@keynv/cli 0.1.0-rc.10 → 0.1.0-rc.12

package/dist/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import 'crypto';
+import { randomBytes } from 'crypto';
 import { readFileSync, existsSync, statSync, writeFileSync, unlinkSync, mkdirSync, rmSync, readdirSync } from 'fs';
-import { homedir } from 'os';
-import { isAbsolute, resolve, join, dirname, basename } from 'path';
+import { hostname, platform, homedir } from 'os';
+import { relative, isAbsolute, resolve, join, dirname, basename } from 'path';
 import { Entry } from '@napi-rs/keyring';
 import { styleText } from 'util';
 import j2, { stdin, stdout } from 'process';
@@ -579,16 +579,16 @@ var require_lib = __commonJS({
     }
     var TypeAssertionError = class extends Error {
       constructor({ errors } = {}) {
-        let errorMessage = `Type mismatch`;
+        let errorMessage2 = `Type mismatch`;
         if (errors && errors.length > 0) {
-          errorMessage += `
+          errorMessage2 += `
 `;
           for (const error of errors) {
-            errorMessage += `
+            errorMessage2 += `
 - ${error}`;
           }
         }
-        super(errorMessage);
+        super(errorMessage2);
       }
     };
     function assert(val, validator) {
@@ -1056,7 +1056,7 @@ var require_lib = __commonJS({
 var VERSION, AGENT;
 var init_version = __esm({
   "src/version.ts"() {
-    VERSION = "0.1.0-rc.10" ;
+    VERSION = "0.1.0-rc.12" ;
     AGENT = `keynv-cli/${VERSION}`;
   }
 });
@@ -1146,10 +1146,10 @@ var init_parser = __esm({
   "../../packages/core/dist/reference/parser.js"() {
     PROJECT_RE = /^[a-z0-9][a-z0-9-]{0,47}$/;
     ENV_RE = /^[a-z0-9][a-z0-9-]{0,23}$/;
-    KEY_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+    KEY_RE = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
     TRAILING_BOUNDARY = "(?!\\w|\\.[a-z0-9])";
-    TEXT_FIND_SOURCE = `(?<![\\w.@/])@[a-z0-9][a-z0-9-]{0,47}\\.[a-z0-9][a-z0-9-]{0,23}\\.[a-z0-9][a-z0-9_-]{0,63}${TRAILING_BOUNDARY}`;
-    ARGV_FIND_SOURCE = `@[a-z0-9][a-z0-9-]{0,47}\\.[a-z0-9][a-z0-9-]{0,23}\\.[a-z0-9][a-z0-9_-]{0,63}${TRAILING_BOUNDARY}`;
+    TEXT_FIND_SOURCE = `(?<![\\w.@/])@[a-z0-9][a-z0-9-]{0,47}\\.[a-z0-9][a-z0-9-]{0,23}\\.[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}${TRAILING_BOUNDARY}`;
+    ARGV_FIND_SOURCE = `@[a-z0-9][a-z0-9-]{0,47}\\.[a-z0-9][a-z0-9-]{0,23}\\.[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}${TRAILING_BOUNDARY}`;
     TEXT_FIND_RE = new RegExp(TEXT_FIND_SOURCE, "g");
     ARGV_FIND_RE = new RegExp(ARGV_FIND_SOURCE, "g");
   }
@@ -1695,15 +1695,15 @@ var init_parseUtil = __esm({
           message: issueData.message
         };
       }
-      let errorMessage = "";
+      let errorMessage2 = "";
       const maps = errorMaps.filter((m) => !!m).slice().reverse();
       for (const map of maps) {
-        errorMessage = map(fullIssue, { data, defaultError: errorMessage }).message;
+        errorMessage2 = map(fullIssue, { data, defaultError: errorMessage2 }).message;
       }
       return {
         ...issueData,
         path: fullPath,
-        message: errorMessage
+        message: errorMessage2
       };
     };
     EMPTY_PATH = [];
@@ -5536,7 +5536,15 @@ function clearCredentialsFile() {
   if (existsSync(legacy)) rmSync(legacy, { force: true });
   try {
     entry().deletePassword();
-  } catch {
+    return true;
+  } catch (err) {
+    process.stderr.write(
+      `keynv: warning \u2014 could not remove OS keychain entry (${err instanceof Error ? err.message : String(err)}).
+  You may need to remove the '${SERVICE}' / '${KEY_ACCOUNT}' entry manually
+  via your OS credential manager (Windows Credential Manager, macOS Keychain, or libsecret).
+`
+    );
+    return false;
   }
 }
 var SERVICE, KEY_ACCOUNT;
@@ -5579,8 +5587,9 @@ async function saveCredentials(creds) {
   cache = creds;
 }
 function clearCredentials() {
-  clearCredentialsFile();
+  const ok = clearCredentialsFile();
   cache = null;
+  return ok;
 }
 var cache;
 var init_store = __esm({
@@ -5604,6 +5613,7 @@ function buildUrl(base, path, query) {
   return url.toString();
 }
 async function tryRefresh(creds) {
+  if (creds.auth_kind === "cli_token" || creds.refresh_token.length === 0) return null;
   const res = await fetch(buildUrl(creds.server_url, "/v1/auth/refresh"), {
     method: "POST",
     headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
@@ -5722,6 +5732,21 @@ var init_format = __esm({
   "src/ui/format.ts"() {
   }
 });
+function walkUp(startDir, predicate) {
+  let dir = resolve(startDir);
+  for (let i = 0; i < 64; i++) {
+    const result = predicate(dir);
+    if (result !== null && result !== void 0) return result;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+var init_fs = __esm({
+  "src/util/fs.ts"() {
+  }
+});
 function parseEnvFile(content, filename) {
   const normalized = content.charCodeAt(0) === 65279 ? content.slice(1) : content;
   const lines = normalized.split(/\r?\n/);
@@ -5748,7 +5773,7 @@ function parseEnvFile(content, filename) {
         `invalid key '${name}' (must match /^[A-Za-z_][A-Za-z0-9_]*$/)`
       );
     }
-    let valueRaw = body.slice(eq + 1);
+    const valueRaw = body.slice(eq + 1);
     let value;
     const valueLeading = valueRaw.replace(/^\s+/, "");
     const firstCh = valueLeading.charAt(0);
@@ -5780,20 +5805,14 @@ function parseEnvFile(content, filename) {
   return entries;
 }
 function findEnvFile(startDir) {
-  let dir = resolve(startDir);
-  for (let i = 0; i < 64; i++) {
+  return walkUp(startDir, (dir) => {
     const candidate = join(dir, ENV_FILE_BASENAME);
-    if (existsSync(candidate)) {
-      try {
-        if (statSync(candidate).isFile()) return candidate;
-      } catch {
-      }
+    try {
+      if (statSync(candidate).isFile()) return candidate;
+    } catch {
     }
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-  return null;
+    return null;
+  });
 }
 function loadEnvFile(opts) {
   if (opts.disabled) return null;
@@ -5818,6 +5837,7 @@ var MAX_FILE_BYTES, KEY_RE2, ENV_FILE_BASENAME, EnvFileParseError, EnvFileNotFou
 var init_envFile = __esm({
   "src/exec/envFile.ts"() {
     init_dist();
+    init_fs();
     MAX_FILE_BYTES = 1e6;
     KEY_RE2 = /^[A-Za-z_][A-Za-z0-9_]*$/;
     ENV_FILE_BASENAME = ".keynv.env";
@@ -5854,16 +5874,129 @@ var init_envFile = __esm({
   }
 });
 
-// src/ui/helpers/tty.ts
-var tty_exports = {};
-__export(tty_exports, {
-  isInteractive: () => isInteractive
-});
-function isInteractive() {
-  return process.stdin.isTTY === true && process.stdout.isTTY === true;
+// src/init/heuristics.ts
+function shannonEntropyBits(s) {
+  if (s.length === 0) return 0;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let h2 = 0;
+  for (const c2 of counts.values()) {
+    const p2 = c2 / s.length;
+    h2 -= p2 * Math.log2(p2);
+  }
+  return h2;
 }
-var init_tty = __esm({
-  "src/ui/helpers/tty.ts"() {
+function nameMatchesLiteralPrefix(name) {
+  const upper = name.toUpperCase();
+  return NAME_LITERAL_PREFIX.some((p2) => upper.startsWith(p2));
+}
+function nameMatchesSecretSuffix(name) {
+  const upper = name.toUpperCase();
+  for (const { suffix, hint } of NAME_SECRET_SUFFIXES) {
+    if (upper.endsWith(suffix) || upper.endsWith(`_${suffix}`)) {
+      return { matched: true, hint };
+    }
+  }
+  return { matched: false, hint: "" };
+}
+function classifyEntry(name, value) {
+  const upper = name.toUpperCase();
+  if (NAME_FRAMEWORK_MANAGED.has(upper)) {
+    return { verdict: "skip", hint: "framework/shell-managed" };
+  }
+  if (NAME_LITERAL_EXACT.has(upper)) {
+    return { verdict: "literal", hint: "common config var" };
+  }
+  if (nameMatchesLiteralPrefix(name)) {
+    return { verdict: "literal", hint: "public env, build-time bundled" };
+  }
+  if (value.length === 0) {
+    return { verdict: "literal", hint: "empty" };
+  }
+  for (const { re, hint } of VALUE_PATTERNS) {
+    if (re.test(value)) return { verdict: "secret", hint };
+  }
+  const suffix = nameMatchesSecretSuffix(name);
+  if (suffix.matched) {
+    return { verdict: "secret", hint: suffix.hint };
+  }
+  if (NAME_DB_URL.test(name)) {
+    return { verdict: "secret", hint: "database URL" };
+  }
+  if (value.length >= 32) {
+    const bits = shannonEntropyBits(value);
+    if (bits >= 3.5) {
+      return { verdict: "secret", hint: `${value.length}-char random-looking string` };
+    }
+  }
+  return { verdict: "ambiguous", hint: "" };
+}
+function previewValue(value, max = 40) {
+  if (value.length === 0) return "(empty)";
+  if (value.length <= max) return value;
+  return `${value.slice(0, max - 1)}\u2026`;
+}
+var NAME_FRAMEWORK_MANAGED, NAME_LITERAL_EXACT, NAME_LITERAL_PREFIX, NAME_SECRET_SUFFIXES, NAME_DB_URL, VALUE_PATTERNS;
+var init_heuristics = __esm({
+  "src/init/heuristics.ts"() {
+    NAME_FRAMEWORK_MANAGED = /* @__PURE__ */ new Set([
+      "NODE_ENV",
+      "PORT",
+      "HOST",
+      "HOSTNAME",
+      "PATH",
+      "HOME",
+      "USER",
+      "SHELL",
+      "PWD",
+      "CI"
+    ]);
+    NAME_LITERAL_EXACT = /* @__PURE__ */ new Set([
+      "DEBUG",
+      "LOG_LEVEL",
+      "LOGLEVEL",
+      "TZ",
+      "LANG",
+      "LC_ALL",
+      "NODE_OPTIONS",
+      "NPM_CONFIG_LOGLEVEL",
+      "TS_NODE_PROJECT"
+    ]);
+    NAME_LITERAL_PREFIX = ["NEXT_PUBLIC_", "VITE_", "REACT_APP_", "PUBLIC_", "EXPO_PUBLIC_"];
+    NAME_SECRET_SUFFIXES = [
+      { suffix: "PRIVATE_KEY", hint: "private key" },
+      { suffix: "API_KEY", hint: "API key" },
+      { suffix: "ACCESS_KEY", hint: "access key" },
+      { suffix: "SECRET_KEY", hint: "secret key" },
+      { suffix: "SECRET", hint: "secret" },
+      { suffix: "PASSWORD", hint: "password" },
+      { suffix: "PASSPHRASE", hint: "passphrase" },
+      { suffix: "TOKEN", hint: "token" },
+      { suffix: "KEY", hint: "key" },
+      { suffix: "CREDENTIALS", hint: "credentials" },
+      { suffix: "AUTH", hint: "auth" },
+      { suffix: "DSN", hint: "connection string" }
+    ];
+    NAME_DB_URL = /^(DATABASE|DB|POSTGRES|MYSQL|MONGO|REDIS)_URL$/i;
+    VALUE_PATTERNS = [
+      { re: /^sk-proj-/, hint: "OpenAI project key" },
+      { re: /^sk-[A-Za-z0-9]{20,}/, hint: "OpenAI key" },
+      { re: /^sk_live_/, hint: "Stripe live key" },
+      { re: /^sk_test_/, hint: "Stripe test key" },
+      { re: /^pk_live_/, hint: "Stripe publishable \u2014 often public, double-check" },
+      { re: /^xoxb-/, hint: "Slack bot token" },
+      { re: /^xoxp-/, hint: "Slack user token" },
+      { re: /^ghp_[A-Za-z0-9]{30,}/, hint: "GitHub personal access token" },
+      { re: /^github_pat_/, hint: "GitHub fine-grained PAT" },
+      { re: /^gho_/, hint: "GitHub OAuth token" },
+      { re: /^AKIA[0-9A-Z]{16}$/, hint: "AWS access key id" },
+      { re: /^ASIA[0-9A-Z]{16}$/, hint: "AWS temporary key id" },
+      { re: /^AIza[0-9A-Za-z_-]{35}$/, hint: "Google API key" },
+      { re: /^ya29\./, hint: "Google OAuth access token" },
+      { re: /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, hint: "JWT" },
+      { re: /^-----BEGIN [A-Z ]+PRIVATE KEY-----/, hint: "PEM private key" },
+      { re: /^([a-z]+):\/\/[^@]+:[^@]+@/i, hint: "connection string with credentials" }
+    ];
   }
 });
 
@@ -7021,23 +7154,109 @@ ${c2}
     } }).prompt();
   }
 });
+function aiContextBody() {
+  return `## keynv (secrets)
+
+This project uses [keynv](https://keynv.dev) for secrets. There is a \`.keynv.env\` file at the project root containing **alias references** like \`OPENAI_API_KEY=@projectname.dev.openai-key\` \u2014 these are NOT real values, they are references to secrets stored in the keynv vault.
+
+### Mental model
+
+- **\`.keynv.env\`** \u2014 checked into git, contains aliases. Safe to read, edit, commit.
+- **Vault** \u2014 holds the real values. The \`keynv\` CLI reads it on demand.
+- **\`keynv exec -- <command>\`** \u2014 forks the command in a subprocess where the real values are injected into env vars. The parent process (where you, the AI agent, run) NEVER sees the real values.
+- **Redactor** \u2014 pipes subprocess stdout/stderr through a masker before they reach this terminal. Even if a script accidentally echoes a secret, you see \`<REDACTED:...>\` here.
+
+### What you should do
+
+When the user asks about secrets or env vars, follow this decision tree:
+
+| User intent | Run / suggest |
+|---|---|
+| "Add a new API key" / "set up a secret" | \`keynv secret create\` (interactive prompt picks project + env + key) |
+| "I have a \`.env\`, migrate it" | \`keynv init\` (you're seeing this file because that already happened) |
+| "Run the app / dev server / tests" | \`keynv exec -- <their existing command>\` (auto-loads \`.keynv.env\`) |
+| "Show me the value of X" | \`keynv secret get @alias\` \u2014 but copy to clipboard, do NOT print the value into chat / terminal |
+| "Rotate this key" | \`keynv secret rotate @alias\` |
+| "Add a new env var to the project" | Edit \`.keynv.env\` and add \`NAME=@project.env.key\` (after creating the secret with \`keynv secret create\`) |
+| "Who has access?" | \`keynv member list <project>\` |
+
+### Hard rules \u2014 do not violate
+
+1. **Never print resolved secret values** to the chat, terminal, log, or any file. The user's editor / scrollback / chat history is an attack surface.
+2. **Never write a \`.env\` file** (or any file) containing real secret values. The whole point of keynv is that those don't exist on disk.
+3. **Never edit \`.keynv.env\` to substitute resolved values for aliases.** The file should only ever contain \`@project.env.key\` references and plain non-secret literals.
+4. **Use \`keynv exec --\` to run commands that need env vars.** Don't try to load \`.keynv.env\` yourself by parsing it manually; the wrapper handles resolution + redaction + subprocess isolation.
+5. **If a tool fails with "blocked by keynv-guard" or similar**, do NOT try to work around it. Tell the user \u2014 that's a sign of a misconfiguration, not an obstacle to bypass.
+6. **Treat the alias literal (\`@project.env.key\`) as the canonical reference**, never the resolved value. When you write code, configs, or commands that need a secret, write the alias.
+
+### Quick reference
+
+\`\`\`bash
+keynv                       # interactive TUI menu (pick projects, secrets, members)
+keynv exec -- <cmd>         # run cmd with .keynv.env loaded
+keynv secret create         # walk through creating a new secret
+keynv secret list <project> # list aliases (no values)
+keynv whoami                # who am I logged in as
+keynv --help                # full command list
+\`\`\`
+
+If \`.keynv.env\` is missing or empty, the user probably hasn't run \`keynv init\` yet \u2014 suggest they do so before they paste a secret into a \`.env\`.`;
+}
+function renderKeynvBlock() {
+  return `${KEYNV_BLOCK_START}
+${aiContextBody()}
+${KEYNV_BLOCK_END}`;
+}
+function writeAiContext(rootPath) {
+  const path = join(rootPath, AGENTS_FILE_BASENAME);
+  const block = renderKeynvBlock();
+  if (!existsSync(path)) {
+    const initial = `# Agent guidance for this project
+
+${block}
+`;
+    writeFileSync(path, initial);
+    return "created";
+  }
+  const existing = readFileSync(path, "utf8");
+  const startIdx = existing.indexOf(KEYNV_BLOCK_START);
+  const endIdx = existing.indexOf(KEYNV_BLOCK_END);
+  if (startIdx >= 0 && endIdx > startIdx) {
+    const before = existing.slice(0, startIdx);
+    const after = existing.slice(endIdx + KEYNV_BLOCK_END.length);
+    const next = `${before}${block}${after}`;
+    if (next === existing) return "unchanged";
+    writeFileSync(path, next);
+    return "updated";
+  }
+  const sep = existing.length === 0 ? "" : existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+  const trailingNewline = existing.endsWith("\n") ? "" : "\n";
+  writeFileSync(path, `${existing}${trailingNewline}${sep}${block}
+`);
+  return "appended";
+}
+var AGENTS_FILE_BASENAME, KEYNV_BLOCK_START, KEYNV_BLOCK_END;
+var init_aiContext = __esm({
+  "src/init/aiContext.ts"() {
+    AGENTS_FILE_BASENAME = "AGENTS.md";
+    KEYNV_BLOCK_START = "<!-- keynv:start -- generated by `keynv init`; safe to leave intact, will be refreshed on re-run -->";
+    KEYNV_BLOCK_END = "<!-- keynv:end -->";
+  }
+});
 function findProjectRoot(startDir) {
-  let dir = resolve(startDir);
-  for (let i = 0; i < 64; i++) {
+  const result = walkUp(startDir, (dir) => {
     for (const marker of PROJECT_MARKERS) {
-      const candidate = join(dir, marker);
-      if (existsSync(candidate)) {
-        return buildRoot(dir, marker);
+      if (existsSync(join(dir, marker))) {
+        return { dir, marker };
       }
     }
     if (existsSync(join(dir, GIT_MARKER))) {
-      return buildRoot(dir, GIT_MARKER);
+      return { dir, marker: GIT_MARKER };
     }
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-  return null;
+    return null;
+  });
+  if (!result) return null;
+  return buildRoot(result.dir, result.marker);
 }
 function buildRoot(dir, marker) {
   let suggestedName = basename(dir);
@@ -7051,16 +7270,20 @@ function buildRoot(dir, marker) {
       }
       if (pkg.scripts && typeof pkg.scripts === "object") {
         scripts = Object.fromEntries(
-          Object.entries(pkg.scripts).filter(
-            ([, v2]) => typeof v2 === "string"
-          )
+          Object.entries(pkg.scripts).filter(([, v2]) => typeof v2 === "string")
         );
       }
     } catch {
       invalid = true;
     }
   }
-  return { path: dir, suggestedName, marker, packageJsonScripts: scripts, packageJsonInvalid: invalid };
+  return {
+    path: dir,
+    suggestedName,
+    marker,
+    packageJsonScripts: scripts,
+    packageJsonInvalid: invalid
+  };
 }
 function findEnvFiles(rootDir) {
   let entries;
@@ -7118,6 +7341,7 @@ function hasExistingKeynvEnv(rootDir) {
 var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME;
 var init_detect = __esm({
   "src/init/detect.ts"() {
+    init_fs();
     PROJECT_MARKERS = [
       "package.json",
       "pyproject.toml",
@@ -7134,221 +7358,6 @@ var init_detect = __esm({
     KEYNV_ENV_BASENAME = ".keynv.env";
   }
 });
-function aiContextBody() {
-  return `## keynv (secrets)
-
-This project uses [keynv](https://keynv.dev) for secrets. There is a \`.keynv.env\` file at the project root containing **alias references** like \`OPENAI_API_KEY=@projectname.dev.openai-key\` \u2014 these are NOT real values, they are references to secrets stored in the keynv vault.
-
-### Mental model
-
-- **\`.keynv.env\`** \u2014 checked into git, contains aliases. Safe to read, edit, commit.
-- **Vault** \u2014 holds the real values. The \`keynv\` CLI reads it on demand.
-- **\`keynv exec -- <command>\`** \u2014 forks the command in a subprocess where the real values are injected into env vars. The parent process (where you, the AI agent, run) NEVER sees the real values.
-- **Redactor** \u2014 pipes subprocess stdout/stderr through a masker before they reach this terminal. Even if a script accidentally echoes a secret, you see \`<REDACTED:...>\` here.
-
-### What you should do
-
-When the user asks about secrets or env vars, follow this decision tree:
-
-| User intent | Run / suggest |
-|---|---|
-| "Add a new API key" / "set up a secret" | \`keynv secret create\` (interactive prompt picks project + env + key) |
-| "I have a \`.env\`, migrate it" | \`keynv init\` (you're seeing this file because that already happened) |
-| "Run the app / dev server / tests" | \`keynv exec -- <their existing command>\` (auto-loads \`.keynv.env\`) |
-| "Show me the value of X" | \`keynv secret get @alias\` \u2014 but copy to clipboard, do NOT print the value into chat / terminal |
-| "Rotate this key" | \`keynv secret rotate @alias\` |
-| "Add a new env var to the project" | Edit \`.keynv.env\` and add \`NAME=@project.env.key\` (after creating the secret with \`keynv secret create\`) |
-| "Who has access?" | \`keynv member list <project>\` |
-
-### Hard rules \u2014 do not violate
-
-1. **Never print resolved secret values** to the chat, terminal, log, or any file. The user's editor / scrollback / chat history is an attack surface.
-2. **Never write a \`.env\` file** (or any file) containing real secret values. The whole point of keynv is that those don't exist on disk.
-3. **Never edit \`.keynv.env\` to substitute resolved values for aliases.** The file should only ever contain \`@project.env.key\` references and plain non-secret literals.
-4. **Use \`keynv exec --\` to run commands that need env vars.** Don't try to load \`.keynv.env\` yourself by parsing it manually; the wrapper handles resolution + redaction + subprocess isolation.
-5. **If a tool fails with "blocked by keynv-guard" or similar**, do NOT try to work around it. Tell the user \u2014 that's a sign of a misconfiguration, not an obstacle to bypass.
-6. **Treat the alias literal (\`@project.env.key\`) as the canonical reference**, never the resolved value. When you write code, configs, or commands that need a secret, write the alias.
-
-### Quick reference
-
-\`\`\`bash
-keynv                       # interactive TUI menu (pick projects, secrets, members)
-keynv exec -- <cmd>         # run cmd with .keynv.env loaded
-keynv secret create         # walk through creating a new secret
-keynv secret list <project> # list aliases (no values)
-keynv whoami                # who am I logged in as
-keynv --help                # full command list
-\`\`\`
-
-If \`.keynv.env\` is missing or empty, the user probably hasn't run \`keynv init\` yet \u2014 suggest they do so before they paste a secret into a \`.env\`.`;
-}
-function renderKeynvBlock() {
-  return `${KEYNV_BLOCK_START}
-${aiContextBody()}
-${KEYNV_BLOCK_END}`;
-}
-function writeAiContext(rootPath) {
-  const path = join(rootPath, AGENTS_FILE_BASENAME);
-  const block = renderKeynvBlock();
-  if (!existsSync(path)) {
-    const initial = `# Agent guidance for this project
-
-${block}
-`;
-    writeFileSync(path, initial);
-    return "created";
-  }
-  const existing = readFileSync(path, "utf8");
-  const startIdx = existing.indexOf(KEYNV_BLOCK_START);
-  const endIdx = existing.indexOf(KEYNV_BLOCK_END);
-  if (startIdx >= 0 && endIdx > startIdx) {
-    const before = existing.slice(0, startIdx);
-    const after = existing.slice(endIdx + KEYNV_BLOCK_END.length);
-    const next = `${before}${block}${after}`;
-    if (next === existing) return "unchanged";
-    writeFileSync(path, next);
-    return "updated";
-  }
-  const sep = existing.length === 0 ? "" : existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
-  const trailingNewline = existing.endsWith("\n") ? "" : "\n";
-  writeFileSync(path, `${existing}${trailingNewline}${sep}${block}
-`);
-  return "appended";
-}
-var AGENTS_FILE_BASENAME, KEYNV_BLOCK_START, KEYNV_BLOCK_END;
-var init_aiContext = __esm({
-  "src/init/aiContext.ts"() {
-    AGENTS_FILE_BASENAME = "AGENTS.md";
-    KEYNV_BLOCK_START = "<!-- keynv:start -- generated by `keynv init`; safe to leave intact, will be refreshed on re-run -->";
-    KEYNV_BLOCK_END = "<!-- keynv:end -->";
-  }
-});
-
-// src/init/heuristics.ts
-function shannonEntropyBits(s) {
-  if (s.length === 0) return 0;
-  const counts = /* @__PURE__ */ new Map();
-  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
-  let h2 = 0;
-  for (const c2 of counts.values()) {
-    const p2 = c2 / s.length;
-    h2 -= p2 * Math.log2(p2);
-  }
-  return h2;
-}
-function nameMatchesLiteralPrefix(name) {
-  const upper = name.toUpperCase();
-  return NAME_LITERAL_PREFIX.some((p2) => upper.startsWith(p2));
-}
-function nameMatchesSecretSuffix(name) {
-  const upper = name.toUpperCase();
-  for (const { suffix, hint } of NAME_SECRET_SUFFIXES) {
-    if (upper.endsWith(suffix) || upper.endsWith(`_${suffix}`)) {
-      return { matched: true, hint };
-    }
-  }
-  return { matched: false, hint: "" };
-}
-function classifyEntry(name, value) {
-  const upper = name.toUpperCase();
-  if (NAME_FRAMEWORK_MANAGED.has(upper)) {
-    return { verdict: "skip", hint: "framework/shell-managed" };
-  }
-  if (NAME_LITERAL_EXACT.has(upper)) {
-    return { verdict: "literal", hint: "common config var" };
-  }
-  if (nameMatchesLiteralPrefix(name)) {
-    return { verdict: "literal", hint: "public env, build-time bundled" };
-  }
-  if (value.length === 0) {
-    return { verdict: "literal", hint: "empty" };
-  }
-  for (const { re, hint } of VALUE_PATTERNS) {
-    if (re.test(value)) return { verdict: "secret", hint };
-  }
-  const suffix = nameMatchesSecretSuffix(name);
-  if (suffix.matched) {
-    return { verdict: "secret", hint: suffix.hint };
-  }
-  if (NAME_DB_URL.test(name)) {
-    return { verdict: "secret", hint: "database URL" };
-  }
-  if (value.length >= 32) {
-    const bits = shannonEntropyBits(value);
-    if (bits >= 3.5) {
-      return { verdict: "secret", hint: `${value.length}-char random-looking string` };
-    }
-  }
-  return { verdict: "ambiguous", hint: "" };
-}
-function previewValue(value, max = 40) {
-  if (value.length === 0) return "(empty)";
-  if (value.length <= max) return value;
-  return `${value.slice(0, max - 1)}\u2026`;
-}
-var NAME_FRAMEWORK_MANAGED, NAME_LITERAL_EXACT, NAME_LITERAL_PREFIX, NAME_SECRET_SUFFIXES, NAME_DB_URL, VALUE_PATTERNS;
-var init_heuristics = __esm({
-  "src/init/heuristics.ts"() {
-    NAME_FRAMEWORK_MANAGED = /* @__PURE__ */ new Set([
-      "NODE_ENV",
-      "PORT",
-      "HOST",
-      "HOSTNAME",
-      "PATH",
-      "HOME",
-      "USER",
-      "SHELL",
-      "PWD",
-      "CI"
-    ]);
-    NAME_LITERAL_EXACT = /* @__PURE__ */ new Set([
-      "DEBUG",
-      "LOG_LEVEL",
-      "LOGLEVEL",
-      "TZ",
-      "LANG",
-      "LC_ALL",
-      "NODE_OPTIONS",
-      "NPM_CONFIG_LOGLEVEL",
-      "TS_NODE_PROJECT"
-    ]);
-    NAME_LITERAL_PREFIX = ["NEXT_PUBLIC_", "VITE_", "REACT_APP_", "PUBLIC_", "EXPO_PUBLIC_"];
-    NAME_SECRET_SUFFIXES = [
-      { suffix: "PRIVATE_KEY", hint: "private key" },
-      { suffix: "API_KEY", hint: "API key" },
-      { suffix: "ACCESS_KEY", hint: "access key" },
-      { suffix: "SECRET_KEY", hint: "secret key" },
-      { suffix: "SECRET", hint: "secret" },
-      { suffix: "PASSWORD", hint: "password" },
-      { suffix: "PASSPHRASE", hint: "passphrase" },
-      { suffix: "TOKEN", hint: "token" },
-      { suffix: "KEY", hint: "key" },
-      { suffix: "CREDENTIALS", hint: "credentials" },
-      { suffix: "AUTH", hint: "auth" },
-      { suffix: "DSN", hint: "connection string" }
-    ];
-    NAME_DB_URL = /^(DATABASE|DB|POSTGRES|MYSQL|MONGO|REDIS)_URL$/i;
-    VALUE_PATTERNS = [
-      { re: /^sk-proj-/, hint: "OpenAI project key" },
-      { re: /^sk-[A-Za-z0-9]{20,}/, hint: "OpenAI key" },
-      { re: /^sk_live_/, hint: "Stripe live key" },
-      { re: /^sk_test_/, hint: "Stripe test key" },
-      { re: /^pk_live_/, hint: "Stripe publishable \u2014 often public, double-check" },
-      { re: /^xoxb-/, hint: "Slack bot token" },
-      { re: /^xoxp-/, hint: "Slack user token" },
-      { re: /^ghp_[A-Za-z0-9]{30,}/, hint: "GitHub personal access token" },
-      { re: /^github_pat_/, hint: "GitHub fine-grained PAT" },
-      { re: /^gho_/, hint: "GitHub OAuth token" },
-      { re: /^AKIA[0-9A-Z]{16}$/, hint: "AWS access key id" },
-      { re: /^ASIA[0-9A-Z]{16}$/, hint: "AWS temporary key id" },
-      { re: /^AIza[0-9A-Za-z_-]{35}$/, hint: "Google API key" },
-      { re: /^ya29\./, hint: "Google OAuth access token" },
-      { re: /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, hint: "JWT" },
-      { re: /^-----BEGIN [A-Z ]+PRIVATE KEY-----/, hint: "PEM private key" },
-      { re: /^([a-z]+):\/\/[^@]+:[^@]+@/i, hint: "connection string with credentials" }
-    ];
-  }
-});
 
 // src/init/scriptWrap.ts
 function analyzeScript(name, command) {
@@ -7641,7 +7650,9 @@ ${detail}`
   }
   const totalEntries = [...perEnv.values()].reduce((n, arr) => n + arr.length, 0);
   if (totalEntries === 0) {
-    R2.info("All env files were empty or only contained framework-managed vars. Nothing to upload.");
+    R2.info(
+      "All env files were empty or only contained framework-managed vars. Nothing to upload."
+    );
     ye("Done.");
     return { exitCode: 0 };
   }
@@ -7693,10 +7704,10 @@ ${detail}`
   const planSummary = [
     `Project:           ${projectChoice.name}${projectChoice.created ? " (will be created)" : ""}`,
     `Environments:      ${distinctEnvs.join(", ")}`,
-    `Per-env breakdown:`,
+    "Per-env breakdown:",
     perEnvCounts,
     `Script wraps:      ${scriptWrapSelection.length}`,
-    `Original .env:     delete after upload`,
+    "Original .env:     delete after upload",
     opts.dryRun ? "Dry-run: no changes will be made." : ""
   ].filter(Boolean).join("\n");
   Se(planSummary, "About to apply");
@@ -7731,7 +7742,11 @@ ${detail}`
             method: "POST",
             body: { env: env2, key: aliasKey, value: e2.value }
           });
-          const alias2 = buildAlias({ project: projectChoice.name, environment: env2, key: aliasKey });
+          const alias2 = buildAlias({
+            project: projectChoice.name,
+            environment: env2,
+            key: aliasKey
+          });
           if (alias2 === null) {
             failed.push({
               env: env2,
@@ -7753,7 +7768,9 @@ ${detail}`
     if (failed.length === 0) {
       s.stop(`Uploaded ${totalToUpload} secret${totalToUpload === 1 ? "" : "s"}`);
     } else {
-      s.error(`${totalToUpload - failed.length}/${totalToUpload} uploaded; ${failed.length} failed`);
+      s.error(
+        `${totalToUpload - failed.length}/${totalToUpload} uploaded; ${failed.length} failed`
+      );
       for (const f of failed) R2.warn(`  [${f.env}] ${f.name}: ${f.reason}`);
     }
   }
@@ -7968,7 +7985,9 @@ async function ensureProjectAndEnvs(client, projectChoice, distinctEnvs) {
         body: envBodyFor(envName)
       });
     } catch (err) {
-      s.error(`Failed to add env "${envName}": ${err instanceof Error ? err.message : String(err)}`);
+      s.error(
+        `Failed to add env "${envName}": ${err instanceof Error ? err.message : String(err)}`
+      );
       return null;
     }
   }
@@ -7987,7 +8006,8 @@ function composeKeynvEnv(opts) {
   const { uploadedAliases, literals, mergeWithExisting } = opts;
   const lines = [];
   if (mergeWithExisting !== null) {
-    const trimmed = mergeWithExisting.replace(/\n+$/, "");
+    const normalized = mergeWithExisting.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+    const trimmed = normalized.replace(/\n+$/, "");
     if (trimmed.length > 0) {
       lines.push(...trimmed.split("\n"));
       lines.push("");
@@ -8014,7 +8034,7 @@ function composeKeynvEnv(opts) {
     }
   }
   if (mergeWithExisting !== null) {
-    lines.push(`# <<< keynv init <<<`);
+    lines.push("# <<< keynv init <<<");
   }
   return lines;
 }
@@ -8035,11 +8055,11 @@ function updatePackageJsonScripts(path, originalScripts, selectedNames) {
 }
 var init_init = __esm({
   "src/ui/flows/init.ts"() {
-    init_dist();
     init_dist5();
+    init_dist();
     init_envFile();
-    init_detect();
     init_aiContext();
+    init_detect();
     init_heuristics();
     init_scriptWrap();
     init_cancel();
@@ -8047,30 +8067,122 @@ var init_init = __esm({
   }
 });
 
-// src/ui/helpers/pickSecret.ts
-async function listSecrets(client, projectId2) {
-  const data = await client.request(
-    `/v1/projects/${projectId2}/secrets`
-  );
-  return data.secrets;
+// src/ui/helpers/tty.ts
+var tty_exports = {};
+__export(tty_exports, {
+  isInteractive: () => isInteractive
+});
+function isInteractive() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true;
 }
-async function pickSecret(client, projectId2, message = "Secret:") {
-  const secrets = await listSecrets(client, projectId2);
-  if (secrets.length === 0) return null;
-  const value = await Ee({
-    message,
-    options: secrets.map((s) => ({
-      value: s.alias,
-      label: s.alias,
-      hint: `v${s.version}`
-    }))
+var init_tty = __esm({
+  "src/ui/helpers/tty.ts"() {
+  }
+});
+function sleep(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+async function errorMessage(res, fallback) {
+  const text = await res.text();
+  if (!text) return fallback;
+  try {
+    const parsed = JSON.parse(text);
+    return parsed.error?.message ?? fallback;
+  } catch {
+    return fallback;
+  }
+}
+function openBrowser(url) {
+  try {
+    const os = platform();
+    const command = os === "win32" ? "cmd" : os === "darwin" ? "open" : "xdg-open";
+    const args = os === "win32" ? ["/c", "start", "", url] : [url];
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function runBrowserAuth(serverUrl) {
+  const startRes = await fetch(new URL("/v1/auth/cli/browser/start", serverUrl).toString(), {
+    method: "POST",
+    headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
+    body: JSON.stringify({ device_name: hostname() })
   });
-  if (q(value)) return null;
-  return secrets.find((s) => s.alias === value) ?? null;
+  if (!startRes.ok) {
+    throw new BrowserAuthError(
+      await errorMessage(startRes, `Browser auth failed to start (${startRes.status}).`)
+    );
+  }
+  const start = await startRes.json();
+  const opened = openBrowser(start.verification_uri_complete);
+  if (opened) {
+    process.stderr.write(
+      `
+  Your code: ${start.user_code}
+  Complete auth in your browser, then return here.
+
+`
+    );
+  } else {
+    process.stderr.write(
+      `
+  Could not open a browser automatically.
+  Open this URL manually:
+
+    ${start.verification_uri_complete}
+
+  Your code: ${start.user_code}
+  Waiting for you to complete auth in the browser...
+
+`
+    );
+  }
+  const deadline = Date.now() + start.expires_in * 1e3;
+  const intervalMs = Math.max(1, start.interval) * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    const pollRes = await fetch(new URL("/v1/auth/cli/browser/poll", serverUrl).toString(), {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
+      body: JSON.stringify({ device_code: start.device_code })
+    });
+    if (pollRes.status === 202) continue;
+    if (!pollRes.ok) {
+      throw new BrowserAuthError(
+        await errorMessage(pollRes, `Browser auth failed (${pollRes.status}).`)
+      );
+    }
+    const data = await pollRes.json();
+    return {
+      auth_kind: "session",
+      server_url: serverUrl,
+      user_id: data.user.id,
+      email: data.user.email,
+      org_id: data.user.org_id,
+      org_role: data.user.org_role,
+      access_token: data.access_token,
+      refresh_token: data.refresh_token,
+      access_expires_at: new Date(Date.now() + data.expires_in * 1e3).toISOString()
+    };
+  }
+  throw new BrowserAuthError("Browser auth timed out. Run `keynv login` to try again.");
 }
-var init_pickSecret = __esm({
-  "src/ui/helpers/pickSecret.ts"() {
-    init_dist5();
+var BrowserAuthError;
+var init_browser_auth = __esm({
+  "src/client/browser-auth.ts"() {
+    init_version();
+    BrowserAuthError = class extends Error {
+    };
+  }
+});
+
+// src/client/defaults.ts
+var DEFAULT_SERVER_URL;
+var init_defaults = __esm({
+  "src/client/defaults.ts"() {
+    DEFAULT_SERVER_URL = "https://api.keynv.dev";
   }
 });
 
@@ -8098,6 +8210,33 @@ var init_pickEnv = __esm({
     init_dist5();
   }
 });
+
+// src/ui/helpers/pickSecret.ts
+async function listSecrets(client, projectId2) {
+  const data = await client.request(
+    `/v1/projects/${projectId2}/secrets`
+  );
+  return data.secrets;
+}
+async function pickSecret(client, projectId2, message = "Secret:") {
+  const secrets = await listSecrets(client, projectId2);
+  if (secrets.length === 0) return null;
+  const value = await Ee({
+    message,
+    options: secrets.map((s) => ({
+      value: s.alias,
+      label: s.alias,
+      hint: `v${s.version}`
+    }))
+  });
+  if (q(value)) return null;
+  return secrets.find((s) => s.alias === value) ?? null;
+}
+var init_pickSecret = __esm({
+  "src/ui/helpers/pickSecret.ts"() {
+    init_dist5();
+  }
+});
 async function runSecretsFlow(client, project) {
   let target = project;
   if (!target) {
@@ -8161,7 +8300,10 @@ async function runSecretMenu(client, project, alias2) {
       }
     } else if (choice === "rotate") {
       const newValue = unwrap(
-        await Ce({ message: "New value", validate: (v2) => v2 && v2.length ? void 0 : "required" })
+        await Ce({
+          message: "New value",
+          validate: (v2) => v2?.length ? void 0 : "required"
+        })
       );
       const data = await client.request(`${path}/rotate`, {
         method: "POST",
@@ -8169,9 +8311,7 @@ async function runSecretMenu(client, project, alias2) {
       });
       R2.success(`Rotated ${data.alias} \u2192 v${data.version}`);
     } else if (choice === "delete") {
-      const confirmed = unwrap(
-        await ue({ message: `Delete ${alias2}?`, initialValue: false })
-      );
+      const confirmed = unwrap(await ue({ message: `Delete ${alias2}?`, initialValue: false }));
       if (!confirmed) continue;
       await client.request(path, { method: "DELETE" });
       R2.success(`Deleted ${alias2}`);
@@ -8180,11 +8320,13 @@ async function runSecretMenu(client, project, alias2) {
   }
 }
 async function copyToClipboard(value) {
-  const platform = process.platform;
-  const cmd = platform === "darwin" ? ["pbcopy", []] : platform === "win32" ? ["clip", []] : ["xclip", ["-selection", "clipboard"]];
+  const platform2 = process.platform;
+  const cmd = platform2 === "darwin" ? ["pbcopy", []] : platform2 === "win32" ? ["clip", []] : ["xclip", ["-selection", "clipboard"]];
   return new Promise((resolve3) => {
     try {
-      const child = spawn(cmd[0], cmd[1], { stdio: ["pipe", "ignore", "ignore"] });
+      const child = spawn(cmd[0], cmd[1], {
+        stdio: ["pipe", "ignore", "ignore"]
+      });
       child.on("error", () => resolve3(false));
       child.on("exit", (code) => resolve3(code === 0));
       child.stdin.end(value);
@@ -8211,7 +8353,7 @@ async function promptNewSecret(client, project) {
       }),
       value: () => Ce({
         message: "Value (hidden)",
-        validate: (v2) => v2 && v2.length ? void 0 : "required"
+        validate: (v2) => v2?.length ? void 0 : "required"
       })
     },
     {
@@ -8240,8 +8382,8 @@ async function createSecretInteractive(client, project) {
 }
 var init_secret = __esm({
   "src/ui/flows/secret.ts"() {
-    init_dist();
     init_dist5();
+    init_dist();
     init_cancel();
     init_pickEnv();
     init_pickProject();
@@ -28574,7 +28716,7 @@ var require_utils_webcrypto = __commonJS({
     var nodeCrypto = __require("crypto");
     module.exports = {
       postgresMd5PasswordHash,
-      randomBytes,
+      randomBytes: randomBytes2,
       deriveKey,
       sha256,
       hashByName,
@@ -28584,7 +28726,7 @@ var require_utils_webcrypto = __commonJS({
     var webCrypto = nodeCrypto.webcrypto || globalThis.crypto;
     var subtleCrypto = webCrypto.subtle;
     var textEncoder = new TextEncoder();
-    function randomBytes(length) {
+    function randomBytes2(length) {
       return webCrypto.getRandomValues(Buffer.alloc(length));
     }
     async function md5(string) {
@@ -28980,11 +29122,11 @@ var require_pg_connection_string = __commonJS({
         config.client_encoding = result.searchParams.get("encoding");
         return config;
       }
-      const hostname = dummyHost ? "" : result.hostname;
+      const hostname2 = dummyHost ? "" : result.hostname;
       if (!config.host) {
-        config.host = decodeURIComponent(hostname);
-      } else if (hostname && /^%2f/i.test(hostname)) {
-        result.pathname = hostname + result.pathname;
+        config.host = decodeURIComponent(hostname2);
+      } else if (hostname2 && /^%2f/i.test(hostname2)) {
+        result.pathname = hostname2 + result.pathname;
       }
       if (!config.port) {
         config.port = result.port;
@@ -40090,9 +40232,9 @@ var require_cluster = __commonJS({
           }
         });
       }
-      resolveSrv(hostname) {
+      resolveSrv(hostname2) {
         return new Promise((resolve3, reject) => {
-          this.options.resolveSrv(hostname, (err, records) => {
+          this.options.resolveSrv(hostname2, (err, records) => {
             if (err) {
               return reject(err);
             }
@@ -40114,14 +40256,14 @@ var require_cluster = __commonJS({
           });
         });
       }
-      dnsLookup(hostname) {
+      dnsLookup(hostname2) {
         return new Promise((resolve3, reject) => {
-          this.options.dnsLookup(hostname, (err, address) => {
+          this.options.dnsLookup(hostname2, (err, address) => {
             if (err) {
-              debug2("failed to resolve hostname %s to IP: %s", hostname, err.message);
+              debug2("failed to resolve hostname %s to IP: %s", hostname2, err.message);
               reject(err);
             } else {
-              debug2("resolved hostname %s to IP %s", hostname, address);
+              debug2("resolved hostname %s to IP %s", hostname2, address);
               resolve3(address);
             }
           });
@@ -42446,85 +42588,27 @@ var init_audit2 = __esm({
 });
 
 // src/ui/flows/login.ts
-async function runLoginFlow(client) {
-  const answers = await he(
-    {
-      server: () => Re({
-        message: "Server URL",
-        placeholder: "http://localhost:8080",
-        defaultValue: "http://localhost:8080"
-      }),
-      email: () => Re({
-        message: "Email",
-        validate: (v2) => v2 && v2.includes("@") ? void 0 : "enter an email"
-      }),
-      password: () => Ce({
-        message: "Password",
-        validate: (v2) => v2 && v2.length >= 1 ? void 0 : "required"
-      })
-    },
-    {
-      onCancel: () => {
-        throw new UserCancelled();
-      }
-    }
-  );
-  const server = answers.server || "http://localhost:8080";
+async function runLoginFlow(client, options = {}) {
+  const server = options.server ?? DEFAULT_SERVER_URL;
   const s = ft();
-  s.start("Authenticating");
-  let res;
+  s.start("Waiting for authorization");
+  let creds;
   try {
-    res = await fetch(new URL("/v1/auth/login", server).toString(), {
-      method: "POST",
-      headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
-      body: JSON.stringify({ email: answers.email, password: answers.password })
-    });
+    creds = await runBrowserAuth(server);
   } catch (err) {
-    s.error("Network error");
-    me(err instanceof Error ? err.message : "unreachable");
-    return false;
-  }
-  if (!res.ok) {
-    let msg = `login failed (${res.status})`;
-    try {
-      const parsed = await res.json();
-      msg = parsed.error?.message ?? msg;
-    } catch {
-    }
-    s.error(msg);
+    s.error("Browser login failed");
+    me(err instanceof Error ? err.message : "Unable to authenticate.");
     return false;
   }
-  const data = await res.json();
-  await saveCredentials({
-    server_url: server,
-    user_id: data.user.id,
-    email: data.user.email,
-    org_id: data.user.org_id,
-    org_role: data.user.org_role,
-    access_token: data.access_token,
-    refresh_token: data.refresh_token,
-    access_expires_at: new Date(Date.now() + data.expires_in * 1e3).toISOString()
-  });
-  await client.setCredentials({
-    server_url: server,
-    user_id: data.user.id,
-    email: data.user.email,
-    org_id: data.user.org_id,
-    org_role: data.user.org_role,
-    access_token: data.access_token,
-    refresh_token: data.refresh_token,
-    access_expires_at: new Date(Date.now() + data.expires_in * 1e3).toISOString()
-  });
-  s.stop(`Logged in as ${data.user.email}`);
+  await client.setCredentials(creds);
+  s.stop(`Logged in as ${creds.email}`);
   return true;
 }
 var init_login = __esm({
   "src/ui/flows/login.ts"() {
     init_dist5();
-    init_http();
-    init_store();
-    init_version();
-    init_cancel();
+    init_browser_auth();
+    init_defaults();
   }
 });
 
@@ -42583,7 +42667,7 @@ async function addMemberInteractive(client, project) {
     {
       email: () => Re({
         message: "Email",
-        validate: (v2) => v2 && v2.includes("@") ? void 0 : "enter an email"
+        validate: (v2) => v2?.includes("@") ? void 0 : "enter an email"
       }),
       role: () => Ee({
         message: "Role",
@@ -42682,8 +42766,11 @@ function printDetail(detail) {
   const envLines = detail.environments.map(
     (e2) => `  ${e2.name}  (tier=${e2.tier}, approval=${e2.require_approval})`
   );
-  Se(`${detail.name}  (${detail.id})
-${envLines.join("\n") || "  (no environments)"}`, "Project");
+  Se(
+    `${detail.name}  (${detail.id})
+${envLines.join("\n") || "  (no environments)"}`,
+    "Project"
+  );
 }
 async function createProjectInteractive(client) {
   const answers = await he(
@@ -42742,6 +42829,7 @@ async function runMenu() {
   ge(`keynv ${VERSION}`);
   const client = new ApiClient();
   await client.ensureHydrated();
+  let didLogin = false;
   if (!client.isLoggedIn) {
     R2.info("Not logged in.");
     try {
@@ -42750,6 +42838,7 @@ async function runMenu() {
         ye("Login cancelled.");
         return 1;
       }
+      didLogin = true;
     } catch (err) {
       if (err instanceof UserCancelled) {
         me("Login cancelled.");
@@ -42761,6 +42850,20 @@ async function runMenu() {
     const u = client.currentUser;
     if (u) R2.message(`${u.email} (${u.org_role}) @ ${u.server_url}`);
   }
+  if (didLogin) {
+    const root = findProjectRoot(process.cwd());
+    const alreadyInitialized = root !== null && hasExistingKeynvEnv(root.path);
+    if (!alreadyInitialized) {
+      const setup = await ue({
+        message: "Set up this project now?",
+        initialValue: true
+      });
+      if (!q(setup) && setup) {
+        const { runInitFlow: runInitFlow2 } = await Promise.resolve().then(() => (init_init(), init_exports));
+        await runInitFlow2(client, { cwd: process.cwd(), dryRun: false, noScripts: false });
+      }
+    }
+  }
   while (true) {
     let choice;
     try {
@@ -42827,15 +42930,16 @@ var init_menu = __esm({
   "src/ui/menu.ts"() {
     init_dist5();
     init_http();
+    init_detect();
     init_store();
-    init_format();
-    init_cancel();
+    init_version();
     init_audit2();
     init_login();
     init_member();
     init_project();
     init_secret();
-    init_version();
+    init_format();
+    init_cancel();
   }
 });
 
@@ -43516,11 +43620,11 @@ var reducers = {
       return { ...state, options: [{ name: `-c`, value: String(command) }] };
     }
   },
-  setError: (state, segment, segmentIndex, errorMessage) => {
+  setError: (state, segment, segmentIndex, errorMessage2) => {
     if (segment === SpecialToken.EndOfInput || segment === SpecialToken.EndOfPartialInput) {
-      return { ...state, errorMessage: `${errorMessage}.` };
+      return { ...state, errorMessage: `${errorMessage2}.` };
     } else {
-      return { ...state, errorMessage: `${errorMessage} ("${segment}").` };
+      return { ...state, errorMessage: `${errorMessage2} ("${segment}").` };
     }
   },
   setOptionArityError: (state, segment) => {
@@ -44657,11 +44761,10 @@ async function resolveAllAliases(client, argv2, extraStrings = []) {
   return resolved;
 }
 function substitute(text, resolved) {
+  const sorted = [...resolved].sort((a, b2) => b2.alias.literal.length - a.alias.literal.length);
   let out = text;
-  for (const r of resolved) {
-    if (out.includes(r.alias.literal)) {
-      out = out.split(r.alias.literal).join(r.value);
-    }
+  for (const r of sorted) {
+    out = out.split(r.alias.literal).join(r.value);
   }
   return out;
 }
@@ -44764,10 +44867,18 @@ var BUILTIN_LINE_PATTERNS = BUILTIN_PATTERNS.filter((p2) => !p2.multiline);
 
 // ../../packages/redactor/dist/entropy.js
 var TOKEN_BOUNDARY_RE = /[\s,;:'"<>(){}[\]=]+/;
+var DEFAULT_EXCLUDE_PREFIXES = [
+  "sha1-",
+  "sha256:",
+  "sha256-",
+  "sha384-",
+  "sha512-"
+];
 var DEFAULTS = {
   enabled: true,
   minLength: 24,
-  minBitsPerChar: 4.5
+  minBitsPerChar: 4.5,
+  excludePrefixes: DEFAULT_EXCLUDE_PREFIXES
 };
 function shannonEntropy(s) {
   if (s.length === 0)
@@ -44800,9 +44911,13 @@ function findEntropyMatches(text, opts = {}) {
     const end = i;
     const token = text.slice(start, end);
     if (token.length >= cfg.minLength) {
-      const h2 = shannonEntropy(token);
-      if (h2 >= cfg.minBitsPerChar) {
-        matches.push({ start, end, token });
+      const lower = token.toLowerCase();
+      const excluded = cfg.excludePrefixes.some((p2) => lower.startsWith(p2));
+      if (!excluded) {
+        const h2 = shannonEntropy(token);
+        if (h2 >= cfg.minBitsPerChar) {
+          matches.push({ start, end, token });
+        }
       }
     }
   }
@@ -44946,7 +45061,19 @@ var ENV_ALLOWLIST = [
   "PWD",
   "OLDPWD",
   "TMPDIR",
-  "SSH_AUTH_SOCK"
+  "SSH_AUTH_SOCK",
+  // Windows-specific
+  "USERPROFILE",
+  "USERNAME",
+  "COMPUTERNAME",
+  "TEMP",
+  "TMP",
+  "SYSTEMROOT",
+  "SYSTEMDRIVE",
+  "WINDIR",
+  "COMSPEC",
+  "APPDATA",
+  "LOCALAPPDATA"
 ];
 function spawnPrivileged(opts) {
   const startedAt = Date.now();
@@ -44962,7 +45089,8 @@ function spawnPrivileged(opts) {
   const child = spawn(opts.command, opts.args, {
     env: env2,
     stdio,
-    detached: false
+    detached: false,
+    shell: process.platform === "win32"
   });
   const literals = opts.resolved.map((r) => r.value).filter((v2) => v2.length > 0);
   if (!opts.noRedact && child.stdout) {
@@ -45026,10 +45154,7 @@ to load a specific file, or set KEYNV_ENV_FILE in the environment.
 spelled \`--from\` to avoid the collision.)
 `,
     examples: [
-      [
-        "Auto-load .keynv.env from cwd or parents",
-        "$0 exec -- next dev"
-      ],
+      ["Auto-load .keynv.env from cwd or parents", "$0 exec -- next dev"],
       [
         "Run mysql with the alias substituted at fork-exec time",
         "$0 exec -- mysql -p@billing.dev.db_pass -h db.example.com"
@@ -45093,7 +45218,11 @@ spelled \`--from\` to avoid the collision.)
 `);
         return 2;
       }
-      throw err;
+      this.context.stderr.write(
+        `keynv: unexpected error loading env file: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 2;
     }
     const viaEnvSpecs = [];
     for (const spec of this.viaEnv ?? []) {
@@ -45165,11 +45294,18 @@ spelled \`--from\` to avoid the collision.)
       injectedEnv[spec.name] = value;
     }
     if (envFileLoaded && !this.quiet) {
-      const total = envFileLoaded.entries.length;
-      const aliasCount = envFileLoaded.entries.filter((e2) => e2.isAlias).length;
+      const aliasEntries = envFileLoaded.entries.filter((e2) => e2.isAlias);
+      const plainEntries = envFileLoaded.entries.filter((e2) => !e2.isAlias);
+      const displayPath = relative(process.cwd(), envFileLoaded.path) || envFileLoaded.path;
+      const parts = [];
+      if (aliasEntries.length > 0) {
+        parts.push(aliasEntries.map((e2) => `${e2.name}=${e2.value}`).join(", ") + " (vault)");
+      }
+      if (plainEntries.length > 0) {
+        parts.push(plainEntries.map((e2) => e2.name).join(", ") + " (plain)");
+      }
       this.context.stderr.write(
-        `keynv: loaded ${total} var${total === 1 ? "" : "s"} from ${envFileLoaded.path} (${aliasCount} resolved from vault)
-`
+        `keynv: loaded ${displayPath}` + (parts.length > 0 ? ` \u2014 ${parts.join("; ")}` : "") + "\n"
       );
     }
     const timeoutS = this.timeout ? Number.parseInt(this.timeout, 10) : void 0;
@@ -45209,10 +45345,142 @@ function signalNumber(sig) {
 }
 
 // src/commands/init.ts
+init_dist();
 init_http();
-init_tty();
+init_envFile();
+init_heuristics();
 init_init();
 init_cancel();
+init_tty();
+
+// src/commands/project.ts
+init_http();
+init_format();
+function isProjectId(input) {
+  return input.startsWith("p_") || /^[a-f0-9]{20,}$/i.test(input);
+}
+async function resolveProjectId(client, input) {
+  if (isProjectId(input)) {
+    return input;
+  }
+  const data = await client.request("/v1/projects");
+  const match = data.projects.find((p2) => p2.name === input);
+  if (!match) throw new Error(`project not found: ${input}`);
+  return match.id;
+}
+var ProjectListCommand = class extends Command {
+  static paths = [["project", "list"]];
+  static usage = Command.Usage({
+    description: "List projects visible to the current user."
+  });
+  json = options_exports.Boolean("--json", false);
+  async execute() {
+    const client = new ApiClient();
+    const data = await client.request("/v1/projects");
+    if (this.json) {
+      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+      return 0;
+    }
+    if (data.projects.length === 0) {
+      this.context.stdout.write("no projects\n");
+      return 0;
+    }
+    this.context.stdout.write(
+      `${table(
+        ["name", "id", "created_at"],
+        data.projects.map((p2) => [p2.name, p2.id, p2.created_at])
+      )}
+`
+    );
+    return 0;
+  }
+};
+var ProjectCreateCommand = class extends Command {
+  static paths = [["project", "create"]];
+  static usage = Command.Usage({
+    description: "Create a new project with one or more environments.",
+    examples: [["Two envs", "$0 project create billing --env dev --env prod:production:approval"]]
+  });
+  name = options_exports.String();
+  envs = options_exports.Array("--env", {
+    description: 'Environment spec: name[:tier[:approval]]. Tier \u2208 {production,non-production}; "approval" sets require_approval=true.'
+  });
+  async execute() {
+    const envs = (this.envs ?? ["dev"]).map((spec) => {
+      const [name, tier, approval] = spec.split(":");
+      return {
+        name: name ?? "",
+        tier: tier ?? "non-production",
+        require_approval: approval === "approval"
+      };
+    });
+    const client = new ApiClient();
+    const result = await client.request("/v1/projects", {
+      method: "POST",
+      body: { name: this.name, environments: envs }
+    });
+    this.context.stdout.write(`created project ${result.name} (${result.id})
+`);
+    for (const e2 of envs) {
+      this.context.stdout.write(
+        `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
+`
+      );
+    }
+    return 0;
+  }
+};
+var ProjectDescribeCommand = class extends Command {
+  static paths = [["project", "describe"]];
+  static usage = Command.Usage({
+    description: "Show metadata for one project.",
+    examples: [
+      ["By ID", "$0 project describe p_go6rqgwz0wlokdsl55ikn"],
+      ["By name", "$0 project describe myproject"]
+    ]
+  });
+  id = options_exports.String();
+  json = options_exports.Boolean("--json", false);
+  async execute() {
+    const client = new ApiClient();
+    const projectId2 = await resolveProjectId(client, this.id);
+    const data = await client.request(`/v1/projects/${projectId2}`);
+    if (this.json) {
+      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+      return 0;
+    }
+    this.context.stdout.write(`project: ${data.name} (${data.id})
+`);
+    for (const e2 of data.environments) {
+      this.context.stdout.write(
+        `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
+`
+      );
+    }
+    return 0;
+  }
+};
+var ProjectDeleteCommand = class extends Command {
+  static paths = [["project", "delete"]];
+  static usage = Command.Usage({ description: "Soft-delete a project." });
+  id = options_exports.String();
+  force = options_exports.Boolean("--force", false);
+  async execute() {
+    if (!this.force) {
+      this.context.stderr.write("keynv: refusing to delete without --force\n");
+      return 2;
+    }
+    const client = new ApiClient();
+    await client.request(`/v1/projects/${this.id}`, { method: "DELETE" });
+    this.context.stdout.write(`deleted project ${this.id}
+`);
+    return 0;
+  }
+};
+
+// src/commands/init.ts
 var InitCommand = class extends Command {
   static paths = [["init"]];
   static usage = Command.Usage({
@@ -45226,6 +45494,11 @@ package.json scripts with \`keynv exec\`.
 Safe to re-run: existing .keynv.env entries are preserved; new
 entries are appended below a marker.
 
+--dry-run prints the secrets that would be uploaded and the alias
+mappings that would be written to .keynv.env, then exits without
+touching any files or making any network calls. Use it to preview
+what init will do before committing.
+
 Requires an interactive terminal (clack TUI). For scripted
 migration, use the lower-level \`keynv project\` and \`keynv secret\`
 commands directly.
@@ -45233,28 +45506,47 @@ commands directly.
     examples: [
       ["Walk the current project", "$0 init"],
       ["Preview without writing or uploading", "$0 init --dry-run"],
-      ["Skip the package.json script-wrapping step", "$0 init --no-scripts"]
+      ["Skip the package.json script-wrapping step", "$0 init --no-scripts"],
+      ["Non-interactive (CI/CD)", "$0 init --env-file .env --project myproject --env dev"]
     ]
   });
   dryRun = options_exports.Boolean("--dry-run", false, {
-    description: "Show what would be done without writing files or uploading secrets."
+    description: "Scan .env files and print the secrets that would be uploaded and the alias mappings that would be written \u2014 no files written, no vault calls made."
   });
   noScripts = options_exports.Boolean("--no-scripts", false, {
     description: "Skip the package.json script-wrapping step."
   });
+  envFile = options_exports.String("--env-file", {
+    description: "Path to .env file to migrate (non-interactive mode)."
+  });
+  project = options_exports.String("--project", {
+    description: "Project name or ID (non-interactive mode)."
+  });
+  env = options_exports.String("--env", {
+    description: "Environment name for --env-file (default: dev)."
+  });
+  secret = options_exports.Array("--secret", {
+    description: "KEY=value secret to upload (non-interactive). Can be specified multiple times."
+  });
   async execute() {
-    if (!isInteractive()) {
-      this.context.stderr.write(
-        "keynv init requires an interactive terminal. Use the lower-level commands (`keynv project`, `keynv secret`) for scripted setup.\n"
-      );
-      return 1;
-    }
     const client = new ApiClient();
     await client.ensureHydrated();
     if (!client.isLoggedIn) {
       this.context.stderr.write("keynv: not logged in. Run `keynv login` first.\n");
       return 1;
     }
+    const hasEnvFile = this.envFile != null;
+    const hasSecrets = this.secret != null && this.secret.length > 0;
+    const isNonInteractive = hasEnvFile || hasSecrets;
+    if (isNonInteractive) {
+      return this.runNonInteractive(client);
+    }
+    if (!isInteractive()) {
+      this.context.stderr.write(
+        "keynv init requires an interactive terminal. Use --env-file or --secret for scripted setup.\n"
+      );
+      return 1;
+    }
     try {
       const outcome = await runInitFlow(client, {
         cwd: process.cwd(),
@@ -45270,9 +45562,102 @@ commands directly.
       return 1;
     }
   }
+  async runNonInteractive(client) {
+    const projectName = this.project;
+    if (!projectName) {
+      this.context.stderr.write("keynv: --project is required in non-interactive mode.\n");
+      return 1;
+    }
+    const resolved = await resolveProjectId(client, projectName);
+    if (!resolved) {
+      this.context.stderr.write(`keynv: project not found: ${projectName}
+`);
+      return 1;
+    }
+    const projectId2 = resolved;
+    const envName = this.env ?? "dev";
+    const secrets = [];
+    if (this.envFile) {
+      try {
+        const content = readFileSync(this.envFile, "utf8");
+        const entries = parseEnvFile(content, this.envFile);
+        for (const e2 of entries) {
+          if (classifyEntry(e2.name, e2.value).verdict !== "skip") {
+            secrets.push({ name: e2.name, value: e2.value });
+          }
+        }
+      } catch (err) {
+        this.context.stderr.write(
+          `keynv: cannot read ${this.envFile}: ${err instanceof Error ? err.message : String(err)}
+`
+        );
+        return 1;
+      }
+    }
+    if (this.secret) {
+      for (const spec of this.secret) {
+        const eq = spec.indexOf("=");
+        if (eq <= 0) {
+          this.context.stderr.write(`keynv: invalid --secret '${spec}', expected KEY=value
+`);
+          return 1;
+        }
+        const name = spec.slice(0, eq);
+        const value = spec.slice(eq + 1);
+        secrets.push({ name, value });
+      }
+    }
+    if (secrets.length === 0) {
+      this.context.stdout.write("keynv: nothing to migrate.\n");
+      return 0;
+    }
+    if (this.dryRun) {
+      this.context.stdout.write(
+        `keynv: dry-run \u2014 would upload ${secrets.length} secret(s) to project ${projectName} (${projectId2}) in env ${envName}
+`
+      );
+      for (const { name } of secrets) {
+        const aliasKey = name.toLowerCase().replace(/_/g, "-");
+        this.context.stdout.write(`  ${name}=@${projectName}.${envName}.${aliasKey}
+`);
+      }
+      return 0;
+    }
+    let uploaded = 0;
+    const failed = [];
+    for (const { name, value } of secrets) {
+      const aliasKey = name.toLowerCase().replace(/_/g, "-");
+      const alias2 = buildAlias({ project: projectName, environment: envName, key: aliasKey });
+      if (!alias2) {
+        failed.push(`${name} (invalid alias key: ${aliasKey})`);
+        continue;
+      }
+      try {
+        await client.request(`/v1/projects/${projectId2}/secrets`, {
+          method: "POST",
+          body: { env: envName, key: aliasKey, value }
+        });
+        uploaded++;
+      } catch (err) {
+        failed.push(`${name}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    this.context.stdout.write(
+      `keynv: uploaded ${uploaded}/${secrets.length} secret(s) to ${projectName}.${envName}
+`
+    );
+    if (failed.length > 0) {
+      for (const f of failed) this.context.stderr.write(`  failed: ${f}
+`);
+      return 1;
+    }
+    return 0;
+  }
 };
 
 // src/commands/login.ts
+init_browser_auth();
+init_defaults();
 init_http();
 init_store();
 init_format();
@@ -45333,18 +45718,40 @@ var LoginCommand = class extends Command {
   static usage = Command.Usage({
     description: "Authenticate against a keynv server.",
     examples: [
-      ["Interactive", "$0 login --server http://localhost:8080"],
+      ["Browser login", "$0 login"],
+      ["Self-hosted browser login", "$0 login --server http://localhost:8080"],
+      ["Headless token login", "$0 login --server http://... --token kt_..."],
       ["Non-interactive", "$0 login --server http://... --email a@b.com --password ..."]
     ]
   });
   server = options_exports.String("--server", { description: "Server base URL." });
+  token = options_exports.String("--token", { description: "CLI token for headless auth." });
   email = options_exports.String("--email", { description: "Email address." });
   password = options_exports.String("--password", {
     description: "Password (use stdin to avoid argv leak)."
   });
   async execute() {
-    const serverUrl = this.server ?? await promptLine("server URL [http://localhost:8080]: ") ?? "";
-    const finalServerUrl = serverUrl.length > 0 ? serverUrl : "http://localhost:8080";
+    const finalServerUrl = this.server ?? DEFAULT_SERVER_URL;
+    if (this.token) {
+      return this.loginWithToken(finalServerUrl, this.token);
+    }
+    if (!this.email && !this.password) {
+      this.context.stdout.write(`Opening browser for ${finalServerUrl} ...
+`);
+      try {
+        const creds = await runBrowserAuth(finalServerUrl);
+        await saveCredentials(creds);
+        this.context.stdout.write(`logged in as ${creds.email} (${creds.org_role})
+`);
+        return 0;
+      } catch (err) {
+        this.context.stderr.write(
+          `keynv: ${err instanceof Error ? err.message : "browser login failed"}
+`
+        );
+        return 1;
+      }
+    }
     const email2 = this.email ?? await promptLine("email: ");
     const password = this.password ?? await promptHidden("password: ");
     const res = await fetch(new URL("/v1/auth/login", finalServerUrl).toString(), {
@@ -45375,6 +45782,7 @@ var LoginCommand = class extends Command {
     const data = await res.json();
     try {
       await saveCredentials({
+        auth_kind: "session",
         server_url: finalServerUrl,
         user_id: data.user.id,
         email: data.user.email,
@@ -45392,6 +45800,54 @@ var LoginCommand = class extends Command {
       return 1;
     }
     this.context.stdout.write(`logged in as ${data.user.email} (${data.user.org_role})
+`);
+    return 0;
+  }
+  async loginWithToken(serverUrl, token) {
+    const res = await fetch(new URL("/v1/whoami", serverUrl).toString(), {
+      headers: { authorization: `Bearer ${token}`, "x-keynv-agent": AGENT }
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      let msg = `token login failed (${res.status})`;
+      try {
+        const parsed = JSON.parse(text);
+        msg = parsed.error?.message ?? msg;
+        this.context.stderr.write(
+          `${fmtError({
+            status: res.status,
+            ...parsed.error?.code ? { code: parsed.error.code } : {},
+            message: msg
+          })}
+`
+        );
+      } catch {
+        this.context.stderr.write(`keynv: ${msg}
+`);
+      }
+      return 1;
+    }
+    const data = await res.json();
+    try {
+      await saveCredentials({
+        auth_kind: "cli_token",
+        server_url: serverUrl,
+        user_id: data.id,
+        email: data.email,
+        org_id: data.org_id,
+        org_role: data.org_role,
+        access_token: token,
+        refresh_token: "",
+        access_expires_at: "9999-12-31T23:59:59.999Z"
+      });
+    } catch (err) {
+      this.context.stderr.write(
+        `keynv: failed to persist credentials: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 1;
+    }
+    this.context.stdout.write(`logged in as ${data.email} (${data.org_role})
 `);
     return 0;
   }
@@ -45442,7 +45898,8 @@ var WhoamiCommand = class extends Command {
     }
     this.context.stdout.write(`user:    ${data.email} (${data.id})
 `);
-    this.context.stdout.write(`org:     ${data.org_id}
+    const orgDisplay = data.org_name ? `${data.org_name} (${data.org_id})` : data.org_id;
+    this.context.stdout.write(`org:     ${orgDisplay}
 `);
     this.context.stdout.write(`role:    ${data.org_role}
 `);
@@ -45451,7 +45908,8 @@ var WhoamiCommand = class extends Command {
     } else {
       this.context.stdout.write("memberships:\n");
       for (const m of data.memberships) {
-        this.context.stdout.write(`  ${m.project_id}: ${m.role}
+        const proj = m.project_name ? `${m.project_name} (${m.project_id})` : m.project_id;
+        this.context.stdout.write(`  ${proj}: ${m.role}
 `);
       }
     }
@@ -45462,14 +45920,6 @@ var WhoamiCommand = class extends Command {
 // src/commands/member.ts
 init_http();
 init_format();
-async function findProjectIdByName(client, name) {
-  const data = await client.request(
-    "/v1/projects"
-  );
-  const match = data.projects.find((p2) => p2.name === name);
-  if (!match) throw new Error(`unknown project: ${name}`);
-  return match.id;
-}
 var MemberAddCommand = class extends Command {
   static paths = [["member", "add"]];
   static usage = Command.Usage({
@@ -45486,7 +45936,7 @@ var MemberAddCommand = class extends Command {
       return 1;
     }
     const client = new ApiClient();
-    const projectId2 = await findProjectIdByName(client, this.project);
+    const projectId2 = await resolveProjectId(client, this.project);
     await client.request(`/v1/projects/${projectId2}/members`, {
       method: "POST",
       body: { email: this.email, role: role2 }
@@ -45503,7 +45953,7 @@ var MemberRemoveCommand = class extends Command {
   email = options_exports.String();
   async execute() {
     const client = new ApiClient();
-    const projectId2 = await findProjectIdByName(client, this.project);
+    const projectId2 = await resolveProjectId(client, this.project);
     const members = await client.request(`/v1/projects/${projectId2}/members`);
     const target = members.members.find((m) => m.email === this.email);
     if (!target) {
@@ -45526,7 +45976,7 @@ var MemberListCommand = class extends Command {
   json = options_exports.Boolean("--json", false);
   async execute() {
     const client = new ApiClient();
-    const projectId2 = await findProjectIdByName(client, this.project);
+    const projectId2 = await resolveProjectId(client, this.project);
     const data = await client.request(`/v1/projects/${projectId2}/members`);
     if (this.json) {
       this.context.stdout.write(`${JSON.stringify(data, null, 2)}
@@ -45547,114 +45997,6 @@ var MemberListCommand = class extends Command {
     return 0;
   }
 };
-
-// src/commands/project.ts
-init_http();
-init_format();
-var ProjectListCommand = class extends Command {
-  static paths = [["project", "list"]];
-  static usage = Command.Usage({
-    description: "List projects visible to the current user."
-  });
-  json = options_exports.Boolean("--json", false);
-  async execute() {
-    const client = new ApiClient();
-    const data = await client.request("/v1/projects");
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
-`);
-      return 0;
-    }
-    if (data.projects.length === 0) {
-      this.context.stdout.write("no projects\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["name", "id", "created_at"],
-        data.projects.map((p2) => [p2.name, p2.id, p2.created_at])
-      )}
-`
-    );
-    return 0;
-  }
-};
-var ProjectCreateCommand = class extends Command {
-  static paths = [["project", "create"]];
-  static usage = Command.Usage({
-    description: "Create a new project with one or more environments.",
-    examples: [["Two envs", "$0 project create billing --env dev --env prod:production:approval"]]
-  });
-  name = options_exports.String();
-  envs = options_exports.Array("--env", {
-    description: 'Environment spec: name[:tier[:approval]]. Tier \u2208 {production,non-production}; "approval" sets require_approval=true.'
-  });
-  async execute() {
-    const envs = (this.envs ?? ["dev"]).map((spec) => {
-      const [name, tier, approval] = spec.split(":");
-      return {
-        name: name ?? "",
-        tier: tier ?? "non-production",
-        require_approval: approval === "approval"
-      };
-    });
-    const client = new ApiClient();
-    const result = await client.request("/v1/projects", {
-      method: "POST",
-      body: { name: this.name, environments: envs }
-    });
-    this.context.stdout.write(`created project ${result.name} (${result.id})
-`);
-    for (const e2 of envs) {
-      this.context.stdout.write(
-        `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
-`
-      );
-    }
-    return 0;
-  }
-};
-var ProjectDescribeCommand = class extends Command {
-  static paths = [["project", "describe"]];
-  static usage = Command.Usage({ description: "Show metadata for one project." });
-  id = options_exports.String();
-  json = options_exports.Boolean("--json", false);
-  async execute() {
-    const client = new ApiClient();
-    const data = await client.request(`/v1/projects/${this.id}`);
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
-`);
-      return 0;
-    }
-    this.context.stdout.write(`project: ${data.name} (${data.id})
-`);
-    for (const e2 of data.environments) {
-      this.context.stdout.write(
-        `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
-`
-      );
-    }
-    return 0;
-  }
-};
-var ProjectDeleteCommand = class extends Command {
-  static paths = [["project", "delete"]];
-  static usage = Command.Usage({ description: "Soft-delete a project." });
-  id = options_exports.String();
-  force = options_exports.Boolean("--force", false);
-  async execute() {
-    if (!this.force) {
-      this.context.stderr.write("keynv: refusing to delete without --force\n");
-      return 2;
-    }
-    const client = new ApiClient();
-    await client.request(`/v1/projects/${this.id}`, { method: "DELETE" });
-    this.context.stdout.write(`deleted project ${this.id}
-`);
-    return 0;
-  }
-};
 var RedactCommand = class extends Command {
   static paths = [["redact"]];
   static usage = Command.Usage({
@@ -45697,11 +46039,9 @@ var RedactStreamCommand = class extends Command {
   static usage = Command.Usage({
     description: "Stream stdin through the line-buffered redactor to stdout.",
     details: `
-Used as a hook handler by per-agent integrations (e.g., Claude Code's
-PostToolUse hook): \`keynv redact-stream\` reads its tool output on
-stdin and writes a redacted version on stdout, preserving the original
-line structure. Multi-line patterns are NOT applied here (see the
-streaming-mode limitation in @keynv/redactor).
+Pipe any output through the line-buffered redactor to stdout.
+Preserves original line structure. Multi-line patterns are NOT applied
+here (see the streaming-mode limitation in the redactor package).
 `
   });
   async execute() {
@@ -45716,18 +46056,13 @@ streaming-mode limitation in @keynv/redactor).
 // src/commands/secret.ts
 init_dist();
 init_http();
+init_secret();
 init_format();
-init_tty();
 init_cancel();
 init_pickProject();
 init_pickSecret();
-init_secret();
-async function findProjectIdByName2(client, name) {
-  const data = await client.request("/v1/projects");
-  const match = data.projects.find((p2) => p2.name === name);
-  if (!match) throw new Error(`unknown project: ${name}`);
-  return match.id;
-}
+init_tty();
+var ALIAS_FORMAT_HINT = "Format: @<project>.<env>.<KEY>  (project/env: lowercase kebab-case; key: letters, digits, _ or -)";
 function missingAlias(stderr) {
   stderr.write("keynv: missing <alias> (TTY required for interactive prompt).\n");
   return 1;
@@ -45776,7 +46111,8 @@ var SecretCreateCommand = class extends Command {
     }
     const parsed = parseAlias(alias2);
     if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'. Expected @project.env.key.
+      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+  ${ALIAS_FORMAT_HINT}
 `);
       return 1;
     }
@@ -45789,7 +46125,7 @@ var SecretCreateCommand = class extends Command {
     } else if (value === void 0) {
       value = await promptHidden("value: ");
     }
-    const projectId2 = await findProjectIdByName2(client, parsed.project);
+    const projectId2 = await resolveProjectId(client, parsed.project);
     await client.request(`/v1/projects/${projectId2}/secrets`, {
       method: "POST",
       body: { env: parsed.environment, key: parsed.key, value }
@@ -45823,10 +46159,11 @@ var SecretGetCommand = class extends Command {
     const parsed = parseAlias(alias2);
     if (!parsed) {
       this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+  ${ALIAS_FORMAT_HINT}
 `);
       return 1;
     }
-    const projectId2 = await findProjectIdByName2(client, parsed.project);
+    const projectId2 = await resolveProjectId(client, parsed.project);
     const data = await client.request(
       `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`
     );
@@ -45867,7 +46204,7 @@ var SecretListCommand = class extends Command {
         throw err;
       }
     }
-    const projectId2 = await findProjectIdByName2(client, projectName);
+    const projectId2 = await resolveProjectId(client, projectName);
     const data = await client.request(`/v1/projects/${projectId2}/secrets`);
     if (this.json) {
       this.context.stdout.write(`${JSON.stringify(data, null, 2)}
@@ -45911,6 +46248,7 @@ var SecretRotateCommand = class extends Command {
     const parsed = parseAlias(alias2);
     if (!parsed) {
       this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+  ${ALIAS_FORMAT_HINT}
 `);
       return 1;
     }
@@ -45926,7 +46264,7 @@ var SecretRotateCommand = class extends Command {
     } else {
       value = await promptHidden("new value: ");
     }
-    const projectId2 = await findProjectIdByName2(client, parsed.project);
+    const projectId2 = await resolveProjectId(client, parsed.project);
     const data = await client.request(
       `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}/rotate`,
       { method: "POST", body: { new_value: value } }
@@ -45957,10 +46295,11 @@ var SecretDeleteCommand = class extends Command {
     const parsed = parseAlias(alias2);
     if (!parsed) {
       this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+  ${ALIAS_FORMAT_HINT}
 `);
       return 1;
     }
-    const projectId2 = await findProjectIdByName2(client, parsed.project);
+    const projectId2 = await resolveProjectId(client, parsed.project);
     await client.request(`/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`, {
       method: "DELETE"
     });
@@ -45969,6 +46308,140 @@ var SecretDeleteCommand = class extends Command {
     return 0;
   }
 };
+function generateSecret(bytes = 32) {
+  return randomBytes(bytes).toString("base64");
+}
+var ServerInitCommand = class extends Command {
+  static paths = [["server", "init"]];
+  static usage = Command.Usage({
+    description: "Generate secrets and deployment files for a new keynv server.",
+    details: `
+Interactive onboarding wizard that generates the configuration
+a fresh keynv server needs: JWT signing secret, master encryption
+key, and deployment templates.
+
+Outputs:
+  \u2022 A .keynv-server.env file you feed into your deployment
+    (Docker Compose, Coolify, or bare-metal).
+  \u2022 Optionally a docker-compose.yml in the current directory.
+
+Non-interactive with --yes to skip prompts.
+`,
+    examples: [
+      ["Interactive wizard", "$0 server init"],
+      ["Non-interactive (CI/scripts)", "$0 server init --yes"],
+      ["Docker Compose output", "$0 server init --compose"],
+      ["Custom output path", "$0 server init --out ./config/env"]
+    ]
+  });
+  yes = options_exports.Boolean("--yes", false, {
+    description: "Skip all prompts (non-interactive)."
+  });
+  compose = options_exports.Boolean("--compose", false, {
+    description: "Also write a docker-compose.yml to the current directory."
+  });
+  out = options_exports.String("--out", {
+    description: "Write server env file to this path (default: .keynv-server.env)."
+  });
+  async execute() {
+    const jwtSecret = generateSecret(48);
+    const masterKey = generateSecret(32);
+    const webSessionSecret = generateSecret(48);
+    const outPath = this.out ?? ".keynv-server.env";
+    const contents = [
+      "# Generated by `keynv server init`.",
+      "# Keep this file secret \u2014 it contains cryptographic key material.",
+      `KEYNV_JWT_SECRET=${jwtSecret}`,
+      `KEYNV_MASTER_KEY=${masterKey}`,
+      "",
+      "# Web dashboard session secret (required for Next.js JWE session tokens).",
+      `KEYNV_WEB_SESSION_SECRET=${webSessionSecret}`,
+      "",
+      "# Server configuration (uncomment and adjust):",
+      "# KEYNV_PORT=8080",
+      "# KEYNV_WEB_URL=https://keynv.example.com",
+      "# KEYNV_PUBLIC_REGISTRATION=false",
+      "# KEYNV_DB_PATH=./keynv.db",
+      "# KEYNV_MASTER_KEY_FILE=./master.key",
+      "# KEYNV_RATE_LIMIT_PER_MINUTE=120",
+      "# KEYNV_ARGON2_MEMORY_KIB=46080",
+      "# KEYNV_ARGON2_TIME_COST=3"
+    ].join("\n");
+    const { writeFileSync: writeFileSync4 } = await import('fs');
+    writeFileSync4(outPath, `${contents}
+`);
+    this.context.stdout.write(`Wrote ${outPath}
+
+`);
+    this.context.stdout.write("Generated secrets:\n");
+    this.context.stdout.write(
+      `  KEYNV_JWT_SECRET         ${jwtSecret.slice(0, 8)}... (base64, 48 bytes)
+`
+    );
+    this.context.stdout.write(
+      `  KEYNV_MASTER_KEY         ${masterKey.slice(0, 8)}... (base64, 32 bytes)
+`
+    );
+    this.context.stdout.write(
+      `  KEYNV_WEB_SESSION_SECRET ${webSessionSecret.slice(0, 8)}... (base64, 48 bytes)
+`
+    );
+    this.context.stdout.write("\nNext steps:\n");
+    this.context.stdout.write(`  1. Feed ${outPath} into your deployment:
+`);
+    this.context.stdout.write("     docker compose --env-file .keynv-server.env up -d\n");
+    this.context.stdout.write("     or load it into Coolify as environment variables.\n");
+    this.context.stdout.write("  2. Bootstrap the first owner:\n");
+    this.context.stdout.write(
+      "     docker exec -it <server-container> node dist/bootstrap.js \\\n"
+    );
+    this.context.stdout.write("       --owner-email alice@example.com \\\n");
+    this.context.stdout.write('       --owner-password "<a long random password>" \\\n');
+    this.context.stdout.write('       --org-name "Acme Inc"\n');
+    this.context.stdout.write("  3. Install the CLI and log in:\n");
+    this.context.stdout.write("     npm install -g @keynv/cli\n");
+    this.context.stdout.write("     keynv login --server https://keynv.example.com\n");
+    this.context.stdout.write("  4. Onboard your first project:\n");
+    this.context.stdout.write("     cd your-project && keynv init\n");
+    if (this.compose) {
+      const composeContent = `# keynv server + Litestream sidecar
+# Generated by \`keynv server init\`.
+# Load with: docker compose --env-file .keynv-server.env up -d
+
+services:
+  server:
+    image: ghcr.io/keynv-labs/keynv-server:latest
+    restart: unless-stopped
+    ports:
+      - '8080:8080'
+    env_file:
+      - .keynv-server.env
+    volumes:
+      - keynv-data:/data
+
+  litestream:
+    image: litestream/litestream:latest
+    restart: unless-stopped
+    volumes:
+      - keynv-data:/data
+    command: replicate
+    environment:
+      LITESTREAM_DB_PATH: /data/keynv.db
+      LITESTREAM_REPLICA_URL: s3://your-bucket/keynv
+      AWS_ACCESS_KEY_ID: \${LITESTREAM_AWS_ACCESS_KEY_ID}
+      AWS_SECRET_ACCESS_KEY: \${LITESTREAM_AWS_SECRET_ACCESS_KEY}
+
+volumes:
+  keynv-data:
+`;
+      writeFileSync4("docker-compose.yml", composeContent);
+      this.context.stdout.write(
+        "\nWrote docker-compose.yml (update Litestream S3 config before deploying).\n"
+      );
+    }
+    return 0;
+  }
+};
 
 // src/commands/test.ts
 init_dist();
@@ -46321,18 +46794,9 @@ var TESTERS = [
   sshTester,
   httpTester
 ];
-function findTester(type) {
-  return TESTERS.find((t) => t.type === type) ?? null;
-}
 
 // src/commands/test.ts
 init_http();
-async function findProjectIdByName3(client, name) {
-  const data = await client.request("/v1/projects");
-  const match = data.projects.find((p2) => p2.name === name);
-  if (!match) throw new Error(`unknown project: ${name}`);
-  return match.id;
-}
 function parseTargets(specs) {
   const out = {};
   for (const spec of specs) {
@@ -46386,12 +46850,17 @@ the error message.
       );
       return 2;
     }
-    const tester = findTester(this.as);
+    const tester = TESTERS.find((t) => t.type === this.as);
     if (!tester) {
       this.context.stderr.write(`keynv: unknown tester '${this.as}'
 `);
       return 1;
     }
+    const timeoutMs = this.timeout ? Number.parseInt(this.timeout, 10) * 1e3 : void 0;
+    if (this.timeout && (timeoutMs === void 0 || Number.isNaN(timeoutMs))) {
+      this.context.stderr.write("keynv: invalid --timeout (expected integer seconds)\n");
+      return 2;
+    }
     let target;
     try {
       target = parseTargets(this.targets ?? []);
@@ -46408,7 +46877,7 @@ the error message.
     }
     let value;
     try {
-      const projectId2 = await findProjectIdByName3(client, parsedAlias.project);
+      const projectId2 = await resolveProjectId(client, parsedAlias.project);
       const data = await client.request(
         `/v1/projects/${projectId2}/secrets/${parsedAlias.environment}/${parsedAlias.key}`
       );
@@ -46419,11 +46888,6 @@ the error message.
 `);
       return 1;
     }
-    const timeoutMs = this.timeout ? Number.parseInt(this.timeout, 10) * 1e3 : void 0;
-    if (this.timeout && (timeoutMs === void 0 || Number.isNaN(timeoutMs))) {
-      this.context.stderr.write("keynv: invalid --timeout (expected integer seconds)\n");
-      return 2;
-    }
     const result = await runTest({
       tester,
       secret: { alias: parsedAlias.literal, value },
@@ -46465,25 +46929,6 @@ the error message.
   }
 };
 
-// src/commands/ui.ts
-init_menu();
-init_tty();
-var UICommand = class extends Command {
-  static paths = [["ui"]];
-  static usage = Command.Usage({
-    description: "Open the interactive menu (also runs by default when no args are given)."
-  });
-  async execute() {
-    if (!isInteractive()) {
-      this.context.stdout.write(
-        "keynv \u2014 AI-safe secrets management.\nRun `keynv --help` for the full command list, or run `keynv` in an interactive\nterminal to open the menu.\n"
-      );
-      return 0;
-    }
-    return runMenu();
-  }
-};
-
 // src/index.ts
 init_format();
 init_version();
@@ -46517,7 +46962,7 @@ cli.register(InitCommand);
 cli.register(RedactCommand);
 cli.register(RedactStreamCommand);
 cli.register(TestCommand);
-cli.register(UICommand);
+cli.register(ServerInitCommand);
 var argv = process.argv.slice(2);
 if (argv.length === 0) {
   const { runMenu: runMenu2 } = await Promise.resolve().then(() => (init_menu(), menu_exports));