@keynv/cli 0.1.0-rc.12 → 0.1.0-rc.13

package/dist/index.js

@@ -1056,7 +1056,7 @@ var require_lib = __commonJS({
 var VERSION, AGENT;
 var init_version = __esm({
   "src/version.ts"() {
-    VERSION = "0.1.0-rc.12" ;
+    VERSION = "0.1.0-rc.13" ;
     AGENT = `keynv-cli/${VERSION}`;
   }
 });
@@ -5599,6 +5599,9 @@ var init_store = __esm({
 });
 
 // src/client/http.ts
+function isClientError(err) {
+  return err instanceof Error && typeof err.status === "number";
+}
 function clientError(status, code, message, details) {
   const err = Object.assign(new Error(message), { status, code, details });
   return err;
@@ -5728,8 +5731,23 @@ function fmtError(err) {
   const status = err.status ? ` (${err.status})` : "";
   return `keynv:${code}${status} ${err.message}`;
 }
+function handleExecError(stderr, err) {
+  if (isClientError(err)) {
+    const code = err.code ? `[${err.code}] ` : "";
+    stderr.write(`keynv: ${code}${err.message}
+`);
+  } else if (err instanceof Error) {
+    stderr.write(`keynv: ${err.message}
+`);
+  } else {
+    stderr.write(`keynv: unexpected error
+`);
+  }
+  return 1;
+}
 var init_format = __esm({
   "src/ui/format.ts"() {
+    init_http();
   }
 });
 function walkUp(startDir, predicate) {
@@ -44657,44 +44675,48 @@ var AuditListCommand = class extends Command {
   sinceId = options_exports.String("--since-id");
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const data = await client.request(
-      "/v1/audit",
-      {
-        query: {
-          event_type: this.eventType,
-          limit: this.limit,
-          since_id: this.sinceId
+    try {
+      const client = new ApiClient();
+      const data = await client.request(
+        "/v1/audit",
+        {
+          query: {
+            event_type: this.eventType,
+            limit: this.limit,
+            since_id: this.sinceId
+          }
         }
-      }
-    );
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+      );
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return 0;
-    }
-    if (data.entries.length === 0) {
-      this.context.stdout.write("no audit entries\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["id", "ts", "actor", "agent", "event"],
-        data.entries.map((e2) => [
-          String(e2.id),
-          e2.ts,
-          e2.actor_user_id ?? "(none)",
-          e2.actor_agent,
-          e2.event_type
-        ])
-      )}
+        return 0;
+      }
+      if (data.entries.length === 0) {
+        this.context.stdout.write("no audit entries\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["id", "ts", "actor", "agent", "event"],
+          data.entries.map((e2) => [
+            String(e2.id),
+            e2.ts,
+            e2.actor_user_id ?? "(none)",
+            e2.actor_agent,
+            e2.event_type
+          ])
+        )}
 `
-    );
-    if (data.next_cursor) {
-      this.context.stdout.write(`(next: --since-id ${data.next_cursor})
+      );
+      if (data.next_cursor) {
+        this.context.stdout.write(`(next: --since-id ${data.next_cursor})
 `);
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 var AuditVerifyCommand = class extends Command {
@@ -44704,23 +44726,27 @@ var AuditVerifyCommand = class extends Command {
   });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const data = await client.request("/v1/audit/verify", { method: "POST" });
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      const data = await client.request("/v1/audit/verify", { method: "POST" });
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return data.ok ? 0 : 1;
-    }
-    if (data.ok) {
-      this.context.stdout.write(`OK: ${data.checked} entries verified
+        return data.ok ? 0 : 1;
+      }
+      if (data.ok) {
+        this.context.stdout.write(`OK: ${data.checked} entries verified
 `);
-      return 0;
-    }
-    this.context.stdout.write(
-      `FAIL: chain broken at id ${data.broken_at_id} (${data.reason}); ${data.checked} entries verified before break
+        return 0;
+      }
+      this.context.stdout.write(
+        `FAIL: chain broken at id ${data.broken_at_id} (${data.reason}); ${data.checked} entries verified before break
 `
-    );
-    return 1;
+      );
+      return 1;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 
@@ -45086,11 +45112,35 @@ function spawnPrivileged(opts) {
     for (const [k2, v2] of Object.entries(opts.injectedEnv)) env2[k2] = v2;
   }
   const stdio = ["inherit", "pipe", "pipe"];
-  const child = spawn(opts.command, opts.args, {
+  const WIN_BUILTINS = /* @__PURE__ */ new Set([
+    "echo",
+    "dir",
+    "type",
+    "copy",
+    "del",
+    "move",
+    "ren",
+    "md",
+    "mkdir",
+    "rd",
+    "rmdir",
+    "cd",
+    "cls",
+    "set",
+    "pause",
+    "find",
+    "where"
+  ]);
+  let spawnCmd = opts.command;
+  let spawnArgs = opts.args;
+  if (process.platform === "win32" && WIN_BUILTINS.has(opts.command.toLowerCase())) {
+    spawnCmd = process.env.COMSPEC ?? "cmd.exe";
+    spawnArgs = ["/d", "/s", "/c", opts.command, ...opts.args];
+  }
+  const child = spawn(spawnCmd, spawnArgs, {
     env: env2,
     stdio,
-    detached: false,
-    shell: process.platform === "win32"
+    detached: false
   });
   const literals = opts.resolved.map((r) => r.value).filter((v2) => v2.length > 0);
   if (!opts.noRedact && child.stdout) {
@@ -45375,25 +45425,29 @@ var ProjectListCommand = class extends Command {
   });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const data = await client.request("/v1/projects");
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      const data = await client.request("/v1/projects");
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
+        return 0;
+      }
+      if (data.projects.length === 0) {
+        this.context.stdout.write("no projects\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["name", "id", "created_at"],
+          data.projects.map((p2) => [p2.name, p2.id, p2.created_at])
+        )}
+`
+      );
       return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    if (data.projects.length === 0) {
-      this.context.stdout.write("no projects\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["name", "id", "created_at"],
-        data.projects.map((p2) => [p2.name, p2.id, p2.created_at])
-      )}
-`
-    );
-    return 0;
   }
 };
 var ProjectCreateCommand = class extends Command {
@@ -45407,28 +45461,32 @@ var ProjectCreateCommand = class extends Command {
     description: 'Environment spec: name[:tier[:approval]]. Tier \u2208 {production,non-production}; "approval" sets require_approval=true.'
   });
   async execute() {
-    const envs = (this.envs ?? ["dev"]).map((spec) => {
-      const [name, tier, approval] = spec.split(":");
-      return {
-        name: name ?? "",
-        tier: tier ?? "non-production",
-        require_approval: approval === "approval"
-      };
-    });
-    const client = new ApiClient();
-    const result = await client.request("/v1/projects", {
-      method: "POST",
-      body: { name: this.name, environments: envs }
-    });
-    this.context.stdout.write(`created project ${result.name} (${result.id})
+    try {
+      const envs = (this.envs ?? ["dev"]).map((spec) => {
+        const [name, tier, approval] = spec.split(":");
+        return {
+          name: name ?? "",
+          tier: tier ?? "non-production",
+          require_approval: approval === "approval"
+        };
+      });
+      const client = new ApiClient();
+      const result = await client.request("/v1/projects", {
+        method: "POST",
+        body: { name: this.name, environments: envs }
+      });
+      this.context.stdout.write(`created project ${result.name} (${result.id})
 `);
-    for (const e2 of envs) {
-      this.context.stdout.write(
-        `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
+      for (const e2 of envs) {
+        this.context.stdout.write(
+          `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
 `
-      );
+        );
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 var ProjectDescribeCommand = class extends Command {
@@ -45443,23 +45501,27 @@ var ProjectDescribeCommand = class extends Command {
   id = options_exports.String();
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const projectId2 = await resolveProjectId(client, this.id);
-    const data = await client.request(`/v1/projects/${projectId2}`);
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.id);
+      const data = await client.request(`/v1/projects/${projectId2}`);
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return 0;
-    }
-    this.context.stdout.write(`project: ${data.name} (${data.id})
+        return 0;
+      }
+      this.context.stdout.write(`project: ${data.name} (${data.id})
 `);
-    for (const e2 of data.environments) {
-      this.context.stdout.write(
-        `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
+      for (const e2 of data.environments) {
+        this.context.stdout.write(
+          `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
 `
-      );
+        );
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 var ProjectDeleteCommand = class extends Command {
@@ -45472,11 +45534,15 @@ var ProjectDeleteCommand = class extends Command {
       this.context.stderr.write("keynv: refusing to delete without --force\n");
       return 2;
     }
-    const client = new ApiClient();
-    await client.request(`/v1/projects/${this.id}`, { method: "DELETE" });
-    this.context.stdout.write(`deleted project ${this.id}
+    try {
+      const client = new ApiClient();
+      await client.request(`/v1/projects/${this.id}`, { method: "DELETE" });
+      this.context.stdout.write(`deleted project ${this.id}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 
@@ -45582,7 +45648,7 @@ commands directly.
         const content = readFileSync(this.envFile, "utf8");
         const entries = parseEnvFile(content, this.envFile);
         for (const e2 of entries) {
-          if (classifyEntry(e2.name, e2.value).verdict !== "skip") {
+          if (classifyEntry(e2.name, e2.value).verdict === "secret") {
             secrets.push({ name: e2.name, value: e2.value });
           }
         }
@@ -45732,6 +45798,13 @@ var LoginCommand = class extends Command {
   });
   async execute() {
     const finalServerUrl = this.server ?? DEFAULT_SERVER_URL;
+    try {
+      new URL(finalServerUrl);
+    } catch {
+      this.context.stderr.write(`keynv: invalid server URL '${finalServerUrl}'
+`);
+      return 1;
+    }
     if (this.token) {
       return this.loginWithToken(finalServerUrl, this.token);
     }
@@ -45754,11 +45827,20 @@ var LoginCommand = class extends Command {
     }
     const email2 = this.email ?? await promptLine("email: ");
     const password = this.password ?? await promptHidden("password: ");
-    const res = await fetch(new URL("/v1/auth/login", finalServerUrl).toString(), {
-      method: "POST",
-      headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
-      body: JSON.stringify({ email: email2, password })
-    });
+    let res;
+    try {
+      res = await fetch(new URL("/v1/auth/login", finalServerUrl).toString(), {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
+        body: JSON.stringify({ email: email2, password })
+      });
+    } catch (err) {
+      this.context.stderr.write(
+        `keynv: cannot reach server '${finalServerUrl}' \u2014 ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 1;
+    }
     if (!res.ok) {
       const text = await res.text();
       let msg = `login failed (${res.status})`;
@@ -45804,9 +45886,18 @@ var LoginCommand = class extends Command {
     return 0;
   }
   async loginWithToken(serverUrl, token) {
-    const res = await fetch(new URL("/v1/whoami", serverUrl).toString(), {
-      headers: { authorization: `Bearer ${token}`, "x-keynv-agent": AGENT }
-    });
+    let res;
+    try {
+      res = await fetch(new URL("/v1/whoami", serverUrl).toString(), {
+        headers: { authorization: `Bearer ${token}`, "x-keynv-agent": AGENT }
+      });
+    } catch (err) {
+      this.context.stderr.write(
+        `keynv: cannot reach server '${serverUrl}' \u2014 ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 1;
+    }
     if (!res.ok) {
       const text = await res.text();
       let msg = `token login failed (${res.status})`;
@@ -45884,36 +45975,40 @@ var WhoamiCommand = class extends Command {
   });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    if (!client.isLoggedIn) {
-      this.context.stderr.write("keynv: not logged in. Run `keynv login`.\n");
-      return 1;
-    }
-    const data = await client.request("/v1/whoami");
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      if (!client.isLoggedIn) {
+        this.context.stderr.write("keynv: not logged in. Run `keynv login`.\n");
+        return 1;
+      }
+      const data = await client.request("/v1/whoami");
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return 0;
-    }
-    this.context.stdout.write(`user:    ${data.email} (${data.id})
+        return 0;
+      }
+      this.context.stdout.write(`user:    ${data.email} (${data.id})
 `);
-    const orgDisplay = data.org_name ? `${data.org_name} (${data.org_id})` : data.org_id;
-    this.context.stdout.write(`org:     ${orgDisplay}
+      const orgDisplay = data.org_name ? `${data.org_name} (${data.org_id})` : data.org_id;
+      this.context.stdout.write(`org:     ${orgDisplay}
 `);
-    this.context.stdout.write(`role:    ${data.org_role}
+      this.context.stdout.write(`role:    ${data.org_role}
 `);
-    if (data.memberships.length === 0) {
-      this.context.stdout.write("memberships: (none)\n");
-    } else {
-      this.context.stdout.write("memberships:\n");
-      for (const m of data.memberships) {
-        const proj = m.project_name ? `${m.project_name} (${m.project_id})` : m.project_id;
-        this.context.stdout.write(`  ${proj}: ${m.role}
+      if (data.memberships.length === 0) {
+        this.context.stdout.write("memberships: (none)\n");
+      } else {
+        this.context.stdout.write("memberships:\n");
+        for (const m of data.memberships) {
+          const proj = m.project_name ? `${m.project_name} (${m.project_id})` : m.project_id;
+          this.context.stdout.write(`  ${proj}: ${m.role}
 `);
+        }
       }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 
@@ -45935,15 +46030,19 @@ var MemberAddCommand = class extends Command {
       this.context.stderr.write("keynv: --role must be one of lead, developer, reader\n");
       return 1;
     }
-    const client = new ApiClient();
-    const projectId2 = await resolveProjectId(client, this.project);
-    await client.request(`/v1/projects/${projectId2}/members`, {
-      method: "POST",
-      body: { email: this.email, role: role2 }
-    });
-    this.context.stdout.write(`added ${this.email} to ${this.project} as ${role2}
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.project);
+      await client.request(`/v1/projects/${projectId2}/members`, {
+        method: "POST",
+        body: { email: this.email, role: role2 }
+      });
+      this.context.stdout.write(`added ${this.email} to ${this.project} as ${role2}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var MemberRemoveCommand = class extends Command {
@@ -45952,21 +46051,25 @@ var MemberRemoveCommand = class extends Command {
   project = options_exports.String();
   email = options_exports.String();
   async execute() {
-    const client = new ApiClient();
-    const projectId2 = await resolveProjectId(client, this.project);
-    const members = await client.request(`/v1/projects/${projectId2}/members`);
-    const target = members.members.find((m) => m.email === this.email);
-    if (!target) {
-      this.context.stderr.write(`keynv: ${this.email} is not a member of ${this.project}
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.project);
+      const members = await client.request(`/v1/projects/${projectId2}/members`);
+      const target = members.members.find((m) => m.email === this.email);
+      if (!target) {
+        this.context.stderr.write(`keynv: ${this.email} is not a member of ${this.project}
 `);
-      return 1;
-    }
-    await client.request(`/v1/projects/${projectId2}/members/${target.user_id}`, {
-      method: "DELETE"
-    });
-    this.context.stdout.write(`removed ${this.email} from ${this.project}
+        return 1;
+      }
+      await client.request(`/v1/projects/${projectId2}/members/${target.user_id}`, {
+        method: "DELETE"
+      });
+      this.context.stdout.write(`removed ${this.email} from ${this.project}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var MemberListCommand = class extends Command {
@@ -45975,26 +46078,30 @@ var MemberListCommand = class extends Command {
   project = options_exports.String();
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const projectId2 = await resolveProjectId(client, this.project);
-    const data = await client.request(`/v1/projects/${projectId2}/members`);
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.project);
+      const data = await client.request(`/v1/projects/${projectId2}/members`);
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
+        return 0;
+      }
+      if (data.members.length === 0) {
+        this.context.stdout.write("no members\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["email", "role", "granted_at"],
+          data.members.map((m) => [m.email, m.role, m.granted_at])
+        )}
+`
+      );
       return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    if (data.members.length === 0) {
-      this.context.stdout.write("no members\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["email", "role", "granted_at"],
-        data.members.map((m) => [m.email, m.role, m.granted_at])
-      )}
-`
-    );
-    return 0;
   }
 };
 var RedactCommand = class extends Command {
@@ -46093,46 +46200,50 @@ var SecretCreateCommand = class extends Command {
   });
   stdin = options_exports.Boolean("--stdin", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    let value = this.value;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        const built = await promptNewSecret(client);
-        if (!built) return 1;
-        alias2 = built.alias;
-        value = built.value;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      let value = this.value;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          const built = await promptNewSecret(client);
+          if (!built) return 1;
+          alias2 = built.alias;
+          value = built.value;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
       }
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    if (this.stdin) {
-      const chunks = [];
-      for await (const chunk of this.context.stdin) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        return 1;
       }
-      value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
-    } else if (value === void 0) {
-      value = await promptHidden("value: ");
-    }
-    const projectId2 = await resolveProjectId(client, parsed.project);
-    await client.request(`/v1/projects/${projectId2}/secrets`, {
-      method: "POST",
-      body: { env: parsed.environment, key: parsed.key, value }
-    });
-    this.context.stdout.write(`created ${parsed.literal}
+      if (this.stdin) {
+        const chunks = [];
+        for await (const chunk of this.context.stdin) {
+          chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        }
+        value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
+      } else if (value === void 0) {
+        value = await promptHidden("value: ");
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      await client.request(`/v1/projects/${projectId2}/secrets`, {
+        method: "POST",
+        body: { env: parsed.environment, key: parsed.key, value }
+      });
+      this.context.stdout.write(`created ${parsed.literal}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var SecretGetCommand = class extends Command {
@@ -46143,40 +46254,44 @@ var SecretGetCommand = class extends Command {
   alias = options_exports.String({ required: false });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        alias2 = await pickAliasInteractive(client) ?? void 0;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          alias2 = await pickAliasInteractive(client) ?? void 0;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
+        if (!alias2) return 1;
       }
-      if (!alias2) return 1;
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    const projectId2 = await resolveProjectId(client, parsed.project);
-    const data = await client.request(
-      `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`
-    );
-    if (this.json) {
-      this.context.stdout.write(
-        `${JSON.stringify({ alias: data.alias, version: data.version, value: data.value })}
-`
+        return 1;
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      const data = await client.request(
+        `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`
       );
-    } else {
-      this.context.stdout.write(`${data.value}
+      if (this.json) {
+        this.context.stdout.write(
+          `${JSON.stringify({ alias: data.alias, version: data.version, value: data.value })}
+`
+        );
+      } else {
+        this.context.stdout.write(`${data.value}
 `);
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 var SecretListCommand = class extends Command {
@@ -46187,42 +46302,47 @@ var SecretListCommand = class extends Command {
   project = options_exports.String({ required: false });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let projectName = this.project;
-    if (!projectName) {
-      if (!isInteractive()) {
-        this.context.stderr.write("keynv: missing <project>.\n");
-        return 1;
-      }
-      try {
-        const picked = await pickProject(client, "Project");
-        if (!picked) return 1;
-        projectName = picked.name;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let projectName = this.project;
+      if (!projectName) {
+        if (!isInteractive()) {
+          this.context.stderr.write("keynv: missing <project>.\n");
+          return 1;
+        }
+        try {
+          const picked = await pickProject(client, "Project");
+          if (!picked) return 1;
+          projectName = picked.name;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
       }
-    }
-    const projectId2 = await resolveProjectId(client, projectName);
-    const data = await client.request(`/v1/projects/${projectId2}/secrets`);
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+      const resolvedProjectName = projectName.startsWith("@") ? projectName.slice(1).split(".")[0] ?? projectName : projectName;
+      const projectId2 = await resolveProjectId(client, resolvedProjectName);
+      const data = await client.request(`/v1/projects/${projectId2}/secrets`);
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
+        return 0;
+      }
+      if (data.secrets.length === 0) {
+        this.context.stdout.write("no secrets\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["alias", "version", "created_at"],
+          data.secrets.map((s) => [s.alias, String(s.version), s.created_at])
+        )}
+`
+      );
       return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    if (data.secrets.length === 0) {
-      this.context.stdout.write("no secrets\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["alias", "version", "created_at"],
-        data.secrets.map((s) => [s.alias, String(s.version), s.created_at])
-      )}
-`
-    );
-    return 0;
   }
 };
 var SecretRotateCommand = class extends Command {
@@ -46232,46 +46352,50 @@ var SecretRotateCommand = class extends Command {
   value = options_exports.String("--value");
   stdin = options_exports.Boolean("--stdin", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        alias2 = await pickAliasInteractive(client) ?? void 0;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          alias2 = await pickAliasInteractive(client) ?? void 0;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
+        if (!alias2) return 1;
       }
-      if (!alias2) return 1;
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    let value;
-    if (this.stdin) {
-      const chunks = [];
-      for await (const chunk of this.context.stdin) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        return 1;
       }
-      value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
-    } else if (this.value !== void 0) {
-      value = this.value;
-    } else {
-      value = await promptHidden("new value: ");
-    }
-    const projectId2 = await resolveProjectId(client, parsed.project);
-    const data = await client.request(
-      `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}/rotate`,
-      { method: "POST", body: { new_value: value } }
-    );
-    this.context.stdout.write(`rotated ${data.alias} \u2192 v${data.version}
+      let value;
+      if (this.stdin) {
+        const chunks = [];
+        for await (const chunk of this.context.stdin) {
+          chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        }
+        value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
+      } else if (this.value !== void 0) {
+        value = this.value;
+      } else {
+        value = await promptHidden("new value: ");
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      const data = await client.request(
+        `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}/rotate`,
+        { method: "POST", body: { new_value: value } }
+      );
+      this.context.stdout.write(`rotated ${data.alias} \u2192 v${data.version}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var SecretDeleteCommand = class extends Command {
@@ -46279,33 +46403,37 @@ var SecretDeleteCommand = class extends Command {
   static usage = Command.Usage({ description: "Soft-delete a secret." });
   alias = options_exports.String({ required: false });
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        alias2 = await pickAliasInteractive(client) ?? void 0;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          alias2 = await pickAliasInteractive(client) ?? void 0;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
+        if (!alias2) return 1;
       }
-      if (!alias2) return 1;
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    const projectId2 = await resolveProjectId(client, parsed.project);
-    await client.request(`/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`, {
-      method: "DELETE"
-    });
-    this.context.stdout.write(`deleted ${parsed.literal}
+        return 1;
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      await client.request(`/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`, {
+        method: "DELETE"
+      });
+      this.context.stdout.write(`deleted ${parsed.literal}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 function generateSecret(bytes = 32) {