  await assertNoSymlink(root);
+  await assertNoSymlink(join3(root, "linguana.json"));
+  await assertNoSymlink(join3(root, ".linguana/setup.json"));
+  const previous = await readProject(root);
+  const framework = await detectFramework(
+    root,
+    options.framework ?? previous?.framework
+  );
+  const origin = apiOrigin(options.apiUrl ?? previous?.apiUrl ?? defaultApiUrl);
+  const environment = options.environment ?? previous?.defaultEnvironment ?? "development";
+  const envName = environmentFile(environment);
+  const envPath = join3(root, envName);
+  await assertNoSymlink(envPath);
+  if (isGitTracked(root, envName))
+    throw new CliError(
+      `${envName} is tracked by Git. Remove it from the index before writing credentials.`,
+      "TRACKED_ENV",
+      2
+    );
+  await ensureGitignore(root);
+  await assertNoSymlink(join3(root, ".linguana"));
+  await mkdir3(join3(root, ".linguana"), { recursive: true, mode: 448 });
+  await access(root, constants.W_OK);
+  await access(join3(root, ".linguana"), constants.W_OK);
+  for (const name of ["linguana.json", ".linguana/setup.json"])
+    await access(join3(root, name), constants.W_OK).catch((error) => {
+      if (error.code !== "ENOENT")
+        throw new CliError(
+          `Cannot write ${name}. Fix local permissions before connecting.`,
+          "CONFIG_NOT_WRITABLE"
+        );
+    });
+  await access(envPath, constants.W_OK).catch((error) => {
+    if (error.code !== "ENOENT")
+      throw new CliError(
+        `Cannot write ${envName}. Fix local permissions before connecting.`,
+        "ENV_NOT_WRITABLE"
+      );
+  });
+  const lockPath = join3(root, ".linguana/cli.lock");
+  let lock;
+  try {
+    lock = await open2(lockPath, "wx", 384);
+  } catch {
+    const owner = await readJson(lockPath);
+    let stale = false;
+    if (owner?.hostname === hostname() && Number.isInteger(owner.pid) && owner.pid > 0) {
+      try {
+        process.kill(owner.pid, 0);
+      } catch (error) {
+        stale = error.code === "ESRCH";
+      }
+    }
+    if (!stale)
+      throw new CliError(
+        "Another setup is running. If it was interrupted on another machine, remove .linguana/cli.lock and retry.",
+        "SETUP_LOCKED"
+      );
+    await rm3(lockPath);
+    lock = await open2(lockPath, "wx", 384);
+  }
+  await lock.writeFile(
+    JSON.stringify({ pid: process.pid, hostname: hostname() })
+  );
+  try {
+    const api = suppliedApi ?? await authenticatedApi(origin, ui);
+    const links = await api.request(
+      "/api/v1/cli/config"
+    );
+    const projectUrl = new URL(
+      "/dashboard",
+      apiOrigin(new URL(links.dashboardUrl).origin)
+    );
+    const journalPath = join3(root, ".linguana/setup.json");
+    const stored = await readJson(journalPath);
+    const journal = stored?.origin === origin ? stored : { schemaVersion: 1, origin, keys: {} };
+    const key = async (scope) => {
+      if (!journal.keys[scope]) {
+        journal.keys[scope] = randomUUID2();
+        await writeJson(journalPath, journal);
+      }
+      return journal.keys[scope];
+    };
+    const organizations = await api.request(
+      "/api/v1/organizations"
+    );
+    let projectId = options.project ?? (!options.newProject && previous?.apiUrl === origin ? previous.projectId : void 0) ?? (!options.newProject ? journal.projectId : void 0);
+    let project = projectId ? await api.request(
+      `/api/v1/projects/${encodeURIComponent(projectId)}/settings`
+    ) : void 0;
+    let organization = options.newOrganization ? void 0 : organizations.find(
+      (item) => item.id === (options.organization ?? project?.organizationId ?? journal.organizationId)
+    );
+    if (options.organization && !organization)
+      throw new CliError(
+        "Organization not found in your account.",
+        "ORGANIZATION_NOT_FOUND"
+      );
+    if (project && options.organization && project.organizationId !== options.organization)
+      throw new CliError(
+        "The project belongs to a different organization.",
+        "PROJECT_SCOPE_MISMATCH",
+        2
+      );
+    if (options.newOrganization && project)
+      throw new CliError(
+        "A new organization cannot be combined with an existing project.",
+        "CONFLICTING_OPTIONS",
+        2
+      );
+    if (!organization) {
+      const selection = options.newOrganization || organizations.length === 0 ? "new" : await ui.choose("Choose an organization", [
+        ...organizations.map((item) => ({
+          value: item.id,
+          label: item.name
+        })),
+        ...ui.interactive ? [{ value: "new", label: "Create an organization" }] : []
+      ]);
+      if (selection === "new") {
+        if (!options.newOrganization && !ui.interactive)
+          throw new CliError(
+            "Pass --new-organization <name> to create your first organization.",
+            "ORGANIZATION_REQUIRED",
+            2
+          );
+        const session = await api.request("/api/auth/get-session");
+        const name = options.newOrganization ?? await ui.input(
+          "Organization name",
+          `${session.user.name}'s workspace`
+        );
+        const created = await api.request(
+          "/api/v1/organizations",
+          {
+            method: "POST",
+            body: { name, slug: slug(name) },
+            key: await key(`organization:${name}`)
+          }
+        );
+        organization = { ...created, memberships: [{ role: "OWNER" }] };
+      } else organization = organizations.find((item) => item.id === selection);
+    }
+    if (organization?.lifecycleStatus !== "ACTIVE" || !organization.memberships.some(
+      (membership) => ["OWNER", "ADMIN"].includes(membership.role)
+    ))
+      throw new CliError(
+        "Connecting credentials requires Owner or Admin access to an active organization.",
+        "INSUFFICIENT_PERMISSIONS"
+      );
+    journal.organizationId = organization.id;
+    await writeJson(journalPath, journal);
+    let createdProject = false;
+    if (!project) {
+      const projects = await api.request(
+        `/api/v1/organizations/${organization.id}/projects`
+      );
+      const selected = options.newProject ? "new" : await ui.choose(
+        "Choose a project",
+        [
+          ...projects.filter((item) => item.lifecycleStatus === "ACTIVE").map((item) => ({ value: item.id, label: item.name })),
+          { value: "new", label: "Create a project" }
+        ],
+        projects.length === 0 ? "new" : void 0
+      );
+      if (selected === "new") {
+        const name = options.newProject ?? await ui.input("Project name", basename2(root));
+        project = await api.request(
+          `/api/v1/organizations/${organization.id}/projects`,
+          {
+            method: "POST",
+            body: { name, slug: slug(name), sourceLocale: "en" },
+            key: await key(`project:${organization.id}:${name}`)
+          }
+        );
+        createdProject = true;
+      } else
+        project = await api.request(
+          `/api/v1/projects/${selected}/settings`
+        );
+    }
+    if (project.lifecycleStatus !== "ACTIVE")
+      throw new CliError(
+        "This project is pending deletion.",
+        "PROJECT_INACTIVE"
+      );
+    if (previous?.template && project.sourceLocale !== "en")
+      throw new CliError(
+        "These templates use English source content. Choose an English-source project.",
+        "SOURCE_LOCALE_MISMATCH",
+        2
+      );
+    projectId = project.id;
+    journal.projectId = project.id;
+    await writeJson(journalPath, journal);
+    const targetEnvironment = project.environments.find(
+      (item) => item.name === environment
+    );
+    if (!targetEnvironment)
+      throw new CliError(
+        "This project does not have the requested environment.",
+        "ENVIRONMENT_NOT_FOUND"
+      );
+    if (createdProject || options.locales !== void 0) {
+      const registry = await api.request(`/api/v1/projects/${project.id}/locale-registry`);
+      const locales = options.locales !== void 0 ? options.locales.split(",").map((item) => item.trim()).filter(Boolean) : await ui.languages(
+        registry.filter((item) => item.code !== project?.sourceLocale).map((item) => ({
+          value: item.code,
+          label: `${item.displayName} (${item.code})`
+        }))
+      );
+      for (const localeCode of new Set(locales)) {
+        if (localeCode === project.sourceLocale) continue;
+        if (!registry.some((item) => item.code === localeCode))
+          throw new CliError(
+            `Unknown locale ${localeCode}.`,
+            "INVALID_LOCALE",
+            2
+          );
+        await api.request(`/api/v1/projects/${project.id}/locales`, {
+          method: "POST",
+          body: {
+            localeCode,
+            status: "ENABLED",
+            fallbackLocale: project.sourceLocale
+          },
+          key: await key(`locale:${project.id}:${localeCode}`)
+        });
+      }
+    }
+    const oldSource = await readFile3(envPath, "utf8").catch((error) => {
+      if (error.code === "ENOENT") return "";
+      throw error;
+    });
+    const old = parseEnv(oldSource);
+    const updates = {
+      LINGUANA_PROJECT_ID: project.id,
+      LINGUANA_ENVIRONMENT: environment,
+      LINGUANA_API_URL: origin,
+      LINGUANA_UPLOAD: "true",
+      LINGUANA_TRANSLATE: "false",
+      VITE_LINGUANA_PROJECT_ID: project.id,
+      VITE_LINGUANA_ENVIRONMENT: environment,
+      VITE_LINGUANA_API_URL: origin,
+      VITE_LINGUANA_PUBLISHABLE_KEY: project.catalogReadKey
+    };
+    const conflicts = Object.keys(updates).filter(
+      (name) => old[name] !== void 0 && old[name] !== updates[name]
+    );
+    if (conflicts.length && !options.overwriteEnv && !await ui.confirm(
+      `Replace these variables in ${envName}: ${conflicts.join(", ")}?`
+    ))
+      throw new CliError(
+        "Environment variables were preserved. Retry with --overwrite-env to replace Linguana values.",
+        "ENV_CONFLICT",
+        2
+      );
+    mergeEnv(oldSource, { ...updates, LINGUANA_PROJECT_TOKEN: "pending" });
+    let token;
+    try {
+      if (old.LINGUANA_API_URL && apiOrigin(old.LINGUANA_API_URL) === origin)
+        token = old.LINGUANA_PROJECT_TOKEN;
+    } catch {
+    }
+    if (token) {
+      try {
+        const current = await new Api(origin, token, api.fetcher).request("/api/v1/project-tokens/current");
+        if (current.projectId !== project.id || current.environmentId !== targetEnvironment.id)
+          token = void 0;
+      } catch (error) {
+        if (error instanceof CliError && "status" in error && [401, 404].includes(Number(error.status)))
+          token = void 0;
+        else throw error;
+      }
+    }
+    let createdTokenId;
+    if (!token) {
+      if (old.LINGUANA_PROJECT_TOKEN && !options.overwriteEnv && !await ui.confirm(
+        `Replace the invalid or differently scoped token in ${envName}?`
+      ))
+        throw new CliError(
+          "Existing token preserved. Use --overwrite-env to replace it.",
+          "ENV_CONFLICT",
+          2
+        );
+      const scope = `token:${project.id}:${environment}`;
+      const create = () => api.request(
+        `/api/v1/projects/${project?.id}/environments/${environment}/tokens`,
+        {
+          method: "POST",
+          body: { name: `Linguana CLI: ${basename2(root)}`.slice(0, 80) },
+          key: journal.keys[scope]
+        }
+      );
+      await key(scope);
+      let result = await create();
+      if (!result.value) {
+        if (!result.id)
+          throw new CliError(
+            "Token recovery failed. Inspect your project tokens in the dashboard.",
+            "TOKEN_RECOVERY_FAILED"
+          );
+        await api.request(`/api/v1/project-tokens/${result.id}`, {
+          method: "DELETE",
+          key: await key(`revoke:${result.id}`)
+        });
+        journal.keys[scope] = randomUUID2();
+        await writeJson(journalPath, journal);
+        result = await create();
+      }
+      if (!result.value)
+        throw new CliError(
+          "The token secret is unavailable. Retry linguana env pull.",
+          "TOKEN_SECRET_UNAVAILABLE"
+        );
+      token = result.value;
+      createdTokenId = result.id;
+    }
+    try {
+      await atomicWrite(
+        envPath,
+        mergeEnv(oldSource, { ...updates, LINGUANA_PROJECT_TOKEN: token }),
+        true
+      );
+    } catch (error) {
+      if (createdTokenId)
+        await api.request(`/api/v1/project-tokens/${createdTokenId}`, {
+          method: "DELETE",
+          key: await key(`revoke:${createdTokenId}`)
+        }).catch(
+          () => ui.notice(
+            "The environment file could not be written. Revoke the new CLI token in the dashboard."
+          )
+        );
+      throw error;
+    }
+    const config = {
+      ...previous,
+      schemaVersion: 1,
+      framework,
+      mode: "connected",
+      apiUrl: origin,
+      organizationId: organization.id,
+      projectId: project.id,
+      sourceLocale: project.sourceLocale,
+      defaultEnvironment: previous?.defaultEnvironment ?? environment
+    };
+    await writeJson(join3(root, "linguana.json"), config);
+    projectUrl.searchParams.set("project", project.id);
+    return {
+      config,
+      environment,
+      envFile: envName,
+      projectId: project.id,
+      organizationId: organization.id,
+      projectUrl: projectUrl.href
+    };
+  } finally {
+    await lock.close();
+    await rm3(lockPath, { force: true });
+  }
+}
+
+// src/doctor.ts
+async function doctor(directory, requestedEnvironment) {
+  const checks = [];
+  const config = await readProject(directory);
+  const framework = await detectFramework(directory, config?.framework);
+  checks.push({ check: "framework", ok: true, message: framework });
+  const manifest = await readJson(join4(directory, "package.json"));
+  const dependencies = {
+    ...manifest?.dependencies,
+    ...manifest?.devDependencies
+  };
+  const adapter = framework === "solidjs" ? "solid" : framework === "tanstack-start" ? "react" : framework;
+  checks.push({
+    check: "sdk",
+    ok: Boolean(
+      dependencies[`@linguanahq/${adapter}`] && dependencies["@linguanahq/vite"]
+    ),
+    message: `Install @linguanahq/${adapter} and @linguanahq/vite.`
+  });
+  const vite = await readFile4(join4(directory, "vite.config.ts"), "utf8").catch(
+    () => ""
+  );
+  checks.push({
+    check: "vite",
+    ok: vite.includes("linguana("),
+    message: "Vite configuration must run linguana() before the framework plugin."
+  });
+  checks.push({
+    check: "configuration",
+    ok: Boolean(config),
+    message: config ? `${config.mode} mode` : "Run linguana link to create linguana.json."
+  });
+  if (config?.mode === "connected") {
+    const accountToken = await savedToken(apiOrigin(config.apiUrl));
+    let authenticated = false;
+    if (accountToken) {
+      try {
+        authenticated = Boolean(
+          (await new Api(config.apiUrl, accountToken).request("/api/auth/get-session"))?.user
+        );
+      } catch {
+      }
+    }
+    checks.push({
+      check: "authentication",
+      ok: authenticated,
+      message: authenticated ? "CLI account session is valid." : "Run linguana login to manage this project."
+    });
+    const environment = requestedEnvironment ?? config.defaultEnvironment;
+    const file = environmentFile(environment);
+    const env = parseEnv(
+      await readFile4(join4(directory, file), "utf8").catch(() => "")
+    );
+    const consistent = env.LINGUANA_PROJECT_ID === config.projectId && env.VITE_LINGUANA_PROJECT_ID === config.projectId && env.LINGUANA_ENVIRONMENT === environment && env.VITE_LINGUANA_ENVIRONMENT === environment && env.LINGUANA_API_URL === config.apiUrl && env.VITE_LINGUANA_API_URL === config.apiUrl;
+    checks.push({
+      check: "environment",
+      ok: consistent,
+      message: consistent ? `${file} matches the linked project.` : `Run linguana env pull --environment ${environment} to synchronize ${file}.`
+    });
+    checks.push({
+      check: "git",
+      ok: !isGitTracked(directory, file),
+      message: `${file} must not be tracked by Git.`
+    });
+    checks.push({
+      check: "browser-secrets",
+      ok: !Object.entries(env).some(
+        ([key, value]) => key.startsWith("VITE_") && (/TOKEN|SECRET|PASSWORD/.test(key) || value.startsWith("lna_"))
+      ),
+      message: "Browser variables must not contain secrets."
+    });
+    if (!env.LINGUANA_PROJECT_TOKEN)
+      checks.push({
+        check: "token",
+        ok: false,
+        message: "No project token found. Run linguana env pull."
+      });
+    else {
+      try {
+        const current = await new Api(
+          apiOrigin(config.apiUrl),
+          env.LINGUANA_PROJECT_TOKEN
+        ).request(
+          "/api/v1/project-tokens/current"
+        );
+        checks.push({
+          check: "token",
+          ok: current.projectId === config.projectId && current.environment === environment,
+          message: "The token must be valid and belong to the linked project."
+        });
+      } catch {
+        checks.push({
+          check: "token",
+          ok: false,
+          message: "Could not validate the token. Check connectivity and run linguana env pull."
+        });
+      }
+    }
+  }
+  return { ok: checks.every((item) => item.ok), checks };
+}
+
+// src/ui.ts
+import * as clack from "@clack/prompts";
+var Ui = class {
+  constructor(options = {}) {
+    this.options = options;
+    this.interactive = Boolean(
+      process.stdin.isTTY && process.stdout.isTTY && !options.yes && !options.json
+    );
+  }
+  options;
+  interactive;
+  answer(value) {
+    if (clack.isCancel(value))
+      throw new CliError(
+        "Canceled. You can resume project setup with linguana link.",
+        "CANCELED",
+        130
+      );
+    return value;
+  }
+  async input(message, initialValue) {
+    if (!this.interactive) {
+      if (initialValue) return initialValue;
+      throw new CliError(
+        `${message} Supply the corresponding command option.`,
+        "INPUT_REQUIRED",
+        2
+      );
+    }
+    return this.answer(
+      await clack.text({
+        message,
+        initialValue,
+        validate: (value) => value?.trim() ? void 0 : "Enter a value."
+      })
+    ).trim();
+  }
+  async choose(message, options, initialValue) {
+    if (!this.interactive) {
+      if (initialValue) return initialValue;
+      const option = options[0];
+      if (options.length === 1 && option) return option.value;
+      throw new CliError(
+        `${message} Supply an explicit option when running noninteractively.`,
+        "INPUT_REQUIRED",
+        2
+      );
+    }
+    return this.answer(
+      await clack.select({ message, options, initialValue })
+    );
+  }
+  async confirm(message, initialValue = false) {
+    if (!this.interactive) return initialValue;
+    return this.answer(await clack.confirm({ message, initialValue }));
+  }
+  async languages(options) {
+    if (!this.interactive)
+      return ["fr", "es", "ar"].filter(
+        (code) => options.some((item) => item.value === code)
+      );
+    return this.answer(
+      await clack.multiselect({
+        message: "Which languages would you like to enable?",
+        options,
+        initialValues: ["fr", "es", "ar"],
+        required: false
+      })
+    );
+  }
+  async progress(message, task) {
+    const spinner2 = this.interactive ? clack.spinner() : void 0;
+    spinner2?.start(message);
+    try {
+      const value = await task();
+      spinner2?.stop(message);
+      return value;
+    } catch (error) {
+      spinner2?.stop("Could not finish this step.");
+      throw error;
+    }
+  }
+  notice(message) {
+    if (this.interactive) clack.log.info(message);
+    else process.stderr.write(`${message}
+`);
+  }
+  result(value, message) {
+    if (this.options.json) process.stdout.write(`${JSON.stringify(value)}
+`);
+    else if (this.interactive) clack.outro(message);
+    else process.stdout.write(`${message}
+`);
+  }
+};
+
+// src/index.ts
+process.once("SIGINT", () => {
+  cancellation.abort();
+  process.exitCode = 130;
+});
+var program = new Command().name("linguana").description("Create and connect multilingual apps with Linguana.").version("0.1.0").option("--json", "Print structured results without secrets").option("--yes", "Use defaults without prompting").option("--api-url <origin>", "Linguana API origin").showHelpAfterError().exitOverride();
+var opts = (command) => command.optsWithGlobals();
+function projectOptions(command) {
+  return command.option("--organization <id>", "Existing organization ID").option("--project <id>", "Existing project ID").option("--new-organization <name>", "Create an organization").option("--new-project <name>", "Create a project").option(
+    "--environment <name>",
+    "Credential environment (default: development)"
+  ).option("--framework <framework>", "Framework name").option("--locales <codes>", "Explicit target languages, comma-separated").option("--overwrite-env", "Replace conflicting Linguana variables");
+}
+function validateOptions(options) {
+  for (const [left, right] of [
+    ["demo", "connect"],
+    ["organization", "newOrganization"],
+    ["project", "newProject"],
+    ["project", "newOrganization"]
+  ])
+    if (options[left] && options[right])
+      throw new CliError(
+        `Options ${left} and ${right} cannot be used together.`,
+        "CONFLICTING_OPTIONS",
+        2
+      );
+  if (options.demo && [
+    options.organization,
+    options.project,
+    options.newOrganization,
+    options.newProject,
+    options.locales
+  ].some(Boolean))
+    throw new CliError(
+      "Project provisioning options cannot be combined with --demo.",
+      "CONFLICTING_OPTIONS",
+      2
+    );
+}
+function packageManager(provided) {
+  const value = provided ?? /^(npm|pnpm|yarn|bun)\//.exec(
+    process.env.npm_config_user_agent ?? ""
+  )?.[1] ?? "npm";
+  if (!["npm", "pnpm", "yarn", "bun"].includes(value))
+    throw new CliError(
+      "Package manager must be npm, pnpm, yarn, or bun.",
+      "INVALID_PACKAGE_MANAGER",
+      2
+    );
+  return value;
+}
+async function install(directory, manager) {
+  await new Promise((done, reject) => {
+    const child = spawn(
+      process.platform === "win32" ? `${manager}.cmd` : manager,
+      ["install"],
+      {
+        cwd: directory,
+        signal: cancellation.signal,
+        stdio: [
+          "ignore",
+          process.argv.includes("--json") ? process.stderr : "inherit",
+          "inherit"
+        ],
+        shell: false
+      }
+    );
+    child.once(
+      "error",
+      () => reject(
+        new CliError(
+          `Could not start ${manager}. Install it, then run ${manager} install in ${directory}.`,
+          "INSTALL_FAILED"
+        )
+      )
+    );
+    child.once(
+      "exit",
+      (code) => code === 0 ? done() : reject(
+        new CliError(
+          `Dependency installation failed. Your app is saved in ${directory}; run ${manager} install there to retry.`,
+          "INSTALL_FAILED"
+        )
+      )
+    );
+  });
+}
+async function originFor(options) {
+  return apiOrigin(
+    options.apiUrl ?? (await readProject(process.cwd()))?.apiUrl ?? defaultApiUrl
+  );
+}
+projectOptions(
+  program.command("create").description("Create a new app").command("app [directory]").option("--template <template>", "blog, saas, or storefront").option("--demo", "Use bundled translations without an account").option("--connect", "Connect a Linguana project").option("--package-manager <manager>", "npm, pnpm, yarn, or bun").option("--skip-install", "Write files without installing dependencies")
+).action(
+  async (directory, _local, command) => {
+    const options = opts(command);
+    validateOptions(options);
+    const ui = new Ui(options);
+    const choices = {
+      template: async () => options.template ?? await ui.choose(
+        "Choose a template",
+        templates.map((item) => ({
+          value: item.id,
+          label: `${item.name} \u2014 ${item.category}`
+        }))
+      ),
+      framework: async () => options.framework ?? await ui.choose(
+        "Choose a framework",
+        frameworks.map((value) => ({ value, label: frameworkLabels[value] }))
+      )
+    };
+    const selectedChoices = ui.interactive ? await group(choices) : {
+      template: await choices.template(),
+      framework: await choices.framework()
+    };
+    const template = selectedChoices.template;
+    if (!templateIds.includes(template))
+      throw new CliError(
+        "Template must be blog, saas, or storefront.",
+        "INVALID_TEMPLATE",
+        2
+      );
+    const selected = selectedChoices.framework;
+    const framework = normalizeFramework(selected);
+    if (!framework)
+      throw new CliError("Unsupported framework.", "INVALID_FRAMEWORK", 2);
+    const target = directory ?? await ui.input("Where should we create your app?", `my-${template}`);
+    try {
+      await validateDestination(target);
+    } catch (error) {
+      throw new CliError(
+        error instanceof Error ? error.message : "Invalid destination.",
+        "INVALID_DESTINATION",
+        2
+      );
+    }
+    const manager = packageManager(
+      options.packageManager ?? (ui.interactive ? await ui.choose(
+        "Package manager",
+        ["npm", "pnpm", "yarn", "bun"].map((value) => ({
+          value,
+          label: value
+        })),
+        packageManager()
+      ) : void 0)
+    );
+    const mode = options.demo ? "demo" : options.connect ? "connected" : await ui.choose("Connect Linguana or try a demo?", [
+      {
+        value: "connected",
+        label: "Connect Linguana",
+        hint: "Browser sign-in and automatic project setup"
+      },
+      {
+        value: "demo",
+        label: "Try the demo",
+        hint: "No account required"
+      }
+    ]);
+    if (options.apiUrl) apiOrigin(options.apiUrl);
+    const sourceRoot = fileURLToPath(new URL("./templates/", import.meta.url));
+    const result = await ui.progress(
+      "Create your app",
+      () => scaffold({
+        directory: target,
+        framework,
+        template,
+        sourceRoot
+      })
+    );
+    if (options.apiUrl) {
+      const config = await readProject(result.directory);
+      await writeJson(join5(result.directory, "linguana.json"), {
+        ...config,
+        apiUrl: apiOrigin(options.apiUrl)
+      });
+    }
+    let connection;
+    if (mode === "connected") {
+      ui.notice(
+        "Your app is saved. If setup is interrupted, run linguana link in its directory to resume."
+      );
+      connection = await connectProject(result.directory, options, ui);
+    }
+    if (!options.skipInstall)
+      await ui.progress(
+        "Install dependencies",
+        () => install(result.directory, manager)
+      );
+    const quotedTarget = process.platform === "win32" ? JSON.stringify(target) : `'${target.replace(/'/g, "'\\''")}'`;
+    ui.result(
+      {
+        directory: result.directory,
+        framework,
+        template,
+        mode,
+        ...connection ? {
+          projectId: connection.projectId,
+          projectUrl: connection.projectUrl,
+          envFile: connection.envFile
+        } : {},
+        nextCommand: `${manager} run dev`
+      },
+      `Your app is ready.
+
+  cd ${quotedTarget}
+  ${manager} run dev
+
+Deployment: see DEPLOY.md in your app.${connection ? `
+Project: ${connection.projectUrl}
+Builds upload manifests. Paid translation and production publishing remain explicit actions in your dashboard.` : "\nConnect later with: npx @linguanahq/cli link"}`
+    );
+  }
+);
+program.command("templates").command("list").action((_local, command) => {
+  const ui = new Ui(opts(command));
+  ui.result(
+    { templates, variants },
+    templates.map(
+      (item) => `${item.id.padEnd(12)} ${item.name} \u2014 ${item.description}
+  ${frameworks.join(", ")}${variants.filter(
+        (variant) => variant.template === item.id && variant.demoUrl
+      ).map(
+        (variant) => `
+  ${frameworkLabels[variant.framework]} demo: ${variant.demoUrl}`
+      ).join("")}`
+    ).join("\n\n")
+  );
+});
+program.command("login").option(
+  "--no-browser",
+  "Print the authorization address without opening a browser"
+).action(async (_local, command) => {
+  const options = opts(command);
+  const ui = new Ui(options);
+  const api = await login(await originFor(options), ui, {
+    browser: options.browser
+  });
+  const session = await api.request("/api/auth/get-session");
+  ui.result(
+    { user: session.user, origin: api.origin },
+    `Signed in as ${session.user.email}.`
+  );
+});
+program.command("logout").action(async (_local, command) => {
+  const options = opts(command);
+  const origin = await originFor(options);
+  await logout(origin);
+  new Ui(options).result({ signedOut: true, origin }, "Signed out of the CLI.");
+});
+program.command("whoami").action(async (_local, command) => {
+  const options = opts(command);
+  const ui = new Ui(options);
+  const api = await authenticatedApi(await originFor(options), ui);
+  const session = await api.request("/api/auth/get-session");
+  ui.result(
+    { user: session.user, origin: api.origin },
+    `${session.user.name} <${session.user.email}>
+${api.origin}`
+  );
+});
+program.command("orgs").command("list").action(async (_local, command) => {
+  const options = opts(command);
+  const ui = new Ui(options);
+  const api = await authenticatedApi(await originFor(options), ui);
+  const result = await api.request(
+    "/api/v1/organizations"
+  );
+  ui.result(
+    result,
+    result.map((item) => `${item.id}  ${item.name}`).join("\n") || "No organizations. Use linguana link --new-organization <name>."
+  );
+});
+program.command("projects").command("list").option("--organization <id>").action(async (_local, command) => {
+  const options = opts(command);
+  const ui = new Ui(options);
+  const api = await authenticatedApi(await originFor(options), ui);
+  const organizations = await api.request("/api/v1/organizations");
+  const organization = options.organization ?? await ui.choose(
+    "Choose an organization",
+    organizations.map((item) => ({ value: item.id, label: item.name }))
+  );
+  const result = await api.request(
+    `/api/v1/organizations/${encodeURIComponent(organization)}/projects`
+  );
+  ui.result(
+    result,
+    result.map((item) => `${item.id}  ${item.name}`).join("\n") || "No projects. Use linguana link --new-project <name>."
+  );
+});
+projectOptions(
+  program.command("link").description("Connect this app and write environment configuration")
+).action(async (_local, command) => {
+  const options = opts(command);
+  validateOptions(options);
+  const ui = new Ui(options);
+  const result = await connectProject(process.cwd(), options, ui);
+  const integration = result.config.framework === "tanstack-start" ? "getting-started/tanstack-start" : `reference/${result.config.framework === "solidjs" ? "solid" : result.config.framework}`;
+  const provider = result.config.framework === "vue" ? "Register createLinguana(options) on your Vue app." : result.config.framework === "tanstack-start" ? "Load the request locale and catalogs on the server, then pass matching hydrationState to LocaleProvider." : result.config.framework === "svelte" ? "Create a client with createLinguana(options), call setLinguana(client) in your root component, and dispose it onDestroy." : "Wrap your app with LocaleProvider and pass the public project configuration.";
+  ui.result(
+    result,
+    `Connected ${result.projectId}. Wrote ${result.envFile}.
+Project: ${result.projectUrl}
+${frameworkLabels[result.config.framework]} integration: https://linguana-docs.mohammedibrahim.dev/docs/${integration}
+Add the Linguana Vite adapter before your framework plugin and load the environment with loadEnv. ${provider} See the integration guide for exact imports.`
+  );
+});
+projectOptions(
+  program.command("env").command("pull").description("Refresh this app's environment credentials")
+).action(async (_local, command) => {
+  const options = opts(command);
+  validateOptions(options);
+  const ui = new Ui(options);
+  const config = await readProject(process.cwd());
+  if (!config?.projectId)
+    throw new CliError(
+      "Run linguana link before pulling environment configuration.",
+      "PROJECT_NOT_LINKED",
+      2
+    );
+  const result = await connectProject(
+    process.cwd(),
+    { ...options, project: config.projectId },
+    ui
+  );
+  ui.result(result, `Updated ${result.envFile} for ${result.environment}.`);
+});
+program.command("doctor").option("--environment <name>").action(async (_local, command) => {
+  const options = opts(command);
+  const result = await doctor(resolve4(process.cwd()), options.environment);
+  new Ui(options).result(
+    result,
+    result.checks.map(
+      (check) => `${check.ok ? "\u2713" : "\u2717"} ${check.check}: ${check.message}`
+    ).join("\n")
+  );
+  if (!result.ok) process.exitCode = 1;
+});
+try {
+  await program.parseAsync();
+} catch (caught) {
+  const error = cancellation.signal.aborted ? new CliError(
+    "Canceled. Your saved app can be resumed with linguana link.",
+    "CANCELED",
+    130
+  ) : caught;
+  if (error instanceof CommanderError && ["commander.helpDisplayed", "commander.version"].includes(error.code))
+    process.exitCode = 0;
+  else {
+    const code = error instanceof CliError ? error.code : error instanceof CommanderError ? "INVALID_ARGUMENTS" : "COMMAND_FAILED";
+    const message = safeMessage(error);
+    if (process.argv.includes("--json"))
+      process.stdout.write(`${JSON.stringify({ error: { code, message } })}
+`);
+    else process.stderr.write(`Linguana: ${message}
+`);
+    process.exitCode = error instanceof CliError ? error.exitCode : error instanceof CommanderError ? 2 : 1;
+  }
+}