@keynv/cli 0.1.0-rc.13 → 0.1.0-rc.15

package/dist/index.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { randomBytes } from 'crypto';
-import { readFileSync, existsSync, statSync, writeFileSync, unlinkSync, mkdirSync, rmSync, readdirSync } from 'fs';
+import { createHash, randomBytes } from 'crypto';
+import { readFileSync, writeFileSync, unlinkSync, existsSync, statSync, readdirSync, mkdirSync, rmSync, lstatSync } from 'fs';
 import { hostname, platform, homedir } from 'os';
-import { relative, isAbsolute, resolve, join, dirname, basename } from 'path';
+import * as nodePath from 'path';
+import { relative, join, isAbsolute, resolve, dirname, basename } from 'path';
 import { Entry } from '@napi-rs/keyring';
-import { styleText } from 'util';
+import { styleText, stripVTControlCharacters } from 'util';
 import j2, { stdin, stdout } from 'process';
 import * as b from 'readline';
 import b__default, { createInterface } from 'readline';
@@ -19,11 +20,11 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+var __require = /* @__PURE__ */ ((x2) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x2, {
   get: (a, b2) => (typeof require !== "undefined" ? require : a)[b2]
-}) : x)(function(x) {
+}) : x2)(function(x2) {
   if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
+  throw Error('Dynamic require of "' + x2 + '" is not supported');
 });
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
@@ -301,16 +302,16 @@ var require_lib = __commonJS({
         }
       });
     }
-    function isArray(spec, { delimiter } = {}) {
+    function isArray(spec, { delimiter: delimiter2 } = {}) {
       return makeValidator({
         test: (value, state) => {
           var _a;
           const originalValue = value;
-          if (typeof value === `string` && typeof delimiter !== `undefined`) {
+          if (typeof value === `string` && typeof delimiter2 !== `undefined`) {
             if (typeof (state === null || state === void 0 ? void 0 : state.coercions) !== `undefined`) {
               if (typeof (state === null || state === void 0 ? void 0 : state.coercion) === `undefined`)
                 return pushError(state, `Unbound coercion result`);
-              value = value.split(delimiter);
+              value = value.split(delimiter2);
             }
           }
           if (!Array.isArray(value))
@@ -328,8 +329,8 @@ var require_lib = __commonJS({
         }
       });
     }
-    function isSet(spec, { delimiter } = {}) {
-      const isArrayValidator = isArray(spec, { delimiter });
+    function isSet(spec, { delimiter: delimiter2 } = {}) {
+      const isArrayValidator = isArray(spec, { delimiter: delimiter2 });
       return makeValidator({
         test: (value, state) => {
           var _a, _b;
@@ -420,16 +421,16 @@ var require_lib = __commonJS({
         }
       });
     }
-    function isTuple(spec, { delimiter } = {}) {
+    function isTuple(spec, { delimiter: delimiter2 } = {}) {
       const lengthValidator = hasExactLength(spec.length);
       return makeValidator({
         test: (value, state) => {
           var _a;
-          if (typeof value === `string` && typeof delimiter !== `undefined`) {
+          if (typeof value === `string` && typeof delimiter2 !== `undefined`) {
             if (typeof (state === null || state === void 0 ? void 0 : state.coercions) !== `undefined`) {
               if (typeof (state === null || state === void 0 ? void 0 : state.coercion) === `undefined`)
                 return pushError(state, `Unbound coercion result`);
-              value = value.split(delimiter);
+              value = value.split(delimiter2);
               state.coercions.push([(_a = state.p) !== null && _a !== void 0 ? _a : `.`, state.coercion.bind(null, value)]);
             }
           }
@@ -1056,14 +1057,20 @@ var require_lib = __commonJS({
 var VERSION, AGENT;
 var init_version = __esm({
   "src/version.ts"() {
-    VERSION = "0.1.0-rc.13" ;
+    VERSION = "0.1.0-rc.15" ;
     AGENT = `keynv-cli/${VERSION}`;
   }
 });
 
 // ../../packages/core/dist/reference/types.js
+var ALIAS_LIMITS;
 var init_types = __esm({
   "../../packages/core/dist/reference/types.js"() {
+    ALIAS_LIMITS = {
+      project: { min: 1, max: 48 },
+      environment: { min: 1, max: 24 },
+      key: { min: 1, max: 64 }
+    };
   }
 });
 
@@ -1095,10 +1102,10 @@ function parseAlias(input) {
 function findAliases(text, opts = {}) {
   if (typeof text !== "string" || text.length === 0)
     return [];
-  const re = opts.mode === "argv" ? ARGV_FIND_RE : TEXT_FIND_RE;
-  re.lastIndex = 0;
+  const re2 = opts.mode === "argv" ? ARGV_FIND_RE : TEXT_FIND_RE;
+  re2.lastIndex = 0;
   const matches = [];
-  for (const m of text.matchAll(re)) {
+  for (const m of text.matchAll(re2)) {
     const literal = m[0];
     const start = m.index;
     if (start === void 0)
@@ -1127,6 +1134,25 @@ function findAliasesInArgv(argv2) {
   }
   return result;
 }
+function replaceAliases(text, resolve4, opts = {}) {
+  if (typeof text !== "string" || text.length === 0)
+    return text;
+  const matches = findAliases(text, opts);
+  if (matches.length === 0)
+    return text;
+  let out = text;
+  for (let i = matches.length - 1; i >= 0; i--) {
+    const m = matches[i];
+    if (!m)
+      continue;
+    const replacement = resolve4(m);
+    if (replacement.startsWith("@") && PROJECT_RE.test(replacement.slice(1).split(".")[0] ?? "")) {
+      throw new Error(`replaceAliases: resolved value for ${m.literal} looks like an alias (${replacement}). Circular or misconfigured resolution detected.`);
+    }
+    out = out.slice(0, m.start) + replacement + out.slice(m.end);
+  }
+  return out;
+}
 function buildAlias(parts) {
   if (!PROJECT_RE.test(parts.project))
     return null;
@@ -1156,6 +1182,15 @@ var init_parser = __esm({
 });
 
 // ../../packages/core/dist/reference/index.js
+var reference_exports = {};
+__export(reference_exports, {
+  ALIAS_LIMITS: () => ALIAS_LIMITS,
+  buildAlias: () => buildAlias,
+  findAliases: () => findAliases,
+  findAliasesInArgv: () => findAliasesInArgv,
+  parseAlias: () => parseAlias,
+  replaceAliases: () => replaceAliases
+});
 var init_reference = __esm({
   "../../packages/core/dist/reference/index.js"() {
     init_types();
@@ -1672,7 +1707,7 @@ function addIssueToContext(ctx, issueData) {
       // then global override map
       overrideMap === en_default ? void 0 : en_default
       // then global default map
-    ].filter((x) => !!x)
+    ].filter((x2) => !!x2)
   });
   ctx.common.issues.push(issue);
 }
@@ -1766,10 +1801,10 @@ var init_parseUtil = __esm({
     });
     DIRTY = (value) => ({ status: "dirty", value });
     OK = (value) => ({ status: "valid", value });
-    isAborted = (x) => x.status === "aborted";
-    isDirty = (x) => x.status === "dirty";
-    isValid = (x) => x.status === "valid";
-    isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
+    isAborted = (x2) => x2.status === "aborted";
+    isDirty = (x2) => x2.status === "dirty";
+    isValid = (x2) => x2.status === "valid";
+    isAsync = (x2) => typeof Promise !== "undefined" && x2 instanceof Promise;
   }
 });
 
@@ -4269,7 +4304,7 @@ var init_types4 = __esm({
           if (!schema)
             return null;
           return schema._parse(new ParseInputLazyPath(ctx, item, ctx.path, itemIndex));
-        }).filter((x) => !!x);
+        }).filter((x2) => !!x2);
         if (ctx.common.async) {
           return Promise.all(items).then((results) => {
             return ParseStatus.mergeArray(status, results);
@@ -4522,7 +4557,7 @@ var init_types4 = __esm({
           return makeIssue({
             data: args,
             path: ctx.path,
-            errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), en_default].filter((x) => !!x),
+            errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), en_default].filter((x2) => !!x2),
             issueData: {
               code: ZodIssueCode.invalid_arguments,
               argumentsError: error
@@ -4533,7 +4568,7 @@ var init_types4 = __esm({
           return makeIssue({
             data: returns,
             path: ctx.path,
-            errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), en_default].filter((x) => !!x),
+            errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), en_default].filter((x2) => !!x2),
             issueData: {
               code: ZodIssueCode.invalid_return_type,
               returnTypeError: error
@@ -5388,7 +5423,7 @@ var init_payload_schemas = __esm({
     role = external_exports.enum(["lead", "developer", "reader"]);
     orgRole = external_exports.enum(["owner", "admin", "developer", "reader"]);
     email = external_exports.string().email();
-    version = external_exports.number().int().positive();
+    version = external_exports.coerce.number().int().positive();
     empty = external_exports.object({}).strict();
     orgId = external_exports.string().min(1);
     ({
@@ -5436,10 +5471,12 @@ var init_payload_schemas = __esm({
       }).strict(),
       "secret.deleted": external_exports.object({ project_id: projectId, env, key }).strict(),
       "secret.test.invoked": external_exports.object({ alias, tester: external_exports.string(), ok: external_exports.boolean(), latency_ms: external_exports.number() }).strict(),
+      "secret.test.denied": external_exports.object({ alias }).strict(),
       "approval.requested": external_exports.object({ alias }).strict(),
       "approval.granted": external_exports.object({ alias, granted_by: userId }).strict(),
       "approval.denied": external_exports.object({ alias, denied_by: userId }).strict(),
-      "kek.rotated": empty
+      "org.created": external_exports.object({ org_id: orgId, name: external_exports.string().min(1) }).strict(),
+      "org.updated": external_exports.object({ org_id: orgId, name: external_exports.string().min(1) }).strict()
     });
   }
 });
@@ -5471,15 +5508,16 @@ function entry() {
   return new Entry(SERVICE, KEY_ACCOUNT);
 }
 async function loadOrCreateKey() {
+  if (process.env["KEYNV_DISABLE_KEYCHAIN"] === "1") {
+    return loadOrCreateFileKey();
+  }
   const e2 = entry();
   let stored;
   try {
     stored = e2.getPassword();
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    throw new Error(
-      `keynv: OS keychain unavailable (${message}). Install libsecret on Linux, or set KEYNV_DISABLE_KEYCHAIN=1 to use a (less secure) file-based key store.`
-    );
+  } catch {
+    const message = process.env["KEYNV_DISABLE_KEYCHAIN"] ? "keynv: OS keychain unavailable. Set KEYNV_DISABLE_KEYCHAIN=1 to use a file-based key store (less secure)." : "keynv: OS keychain unavailable. Install libsecret on Linux, or set KEYNV_DISABLE_KEYCHAIN=1 to use a file-based key store (less secure).";
+    throw new Error(message);
   }
   if (stored) {
     return new Uint8Array(Buffer.from(stored, "base64"));
@@ -5494,6 +5532,20 @@ async function loadOrCreateKey() {
   }
   return fresh;
 }
+function fileKeyPath() {
+  return process.env["KEYNV_CREDENTIALS_KEY_FILE"] ?? join(homedir(), ".keynv", ".credentials-key");
+}
+async function loadOrCreateFileKey() {
+  const path = fileKeyPath();
+  if (existsSync(path)) {
+    const raw = readFileSync(path, "utf8").trim();
+    return new Uint8Array(Buffer.from(raw, "base64"));
+  }
+  const fresh = await crypto_exports.generateKey();
+  if (!existsSync(dirname(path))) mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, Buffer.from(fresh).toString("base64"), { mode: 384 });
+  return fresh;
+}
 async function saveCredentialsBlob(plaintext) {
   const key2 = await loadOrCreateKey();
   const sealed = await crypto_exports.encryptSecret(Buffer.from(plaintext).toString("utf8"), key2);
@@ -5534,6 +5586,11 @@ function clearCredentialsFile() {
   if (existsSync(path)) rmSync(path, { force: true });
   const legacy = legacyPath();
   if (existsSync(legacy)) rmSync(legacy, { force: true });
+  if (process.env["KEYNV_DISABLE_KEYCHAIN"] === "1") {
+    const keyPath = fileKeyPath();
+    if (existsSync(keyPath)) rmSync(keyPath, { force: true });
+    return true;
+  }
   try {
     entry().deletePassword();
     return true;
@@ -5656,7 +5713,16 @@ var init_http = __esm({
         return this.creds;
       }
       async ensureHydrated() {
-        if (this.hydrated) await this.hydrated;
+        if (this.hydrated) {
+          try {
+            await this.hydrated;
+          } catch (err) {
+            process.stderr.write(
+              `${err instanceof Error ? err.message : `keynv: credential load failed \u2014 ${String(err)}`}
+`
+            );
+          }
+        }
       }
       async setCredentials(creds) {
         this.creds = creds;
@@ -5678,21 +5744,40 @@ var init_http = __esm({
           headers.authorization = `Bearer ${this.creds.access_token}`;
         }
         const url = this.creds ? buildUrl(this.creds.server_url, path, opts.query) : path;
-        let res = await fetch(url, {
-          method: opts.method ?? "GET",
-          headers,
-          ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
-        });
+        let res;
+        try {
+          res = await fetch(url, {
+            method: opts.method ?? "GET",
+            headers,
+            ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
+          });
+        } catch (err) {
+          const cause = err instanceof Error ? err.message : String(err);
+          const serverUrl = this.creds?.server_url ?? url;
+          throw new Error(
+            `keynv: cannot reach server '${serverUrl}' \u2014 ${cause}
+       Check the server is running: curl ${serverUrl}/v1/health`
+          );
+        }
         if (res.status === 401 && this.creds && opts.authed !== false) {
           const refreshed = await tryRefresh(this.creds);
           if (refreshed) {
             this.creds = refreshed;
             headers.authorization = `Bearer ${refreshed.access_token}`;
-            res = await fetch(url, {
-              method: opts.method ?? "GET",
-              headers,
-              ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
-            });
+            try {
+              res = await fetch(url, {
+                method: opts.method ?? "GET",
+                headers,
+                ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
+              });
+            } catch (err) {
+              const cause = err instanceof Error ? err.message : String(err);
+              const serverUrl = this.creds?.server_url ?? url;
+              throw new Error(
+                `keynv: cannot reach server '${serverUrl}' \u2014 ${cause}
+       Check the server is running: curl ${serverUrl}/v1/health`
+              );
+            }
           }
         }
         if (res.status === 204) return void 0;
@@ -5740,8 +5825,7 @@ function handleExecError(stderr, err) {
     stderr.write(`keynv: ${err.message}
 `);
   } else {
-    stderr.write(`keynv: unexpected error
-`);
+    stderr.write("keynv: unexpected error\n");
   }
   return 1;
 }
@@ -5816,7 +5900,7 @@ function parseEnvFile(content, filename) {
     entries.push({
       name,
       value,
-      isAlias: parseAlias(value) !== null,
+      isAlias: reference_exports.parseAlias(value) !== null,
       line: lineNo
     });
   }
@@ -5891,6 +5975,210 @@ var init_envFile = __esm({
     };
   }
 });
+function aiContextBody() {
+  return `## keynv (secrets)
+
+This project uses [keynv](https://keynv.dev) for secrets. There is a \`.keynv.env\` file at the project root containing **alias references** like \`OPENAI_API_KEY=@projectname.dev.openai-key\` \u2014 these are NOT real values, they are references to secrets stored in the keynv vault.
+
+### Mental model
+
+- **\`.keynv.env\`** \u2014 checked into git, contains aliases. Safe to read, edit, commit.
+- **Vault** \u2014 holds the real values. The \`keynv\` CLI reads it on demand.
+- **\`keynv exec -- <command>\`** \u2014 forks the command in a subprocess where the real values are injected into env vars. The parent process (where you, the AI agent, run) NEVER sees the real values.
+- **Redactor** \u2014 pipes subprocess stdout/stderr through a masker before they reach this terminal. Even if a script accidentally echoes a secret, you see \`<REDACTED:...>\` here.
+
+### What you should do
+
+When the user asks about secrets or env vars, follow this decision tree:
+
+| User intent | Run / suggest |
+|---|---|
+| "Add a new API key" / "set up a secret" | \`keynv secret create\` (interactive prompt picks project + env + key) |
+| "I have a \`.env\`, migrate it" | \`keynv init\` (you're seeing this file because that already happened) |
+| "Run the app / dev server / tests" | \`keynv exec -- <their existing command>\` (auto-loads \`.keynv.env\`) |
+| "Show me the value of X" | \`keynv secret get @alias\` \u2014 but copy to clipboard, do NOT print the value into chat / terminal |
+| "Rotate this key" | \`keynv secret rotate @alias\` |
+| "Add a new env var to the project" | Edit \`.keynv.env\` and add \`NAME=@project.env.key\` (after creating the secret with \`keynv secret create\`) |
+| "Who has access?" | \`keynv member list <project>\` |
+
+### Hard rules \u2014 do not violate
+
+1. **Never print resolved secret values** to the chat, terminal, log, or any file. The user's editor / scrollback / chat history is an attack surface.
+2. **Never write a \`.env\` file** (or any file) containing real secret values. The whole point of keynv is that those don't exist on disk.
+3. **Never edit \`.keynv.env\` to substitute resolved values for aliases.** The file should only ever contain \`@project.env.key\` references and plain non-secret literals.
+4. **Use \`keynv exec --\` to run commands that need env vars.** Don't try to load \`.keynv.env\` yourself by parsing it manually; the wrapper handles resolution + redaction + subprocess isolation.
+5. **If a tool fails with "blocked by keynv-guard" or similar**, do NOT try to work around it. Tell the user \u2014 that's a sign of a misconfiguration, not an obstacle to bypass.
+6. **Treat the alias literal (\`@project.env.key\`) as the canonical reference**, never the resolved value. When you write code, configs, or commands that need a secret, write the alias.
+
+### Quick reference
+
+\`\`\`bash
+keynv                       # interactive TUI menu (pick projects, secrets, members)
+keynv exec -- <cmd>         # run cmd with .keynv.env loaded
+keynv secret create         # walk through creating a new secret
+keynv secret list <project> # list aliases (no values)
+keynv whoami                # who am I logged in as
+keynv --help                # full command list
+\`\`\`
+
+If \`.keynv.env\` is missing or empty, the user probably hasn't run \`keynv init\` yet \u2014 suggest they do so before they paste a secret into a \`.env\`.`;
+}
+function renderKeynvBlock() {
+  return `${KEYNV_BLOCK_START}
+${aiContextBody()}
+${KEYNV_BLOCK_END}`;
+}
+function writeAiContext(rootPath) {
+  const path = join(rootPath, AGENTS_FILE_BASENAME);
+  const block = renderKeynvBlock();
+  if (!existsSync(path)) {
+    const initial = `# Agent guidance for this project
+
+${block}
+`;
+    writeFileSync(path, initial);
+    return "created";
+  }
+  const existing = readFileSync(path, "utf8");
+  const startIdx = existing.indexOf(KEYNV_BLOCK_START);
+  const endIdx = existing.indexOf(KEYNV_BLOCK_END);
+  if (startIdx >= 0 && endIdx > startIdx) {
+    const before = existing.slice(0, startIdx);
+    const after = existing.slice(endIdx + KEYNV_BLOCK_END.length);
+    const next = `${before}${block}${after}`;
+    if (next === existing) return "unchanged";
+    writeFileSync(path, next);
+    return "updated";
+  }
+  const sep = existing.length === 0 ? "" : existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+  const trailingNewline = existing.endsWith("\n") ? "" : "\n";
+  writeFileSync(path, `${existing}${trailingNewline}${sep}${block}
+`);
+  return "appended";
+}
+var AGENTS_FILE_BASENAME, KEYNV_BLOCK_START, KEYNV_BLOCK_END;
+var init_ai_context = __esm({
+  "src/init/ai-context.ts"() {
+    AGENTS_FILE_BASENAME = "AGENTS.md";
+    KEYNV_BLOCK_START = "<!-- keynv:start -- generated by `keynv init`; safe to leave intact, will be refreshed on re-run -->";
+    KEYNV_BLOCK_END = "<!-- keynv:end -->";
+  }
+});
+function findProjectRoot(startDir) {
+  const result = walkUp(startDir, (dir) => {
+    for (const marker of PROJECT_MARKERS) {
+      if (existsSync(join(dir, marker))) {
+        return { dir, marker };
+      }
+    }
+    if (existsSync(join(dir, GIT_MARKER))) {
+      return { dir, marker: GIT_MARKER };
+    }
+    return null;
+  });
+  if (!result) return null;
+  return buildRoot(result.dir, result.marker);
+}
+function buildRoot(dir, marker) {
+  let suggestedName = basename(dir);
+  let scripts = null;
+  let invalid = false;
+  if (marker === "package.json" || existsSync(join(dir, "package.json"))) {
+    try {
+      const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+      if (typeof pkg.name === "string" && pkg.name.length > 0) {
+        suggestedName = pkg.name.replace(/^@[^/]+\//, "");
+      }
+      if (pkg.scripts && typeof pkg.scripts === "object") {
+        scripts = Object.fromEntries(
+          Object.entries(pkg.scripts).filter(([, v2]) => typeof v2 === "string")
+        );
+      }
+    } catch {
+      invalid = true;
+    }
+  }
+  return {
+    path: dir,
+    suggestedName,
+    marker,
+    packageJsonScripts: scripts,
+    packageJsonInvalid: invalid
+  };
+}
+function findEnvFiles(rootDir) {
+  let entries;
+  try {
+    entries = readdirSync(rootDir);
+  } catch {
+    return [];
+  }
+  const hits = [];
+  for (const name of entries) {
+    if (!ENV_GLOB.test(name)) continue;
+    if (ENV_EXAMPLE.test(name)) continue;
+    if (name === KEYNV_ENV_BASENAME) continue;
+    const full = join(rootDir, name);
+    try {
+      if (!statSync(full).isFile()) continue;
+    } catch {
+      continue;
+    }
+    const suffixMatch = name.match(/^\.env\.(.+)$/);
+    const suffix = suffixMatch ? suffixMatch[1] : null;
+    hits.push({ path: full, name, suffix, suggestedEnv: suggestedEnvForSuffix(suffix) });
+  }
+  hits.sort((a, b2) => {
+    if (a.suffix === null) return -1;
+    if (b2.suffix === null) return 1;
+    return a.name.localeCompare(b2.name);
+  });
+  return hits;
+}
+function suggestedEnvForSuffix(suffix) {
+  if (suffix === null) return "dev";
+  switch (suffix) {
+    case "local":
+    case "development":
+    case "dev":
+      return "dev";
+    case "production":
+    case "prod":
+      return "prod";
+    case "staging":
+    case "stage":
+      return "staging";
+    case "test":
+      return "test";
+    case "preview":
+      return "preview";
+    default:
+      return suffix;
+  }
+}
+function hasExistingKeynvEnv(rootDir) {
+  return existsSync(join(rootDir, KEYNV_ENV_BASENAME));
+}
+var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME;
+var init_detect = __esm({
+  "src/init/detect.ts"() {
+    init_fs();
+    PROJECT_MARKERS = [
+      "package.json",
+      "pyproject.toml",
+      "Cargo.toml",
+      "go.mod",
+      "pnpm-workspace.yaml",
+      "deno.json",
+      "deno.jsonc",
+      "requirements.txt"
+    ];
+    GIT_MARKER = ".git";
+    ENV_GLOB = /^\.env(\.[A-Za-z0-9_-]+)?$/;
+    ENV_EXAMPLE = /^\.env\.(example|sample|template|dist|defaults)$/;
+    KEYNV_ENV_BASENAME = ".keynv.env";
+  }
+});
 
 // src/init/heuristics.ts
 function shannonEntropyBits(s) {
@@ -5931,8 +6219,8 @@ function classifyEntry(name, value) {
   if (value.length === 0) {
     return { verdict: "literal", hint: "empty" };
   }
-  for (const { re, hint } of VALUE_PATTERNS) {
-    if (re.test(value)) return { verdict: "secret", hint };
+  for (const { re: re2, hint } of VALUE_PATTERNS) {
+    if (re2.test(value)) return { verdict: "secret", hint };
   }
   const suffix = nameMatchesSecretSuffix(name);
   if (suffix.matched) {
@@ -6033,11 +6321,11 @@ var init_utils = __esm({
         return input.length - surrogatePairsNr;
       };
     })();
-    isFullWidth = (x) => {
-      return x === 12288 || x >= 65281 && x <= 65376 || x >= 65504 && x <= 65510;
+    isFullWidth = (x2) => {
+      return x2 === 12288 || x2 >= 65281 && x2 <= 65376 || x2 >= 65504 && x2 <= 65510;
     };
-    isWideNotCJKTNotEmoji = (x) => {
-      return x === 8987 || x === 9001 || x >= 12272 && x <= 12287 || x >= 12289 && x <= 12350 || x >= 12441 && x <= 12543 || x >= 12549 && x <= 12591 || x >= 12593 && x <= 12686 || x >= 12688 && x <= 12771 || x >= 12783 && x <= 12830 || x >= 12832 && x <= 12871 || x >= 12880 && x <= 19903 || x >= 65040 && x <= 65049 || x >= 65072 && x <= 65106 || x >= 65108 && x <= 65126 || x >= 65128 && x <= 65131 || x >= 127488 && x <= 127490 || x >= 127504 && x <= 127547 || x >= 127552 && x <= 127560 || x >= 131072 && x <= 196605 || x >= 196608 && x <= 262141;
+    isWideNotCJKTNotEmoji = (x2) => {
+      return x2 === 8987 || x2 === 9001 || x2 >= 12272 && x2 <= 12287 || x2 >= 12289 && x2 <= 12350 || x2 >= 12441 && x2 <= 12543 || x2 >= 12549 && x2 <= 12591 || x2 >= 12593 && x2 <= 12686 || x2 >= 12688 && x2 <= 12771 || x2 >= 12783 && x2 <= 12830 || x2 >= 12832 && x2 <= 12871 || x2 >= 12880 && x2 <= 19903 || x2 >= 65040 && x2 <= 65049 || x2 >= 65072 && x2 <= 65106 || x2 >= 65108 && x2 <= 65126 || x2 >= 65128 && x2 <= 65131 || x2 >= 127488 && x2 <= 127490 || x2 >= 127504 && x2 <= 127547 || x2 >= 127552 && x2 <= 127560 || x2 >= 131072 && x2 <= 196605 || x2 >= 196608 && x2 <= 262141;
     };
   }
 });
@@ -6384,14 +6672,14 @@ var require_src = __commonJS({
     var CSI2 = `${ESC2}[`;
     var beep = "\x07";
     var cursor = {
-      to(x, y) {
-        if (!y) return `${CSI2}${x + 1}G`;
-        return `${CSI2}${y + 1};${x + 1}H`;
+      to(x2, y) {
+        if (!y) return `${CSI2}${x2 + 1}G`;
+        return `${CSI2}${y + 1};${x2 + 1}H`;
       },
-      move(x, y) {
+      move(x2, y) {
         let ret = "";
-        if (x < 0) ret += `${CSI2}${-x}D`;
-        else if (x > 0) ret += `${CSI2}${x}C`;
+        if (x2 < 0) ret += `${CSI2}${-x2}D`;
+        else if (x2 > 0) ret += `${CSI2}${x2}C`;
         if (y < 0) ret += `${CSI2}${-y}A`;
         else if (y > 0) ret += `${CSI2}${y}B`;
         return ret;
@@ -6436,6 +6724,39 @@ function d(r, t, s) {
   const e2 = r + t, i = Math.max(s.length - 1, 0), n = e2 < 0 ? i : e2 > i ? 0 : e2;
   return s[n].disabled ? d(n, t < 0 ? -1 : 1, s) : n;
 }
+function I(r, t, s, e2) {
+  const i = e2.split(`
+`);
+  let n = 0, o = r;
+  for (const a of i) {
+    if (o <= a.length) break;
+    o -= a.length + 1, n++;
+  }
+  for (n = Math.max(0, Math.min(i.length - 1, n + s)), o = Math.min(o, i[n].length) + t; o < 0 && n > 0; ) n--, o += i[n].length + 1;
+  for (; o > i[n].length && n < i.length - 1; ) o -= i[n].length + 1, n++;
+  o = Math.max(0, Math.min(i[n].length, o));
+  let u = 0;
+  for (let a = 0; a < n; a++) u += i[a].length + 1;
+  return u + o;
+}
+function j(r) {
+  if (r.aliases !== void 0) {
+    const t = r.aliases;
+    for (const s in t) {
+      if (!Object.hasOwn(t, s)) continue;
+      const e2 = t[s];
+      h.actions.has(e2) && (h.aliases.has(s) || h.aliases.set(s, e2));
+    }
+  }
+  if (r.messages !== void 0) {
+    const t = r.messages;
+    t.cancel !== void 0 && (h.messages.cancel = t.cancel), t.error !== void 0 && (h.messages.error = t.error);
+  }
+  if (r.withGuide !== void 0 && (h.withGuide = r.withGuide !== false), r.date !== void 0) {
+    const t = r.date;
+    t.monthNames !== void 0 && (h.date.monthNames = [...t.monthNames]), t.messages !== void 0 && (t.messages.required !== void 0 && (h.date.messages.required = t.messages.required), t.messages.invalidMonth !== void 0 && (h.date.messages.invalidMonth = t.messages.invalidMonth), t.messages.invalidDay !== void 0 && (h.date.messages.invalidDay = t.messages.invalidDay), t.messages.afterMin !== void 0 && (h.date.messages.afterMin = t.messages.afterMin), t.messages.beforeMax !== void 0 && (h.date.messages.beforeMax = t.messages.beforeMax));
+  }
+}
 function C(r, t) {
   if (typeof r == "string") return h.aliases.get(r) === t;
   for (const s of r) if (s !== void 0 && C(s, t)) return true;
@@ -6481,12 +6802,55 @@ function W(r, t, s, e2 = s, i) {
   const n = A(r ?? stdout);
   return wrapAnsi(t, n - s.length, { hard: true, trim: false }).split(`
 `).map((o, u) => {
-    const a = o;
+    const a = i ? i(o, u) : o;
     return `${u === 0 ? e2 : s}${a}`;
   }).join(`
 `);
 }
-var import_sisteransi, G, K, h, Y, k, A, L, p, X, nt, ot, ut, ht;
+function B(r, t) {
+  if (r === void 0 || t.length === 0) return 0;
+  const s = t.findIndex((e2) => e2.value === r);
+  return s !== -1 ? s : 0;
+}
+function J(r, t) {
+  return (t.label ?? String(t.value)).toLowerCase().includes(r.toLowerCase());
+}
+function H(r, t) {
+  if (t) return r ? t : t[0];
+}
+function P(r) {
+  return [...r].map((t) => Z[t]);
+}
+function tt(r) {
+  const t = new Intl.DateTimeFormat(r, { year: "numeric", month: "2-digit", day: "2-digit" }).formatToParts(new Date(2e3, 0, 15)), s = [];
+  let e2 = "/";
+  for (const i of t) i.type === "literal" ? e2 = i.value.trim() || i.value : (i.type === "year" || i.type === "month" || i.type === "day") && s.push({ type: i.type, len: i.type === "year" ? 4 : 2 });
+  return { segments: s, separator: e2 };
+}
+function U(r) {
+  return Number.parseInt((r || "0").replace(/_/g, "0"), 10) || 0;
+}
+function x(r) {
+  return { year: U(r.year), month: U(r.month), day: U(r.day) };
+}
+function $(r, t) {
+  return new Date(r || 2001, t || 1, 0).getDate();
+}
+function F(r) {
+  const { year: t, month: s, day: e2 } = x(r);
+  if (!t || t < 0 || t > 9999 || !s || s < 1 || s > 12 || !e2 || e2 < 1) return;
+  const i = new Date(Date.UTC(t, s - 1, e2));
+  if (!(i.getUTCFullYear() !== t || i.getUTCMonth() !== s - 1 || i.getUTCDate() !== e2)) return { year: t, month: s, day: e2 };
+}
+function N(r) {
+  const t = F(r);
+  return t ? new Date(Date.UTC(t.year, t.month - 1, t.day)) : void 0;
+}
+function st(r, t, s, e2) {
+  const i = s ? { year: s.getUTCFullYear(), month: s.getUTCMonth() + 1, day: s.getUTCDate() } : null, n = e2 ? { year: e2.getUTCFullYear(), month: e2.getUTCMonth() + 1, day: e2.getUTCDate() } : null;
+  return r === "year" ? { min: i?.year ?? 1, max: n?.year ?? 9999 } : r === "month" ? { min: i && t.year === i.year ? i.month : 1, max: n && t.year === n.year ? n.month : 12 } : { min: i && t.year === i.year && t.month === i.month ? i.day : 1, max: n && t.year === n.year && t.month === n.month ? n.day : $(t.year, t.month) };
+}
+var import_sisteransi, G, K, h, Y, k, A, L, p, Q, X, Z, et, it, rt, nt, ot, ut, at, ht;
 var init_dist4 = __esm({
   "../../node_modules/.pnpm/@clack+core@1.3.0/node_modules/@clack/core/dist/index.mjs"() {
     init_main();
@@ -6623,6 +6987,69 @@ var init_dist4 = __esm({
         }
       }
     };
+    Q = class extends p {
+      filteredOptions;
+      multiple;
+      isNavigating = false;
+      selectedValues = [];
+      focusedValue;
+      #s = 0;
+      #r = "";
+      #t;
+      #n;
+      #u;
+      get cursor() {
+        return this.#s;
+      }
+      get userInputWithCursor() {
+        if (!this.userInput) return styleText(["inverse", "hidden"], "_");
+        if (this._cursor >= this.userInput.length) return `${this.userInput}\u2588`;
+        const t = this.userInput.slice(0, this._cursor), [s, ...e2] = this.userInput.slice(this._cursor);
+        return `${t}${styleText("inverse", s)}${e2.join("")}`;
+      }
+      get options() {
+        return typeof this.#n == "function" ? this.#n() : this.#n;
+      }
+      constructor(t) {
+        super(t), this.#n = t.options, this.#u = t.placeholder;
+        const s = this.options;
+        this.filteredOptions = [...s], this.multiple = t.multiple === true, this.#t = typeof t.options == "function" ? t.filter : t.filter ?? J;
+        let e2;
+        if (t.initialValue && Array.isArray(t.initialValue) ? this.multiple ? e2 = t.initialValue : e2 = t.initialValue.slice(0, 1) : !this.multiple && this.options.length > 0 && (e2 = [this.options[0].value]), e2) for (const i of e2) {
+          const n = s.findIndex((o) => o.value === i);
+          n !== -1 && (this.toggleSelected(i), this.#s = n);
+        }
+        this.focusedValue = this.options[this.#s]?.value, this.on("key", (i, n) => this.#e(i, n)), this.on("userInput", (i) => this.#i(i));
+      }
+      _isActionKey(t, s) {
+        return t === "	" || this.multiple && this.isNavigating && s.name === "space" && t !== void 0 && t !== "";
+      }
+      #e(t, s) {
+        const e2 = s.name === "up", i = s.name === "down", n = s.name === "return", o = this.userInput === "" || this.userInput === "	", u = this.#u, a = this.options, l = u !== void 0 && u !== "" && a.some((f) => !f.disabled && (this.#t ? this.#t(u, f) : true));
+        if (s.name === "tab" && o && l) {
+          this.userInput === "	" && this._clearUserInput(), this._setUserInput(u, true), this.isNavigating = false;
+          return;
+        }
+        e2 || i ? (this.#s = d(this.#s, e2 ? -1 : 1, this.filteredOptions), this.focusedValue = this.filteredOptions[this.#s]?.value, this.multiple || (this.selectedValues = [this.focusedValue]), this.isNavigating = true) : n ? this.value = H(this.multiple, this.selectedValues) : this.multiple ? this.focusedValue !== void 0 && (s.name === "tab" || this.isNavigating && s.name === "space") ? this.toggleSelected(this.focusedValue) : this.isNavigating = false : (this.focusedValue && (this.selectedValues = [this.focusedValue]), this.isNavigating = false);
+      }
+      deselectAll() {
+        this.selectedValues = [];
+      }
+      toggleSelected(t) {
+        this.filteredOptions.length !== 0 && (this.multiple ? this.selectedValues.includes(t) ? this.selectedValues = this.selectedValues.filter((s) => s !== t) : this.selectedValues = [...this.selectedValues, t] : this.selectedValues = [t]);
+      }
+      #i(t) {
+        if (t !== this.#r) {
+          this.#r = t;
+          const s = this.options;
+          t && this.#t ? this.filteredOptions = s.filter((n) => this.#t?.(t, n)) : this.filteredOptions = [...s];
+          const e2 = B(this.focusedValue, this.filteredOptions);
+          this.#s = d(e2, 0, this.filteredOptions);
+          const i = this.filteredOptions[this.#s];
+          i && !i.disabled ? this.focusedValue = i.value : this.focusedValue = void 0, this.multiple || (this.focusedValue !== void 0 ? this.toggleSelected(this.focusedValue) : this.deselectAll());
+        }
+      }
+    };
     X = class extends p {
       get cursor() {
         return this.value ? 0 : 1;
@@ -6640,6 +7067,266 @@ var init_dist4 = __esm({
         });
       }
     };
+    Z = { Y: { type: "year", len: 4 }, M: { type: "month", len: 2 }, D: { type: "day", len: 2 } };
+    et = class extends p {
+      #s;
+      #r;
+      #t;
+      #n;
+      #u;
+      #e = { segmentIndex: 0, positionInSegment: 0 };
+      #i = true;
+      #o = null;
+      inlineError = "";
+      get segmentCursor() {
+        return { ...this.#e };
+      }
+      get segmentValues() {
+        return { ...this.#t };
+      }
+      get segments() {
+        return this.#s;
+      }
+      get separator() {
+        return this.#r;
+      }
+      get formattedValue() {
+        return this.#c(this.#t);
+      }
+      #c(t) {
+        return this.#s.map((s) => t[s.type]).join(this.#r);
+      }
+      #a() {
+        this._setUserInput(this.#c(this.#t)), this._setValue(N(this.#t) ?? void 0);
+      }
+      constructor(t) {
+        const s = t.format ? { segments: P(t.format), separator: t.separator ?? "/" } : tt(t.locale), e2 = t.separator ?? s.separator, i = t.format ? P(t.format) : s.segments, n = t.initialValue ?? t.defaultValue, o = n ? { year: String(n.getUTCFullYear()).padStart(4, "0"), month: String(n.getUTCMonth() + 1).padStart(2, "0"), day: String(n.getUTCDate()).padStart(2, "0") } : { year: "____", month: "__", day: "__" }, u = i.map((a) => o[a.type]).join(e2);
+        super({ ...t, initialUserInput: u }, false), this.#s = i, this.#r = e2, this.#t = o, this.#n = t.minDate, this.#u = t.maxDate, this.#a(), this.on("cursor", (a) => this.#d(a)), this.on("key", (a, l) => this.#f(a, l)), this.on("finalize", () => this.#g(t));
+      }
+      #h() {
+        const t = Math.max(0, Math.min(this.#e.segmentIndex, this.#s.length - 1)), s = this.#s[t];
+        if (s) return this.#e.positionInSegment = Math.max(0, Math.min(this.#e.positionInSegment, s.len - 1)), { segment: s, index: t };
+      }
+      #l(t) {
+        this.inlineError = "", this.#o = null;
+        const s = this.#h();
+        s && (this.#e.segmentIndex = Math.max(0, Math.min(this.#s.length - 1, s.index + t)), this.#e.positionInSegment = 0, this.#i = true);
+      }
+      #p(t) {
+        const s = this.#h();
+        if (!s) return;
+        const { segment: e2 } = s, i = this.#t[e2.type], n = !i || i.replace(/_/g, "") === "", o = Number.parseInt((i || "0").replace(/_/g, "0"), 10) || 0, u = st(e2.type, x(this.#t), this.#n, this.#u);
+        let a;
+        n ? a = t === 1 ? u.min : u.max : a = Math.max(Math.min(u.max, o + t), u.min), this.#t = { ...this.#t, [e2.type]: a.toString().padStart(e2.len, "0") }, this.#i = true, this.#o = null, this.#a();
+      }
+      #d(t) {
+        if (t) switch (t) {
+          case "right":
+            return this.#l(1);
+          case "left":
+            return this.#l(-1);
+          case "up":
+            return this.#p(1);
+          case "down":
+            return this.#p(-1);
+        }
+      }
+      #f(t, s) {
+        if (s?.name === "backspace" || s?.sequence === "\x7F" || s?.sequence === "\b" || t === "\x7F" || t === "\b") {
+          this.inlineError = "";
+          const e2 = this.#h();
+          if (!e2) return;
+          if (!this.#t[e2.segment.type].replace(/_/g, "")) {
+            this.#l(-1);
+            return;
+          }
+          this.#t[e2.segment.type] = "_".repeat(e2.segment.len), this.#i = true, this.#e.positionInSegment = 0, this.#a();
+          return;
+        }
+        if (s?.name === "tab") {
+          this.inlineError = "";
+          const e2 = this.#h();
+          if (!e2) return;
+          const i = s.shift ? -1 : 1, n = e2.index + i;
+          n >= 0 && n < this.#s.length && (this.#e.segmentIndex = n, this.#e.positionInSegment = 0, this.#i = true);
+          return;
+        }
+        if (t && /^[0-9]$/.test(t)) {
+          const e2 = this.#h();
+          if (!e2) return;
+          const { segment: i } = e2, n = !this.#t[i.type].replace(/_/g, "");
+          if (this.#i && this.#o !== null && !n) {
+            const m = this.#o + t, g = { ...this.#t, [i.type]: m }, _ = this.#m(g, i);
+            if (_) {
+              this.inlineError = _, this.#o = null, this.#i = false;
+              return;
+            }
+            this.inlineError = "", this.#t[i.type] = m, this.#o = null, this.#i = false, this.#a(), e2.index < this.#s.length - 1 && (this.#e.segmentIndex = e2.index + 1, this.#e.positionInSegment = 0, this.#i = true);
+            return;
+          }
+          this.#i && !n && (this.#t[i.type] = "_".repeat(i.len), this.#e.positionInSegment = 0), this.#i = false, this.#o = null;
+          const o = this.#t[i.type], u = o.indexOf("_"), a = u >= 0 ? u : Math.min(this.#e.positionInSegment, i.len - 1);
+          if (a < 0 || a >= i.len) return;
+          let l = o.slice(0, a) + t + o.slice(a + 1), f = false;
+          if (a === 0 && o === "__" && (i.type === "month" || i.type === "day")) {
+            const m = Number.parseInt(t, 10);
+            l = `0${t}`, f = m <= (i.type === "month" ? 1 : 2);
+          }
+          if (i.type === "year" && (l = (o.replace(/_/g, "") + t).padStart(i.len, "_")), !l.includes("_")) {
+            const m = { ...this.#t, [i.type]: l }, g = this.#m(m, i);
+            if (g) {
+              this.inlineError = g;
+              return;
+            }
+          }
+          this.inlineError = "", this.#t[i.type] = l;
+          const y = l.includes("_") ? void 0 : F(this.#t);
+          if (y) {
+            const { year: m, month: g } = y, _ = $(m, g);
+            this.#t = { year: String(Math.max(0, Math.min(9999, m))).padStart(4, "0"), month: String(Math.max(1, Math.min(12, g))).padStart(2, "0"), day: String(Math.max(1, Math.min(_, y.day))).padStart(2, "0") };
+          }
+          this.#a();
+          const T = l.indexOf("_");
+          f ? (this.#i = true, this.#o = t) : T >= 0 ? this.#e.positionInSegment = T : u >= 0 && e2.index < this.#s.length - 1 ? (this.#e.segmentIndex = e2.index + 1, this.#e.positionInSegment = 0, this.#i = true) : this.#e.positionInSegment = Math.min(a + 1, i.len - 1);
+        }
+      }
+      #m(t, s) {
+        const { month: e2, day: i } = x(t);
+        if (s.type === "month" && (e2 < 0 || e2 > 12)) return h.date.messages.invalidMonth;
+        if (s.type === "day" && (i < 0 || i > 31)) return h.date.messages.invalidDay(31, "any month");
+      }
+      #g(t) {
+        const { year: s, month: e2, day: i } = x(this.#t);
+        if (s && e2 && i) {
+          const n = $(s, e2);
+          this.#t = { ...this.#t, day: String(Math.min(i, n)).padStart(2, "0") };
+        }
+        this.value = N(this.#t) ?? t.defaultValue ?? void 0;
+      }
+    };
+    it = class extends p {
+      options;
+      cursor = 0;
+      #s;
+      getGroupItems(t) {
+        return this.options.filter((s) => s.group === t);
+      }
+      isGroupSelected(t) {
+        const s = this.getGroupItems(t), e2 = this.value;
+        return e2 === void 0 ? false : s.every((i) => e2.includes(i.value));
+      }
+      toggleValue() {
+        const t = this.options[this.cursor];
+        if (this.value === void 0 && (this.value = []), t.group === true) {
+          const s = t.value, e2 = this.getGroupItems(s);
+          this.isGroupSelected(s) ? this.value = this.value.filter((i) => e2.findIndex((n) => n.value === i) === -1) : this.value = [...this.value, ...e2.map((i) => i.value)], this.value = Array.from(new Set(this.value));
+        } else {
+          const s = this.value.includes(t.value);
+          this.value = s ? this.value.filter((e2) => e2 !== t.value) : [...this.value, t.value];
+        }
+      }
+      constructor(t) {
+        super(t, false);
+        const { options: s } = t;
+        this.#s = t.selectableGroups !== false, this.options = Object.entries(s).flatMap(([e2, i]) => [{ value: e2, group: true, label: e2 }, ...i.map((n) => ({ ...n, group: e2 }))]), this.value = [...t.initialValues ?? []], this.cursor = Math.max(this.options.findIndex(({ value: e2 }) => e2 === t.cursorAt), this.#s ? 0 : 1), this.on("cursor", (e2) => {
+          switch (e2) {
+            case "left":
+            case "up": {
+              this.cursor = this.cursor === 0 ? this.options.length - 1 : this.cursor - 1;
+              const i = this.options[this.cursor]?.group === true;
+              !this.#s && i && (this.cursor = this.cursor === 0 ? this.options.length - 1 : this.cursor - 1);
+              break;
+            }
+            case "down":
+            case "right": {
+              this.cursor = this.cursor === this.options.length - 1 ? 0 : this.cursor + 1;
+              const i = this.options[this.cursor]?.group === true;
+              !this.#s && i && (this.cursor = this.cursor === this.options.length - 1 ? 0 : this.cursor + 1);
+              break;
+            }
+            case "space":
+              this.toggleValue();
+              break;
+          }
+        });
+      }
+    };
+    rt = class extends p {
+      #s = false;
+      #r;
+      focused = "editor";
+      get userInputWithCursor() {
+        if (this.state === "submit") return this.userInput;
+        const t = this.userInput;
+        if (this.cursor >= t.length) return `${t}\u2588`;
+        const s = t.slice(0, this.cursor), e2 = t[this.cursor], i = t.slice(this.cursor + 1);
+        return e2 === `
+` ? `${s}\u2588
+${i}` : `${s}${styleText("inverse", e2)}${i}`;
+      }
+      get cursor() {
+        return this._cursor;
+      }
+      #t(t) {
+        if (this.userInput.length === 0) {
+          this._setUserInput(t);
+          return;
+        }
+        this._setUserInput(this.userInput.slice(0, this.cursor) + t + this.userInput.slice(this.cursor));
+      }
+      #n(t) {
+        const s = this.value ?? "";
+        switch (t) {
+          case "up":
+            this._cursor = I(this._cursor, 0, -1, s);
+            return;
+          case "down":
+            this._cursor = I(this._cursor, 0, 1, s);
+            return;
+          case "left":
+            this._cursor = I(this._cursor, -1, 0, s);
+            return;
+          case "right":
+            this._cursor = I(this._cursor, 1, 0, s);
+            return;
+        }
+      }
+      _shouldSubmit(t, s) {
+        if (this.#r) return this.focused === "submit" ? true : (this.#t(`
+`), this._cursor++, false);
+        const e2 = this.#s;
+        return this.#s = true, e2 ? (this.userInput[this.cursor - 1] === `
+` && (this._setUserInput(this.userInput.slice(0, this.cursor - 1) + this.userInput.slice(this.cursor)), this._cursor--), true) : (this.#t(`
+`), this._cursor++, false);
+      }
+      constructor(t) {
+        super(t, false), this.#r = t.showSubmit ?? false, this.on("key", (s, e2) => {
+          if (e2?.name && h.actions.has(e2.name)) {
+            this.#n(e2.name);
+            return;
+          }
+          if (s === "	" && this.#r) {
+            this.focused = this.focused === "editor" ? "submit" : "editor";
+            return;
+          }
+          if (e2?.name !== "return") {
+            if (this.#s = false, e2?.name === "backspace" && this.cursor > 0) {
+              this._setUserInput(this.userInput.slice(0, this.cursor - 1) + this.userInput.slice(this.cursor)), this._cursor--;
+              return;
+            }
+            if (e2?.name === "delete" && this.cursor < this.userInput.length) {
+              this._setUserInput(this.userInput.slice(0, this.cursor) + this.userInput.slice(this.cursor + 1));
+              return;
+            }
+            s && (this.#r && this.focused === "submit" && (this.focused = "editor"), this.#t(s ?? ""), this._cursor++);
+          }
+        }), this.on("userInput", (s) => {
+          this._setValue(s);
+        }), this.on("finalize", () => {
+          this.value || (this.value = t.defaultValue), this.value === void 0 && (this.value = "");
+        });
+      }
+    };
     nt = class extends p {
       options;
       cursor = 0;
@@ -6737,6 +7424,21 @@ var init_dist4 = __esm({
         });
       }
     };
+    at = class extends p {
+      options;
+      cursor = 0;
+      constructor(t) {
+        super(t, false), this.options = t.options;
+        const s = t.caseSensitive === true, e2 = this.options.map(({ value: [i] }) => s ? i : i?.toLowerCase());
+        this.cursor = Math.max(e2.indexOf(t.initialValue), 0), this.on("key", (i, n) => {
+          if (!i) return;
+          const o = s && n.shift ? i.toUpperCase() : i;
+          if (!e2.includes(o)) return;
+          const u = this.options.find(({ value: [a] }) => s ? a === o : a?.toLowerCase() === i);
+          u && (this.value = u.value, this.state = "submit", this.emit("submit"));
+        });
+      }
+    };
     ht = class extends p {
       get userInputWithCursor() {
         if (this.state === "submit") return this.userInput;
@@ -6758,10 +7460,130 @@ var init_dist4 = __esm({
     };
   }
 });
+
+// ../../node_modules/.pnpm/@clack+prompts@1.3.0/node_modules/@clack/prompts/dist/index.mjs
+var dist_exports = {};
+__export(dist_exports, {
+  S_BAR: () => $2,
+  S_BAR_END: () => E2,
+  S_BAR_END_RIGHT: () => Et,
+  S_BAR_H: () => st2,
+  S_BAR_START: () => lt,
+  S_BAR_START_RIGHT: () => It,
+  S_CHECKBOX_ACTIVE: () => et2,
+  S_CHECKBOX_INACTIVE: () => J2,
+  S_CHECKBOX_SELECTED: () => U2,
+  S_CONNECT_LEFT: () => xt,
+  S_CORNER_BOTTOM_LEFT: () => dt,
+  S_CORNER_BOTTOM_RIGHT: () => $t,
+  S_CORNER_TOP_LEFT: () => Ot,
+  S_CORNER_TOP_RIGHT: () => ct,
+  S_ERROR: () => gt,
+  S_INFO: () => ht2,
+  S_PASSWORD_MASK: () => Gt,
+  S_RADIO_ACTIVE: () => z2,
+  S_RADIO_INACTIVE: () => H2,
+  S_STEP_ACTIVE: () => _t,
+  S_STEP_CANCEL: () => ot2,
+  S_STEP_ERROR: () => ut2,
+  S_STEP_SUBMIT: () => F2,
+  S_SUCCESS: () => pt,
+  S_WARN: () => mt,
+  autocomplete: () => At,
+  autocompleteMultiselect: () => ie,
+  box: () => oe,
+  cancel: () => me,
+  confirm: () => ue,
+  date: () => le,
+  group: () => he,
+  groupMultiselect: () => pe,
+  intro: () => ge,
+  isCI: () => at2,
+  isCancel: () => q,
+  isTTY: () => Tt,
+  limitOptions: () => Y2,
+  log: () => R2,
+  multiline: () => fe,
+  multiselect: () => ve,
+  note: () => Se,
+  outro: () => ye,
+  password: () => Ce,
+  path: () => Te,
+  progress: () => Ie,
+  select: () => Ee,
+  selectKey: () => Ge,
+  settings: () => h,
+  spinner: () => ft,
+  stream: () => K2,
+  symbol: () => M,
+  symbolBar: () => yt,
+  taskLog: () => Me,
+  tasks: () => xe,
+  text: () => Re,
+  unicode: () => tt2,
+  unicodeOr: () => w2,
+  updateSettings: () => j
+});
 function te() {
   return j2.platform !== "win32" ? j2.env.TERM !== "linux" : !!j2.env.CI || !!j2.env.WT_SESSION || !!j2.env.TERMINUS_SUBLIME || j2.env.ConEmuTask === "{cmd::Cmder}" || j2.env.TERM_PROGRAM === "Terminus-Sublime" || j2.env.TERM_PROGRAM === "vscode" || j2.env.TERM === "xterm-256color" || j2.env.TERM === "alacritty" || j2.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
-var import_sisteransi2, tt, at2, w2, _t, ot2, ut2, F, lt, $, E2, z2, H, et2, U, J, Gt, st, ct, xt, $t, dt, ht2, pt, mt, gt, M, yt, ee, Y2, ue, he, R2, me, ge, ye, Q2, ve, we, be, Se, Ce, _e, ft, it2, Ee, Re;
+function Mt(t) {
+  return t.label ?? String(t.value ?? "");
+}
+function Rt(t, r) {
+  if (!t) return true;
+  const s = (r.label ?? String(r.value ?? "")).toLowerCase(), i = (r.hint ?? "").toLowerCase(), u = String(r.value).toLowerCase(), n = t.toLowerCase();
+  return s.includes(n) || i.includes(n) || u.includes(n);
+}
+function se(t, r) {
+  const s = [];
+  for (const i of r) t.includes(i.value) && s.push(i);
+  return s;
+}
+function Pt(t, r, s, i) {
+  let u = s, n = s;
+  return i === "center" ? u = Math.floor((r - t) / 2) : i === "right" && (u = r - t - s), n = r - u - t, [u, n];
+}
+function ce(t, r) {
+  const s = t.segmentValues, i = t.segmentCursor;
+  if (r === "submit" || r === "cancel") return t.formattedValue;
+  const u = styleText("gray", t.separator);
+  return t.segments.map((n, o) => {
+    const c2 = o === i.segmentIndex && !["submit", "cancel"].includes(r), a = de[n.type];
+    return $e(s[n.type], { isActive: c2, label: a });
+  }).join(u);
+}
+function $e(t, r) {
+  const s = !t || t.replace(/_/g, "") === "";
+  return r.isActive ? styleText("inverse", s ? r.label : t.replace(/_/g, " ")) : s ? styleText("dim", r.label) : t.replace(/_/g, styleText("dim", " "));
+}
+function Ie({ style: t = "heavy", max: r = 100, size: s = 40, ...i } = {}) {
+  const u = ft(i);
+  let n = 0, o = "";
+  const c2 = Math.max(1, r), a = Math.max(1, s), l = (m) => {
+    switch (m) {
+      case "initial":
+      case "active":
+        return (g) => styleText("magenta", g);
+      case "error":
+      case "cancel":
+        return (g) => styleText("red", g);
+      case "submit":
+        return (g) => styleText("green", g);
+      default:
+        return (g) => styleText("magenta", g);
+    }
+  }, d2 = (m, g) => {
+    const S2 = Math.floor(n / c2 * a);
+    return `${l(m)(Vt[t].repeat(S2))}${styleText("dim", Vt[t].repeat(a - S2))} ${g}`;
+  }, y = (m = "") => {
+    o = m, u.start(d2("initial", m));
+  }, p2 = (m = 1, g) => {
+    n = Math.min(c2, m + n), u.message(d2("active", g ?? o)), o = g ?? o;
+  };
+  return { start: y, stop: u.stop, cancel: u.cancel, error: u.error, clear: u.clear, advance: p2, isCancelled: u.isCancelled, message: (m) => p2(0, m) };
+}
+var import_sisteransi2, tt2, at2, Tt, w2, _t, ot2, ut2, F2, lt, $2, E2, It, Et, z2, H2, et2, U2, J2, Gt, st2, ct, xt, $t, dt, Ot, ht2, pt, mt, gt, M, yt, ee, Y2, At, ie, re, ne, ae, oe, ue, le, de, he, pe, R2, me, ge, ye, fe, Q2, ve, we, be, Se, Ce, Te, _e, ft, Vt, it2, Ee, Ge, jt, K2, xe, Oe, Me, Re;
 var init_dist5 = __esm({
   "../../node_modules/.pnpm/@clack+prompts@1.3.0/node_modules/@clack/prompts/dist/index.mjs"() {
     init_dist4();
@@ -6769,30 +7591,31 @@ var init_dist5 = __esm({
     init_main();
     init_dist3();
     import_sisteransi2 = __toESM(require_src());
-    tt = te();
+    tt2 = te();
     at2 = () => process.env.CI === "true";
-    w2 = (t, r) => tt ? t : r;
+    Tt = (t) => t.isTTY === true;
+    w2 = (t, r) => tt2 ? t : r;
     _t = w2("\u25C6", "*");
     ot2 = w2("\u25A0", "x");
     ut2 = w2("\u25B2", "x");
-    F = w2("\u25C7", "o");
+    F2 = w2("\u25C7", "o");
     lt = w2("\u250C", "T");
-    $ = w2("\u2502", "|");
+    $2 = w2("\u2502", "|");
     E2 = w2("\u2514", "\u2014");
-    w2("\u2510", "T");
-    w2("\u2518", "\u2014");
+    It = w2("\u2510", "T");
+    Et = w2("\u2518", "\u2014");
     z2 = w2("\u25CF", ">");
-    H = w2("\u25CB", " ");
+    H2 = w2("\u25CB", " ");
     et2 = w2("\u25FB", "[\u2022]");
-    U = w2("\u25FC", "[+]");
-    J = w2("\u25FB", "[ ]");
+    U2 = w2("\u25FC", "[+]");
+    J2 = w2("\u25FB", "[ ]");
     Gt = w2("\u25AA", "\u2022");
-    st = w2("\u2500", "-");
+    st2 = w2("\u2500", "-");
     ct = w2("\u256E", "+");
     xt = w2("\u251C", "+");
     $t = w2("\u256F", "+");
     dt = w2("\u2570", "+");
-    w2("\u256D", "+");
+    Ot = w2("\u256D", "+");
     ht2 = w2("\u25CF", "\u2022");
     pt = w2("\u25C6", "*");
     mt = w2("\u25B2", "!");
@@ -6807,20 +7630,20 @@ var init_dist5 = __esm({
         case "error":
           return styleText("yellow", ut2);
         case "submit":
-          return styleText("green", F);
+          return styleText("green", F2);
       }
     };
     yt = (t) => {
       switch (t) {
         case "initial":
         case "active":
-          return styleText("cyan", $);
+          return styleText("cyan", $2);
         case "cancel":
-          return styleText("red", $);
+          return styleText("red", $2);
         case "error":
-          return styleText("yellow", $);
+          return styleText("yellow", $2);
         case "submit":
-          return styleText("green", $);
+          return styleText("green", $2);
       }
     };
     ee = (t, r, s, i, u) => {
@@ -6846,42 +7669,178 @@ var init_dist5 = __esm({
         h2.push(G2), f += G2.length;
       }
       if (f > d2) {
-        let b2 = 0, G2 = 0, x = f;
-        const A2 = t - v2, P = (N, D2) => ee(h2, x, N, D2, d2);
-        m ? ({ lineCount: x, removals: b2 } = P(0, A2), x > d2 && ({ lineCount: x, removals: G2 } = P(A2 + 1, h2.length))) : ({ lineCount: x, removals: G2 } = P(A2 + 1, h2.length), x > d2 && ({ lineCount: x, removals: b2 } = P(0, A2))), b2 > 0 && (m = true, h2.splice(0, b2)), G2 > 0 && (g = true, h2.splice(h2.length - G2, G2));
+        let b2 = 0, G2 = 0, x2 = f;
+        const A2 = t - v2, P2 = (N2, D2) => ee(h2, x2, N2, D2, d2);
+        m ? ({ lineCount: x2, removals: b2 } = P2(0, A2), x2 > d2 && ({ lineCount: x2, removals: G2 } = P2(A2 + 1, h2.length))) : ({ lineCount: x2, removals: G2 } = P2(A2 + 1, h2.length), x2 > d2 && ({ lineCount: x2, removals: b2 } = P2(0, A2))), b2 > 0 && (m = true, h2.splice(0, b2)), G2 > 0 && (g = true, h2.splice(h2.length - G2, G2));
       }
       const C2 = [];
       m && C2.push(l);
       for (const b2 of h2) for (const G2 of b2) C2.push(G2);
       return g && C2.push(l), C2;
     };
+    At = (t) => new Q({ options: t.options, initialValue: t.initialValue ? [t.initialValue] : void 0, initialUserInput: t.initialUserInput, placeholder: t.placeholder, filter: t.filter ?? ((r, s) => Rt(r, s)), signal: t.signal, input: t.input, output: t.output, validate: t.validate, render() {
+      const r = t.withGuide ?? h.withGuide, s = r ? [`${styleText("gray", $2)}`, `${M(this.state)}  ${t.message}`] : [`${M(this.state)}  ${t.message}`], i = this.userInput, u = this.options, n = t.placeholder, o = i === "" && n !== void 0, c2 = (a, l) => {
+        const d2 = Mt(a), y = a.hint && a.value === this.focusedValue ? styleText("dim", ` (${a.hint})`) : "";
+        switch (l) {
+          case "active":
+            return `${styleText("green", z2)} ${d2}${y}`;
+          case "inactive":
+            return `${styleText("dim", H2)} ${styleText("dim", d2)}`;
+          case "disabled":
+            return `${styleText("gray", H2)} ${styleText(["strikethrough", "gray"], d2)}`;
+        }
+      };
+      switch (this.state) {
+        case "submit": {
+          const a = se(this.selectedValues, u), l = a.length > 0 ? `  ${styleText("dim", a.map(Mt).join(", "))}` : "", d2 = r ? styleText("gray", $2) : "";
+          return `${s.join(`
+`)}
+${d2}${l}`;
+        }
+        case "cancel": {
+          const a = i ? `  ${styleText(["strikethrough", "dim"], i)}` : "", l = r ? styleText("gray", $2) : "";
+          return `${s.join(`
+`)}
+${l}${a}`;
+        }
+        default: {
+          const a = this.state === "error" ? "yellow" : "cyan", l = r ? `${styleText(a, $2)}  ` : "", d2 = r ? styleText(a, E2) : "";
+          let y = "";
+          if (this.isNavigating || o) {
+            const v2 = o ? n : i;
+            y = v2 !== "" ? ` ${styleText("dim", v2)}` : "";
+          } else y = ` ${this.userInputWithCursor}`;
+          const p2 = this.filteredOptions.length !== u.length ? styleText("dim", ` (${this.filteredOptions.length} match${this.filteredOptions.length === 1 ? "" : "es"})`) : "", m = this.filteredOptions.length === 0 && i ? [`${l}${styleText("yellow", "No matches found")}`] : [], g = this.state === "error" ? [`${l}${styleText("yellow", this.error)}`] : [];
+          r && s.push(`${l.trimEnd()}`), s.push(`${l}${styleText("dim", "Search:")}${y}${p2}`, ...m, ...g);
+          const S2 = [`${styleText("dim", "\u2191/\u2193")} to select`, `${styleText("dim", "Enter:")} confirm`, `${styleText("dim", "Type:")} to search`], h2 = [`${l}${S2.join(" \u2022 ")}`, d2], f = this.filteredOptions.length === 0 ? [] : Y2({ cursor: this.cursor, options: this.filteredOptions, columnPadding: r ? 3 : 0, rowPadding: s.length + h2.length, style: (v2, T) => c2(v2, v2.disabled ? "disabled" : T ? "active" : "inactive"), maxItems: t.maxItems, output: t.output });
+          return [...s, ...f.map((v2) => `${l}${v2}`), ...h2].join(`
+`);
+        }
+      }
+    } }).prompt();
+    ie = (t) => {
+      const r = (i, u, n, o) => {
+        const c2 = n.includes(i.value), a = i.label ?? String(i.value ?? ""), l = i.hint && o !== void 0 && i.value === o ? styleText("dim", ` (${i.hint})`) : "", d2 = c2 ? styleText("green", U2) : styleText("dim", J2);
+        return i.disabled ? `${styleText("gray", J2)} ${styleText(["strikethrough", "gray"], a)}` : u ? `${d2} ${a}${l}` : `${d2} ${styleText("dim", a)}`;
+      }, s = new Q({ options: t.options, multiple: true, placeholder: t.placeholder, filter: t.filter ?? ((i, u) => Rt(i, u)), validate: () => {
+        if (t.required && s.selectedValues.length === 0) return "Please select at least one item";
+      }, initialValue: t.initialValues, signal: t.signal, input: t.input, output: t.output, render() {
+        const i = t.withGuide ?? h.withGuide, u = `${i ? `${styleText("gray", $2)}
+` : ""}${M(this.state)}  ${t.message}
+`, n = this.userInput, o = t.placeholder, c2 = n === "" && o !== void 0, a = this.isNavigating || c2 ? styleText("dim", c2 ? o : n) : this.userInputWithCursor, l = this.options, d2 = this.filteredOptions.length !== l.length ? styleText("dim", ` (${this.filteredOptions.length} match${this.filteredOptions.length === 1 ? "" : "es"})`) : "";
+        switch (this.state) {
+          case "submit":
+            return `${u}${i ? `${styleText("gray", $2)}  ` : ""}${styleText("dim", `${this.selectedValues.length} items selected`)}`;
+          case "cancel":
+            return `${u}${i ? `${styleText("gray", $2)}  ` : ""}${styleText(["strikethrough", "dim"], n)}`;
+          default: {
+            const y = this.state === "error" ? "yellow" : "cyan", p2 = i ? `${styleText(y, $2)}  ` : "", m = i ? styleText(y, E2) : "", g = [`${styleText("dim", "\u2191/\u2193")} to navigate`, `${styleText("dim", this.isNavigating ? "Space/Tab:" : "Tab:")} select`, `${styleText("dim", "Enter:")} confirm`, `${styleText("dim", "Type:")} to search`], S2 = this.filteredOptions.length === 0 && n ? [`${p2}${styleText("yellow", "No matches found")}`] : [], h2 = this.state === "error" ? [`${p2}${styleText("yellow", this.error)}`] : [], f = [...`${u}${i ? styleText(y, $2) : ""}`.split(`
+`), `${p2}${styleText("dim", "Search:")} ${a}${d2}`, ...S2, ...h2], v2 = [`${p2}${g.join(" \u2022 ")}`, m], T = Y2({ cursor: this.cursor, options: this.filteredOptions, style: (C2, b2) => r(C2, b2, this.selectedValues, this.focusedValue), maxItems: t.maxItems, output: t.output, rowPadding: f.length + v2.length });
+            return [...f, ...T.map((C2) => `${p2}${C2}`), ...v2].join(`
+`);
+          }
+        }
+      } });
+      return s.prompt();
+    };
+    re = [Ot, ct, dt, $t];
+    ne = [lt, It, E2, Et];
+    ae = (t) => t;
+    oe = (t = "", r = "", s) => {
+      const i = s?.output ?? process.stdout, u = A(i), n = 2, o = s?.titlePadding ?? 1, c2 = s?.contentPadding ?? 2, a = s?.width === void 0 || s.width === "auto" ? 1 : Math.min(1, s.width), l = s?.withGuide ?? h.withGuide ? `${$2} ` : "", d2 = s?.formatBorder ?? ae, y = (s?.rounded ? re : ne).map(d2), p2 = d2(st2), m = d2($2), g = dist_default2(l), S2 = dist_default2(r), h2 = u - g;
+      let f = Math.floor(u * a) - g;
+      if (s?.width === "auto") {
+        const P2 = t.split(`
+`);
+        let N2 = S2 + o * 2;
+        for (const rt2 of P2) {
+          const W2 = dist_default2(rt2) + c2 * 2;
+          W2 > N2 && (N2 = W2);
+        }
+        const D2 = N2 + n;
+        D2 < f && (f = D2);
+      }
+      f % 2 !== 0 && (f < h2 ? f++ : f--);
+      const v2 = f - n, T = v2 - o * 2, C2 = S2 > T ? `${r.slice(0, T - 3)}...` : r, [b2, G2] = Pt(dist_default2(C2), v2, o, s?.titleAlign), x2 = wrapAnsi(t, v2 - c2 * 2, { hard: true, trim: false });
+      i.write(`${l}${y[0]}${p2.repeat(b2)}${C2}${p2.repeat(G2)}${y[1]}
+`);
+      const A2 = x2.split(`
+`);
+      for (const P2 of A2) {
+        const [N2, D2] = Pt(dist_default2(P2), v2, c2, s?.contentAlign);
+        i.write(`${l}${m}${" ".repeat(N2)}${P2}${" ".repeat(D2)}${m}
+`);
+      }
+      i.write(`${l}${y[2]}${p2.repeat(v2)}${y[3]}
+`);
+    };
     ue = (t) => {
       const r = t.active ?? "Yes", s = t.inactive ?? "No";
       return new X({ active: r, inactive: s, signal: t.signal, input: t.input, output: t.output, initialValue: t.initialValue ?? true, render() {
-        const i = t.withGuide ?? h.withGuide, u = `${M(this.state)}  `, n = i ? `${styleText("gray", $)}  ` : "", o = W(t.output, t.message, n, u), c2 = `${i ? `${styleText("gray", $)}
+        const i = t.withGuide ?? h.withGuide, u = `${M(this.state)}  `, n = i ? `${styleText("gray", $2)}  ` : "", o = W(t.output, t.message, n, u), c2 = `${i ? `${styleText("gray", $2)}
 ` : ""}${o}
 `, a = this.value ? r : s;
         switch (this.state) {
           case "submit": {
-            const l = i ? `${styleText("gray", $)}  ` : "";
+            const l = i ? `${styleText("gray", $2)}  ` : "";
             return `${c2}${l}${styleText("dim", a)}`;
           }
           case "cancel": {
-            const l = i ? `${styleText("gray", $)}  ` : "";
+            const l = i ? `${styleText("gray", $2)}  ` : "";
             return `${c2}${l}${styleText(["strikethrough", "dim"], a)}${i ? `
-${styleText("gray", $)}` : ""}`;
+${styleText("gray", $2)}` : ""}`;
           }
           default: {
-            const l = i ? `${styleText("cyan", $)}  ` : "", d2 = i ? styleText("cyan", E2) : "";
-            return `${c2}${l}${this.value ? `${styleText("green", z2)} ${r}` : `${styleText("dim", H)} ${styleText("dim", r)}`}${t.vertical ? i ? `
-${styleText("cyan", $)}  ` : `
-` : ` ${styleText("dim", "/")} `}${this.value ? `${styleText("dim", H)} ${styleText("dim", s)}` : `${styleText("green", z2)} ${s}`}
+            const l = i ? `${styleText("cyan", $2)}  ` : "", d2 = i ? styleText("cyan", E2) : "";
+            return `${c2}${l}${this.value ? `${styleText("green", z2)} ${r}` : `${styleText("dim", H2)} ${styleText("dim", r)}`}${t.vertical ? i ? `
+${styleText("cyan", $2)}  ` : `
+` : ` ${styleText("dim", "/")} `}${this.value ? `${styleText("dim", H2)} ${styleText("dim", s)}` : `${styleText("green", z2)} ${s}`}
 ${d2}
 `;
           }
         }
       } }).prompt();
     };
+    le = (t) => {
+      const r = t.validate;
+      return new et({ ...t, validate(s) {
+        if (s === void 0) return t.defaultValue !== void 0 ? void 0 : r ? r(s) : h.date.messages.required;
+        const i = (u) => u.toISOString().slice(0, 10);
+        if (t.minDate && i(s) < i(t.minDate)) return h.date.messages.afterMin(t.minDate);
+        if (t.maxDate && i(s) > i(t.maxDate)) return h.date.messages.beforeMax(t.maxDate);
+        if (r) return r(s);
+      }, render() {
+        const s = (t?.withGuide ?? h.withGuide) !== false, i = `${`${s ? `${styleText("gray", $2)}
+` : ""}${M(this.state)}  `}${t.message}
+`, u = this.state !== "initial" ? this.state : "active", n = ce(this, u), o = this.value instanceof Date ? this.formattedValue : "";
+        switch (this.state) {
+          case "error": {
+            const c2 = this.error ? `  ${styleText("yellow", this.error)}` : "", a = s ? `${styleText("yellow", $2)}  ` : "", l = s ? styleText("yellow", E2) : "";
+            return `${i.trim()}
+${a}${n}
+${l}${c2}
+`;
+          }
+          case "submit": {
+            const c2 = o ? `  ${styleText("dim", o)}` : "", a = s ? styleText("gray", $2) : "";
+            return `${i}${a}${c2}`;
+          }
+          case "cancel": {
+            const c2 = o ? `  ${styleText(["strikethrough", "dim"], o)}` : "", a = s ? styleText("gray", $2) : "";
+            return `${i}${a}${c2}${o.trim() ? `
+${a}` : ""}`;
+          }
+          default: {
+            const c2 = s ? `${styleText("cyan", $2)}  ` : "", a = s ? styleText("cyan", E2) : "", l = s ? `${styleText("cyan", $2)}  ` : "", d2 = this.inlineError ? `
+${l}${styleText("yellow", this.inlineError)}` : "";
+            return `${i}${c2}${n}${d2}
+${a}
+`;
+          }
+        }
+      } }).prompt();
+    };
+    de = { year: "yyyy", month: "mm", day: "dd" };
     he = async (t, r) => {
       const s = {}, i = Object.keys(t);
       for (const u of i) {
@@ -6896,7 +7855,74 @@ ${d2}
       }
       return s;
     };
-    R2 = { message: (t = [], { symbol: r = styleText("gray", $), secondarySymbol: s = styleText("gray", $), output: i = process.stdout, spacing: u = 1, withGuide: n } = {}) => {
+    pe = (t) => {
+      const { selectableGroups: r = true, groupSpacing: s = 0 } = t, i = (n, o, c2 = []) => {
+        const a = n.label ?? String(n.value), l = typeof n.group == "string", d2 = l && (c2[c2.indexOf(n) + 1] ?? { group: true }), y = l && d2 && d2.group === true, p2 = l ? r ? `${y ? E2 : $2} ` : "  " : "";
+        let m = "";
+        if (s > 0 && !l) {
+          const S2 = `
+${styleText("cyan", $2)}`;
+          m = `${S2.repeat(s - 1)}${S2}  `;
+        }
+        if (o === "active") return `${m}${styleText("dim", p2)}${styleText("cyan", et2)} ${a}${n.hint ? ` ${styleText("dim", `(${n.hint})`)}` : ""}`;
+        if (o === "group-active") return `${m}${p2}${styleText("cyan", et2)} ${styleText("dim", a)}`;
+        if (o === "group-active-selected") return `${m}${p2}${styleText("green", U2)} ${styleText("dim", a)}`;
+        if (o === "selected") {
+          const S2 = l || r ? styleText("green", U2) : "";
+          return `${m}${styleText("dim", p2)}${S2} ${styleText("dim", a)}${n.hint ? ` ${styleText("dim", `(${n.hint})`)}` : ""}`;
+        }
+        if (o === "cancelled") return `${styleText(["strikethrough", "dim"], a)}`;
+        if (o === "active-selected") return `${m}${styleText("dim", p2)}${styleText("green", U2)} ${a}${n.hint ? ` ${styleText("dim", `(${n.hint})`)}` : ""}`;
+        if (o === "submitted") return `${styleText("dim", a)}`;
+        const g = l || r ? styleText("dim", J2) : "";
+        return `${m}${styleText("dim", p2)}${g} ${styleText("dim", a)}`;
+      }, u = t.required ?? true;
+      return new it({ options: t.options, signal: t.signal, input: t.input, output: t.output, initialValues: t.initialValues, required: u, cursorAt: t.cursorAt, selectableGroups: r, validate(n) {
+        if (u && (n === void 0 || n.length === 0)) return `Please select at least one option.
+${styleText("reset", styleText("dim", `Press ${styleText(["gray", "bgWhite", "inverse"], " space ")} to select, ${styleText("gray", styleText(["bgWhite", "inverse"], " enter "))} to submit`))}`;
+      }, render() {
+        const n = t.withGuide ?? h.withGuide, o = `${n ? `${styleText("gray", $2)}
+` : ""}${M(this.state)}  ${t.message}
+`, c2 = this.value ?? [];
+        switch (this.state) {
+          case "submit": {
+            const a = this.options.filter(({ value: d2 }) => c2.includes(d2)).map((d2) => i(d2, "submitted")), l = a.length === 0 ? "" : `  ${a.join(styleText("dim", ", "))}`;
+            return `${o}${n ? styleText("gray", $2) : ""}${l}`;
+          }
+          case "cancel": {
+            const a = this.options.filter(({ value: l }) => c2.includes(l)).map((l) => i(l, "cancelled")).join(styleText("dim", ", "));
+            return `${o}${n ? `${styleText("gray", $2)}  ` : ""}${a.trim() ? `${a}${n ? `
+${styleText("gray", $2)}` : ""}` : ""}`;
+          }
+          case "error": {
+            const a = this.error.split(`
+`).map((l, d2) => d2 === 0 ? `${n ? `${styleText("yellow", E2)}  ` : ""}${styleText("yellow", l)}` : `   ${l}`).join(`
+`);
+            return `${o}${n ? `${styleText("yellow", $2)}  ` : ""}${this.options.map((l, d2, y) => {
+              const p2 = c2.includes(l.value) || l.group === true && this.isGroupSelected(`${l.value}`), m = d2 === this.cursor;
+              return !m && typeof l.group == "string" && this.options[this.cursor].value === l.group ? i(l, p2 ? "group-active-selected" : "group-active", y) : m && p2 ? i(l, "active-selected", y) : p2 ? i(l, "selected", y) : i(l, m ? "active" : "inactive", y);
+            }).join(`
+${n ? `${styleText("yellow", $2)}  ` : ""}`)}
+${a}
+`;
+          }
+          default: {
+            const a = this.options.map((d2, y, p2) => {
+              const m = c2.includes(d2.value) || d2.group === true && this.isGroupSelected(`${d2.value}`), g = y === this.cursor, S2 = !g && typeof d2.group == "string" && this.options[this.cursor].value === d2.group;
+              let h2 = "";
+              return S2 ? h2 = i(d2, m ? "group-active-selected" : "group-active", p2) : g && m ? h2 = i(d2, "active-selected", p2) : m ? h2 = i(d2, "selected", p2) : h2 = i(d2, g ? "active" : "inactive", p2), `${y !== 0 && !h2.startsWith(`
+`) ? "  " : ""}${h2}`;
+            }).join(`
+${n ? styleText("cyan", $2) : ""}`), l = a.startsWith(`
+`) ? "" : "  ";
+            return `${o}${n ? styleText("cyan", $2) : ""}${l}${a}
+${n ? styleText("cyan", E2) : ""}
+`;
+          }
+        }
+      } }).prompt();
+    };
+    R2 = { message: (t = [], { symbol: r = styleText("gray", $2), secondarySymbol: s = styleText("gray", $2), output: i = process.stdout, spacing: u = 1, withGuide: n } = {}) => {
       const o = [], c2 = n ?? h.withGuide, a = c2 ? s : "", l = c2 ? `${r}  ` : "", d2 = c2 ? `${s}  ` : "";
       for (let p2 = 0; p2 < u; p2++) o.push(a);
       const y = Array.isArray(t) ? t : t.split(`
@@ -6914,7 +7940,7 @@ ${d2}
     }, success: (t, r) => {
       R2.message(t, { ...r, symbol: styleText("green", pt) });
     }, step: (t, r) => {
-      R2.message(t, { ...r, symbol: styleText("green", F) });
+      R2.message(t, { ...r, symbol: styleText("green", F2) });
     }, warn: (t, r) => {
       R2.message(t, { ...r, symbol: styleText("yellow", mt) });
     }, warning: (t, r) => {
@@ -6934,25 +7960,53 @@ ${d2}
 `);
     };
     ye = (t = "", r) => {
-      const s = r?.output ?? process.stdout, i = r?.withGuide ?? h.withGuide ? `${styleText("gray", $)}
+      const s = r?.output ?? process.stdout, i = r?.withGuide ?? h.withGuide ? `${styleText("gray", $2)}
 ${styleText("gray", E2)}  ` : "";
       s.write(`${i}${t}
 
 `);
     };
+    fe = (t) => new rt({ validate: t.validate, placeholder: t.placeholder, defaultValue: t.defaultValue, initialValue: t.initialValue, showSubmit: t.showSubmit, output: t.output, signal: t.signal, input: t.input, render() {
+      const r = t?.withGuide ?? h.withGuide, s = `${`${r ? `${styleText("gray", $2)}
+` : ""}${M(this.state)}  `}${t.message}
+`, i = t.placeholder ? styleText("inverse", t.placeholder[0]) + styleText("dim", t.placeholder.slice(1)) : styleText(["inverse", "hidden"], "_"), u = this.userInput ? this.userInputWithCursor : i, n = this.value ?? "", o = t.showSubmit ? `
+  ${styleText(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
+      switch (this.state) {
+        case "error": {
+          const c2 = `${styleText("yellow", $2)}  `, a = r ? W(t.output, u, c2, void 0) : u, l = styleText("yellow", E2);
+          return `${s}${a}
+${l}  ${styleText("yellow", this.error)}${o}
+`;
+        }
+        case "submit": {
+          const c2 = `${styleText("gray", $2)}  `, a = r ? W(t.output, n, c2, void 0, (l) => styleText("dim", l)) : n ? styleText("dim", n) : "";
+          return `${s}${a}`;
+        }
+        case "cancel": {
+          const c2 = `${styleText("gray", $2)}  `, a = r ? W(t.output, n, c2, void 0, (l) => styleText(["strikethrough", "dim"], l)) : n ? styleText(["strikethrough", "dim"], n) : "";
+          return `${s}${a}`;
+        }
+        default: {
+          const c2 = r ? `${styleText("cyan", $2)}  ` : "", a = r ? styleText("cyan", E2) : "", l = r ? W(t.output, u, c2) : u;
+          return `${s}${l}
+${a}${o}
+`;
+        }
+      }
+    } }).prompt();
     Q2 = (t, r) => t.split(`
 `).map((s) => r(s)).join(`
 `);
     ve = (t) => {
       const r = (i, u) => {
         const n = i.label ?? String(i.value);
-        return u === "disabled" ? `${styleText("gray", J)} ${Q2(n, (o) => styleText(["strikethrough", "gray"], o))}${i.hint ? ` ${styleText("dim", `(${i.hint ?? "disabled"})`)}` : ""}` : u === "active" ? `${styleText("cyan", et2)} ${n}${i.hint ? ` ${styleText("dim", `(${i.hint})`)}` : ""}` : u === "selected" ? `${styleText("green", U)} ${Q2(n, (o) => styleText("dim", o))}${i.hint ? ` ${styleText("dim", `(${i.hint})`)}` : ""}` : u === "cancelled" ? `${Q2(n, (o) => styleText(["strikethrough", "dim"], o))}` : u === "active-selected" ? `${styleText("green", U)} ${n}${i.hint ? ` ${styleText("dim", `(${i.hint})`)}` : ""}` : u === "submitted" ? `${Q2(n, (o) => styleText("dim", o))}` : `${styleText("dim", J)} ${Q2(n, (o) => styleText("dim", o))}`;
+        return u === "disabled" ? `${styleText("gray", J2)} ${Q2(n, (o) => styleText(["strikethrough", "gray"], o))}${i.hint ? ` ${styleText("dim", `(${i.hint ?? "disabled"})`)}` : ""}` : u === "active" ? `${styleText("cyan", et2)} ${n}${i.hint ? ` ${styleText("dim", `(${i.hint})`)}` : ""}` : u === "selected" ? `${styleText("green", U2)} ${Q2(n, (o) => styleText("dim", o))}${i.hint ? ` ${styleText("dim", `(${i.hint})`)}` : ""}` : u === "cancelled" ? `${Q2(n, (o) => styleText(["strikethrough", "dim"], o))}` : u === "active-selected" ? `${styleText("green", U2)} ${n}${i.hint ? ` ${styleText("dim", `(${i.hint})`)}` : ""}` : u === "submitted" ? `${Q2(n, (o) => styleText("dim", o))}` : `${styleText("dim", J2)} ${Q2(n, (o) => styleText("dim", o))}`;
       }, s = t.required ?? true;
       return new nt({ options: t.options, signal: t.signal, input: t.input, output: t.output, initialValues: t.initialValues, required: s, cursorAt: t.cursorAt, validate(i) {
         if (s && (i === void 0 || i.length === 0)) return `Please select at least one option.
 ${styleText("reset", styleText("dim", `Press ${styleText(["gray", "bgWhite", "inverse"], " space ")} to select, ${styleText("gray", styleText("bgWhite", styleText("inverse", " enter ")))} to submit`))}`;
       }, render() {
-        const i = t.withGuide ?? h.withGuide, u = W(t.output, t.message, i ? `${yt(this.state)}  ` : "", `${M(this.state)}  `), n = `${i ? `${styleText("gray", $)}
+        const i = t.withGuide ?? h.withGuide, u = W(t.output, t.message, i ? `${yt(this.state)}  ` : "", `${M(this.state)}  `), n = `${i ? `${styleText("gray", $2)}
 ` : ""}${u}
 `, o = this.value ?? [], c2 = (a, l) => {
           if (a.disabled) return r(a, "disabled");
@@ -6961,18 +8015,18 @@ ${styleText("reset", styleText("dim", `Press ${styleText(["gray", "bgWhite", "in
         };
         switch (this.state) {
           case "submit": {
-            const a = this.options.filter(({ value: d2 }) => o.includes(d2)).map((d2) => r(d2, "submitted")).join(styleText("dim", ", ")) || styleText("dim", "none"), l = W(t.output, a, i ? `${styleText("gray", $)}  ` : "");
+            const a = this.options.filter(({ value: d2 }) => o.includes(d2)).map((d2) => r(d2, "submitted")).join(styleText("dim", ", ")) || styleText("dim", "none"), l = W(t.output, a, i ? `${styleText("gray", $2)}  ` : "");
             return `${n}${l}`;
           }
           case "cancel": {
             const a = this.options.filter(({ value: d2 }) => o.includes(d2)).map((d2) => r(d2, "cancelled")).join(styleText("dim", ", "));
-            if (a.trim() === "") return `${n}${styleText("gray", $)}`;
-            const l = W(t.output, a, i ? `${styleText("gray", $)}  ` : "");
+            if (a.trim() === "") return `${n}${styleText("gray", $2)}`;
+            const l = W(t.output, a, i ? `${styleText("gray", $2)}  ` : "");
             return `${n}${l}${i ? `
-${styleText("gray", $)}` : ""}`;
+${styleText("gray", $2)}` : ""}`;
           }
           case "error": {
-            const a = i ? `${styleText("yellow", $)}  ` : "", l = this.error.split(`
+            const a = i ? `${styleText("yellow", $2)}  ` : "", l = this.error.split(`
 `).map((p2, m) => m === 0 ? `${i ? `${styleText("yellow", E2)}  ` : ""}${styleText("yellow", p2)}` : `   ${p2}`).join(`
 `), d2 = n.split(`
 `).length, y = l.split(`
@@ -6983,7 +8037,7 @@ ${l}
 `;
           }
           default: {
-            const a = i ? `${styleText("cyan", $)}  ` : "", l = n.split(`
+            const a = i ? `${styleText("cyan", $2)}  ` : "", l = n.split(`
 `).length, d2 = i ? 2 : 1;
             return `${n}${a}${Y2({ output: t.output, options: this.options, cursor: this.cursor, maxItems: t.maxItems, columnPadding: a.length, rowPadding: l + d2, style: c2 }).join(`
 ${a}`)}
@@ -7004,97 +8058,120 @@ ${i ? styleText("cyan", E2) : ""}
 `).map(n), ""], c2 = dist_default2(r), a = Math.max(o.reduce((p2, m) => {
         const g = dist_default2(m);
         return g > p2 ? g : p2;
-      }, 0), c2) + 2, l = o.map((p2) => `${styleText("gray", $)}  ${p2}${" ".repeat(a - dist_default2(p2))}${styleText("gray", $)}`).join(`
-`), d2 = u ? `${styleText("gray", $)}
+      }, 0), c2) + 2, l = o.map((p2) => `${styleText("gray", $2)}  ${p2}${" ".repeat(a - dist_default2(p2))}${styleText("gray", $2)}`).join(`
+`), d2 = u ? `${styleText("gray", $2)}
 ` : "", y = u ? xt : dt;
-      i.write(`${d2}${styleText("green", F)}  ${styleText("reset", r)} ${styleText("gray", st.repeat(Math.max(a - c2 - 1, 1)) + ct)}
+      i.write(`${d2}${styleText("green", F2)}  ${styleText("reset", r)} ${styleText("gray", st2.repeat(Math.max(a - c2 - 1, 1)) + ct)}
 ${l}
-${styleText("gray", y + st.repeat(a + 2) + $t)}
+${styleText("gray", y + st2.repeat(a + 2) + $t)}
 `);
     };
     Ce = (t) => new ot({ validate: t.validate, mask: t.mask ?? Gt, signal: t.signal, input: t.input, output: t.output, render() {
-      const r = t.withGuide ?? h.withGuide, s = `${r ? `${styleText("gray", $)}
+      const r = t.withGuide ?? h.withGuide, s = `${r ? `${styleText("gray", $2)}
 ` : ""}${M(this.state)}  ${t.message}
 `, i = this.userInputWithCursor, u = this.masked;
       switch (this.state) {
         case "error": {
-          const n = r ? `${styleText("yellow", $)}  ` : "", o = r ? `${styleText("yellow", E2)}  ` : "", c2 = u ?? "";
+          const n = r ? `${styleText("yellow", $2)}  ` : "", o = r ? `${styleText("yellow", E2)}  ` : "", c2 = u ?? "";
           return t.clearOnError && this.clear(), `${s.trim()}
 ${n}${c2}
 ${o}${styleText("yellow", this.error)}
 `;
         }
         case "submit": {
-          const n = r ? `${styleText("gray", $)}  ` : "", o = u ? styleText("dim", u) : "";
+          const n = r ? `${styleText("gray", $2)}  ` : "", o = u ? styleText("dim", u) : "";
           return `${s}${n}${o}`;
         }
         case "cancel": {
-          const n = r ? `${styleText("gray", $)}  ` : "", o = u ? styleText(["strikethrough", "dim"], u) : "";
+          const n = r ? `${styleText("gray", $2)}  ` : "", o = u ? styleText(["strikethrough", "dim"], u) : "";
           return `${s}${n}${o}${u && r ? `
-${styleText("gray", $)}` : ""}`;
+${styleText("gray", $2)}` : ""}`;
         }
         default: {
-          const n = r ? `${styleText("cyan", $)}  ` : "", o = r ? styleText("cyan", E2) : "";
+          const n = r ? `${styleText("cyan", $2)}  ` : "", o = r ? styleText("cyan", E2) : "";
           return `${s}${n}${i}
 ${o}
 `;
         }
       }
     } }).prompt();
+    Te = (t) => {
+      const r = t.validate;
+      return At({ ...t, initialUserInput: t.initialValue ?? t.root ?? process.cwd(), maxItems: 5, validate(s) {
+        if (!Array.isArray(s)) {
+          if (!s) return "Please select a path";
+          if (r) return r(s);
+        }
+      }, options() {
+        const s = this.userInput;
+        if (s === "") return [];
+        try {
+          let i;
+          existsSync(s) ? lstatSync(s).isDirectory() && (!t.directory || s.endsWith("/")) ? i = s : i = dirname(s) : i = dirname(s);
+          const u = s.length > 1 && s.endsWith("/") ? s.slice(0, -1) : s;
+          return readdirSync(i).map((n) => {
+            const o = join(i, n), c2 = lstatSync(o);
+            return { name: n, path: o, isDirectory: c2.isDirectory() };
+          }).filter(({ path: n, isDirectory: o }) => n.startsWith(u) && (o || !t.directory)).map((n) => ({ value: n.path }));
+        } catch {
+          return [];
+        }
+      } });
+    };
     _e = (t) => styleText("magenta", t);
-    ft = ({ indicator: t = "dots", onCancel: r, output: s = process.stdout, cancelMessage: i, errorMessage: u, frames: n = tt ? ["\u25D2", "\u25D0", "\u25D3", "\u25D1"] : ["\u2022", "o", "O", "0"], delay: o = tt ? 80 : 120, signal: c2, ...a } = {}) => {
+    ft = ({ indicator: t = "dots", onCancel: r, output: s = process.stdout, cancelMessage: i, errorMessage: u, frames: n = tt2 ? ["\u25D2", "\u25D0", "\u25D3", "\u25D1"] : ["\u2022", "o", "O", "0"], delay: o = tt2 ? 80 : 120, signal: c2, ...a } = {}) => {
       const l = at2();
       let d2, y, p2 = false, m = false, g = "", S2, h2 = performance.now();
-      const f = A(s), v2 = a?.styleFrame ?? _e, T = (I) => {
-        const V2 = I > 1 ? u ?? h.messages.error : i ?? h.messages.cancel;
-        m = I === 1, p2 && (W2(V2, I), m && typeof r == "function" && r());
+      const f = A(s), v2 = a?.styleFrame ?? _e, T = (I2) => {
+        const V2 = I2 > 1 ? u ?? h.messages.error : i ?? h.messages.cancel;
+        m = I2 === 1, p2 && (W2(V2, I2), m && typeof r == "function" && r());
       }, C2 = () => T(2), b2 = () => T(1), G2 = () => {
         process.on("uncaughtExceptionMonitor", C2), process.on("unhandledRejection", C2), process.on("SIGINT", b2), process.on("SIGTERM", b2), process.on("exit", T), c2 && c2.addEventListener("abort", b2);
-      }, x = () => {
+      }, x2 = () => {
         process.removeListener("uncaughtExceptionMonitor", C2), process.removeListener("unhandledRejection", C2), process.removeListener("SIGINT", b2), process.removeListener("SIGTERM", b2), process.removeListener("exit", T), c2 && c2.removeEventListener("abort", b2);
       }, A2 = () => {
         if (S2 === void 0) return;
         l && s.write(`
 `);
-        const I = wrapAnsi(S2, f, { hard: true, trim: false }).split(`
+        const I2 = wrapAnsi(S2, f, { hard: true, trim: false }).split(`
 `);
-        I.length > 1 && s.write(import_sisteransi2.cursor.up(I.length - 1)), s.write(import_sisteransi2.cursor.to(0)), s.write(import_sisteransi2.erase.down());
-      }, P = (I) => I.replace(/\.+$/, ""), N = (I) => {
-        const V2 = (performance.now() - I) / 1e3, B = Math.floor(V2 / 60), L2 = Math.floor(V2 % 60);
-        return B > 0 ? `[${B}m ${L2}s]` : `[${L2}s]`;
-      }, D2 = a.withGuide ?? h.withGuide, rt2 = (I = "") => {
-        p2 = true, d2 = R({ output: s }), g = P(I), h2 = performance.now(), D2 && s.write(`${styleText("gray", $)}
+        I2.length > 1 && s.write(import_sisteransi2.cursor.up(I2.length - 1)), s.write(import_sisteransi2.cursor.to(0)), s.write(import_sisteransi2.erase.down());
+      }, P2 = (I2) => I2.replace(/\.+$/, ""), N2 = (I2) => {
+        const V2 = (performance.now() - I2) / 1e3, B2 = Math.floor(V2 / 60), L2 = Math.floor(V2 % 60);
+        return B2 > 0 ? `[${B2}m ${L2}s]` : `[${L2}s]`;
+      }, D2 = a.withGuide ?? h.withGuide, rt2 = (I2 = "") => {
+        p2 = true, d2 = R({ output: s }), g = P2(I2), h2 = performance.now(), D2 && s.write(`${styleText("gray", $2)}
 `);
-        let V2 = 0, B = 0;
+        let V2 = 0, B2 = 0;
         G2(), y = setInterval(() => {
           if (l && g === S2) return;
           A2(), S2 = g;
           const L2 = v2(n[V2]);
-          let Z;
-          if (l) Z = `${L2}  ${g}...`;
-          else if (t === "timer") Z = `${L2}  ${g} ${N(h2)}`;
+          let Z2;
+          if (l) Z2 = `${L2}  ${g}...`;
+          else if (t === "timer") Z2 = `${L2}  ${g} ${N2(h2)}`;
           else {
-            const kt = ".".repeat(Math.floor(B)).slice(0, 3);
-            Z = `${L2}  ${g}${kt}`;
+            const kt = ".".repeat(Math.floor(B2)).slice(0, 3);
+            Z2 = `${L2}  ${g}${kt}`;
           }
-          const Nt = wrapAnsi(Z, f, { hard: true, trim: false });
-          s.write(Nt), V2 = V2 + 1 < n.length ? V2 + 1 : 0, B = B < 4 ? B + 0.125 : 0;
+          const Nt = wrapAnsi(Z2, f, { hard: true, trim: false });
+          s.write(Nt), V2 = V2 + 1 < n.length ? V2 + 1 : 0, B2 = B2 < 4 ? B2 + 0.125 : 0;
         }, o);
-      }, W2 = (I = "", V2 = 0, B = false) => {
+      }, W2 = (I2 = "", V2 = 0, B2 = false) => {
         if (!p2) return;
         p2 = false, clearInterval(y), A2();
-        const L2 = V2 === 0 ? styleText("green", F) : V2 === 1 ? styleText("red", ot2) : styleText("red", ut2);
-        g = I ?? g, B || (t === "timer" ? s.write(`${L2}  ${g} ${N(h2)}
+        const L2 = V2 === 0 ? styleText("green", F2) : V2 === 1 ? styleText("red", ot2) : styleText("red", ut2);
+        g = I2 ?? g, B2 || (t === "timer" ? s.write(`${L2}  ${g} ${N2(h2)}
 `) : s.write(`${L2}  ${g}
-`)), x(), d2();
+`)), x2(), d2();
       };
-      return { start: rt2, stop: (I = "") => W2(I, 0), message: (I = "") => {
-        g = P(I ?? g);
-      }, cancel: (I = "") => W2(I, 1), error: (I = "") => W2(I, 2), clear: () => W2("", 0, true), get isCancelled() {
+      return { start: rt2, stop: (I2 = "") => W2(I2, 0), message: (I2 = "") => {
+        g = P2(I2 ?? g);
+      }, cancel: (I2 = "") => W2(I2, 1), error: (I2 = "") => W2(I2, 2), clear: () => W2("", 0, true), get isCancelled() {
         return m;
       } };
     };
-    ({ light: w2("\u2500", "-"), heavy: w2("\u2501", "="), block: w2("\u2588", "#") });
+    Vt = { light: w2("\u2500", "-"), heavy: w2("\u2501", "="), block: w2("\u2588", "#") };
     it2 = (t, r) => t.includes(`
 `) ? t.split(`
 `).map((s) => r(s)).join(`
@@ -7104,7 +8181,7 @@ ${o}
         const u = s.label ?? String(s.value);
         switch (i) {
           case "disabled":
-            return `${styleText("gray", H)} ${it2(u, (n) => styleText("gray", n))}${s.hint ? ` ${styleText("dim", `(${s.hint ?? "disabled"})`)}` : ""}`;
+            return `${styleText("gray", H2)} ${it2(u, (n) => styleText("gray", n))}${s.hint ? ` ${styleText("dim", `(${s.hint ?? "disabled"})`)}` : ""}`;
           case "selected":
             return `${it2(u, (n) => styleText("dim", n))}`;
           case "active":
@@ -7112,25 +8189,25 @@ ${o}
           case "cancelled":
             return `${it2(u, (n) => styleText(["strikethrough", "dim"], n))}`;
           default:
-            return `${styleText("dim", H)} ${it2(u, (n) => styleText("dim", n))}`;
+            return `${styleText("dim", H2)} ${it2(u, (n) => styleText("dim", n))}`;
         }
       };
       return new ut({ options: t.options, signal: t.signal, input: t.input, output: t.output, initialValue: t.initialValue, render() {
-        const s = t.withGuide ?? h.withGuide, i = `${M(this.state)}  `, u = `${yt(this.state)}  `, n = W(t.output, t.message, u, i), o = `${s ? `${styleText("gray", $)}
+        const s = t.withGuide ?? h.withGuide, i = `${M(this.state)}  `, u = `${yt(this.state)}  `, n = W(t.output, t.message, u, i), o = `${s ? `${styleText("gray", $2)}
 ` : ""}${n}
 `;
         switch (this.state) {
           case "submit": {
-            const c2 = s ? `${styleText("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "selected"), c2);
+            const c2 = s ? `${styleText("gray", $2)}  ` : "", a = W(t.output, r(this.options[this.cursor], "selected"), c2);
             return `${o}${a}`;
           }
           case "cancel": {
-            const c2 = s ? `${styleText("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "cancelled"), c2);
+            const c2 = s ? `${styleText("gray", $2)}  ` : "", a = W(t.output, r(this.options[this.cursor], "cancelled"), c2);
             return `${o}${a}${s ? `
-${styleText("gray", $)}` : ""}`;
+${styleText("gray", $2)}` : ""}`;
           }
           default: {
-            const c2 = s ? `${styleText("cyan", $)}  ` : "", a = s ? styleText("cyan", E2) : "", l = o.split(`
+            const c2 = s ? `${styleText("cyan", $2)}  ` : "", a = s ? styleText("cyan", E2) : "", l = o.split(`
 `).length, d2 = s ? 2 : 1;
             return `${o}${c2}${Y2({ output: t.output, cursor: this.cursor, options: this.options, maxItems: t.maxItems, columnPadding: c2.length, rowPadding: l + d2, style: (y, p2) => r(y, y.disabled ? "disabled" : p2 ? "active" : "inactive") }).join(`
 ${c2}`)}
@@ -7140,30 +8217,157 @@ ${a}
         }
       } }).prompt();
     };
-    `${styleText("gray", $)}  `;
+    Ge = (t) => {
+      const r = (s, i = "inactive") => {
+        const u = s.label ?? String(s.value);
+        return i === "selected" ? `${styleText("dim", u)}` : i === "cancelled" ? `${styleText(["strikethrough", "dim"], u)}` : i === "active" ? `${styleText(["bgCyan", "gray"], ` ${s.value} `)} ${u}${s.hint ? ` ${styleText("dim", `(${s.hint})`)}` : ""}` : `${styleText(["gray", "bgWhite", "inverse"], ` ${s.value} `)} ${u}${s.hint ? ` ${styleText("dim", `(${s.hint})`)}` : ""}`;
+      };
+      return new at({ options: t.options, signal: t.signal, input: t.input, output: t.output, initialValue: t.initialValue, caseSensitive: t.caseSensitive, render() {
+        const s = t.withGuide ?? h.withGuide, i = `${s ? `${styleText("gray", $2)}
+` : ""}${M(this.state)}  ${t.message}
+`;
+        switch (this.state) {
+          case "submit": {
+            const u = s ? `${styleText("gray", $2)}  ` : "", n = this.options.find((c2) => c2.value === this.value) ?? t.options[0], o = W(t.output, r(n, "selected"), u);
+            return `${i}${o}`;
+          }
+          case "cancel": {
+            const u = s ? `${styleText("gray", $2)}  ` : "", n = W(t.output, r(this.options[0], "cancelled"), u);
+            return `${i}${n}${s ? `
+${styleText("gray", $2)}` : ""}`;
+          }
+          default: {
+            const u = s ? `${styleText("cyan", $2)}  ` : "", n = s ? styleText("cyan", E2) : "", o = this.options.map((c2, a) => W(t.output, r(c2, a === this.cursor ? "active" : "inactive"), u)).join(`
+`);
+            return `${i}${o}
+${n}
+`;
+          }
+        }
+      } }).prompt();
+    };
+    jt = `${styleText("gray", $2)}  `;
+    K2 = { message: async (t, { symbol: r = styleText("gray", $2) } = {}) => {
+      process.stdout.write(`${styleText("gray", $2)}
+${r}  `);
+      let s = 3;
+      for await (let i of t) {
+        i = i.replace(/\n/g, `
+${jt}`), i.includes(`
+`) && (s = 3 + stripVTControlCharacters(i.slice(i.lastIndexOf(`
+`))).length);
+        const u = stripVTControlCharacters(i).length;
+        s + u < process.stdout.columns ? (s += u, process.stdout.write(i)) : (process.stdout.write(`
+${jt}${i.trimStart()}`), s = 3 + stripVTControlCharacters(i.trimStart()).length);
+      }
+      process.stdout.write(`
+`);
+    }, info: (t) => K2.message(t, { symbol: styleText("blue", ht2) }), success: (t) => K2.message(t, { symbol: styleText("green", pt) }), step: (t) => K2.message(t, { symbol: styleText("green", F2) }), warn: (t) => K2.message(t, { symbol: styleText("yellow", mt) }), warning: (t) => K2.warn(t), error: (t) => K2.message(t, { symbol: styleText("red", gt) }) };
+    xe = async (t, r) => {
+      for (const s of t) {
+        if (s.enabled === false) continue;
+        const i = ft(r);
+        i.start(s.title);
+        const u = await s.task(i.message);
+        i.stop(u || s.title);
+      }
+    };
+    Oe = (t) => t.replace(/\x1b\[(?:\d+;)*\d*[ABCDEFGHfJKSTsu]|\x1b\[(s|u)/g, "");
+    Me = (t) => {
+      const r = t.output ?? process.stdout, s = A(r), i = styleText("gray", $2), u = t.spacing ?? 1, n = 3, o = t.retainLog === true, c2 = !at2() && Tt(r);
+      r.write(`${i}
+`), r.write(`${styleText("green", F2)}  ${t.title}
+`);
+      for (let h2 = 0; h2 < u; h2++) r.write(`${i}
+`);
+      const a = [{ value: "", full: "" }];
+      let l = false;
+      const d2 = (h2) => {
+        if (a.length === 0) return;
+        let f = 0;
+        h2 && (f += u + 2);
+        for (const v2 of a) {
+          const { value: T, result: C2 } = v2;
+          let b2 = C2?.message ?? T;
+          if (b2.length === 0) continue;
+          C2 === void 0 && v2.header !== void 0 && v2.header !== "" && (b2 += `
+${v2.header}`);
+          const G2 = b2.split(`
+`).reduce((x2, A2) => A2 === "" ? x2 + 1 : x2 + Math.ceil((A2.length + n) / s), 0);
+          f += G2;
+        }
+        f > 0 && (f += 1, r.write(import_sisteransi2.erase.lines(f)));
+      }, y = (h2, f, v2) => {
+        const T = v2 ? `${h2.full}
+${h2.value}` : h2.value;
+        h2.header !== void 0 && h2.header !== "" && R2.message(h2.header.split(`
+`).map((C2) => styleText("bold", C2)), { output: r, secondarySymbol: i, symbol: i, spacing: 0 }), R2.message(T.split(`
+`).map((C2) => styleText("dim", C2)), { output: r, secondarySymbol: i, symbol: i, spacing: f ?? u });
+      }, p2 = () => {
+        for (const h2 of a) {
+          const { header: f, value: v2, full: T } = h2;
+          (f === void 0 || f.length === 0) && v2.length === 0 || y(h2, void 0, o === true && T.length > 0);
+        }
+      }, m = (h2, f, v2) => {
+        if (d2(false), (v2?.raw !== true || !l) && h2.value !== "" && (h2.value += `
+`), h2.value += Oe(f), l = v2?.raw === true, t.limit !== void 0) {
+          const T = h2.value.split(`
+`), C2 = T.length - t.limit;
+          if (C2 > 0) {
+            const b2 = T.splice(0, C2);
+            o && (h2.full += (h2.full === "" ? "" : `
+`) + b2.join(`
+`));
+          }
+          h2.value = T.join(`
+`);
+        }
+        c2 && g();
+      }, g = () => {
+        for (const h2 of a) h2.result ? h2.result.status === "error" ? R2.error(h2.result.message, { output: r, secondarySymbol: i, spacing: 0 }) : R2.success(h2.result.message, { output: r, secondarySymbol: i, spacing: 0 }) : h2.value !== "" && y(h2, 0);
+      }, S2 = (h2, f) => {
+        d2(false), h2.result = f, c2 && g();
+      };
+      return { message(h2, f) {
+        m(a[0], h2, f);
+      }, group(h2) {
+        const f = { header: h2, value: "", full: "" };
+        return a.push(f), { message(v2, T) {
+          m(f, v2, T);
+        }, error(v2) {
+          S2(f, { status: "error", message: v2 });
+        }, success(v2) {
+          S2(f, { status: "success", message: v2 });
+        } };
+      }, error(h2, f) {
+        d2(true), R2.error(h2, { output: r, secondarySymbol: i, spacing: 1 }), f?.showLog !== false && p2(), a.splice(1, a.length - 1), a[0].value = "", a[0].full = "";
+      }, success(h2, f) {
+        d2(true), R2.success(h2, { output: r, secondarySymbol: i, spacing: 1 }), f?.showLog === true && p2(), a.splice(1, a.length - 1), a[0].value = "", a[0].full = "";
+      } };
+    };
     Re = (t) => new ht({ validate: t.validate, placeholder: t.placeholder, defaultValue: t.defaultValue, initialValue: t.initialValue, output: t.output, signal: t.signal, input: t.input, render() {
-      const r = t?.withGuide ?? h.withGuide, s = `${`${r ? `${styleText("gray", $)}
+      const r = t?.withGuide ?? h.withGuide, s = `${`${r ? `${styleText("gray", $2)}
 ` : ""}${M(this.state)}  `}${t.message}
 `, i = t.placeholder ? styleText("inverse", t.placeholder[0]) + styleText("dim", t.placeholder.slice(1)) : styleText(["inverse", "hidden"], "_"), u = this.userInput ? this.userInputWithCursor : i, n = this.value ?? "";
       switch (this.state) {
         case "error": {
-          const o = this.error ? `  ${styleText("yellow", this.error)}` : "", c2 = r ? `${styleText("yellow", $)}  ` : "", a = r ? styleText("yellow", E2) : "";
+          const o = this.error ? `  ${styleText("yellow", this.error)}` : "", c2 = r ? `${styleText("yellow", $2)}  ` : "", a = r ? styleText("yellow", E2) : "";
           return `${s.trim()}
 ${c2}${u}
 ${a}${o}
 `;
         }
         case "submit": {
-          const o = n ? `  ${styleText("dim", n)}` : "", c2 = r ? styleText("gray", $) : "";
+          const o = n ? `  ${styleText("dim", n)}` : "", c2 = r ? styleText("gray", $2) : "";
           return `${s}${c2}${o}`;
         }
         case "cancel": {
-          const o = n ? `  ${styleText(["strikethrough", "dim"], n)}` : "", c2 = r ? styleText("gray", $) : "";
+          const o = n ? `  ${styleText(["strikethrough", "dim"], n)}` : "", c2 = r ? styleText("gray", $2) : "";
           return `${s}${c2}${o}${n.trim() ? `
 ${c2}` : ""}`;
         }
         default: {
-          const o = r ? `${styleText("cyan", $)}  ` : "", c2 = r ? styleText("cyan", E2) : "";
+          const o = r ? `${styleText("cyan", $2)}  ` : "", c2 = r ? styleText("cyan", E2) : "";
           return `${s}${o}${u}
 ${c2}
 `;
@@ -7172,212 +8376,8 @@ ${c2}
     } }).prompt();
   }
 });
-function aiContextBody() {
-  return `## keynv (secrets)
-
-This project uses [keynv](https://keynv.dev) for secrets. There is a \`.keynv.env\` file at the project root containing **alias references** like \`OPENAI_API_KEY=@projectname.dev.openai-key\` \u2014 these are NOT real values, they are references to secrets stored in the keynv vault.
 
-### Mental model
-
-- **\`.keynv.env\`** \u2014 checked into git, contains aliases. Safe to read, edit, commit.
-- **Vault** \u2014 holds the real values. The \`keynv\` CLI reads it on demand.
-- **\`keynv exec -- <command>\`** \u2014 forks the command in a subprocess where the real values are injected into env vars. The parent process (where you, the AI agent, run) NEVER sees the real values.
-- **Redactor** \u2014 pipes subprocess stdout/stderr through a masker before they reach this terminal. Even if a script accidentally echoes a secret, you see \`<REDACTED:...>\` here.
-
-### What you should do
-
-When the user asks about secrets or env vars, follow this decision tree:
-
-| User intent | Run / suggest |
-|---|---|
-| "Add a new API key" / "set up a secret" | \`keynv secret create\` (interactive prompt picks project + env + key) |
-| "I have a \`.env\`, migrate it" | \`keynv init\` (you're seeing this file because that already happened) |
-| "Run the app / dev server / tests" | \`keynv exec -- <their existing command>\` (auto-loads \`.keynv.env\`) |
-| "Show me the value of X" | \`keynv secret get @alias\` \u2014 but copy to clipboard, do NOT print the value into chat / terminal |
-| "Rotate this key" | \`keynv secret rotate @alias\` |
-| "Add a new env var to the project" | Edit \`.keynv.env\` and add \`NAME=@project.env.key\` (after creating the secret with \`keynv secret create\`) |
-| "Who has access?" | \`keynv member list <project>\` |
-
-### Hard rules \u2014 do not violate
-
-1. **Never print resolved secret values** to the chat, terminal, log, or any file. The user's editor / scrollback / chat history is an attack surface.
-2. **Never write a \`.env\` file** (or any file) containing real secret values. The whole point of keynv is that those don't exist on disk.
-3. **Never edit \`.keynv.env\` to substitute resolved values for aliases.** The file should only ever contain \`@project.env.key\` references and plain non-secret literals.
-4. **Use \`keynv exec --\` to run commands that need env vars.** Don't try to load \`.keynv.env\` yourself by parsing it manually; the wrapper handles resolution + redaction + subprocess isolation.
-5. **If a tool fails with "blocked by keynv-guard" or similar**, do NOT try to work around it. Tell the user \u2014 that's a sign of a misconfiguration, not an obstacle to bypass.
-6. **Treat the alias literal (\`@project.env.key\`) as the canonical reference**, never the resolved value. When you write code, configs, or commands that need a secret, write the alias.
-
-### Quick reference
-
-\`\`\`bash
-keynv                       # interactive TUI menu (pick projects, secrets, members)
-keynv exec -- <cmd>         # run cmd with .keynv.env loaded
-keynv secret create         # walk through creating a new secret
-keynv secret list <project> # list aliases (no values)
-keynv whoami                # who am I logged in as
-keynv --help                # full command list
-\`\`\`
-
-If \`.keynv.env\` is missing or empty, the user probably hasn't run \`keynv init\` yet \u2014 suggest they do so before they paste a secret into a \`.env\`.`;
-}
-function renderKeynvBlock() {
-  return `${KEYNV_BLOCK_START}
-${aiContextBody()}
-${KEYNV_BLOCK_END}`;
-}
-function writeAiContext(rootPath) {
-  const path = join(rootPath, AGENTS_FILE_BASENAME);
-  const block = renderKeynvBlock();
-  if (!existsSync(path)) {
-    const initial = `# Agent guidance for this project
-
-${block}
-`;
-    writeFileSync(path, initial);
-    return "created";
-  }
-  const existing = readFileSync(path, "utf8");
-  const startIdx = existing.indexOf(KEYNV_BLOCK_START);
-  const endIdx = existing.indexOf(KEYNV_BLOCK_END);
-  if (startIdx >= 0 && endIdx > startIdx) {
-    const before = existing.slice(0, startIdx);
-    const after = existing.slice(endIdx + KEYNV_BLOCK_END.length);
-    const next = `${before}${block}${after}`;
-    if (next === existing) return "unchanged";
-    writeFileSync(path, next);
-    return "updated";
-  }
-  const sep = existing.length === 0 ? "" : existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
-  const trailingNewline = existing.endsWith("\n") ? "" : "\n";
-  writeFileSync(path, `${existing}${trailingNewline}${sep}${block}
-`);
-  return "appended";
-}
-var AGENTS_FILE_BASENAME, KEYNV_BLOCK_START, KEYNV_BLOCK_END;
-var init_aiContext = __esm({
-  "src/init/aiContext.ts"() {
-    AGENTS_FILE_BASENAME = "AGENTS.md";
-    KEYNV_BLOCK_START = "<!-- keynv:start -- generated by `keynv init`; safe to leave intact, will be refreshed on re-run -->";
-    KEYNV_BLOCK_END = "<!-- keynv:end -->";
-  }
-});
-function findProjectRoot(startDir) {
-  const result = walkUp(startDir, (dir) => {
-    for (const marker of PROJECT_MARKERS) {
-      if (existsSync(join(dir, marker))) {
-        return { dir, marker };
-      }
-    }
-    if (existsSync(join(dir, GIT_MARKER))) {
-      return { dir, marker: GIT_MARKER };
-    }
-    return null;
-  });
-  if (!result) return null;
-  return buildRoot(result.dir, result.marker);
-}
-function buildRoot(dir, marker) {
-  let suggestedName = basename(dir);
-  let scripts = null;
-  let invalid = false;
-  if (marker === "package.json" || existsSync(join(dir, "package.json"))) {
-    try {
-      const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
-      if (typeof pkg.name === "string" && pkg.name.length > 0) {
-        suggestedName = pkg.name.replace(/^@[^/]+\//, "");
-      }
-      if (pkg.scripts && typeof pkg.scripts === "object") {
-        scripts = Object.fromEntries(
-          Object.entries(pkg.scripts).filter(([, v2]) => typeof v2 === "string")
-        );
-      }
-    } catch {
-      invalid = true;
-    }
-  }
-  return {
-    path: dir,
-    suggestedName,
-    marker,
-    packageJsonScripts: scripts,
-    packageJsonInvalid: invalid
-  };
-}
-function findEnvFiles(rootDir) {
-  let entries;
-  try {
-    entries = readdirSync(rootDir);
-  } catch {
-    return [];
-  }
-  const hits = [];
-  for (const name of entries) {
-    if (!ENV_GLOB.test(name)) continue;
-    if (ENV_EXAMPLE.test(name)) continue;
-    if (name === KEYNV_ENV_BASENAME) continue;
-    const full = join(rootDir, name);
-    try {
-      if (!statSync(full).isFile()) continue;
-    } catch {
-      continue;
-    }
-    const suffixMatch = name.match(/^\.env\.(.+)$/);
-    const suffix = suffixMatch ? suffixMatch[1] : null;
-    hits.push({ path: full, name, suffix, suggestedEnv: suggestedEnvForSuffix(suffix) });
-  }
-  hits.sort((a, b2) => {
-    if (a.suffix === null) return -1;
-    if (b2.suffix === null) return 1;
-    return a.name.localeCompare(b2.name);
-  });
-  return hits;
-}
-function suggestedEnvForSuffix(suffix) {
-  if (suffix === null) return "dev";
-  switch (suffix) {
-    case "local":
-    case "development":
-    case "dev":
-      return "dev";
-    case "production":
-    case "prod":
-      return "prod";
-    case "staging":
-    case "stage":
-      return "staging";
-    case "test":
-      return "test";
-    case "preview":
-      return "preview";
-    default:
-      return suffix;
-  }
-}
-function hasExistingKeynvEnv(rootDir) {
-  return existsSync(join(rootDir, KEYNV_ENV_BASENAME));
-}
-var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME;
-var init_detect = __esm({
-  "src/init/detect.ts"() {
-    init_fs();
-    PROJECT_MARKERS = [
-      "package.json",
-      "pyproject.toml",
-      "Cargo.toml",
-      "go.mod",
-      "pnpm-workspace.yaml",
-      "deno.json",
-      "deno.jsonc",
-      "requirements.txt"
-    ];
-    GIT_MARKER = ".git";
-    ENV_GLOB = /^\.env(\.[A-Za-z0-9_-]+)?$/;
-    ENV_EXAMPLE = /^\.env\.(example|sample|template|dist|defaults)$/;
-    KEYNV_ENV_BASENAME = ".keynv.env";
-  }
-});
-
-// src/init/scriptWrap.ts
+// src/init/script-wrap.ts
 function analyzeScript(name, command) {
   const trimmed = command.trim();
   if (trimmed.startsWith("keynv ") || trimmed.startsWith("keynv	")) {
@@ -7482,8 +8482,8 @@ function applyWraps(original, selectedScriptNames) {
   return out;
 }
 var KEYNV_PREFIX, ENV_AWARE_TOOLS, NON_ENV_TOOLS;
-var init_scriptWrap = __esm({
-  "src/init/scriptWrap.ts"() {
+var init_script_wrap = __esm({
+  "src/init/script-wrap.ts"() {
     KEYNV_PREFIX = "keynv exec --";
     ENV_AWARE_TOOLS = /* @__PURE__ */ new Set([
       "node",
@@ -7596,6 +8596,14 @@ __export(init_exports, {
   UserCancelled: () => UserCancelled,
   runInitFlow: () => runInitFlow
 });
+function toAliasKey(name) {
+  if (!name) return name;
+  const KEY_RE3 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+  if (KEY_RE3.test(name)) return name;
+  const normalised = name.toLowerCase().replace(/_/g, "-");
+  if (KEY_RE3.test(normalised)) return normalised;
+  return normalised.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64) || "key";
+}
 async function runInitFlow(client, opts) {
   ge("keynv init");
   const root = findProjectRoot(opts.cwd);
@@ -7754,13 +8762,13 @@ ${detail}`
         if (!selected.has(`${env2}|${e2.name}`)) continue;
         i++;
         s.message(`Uploading (${i}/${totalToUpload}) [${env2}] ${e2.name}`);
-        const aliasKey = e2.name.toLowerCase().replace(/_/g, "-");
+        const aliasKey = toAliasKey(e2.name);
         try {
           await client.request(`/v1/projects/${projectId2}/secrets`, {
             method: "POST",
             body: { env: env2, key: aliasKey, value: e2.value }
           });
-          const alias2 = buildAlias({
+          const alias2 = reference_exports.buildAlias({
             project: projectChoice.name,
             environment: env2,
             key: aliasKey
@@ -7812,6 +8820,30 @@ ${detail}`
     R2.error(`Failed to write .keynv.env: ${err instanceof Error ? err.message : String(err)}`);
     return { exitCode: 1 };
   }
+  const otherEnvsWithAliases = distinctEnvs.filter(
+    (env2) => env2 !== defaultEnv && (uploadedByEnv.get(env2)?.size ?? 0) > 0
+  );
+  for (const env2 of otherEnvsWithAliases) {
+    const envUploaded = uploadedByEnv.get(env2) ?? /* @__PURE__ */ new Map();
+    const envLiterals = (perEnv.get(env2) ?? []).filter((e2) => !selected.has(`${env2}|${e2.name}`));
+    const envFilePath = join(root.path, `.keynv.${env2}.env`);
+    try {
+      const lines = composeKeynvEnv({
+        uploadedAliases: envUploaded,
+        literals: envLiterals,
+        mergeWithExisting: null
+      });
+      writeFileSync(envFilePath, `${lines.join("\n")}
+`);
+      R2.success(
+        `Wrote .keynv.${env2}.env (${envUploaded.size} secret alias${envUploaded.size === 1 ? "" : "es"} from "${env2}")`
+      );
+    } catch (err) {
+      R2.warn(
+        `Could not write .keynv.${env2}.env: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
   try {
     const outcome = writeAiContext(root.path);
     if (outcome === "created") R2.success("Wrote AGENTS.md (so AI agents understand keynv)");
@@ -7848,7 +8880,8 @@ ${detail}`
   if (otherEnvs.length > 0) {
     const lines = otherEnvs.map((env2) => {
       const count = uploadedByEnv.get(env2)?.size ?? 0;
-      return `  ${env2}: ${count} secret${count === 1 ? "" : "s"} in vault (use \`keynv exec --from .keynv.${env2}.env -- <cmd>\` after creating that file)`;
+      const hasFile = count > 0;
+      return hasFile ? `  ${env2}: ${count} secret${count === 1 ? "" : "s"} \u2192 .keynv.${env2}.env (use \`keynv exec --from .keynv.${env2}.env -- <cmd>\`)` : `  ${env2}: 0 secrets in vault (no alias file written)`;
     });
     Se(lines.join("\n"), "Secrets in other envs");
   }
@@ -8076,10 +9109,10 @@ var init_init = __esm({
     init_dist5();
     init_dist();
     init_envFile();
-    init_aiContext();
+    init_ai_context();
     init_detect();
     init_heuristics();
-    init_scriptWrap();
+    init_script_wrap();
     init_cancel();
     init_pickProject();
   }
@@ -8098,7 +9131,7 @@ var init_tty = __esm({
   }
 });
 function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 async function errorMessage(res, fallback) {
   const text = await res.text();
@@ -8110,7 +9143,16 @@ async function errorMessage(res, fallback) {
     return fallback;
   }
 }
+function isSafeUrl(urlStr) {
+  try {
+    const parsed = new URL(urlStr);
+    return parsed.protocol === "https:" || parsed.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
 function openBrowser(url) {
+  if (!isSafeUrl(url)) return false;
   try {
     const os = platform();
     const command = os === "win32" ? "cmd" : os === "darwin" ? "open" : "xdg-open";
@@ -8296,7 +9338,7 @@ async function runSecretMenu(client, project, alias2) {
         ]
       })
     );
-    const parsed = parseAlias(alias2);
+    const parsed = reference_exports.parseAlias(alias2);
     if (!parsed) {
       R2.warn(`unparseable alias: ${alias2}`);
       return;
@@ -8340,16 +9382,16 @@ async function runSecretMenu(client, project, alias2) {
 async function copyToClipboard(value) {
   const platform2 = process.platform;
   const cmd = platform2 === "darwin" ? ["pbcopy", []] : platform2 === "win32" ? ["clip", []] : ["xclip", ["-selection", "clipboard"]];
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     try {
       const child = spawn(cmd[0], cmd[1], {
         stdio: ["pipe", "ignore", "ignore"]
       });
-      child.on("error", () => resolve3(false));
-      child.on("exit", (code) => resolve3(code === 0));
+      child.on("error", () => resolve4(false));
+      child.on("exit", (code) => resolve4(code === 0));
       child.stdin.end(value);
     } catch {
-      resolve3(false);
+      resolve4(false);
     }
   });
 }
@@ -8380,14 +9422,14 @@ async function promptNewSecret(client, project) {
       }
     }
   );
-  const built = buildAlias({ project: target.name, environment: env2, key: answers.key });
+  const built = reference_exports.buildAlias({ project: target.name, environment: env2, key: answers.key });
   if (!built) return null;
   return { alias: built.literal, value: answers.value };
 }
 async function createSecretInteractive(client, project) {
   const built = await promptNewSecret(client, project);
   if (!built) return;
-  const parsed = parseAlias(built.alias);
+  const parsed = reference_exports.parseAlias(built.alias);
   if (!parsed) {
     R2.warn("Invalid alias produced by form; aborting.");
     return;
@@ -14230,8 +15272,8 @@ var require_umd = __commonJS({
           if (this.unsigned) return this;
           return fromBits(this.low, this.high, true);
         };
-        LongPrototype.toBytes = function toBytes(le) {
-          return le ? this.toBytesLE() : this.toBytesBE();
+        LongPrototype.toBytes = function toBytes(le2) {
+          return le2 ? this.toBytesLE() : this.toBytesBE();
         };
         LongPrototype.toBytesLE = function toBytesLE() {
           var hi = this.high, lo = this.low;
@@ -14259,8 +15301,8 @@ var require_umd = __commonJS({
             lo & 255
           ];
         };
-        Long.fromBytes = function fromBytes(bytes, unsigned, le) {
-          return le ? Long.fromBytesLE(bytes, unsigned) : Long.fromBytesBE(bytes, unsigned);
+        Long.fromBytes = function fromBytes(bytes, unsigned, le2) {
+          return le2 ? Long.fromBytesLE(bytes, unsigned) : Long.fromBytesBE(bytes, unsigned);
         };
         Long.fromBytesLE = function fromBytesLE(bytes, unsigned) {
           return new Long(
@@ -18396,7 +19438,7 @@ var require_packet = __commonJS({
           let y = 0;
           let m = 0;
           let d2 = 0;
-          let H2 = 0;
+          let H3 = 0;
           let M2 = 0;
           let S2 = 0;
           let ms = 0;
@@ -18406,20 +19448,20 @@ var require_packet = __commonJS({
             d2 = this.readInt8();
           }
           if (length > 6) {
-            H2 = this.readInt8();
+            H3 = this.readInt8();
             M2 = this.readInt8();
             S2 = this.readInt8();
           }
           if (length > 10) {
             ms = this.readInt32() / 1e3;
           }
-          if (y + m + d2 + H2 + M2 + S2 + ms === 0) {
+          if (y + m + d2 + H3 + M2 + S2 + ms === 0) {
             return INVALID_DATE;
           }
           if (timezone === "Z") {
-            return new Date(Date.UTC(y, m - 1, d2, H2, M2, S2, ms));
+            return new Date(Date.UTC(y, m - 1, d2, H3, M2, S2, ms));
           }
-          return new Date(y, m - 1, d2, H2, M2, S2, ms);
+          return new Date(y, m - 1, d2, H3, M2, S2, ms);
         }
         let str = this.readDateTimeString(6, "T", null);
         if (!str) {
@@ -18435,7 +19477,7 @@ var require_packet = __commonJS({
         let y = 0;
         let m = 0;
         let d2 = 0;
-        let H2 = 0;
+        let H3 = 0;
         let M2 = 0;
         let S2 = 0;
         let ms = 0;
@@ -18447,11 +19489,11 @@ var require_packet = __commonJS({
           str = [leftPad(4, y), leftPad(2, m), leftPad(2, d2)].join("-");
         }
         if (length > 6) {
-          H2 = this.readInt8();
+          H3 = this.readInt8();
           M2 = this.readInt8();
           S2 = this.readInt8();
           str += `${timeSep || " "}${[
-            leftPad(2, H2),
+            leftPad(2, H3),
             leftPad(2, M2),
             leftPad(2, S2)
           ].join(":")}`;
@@ -18479,13 +19521,13 @@ var require_packet = __commonJS({
         }
         const sign = this.readInt8() ? -1 : 1;
         let d2 = 0;
-        let H2 = 0;
+        let H3 = 0;
         let M2 = 0;
         let S2 = 0;
         let ms = 0;
         if (length > 6) {
           d2 = this.readInt32();
-          H2 = this.readInt8();
+          H3 = this.readInt8();
           M2 = this.readInt8();
           S2 = this.readInt8();
         }
@@ -18493,14 +19535,14 @@ var require_packet = __commonJS({
           ms = this.readInt32();
         }
         if (convertTtoMs) {
-          H2 += d2 * 24;
-          M2 += H2 * 60;
+          H3 += d2 * 24;
+          M2 += H3 * 60;
           S2 += M2 * 60;
           ms += S2 * 1e3;
           ms *= sign;
           return ms;
         }
-        return (sign === -1 ? "-" : "") + [leftPad(2, d2 * 24 + H2), leftPad(2, M2), leftPad(2, S2)].join(":") + (ms ? `.${ms}`.replace(/0+$/, "") : "");
+        return (sign === -1 ? "-" : "") + [leftPad(2, d2 * 24 + H3), leftPad(2, M2), leftPad(2, S2)].join(":") + (ms ? `.${ms}`.replace(/0+$/, "") : "");
       }
       readLengthCodedString(encoding) {
         const len = this.readLengthCodedNumber();
@@ -18638,7 +19680,7 @@ var require_packet = __commonJS({
         }
         const bufferLength = buffer.length;
         function parseGeometry() {
-          let x, y, i, j3, numPoints, numRings, num, line;
+          let x2, y, i, j3, numPoints, numRings, num, line;
           let result = null;
           if (offset + 5 > bufferLength) {
             return null;
@@ -18652,11 +19694,11 @@ var require_packet = __commonJS({
               if (offset + 16 > bufferLength) {
                 return null;
               }
-              x = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
+              x2 = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
               offset += 8;
               y = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
               offset += 8;
-              result = { x, y };
+              result = { x: x2, y };
               break;
             case 2:
               if (offset + 4 > bufferLength) {
@@ -18672,11 +19714,11 @@ var require_packet = __commonJS({
                 if (offset + 16 > bufferLength) {
                   break;
                 }
-                x = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
+                x2 = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
                 offset += 8;
                 y = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
                 offset += 8;
-                result.push({ x, y });
+                result.push({ x: x2, y });
               }
               break;
             case 3:
@@ -18700,11 +19742,11 @@ var require_packet = __commonJS({
                   if (offset + 16 > bufferLength) {
                     break;
                   }
-                  x = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
+                  x2 = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
                   offset += 8;
                   y = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
                   offset += 8;
-                  line.push({ x, y });
+                  line.push({ x: x2, y });
                 }
                 result.push(line);
               }
@@ -25095,7 +26137,7 @@ var require_named_placeholders = __commonJS({
         }
         return s;
       }
-      function join6(tree) {
+      function join8(tree) {
         if (tree.length === 1) {
           return tree;
         }
@@ -25121,7 +26163,7 @@ var require_named_placeholders = __commonJS({
         if (cache2 && (tree = cache2.get(query))) {
           return toArrayParams(tree, paramsObj);
         }
-        tree = join6(parse(query));
+        tree = join8(parse(query));
         if (cache2) {
           cache2.set(query, tree);
         }
@@ -25277,11 +26319,11 @@ var require_connection = __commonJS({
             const config = this.config;
             tracePromise(
               connectChannel,
-              () => new Promise((resolve3, reject) => {
+              () => new Promise((resolve4, reject) => {
                 let onConnect, onError;
                 onConnect = (param) => {
                   this.removeListener("error", onError);
-                  resolve3(param);
+                  resolve4(param);
                 };
                 onError = (err) => {
                   this.removeListener("connect", onConnect);
@@ -25706,9 +26748,9 @@ var require_connection = __commonJS({
         } else if (shouldTrace(queryChannel)) {
           tracePromise(
             queryChannel,
-            () => new Promise((resolve3, reject) => {
+            () => new Promise((resolve4, reject) => {
               cmdQuery.once("error", reject);
-              cmdQuery.once("end", () => resolve3());
+              cmdQuery.once("end", () => resolve4());
               this.addCommand(cmdQuery);
             }),
             () => {
@@ -25855,12 +26897,12 @@ var require_connection = __commonJS({
         } else if (shouldTrace(executeChannel)) {
           tracePromise(
             executeChannel,
-            () => new Promise((resolve3, reject) => {
+            () => new Promise((resolve4, reject) => {
               prepareAndExecute((err) => {
                 executeCommand.emit("error", err);
               });
               executeCommand.once("error", reject);
-              executeCommand.once("end", () => resolve3());
+              executeCommand.once("end", () => resolve4());
             }),
             () => {
               const server = getServerContext(this.config);
@@ -26125,13 +27167,13 @@ var require_capture_local_err = __commonJS({
 var require_make_done_cb = __commonJS({
   "../../node_modules/.pnpm/mysql2@3.22.3_@types+node@24.12.3/node_modules/mysql2/lib/promise/make_done_cb.js"(exports, module) {
     var { applyCapturedStack } = require_capture_local_err();
-    function makeDoneCb(resolve3, reject, stackHolder) {
+    function makeDoneCb(resolve4, reject, stackHolder) {
       return function(err, rows, fields) {
         if (err) {
           applyCapturedStack(err, stackHolder);
           reject(err);
         } else {
-          resolve3([rows, fields]);
+          resolve4([rows, fields]);
         }
       };
     }
@@ -26154,8 +27196,8 @@ var require_prepared_statement_info = __commonJS({
         const stackHolder = captureStackHolder(
           _PromisePreparedStatementInfo.prototype.execute
         );
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           if (parameters) {
             s.execute(parameters, done);
           } else {
@@ -26164,9 +27206,9 @@ var require_prepared_statement_info = __commonJS({
         });
       }
       close() {
-        return new this.Promise((resolve3) => {
+        return new this.Promise((resolve4) => {
           this.statement.close();
-          resolve3();
+          resolve4();
         });
       }
     };
@@ -26237,8 +27279,8 @@ var require_connection2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           if (params !== void 0) {
             c2.query(query, params, done);
           } else {
@@ -26254,8 +27296,8 @@ var require_connection2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           if (params !== void 0) {
             c2.execute(query, params, done);
           } else {
@@ -26264,8 +27306,8 @@ var require_connection2 = __commonJS({
         });
       }
       end() {
-        return new this.Promise((resolve3) => {
-          this.connection.end(resolve3);
+        return new this.Promise((resolve4) => {
+          this.connection.end(resolve4);
         });
       }
       async [Symbol.asyncDispose]() {
@@ -26278,16 +27320,16 @@ var require_connection2 = __commonJS({
         const stackHolder = captureStackHolder(
           _PromiseConnection.prototype.beginTransaction
         );
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           c2.beginTransaction(done);
         });
       }
       commit() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.commit);
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           c2.commit(done);
         });
       }
@@ -26296,21 +27338,21 @@ var require_connection2 = __commonJS({
         const stackHolder = captureStackHolder(
           _PromiseConnection.prototype.rollback
         );
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           c2.rollback(done);
         });
       }
       ping() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.ping);
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           c2.ping((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve3(true);
+              resolve4(true);
             }
           });
         });
@@ -26318,13 +27360,13 @@ var require_connection2 = __commonJS({
       reset() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.reset);
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           c2.reset((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve3();
+              resolve4();
             }
           });
         });
@@ -26332,13 +27374,13 @@ var require_connection2 = __commonJS({
       connect() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.connect);
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           c2.connect((err, param) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve3(param);
+              resolve4(param);
             }
           });
         });
@@ -26347,7 +27389,7 @@ var require_connection2 = __commonJS({
         const c2 = this.connection;
         const promiseImpl = this.Promise;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.prepare);
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           c2.prepare(options, (err, statement) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
@@ -26357,7 +27399,7 @@ var require_connection2 = __commonJS({
                 statement,
                 promiseImpl
               );
-              resolve3(wrappedStatement);
+              resolve4(wrappedStatement);
             }
           });
         });
@@ -26367,13 +27409,13 @@ var require_connection2 = __commonJS({
         const stackHolder = captureStackHolder(
           _PromiseConnection.prototype.changeUser
         );
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           c2.changeUser(options, (err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve3();
+              resolve4();
             }
           });
         });
@@ -26835,12 +27877,12 @@ var require_pool2 = __commonJS({
       }
       getConnection() {
         const corePool = this.pool;
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           corePool.getConnection((err, coreConnection) => {
             if (err) {
               reject(err);
             } else {
-              resolve3(new PromisePoolConnection(coreConnection, this.Promise));
+              resolve4(new PromisePoolConnection(coreConnection, this.Promise));
             }
           });
         });
@@ -26856,8 +27898,8 @@ var require_pool2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           if (args !== void 0) {
             corePool.query(sql, args, done);
           } else {
@@ -26873,8 +27915,8 @@ var require_pool2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           if (args) {
             corePool.execute(sql, args, done);
           } else {
@@ -26885,13 +27927,13 @@ var require_pool2 = __commonJS({
       end() {
         const corePool = this.pool;
         const stackHolder = captureStackHolder(_PromisePool.prototype.end);
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           corePool.end((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve3();
+              resolve4();
             }
           });
         });
@@ -27316,12 +28358,12 @@ var require_pool_cluster2 = __commonJS({
       }
       getConnection() {
         const corePoolNamespace = this.poolNamespace;
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           corePoolNamespace.getConnection((err, coreConnection) => {
             if (err) {
               reject(err);
             } else {
-              resolve3(new PromisePoolConnection(coreConnection, this.Promise));
+              resolve4(new PromisePoolConnection(coreConnection, this.Promise));
             }
           });
         });
@@ -27336,8 +28378,8 @@ var require_pool_cluster2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           corePoolNamespace.query(sql, values, done);
         });
       }
@@ -27351,8 +28393,8 @@ var require_pool_cluster2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           corePoolNamespace.execute(sql, values, done);
         });
       }
@@ -27390,9 +28432,9 @@ var require_promise = __commonJS({
           "no Promise implementation available.Use promise-enabled node version or pass userland Promise implementation as parameter, for example: { Promise: require('bluebird') }"
         );
       }
-      return new thePromise((resolve3, reject) => {
+      return new thePromise((resolve4, reject) => {
         coreConnection.once("connect", () => {
-          resolve3(new PromiseConnection(coreConnection, thePromise));
+          resolve4(new PromiseConnection(coreConnection, thePromise));
         });
         coreConnection.once("error", (err) => {
           applyCapturedStack(err, stackHolder);
@@ -27419,7 +28461,7 @@ var require_promise = __commonJS({
       }
       getConnection(pattern, selector) {
         const corePoolCluster = this.poolCluster;
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           corePoolCluster.getConnection(
             pattern,
             selector,
@@ -27427,7 +28469,7 @@ var require_promise = __commonJS({
               if (err) {
                 reject(err);
               } else {
-                resolve3(new PromisePoolConnection(coreConnection, this.Promise));
+                resolve4(new PromisePoolConnection(coreConnection, this.Promise));
               }
             }
           );
@@ -27441,8 +28483,8 @@ var require_promise = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           corePoolCluster.query(sql, args, done);
         });
       }
@@ -27456,8 +28498,8 @@ var require_promise = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve3, reject) => {
-          const done = makeDoneCb(resolve3, reject, stackHolder);
+        return new this.Promise((resolve4, reject) => {
+          const done = makeDoneCb(resolve4, reject, stackHolder);
           corePoolCluster.execute(sql, args, done);
         });
       }
@@ -27470,13 +28512,13 @@ var require_promise = __commonJS({
       end() {
         const corePoolCluster = this.poolCluster;
         const stackHolder = captureStackHolder(_PromisePoolCluster.prototype.end);
-        return new this.Promise((resolve3, reject) => {
+        return new this.Promise((resolve4, reject) => {
           corePoolCluster.end((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve3();
+              resolve4();
             }
           });
         });
@@ -30551,7 +31593,7 @@ var require_dist = __commonJS({
     function parse(stream, callback) {
       const parser = new parser_1.Parser();
       stream.on("data", (buffer) => parser.parse(buffer, callback));
-      return new Promise((resolve3) => stream.on("end", () => resolve3()));
+      return new Promise((resolve4) => stream.on("end", () => resolve4()));
     }
     exports.parse = parse;
   }
@@ -31045,28 +32087,28 @@ var require_helper = __commonJS({
     var isValidEntry = module.exports.isValidEntry = function(entry2) {
       var rules = {
         // host
-        0: function(x) {
-          return x.length > 0;
+        0: function(x2) {
+          return x2.length > 0;
         },
         // port
-        1: function(x) {
-          if (x === "*") {
+        1: function(x2) {
+          if (x2 === "*") {
             return true;
           }
-          x = Number(x);
-          return isFinite(x) && x > 0 && x < 9007199254740992 && Math.floor(x) === x;
+          x2 = Number(x2);
+          return isFinite(x2) && x2 > 0 && x2 < 9007199254740992 && Math.floor(x2) === x2;
         },
         // database
-        2: function(x) {
-          return x.length > 0;
+        2: function(x2) {
+          return x2.length > 0;
         },
         // username
-        3: function(x) {
-          return x.length > 0;
+        3: function(x2) {
+          return x2.length > 0;
         },
         // password
-        4: function(x) {
-          return x.length > 0;
+        4: function(x2) {
+          return x2.length > 0;
         }
       };
       for (var idx = 0; idx < fieldNames.length; idx += 1) {
@@ -31094,8 +32136,8 @@ var require_lib6 = __commonJS({
         if (err || !helper.usePgPass(stat, file)) {
           return cb(void 0);
         }
-        var st2 = fs.createReadStream(file);
-        helper.getPassword(connInfo, st2, cb);
+        var st3 = fs.createReadStream(file);
+        helper.getPassword(connInfo, st3, cb);
       });
     };
     module.exports.warnTo = helper.warnTo;
@@ -31276,12 +32318,12 @@ var require_client2 = __commonJS({
           this._connect(callback);
           return;
         }
-        return new this._Promise((resolve3, reject) => {
+        return new this._Promise((resolve4, reject) => {
           this._connect((error) => {
             if (error) {
               reject(error);
             } else {
-              resolve3(this);
+              resolve4(this);
             }
           });
         });
@@ -31627,8 +32669,8 @@ var require_client2 = __commonJS({
           readTimeout = config.query_timeout || this.connectionParameters.query_timeout;
           query = new Query2(config, values, callback);
           if (!query.callback) {
-            result = new this._Promise((resolve3, reject) => {
-              query.callback = (err, res) => err ? reject(err) : resolve3(res);
+            result = new this._Promise((resolve4, reject) => {
+              query.callback = (err, res) => err ? reject(err) : resolve4(res);
             }).catch((err) => {
               Error.captureStackTrace(err);
               throw err;
@@ -31705,8 +32747,8 @@ var require_client2 = __commonJS({
         if (cb) {
           this.connection.once("end", cb);
         } else {
-          return new this._Promise((resolve3) => {
-            this.connection.once("end", resolve3);
+          return new this._Promise((resolve4) => {
+            this.connection.once("end", resolve4);
           });
         }
       }
@@ -31754,8 +32796,8 @@ var require_pg_pool = __commonJS({
       const cb = function(err, client) {
         err ? rej(err) : res(client);
       };
-      const result = new Promise2(function(resolve3, reject) {
-        res = resolve3;
+      const result = new Promise2(function(resolve4, reject) {
+        res = resolve4;
         rej = reject;
       }).catch((err) => {
         Error.captureStackTrace(err);
@@ -31816,7 +32858,7 @@ var require_pg_pool = __commonJS({
         if (typeof Promise2.try === "function") {
           return Promise2.try(f);
         }
-        return new Promise2((resolve3) => resolve3(f()));
+        return new Promise2((resolve4) => resolve4(f()));
       }
       _isFull() {
         return this._clients.length >= this.options.max;
@@ -32208,8 +33250,8 @@ var require_query4 = __commonJS({
     NativeQuery.prototype._getPromise = function() {
       if (this._promise) return this._promise;
       this._promise = new Promise(
-        function(resolve3, reject) {
-          this._once("end", resolve3);
+        function(resolve4, reject) {
+          this._once("end", resolve4);
           this._once("error", reject);
         }.bind(this)
       );
@@ -32386,12 +33428,12 @@ var require_client3 = __commonJS({
         this._connect(callback);
         return;
       }
-      return new this._Promise((resolve3, reject) => {
+      return new this._Promise((resolve4, reject) => {
         this._connect((error) => {
           if (error) {
             reject(error);
           } else {
-            resolve3(this);
+            resolve4(this);
           }
         });
       });
@@ -32415,8 +33457,8 @@ var require_client3 = __commonJS({
         query = new NativeQuery(config, values, callback);
         if (!query.callback) {
           let resolveOut, rejectOut;
-          result = new this._Promise((resolve3, reject) => {
-            resolveOut = resolve3;
+          result = new this._Promise((resolve4, reject) => {
+            resolveOut = resolve4;
             rejectOut = reject;
           }).catch((err) => {
             Error.captureStackTrace(err);
@@ -32476,8 +33518,8 @@ var require_client3 = __commonJS({
       }
       let result;
       if (!cb) {
-        result = new this._Promise(function(resolve3, reject) {
-          cb = (err) => err ? reject(err) : resolve3();
+        result = new this._Promise(function(resolve4, reject) {
+          cb = (err) => err ? reject(err) : resolve4();
         });
       }
       this.native.end(function() {
@@ -36400,8 +37442,8 @@ var require_common = __commonJS({
         }
         return debug2;
       }
-      function extend(namespace, delimiter) {
-        const newDebug = createDebug(this.namespace + (typeof delimiter === "undefined" ? ":" : delimiter) + namespace);
+      function extend(namespace, delimiter2) {
+        const newDebug = createDebug(this.namespace + (typeof delimiter2 === "undefined" ? ":" : delimiter2) + namespace);
         newDebug.log = this.log;
         return newDebug;
       }
@@ -37126,8 +38168,8 @@ var require_utils4 = __commonJS({
     }
     exports.wrapMultiResult = wrapMultiResult;
     function isInt(value) {
-      const x = parseFloat(value);
-      return !isNaN(value) && (x | 0) === x;
+      const x2 = parseFloat(value);
+      return !isNaN(value) && (x2 | 0) === x2;
     }
     exports.isInt = isInt;
     function packObject(array) {
@@ -37584,7 +38626,7 @@ var require_Command = __commonJS({
         }
       }
       initPromise() {
-        const promise = new Promise((resolve3, reject) => {
+        const promise = new Promise((resolve4, reject) => {
           if (!this.transformed) {
             this.transformed = true;
             const transformer = _Command._transformer.argument[this.name];
@@ -37593,7 +38635,7 @@ var require_Command = __commonJS({
             }
             this.stringifyArguments();
           }
-          this.resolve = this._convertValue(resolve3);
+          this.resolve = this._convertValue(resolve4);
           this.reject = (err) => {
             this._clearTimers();
             if (this.errorStack) {
@@ -37626,11 +38668,11 @@ var require_Command = __commonJS({
       /**
        * Convert the value from buffer to the target encoding.
        */
-      _convertValue(resolve3) {
+      _convertValue(resolve4) {
         return (value) => {
           try {
             this._clearTimers();
-            resolve3(this.transformReply(value));
+            resolve4(this.transformReply(value));
             this.isResolved = true;
           } catch (err) {
             this.reject(err);
@@ -37736,9 +38778,9 @@ var require_Command = __commonJS({
         this.length = 0;
         this.items = [];
       }
-      push(x) {
-        this.length += Buffer.byteLength(x);
-        this.items.push(x);
+      push(x2) {
+        this.length += Buffer.byteLength(x2);
+        this.items.push(x2);
       }
       toBuffer() {
         const result = Buffer.allocUnsafe(this.length);
@@ -37908,13 +38950,13 @@ var require_autoPipelining = __commonJS({
       if (client.isCluster && !client.slots.length) {
         if (client.status === "wait")
           client.connect().catch(lodash_1.noop);
-        return (0, standard_as_callback_1.default)(new Promise(function(resolve3, reject) {
+        return (0, standard_as_callback_1.default)(new Promise(function(resolve4, reject) {
           client.delayUntilReady((err) => {
             if (err) {
               reject(err);
               return;
             }
-            executeWithAutoPipelining(client, functionName, commandName, args, null).then(resolve3, reject);
+            executeWithAutoPipelining(client, functionName, commandName, args, null).then(resolve4, reject);
           });
         }), callback);
       }
@@ -37935,13 +38977,13 @@ var require_autoPipelining = __commonJS({
         pipeline[exports.kExec] = true;
         setImmediate(executeAutoPipeline, client, slotKey);
       }
-      const autoPipelinePromise = new Promise(function(resolve3, reject) {
+      const autoPipelinePromise = new Promise(function(resolve4, reject) {
         pipeline[exports.kCallbacks].push(function(err, value) {
           if (err) {
             reject(err);
             return;
           }
-          resolve3(value);
+          resolve4(value);
         });
         if (functionName === "call") {
           args.unshift(commandName);
@@ -38176,8 +39218,8 @@ var require_Pipeline = __commonJS({
           this[name] = redis[name];
           this[name + "Buffer"] = redis[name + "Buffer"];
         });
-        this.promise = new Promise((resolve3, reject) => {
-          this.resolve = resolve3;
+        this.promise = new Promise((resolve4, reject) => {
+          this.resolve = resolve4;
           this.reject = reject;
         });
         const _this = this;
@@ -38477,13 +39519,13 @@ var require_transaction = __commonJS({
           if (this.isCluster && !this.redis.slots.length) {
             if (this.redis.status === "wait")
               this.redis.connect().catch(utils_1.noop);
-            return (0, standard_as_callback_1.default)(new Promise((resolve3, reject) => {
+            return (0, standard_as_callback_1.default)(new Promise((resolve4, reject) => {
               this.redis.delayUntilReady((err) => {
                 if (err) {
                   reject(err);
                   return;
                 }
-                this.exec(pipeline).then(resolve3, reject);
+                this.exec(pipeline).then(resolve4, reject);
               });
             }), callback);
           }
@@ -39612,7 +40654,7 @@ var require_cluster = __commonJS({
        * Connect to a cluster
        */
       connect() {
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           if (this.status === "connecting" || this.status === "connect" || this.status === "ready") {
             reject(new Error("Redis is already connecting/connected"));
             return;
@@ -39641,7 +40683,7 @@ var require_cluster = __commonJS({
               this.retryAttempts = 0;
               this.executeOfflineCommands();
               this.resetNodesRefreshInterval();
-              resolve3();
+              resolve4();
             };
             let closeListener = void 0;
             const refreshListener = () => {
@@ -40251,7 +41293,7 @@ var require_cluster = __commonJS({
         });
       }
       resolveSrv(hostname2) {
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           this.options.resolveSrv(hostname2, (err, records) => {
             if (err) {
               return reject(err);
@@ -40265,7 +41307,7 @@ var require_cluster = __commonJS({
               if (!group.records.length) {
                 sortedKeys.shift();
               }
-              self2.dnsLookup(record.name).then((host) => resolve3({
+              self2.dnsLookup(record.name).then((host) => resolve4({
                 host,
                 port: record.port
               }), tryFirstOne);
@@ -40275,14 +41317,14 @@ var require_cluster = __commonJS({
         });
       }
       dnsLookup(hostname2) {
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           this.options.dnsLookup(hostname2, (err, address) => {
             if (err) {
               debug2("failed to resolve hostname %s to IP: %s", hostname2, err.message);
               reject(err);
             } else {
               debug2("resolved hostname %s to IP %s", hostname2, address);
-              resolve3(address);
+              resolve4(address);
             }
           });
         });
@@ -40437,7 +41479,7 @@ var require_StandaloneConnector = __commonJS({
         if (options.tls) {
           Object.assign(connectionOptions, options.tls);
         }
-        return new Promise((resolve3, reject) => {
+        return new Promise((resolve4, reject) => {
           process.nextTick(() => {
             if (!this.connecting) {
               reject(new Error(utils_1.CONNECTION_CLOSED_ERROR_MSG));
@@ -40456,7 +41498,7 @@ var require_StandaloneConnector = __commonJS({
             this.stream.once("error", (err) => {
               this.firstError = err;
             });
-            resolve3(this.stream);
+            resolve4(this.stream);
           });
         });
       }
@@ -40612,7 +41654,7 @@ var require_SentinelConnector = __commonJS({
             const error = new Error(errorMsg);
             if (typeof retryDelay === "number") {
               eventEmitter("error", error);
-              await new Promise((resolve3) => setTimeout(resolve3, retryDelay));
+              await new Promise((resolve4) => setTimeout(resolve4, retryDelay));
               return connectToNext();
             } else {
               throw error;
@@ -41929,7 +42971,7 @@ var require_Redis = __commonJS({
        * if the connection fails, times out, or if Redis is already connecting/connected.
        */
       connect(callback) {
-        const promise = new Promise((resolve3, reject) => {
+        const promise = new Promise((resolve4, reject) => {
           if (this.status === "connecting" || this.status === "connect" || this.status === "ready") {
             reject(new Error("Redis is already connecting/connected"));
             return;
@@ -42008,7 +43050,7 @@ var require_Redis = __commonJS({
             }
             const connectionReadyHandler = function() {
               _this.removeListener("close", connectionCloseHandler);
-              resolve3();
+              resolve4();
             };
             var connectionCloseHandler = function() {
               _this.removeListener("ready", connectionReadyHandler);
@@ -42102,10 +43144,10 @@ var require_Redis = __commonJS({
           monitor: true,
           lazyConnect: false
         });
-        return (0, standard_as_callback_1.default)(new Promise(function(resolve3, reject) {
+        return (0, standard_as_callback_1.default)(new Promise(function(resolve4, reject) {
           monitorInstance.once("error", reject);
           monitorInstance.once("monitoring", function() {
-            resolve3(monitorInstance);
+            resolve4(monitorInstance);
           });
         }), callback);
       }
@@ -42878,7 +43920,15 @@ async function runMenu() {
       });
       if (!q(setup) && setup) {
         const { runInitFlow: runInitFlow2 } = await Promise.resolve().then(() => (init_init(), init_exports));
-        await runInitFlow2(client, { cwd: process.cwd(), dryRun: false, noScripts: false });
+        const outcome = await runInitFlow2(client, {
+          cwd: process.cwd(),
+          dryRun: false,
+          noScripts: false
+        });
+        if (outcome.exitCode === 0) {
+          ye("All set. Run keynv again anytime to manage secrets.");
+          return 0;
+        }
       }
     }
   }
@@ -42948,8 +43998,8 @@ var init_menu = __esm({
   "src/ui/menu.ts"() {
     init_dist5();
     init_http();
-    init_detect();
     init_store();
+    init_detect();
     init_version();
     init_audit2();
     init_login();
@@ -43963,11 +45013,11 @@ function formatMarkdownish(text, { format, paragraphs }) {
 
 `);
   }
-  text = text.replace(/(`+)((?:.|[\n])*?)\1/g, ($0, $1, $2) => {
-    return format.code($1 + $2 + $1);
+  text = text.replace(/(`+)((?:.|[\n])*?)\1/g, ($0, $1, $22) => {
+    return format.code($1 + $22 + $1);
   });
-  text = text.replace(/(\*\*)((?:.|[\n])*?)\1/g, ($0, $1, $2) => {
-    return format.bold($1 + $2 + $1);
+  text = text.replace(/(\*\*)((?:.|[\n])*?)\1/g, ($0, $1, $22) => {
+    return format.bold($1 + $22 + $1);
   });
   return text ? `${text}
 ` : ``;
@@ -44749,8 +45799,6 @@ var AuditVerifyCommand = class extends Command {
     }
   }
 };
-
-// src/commands/exec.ts
 init_http();
 init_envFile();
 
@@ -44758,15 +45806,15 @@ init_envFile();
 init_dist();
 async function resolveAllAliases(client, argv2, extraStrings = []) {
   const seen = /* @__PURE__ */ new Map();
-  const argvScans = findAliasesInArgv(argv2);
+  const argvScans = reference_exports.findAliasesInArgv(argv2);
   for (const { matches } of argvScans) {
     for (const m of matches) {
       seen.set(m.literal, m);
     }
   }
   for (const s of extraStrings) {
-    for (const m of findAliasesInArgv([s])) {
-      for (const x of m.matches) seen.set(x.literal, x);
+    for (const m of reference_exports.findAliasesInArgv([s])) {
+      for (const x2 of m.matches) seen.set(x2.literal, x2);
     }
   }
   if (seen.size === 0) return [];
@@ -44858,10 +45906,18 @@ var BUILTIN_PATTERNS = [
     name: "stripe-live-secret-key",
     regex: /\bsk_live_[A-Za-z0-9]{24,}\b/g
   },
+  {
+    name: "stripe-test-secret-key",
+    regex: /\bsk_test_[A-Za-z0-9]{24,}\b/g
+  },
   {
     name: "stripe-restricted-live-key",
     regex: /\brk_live_[A-Za-z0-9]{24,}\b/g
   },
+  {
+    name: "stripe-restricted-test-key",
+    regex: /\brk_test_[A-Za-z0-9]{24,}\b/g
+  },
   {
     // Negative lookahead skips Anthropic-prefixed keys so the more
     // specific anthropic-api-key pattern wins on those.
@@ -44957,7 +46013,9 @@ function defaultRender(name) {
   return `<REDACTED:${name}>`;
 }
 function preview(matched) {
-  return matched.length <= 8 ? matched : `${matched.slice(0, 4)}...`;
+  if (matched.length <= 4)
+    return "****";
+  return `${matched.slice(0, 4)}...`;
 }
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -44988,8 +46046,8 @@ function redact(text, opts = {}) {
     for (const literal of opts.literals) {
       if (!literal)
         continue;
-      const re = new RegExp(escapeRegExp(literal), "g");
-      for (const m of text.matchAll(re)) {
+      const re2 = new RegExp(escapeRegExp(literal), "g");
+      for (const m of text.matchAll(re2)) {
         if (m.index === void 0)
           continue;
         raw.push({
@@ -45099,7 +46157,9 @@ var ENV_ALLOWLIST = [
   "WINDIR",
   "COMSPEC",
   "APPDATA",
-  "LOCALAPPDATA"
+  "LOCALAPPDATA",
+  "PATHEXT"
+  // needed so child processes can resolve executables by name
 ];
 function spawnPrivileged(opts) {
   const startedAt = Date.now();
@@ -45108,6 +46168,11 @@ function spawnPrivileged(opts) {
     const v2 = process.env[name];
     if (v2 !== void 0) env2[name] = v2;
   }
+  const nmBin = findNodeModulesBin(process.cwd());
+  if (nmBin) {
+    const existingPath = env2.PATH ?? "";
+    env2.PATH = existingPath.startsWith(nmBin + nodePath.delimiter) ? existingPath : nmBin + nodePath.delimiter + existingPath;
+  }
   if (opts.injectedEnv) {
     for (const [k2, v2] of Object.entries(opts.injectedEnv)) env2[k2] = v2;
   }
@@ -45133,14 +46198,33 @@ function spawnPrivileged(opts) {
   ]);
   let spawnCmd = opts.command;
   let spawnArgs = opts.args;
-  if (process.platform === "win32" && WIN_BUILTINS.has(opts.command.toLowerCase())) {
-    spawnCmd = process.env.COMSPEC ?? "cmd.exe";
-    spawnArgs = ["/d", "/s", "/c", opts.command, ...opts.args];
+  let windowsVerbatimArguments = false;
+  if (process.platform === "win32") {
+    const comspec = env2.COMSPEC ?? process.env.COMSPEC ?? "cmd.exe";
+    if (WIN_BUILTINS.has(opts.command.toLowerCase())) {
+      spawnCmd = comspec;
+      spawnArgs = ["/d", "/s", "/c", opts.command, ...opts.args];
+    } else {
+      const resolved = resolveWindowsCmd(opts.command, env2);
+      if (resolved !== null) {
+        const ext = nodePath.extname(resolved).toLowerCase();
+        if (ext === ".cmd" || ext === ".bat") {
+          const q2 = (s) => s.includes(" ") ? `"${s}"` : s;
+          const inner = [q2(resolved), ...opts.args.map(q2)].join(" ");
+          spawnCmd = comspec;
+          spawnArgs = ["/d", "/s", "/c", `"${inner}"`];
+          windowsVerbatimArguments = true;
+        } else {
+          spawnCmd = resolved;
+        }
+      }
+    }
   }
   const child = spawn(spawnCmd, spawnArgs, {
     env: env2,
     stdio,
-    detached: false
+    detached: false,
+    windowsVerbatimArguments
   });
   const literals = opts.resolved.map((r) => r.value).filter((v2) => v2.length > 0);
   if (!opts.noRedact && child.stdout) {
@@ -45161,14 +46245,14 @@ function spawnPrivileged(opts) {
     }, opts.timeoutS * 1e3);
     timer.unref();
   }
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     child.on("error", (err) => {
       if (timer) clearTimeout(timer);
       reject(err);
     });
     child.on("close", (code, signal) => {
       if (timer) clearTimeout(timer);
-      resolve3({
+      resolve4({
         exitCode: code ?? 0,
         signal,
         durationMs: Date.now() - startedAt
@@ -45176,6 +46260,34 @@ function spawnPrivileged(opts) {
     });
   });
 }
+function resolveWindowsCmd(command, subprocessEnv) {
+  if (nodePath.extname(command)) return null;
+  if (command.includes("/") || command.includes("\\")) return null;
+  const pathExt = (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").map((e2) => e2.toLowerCase()).filter(Boolean);
+  const pathStr = subprocessEnv.PATH ?? process.env.PATH ?? "";
+  const pathDirs = pathStr.split(nodePath.delimiter).filter(Boolean);
+  for (const dir of pathDirs) {
+    for (const ext of pathExt) {
+      try {
+        const full = nodePath.join(dir, command + ext);
+        if (existsSync(full)) return full;
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+function findNodeModulesBin(cwd) {
+  let dir = nodePath.resolve(cwd);
+  for (let i = 0; i < 20; i++) {
+    const candidate = nodePath.join(dir, "node_modules", ".bin");
+    if (existsSync(candidate)) return candidate;
+    const parent = nodePath.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
 
 // src/commands/exec.ts
 var ExecCommand = class extends Command {
@@ -45232,6 +46344,10 @@ spelled \`--from\` to avoid the collision.)
   quiet = options_exports.Boolean("--quiet", false, {
     description: `Suppress the "loaded N vars from ${ENV_FILE_BASENAME}" status line.`
   });
+  // Option.Rest: keynv options (e.g. --no-env-file) are parsed before `--`.
+  // Everything after `--` is captured in rest verbatim, including subprocess
+  // flags like `--port 3005` and `-v`. Always use `--` to separate keynv
+  // options from the subprocess command.
   rest = options_exports.Rest();
   async execute() {
     if (!this.rest || this.rest.length === 0) {
@@ -45274,6 +46390,13 @@ spelled \`--from\` to avoid the collision.)
       );
       return 2;
     }
+    if (!envFileLoaded && !this.noEnvFile && !this.envFile && !process.env.KEYNV_ENV_FILE) {
+      this.context.stderr.write(
+        `keynv: no ${ENV_FILE_BASENAME} found in this directory or any parent.
+       Run \`keynv init\` in your project root to migrate secrets and create one.
+`
+      );
+    }
     const viaEnvSpecs = [];
     for (const spec of this.viaEnv ?? []) {
       const eq = spec.indexOf("=");
@@ -45349,13 +46472,14 @@ spelled \`--from\` to avoid the collision.)
       const displayPath = relative(process.cwd(), envFileLoaded.path) || envFileLoaded.path;
       const parts = [];
       if (aliasEntries.length > 0) {
-        parts.push(aliasEntries.map((e2) => `${e2.name}=${e2.value}`).join(", ") + " (vault)");
+        parts.push(`${aliasEntries.map((e2) => `${e2.name}=${e2.value}`).join(", ")} (vault)`);
       }
       if (plainEntries.length > 0) {
-        parts.push(plainEntries.map((e2) => e2.name).join(", ") + " (plain)");
+        parts.push(`${plainEntries.map((e2) => e2.name).join(", ")} (plain)`);
       }
       this.context.stderr.write(
-        `keynv: loaded ${displayPath}` + (parts.length > 0 ? ` \u2014 ${parts.join("; ")}` : "") + "\n"
+        `keynv: loaded ${displayPath}${parts.length > 0 ? ` \u2014 ${parts.join("; ")}` : ""}
+`
       );
     }
     const timeoutS = this.timeout ? Number.parseInt(this.timeout, 10) : void 0;
@@ -45398,6 +46522,8 @@ function signalNumber(sig) {
 init_dist();
 init_http();
 init_envFile();
+init_ai_context();
+init_detect();
 init_heuristics();
 init_init();
 init_cancel();
@@ -45414,7 +46540,8 @@ async function resolveProjectId(client, input) {
     return input;
   }
   const data = await client.request("/v1/projects");
-  const match = data.projects.find((p2) => p2.name === input);
+  const lowerInput = input.toLowerCase();
+  const match = data.projects.find((p2) => p2.name.toLowerCase() === lowerInput);
   if (!match) throw new Error(`project not found: ${input}`);
   return match.id;
 }
@@ -45547,6 +46674,14 @@ var ProjectDeleteCommand = class extends Command {
 };
 
 // src/commands/init.ts
+function toAliasKey2(name) {
+  if (!name) return name;
+  const KEY_RE3 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+  if (KEY_RE3.test(name)) return name;
+  const normalised = name.toLowerCase().replace(/_/g, "-");
+  if (KEY_RE3.test(normalised)) return normalised;
+  return normalised.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64) || "key";
+}
 var InitCommand = class extends Command {
   static paths = [["init"]];
   static usage = Command.Usage({
@@ -45565,15 +46700,16 @@ mappings that would be written to .keynv.env, then exits without
 touching any files or making any network calls. Use it to preview
 what init will do before committing.
 
-Requires an interactive terminal (clack TUI). For scripted
-migration, use the lower-level \`keynv project\` and \`keynv secret\`
-commands directly.
+For scripted migration, use \`--env-file\` or \`--secret\` flags, or
+\`--yes\` to auto-scan the project directory and set up without
+any prompts.
 `,
     examples: [
       ["Walk the current project", "$0 init"],
       ["Preview without writing or uploading", "$0 init --dry-run"],
       ["Skip the package.json script-wrapping step", "$0 init --no-scripts"],
-      ["Non-interactive (CI/CD)", "$0 init --env-file .env --project myproject --env dev"]
+      ["Non-interactive (CI/CD)", "$0 init --env-file .env --project myproject --env dev"],
+      ["Auto-scan & set up without prompts (CI/CD)", "$0 init --yes"]
     ]
   });
   dryRun = options_exports.Boolean("--dry-run", false, {
@@ -45594,6 +46730,9 @@ commands directly.
   secret = options_exports.Array("--secret", {
     description: "KEY=value secret to upload (non-interactive). Can be specified multiple times."
   });
+  yes = options_exports.Boolean("--yes", false, {
+    description: "Auto-scan .env files, classify, and set up without prompts. Implies non-interactive mode."
+  });
   async execute() {
     const client = new ApiClient();
     await client.ensureHydrated();
@@ -45603,13 +46742,13 @@ commands directly.
     }
     const hasEnvFile = this.envFile != null;
     const hasSecrets = this.secret != null && this.secret.length > 0;
-    const isNonInteractive = hasEnvFile || hasSecrets;
+    const isNonInteractive = hasEnvFile || hasSecrets || this.dryRun || this.yes;
     if (isNonInteractive) {
       return this.runNonInteractive(client);
     }
     if (!isInteractive()) {
       this.context.stderr.write(
-        "keynv init requires an interactive terminal. Use --env-file or --secret for scripted setup.\n"
+        "keynv init requires an interactive terminal. Use --dry-run, --env-file, or --secret for scripted setup.\n"
       );
       return 1;
     }
@@ -45629,6 +46768,9 @@ commands directly.
     }
   }
   async runNonInteractive(client) {
+    if (this.yes && !this.envFile && !this.secret) {
+      return this.runAutoScan(client);
+    }
     const projectName = this.project;
     if (!projectName) {
       this.context.stderr.write("keynv: --project is required in non-interactive mode.\n");
@@ -45678,34 +46820,147 @@ commands directly.
       return 0;
     }
     if (this.dryRun) {
-      this.context.stdout.write(
-        `keynv: dry-run \u2014 would upload ${secrets.length} secret(s) to project ${projectName} (${projectId2}) in env ${envName}
+      if (this.envFile || this.secret && this.secret.length > 0) {
+        this.context.stdout.write(
+          `keynv: dry-run \u2014 would upload ${secrets.length} secret(s) to project ${projectName} (${projectId2}) in env ${envName}
 `
+        );
+        for (const { name } of secrets) {
+          const aliasKey = toAliasKey2(name);
+          this.context.stdout.write(`  ${name}=@${projectName}.${envName}.${aliasKey}
+`);
+        }
+        return 0;
+      }
+      this.context.stdout.write(
+        "keynv: dry-run mode \u2014 no --env-file or --secret provided. Nothing to scan.\n"
       );
+      return 0;
+    }
+    const secretsWithKeys = secrets.map((s) => ({ ...s, aliasKey: toAliasKey2(s.name) }));
+    return this.uploadSecrets(client, projectId2, projectName, envName, secretsWithKeys);
+  }
+  /**
+   * Auto-scan mode (--yes without explicit --env-file). Finds .env files
+   * in the project root, classifies entries, creates a project, uploads
+   * secrets, and writes .keynv.env — all without prompts.
+   */
+  async runAutoScan(client) {
+    const root = findProjectRoot(process.cwd());
+    if (!root) {
+      this.context.stderr.write("keynv: no project root found (no package.json, .git, etc.).\n");
+      return 1;
+    }
+    const envFiles = findEnvFiles(root.path);
+    if (envFiles.length === 0) {
+      this.context.stdout.write("keynv: no .env files found. Nothing to migrate.\n");
+      return 0;
+    }
+    const projectName = this.project ?? root.suggestedName;
+    const envName = this.env ?? suggestedEnvForSuffix(envFiles[0]?.suffix ?? null);
+    const secrets = [];
+    for (const f of envFiles) {
+      try {
+        const entries = parseEnvFile(readFileSync(f.path, "utf8"), f.path);
+        for (const e2 of entries) {
+          if (classifyEntry(e2.name, e2.value).verdict === "secret") {
+            secrets.push({ name: e2.name, value: e2.value });
+          }
+        }
+      } catch {
+        this.context.stderr.write(`keynv: warning \u2014 could not parse ${f.name}, skipping.
+`);
+      }
+    }
+    if (secrets.length === 0) {
+      this.context.stdout.write("keynv: no secrets detected in .env files. Nothing to upload.\n");
+      return 0;
+    }
+    this.context.stdout.write(
+      `keynv: auto-scan found ${secrets.length} secret(s) across ${envFiles.length} file(s).
+`
+    );
+    if (this.dryRun) {
       for (const { name } of secrets) {
-        const aliasKey = name.toLowerCase().replace(/_/g, "-");
+        const aliasKey = toAliasKey2(name);
         this.context.stdout.write(`  ${name}=@${projectName}.${envName}.${aliasKey}
 `);
       }
       return 0;
     }
+    let projectId2;
+    try {
+      projectId2 = await resolveProjectId(client, projectName);
+    } catch {
+      const created = await client.request("/v1/projects", {
+        method: "POST",
+        body: {
+          name: projectName,
+          environments: [{ name: envName, tier: "non-production", require_approval: false }]
+        }
+      });
+      projectId2 = created.id;
+      this.context.stdout.write(`keynv: created project "${projectName}" (${projectId2}).
+`);
+    }
+    const secretsWithKeys = secrets.map((s) => ({ ...s, aliasKey: toAliasKey2(s.name) }));
+    const result = await this.uploadSecrets(
+      client,
+      projectId2,
+      projectName,
+      envName,
+      secretsWithKeys
+    );
+    if (result !== 0) return result;
+    const aliasLines = secretsWithKeys.map((s) => `# ${s.name}
+${s.name}=@${projectName}.${envName}.${s.aliasKey}`).join("\n");
+    const keynvEnvPath = join(root.path, ".keynv.env");
+    writeFileSync(keynvEnvPath, `# Auto-generated by keynv init --yes
+${aliasLines}
+`);
+    this.context.stdout.write(`keynv: wrote ${keynvEnvPath}
+`);
+    try {
+      const outcome = writeAiContext(root.path);
+      if (outcome === "created") this.context.stdout.write("keynv: wrote AGENTS.md\n");
+    } catch {
+      this.context.stdout.write("keynv: warning \u2014 could not write AGENTS.md.\n");
+    }
+    for (const f of envFiles) {
+      unlinkSync(f.path);
+      this.context.stdout.write(`keynv: removed ${f.name} (secrets migrated to vault).
+`);
+    }
+    this.context.stdout.write(
+      "keynv: done. Use `keynv exec` to run commands with resolved secrets.\n"
+    );
+    return 0;
+  }
+  /**
+   * Upload secrets to the vault and print the result. Shared between
+   * runNonInteractive and runAutoScan.
+   */
+  async uploadSecrets(client, projectId2, projectName, envName, secrets) {
     let uploaded = 0;
     const failed = [];
-    for (const { name, value } of secrets) {
-      const aliasKey = name.toLowerCase().replace(/_/g, "-");
-      const alias2 = buildAlias({ project: projectName, environment: envName, key: aliasKey });
+    for (const s of secrets) {
+      const alias2 = reference_exports.buildAlias({
+        project: projectName,
+        environment: envName,
+        key: s.aliasKey
+      });
       if (!alias2) {
-        failed.push(`${name} (invalid alias key: ${aliasKey})`);
+        failed.push({ name: s.name, reason: `invalid alias key: ${s.aliasKey}` });
         continue;
       }
       try {
         await client.request(`/v1/projects/${projectId2}/secrets`, {
           method: "POST",
-          body: { env: envName, key: aliasKey, value }
+          body: { env: envName, key: s.aliasKey, value: s.value }
         });
         uploaded++;
       } catch (err) {
-        failed.push(`${name}: ${err instanceof Error ? err.message : String(err)}`);
+        failed.push({ name: s.name, reason: err instanceof Error ? err.message : String(err) });
       }
     }
     this.context.stdout.write(
@@ -45713,7 +46968,7 @@ commands directly.
 `
     );
     if (failed.length > 0) {
-      for (const f of failed) this.context.stderr.write(`  failed: ${f}
+      for (const f of failed) this.context.stderr.write(`  failed: ${f.name} \u2014 ${f.reason}
 `);
       return 1;
     }
@@ -45735,7 +46990,7 @@ async function promptHidden(prompt) {
   process.stdin.setRawMode(true);
   process.stdin.resume();
   process.stdin.setEncoding("utf8");
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let buf = "";
     const onData = (chunk) => {
       for (const ch of chunk) {
@@ -45744,7 +46999,7 @@ async function promptHidden(prompt) {
           process.stdin.pause();
           process.stdin.removeListener("data", onData);
           process.stdout.write("\n");
-          resolve3(buf);
+          resolve4(buf);
           return;
         }
         if (ch === "") {
@@ -45762,10 +47017,10 @@ async function promptHidden(prompt) {
 }
 async function promptLine(prompt) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     rl.question(prompt, (answer) => {
       rl.close();
-      resolve3(answer.trim());
+      resolve4(answer.trim());
     });
   });
 }
@@ -45794,7 +47049,7 @@ var LoginCommand = class extends Command {
   token = options_exports.String("--token", { description: "CLI token for headless auth." });
   email = options_exports.String("--email", { description: "Email address." });
   password = options_exports.String("--password", {
-    description: "Password (use stdin to avoid argv leak)."
+    description: "Password. WARNING: passing passwords via --password leaks them to process listings (ps). Use interactive prompt or pipe via stdin instead."
   });
   async execute() {
     const finalServerUrl = this.server ?? DEFAULT_SERVER_URL;
@@ -45826,7 +47081,15 @@ var LoginCommand = class extends Command {
       }
     }
     const email2 = this.email ?? await promptLine("email: ");
-    const password = this.password ?? await promptHidden("password: ");
+    let password;
+    if (this.password) {
+      this.context.stderr.write(
+        "keynv: WARNING: --password leaks credentials to process listings. Use interactive prompt or pipe via stdin instead.\n"
+      );
+      password = this.password;
+    } else {
+      password = await promptHidden("password: ");
+    }
     let res;
     try {
       res = await fetch(new URL("/v1/auth/login", finalServerUrl).toString(), {
@@ -46152,9 +47415,9 @@ here (see the streaming-mode limitation in the redactor package).
 `
   });
   async execute() {
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const transform = createRedactStream();
-      this.context.stdin.pipe(transform).pipe(this.context.stdout).on("error", reject).on("finish", () => resolve3(0));
+      this.context.stdin.pipe(transform).pipe(this.context.stdout).on("error", reject).on("finish", () => resolve4(0));
       this.context.stdin.on("error", reject);
     });
   }
@@ -46217,7 +47480,7 @@ var SecretCreateCommand = class extends Command {
           throw err;
         }
       }
-      const parsed = parseAlias(alias2);
+      const parsed = reference_exports.parseAlias(alias2);
       if (!parsed) {
         this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
@@ -46234,10 +47497,13 @@ var SecretCreateCommand = class extends Command {
         value = await promptHidden("value: ");
       }
       const projectId2 = await resolveProjectId(client, parsed.project);
-      await client.request(`/v1/projects/${projectId2}/secrets`, {
-        method: "POST",
-        body: { env: parsed.environment, key: parsed.key, value }
-      });
+      await client.request(
+        `/v1/projects/${projectId2}/secrets`,
+        {
+          method: "POST",
+          body: { env: parsed.environment, key: parsed.key, value }
+        }
+      );
       this.context.stdout.write(`created ${parsed.literal}
 `);
       return 0;
@@ -46268,7 +47534,7 @@ var SecretGetCommand = class extends Command {
         }
         if (!alias2) return 1;
       }
-      const parsed = parseAlias(alias2);
+      const parsed = reference_exports.parseAlias(alias2);
       if (!parsed) {
         this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
@@ -46320,7 +47586,15 @@ var SecretListCommand = class extends Command {
           throw err;
         }
       }
-      const resolvedProjectName = projectName.startsWith("@") ? projectName.slice(1).split(".")[0] ?? projectName : projectName;
+      let resolvedProjectName = projectName;
+      if (projectName.startsWith("@")) {
+        const parsed = reference_exports.parseAlias(projectName);
+        if (parsed) {
+          resolvedProjectName = parsed.project;
+        } else {
+          resolvedProjectName = projectName.slice(1).split(".")[0] ?? projectName;
+        }
+      }
       const projectId2 = await resolveProjectId(client, resolvedProjectName);
       const data = await client.request(`/v1/projects/${projectId2}/secrets`);
       if (this.json) {
@@ -46366,7 +47640,7 @@ var SecretRotateCommand = class extends Command {
         }
         if (!alias2) return 1;
       }
-      const parsed = parseAlias(alias2);
+      const parsed = reference_exports.parseAlias(alias2);
       if (!parsed) {
         this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
@@ -46402,6 +47676,7 @@ var SecretDeleteCommand = class extends Command {
   static paths = [["secret", "delete"]];
   static usage = Command.Usage({ description: "Soft-delete a secret." });
   alias = options_exports.String({ required: false });
+  force = options_exports.Boolean("--force", false);
   async execute() {
     try {
       const client = new ApiClient();
@@ -46417,17 +47692,35 @@ var SecretDeleteCommand = class extends Command {
         }
         if (!alias2) return 1;
       }
-      const parsed = parseAlias(alias2);
+      const parsed = reference_exports.parseAlias(alias2);
       if (!parsed) {
         this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
 `);
         return 1;
       }
+      if (!this.force) {
+        if (isInteractive()) {
+          const { confirm } = await Promise.resolve().then(() => (init_dist5(), dist_exports));
+          const ok = await confirm({
+            message: `Delete secret ${parsed.literal}?`
+          });
+          if (!ok) {
+            this.context.stderr.write("Cancelled.\n");
+            return 130;
+          }
+        } else {
+          this.context.stderr.write("keynv: refusing to delete without --force\n");
+          return 2;
+        }
+      }
       const projectId2 = await resolveProjectId(client, parsed.project);
-      await client.request(`/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`, {
-        method: "DELETE"
-      });
+      await client.request(
+        `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`,
+        {
+          method: "DELETE"
+        }
+      );
       this.context.stdout.write(`deleted ${parsed.literal}
 `);
       return 0;
@@ -46495,9 +47788,9 @@ Non-interactive with --yes to skip prompts.
       "# KEYNV_ARGON2_MEMORY_KIB=46080",
       "# KEYNV_ARGON2_TIME_COST=3"
     ].join("\n");
-    const { writeFileSync: writeFileSync4 } = await import('fs');
-    writeFileSync4(outPath, `${contents}
-`);
+    const { writeFileSync: writeFileSync5 } = await import('fs');
+    writeFileSync5(outPath, `${contents}
+`, { mode: 384 });
     this.context.stdout.write(`Wrote ${outPath}
 
 `);
@@ -46562,7 +47855,7 @@ services:
 volumes:
   keynv-data:
 `;
-      writeFileSync4("docker-compose.yml", composeContent);
+      writeFileSync5("docker-compose.yml", composeContent, { mode: 384 });
       this.context.stdout.write(
         "\nWrote docker-compose.yml (update Litestream S3 config before deploying).\n"
       );
@@ -46576,6 +47869,60 @@ init_dist();
 
 // ../../packages/testers/dist/http.js
 init_zod();
+
+// ../../packages/testers/dist/ssrf.js
+var PRIVATE_CIDRS = [
+  /^0\./,
+  /^10\./,
+  /^127\./,
+  /^169\.254\./,
+  /^172\.(1[6-9]|2\d|3[01])\./,
+  /^192\.0[0-2]\./,
+  /^192\.168\./,
+  /^198\.51\.100\./,
+  /^203\.0\.113\./,
+  /^224\./,
+  /^240\./
+];
+var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata.internal",
+  "instance-data"
+]);
+function isLoopbackAllowed() {
+  return !!process.env["KEYNV_ALLOW_LOOPBACK_TESTERS"];
+}
+function isBlockedHost(host) {
+  const lower = host.toLowerCase();
+  if (BLOCKED_HOSTNAMES.has(lower)) {
+    if (isLoopbackAllowed() && lower === "localhost")
+      return false;
+    return true;
+  }
+  if (lower === "0.0.0.0" || lower === "[::]" || lower === "[::1]")
+    return !isLoopbackAllowed();
+  for (const re2 of PRIVATE_CIDRS) {
+    if (re2.test(lower)) {
+      if (isLoopbackAllowed() && /^127\./.test(lower))
+        return false;
+      return true;
+    }
+  }
+  return false;
+}
+function isBlockedUrl(urlStr) {
+  try {
+    const parsed = new URL(urlStr);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+      return true;
+    return isBlockedHost(parsed.hostname);
+  } catch {
+    return true;
+  }
+}
+
+// ../../packages/testers/dist/http.js
 var Target = external_exports.object({
   url: external_exports.string().url(),
   method: external_exports.enum(["GET", "POST", "HEAD"]).default("GET"),
@@ -46594,6 +47941,13 @@ var httpTester = {
   type: "http",
   schema: Target,
   async test(secret, target) {
+    if (isBlockedUrl(target.url)) {
+      return {
+        ok: false,
+        latency_ms: 0,
+        error: "Target URL is blocked (private/internal IP or metadata endpoint)."
+      };
+    }
     const start = Date.now();
     const headers = {};
     switch (target.auth) {
@@ -46647,12 +48001,20 @@ var Target2 = external_exports.object({
   host: external_exports.string().min(1),
   port: external_exports.coerce.number().int().min(1).max(65535).default(3306),
   database: external_exports.string().min(1).optional(),
-  user: external_exports.string().min(1)
+  user: external_exports.string().min(1),
+  ssl: external_exports.coerce.boolean().optional()
 });
 var mysqlTester = {
   type: "mysql",
   schema: Target2,
   async test(secret, target) {
+    if (isBlockedHost(target.host)) {
+      return {
+        ok: false,
+        latency_ms: 0,
+        error: "Target host is blocked (private/internal IP or metadata endpoint)."
+      };
+    }
     const start = Date.now();
     const mysql = await Promise.resolve().then(() => __toESM(require_promise()));
     const conn = await mysql.createConnection({
@@ -46661,6 +48023,7 @@ var mysqlTester = {
       ...target.database ? { database: target.database } : {},
       user: target.user,
       password: secret.value,
+      ...target.ssl !== false ? { ssl: {} } : {},
       connectTimeout: 5e3
     }).catch((err) => {
       return {
@@ -46700,6 +48063,13 @@ var postgresTester = {
   type: "postgres",
   schema: Target3,
   async test(secret, target) {
+    if (isBlockedHost(target.host)) {
+      return {
+        ok: false,
+        latency_ms: 0,
+        error: "Target host is blocked (private/internal IP or metadata endpoint)."
+      };
+    }
     const start = Date.now();
     const { Client: Client2 } = await Promise.resolve().then(() => (init_esm(), esm_exports));
     const client = new Client2({
@@ -46708,7 +48078,7 @@ var postgresTester = {
       database: target.database,
       user: target.user,
       password: secret.value,
-      ssl: target.ssl ?? false,
+      ssl: target.ssl ?? true,
       connectionTimeoutMillis: 5e3,
       statement_timeout: 5e3
     });
@@ -46747,6 +48117,13 @@ var redisTester = {
   type: "redis",
   schema: Target4,
   async test(secret, target) {
+    if (isBlockedHost(target.host)) {
+      return {
+        ok: false,
+        latency_ms: 0,
+        error: "Target host is blocked (private/internal IP or metadata endpoint)."
+      };
+    }
     const start = Date.now();
     const { default: Redis } = await Promise.resolve().then(() => __toESM(require_built3()));
     const client = new Redis({
@@ -46790,15 +48167,28 @@ var Target5 = external_exports.object({
    * 'password' uses secret.value as a password; 'key' uses
    * secret.value as a PEM-encoded private key.
    */
-  auth: external_exports.enum(["password", "key"]).default("password")
+  auth: external_exports.enum(["password", "key"]).default("password"),
+  /**
+   * Expected SHA-256 fingerprint of the server host public key
+   * (base64, no padding). When set, the connection is rejected if
+   * the key does not match — preventing MITM attacks.
+   */
+  host_key_sha256: external_exports.string().min(1).optional()
 });
 var sshTester = {
   type: "ssh",
   schema: Target5,
   async test(secret, target) {
+    if (isBlockedHost(target.host)) {
+      return {
+        ok: false,
+        latency_ms: 0,
+        error: "Target host is blocked (private/internal IP or metadata endpoint)."
+      };
+    }
     const start = Date.now();
     const { Client: Client2 } = await import('ssh2');
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       const client = new Client2();
       let settled = false;
       const settle = (result) => {
@@ -46809,7 +48199,7 @@ var sshTester = {
           client.end();
         } catch {
         }
-        resolve3(result);
+        resolve4(result);
       };
       client.once("ready", () => {
         client.exec("true", (err, stream) => {
@@ -46834,13 +48224,30 @@ var sshTester = {
         settle({ ok: false, latency_ms: Date.now() - start, error: err.message });
       });
       try {
-        client.connect({
+        const connectOpts = {
           host: target.host,
           port: target.port,
           username: target.user,
-          ...target.auth === "password" ? { password: secret.value } : { privateKey: secret.value },
           readyTimeout: 5e3
-        });
+        };
+        if (target.auth === "password") {
+          connectOpts.password = secret.value;
+        } else {
+          connectOpts.privateKey = secret.value;
+        }
+        if (target.host_key_sha256) {
+          const expected = target.host_key_sha256;
+          connectOpts.hostVerifier = (key2) => {
+            if (typeof key2 === "string") {
+              return createHash("sha256").update(key2, "utf8").digest("base64").replace(/=+$/, "") === expected;
+            }
+            if (Buffer.isBuffer(key2)) {
+              return createHash("sha256").update(key2).digest("base64").replace(/=+$/, "") === expected;
+            }
+            return false;
+          };
+        }
+        client.connect(connectOpts);
       } catch (err) {
         settle({
           ok: false,
@@ -46853,6 +48260,8 @@ var sshTester = {
 };
 
 // ../../packages/testers/dist/types.js
+init_zod();
+external_exports.enum(["postgres", "mysql", "redis", "ssh", "http"]);
 var DEFAULT_TIMEOUT_MS = 5e3;
 
 // ../../packages/testers/dist/sanitize.js
@@ -46875,12 +48284,12 @@ function sanitizeResult(result, secret) {
 
 // ../../packages/testers/dist/run.js
 function withTimeout(promise, ms) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const t = setTimeout(() => reject(new Error(`tester timed out after ${ms}ms`)), ms);
     t.unref();
     promise.then((v2) => {
       clearTimeout(t);
-      resolve3(v2);
+      resolve4(v2);
     }, (err) => {
       clearTimeout(t);
       reject(err);
@@ -46915,7 +48324,7 @@ function formatZodIssues(error) {
 }
 
 // ../../packages/testers/dist/index.js
-var TESTERS = [
+var testers = [
   postgresTester,
   mysqlTester,
   redisTester,
@@ -46965,7 +48374,7 @@ the error message.
     description: "Override the default 5s timeout (in seconds)."
   });
   async execute() {
-    const parsedAlias = parseAlias(this.alias);
+    const parsedAlias = reference_exports.parseAlias(this.alias);
     if (!parsedAlias) {
       this.context.stderr.write(`keynv: invalid alias '${this.alias}'
 `);
@@ -46973,12 +48382,12 @@ the error message.
     }
     if (!this.as) {
       this.context.stderr.write(
-        `keynv: --as is required (one of: ${TESTERS.map((t) => t.type).join(", ")})
+        `keynv: --as is required (one of: ${testers.map((t) => t.type).join(", ")})
 `
       );
       return 2;
     }
-    const tester = TESTERS.find((t) => t.type === this.as);
+    const tester = testers.find((t) => t.type === this.as);
     if (!tester) {
       this.context.stderr.write(`keynv: unknown tester '${this.as}'
 `);
@@ -47108,7 +48517,7 @@ if (argv.length === 0) {
     process.exit(0);
   }
 } else {
-  cli.runExit(argv).catch((err) => {
+  cli.run(argv).then((code) => process.exit(code ?? 0)).catch((err) => {
     process.stderr.write(`${fmtError(err)}
 `);
     process.exit(1);