gigadrive 2.2.0 → 2.3.0

package/dist/index.mjs

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command14 } from "@effect/cli";
+import { Command as Command15 } from "@effect/cli";
 import { NodeContext, NodeRuntime } from "@effect/platform-node";
 import { NetworkConfigLive as NetworkConfigLive2 } from "@gigadrive/network-config";
-import { Effect as Effect23, Layer, LogLevel, Logger } from "effect";
+import { Effect as Effect27, Layer, LogLevel, Logger } from "effect";
 
 // package.json
 var package_default = {
   name: "gigadrive",
-  version: "2.2.0",
+  version: "2.3.0",
   repository: {
     type: "git",
     url: "https://github.com/Gigadrive/sdk.git",
@@ -135,6 +135,31 @@ var ApplicationNotFoundError = class extends Schema.TaggedError()(
   }
 ) {
 };
+var EnvFileReadError = class extends Schema.TaggedError()("EnvFileReadError", {
+  message: Schema.String,
+  cause: Schema.optional(Schema.String)
+}) {
+};
+var EnvFileWriteError = class extends Schema.TaggedError()("EnvFileWriteError", {
+  message: Schema.String,
+  cause: Schema.optional(Schema.String)
+}) {
+};
+var DevCredentialsStoreReadError = class extends Schema.TaggedError()(
+  "DevCredentialsStoreReadError",
+  {
+    message: Schema.String
+  }
+) {
+};
+var DevCredentialsStoreWriteError = class extends Schema.TaggedError()(
+  "DevCredentialsStoreWriteError",
+  {
+    message: Schema.String,
+    cause: Schema.optional(Schema.String)
+  }
+) {
+};
 var ConfigNotFoundError = class extends Schema.TaggedError()("ConfigNotFoundError", {
   message: Schema.String,
   directory: Schema.String
@@ -300,6 +325,10 @@ var ProjectLink = Schema2.Struct({
   applicationId: Schema2.String,
   organizationId: Schema2.optional(Schema2.String)
 });
+var DevKeyEntry = Schema2.Struct({
+  apiKeyId: Schema2.String
+});
+var DevKeyStore = Schema2.Record({ key: Schema2.String, value: DevKeyEntry });
 
 // src/services/auth-storage.ts
 var AuthStorageService = class extends Effect.Service()("AuthStorageService", {
@@ -380,7 +409,11 @@ var AuthStorageService = class extends Effect.Service()("AuthStorageService", {
 import { Config, Effect as Effect2, Schema as Schema4 } from "effect";
 var OAuthEnvConfig = Config.all({
   issuerUrl: Config.string("GIGADRIVE_NETWORK_OAUTH_ISSUER_URL").pipe(Config.withDefault("https://idp.gigadrive.de")),
-  clientId: Config.string("GIGADRIVE_NETWORK_OAUTH_CLIENT_ID").pipe(Config.withDefault("todo_add_client_id"))
+  // Default is the first-party CLI's public OAuth client (seeded in the Network
+  // repo). Override with GIGADRIVE_NETWORK_OAUTH_CLIENT_ID per environment.
+  clientId: Config.string("GIGADRIVE_NETWORK_OAUTH_CLIENT_ID").pipe(
+    Config.withDefault("0195c11c-0000-7000-8000-000000000001")
+  )
 });
 var OpenIdDiscoveryDocument = Schema4.Struct({
   issuer: Schema4.optional(Schema4.String),
@@ -388,7 +421,33 @@ var OpenIdDiscoveryDocument = Schema4.Struct({
   token_endpoint: Schema4.optional(Schema4.String),
   userinfo_endpoint: Schema4.optional(Schema4.String)
 });
-var DEFAULT_SCOPE = "offline_access openid profile email";
+var CLI_SCOPES = [
+  // Identity / OIDC
+  "offline_access",
+  "openid",
+  "profile",
+  "email",
+  // Network API capabilities
+  "network:applications:read",
+  "network:env_vars:read",
+  "network:env_vars:write",
+  "network:env_vars:delete",
+  "network:deployments:read",
+  "network:deployments:write",
+  "network:deployments:trigger",
+  "network:ai_gateway:chat",
+  "network:ai_gateway:models",
+  "network:ai_gateway:usage:read",
+  "network:ai_gateway:budgets:read",
+  "network:ai_gateway:budgets:write",
+  "network:ai_gateway:policies:read",
+  "network:ai_gateway:policies:write",
+  // Provisioning local-dev API credentials
+  "platform:api_keys:read",
+  "platform:api_keys:write",
+  "platform:api_keys:delete"
+];
+var DEFAULT_SCOPE = CLI_SCOPES.join(" ");
 var OAuthConfigService = class extends Effect2.Service()("OAuthConfigService", {
   accessors: true,
   effect: Effect2.gen(function* () {
@@ -1539,8 +1598,231 @@ var deploymentsCommand = deploymentsBase.pipe(
 );
 
 // src/commands/env/index.ts
-import { Args as Args3, Command as Command7, Options as Options4 } from "@effect/cli";
-import { Console as Console7, Effect as Effect14, Option as Option7 } from "effect";
+import { Args as Args3, Command as Command7, Options as Options4, Prompt } from "@effect/cli";
+import { Console as Console7, Effect as Effect17, Option as Option10 } from "effect";
+
+// src/services/env-file.ts
+import { FileSystem as FileSystem6, Path as Path5 } from "@effect/platform";
+import { Effect as Effect14, Option as Option7 } from "effect";
+
+// src/lib/dotenv.ts
+var DEFAULT_ENV_HEADER = "# Generated by `gigadrive env pull` \u2014 do not edit by hand.";
+var UNQUOTED_SAFE = /^[A-Za-z0-9_.\-/@:+]*$/;
+var formatEnvValue = (value) => {
+  if (UNQUOTED_SAFE.test(value)) {
+    return value;
+  }
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+  return `"${escaped}"`;
+};
+var serializeEnv = (entries, opts) => {
+  const header = opts?.header ?? DEFAULT_ENV_HEADER;
+  if (entries.length === 0) {
+    return `${header}
+`;
+  }
+  const body = entries.map((e) => `${e.key}=${formatEnvValue(e.value)}`).join("\n");
+  return `${header}
+${body}
+`;
+};
+var parseEnv = (content) => {
+  const result = {};
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#")) {
+      continue;
+    }
+    const eq = line.indexOf("=");
+    if (eq <= 0) {
+      continue;
+    }
+    const key = line.slice(0, eq).trim();
+    let value = line.slice(eq + 1).trim();
+    if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+      value = value.slice(1, -1).replace(/\\(\\|"|n|r|t)/g, (_, ch) => {
+        switch (ch) {
+          case "n":
+            return "\n";
+          case "r":
+            return "\r";
+          case "t":
+            return "	";
+          case '"':
+            return '"';
+          default:
+            return "\\";
+        }
+      });
+    }
+    result[key] = value;
+  }
+  return result;
+};
+
+// src/services/env-file.ts
+var EnvFileService = class extends Effect14.Service()("EnvFileService", {
+  accessors: true,
+  effect: Effect14.gen(function* () {
+    const fs = yield* FileSystem6.FileSystem;
+    const pathService = yield* Path5.Path;
+    const exists = Effect14.fn("EnvFileService.exists")(function* (filePath) {
+      return yield* fs.exists(filePath).pipe(Effect14.mapError(() => new EnvFileReadError({ message: `Failed to check whether ${filePath} exists` })));
+    });
+    const read = Effect14.fn("EnvFileService.read")(function* (filePath) {
+      const present = yield* exists(filePath);
+      if (!present) return Option7.none();
+      const contents = yield* fs.readFileString(filePath, "utf8").pipe(Effect14.mapError(() => new EnvFileReadError({ message: `Failed to read ${filePath}` })));
+      return Option7.some(contents);
+    });
+    const write = Effect14.fn("EnvFileService.write")(function* (filePath, entries, opts) {
+      const dir = pathService.dirname(filePath);
+      yield* fs.makeDirectory(dir, { recursive: true }).pipe(
+        Effect14.mapError(
+          (error) => new EnvFileWriteError({ message: `Failed to create directory for ${filePath}`, cause: String(error) })
+        )
+      );
+      yield* fs.writeFileString(filePath, serializeEnv(entries, opts), { mode: 384 }).pipe(
+        Effect14.mapError(
+          (error) => new EnvFileWriteError({ message: `Failed to write ${filePath}`, cause: String(error) })
+        )
+      );
+      yield* fs.chmod(filePath, 384).pipe(
+        Effect14.mapError(
+          (error) => new EnvFileWriteError({ message: `Failed to secure ${filePath}`, cause: String(error) })
+        )
+      );
+    });
+    const ensureGitignored = Effect14.fn("EnvFileService.ensureGitignored")(function* (dir, entry) {
+      const gitignorePath = pathService.join(dir, ".gitignore");
+      const existing = yield* read(gitignorePath);
+      const current = Option7.getOrElse(existing, () => "");
+      const alreadyIgnored = current.split("\n").some((line) => line.trim() === entry);
+      if (alreadyIgnored) {
+        return false;
+      }
+      const separator = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
+      yield* fs.writeFileString(gitignorePath, `${current}${separator}${entry}
+`).pipe(
+        Effect14.mapError(
+          (error) => new EnvFileWriteError({ message: "Failed to update .gitignore", cause: String(error) })
+        )
+      );
+      return true;
+    });
+    return { exists, read, write, ensureGitignored };
+  })
+}) {
+};
+
+// src/services/local-credentials.ts
+import { Config as Config3, Effect as Effect16, Option as Option9 } from "effect";
+import * as os3 from "os";
+
+// src/services/dev-credentials-store.ts
+import { FileSystem as FileSystem7, Path as Path6 } from "@effect/platform";
+import { Effect as Effect15, Option as Option8, Schema as Schema6 } from "effect";
+import * as os2 from "os";
+var DevCredentialsStore = class extends Effect15.Service()("DevCredentialsStore", {
+  accessors: true,
+  effect: Effect15.gen(function* () {
+    const fs = yield* FileSystem7.FileSystem;
+    const pathService = yield* Path6.Path;
+    const homeDir = os2.homedir();
+    const storeDir = pathService.join(homeDir, ".gigadrive");
+    const storeFile = pathService.join(storeDir, "dev-keys.json");
+    const ensureDirectory = Effect15.gen(function* () {
+      yield* fs.makeDirectory(storeDir, { recursive: true }).pipe(
+        Effect15.mapError(
+          (error) => new DevCredentialsStoreWriteError({ message: "Failed to create ~/.gigadrive", cause: String(error) })
+        )
+      );
+      yield* fs.chmod(storeDir, 448).pipe(
+        Effect15.mapError(
+          (error) => new DevCredentialsStoreWriteError({
+            message: "Failed to set ~/.gigadrive permissions",
+            cause: String(error)
+          })
+        )
+      );
+    });
+    const load = Effect15.gen(function* () {
+      const present = yield* fs.exists(storeFile).pipe(Effect15.mapError(() => new DevCredentialsStoreReadError({ message: "Failed to check dev-keys.json" })));
+      if (!present) return {};
+      const data = yield* fs.readFileString(storeFile, "utf8").pipe(Effect15.mapError(() => new DevCredentialsStoreReadError({ message: "Failed to read dev-keys.json" })));
+      const json = yield* Effect15.try({
+        try: () => JSON.parse(data),
+        catch: () => new DevCredentialsStoreReadError({ message: "dev-keys.json contains invalid JSON" })
+      });
+      return yield* Schema6.decodeUnknown(DevKeyStore)(json).pipe(
+        Effect15.mapError(() => new DevCredentialsStoreReadError({ message: "dev-keys.json has an invalid schema" }))
+      );
+    });
+    const get = Effect15.fn("DevCredentialsStore.get")(function* (applicationId) {
+      const store = yield* load;
+      const entry = store[applicationId];
+      return entry ? Option8.some(entry) : Option8.none();
+    });
+    const set = Effect15.fn("DevCredentialsStore.set")(function* (applicationId, entry) {
+      const store = yield* load;
+      const next = { ...store, [applicationId]: entry };
+      yield* ensureDirectory;
+      yield* fs.writeFileString(storeFile, `${JSON.stringify(next, null, 2)}
+`, { mode: 384 }).pipe(
+        Effect15.mapError(
+          (error) => new DevCredentialsStoreWriteError({ message: "Failed to write dev-keys.json", cause: String(error) })
+        )
+      );
+    });
+    return { get, set };
+  })
+}) {
+};
+
+// src/services/local-credentials.ts
+var DEV_KEY_SCOPES = ["network:env_vars:read"];
+var ApiBaseUrl2 = Config3.string("GIGADRIVE_API_BASE_URL").pipe(Config3.withDefault("https://api.gigadrive.network"));
+var credentialEntries = (clientId, clientSecret, baseUrl) => [
+  { key: "GIGADRIVE_CLIENT_ID", value: clientId },
+  { key: "GIGADRIVE_CLIENT_SECRET", value: clientSecret },
+  { key: "GIGADRIVE_API_BASE_URL", value: baseUrl }
+];
+var LocalCredentialsService = class extends Effect16.Service()("LocalCredentialsService", {
+  accessors: true,
+  dependencies: [ApiClientService.Default, DevCredentialsStore.Default],
+  effect: Effect16.gen(function* () {
+    const apiClient = yield* ApiClientService;
+    const store = yield* DevCredentialsStore;
+    const baseUrl = yield* ApiBaseUrl2;
+    const keyName = (applicationId) => `cli-dev:${os3.hostname()}:${applicationId}`;
+    const provision = Effect16.fn("LocalCredentialsService.provision")(function* (input) {
+      const stored = yield* store.get(input.applicationId);
+      const existing = input.existingContent ? parseEnv(input.existingContent) : {};
+      const existingClientId = existing["GIGADRIVE_CLIENT_ID"];
+      const existingClientSecret = existing["GIGADRIVE_CLIENT_SECRET"];
+      const canReuse = !input.rotate && existingClientId !== void 0 && existingClientSecret !== void 0 && Option9.isSome(stored) && stored.value.apiKeyId === existingClientId;
+      if (canReuse) {
+        return credentialEntries(existingClientId, existingClientSecret, baseUrl);
+      }
+      if (Option9.isSome(stored)) {
+        yield* apiClient.request((client) => client.apiKeys.delete(stored.value.apiKeyId)).pipe(Effect16.catchTag("ApiRequestError", () => Effect16.void));
+      }
+      const created = yield* apiClient.request(
+        (client) => client.apiKeys.create({
+          name: keyName(input.applicationId),
+          applicationId: input.applicationId,
+          scopes: DEV_KEY_SCOPES
+        })
+      );
+      yield* store.set(input.applicationId, { apiKeyId: created.id });
+      return credentialEntries(created.id, created.secret, baseUrl);
+    });
+    return { provision };
+  })
+}) {
+};
+
+// src/commands/env/index.ts
 var appOption3 = Options4.text("app").pipe(
   Options4.withAlias("a"),
   Options4.withDescription("Operate on this application (overrides the linked application)"),
@@ -1563,21 +1845,40 @@ var keyValueArg = Args3.text({ name: "key=value" }).pipe(
   Args3.withDescription("Variable assignment, e.g. DATABASE_URL=postgres://user:pass@host/db")
 );
 var keyOrIdArg = Args3.text({ name: "key-or-id" }).pipe(Args3.withDescription("Variable key or ID to remove"));
-var resolveScope = (app, org) => Effect14.gen(function* () {
-  if (Option7.isSome(org)) {
+var fileArg = Args3.text({ name: "file" }).pipe(
+  Args3.withDescription("Output file to write (default: .env.local)"),
+  Args3.optional
+);
+var environmentOption = Options4.text("environment").pipe(
+  Options4.withAlias("e"),
+  Options4.withDescription("Environment slug to resolve overrides for (e.g. preview). Omit for the local baseline"),
+  Options4.optional
+);
+var yesOption = Options4.boolean("yes").pipe(
+  Options4.withAlias("y"),
+  Options4.withDescription("Overwrite an existing file without confirmation")
+);
+var withCredentialsOption = Options4.boolean("with-credentials").pipe(
+  Options4.withDescription("Also provision API-key credentials so the local app can call the API as this application")
+);
+var rotateOption = Options4.boolean("rotate").pipe(
+  Options4.withDescription("Force a fresh API key when provisioning credentials, revoking the previous one")
+);
+var resolveScope = (app, org) => Effect17.gen(function* () {
+  if (Option10.isSome(org)) {
     return { kind: "organization", id: org.value };
   }
   const projectLink = yield* ProjectLinkService;
-  const id = yield* Option7.match(app, {
-    onSome: (value) => Effect14.succeed(value),
-    onNone: () => projectLink.resolve(process.cwd()).pipe(Effect14.map((link) => link.applicationId))
+  const id = yield* Option10.match(app, {
+    onSome: (value) => Effect17.succeed(value),
+    onNone: () => projectLink.resolve(process.cwd()).pipe(Effect17.map((link) => link.applicationId))
   });
   return { kind: "application", id };
 });
 var envListCommand = Command7.make(
   "list",
   { app: appOption3, org: orgOption4 },
-  ({ app, org }) => Effect14.gen(function* () {
+  ({ app, org }) => Effect17.gen(function* () {
     const apiClient = yield* ApiClientService;
     const scope = yield* resolveScope(app, org);
     const { items } = yield* apiClient.request(
@@ -1591,23 +1892,23 @@ var envListCommand = Command7.make(
       yield* Console7.log(`${v.key}=${v.sensitive ? "***" : v.value ?? ""}`);
     }
   }).pipe(
-    Effect14.catchTags({
+    Effect17.catchTags({
       NotAuthenticatedError: (err) => Console7.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
-        Effect14.andThen(Effect14.fail(err))
+        Effect17.andThen(Effect17.fail(err))
       ),
-      ApiRequestError: (err) => Console7.error(`Failed to list environment variables: ${err.message}`).pipe(Effect14.andThen(Effect14.fail(err))),
-      ProjectNotLinkedError: (err) => Console7.error(err.message).pipe(Effect14.andThen(Effect14.fail(err))),
-      ProjectLinkReadError: (err) => Console7.error(err.message).pipe(Effect14.andThen(Effect14.fail(err)))
+      ApiRequestError: (err) => Console7.error(`Failed to list environment variables: ${err.message}`).pipe(Effect17.andThen(Effect17.fail(err))),
+      ProjectNotLinkedError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err))),
+      ProjectLinkReadError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err)))
     })
   )
 );
 var envSetCommand = Command7.make(
   "set",
   { keyValue: keyValueArg, app: appOption3, org: orgOption4, sensitive: sensitiveOption, env: envIdOption },
-  ({ keyValue, app, org, sensitive, env }) => Effect14.gen(function* () {
+  ({ keyValue, app, org, sensitive, env }) => Effect17.gen(function* () {
     const separator = keyValue.indexOf("=");
     if (separator <= 0) {
-      return yield* Effect14.fail(
+      return yield* Effect17.fail(
         new InvalidEnvVarFormatError({
           message: 'Invalid format. Use KEY=VALUE, e.g. "gigadrive env set DATABASE_URL=postgres://...".'
         })
@@ -1617,27 +1918,27 @@ var envSetCommand = Command7.make(
     const value = keyValue.slice(separator + 1);
     const apiClient = yield* ApiClientService;
     const scope = yield* resolveScope(app, org);
-    const environmentId = Option7.getOrUndefined(env);
+    const environmentId = Option10.getOrUndefined(env);
     const created = yield* apiClient.request(
       (client) => scope.kind === "organization" ? client.organizations.envVars.create(scope.id, { key, value, sensitive }) : client.applications.envVars.create(scope.id, { key, value, sensitive, environmentId })
     );
     yield* Console7.log(`Set ${created.key}.`);
   }).pipe(
-    Effect14.catchTags({
-      InvalidEnvVarFormatError: (err) => Console7.error(err.message).pipe(Effect14.andThen(Effect14.fail(err))),
+    Effect17.catchTags({
+      InvalidEnvVarFormatError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err))),
       NotAuthenticatedError: (err) => Console7.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
-        Effect14.andThen(Effect14.fail(err))
+        Effect17.andThen(Effect17.fail(err))
       ),
-      ApiRequestError: (err) => Console7.error(`Failed to set environment variable: ${err.message}`).pipe(Effect14.andThen(Effect14.fail(err))),
-      ProjectNotLinkedError: (err) => Console7.error(err.message).pipe(Effect14.andThen(Effect14.fail(err))),
-      ProjectLinkReadError: (err) => Console7.error(err.message).pipe(Effect14.andThen(Effect14.fail(err)))
+      ApiRequestError: (err) => Console7.error(`Failed to set environment variable: ${err.message}`).pipe(Effect17.andThen(Effect17.fail(err))),
+      ProjectNotLinkedError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err))),
+      ProjectLinkReadError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err)))
     })
   )
 );
 var envRmCommand = Command7.make(
   "rm",
   { keyOrId: keyOrIdArg, app: appOption3, org: orgOption4 },
-  ({ keyOrId, app, org }) => Effect14.gen(function* () {
+  ({ keyOrId, app, org }) => Effect17.gen(function* () {
     const apiClient = yield* ApiClientService;
     const scope = yield* resolveScope(app, org);
     const { items } = yield* apiClient.request(
@@ -1645,7 +1946,7 @@ var envRmCommand = Command7.make(
     );
     const target = items.find((v) => v.id === keyOrId || v.key === keyOrId);
     if (target === void 0) {
-      return yield* Effect14.fail(
+      return yield* Effect17.fail(
         new EnvVarNotFoundError({ message: `No environment variable matching "${keyOrId}".` })
       );
     }
@@ -1654,23 +1955,97 @@ var envRmCommand = Command7.make(
     );
     yield* Console7.log(`Removed ${target.key}.`);
   }).pipe(
-    Effect14.catchTags({
-      EnvVarNotFoundError: (err) => Console7.error(err.message).pipe(Effect14.andThen(Effect14.fail(err))),
+    Effect17.catchTags({
+      EnvVarNotFoundError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err))),
+      NotAuthenticatedError: (err) => Console7.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
+        Effect17.andThen(Effect17.fail(err))
+      ),
+      ApiRequestError: (err) => Console7.error(`Failed to remove environment variable: ${err.message}`).pipe(Effect17.andThen(Effect17.fail(err))),
+      ProjectNotLinkedError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err))),
+      ProjectLinkReadError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err)))
+    })
+  )
+);
+var envPullCommand = Command7.make(
+  "pull",
+  {
+    file: fileArg,
+    app: appOption3,
+    environment: environmentOption,
+    yes: yesOption,
+    withCredentials: withCredentialsOption,
+    rotate: rotateOption
+  },
+  ({ file, app, environment, yes, withCredentials, rotate }) => Effect17.gen(function* () {
+    const apiClient = yield* ApiClientService;
+    const projectLink = yield* ProjectLinkService;
+    const envFile = yield* EnvFileService;
+    const applicationId = yield* Option10.match(app, {
+      onSome: (value) => Effect17.succeed(value),
+      onNone: () => projectLink.resolve(process.cwd()).pipe(Effect17.map((link) => link.applicationId))
+    });
+    const target = Option10.getOrElse(file, () => ".env.local");
+    const environmentSlug = Option10.getOrUndefined(environment);
+    const { items, omittedSensitive } = yield* apiClient.request(
+      (client) => client.applications.envVars.pull(applicationId, environmentSlug ? { environment: environmentSlug } : void 0)
+    );
+    const existing = yield* envFile.read(target);
+    if (Option10.isSome(existing) && !yes) {
+      const overwrite = yield* Prompt.run(
+        Prompt.confirm({ message: `${target} already exists. Overwrite?`, initial: false })
+      );
+      if (!overwrite) {
+        return yield* Console7.log("Cancelled.");
+      }
+    }
+    let credentialEntries2 = [];
+    if (withCredentials) {
+      const localCredentials = yield* LocalCredentialsService;
+      credentialEntries2 = yield* localCredentials.provision({
+        applicationId,
+        rotate,
+        existingContent: Option10.getOrUndefined(existing)
+      });
+    }
+    const entries = [...items.map((v) => ({ key: v.key, value: v.value })), ...credentialEntries2];
+    yield* envFile.write(target, entries);
+    const gitignored = yield* envFile.ensureGitignored(process.cwd(), target);
+    yield* Console7.log(
+      `Pulled ${items.length} environment variable(s)${withCredentials ? " and API credentials" : ""} to ${target}.`
+    );
+    if (omittedSensitive > 0) {
+      yield* Console7.log(
+        `Skipped ${omittedSensitive} sensitive variable(s); secrets live only in production/preview environments.`
+      );
+    }
+    if (gitignored) {
+      yield* Console7.log(`Added ${target} to .gitignore.`);
+    }
+  }).pipe(
+    Effect17.catchTags({
+      // Ctrl+C during the overwrite prompt is a deliberate cancel — exit 0.
+      QuitException: () => Console7.log("Cancelled."),
       NotAuthenticatedError: (err) => Console7.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
-        Effect14.andThen(Effect14.fail(err))
+        Effect17.andThen(Effect17.fail(err))
       ),
-      ApiRequestError: (err) => Console7.error(`Failed to remove environment variable: ${err.message}`).pipe(Effect14.andThen(Effect14.fail(err))),
-      ProjectNotLinkedError: (err) => Console7.error(err.message).pipe(Effect14.andThen(Effect14.fail(err))),
-      ProjectLinkReadError: (err) => Console7.error(err.message).pipe(Effect14.andThen(Effect14.fail(err)))
+      ApiRequestError: (err) => Console7.error(`Failed to pull environment variables: ${err.message}`).pipe(Effect17.andThen(Effect17.fail(err))),
+      ProjectNotLinkedError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err))),
+      ProjectLinkReadError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err))),
+      EnvFileReadError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err))),
+      EnvFileWriteError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err))),
+      DevCredentialsStoreReadError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err))),
+      DevCredentialsStoreWriteError: (err) => Console7.error(err.message).pipe(Effect17.andThen(Effect17.fail(err)))
     })
   )
 );
-var envBase = Command7.make("env", {}, () => Effect14.void);
-var envCommand = envBase.pipe(Command7.withSubcommands([envListCommand, envSetCommand, envRmCommand]));
+var envBase = Command7.make("env", {}, () => Effect17.void);
+var envCommand = envBase.pipe(
+  Command7.withSubcommands([envListCommand, envSetCommand, envRmCommand, envPullCommand])
+);
 
 // src/commands/link/index.ts
-import { Command as Command8, Options as Options5, Prompt } from "@effect/cli";
-import { Console as Console8, Effect as Effect15, Option as Option8 } from "effect";
+import { Command as Command8, Options as Options5, Prompt as Prompt2 } from "@effect/cli";
+import { Console as Console8, Effect as Effect18, Option as Option11 } from "effect";
 var appOption4 = Options5.text("app").pipe(
   Options5.withAlias("a"),
   Options5.withDescription("Application ID to link (skips the interactive picker)"),
@@ -1684,26 +2059,26 @@ var orgOption5 = Options5.text("org").pipe(
 var linkCommand = Command8.make(
   "link",
   { app: appOption4, org: orgOption5 },
-  ({ app, org }) => Effect15.gen(function* () {
+  ({ app, org }) => Effect18.gen(function* () {
     const apiClient = yield* ApiClientService;
     const projectLink = yield* ProjectLinkService;
     const cwd = process.cwd();
-    const organizationId = Option8.getOrUndefined(org);
+    const organizationId = Option11.getOrUndefined(org);
     const { items: apps } = yield* apiClient.request((client) => client.applications.list({ organizationId }));
     if (apps.length === 0) {
-      return yield* Effect15.fail(
+      return yield* Effect18.fail(
         new NoApplicationsFoundError({
           message: 'No applications found. Create one in the Gigadrive console, then run "gigadrive link" again.'
         })
       );
     }
-    const explicitAppId = Option8.getOrUndefined(app);
+    const explicitAppId = Option11.getOrUndefined(app);
     let applicationId;
     let linkedOrganizationId;
     if (explicitAppId !== void 0) {
       const match = apps.find((a) => a.id === explicitAppId);
       if (match === void 0) {
-        return yield* Effect15.fail(
+        return yield* Effect18.fail(
           new ApplicationNotFoundError({
             message: `Application "${explicitAppId}" was not found among your applications.`
           })
@@ -1715,8 +2090,8 @@ var linkCommand = Command8.make(
       applicationId = apps[0].id;
       linkedOrganizationId = apps[0].organization.id;
     } else {
-      const chosen = yield* Prompt.run(
-        Prompt.select({
+      const chosen = yield* Prompt2.run(
+        Prompt2.select({
           message: "Select an application to link",
           choices: apps.map((a) => ({ title: `${a.name} (${a.organization.name})`, value: a }))
         })
@@ -1728,48 +2103,48 @@ var linkCommand = Command8.make(
     yield* Console8.log(`Linked this directory to application ${applicationId}.`);
     yield* Console8.log('Tip: add ".gigadrive/" to your .gitignore.');
   }).pipe(
-    Effect15.catchTags({
+    Effect18.catchTags({
       // Ctrl+C during the picker is a deliberate cancel — exit 0.
       QuitException: () => Console8.log("Cancelled."),
       NotAuthenticatedError: (err) => Console8.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
-        Effect15.andThen(Effect15.fail(err))
+        Effect18.andThen(Effect18.fail(err))
       ),
-      ApiRequestError: (err) => Console8.error(`Failed to list applications: ${err.message}`).pipe(Effect15.andThen(Effect15.fail(err))),
-      NoApplicationsFoundError: (err) => Console8.error(err.message).pipe(Effect15.andThen(Effect15.fail(err))),
-      ApplicationNotFoundError: (err) => Console8.error(err.message).pipe(Effect15.andThen(Effect15.fail(err))),
-      ProjectLinkWriteError: (err) => Console8.error(err.message).pipe(Effect15.andThen(Effect15.fail(err)))
+      ApiRequestError: (err) => Console8.error(`Failed to list applications: ${err.message}`).pipe(Effect18.andThen(Effect18.fail(err))),
+      NoApplicationsFoundError: (err) => Console8.error(err.message).pipe(Effect18.andThen(Effect18.fail(err))),
+      ApplicationNotFoundError: (err) => Console8.error(err.message).pipe(Effect18.andThen(Effect18.fail(err))),
+      ProjectLinkWriteError: (err) => Console8.error(err.message).pipe(Effect18.andThen(Effect18.fail(err)))
     })
   )
 );
 var unlinkCommand = Command8.make(
   "unlink",
   {},
-  () => Effect15.gen(function* () {
+  () => Effect18.gen(function* () {
     const projectLink = yield* ProjectLinkService;
     yield* projectLink.remove(process.cwd());
     yield* Console8.log("Unlinked this directory.");
   }).pipe(
-    Effect15.catchTags({
-      ProjectLinkWriteError: (err) => Console8.error(err.message).pipe(Effect15.andThen(Effect15.fail(err)))
+    Effect18.catchTags({
+      ProjectLinkWriteError: (err) => Console8.error(err.message).pipe(Effect18.andThen(Effect18.fail(err)))
     })
   )
 );
 
 // src/commands/login/index.ts
 import { Command as Command9 } from "@effect/cli";
-import { Console as Console9, Effect as Effect16 } from "effect";
+import { Console as Console9, Effect as Effect19 } from "effect";
 var loginCommand = Command9.make(
   "login",
   {},
-  () => Effect16.gen(function* () {
+  () => Effect19.gen(function* () {
     yield* Console9.log("Initiating login...");
     const auth = yield* AuthService;
     yield* auth.login;
-    const info = yield* auth.getUserInfo.pipe(Effect16.catchAll(() => Effect16.succeed({})));
+    const info = yield* auth.getUserInfo.pipe(Effect19.catchAll(() => Effect19.succeed({})));
     const name = auth.inferUserName(info);
     yield* Console9.log(`You are now logged in as ${name}.`);
   }).pipe(
-    Effect16.catchTags({
+    Effect19.catchTags({
       LoginFlowError: (err) => Console9.error(`Login failed: ${err.message}`),
       TokenExchangeError: (err) => Console9.error(`Login failed: ${err.message}`),
       OAuthDiscoveryError: (err) => Console9.error(`Login failed: ${err.message}`),
@@ -1780,51 +2155,51 @@ var loginCommand = Command9.make(
 
 // src/commands/logout/index.ts
 import { Command as Command10 } from "@effect/cli";
-import { Console as Console10, Effect as Effect17 } from "effect";
+import { Console as Console10, Effect as Effect20 } from "effect";
 var logoutCommand = Command10.make(
   "logout",
   {},
-  () => Effect17.gen(function* () {
+  () => Effect20.gen(function* () {
     const auth = yield* AuthService;
     yield* auth.logout;
     yield* Console10.log("Logged out.");
   }).pipe(
-    Effect17.catchTags({
-      AuthStorageWriteError: (err) => Console10.error(`Failed to log out: ${err.message}`).pipe(Effect17.andThen(Effect17.fail(err)))
+    Effect20.catchTags({
+      AuthStorageWriteError: (err) => Console10.error(`Failed to log out: ${err.message}`).pipe(Effect20.andThen(Effect20.fail(err)))
     })
   )
 );
 
 // src/commands/platform/index.ts
 import { Command as Command12 } from "@effect/cli";
-import { Effect as Effect21 } from "effect";
+import { Effect as Effect24 } from "effect";
 
 // src/commands/platform/deploy/index.ts
 import { Command as Command11, Options as Options6 } from "@effect/cli";
-import { FileSystem as FileSystem7, Path as Path6 } from "@effect/platform";
+import { FileSystem as FileSystem9, Path as Path8 } from "@effect/platform";
 import { formatFileSize } from "@gigadrive/commons";
-import { Console as Console11, Duration, Effect as Effect20, Option as Option9, Schedule, Stream } from "effect";
-import * as os2 from "os";
+import { Console as Console11, Duration, Effect as Effect23, Option as Option12, Schedule, Stream } from "effect";
+import * as os4 from "os";
 
 // src/services/archive.ts
-import { FileSystem as FileSystem6, Path as Path5 } from "@effect/platform";
+import { FileSystem as FileSystem8, Path as Path7 } from "@effect/platform";
 import { getFilesForPattern } from "@gigadrive/build-utils";
 import archiver from "archiver";
-import { Effect as Effect18 } from "effect";
+import { Effect as Effect21 } from "effect";
 import ignore from "ignore";
 import * as nodeFs from "fs";
 import * as nodeFsPromises from "fs/promises";
 var IGNORE_FILE_NAMES = [".gigadriveignore", ".vercelignore", ".dockerignore", ".nowignore"];
 var readIgnoreFile = (fs, ignorePath) => fs.readFileString(ignorePath, "utf8").pipe(
-  Effect18.map((content) => content.split("\n").filter((line) => line.trim() !== "")),
-  Effect18.catchAll(() => Effect18.succeed([]))
+  Effect21.map((content) => content.split("\n").filter((line) => line.trim() !== "")),
+  Effect21.catchAll(() => Effect21.succeed([]))
 );
-var collectIgnorePatterns = (fs, pathService, dir, baseDir, ignoreRules) => Effect18.gen(function* () {
-  const items = yield* fs.readDirectory(dir).pipe(Effect18.mapError(() => new ArchiveCreateError({ message: `Failed to read directory: ${dir}` })));
+var collectIgnorePatterns = (fs, pathService, dir, baseDir, ignoreRules) => Effect21.gen(function* () {
+  const items = yield* fs.readDirectory(dir).pipe(Effect21.mapError(() => new ArchiveCreateError({ message: `Failed to read directory: ${dir}` })));
   for (const item of items) {
     const fullPath = pathService.join(dir, item);
     const relativePath = pathService.relative(baseDir, fullPath);
-    const stat = yield* Effect18.tryPromise({
+    const stat = yield* Effect21.tryPromise({
       try: () => nodeFsPromises.lstat(fullPath),
       catch: () => new ArchiveCreateError({ message: `Failed to stat: ${fullPath}` })
     });
@@ -1844,8 +2219,8 @@ var collectIgnorePatterns = (fs, pathService, dir, baseDir, ignoreRules) => Effe
       yield* collectIgnorePatterns(fs, pathService, fullPath, baseDir, ignoreRules);
     }
   }
-}).pipe(Effect18.catchAll(() => Effect18.void));
-var initializeIgnoreRules = (fs, pathService, baseDir) => Effect18.gen(function* () {
+}).pipe(Effect21.catchAll(() => Effect21.void));
+var initializeIgnoreRules = (fs, pathService, baseDir) => Effect21.gen(function* () {
   const ignoreRules = ignore();
   ignoreRules.add([".git/", "**/.DS_Store", "**/Thumbs.db"]);
   for (const ignoreFileName of IGNORE_FILE_NAMES) {
@@ -1860,14 +2235,14 @@ var initializeIgnoreRules = (fs, pathService, baseDir) => Effect18.gen(function*
   yield* collectIgnorePatterns(fs, pathService, baseDir, baseDir, ignoreRules);
   return ignoreRules;
 });
-var getFilesToInclude = (fs, pathService, dir, ignoreRules) => Effect18.gen(function* () {
+var getFilesToInclude = (fs, pathService, dir, ignoreRules) => Effect21.gen(function* () {
   const filesToInclude = [];
-  const walkDir = (currentDir) => Effect18.gen(function* () {
-    const items = yield* fs.readDirectory(currentDir).pipe(Effect18.mapError(() => new ArchiveCreateError({ message: `Failed to read directory: ${currentDir}` })));
+  const walkDir = (currentDir) => Effect21.gen(function* () {
+    const items = yield* fs.readDirectory(currentDir).pipe(Effect21.mapError(() => new ArchiveCreateError({ message: `Failed to read directory: ${currentDir}` })));
     for (const item of items) {
       const fullPath = pathService.join(currentDir, item);
       const relativePath = pathService.relative(dir, fullPath);
-      const stat = yield* Effect18.tryPromise({
+      const stat = yield* Effect21.tryPromise({
         try: () => nodeFsPromises.lstat(fullPath),
         catch: () => new ArchiveCreateError({ message: `Failed to stat: ${fullPath}` })
       });
@@ -1881,21 +2256,21 @@ var getFilesToInclude = (fs, pathService, dir, ignoreRules) => Effect18.gen(func
         }
       }
     }
-  }).pipe(Effect18.catchAll(() => Effect18.void));
+  }).pipe(Effect21.catchAll(() => Effect21.void));
   yield* walkDir(dir);
   return filesToInclude;
 });
-var ArchiveService = class extends Effect18.Service()("ArchiveService", {
+var ArchiveService = class extends Effect21.Service()("ArchiveService", {
   accessors: true,
-  effect: Effect18.gen(function* () {
-    const fs = yield* FileSystem6.FileSystem;
-    const pathService = yield* Path5.Path;
-    const createZipArchive = Effect18.fn("ArchiveService.createZipArchive")(function* (inputDir, outputFile, options = {}) {
-      yield* Effect18.annotateCurrentSpan("inputDir", inputDir);
-      yield* Effect18.annotateCurrentSpan("outputFile", outputFile);
-      yield* Effect18.log("Creating zip archive", { inputDir, outputFile });
+  effect: Effect21.gen(function* () {
+    const fs = yield* FileSystem8.FileSystem;
+    const pathService = yield* Path7.Path;
+    const createZipArchive = Effect21.fn("ArchiveService.createZipArchive")(function* (inputDir, outputFile, options = {}) {
+      yield* Effect21.annotateCurrentSpan("inputDir", inputDir);
+      yield* Effect21.annotateCurrentSpan("outputFile", outputFile);
+      yield* Effect21.log("Creating zip archive", { inputDir, outputFile });
       const ignoreRules = options.useIgnoreFiles !== false ? yield* initializeIgnoreRules(fs, pathService, inputDir) : ignore();
-      const filesToInclude = options.whitelist ? yield* Effect18.tryPromise({
+      const filesToInclude = options.whitelist ? yield* Effect21.tryPromise({
         try: () => Promise.all(
           options.whitelist.map((file) => getFilesForPattern(file, inputDir, options.excludeFiles ?? []))
         ),
@@ -1903,25 +2278,25 @@ var ArchiveService = class extends Effect18.Service()("ArchiveService", {
           message: "Failed to resolve whitelist patterns",
           cause: error instanceof Error ? error.message : String(error)
         })
-      }) : yield* Effect18.gen(function* () {
+      }) : yield* Effect21.gen(function* () {
         if (options.excludeFiles && options.excludeFiles.length > 0) {
           ignoreRules.add(options.excludeFiles);
         }
         return yield* getFilesToInclude(fs, pathService, inputDir, ignoreRules).pipe(
-          Effect18.map((files) => [files])
+          Effect21.map((files) => [files])
         );
       });
-      const archiveExists = yield* fs.exists(outputFile).pipe(Effect18.catchAll(() => Effect18.succeed(false)));
+      const archiveExists = yield* fs.exists(outputFile).pipe(Effect21.catchAll(() => Effect21.succeed(false)));
       if (archiveExists) {
         yield* fs.remove(outputFile).pipe(
-          Effect18.mapError(
+          Effect21.mapError(
             (error) => new ArchiveCreateError({
               message: `Failed to remove existing archive: ${String(error)}`
             })
           )
         );
       }
-      yield* Effect18.tryPromise({
+      yield* Effect21.tryPromise({
         try: () => new Promise((resolve, reject) => {
           const output = nodeFs.createWriteStream(outputFile);
           const archive = archiver("zip", { zlib: { level: 9 } });
@@ -1940,14 +2315,14 @@ var ArchiveService = class extends Effect18.Service()("ArchiveService", {
         })
       });
       const fileInfo = yield* fs.stat(outputFile).pipe(
-        Effect18.mapError(
+        Effect21.mapError(
           (error) => new ArchiveCreateError({
             message: `Failed to stat archive: ${String(error)}`
           })
         )
       );
       const size = Number(fileInfo.size);
-      yield* Effect18.log("Archive created", { size });
+      yield* Effect21.log("Archive created", { size });
       return { path: outputFile, size };
     });
     return { createZipArchive };
@@ -1956,32 +2331,32 @@ var ArchiveService = class extends Effect18.Service()("ArchiveService", {
 };
 
 // src/services/deployment-api.ts
-import { Effect as Effect19 } from "effect";
-var DeploymentApiService = class extends Effect19.Service()("DeploymentApiService", {
+import { Effect as Effect22 } from "effect";
+var DeploymentApiService = class extends Effect22.Service()("DeploymentApiService", {
   accessors: true,
   dependencies: [ApiClientService.Default],
-  effect: Effect19.gen(function* () {
+  effect: Effect22.gen(function* () {
     const apiClient = yield* ApiClientService;
     const getClient = apiClient.getClient.pipe(
-      Effect19.mapError((err) => new DeploymentAuthError({ message: `Authentication failed: ${err.message}` }))
+      Effect22.mapError((err) => new DeploymentAuthError({ message: `Authentication failed: ${err.message}` }))
     );
-    const createDeployment = Effect19.fn("DeploymentApiService.createDeployment")(function* (applicationId) {
-      yield* Effect19.annotateCurrentSpan("applicationId", applicationId);
-      yield* Effect19.log("Creating deployment", { applicationId });
+    const createDeployment = Effect22.fn("DeploymentApiService.createDeployment")(function* (applicationId) {
+      yield* Effect22.annotateCurrentSpan("applicationId", applicationId);
+      yield* Effect22.log("Creating deployment", { applicationId });
       const client = yield* getClient;
-      const deployment = yield* Effect19.tryPromise({
+      const deployment = yield* Effect22.tryPromise({
         try: () => client.deployments.create({ applicationId }),
         catch: (error) => new DeploymentCreateError({
           message: `Failed to create deployment: ${error instanceof Error ? error.message : String(error)}`
         })
       });
-      yield* Effect19.log("Deployment created", { deploymentId: deployment.id });
+      yield* Effect22.log("Deployment created", { deploymentId: deployment.id });
       return deployment.id;
     });
-    const startMultipartUpload = Effect19.fn("DeploymentApiService.startMultipartUpload")(function* (deploymentId) {
-      yield* Effect19.annotateCurrentSpan("deploymentId", deploymentId);
+    const startMultipartUpload = Effect22.fn("DeploymentApiService.startMultipartUpload")(function* (deploymentId) {
+      yield* Effect22.annotateCurrentSpan("deploymentId", deploymentId);
       const client = yield* getClient;
-      const result = yield* Effect19.tryPromise({
+      const result = yield* Effect22.tryPromise({
         try: () => client.deployments.startUpload(deploymentId),
         catch: (error) => new UploadStartError({
           message: `Failed to start multipart upload: ${error instanceof Error ? error.message : String(error)}`
@@ -1989,9 +2364,9 @@ var DeploymentApiService = class extends Effect19.Service()("DeploymentApiServic
       });
       return result.uploadId;
     });
-    const getPresignedUrl = Effect19.fn("DeploymentApiService.getPresignedUrl")(function* (deploymentId, uploadId, partNumber) {
+    const getPresignedUrl = Effect22.fn("DeploymentApiService.getPresignedUrl")(function* (deploymentId, uploadId, partNumber) {
       const client = yield* getClient;
-      const result = yield* Effect19.tryPromise({
+      const result = yield* Effect22.tryPromise({
         try: () => client.deployments.getPresignedUrl(deploymentId, uploadId, partNumber),
         catch: (error) => new PresignedUrlError({
           message: `Failed to get presigned URL: ${error instanceof Error ? error.message : String(error)}`,
@@ -2000,11 +2375,11 @@ var DeploymentApiService = class extends Effect19.Service()("DeploymentApiServic
       });
       return result.url;
     });
-    const uploadPart = Effect19.fn("DeploymentApiService.uploadPart")(function* (presignedUrl, data, partNumber) {
-      yield* Effect19.annotateCurrentSpan("partNumber", partNumber);
-      yield* Effect19.annotateCurrentSpan("size", data.length);
+    const uploadPart = Effect22.fn("DeploymentApiService.uploadPart")(function* (presignedUrl, data, partNumber) {
+      yield* Effect22.annotateCurrentSpan("partNumber", partNumber);
+      yield* Effect22.annotateCurrentSpan("size", data.length);
       const client = yield* getClient;
-      const result = yield* Effect19.tryPromise({
+      const result = yield* Effect22.tryPromise({
         try: () => client.deployments.uploadPart(presignedUrl, data, partNumber),
         catch: (error) => new UploadPartError({
           message: `Failed to upload part ${partNumber}: ${error instanceof Error ? error.message : String(error)}`,
@@ -2013,21 +2388,21 @@ var DeploymentApiService = class extends Effect19.Service()("DeploymentApiServic
       });
       return result;
     });
-    const completeUpload = Effect19.fn("DeploymentApiService.completeUpload")(function* (deploymentId, uploadId, parts) {
-      yield* Effect19.annotateCurrentSpan("deploymentId", deploymentId);
-      yield* Effect19.annotateCurrentSpan("partsCount", parts.length);
+    const completeUpload = Effect22.fn("DeploymentApiService.completeUpload")(function* (deploymentId, uploadId, parts) {
+      yield* Effect22.annotateCurrentSpan("deploymentId", deploymentId);
+      yield* Effect22.annotateCurrentSpan("partsCount", parts.length);
       const client = yield* getClient;
-      yield* Effect19.tryPromise({
+      yield* Effect22.tryPromise({
         try: () => client.deployments.completeUpload(deploymentId, uploadId, parts),
         catch: (error) => new UploadCompleteError({
           message: `Failed to complete upload: ${error instanceof Error ? error.message : String(error)}`
         })
       });
-      yield* Effect19.log("Upload completed successfully");
+      yield* Effect22.log("Upload completed successfully");
     });
-    const getDeploymentStatus = Effect19.fn("DeploymentApiService.getDeploymentStatus")(function* (deploymentId) {
+    const getDeploymentStatus = Effect22.fn("DeploymentApiService.getDeploymentStatus")(function* (deploymentId) {
       const client = yield* getClient;
-      const deployment = yield* Effect19.tryPromise({
+      const deployment = yield* Effect22.tryPromise({
         try: () => client.deployments.get(deploymentId),
         catch: (error) => new DeploymentStatusError({
           message: `Failed to get deployment status: ${error instanceof Error ? error.message : String(error)}`
@@ -2035,9 +2410,9 @@ var DeploymentApiService = class extends Effect19.Service()("DeploymentApiServic
       });
       return deployment.status;
     });
-    const getLogs = Effect19.fn("DeploymentApiService.getLogs")(function* (deploymentId, options) {
+    const getLogs = Effect22.fn("DeploymentApiService.getLogs")(function* (deploymentId, options) {
       const client = yield* getClient;
-      const result = yield* Effect19.tryPromise({
+      const result = yield* Effect22.tryPromise({
         try: () => client.deployments.getLogs(deploymentId, options),
         catch: (error) => new DeploymentLogsFetchError({
           message: `Failed to get logs: ${error instanceof Error ? error.message : String(error)}`
@@ -2045,9 +2420,9 @@ var DeploymentApiService = class extends Effect19.Service()("DeploymentApiServic
       });
       return result;
     });
-    const getHostnames = Effect19.fn("DeploymentApiService.getHostnames")(function* (deploymentId) {
+    const getHostnames = Effect22.fn("DeploymentApiService.getHostnames")(function* (deploymentId) {
       const client = yield* getClient;
-      const result = yield* Effect19.tryPromise({
+      const result = yield* Effect22.tryPromise({
         try: () => client.deployments.getHostnames(deploymentId),
         catch: (error) => new DeploymentHostnamesFetchError({
           message: `Failed to get hostnames: ${error instanceof Error ? error.message : String(error)}`
@@ -2078,24 +2453,24 @@ var appOption5 = Options6.text("app").pipe(
 var deployCommand = Command11.make(
   "deploy",
   { app: appOption5 },
-  ({ app }) => Effect20.gen(function* () {
+  ({ app }) => Effect23.gen(function* () {
     const projectConfig = yield* ProjectConfigService;
     const deploymentApi = yield* DeploymentApiService;
     const archiveService = yield* ArchiveService;
     const projectLink = yield* ProjectLinkService;
-    const pathService = yield* Path6.Path;
+    const pathService = yield* Path8.Path;
     const cwd = process.cwd();
-    const applicationId = yield* Option9.match(app, {
-      onSome: (id) => Effect20.succeed(id),
-      onNone: () => projectLink.resolve(cwd).pipe(Effect20.map((link) => link.applicationId))
+    const applicationId = yield* Option12.match(app, {
+      onSome: (id) => Effect23.succeed(id),
+      onNone: () => projectLink.resolve(cwd).pipe(Effect23.map((link) => link.applicationId))
     });
-    yield* Effect20.log("Starting deploy command");
+    yield* Effect23.log("Starting deploy command");
     const { config } = yield* projectConfig.resolve(cwd);
     yield* Console11.log("Creating deployment...");
     const deploymentId = yield* deploymentApi.createDeployment(applicationId);
     yield* Console11.log(`Deployment ID: ${deploymentId}`);
     yield* Console11.log("Creating archive...");
-    const archivePath = pathService.join(os2.tmpdir(), `project-${Date.now()}.zip`);
+    const archivePath = pathService.join(os4.tmpdir(), `project-${Date.now()}.zip`);
     const archive = yield* archiveService.createZipArchive(config.userArchive?.rootOverwrite || cwd, archivePath, {
       whitelist: config.userArchive?.fileWhitelist,
       excludeFiles: config.excludeFiles,
@@ -2109,55 +2484,55 @@ var deployCommand = Command11.make(
     yield* Console11.log("The deployment pipeline is now being provisioned. This may take a few seconds.");
     yield* pollDeployment(deploymentId);
   }).pipe(
-    Effect20.catchTags({
-      ProjectNotLinkedError: (err) => Console11.error(err.message).pipe(Effect20.andThen(Effect20.fail(err))),
-      ProjectLinkReadError: (err) => Console11.error(err.message).pipe(Effect20.andThen(Effect20.fail(err))),
-      ConfigNotFoundError: (err) => Console11.error(err.message).pipe(Effect20.andThen(Effect20.fail(err))),
-      ConfigParseError: (err) => Console11.error(`Config parse error: ${err.message}`).pipe(Effect20.andThen(Effect20.fail(err))),
-      ConfigValidationError: (err) => Effect20.gen(function* () {
+    Effect23.catchTags({
+      ProjectNotLinkedError: (err) => Console11.error(err.message).pipe(Effect23.andThen(Effect23.fail(err))),
+      ProjectLinkReadError: (err) => Console11.error(err.message).pipe(Effect23.andThen(Effect23.fail(err))),
+      ConfigNotFoundError: (err) => Console11.error(err.message).pipe(Effect23.andThen(Effect23.fail(err))),
+      ConfigParseError: (err) => Console11.error(`Config parse error: ${err.message}`).pipe(Effect23.andThen(Effect23.fail(err))),
+      ConfigValidationError: (err) => Effect23.gen(function* () {
         for (const e of err.errors) {
           yield* Console11.error(e);
         }
         yield* Console11.error(err.message);
-      }).pipe(Effect20.andThen(Effect20.fail(err))),
-      DeploymentCreateError: (err) => Console11.error(`Deployment creation failed: ${err.message}`).pipe(Effect20.andThen(Effect20.fail(err))),
-      ArchiveCreateError: (err) => Console11.error(`Archive creation failed: ${err.message}`).pipe(Effect20.andThen(Effect20.fail(err))),
-      UploadStartError: (err) => Console11.error(`Upload failed: ${err.message}`).pipe(Effect20.andThen(Effect20.fail(err))),
-      UploadPartError: (err) => Console11.error(`Upload failed: ${err.message}`).pipe(Effect20.andThen(Effect20.fail(err))),
-      UploadCompleteError: (err) => Console11.error(`Upload failed: ${err.message}`).pipe(Effect20.andThen(Effect20.fail(err))),
-      PresignedUrlError: (err) => Console11.error(`Upload failed: ${err.message}`).pipe(Effect20.andThen(Effect20.fail(err))),
-      DeploymentAuthError: (err) => Console11.error(`Authentication failed: ${err.message}`).pipe(Effect20.andThen(Effect20.fail(err))),
-      DeploymentFailedError: (err) => Console11.error(err.message).pipe(Effect20.andThen(Effect20.fail(err)))
+      }).pipe(Effect23.andThen(Effect23.fail(err))),
+      DeploymentCreateError: (err) => Console11.error(`Deployment creation failed: ${err.message}`).pipe(Effect23.andThen(Effect23.fail(err))),
+      ArchiveCreateError: (err) => Console11.error(`Archive creation failed: ${err.message}`).pipe(Effect23.andThen(Effect23.fail(err))),
+      UploadStartError: (err) => Console11.error(`Upload failed: ${err.message}`).pipe(Effect23.andThen(Effect23.fail(err))),
+      UploadPartError: (err) => Console11.error(`Upload failed: ${err.message}`).pipe(Effect23.andThen(Effect23.fail(err))),
+      UploadCompleteError: (err) => Console11.error(`Upload failed: ${err.message}`).pipe(Effect23.andThen(Effect23.fail(err))),
+      PresignedUrlError: (err) => Console11.error(`Upload failed: ${err.message}`).pipe(Effect23.andThen(Effect23.fail(err))),
+      DeploymentAuthError: (err) => Console11.error(`Authentication failed: ${err.message}`).pipe(Effect23.andThen(Effect23.fail(err))),
+      DeploymentFailedError: (err) => Console11.error(err.message).pipe(Effect23.andThen(Effect23.fail(err)))
     })
   )
 );
-var uploadArchive = (deploymentId, archivePath, fileSize) => Effect20.gen(function* () {
+var uploadArchive = (deploymentId, archivePath, fileSize) => Effect23.gen(function* () {
   const deploymentApi = yield* DeploymentApiService;
-  const fs = yield* FileSystem7.FileSystem;
+  const fs = yield* FileSystem9.FileSystem;
   const uploadId = yield* deploymentApi.startMultipartUpload(deploymentId);
   const FILE_CHUNK_SIZE = 10 * 1024 * 1024;
   const numChunks = Math.ceil(fileSize / FILE_CHUNK_SIZE);
-  yield* Effect20.log("Starting multipart upload", { uploadId, numChunks, fileSize });
-  const parts = yield* Effect20.all(
+  yield* Effect23.log("Starting multipart upload", { uploadId, numChunks, fileSize });
+  const parts = yield* Effect23.all(
     Array.from({ length: numChunks }, (_, i) => {
       const partNumber = i + 1;
       const start = i * FILE_CHUNK_SIZE;
       const bytesToRead = partNumber < numChunks ? FILE_CHUNK_SIZE : fileSize - start;
-      return Effect20.gen(function* () {
+      return Effect23.gen(function* () {
         const presignedUrl = yield* deploymentApi.getPresignedUrl(deploymentId, uploadId, partNumber);
         const chunkData = yield* Stream.runCollect(fs.stream(archivePath, { offset: start, bytesToRead })).pipe(
-          Effect20.map((chunks) => {
+          Effect23.map((chunks) => {
             const arrays = Array.from(chunks);
             return Buffer.concat(arrays);
           }),
-          Effect20.mapError(
+          Effect23.mapError(
             (error) => new UploadPartError({
               message: `Failed to read chunk ${partNumber}: ${String(error)}`,
               partNumber
             })
           )
         );
-        yield* Effect20.log(`Uploading part ${partNumber}/${numChunks}`, { size: chunkData.length });
+        yield* Effect23.log(`Uploading part ${partNumber}/${numChunks}`, { size: chunkData.length });
         return yield* deploymentApi.uploadPart(presignedUrl, chunkData, partNumber);
       });
     }),
@@ -2165,20 +2540,20 @@ var uploadArchive = (deploymentId, archivePath, fileSize) => Effect20.gen(functi
   );
   yield* deploymentApi.completeUpload(deploymentId, uploadId, parts);
 });
-var pollDeployment = (deploymentId) => Effect20.gen(function* () {
+var pollDeployment = (deploymentId) => Effect23.gen(function* () {
   const deploymentApi = yield* DeploymentApiService;
   let lastStatus = "PENDING";
   let logOffset = 0;
   yield* Console11.log("Status: Pending");
-  yield* Effect20.repeat(
-    Effect20.gen(function* () {
-      const newStatus = yield* deploymentApi.getDeploymentStatus(deploymentId).pipe(Effect20.catchTag("DeploymentStatusError", () => Effect20.succeed(lastStatus)));
+  yield* Effect23.repeat(
+    Effect23.gen(function* () {
+      const newStatus = yield* deploymentApi.getDeploymentStatus(deploymentId).pipe(Effect23.catchTag("DeploymentStatusError", () => Effect23.succeed(lastStatus)));
       if (newStatus !== lastStatus) {
         lastStatus = newStatus;
         const label = newStatus.charAt(0) + newStatus.slice(1).toLowerCase();
         yield* Console11.log(`Status: ${label}`);
       }
-      const logsPage = yield* deploymentApi.getLogs(deploymentId, { offset: logOffset, limit: 100 }).pipe(Effect20.catchTag("DeploymentLogsFetchError", () => Effect20.succeed(null)));
+      const logsPage = yield* deploymentApi.getLogs(deploymentId, { offset: logOffset, limit: 100 }).pipe(Effect23.catchTag("DeploymentLogsFetchError", () => Effect23.succeed(null)));
       if (logsPage) {
         for (const logEntry of logsPage.items) {
           logOffset++;
@@ -2186,17 +2561,17 @@ var pollDeployment = (deploymentId) => Effect20.gen(function* () {
         }
       }
       if (newStatus === "ACTIVE") {
-        const hostnames = yield* deploymentApi.getHostnames(deploymentId).pipe(Effect20.catchTag("DeploymentHostnamesFetchError", () => Effect20.succeed([])));
+        const hostnames = yield* deploymentApi.getHostnames(deploymentId).pipe(Effect23.catchTag("DeploymentHostnamesFetchError", () => Effect23.succeed([])));
         const active = hostnames.find((h) => h.active) ?? hostnames.at(0);
         if (active) {
           yield* Console11.log(`Deployed to https://${active.hostname}`);
         } else {
           yield* Console11.log("Deployment is live.");
         }
-        return yield* Effect20.fail("done");
+        return yield* Effect23.fail("done");
       }
       if (newStatus === "FAILED") {
-        return yield* Effect20.fail(
+        return yield* Effect23.fail(
           new DeploymentFailedError({
             message: "The deployment failed. Please check the logs for more information."
           })
@@ -2205,9 +2580,9 @@ var pollDeployment = (deploymentId) => Effect20.gen(function* () {
     }),
     Schedule.addDelay(Schedule.forever, () => Duration.seconds(1))
   ).pipe(
-    Effect20.catchAll((err) => {
-      if (err === "done") return Effect20.void;
-      return Effect20.fail(err);
+    Effect23.catchAll((err) => {
+      if (err === "done") return Effect23.void;
+      return Effect23.fail(err);
     })
   );
 });
@@ -2223,31 +2598,174 @@ var printLog = (logEntry) => {
 };
 
 // src/commands/platform/index.ts
-var platformBase = Command12.make("platform", {}, () => Effect21.void);
+var platformBase = Command12.make("platform", {}, () => Effect24.void);
 var platformCommand = platformBase.pipe(Command12.withSubcommands([deployCommand]));
 
+// src/commands/setup/index.ts
+import { Args as Args4, Command as Command13, Options as Options7, Prompt as Prompt3 } from "@effect/cli";
+import { Console as Console12, Effect as Effect25, Option as Option13 } from "effect";
+var fileArg2 = Args4.text({ name: "file" }).pipe(
+  Args4.withDescription("Output file to write (default: .env.local)"),
+  Args4.optional
+);
+var appOption6 = Options7.text("app").pipe(
+  Options7.withAlias("a"),
+  Options7.withDescription("Application ID to set up (skips the interactive picker)"),
+  Options7.optional
+);
+var orgOption6 = Options7.text("org").pipe(
+  Options7.withAlias("o"),
+  Options7.withDescription("Only list applications belonging to this organization ID when picking"),
+  Options7.optional
+);
+var environmentOption2 = Options7.text("environment").pipe(
+  Options7.withAlias("e"),
+  Options7.withDescription("Environment slug to resolve overrides for (e.g. preview)"),
+  Options7.optional
+);
+var yesOption2 = Options7.boolean("yes").pipe(
+  Options7.withAlias("y"),
+  Options7.withDescription("Overwrite an existing file without confirmation")
+);
+var rotateOption2 = Options7.boolean("rotate").pipe(
+  Options7.withDescription("Force a fresh API key, revoking the previous one")
+);
+var setupCommand = Command13.make(
+  "setup",
+  {
+    file: fileArg2,
+    app: appOption6,
+    org: orgOption6,
+    environment: environmentOption2,
+    yes: yesOption2,
+    rotate: rotateOption2
+  },
+  ({ file, app, org, environment, yes, rotate }) => Effect25.gen(function* () {
+    const apiClient = yield* ApiClientService;
+    const projectLink = yield* ProjectLinkService;
+    const envFile = yield* EnvFileService;
+    const localCredentials = yield* LocalCredentialsService;
+    const cwd = process.cwd();
+    const existingLink = yield* projectLink.load(cwd);
+    let applicationId;
+    if (Option13.isSome(existingLink)) {
+      applicationId = existingLink.value.applicationId;
+      if (Option13.isSome(app) || Option13.isSome(org)) {
+        yield* Console12.log(
+          `Note: this directory is already linked to ${applicationId}; ignoring --app/--org. Run "gigadrive unlink" first to target a different application.`
+        );
+      }
+    } else {
+      const organizationId = Option13.getOrUndefined(org);
+      const { items: apps } = yield* apiClient.request((client) => client.applications.list({ organizationId }));
+      if (apps.length === 0) {
+        return yield* Effect25.fail(
+          new NoApplicationsFoundError({
+            message: 'No applications found. Create one in the Gigadrive console, then run "gigadrive setup" again.'
+          })
+        );
+      }
+      const explicitAppId = Option13.getOrUndefined(app);
+      let chosen;
+      if (explicitAppId !== void 0) {
+        const match = apps.find((a) => a.id === explicitAppId);
+        if (match === void 0) {
+          return yield* Effect25.fail(
+            new ApplicationNotFoundError({
+              message: `Application "${explicitAppId}" was not found among your applications.`
+            })
+          );
+        }
+        chosen = match;
+      } else if (apps.length === 1) {
+        chosen = apps[0];
+      } else {
+        chosen = yield* Prompt3.run(
+          Prompt3.select({
+            message: "Select an application to set up",
+            choices: apps.map((a) => ({ title: `${a.name} (${a.organization.name})`, value: a }))
+          })
+        );
+      }
+      applicationId = chosen.id;
+      yield* projectLink.save(cwd, { applicationId, organizationId: chosen.organization.id });
+      yield* Console12.log(`Linked this directory to application ${applicationId}.`);
+    }
+    const target = Option13.getOrElse(file, () => ".env.local");
+    const environmentSlug = Option13.getOrUndefined(environment);
+    const { items, omittedSensitive } = yield* apiClient.request(
+      (client) => client.applications.envVars.pull(applicationId, environmentSlug ? { environment: environmentSlug } : void 0)
+    );
+    const existing = yield* envFile.read(target);
+    if (Option13.isSome(existing) && !yes) {
+      const overwrite = yield* Prompt3.run(
+        Prompt3.confirm({ message: `${target} already exists. Overwrite?`, initial: false })
+      );
+      if (!overwrite) {
+        return yield* Console12.log("Cancelled.");
+      }
+    }
+    const credentialEntries2 = yield* localCredentials.provision({
+      applicationId,
+      rotate,
+      existingContent: Option13.getOrUndefined(existing)
+    });
+    const entries = [...items.map((v) => ({ key: v.key, value: v.value })), ...credentialEntries2];
+    yield* envFile.write(target, entries);
+    const gitignored = yield* envFile.ensureGitignored(cwd, target);
+    yield* Console12.log("\nLocal dev environment ready.");
+    yield* Console12.log(`  \u2022 Wrote ${items.length} variable(s) and API credentials to ${target}.`);
+    if (omittedSensitive > 0) {
+      yield* Console12.log(
+        `  \u2022 Skipped ${omittedSensitive} sensitive variable(s) (only production/preview hold secrets).`
+      );
+    }
+    if (gitignored) {
+      yield* Console12.log(`  \u2022 Added ${target} to .gitignore.`);
+    }
+    yield* Console12.log("  \u2022 Your app can now call the Gigadrive API via the SDK (GIGADRIVE_CLIENT_ID/SECRET).");
+  }).pipe(
+    Effect25.catchTags({
+      // Ctrl+C during a prompt is a deliberate cancel — exit 0.
+      QuitException: () => Console12.log("Cancelled."),
+      NotAuthenticatedError: (err) => Console12.error('You are not logged in. Run "gigadrive login" to authenticate.').pipe(
+        Effect25.andThen(Effect25.fail(err))
+      ),
+      ApiRequestError: (err) => Console12.error(`Setup failed: ${err.message}`).pipe(Effect25.andThen(Effect25.fail(err))),
+      NoApplicationsFoundError: (err) => Console12.error(err.message).pipe(Effect25.andThen(Effect25.fail(err))),
+      ApplicationNotFoundError: (err) => Console12.error(err.message).pipe(Effect25.andThen(Effect25.fail(err))),
+      ProjectLinkReadError: (err) => Console12.error(err.message).pipe(Effect25.andThen(Effect25.fail(err))),
+      ProjectLinkWriteError: (err) => Console12.error(err.message).pipe(Effect25.andThen(Effect25.fail(err))),
+      EnvFileReadError: (err) => Console12.error(err.message).pipe(Effect25.andThen(Effect25.fail(err))),
+      EnvFileWriteError: (err) => Console12.error(err.message).pipe(Effect25.andThen(Effect25.fail(err))),
+      DevCredentialsStoreReadError: (err) => Console12.error(err.message).pipe(Effect25.andThen(Effect25.fail(err))),
+      DevCredentialsStoreWriteError: (err) => Console12.error(err.message).pipe(Effect25.andThen(Effect25.fail(err)))
+    })
+  )
+);
+
 // src/commands/whoami/index.ts
-import { Command as Command13 } from "@effect/cli";
-import { Console as Console12, Effect as Effect22 } from "effect";
-var whoamiCommand = Command13.make(
+import { Command as Command14 } from "@effect/cli";
+import { Console as Console13, Effect as Effect26 } from "effect";
+var whoamiCommand = Command14.make(
   "whoami",
   {},
-  () => Effect22.gen(function* () {
+  () => Effect26.gen(function* () {
     const auth = yield* AuthService;
     const info = yield* auth.getUserInfo;
-    yield* Console12.log(JSON.stringify(info, null, 2));
+    yield* Console13.log(JSON.stringify(info, null, 2));
   }).pipe(
-    Effect22.catchTags({
-      NotAuthenticatedError: () => Console12.log('You are not logged in. Run "gigadrive login" to authenticate.'),
-      UserInfoFetchError: (err) => Console12.error(`Failed to retrieve user info: ${err.message}`),
-      OAuthDiscoveryError: (err) => Console12.error(`Failed to retrieve user info: ${err.message}`)
+    Effect26.catchTags({
+      NotAuthenticatedError: () => Console13.log('You are not logged in. Run "gigadrive login" to authenticate.'),
+      UserInfoFetchError: (err) => Console13.error(`Failed to retrieve user info: ${err.message}`),
+      OAuthDiscoveryError: (err) => Console13.error(`Failed to retrieve user info: ${err.message}`)
     })
   )
 );
 
 // src/index.ts
-var gigadrive = Command14.make("gigadrive", {}, () => Effect23.void).pipe(
-  Command14.withSubcommands([
+var gigadrive = Command15.make("gigadrive", {}, () => Effect27.void).pipe(
+  Command15.withSubcommands([
     loginCommand,
     logoutCommand,
     whoamiCommand,
@@ -2259,10 +2777,11 @@ var gigadrive = Command14.make("gigadrive", {}, () => Effect23.void).pipe(
     aiCommand,
     buildCommand,
     debugCommand,
-    platformCommand
+    platformCommand,
+    setupCommand
   ])
 );
-var cli = Command14.run(gigadrive, {
+var cli = Command15.run(gigadrive, {
   name: "Gigadrive CLI",
   version: package_default.version
 });
@@ -2273,13 +2792,16 @@ var BaseServices = Layer.mergeAll(
   ArchiveService.Default,
   NetworkConfigLive2,
   ProjectConfigService.Default,
-  ProjectLinkService.Default
+  ProjectLinkService.Default,
+  EnvFileService.Default,
+  DevCredentialsStore.Default
 ).pipe(Layer.provideMerge(AuthService.Default));
 var ApiClientLive = Layer.provide(ApiClientService.Default, BaseServices);
 var DeploymentApiLive = Layer.provide(DeploymentApiService.Default, BaseServices);
-var ServicesLive = Layer.mergeAll(BaseServices, ApiClientLive, DeploymentApiLive);
+var LocalCredentialsLive = Layer.provide(LocalCredentialsService.Default, BaseServices);
+var ServicesLive = Layer.mergeAll(BaseServices, ApiClientLive, DeploymentApiLive, LocalCredentialsLive);
 var AppLive = Layer.mergeAll(ServicesLive, Logger.minimumLogLevel(LogLevel.Info)).pipe(
   Layer.provideMerge(NodeContext.layer)
 );
-NodeRuntime.runMain(Effect23.provide(cli(process.argv), AppLive));
+NodeRuntime.runMain(Effect27.provide(cli(process.argv), AppLive));
 //# sourceMappingURL=index.mjs.map