ultraenv 1.0.0 → 1.0.2

package/dist/cli/index.cjs

@@ -306,7 +306,13 @@ var init_errors = __esm({
       code;
       constructor(message, options = {}) {
         const fsCode = options.code ?? options.cause?.code ?? "UNKNOWN";
-        const opHint = options.path !== void 0 ? `Could not ${options.operation ?? "access"} "${options.path}".` : "";
+        const opHint = options.path !== void 0 ? (
+          /* v8 ignore start */
+          `Could not ${options.operation ?? "access"} "${options.path}".`
+        ) : (
+          /* v8 ignore stop */
+          ""
+        );
         super(message, {
           code: `FS_${fsCode}`,
           hint: options.hint ?? `${opHint} Ensure the file exists and you have the necessary permissions.`,
@@ -773,7 +779,8 @@ function parseYamlScalar(value) {
   if (cleanValue === "") return "";
   if (cleanValue === "true" || cleanValue === "True" || cleanValue === "TRUE") return true;
   if (cleanValue === "false" || cleanValue === "False" || cleanValue === "FALSE") return false;
-  if (cleanValue === "null" || cleanValue === "Null" || cleanValue === "NULL" || cleanValue === "~") return null;
+  if (cleanValue === "null" || cleanValue === "Null" || cleanValue === "NULL" || cleanValue === "~")
+    return null;
   if (/^-?\d+$/.test(cleanValue)) return parseInt(cleanValue, 10);
   if (/^-?\d+\.\d+$/.test(cleanValue)) return parseFloat(cleanValue);
   if (cleanValue.startsWith('"') && cleanValue.endsWith('"') || cleanValue.startsWith("'") && cleanValue.endsWith("'")) {
@@ -958,14 +965,18 @@ async function run(args, ctx) {
     const envDir = await prompt("  Environment directory", { default: "." });
     writeLine("");
     writeLine(cyan("  Creating configuration..."));
-    const configContent = JSON.stringify({
-      envDir,
-      expandVariables: true,
-      overrideProcessEnv: false,
-      mergeStrategy: "last-wins",
-      outputFormat: "terminal",
-      debug: false
-    }, null, 2) + "\n";
+    const configContent = JSON.stringify(
+      {
+        envDir,
+        expandVariables: true,
+        overrideProcessEnv: false,
+        mergeStrategy: "last-wins",
+        outputFormat: "terminal",
+        debug: false
+      },
+      null,
+      2
+    ) + "\n";
     await writeFile(configPath, configContent);
     writeLine(green(`  \u2713 Created ${configPath}`));
     if (!await exists(envPath)) {
@@ -1104,14 +1115,11 @@ function resolveEscapeSequence(chars, startIndex, filePath, lineNumber) {
         }
         return { resolved: String.fromCodePoint(codePoint), charsConsumed: 4 };
       }
-      throw new ParseError(
-        `Invalid hex escape sequence: ${"\\"}x${hex}`,
-        {
-          line: lineNumber,
-          filePath,
-          hint: "Hex escapes must be exactly 2 hex digits, e.g. \\x0A for newline."
-        }
-      );
+      throw new ParseError(`Invalid hex escape sequence: ${"\\"}x${hex}`, {
+        line: lineNumber,
+        filePath,
+        hint: "Hex escapes must be exactly 2 hex digits, e.g. \\x0A for newline."
+      });
     }
     case "u":
     case "U": {
@@ -1126,14 +1134,11 @@ function resolveEscapeSequence(chars, startIndex, filePath, lineNumber) {
         }
         return { resolved: String.fromCodePoint(codePoint), charsConsumed: 6 };
       }
-      throw new ParseError(
-        `Invalid unicode escape sequence: ${"\\"}u${hexDigits}`,
-        {
-          line: lineNumber,
-          filePath,
-          hint: 'Unicode escapes must be exactly 4 hex digits, e.g. \\u0041 for "A".'
-        }
-      );
+      throw new ParseError(`Invalid unicode escape sequence: ${"\\"}u${hexDigits}`, {
+        line: lineNumber,
+        filePath,
+        hint: 'Unicode escapes must be exactly 4 hex digits, e.g. \\u0041 for "A".'
+      });
     }
     /* v8 ignore start */
     default: {
@@ -1415,11 +1420,7 @@ function parseEnvFile(content, filePath) {
         comment = trimmedAfter.slice(1).trim();
       }
     } else if (firstChar === "'") {
-      const result = parseSingleQuotedValue(
-        lines,
-        lineIndex,
-        valueStartIndex + 1
-      );
+      const result = parseSingleQuotedValue(lines, lineIndex, valueStartIndex + 1);
       if (!result.closed) {
         throw new ParseError("Unterminated single-quoted string", {
           line: oneBasedLine,
@@ -1440,11 +1441,7 @@ function parseEnvFile(content, filePath) {
         comment = trimmedAfter.slice(1).trim();
       }
     } else if (firstChar === "`") {
-      const result = parseBacktickQuotedValue(
-        lines,
-        lineIndex,
-        valueStartIndex + 1
-      );
+      const result = parseBacktickQuotedValue(lines, lineIndex, valueStartIndex + 1);
       if (!result.closed) {
         throw new ParseError("Unterminated backtick-quoted string", {
           line: oneBasedLine,
@@ -1676,12 +1673,9 @@ function expandVariables(vars, env, options) {
   const resolving = /* @__PURE__ */ new Set();
   function expandValue(raw, depth) {
     if (depth > maxDepth) {
-      throw new InterpolationError(
-        `Maximum interpolation depth (${maxDepth}) exceeded`,
-        {
-          hint: "Check for deeply nested variable references. Consider simplifying your variable definitions."
-        }
-      );
+      throw new InterpolationError(`Maximum interpolation depth (${maxDepth}) exceeded`, {
+        hint: "Check for deeply nested variable references. Consider simplifying your variable definitions."
+      });
     }
     const result2 = [];
     let i = 0;
@@ -1717,14 +1711,11 @@ function expandVariables(vars, env, options) {
           const parsed = parseExpression(inner);
           if (resolving.has(parsed.varName)) {
             const chain = Array.from(resolving).concat(parsed.varName).join(" \u2192 ");
-            throw new InterpolationError(
-              `Circular variable reference detected: ${chain}`,
-              {
-                variable: parsed.varName,
-                circular: true,
-                hint: "Break the cycle by removing one of the circular references."
-              }
-            );
+            throw new InterpolationError(`Circular variable reference detected: ${chain}`, {
+              variable: parsed.varName,
+              circular: true,
+              hint: "Break the cycle by removing one of the circular references."
+            });
           }
           resolving.add(parsed.varName);
           if (parsed.varName in vars && !(parsed.varName in resolvedMap)) {
@@ -1755,14 +1746,11 @@ function expandVariables(vars, env, options) {
         const varName = raw.slice(i, nameEnd);
         if (resolving.has(varName)) {
           const chain = Array.from(resolving).concat(varName).join(" \u2192 ");
-          throw new InterpolationError(
-            `Circular variable reference detected: ${chain}`,
-            {
-              variable: varName,
-              circular: true,
-              hint: "Break the cycle by removing one of the circular references."
-            }
-          );
+          throw new InterpolationError(`Circular variable reference detected: ${chain}`, {
+            variable: varName,
+            circular: true,
+            hint: "Break the cycle by removing one of the circular references."
+          });
         }
         resolving.add(varName);
         if (varName in vars && !(varName in resolvedMap)) {
@@ -2181,18 +2169,12 @@ function drawTable(headers, rows, options) {
       colWidths = naturalWidths.map((w) => Math.min(w, Math.max(avgWidth, 4)));
     }
   }
-  const wrappedHeaders = headers.map(
-    (h, i) => wrapText(h, colWidths[i] ?? 8)
-  );
+  const wrappedHeaders = headers.map((h, i) => wrapText(h, colWidths[i] ?? 8));
   const wrappedRows = rows.map(
-    (row) => row.map(
-      (cell, i) => wrapText(cell, colWidths[i] ?? 8)
-    )
+    (row) => row.map((cell, i) => wrapText(cell, colWidths[i] ?? 8))
   );
   const maxHeaderLines = Math.max(...wrappedHeaders.map((lines2) => lines2.length));
-  const maxRowLines = rows.length > 0 ? Math.max(...wrappedRows.map(
-    (row) => Math.max(...row.map((cell) => cell.length))
-  )) : 1;
+  const maxRowLines = rows.length > 0 ? Math.max(...wrappedRows.map((row) => Math.max(...row.map((cell) => cell.length)))) : 1;
   const maxLines = Math.max(maxHeaderLines, maxRowLines);
   const lines = [];
   const separatorParts = colWidths.map((w) => "\u2500".repeat(w + opts.padding * 2));
@@ -2734,8 +2716,8 @@ async function run3(args, ctx) {
     const format = args.flags["--format"] ?? "declaration";
     const outFlag = args.flags["--out"];
     const defaultOutPaths = {
-      "declaration": "src/env.d.ts",
-      "module": "src/env.ts",
+      declaration: "src/env.d.ts",
+      module: "src/env.ts",
       "json-schema": "env.schema.json"
     };
     const outputPath = outFlag ? (0, import_node_path6.resolve)(cwd, outFlag) : (0, import_node_path6.resolve)(cwd, defaultOutPaths[format] ?? "src/env.d.ts");
@@ -2747,27 +2729,21 @@ async function run3(args, ctx) {
     let content = "";
     if (format === "declaration") {
       const { generateDeclarationContent: generateDeclarationContent2 } = await Promise.resolve().then(() => (init_declaration(), declaration_exports));
-      content = generateDeclarationContent2(
-        result.env,
-        schema,
-        { interfaceName, jsdoc: true, indent: 4 }
-      );
+      content = generateDeclarationContent2(result.env, schema, {
+        interfaceName,
+        jsdoc: true,
+        indent: 4
+      });
     } else if (format === "module") {
       const { generateModuleContent: generateModuleContent2 } = await Promise.resolve().then(() => (init_module(), module_exports));
       if (!schema) {
         writeError(yellow("  Warning: No schema defined. Generating empty module."));
         writeError(yellow("  Add a schema to your .ultraenvrc.json for typed output."));
       }
-      content = generateModuleContent2(
-        schema ?? {},
-        { interfaceName, jsdoc: true, indent: 2 }
-      );
+      content = generateModuleContent2(schema ?? {}, { interfaceName, jsdoc: true, indent: 2 });
     } else if (format === "json-schema") {
       const { generateJsonSchemaContent: generateJsonSchemaContent2 } = await Promise.resolve().then(() => (init_json_schema(), json_schema_exports));
-      content = generateJsonSchemaContent2(
-        schema ?? {},
-        { includeDescriptions: true, indent: 2 }
-      );
+      content = generateJsonSchemaContent2(schema ?? {}, { includeDescriptions: true, indent: 2 });
     }
     const { writeFile: writeFile2, ensureDir: ensureDir2 } = await Promise.resolve().then(() => (init_fs(), fs_exports));
     await ensureDir2((0, import_node_path6.resolve)(outputPath, ".."));
@@ -3319,7 +3295,11 @@ async function checkSync(envPath, examplePath, ctx) {
     if (ctx.outputFormat === "json") {
       writeJson({ inSync: false, error: ".env file not found" });
     } else {
-      writeError(yellow('  \u26A0 .env file not found. Run "ultraenv sync --mode generate" to create .env.example.'));
+      writeError(
+        yellow(
+          '  \u26A0 .env file not found. Run "ultraenv sync --mode generate" to create .env.example.'
+        )
+      );
     }
     return 1;
   }
@@ -3327,7 +3307,9 @@ async function checkSync(envPath, examplePath, ctx) {
     if (ctx.outputFormat === "json") {
       writeJson({ inSync: false, error: ".env.example not found" });
     } else {
-      writeError(yellow('  \u26A0 .env.example not found. Run "ultraenv sync --mode generate" to create it.'));
+      writeError(
+        yellow('  \u26A0 .env.example not found. Run "ultraenv sync --mode generate" to create it.')
+      );
     }
     return 1;
   }
@@ -3348,11 +3330,14 @@ async function checkSync(envPath, examplePath, ctx) {
   writeLine(formatSyncDiff2(diff));
   writeLine("");
   if (!diff.inSync) {
-    const box = drawBox([
-      "Your .env is out of sync with .env.example.",
-      'Run "ultraenv sync --mode generate" to update .env.example',
-      'or "ultraenv sync --mode interactive" to review changes.'
-    ], { title: "ACTION NEEDED", border: "rounded" });
+    const box = drawBox(
+      [
+        "Your .env is out of sync with .env.example.",
+        'Run "ultraenv sync --mode generate" to update .env.example',
+        'or "ultraenv sync --mode interactive" to review changes.'
+      ],
+      { title: "ACTION NEEDED", border: "rounded" }
+    );
     writeLine(box);
     writeLine("");
     return 1;
@@ -3671,7 +3656,7 @@ var init_secret_patterns = __esm({
       {
         id: "google-oauth-client-secret",
         name: "Google OAuth Client Secret",
-        pattern: /(?:^|["'\s:=,`]GOCSPX-[A-Za-z0-9_-]{28,})(?:["'\s,`;]|$)/gm,
+        pattern: /(?:^|["'\s:=,`])(GOCSPX-[A-Za-z0-9_-]{28,})(?:["'\s,`;]|$)/gm,
         confidence: 0.9,
         severity: "critical",
         description: "Google OAuth Client Secret (new format). Used for OAuth authentication flows.",
@@ -4435,9 +4420,7 @@ function extractCandidates(line) {
     const captured = tokenMatch[1];
     if (captured === void 0) continue;
     const tokenIndex = tokenMatch.index + 1;
-    const existing = candidates.some(
-      (c) => c.value === captured && c.column === tokenIndex
-    );
+    const existing = candidates.some((c) => c.value === captured && c.column === tokenIndex);
     if (!existing) {
       candidates.push({ value: captured, column: tokenMatch.index + 1 });
     }
@@ -5143,15 +5126,9 @@ function getSeverity(pattern) {
 function formatTerminal(result) {
   const lines = [];
   const totalCount = result.secrets.length;
-  const criticalCount = result.secrets.filter(
-    (s) => getSeverity(s.pattern) === "critical"
-  ).length;
-  const highCount = result.secrets.filter(
-    (s) => getSeverity(s.pattern) === "high"
-  ).length;
-  const mediumCount = result.secrets.filter(
-    (s) => getSeverity(s.pattern) === "medium"
-  ).length;
+  const criticalCount = result.secrets.filter((s) => getSeverity(s.pattern) === "critical").length;
+  const highCount = result.secrets.filter((s) => getSeverity(s.pattern) === "high").length;
+  const mediumCount = result.secrets.filter((s) => getSeverity(s.pattern) === "medium").length;
   lines.push("");
   lines.push(`${BOLD}=== ultraenv Secret Scan Report ===${RESET}`);
   lines.push("");
@@ -5167,7 +5144,9 @@ function formatTerminal(result) {
   }
   const summaryParts = [];
   if (criticalCount > 0) {
-    summaryParts.push(`${SEVERITY_CONFIG.critical.terminalColor}${BOLD}${criticalCount} critical${RESET}`);
+    summaryParts.push(
+      `${SEVERITY_CONFIG.critical.terminalColor}${BOLD}${criticalCount} critical${RESET}`
+    );
   }
   if (highCount > 0) {
     summaryParts.push(`${SEVERITY_CONFIG.high.terminalColor}${BOLD}${highCount} high${RESET}`);
@@ -5693,13 +5672,16 @@ async function run7(args, ctx) {
     if (!gitignoreExists) {
       writeError(red("  \u2717 No .gitignore file found!"));
       writeLine("");
-      const box = drawBox([
-        "Your project has no .gitignore file.",
-        "Secrets in .env files could be committed to version control.",
-        "Create a .gitignore with ultraenv entries:",
-        "",
-        "  ultraenv init"
-      ], { title: "DANGER", border: "double" });
+      const box = drawBox(
+        [
+          "Your project has no .gitignore file.",
+          "Secrets in .env files could be committed to version control.",
+          "Create a .gitignore with ultraenv entries:",
+          "",
+          "  ultraenv init"
+        ],
+        { title: "DANGER", border: "double" }
+      );
       writeLine(box);
       writeLine("");
       return 1;
@@ -5715,7 +5697,9 @@ async function run7(args, ctx) {
         issues.push(pattern);
       }
     }
-    writeLine(green(`  \u2713 ${protectedEntries.length}/${PROTECTED_PATTERNS.length} patterns protected`));
+    writeLine(
+      green(`  \u2713 ${protectedEntries.length}/${PROTECTED_PATTERNS.length} patterns protected`)
+    );
     const envFiles = [".env", ".env.local", ".env.production", ".env.development"];
     const notIgnored = [];
     for (const envFile of envFiles) {
@@ -5746,13 +5730,16 @@ async function run7(args, ctx) {
           writeError(red(`    - ${f}`));
         }
         writeLine("");
-        const warnBox = drawBox([
-          "Tracked .env files may contain secrets.",
-          "Remove them from version control immediately:",
-          "",
-          "  git rm --cached .env*",
-          '  git commit -m "Remove tracked .env files"'
-        ], { title: "WARNING", border: "double" });
+        const warnBox = drawBox(
+          [
+            "Tracked .env files may contain secrets.",
+            "Remove them from version control immediately:",
+            "",
+            "  git rm --cached .env*",
+            '  git commit -m "Remove tracked .env files"'
+          ],
+          { title: "WARNING", border: "double" }
+        );
         writeLine(warnBox);
         writeLine("");
         return 1;
@@ -5808,13 +5795,7 @@ var init_protect = __esm({
     import_node_path11 = require("path");
     init_fs();
     init_git();
-    PROTECTED_PATTERNS = [
-      ".env",
-      ".env.local",
-      ".env.*.local",
-      ".env.vault",
-      ".env.keys"
-    ];
+    PROTECTED_PATTERNS = [".env", ".env.local", ".env.*.local", ".env.vault", ".env.keys"];
   }
 });
 
@@ -5841,11 +5822,7 @@ function manualHkdf(ikm, salt, info, length) {
   const okm = Buffer.alloc(length);
   let previous = Buffer.alloc(0);
   for (let i = 1; i <= n; i++) {
-    const hmacData = Buffer.concat([
-      previous,
-      infoBuffer,
-      Buffer.from([i])
-    ]);
+    const hmacData = Buffer.concat([previous, infoBuffer, Buffer.from([i])]);
     previous = (0, import_node_crypto.createHmac)("sha256", prk).update(hmacData).digest();
     const offset = (i - 1) * hashLen;
     const copyLen = Math.min(hashLen, length - offset);
@@ -5862,10 +5839,7 @@ function encrypt(key, plaintext) {
   const iv = (0, import_node_crypto.randomBytes)(12);
   const algo = `aes-${key.length * 8}-gcm`;
   const cipher = (0, import_node_crypto.createCipheriv)(algo, key, iv);
-  const ciphertext = Buffer.concat([
-    cipher.update(plaintext),
-    cipher.final()
-  ]);
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
   const authTag = cipher.getAuthTag();
   return { iv, authTag, ciphertext };
 }
@@ -5879,10 +5853,7 @@ function decrypt(key, iv, authTag, ciphertext) {
   const decipher = (0, import_node_crypto.createDecipheriv)(algo, key, iv);
   decipher.setAuthTag(authTag);
   try {
-    return Buffer.concat([
-      decipher.update(ciphertext),
-      decipher.final()
-    ]);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(
@@ -5934,12 +5905,9 @@ function decryptValue(encrypted, key) {
     );
   }
   if (!encrypted.startsWith(ENCRYPTED_PREFIX)) {
-    throw new EncryptionError(
-      "Invalid encrypted value format: missing required prefix",
-      {
-        hint: `Expected the value to start with "${ENCRYPTED_PREFIX}". This value may not have been encrypted by ultraenv.`
-      }
-    );
+    throw new EncryptionError("Invalid encrypted value format: missing required prefix", {
+      hint: `Expected the value to start with "${ENCRYPTED_PREFIX}". This value may not have been encrypted by ultraenv.`
+    });
   }
   const payload = encrypted.slice(ENCRYPTED_PREFIX.length);
   const parts = payload.split(":");
@@ -5955,16 +5923,14 @@ function decryptValue(encrypted, key) {
   const authTagB64 = parts[1];
   const ciphertextB64 = parts[2];
   if (ivB64 === void 0 || authTagB64 === void 0 || ciphertextB64 === void 0) {
-    throw new EncryptionError(
-      "Invalid encrypted value: unexpected component structure",
-      { hint: "The encrypted data may be corrupted. Try re-encrypting the value." }
-    );
+    throw new EncryptionError("Invalid encrypted value: unexpected component structure", {
+      hint: "The encrypted data may be corrupted. Try re-encrypting the value."
+    });
   }
   if (ivB64.length === 0 || authTagB64.length === 0 || ciphertextB64.length === 0) {
-    throw new EncryptionError(
-      "Invalid encrypted value: one or more base64 components are empty",
-      { hint: "The encrypted data may be corrupted. Try re-encrypting the value." }
-    );
+    throw new EncryptionError("Invalid encrypted value: one or more base64 components are empty", {
+      hint: "The encrypted data may be corrupted. Try re-encrypting the value."
+    });
   }
   try {
     const iv = base64ToBuffer(ivB64);
@@ -5973,7 +5939,9 @@ function decryptValue(encrypted, key) {
     if (iv.length !== IV_LENGTH) {
       throw new EncryptionError(
         `Invalid IV length: expected ${IV_LENGTH} bytes, got ${iv.length}`,
-        { hint: "The encrypted data may be corrupted or was produced by a different version of ultraenv." }
+        {
+          hint: "The encrypted data may be corrupted or was produced by a different version of ultraenv."
+        }
       );
     }
     if (authTag.length !== AUTH_TAG_LENGTH) {
@@ -5988,10 +5956,9 @@ function decryptValue(encrypted, key) {
     if (error instanceof EncryptionError) throw error;
     const message = error instanceof Error ? error.message : String(error);
     if (message.includes("Invalid") || message.includes("base64")) {
-      throw new EncryptionError(
-        "Invalid base64 encoding in encrypted value",
-        { hint: "The encrypted data may be corrupted. Ensure the value was not modified." }
-      );
+      throw new EncryptionError("Invalid base64 encoding in encrypted value", {
+        hint: "The encrypted data may be corrupted. Ensure the value was not modified."
+      });
     }
     throw new EncryptionError(
       "Failed to decrypt value. The key may be incorrect or the ciphertext was tampered with.",
@@ -6041,10 +6008,9 @@ function deriveEnvironmentKey(masterKey, environment) {
     );
   }
   if (environment.length === 0) {
-    throw new EncryptionError(
-      "Environment name cannot be empty",
-      { hint: 'Provide a valid environment name (e.g., "development", "production").' }
-    );
+    throw new EncryptionError("Environment name cannot be empty", {
+      hint: 'Provide a valid environment name (e.g., "development", "production").'
+    });
   }
   if (HKDF_SALT.length < DEFAULT_SALT_LENGTH) {
     const paddedSalt = Buffer.alloc(DEFAULT_SALT_LENGTH);
@@ -6056,12 +6022,7 @@ function deriveEnvironmentKey(masterKey, environment) {
       DEFAULT_KEY_LENGTH
     );
   }
-  return deriveKey(
-    masterKey,
-    HKDF_SALT,
-    `${HKDF_INFO_PREFIX}${environment}`,
-    DEFAULT_KEY_LENGTH
-  );
+  return deriveKey(masterKey, HKDF_SALT, `${HKDF_INFO_PREFIX}${environment}`, DEFAULT_KEY_LENGTH);
 }
 function formatKey(key) {
   if (key.length === 0) {
@@ -6081,21 +6042,17 @@ function parseKey2(formatted) {
   }
   const base64Part = formatted.slice(KEY_PREFIX.length);
   if (base64Part.length === 0) {
-    throw new EncryptionError(
-      "Invalid key format: base64 payload is empty after prefix",
-      { hint: "The key appears to be truncated. Generate a new key." }
-    );
+    throw new EncryptionError("Invalid key format: base64 payload is empty after prefix", {
+      hint: "The key appears to be truncated. Generate a new key."
+    });
   }
   try {
     return base64ToBuffer(base64Part);
   } catch (error) {
-    throw new EncryptionError(
-      "Failed to decode key: invalid base64 encoding",
-      {
-        cause: error instanceof Error ? error : void 0,
-        hint: 'The key may be corrupted. Generate a new key with "ultraenv key generate".'
-      }
-    );
+    throw new EncryptionError("Failed to decode key: invalid base64 encoding", {
+      cause: error instanceof Error ? error : void 0,
+      hint: 'The key may be corrupted. Generate a new key with "ultraenv key generate".'
+    });
   }
 }
 function isValidKeyFormat(formatted) {
@@ -6157,12 +6114,9 @@ function parseKeysFile(content) {
     if (!eqMatch) {
       const plainMatch = line.match(/^ULTRAENV_KEY_([A-Za-z0-9_]+)=(.*)$/);
       if (!plainMatch) {
-        throw new EncryptionError(
-          `Invalid keys file format at line ${i + 1}: "${line}"`,
-          {
-            hint: 'Each key entry should be in the format: ULTRAENV_KEY_{ENVIRONMENT}="ultraenv_key_v1_..."'
-          }
-        );
+        throw new EncryptionError(`Invalid keys file format at line ${i + 1}: "${line}"`, {
+          hint: 'Each key entry should be in the format: ULTRAENV_KEY_{ENVIRONMENT}="ultraenv_key_v1_..."'
+        });
       }
       const envName2 = plainMatch[1].toLowerCase();
       const keyValue2 = plainMatch[2];
@@ -6308,21 +6262,14 @@ function parseVaultFile(content) {
     if (rawLine === void 0) continue;
     const line = rawLine.trim();
     if (line.length === 0 || line.startsWith("#")) continue;
-    const match = line.match(
-      new RegExp(`^${VAULT_VAR_PREFIX}([A-Za-z0-9_]+)="(.*)"$`)
-    );
+    const match = line.match(new RegExp(`^${VAULT_VAR_PREFIX}([A-Za-z0-9_]+)="(.*)"$`));
     if (!match) {
-      const plainMatch = line.match(
-        new RegExp(`^${VAULT_VAR_PREFIX}([A-Za-z0-9_]+)=(.*)$`)
-      );
+      const plainMatch = line.match(new RegExp(`^${VAULT_VAR_PREFIX}([A-Za-z0-9_]+)=(.*)$`));
       if (!plainMatch) {
-        throw new VaultError(
-          `Invalid vault file format at line ${lineNumber}: "${line}"`,
-          {
-            operation: "parse",
-            hint: `Each environment entry should be in the format: ${VAULT_VAR_PREFIX}{ENVIRONMENT}="encrypted:..."`
-          }
-        );
+        throw new VaultError(`Invalid vault file format at line ${lineNumber}: "${line}"`, {
+          operation: "parse",
+          hint: `Each environment entry should be in the format: ${VAULT_VAR_PREFIX}{ENVIRONMENT}="encrypted:..."`
+        });
       }
       const envName2 = plainMatch[1].toLowerCase();
       const encryptedValue2 = plainMatch[2];
@@ -6375,41 +6322,32 @@ async function readVaultFile(path) {
     return parseVaultFile(content);
   } catch (error) {
     if (error instanceof VaultError) throw error;
-    throw new VaultError(
-      `Failed to read vault file "${path}"`,
-      {
-        operation: "read",
-        /* v8 ignore start */
-        cause: error instanceof Error ? error : void 0
-        /* v8 ignore stop */
-      }
-    );
+    throw new VaultError(`Failed to read vault file "${path}"`, {
+      operation: "read",
+      /* v8 ignore start */
+      cause: error instanceof Error ? error : void 0
+      /* v8 ignore stop */
+    });
   }
 }
 async function writeVaultFile(path, environments) {
   if (environments.size === 0) {
-    throw new VaultError(
-      "Cannot write an empty vault file",
-      {
-        operation: "write",
-        hint: "Add at least one environment to the vault before writing."
-      }
-    );
+    throw new VaultError("Cannot write an empty vault file", {
+      operation: "write",
+      hint: "Add at least one environment to the vault before writing."
+    });
   }
   try {
     const content = serializeVaultFile(environments);
     await writeFile(path, content, "utf-8");
   } catch (error) {
     if (error instanceof VaultError) throw error;
-    throw new VaultError(
-      `Failed to write vault file "${path}"`,
-      {
-        operation: "write",
-        /* v8 ignore start */
-        cause: error instanceof Error ? error : void 0
-        /* v8 ignore stop */
-      }
-    );
+    throw new VaultError(`Failed to write vault file "${path}"`, {
+      operation: "write",
+      /* v8 ignore start */
+      cause: error instanceof Error ? error : void 0
+      /* v8 ignore stop */
+    });
   }
 }
 function countEncryptedVars(encrypted) {
@@ -6942,16 +6880,14 @@ var init_vault_diff = __esm({
 // src/vault/integrity.ts
 function computeIntegrity(data, key) {
   if (key.length === 0) {
-    throw new EncryptionError(
-      "Cannot compute integrity with an empty key",
-      { hint: "Provide a valid encryption key for integrity computation." }
-    );
+    throw new EncryptionError("Cannot compute integrity with an empty key", {
+      hint: "Provide a valid encryption key for integrity computation."
+    });
   }
   if (data.length === 0) {
-    throw new EncryptionError(
-      "Cannot compute integrity for empty data",
-      { hint: "Provide non-empty data for integrity computation." }
-    );
+    throw new EncryptionError("Cannot compute integrity for empty data", {
+      hint: "Provide non-empty data for integrity computation."
+    });
   }
   const hmac = (0, import_node_crypto3.createHmac)(HMAC_ALGORITHM, key);
   hmac.update(data, "utf-8");
@@ -7183,12 +7119,14 @@ async function validateAllEnvironments(schema, cwd) {
       const message = error instanceof Error ? error.message : String(error);
       results.set(envName ?? pattern, {
         valid: false,
-        errors: [{
-          field: "",
-          value: "",
-          message: `Failed to read/parse file: ${message}`,
-          hint: "Check that the file is a valid .env file."
-        }],
+        errors: [
+          {
+            field: "",
+            value: "",
+            message: `Failed to read/parse file: ${message}`,
+            hint: "Check that the file is a valid .env file."
+          }
+        ],
         warnings: []
       });
     }
@@ -7199,14 +7137,11 @@ async function switchEnvironment(envName, cwd) {
   const baseDir = (0, import_node_path19.resolve)(cwd ?? process.cwd());
   const envFile = (0, import_node_path19.join)(baseDir, `.env.${envName}`);
   if (!await exists(envFile)) {
-    throw new FileSystemError(
-      `Environment file ".env.${envName}" not found`,
-      {
-        path: envFile,
-        operation: "read",
-        hint: `Create a ".env.${envName}" file first, or use "ultraenv env create ${envName}".`
-      }
-    );
+    throw new FileSystemError(`Environment file ".env.${envName}" not found`, {
+      path: envFile,
+      operation: "read",
+      hint: `Create a ".env.${envName}" file first, or use "ultraenv env create ${envName}".`
+    });
   }
   const content = await readFile(envFile);
   const header = [
@@ -7392,24 +7327,18 @@ async function compareEnvironments(env1, env2, cwd, _schema) {
   const resolvedEnv1Path = env1.includes("/") || env1.includes("\\") ? (0, import_node_path20.resolve)(env1) : env1Path;
   const resolvedEnv2Path = env2.includes("/") || env2.includes("\\") ? (0, import_node_path20.resolve)(env2) : env2Path;
   if (!await exists(resolvedEnv1Path)) {
-    throw new FileSystemError(
-      `Environment file not found: "${resolvedEnv1Path}"`,
-      {
-        path: resolvedEnv1Path,
-        operation: "read",
-        hint: `Ensure ".env.${env1}" exists in the project directory.`
-      }
-    );
+    throw new FileSystemError(`Environment file not found: "${resolvedEnv1Path}"`, {
+      path: resolvedEnv1Path,
+      operation: "read",
+      hint: `Ensure ".env.${env1}" exists in the project directory.`
+    });
   }
   if (!await exists(resolvedEnv2Path)) {
-    throw new FileSystemError(
-      `Environment file not found: "${resolvedEnv2Path}"`,
-      {
-        path: resolvedEnv2Path,
-        operation: "read",
-        hint: `Ensure ".env.${env2}" exists in the project directory.`
-      }
-    );
+    throw new FileSystemError(`Environment file not found: "${resolvedEnv2Path}"`, {
+      path: resolvedEnv2Path,
+      operation: "read",
+      hint: `Ensure ".env.${env2}" exists in the project directory.`
+    });
   }
   const env1Content = await readFile(resolvedEnv1Path);
   const env2Content = await readFile(resolvedEnv2Path);
@@ -7502,14 +7431,18 @@ function formatComparison(comparison) {
     lines.push("");
     lines.push(`Only in ${comparison.env1Name} (${comparison.onlyInEnv1.length}):`);
     for (const diff of comparison.onlyInEnv1) {
-      lines.push(`  - ${diff.key}${diff.isSecret ? " [SECRET]" : ""} = ${diff.value1 || "(empty)"}`);
+      lines.push(
+        `  - ${diff.key}${diff.isSecret ? " [SECRET]" : ""} = ${diff.value1 || "(empty)"}`
+      );
     }
   }
   if (comparison.onlyInEnv2.length > 0) {
     lines.push("");
     lines.push(`Only in ${comparison.env2Name} (${comparison.onlyInEnv2.length}):`);
     for (const diff of comparison.onlyInEnv2) {
-      lines.push(`  + ${diff.key}${diff.isSecret ? " [SECRET]" : ""} = ${diff.value2 || "(empty)"}`);
+      lines.push(
+        `  + ${diff.key}${diff.isSecret ? " [SECRET]" : ""} = ${diff.value2 || "(empty)"}`
+      );
     }
   }
   if (comparison.different.length > 0) {
@@ -7643,10 +7576,7 @@ async function run17(args, ctx) {
       writeLine(yellow("  No schema defined in configuration. Basic validation only."));
       writeLine("");
     }
-    const results = await validateAllEnvironments(
-      ctx.config.schema?.definitions ?? {},
-      cwd
-    );
+    const results = await validateAllEnvironments(ctx.config.schema?.definitions ?? {}, cwd);
     if (ctx.outputFormat === "json") {
       const jsonResults = {};
       for (const [name, result] of results) {
@@ -7799,14 +7729,11 @@ function validateEnvironmentName(name) {
     });
   }
   if (name.length > 64) {
-    throw new FileSystemError(
-      `Environment name too long: ${name.length} characters (max 64)`,
-      {
-        path: "",
-        operation: "validate",
-        hint: "Use a shorter environment name."
-      }
-    );
+    throw new FileSystemError(`Environment name too long: ${name.length} characters (max 64)`, {
+      path: "",
+      operation: "validate",
+      hint: "Use a shorter environment name."
+    });
   }
   if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
     throw new FileSystemError(
@@ -7820,14 +7747,11 @@ function validateEnvironmentName(name) {
   }
   const reserved = ["local", "example", "template", "bak", "backup", "old", "tmp", "temp"];
   if (reserved.includes(name.toLowerCase())) {
-    throw new FileSystemError(
-      `Reserved environment name: "${name}"`,
-      {
-        path: "",
-        operation: "validate",
-        hint: `The name "${name}" is reserved. Choose a different name.`
-      }
-    );
+    throw new FileSystemError(`Reserved environment name: "${name}"`, {
+      path: "",
+      operation: "validate",
+      hint: `The name "${name}" is reserved. Choose a different name.`
+    });
   }
 }
 async function createEnvironment(name, options) {
@@ -7835,28 +7759,22 @@ async function createEnvironment(name, options) {
   const baseDir = (0, import_node_path21.resolve)(options?.cwd ?? process.cwd());
   const outputPath = (0, import_node_path21.join)(baseDir, `.env.${name}`);
   if (await exists(outputPath)) {
-    throw new FileSystemError(
-      `Environment file already exists: ".env.${name}"`,
-      {
-        path: outputPath,
-        operation: "create",
-        hint: "Delete the existing file first, or use a different environment name."
-      }
-    );
+    throw new FileSystemError(`Environment file already exists: ".env.${name}"`, {
+      path: outputPath,
+      operation: "create",
+      hint: "Delete the existing file first, or use a different environment name."
+    });
   }
   let content;
   let variables = [];
   if (options?.copyFrom !== void 0) {
     const sourcePath = (0, import_node_path21.join)(baseDir, `.env.${options.copyFrom}`);
     if (!await exists(sourcePath)) {
-      throw new FileSystemError(
-        `Source environment not found: ".env.${options.copyFrom}"`,
-        {
-          path: sourcePath,
-          operation: "read",
-          hint: `Ensure ".env.${options.copyFrom}" exists before copying.`
-        }
-      );
+      throw new FileSystemError(`Source environment not found: ".env.${options.copyFrom}"`, {
+        path: sourcePath,
+        operation: "read",
+        hint: `Ensure ".env.${options.copyFrom}" exists before copying.`
+      });
     }
     content = await readFile(sourcePath);
     variables = extractVariables(content, options?.schema);
@@ -7877,14 +7795,11 @@ async function createEnvironment(name, options) {
     } else if (await exists(templatePath)) {
       content = await readFile(templatePath);
     } else {
-      throw new FileSystemError(
-        `Template not found: "${options.fromTemplate}"`,
-        {
-          path: templatePath,
-          operation: "read",
-          hint: "Use a built-in template name (nodejs, nextjs, docker) or a valid file path."
-        }
-      );
+      throw new FileSystemError(`Template not found: "${options.fromTemplate}"`, {
+        path: templatePath,
+        operation: "read",
+        hint: "Use a built-in template name (nodejs, nextjs, docker) or a valid file path."
+      });
     }
     variables = extractVariables(content, options?.schema);
     const values = collectValues(variables, options?.values);
@@ -7919,9 +7834,18 @@ async function createEnvironment(name, options) {
 }
 function listTemplates() {
   return [
-    { name: "nodejs", description: "Node.js backend environment (PORT, DATABASE_URL, JWT, CORS, etc.)" },
-    { name: "nextjs", description: "Next.js frontend environment (NEXT_PUBLIC_* variables, analytics, etc.)" },
-    { name: "docker", description: "Docker deployment environment (container ports, Postgres, Redis, etc.)" }
+    {
+      name: "nodejs",
+      description: "Node.js backend environment (PORT, DATABASE_URL, JWT, CORS, etc.)"
+    },
+    {
+      name: "nextjs",
+      description: "Next.js frontend environment (NEXT_PUBLIC_* variables, analytics, etc.)"
+    },
+    {
+      name: "docker",
+      description: "Docker deployment environment (container ports, Postgres, Redis, etc.)"
+    }
   ];
 }
 var import_node_path21, NODEJS_TEMPLATE, NEXTJS_TEMPLATE, DOCKER_TEMPLATE, BUILTIN_TEMPLATES;
@@ -8213,10 +8137,7 @@ async function run22(args, ctx) {
       failFast: args.flags["--fail-fast"] ?? true,
       outputFormat
     });
-    const formatted = formatScanResult(
-      result,
-      outputFormat
-    );
+    const formatted = formatScanResult(result, outputFormat);
     process.stdout.write(formatted + "\n");
     return result.found ? 1 : 0;
   } catch (error) {
@@ -8560,7 +8481,9 @@ async function run25(args, ctx) {
       writeJson({ checks, summary: { passed, warnings, failed, total: checks.length } });
       return failed > 0 ? 1 : 0;
     }
-    writeLine(cyan(`  ${passed}/${checks.length} passed, ${warnings} warning(s), ${failed} failure(s)`));
+    writeLine(
+      cyan(`  ${passed}/${checks.length} passed, ${warnings} warning(s), ${failed} failure(s)`)
+    );
     writeLine("");
     if (failed > 0) {
       writeLine(red(bold("  Some checks failed. Fix the issues above.")));
@@ -8776,11 +8699,11 @@ async function run27(args, _ctx) {
       writeLine(`  Usage: ${cmd.usage}`);
       writeLine("");
       const optionsMap = {
-        "init": ["--force", "--cwd <path>"],
-        "validate": ["--env-dir <path>", "--quiet"],
-        "typegen": ["--format <type>", "--out <path>", "--interface <name>"],
-        "sync": ["--mode <mode>", "--file <path>", "--out <path>", "--watch"],
-        "scan": ["--scope <scope>", "--format <type>", "--include <glob>", "--exclude <glob>"],
+        init: ["--force", "--cwd <path>"],
+        validate: ["--env-dir <path>", "--quiet"],
+        typegen: ["--format <type>", "--out <path>", "--interface <name>"],
+        sync: ["--mode <mode>", "--file <path>", "--out <path>", "--watch"],
+        scan: ["--scope <scope>", "--format <type>", "--include <glob>", "--exclude <glob>"],
         "vault init": ["--env <name>", "--force", "--key <key>"],
         "vault encrypt": ["--env <name>", "--key <key>"],
         "vault decrypt": ["--env <name>", "--key <key>"],
@@ -8809,7 +8732,9 @@ async function run27(args, _ctx) {
   writeLine("");
   writeLine("  COMMANDS:");
   writeLine("");
-  const core = COMMANDS.filter((c) => !c.name.startsWith("vault") && !c.name.startsWith("envs") && !c.name.startsWith("ci"));
+  const core = COMMANDS.filter(
+    (c) => !c.name.startsWith("vault") && !c.name.startsWith("envs") && !c.name.startsWith("ci")
+  );
   const vault = COMMANDS.filter((c) => c.name.startsWith("vault"));
   const envs = COMMANDS.filter((c) => c.name.startsWith("envs"));
   const ci = COMMANDS.filter((c) => c.name.startsWith("ci"));
@@ -8848,32 +8773,112 @@ var init_help = __esm({
     init_colors();
     init_constants();
     COMMANDS = [
-      { name: "init", description: "Initialize ultraenv in a project", usage: "ultraenv init [options]" },
-      { name: "validate", description: "Validate environment against schema", usage: "ultraenv validate [options]" },
-      { name: "typegen", description: "Generate TypeScript types", usage: "ultraenv typegen [options]" },
+      {
+        name: "init",
+        description: "Initialize ultraenv in a project",
+        usage: "ultraenv init [options]"
+      },
+      {
+        name: "validate",
+        description: "Validate environment against schema",
+        usage: "ultraenv validate [options]"
+      },
+      {
+        name: "typegen",
+        description: "Generate TypeScript types",
+        usage: "ultraenv typegen [options]"
+      },
       { name: "sync", description: "Sync .env.example", usage: "ultraenv sync [options]" },
       { name: "scan", description: "Scan for leaked secrets", usage: "ultraenv scan [options]" },
       { name: "debug", description: "Show environment diagnostics", usage: "ultraenv debug [options]" },
-      { name: "protect", description: "Verify .gitignore protection", usage: "ultraenv protect [options]" },
-      { name: "vault init", description: "Initialize encrypted vault", usage: "ultraenv vault init [options]" },
-      { name: "vault encrypt", description: "Encrypt .env \u2192 vault", usage: "ultraenv vault encrypt [options]" },
-      { name: "vault decrypt", description: "Decrypt vault \u2192 .env", usage: "ultraenv vault decrypt [options]" },
-      { name: "vault rekey", description: "Rotate encryption keys", usage: "ultraenv vault rekey [options]" },
-      { name: "vault status", description: "Show vault status", usage: "ultraenv vault status [options]" },
-      { name: "vault diff", description: "Compare .env vs vault", usage: "ultraenv vault diff [options]" },
-      { name: "vault verify", description: "Verify vault integrity", usage: "ultraenv vault verify [options]" },
-      { name: "envs list", description: "List all environments", usage: "ultraenv envs list [options]" },
-      { name: "envs compare", description: "Compare two environments", usage: "ultraenv envs compare <env1> <env2>" },
-      { name: "envs validate", description: "Validate all environments", usage: "ultraenv envs validate [options]" },
-      { name: "envs create", description: "Create new environment", usage: "ultraenv envs create <name> [options]" },
-      { name: "envs switch", description: "Switch current environment", usage: "ultraenv envs switch <name>" },
-      { name: "ci validate", description: "CI validation mode", usage: "ultraenv ci validate [options]" },
-      { name: "ci check-sync", description: "CI sync check", usage: "ultraenv ci check-sync [options]" },
+      {
+        name: "protect",
+        description: "Verify .gitignore protection",
+        usage: "ultraenv protect [options]"
+      },
+      {
+        name: "vault init",
+        description: "Initialize encrypted vault",
+        usage: "ultraenv vault init [options]"
+      },
+      {
+        name: "vault encrypt",
+        description: "Encrypt .env \u2192 vault",
+        usage: "ultraenv vault encrypt [options]"
+      },
+      {
+        name: "vault decrypt",
+        description: "Decrypt vault \u2192 .env",
+        usage: "ultraenv vault decrypt [options]"
+      },
+      {
+        name: "vault rekey",
+        description: "Rotate encryption keys",
+        usage: "ultraenv vault rekey [options]"
+      },
+      {
+        name: "vault status",
+        description: "Show vault status",
+        usage: "ultraenv vault status [options]"
+      },
+      {
+        name: "vault diff",
+        description: "Compare .env vs vault",
+        usage: "ultraenv vault diff [options]"
+      },
+      {
+        name: "vault verify",
+        description: "Verify vault integrity",
+        usage: "ultraenv vault verify [options]"
+      },
+      {
+        name: "envs list",
+        description: "List all environments",
+        usage: "ultraenv envs list [options]"
+      },
+      {
+        name: "envs compare",
+        description: "Compare two environments",
+        usage: "ultraenv envs compare <env1> <env2>"
+      },
+      {
+        name: "envs validate",
+        description: "Validate all environments",
+        usage: "ultraenv envs validate [options]"
+      },
+      {
+        name: "envs create",
+        description: "Create new environment",
+        usage: "ultraenv envs create <name> [options]"
+      },
+      {
+        name: "envs switch",
+        description: "Switch current environment",
+        usage: "ultraenv envs switch <name>"
+      },
+      {
+        name: "ci validate",
+        description: "CI validation mode",
+        usage: "ultraenv ci validate [options]"
+      },
+      {
+        name: "ci check-sync",
+        description: "CI sync check",
+        usage: "ultraenv ci check-sync [options]"
+      },
       { name: "ci scan", description: "CI secret scan", usage: "ultraenv ci scan [options]" },
       { name: "ci setup", description: "Generate CI config", usage: "ultraenv ci setup [options]" },
-      { name: "install-hook", description: "Install git pre-commit hook", usage: "ultraenv install-hook [options]" },
+      {
+        name: "install-hook",
+        description: "Install git pre-commit hook",
+        usage: "ultraenv install-hook [options]"
+      },
       { name: "doctor", description: "Self-check installation", usage: "ultraenv doctor [options]" },
-      { name: "completion", description: "Generate shell completions", usage: "ultraenv completion <shell>" },
+      {
+        name: "completion",
+        description: "Generate shell completions",
+        usage: "ultraenv completion <shell>"
+      },
       { name: "version", description: "Show version", usage: "ultraenv version" }
     ];
   }
@@ -8913,19 +8918,8 @@ var VAULT_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "diff",
   "verify"
 ]);
-var ENVS_SUBCOMMANDS = /* @__PURE__ */ new Set([
-  "list",
-  "compare",
-  "validate",
-  "create",
-  "switch"
-]);
-var CI_SUBCOMMANDS = /* @__PURE__ */ new Set([
-  "validate",
-  "check-sync",
-  "scan",
-  "setup"
-]);
+var ENVS_SUBCOMMANDS = /* @__PURE__ */ new Set(["list", "compare", "validate", "create", "switch"]);
+var CI_SUBCOMMANDS = /* @__PURE__ */ new Set(["validate", "check-sync", "scan", "setup"]);
 var OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set([
   "--config",
   "--format",
@@ -9068,37 +9062,97 @@ init_errors();
 var import_node_path27 = require("path");
 var COMMAND_REGISTRY = {
   // Core commands
-  "init": () => Promise.resolve().then(() => (init_init(), init_exports)).then((m) => ({ runner: m.run, description: "Initialize project" })),
-  "validate": () => Promise.resolve().then(() => (init_validate(), validate_exports)).then((m) => ({ runner: m.run, description: "Validate environment" })),
-  "typegen": () => Promise.resolve().then(() => (init_typegen(), typegen_exports)).then((m) => ({ runner: m.run, description: "Generate TypeScript types" })),
-  "sync": () => Promise.resolve().then(() => (init_sync(), sync_exports)).then((m) => ({ runner: m.run, description: "Sync .env.example" })),
-  "scan": () => Promise.resolve().then(() => (init_scan(), scan_exports)).then((m) => ({ runner: m.run, description: "Scan for secrets" })),
-  "debug": () => Promise.resolve().then(() => (init_debug(), debug_exports)).then((m) => ({ runner: m.run, description: "Show diagnostics" })),
-  "protect": () => Promise.resolve().then(() => (init_protect(), protect_exports)).then((m) => ({ runner: m.run, description: "Check .gitignore" })),
+  init: () => Promise.resolve().then(() => (init_init(), init_exports)).then((m) => ({
+    runner: m.run,
+    description: "Initialize project"
+  })),
+  validate: () => Promise.resolve().then(() => (init_validate(), validate_exports)).then((m) => ({
+    runner: m.run,
+    description: "Validate environment"
+  })),
+  typegen: () => Promise.resolve().then(() => (init_typegen(), typegen_exports)).then((m) => ({
+    runner: m.run,
+    description: "Generate TypeScript types"
+  })),
+  sync: () => Promise.resolve().then(() => (init_sync(), sync_exports)).then((m) => ({ runner: m.run, description: "Sync .env.example" })),
+  scan: () => Promise.resolve().then(() => (init_scan(), scan_exports)).then((m) => ({ runner: m.run, description: "Scan for secrets" })),
+  debug: () => Promise.resolve().then(() => (init_debug(), debug_exports)).then((m) => ({ runner: m.run, description: "Show diagnostics" })),
+  protect: () => Promise.resolve().then(() => (init_protect(), protect_exports)).then((m) => ({
+    runner: m.run,
+    description: "Check .gitignore"
+  })),
   // Vault subcommands
-  "vault.init": () => Promise.resolve().then(() => (init_vault_init(), vault_init_exports)).then((m) => ({ runner: m.run, description: "Initialize vault" })),
-  "vault.encrypt": () => Promise.resolve().then(() => (init_vault_encrypt(), vault_encrypt_exports)).then((m) => ({ runner: m.run, description: "Encrypt to vault" })),
-  "vault.decrypt": () => Promise.resolve().then(() => (init_vault_decrypt(), vault_decrypt_exports)).then((m) => ({ runner: m.run, description: "Decrypt from vault" })),
-  "vault.rekey": () => Promise.resolve().then(() => (init_vault_rekey(), vault_rekey_exports)).then((m) => ({ runner: m.run, description: "Rotate keys" })),
-  "vault.status": () => Promise.resolve().then(() => (init_vault_status(), vault_status_exports)).then((m) => ({ runner: m.run, description: "Vault status" })),
-  "vault.diff": () => Promise.resolve().then(() => (init_vault_diff(), vault_diff_exports)).then((m) => ({ runner: m.run, description: "Compare vs vault" })),
-  "vault.verify": () => Promise.resolve().then(() => (init_vault_verify(), vault_verify_exports)).then((m) => ({ runner: m.run, description: "Verify integrity" })),
+  "vault.init": () => Promise.resolve().then(() => (init_vault_init(), vault_init_exports)).then((m) => ({
+    runner: m.run,
+    description: "Initialize vault"
+  })),
+  "vault.encrypt": () => Promise.resolve().then(() => (init_vault_encrypt(), vault_encrypt_exports)).then((m) => ({
+    runner: m.run,
+    description: "Encrypt to vault"
+  })),
+  "vault.decrypt": () => Promise.resolve().then(() => (init_vault_decrypt(), vault_decrypt_exports)).then((m) => ({
+    runner: m.run,
+    description: "Decrypt from vault"
+  })),
+  "vault.rekey": () => Promise.resolve().then(() => (init_vault_rekey(), vault_rekey_exports)).then((m) => ({
+    runner: m.run,
+    description: "Rotate keys"
+  })),
+  "vault.status": () => Promise.resolve().then(() => (init_vault_status(), vault_status_exports)).then((m) => ({
+    runner: m.run,
+    description: "Vault status"
+  })),
+  "vault.diff": () => Promise.resolve().then(() => (init_vault_diff(), vault_diff_exports)).then((m) => ({
+    runner: m.run,
+    description: "Compare vs vault"
+  })),
+  "vault.verify": () => Promise.resolve().then(() => (init_vault_verify(), vault_verify_exports)).then((m) => ({
+    runner: m.run,
+    description: "Verify integrity"
+  })),
   // Environment subcommands
-  "envs.list": () => Promise.resolve().then(() => (init_envs_list(), envs_list_exports)).then((m) => ({ runner: m.run, description: "List environments" })),
-  "envs.compare": () => Promise.resolve().then(() => (init_envs_compare(), envs_compare_exports)).then((m) => ({ runner: m.run, description: "Compare envs" })),
-  "envs.validate": () => Promise.resolve().then(() => (init_envs_validate(), envs_validate_exports)).then((m) => ({ runner: m.run, description: "Validate envs" })),
-  "envs.create": () => Promise.resolve().then(() => (init_envs_create(), envs_create_exports)).then((m) => ({ runner: m.run, description: "Create environment" })),
-  "envs.switch": () => Promise.resolve().then(() => (init_envs_switch(), envs_switch_exports)).then((m) => ({ runner: m.run, description: "Switch environment" })),
+  "envs.list": () => Promise.resolve().then(() => (init_envs_list(), envs_list_exports)).then((m) => ({
+    runner: m.run,
+    description: "List environments"
+  })),
+  "envs.compare": () => Promise.resolve().then(() => (init_envs_compare(), envs_compare_exports)).then((m) => ({
+    runner: m.run,
+    description: "Compare envs"
+  })),
+  "envs.validate": () => Promise.resolve().then(() => (init_envs_validate(), envs_validate_exports)).then((m) => ({
+    runner: m.run,
+    description: "Validate envs"
+  })),
+  "envs.create": () => Promise.resolve().then(() => (init_envs_create(), envs_create_exports)).then((m) => ({
+    runner: m.run,
+    description: "Create environment"
+  })),
+  "envs.switch": () => Promise.resolve().then(() => (init_envs_switch(), envs_switch_exports)).then((m) => ({
+    runner: m.run,
+    description: "Switch environment"
+  })),
   // CI subcommands
-  "ci.validate": () => Promise.resolve().then(() => (init_ci_validate(), ci_validate_exports)).then((m) => ({ runner: m.run, description: "CI validate" })),
-  "ci.check-sync": () => Promise.resolve().then(() => (init_ci_check_sync(), ci_check_sync_exports)).then((m) => ({ runner: m.run, description: "CI sync check" })),
+  "ci.validate": () => Promise.resolve().then(() => (init_ci_validate(), ci_validate_exports)).then((m) => ({
+    runner: m.run,
+    description: "CI validate"
+  })),
+  "ci.check-sync": () => Promise.resolve().then(() => (init_ci_check_sync(), ci_check_sync_exports)).then((m) => ({
+    runner: m.run,
+    description: "CI sync check"
+  })),
   "ci.scan": () => Promise.resolve().then(() => (init_ci_scan(), ci_scan_exports)).then((m) => ({ runner: m.run, description: "CI scan" })),
   "ci.setup": () => Promise.resolve().then(() => (init_ci_setup(), ci_setup_exports)).then((m) => ({ runner: m.run, description: "CI setup" })),
   // Utility commands
-  "install-hook": () => Promise.resolve().then(() => (init_install_hook(), install_hook_exports)).then((m) => ({ runner: m.run, description: "Install git hook" })),
-  "doctor": () => Promise.resolve().then(() => (init_doctor(), doctor_exports)).then((m) => ({ runner: m.run, description: "Self-check" })),
-  "completion": () => Promise.resolve().then(() => (init_completion(), completion_exports)).then((m) => ({ runner: m.run, description: "Shell completions" })),
-  "help": () => Promise.resolve().then(() => (init_help(), help_exports)).then((m) => ({ runner: m.run, description: "Show help" }))
+  "install-hook": () => Promise.resolve().then(() => (init_install_hook(), install_hook_exports)).then((m) => ({
+    runner: m.run,
+    description: "Install git hook"
+  })),
+  doctor: () => Promise.resolve().then(() => (init_doctor(), doctor_exports)).then((m) => ({ runner: m.run, description: "Self-check" })),
+  completion: () => Promise.resolve().then(() => (init_completion(), completion_exports)).then((m) => ({
+    runner: m.run,
+    description: "Shell completions"
+  })),
+  help: () => Promise.resolve().then(() => (init_help(), help_exports)).then((m) => ({ runner: m.run, description: "Show help" }))
 };
 function handleVersion() {
   writeLine(`ultraenv v${VERSION}`);
@@ -9129,14 +9183,28 @@ async function run28(argv) {
       const helpCmd2 = COMMAND_REGISTRY["help"];
       if (helpCmd2) {
         const entry = await helpCmd2();
-        return entry.runner(args, { config: config2.config, cwd: config2.cwd, colorEnabled: true, debug: config2.debug, quiet: config2.quiet, outputFormat: config2.outputFormat });
+        return entry.runner(args, {
+          config: config2.config,
+          cwd: config2.cwd,
+          colorEnabled: true,
+          debug: config2.debug,
+          quiet: config2.quiet,
+          outputFormat: config2.outputFormat
+        });
       }
       return 1;
     }
     const helpCmd = COMMAND_REGISTRY["help"];
     if (helpCmd) {
       const entry = await helpCmd();
-      return entry.runner(args, { config: config2.config, cwd: config2.cwd, colorEnabled: true, debug: config2.debug, quiet: config2.quiet, outputFormat: config2.outputFormat });
+      return entry.runner(args, {
+        config: config2.config,
+        cwd: config2.cwd,
+        colorEnabled: true,
+        debug: config2.debug,
+        quiet: config2.quiet,
+        outputFormat: config2.outputFormat
+      });
     }
     return 1;
   }
@@ -9176,12 +9244,18 @@ async function run28(argv) {
   } catch (error) {
     if (error instanceof UltraenvError) {
       if (outputFormat === "json") {
-        writeError(JSON.stringify({
-          error: true,
-          code: error.code,
-          message: error.message,
-          hint: error.hint
-        }, null, 2));
+        writeError(
+          JSON.stringify(
+            {
+              error: true,
+              code: error.code,
+              message: error.message,
+              hint: error.hint
+            },
+            null,
+            2
+          )
+        );
       } else {
         writeError("");
         writeError(red(bold(`  [${error.code}] ${error.message}`)));
@@ -9194,10 +9268,16 @@ async function run28(argv) {
       return 1;
     }
     if (outputFormat === "json") {
-      writeError(JSON.stringify({
-        error: true,
-        message: error instanceof Error ? error.message : String(error)
-      }, null, 2));
+      writeError(
+        JSON.stringify(
+          {
+            error: true,
+            message: error instanceof Error ? error.message : String(error)
+          },
+          null,
+          2
+        )
+      );
     } else {
       writeError("");
       writeError(red(bold("  Unexpected error:")));