@keynv/cli 0.1.0-rc.12 → 0.1.0-rc.14

package/dist/index.js

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
 import { randomBytes } from 'crypto';
-import { readFileSync, existsSync, statSync, writeFileSync, unlinkSync, mkdirSync, rmSync, readdirSync } from 'fs';
+import { readFileSync, writeFileSync, unlinkSync, existsSync, statSync, readdirSync, mkdirSync, rmSync } from 'fs';
 import { hostname, platform, homedir } from 'os';
-import { relative, isAbsolute, resolve, join, dirname, basename } from 'path';
+import * as nodePath from 'path';
+import { relative, join, isAbsolute, resolve, dirname, basename } from 'path';
 import { Entry } from '@napi-rs/keyring';
 import { styleText } from 'util';
 import j2, { stdin, stdout } from 'process';
@@ -301,16 +302,16 @@ var require_lib = __commonJS({
         }
       });
     }
-    function isArray(spec, { delimiter } = {}) {
+    function isArray(spec, { delimiter: delimiter2 } = {}) {
       return makeValidator({
         test: (value, state) => {
           var _a;
           const originalValue = value;
-          if (typeof value === `string` && typeof delimiter !== `undefined`) {
+          if (typeof value === `string` && typeof delimiter2 !== `undefined`) {
             if (typeof (state === null || state === void 0 ? void 0 : state.coercions) !== `undefined`) {
               if (typeof (state === null || state === void 0 ? void 0 : state.coercion) === `undefined`)
                 return pushError(state, `Unbound coercion result`);
-              value = value.split(delimiter);
+              value = value.split(delimiter2);
             }
           }
           if (!Array.isArray(value))
@@ -328,8 +329,8 @@ var require_lib = __commonJS({
         }
       });
     }
-    function isSet(spec, { delimiter } = {}) {
-      const isArrayValidator = isArray(spec, { delimiter });
+    function isSet(spec, { delimiter: delimiter2 } = {}) {
+      const isArrayValidator = isArray(spec, { delimiter: delimiter2 });
       return makeValidator({
         test: (value, state) => {
           var _a, _b;
@@ -420,16 +421,16 @@ var require_lib = __commonJS({
         }
       });
     }
-    function isTuple(spec, { delimiter } = {}) {
+    function isTuple(spec, { delimiter: delimiter2 } = {}) {
       const lengthValidator = hasExactLength(spec.length);
       return makeValidator({
         test: (value, state) => {
           var _a;
-          if (typeof value === `string` && typeof delimiter !== `undefined`) {
+          if (typeof value === `string` && typeof delimiter2 !== `undefined`) {
             if (typeof (state === null || state === void 0 ? void 0 : state.coercions) !== `undefined`) {
               if (typeof (state === null || state === void 0 ? void 0 : state.coercion) === `undefined`)
                 return pushError(state, `Unbound coercion result`);
-              value = value.split(delimiter);
+              value = value.split(delimiter2);
               state.coercions.push([(_a = state.p) !== null && _a !== void 0 ? _a : `.`, state.coercion.bind(null, value)]);
             }
           }
@@ -1056,7 +1057,7 @@ var require_lib = __commonJS({
 var VERSION, AGENT;
 var init_version = __esm({
   "src/version.ts"() {
-    VERSION = "0.1.0-rc.12" ;
+    VERSION = "0.1.0-rc.14" ;
     AGENT = `keynv-cli/${VERSION}`;
   }
 });
@@ -5599,6 +5600,9 @@ var init_store = __esm({
 });
 
 // src/client/http.ts
+function isClientError(err) {
+  return err instanceof Error && typeof err.status === "number";
+}
 function clientError(status, code, message, details) {
   const err = Object.assign(new Error(message), { status, code, details });
   return err;
@@ -5653,7 +5657,16 @@ var init_http = __esm({
         return this.creds;
       }
       async ensureHydrated() {
-        if (this.hydrated) await this.hydrated;
+        if (this.hydrated) {
+          try {
+            await this.hydrated;
+          } catch (err) {
+            process.stderr.write(
+              `${err instanceof Error ? err.message : `keynv: credential load failed \u2014 ${String(err)}`}
+`
+            );
+          }
+        }
       }
       async setCredentials(creds) {
         this.creds = creds;
@@ -5675,21 +5688,40 @@ var init_http = __esm({
           headers.authorization = `Bearer ${this.creds.access_token}`;
         }
         const url = this.creds ? buildUrl(this.creds.server_url, path, opts.query) : path;
-        let res = await fetch(url, {
-          method: opts.method ?? "GET",
-          headers,
-          ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
-        });
+        let res;
+        try {
+          res = await fetch(url, {
+            method: opts.method ?? "GET",
+            headers,
+            ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
+          });
+        } catch (err) {
+          const cause = err instanceof Error ? err.message : String(err);
+          const serverUrl = this.creds?.server_url ?? url;
+          throw new Error(
+            `keynv: cannot reach server '${serverUrl}' \u2014 ${cause}
+       Check the server is running: curl ${serverUrl}/v1/health`
+          );
+        }
         if (res.status === 401 && this.creds && opts.authed !== false) {
           const refreshed = await tryRefresh(this.creds);
           if (refreshed) {
             this.creds = refreshed;
             headers.authorization = `Bearer ${refreshed.access_token}`;
-            res = await fetch(url, {
-              method: opts.method ?? "GET",
-              headers,
-              ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
-            });
+            try {
+              res = await fetch(url, {
+                method: opts.method ?? "GET",
+                headers,
+                ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
+              });
+            } catch (err) {
+              const cause = err instanceof Error ? err.message : String(err);
+              const serverUrl = this.creds?.server_url ?? url;
+              throw new Error(
+                `keynv: cannot reach server '${serverUrl}' \u2014 ${cause}
+       Check the server is running: curl ${serverUrl}/v1/health`
+              );
+            }
           }
         }
         if (res.status === 204) return void 0;
@@ -5728,8 +5760,23 @@ function fmtError(err) {
   const status = err.status ? ` (${err.status})` : "";
   return `keynv:${code}${status} ${err.message}`;
 }
+function handleExecError(stderr, err) {
+  if (isClientError(err)) {
+    const code = err.code ? `[${err.code}] ` : "";
+    stderr.write(`keynv: ${code}${err.message}
+`);
+  } else if (err instanceof Error) {
+    stderr.write(`keynv: ${err.message}
+`);
+  } else {
+    stderr.write(`keynv: unexpected error
+`);
+  }
+  return 1;
+}
 var init_format = __esm({
   "src/ui/format.ts"() {
+    init_http();
   }
 });
 function walkUp(startDir, predicate) {
@@ -5873,6 +5920,121 @@ var init_envFile = __esm({
     };
   }
 });
+function findProjectRoot(startDir) {
+  const result = walkUp(startDir, (dir) => {
+    for (const marker of PROJECT_MARKERS) {
+      if (existsSync(join(dir, marker))) {
+        return { dir, marker };
+      }
+    }
+    if (existsSync(join(dir, GIT_MARKER))) {
+      return { dir, marker: GIT_MARKER };
+    }
+    return null;
+  });
+  if (!result) return null;
+  return buildRoot(result.dir, result.marker);
+}
+function buildRoot(dir, marker) {
+  let suggestedName = basename(dir);
+  let scripts = null;
+  let invalid = false;
+  if (marker === "package.json" || existsSync(join(dir, "package.json"))) {
+    try {
+      const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+      if (typeof pkg.name === "string" && pkg.name.length > 0) {
+        suggestedName = pkg.name.replace(/^@[^/]+\//, "");
+      }
+      if (pkg.scripts && typeof pkg.scripts === "object") {
+        scripts = Object.fromEntries(
+          Object.entries(pkg.scripts).filter(([, v2]) => typeof v2 === "string")
+        );
+      }
+    } catch {
+      invalid = true;
+    }
+  }
+  return {
+    path: dir,
+    suggestedName,
+    marker,
+    packageJsonScripts: scripts,
+    packageJsonInvalid: invalid
+  };
+}
+function findEnvFiles(rootDir) {
+  let entries;
+  try {
+    entries = readdirSync(rootDir);
+  } catch {
+    return [];
+  }
+  const hits = [];
+  for (const name of entries) {
+    if (!ENV_GLOB.test(name)) continue;
+    if (ENV_EXAMPLE.test(name)) continue;
+    if (name === KEYNV_ENV_BASENAME) continue;
+    const full = join(rootDir, name);
+    try {
+      if (!statSync(full).isFile()) continue;
+    } catch {
+      continue;
+    }
+    const suffixMatch = name.match(/^\.env\.(.+)$/);
+    const suffix = suffixMatch ? suffixMatch[1] : null;
+    hits.push({ path: full, name, suffix, suggestedEnv: suggestedEnvForSuffix(suffix) });
+  }
+  hits.sort((a, b2) => {
+    if (a.suffix === null) return -1;
+    if (b2.suffix === null) return 1;
+    return a.name.localeCompare(b2.name);
+  });
+  return hits;
+}
+function suggestedEnvForSuffix(suffix) {
+  if (suffix === null) return "dev";
+  switch (suffix) {
+    case "local":
+    case "development":
+    case "dev":
+      return "dev";
+    case "production":
+    case "prod":
+      return "prod";
+    case "staging":
+    case "stage":
+      return "staging";
+    case "test":
+      return "test";
+    case "preview":
+      return "preview";
+    default:
+      return suffix;
+  }
+}
+function hasExistingKeynvEnv(rootDir) {
+  return existsSync(join(rootDir, KEYNV_ENV_BASENAME));
+}
+var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME;
+var init_detect = __esm({
+  "src/init/detect.ts"() {
+    init_fs();
+    PROJECT_MARKERS = [
+      "package.json",
+      "pyproject.toml",
+      "Cargo.toml",
+      "go.mod",
+      "pnpm-workspace.yaml",
+      "deno.json",
+      "deno.jsonc",
+      "requirements.txt"
+    ];
+    GIT_MARKER = ".git";
+    ENV_GLOB = /^\.env(\.[A-Za-z0-9_-]+)?$/;
+    ENV_EXAMPLE = /^\.env\.(example|sample|template|dist|defaults)$/;
+    KEYNV_ENV_BASENAME = ".keynv.env";
+  }
+});
 
 // src/init/heuristics.ts
 function shannonEntropyBits(s) {
@@ -5999,6 +6161,95 @@ var init_heuristics = __esm({
     ];
   }
 });
+function aiContextBody() {
+  return `## keynv (secrets)
+
+This project uses [keynv](https://keynv.dev) for secrets. There is a \`.keynv.env\` file at the project root containing **alias references** like \`OPENAI_API_KEY=@projectname.dev.openai-key\` \u2014 these are NOT real values, they are references to secrets stored in the keynv vault.
+
+### Mental model
+
+- **\`.keynv.env\`** \u2014 checked into git, contains aliases. Safe to read, edit, commit.
+- **Vault** \u2014 holds the real values. The \`keynv\` CLI reads it on demand.
+- **\`keynv exec -- <command>\`** \u2014 forks the command in a subprocess where the real values are injected into env vars. The parent process (where you, the AI agent, run) NEVER sees the real values.
+- **Redactor** \u2014 pipes subprocess stdout/stderr through a masker before they reach this terminal. Even if a script accidentally echoes a secret, you see \`<REDACTED:...>\` here.
+
+### What you should do
+
+When the user asks about secrets or env vars, follow this decision tree:
+
+| User intent | Run / suggest |
+|---|---|
+| "Add a new API key" / "set up a secret" | \`keynv secret create\` (interactive prompt picks project + env + key) |
+| "I have a \`.env\`, migrate it" | \`keynv init\` (you're seeing this file because that already happened) |
+| "Run the app / dev server / tests" | \`keynv exec -- <their existing command>\` (auto-loads \`.keynv.env\`) |
+| "Show me the value of X" | \`keynv secret get @alias\` \u2014 but copy to clipboard, do NOT print the value into chat / terminal |
+| "Rotate this key" | \`keynv secret rotate @alias\` |
+| "Add a new env var to the project" | Edit \`.keynv.env\` and add \`NAME=@project.env.key\` (after creating the secret with \`keynv secret create\`) |
+| "Who has access?" | \`keynv member list <project>\` |
+
+### Hard rules \u2014 do not violate
+
+1. **Never print resolved secret values** to the chat, terminal, log, or any file. The user's editor / scrollback / chat history is an attack surface.
+2. **Never write a \`.env\` file** (or any file) containing real secret values. The whole point of keynv is that those don't exist on disk.
+3. **Never edit \`.keynv.env\` to substitute resolved values for aliases.** The file should only ever contain \`@project.env.key\` references and plain non-secret literals.
+4. **Use \`keynv exec --\` to run commands that need env vars.** Don't try to load \`.keynv.env\` yourself by parsing it manually; the wrapper handles resolution + redaction + subprocess isolation.
+5. **If a tool fails with "blocked by keynv-guard" or similar**, do NOT try to work around it. Tell the user \u2014 that's a sign of a misconfiguration, not an obstacle to bypass.
+6. **Treat the alias literal (\`@project.env.key\`) as the canonical reference**, never the resolved value. When you write code, configs, or commands that need a secret, write the alias.
+
+### Quick reference
+
+\`\`\`bash
+keynv                       # interactive TUI menu (pick projects, secrets, members)
+keynv exec -- <cmd>         # run cmd with .keynv.env loaded
+keynv secret create         # walk through creating a new secret
+keynv secret list <project> # list aliases (no values)
+keynv whoami                # who am I logged in as
+keynv --help                # full command list
+\`\`\`
+
+If \`.keynv.env\` is missing or empty, the user probably hasn't run \`keynv init\` yet \u2014 suggest they do so before they paste a secret into a \`.env\`.`;
+}
+function renderKeynvBlock() {
+  return `${KEYNV_BLOCK_START}
+${aiContextBody()}
+${KEYNV_BLOCK_END}`;
+}
+function writeAiContext(rootPath) {
+  const path = join(rootPath, AGENTS_FILE_BASENAME);
+  const block = renderKeynvBlock();
+  if (!existsSync(path)) {
+    const initial = `# Agent guidance for this project
+
+${block}
+`;
+    writeFileSync(path, initial);
+    return "created";
+  }
+  const existing = readFileSync(path, "utf8");
+  const startIdx = existing.indexOf(KEYNV_BLOCK_START);
+  const endIdx = existing.indexOf(KEYNV_BLOCK_END);
+  if (startIdx >= 0 && endIdx > startIdx) {
+    const before = existing.slice(0, startIdx);
+    const after = existing.slice(endIdx + KEYNV_BLOCK_END.length);
+    const next = `${before}${block}${after}`;
+    if (next === existing) return "unchanged";
+    writeFileSync(path, next);
+    return "updated";
+  }
+  const sep = existing.length === 0 ? "" : existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+  const trailingNewline = existing.endsWith("\n") ? "" : "\n";
+  writeFileSync(path, `${existing}${trailingNewline}${sep}${block}
+`);
+  return "appended";
+}
+var AGENTS_FILE_BASENAME, KEYNV_BLOCK_START, KEYNV_BLOCK_END;
+var init_aiContext = __esm({
+  "src/init/aiContext.ts"() {
+    AGENTS_FILE_BASENAME = "AGENTS.md";
+    KEYNV_BLOCK_START = "<!-- keynv:start -- generated by `keynv init`; safe to leave intact, will be refreshed on re-run -->";
+    KEYNV_BLOCK_END = "<!-- keynv:end -->";
+  }
+});
 
 // ../../node_modules/.pnpm/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/utils.js
 var getCodePointsLength, isFullWidth, isWideNotCJKTNotEmoji;
@@ -7154,210 +7405,6 @@ ${c2}
     } }).prompt();
   }
 });
-function aiContextBody() {
-  return `## keynv (secrets)
-
-This project uses [keynv](https://keynv.dev) for secrets. There is a \`.keynv.env\` file at the project root containing **alias references** like \`OPENAI_API_KEY=@projectname.dev.openai-key\` \u2014 these are NOT real values, they are references to secrets stored in the keynv vault.
-
-### Mental model
-
-- **\`.keynv.env\`** \u2014 checked into git, contains aliases. Safe to read, edit, commit.
-- **Vault** \u2014 holds the real values. The \`keynv\` CLI reads it on demand.
-- **\`keynv exec -- <command>\`** \u2014 forks the command in a subprocess where the real values are injected into env vars. The parent process (where you, the AI agent, run) NEVER sees the real values.
-- **Redactor** \u2014 pipes subprocess stdout/stderr through a masker before they reach this terminal. Even if a script accidentally echoes a secret, you see \`<REDACTED:...>\` here.
-
-### What you should do
-
-When the user asks about secrets or env vars, follow this decision tree:
-
-| User intent | Run / suggest |
-|---|---|
-| "Add a new API key" / "set up a secret" | \`keynv secret create\` (interactive prompt picks project + env + key) |
-| "I have a \`.env\`, migrate it" | \`keynv init\` (you're seeing this file because that already happened) |
-| "Run the app / dev server / tests" | \`keynv exec -- <their existing command>\` (auto-loads \`.keynv.env\`) |
-| "Show me the value of X" | \`keynv secret get @alias\` \u2014 but copy to clipboard, do NOT print the value into chat / terminal |
-| "Rotate this key" | \`keynv secret rotate @alias\` |
-| "Add a new env var to the project" | Edit \`.keynv.env\` and add \`NAME=@project.env.key\` (after creating the secret with \`keynv secret create\`) |
-| "Who has access?" | \`keynv member list <project>\` |
-
-### Hard rules \u2014 do not violate
-
-1. **Never print resolved secret values** to the chat, terminal, log, or any file. The user's editor / scrollback / chat history is an attack surface.
-2. **Never write a \`.env\` file** (or any file) containing real secret values. The whole point of keynv is that those don't exist on disk.
-3. **Never edit \`.keynv.env\` to substitute resolved values for aliases.** The file should only ever contain \`@project.env.key\` references and plain non-secret literals.
-4. **Use \`keynv exec --\` to run commands that need env vars.** Don't try to load \`.keynv.env\` yourself by parsing it manually; the wrapper handles resolution + redaction + subprocess isolation.
-5. **If a tool fails with "blocked by keynv-guard" or similar**, do NOT try to work around it. Tell the user \u2014 that's a sign of a misconfiguration, not an obstacle to bypass.
-6. **Treat the alias literal (\`@project.env.key\`) as the canonical reference**, never the resolved value. When you write code, configs, or commands that need a secret, write the alias.
-
-### Quick reference
-
-\`\`\`bash
-keynv                       # interactive TUI menu (pick projects, secrets, members)
-keynv exec -- <cmd>         # run cmd with .keynv.env loaded
-keynv secret create         # walk through creating a new secret
-keynv secret list <project> # list aliases (no values)
-keynv whoami                # who am I logged in as
-keynv --help                # full command list
-\`\`\`
-
-If \`.keynv.env\` is missing or empty, the user probably hasn't run \`keynv init\` yet \u2014 suggest they do so before they paste a secret into a \`.env\`.`;
-}
-function renderKeynvBlock() {
-  return `${KEYNV_BLOCK_START}
-${aiContextBody()}
-${KEYNV_BLOCK_END}`;
-}
-function writeAiContext(rootPath) {
-  const path = join(rootPath, AGENTS_FILE_BASENAME);
-  const block = renderKeynvBlock();
-  if (!existsSync(path)) {
-    const initial = `# Agent guidance for this project
-
-${block}
-`;
-    writeFileSync(path, initial);
-    return "created";
-  }
-  const existing = readFileSync(path, "utf8");
-  const startIdx = existing.indexOf(KEYNV_BLOCK_START);
-  const endIdx = existing.indexOf(KEYNV_BLOCK_END);
-  if (startIdx >= 0 && endIdx > startIdx) {
-    const before = existing.slice(0, startIdx);
-    const after = existing.slice(endIdx + KEYNV_BLOCK_END.length);
-    const next = `${before}${block}${after}`;
-    if (next === existing) return "unchanged";
-    writeFileSync(path, next);
-    return "updated";
-  }
-  const sep = existing.length === 0 ? "" : existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
-  const trailingNewline = existing.endsWith("\n") ? "" : "\n";
-  writeFileSync(path, `${existing}${trailingNewline}${sep}${block}
-`);
-  return "appended";
-}
-var AGENTS_FILE_BASENAME, KEYNV_BLOCK_START, KEYNV_BLOCK_END;
-var init_aiContext = __esm({
-  "src/init/aiContext.ts"() {
-    AGENTS_FILE_BASENAME = "AGENTS.md";
-    KEYNV_BLOCK_START = "<!-- keynv:start -- generated by `keynv init`; safe to leave intact, will be refreshed on re-run -->";
-    KEYNV_BLOCK_END = "<!-- keynv:end -->";
-  }
-});
-function findProjectRoot(startDir) {
-  const result = walkUp(startDir, (dir) => {
-    for (const marker of PROJECT_MARKERS) {
-      if (existsSync(join(dir, marker))) {
-        return { dir, marker };
-      }
-    }
-    if (existsSync(join(dir, GIT_MARKER))) {
-      return { dir, marker: GIT_MARKER };
-    }
-    return null;
-  });
-  if (!result) return null;
-  return buildRoot(result.dir, result.marker);
-}
-function buildRoot(dir, marker) {
-  let suggestedName = basename(dir);
-  let scripts = null;
-  let invalid = false;
-  if (marker === "package.json" || existsSync(join(dir, "package.json"))) {
-    try {
-      const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
-      if (typeof pkg.name === "string" && pkg.name.length > 0) {
-        suggestedName = pkg.name.replace(/^@[^/]+\//, "");
-      }
-      if (pkg.scripts && typeof pkg.scripts === "object") {
-        scripts = Object.fromEntries(
-          Object.entries(pkg.scripts).filter(([, v2]) => typeof v2 === "string")
-        );
-      }
-    } catch {
-      invalid = true;
-    }
-  }
-  return {
-    path: dir,
-    suggestedName,
-    marker,
-    packageJsonScripts: scripts,
-    packageJsonInvalid: invalid
-  };
-}
-function findEnvFiles(rootDir) {
-  let entries;
-  try {
-    entries = readdirSync(rootDir);
-  } catch {
-    return [];
-  }
-  const hits = [];
-  for (const name of entries) {
-    if (!ENV_GLOB.test(name)) continue;
-    if (ENV_EXAMPLE.test(name)) continue;
-    if (name === KEYNV_ENV_BASENAME) continue;
-    const full = join(rootDir, name);
-    try {
-      if (!statSync(full).isFile()) continue;
-    } catch {
-      continue;
-    }
-    const suffixMatch = name.match(/^\.env\.(.+)$/);
-    const suffix = suffixMatch ? suffixMatch[1] : null;
-    hits.push({ path: full, name, suffix, suggestedEnv: suggestedEnvForSuffix(suffix) });
-  }
-  hits.sort((a, b2) => {
-    if (a.suffix === null) return -1;
-    if (b2.suffix === null) return 1;
-    return a.name.localeCompare(b2.name);
-  });
-  return hits;
-}
-function suggestedEnvForSuffix(suffix) {
-  if (suffix === null) return "dev";
-  switch (suffix) {
-    case "local":
-    case "development":
-    case "dev":
-      return "dev";
-    case "production":
-    case "prod":
-      return "prod";
-    case "staging":
-    case "stage":
-      return "staging";
-    case "test":
-      return "test";
-    case "preview":
-      return "preview";
-    default:
-      return suffix;
-  }
-}
-function hasExistingKeynvEnv(rootDir) {
-  return existsSync(join(rootDir, KEYNV_ENV_BASENAME));
-}
-var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME;
-var init_detect = __esm({
-  "src/init/detect.ts"() {
-    init_fs();
-    PROJECT_MARKERS = [
-      "package.json",
-      "pyproject.toml",
-      "Cargo.toml",
-      "go.mod",
-      "pnpm-workspace.yaml",
-      "deno.json",
-      "deno.jsonc",
-      "requirements.txt"
-    ];
-    GIT_MARKER = ".git";
-    ENV_GLOB = /^\.env(\.[A-Za-z0-9_-]+)?$/;
-    ENV_EXAMPLE = /^\.env\.(example|sample|template|dist|defaults)$/;
-    KEYNV_ENV_BASENAME = ".keynv.env";
-  }
-});
 
 // src/init/scriptWrap.ts
 function analyzeScript(name, command) {
@@ -7578,6 +7625,14 @@ __export(init_exports, {
   UserCancelled: () => UserCancelled,
   runInitFlow: () => runInitFlow
 });
+function toAliasKey(name) {
+  if (!name) return name;
+  const KEY_RE3 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+  if (KEY_RE3.test(name)) return name;
+  const normalised = name.toLowerCase().replace(/_/g, "-");
+  if (KEY_RE3.test(normalised)) return normalised;
+  return normalised.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64) || "key";
+}
 async function runInitFlow(client, opts) {
   ge("keynv init");
   const root = findProjectRoot(opts.cwd);
@@ -7736,7 +7791,7 @@ ${detail}`
         if (!selected.has(`${env2}|${e2.name}`)) continue;
         i++;
         s.message(`Uploading (${i}/${totalToUpload}) [${env2}] ${e2.name}`);
-        const aliasKey = e2.name.toLowerCase().replace(/_/g, "-");
+        const aliasKey = toAliasKey(e2.name);
         try {
           await client.request(`/v1/projects/${projectId2}/secrets`, {
             method: "POST",
@@ -7794,6 +7849,30 @@ ${detail}`
     R2.error(`Failed to write .keynv.env: ${err instanceof Error ? err.message : String(err)}`);
     return { exitCode: 1 };
   }
+  const otherEnvsWithAliases = distinctEnvs.filter(
+    (env2) => env2 !== defaultEnv && (uploadedByEnv.get(env2)?.size ?? 0) > 0
+  );
+  for (const env2 of otherEnvsWithAliases) {
+    const envUploaded = uploadedByEnv.get(env2) ?? /* @__PURE__ */ new Map();
+    const envLiterals = (perEnv.get(env2) ?? []).filter((e2) => !selected.has(`${env2}|${e2.name}`));
+    const envFilePath = join(root.path, `.keynv.${env2}.env`);
+    try {
+      const lines = composeKeynvEnv({
+        uploadedAliases: envUploaded,
+        literals: envLiterals,
+        mergeWithExisting: null
+      });
+      writeFileSync(envFilePath, `${lines.join("\n")}
+`);
+      R2.success(
+        `Wrote .keynv.${env2}.env (${envUploaded.size} secret alias${envUploaded.size === 1 ? "" : "es"} from "${env2}")`
+      );
+    } catch (err) {
+      R2.warn(
+        `Could not write .keynv.${env2}.env: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
   try {
     const outcome = writeAiContext(root.path);
     if (outcome === "created") R2.success("Wrote AGENTS.md (so AI agents understand keynv)");
@@ -7830,7 +7909,8 @@ ${detail}`
   if (otherEnvs.length > 0) {
     const lines = otherEnvs.map((env2) => {
       const count = uploadedByEnv.get(env2)?.size ?? 0;
-      return `  ${env2}: ${count} secret${count === 1 ? "" : "s"} in vault (use \`keynv exec --from .keynv.${env2}.env -- <cmd>\` after creating that file)`;
+      const hasFile = count > 0;
+      return hasFile ? `  ${env2}: ${count} secret${count === 1 ? "" : "s"} \u2192 .keynv.${env2}.env (use \`keynv exec --from .keynv.${env2}.env -- <cmd>\`)` : `  ${env2}: 0 secrets in vault (no alias file written)`;
     });
     Se(lines.join("\n"), "Secrets in other envs");
   }
@@ -8080,7 +8160,7 @@ var init_tty = __esm({
   }
 });
 function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 async function errorMessage(res, fallback) {
   const text = await res.text();
@@ -8322,16 +8402,16 @@ async function runSecretMenu(client, project, alias2) {
 async function copyToClipboard(value) {
   const platform2 = process.platform;
   const cmd = platform2 === "darwin" ? ["pbcopy", []] : platform2 === "win32" ? ["clip", []] : ["xclip", ["-selection", "clipboard"]];
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     try {
       const child = spawn(cmd[0], cmd[1], {
         stdio: ["pipe", "ignore", "ignore"]
       });
-      child.on("error", () => resolve3(false));
-      child.on("exit", (code) => resolve3(code === 0));
+      child.on("error", () => resolve4(false));
+      child.on("exit", (code) => resolve4(code === 0));
       child.stdin.end(value);
     } catch {
-      resolve3(false);
+      resolve4(false);
     }
   });
 }
@@ -25077,7 +25157,7 @@ var require_named_placeholders = __commonJS({
         }
         return s;
       }
-      function join6(tree) {
+      function join8(tree) {
         if (tree.length === 1) {
           return tree;
         }
@@ -25103,7 +25183,7 @@ var require_named_placeholders = __commonJS({
         if (cache2 && (tree = cache2.get(query))) {
           return toArrayParams(tree, paramsObj);
         }
-        tree = join6(parse(query));
+        tree = join8(parse(query));
         if (cache2) {
           cache2.set(query, tree);
         }
@@ -25259,11 +25339,11 @@ var require_connection = __commonJS({
             const config = this.config;
             tracePromise(
               connectChannel,
-              () => new Promise((resolve3, reject) => {
+              () => new Promise((resolve4, reject) => {
                 let onConnect, onError;
                 onConnect = (param) => {
                   this.removeListener("error", onError);
-                  resolve3(param);
+                  resolve4(param);
                 };
                 onError = (err) => {
                   this.removeListener("connect", onConnect);
@@ -25688,9 +25768,9 @@ var require_connection = __commonJS({
         } else if (shouldTrace(queryChannel)) {
           tracePromise(
             queryChannel,
-            () => new Promise((resolve3, reject) => {
+            () => new Promise((resolve4, reject) => {
               cmdQuery.once("error", reject);
-              cmdQuery.once("end", () => resolve3());
+              cmdQuery.once("end", () => resolve4());
               this.addCommand(cmdQuery);
             }),
             () => {
@@ -25837,12 +25917,12 @@ var require_connection = __commonJS({
         } else if (shouldTrace(executeChannel)) {
           tracePromise(
             executeChannel,
-            () => new Promise((resolve3, reject) => {
+            () => new Promise((resolve4, reject) => {
               prepareAndExecute((err) => {
                 executeCommand.emit("error", err);
               });
               executeCommand.once("error", reject);
-              executeCommand.once("end", () => resolve3());
+              executeCommand.once("end", () => resolve4());
             }),
             () => {
               const server = getServerContext(this.config);
@@ -26107,13 +26187,13 @@ var require_capture_local_err = __commonJS({
 var require_make_done_cb = __commonJS({
   "../../node_modules/.pnpm/mysql2@3.22.3_@types+node@24.12.3/node_modules/mysql2/lib/promise/make_done_cb.js"(exports, module) {
     var { applyCapturedStack } = require_capture_local_err();
-    function makeDoneCb(resolve3, reject, stackHolder) {
+    function makeDoneCb(resolve4, reject, stackHolder) {
       return function(err, rows, fields) {
         if (err) {
           applyCapturedStack(err, stackHolder);
           reject(err);
         } else {
-          resolve3([rows, fields]);
+          resolve4([rows, fields]);
         }
       };
     }
@@ -26136,8 +26216,8 @@ var require_prepared_statement_info = __commonJS({
         const stackHolder = captureStackHolder(
           _PromisePreparedStatementInfo.prototype.execute
         );
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           if (parameters) {
             s.execute(parameters, done);
           } else {
@@ -26146,9 +26226,9 @@ var require_prepared_statement_info = __commonJS({
         });
       }
       close() {
-        return new this.Promise((resolve3) => {
+        return new this.Promise((resolve4) => {
           this.statement.close();
-          resolve3();
+          resolve4();
         });
       }
     };
@@ -26219,8 +26299,8 @@ var require_connection2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           if (params !== void 0) {
             c2.query(query, params, done);
           } else {
@@ -26236,8 +26316,8 @@ var require_connection2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           if (params !== void 0) {
             c2.execute(query, params, done);
           } else {
@@ -26246,8 +26326,8 @@ var require_connection2 = __commonJS({
         });
       }
       end() {
-        return new this.Promise((resolve3) => {
-          this.connection.end(resolve3);
+        return new this.Promise((resolve4) => {
+          this.connection.end(resolve4);
         });
       }
       async [Symbol.asyncDispose]() {
@@ -26260,16 +26340,16 @@ var require_connection2 = __commonJS({
         const stackHolder = captureStackHolder(
           _PromiseConnection.prototype.beginTransaction
         );
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           c2.beginTransaction(done);
         });
       }
       commit() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.commit);
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           c2.commit(done);
         });
       }
@@ -26278,21 +26358,21 @@ var require_connection2 = __commonJS({
         const stackHolder = captureStackHolder(
           _PromiseConnection.prototype.rollback
         );
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           c2.rollback(done);
         });
       }
       ping() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.ping);
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           c2.ping((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve3(true);
+              resolve4(true);
             }
           });
         });
@@ -26300,13 +26380,13 @@ var require_connection2 = __commonJS({
       reset() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.reset);
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           c2.reset((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve3();
+              resolve4();
             }
           });
         });
@@ -26314,13 +26394,13 @@ var require_connection2 = __commonJS({
       connect() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.connect);
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           c2.connect((err, param) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve3(param);
+              resolve4(param);
             }
           });
         });
@@ -26329,7 +26409,7 @@ var require_connection2 = __commonJS({
         const c2 = this.connection;
         const promiseImpl = this.Promise;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.prepare);
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           c2.prepare(options, (err, statement) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
@@ -26339,7 +26419,7 @@ var require_connection2 = __commonJS({
                 statement,
                 promiseImpl
               );
-              resolve3(wrappedStatement);
+              resolve4(wrappedStatement);
             }
           });
         });
@@ -26349,13 +26429,13 @@ var require_connection2 = __commonJS({
         const stackHolder = captureStackHolder(
           _PromiseConnection.prototype.changeUser
         );
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           c2.changeUser(options, (err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve3();
+              resolve4();
             }
           });
         });
@@ -26817,12 +26897,12 @@ var require_pool2 = __commonJS({
       }
       getConnection() {
         const corePool = this.pool;
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           corePool.getConnection((err, coreConnection) => {
             if (err) {
               reject(err);
             } else {
-              resolve3(new PromisePoolConnection(coreConnection, this.Promise));
+              resolve4(new PromisePoolConnection(coreConnection, this.Promise));
             }
           });
         });
@@ -26838,8 +26918,8 @@ var require_pool2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           if (args !== void 0) {
             corePool.query(sql, args, done);
           } else {
@@ -26855,8 +26935,8 @@ var require_pool2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           if (args) {
             corePool.execute(sql, args, done);
           } else {
@@ -26867,13 +26947,13 @@ var require_pool2 = __commonJS({
       end() {
         const corePool = this.pool;
         const stackHolder = captureStackHolder(_PromisePool.prototype.end);
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           corePool.end((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve3();
+              resolve4();
             }
           });
         });
@@ -27298,12 +27378,12 @@ var require_pool_cluster2 = __commonJS({
       }
       getConnection() {
         const corePoolNamespace = this.poolNamespace;
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           corePoolNamespace.getConnection((err, coreConnection) => {
             if (err) {
               reject(err);
             } else {
-              resolve3(new PromisePoolConnection(coreConnection, this.Promise));
+              resolve4(new PromisePoolConnection(coreConnection, this.Promise));
             }
           });
         });
@@ -27318,8 +27398,8 @@ var require_pool_cluster2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           corePoolNamespace.query(sql, values, done);
         });
       }
@@ -27333,8 +27413,8 @@ var require_pool_cluster2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           corePoolNamespace.execute(sql, values, done);
         });
       }
@@ -27372,9 +27452,9 @@ var require_promise = __commonJS({
           "no Promise implementation available.Use promise-enabled node version or pass userland Promise implementation as parameter, for example: { Promise: require('bluebird') }"
         );
       }
-      return new thePromise((resolve3, reject) => {
+      return new thePromise((resolve4, reject) => {
         coreConnection.once("connect", () => {
-          resolve3(new PromiseConnection(coreConnection, thePromise));
+          resolve4(new PromiseConnection(coreConnection, thePromise));
         });
         coreConnection.once("error", (err) => {
           applyCapturedStack(err, stackHolder);
@@ -27401,7 +27481,7 @@ var require_promise = __commonJS({
       }
       getConnection(pattern, selector) {
         const corePoolCluster = this.poolCluster;
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           corePoolCluster.getConnection(
             pattern,
             selector,
@@ -27409,7 +27489,7 @@ var require_promise = __commonJS({
               if (err) {
                 reject(err);
               } else {
-                resolve3(new PromisePoolConnection(coreConnection, this.Promise));
+                resolve4(new PromisePoolConnection(coreConnection, this.Promise));
               }
             }
           );
@@ -27423,8 +27503,8 @@ var require_promise = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           corePoolCluster.query(sql, args, done);
         });
       }
@@ -27438,8 +27518,8 @@ var require_promise = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           corePoolCluster.execute(sql, args, done);
         });
       }
@@ -27452,13 +27532,13 @@ var require_promise = __commonJS({
       end() {
         const corePoolCluster = this.poolCluster;
         const stackHolder = captureStackHolder(_PromisePoolCluster.prototype.end);
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           corePoolCluster.end((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve3();
+              resolve4();
             }
           });
         });
@@ -30533,7 +30613,7 @@ var require_dist = __commonJS({
     function parse(stream, callback) {
       const parser = new parser_1.Parser();
       stream.on("data", (buffer) => parser.parse(buffer, callback));
-      return new Promise((resolve3) => stream.on("end", () => resolve3()));
+      return new Promise((resolve4) => stream.on("end", () => resolve4()));
     }
     exports.parse = parse;
   }
@@ -31258,12 +31338,12 @@ var require_client2 = __commonJS({
           this._connect(callback);
           return;
         }
-        return new this._Promise((resolve3, reject) => {
+        return new this._Promise((resolve4, reject) => {
           this._connect((error) => {
             if (error) {
               reject(error);
             } else {
-              resolve3(this);
+              resolve4(this);
             }
           });
         });
@@ -31609,8 +31689,8 @@ var require_client2 = __commonJS({
           readTimeout = config.query_timeout || this.connectionParameters.query_timeout;
           query = new Query2(config, values, callback);
           if (!query.callback) {
-            result = new this._Promise((resolve3, reject) => {
-              query.callback = (err, res) => err ? reject(err) : resolve3(res);
+            result = new this._Promise((resolve4, reject) => {
+              query.callback = (err, res) => err ? reject(err) : resolve4(res);
             }).catch((err) => {
               Error.captureStackTrace(err);
               throw err;
@@ -31687,8 +31767,8 @@ var require_client2 = __commonJS({
         if (cb) {
           this.connection.once("end", cb);
         } else {
-          return new this._Promise((resolve3) => {
-            this.connection.once("end", resolve3);
+          return new this._Promise((resolve4) => {
+            this.connection.once("end", resolve4);
           });
         }
       }
@@ -31736,8 +31816,8 @@ var require_pg_pool = __commonJS({
       const cb = function(err, client) {
         err ? rej(err) : res(client);
       };
-      const result = new Promise2(function(resolve3, reject) {
-        res = resolve3;
+      const result = new Promise2(function(resolve4, reject) {
+        res = resolve4;
         rej = reject;
       }).catch((err) => {
         Error.captureStackTrace(err);
@@ -31798,7 +31878,7 @@ var require_pg_pool = __commonJS({
         if (typeof Promise2.try === "function") {
           return Promise2.try(f);
         }
-        return new Promise2((resolve3) => resolve3(f()));
+        return new Promise2((resolve4) => resolve4(f()));
       }
       _isFull() {
         return this._clients.length >= this.options.max;
@@ -32190,8 +32270,8 @@ var require_query4 = __commonJS({
     NativeQuery.prototype._getPromise = function() {
       if (this._promise) return this._promise;
       this._promise = new Promise(
-        function(resolve3, reject) {
-          this._once("end", resolve3);
+        function(resolve4, reject) {
+          this._once("end", resolve4);
           this._once("error", reject);
         }.bind(this)
       );
@@ -32368,12 +32448,12 @@ var require_client3 = __commonJS({
         this._connect(callback);
         return;
       }
-      return new this._Promise((resolve3, reject) => {
+      return new this._Promise((resolve4, reject) => {
         this._connect((error) => {
           if (error) {
             reject(error);
           } else {
-            resolve3(this);
+            resolve4(this);
           }
         });
       });
@@ -32397,8 +32477,8 @@ var require_client3 = __commonJS({
         query = new NativeQuery(config, values, callback);
         if (!query.callback) {
           let resolveOut, rejectOut;
-          result = new this._Promise((resolve3, reject) => {
-            resolveOut = resolve3;
+          result = new this._Promise((resolve4, reject) => {
+            resolveOut = resolve4;
             rejectOut = reject;
           }).catch((err) => {
             Error.captureStackTrace(err);
@@ -32458,8 +32538,8 @@ var require_client3 = __commonJS({
       }
       let result;
       if (!cb) {
-        result = new this._Promise(function(resolve3, reject) {
-          cb = (err) => err ? reject(err) : resolve3();
+        result = new this._Promise(function(resolve4, reject) {
+          cb = (err) => err ? reject(err) : resolve4();
         });
       }
       this.native.end(function() {
@@ -36382,8 +36462,8 @@ var require_common = __commonJS({
         }
         return debug2;
       }
-      function extend(namespace, delimiter) {
-        const newDebug = createDebug(this.namespace + (typeof delimiter === "undefined" ? ":" : delimiter) + namespace);
+      function extend(namespace, delimiter2) {
+        const newDebug = createDebug(this.namespace + (typeof delimiter2 === "undefined" ? ":" : delimiter2) + namespace);
         newDebug.log = this.log;
         return newDebug;
       }
@@ -37566,7 +37646,7 @@ var require_Command = __commonJS({
         }
       }
       initPromise() {
-        const promise = new Promise((resolve3, reject) => {
+        const promise = new Promise((resolve4, reject) => {
           if (!this.transformed) {
             this.transformed = true;
             const transformer = _Command._transformer.argument[this.name];
@@ -37575,7 +37655,7 @@ var require_Command = __commonJS({
             }
             this.stringifyArguments();
           }
-          this.resolve = this._convertValue(resolve3);
+          this.resolve = this._convertValue(resolve4);
           this.reject = (err) => {
             this._clearTimers();
             if (this.errorStack) {
@@ -37608,11 +37688,11 @@ var require_Command = __commonJS({
       /**
        * Convert the value from buffer to the target encoding.
        */
-      _convertValue(resolve3) {
+      _convertValue(resolve4) {
         return (value) => {
           try {
             this._clearTimers();
-            resolve3(this.transformReply(value));
+            resolve4(this.transformReply(value));
             this.isResolved = true;
           } catch (err) {
             this.reject(err);
@@ -37890,13 +37970,13 @@ var require_autoPipelining = __commonJS({
       if (client.isCluster && !client.slots.length) {
         if (client.status === "wait")
           client.connect().catch(lodash_1.noop);
-        return (0, standard_as_callback_1.default)(new Promise(function(resolve3, reject) {
+        return (0, standard_as_callback_1.default)(new Promise(function(resolve4, reject) {
           client.delayUntilReady((err) => {
             if (err) {
               reject(err);
               return;
             }
-            executeWithAutoPipelining(client, functionName, commandName, args, null).then(resolve3, reject);
+            executeWithAutoPipelining(client, functionName, commandName, args, null).then(resolve4, reject);
           });
         }), callback);
       }
@@ -37917,13 +37997,13 @@ var require_autoPipelining = __commonJS({
         pipeline[exports.kExec] = true;
         setImmediate(executeAutoPipeline, client, slotKey);
       }
-      const autoPipelinePromise = new Promise(function(resolve3, reject) {
+      const autoPipelinePromise = new Promise(function(resolve4, reject) {
         pipeline[exports.kCallbacks].push(function(err, value) {
           if (err) {
             reject(err);
             return;
           }
-          resolve3(value);
+          resolve4(value);
         });
         if (functionName === "call") {
           args.unshift(commandName);
@@ -38158,8 +38238,8 @@ var require_Pipeline = __commonJS({
           this[name] = redis[name];
           this[name + "Buffer"] = redis[name + "Buffer"];
         });
-        this.promise = new Promise((resolve3, reject) => {
-          this.resolve = resolve3;
+        this.promise = new Promise((resolve4, reject) => {
+          this.resolve = resolve4;
           this.reject = reject;
         });
         const _this = this;
@@ -38459,13 +38539,13 @@ var require_transaction = __commonJS({
           if (this.isCluster && !this.redis.slots.length) {
             if (this.redis.status === "wait")
               this.redis.connect().catch(utils_1.noop);
-            return (0, standard_as_callback_1.default)(new Promise((resolve3, reject) => {
+            return (0, standard_as_callback_1.default)(new Promise((resolve4, reject) => {
               this.redis.delayUntilReady((err) => {
                 if (err) {
                   reject(err);
                   return;
                 }
-                this.exec(pipeline).then(resolve3, reject);
+                this.exec(pipeline).then(resolve4, reject);
               });
             }), callback);
           }
@@ -39594,7 +39674,7 @@ var require_cluster = __commonJS({
        * Connect to a cluster
        */
       connect() {
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           if (this.status === "connecting" || this.status === "connect" || this.status === "ready") {
             reject(new Error("Redis is already connecting/connected"));
             return;
@@ -39623,7 +39703,7 @@ var require_cluster = __commonJS({
               this.retryAttempts = 0;
               this.executeOfflineCommands();
               this.resetNodesRefreshInterval();
-              resolve3();
+              resolve4();
             };
             let closeListener = void 0;
             const refreshListener = () => {
@@ -40233,7 +40313,7 @@ var require_cluster = __commonJS({
         });
       }
       resolveSrv(hostname2) {
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           this.options.resolveSrv(hostname2, (err, records) => {
             if (err) {
               return reject(err);
@@ -40247,7 +40327,7 @@ var require_cluster = __commonJS({
               if (!group.records.length) {
                 sortedKeys.shift();
               }
-              self2.dnsLookup(record.name).then((host) => resolve3({
+              self2.dnsLookup(record.name).then((host) => resolve4({
                 host,
                 port: record.port
               }), tryFirstOne);
@@ -40257,14 +40337,14 @@ var require_cluster = __commonJS({
         });
       }
       dnsLookup(hostname2) {
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           this.options.dnsLookup(hostname2, (err, address) => {
             if (err) {
               debug2("failed to resolve hostname %s to IP: %s", hostname2, err.message);
               reject(err);
             } else {
               debug2("resolved hostname %s to IP %s", hostname2, address);
-              resolve3(address);
+              resolve4(address);
             }
           });
         });
@@ -40419,7 +40499,7 @@ var require_StandaloneConnector = __commonJS({
         if (options.tls) {
           Object.assign(connectionOptions, options.tls);
         }
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           process.nextTick(() => {
             if (!this.connecting) {
               reject(new Error(utils_1.CONNECTION_CLOSED_ERROR_MSG));
@@ -40438,7 +40518,7 @@ var require_StandaloneConnector = __commonJS({
             this.stream.once("error", (err) => {
               this.firstError = err;
             });
-            resolve3(this.stream);
+            resolve4(this.stream);
           });
         });
       }
@@ -40594,7 +40674,7 @@ var require_SentinelConnector = __commonJS({
             const error = new Error(errorMsg);
             if (typeof retryDelay === "number") {
               eventEmitter("error", error);
-              await new Promise((resolve3) => setTimeout(resolve3, retryDelay));
+              await new Promise((resolve4) => setTimeout(resolve4, retryDelay));
               return connectToNext();
             } else {
               throw error;
@@ -41911,7 +41991,7 @@ var require_Redis = __commonJS({
        * if the connection fails, times out, or if Redis is already connecting/connected.
        */
       connect(callback) {
-        const promise = new Promise((resolve3, reject) => {
+        const promise = new Promise((resolve4, reject) => {
           if (this.status === "connecting" || this.status === "connect" || this.status === "ready") {
             reject(new Error("Redis is already connecting/connected"));
             return;
@@ -41990,7 +42070,7 @@ var require_Redis = __commonJS({
             }
             const connectionReadyHandler = function() {
               _this.removeListener("close", connectionCloseHandler);
-              resolve3();
+              resolve4();
             };
             var connectionCloseHandler = function() {
               _this.removeListener("ready", connectionReadyHandler);
@@ -42084,10 +42164,10 @@ var require_Redis = __commonJS({
           monitor: true,
           lazyConnect: false
         });
-        return (0, standard_as_callback_1.default)(new Promise(function(resolve3, reject) {
+        return (0, standard_as_callback_1.default)(new Promise(function(resolve4, reject) {
           monitorInstance.once("error", reject);
           monitorInstance.once("monitoring", function() {
-            resolve3(monitorInstance);
+            resolve4(monitorInstance);
           });
         }), callback);
       }
@@ -42860,7 +42940,15 @@ async function runMenu() {
       });
       if (!q(setup) && setup) {
         const { runInitFlow: runInitFlow2 } = await Promise.resolve().then(() => (init_init(), init_exports));
-        await runInitFlow2(client, { cwd: process.cwd(), dryRun: false, noScripts: false });
+        const outcome = await runInitFlow2(client, {
+          cwd: process.cwd(),
+          dryRun: false,
+          noScripts: false
+        });
+        if (outcome.exitCode === 0) {
+          ye("All set. Run keynv again anytime to manage secrets.");
+          return 0;
+        }
       }
     }
   }
@@ -42930,8 +43018,8 @@ var init_menu = __esm({
   "src/ui/menu.ts"() {
     init_dist5();
     init_http();
-    init_detect();
     init_store();
+    init_detect();
     init_version();
     init_audit2();
     init_login();
@@ -44657,44 +44745,48 @@ var AuditListCommand = class extends Command {
   sinceId = options_exports.String("--since-id");
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const data = await client.request(
-      "/v1/audit",
-      {
-        query: {
-          event_type: this.eventType,
-          limit: this.limit,
-          since_id: this.sinceId
+    try {
+      const client = new ApiClient();
+      const data = await client.request(
+        "/v1/audit",
+        {
+          query: {
+            event_type: this.eventType,
+            limit: this.limit,
+            since_id: this.sinceId
+          }
         }
-      }
-    );
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+      );
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return 0;
-    }
-    if (data.entries.length === 0) {
-      this.context.stdout.write("no audit entries\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["id", "ts", "actor", "agent", "event"],
-        data.entries.map((e2) => [
-          String(e2.id),
-          e2.ts,
-          e2.actor_user_id ?? "(none)",
-          e2.actor_agent,
-          e2.event_type
-        ])
-      )}
+        return 0;
+      }
+      if (data.entries.length === 0) {
+        this.context.stdout.write("no audit entries\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["id", "ts", "actor", "agent", "event"],
+          data.entries.map((e2) => [
+            String(e2.id),
+            e2.ts,
+            e2.actor_user_id ?? "(none)",
+            e2.actor_agent,
+            e2.event_type
+          ])
+        )}
 `
-    );
-    if (data.next_cursor) {
-      this.context.stdout.write(`(next: --since-id ${data.next_cursor})
+      );
+      if (data.next_cursor) {
+        this.context.stdout.write(`(next: --since-id ${data.next_cursor})
 `);
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 var AuditVerifyCommand = class extends Command {
@@ -44704,27 +44796,29 @@ var AuditVerifyCommand = class extends Command {
   });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const data = await client.request("/v1/audit/verify", { method: "POST" });
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      const data = await client.request("/v1/audit/verify", { method: "POST" });
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return data.ok ? 0 : 1;
-    }
-    if (data.ok) {
-      this.context.stdout.write(`OK: ${data.checked} entries verified
+        return data.ok ? 0 : 1;
+      }
+      if (data.ok) {
+        this.context.stdout.write(`OK: ${data.checked} entries verified
 `);
-      return 0;
-    }
-    this.context.stdout.write(
-      `FAIL: chain broken at id ${data.broken_at_id} (${data.reason}); ${data.checked} entries verified before break
+        return 0;
+      }
+      this.context.stdout.write(
+        `FAIL: chain broken at id ${data.broken_at_id} (${data.reason}); ${data.checked} entries verified before break
 `
-    );
-    return 1;
+      );
+      return 1;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
-
-// src/commands/exec.ts
 init_http();
 init_envFile();
 
@@ -45073,7 +45167,9 @@ var ENV_ALLOWLIST = [
   "WINDIR",
   "COMSPEC",
   "APPDATA",
-  "LOCALAPPDATA"
+  "LOCALAPPDATA",
+  "PATHEXT"
+  // needed so child processes can resolve executables by name
 ];
 function spawnPrivileged(opts) {
   const startedAt = Date.now();
@@ -45082,15 +45178,63 @@ function spawnPrivileged(opts) {
     const v2 = process.env[name];
     if (v2 !== void 0) env2[name] = v2;
   }
+  const nmBin = findNodeModulesBin(process.cwd());
+  if (nmBin) {
+    const existingPath = env2.PATH ?? "";
+    env2.PATH = existingPath.startsWith(nmBin + nodePath.delimiter) ? existingPath : nmBin + nodePath.delimiter + existingPath;
+  }
   if (opts.injectedEnv) {
     for (const [k2, v2] of Object.entries(opts.injectedEnv)) env2[k2] = v2;
   }
   const stdio = ["inherit", "pipe", "pipe"];
-  const child = spawn(opts.command, opts.args, {
+  const WIN_BUILTINS = /* @__PURE__ */ new Set([
+    "echo",
+    "dir",
+    "type",
+    "copy",
+    "del",
+    "move",
+    "ren",
+    "md",
+    "mkdir",
+    "rd",
+    "rmdir",
+    "cd",
+    "cls",
+    "set",
+    "pause",
+    "find",
+    "where"
+  ]);
+  let spawnCmd = opts.command;
+  let spawnArgs = opts.args;
+  let windowsVerbatimArguments = false;
+  if (process.platform === "win32") {
+    const comspec = env2.COMSPEC ?? process.env.COMSPEC ?? "cmd.exe";
+    if (WIN_BUILTINS.has(opts.command.toLowerCase())) {
+      spawnCmd = comspec;
+      spawnArgs = ["/d", "/s", "/c", opts.command, ...opts.args];
+    } else {
+      const resolved = resolveWindowsCmd(opts.command, env2);
+      if (resolved !== null) {
+        const ext = nodePath.extname(resolved).toLowerCase();
+        if (ext === ".cmd" || ext === ".bat") {
+          const q2 = (s) => s.includes(" ") ? `"${s}"` : s;
+          const inner = [q2(resolved), ...opts.args.map(q2)].join(" ");
+          spawnCmd = comspec;
+          spawnArgs = ["/d", "/s", "/c", `"${inner}"`];
+          windowsVerbatimArguments = true;
+        } else {
+          spawnCmd = resolved;
+        }
+      }
+    }
+  }
+  const child = spawn(spawnCmd, spawnArgs, {
     env: env2,
     stdio,
     detached: false,
-    shell: process.platform === "win32"
+    windowsVerbatimArguments
   });
   const literals = opts.resolved.map((r) => r.value).filter((v2) => v2.length > 0);
   if (!opts.noRedact && child.stdout) {
@@ -45111,14 +45255,14 @@ function spawnPrivileged(opts) {
     }, opts.timeoutS * 1e3);
     timer.unref();
   }
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     child.on("error", (err) => {
       if (timer) clearTimeout(timer);
       reject(err);
     });
     child.on("close", (code, signal) => {
       if (timer) clearTimeout(timer);
-      resolve3({
+      resolve4({
         exitCode: code ?? 0,
         signal,
         durationMs: Date.now() - startedAt
@@ -45126,6 +45270,34 @@ function spawnPrivileged(opts) {
     });
   });
 }
+function resolveWindowsCmd(command, subprocessEnv) {
+  if (nodePath.extname(command)) return null;
+  if (command.includes("/") || command.includes("\\")) return null;
+  const pathExt = (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").map((e2) => e2.toLowerCase()).filter(Boolean);
+  const pathStr = subprocessEnv.PATH ?? process.env.PATH ?? "";
+  const pathDirs = pathStr.split(nodePath.delimiter).filter(Boolean);
+  for (const dir of pathDirs) {
+    for (const ext of pathExt) {
+      try {
+        const full = nodePath.join(dir, command + ext);
+        if (existsSync(full)) return full;
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+function findNodeModulesBin(cwd) {
+  let dir = nodePath.resolve(cwd);
+  for (let i = 0; i < 20; i++) {
+    const candidate = nodePath.join(dir, "node_modules", ".bin");
+    if (existsSync(candidate)) return candidate;
+    const parent = nodePath.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
 
 // src/commands/exec.ts
 var ExecCommand = class extends Command {
@@ -45182,6 +45354,10 @@ spelled \`--from\` to avoid the collision.)
   quiet = options_exports.Boolean("--quiet", false, {
     description: `Suppress the "loaded N vars from ${ENV_FILE_BASENAME}" status line.`
   });
+  // Option.Rest: keynv options (e.g. --no-env-file) are parsed before `--`.
+  // Everything after `--` is captured in rest verbatim, including subprocess
+  // flags like `--port 3005` and `-v`. Always use `--` to separate keynv
+  // options from the subprocess command.
   rest = options_exports.Rest();
   async execute() {
     if (!this.rest || this.rest.length === 0) {
@@ -45224,6 +45400,13 @@ spelled \`--from\` to avoid the collision.)
       );
       return 2;
     }
+    if (!envFileLoaded && !this.noEnvFile && !this.envFile && !process.env.KEYNV_ENV_FILE) {
+      this.context.stderr.write(
+        `keynv: no ${ENV_FILE_BASENAME} found in this directory or any parent.
+       Run \`keynv init\` in your project root to migrate secrets and create one.
+`
+      );
+    }
     const viaEnvSpecs = [];
     for (const spec of this.viaEnv ?? []) {
       const eq = spec.indexOf("=");
@@ -45348,7 +45531,9 @@ function signalNumber(sig) {
 init_dist();
 init_http();
 init_envFile();
+init_detect();
 init_heuristics();
+init_aiContext();
 init_init();
 init_cancel();
 init_tty();
@@ -45364,7 +45549,8 @@ async function resolveProjectId(client, input) {
     return input;
   }
   const data = await client.request("/v1/projects");
-  const match = data.projects.find((p2) => p2.name === input);
+  const lowerInput = input.toLowerCase();
+  const match = data.projects.find((p2) => p2.name.toLowerCase() === lowerInput);
   if (!match) throw new Error(`project not found: ${input}`);
   return match.id;
 }
@@ -45375,25 +45561,29 @@ var ProjectListCommand = class extends Command {
   });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const data = await client.request("/v1/projects");
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      const data = await client.request("/v1/projects");
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
+        return 0;
+      }
+      if (data.projects.length === 0) {
+        this.context.stdout.write("no projects\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["name", "id", "created_at"],
+          data.projects.map((p2) => [p2.name, p2.id, p2.created_at])
+        )}
+`
+      );
       return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    if (data.projects.length === 0) {
-      this.context.stdout.write("no projects\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["name", "id", "created_at"],
-        data.projects.map((p2) => [p2.name, p2.id, p2.created_at])
-      )}
-`
-    );
-    return 0;
   }
 };
 var ProjectCreateCommand = class extends Command {
@@ -45407,28 +45597,32 @@ var ProjectCreateCommand = class extends Command {
     description: 'Environment spec: name[:tier[:approval]]. Tier \u2208 {production,non-production}; "approval" sets require_approval=true.'
   });
   async execute() {
-    const envs = (this.envs ?? ["dev"]).map((spec) => {
-      const [name, tier, approval] = spec.split(":");
-      return {
-        name: name ?? "",
-        tier: tier ?? "non-production",
-        require_approval: approval === "approval"
-      };
-    });
-    const client = new ApiClient();
-    const result = await client.request("/v1/projects", {
-      method: "POST",
-      body: { name: this.name, environments: envs }
-    });
-    this.context.stdout.write(`created project ${result.name} (${result.id})
+    try {
+      const envs = (this.envs ?? ["dev"]).map((spec) => {
+        const [name, tier, approval] = spec.split(":");
+        return {
+          name: name ?? "",
+          tier: tier ?? "non-production",
+          require_approval: approval === "approval"
+        };
+      });
+      const client = new ApiClient();
+      const result = await client.request("/v1/projects", {
+        method: "POST",
+        body: { name: this.name, environments: envs }
+      });
+      this.context.stdout.write(`created project ${result.name} (${result.id})
 `);
-    for (const e2 of envs) {
-      this.context.stdout.write(
-        `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
+      for (const e2 of envs) {
+        this.context.stdout.write(
+          `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
 `
-      );
+        );
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 var ProjectDescribeCommand = class extends Command {
@@ -45443,23 +45637,27 @@ var ProjectDescribeCommand = class extends Command {
   id = options_exports.String();
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const projectId2 = await resolveProjectId(client, this.id);
-    const data = await client.request(`/v1/projects/${projectId2}`);
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.id);
+      const data = await client.request(`/v1/projects/${projectId2}`);
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return 0;
-    }
-    this.context.stdout.write(`project: ${data.name} (${data.id})
+        return 0;
+      }
+      this.context.stdout.write(`project: ${data.name} (${data.id})
 `);
-    for (const e2 of data.environments) {
-      this.context.stdout.write(
-        `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
+      for (const e2 of data.environments) {
+        this.context.stdout.write(
+          `  env: ${e2.name} (tier=${e2.tier}, approval=${e2.require_approval})
 `
-      );
+        );
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 var ProjectDeleteCommand = class extends Command {
@@ -45472,15 +45670,27 @@ var ProjectDeleteCommand = class extends Command {
       this.context.stderr.write("keynv: refusing to delete without --force\n");
       return 2;
     }
-    const client = new ApiClient();
-    await client.request(`/v1/projects/${this.id}`, { method: "DELETE" });
-    this.context.stdout.write(`deleted project ${this.id}
+    try {
+      const client = new ApiClient();
+      await client.request(`/v1/projects/${this.id}`, { method: "DELETE" });
+      this.context.stdout.write(`deleted project ${this.id}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 
 // src/commands/init.ts
+function toAliasKey2(name) {
+  if (!name) return name;
+  const KEY_RE3 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+  if (KEY_RE3.test(name)) return name;
+  const normalised = name.toLowerCase().replace(/_/g, "-");
+  if (KEY_RE3.test(normalised)) return normalised;
+  return normalised.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64) || "key";
+}
 var InitCommand = class extends Command {
   static paths = [["init"]];
   static usage = Command.Usage({
@@ -45499,15 +45709,19 @@ mappings that would be written to .keynv.env, then exits without
 touching any files or making any network calls. Use it to preview
 what init will do before committing.
 
-Requires an interactive terminal (clack TUI). For scripted
-migration, use the lower-level \`keynv project\` and \`keynv secret\`
-commands directly.
+For scripted migration, use \`--env-file\` or \`--secret\` flags, or
+\`--yes\` to auto-scan the project directory and set up without
+any prompts.
 `,
     examples: [
       ["Walk the current project", "$0 init"],
       ["Preview without writing or uploading", "$0 init --dry-run"],
       ["Skip the package.json script-wrapping step", "$0 init --no-scripts"],
-      ["Non-interactive (CI/CD)", "$0 init --env-file .env --project myproject --env dev"]
+      ["Non-interactive (CI/CD)", "$0 init --env-file .env --project myproject --env dev"],
+      [
+        "Auto-scan & set up without prompts (CI/CD)",
+        "$0 init --yes"
+      ]
     ]
   });
   dryRun = options_exports.Boolean("--dry-run", false, {
@@ -45528,6 +45742,9 @@ commands directly.
   secret = options_exports.Array("--secret", {
     description: "KEY=value secret to upload (non-interactive). Can be specified multiple times."
   });
+  yes = options_exports.Boolean("--yes", false, {
+    description: "Auto-scan .env files, classify, and set up without prompts. Implies non-interactive mode."
+  });
   async execute() {
     const client = new ApiClient();
     await client.ensureHydrated();
@@ -45537,13 +45754,13 @@ commands directly.
     }
     const hasEnvFile = this.envFile != null;
     const hasSecrets = this.secret != null && this.secret.length > 0;
-    const isNonInteractive = hasEnvFile || hasSecrets;
+    const isNonInteractive = hasEnvFile || hasSecrets || this.dryRun || this.yes;
     if (isNonInteractive) {
       return this.runNonInteractive(client);
     }
     if (!isInteractive()) {
       this.context.stderr.write(
-        "keynv init requires an interactive terminal. Use --env-file or --secret for scripted setup.\n"
+        "keynv init requires an interactive terminal. Use --dry-run, --env-file, or --secret for scripted setup.\n"
       );
       return 1;
     }
@@ -45563,6 +45780,9 @@ commands directly.
     }
   }
   async runNonInteractive(client) {
+    if (this.yes && !this.envFile && !this.secret) {
+      return this.runAutoScan(client);
+    }
     const projectName = this.project;
     if (!projectName) {
       this.context.stderr.write("keynv: --project is required in non-interactive mode.\n");
@@ -45582,7 +45802,7 @@ commands directly.
         const content = readFileSync(this.envFile, "utf8");
         const entries = parseEnvFile(content, this.envFile);
         for (const e2 of entries) {
-          if (classifyEntry(e2.name, e2.value).verdict !== "skip") {
+          if (classifyEntry(e2.name, e2.value).verdict === "secret") {
             secrets.push({ name: e2.name, value: e2.value });
           }
         }
@@ -45612,34 +45832,134 @@ commands directly.
       return 0;
     }
     if (this.dryRun) {
-      this.context.stdout.write(
-        `keynv: dry-run \u2014 would upload ${secrets.length} secret(s) to project ${projectName} (${projectId2}) in env ${envName}
+      if (this.envFile || this.secret && this.secret.length > 0) {
+        this.context.stdout.write(
+          `keynv: dry-run \u2014 would upload ${secrets.length} secret(s) to project ${projectName} (${projectId2}) in env ${envName}
 `
+        );
+        for (const { name } of secrets) {
+          const aliasKey = toAliasKey2(name);
+          this.context.stdout.write(`  ${name}=@${projectName}.${envName}.${aliasKey}
+`);
+        }
+        return 0;
+      }
+      this.context.stdout.write(
+        "keynv: dry-run mode \u2014 no --env-file or --secret provided. Nothing to scan.\n"
       );
+      return 0;
+    }
+    const secretsWithKeys = secrets.map((s) => ({ ...s, aliasKey: toAliasKey2(s.name) }));
+    return this.uploadSecrets(client, projectId2, projectName, envName, secretsWithKeys);
+  }
+  /**
+   * Auto-scan mode (--yes without explicit --env-file). Finds .env files
+   * in the project root, classifies entries, creates a project, uploads
+   * secrets, and writes .keynv.env — all without prompts.
+   */
+  async runAutoScan(client) {
+    const root = findProjectRoot(process.cwd());
+    if (!root) {
+      this.context.stderr.write(
+        "keynv: no project root found (no package.json, .git, etc.).\n"
+      );
+      return 1;
+    }
+    const envFiles = findEnvFiles(root.path);
+    if (envFiles.length === 0) {
+      this.context.stdout.write("keynv: no .env files found. Nothing to migrate.\n");
+      return 0;
+    }
+    const projectName = this.project ?? root.suggestedName;
+    const envName = this.env ?? suggestedEnvForSuffix(envFiles[0]?.suffix ?? null);
+    const secrets = [];
+    for (const f of envFiles) {
+      try {
+        const entries = parseEnvFile(readFileSync(f.path, "utf8"), f.path);
+        for (const e2 of entries) {
+          if (classifyEntry(e2.name, e2.value).verdict === "secret") {
+            secrets.push({ name: e2.name, value: e2.value });
+          }
+        }
+      } catch {
+        this.context.stderr.write(`keynv: warning \u2014 could not parse ${f.name}, skipping.
+`);
+      }
+    }
+    if (secrets.length === 0) {
+      this.context.stdout.write("keynv: no secrets detected in .env files. Nothing to upload.\n");
+      return 0;
+    }
+    this.context.stdout.write(
+      `keynv: auto-scan found ${secrets.length} secret(s) across ${envFiles.length} file(s).
+`
+    );
+    if (this.dryRun) {
       for (const { name } of secrets) {
-        const aliasKey = name.toLowerCase().replace(/_/g, "-");
+        const aliasKey = toAliasKey2(name);
         this.context.stdout.write(`  ${name}=@${projectName}.${envName}.${aliasKey}
 `);
       }
       return 0;
     }
+    let projectId2;
+    try {
+      projectId2 = await resolveProjectId(client, projectName);
+    } catch {
+      const created = await client.request("/v1/projects", {
+        method: "POST",
+        body: { name: projectName, environments: [{ name: envName, tier: "non-production", require_approval: false }] }
+      });
+      projectId2 = created.id;
+      this.context.stdout.write(`keynv: created project "${projectName}" (${projectId2}).
+`);
+    }
+    const secretsWithKeys = secrets.map((s) => ({ ...s, aliasKey: toAliasKey2(s.name) }));
+    const result = await this.uploadSecrets(client, projectId2, projectName, envName, secretsWithKeys);
+    if (result !== 0) return result;
+    const aliasLines = secretsWithKeys.map((s) => `# ${s.name}
+${s.name}=@${projectName}.${envName}.${s.aliasKey}`).join("\n");
+    const keynvEnvPath = join(root.path, ".keynv.env");
+    writeFileSync(keynvEnvPath, `# Auto-generated by keynv init --yes
+${aliasLines}
+`);
+    this.context.stdout.write(`keynv: wrote ${keynvEnvPath}
+`);
+    try {
+      const outcome = writeAiContext(root.path);
+      if (outcome === "created") this.context.stdout.write("keynv: wrote AGENTS.md\n");
+    } catch {
+      this.context.stdout.write("keynv: warning \u2014 could not write AGENTS.md.\n");
+    }
+    for (const f of envFiles) {
+      unlinkSync(f.path);
+      this.context.stdout.write(`keynv: removed ${f.name} (secrets migrated to vault).
+`);
+    }
+    this.context.stdout.write("keynv: done. Use `keynv exec` to run commands with resolved secrets.\n");
+    return 0;
+  }
+  /**
+   * Upload secrets to the vault and print the result. Shared between
+   * runNonInteractive and runAutoScan.
+   */
+  async uploadSecrets(client, projectId2, projectName, envName, secrets) {
     let uploaded = 0;
     const failed = [];
-    for (const { name, value } of secrets) {
-      const aliasKey = name.toLowerCase().replace(/_/g, "-");
-      const alias2 = buildAlias({ project: projectName, environment: envName, key: aliasKey });
+    for (const s of secrets) {
+      const alias2 = buildAlias({ project: projectName, environment: envName, key: s.aliasKey });
       if (!alias2) {
-        failed.push(`${name} (invalid alias key: ${aliasKey})`);
+        failed.push({ name: s.name, reason: `invalid alias key: ${s.aliasKey}` });
         continue;
       }
       try {
         await client.request(`/v1/projects/${projectId2}/secrets`, {
           method: "POST",
-          body: { env: envName, key: aliasKey, value }
+          body: { env: envName, key: s.aliasKey, value: s.value }
         });
         uploaded++;
       } catch (err) {
-        failed.push(`${name}: ${err instanceof Error ? err.message : String(err)}`);
+        failed.push({ name: s.name, reason: err instanceof Error ? err.message : String(err) });
       }
     }
     this.context.stdout.write(
@@ -45647,7 +45967,7 @@ commands directly.
 `
     );
     if (failed.length > 0) {
-      for (const f of failed) this.context.stderr.write(`  failed: ${f}
+      for (const f of failed) this.context.stderr.write(`  failed: ${f.name} \u2014 ${f.reason}
 `);
       return 1;
     }
@@ -45669,7 +45989,7 @@ async function promptHidden(prompt) {
   process.stdin.setRawMode(true);
   process.stdin.resume();
   process.stdin.setEncoding("utf8");
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let buf = "";
     const onData = (chunk) => {
       for (const ch of chunk) {
@@ -45678,7 +45998,7 @@ async function promptHidden(prompt) {
           process.stdin.pause();
           process.stdin.removeListener("data", onData);
           process.stdout.write("\n");
-          resolve3(buf);
+          resolve4(buf);
           return;
         }
         if (ch === "") {
@@ -45696,10 +46016,10 @@ async function promptHidden(prompt) {
 }
 async function promptLine(prompt) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     rl.question(prompt, (answer) => {
       rl.close();
-      resolve3(answer.trim());
+      resolve4(answer.trim());
     });
   });
 }
@@ -45732,6 +46052,13 @@ var LoginCommand = class extends Command {
   });
   async execute() {
     const finalServerUrl = this.server ?? DEFAULT_SERVER_URL;
+    try {
+      new URL(finalServerUrl);
+    } catch {
+      this.context.stderr.write(`keynv: invalid server URL '${finalServerUrl}'
+`);
+      return 1;
+    }
     if (this.token) {
       return this.loginWithToken(finalServerUrl, this.token);
     }
@@ -45754,11 +46081,20 @@ var LoginCommand = class extends Command {
     }
     const email2 = this.email ?? await promptLine("email: ");
     const password = this.password ?? await promptHidden("password: ");
-    const res = await fetch(new URL("/v1/auth/login", finalServerUrl).toString(), {
-      method: "POST",
-      headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
-      body: JSON.stringify({ email: email2, password })
-    });
+    let res;
+    try {
+      res = await fetch(new URL("/v1/auth/login", finalServerUrl).toString(), {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
+        body: JSON.stringify({ email: email2, password })
+      });
+    } catch (err) {
+      this.context.stderr.write(
+        `keynv: cannot reach server '${finalServerUrl}' \u2014 ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 1;
+    }
     if (!res.ok) {
       const text = await res.text();
       let msg = `login failed (${res.status})`;
@@ -45804,9 +46140,18 @@ var LoginCommand = class extends Command {
     return 0;
   }
   async loginWithToken(serverUrl, token) {
-    const res = await fetch(new URL("/v1/whoami", serverUrl).toString(), {
-      headers: { authorization: `Bearer ${token}`, "x-keynv-agent": AGENT }
-    });
+    let res;
+    try {
+      res = await fetch(new URL("/v1/whoami", serverUrl).toString(), {
+        headers: { authorization: `Bearer ${token}`, "x-keynv-agent": AGENT }
+      });
+    } catch (err) {
+      this.context.stderr.write(
+        `keynv: cannot reach server '${serverUrl}' \u2014 ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 1;
+    }
     if (!res.ok) {
       const text = await res.text();
       let msg = `token login failed (${res.status})`;
@@ -45884,36 +46229,40 @@ var WhoamiCommand = class extends Command {
   });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    if (!client.isLoggedIn) {
-      this.context.stderr.write("keynv: not logged in. Run `keynv login`.\n");
-      return 1;
-    }
-    const data = await client.request("/v1/whoami");
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      if (!client.isLoggedIn) {
+        this.context.stderr.write("keynv: not logged in. Run `keynv login`.\n");
+        return 1;
+      }
+      const data = await client.request("/v1/whoami");
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
-      return 0;
-    }
-    this.context.stdout.write(`user:    ${data.email} (${data.id})
+        return 0;
+      }
+      this.context.stdout.write(`user:    ${data.email} (${data.id})
 `);
-    const orgDisplay = data.org_name ? `${data.org_name} (${data.org_id})` : data.org_id;
-    this.context.stdout.write(`org:     ${orgDisplay}
+      const orgDisplay = data.org_name ? `${data.org_name} (${data.org_id})` : data.org_id;
+      this.context.stdout.write(`org:     ${orgDisplay}
 `);
-    this.context.stdout.write(`role:    ${data.org_role}
+      this.context.stdout.write(`role:    ${data.org_role}
 `);
-    if (data.memberships.length === 0) {
-      this.context.stdout.write("memberships: (none)\n");
-    } else {
-      this.context.stdout.write("memberships:\n");
-      for (const m of data.memberships) {
-        const proj = m.project_name ? `${m.project_name} (${m.project_id})` : m.project_id;
-        this.context.stdout.write(`  ${proj}: ${m.role}
+      if (data.memberships.length === 0) {
+        this.context.stdout.write("memberships: (none)\n");
+      } else {
+        this.context.stdout.write("memberships:\n");
+        for (const m of data.memberships) {
+          const proj = m.project_name ? `${m.project_name} (${m.project_id})` : m.project_id;
+          this.context.stdout.write(`  ${proj}: ${m.role}
 `);
+        }
       }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 
@@ -45935,15 +46284,19 @@ var MemberAddCommand = class extends Command {
       this.context.stderr.write("keynv: --role must be one of lead, developer, reader\n");
       return 1;
     }
-    const client = new ApiClient();
-    const projectId2 = await resolveProjectId(client, this.project);
-    await client.request(`/v1/projects/${projectId2}/members`, {
-      method: "POST",
-      body: { email: this.email, role: role2 }
-    });
-    this.context.stdout.write(`added ${this.email} to ${this.project} as ${role2}
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.project);
+      await client.request(`/v1/projects/${projectId2}/members`, {
+        method: "POST",
+        body: { email: this.email, role: role2 }
+      });
+      this.context.stdout.write(`added ${this.email} to ${this.project} as ${role2}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var MemberRemoveCommand = class extends Command {
@@ -45952,21 +46305,25 @@ var MemberRemoveCommand = class extends Command {
   project = options_exports.String();
   email = options_exports.String();
   async execute() {
-    const client = new ApiClient();
-    const projectId2 = await resolveProjectId(client, this.project);
-    const members = await client.request(`/v1/projects/${projectId2}/members`);
-    const target = members.members.find((m) => m.email === this.email);
-    if (!target) {
-      this.context.stderr.write(`keynv: ${this.email} is not a member of ${this.project}
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.project);
+      const members = await client.request(`/v1/projects/${projectId2}/members`);
+      const target = members.members.find((m) => m.email === this.email);
+      if (!target) {
+        this.context.stderr.write(`keynv: ${this.email} is not a member of ${this.project}
 `);
-      return 1;
-    }
-    await client.request(`/v1/projects/${projectId2}/members/${target.user_id}`, {
-      method: "DELETE"
-    });
-    this.context.stdout.write(`removed ${this.email} from ${this.project}
+        return 1;
+      }
+      await client.request(`/v1/projects/${projectId2}/members/${target.user_id}`, {
+        method: "DELETE"
+      });
+      this.context.stdout.write(`removed ${this.email} from ${this.project}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var MemberListCommand = class extends Command {
@@ -45975,26 +46332,30 @@ var MemberListCommand = class extends Command {
   project = options_exports.String();
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    const projectId2 = await resolveProjectId(client, this.project);
-    const data = await client.request(`/v1/projects/${projectId2}/members`);
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+    try {
+      const client = new ApiClient();
+      const projectId2 = await resolveProjectId(client, this.project);
+      const data = await client.request(`/v1/projects/${projectId2}/members`);
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
+        return 0;
+      }
+      if (data.members.length === 0) {
+        this.context.stdout.write("no members\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["email", "role", "granted_at"],
+          data.members.map((m) => [m.email, m.role, m.granted_at])
+        )}
+`
+      );
       return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    if (data.members.length === 0) {
-      this.context.stdout.write("no members\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["email", "role", "granted_at"],
-        data.members.map((m) => [m.email, m.role, m.granted_at])
-      )}
-`
-    );
-    return 0;
   }
 };
 var RedactCommand = class extends Command {
@@ -46045,9 +46406,9 @@ here (see the streaming-mode limitation in the redactor package).
 `
   });
   async execute() {
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const transform = createRedactStream();
-      this.context.stdin.pipe(transform).pipe(this.context.stdout).on("error", reject).on("finish", () => resolve3(0));
+      this.context.stdin.pipe(transform).pipe(this.context.stdout).on("error", reject).on("finish", () => resolve4(0));
       this.context.stdin.on("error", reject);
     });
   }
@@ -46093,46 +46454,53 @@ var SecretCreateCommand = class extends Command {
   });
   stdin = options_exports.Boolean("--stdin", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    let value = this.value;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        const built = await promptNewSecret(client);
-        if (!built) return 1;
-        alias2 = built.alias;
-        value = built.value;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      let value = this.value;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          const built = await promptNewSecret(client);
+          if (!built) return 1;
+          alias2 = built.alias;
+          value = built.value;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
       }
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    if (this.stdin) {
-      const chunks = [];
-      for await (const chunk of this.context.stdin) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        return 1;
       }
-      value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
-    } else if (value === void 0) {
-      value = await promptHidden("value: ");
-    }
-    const projectId2 = await resolveProjectId(client, parsed.project);
-    await client.request(`/v1/projects/${projectId2}/secrets`, {
-      method: "POST",
-      body: { env: parsed.environment, key: parsed.key, value }
-    });
-    this.context.stdout.write(`created ${parsed.literal}
+      if (this.stdin) {
+        const chunks = [];
+        for await (const chunk of this.context.stdin) {
+          chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        }
+        value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
+      } else if (value === void 0) {
+        value = await promptHidden("value: ");
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      await client.request(
+        `/v1/projects/${projectId2}/secrets`,
+        {
+          method: "POST",
+          body: { env: parsed.environment, key: parsed.key, value }
+        }
+      );
+      this.context.stdout.write(`created ${parsed.literal}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var SecretGetCommand = class extends Command {
@@ -46143,40 +46511,44 @@ var SecretGetCommand = class extends Command {
   alias = options_exports.String({ required: false });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        alias2 = await pickAliasInteractive(client) ?? void 0;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          alias2 = await pickAliasInteractive(client) ?? void 0;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
+        if (!alias2) return 1;
       }
-      if (!alias2) return 1;
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    const projectId2 = await resolveProjectId(client, parsed.project);
-    const data = await client.request(
-      `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`
-    );
-    if (this.json) {
-      this.context.stdout.write(
-        `${JSON.stringify({ alias: data.alias, version: data.version, value: data.value })}
-`
+        return 1;
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      const data = await client.request(
+        `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`
       );
-    } else {
-      this.context.stdout.write(`${data.value}
+      if (this.json) {
+        this.context.stdout.write(
+          `${JSON.stringify({ alias: data.alias, version: data.version, value: data.value })}
+`
+        );
+      } else {
+        this.context.stdout.write(`${data.value}
 `);
+      }
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    return 0;
   }
 };
 var SecretListCommand = class extends Command {
@@ -46187,42 +46559,55 @@ var SecretListCommand = class extends Command {
   project = options_exports.String({ required: false });
   json = options_exports.Boolean("--json", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let projectName = this.project;
-    if (!projectName) {
-      if (!isInteractive()) {
-        this.context.stderr.write("keynv: missing <project>.\n");
-        return 1;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let projectName = this.project;
+      if (!projectName) {
+        if (!isInteractive()) {
+          this.context.stderr.write("keynv: missing <project>.\n");
+          return 1;
+        }
+        try {
+          const picked = await pickProject(client, "Project");
+          if (!picked) return 1;
+          projectName = picked.name;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
       }
-      try {
-        const picked = await pickProject(client, "Project");
-        if (!picked) return 1;
-        projectName = picked.name;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+      let resolvedProjectName = projectName;
+      if (projectName.startsWith("@")) {
+        const parsed = parseAlias(projectName);
+        if (parsed) {
+          resolvedProjectName = parsed.project;
+        } else {
+          resolvedProjectName = projectName.slice(1).split(".")[0] ?? projectName;
+        }
       }
-    }
-    const projectId2 = await resolveProjectId(client, projectName);
-    const data = await client.request(`/v1/projects/${projectId2}/secrets`);
-    if (this.json) {
-      this.context.stdout.write(`${JSON.stringify(data, null, 2)}
+      const projectId2 = await resolveProjectId(client, resolvedProjectName);
+      const data = await client.request(`/v1/projects/${projectId2}/secrets`);
+      if (this.json) {
+        this.context.stdout.write(`${JSON.stringify(data, null, 2)}
 `);
+        return 0;
+      }
+      if (data.secrets.length === 0) {
+        this.context.stdout.write("no secrets\n");
+        return 0;
+      }
+      this.context.stdout.write(
+        `${table(
+          ["alias", "version", "created_at"],
+          data.secrets.map((s) => [s.alias, String(s.version), s.created_at])
+        )}
+`
+      );
       return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
     }
-    if (data.secrets.length === 0) {
-      this.context.stdout.write("no secrets\n");
-      return 0;
-    }
-    this.context.stdout.write(
-      `${table(
-        ["alias", "version", "created_at"],
-        data.secrets.map((s) => [s.alias, String(s.version), s.created_at])
-      )}
-`
-    );
-    return 0;
   }
 };
 var SecretRotateCommand = class extends Command {
@@ -46232,46 +46617,50 @@ var SecretRotateCommand = class extends Command {
   value = options_exports.String("--value");
   stdin = options_exports.Boolean("--stdin", false);
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        alias2 = await pickAliasInteractive(client) ?? void 0;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          alias2 = await pickAliasInteractive(client) ?? void 0;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
+        if (!alias2) return 1;
       }
-      if (!alias2) return 1;
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    let value;
-    if (this.stdin) {
-      const chunks = [];
-      for await (const chunk of this.context.stdin) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        return 1;
       }
-      value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
-    } else if (this.value !== void 0) {
-      value = this.value;
-    } else {
-      value = await promptHidden("new value: ");
-    }
-    const projectId2 = await resolveProjectId(client, parsed.project);
-    const data = await client.request(
-      `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}/rotate`,
-      { method: "POST", body: { new_value: value } }
-    );
-    this.context.stdout.write(`rotated ${data.alias} \u2192 v${data.version}
+      let value;
+      if (this.stdin) {
+        const chunks = [];
+        for await (const chunk of this.context.stdin) {
+          chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        }
+        value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
+      } else if (this.value !== void 0) {
+        value = this.value;
+      } else {
+        value = await promptHidden("new value: ");
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      const data = await client.request(
+        `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}/rotate`,
+        { method: "POST", body: { new_value: value } }
+      );
+      this.context.stdout.write(`rotated ${data.alias} \u2192 v${data.version}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 var SecretDeleteCommand = class extends Command {
@@ -46279,33 +46668,40 @@ var SecretDeleteCommand = class extends Command {
   static usage = Command.Usage({ description: "Soft-delete a secret." });
   alias = options_exports.String({ required: false });
   async execute() {
-    const client = new ApiClient();
-    await client.ensureHydrated();
-    let alias2 = this.alias;
-    if (!alias2) {
-      if (!isInteractive()) return missingAlias(this.context.stderr);
-      try {
-        alias2 = await pickAliasInteractive(client) ?? void 0;
-      } catch (err) {
-        if (err instanceof UserCancelled) return 130;
-        throw err;
+    try {
+      const client = new ApiClient();
+      await client.ensureHydrated();
+      let alias2 = this.alias;
+      if (!alias2) {
+        if (!isInteractive()) return missingAlias(this.context.stderr);
+        try {
+          alias2 = await pickAliasInteractive(client) ?? void 0;
+        } catch (err) {
+          if (err instanceof UserCancelled) return 130;
+          throw err;
+        }
+        if (!alias2) return 1;
       }
-      if (!alias2) return 1;
-    }
-    const parsed = parseAlias(alias2);
-    if (!parsed) {
-      this.context.stderr.write(`keynv: invalid alias '${alias2}'.
+      const parsed = parseAlias(alias2);
+      if (!parsed) {
+        this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
 `);
-      return 1;
-    }
-    const projectId2 = await resolveProjectId(client, parsed.project);
-    await client.request(`/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`, {
-      method: "DELETE"
-    });
-    this.context.stdout.write(`deleted ${parsed.literal}
+        return 1;
+      }
+      const projectId2 = await resolveProjectId(client, parsed.project);
+      await client.request(
+        `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`,
+        {
+          method: "DELETE"
+        }
+      );
+      this.context.stdout.write(`deleted ${parsed.literal}
 `);
-    return 0;
+      return 0;
+    } catch (err) {
+      return handleExecError(this.context.stderr, err);
+    }
   }
 };
 function generateSecret(bytes = 32) {
@@ -46367,8 +46763,8 @@ Non-interactive with --yes to skip prompts.
       "# KEYNV_ARGON2_MEMORY_KIB=46080",
       "# KEYNV_ARGON2_TIME_COST=3"
     ].join("\n");
-    const { writeFileSync: writeFileSync4 } = await import('fs');
-    writeFileSync4(outPath, `${contents}
+    const { writeFileSync: writeFileSync5 } = await import('fs');
+    writeFileSync5(outPath, `${contents}
 `);
     this.context.stdout.write(`Wrote ${outPath}
 
@@ -46434,7 +46830,7 @@ services:
 volumes:
   keynv-data:
 `;
-      writeFileSync4("docker-compose.yml", composeContent);
+      writeFileSync5("docker-compose.yml", composeContent);
       this.context.stdout.write(
         "\nWrote docker-compose.yml (update Litestream S3 config before deploying).\n"
       );
@@ -46670,7 +47066,7 @@ var sshTester = {
   async test(secret, target) {
     const start = Date.now();
     const { Client: Client2 } = await import('ssh2');
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       const client = new Client2();
       let settled = false;
       const settle = (result) => {
@@ -46681,7 +47077,7 @@ var sshTester = {
           client.end();
         } catch {
         }
-        resolve3(result);
+        resolve4(result);
       };
       client.once("ready", () => {
         client.exec("true", (err, stream) => {
@@ -46747,12 +47143,12 @@ function sanitizeResult(result, secret) {
 
 // ../../packages/testers/dist/run.js
 function withTimeout(promise, ms) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const t = setTimeout(() => reject(new Error(`tester timed out after ${ms}ms`)), ms);
     t.unref();
     promise.then((v2) => {
       clearTimeout(t);
-      resolve3(v2);
+      resolve4(v2);
     }, (err) => {
       clearTimeout(t);
       reject(err);