md4ai 0.10.4 → 0.12.0

package/dist/index.bundled.js

@@ -73,7 +73,7 @@ var CURRENT_VERSION;
 var init_check_update = __esm({
   "dist/check-update.js"() {
     "use strict";
-    CURRENT_VERSION = true ? "0.10.4" : "0.0.0-dev";
+    CURRENT_VERSION = true ? "0.12.0" : "0.0.0-dev";
   }
 });
 
@@ -1479,7 +1479,61 @@ function computeDrift(variables, apps, localPresence, workflowRefs) {
     workflowBrokenRefs: workflowBrokenRefs.sort()
   };
 }
-var execFileAsync, MANIFEST_PATH;
+function computeDopplerDrift(doppler2, manifest) {
+  const dopplerNotDeployed = [];
+  const notInDoppler = [];
+  const allDopplerSecrets = /* @__PURE__ */ new Set();
+  for (const config2 of doppler2.configs) {
+    for (const name of config2.secretNames)
+      allDopplerSecrets.add(name);
+  }
+  for (const config2 of doppler2.configs) {
+    const targets = CONFIG_TARGET_MAP[config2.name.toLowerCase()];
+    if (!targets)
+      continue;
+    for (const secretName of config2.secretNames) {
+      const manifestVar = manifest.variables.find((v) => v.name === secretName);
+      if (targets.local && manifestVar) {
+        for (const [app, status] of Object.entries(manifestVar.localStatus)) {
+          if (status === "missing") {
+            dopplerNotDeployed.push({
+              variable: secretName,
+              config: config2.name,
+              missingFrom: "local",
+              app
+            });
+          }
+        }
+      }
+      if (targets.vercel && manifestVar?.vercelStatus) {
+        for (const [proj, status] of Object.entries(manifestVar.vercelStatus)) {
+          if (status === "missing") {
+            dopplerNotDeployed.push({
+              variable: secretName,
+              config: config2.name,
+              missingFrom: "vercel",
+              app: proj
+            });
+          }
+        }
+      }
+      if (targets.github && manifestVar?.githubStatus === "missing") {
+        dopplerNotDeployed.push({
+          variable: secretName,
+          config: config2.name,
+          missingFrom: "github"
+        });
+      }
+    }
+  }
+  for (const v of manifest.variables) {
+    if (!allDopplerSecrets.has(v.name)) {
+      notInDoppler.push({ variable: v.name, foundIn: "manifest" });
+    }
+  }
+  return { dopplerNotDeployed, notInDoppler };
+}
+var execFileAsync, MANIFEST_PATH, CONFIG_TARGET_MAP;
 var init_env_manifest_scanner = __esm({
   "dist/scanner/env-manifest-scanner.js"() {
     "use strict";
@@ -1488,6 +1542,15 @@ var init_env_manifest_scanner = __esm({
     init_fetch_env_vars();
     execFileAsync = promisify(execFile);
     MANIFEST_PATH = "docs/reference/env-manifest.md";
+    CONFIG_TARGET_MAP = {
+      dev: { local: true, vercel: false, github: false },
+      development: { local: true, vercel: false, github: false },
+      stg: { local: false, vercel: true, github: false },
+      staging: { local: false, vercel: true, github: false },
+      prd: { local: false, vercel: true, github: true },
+      prod: { local: false, vercel: true, github: true },
+      production: { local: false, vercel: true, github: true }
+    };
   }
 });
 
@@ -1591,19 +1654,226 @@ var init_marketplace_scanner = __esm({
   }
 });
 
+// dist/doppler/auth.js
+async function resolveDopplerToken() {
+  const creds = await loadCredentials();
+  if (creds?.dopplerToken) {
+    const { join: join17 } = await import("node:path");
+    const { homedir: homedir10 } = await import("node:os");
+    return {
+      token: creds.dopplerToken,
+      sourcePath: join17(homedir10(), ".md4ai", "credentials.json")
+    };
+  }
+  return null;
+}
+var init_auth3 = __esm({
+  "dist/doppler/auth.js"() {
+    "use strict";
+    init_config();
+  }
+});
+
+// dist/doppler/api.js
+async function dopplerFetch(url, token, retryCount = 0) {
+  const res = await fetch(url, {
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json"
+    }
+  });
+  if (res.status === 429 && retryCount < MAX_RETRIES) {
+    const retryAfter = parseInt(res.headers.get("retry-after") ?? "2", 10);
+    await new Promise((r) => setTimeout(r, retryAfter * 1e3));
+    return dopplerFetch(url, token, retryCount + 1);
+  }
+  if (!res.ok) {
+    const isAuth = res.status === 401 || res.status === 403;
+    const body = await res.text().catch(() => "");
+    throw new DopplerApiError(`Doppler API ${res.status}: ${body || res.statusText}`, res.status, isAuth);
+  }
+  return res.json();
+}
+async function fetchDopplerConfigs(projectSlug, token) {
+  const data = await dopplerFetch(`https://api.doppler.com/v3/configs?project=${encodeURIComponent(projectSlug)}`, token);
+  return data.configs;
+}
+async function fetchDopplerSecretNames(projectSlug, configName, token) {
+  const data = await dopplerFetch(`https://api.doppler.com/v3/configs/config/secrets?project=${encodeURIComponent(projectSlug)}&config=${encodeURIComponent(configName)}`, token);
+  return Object.keys(data.secrets);
+}
+async function validateDopplerToken(token) {
+  try {
+    const data = await dopplerFetch("https://api.doppler.com/v3/projects", token);
+    return { valid: true, projectCount: data.projects.length };
+  } catch (err) {
+    if (err instanceof DopplerApiError && err.isAuthError) {
+      return { valid: false, projectCount: 0 };
+    }
+    throw err;
+  }
+}
+async function fetchDopplerProjects(token) {
+  const data = await dopplerFetch("https://api.doppler.com/v3/projects", token);
+  return data.projects.map((p) => ({ slug: p.slug, name: p.name }));
+}
+var DopplerApiError, MAX_RETRIES;
+var init_api = __esm({
+  "dist/doppler/api.js"() {
+    "use strict";
+    DopplerApiError = class extends Error {
+      status;
+      isAuthError;
+      constructor(message, status, isAuthError) {
+        super(message);
+        this.status = status;
+        this.isAuthError = isAuthError;
+        this.name = "DopplerApiError";
+      }
+    };
+    MAX_RETRIES = 2;
+  }
+});
+
+// dist/scanner/doppler-scanner.js
+import { readFile as readFile9 } from "node:fs/promises";
+import { join as join11, basename } from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
+import chalk10 from "chalk";
+import { select as select3 } from "@inquirer/prompts";
+async function parseDopplerYaml(projectRoot) {
+  const yamlPath = join11(projectRoot, "doppler.yaml");
+  if (!existsSync6(yamlPath))
+    return null;
+  try {
+    const content = await readFile9(yamlPath, "utf-8");
+    const match = content.match(/^project:\s*["']?([a-z0-9_-]+)["']?\s*$/m);
+    return match?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+async function scanDoppler(projectRoot, folderId) {
+  const tokenResult = await resolveDopplerToken();
+  if (!tokenResult) {
+    console.log(chalk10.dim('  Doppler: no token configured. Run "md4ai doppler connect" to set up.'));
+    return null;
+  }
+  let projectSlug = await parseDopplerYaml(projectRoot);
+  let matchedVia = "doppler-yaml";
+  if (!projectSlug && folderId) {
+    const state = await loadState();
+    projectSlug = state.dopplerProjects?.[folderId] ?? null;
+    if (projectSlug)
+      matchedVia = "manual";
+  }
+  if (!projectSlug) {
+    if (!folderId || !process.stdin.isTTY) {
+      console.log(chalk10.dim('  Doppler: token configured but no project linked. Run "md4ai doppler set-project <slug>" to link one.'));
+      return null;
+    }
+    const projects = await fetchDopplerProjects(tokenResult.token);
+    if (projects.length === 0) {
+      console.log(chalk10.yellow("  Doppler: no projects accessible with this token."));
+      return null;
+    }
+    const projectName = basename(projectRoot);
+    if (projects.length === 1) {
+      projectSlug = projects[0].slug;
+      console.log(chalk10.green(`  Doppler: using "${projectSlug}" (only accessible project).`));
+    } else {
+      const autoMatch = projects.find((p) => p.slug.toLowerCase() === projectName.toLowerCase());
+      if (autoMatch) {
+        projectSlug = autoMatch.slug;
+        console.log(chalk10.green(`  Doppler: auto-matched project "${projectSlug}" from project name.`));
+      } else {
+        projectSlug = await select3({
+          message: `Which Doppler project holds secrets for "${projectName}"?`,
+          choices: projects.map((p) => ({
+            name: `${p.slug}${p.name !== p.slug ? ` (${p.name})` : ""}`,
+            value: p.slug
+          }))
+        });
+      }
+    }
+    const state = await loadState();
+    const dopplerProjects = state.dopplerProjects ?? {};
+    dopplerProjects[folderId] = projectSlug;
+    await saveState({ dopplerProjects });
+    matchedVia = "manual";
+    console.log(chalk10.dim(`  Doppler: saved "${projectSlug}" for this project. To change: md4ai doppler set-project <slug>`));
+  }
+  console.log(chalk10.dim(`  Doppler: checking project "${projectSlug}" (via ${matchedVia})...`));
+  try {
+    const apiConfigs = await fetchDopplerConfigs(projectSlug, tokenResult.token);
+    const CONCURRENCY = 4;
+    const configs = [];
+    for (let i = 0; i < apiConfigs.length; i += CONCURRENCY) {
+      const batch = apiConfigs.slice(i, i + CONCURRENCY);
+      const results = await Promise.all(batch.map(async (cfg) => {
+        try {
+          const secretNames = await fetchDopplerSecretNames(projectSlug, cfg.name, tokenResult.token);
+          return {
+            name: cfg.name,
+            environment: cfg.environment,
+            secretNames
+          };
+        } catch (err) {
+          if (err instanceof DopplerApiError && err.status === 429) {
+            console.log(chalk10.yellow(`  Doppler: rate limited on config "${cfg.name}", skipping remaining.`));
+            return null;
+          }
+          console.log(chalk10.dim(`  Doppler: failed to fetch config "${cfg.name}": ${err instanceof Error ? err.message : String(err)}`));
+          return null;
+        }
+      }));
+      for (const r of results) {
+        if (r)
+          configs.push(r);
+      }
+    }
+    console.log(chalk10.dim(`  Doppler: ${configs.length} config(s), ${configs.reduce((n, c) => n + c.secretNames.length, 0)} total secrets`));
+    return {
+      project: projectSlug,
+      configs,
+      matchedVia,
+      checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  } catch (err) {
+    if (err instanceof DopplerApiError) {
+      if (err.isAuthError) {
+        console.log(chalk10.yellow('  Doppler: token invalid or expired. Run "md4ai doppler connect" to reconfigure.'));
+      } else {
+        console.log(chalk10.yellow(`  Doppler: API error \u2014 ${err.message}`));
+      }
+    } else {
+      console.log(chalk10.yellow(`  Doppler: ${err instanceof Error ? err.message : String(err)}`));
+    }
+    return null;
+  }
+}
+var init_doppler_scanner = __esm({
+  "dist/scanner/doppler-scanner.js"() {
+    "use strict";
+    init_auth3();
+    init_api();
+    init_config();
+  }
+});
+
 // dist/scanner/index.js
 import { readdir as readdir3 } from "node:fs/promises";
-import { join as join11, relative as relative3 } from "node:path";
-import { existsSync as existsSync6 } from "node:fs";
+import { join as join12, relative as relative3 } from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { createHash } from "node:crypto";
-async function scanProject(projectRoot) {
+async function scanProject(projectRoot, folderId) {
   const allFiles = await discoverFiles(projectRoot);
   const rootFiles = identifyRoots(allFiles, projectRoot);
   const allRefs = [];
   const allBrokenRefs = [];
   for (const file of allFiles) {
-    const fullPath = file.startsWith("/") ? file : join11(projectRoot, file);
+    const fullPath = file.startsWith("/") ? file : join12(projectRoot, file);
     try {
       const { refs, brokenRefs: brokenRefs2 } = await parseFileReferences(fullPath, projectRoot);
       allRefs.push(...refs);
@@ -1618,6 +1888,12 @@ async function scanProject(projectRoot) {
   const toolings = await detectToolings(projectRoot);
   const envManifest = await scanEnvManifest(projectRoot);
   const marketplacePlugins = await scanMarketplacePlugins();
+  const doppler2 = await scanDoppler(projectRoot, folderId);
+  if (doppler2 && envManifest) {
+    const dopplerDrift = computeDopplerDrift(doppler2, envManifest);
+    envManifest.drift.dopplerNotDeployed = dopplerDrift.dopplerNotDeployed;
+    envManifest.drift.notInDoppler = dopplerDrift.notInDoppler;
+  }
   const depthMap = /* @__PURE__ */ new Map();
   const queue = [...rootFiles];
   for (const r of queue)
@@ -1638,7 +1914,7 @@ async function scanProject(projectRoot) {
     depth: depthMap.get(br.from) ?? 999
   }));
   brokenRefs.sort((a, b) => a.depth - b.depth || a.from.localeCompare(b.from));
-  const scanData = JSON.stringify({ graph, orphans, brokenRefs, skills, staleFiles, toolings, envManifest, marketplacePlugins });
+  const scanData = JSON.stringify({ graph, orphans, brokenRefs, skills, staleFiles, toolings, envManifest, marketplacePlugins, doppler: doppler2 });
   const dataHash = createHash("sha256").update(scanData).digest("hex");
   return {
     graph,
@@ -1648,6 +1924,7 @@ async function scanProject(projectRoot) {
     staleFiles,
     toolings,
     envManifest,
+    doppler: doppler2,
     marketplacePlugins,
     scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
     dataHash
@@ -1655,18 +1932,18 @@ async function scanProject(projectRoot) {
 }
 async function discoverFiles(projectRoot) {
   const files = [];
-  const claudeDir = join11(projectRoot, ".claude");
-  if (existsSync6(claudeDir)) {
+  const claudeDir = join12(projectRoot, ".claude");
+  if (existsSync7(claudeDir)) {
     await walkDir(claudeDir, projectRoot, files);
   }
-  if (existsSync6(join11(projectRoot, "CLAUDE.md"))) {
+  if (existsSync7(join12(projectRoot, "CLAUDE.md"))) {
     files.push("CLAUDE.md");
   }
-  if (existsSync6(join11(projectRoot, "skills.md"))) {
+  if (existsSync7(join12(projectRoot, "skills.md"))) {
     files.push("skills.md");
   }
-  const plansDir = join11(projectRoot, "docs", "plans");
-  if (existsSync6(plansDir)) {
+  const plansDir = join12(projectRoot, "docs", "plans");
+  if (existsSync7(plansDir)) {
     await walkDir(plansDir, projectRoot, files);
   }
   return [...new Set(files)];
@@ -1674,7 +1951,7 @@ async function discoverFiles(projectRoot) {
 async function walkDir(dir, projectRoot, files) {
   const entries = await readdir3(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join11(dir, entry.name);
+    const fullPath = join12(dir, entry.name);
     if (entry.isDirectory()) {
       if (["node_modules", ".git", ".turbo", "cache", "session-env"].includes(entry.name))
         continue;
@@ -1694,15 +1971,15 @@ function identifyRoots(allFiles, projectRoot) {
   }
   for (const globalFile of GLOBAL_ROOT_FILES) {
     const expanded = globalFile.replace("~", homedir7());
-    if (existsSync6(expanded)) {
+    if (existsSync7(expanded)) {
       roots.push(globalFile);
     }
   }
   return roots;
 }
 async function readClaudeConfigFiles(projectRoot, graphFilePaths) {
-  const { readFile: readFile13, stat: stat2 } = await import("node:fs/promises");
-  const { existsSync: existsSync14 } = await import("node:fs");
+  const { readFile: readFile14, stat: stat2 } = await import("node:fs/promises");
+  const { existsSync: existsSync15 } = await import("node:fs");
   const filePaths = graphFilePaths ?? await discoverFiles(projectRoot);
   const files = [];
   const seen = /* @__PURE__ */ new Set();
@@ -1712,11 +1989,11 @@ async function readClaudeConfigFiles(projectRoot, graphFilePaths) {
     if (relPath.startsWith("~") || relPath.startsWith("/"))
       continue;
     seen.add(relPath);
-    const fullPath = join11(projectRoot, relPath);
-    if (!existsSync14(fullPath))
+    const fullPath = join12(projectRoot, relPath);
+    if (!existsSync15(fullPath))
       continue;
     try {
-      const content = await readFile13(fullPath, "utf-8");
+      const content = await readFile14(fullPath, "utf-8");
       const fileStat = await stat2(fullPath);
       const lastMod = getGitLastModified(fullPath, projectRoot);
       files.push({ filePath: relPath, content, sizeBytes: fileStat.size, lastModified: lastMod });
@@ -1729,7 +2006,7 @@ function detectStaleFiles(allFiles, projectRoot) {
   const stale = [];
   const now = Date.now();
   for (const file of allFiles) {
-    const fullPath = join11(projectRoot, file);
+    const fullPath = join12(projectRoot, file);
     const lastMod = getGitLastModified(fullPath, projectRoot);
     if (lastMod) {
       const days = Math.floor((now - new Date(lastMod).getTime()) / (1e3 * 60 * 60 * 24));
@@ -1752,6 +2029,7 @@ var init_scanner = __esm({
     init_tooling_detector();
     init_env_manifest_scanner();
     init_marketplace_scanner();
+    init_doppler_scanner();
   }
 });
 
@@ -1896,7 +2174,7 @@ var init_push_toolings = __esm({
 });
 
 // dist/commands/push-health-results.js
-import chalk10 from "chalk";
+import chalk11 from "chalk";
 async function pushHealthResults(supabase, folderId, manifest) {
   const { data: checks } = await supabase.from("env_health_checks").select("id, check_type, check_config").eq("folder_id", folderId).eq("enabled", true);
   if (!checks?.length)
@@ -1964,9 +2242,9 @@ async function pushHealthResults(supabase, folderId, manifest) {
   if (results.length > 0) {
     const { error } = await supabase.from("env_health_results").insert(results);
     if (error) {
-      console.error(chalk10.yellow(`Health results warning: ${error.message}`));
+      console.error(chalk11.yellow(`Health results warning: ${error.message}`));
     } else {
-      console.log(chalk10.green(`  Updated ${results.length} health check result(s).`));
+      console.log(chalk11.green(`  Updated ${results.length} health check result(s).`));
       const checkIds = results.map((r) => r.check_id);
       const { data: allResults } = await supabase.from("env_health_results").select("id, check_id, ran_at").in("check_id", checkIds).order("ran_at", { ascending: false });
       if (allResults) {
@@ -2035,21 +2313,30 @@ var map_exports = {};
 __export(map_exports, {
   mapCommand: () => mapCommand
 });
-import { resolve as resolve4, basename } from "node:path";
+import { resolve as resolve4, basename as basename2 } from "node:path";
 import { writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
-import { existsSync as existsSync7 } from "node:fs";
-import chalk11 from "chalk";
-import { select as select3, input as input5, confirm as confirm2 } from "@inquirer/prompts";
+import { existsSync as existsSync8 } from "node:fs";
+import chalk12 from "chalk";
+import { select as select4, input as input5, confirm as confirm2 } from "@inquirer/prompts";
 async function mapCommand(path, options) {
   await checkForUpdate();
   const projectRoot = resolve4(path ?? process.cwd());
-  if (!existsSync7(projectRoot)) {
-    console.error(chalk11.red(`Path not found: ${projectRoot}`));
+  if (!existsSync8(projectRoot)) {
+    console.error(chalk12.red(`Path not found: ${projectRoot}`));
     process.exit(1);
   }
-  console.log(chalk11.blue(`Scanning: ${projectRoot}
+  console.log(chalk12.blue(`Scanning: ${projectRoot}
 `));
-  const result = await scanProject(projectRoot);
+  let earlyFolderId;
+  if (!options.offline) {
+    try {
+      const { supabase: earlyDb } = await getAuthenticatedClient();
+      const { data: dp } = await earlyDb.from("device_paths").select("folder_id").eq("path", projectRoot).maybeSingle();
+      earlyFolderId = dp?.folder_id ?? void 0;
+    } catch {
+    }
+  }
+  const result = await scanProject(projectRoot, earlyFolderId);
   console.log(`  Files found:   ${result.graph.nodes.length}`);
   console.log(`  References:    ${result.graph.edges.length}`);
   console.log(`  Broken refs:   ${result.brokenRefs.length}`);
@@ -2058,26 +2345,27 @@ async function mapCommand(path, options) {
   console.log(`  Skills:        ${result.skills.length}`);
   console.log(`  Toolings:      ${result.toolings.length}`);
   console.log(`  Env Vars:      ${result.envManifest?.variables.length ?? 0} (${result.envManifest ? "manifest found" : "no manifest"})`);
+  console.log(`  Doppler:       ${result.doppler ? `${result.doppler.configs.length} config(s) \u2014 ${result.doppler.project}` : "see above"}`);
   console.log(`  Plugins:       ${result.marketplacePlugins.length} (${result.marketplacePlugins.reduce((n, p) => n + p.skills.length, 0)} skills)`);
   console.log(`  Data hash:     ${result.dataHash.slice(0, 12)}...`);
   if (result.brokenRefs.length > 0) {
-    console.log(chalk11.red(`
+    console.log(chalk12.red(`
   Warning: ${result.brokenRefs.length} broken reference(s) found:`));
     for (const br of result.brokenRefs.slice(0, 5)) {
-      console.log(chalk11.red(`    ${br.from} -> ${br.to}`));
+      console.log(chalk12.red(`    ${br.from} -> ${br.to}`));
     }
     if (result.brokenRefs.length > 5) {
-      console.log(chalk11.red(`    ... and ${result.brokenRefs.length - 5} more`));
+      console.log(chalk12.red(`    ... and ${result.brokenRefs.length - 5} more`));
     }
   }
   const outputDir = resolve4(projectRoot, "output");
-  if (!existsSync7(outputDir)) {
+  if (!existsSync8(outputDir)) {
     await mkdir2(outputDir, { recursive: true });
   }
   const htmlPath = resolve4(outputDir, "index.html");
   const html = generateOfflineHtml(result, projectRoot);
   await writeFile2(htmlPath, html, "utf-8");
-  console.log(chalk11.green(`
+  console.log(chalk12.green(`
 Local preview: ${htmlPath}`));
   if (!options.offline) {
     try {
@@ -2088,7 +2376,7 @@ Local preview: ${htmlPath}`));
         const { data: proposedFiles } = await supabase.from("folder_files").select("id, file_path, proposed_at").eq("folder_id", folder_id).eq("proposed_for_deletion", true);
         if (proposedFiles?.length && process.stdin.isTTY) {
           const { checkbox } = await import("@inquirer/prompts");
-          console.log(chalk11.yellow(`
+          console.log(chalk12.yellow(`
 ${proposedFiles.length} file(s) proposed for deletion:
 `));
           const toDelete = await checkbox({
@@ -2102,16 +2390,16 @@ ${proposedFiles.length} file(s) proposed for deletion:
           for (const file of toDelete) {
             const fullPath = resolve4(projectRoot, file.file_path);
             if (!fullPath.startsWith(resolvedRoot + "/")) {
-              console.error(chalk11.red(`  Blocked path traversal: ${file.file_path}`));
+              console.error(chalk12.red(`  Blocked path traversal: ${file.file_path}`));
               continue;
             }
             try {
               const { unlink } = await import("node:fs/promises");
               await unlink(fullPath);
               await supabase.from("folder_files").delete().eq("id", file.id);
-              console.log(chalk11.green(`  Deleted: ${file.file_path}`));
+              console.log(chalk12.green(`  Deleted: ${file.file_path}`));
             } catch (err) {
-              console.error(chalk11.red(`  Failed to delete ${file.file_path}: ${err instanceof Error ? err.message : String(err)}`));
+              console.error(chalk12.red(`  Failed to delete ${file.file_path}: ${err instanceof Error ? err.message : String(err)}`));
             }
           }
           const keptIds = proposedFiles.filter((f) => !toDelete.some((d) => d.id === f.id)).map((f) => f.id);
@@ -2119,11 +2407,11 @@ ${proposedFiles.length} file(s) proposed for deletion:
             for (const id of keptIds) {
               await supabase.from("folder_files").update({ proposed_for_deletion: false, proposed_at: null, proposed_by: null }).eq("id", id);
             }
-            console.log(chalk11.cyan(`  Kept ${keptIds.length} file(s) \u2014 proposals cleared.`));
+            console.log(chalk12.cyan(`  Kept ${keptIds.length} file(s) \u2014 proposals cleared.`));
           }
           console.log("");
         } else if (proposedFiles?.length) {
-          console.log(chalk11.dim(`  ${proposedFiles.length} file(s) proposed for deletion \u2014 skipped (non-interactive mode).`));
+          console.log(chalk12.dim(`  ${proposedFiles.length} file(s) proposed for deletion \u2014 skipped (non-interactive mode).`));
         }
         let storedManifest = null;
         if (!result.envManifest) {
@@ -2145,9 +2433,12 @@ ${proposedFiles.length} file(s) proposed for deletion:
         if (result.envManifest) {
           updatePayload.env_manifest_json = result.envManifest;
         }
+        if (result.doppler) {
+          updatePayload.doppler_json = result.doppler;
+        }
         const { error } = await supabase.from("claude_folders").update(updatePayload).eq("id", folder_id);
         if (error) {
-          console.error(chalk11.yellow(`Sync warning: ${error.message}`));
+          console.error(chalk12.yellow(`Sync warning: ${error.message}`));
         } else {
           await pushToolings(supabase, folder_id, result.toolings);
           const manifestForHealth = result.envManifest ?? storedManifest;
@@ -2160,8 +2451,8 @@ ${proposedFiles.length} file(s) proposed for deletion:
             lastDeviceName: device_name,
             lastSyncAt: (/* @__PURE__ */ new Date()).toISOString()
           });
-          console.log(chalk11.green("Synced to Supabase."));
-          console.log(chalk11.cyan(`
+          console.log(chalk12.green("Synced to Supabase."));
+          console.log(chalk12.cyan(`
   https://www.md4ai.com/project/${folder_id}
 `));
           const graphPaths = result.graph.nodes.map((n) => n.filePath);
@@ -2176,18 +2467,18 @@ ${proposedFiles.length} file(s) proposed for deletion:
                 last_modified: file.lastModified
               }, { onConflict: "folder_id,file_path" });
             }
-            console.log(chalk11.green(`  Uploaded ${configFiles.length} config file(s).`));
+            console.log(chalk12.green(`  Uploaded ${configFiles.length} config file(s).`));
           }
         }
       } else {
-        console.log(chalk11.yellow("\nThis folder is not linked to a project on your dashboard."));
+        console.log(chalk12.yellow("\nThis folder is not linked to a project on your dashboard."));
         if (!process.stdin.isTTY) {
-          console.log(chalk11.dim("Non-interactive mode \u2014 skipping link prompt."));
+          console.log(chalk12.dim("Non-interactive mode \u2014 skipping link prompt."));
           return;
         }
         const shouldLink = await confirm2({ message: "Would you like to link it now?" });
         if (!shouldLink) {
-          console.log(chalk11.dim("Skipped \u2014 local preview still generated."));
+          console.log(chalk12.dim("Skipped \u2014 local preview still generated."));
         } else {
           const { supabase: sb, userId } = await getAuthenticatedClient();
           const { data: folders } = await sb.from("claude_folders").select("id, name").order("name");
@@ -2195,7 +2486,7 @@ ${proposedFiles.length} file(s) proposed for deletion:
             { name: "+ Create a new project", value: "__new__" },
             ...(folders ?? []).map((f) => ({ name: f.name, value: f.id }))
           ];
-          const chosen = await select3({
+          const chosen = await select4({
             message: "Link to which project?",
             choices
           });
@@ -2203,15 +2494,15 @@ ${proposedFiles.length} file(s) proposed for deletion:
           if (chosen === "__new__") {
             const projectName = await input5({
               message: "Project name:",
-              default: basename(projectRoot)
+              default: basename2(projectRoot)
             });
             const { data: newFolder, error: createErr } = await sb.from("claude_folders").insert({ user_id: userId, name: projectName }).select("id").single();
             if (createErr || !newFolder) {
-              console.error(chalk11.red(`Failed to create project: ${createErr?.message}`));
+              console.error(chalk12.red(`Failed to create project: ${createErr?.message}`));
               return;
             }
             folderId = newFolder.id;
-            console.log(chalk11.green(`Created project "${projectName}".`));
+            console.log(chalk12.green(`Created project "${projectName}".`));
           } else {
             folderId = chosen;
           }
@@ -2237,6 +2528,7 @@ ${proposedFiles.length} file(s) proposed for deletion:
             skills_table_json: result.skills,
             stale_files_json: result.staleFiles,
             env_manifest_json: result.envManifest,
+            doppler_json: result.doppler,
             marketplace_plugins_json: result.marketplacePlugins,
             last_scanned: result.scannedAt,
             data_hash: result.dataHash
@@ -2261,14 +2553,14 @@ ${proposedFiles.length} file(s) proposed for deletion:
             lastDeviceName: deviceName,
             lastSyncAt: (/* @__PURE__ */ new Date()).toISOString()
           });
-          console.log(chalk11.green("\nLinked and synced."));
-          console.log(chalk11.cyan(`
+          console.log(chalk12.green("\nLinked and synced."));
+          console.log(chalk12.cyan(`
   https://www.md4ai.com/project/${folderId}
 `));
         }
       }
     } catch {
-      console.log(chalk11.yellow("Not logged in \u2014 local preview only."));
+      console.log(chalk12.yellow("Not logged in \u2014 local preview only."));
     }
   }
 }
@@ -2292,29 +2584,29 @@ __export(sync_exports, {
   syncCommand: () => syncCommand
 });
 import { resolve as resolve5 } from "node:path";
-import { existsSync as existsSync10 } from "node:fs";
-import chalk14 from "chalk";
+import { existsSync as existsSync11 } from "node:fs";
+import chalk15 from "chalk";
 function isValidProjectPath(p) {
   const resolved = resolve5(p);
-  return resolved.startsWith("/") && !resolved.includes("..") && existsSync10(resolved);
+  return resolved.startsWith("/") && !resolved.includes("..") && existsSync11(resolved);
 }
 async function syncCommand(options) {
   const { supabase } = await getAuthenticatedClient();
   if (options.all) {
     const { data: devices, error } = await supabase.from("device_paths").select("folder_id, device_name, path");
     if (error || !devices?.length) {
-      console.error(chalk14.red("No devices found."));
+      console.error(chalk15.red("No devices found."));
       process.exit(1);
     }
     for (const device of devices) {
       if (!isValidProjectPath(device.path)) {
-        console.error(chalk14.red(`  Skipping invalid path: ${device.path}`));
+        console.error(chalk15.red(`  Skipping invalid path: ${device.path}`));
         continue;
       }
-      console.log(chalk14.blue(`Syncing: ${device.path}`));
+      console.log(chalk15.blue(`Syncing: ${device.path}`));
       const { data: proposedAll } = await supabase.from("folder_files").select("file_path").eq("folder_id", device.folder_id).eq("proposed_for_deletion", true);
       if (proposedAll?.length) {
-        console.log(chalk14.yellow(`  ${proposedAll.length} file(s) proposed for deletion \u2014 run \`md4ai scan\` to review.`));
+        console.log(chalk15.yellow(`  ${proposedAll.length} file(s) proposed for deletion \u2014 run \`md4ai scan\` to review.`));
       }
       try {
         const result = await scanProject(device.path);
@@ -2330,32 +2622,32 @@ async function syncCommand(options) {
         }).eq("id", device.folder_id);
         await pushToolings(supabase, device.folder_id, result.toolings);
         await supabase.from("device_paths").update({ last_synced: (/* @__PURE__ */ new Date()).toISOString() }).eq("folder_id", device.folder_id).eq("device_name", device.device_name);
-        console.log(chalk14.green(`  Done: ${device.device_name}`));
+        console.log(chalk15.green(`  Done: ${device.device_name}`));
       } catch (err) {
-        console.error(chalk14.red(`  Failed: ${device.path}: ${err}`));
+        console.error(chalk15.red(`  Failed: ${device.path}: ${err}`));
       }
     }
     await saveState({ lastSyncAt: (/* @__PURE__ */ new Date()).toISOString() });
-    console.log(chalk14.green("\nAll devices synced."));
+    console.log(chalk15.green("\nAll devices synced."));
   } else {
     const state = await loadState();
     if (!state.lastFolderId) {
-      console.error(chalk14.yellow("No recent sync. Use: md4ai sync --all, or md4ai scan <path> first."));
+      console.error(chalk15.yellow("No recent sync. Use: md4ai sync --all, or md4ai scan <path> first."));
       process.exit(1);
     }
     const { data: device } = await supabase.from("device_paths").select("folder_id, device_name, path").eq("folder_id", state.lastFolderId).eq("device_name", state.lastDeviceName).single();
     if (!device) {
-      console.error(chalk14.red("Could not find last synced device/folder."));
+      console.error(chalk15.red("Could not find last synced device/folder."));
       process.exit(1);
     }
     if (!isValidProjectPath(device.path)) {
-      console.error(chalk14.red(`Invalid project path: ${device.path}`));
+      console.error(chalk15.red(`Invalid project path: ${device.path}`));
       process.exit(1);
     }
-    console.log(chalk14.blue(`Syncing: ${device.path}`));
+    console.log(chalk15.blue(`Syncing: ${device.path}`));
     const { data: proposedSingle } = await supabase.from("folder_files").select("file_path").eq("folder_id", device.folder_id).eq("proposed_for_deletion", true);
     if (proposedSingle?.length) {
-      console.log(chalk14.yellow(`  ${proposedSingle.length} file(s) proposed for deletion \u2014 run \`md4ai scan\` to review.`));
+      console.log(chalk15.yellow(`  ${proposedSingle.length} file(s) proposed for deletion \u2014 run \`md4ai scan\` to review.`));
     }
     const result = await scanProject(device.path);
     await supabase.from("claude_folders").update({
@@ -2370,7 +2662,7 @@ async function syncCommand(options) {
     await pushToolings(supabase, device.folder_id, result.toolings);
     await supabase.from("device_paths").update({ last_synced: (/* @__PURE__ */ new Date()).toISOString() }).eq("folder_id", device.folder_id).eq("device_name", device.device_name);
     await saveState({ lastSyncAt: (/* @__PURE__ */ new Date()).toISOString() });
-    console.log(chalk14.green("Synced."));
+    console.log(chalk15.green("Synced."));
   }
 }
 var init_sync = __esm({
@@ -2384,16 +2676,16 @@ var init_sync = __esm({
 });
 
 // dist/mcp/read-configs.js
-import { readFile as readFile11 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { readFile as readFile12 } from "node:fs/promises";
+import { join as join15 } from "node:path";
 import { homedir as homedir9 } from "node:os";
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 import { readdir as readdir4 } from "node:fs/promises";
 async function readJsonSafe(path) {
   try {
-    if (!existsSync12(path))
+    if (!existsSync13(path))
       return null;
-    const raw = await readFile11(path, "utf-8");
+    const raw = await readFile12(path, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -2455,50 +2747,50 @@ function parseFlatConfig(data, source) {
 async function readAllMcpConfigs() {
   const home = homedir9();
   const entries = [];
-  const userConfig = await readJsonSafe(join14(home, ".claude.json"));
+  const userConfig = await readJsonSafe(join15(home, ".claude.json"));
   entries.push(...parseServers(userConfig, "global"));
-  const globalMcp = await readJsonSafe(join14(home, ".claude", "mcp.json"));
+  const globalMcp = await readJsonSafe(join15(home, ".claude", "mcp.json"));
   entries.push(...parseServers(globalMcp, "global"));
-  const cwdMcp = await readJsonSafe(join14(process.cwd(), ".mcp.json"));
+  const cwdMcp = await readJsonSafe(join15(process.cwd(), ".mcp.json"));
   entries.push(...parseServers(cwdMcp, "project"));
-  const pluginsBase = join14(home, ".claude", "plugins", "marketplaces");
-  if (existsSync12(pluginsBase)) {
+  const pluginsBase = join15(home, ".claude", "plugins", "marketplaces");
+  if (existsSync13(pluginsBase)) {
     try {
       const marketplaces = await readdir4(pluginsBase, { withFileTypes: true });
       for (const mp of marketplaces) {
         if (!mp.isDirectory())
           continue;
-        const extDir = join14(pluginsBase, mp.name, "external_plugins");
-        if (!existsSync12(extDir))
+        const extDir = join15(pluginsBase, mp.name, "external_plugins");
+        if (!existsSync13(extDir))
           continue;
         const plugins = await readdir4(extDir, { withFileTypes: true });
         for (const plugin of plugins) {
           if (!plugin.isDirectory())
             continue;
-          const pluginMcp = await readJsonSafe(join14(extDir, plugin.name, ".mcp.json"));
+          const pluginMcp = await readJsonSafe(join15(extDir, plugin.name, ".mcp.json"));
           entries.push(...parseServers(pluginMcp, "plugin"));
         }
       }
     } catch {
     }
   }
-  const cacheBase = join14(home, ".claude", "plugins", "cache");
-  if (existsSync12(cacheBase)) {
+  const cacheBase = join15(home, ".claude", "plugins", "cache");
+  if (existsSync13(cacheBase)) {
     try {
       const registries = await readdir4(cacheBase, { withFileTypes: true });
       for (const reg of registries) {
         if (!reg.isDirectory())
           continue;
-        const regDir = join14(cacheBase, reg.name);
+        const regDir = join15(cacheBase, reg.name);
         const plugins = await readdir4(regDir, { withFileTypes: true });
         for (const plugin of plugins) {
           if (!plugin.isDirectory())
             continue;
-          const versionDirs = await readdir4(join14(regDir, plugin.name), { withFileTypes: true });
+          const versionDirs = await readdir4(join15(regDir, plugin.name), { withFileTypes: true });
           for (const ver of versionDirs) {
             if (!ver.isDirectory())
               continue;
-            const mcpPath = join14(regDir, plugin.name, ver.name, ".mcp.json");
+            const mcpPath = join15(regDir, plugin.name, ver.name, ".mcp.json");
             const flatData = await readJsonSafe(mcpPath);
             if (flatData) {
               entries.push(...parseFlatConfig(flatData, "plugin"));
@@ -2648,7 +2940,7 @@ var mcp_watch_exports = {};
 __export(mcp_watch_exports, {
   mcpWatchCommand: () => mcpWatchCommand
 });
-import chalk20 from "chalk";
+import chalk21 from "chalk";
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 function detectTty() {
@@ -2802,20 +3094,20 @@ function buildRows(configs, httpResults, cdpStatus) {
 }
 function printTable(rows, deviceName, watcherPid, cdpResult) {
   process.stdout.write("\x1B[3J\x1B[2J\x1B[H");
-  console.log(chalk20.bold.cyan(`
-  MCP Monitor v${CURRENT_VERSION} \u2014 ${deviceName}`) + chalk20.dim(`  (PID ${watcherPid})`));
-  console.log(chalk20.dim(`  ${(/* @__PURE__ */ new Date()).toLocaleTimeString()} \xB7 refreshes every 30s \xB7 Ctrl+C to stop
+  console.log(chalk21.bold.cyan(`
+  MCP Monitor v${CURRENT_VERSION} \u2014 ${deviceName}`) + chalk21.dim(`  (PID ${watcherPid})`));
+  console.log(chalk21.dim(`  ${(/* @__PURE__ */ new Date()).toLocaleTimeString()} \xB7 refreshes every 30s \xB7 Ctrl+C to stop
 `));
   if (cdpResult) {
     if (cdpResult.status === "reachable") {
       const browserInfo = cdpResult.browser ? ` (${cdpResult.browser})` : "";
-      console.log(chalk20.green("  \u2714 Chrome browser connected") + chalk20.dim(browserInfo));
-      console.log(chalk20.dim("    Claude Code can control Chrome via DevTools Protocol on localhost:9222"));
+      console.log(chalk21.green("  \u2714 Chrome browser connected") + chalk21.dim(browserInfo));
+      console.log(chalk21.dim("    Claude Code can control Chrome via DevTools Protocol on localhost:9222"));
     } else {
-      console.log(chalk20.red("  \u2717 Chrome browser not connected"));
-      console.log(chalk20.dim("    Claude Code cannot reach Chrome. To fix:"));
-      console.log(chalk20.dim("    1. Open Chrome with: google-chrome --remote-debugging-port=9222"));
-      console.log(chalk20.dim("    2. Or add --remote-debugging-port=9222 to your Chrome shortcut"));
+      console.log(chalk21.red("  \u2717 Chrome browser not connected"));
+      console.log(chalk21.dim("    Claude Code cannot reach Chrome. To fix:"));
+      console.log(chalk21.dim("    1. Open Chrome with: google-chrome --remote-debugging-port=9222"));
+      console.log(chalk21.dim("    2. Or add --remote-debugging-port=9222 to your Chrome shortcut"));
     }
     console.log("");
   }
@@ -2836,41 +3128,41 @@ function printTable(rows, deviceName, watcherPid, cdpResult) {
       sessionNum++;
       const totalMem = servers.reduce((sum, s) => sum + (s.memory_mb ?? 0), 0);
       const label = byTty.size === 1 ? "Claude Code session" : `Claude Code session ${sessionNum}`;
-      console.log(chalk20.green(`  ${label}`) + chalk20.dim(` \u2014 ${servers.length} server${servers.length !== 1 ? "s" : ""} \xB7 ${totalMem} MB \xB7 terminal ${tty}`));
+      console.log(chalk21.green(`  ${label}`) + chalk21.dim(` \u2014 ${servers.length} server${servers.length !== 1 ? "s" : ""} \xB7 ${totalMem} MB \xB7 terminal ${tty}`));
       for (const s of servers) {
         const uptime = formatUptime(s.uptime_seconds ?? 0);
-        const source = chalk20.dim(`[${s.config_source}]`);
-        console.log(`    ${chalk20.green("\u25CF")} ${s.server_name.padEnd(20)} ${source} ${chalk20.dim((s.package_name ?? "").padEnd(25))} ${String(s.memory_mb ?? 0).padStart(4)} MB  ${uptime}`);
+        const source = chalk21.dim(`[${s.config_source}]`);
+        console.log(`    ${chalk21.green("\u25CF")} ${s.server_name.padEnd(20)} ${source} ${chalk21.dim((s.package_name ?? "").padEnd(25))} ${String(s.memory_mb ?? 0).padStart(4)} MB  ${uptime}`);
       }
       console.log("");
     }
     if (byTty.size > 1) {
-      console.log(chalk20.dim("  Each open Claude Code window runs its own set of MCP servers.\n"));
+      console.log(chalk21.dim("  Each open Claude Code window runs its own set of MCP servers.\n"));
     }
   }
   if (runningHttp.length > 0) {
-    console.log(chalk20.blue(`  Remote Services (${runningHttp.length})`) + chalk20.dim(" \u2014 HTTP endpoints reachable"));
+    console.log(chalk21.blue(`  Remote Services (${runningHttp.length})`) + chalk21.dim(" \u2014 HTTP endpoints reachable"));
     for (const s of runningHttp) {
-      console.log(`    ${chalk20.blue("\u25CF")} ${s.server_name.padEnd(20)} ${chalk20.dim((s.http_url ?? "").padEnd(30))}`);
+      console.log(`    ${chalk21.blue("\u25CF")} ${s.server_name.padEnd(20)} ${chalk21.dim((s.http_url ?? "").padEnd(30))}`);
     }
     console.log("");
   }
   if (stopped.length > 0 || errored.length > 0) {
     const notRunning = [...stopped, ...errored];
-    console.log(chalk20.yellow(`  Not Running (${notRunning.length})`) + chalk20.dim(" \u2014 configured but no process detected"));
+    console.log(chalk21.yellow(`  Not Running (${notRunning.length})`) + chalk21.dim(" \u2014 configured but no process detected"));
     for (const s of notRunning) {
-      const icon = s.status === "error" ? chalk20.red("\u2717") : chalk20.yellow("\u25CB");
-      const source = chalk20.dim(`[${s.config_source}]`);
-      const detail = s.error_detail ? chalk20.dim(` \u2014 ${s.error_detail}`) : "";
+      const icon = s.status === "error" ? chalk21.red("\u2717") : chalk21.yellow("\u25CB");
+      const source = chalk21.dim(`[${s.config_source}]`);
+      const detail = s.error_detail ? chalk21.dim(` \u2014 ${s.error_detail}`) : "";
       console.log(`    ${icon} ${s.server_name.padEnd(20)} ${source}${detail}`);
     }
     console.log("");
   }
   if (rows.length === 0) {
-    console.log(chalk20.yellow("  No MCP servers configured."));
-    console.log(chalk20.dim("  Configure servers in ~/.claude/mcp.json or .mcp.json\n"));
+    console.log(chalk21.yellow("  No MCP servers configured."));
+    console.log(chalk21.dim("  Configure servers in ~/.claude/mcp.json or .mcp.json\n"));
   }
-  console.log(chalk20.bgYellow.black.bold("  \u26A0  DO NOT CLOSE THIS WINDOW \u2014 it feeds live data to the dashboard  \u26A0  "));
+  console.log(chalk21.bgYellow.black.bold("  \u26A0  DO NOT CLOSE THIS WINDOW \u2014 it feeds live data to the dashboard  \u26A0  "));
   console.log("");
 }
 function formatUptime(seconds) {
@@ -2899,7 +3191,7 @@ async function mcpWatchCommand() {
   const { data: existingWatchers } = await supabase.from("mcp_watchers").select("pid, tty, cli_version, started_at").eq("device_id", deviceId);
   if (existingWatchers && existingWatchers.length > 0) {
     console.log("");
-    console.log(chalk20.yellow(`  Replacing ${existingWatchers.length} existing watcher${existingWatchers.length !== 1 ? "s" : ""} on this device...`));
+    console.log(chalk21.yellow(`  Replacing ${existingWatchers.length} existing watcher${existingWatchers.length !== 1 ? "s" : ""} on this device...`));
     for (const w of existingWatchers) {
       try {
         if (typeof w.pid === "number" && w.pid > 1 && w.pid !== process.pid) {
@@ -2910,15 +3202,15 @@ async function mcpWatchCommand() {
     }
     await supabase.from("mcp_watchers").delete().eq("device_id", deviceId);
     await new Promise((r) => setTimeout(r, 1e3));
-    console.log(chalk20.dim("  Previous watcher stopped.\n"));
+    console.log(chalk21.dim("  Previous watcher stopped.\n"));
   }
   process.stdout.write(`\x1B]0;MCP mon\x07`);
-  console.log(chalk20.blue(`Starting MCP monitor for ${deviceName}...`));
+  console.log(chalk21.blue(`Starting MCP monitor for ${deviceName}...`));
   console.log("");
-  console.log(chalk20.dim("  View this in the online dashboard at:"));
-  console.log(chalk20.cyan(`  https://www.md4ai.com/device/${deviceId}`));
+  console.log(chalk21.dim("  View this in the online dashboard at:"));
+  console.log(chalk21.cyan(`  https://www.md4ai.com/device/${deviceId}`));
   console.log("");
-  console.log(chalk20.yellow("  Please note, closing this window will stop ALL watch reports."));
+  console.log(chalk21.yellow("  Please note, closing this window will stop ALL watch reports."));
   console.log("");
   await supabase.from("mcp_watchers").upsert({
     device_id: deviceId,
@@ -2948,7 +3240,7 @@ async function mcpWatchCommand() {
       return;
     }
     if (deleteError) {
-      console.error(chalk20.red(`  [debug] Failed to delete old status: ${deleteError.message}`));
+      console.error(chalk21.red(`  [debug] Failed to delete old status: ${deleteError.message}`));
     }
     if (rows.length > 0) {
       const { error: insertError } = await supabase.from("mcp_server_status").insert(rows.map((row) => ({
@@ -2961,7 +3253,7 @@ async function mcpWatchCommand() {
         return;
       }
       if (insertError) {
-        console.error(chalk20.red(`  [debug] Failed to write MCP status: ${insertError.message}`));
+        console.error(chalk21.red(`  [debug] Failed to write MCP status: ${insertError.message}`));
       }
     }
     const { error: heartbeatError } = await supabase.from("mcp_watchers").update({ last_heartbeat: now }).eq("device_id", deviceId).eq("pid", myPid);
@@ -2979,11 +3271,11 @@ async function mcpWatchCommand() {
       return;
     }
     jwtRefreshAttempted = true;
-    console.log(chalk20.yellow("\n  Session token expired \u2014 attempting to refresh..."));
+    console.log(chalk21.yellow("\n  Session token expired \u2014 attempting to refresh..."));
     const refreshed = await refreshSession();
     if (refreshed) {
       supabase = refreshed.supabase;
-      console.log(chalk20.green("  Session refreshed successfully. Resuming monitoring.\n"));
+      console.log(chalk21.green("  Session refreshed successfully. Resuming monitoring.\n"));
       jwtRefreshAttempted = false;
       await supabase.from("mcp_watchers").upsert({
         device_id: deviceId,
@@ -3001,14 +3293,14 @@ async function mcpWatchCommand() {
   function printSessionExpired() {
     process.stdout.write("\x1B[3J\x1B[2J\x1B[H");
     console.log("");
-    console.log(chalk20.bgRed.white.bold("  \u2717  SESSION EXPIRED \u2014 this watcher is no longer sending data to the dashboard  \u2717  "));
+    console.log(chalk21.bgRed.white.bold("  \u2717  SESSION EXPIRED \u2014 this watcher is no longer sending data to the dashboard  \u2717  "));
     console.log("");
-    console.log(chalk20.yellow("  Your authentication token has expired and could not be refreshed."));
-    console.log(chalk20.yellow('  The dashboard will show "No watchers" because this process can no longer update it.'));
+    console.log(chalk21.yellow("  Your authentication token has expired and could not be refreshed."));
+    console.log(chalk21.yellow('  The dashboard will show "No watchers" because this process can no longer update it.'));
     console.log("");
-    console.log(chalk20.white("  To fix this:"));
-    console.log(chalk20.cyan("    1. Run: md4ai login"));
-    console.log(chalk20.cyan("    2. Then restart the watcher: md4ai mcp-watch"));
+    console.log(chalk21.white("  To fix this:"));
+    console.log(chalk21.cyan("    1. Run: md4ai login"));
+    console.log(chalk21.cyan("    2. Then restart the watcher: md4ai mcp-watch"));
     console.log("");
   }
   let interval;
@@ -3051,7 +3343,7 @@ async function mcpWatchCommand() {
     clearInterval(interval);
     clearInterval(envInterval);
     await supabase.from("mcp_watchers").delete().eq("device_id", deviceId).eq("pid", myPid);
-    console.log(chalk20.dim("\nMCP monitor stopped."));
+    console.log(chalk21.dim("\nMCP monitor stopped."));
     process.exit(0);
   };
   process.on("SIGINT", () => {
@@ -3359,71 +3651,71 @@ init_map();
 
 // dist/commands/simulate.js
 init_dist();
-import { join as join12 } from "node:path";
-import { existsSync as existsSync8 } from "node:fs";
+import { join as join13 } from "node:path";
+import { existsSync as existsSync9 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import chalk12 from "chalk";
+import chalk13 from "chalk";
 async function simulateCommand(prompt) {
   const projectRoot = process.cwd();
-  console.log(chalk12.blue(`Simulating prompt: "${prompt}"
+  console.log(chalk13.blue(`Simulating prompt: "${prompt}"
 `));
-  console.log(chalk12.dim("Files Claude would load:\n"));
-  const globalClaude = join12(homedir8(), ".claude", "CLAUDE.md");
-  if (existsSync8(globalClaude)) {
-    console.log(chalk12.green("  \u2713 ~/.claude/CLAUDE.md (global)"));
+  console.log(chalk13.dim("Files Claude would load:\n"));
+  const globalClaude = join13(homedir8(), ".claude", "CLAUDE.md");
+  if (existsSync9(globalClaude)) {
+    console.log(chalk13.green("  \u2713 ~/.claude/CLAUDE.md (global)"));
   }
   for (const rootFile of ROOT_FILES) {
-    const fullPath = join12(projectRoot, rootFile);
-    if (existsSync8(fullPath)) {
-      console.log(chalk12.green(`  \u2713 ${rootFile} (project root)`));
+    const fullPath = join13(projectRoot, rootFile);
+    if (existsSync9(fullPath)) {
+      console.log(chalk13.green(`  \u2713 ${rootFile} (project root)`));
     }
   }
   const settingsFiles = [
-    join12(homedir8(), ".claude", "settings.json"),
-    join12(homedir8(), ".claude", "settings.local.json"),
-    join12(projectRoot, ".claude", "settings.json"),
-    join12(projectRoot, ".claude", "settings.local.json")
+    join13(homedir8(), ".claude", "settings.json"),
+    join13(homedir8(), ".claude", "settings.local.json"),
+    join13(projectRoot, ".claude", "settings.json"),
+    join13(projectRoot, ".claude", "settings.local.json")
   ];
   for (const sf of settingsFiles) {
-    if (existsSync8(sf)) {
+    if (existsSync9(sf)) {
       const display = sf.startsWith(homedir8()) ? sf.replace(homedir8(), "~") : sf.replace(projectRoot + "/", "");
-      console.log(chalk12.green(`  \u2713 ${display} (settings)`));
+      console.log(chalk13.green(`  \u2713 ${display} (settings)`));
     }
   }
   const words = prompt.split(/\s+/);
   for (const word of words) {
     const cleaned = word.replace(/['"]/g, "");
-    const candidatePath = join12(projectRoot, cleaned);
-    if (existsSync8(candidatePath) && cleaned.includes("/")) {
-      console.log(chalk12.cyan(`  \u2192 ${cleaned} (referenced in prompt)`));
+    const candidatePath = join13(projectRoot, cleaned);
+    if (existsSync9(candidatePath) && cleaned.includes("/")) {
+      console.log(chalk13.cyan(`  \u2192 ${cleaned} (referenced in prompt)`));
     }
   }
-  console.log(chalk12.dim("\nNote: This is an approximation. Actual file loading depends on Claude Code internals."));
+  console.log(chalk13.dim("\nNote: This is an approximation. Actual file loading depends on Claude Code internals."));
 }
 
 // dist/commands/print.js
-import { join as join13 } from "node:path";
-import { readFile as readFile9, writeFile as writeFile3 } from "node:fs/promises";
-import { existsSync as existsSync9 } from "node:fs";
-import chalk13 from "chalk";
+import { join as join14 } from "node:path";
+import { readFile as readFile10, writeFile as writeFile3 } from "node:fs/promises";
+import { existsSync as existsSync10 } from "node:fs";
+import chalk14 from "chalk";
 async function printCommand(title) {
   const projectRoot = process.cwd();
-  const scanDataPath = join13(projectRoot, "output", "index.html");
-  if (!existsSync9(scanDataPath)) {
-    console.error(chalk13.red("No scan data found. Run: md4ai scan"));
+  const scanDataPath = join14(projectRoot, "output", "index.html");
+  if (!existsSync10(scanDataPath)) {
+    console.error(chalk14.red("No scan data found. Run: md4ai scan"));
     process.exit(1);
   }
-  const html = await readFile9(scanDataPath, "utf-8");
+  const html = await readFile10(scanDataPath, "utf-8");
   const match = html.match(/<script type="application\/json" id="scan-data">([\s\S]*?)<\/script>/);
   if (!match) {
-    console.error(chalk13.red("Could not extract scan data from output/index.html"));
+    console.error(chalk14.red("Could not extract scan data from output/index.html"));
     process.exit(1);
   }
   const result = JSON.parse(match[1]);
   const printHtml = generatePrintHtml(result, title);
-  const outputPath = join13(projectRoot, "output", `print-${Date.now()}.html`);
+  const outputPath = join14(projectRoot, "output", `print-${Date.now()}.html`);
   await writeFile3(outputPath, printHtml, "utf-8");
-  console.log(chalk13.green(`Print-ready wall sheet: ${outputPath}`));
+  console.log(chalk14.green(`Print-ready wall sheet: ${outputPath}`));
 }
 function escapeHtml2(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
@@ -3489,7 +3781,7 @@ init_scanner();
 init_push_toolings();
 init_device_utils();
 import { resolve as resolve6 } from "node:path";
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 async function linkCommand(projectId) {
   const { supabase, userId } = await getAuthenticatedClient();
   const cwd = resolve6(process.cwd());
@@ -3497,11 +3789,11 @@ async function linkCommand(projectId) {
   const osType = detectOs2();
   const { data: folder, error: folderErr } = await supabase.from("claude_folders").select("id, name").eq("id", projectId).single();
   if (folderErr || !folder) {
-    console.error(chalk15.red("Project not found, or you do not have access."));
-    console.error(chalk15.yellow("Check the project ID in the MD4AI web dashboard."));
+    console.error(chalk16.red("Project not found, or you do not have access."));
+    console.error(chalk16.yellow("Check the project ID in the MD4AI web dashboard."));
     process.exit(1);
   }
-  console.log(chalk15.blue(`
+  console.log(chalk16.blue(`
 Linking "${folder.name}" to this device...
 `));
   console.log(`  Project:  ${folder.name}`);
@@ -3525,19 +3817,20 @@ Linking "${folder.name}" to this device...
       path: cwd
     });
     if (pathErr) {
-      console.error(chalk15.red(`Failed to link: ${pathErr.message}`));
+      console.error(chalk16.red(`Failed to link: ${pathErr.message}`));
       process.exit(1);
     }
   }
-  console.log(chalk15.green("\nLinked successfully."));
-  console.log(chalk15.blue("\nRunning initial scan...\n"));
-  const result = await scanProject(cwd);
+  console.log(chalk16.green("\nLinked successfully."));
+  console.log(chalk16.blue("\nRunning initial scan...\n"));
+  const result = await scanProject(cwd, folder.id);
   console.log(`  Files:     ${result.graph.nodes.length}`);
   console.log(`  References:${result.graph.edges.length}`);
   console.log(`  Orphans:   ${result.orphans.length}`);
   console.log(`  Skills:    ${result.skills.length}`);
   console.log(`  Toolings:  ${result.toolings.length}`);
   console.log(`  Env Vars:  ${result.envManifest?.variables.length ?? 0} (${result.envManifest ? "manifest found" : "no manifest"})`);
+  console.log(`  Doppler:  ${result.doppler ? `${result.doppler.configs.length} config(s) \u2014 ${result.doppler.project}` : "see above"}`);
   console.log(`  Plugins:   ${result.marketplacePlugins.length} (${result.marketplacePlugins.reduce((n, p) => n + p.skills.length, 0)} skills)`);
   const { error: scanErr } = await supabase.from("claude_folders").update({
     graph_json: result.graph,
@@ -3546,12 +3839,13 @@ Linking "${folder.name}" to this device...
     skills_table_json: result.skills,
     stale_files_json: result.staleFiles,
     env_manifest_json: result.envManifest,
+    doppler_json: result.doppler,
     marketplace_plugins_json: result.marketplacePlugins,
     last_scanned: result.scannedAt,
     data_hash: result.dataHash
   }).eq("id", folder.id);
   if (scanErr) {
-    console.error(chalk15.yellow(`Scan upload warning: ${scanErr.message}`));
+    console.error(chalk16.yellow(`Scan upload warning: ${scanErr.message}`));
   }
   await pushToolings(supabase, folder.id, result.toolings);
   const graphPaths = result.graph.nodes.map((n) => n.filePath);
@@ -3566,7 +3860,7 @@ Linking "${folder.name}" to this device...
         last_modified: file.lastModified
       }, { onConflict: "folder_id,file_path" });
     }
-    console.log(chalk15.green(`  Uploaded ${configFiles.length} config file(s).`));
+    console.log(chalk16.green(`  Uploaded ${configFiles.length} config file(s).`));
   }
   await supabase.from("device_paths").update({ last_synced: (/* @__PURE__ */ new Date()).toISOString() }).eq("folder_id", folder.id).eq("device_name", deviceName);
   await saveState({
@@ -3575,40 +3869,40 @@ Linking "${folder.name}" to this device...
     lastSyncAt: (/* @__PURE__ */ new Date()).toISOString()
   });
   const projectUrl = `https://www.md4ai.com/project/${folder.id}`;
-  console.log(chalk15.green("\nDone! Project linked and scanned."));
-  console.log(chalk15.cyan(`
+  console.log(chalk16.green("\nDone! Project linked and scanned."));
+  console.log(chalk16.cyan(`
   ${projectUrl}
 `));
-  console.log(chalk15.grey('Run "md4ai scan" to rescan at any time.'));
+  console.log(chalk16.grey('Run "md4ai scan" to rescan at any time.'));
 }
 
 // dist/commands/import-bundle.js
-import { readFile as readFile10, writeFile as writeFile4, mkdir as mkdir3, stat as fsStat } from "node:fs/promises";
+import { readFile as readFile11, writeFile as writeFile4, mkdir as mkdir3, stat as fsStat } from "node:fs/promises";
 import { dirname as dirname3, resolve as resolve7 } from "node:path";
-import { existsSync as existsSync11 } from "node:fs";
-import chalk16 from "chalk";
+import { existsSync as existsSync12 } from "node:fs";
+import chalk17 from "chalk";
 import { confirm as confirm3, input as input6 } from "@inquirer/prompts";
 var MAX_BUNDLE_SIZE_BYTES = 50 * 1024 * 1024;
 async function importBundleCommand(zipPath) {
-  if (!existsSync11(zipPath)) {
-    console.error(chalk16.red(`File not found: ${zipPath}`));
+  if (!existsSync12(zipPath)) {
+    console.error(chalk17.red(`File not found: ${zipPath}`));
     process.exit(1);
   }
   const fileStat = await fsStat(zipPath);
   if (fileStat.size > MAX_BUNDLE_SIZE_BYTES) {
-    console.error(chalk16.red(`Bundle too large (${Math.round(fileStat.size / 1024 / 1024)} MB). Maximum is 50 MB.`));
+    console.error(chalk17.red(`Bundle too large (${Math.round(fileStat.size / 1024 / 1024)} MB). Maximum is 50 MB.`));
     process.exit(1);
   }
   const JSZip = (await import("jszip")).default;
-  const zipData = await readFile10(zipPath);
+  const zipData = await readFile11(zipPath);
   const zip = await JSZip.loadAsync(zipData);
   const manifestFile = zip.file("manifest.json");
   if (!manifestFile) {
-    console.error(chalk16.red("Invalid bundle: missing manifest.json"));
+    console.error(chalk17.red("Invalid bundle: missing manifest.json"));
     process.exit(1);
   }
   const manifest = JSON.parse(await manifestFile.async("string"));
-  console.log(chalk16.blue(`
+  console.log(chalk17.blue(`
 Bundle: ${manifest.folderName}`));
   console.log(`  Exported by: ${manifest.ownerEmail}`);
   console.log(`  Exported at: ${manifest.exportedAt}`);
@@ -3622,10 +3916,10 @@ Bundle: ${manifest.folderName}`));
     }
   }
   if (files.length === 0) {
-    console.log(chalk16.yellow("No Claude config files found in bundle."));
+    console.log(chalk17.yellow("No Claude config files found in bundle."));
     return;
   }
-  console.log(chalk16.blue(`
+  console.log(chalk17.blue(`
 Files to extract:`));
   for (const f of files) {
     console.log(`  ${f.filePath}`);
@@ -3638,39 +3932,39 @@ Files to extract:`));
     message: `Extract ${files.length} file(s) to ${targetDir}?`
   });
   if (!proceed) {
-    console.log(chalk16.yellow("Cancelled."));
+    console.log(chalk17.yellow("Cancelled."));
     return;
   }
   const resolvedTarget = resolve7(targetDir);
   for (const file of files) {
     const fullPath = resolve7(targetDir, file.filePath);
     if (!fullPath.startsWith(resolvedTarget + "/") && fullPath !== resolvedTarget) {
-      console.error(chalk16.red(`  Blocked path traversal: ${file.filePath}`));
+      console.error(chalk17.red(`  Blocked path traversal: ${file.filePath}`));
       continue;
     }
     const dir = dirname3(fullPath);
-    if (!existsSync11(dir)) {
+    if (!existsSync12(dir)) {
       await mkdir3(dir, { recursive: true });
     }
     await writeFile4(fullPath, file.content, "utf-8");
-    console.log(chalk16.green(`  \u2713 ${file.filePath}`));
+    console.log(chalk17.green(`  \u2713 ${file.filePath}`));
   }
-  console.log(chalk16.green(`
+  console.log(chalk17.green(`
 Done! ${files.length} file(s) extracted to ${targetDir}`));
 }
 
 // dist/commands/admin-update-tool.js
 init_auth();
-import chalk17 from "chalk";
+import chalk18 from "chalk";
 var VALID_CATEGORIES = ["framework", "runtime", "cli", "mcp", "package", "database", "other"];
 async function adminUpdateToolCommand(options) {
   const { supabase } = await getAuthenticatedClient();
   if (!options.name) {
-    console.error(chalk17.red("--name is required."));
+    console.error(chalk18.red("--name is required."));
     process.exit(1);
   }
   if (options.category && !VALID_CATEGORIES.includes(options.category)) {
-    console.error(chalk17.red(`Invalid category. Must be one of: ${VALID_CATEGORIES.join(", ")}`));
+    console.error(chalk18.red(`Invalid category. Must be one of: ${VALID_CATEGORIES.join(", ")}`));
     process.exit(1);
   }
   const { data: existing } = await supabase.from("tools_registry").select("id, name, display_name, category").eq("name", options.name).maybeSingle();
@@ -3692,13 +3986,13 @@ async function adminUpdateToolCommand(options) {
       updates.notes = options.notes;
     const { error } = await supabase.from("tools_registry").update(updates).eq("id", existing.id);
     if (error) {
-      console.error(chalk17.red(`Failed to update: ${error.message}`));
+      console.error(chalk18.red(`Failed to update: ${error.message}`));
       process.exit(1);
     }
-    console.log(chalk17.green(`Updated "${existing.display_name}" in the registry.`));
+    console.log(chalk18.green(`Updated "${existing.display_name}" in the registry.`));
   } else {
     if (!options.display || !options.category) {
-      console.error(chalk17.red("New tools require --display and --category."));
+      console.error(chalk18.red("New tools require --display and --category."));
       process.exit(1);
     }
     const { error } = await supabase.from("tools_registry").insert({
@@ -3712,25 +4006,25 @@ async function adminUpdateToolCommand(options) {
       notes: options.notes ?? null
     });
     if (error) {
-      console.error(chalk17.red(`Failed to create: ${error.message}`));
+      console.error(chalk18.red(`Failed to create: ${error.message}`));
       process.exit(1);
     }
-    console.log(chalk17.green(`Added "${options.display}" to the registry.`));
+    console.log(chalk18.green(`Added "${options.display}" to the registry.`));
   }
 }
 
 // dist/commands/admin-list-tools.js
 init_auth();
-import chalk18 from "chalk";
+import chalk19 from "chalk";
 async function adminListToolsCommand() {
   const { supabase } = await getAuthenticatedClient();
   const { data: tools, error } = await supabase.from("tools_registry").select("*").order("category").order("display_name");
   if (error) {
-    console.error(chalk18.red(`Failed to fetch tools: ${error.message}`));
+    console.error(chalk19.red(`Failed to fetch tools: ${error.message}`));
     process.exit(1);
   }
   if (!tools?.length) {
-    console.log(chalk18.yellow("No tools in the registry."));
+    console.log(chalk19.yellow("No tools in the registry."));
     return;
   }
   const nameW = Math.max(16, ...tools.map((t) => t.display_name.length));
@@ -3744,7 +4038,7 @@ async function adminListToolsCommand() {
     "Beta".padEnd(betaW),
     "Last Checked"
   ].join("  ");
-  console.log(chalk18.bold(header));
+  console.log(chalk19.bold(header));
   console.log("\u2500".repeat(header.length));
   for (const tool of tools) {
     const lastChecked = tool.updated_at ? formatRelative(new Date(tool.updated_at)) : "\u2014";
@@ -3757,7 +4051,7 @@ async function adminListToolsCommand() {
     ].join("  ");
     console.log(row);
   }
-  console.log(chalk18.grey(`
+  console.log(chalk19.grey(`
 ${tools.length} tool(s) in registry.`));
 }
 function formatRelative(date) {
@@ -3775,7 +4069,7 @@ function formatRelative(date) {
 
 // dist/commands/admin-fetch-versions.js
 init_auth();
-import chalk19 from "chalk";
+import chalk20 from "chalk";
 
 // dist/commands/version-sources.js
 var VERSION_SOURCES = {
@@ -3804,11 +4098,11 @@ async function adminFetchVersionsCommand() {
   const { supabase } = await getAuthenticatedClient();
   const { data: tools, error } = await supabase.from("tools_registry").select("*").order("display_name");
   if (error) {
-    console.error(chalk19.red(`Failed to fetch tools: ${error.message}`));
+    console.error(chalk20.red(`Failed to fetch tools: ${error.message}`));
     process.exit(1);
   }
   if (!tools?.length) {
-    console.log(chalk19.yellow("No tools in the registry."));
+    console.log(chalk20.yellow("No tools in the registry."));
   }
   const { data: allProjectToolings } = await supabase.from("project_toolings").select("tool_name, detection_source").is("tool_id", null);
   const registeredNames = new Set((tools ?? []).map((t) => t.name));
@@ -3819,7 +4113,7 @@ async function adminFetchVersionsCommand() {
     }
   }
   if (unregisteredNames.size > 0) {
-    console.log(chalk19.blue(`Auto-registering ${unregisteredNames.size} unverified package(s)...
+    console.log(chalk20.blue(`Auto-registering ${unregisteredNames.size} unverified package(s)...
 `));
     for (const name of unregisteredNames) {
       const displayName = name;
@@ -3837,10 +4131,10 @@ async function adminFetchVersionsCommand() {
     }
   }
   if (!tools?.length) {
-    console.log(chalk19.yellow("No tools to fetch."));
+    console.log(chalk20.yellow("No tools to fetch."));
     return;
   }
-  console.log(chalk19.bold(`Fetching versions for ${tools.length} tool(s)...
+  console.log(chalk20.bold(`Fetching versions for ${tools.length} tool(s)...
 `));
   const results = await Promise.all(tools.map(async (tool) => {
     const source = VERSION_SOURCES[tool.name] ?? { type: "npm", package: tool.name };
@@ -3879,10 +4173,10 @@ async function adminFetchVersionsCommand() {
     "Beta".padEnd(betaW),
     "Status".padEnd(statusW)
   ].join("  ");
-  console.log(chalk19.bold(header));
+  console.log(chalk20.bold(header));
   console.log("\u2500".repeat(header.length));
   for (const result of results) {
-    const statusColour = result.status === "updated" ? chalk19.green : result.status === "unchanged" ? chalk19.grey : result.status === "failed" ? chalk19.red : chalk19.yellow;
+    const statusColour = result.status === "updated" ? chalk20.green : result.status === "unchanged" ? chalk20.grey : result.status === "failed" ? chalk20.red : chalk20.yellow;
     const row = [
       result.displayName.padEnd(nameW),
       (result.stable ?? "\u2014").padEnd(stableW),
@@ -3895,8 +4189,8 @@ async function adminFetchVersionsCommand() {
   const unchanged = results.filter((r) => r.status === "unchanged").length;
   const failed = results.filter((r) => r.status === "failed").length;
   const noSource = results.filter((r) => r.status === "no source").length;
-  console.log(chalk19.grey(`
-${results.length} tool(s): `) + chalk19.green(`${updated} updated`) + ", " + chalk19.grey(`${unchanged} unchanged`) + ", " + chalk19.red(`${failed} failed`) + ", " + chalk19.yellow(`${noSource} no source`));
+  console.log(chalk20.grey(`
+${results.length} tool(s): `) + chalk20.green(`${updated} updated`) + ", " + chalk20.grey(`${unchanged} unchanged`) + ", " + chalk20.red(`${failed} failed`) + ", " + chalk20.yellow(`${noSource} no source`));
 }
 async function fetchVersions(source) {
   const controller = new AbortController();
@@ -3954,10 +4248,10 @@ async function fetchGitHubVersions(repo, signal) {
 init_mcp_watch();
 
 // dist/commands/init-manifest.js
-import { resolve as resolve8, join as join15, relative as relative4, dirname as dirname4 } from "node:path";
-import { readFile as readFile12, writeFile as writeFile5, mkdir as mkdir4 } from "node:fs/promises";
-import { existsSync as existsSync13 } from "node:fs";
-import chalk21 from "chalk";
+import { resolve as resolve8, join as join16, relative as relative4, dirname as dirname4 } from "node:path";
+import { readFile as readFile13, writeFile as writeFile5, mkdir as mkdir4 } from "node:fs/promises";
+import { existsSync as existsSync14 } from "node:fs";
+import chalk22 from "chalk";
 var SECRET_PATTERNS = [
   /_KEY$/i,
   /_SECRET$/i,
@@ -3973,8 +4267,8 @@ function isLikelySecret(name) {
 async function discoverEnvFiles(projectRoot) {
   const apps = [];
   for (const envName of [".env", ".env.local", ".env.example"]) {
-    const envPath = join15(projectRoot, envName);
-    if (existsSync13(envPath)) {
+    const envPath = join16(projectRoot, envName);
+    if (existsSync14(envPath)) {
       const vars = await extractVarNames(envPath);
       if (vars.length > 0) {
         apps.push({ name: "root", envFilePath: envName, vars });
@@ -3984,12 +4278,12 @@ async function discoverEnvFiles(projectRoot) {
   }
   const subdirs = ["web", "cli", "api", "app", "server", "packages"];
   for (const sub of subdirs) {
-    const subDir = join15(projectRoot, sub);
-    if (!existsSync13(subDir))
+    const subDir = join16(projectRoot, sub);
+    if (!existsSync14(subDir))
       continue;
     for (const envName of [".env.local", ".env", ".env.example"]) {
-      const envPath = join15(subDir, envName);
-      if (existsSync13(envPath)) {
+      const envPath = join16(subDir, envName);
+      if (existsSync14(envPath)) {
         const vars = await extractVarNames(envPath);
         if (vars.length > 0) {
           apps.push({
@@ -4005,7 +4299,7 @@ async function discoverEnvFiles(projectRoot) {
   return apps;
 }
 async function extractVarNames(envPath) {
-  const content = await readFile12(envPath, "utf-8");
+  const content = await readFile13(envPath, "utf-8");
   const vars = [];
   for (const line of content.split("\n")) {
     const trimmed = line.trim();
@@ -4050,38 +4344,38 @@ function generateManifest(apps) {
 }
 async function initManifestCommand() {
   const projectRoot = resolve8(process.cwd());
-  const manifestPath = join15(projectRoot, "docs", "reference", "env-manifest.md");
-  if (existsSync13(manifestPath)) {
-    console.log(chalk21.yellow(`Manifest already exists: ${relative4(projectRoot, manifestPath)}`));
-    console.log(chalk21.dim("Edit it directly to make changes."));
+  const manifestPath = join16(projectRoot, "docs", "reference", "env-manifest.md");
+  if (existsSync14(manifestPath)) {
+    console.log(chalk22.yellow(`Manifest already exists: ${relative4(projectRoot, manifestPath)}`));
+    console.log(chalk22.dim("Edit it directly to make changes."));
     return;
   }
-  console.log(chalk21.blue("Scanning for .env files...\n"));
+  console.log(chalk22.blue("Scanning for .env files...\n"));
   const apps = await discoverEnvFiles(projectRoot);
   if (apps.length === 0) {
-    console.log(chalk21.yellow("No .env files found. Create a manifest manually at:"));
-    console.log(chalk21.cyan(`  docs/reference/env-manifest.md`));
+    console.log(chalk22.yellow("No .env files found. Create a manifest manually at:"));
+    console.log(chalk22.cyan(`  docs/reference/env-manifest.md`));
     return;
   }
   for (const app of apps) {
-    console.log(`  ${chalk21.green(app.name)}: ${app.envFilePath} (${app.vars.length} vars)`);
+    console.log(`  ${chalk22.green(app.name)}: ${app.envFilePath} (${app.vars.length} vars)`);
   }
   const content = generateManifest(apps);
   const dir = dirname4(manifestPath);
-  if (!existsSync13(dir)) {
+  if (!existsSync14(dir)) {
     await mkdir4(dir, { recursive: true });
   }
   await writeFile5(manifestPath, content, "utf-8");
-  console.log(chalk21.green(`
+  console.log(chalk22.green(`
 Manifest created: ${relative4(projectRoot, manifestPath)}`));
-  console.log(chalk21.dim("Review and edit the file \u2014 it is your source of truth."));
-  console.log(chalk21.dim("Then run `md4ai scan` to verify against your environments."));
+  console.log(chalk22.dim("Review and edit the file \u2014 it is your source of truth."));
+  console.log(chalk22.dim("Then run `md4ai scan` to verify against your environments."));
 }
 
 // dist/commands/update.js
 init_check_update();
 init_config();
-import chalk22 from "chalk";
+import chalk23 from "chalk";
 import { execFileSync as execFileSync6, spawn } from "node:child_process";
 async function fetchLatestVersion() {
   try {
@@ -4130,13 +4424,13 @@ function spawnPostUpdate() {
 }
 async function postUpdateFlow() {
   const { confirm: confirm4 } = await import("@inquirer/prompts");
-  console.log(chalk22.green(`
+  console.log(chalk23.green(`
   md4ai v${CURRENT_VERSION} \u2014 you're on the latest version.
 `));
   const creds = await loadCredentials();
   const isLoggedIn = !!creds?.accessToken && Date.now() < creds.expiresAt;
   if (!isLoggedIn) {
-    console.log(chalk22.yellow("  You are not logged in.\n"));
+    console.log(chalk23.yellow("  You are not logged in.\n"));
     const wantLogin = await confirm4({
       message: "Log in now?",
       default: true
@@ -4147,7 +4441,7 @@ async function postUpdateFlow() {
       await loginCommand2();
       console.log("");
     } else {
-      console.log(chalk22.dim("\nRun md4ai login when you're ready.\n"));
+      console.log(chalk23.dim("\nRun md4ai login when you're ready.\n"));
       return;
     }
   }
@@ -4181,7 +4475,7 @@ async function postUpdateFlow() {
     const { mcpWatchCommand: mcpWatchCommand2 } = await Promise.resolve().then(() => (init_mcp_watch(), mcp_watch_exports));
     await mcpWatchCommand2();
   } else {
-    console.log(chalk22.dim("\nYou can start monitoring later with: md4ai mcp-watch\n"));
+    console.log(chalk23.dim("\nYou can start monitoring later with: md4ai mcp-watch\n"));
   }
 }
 async function updateCommand(options) {
@@ -4189,19 +4483,19 @@ async function updateCommand(options) {
     await postUpdateFlow();
     return;
   }
-  console.log(chalk22.blue(`
+  console.log(chalk23.blue(`
   Current version: v${CURRENT_VERSION}`));
-  console.log(chalk22.dim("  Checking for updates...\n"));
+  console.log(chalk23.dim("  Checking for updates...\n"));
   const latest = await fetchLatestVersion();
   if (!latest) {
-    console.log(chalk22.yellow("  Could not reach the npm registry. Check your internet connection."));
+    console.log(chalk23.yellow("  Could not reach the npm registry. Check your internet connection."));
     process.exit(1);
   }
   if (!isNewer2(latest, CURRENT_VERSION)) {
     await postUpdateFlow();
     return;
   }
-  console.log(chalk22.white("  Update available: ") + chalk22.dim(`v${CURRENT_VERSION}`) + chalk22.white(" \u2192 ") + chalk22.green.bold(`v${latest}
+  console.log(chalk23.white("  Update available: ") + chalk23.dim(`v${CURRENT_VERSION}`) + chalk23.white(" \u2192 ") + chalk23.green.bold(`v${latest}
 `));
   const { confirm: confirm4 } = await import("@inquirer/prompts");
   const wantUpdate = await confirm4({
@@ -4209,17 +4503,17 @@ async function updateCommand(options) {
     default: true
   });
   if (!wantUpdate) {
-    console.log(chalk22.dim("\nUpdate skipped.\n"));
+    console.log(chalk23.dim("\nUpdate skipped.\n"));
     return;
   }
-  console.log(chalk22.blue("\n  Installing...\n"));
+  console.log(chalk23.blue("\n  Installing...\n"));
   const ok = runNpmInstall();
   if (!ok) {
-    console.log(chalk22.red("\n  npm install failed. Try running manually:"));
-    console.log(chalk22.cyan("    npm install -g md4ai\n"));
+    console.log(chalk23.red("\n  npm install failed. Try running manually:"));
+    console.log(chalk23.cyan("    npm install -g md4ai\n"));
     process.exit(1);
   }
-  console.log(chalk22.green("\n  Updated successfully.\n"));
+  console.log(chalk23.green("\n  Updated successfully.\n"));
   spawnPostUpdate();
 }
 
@@ -4227,7 +4521,7 @@ async function updateCommand(options) {
 init_check_update();
 init_map();
 init_mcp_watch();
-import chalk23 from "chalk";
+import chalk24 from "chalk";
 import { resolve as resolve9 } from "node:path";
 async function fetchLatestVersion2() {
   try {
@@ -4259,13 +4553,13 @@ function isNewer3(a, b) {
 async function startCommand() {
   const projectRoot = resolve9(process.cwd());
   console.log("");
-  console.log(chalk23.bold.cyan(`  MD4AI v${CURRENT_VERSION}`));
-  console.log(chalk23.dim(`  ${projectRoot}`));
+  console.log(chalk24.bold.cyan(`  MD4AI v${CURRENT_VERSION}`));
+  console.log(chalk24.dim(`  ${projectRoot}`));
   console.log("");
-  console.log(chalk23.blue("  \u2460 Checking for updates..."));
+  console.log(chalk24.blue("  \u2460 Checking for updates..."));
   const latest = await fetchLatestVersion2();
   if (latest && isNewer3(latest, CURRENT_VERSION)) {
-    console.log(chalk23.yellow(`     Update available: v${CURRENT_VERSION} \u2192 v${latest}`));
+    console.log(chalk24.yellow(`     Update available: v${CURRENT_VERSION} \u2192 v${latest}`));
     if (process.stdin.isTTY) {
       const { confirm: confirm4 } = await import("@inquirer/prompts");
       const wantUpdate = await confirm4({
@@ -4274,61 +4568,179 @@ async function startCommand() {
       });
       if (wantUpdate) {
         const { execFileSync: execFileSync7 } = await import("node:child_process");
-        console.log(chalk23.blue("\n  Installing...\n"));
+        console.log(chalk24.blue("\n  Installing...\n"));
         try {
           execFileSync7("npm", ["install", "-g", "md4ai"], {
             stdio: "inherit",
             timeout: 6e4
           });
-          console.log(chalk23.green("  Updated successfully."));
-          console.log(chalk23.dim("  Restarting with the new version...\n"));
+          console.log(chalk24.green("  Updated successfully."));
+          console.log(chalk24.dim("  Restarting with the new version...\n"));
           const { spawn: spawn2 } = await import("node:child_process");
           const child = spawn2("md4ai", ["start"], { stdio: "inherit", shell: false });
           child.on("exit", (code) => process.exit(code ?? 0));
           return;
         } catch {
-          console.log(chalk23.yellow("  Update failed \u2014 continuing with current version.\n"));
+          console.log(chalk24.yellow("  Update failed \u2014 continuing with current version.\n"));
         }
       } else {
         console.log("");
       }
     } else {
-      console.log(chalk23.dim("     Run md4ai update to install it.\n"));
+      console.log(chalk24.dim("     Run md4ai update to install it.\n"));
     }
   } else if (latest) {
-    console.log(chalk23.green("     You're on the latest version.\n"));
+    console.log(chalk24.green("     You're on the latest version.\n"));
   } else {
-    console.log(chalk23.dim("     Could not reach npm registry \u2014 skipping.\n"));
+    console.log(chalk24.dim("     Could not reach npm registry \u2014 skipping.\n"));
   }
-  console.log(chalk23.blue("  \u2461 Scanning project files..."));
+  console.log(chalk24.blue("  \u2461 Scanning project files..."));
   console.log("");
   await mapCommand(projectRoot, {});
   if (!process.stdin.isTTY) {
-    console.log(chalk23.dim("\n  Non-interactive mode \u2014 skipping MCP monitor."));
+    console.log(chalk24.dim("\n  Non-interactive mode \u2014 skipping MCP monitor."));
     return;
   }
   console.log("");
-  console.log(chalk23.blue("  \u2462 Starting MCP monitor..."));
+  console.log(chalk24.blue("  \u2462 Starting MCP monitor..."));
   console.log("");
   await mcpWatchCommand();
 }
 
 // dist/commands/config.js
 init_config();
-import chalk24 from "chalk";
-var ALLOWED_KEYS = ["vercel-token"];
+import chalk25 from "chalk";
+var ALLOWED_KEYS = ["vercel-token", "doppler-token"];
 var KEY_MAP = {
-  "vercel-token": "vercelToken"
+  "vercel-token": "vercelToken",
+  "doppler-token": "dopplerToken"
 };
 async function configSetCommand(key, value) {
   if (!ALLOWED_KEYS.includes(key)) {
-    console.error(chalk24.red(`Unknown config key: ${key}`));
+    console.error(chalk25.red(`Unknown config key: ${key}`));
     console.log(`  Allowed keys: ${ALLOWED_KEYS.join(", ")}`);
     process.exit(1);
   }
   const credKey = KEY_MAP[key];
   await mergeCredentials({ [credKey]: value });
-  console.log(chalk24.green(`Saved ${key}.`));
+  console.log(chalk25.green(`Saved ${key}.`));
+}
+
+// dist/commands/doppler.js
+init_config();
+init_api();
+init_auth();
+init_dist();
+import chalk26 from "chalk";
+import { input as input7 } from "@inquirer/prompts";
+async function dopplerConnectCommand() {
+  const token = await input7({
+    message: "Enter your Doppler service account token:",
+    transformer: (val) => val.replace(/./g, "*"),
+    validate: (val) => val.length > 0 || "Token is required"
+  });
+  console.log(chalk26.dim("  Validating token..."));
+  const { valid, projectCount } = await validateDopplerToken(token);
+  if (!valid) {
+    console.error(chalk26.red("Token is invalid or has expired."));
+    console.log(chalk26.yellow("Generate a service account token at https://dashboard.doppler.com"));
+    process.exit(1);
+  }
+  await mergeCredentials({ dopplerToken: token });
+  console.log(chalk26.green(`Token validated \u2014 ${projectCount} project${projectCount !== 1 ? "s" : ""} accessible.`));
+  console.log(chalk26.green("Saved to ~/.md4ai/credentials.json"));
+  const creds = await loadCredentials();
+  if (!creds?.accessToken || !creds?.userId) {
+    console.log("");
+    console.log(chalk26.yellow("\u26A0 Not logged in to MD4AI \u2014 token saved locally only."));
+    console.log(chalk26.yellow("  The web dashboard cannot show live Doppler status until the token is synced."));
+    console.log(chalk26.yellow('  To fix: run "md4ai login", then "md4ai doppler connect" again.'));
+  } else {
+    let supabase = createSupabaseClient(getAnonKey(), creds.accessToken);
+    let userId = creds.userId;
+    if (Date.now() > creds.expiresAt) {
+      const refreshed = await refreshSession();
+      if (refreshed) {
+        supabase = refreshed.supabase;
+        userId = refreshed.userId;
+      } else {
+        console.log("");
+        console.log(chalk26.yellow("\u26A0 Session expired \u2014 token saved locally only."));
+        console.log(chalk26.yellow('  To sync to the web dashboard: run "md4ai login", then "md4ai doppler connect" again.'));
+      }
+    }
+    if (supabase) {
+      try {
+        const { error } = await supabase.from("user_secrets").upsert({ user_id: userId, doppler_token: token, updated_at: (/* @__PURE__ */ new Date()).toISOString() }, { onConflict: "user_id" });
+        if (error) {
+          console.log(chalk26.yellow(`\u26A0 Could not sync token to web dashboard: ${error.message}`));
+        } else {
+          const { data: verify } = await supabase.from("user_secrets").select("id").eq("user_id", userId).maybeSingle();
+          if (verify) {
+            console.log(chalk26.green("Token synced to web dashboard."));
+          } else {
+            console.log(chalk26.yellow("\u26A0 Token sync could not be verified \u2014 check the web dashboard."));
+          }
+        }
+      } catch (err) {
+        console.log(chalk26.yellow(`\u26A0 Could not sync token to web dashboard: ${err instanceof Error ? err.message : "unknown error"}`));
+      }
+    }
+  }
+  console.log("");
+  console.log(chalk26.cyan("Next step: link a Doppler project to your Claude project."));
+  console.log(chalk26.dim("  The scanner looks for a doppler.yaml in the project root, e.g.:"));
+  console.log(chalk26.dim("    project: my-doppler-project"));
+  console.log(chalk26.dim("  Or use a manual override:"));
+  console.log(chalk26.dim("    md4ai doppler set-project <slug>"));
+  console.log(chalk26.dim('  Then run "md4ai scan" to fetch secret names from Doppler.'));
+}
+async function dopplerDisconnectCommand() {
+  const creds = await loadCredentials();
+  if (!creds?.dopplerToken) {
+    console.log(chalk26.yellow("No Doppler token configured."));
+    return;
+  }
+  const { dopplerToken: _, ...rest } = creds;
+  const { writeFile: writeFile6, chmod: chmod2 } = await import("node:fs/promises");
+  const { join: join17 } = await import("node:path");
+  const { homedir: homedir10 } = await import("node:os");
+  const credPath = join17(homedir10(), ".md4ai", "credentials.json");
+  await writeFile6(credPath, JSON.stringify(rest, null, 2), "utf-8");
+  await chmod2(credPath, 384);
+  try {
+    const currentCreds = await loadCredentials();
+    if (currentCreds?.accessToken && currentCreds?.userId) {
+      let supabase = createSupabaseClient(getAnonKey(), currentCreds.accessToken);
+      let userId = currentCreds.userId;
+      if (Date.now() > currentCreds.expiresAt) {
+        const refreshed = await refreshSession();
+        if (refreshed) {
+          supabase = refreshed.supabase;
+          userId = refreshed.userId;
+        }
+      }
+      await supabase.from("user_secrets").delete().eq("user_id", userId);
+      console.log(chalk26.green("Doppler token removed from local and web dashboard."));
+    } else {
+      console.log(chalk26.green("Doppler token removed locally."));
+    }
+  } catch {
+    console.log(chalk26.green("Doppler token removed locally."));
+  }
+}
+async function dopplerSetProjectCommand(slug) {
+  const state = await loadState();
+  const folderId = state.lastFolderId;
+  if (!folderId) {
+    console.error(chalk26.red('No project linked yet. Run "md4ai scan" first to link a project.'));
+    process.exit(1);
+  }
+  const dopplerProjects = state.dopplerProjects ?? {};
+  dopplerProjects[folderId] = slug;
+  await saveState({ dopplerProjects });
+  console.log(chalk26.green(`Doppler project "${slug}" linked to folder ${folderId.slice(0, 8)}...`));
+  console.log(chalk26.dim("This override will be used instead of doppler.yaml."));
 }
 
 // dist/index.js
@@ -4357,6 +4769,10 @@ program.command("mcp-watch").description("Monitor MCP server status on this devi
 program.command("init-manifest").description("Scaffold a starter env-manifest.md from detected .env files").action(initManifestCommand);
 var config = program.command("config").description("Manage CLI configuration");
 config.command("set <key> <value>").description("Set a configuration value (e.g. vercel-token)").action(configSetCommand);
+var doppler = program.command("doppler").description("Manage Doppler integration");
+doppler.command("connect").description("Configure Doppler token for secrets scanning").action(dopplerConnectCommand);
+doppler.command("disconnect").description("Remove stored Doppler token").action(dopplerDisconnectCommand);
+doppler.command("set-project <slug>").description("Override Doppler project slug for the current linked project").action(dopplerSetProjectCommand);
 var admin = program.command("admin").description("Admin commands for managing the tools registry");
 admin.command("update-tool").description("Add or update a tool in the master registry").requiredOption("--name <name>", "Canonical tool name (e.g. next, playwright)").option("--display <display>", 'Human-friendly display name (e.g. "Next.js")').option("--category <category>", "Tool category (framework|runtime|cli|mcp|package|database|other)").option("--stable <version>", "Latest stable version").option("--beta <version>", "Latest beta/RC version").option("--source <url>", "Source of truth URL for checking versions").option("--install <url>", "Download/install link").option("--notes <text>", "Compatibility notes or warnings").action(adminUpdateToolCommand);
 admin.command("list-tools").description("List all tools in the master registry").action(adminListToolsCommand);