@keynv/cli 0.1.0-rc.11 → 0.1.0-rc.13

package/dist/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import 'crypto';
+import { randomBytes } from 'crypto';
 import { readFileSync, existsSync, statSync, writeFileSync, unlinkSync, mkdirSync, rmSync, readdirSync } from 'fs';
 import { hostname, platform, homedir } from 'os';
-import { isAbsolute, resolve, join, dirname, basename } from 'path';
+import { relative, isAbsolute, resolve, join, dirname, basename } from 'path';
 import { Entry } from '@napi-rs/keyring';
 import { styleText } from 'util';
 import j2, { stdin, stdout } from 'process';
@@ -1056,7 +1056,7 @@ var require_lib = __commonJS({
 var VERSION, AGENT;
 var init_version = __esm({
   "src/version.ts"() {
-    VERSION = "0.1.0-rc.11" ;
+    VERSION = "0.1.0-rc.13" ;
     AGENT = `keynv-cli/${VERSION}`;
   }
 });
@@ -1146,10 +1146,10 @@ var init_parser = __esm({
   "../../packages/core/dist/reference/parser.js"() {
     PROJECT_RE = /^[a-z0-9][a-z0-9-]{0,47}$/;
     ENV_RE = /^[a-z0-9][a-z0-9-]{0,23}$/;
-    KEY_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+    KEY_RE = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
     TRAILING_BOUNDARY = "(?!\\w|\\.[a-z0-9])";
-    TEXT_FIND_SOURCE = `(?<![\\w.@/])@[a-z0-9][a-z0-9-]{0,47}\\.[a-z0-9][a-z0-9-]{0,23}\\.[a-z0-9][a-z0-9_-]{0,63}${TRAILING_BOUNDARY}`;
-    ARGV_FIND_SOURCE = `@[a-z0-9][a-z0-9-]{0,47}\\.[a-z0-9][a-z0-9-]{0,23}\\.[a-z0-9][a-z0-9_-]{0,63}${TRAILING_BOUNDARY}`;
+    TEXT_FIND_SOURCE = `(?<![\\w.@/])@[a-z0-9][a-z0-9-]{0,47}\\.[a-z0-9][a-z0-9-]{0,23}\\.[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}${TRAILING_BOUNDARY}`;
+    ARGV_FIND_SOURCE = `@[a-z0-9][a-z0-9-]{0,47}\\.[a-z0-9][a-z0-9-]{0,23}\\.[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}${TRAILING_BOUNDARY}`;
     TEXT_FIND_RE = new RegExp(TEXT_FIND_SOURCE, "g");
     ARGV_FIND_RE = new RegExp(ARGV_FIND_SOURCE, "g");
   }
@@ -5536,7 +5536,15 @@ function clearCredentialsFile() {
   if (existsSync(legacy)) rmSync(legacy, { force: true });
   try {
     entry().deletePassword();
-  } catch {
+    return true;
+  } catch (err) {
+    process.stderr.write(
+      `keynv: warning \u2014 could not remove OS keychain entry (${err instanceof Error ? err.message : String(err)}).
+  You may need to remove the '${SERVICE}' / '${KEY_ACCOUNT}' entry manually
+  via your OS credential manager (Windows Credential Manager, macOS Keychain, or libsecret).
+`
+    );
+    return false;
   }
 }
 var SERVICE, KEY_ACCOUNT;
@@ -5579,8 +5587,9 @@ async function saveCredentials(creds) {
   cache = creds;
 }
 function clearCredentials() {
-  clearCredentialsFile();
+  const ok = clearCredentialsFile();
   cache = null;
+  return ok;
 }
 var cache;
 var init_store = __esm({
@@ -5590,6 +5599,9 @@ var init_store = __esm({
 });
 
 // src/client/http.ts
+function isClientError(err) {
+  return err instanceof Error && typeof err.status === "number";
+}
 function clientError(status, code, message, details) {
   const err = Object.assign(new Error(message), { status, code, details });
   return err;
@@ -5719,8 +5731,38 @@ function fmtError(err) {
   const status = err.status ? ` (${err.status})` : "";
   return `keynv:${code}${status} ${err.message}`;
 }
+function handleExecError(stderr, err) {
+  if (isClientError(err)) {
+    const code = err.code ? `[${err.code}] ` : "";
+    stderr.write(`keynv: ${code}${err.message}
+`);
+  } else if (err instanceof Error) {
+    stderr.write(`keynv: ${err.message}
+`);
+  } else {
+    stderr.write(`keynv: unexpected error
+`);
+  }
+  return 1;
+}
 var init_format = __esm({
   "src/ui/format.ts"() {
+    init_http();
+  }
+});
+function walkUp(startDir, predicate) {
+  let dir = resolve(startDir);
+  for (let i = 0; i < 64; i++) {
+    const result = predicate(dir);
+    if (result !== null && result !== void 0) return result;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+var init_fs = __esm({
+  "src/util/fs.ts"() {
   }
 });
 function parseEnvFile(content, filename) {
@@ -5781,20 +5823,14 @@ function parseEnvFile(content, filename) {
   return entries;
 }
 function findEnvFile(startDir) {
-  let dir = resolve(startDir);
-  for (let i = 0; i < 64; i++) {
+  return walkUp(startDir, (dir) => {
     const candidate = join(dir, ENV_FILE_BASENAME);
-    if (existsSync(candidate)) {
-      try {
-        if (statSync(candidate).isFile()) return candidate;
-      } catch {
-      }
+    try {
+      if (statSync(candidate).isFile()) return candidate;
+    } catch {
     }
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-  return null;
+    return null;
+  });
 }
 function loadEnvFile(opts) {
   if (opts.disabled) return null;
@@ -5819,6 +5855,7 @@ var MAX_FILE_BYTES, KEY_RE2, ENV_FILE_BASENAME, EnvFileParseError, EnvFileNotFou
 var init_envFile = __esm({
   "src/exec/envFile.ts"() {
     init_dist();
+    init_fs();
     MAX_FILE_BYTES = 1e6;
     KEY_RE2 = /^[A-Za-z_][A-Za-z0-9_]*$/;
     ENV_FILE_BASENAME = ".keynv.env";
@@ -5855,6 +5892,132 @@ var init_envFile = __esm({
   }
 });
 
+// src/init/heuristics.ts
+function shannonEntropyBits(s) {
+  if (s.length === 0) return 0;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let h2 = 0;
+  for (const c2 of counts.values()) {
+    const p2 = c2 / s.length;
+    h2 -= p2 * Math.log2(p2);
+  }
+  return h2;
+}
+function nameMatchesLiteralPrefix(name) {
+  const upper = name.toUpperCase();
+  return NAME_LITERAL_PREFIX.some((p2) => upper.startsWith(p2));
+}
+function nameMatchesSecretSuffix(name) {
+  const upper = name.toUpperCase();
+  for (const { suffix, hint } of NAME_SECRET_SUFFIXES) {
+    if (upper.endsWith(suffix) || upper.endsWith(`_${suffix}`)) {
+      return { matched: true, hint };
+    }
+  }
+  return { matched: false, hint: "" };
+}
+function classifyEntry(name, value) {
+  const upper = name.toUpperCase();
+  if (NAME_FRAMEWORK_MANAGED.has(upper)) {
+    return { verdict: "skip", hint: "framework/shell-managed" };
+  }
+  if (NAME_LITERAL_EXACT.has(upper)) {
+    return { verdict: "literal", hint: "common config var" };
+  }
+  if (nameMatchesLiteralPrefix(name)) {
+    return { verdict: "literal", hint: "public env, build-time bundled" };
+  }
+  if (value.length === 0) {
+    return { verdict: "literal", hint: "empty" };
+  }
+  for (const { re, hint } of VALUE_PATTERNS) {
+    if (re.test(value)) return { verdict: "secret", hint };
+  }
+  const suffix = nameMatchesSecretSuffix(name);
+  if (suffix.matched) {
+    return { verdict: "secret", hint: suffix.hint };
+  }
+  if (NAME_DB_URL.test(name)) {
+    return { verdict: "secret", hint: "database URL" };
+  }
+  if (value.length >= 32) {
+    const bits = shannonEntropyBits(value);
+    if (bits >= 3.5) {
+      return { verdict: "secret", hint: `${value.length}-char random-looking string` };
+    }
+  }
+  return { verdict: "ambiguous", hint: "" };
+}
+function previewValue(value, max = 40) {
+  if (value.length === 0) return "(empty)";
+  if (value.length <= max) return value;
+  return `${value.slice(0, max - 1)}\u2026`;
+}
+var NAME_FRAMEWORK_MANAGED, NAME_LITERAL_EXACT, NAME_LITERAL_PREFIX, NAME_SECRET_SUFFIXES, NAME_DB_URL, VALUE_PATTERNS;
+var init_heuristics = __esm({
+  "src/init/heuristics.ts"() {
+    NAME_FRAMEWORK_MANAGED = /* @__PURE__ */ new Set([
+      "NODE_ENV",
+      "PORT",
+      "HOST",
+      "HOSTNAME",
+      "PATH",
+      "HOME",
+      "USER",
+      "SHELL",
+      "PWD",
+      "CI"
+    ]);
+    NAME_LITERAL_EXACT = /* @__PURE__ */ new Set([
+      "DEBUG",
+      "LOG_LEVEL",
+      "LOGLEVEL",
+      "TZ",
+      "LANG",
+      "LC_ALL",
+      "NODE_OPTIONS",
+      "NPM_CONFIG_LOGLEVEL",
+      "TS_NODE_PROJECT"
+    ]);
+    NAME_LITERAL_PREFIX = ["NEXT_PUBLIC_", "VITE_", "REACT_APP_", "PUBLIC_", "EXPO_PUBLIC_"];
+    NAME_SECRET_SUFFIXES = [
+      { suffix: "PRIVATE_KEY", hint: "private key" },
+      { suffix: "API_KEY", hint: "API key" },
+      { suffix: "ACCESS_KEY", hint: "access key" },
+      { suffix: "SECRET_KEY", hint: "secret key" },
+      { suffix: "SECRET", hint: "secret" },
+      { suffix: "PASSWORD", hint: "password" },
+      { suffix: "PASSPHRASE", hint: "passphrase" },
+      { suffix: "TOKEN", hint: "token" },
+      { suffix: "KEY", hint: "key" },
+      { suffix: "CREDENTIALS", hint: "credentials" },
+      { suffix: "AUTH", hint: "auth" },
+      { suffix: "DSN", hint: "connection string" }
+    ];
+    NAME_DB_URL = /^(DATABASE|DB|POSTGRES|MYSQL|MONGO|REDIS)_URL$/i;
+    VALUE_PATTERNS = [
+      { re: /^sk-proj-/, hint: "OpenAI project key" },
+      { re: /^sk-[A-Za-z0-9]{20,}/, hint: "OpenAI key" },
+      { re: /^sk_live_/, hint: "Stripe live key" },
+      { re: /^sk_test_/, hint: "Stripe test key" },
+      { re: /^pk_live_/, hint: "Stripe publishable \u2014 often public, double-check" },
+      { re: /^xoxb-/, hint: "Slack bot token" },
+      { re: /^xoxp-/, hint: "Slack user token" },
+      { re: /^ghp_[A-Za-z0-9]{30,}/, hint: "GitHub personal access token" },
+      { re: /^github_pat_/, hint: "GitHub fine-grained PAT" },
+      { re: /^gho_/, hint: "GitHub OAuth token" },
+      { re: /^AKIA[0-9A-Z]{16}$/, hint: "AWS access key id" },
+      { re: /^ASIA[0-9A-Z]{16}$/, hint: "AWS temporary key id" },
+      { re: /^AIza[0-9A-Za-z_-]{35}$/, hint: "Google API key" },
+      { re: /^ya29\./, hint: "Google OAuth access token" },
+      { re: /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, hint: "JWT" },
+      { re: /^-----BEGIN [A-Z ]+PRIVATE KEY-----/, hint: "PEM private key" },
+      { re: /^([a-z]+):\/\/[^@]+:[^@]+@/i, hint: "connection string with credentials" }
+    ];
+  }
+});
+
 // ../../node_modules/.pnpm/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/utils.js
 var getCodePointsLength, isFullWidth, isWideNotCJKTNotEmoji;
 var init_utils = __esm({
@@ -7099,22 +7262,19 @@ var init_aiContext = __esm({
   }
 });
 function findProjectRoot(startDir) {
-  let dir = resolve(startDir);
-  for (let i = 0; i < 64; i++) {
+  const result = walkUp(startDir, (dir) => {
     for (const marker of PROJECT_MARKERS) {
-      const candidate = join(dir, marker);
-      if (existsSync(candidate)) {
-        return buildRoot(dir, marker);
+      if (existsSync(join(dir, marker))) {
+        return { dir, marker };
       }
     }
     if (existsSync(join(dir, GIT_MARKER))) {
-      return buildRoot(dir, GIT_MARKER);
+      return { dir, marker: GIT_MARKER };
     }
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-  return null;
+    return null;
+  });
+  if (!result) return null;
+  return buildRoot(result.dir, result.marker);
 }
 function buildRoot(dir, marker) {
   let suggestedName = basename(dir);
@@ -7199,6 +7359,7 @@ function hasExistingKeynvEnv(rootDir) {
 var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME;
 var init_detect = __esm({
   "src/init/detect.ts"() {
+    init_fs();
     PROJECT_MARKERS = [
       "package.json",
       "pyproject.toml",
@@ -7216,132 +7377,6 @@ var init_detect = __esm({
   }
 });
 
-// src/init/heuristics.ts
-function shannonEntropyBits(s) {
-  if (s.length === 0) return 0;
-  const counts = /* @__PURE__ */ new Map();
-  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
-  let h2 = 0;
-  for (const c2 of counts.values()) {
-    const p2 = c2 / s.length;
-    h2 -= p2 * Math.log2(p2);
-  }
-  return h2;
-}
-function nameMatchesLiteralPrefix(name) {
-  const upper = name.toUpperCase();
-  return NAME_LITERAL_PREFIX.some((p2) => upper.startsWith(p2));
-}
-function nameMatchesSecretSuffix(name) {
-  const upper = name.toUpperCase();
-  for (const { suffix, hint } of NAME_SECRET_SUFFIXES) {
-    if (upper.endsWith(suffix) || upper.endsWith(`_${suffix}`)) {
-      return { matched: true, hint };
-    }
-  }
-  return { matched: false, hint: "" };
-}
-function classifyEntry(name, value) {
-  const upper = name.toUpperCase();
-  if (NAME_FRAMEWORK_MANAGED.has(upper)) {
-    return { verdict: "skip", hint: "framework/shell-managed" };
-  }
-  if (NAME_LITERAL_EXACT.has(upper)) {
-    return { verdict: "literal", hint: "common config var" };
-  }
-  if (nameMatchesLiteralPrefix(name)) {
-    return { verdict: "literal", hint: "public env, build-time bundled" };
-  }
-  if (value.length === 0) {
-    return { verdict: "literal", hint: "empty" };
-  }
-  for (const { re, hint } of VALUE_PATTERNS) {
-    if (re.test(value)) return { verdict: "secret", hint };
-  }
-  const suffix = nameMatchesSecretSuffix(name);
-  if (suffix.matched) {
-    return { verdict: "secret", hint: suffix.hint };
-  }
-  if (NAME_DB_URL.test(name)) {
-    return { verdict: "secret", hint: "database URL" };
-  }
-  if (value.length >= 32) {
-    const bits = shannonEntropyBits(value);
-    if (bits >= 3.5) {
-      return { verdict: "secret", hint: `${value.length}-char random-looking string` };
-    }
-  }
-  return { verdict: "ambiguous", hint: "" };
-}
-function previewValue(value, max = 40) {
-  if (value.length === 0) return "(empty)";
-  if (value.length <= max) return value;
-  return `${value.slice(0, max - 1)}\u2026`;
-}
-var NAME_FRAMEWORK_MANAGED, NAME_LITERAL_EXACT, NAME_LITERAL_PREFIX, NAME_SECRET_SUFFIXES, NAME_DB_URL, VALUE_PATTERNS;
-var init_heuristics = __esm({
-  "src/init/heuristics.ts"() {
-    NAME_FRAMEWORK_MANAGED = /* @__PURE__ */ new Set([
-      "NODE_ENV",
-      "PORT",
-      "HOST",
-      "HOSTNAME",
-      "PATH",
-      "HOME",
-      "USER",
-      "SHELL",
-      "PWD",
-      "CI"
-    ]);
-    NAME_LITERAL_EXACT = /* @__PURE__ */ new Set([
-      "DEBUG",
-      "LOG_LEVEL",
-      "LOGLEVEL",
-      "TZ",
-      "LANG",
-      "LC_ALL",
-      "NODE_OPTIONS",
-      "NPM_CONFIG_LOGLEVEL",
-      "TS_NODE_PROJECT"
-    ]);
-    NAME_LITERAL_PREFIX = ["NEXT_PUBLIC_", "VITE_", "REACT_APP_", "PUBLIC_", "EXPO_PUBLIC_"];
-    NAME_SECRET_SUFFIXES = [
-      { suffix: "PRIVATE_KEY", hint: "private key" },
-      { suffix: "API_KEY", hint: "API key" },
-      { suffix: "ACCESS_KEY", hint: "access key" },
-      { suffix: "SECRET_KEY", hint: "secret key" },
-      { suffix: "SECRET", hint: "secret" },
-      { suffix: "PASSWORD", hint: "password" },
-      { suffix: "PASSPHRASE", hint: "passphrase" },
-      { suffix: "TOKEN", hint: "token" },
-      { suffix: "KEY", hint: "key" },
-      { suffix: "CREDENTIALS", hint: "credentials" },
-      { suffix: "AUTH", hint: "auth" },
-      { suffix: "DSN", hint: "connection string" }
-    ];
-    NAME_DB_URL = /^(DATABASE|DB|POSTGRES|MYSQL|MONGO|REDIS)_URL$/i;
-    VALUE_PATTERNS = [
-      { re: /^sk-proj-/, hint: "OpenAI project key" },
-      { re: /^sk-[A-Za-z0-9]{20,}/, hint: "OpenAI key" },
-      { re: /^sk_live_/, hint: "Stripe live key" },
-      { re: /^sk_test_/, hint: "Stripe test key" },
-      { re: /^pk_live_/, hint: "Stripe publishable \u2014 often public, double-check" },
-      { re: /^xoxb-/, hint: "Slack bot token" },
-      { re: /^xoxp-/, hint: "Slack user token" },
-      { re: /^ghp_[A-Za-z0-9]{30,}/, hint: "GitHub personal access token" },
-      { re: /^github_pat_/, hint: "GitHub fine-grained PAT" },
-      { re: /^gho_/, hint: "GitHub OAuth token" },
-      { re: /^AKIA[0-9A-Z]{16}$/, hint: "AWS access key id" },
-      { re: /^ASIA[0-9A-Z]{16}$/, hint: "AWS temporary key id" },
-      { re: /^AIza[0-9A-Za-z_-]{35}$/, hint: "Google API key" },
-      { re: /^ya29\./, hint: "Google OAuth access token" },
-      { re: /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, hint: "JWT" },
-      { re: /^-----BEGIN [A-Z ]+PRIVATE KEY-----/, hint: "PEM private key" },
-      { re: /^([a-z]+):\/\/[^@]+:[^@]+@/i, hint: "connection string with credentials" }
-    ];
-  }
-});
-
 // src/init/scriptWrap.ts
 function analyzeScript(name, command) {
   const trimmed = command.trim();
@@ -7989,7 +8024,8 @@ function composeKeynvEnv(opts) {
   const { uploadedAliases, literals, mergeWithExisting } = opts;
   const lines = [];
   if (mergeWithExisting !== null) {
-    const trimmed = mergeWithExisting.replace(/\n+$/, "");
+    const normalized = mergeWithExisting.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+    const trimmed = normalized.replace(/\n+$/, "");
     if (trimmed.length > 0) {
       lines.push(...trimmed.split("\n"));
       lines.push("");
@@ -8099,8 +8135,27 @@ async function runBrowserAuth(serverUrl) {
   }
   const start = await startRes.json();
   const opened = openBrowser(start.verification_uri_complete);
-  if (!opened) {
-    throw new BrowserAuthError(`Open this URL in your browser: ${start.verification_uri_complete}`);
+  if (opened) {
+    process.stderr.write(
+      `
+  Your code: ${start.user_code}
+  Complete auth in your browser, then return here.
+
+`
+    );
+  } else {
+    process.stderr.write(
+      `
+  Could not open a browser automatically.
+  Open this URL manually:
+
+    ${start.verification_uri_complete}
+
+  Your code: ${start.user_code}
+  Waiting for you to complete auth in the browser...
+
+`
+    );
   }
   const deadline = Date.now() + start.expires_in * 1e3;
   const intervalMs = Math.max(1, start.interval) * 1e3;
@@ -28679,7 +28734,7 @@ var require_utils_webcrypto = __commonJS({
     var nodeCrypto = __require("crypto");
     module.exports = {
       postgresMd5PasswordHash,
-      randomBytes,
+      randomBytes: randomBytes2,
       deriveKey,
       sha256,
       hashByName,
@@ -28689,7 +28744,7 @@ var require_utils_webcrypto = __commonJS({
     var webCrypto = nodeCrypto.webcrypto || globalThis.crypto;
     var subtleCrypto = webCrypto.subtle;
     var textEncoder = new TextEncoder();
-    function randomBytes(length) {
+    function randomBytes2(length) {
       return webCrypto.getRandomValues(Buffer.alloc(length));
     }
     async function md5(string) {
@@ -42554,7 +42609,7 @@ var init_audit2 = __esm({
 async function runLoginFlow(client, options = {}) {
   const server = options.server ?? DEFAULT_SERVER_URL;
   const s = ft();
-  s.start("Opening browser for keynv login");
+  s.start("Waiting for authorization");
   let creds;
   try {
     creds = await runBrowserAuth(server);
@@ -42814,13 +42869,17 @@ async function runMenu() {
     if (u) R2.message(`${u.email} (${u.org_role}) @ ${u.server_url}`);
   }
   if (didLogin) {
-    const setup = await ue({
-      message: "Set up this project now?",
-      initialValue: true
-    });
-    if (!q(setup) && setup) {
-      const { runInitFlow: runInitFlow2 } = await Promise.resolve().then(() => (init_init(), init_exports));
-      await runInitFlow2(client, { cwd: process.cwd(), dryRun: false, noScripts: false });
+    const root = findProjectRoot(process.cwd());
+    const alreadyInitialized = root !== null && hasExistingKeynvEnv(root.path);
+    if (!alreadyInitialized) {
+      const setup = await ue({
+        message: "Set up this project now?",
+        initialValue: true
+      });
+      if (!q(setup) && setup) {
+        const { runInitFlow: runInitFlow2 } = await Promise.resolve().then(() => (init_init(), init_exports));
+        await runInitFlow2(client, { cwd: process.cwd(), dryRun: false, noScripts: false });
+      }
     }
   }
   while (true) {
@@ -42889,6 +42948,7 @@ var init_menu = __esm({
   "src/ui/menu.ts"() {
     init_dist5();
     init_http();
+    init_detect();
     init_store();
     init_version();
     init_audit2();
@@ -44615,44 +44675,48 @@ var AuditListCommand = class extends Command {
   sinceId = options_exports.String("--since-id");
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const data = await client.request(
-      "/v1/audit",
-      {
-        query: {
-          event_type: this.eventType,
-          limit: this.limit,
-          since_id: this.sinceId
+    try {
+      const client = new ApiClient();
+      const data = await client.request(
+        "/v1/audit",
+        {
+          query: {
+            event_type: this.eventType,
+            limit: this.limit,
+            since_id: this.sinceId
+          }
         }
-      }
-    );
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+      );
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return 0;
-    }
-    if (data.entries.length === 0) {
-      this.context.stdout.write("no audit entries\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["id", "ts", "actor", "agent", "event"],
-        data.entries.map((e2) => [
-          String(e2.id),
-          e2.ts,
-          e2.actor_user_id ?? "(none)",
-          e2.actor_agent,
-          e2.event_type
-        ])
-      )}
+        return 0;
+      }
+      if (data.entries.length === 0) {
+        this.context.stdout.write("no audit entries\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["id", "ts", "actor", "agent", "event"],
+          data.entries.map((e2) => [
+            String(e2.id),
+            e2.ts,
+            e2.actor_user_id ?? "(none)",
+            e2.actor_agent,
+            e2.event_type
+          ])
+        )}
 `
-    );
-    if (data.next_cursor) {
-      this.context.stdout.write(`(next: --since-id ${data.next_cursor})
+      );
+      if (data.next_cursor) {
+        this.context.stdout.write(`(next: --since-id ${data.next_cursor})
 `);
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 var AuditVerifyCommand = class extends Command {
@@ -44662,23 +44726,27 @@ var AuditVerifyCommand = class extends Command {
   });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const data = await client.request("/v1/audit/verify", { method: "POST" });
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      const data = await client.request("/v1/audit/verify", { method: "POST" });
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return data.ok ? 0 : 1;
-    }
-    if (data.ok) {
-      this.context.stdout.write(`OK: ${data.checked} entries verified
+        return data.ok ? 0 : 1;
+      }
+      if (data.ok) {
+        this.context.stdout.write(`OK: ${data.checked} entries verified
 `);
-      return 0;
-    }
-    this.context.stdout.write(
-      `FAIL: chain broken at id ${data.broken_at_id} (${data.reason}); ${data.checked} entries verified before break
+        return 0;
+      }
+      this.context.stdout.write(
+        `FAIL: chain broken at id ${data.broken_at_id} (${data.reason}); ${data.checked} entries verified before break
 `
-    );
-    return 1;
+      );
+      return 1;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 
@@ -44719,11 +44787,10 @@ async function resolveAllAliases(client, argv2, extraStrings = []) {
   return resolved;
 }
 function substitute(text, resolved) {
+  const sorted = [...resolved].sort((a, b2) => b2.alias.literal.length - a.alias.literal.length);
   let out = text;
-  for (const r of resolved) {
-    if (out.includes(r.alias.literal)) {
-      out = out.split(r.alias.literal).join(r.value);
-    }
+  for (const r of sorted) {
+    out = out.split(r.alias.literal).join(r.value);
   }
   return out;
 }
@@ -44826,10 +44893,18 @@ var BUILTIN_LINE_PATTERNS = BUILTIN_PATTERNS.filter((p2) => !p2.multiline);
 
 // ../../packages/redactor/dist/entropy.js
 var TOKEN_BOUNDARY_RE = /[\s,;:'"<>(){}[\]=]+/;
+var DEFAULT_EXCLUDE_PREFIXES = [
+  "sha1-",
+  "sha256:",
+  "sha256-",
+  "sha384-",
+  "sha512-"
+];
 var DEFAULTS = {
   enabled: true,
   minLength: 24,
-  minBitsPerChar: 4.5
+  minBitsPerChar: 4.5,
+  excludePrefixes: DEFAULT_EXCLUDE_PREFIXES
 };
 function shannonEntropy(s) {
   if (s.length === 0)
@@ -44862,9 +44937,13 @@ function findEntropyMatches(text, opts = {}) {
     const end = i;
     const token = text.slice(start, end);
     if (token.length >= cfg.minLength) {
-      const h2 = shannonEntropy(token);
-      if (h2 >= cfg.minBitsPerChar) {
-        matches.push({ start, end, token });
+      const lower = token.toLowerCase();
+      const excluded = cfg.excludePrefixes.some((p2) => lower.startsWith(p2));
+      if (!excluded) {
+        const h2 = shannonEntropy(token);
+        if (h2 >= cfg.minBitsPerChar) {
+          matches.push({ start, end, token });
+        }
       }
     }
   }
@@ -45008,7 +45087,19 @@ var ENV_ALLOWLIST = [
   "PWD",
   "OLDPWD",
   "TMPDIR",
-  "SSH_AUTH_SOCK"
+  "SSH_AUTH_SOCK",
+  // Windows-specific
+  "USERPROFILE",
+  "USERNAME",
+  "COMPUTERNAME",
+  "TEMP",
+  "TMP",
+  "SYSTEMROOT",
+  "SYSTEMDRIVE",
+  "WINDIR",
+  "COMSPEC",
+  "APPDATA",
+  "LOCALAPPDATA"
 ];
 function spawnPrivileged(opts) {
   const startedAt = Date.now();
@@ -45021,7 +45112,32 @@ function spawnPrivileged(opts) {
     for (const [k2, v2] of Object.entries(opts.injectedEnv)) env2[k2] = v2;
   }
   const stdio = ["inherit", "pipe", "pipe"];
-  const child = spawn(opts.command, opts.args, {
+  const WIN_BUILTINS = /* @__PURE__ */ new Set([
+    "echo",
+    "dir",
+    "type",
+    "copy",
+    "del",
+    "move",
+    "ren",
+    "md",
+    "mkdir",
+    "rd",
+    "rmdir",
+    "cd",
+    "cls",
+    "set",
+    "pause",
+    "find",
+    "where"
+  ]);
+  let spawnCmd = opts.command;
+  let spawnArgs = opts.args;
+  if (process.platform === "win32" && WIN_BUILTINS.has(opts.command.toLowerCase())) {
+    spawnCmd = process.env.COMSPEC ?? "cmd.exe";
+    spawnArgs = ["/d", "/s", "/c", opts.command, ...opts.args];
+  }
+  const child = spawn(spawnCmd, spawnArgs, {
     env: env2,
     stdio,
     detached: false
@@ -45152,7 +45268,11 @@ spelled \`--from\` to avoid the collision.)
 `);
         return 2;
       }
-      throw err;
+      this.context.stderr.write(
+        `keynv: unexpected error loading env file: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 2;
     }
     const viaEnvSpecs = [];
     for (const spec of this.viaEnv ?? []) {
@@ -45224,11 +45344,18 @@ spelled \`--from\` to avoid the collision.)
       injectedEnv[spec.name] = value;
     }
     if (envFileLoaded && !this.quiet) {
-      const total = envFileLoaded.entries.length;
-      const aliasCount = envFileLoaded.entries.filter((e2) => e2.isAlias).length;
+      const aliasEntries = envFileLoaded.entries.filter((e2) => e2.isAlias);
+      const plainEntries = envFileLoaded.entries.filter((e2) => !e2.isAlias);
+      const displayPath = relative(process.cwd(), envFileLoaded.path) || envFileLoaded.path;
+      const parts = [];
+      if (aliasEntries.length > 0) {
+        parts.push(aliasEntries.map((e2) => `${e2.name}=${e2.value}`).join(", ") + " (vault)");
+      }
+      if (plainEntries.length > 0) {
+        parts.push(plainEntries.map((e2) => e2.name).join(", ") + " (plain)");
+      }
       this.context.stderr.write(
-        `keynv: loaded ${total} var${total === 1 ? "" : "s"} from ${envFileLoaded.path} (${aliasCount} resolved from vault)
-`
+        `keynv: loaded ${displayPath}` + (parts.length > 0 ? ` \u2014 ${parts.join("; ")}` : "") + "\n"
       );
     }
     const timeoutS = this.timeout ? Number.parseInt(this.timeout, 10) : void 0;
@@ -45268,10 +45395,158 @@ function signalNumber(sig) {
 }
 
 // src/commands/init.ts
+init_dist();
 init_http();
+init_envFile();
+init_heuristics();
 init_init();
 init_cancel();
 init_tty();
+
+// src/commands/project.ts
+init_http();
+init_format();
+function isProjectId(input) {
+  return input.startsWith("p_") || /^[a-f0-9]{20,}$/i.test(input);
+}
+async function resolveProjectId(client, input) {
+  if (isProjectId(input)) {
+    return input;
+  }
+  const data = await client.request("/v1/projects");
+  const match = data.projects.find((p2) => p2.name === input);
+  if (!match) throw new Error(`project not found: ${input}`);
+  return match.id;
+}
+var ProjectListCommand = class extends Command {
+  static paths = [["project", "list"]];
+  static usage = Command.Usage({
+    description: "List projects visible to the current user."
+  });
+  json = options_exports.Boolean("--json", false);
+  async execute() {
+    try {
+      const client = new ApiClient();
+      const data = await client.request("/v1/projects");
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+        return 0;
+      }
+      if (data.projects.length === 0) {
+        this.context.stdout.write("no projects\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["name", "id", "created_at"],
+          data.projects.map((p2) => [p2.name, p2.id, p2.created_at])
+        )}
+`
+      );
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
+  }
+};
+var ProjectCreateCommand = class extends Command {
+  static paths = [["project", "create"]];
+  static usage = Command.Usage({
+    description: "Create a new project with one or more environments.",
+    examples: [["Two envs", "$0 project create billing --env dev --env prod:production:approval"]]
+  });
+  name = options_exports.String();
+  envs = options_exports.Array("--env", {
+    description: 'Environment spec: name[:tier[:approval]]. Tier \u2208 {production,non-production}; "approval" sets require_approval=true.'
+  });
+  async execute() {
+    try {
+      const envs = (this.envs ?? ["dev"]).map((spec) => {
+        const [name, tier, approval] = spec.split(":");
+        return {
+          name: name ?? "",
+          tier: tier ?? "non-production",
+          require_approval: approval === "approval"
+        };
+      });
+      const client = new ApiClient();
+      const result = await client.request("/v1/projects", {
+        method: "POST",
+        body: { name: this.name, environments: envs }
+      });
+      this.context.stdout.write(`created project ${result.name} (${result.id})
+`);
+      for (const e2 of envs) {
+        this.context.stdout.write(
+          `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
+`
+        );
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
+  }
+};
+var ProjectDescribeCommand = class extends Command {
+  static paths = [["project", "describe"]];
+  static usage = Command.Usage({
+    description: "Show metadata for one project.",
+    examples: [
+      ["By ID", "$0 project describe p_go6rqgwz0wlokdsl55ikn"],
+      ["By name", "$0 project describe myproject"]
+    ]
+  });
+  id = options_exports.String();
+  json = options_exports.Boolean("--json", false);
+  async execute() {
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.id);
+      const data = await client.request(`/v1/projects/${projectId2}`);
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+        return 0;
+      }
+      this.context.stdout.write(`project: ${data.name} (${data.id})
+`);
+      for (const e2 of data.environments) {
+        this.context.stdout.write(
+          `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
+`
+        );
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
+  }
+};
+var ProjectDeleteCommand = class extends Command {
+  static paths = [["project", "delete"]];
+  static usage = Command.Usage({ description: "Soft-delete a project." });
+  id = options_exports.String();
+  force = options_exports.Boolean("--force", false);
+  async execute() {
+    if (!this.force) {
+      this.context.stderr.write("keynv: refusing to delete without --force\n");
+      return 2;
+    }
+    try {
+      const client = new ApiClient();
+      await client.request(`/v1/projects/${this.id}`, { method: "DELETE" });
+      this.context.stdout.write(`deleted project ${this.id}
+`);
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
+  }
+};
+
+// src/commands/init.ts
 var InitCommand = class extends Command {
   static paths = [["init"]];
   static usage = Command.Usage({
@@ -45285,6 +45560,11 @@ package.json scripts with \`keynv exec\`.
 Safe to re-run: existing .keynv.env entries are preserved; new
 entries are appended below a marker.
 
+--dry-run prints the secrets that would be uploaded and the alias
+mappings that would be written to .keynv.env, then exits without
+touching any files or making any network calls. Use it to preview
+what init will do before committing.
+
 Requires an interactive terminal (clack TUI). For scripted
 migration, use the lower-level \`keynv project\` and \`keynv secret\`
 commands directly.
@@ -45292,28 +45572,47 @@ commands directly.
     examples: [
       ["Walk the current project", "$0 init"],
       ["Preview without writing or uploading", "$0 init --dry-run"],
-      ["Skip the package.json script-wrapping step", "$0 init --no-scripts"]
+      ["Skip the package.json script-wrapping step", "$0 init --no-scripts"],
+      ["Non-interactive (CI/CD)", "$0 init --env-file .env --project myproject --env dev"]
     ]
   });
   dryRun = options_exports.Boolean("--dry-run", false, {
-    description: "Show what would be done without writing files or uploading secrets."
+    description: "Scan .env files and print the secrets that would be uploaded and the alias mappings that would be written \u2014 no files written, no vault calls made."
   });
   noScripts = options_exports.Boolean("--no-scripts", false, {
     description: "Skip the package.json script-wrapping step."
   });
+  envFile = options_exports.String("--env-file", {
+    description: "Path to .env file to migrate (non-interactive mode)."
+  });
+  project = options_exports.String("--project", {
+    description: "Project name or ID (non-interactive mode)."
+  });
+  env = options_exports.String("--env", {
+    description: "Environment name for --env-file (default: dev)."
+  });
+  secret = options_exports.Array("--secret", {
+    description: "KEY=value secret to upload (non-interactive). Can be specified multiple times."
+  });
   async execute() {
-    if (!isInteractive()) {
-      this.context.stderr.write(
-        "keynv init requires an interactive terminal. Use the lower-level commands (`keynv project`, `keynv secret`) for scripted setup.\n"
-      );
-      return 1;
-    }
     const client = new ApiClient();
     await client.ensureHydrated();
     if (!client.isLoggedIn) {
       this.context.stderr.write("keynv: not logged in. Run `keynv login` first.\n");
       return 1;
     }
+    const hasEnvFile = this.envFile != null;
+    const hasSecrets = this.secret != null && this.secret.length > 0;
+    const isNonInteractive = hasEnvFile || hasSecrets;
+    if (isNonInteractive) {
+      return this.runNonInteractive(client);
+    }
+    if (!isInteractive()) {
+      this.context.stderr.write(
+        "keynv init requires an interactive terminal. Use --env-file or --secret for scripted setup.\n"
+      );
+      return 1;
+    }
     try {
       const outcome = await runInitFlow(client, {
         cwd: process.cwd(),
@@ -45329,6 +45628,97 @@ commands directly.
       return 1;
     }
   }
+  async runNonInteractive(client) {
+    const projectName = this.project;
+    if (!projectName) {
+      this.context.stderr.write("keynv: --project is required in non-interactive mode.\n");
+      return 1;
+    }
+    const resolved = await resolveProjectId(client, projectName);
+    if (!resolved) {
+      this.context.stderr.write(`keynv: project not found: ${projectName}
+`);
+      return 1;
+    }
+    const projectId2 = resolved;
+    const envName = this.env ?? "dev";
+    const secrets = [];
+    if (this.envFile) {
+      try {
+        const content = readFileSync(this.envFile, "utf8");
+        const entries = parseEnvFile(content, this.envFile);
+        for (const e2 of entries) {
+          if (classifyEntry(e2.name, e2.value).verdict === "secret") {
+            secrets.push({ name: e2.name, value: e2.value });
+          }
+        }
+      } catch (err) {
+        this.context.stderr.write(
+          `keynv: cannot read ${this.envFile}: ${err instanceof Error ? err.message : String(err)}
+`
+        );
+        return 1;
+      }
+    }
+    if (this.secret) {
+      for (const spec of this.secret) {
+        const eq = spec.indexOf("=");
+        if (eq <= 0) {
+          this.context.stderr.write(`keynv: invalid --secret '${spec}', expected KEY=value
+`);
+          return 1;
+        }
+        const name = spec.slice(0, eq);
+        const value = spec.slice(eq + 1);
+        secrets.push({ name, value });
+      }
+    }
+    if (secrets.length === 0) {
+      this.context.stdout.write("keynv: nothing to migrate.\n");
+      return 0;
+    }
+    if (this.dryRun) {
+      this.context.stdout.write(
+        `keynv: dry-run \u2014 would upload ${secrets.length} secret(s) to project ${projectName} (${projectId2}) in env ${envName}
+`
+      );
+      for (const { name } of secrets) {
+        const aliasKey = name.toLowerCase().replace(/_/g, "-");
+        this.context.stdout.write(`  ${name}=@${projectName}.${envName}.${aliasKey}
+`);
+      }
+      return 0;
+    }
+    let uploaded = 0;
+    const failed = [];
+    for (const { name, value } of secrets) {
+      const aliasKey = name.toLowerCase().replace(/_/g, "-");
+      const alias2 = buildAlias({ project: projectName, environment: envName, key: aliasKey });
+      if (!alias2) {
+        failed.push(`${name} (invalid alias key: ${aliasKey})`);
+        continue;
+      }
+      try {
+        await client.request(`/v1/projects/${projectId2}/secrets`, {
+          method: "POST",
+          body: { env: envName, key: aliasKey, value }
+        });
+        uploaded++;
+      } catch (err) {
+        failed.push(`${name}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    this.context.stdout.write(
+      `keynv: uploaded ${uploaded}/${secrets.length} secret(s) to ${projectName}.${envName}
+`
+    );
+    if (failed.length > 0) {
+      for (const f of failed) this.context.stderr.write(`  failed: ${f}
+`);
+      return 1;
+    }
+    return 0;
+  }
 };
 
 // src/commands/login.ts
@@ -45408,6 +45798,13 @@ var LoginCommand = class extends Command {
   });
   async execute() {
     const finalServerUrl = this.server ?? DEFAULT_SERVER_URL;
+    try {
+      new URL(finalServerUrl);
+    } catch {
+      this.context.stderr.write(`keynv: invalid server URL '${finalServerUrl}'
+`);
+      return 1;
+    }
     if (this.token) {
       return this.loginWithToken(finalServerUrl, this.token);
     }
@@ -45430,11 +45827,20 @@ var LoginCommand = class extends Command {
     }
     const email2 = this.email ?? await promptLine("email: ");
     const password = this.password ?? await promptHidden("password: ");
-    const res = await fetch(new URL("/v1/auth/login", finalServerUrl).toString(), {
-      method: "POST",
-      headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
-      body: JSON.stringify({ email: email2, password })
-    });
+    let res;
+    try {
+      res = await fetch(new URL("/v1/auth/login", finalServerUrl).toString(), {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
+        body: JSON.stringify({ email: email2, password })
+      });
+    } catch (err) {
+      this.context.stderr.write(
+        `keynv: cannot reach server '${finalServerUrl}' \u2014 ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 1;
+    }
     if (!res.ok) {
       const text = await res.text();
       let msg = `login failed (${res.status})`;
@@ -45480,9 +45886,18 @@ var LoginCommand = class extends Command {
     return 0;
   }
   async loginWithToken(serverUrl, token) {
-    const res = await fetch(new URL("/v1/whoami", serverUrl).toString(), {
-      headers: { authorization: `Bearer ${token}`, "x-keynv-agent": AGENT }
-    });
+    let res;
+    try {
+      res = await fetch(new URL("/v1/whoami", serverUrl).toString(), {
+        headers: { authorization: `Bearer ${token}`, "x-keynv-agent": AGENT }
+      });
+    } catch (err) {
+      this.context.stderr.write(
+        `keynv: cannot reach server '${serverUrl}' \u2014 ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 1;
+    }
     if (!res.ok) {
       const text = await res.text();
       let msg = `token login failed (${res.status})`;
@@ -45560,48 +45975,46 @@ var WhoamiCommand = class extends Command {
   });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    if (!client.isLoggedIn) {
-      this.context.stderr.write("keynv: not logged in. Run `keynv login`.\n");
-      return 1;
-    }
-    const data = await client.request("/v1/whoami");
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      if (!client.isLoggedIn) {
+        this.context.stderr.write("keynv: not logged in. Run `keynv login`.\n");
+        return 1;
+      }
+      const data = await client.request("/v1/whoami");
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return 0;
-    }
-    this.context.stdout.write(`user:    ${data.email} (${data.id})
+        return 0;
+      }
+      this.context.stdout.write(`user:    ${data.email} (${data.id})
 `);
-    this.context.stdout.write(`org:     ${data.org_id}
+      const orgDisplay = data.org_name ? `${data.org_name} (${data.org_id})` : data.org_id;
+      this.context.stdout.write(`org:     ${orgDisplay}
 `);
-    this.context.stdout.write(`role:    ${data.org_role}
+      this.context.stdout.write(`role:    ${data.org_role}
 `);
-    if (data.memberships.length === 0) {
-      this.context.stdout.write("memberships: (none)\n");
-    } else {
-      this.context.stdout.write("memberships:\n");
-      for (const m of data.memberships) {
-        this.context.stdout.write(`  ${m.project_id}: ${m.role}
+      if (data.memberships.length === 0) {
+        this.context.stdout.write("memberships: (none)\n");
+      } else {
+        this.context.stdout.write("memberships:\n");
+        for (const m of data.memberships) {
+          const proj = m.project_name ? `${m.project_name} (${m.project_id})` : m.project_id;
+          this.context.stdout.write(`  ${proj}: ${m.role}
 `);
+        }
       }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 
 // src/commands/member.ts
 init_http();
 init_format();
-async function findProjectIdByName(client, name) {
-  const data = await client.request(
-    "/v1/projects"
-  );
-  const match = data.projects.find((p2) => p2.name === name);
-  if (!match) throw new Error(`unknown project: ${name}`);
-  return match.id;
-}
 var MemberAddCommand = class extends Command {
   static paths = [["member", "add"]];
   static usage = Command.Usage({
@@ -45617,15 +46030,19 @@ var MemberAddCommand = class extends Command {
       this.context.stderr.write("keynv: --role must be one of lead, developer, reader\n");
       return 1;
     }
-    const client = new ApiClient();
-    const projectId2 = await findProjectIdByName(client, this.project);
-    await client.request(`/v1/projects/${projectId2}/members`, {
-      method: "POST",
-      body: { email: this.email, role: role2 }
-    });
-    this.context.stdout.write(`added ${this.email} to ${this.project} as ${role2}
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.project);
+      await client.request(`/v1/projects/${projectId2}/members`, {
+        method: "POST",
+        body: { email: this.email, role: role2 }
+      });
+      this.context.stdout.write(`added ${this.email} to ${this.project} as ${role2}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var MemberRemoveCommand = class extends Command {
@@ -45634,21 +46051,25 @@ var MemberRemoveCommand = class extends Command {
   project = options_exports.String();
   email = options_exports.String();
   async execute() {
-    const client = new ApiClient();
-    const projectId2 = await findProjectIdByName(client, this.project);
-    const members = await client.request(`/v1/projects/${projectId2}/members`);
-    const target = members.members.find((m) => m.email === this.email);
-    if (!target) {
-      this.context.stderr.write(`keynv: ${this.email} is not a member of ${this.project}
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.project);
+      const members = await client.request(`/v1/projects/${projectId2}/members`);
+      const target = members.members.find((m) => m.email === this.email);
+      if (!target) {
+        this.context.stderr.write(`keynv: ${this.email} is not a member of ${this.project}
 `);
-      return 1;
-    }
-    await client.request(`/v1/projects/${projectId2}/members/${target.user_id}`, {
-      method: "DELETE"
-    });
-    this.context.stdout.write(`removed ${this.email} from ${this.project}
+        return 1;
+      }
+      await client.request(`/v1/projects/${projectId2}/members/${target.user_id}`, {
+        method: "DELETE"
+      });
+      this.context.stdout.write(`removed ${this.email} from ${this.project}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var MemberListCommand = class extends Command {
@@ -45657,134 +46078,30 @@ var MemberListCommand = class extends Command {
   project = options_exports.String();
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const projectId2 = await findProjectIdByName(client, this.project);
-    const data = await client.request(`/v1/projects/${projectId2}/members`);
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
-`);
-      return 0;
-    }
-    if (data.members.length === 0) {
-      this.context.stdout.write("no members\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["email", "role", "granted_at"],
-        data.members.map((m) => [m.email, m.role, m.granted_at])
-      )}
-`
-    );
-    return 0;
-  }
-};
-
-// src/commands/project.ts
-init_http();
-init_format();
-var ProjectListCommand = class extends Command {
-  static paths = [["project", "list"]];
-  static usage = Command.Usage({
-    description: "List projects visible to the current user."
-  });
-  json = options_exports.Boolean("--json", false);
-  async execute() {
-    const client = new ApiClient();
-    const data = await client.request("/v1/projects");
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
-`);
-      return 0;
-    }
-    if (data.projects.length === 0) {
-      this.context.stdout.write("no projects\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["name", "id", "created_at"],
-        data.projects.map((p2) => [p2.name, p2.id, p2.created_at])
-      )}
-`
-    );
-    return 0;
-  }
-};
-var ProjectCreateCommand = class extends Command {
-  static paths = [["project", "create"]];
-  static usage = Command.Usage({
-    description: "Create a new project with one or more environments.",
-    examples: [["Two envs", "$0 project create billing --env dev --env prod:production:approval"]]
-  });
-  name = options_exports.String();
-  envs = options_exports.Array("--env", {
-    description: 'Environment spec: name[:tier[:approval]]. Tier \u2208 {production,non-production}; "approval" sets require_approval=true.'
-  });
-  async execute() {
-    const envs = (this.envs ?? ["dev"]).map((spec) => {
-      const [name, tier, approval] = spec.split(":");
-      return {
-        name: name ?? "",
-        tier: tier ?? "non-production",
-        require_approval: approval === "approval"
-      };
-    });
-    const client = new ApiClient();
-    const result = await client.request("/v1/projects", {
-      method: "POST",
-      body: { name: this.name, environments: envs }
-    });
-    this.context.stdout.write(`created project ${result.name} (${result.id})
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.project);
+      const data = await client.request(`/v1/projects/${projectId2}/members`);
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-    for (const e2 of envs) {
+        return 0;
+      }
+      if (data.members.length === 0) {
+        this.context.stdout.write("no members\n");
+        return 0;
+      }
       this.context.stdout.write(
-        `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
+        `${table(
+          ["email", "role", "granted_at"],
+          data.members.map((m) => [m.email, m.role, m.granted_at])
+        )}
 `
       );
-    }
-    return 0;
-  }
-};
-var ProjectDescribeCommand = class extends Command {
-  static paths = [["project", "describe"]];
-  static usage = Command.Usage({ description: "Show metadata for one project." });
-  id = options_exports.String();
-  json = options_exports.Boolean("--json", false);
-  async execute() {
-    const client = new ApiClient();
-    const data = await client.request(`/v1/projects/${this.id}`);
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
-`);
       return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    this.context.stdout.write(`project: ${data.name} (${data.id})
-`);
-    for (const e2 of data.environments) {
-      this.context.stdout.write(
-        `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
-`
-      );
-    }
-    return 0;
-  }
-};
-var ProjectDeleteCommand = class extends Command {
-  static paths = [["project", "delete"]];
-  static usage = Command.Usage({ description: "Soft-delete a project." });
-  id = options_exports.String();
-  force = options_exports.Boolean("--force", false);
-  async execute() {
-    if (!this.force) {
-      this.context.stderr.write("keynv: refusing to delete without --force\n");
-      return 2;
-    }
-    const client = new ApiClient();
-    await client.request(`/v1/projects/${this.id}`, { method: "DELETE" });
-    this.context.stdout.write(`deleted project ${this.id}
-`);
-    return 0;
   }
 };
 var RedactCommand = class extends Command {
@@ -45829,11 +46146,9 @@ var RedactStreamCommand = class extends Command {
   static usage = Command.Usage({
     description: "Stream stdin through the line-buffered redactor to stdout.",
     details: `
-Used as a hook handler by per-agent integrations (e.g., Claude Code's
-PostToolUse hook): \`keynv redact-stream\` reads its tool output on
-stdin and writes a redacted version on stdout, preserving the original
-line structure. Multi-line patterns are NOT applied here (see the
-streaming-mode limitation in @keynv/redactor).
+Pipe any output through the line-buffered redactor to stdout.
+Preserves original line structure. Multi-line patterns are NOT applied
+here (see the streaming-mode limitation in the redactor package).
 `
   });
   async execute() {
@@ -45854,12 +46169,7 @@ init_cancel();
 init_pickProject();
 init_pickSecret();
 init_tty();
-async function findProjectIdByName2(client, name) {
-  const data = await client.request("/v1/projects");
-  const match = data.projects.find((p2) => p2.name === name);
-  if (!match) throw new Error(`unknown project: ${name}`);
-  return match.id;
-}
+var ALIAS_FORMAT_HINT = "Format: @<project>.<env>.<KEY>  (project/env: lowercase kebab-case; key: letters, digits, _ or -)";
 function missingAlias(stderr) {
   stderr.write("keynv: missing <alias> (TTY required for interactive prompt).\n");
   return 1;
@@ -45890,45 +46200,50 @@ var SecretCreateCommand = class extends Command {
   });
   stdin = options_exports.Boolean("--stdin", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    let value = this.value;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        const built = await promptNewSecret(client);
-        if (!built) return 1;
-        alias2 = built.alias;
-        value = built.value;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      let value = this.value;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          const built = await promptNewSecret(client);
+          if (!built) return 1;
+          alias2 = built.alias;
+          value = built.value;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
       }
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'. Expected @project.env.key.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+  ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    if (this.stdin) {
-      const chunks = [];
-      for await (const chunk of this.context.stdin) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        return 1;
       }
-      value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
-    } else if (value === void 0) {
-      value = await promptHidden("value: ");
-    }
-    const projectId2 = await findProjectIdByName2(client, parsed.project);
-    await client.request(`/v1/projects/${projectId2}/secrets`, {
-      method: "POST",
-      body: { env: parsed.environment, key: parsed.key, value }
-    });
-    this.context.stdout.write(`created ${parsed.literal}
+      if (this.stdin) {
+        const chunks = [];
+        for await (const chunk of this.context.stdin) {
+          chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        }
+        value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
+      } else if (value === void 0) {
+        value = await promptHidden("value: ");
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      await client.request(`/v1/projects/${projectId2}/secrets`, {
+        method: "POST",
+        body: { env: parsed.environment, key: parsed.key, value }
+      });
+      this.context.stdout.write(`created ${parsed.literal}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var SecretGetCommand = class extends Command {
@@ -45939,39 +46254,44 @@ var SecretGetCommand = class extends Command {
   alias = options_exports.String({ required: false });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        alias2 = await pickAliasInteractive(client) ?? void 0;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          alias2 = await pickAliasInteractive(client) ?? void 0;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
+        if (!alias2) return 1;
       }
-      if (!alias2) return 1;
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+  ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    const projectId2 = await findProjectIdByName2(client, parsed.project);
-    const data = await client.request(
-      `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`
-    );
-    if (this.json) {
-      this.context.stdout.write(
-        `${JSON.stringify({ alias: data.alias, version: data.version, value: data.value })}
-`
+        return 1;
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      const data = await client.request(
+        `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`
       );
-    } else {
-      this.context.stdout.write(`${data.value}
+      if (this.json) {
+        this.context.stdout.write(
+          `${JSON.stringify({ alias: data.alias, version: data.version, value: data.value })}
+`
+        );
+      } else {
+        this.context.stdout.write(`${data.value}
 `);
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 var SecretListCommand = class extends Command {
@@ -45982,42 +46302,47 @@ var SecretListCommand = class extends Command {
   project = options_exports.String({ required: false });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let projectName = this.project;
-    if (!projectName) {
-      if (!isInteractive()) {
-        this.context.stderr.write("keynv: missing <project>.\n");
-        return 1;
-      }
-      try {
-        const picked = await pickProject(client, "Project");
-        if (!picked) return 1;
-        projectName = picked.name;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let projectName = this.project;
+      if (!projectName) {
+        if (!isInteractive()) {
+          this.context.stderr.write("keynv: missing <project>.\n");
+          return 1;
+        }
+        try {
+          const picked = await pickProject(client, "Project");
+          if (!picked) return 1;
+          projectName = picked.name;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
       }
-    }
-    const projectId2 = await findProjectIdByName2(client, projectName);
-    const data = await client.request(`/v1/projects/${projectId2}/secrets`);
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+      const resolvedProjectName = projectName.startsWith("@") ? projectName.slice(1).split(".")[0] ?? projectName : projectName;
+      const projectId2 = await resolveProjectId(client, resolvedProjectName);
+      const data = await client.request(`/v1/projects/${projectId2}/secrets`);
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
+        return 0;
+      }
+      if (data.secrets.length === 0) {
+        this.context.stdout.write("no secrets\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["alias", "version", "created_at"],
+          data.secrets.map((s) => [s.alias, String(s.version), s.created_at])
+        )}
+`
+      );
       return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    if (data.secrets.length === 0) {
-      this.context.stdout.write("no secrets\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["alias", "version", "created_at"],
-        data.secrets.map((s) => [s.alias, String(s.version), s.created_at])
-      )}
-`
-    );
-    return 0;
   }
 };
 var SecretRotateCommand = class extends Command {
@@ -46027,45 +46352,50 @@ var SecretRotateCommand = class extends Command {
   value = options_exports.String("--value");
   stdin = options_exports.Boolean("--stdin", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        alias2 = await pickAliasInteractive(client) ?? void 0;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          alias2 = await pickAliasInteractive(client) ?? void 0;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
+        if (!alias2) return 1;
       }
-      if (!alias2) return 1;
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+  ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    let value;
-    if (this.stdin) {
-      const chunks = [];
-      for await (const chunk of this.context.stdin) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        return 1;
       }
-      value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
-    } else if (this.value !== void 0) {
-      value = this.value;
-    } else {
-      value = await promptHidden("new value: ");
-    }
-    const projectId2 = await findProjectIdByName2(client, parsed.project);
-    const data = await client.request(
-      `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}/rotate`,
-      { method: "POST", body: { new_value: value } }
-    );
-    this.context.stdout.write(`rotated ${data.alias} \u2192 v${data.version}
+      let value;
+      if (this.stdin) {
+        const chunks = [];
+        for await (const chunk of this.context.stdin) {
+          chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        }
+        value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
+      } else if (this.value !== void 0) {
+        value = this.value;
+      } else {
+        value = await promptHidden("new value: ");
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      const data = await client.request(
+        `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}/rotate`,
+        { method: "POST", body: { new_value: value } }
+      );
+      this.context.stdout.write(`rotated ${data.alias} \u2192 v${data.version}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var SecretDeleteCommand = class extends Command {
@@ -46073,31 +46403,170 @@ var SecretDeleteCommand = class extends Command {
   static usage = Command.Usage({ description: "Soft-delete a secret." });
   alias = options_exports.String({ required: false });
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        alias2 = await pickAliasInteractive(client) ?? void 0;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          alias2 = await pickAliasInteractive(client) ?? void 0;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
+        if (!alias2) return 1;
       }
-      if (!alias2) return 1;
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+  ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
+        return 1;
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      await client.request(`/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`, {
+        method: "DELETE"
+      });
+      this.context.stdout.write(`deleted ${parsed.literal}
+`);
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    const projectId2 = await findProjectIdByName2(client, parsed.project);
-    await client.request(`/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`, {
-      method: "DELETE"
-    });
-    this.context.stdout.write(`deleted ${parsed.literal}
+  }
+};
+function generateSecret(bytes = 32) {
+  return randomBytes(bytes).toString("base64");
+}
+var ServerInitCommand = class extends Command {
+  static paths = [["server", "init"]];
+  static usage = Command.Usage({
+    description: "Generate secrets and deployment files for a new keynv server.",
+    details: `
+Interactive onboarding wizard that generates the configuration
+a fresh keynv server needs: JWT signing secret, master encryption
+key, and deployment templates.
+
+Outputs:
+  \u2022 A .keynv-server.env file you feed into your deployment
+    (Docker Compose, Coolify, or bare-metal).
+  \u2022 Optionally a docker-compose.yml in the current directory.
+
+Non-interactive with --yes to skip prompts.
+`,
+    examples: [
+      ["Interactive wizard", "$0 server init"],
+      ["Non-interactive (CI/scripts)", "$0 server init --yes"],
+      ["Docker Compose output", "$0 server init --compose"],
+      ["Custom output path", "$0 server init --out ./config/env"]
+    ]
+  });
+  yes = options_exports.Boolean("--yes", false, {
+    description: "Skip all prompts (non-interactive)."
+  });
+  compose = options_exports.Boolean("--compose", false, {
+    description: "Also write a docker-compose.yml to the current directory."
+  });
+  out = options_exports.String("--out", {
+    description: "Write server env file to this path (default: .keynv-server.env)."
+  });
+  async execute() {
+    const jwtSecret = generateSecret(48);
+    const masterKey = generateSecret(32);
+    const webSessionSecret = generateSecret(48);
+    const outPath = this.out ?? ".keynv-server.env";
+    const contents = [
+      "# Generated by `keynv server init`.",
+      "# Keep this file secret \u2014 it contains cryptographic key material.",
+      `KEYNV_JWT_SECRET=${jwtSecret}`,
+      `KEYNV_MASTER_KEY=${masterKey}`,
+      "",
+      "# Web dashboard session secret (required for Next.js JWE session tokens).",
+      `KEYNV_WEB_SESSION_SECRET=${webSessionSecret}`,
+      "",
+      "# Server configuration (uncomment and adjust):",
+      "# KEYNV_PORT=8080",
+      "# KEYNV_WEB_URL=https://keynv.example.com",
+      "# KEYNV_PUBLIC_REGISTRATION=false",
+      "# KEYNV_DB_PATH=./keynv.db",
+      "# KEYNV_MASTER_KEY_FILE=./master.key",
+      "# KEYNV_RATE_LIMIT_PER_MINUTE=120",
+      "# KEYNV_ARGON2_MEMORY_KIB=46080",
+      "# KEYNV_ARGON2_TIME_COST=3"
+    ].join("\n");
+    const { writeFileSync: writeFileSync4 } = await import('fs');
+    writeFileSync4(outPath, `${contents}
 `);
+    this.context.stdout.write(`Wrote ${outPath}
+
+`);
+    this.context.stdout.write("Generated secrets:\n");
+    this.context.stdout.write(
+      `  KEYNV_JWT_SECRET         ${jwtSecret.slice(0, 8)}... (base64, 48 bytes)
+`
+    );
+    this.context.stdout.write(
+      `  KEYNV_MASTER_KEY         ${masterKey.slice(0, 8)}... (base64, 32 bytes)
+`
+    );
+    this.context.stdout.write(
+      `  KEYNV_WEB_SESSION_SECRET ${webSessionSecret.slice(0, 8)}... (base64, 48 bytes)
+`
+    );
+    this.context.stdout.write("\nNext steps:\n");
+    this.context.stdout.write(`  1. Feed ${outPath} into your deployment:
+`);
+    this.context.stdout.write("     docker compose --env-file .keynv-server.env up -d\n");
+    this.context.stdout.write("     or load it into Coolify as environment variables.\n");
+    this.context.stdout.write("  2. Bootstrap the first owner:\n");
+    this.context.stdout.write(
+      "     docker exec -it <server-container> node dist/bootstrap.js \\\n"
+    );
+    this.context.stdout.write("       --owner-email alice@example.com \\\n");
+    this.context.stdout.write('       --owner-password "<a long random password>" \\\n');
+    this.context.stdout.write('       --org-name "Acme Inc"\n');
+    this.context.stdout.write("  3. Install the CLI and log in:\n");
+    this.context.stdout.write("     npm install -g @keynv/cli\n");
+    this.context.stdout.write("     keynv login --server https://keynv.example.com\n");
+    this.context.stdout.write("  4. Onboard your first project:\n");
+    this.context.stdout.write("     cd your-project && keynv init\n");
+    if (this.compose) {
+      const composeContent = `# keynv server + Litestream sidecar
+# Generated by \`keynv server init\`.
+# Load with: docker compose --env-file .keynv-server.env up -d
+
+services:
+  server:
+    image: ghcr.io/keynv-labs/keynv-server:latest
+    restart: unless-stopped
+    ports:
+      - '8080:8080'
+    env_file:
+      - .keynv-server.env
+    volumes:
+      - keynv-data:/data
+
+  litestream:
+    image: litestream/litestream:latest
+    restart: unless-stopped
+    volumes:
+      - keynv-data:/data
+    command: replicate
+    environment:
+      LITESTREAM_DB_PATH: /data/keynv.db
+      LITESTREAM_REPLICA_URL: s3://your-bucket/keynv
+      AWS_ACCESS_KEY_ID: \${LITESTREAM_AWS_ACCESS_KEY_ID}
+      AWS_SECRET_ACCESS_KEY: \${LITESTREAM_AWS_SECRET_ACCESS_KEY}
+
+volumes:
+  keynv-data:
+`;
+      writeFileSync4("docker-compose.yml", composeContent);
+      this.context.stdout.write(
+        "\nWrote docker-compose.yml (update Litestream S3 config before deploying).\n"
+      );
+    }
     return 0;
   }
 };
@@ -46453,18 +46922,9 @@ var TESTERS = [
   sshTester,
   httpTester
 ];
-function findTester(type) {
-  return TESTERS.find((t) => t.type === type) ?? null;
-}
 
 // src/commands/test.ts
 init_http();
-async function findProjectIdByName3(client, name) {
-  const data = await client.request("/v1/projects");
-  const match = data.projects.find((p2) => p2.name === name);
-  if (!match) throw new Error(`unknown project: ${name}`);
-  return match.id;
-}
 function parseTargets(specs) {
   const out = {};
   for (const spec of specs) {
@@ -46518,12 +46978,17 @@ the error message.
       );
       return 2;
     }
-    const tester = findTester(this.as);
+    const tester = TESTERS.find((t) => t.type === this.as);
     if (!tester) {
       this.context.stderr.write(`keynv: unknown tester '${this.as}'
 `);
       return 1;
     }
+    const timeoutMs = this.timeout ? Number.parseInt(this.timeout, 10) * 1e3 : void 0;
+    if (this.timeout && (timeoutMs === void 0 || Number.isNaN(timeoutMs))) {
+      this.context.stderr.write("keynv: invalid --timeout (expected integer seconds)\n");
+      return 2;
+    }
     let target;
     try {
       target = parseTargets(this.targets ?? []);
@@ -46540,7 +47005,7 @@ the error message.
     }
     let value;
     try {
-      const projectId2 = await findProjectIdByName3(client, parsedAlias.project);
+      const projectId2 = await resolveProjectId(client, parsedAlias.project);
       const data = await client.request(
         `/v1/projects/${projectId2}/secrets/${parsedAlias.environment}/${parsedAlias.key}`
       );
@@ -46551,11 +47016,6 @@ the error message.
 `);
       return 1;
     }
-    const timeoutMs = this.timeout ? Number.parseInt(this.timeout, 10) * 1e3 : void 0;
-    if (this.timeout && (timeoutMs === void 0 || Number.isNaN(timeoutMs))) {
-      this.context.stderr.write("keynv: invalid --timeout (expected integer seconds)\n");
-      return 2;
-    }
     const result = await runTest({
       tester,
       secret: { alias: parsedAlias.literal, value },
@@ -46597,25 +47057,6 @@ the error message.
   }
 };
 
-// src/commands/ui.ts
-init_tty();
-init_menu();
-var UICommand = class extends Command {
-  static paths = [["ui"]];
-  static usage = Command.Usage({
-    description: "Open the interactive menu (also runs by default when no args are given)."
-  });
-  async execute() {
-    if (!isInteractive()) {
-      this.context.stdout.write(
-        "keynv \u2014 AI-safe secrets management.\nRun `keynv --help` for the full command list, or run `keynv` in an interactive\nterminal to open the menu.\n"
-      );
-      return 0;
-    }
-    return runMenu();
-  }
-};
-
 // src/index.ts
 init_format();
 init_version();
@@ -46649,7 +47090,7 @@ cli.register(InitCommand);
 cli.register(RedactCommand);
 cli.register(RedactStreamCommand);
 cli.register(TestCommand);
-cli.register(UICommand);
+cli.register(ServerInitCommand);
 var argv = process.argv.slice(2);
 if (argv.length === 0) {
   const { runMenu: runMenu2 } = await Promise.resolve().then(() => (init_menu(), menu_exports));