@keynv/cli 0.1.0-rc.14 → 0.1.0-rc.15

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { randomBytes } from 'crypto';
-import { readFileSync, writeFileSync, unlinkSync, existsSync, statSync, readdirSync, mkdirSync, rmSync } from 'fs';
+import { createHash, randomBytes } from 'crypto';
+import { readFileSync, writeFileSync, unlinkSync, existsSync, statSync, readdirSync, mkdirSync, rmSync, lstatSync } from 'fs';
 import { hostname, platform, homedir } from 'os';
 import * as nodePath from 'path';
 import { relative, join, isAbsolute, resolve, dirname, basename } from 'path';
 import { Entry } from '@napi-rs/keyring';
-import { styleText } from 'util';
+import { styleText, stripVTControlCharacters } from 'util';
 import j2, { stdin, stdout } from 'process';
 import * as b from 'readline';
 import b__default, { createInterface } from 'readline';
@@ -20,11 +20,11 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+var __require = /* @__PURE__ */ ((x2) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x2, {
   get: (a, b2) => (typeof require !== "undefined" ? require : a)[b2]
-}) : x)(function(x) {
+}) : x2)(function(x2) {
   if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
+  throw Error('Dynamic require of "' + x2 + '" is not supported');
 });
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
@@ -1057,14 +1057,20 @@ var require_lib = __commonJS({
 var VERSION, AGENT;
 var init_version = __esm({
   "src/version.ts"() {
-    VERSION = "0.1.0-rc.14" ;
+    VERSION = "0.1.0-rc.15" ;
     AGENT = `keynv-cli/${VERSION}`;
   }
 });
 
 // ../../packages/core/dist/reference/types.js
+var ALIAS_LIMITS;
 var init_types = __esm({
   "../../packages/core/dist/reference/types.js"() {
+    ALIAS_LIMITS = {
+      project: { min: 1, max: 48 },
+      environment: { min: 1, max: 24 },
+      key: { min: 1, max: 64 }
+    };
   }
 });
 
@@ -1096,10 +1102,10 @@ function parseAlias(input) {
 function findAliases(text, opts = {}) {
   if (typeof text !== "string" || text.length === 0)
     return [];
-  const re = opts.mode === "argv" ? ARGV_FIND_RE : TEXT_FIND_RE;
-  re.lastIndex = 0;
+  const re2 = opts.mode === "argv" ? ARGV_FIND_RE : TEXT_FIND_RE;
+  re2.lastIndex = 0;
   const matches = [];
-  for (const m of text.matchAll(re)) {
+  for (const m of text.matchAll(re2)) {
     const literal = m[0];
     const start = m.index;
     if (start === void 0)
@@ -1128,6 +1134,25 @@ function findAliasesInArgv(argv2) {
   }
   return result;
 }
+function replaceAliases(text, resolve4, opts = {}) {
+  if (typeof text !== "string" || text.length === 0)
+    return text;
+  const matches = findAliases(text, opts);
+  if (matches.length === 0)
+    return text;
+  let out = text;
+  for (let i = matches.length - 1; i >= 0; i--) {
+    const m = matches[i];
+    if (!m)
+      continue;
+    const replacement = resolve4(m);
+    if (replacement.startsWith("@") && PROJECT_RE.test(replacement.slice(1).split(".")[0] ?? "")) {
+      throw new Error(`replaceAliases: resolved value for ${m.literal} looks like an alias (${replacement}). Circular or misconfigured resolution detected.`);
+    }
+    out = out.slice(0, m.start) + replacement + out.slice(m.end);
+  }
+  return out;
+}
 function buildAlias(parts) {
   if (!PROJECT_RE.test(parts.project))
     return null;
@@ -1157,6 +1182,15 @@ var init_parser = __esm({
 });
 
 // ../../packages/core/dist/reference/index.js
+var reference_exports = {};
+__export(reference_exports, {
+  ALIAS_LIMITS: () => ALIAS_LIMITS,
+  buildAlias: () => buildAlias,
+  findAliases: () => findAliases,
+  findAliasesInArgv: () => findAliasesInArgv,
+  parseAlias: () => parseAlias,
+  replaceAliases: () => replaceAliases
+});
 var init_reference = __esm({
   "../../packages/core/dist/reference/index.js"() {
     init_types();
@@ -1673,7 +1707,7 @@ function addIssueToContext(ctx, issueData) {
       // then global override map
       overrideMap === en_default ? void 0 : en_default
       // then global default map
-    ].filter((x) => !!x)
+    ].filter((x2) => !!x2)
   });
   ctx.common.issues.push(issue);
 }
@@ -1767,10 +1801,10 @@ var init_parseUtil = __esm({
     });
     DIRTY = (value) => ({ status: "dirty", value });
     OK = (value) => ({ status: "valid", value });
-    isAborted = (x) => x.status === "aborted";
-    isDirty = (x) => x.status === "dirty";
-    isValid = (x) => x.status === "valid";
-    isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
+    isAborted = (x2) => x2.status === "aborted";
+    isDirty = (x2) => x2.status === "dirty";
+    isValid = (x2) => x2.status === "valid";
+    isAsync = (x2) => typeof Promise !== "undefined" && x2 instanceof Promise;
   }
 });
 
@@ -4270,7 +4304,7 @@ var init_types4 = __esm({
           if (!schema)
             return null;
           return schema._parse(new ParseInputLazyPath(ctx, item, ctx.path, itemIndex));
-        }).filter((x) => !!x);
+        }).filter((x2) => !!x2);
         if (ctx.common.async) {
           return Promise.all(items).then((results) => {
             return ParseStatus.mergeArray(status, results);
@@ -4523,7 +4557,7 @@ var init_types4 = __esm({
           return makeIssue({
             data: args,
             path: ctx.path,
-            errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), en_default].filter((x) => !!x),
+            errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), en_default].filter((x2) => !!x2),
             issueData: {
               code: ZodIssueCode.invalid_arguments,
               argumentsError: error
@@ -4534,7 +4568,7 @@ var init_types4 = __esm({
           return makeIssue({
             data: returns,
             path: ctx.path,
-            errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), en_default].filter((x) => !!x),
+            errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), en_default].filter((x2) => !!x2),
             issueData: {
               code: ZodIssueCode.invalid_return_type,
               returnTypeError: error
@@ -5389,7 +5423,7 @@ var init_payload_schemas = __esm({
     role = external_exports.enum(["lead", "developer", "reader"]);
     orgRole = external_exports.enum(["owner", "admin", "developer", "reader"]);
     email = external_exports.string().email();
-    version = external_exports.number().int().positive();
+    version = external_exports.coerce.number().int().positive();
     empty = external_exports.object({}).strict();
     orgId = external_exports.string().min(1);
     ({
@@ -5437,10 +5471,12 @@ var init_payload_schemas = __esm({
       }).strict(),
       "secret.deleted": external_exports.object({ project_id: projectId, env, key }).strict(),
       "secret.test.invoked": external_exports.object({ alias, tester: external_exports.string(), ok: external_exports.boolean(), latency_ms: external_exports.number() }).strict(),
+      "secret.test.denied": external_exports.object({ alias }).strict(),
       "approval.requested": external_exports.object({ alias }).strict(),
       "approval.granted": external_exports.object({ alias, granted_by: userId }).strict(),
       "approval.denied": external_exports.object({ alias, denied_by: userId }).strict(),
-      "kek.rotated": empty
+      "org.created": external_exports.object({ org_id: orgId, name: external_exports.string().min(1) }).strict(),
+      "org.updated": external_exports.object({ org_id: orgId, name: external_exports.string().min(1) }).strict()
     });
   }
 });
@@ -5472,15 +5508,16 @@ function entry() {
   return new Entry(SERVICE, KEY_ACCOUNT);
 }
 async function loadOrCreateKey() {
+  if (process.env["KEYNV_DISABLE_KEYCHAIN"] === "1") {
+    return loadOrCreateFileKey();
+  }
   const e2 = entry();
   let stored;
   try {
     stored = e2.getPassword();
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    throw new Error(
-      `keynv: OS keychain unavailable (${message}). Install libsecret on Linux, or set KEYNV_DISABLE_KEYCHAIN=1 to use a (less secure) file-based key store.`
-    );
+  } catch {
+    const message = process.env["KEYNV_DISABLE_KEYCHAIN"] ? "keynv: OS keychain unavailable. Set KEYNV_DISABLE_KEYCHAIN=1 to use a file-based key store (less secure)." : "keynv: OS keychain unavailable. Install libsecret on Linux, or set KEYNV_DISABLE_KEYCHAIN=1 to use a file-based key store (less secure).";
+    throw new Error(message);
   }
   if (stored) {
     return new Uint8Array(Buffer.from(stored, "base64"));
@@ -5495,6 +5532,20 @@ async function loadOrCreateKey() {
   }
   return fresh;
 }
+function fileKeyPath() {
+  return process.env["KEYNV_CREDENTIALS_KEY_FILE"] ?? join(homedir(), ".keynv", ".credentials-key");
+}
+async function loadOrCreateFileKey() {
+  const path = fileKeyPath();
+  if (existsSync(path)) {
+    const raw = readFileSync(path, "utf8").trim();
+    return new Uint8Array(Buffer.from(raw, "base64"));
+  }
+  const fresh = await crypto_exports.generateKey();
+  if (!existsSync(dirname(path))) mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, Buffer.from(fresh).toString("base64"), { mode: 384 });
+  return fresh;
+}
 async function saveCredentialsBlob(plaintext) {
   const key2 = await loadOrCreateKey();
   const sealed = await crypto_exports.encryptSecret(Buffer.from(plaintext).toString("utf8"), key2);
@@ -5535,6 +5586,11 @@ function clearCredentialsFile() {
   if (existsSync(path)) rmSync(path, { force: true });
   const legacy = legacyPath();
   if (existsSync(legacy)) rmSync(legacy, { force: true });
+  if (process.env["KEYNV_DISABLE_KEYCHAIN"] === "1") {
+    const keyPath = fileKeyPath();
+    if (existsSync(keyPath)) rmSync(keyPath, { force: true });
+    return true;
+  }
   try {
     entry().deletePassword();
     return true;
@@ -5769,8 +5825,7 @@ function handleExecError(stderr, err) {
     stderr.write(`keynv: ${err.message}
 `);
   } else {
-    stderr.write(`keynv: unexpected error
-`);
+    stderr.write("keynv: unexpected error\n");
   }
   return 1;
 }
@@ -5845,7 +5900,7 @@ function parseEnvFile(content, filename) {
     entries.push({
       name,
       value,
-      isAlias: parseAlias(value) !== null,
+      isAlias: reference_exports.parseAlias(value) !== null,
       line: lineNo
     });
   }
@@ -5920,247 +5975,6 @@ var init_envFile = __esm({
     };
   }
 });
-function findProjectRoot(startDir) {
-  const result = walkUp(startDir, (dir) => {
-    for (const marker of PROJECT_MARKERS) {
-      if (existsSync(join(dir, marker))) {
-        return { dir, marker };
-      }
-    }
-    if (existsSync(join(dir, GIT_MARKER))) {
-      return { dir, marker: GIT_MARKER };
-    }
-    return null;
-  });
-  if (!result) return null;
-  return buildRoot(result.dir, result.marker);
-}
-function buildRoot(dir, marker) {
-  let suggestedName = basename(dir);
-  let scripts = null;
-  let invalid = false;
-  if (marker === "package.json" || existsSync(join(dir, "package.json"))) {
-    try {
-      const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
-      if (typeof pkg.name === "string" && pkg.name.length > 0) {
-        suggestedName = pkg.name.replace(/^@[^/]+\//, "");
-      }
-      if (pkg.scripts && typeof pkg.scripts === "object") {
-        scripts = Object.fromEntries(
-          Object.entries(pkg.scripts).filter(([, v2]) => typeof v2 === "string")
-        );
-      }
-    } catch {
-      invalid = true;
-    }
-  }
-  return {
-    path: dir,
-    suggestedName,
-    marker,
-    packageJsonScripts: scripts,
-    packageJsonInvalid: invalid
-  };
-}
-function findEnvFiles(rootDir) {
-  let entries;
-  try {
-    entries = readdirSync(rootDir);
-  } catch {
-    return [];
-  }
-  const hits = [];
-  for (const name of entries) {
-    if (!ENV_GLOB.test(name)) continue;
-    if (ENV_EXAMPLE.test(name)) continue;
-    if (name === KEYNV_ENV_BASENAME) continue;
-    const full = join(rootDir, name);
-    try {
-      if (!statSync(full).isFile()) continue;
-    } catch {
-      continue;
-    }
-    const suffixMatch = name.match(/^\.env\.(.+)$/);
-    const suffix = suffixMatch ? suffixMatch[1] : null;
-    hits.push({ path: full, name, suffix, suggestedEnv: suggestedEnvForSuffix(suffix) });
-  }
-  hits.sort((a, b2) => {
-    if (a.suffix === null) return -1;
-    if (b2.suffix === null) return 1;
-    return a.name.localeCompare(b2.name);
-  });
-  return hits;
-}
-function suggestedEnvForSuffix(suffix) {
-  if (suffix === null) return "dev";
-  switch (suffix) {
-    case "local":
-    case "development":
-    case "dev":
-      return "dev";
-    case "production":
-    case "prod":
-      return "prod";
-    case "staging":
-    case "stage":
-      return "staging";
-    case "test":
-      return "test";
-    case "preview":
-      return "preview";
-    default:
-      return suffix;
-  }
-}
-function hasExistingKeynvEnv(rootDir) {
-  return existsSync(join(rootDir, KEYNV_ENV_BASENAME));
-}
-var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME;
-var init_detect = __esm({
-  "src/init/detect.ts"() {
-    init_fs();
-    PROJECT_MARKERS = [
-      "package.json",
-      "pyproject.toml",
-      "Cargo.toml",
-      "go.mod",
-      "pnpm-workspace.yaml",
-      "deno.json",
-      "deno.jsonc",
-      "requirements.txt"
-    ];
-    GIT_MARKER = ".git";
-    ENV_GLOB = /^\.env(\.[A-Za-z0-9_-]+)?$/;
-    ENV_EXAMPLE = /^\.env\.(example|sample|template|dist|defaults)$/;
-    KEYNV_ENV_BASENAME = ".keynv.env";
-  }
-});
-
-// src/init/heuristics.ts
-function shannonEntropyBits(s) {
-  if (s.length === 0) return 0;
-  const counts = /* @__PURE__ */ new Map();
-  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
-  let h2 = 0;
-  for (const c2 of counts.values()) {
-    const p2 = c2 / s.length;
-    h2 -= p2 * Math.log2(p2);
-  }
-  return h2;
-}
-function nameMatchesLiteralPrefix(name) {
-  const upper = name.toUpperCase();
-  return NAME_LITERAL_PREFIX.some((p2) => upper.startsWith(p2));
-}
-function nameMatchesSecretSuffix(name) {
-  const upper = name.toUpperCase();
-  for (const { suffix, hint } of NAME_SECRET_SUFFIXES) {
-    if (upper.endsWith(suffix) || upper.endsWith(`_${suffix}`)) {
-      return { matched: true, hint };
-    }
-  }
-  return { matched: false, hint: "" };
-}
-function classifyEntry(name, value) {
-  const upper = name.toUpperCase();
-  if (NAME_FRAMEWORK_MANAGED.has(upper)) {
-    return { verdict: "skip", hint: "framework/shell-managed" };
-  }
-  if (NAME_LITERAL_EXACT.has(upper)) {
-    return { verdict: "literal", hint: "common config var" };
-  }
-  if (nameMatchesLiteralPrefix(name)) {
-    return { verdict: "literal", hint: "public env, build-time bundled" };
-  }
-  if (value.length === 0) {
-    return { verdict: "literal", hint: "empty" };
-  }
-  for (const { re, hint } of VALUE_PATTERNS) {
-    if (re.test(value)) return { verdict: "secret", hint };
-  }
-  const suffix = nameMatchesSecretSuffix(name);
-  if (suffix.matched) {
-    return { verdict: "secret", hint: suffix.hint };
-  }
-  if (NAME_DB_URL.test(name)) {
-    return { verdict: "secret", hint: "database URL" };
-  }
-  if (value.length >= 32) {
-    const bits = shannonEntropyBits(value);
-    if (bits >= 3.5) {
-      return { verdict: "secret", hint: `${value.length}-char random-looking string` };
-    }
-  }
-  return { verdict: "ambiguous", hint: "" };
-}
-function previewValue(value, max = 40) {
-  if (value.length === 0) return "(empty)";
-  if (value.length <= max) return value;
-  return `${value.slice(0, max - 1)}\u2026`;
-}
-var NAME_FRAMEWORK_MANAGED, NAME_LITERAL_EXACT, NAME_LITERAL_PREFIX, NAME_SECRET_SUFFIXES, NAME_DB_URL, VALUE_PATTERNS;
-var init_heuristics = __esm({
-  "src/init/heuristics.ts"() {
-    NAME_FRAMEWORK_MANAGED = /* @__PURE__ */ new Set([
-      "NODE_ENV",
-      "PORT",
-      "HOST",
-      "HOSTNAME",
-      "PATH",
-      "HOME",
-      "USER",
-      "SHELL",
-      "PWD",
-      "CI"
-    ]);
-    NAME_LITERAL_EXACT = /* @__PURE__ */ new Set([
-      "DEBUG",
-      "LOG_LEVEL",
-      "LOGLEVEL",
-      "TZ",
-      "LANG",
-      "LC_ALL",
-      "NODE_OPTIONS",
-      "NPM_CONFIG_LOGLEVEL",
-      "TS_NODE_PROJECT"
-    ]);
-    NAME_LITERAL_PREFIX = ["NEXT_PUBLIC_", "VITE_", "REACT_APP_", "PUBLIC_", "EXPO_PUBLIC_"];
-    NAME_SECRET_SUFFIXES = [
-      { suffix: "PRIVATE_KEY", hint: "private key" },
-      { suffix: "API_KEY", hint: "API key" },
-      { suffix: "ACCESS_KEY", hint: "access key" },
-      { suffix: "SECRET_KEY", hint: "secret key" },
-      { suffix: "SECRET", hint: "secret" },
-      { suffix: "PASSWORD", hint: "password" },
-      { suffix: "PASSPHRASE", hint: "passphrase" },
-      { suffix: "TOKEN", hint: "token" },
-      { suffix: "KEY", hint: "key" },
-      { suffix: "CREDENTIALS", hint: "credentials" },
-      { suffix: "AUTH", hint: "auth" },
-      { suffix: "DSN", hint: "connection string" }
-    ];
-    NAME_DB_URL = /^(DATABASE|DB|POSTGRES|MYSQL|MONGO|REDIS)_URL$/i;
-    VALUE_PATTERNS = [
-      { re: /^sk-proj-/, hint: "OpenAI project key" },
-      { re: /^sk-[A-Za-z0-9]{20,}/, hint: "OpenAI key" },
-      { re: /^sk_live_/, hint: "Stripe live key" },
-      { re: /^sk_test_/, hint: "Stripe test key" },
-      { re: /^pk_live_/, hint: "Stripe publishable \u2014 often public, double-check" },
-      { re: /^xoxb-/, hint: "Slack bot token" },
-      { re: /^xoxp-/, hint: "Slack user token" },
-      { re: /^ghp_[A-Za-z0-9]{30,}/, hint: "GitHub personal access token" },
-      { re: /^github_pat_/, hint: "GitHub fine-grained PAT" },
-      { re: /^gho_/, hint: "GitHub OAuth token" },
-      { re: /^AKIA[0-9A-Z]{16}$/, hint: "AWS access key id" },
-      { re: /^ASIA[0-9A-Z]{16}$/, hint: "AWS temporary key id" },
-      { re: /^AIza[0-9A-Za-z_-]{35}$/, hint: "Google API key" },
-      { re: /^ya29\./, hint: "Google OAuth access token" },
-      { re: /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, hint: "JWT" },
-      { re: /^-----BEGIN [A-Z ]+PRIVATE KEY-----/, hint: "PEM private key" },
-      { re: /^([a-z]+):\/\/[^@]+:[^@]+@/i, hint: "connection string with credentials" }
-    ];
-  }
-});
 function aiContextBody() {
   return `## keynv (secrets)
 
@@ -6243,13 +6057,254 @@ ${block}
   return "appended";
 }
 var AGENTS_FILE_BASENAME, KEYNV_BLOCK_START, KEYNV_BLOCK_END;
-var init_aiContext = __esm({
-  "src/init/aiContext.ts"() {
+var init_ai_context = __esm({
+  "src/init/ai-context.ts"() {
     AGENTS_FILE_BASENAME = "AGENTS.md";
     KEYNV_BLOCK_START = "<!-- keynv:start -- generated by `keynv init`; safe to leave intact, will be refreshed on re-run -->";
     KEYNV_BLOCK_END = "<!-- keynv:end -->";
   }
 });
+function findProjectRoot(startDir) {
+  const result = walkUp(startDir, (dir) => {
+    for (const marker of PROJECT_MARKERS) {
+      if (existsSync(join(dir, marker))) {
+        return { dir, marker };
+      }
+    }
+    if (existsSync(join(dir, GIT_MARKER))) {
+      return { dir, marker: GIT_MARKER };
+    }
+    return null;
+  });
+  if (!result) return null;
+  return buildRoot(result.dir, result.marker);
+}
+function buildRoot(dir, marker) {
+  let suggestedName = basename(dir);
+  let scripts = null;
+  let invalid = false;
+  if (marker === "package.json" || existsSync(join(dir, "package.json"))) {
+    try {
+      const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+      if (typeof pkg.name === "string" && pkg.name.length > 0) {
+        suggestedName = pkg.name.replace(/^@[^/]+\//, "");
+      }
+      if (pkg.scripts && typeof pkg.scripts === "object") {
+        scripts = Object.fromEntries(
+          Object.entries(pkg.scripts).filter(([, v2]) => typeof v2 === "string")
+        );
+      }
+    } catch {
+      invalid = true;
+    }
+  }
+  return {
+    path: dir,
+    suggestedName,
+    marker,
+    packageJsonScripts: scripts,
+    packageJsonInvalid: invalid
+  };
+}
+function findEnvFiles(rootDir) {
+  let entries;
+  try {
+    entries = readdirSync(rootDir);
+  } catch {
+    return [];
+  }
+  const hits = [];
+  for (const name of entries) {
+    if (!ENV_GLOB.test(name)) continue;
+    if (ENV_EXAMPLE.test(name)) continue;
+    if (name === KEYNV_ENV_BASENAME) continue;
+    const full = join(rootDir, name);
+    try {
+      if (!statSync(full).isFile()) continue;
+    } catch {
+      continue;
+    }
+    const suffixMatch = name.match(/^\.env\.(.+)$/);
+    const suffix = suffixMatch ? suffixMatch[1] : null;
+    hits.push({ path: full, name, suffix, suggestedEnv: suggestedEnvForSuffix(suffix) });
+  }
+  hits.sort((a, b2) => {
+    if (a.suffix === null) return -1;
+    if (b2.suffix === null) return 1;
+    return a.name.localeCompare(b2.name);
+  });
+  return hits;
+}
+function suggestedEnvForSuffix(suffix) {
+  if (suffix === null) return "dev";
+  switch (suffix) {
+    case "local":
+    case "development":
+    case "dev":
+      return "dev";
+    case "production":
+    case "prod":
+      return "prod";
+    case "staging":
+    case "stage":
+      return "staging";
+    case "test":
+      return "test";
+    case "preview":
+      return "preview";
+    default:
+      return suffix;
+  }
+}
+function hasExistingKeynvEnv(rootDir) {
+  return existsSync(join(rootDir, KEYNV_ENV_BASENAME));
+}
+var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME;
+var init_detect = __esm({
+  "src/init/detect.ts"() {
+    init_fs();
+    PROJECT_MARKERS = [
+      "package.json",
+      "pyproject.toml",
+      "Cargo.toml",
+      "go.mod",
+      "pnpm-workspace.yaml",
+      "deno.json",
+      "deno.jsonc",
+      "requirements.txt"
+    ];
+    GIT_MARKER = ".git";
+    ENV_GLOB = /^\.env(\.[A-Za-z0-9_-]+)?$/;
+    ENV_EXAMPLE = /^\.env\.(example|sample|template|dist|defaults)$/;
+    KEYNV_ENV_BASENAME = ".keynv.env";
+  }
+});
+
+// src/init/heuristics.ts
+function shannonEntropyBits(s) {
+  if (s.length === 0) return 0;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let h2 = 0;
+  for (const c2 of counts.values()) {
+    const p2 = c2 / s.length;
+    h2 -= p2 * Math.log2(p2);
+  }
+  return h2;
+}
+function nameMatchesLiteralPrefix(name) {
+  const upper = name.toUpperCase();
+  return NAME_LITERAL_PREFIX.some((p2) => upper.startsWith(p2));
+}
+function nameMatchesSecretSuffix(name) {
+  const upper = name.toUpperCase();
+  for (const { suffix, hint } of NAME_SECRET_SUFFIXES) {
+    if (upper.endsWith(suffix) || upper.endsWith(`_${suffix}`)) {
+      return { matched: true, hint };
+    }
+  }
+  return { matched: false, hint: "" };
+}
+function classifyEntry(name, value) {
+  const upper = name.toUpperCase();
+  if (NAME_FRAMEWORK_MANAGED.has(upper)) {
+    return { verdict: "skip", hint: "framework/shell-managed" };
+  }
+  if (NAME_LITERAL_EXACT.has(upper)) {
+    return { verdict: "literal", hint: "common config var" };
+  }
+  if (nameMatchesLiteralPrefix(name)) {
+    return { verdict: "literal", hint: "public env, build-time bundled" };
+  }
+  if (value.length === 0) {
+    return { verdict: "literal", hint: "empty" };
+  }
+  for (const { re: re2, hint } of VALUE_PATTERNS) {
+    if (re2.test(value)) return { verdict: "secret", hint };
+  }
+  const suffix = nameMatchesSecretSuffix(name);
+  if (suffix.matched) {
+    return { verdict: "secret", hint: suffix.hint };
+  }
+  if (NAME_DB_URL.test(name)) {
+    return { verdict: "secret", hint: "database URL" };
+  }
+  if (value.length >= 32) {
+    const bits = shannonEntropyBits(value);
+    if (bits >= 3.5) {
+      return { verdict: "secret", hint: `${value.length}-char random-looking string` };
+    }
+  }
+  return { verdict: "ambiguous", hint: "" };
+}
+function previewValue(value, max = 40) {
+  if (value.length === 0) return "(empty)";
+  if (value.length <= max) return value;
+  return `${value.slice(0, max - 1)}\u2026`;
+}
+var NAME_FRAMEWORK_MANAGED, NAME_LITERAL_EXACT, NAME_LITERAL_PREFIX, NAME_SECRET_SUFFIXES, NAME_DB_URL, VALUE_PATTERNS;
+var init_heuristics = __esm({
+  "src/init/heuristics.ts"() {
+    NAME_FRAMEWORK_MANAGED = /* @__PURE__ */ new Set([
+      "NODE_ENV",
+      "PORT",
+      "HOST",
+      "HOSTNAME",
+      "PATH",
+      "HOME",
+      "USER",
+      "SHELL",
+      "PWD",
+      "CI"
+    ]);
+    NAME_LITERAL_EXACT = /* @__PURE__ */ new Set([
+      "DEBUG",
+      "LOG_LEVEL",
+      "LOGLEVEL",
+      "TZ",
+      "LANG",
+      "LC_ALL",
+      "NODE_OPTIONS",
+      "NPM_CONFIG_LOGLEVEL",
+      "TS_NODE_PROJECT"
+    ]);
+    NAME_LITERAL_PREFIX = ["NEXT_PUBLIC_", "VITE_", "REACT_APP_", "PUBLIC_", "EXPO_PUBLIC_"];
+    NAME_SECRET_SUFFIXES = [
+      { suffix: "PRIVATE_KEY", hint: "private key" },
+      { suffix: "API_KEY", hint: "API key" },
+      { suffix: "ACCESS_KEY", hint: "access key" },
+      { suffix: "SECRET_KEY", hint: "secret key" },
+      { suffix: "SECRET", hint: "secret" },
+      { suffix: "PASSWORD", hint: "password" },
+      { suffix: "PASSPHRASE", hint: "passphrase" },
+      { suffix: "TOKEN", hint: "token" },
+      { suffix: "KEY", hint: "key" },
+      { suffix: "CREDENTIALS", hint: "credentials" },
+      { suffix: "AUTH", hint: "auth" },
+      { suffix: "DSN", hint: "connection string" }
+    ];
+    NAME_DB_URL = /^(DATABASE|DB|POSTGRES|MYSQL|MONGO|REDIS)_URL$/i;
+    VALUE_PATTERNS = [
+      { re: /^sk-proj-/, hint: "OpenAI project key" },
+      { re: /^sk-[A-Za-z0-9]{20,}/, hint: "OpenAI key" },
+      { re: /^sk_live_/, hint: "Stripe live key" },
+      { re: /^sk_test_/, hint: "Stripe test key" },
+      { re: /^pk_live_/, hint: "Stripe publishable \u2014 often public, double-check" },
+      { re: /^xoxb-/, hint: "Slack bot token" },
+      { re: /^xoxp-/, hint: "Slack user token" },
+      { re: /^ghp_[A-Za-z0-9]{30,}/, hint: "GitHub personal access token" },
+      { re: /^github_pat_/, hint: "GitHub fine-grained PAT" },
+      { re: /^gho_/, hint: "GitHub OAuth token" },
+      { re: /^AKIA[0-9A-Z]{16}$/, hint: "AWS access key id" },
+      { re: /^ASIA[0-9A-Z]{16}$/, hint: "AWS temporary key id" },
+      { re: /^AIza[0-9A-Za-z_-]{35}$/, hint: "Google API key" },
+      { re: /^ya29\./, hint: "Google OAuth access token" },
+      { re: /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, hint: "JWT" },
+      { re: /^-----BEGIN [A-Z ]+PRIVATE KEY-----/, hint: "PEM private key" },
+      { re: /^([a-z]+):\/\/[^@]+:[^@]+@/i, hint: "connection string with credentials" }
+    ];
+  }
+});
 
 // ../../node_modules/.pnpm/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/utils.js
 var getCodePointsLength, isFullWidth, isWideNotCJKTNotEmoji;
@@ -6266,11 +6321,11 @@ var init_utils = __esm({
         return input.length - surrogatePairsNr;
       };
     })();
-    isFullWidth = (x) => {
-      return x === 12288 || x >= 65281 && x <= 65376 || x >= 65504 && x <= 65510;
+    isFullWidth = (x2) => {
+      return x2 === 12288 || x2 >= 65281 && x2 <= 65376 || x2 >= 65504 && x2 <= 65510;
     };
-    isWideNotCJKTNotEmoji = (x) => {
-      return x === 8987 || x === 9001 || x >= 12272 && x <= 12287 || x >= 12289 && x <= 12350 || x >= 12441 && x <= 12543 || x >= 12549 && x <= 12591 || x >= 12593 && x <= 12686 || x >= 12688 && x <= 12771 || x >= 12783 && x <= 12830 || x >= 12832 && x <= 12871 || x >= 12880 && x <= 19903 || x >= 65040 && x <= 65049 || x >= 65072 && x <= 65106 || x >= 65108 && x <= 65126 || x >= 65128 && x <= 65131 || x >= 127488 && x <= 127490 || x >= 127504 && x <= 127547 || x >= 127552 && x <= 127560 || x >= 131072 && x <= 196605 || x >= 196608 && x <= 262141;
+    isWideNotCJKTNotEmoji = (x2) => {
+      return x2 === 8987 || x2 === 9001 || x2 >= 12272 && x2 <= 12287 || x2 >= 12289 && x2 <= 12350 || x2 >= 12441 && x2 <= 12543 || x2 >= 12549 && x2 <= 12591 || x2 >= 12593 && x2 <= 12686 || x2 >= 12688 && x2 <= 12771 || x2 >= 12783 && x2 <= 12830 || x2 >= 12832 && x2 <= 12871 || x2 >= 12880 && x2 <= 19903 || x2 >= 65040 && x2 <= 65049 || x2 >= 65072 && x2 <= 65106 || x2 >= 65108 && x2 <= 65126 || x2 >= 65128 && x2 <= 65131 || x2 >= 127488 && x2 <= 127490 || x2 >= 127504 && x2 <= 127547 || x2 >= 127552 && x2 <= 127560 || x2 >= 131072 && x2 <= 196605 || x2 >= 196608 && x2 <= 262141;
     };
   }
 });
@@ -6617,14 +6672,14 @@ var require_src = __commonJS({
     var CSI2 = `${ESC2}[`;
     var beep = "\x07";
     var cursor = {
-      to(x, y) {
-        if (!y) return `${CSI2}${x + 1}G`;
-        return `${CSI2}${y + 1};${x + 1}H`;
+      to(x2, y) {
+        if (!y) return `${CSI2}${x2 + 1}G`;
+        return `${CSI2}${y + 1};${x2 + 1}H`;
       },
-      move(x, y) {
+      move(x2, y) {
         let ret = "";
-        if (x < 0) ret += `${CSI2}${-x}D`;
-        else if (x > 0) ret += `${CSI2}${x}C`;
+        if (x2 < 0) ret += `${CSI2}${-x2}D`;
+        else if (x2 > 0) ret += `${CSI2}${x2}C`;
         if (y < 0) ret += `${CSI2}${-y}A`;
         else if (y > 0) ret += `${CSI2}${y}B`;
         return ret;
@@ -6669,6 +6724,39 @@ function d(r, t, s) {
   const e2 = r + t, i = Math.max(s.length - 1, 0), n = e2 < 0 ? i : e2 > i ? 0 : e2;
   return s[n].disabled ? d(n, t < 0 ? -1 : 1, s) : n;
 }
+function I(r, t, s, e2) {
+  const i = e2.split(`
+`);
+  let n = 0, o = r;
+  for (const a of i) {
+    if (o <= a.length) break;
+    o -= a.length + 1, n++;
+  }
+  for (n = Math.max(0, Math.min(i.length - 1, n + s)), o = Math.min(o, i[n].length) + t; o < 0 && n > 0; ) n--, o += i[n].length + 1;
+  for (; o > i[n].length && n < i.length - 1; ) o -= i[n].length + 1, n++;
+  o = Math.max(0, Math.min(i[n].length, o));
+  let u = 0;
+  for (let a = 0; a < n; a++) u += i[a].length + 1;
+  return u + o;
+}
+function j(r) {
+  if (r.aliases !== void 0) {
+    const t = r.aliases;
+    for (const s in t) {
+      if (!Object.hasOwn(t, s)) continue;
+      const e2 = t[s];
+      h.actions.has(e2) && (h.aliases.has(s) || h.aliases.set(s, e2));
+    }
+  }
+  if (r.messages !== void 0) {
+    const t = r.messages;
+    t.cancel !== void 0 && (h.messages.cancel = t.cancel), t.error !== void 0 && (h.messages.error = t.error);
+  }
+  if (r.withGuide !== void 0 && (h.withGuide = r.withGuide !== false), r.date !== void 0) {
+    const t = r.date;
+    t.monthNames !== void 0 && (h.date.monthNames = [...t.monthNames]), t.messages !== void 0 && (t.messages.required !== void 0 && (h.date.messages.required = t.messages.required), t.messages.invalidMonth !== void 0 && (h.date.messages.invalidMonth = t.messages.invalidMonth), t.messages.invalidDay !== void 0 && (h.date.messages.invalidDay = t.messages.invalidDay), t.messages.afterMin !== void 0 && (h.date.messages.afterMin = t.messages.afterMin), t.messages.beforeMax !== void 0 && (h.date.messages.beforeMax = t.messages.beforeMax));
+  }
+}
 function C(r, t) {
   if (typeof r == "string") return h.aliases.get(r) === t;
   for (const s of r) if (s !== void 0 && C(s, t)) return true;
@@ -6714,12 +6802,55 @@ function W(r, t, s, e2 = s, i) {
   const n = A(r ?? stdout);
   return wrapAnsi(t, n - s.length, { hard: true, trim: false }).split(`
 `).map((o, u) => {
-    const a = o;
+    const a = i ? i(o, u) : o;
     return `${u === 0 ? e2 : s}${a}`;
   }).join(`
 `);
 }
-var import_sisteransi, G, K, h, Y, k, A, L, p, X, nt, ot, ut, ht;
+function B(r, t) {
+  if (r === void 0 || t.length === 0) return 0;
+  const s = t.findIndex((e2) => e2.value === r);
+  return s !== -1 ? s : 0;
+}
+function J(r, t) {
+  return (t.label ?? String(t.value)).toLowerCase().includes(r.toLowerCase());
+}
+function H(r, t) {
+  if (t) return r ? t : t[0];
+}
+function P(r) {
+  return [...r].map((t) => Z[t]);
+}
+function tt(r) {
+  const t = new Intl.DateTimeFormat(r, { year: "numeric", month: "2-digit", day: "2-digit" }).formatToParts(new Date(2e3, 0, 15)), s = [];
+  let e2 = "/";
+  for (const i of t) i.type === "literal" ? e2 = i.value.trim() || i.value : (i.type === "year" || i.type === "month" || i.type === "day") && s.push({ type: i.type, len: i.type === "year" ? 4 : 2 });
+  return { segments: s, separator: e2 };
+}
+function U(r) {
+  return Number.parseInt((r || "0").replace(/_/g, "0"), 10) || 0;
+}
+function x(r) {
+  return { year: U(r.year), month: U(r.month), day: U(r.day) };
+}
+function $(r, t) {
+  return new Date(r || 2001, t || 1, 0).getDate();
+}
+function F(r) {
+  const { year: t, month: s, day: e2 } = x(r);
+  if (!t || t < 0 || t > 9999 || !s || s < 1 || s > 12 || !e2 || e2 < 1) return;
+  const i = new Date(Date.UTC(t, s - 1, e2));
+  if (!(i.getUTCFullYear() !== t || i.getUTCMonth() !== s - 1 || i.getUTCDate() !== e2)) return { year: t, month: s, day: e2 };
+}
+function N(r) {
+  const t = F(r);
+  return t ? new Date(Date.UTC(t.year, t.month - 1, t.day)) : void 0;
+}
+function st(r, t, s, e2) {
+  const i = s ? { year: s.getUTCFullYear(), month: s.getUTCMonth() + 1, day: s.getUTCDate() } : null, n = e2 ? { year: e2.getUTCFullYear(), month: e2.getUTCMonth() + 1, day: e2.getUTCDate() } : null;
+  return r === "year" ? { min: i?.year ?? 1, max: n?.year ?? 9999 } : r === "month" ? { min: i && t.year === i.year ? i.month : 1, max: n && t.year === n.year ? n.month : 12 } : { min: i && t.year === i.year && t.month === i.month ? i.day : 1, max: n && t.year === n.year && t.month === n.month ? n.day : $(t.year, t.month) };
+}
+var import_sisteransi, G, K, h, Y, k, A, L, p, Q, X, Z, et, it, rt, nt, ot, ut, at, ht;
 var init_dist4 = __esm({
   "../../node_modules/.pnpm/@clack+core@1.3.0/node_modules/@clack/core/dist/index.mjs"() {
     init_main();
@@ -6856,6 +6987,69 @@ var init_dist4 = __esm({
         }
       }
     };
+    Q = class extends p {
+      filteredOptions;
+      multiple;
+      isNavigating = false;
+      selectedValues = [];
+      focusedValue;
+      #s = 0;
+      #r = "";
+      #t;
+      #n;
+      #u;
+      get cursor() {
+        return this.#s;
+      }
+      get userInputWithCursor() {
+        if (!this.userInput) return styleText(["inverse", "hidden"], "_");
+        if (this._cursor >= this.userInput.length) return `${this.userInput}\u2588`;
+        const t = this.userInput.slice(0, this._cursor), [s, ...e2] = this.userInput.slice(this._cursor);
+        return `${t}${styleText("inverse", s)}${e2.join("")}`;
+      }
+      get options() {
+        return typeof this.#n == "function" ? this.#n() : this.#n;
+      }
+      constructor(t) {
+        super(t), this.#n = t.options, this.#u = t.placeholder;
+        const s = this.options;
+        this.filteredOptions = [...s], this.multiple = t.multiple === true, this.#t = typeof t.options == "function" ? t.filter : t.filter ?? J;
+        let e2;
+        if (t.initialValue && Array.isArray(t.initialValue) ? this.multiple ? e2 = t.initialValue : e2 = t.initialValue.slice(0, 1) : !this.multiple && this.options.length > 0 && (e2 = [this.options[0].value]), e2) for (const i of e2) {
+          const n = s.findIndex((o) => o.value === i);
+          n !== -1 && (this.toggleSelected(i), this.#s = n);
+        }
+        this.focusedValue = this.options[this.#s]?.value, this.on("key", (i, n) => this.#e(i, n)), this.on("userInput", (i) => this.#i(i));
+      }
+      _isActionKey(t, s) {
+        return t === "	" || this.multiple && this.isNavigating && s.name === "space" && t !== void 0 && t !== "";
+      }
+      #e(t, s) {
+        const e2 = s.name === "up", i = s.name === "down", n = s.name === "return", o = this.userInput === "" || this.userInput === "	", u = this.#u, a = this.options, l = u !== void 0 && u !== "" && a.some((f) => !f.disabled && (this.#t ? this.#t(u, f) : true));
+        if (s.name === "tab" && o && l) {
+          this.userInput === "	" && this._clearUserInput(), this._setUserInput(u, true), this.isNavigating = false;
+          return;
+        }
+        e2 || i ? (this.#s = d(this.#s, e2 ? -1 : 1, this.filteredOptions), this.focusedValue = this.filteredOptions[this.#s]?.value, this.multiple || (this.selectedValues = [this.focusedValue]), this.isNavigating = true) : n ? this.value = H(this.multiple, this.selectedValues) : this.multiple ? this.focusedValue !== void 0 && (s.name === "tab" || this.isNavigating && s.name === "space") ? this.toggleSelected(this.focusedValue) : this.isNavigating = false : (this.focusedValue && (this.selectedValues = [this.focusedValue]), this.isNavigating = false);
+      }
+      deselectAll() {
+        this.selectedValues = [];
+      }
+      toggleSelected(t) {
+        this.filteredOptions.length !== 0 && (this.multiple ? this.selectedValues.includes(t) ? this.selectedValues = this.selectedValues.filter((s) => s !== t) : this.selectedValues = [...this.selectedValues, t] : this.selectedValues = [t]);
+      }
+      #i(t) {
+        if (t !== this.#r) {
+          this.#r = t;
+          const s = this.options;
+          t && this.#t ? this.filteredOptions = s.filter((n) => this.#t?.(t, n)) : this.filteredOptions = [...s];
+          const e2 = B(this.focusedValue, this.filteredOptions);
+          this.#s = d(e2, 0, this.filteredOptions);
+          const i = this.filteredOptions[this.#s];
+          i && !i.disabled ? this.focusedValue = i.value : this.focusedValue = void 0, this.multiple || (this.focusedValue !== void 0 ? this.toggleSelected(this.focusedValue) : this.deselectAll());
+        }
+      }
+    };
     X = class extends p {
       get cursor() {
         return this.value ? 0 : 1;
@@ -6873,6 +7067,266 @@ var init_dist4 = __esm({
         });
       }
     };
+    Z = { Y: { type: "year", len: 4 }, M: { type: "month", len: 2 }, D: { type: "day", len: 2 } };
+    et = class extends p {
+      #s;
+      #r;
+      #t;
+      #n;
+      #u;
+      #e = { segmentIndex: 0, positionInSegment: 0 };
+      #i = true;
+      #o = null;
+      inlineError = "";
+      get segmentCursor() {
+        return { ...this.#e };
+      }
+      get segmentValues() {
+        return { ...this.#t };
+      }
+      get segments() {
+        return this.#s;
+      }
+      get separator() {
+        return this.#r;
+      }
+      get formattedValue() {
+        return this.#c(this.#t);
+      }
+      #c(t) {
+        return this.#s.map((s) => t[s.type]).join(this.#r);
+      }
+      #a() {
+        this._setUserInput(this.#c(this.#t)), this._setValue(N(this.#t) ?? void 0);
+      }
+      constructor(t) {
+        const s = t.format ? { segments: P(t.format), separator: t.separator ?? "/" } : tt(t.locale), e2 = t.separator ?? s.separator, i = t.format ? P(t.format) : s.segments, n = t.initialValue ?? t.defaultValue, o = n ? { year: String(n.getUTCFullYear()).padStart(4, "0"), month: String(n.getUTCMonth() + 1).padStart(2, "0"), day: String(n.getUTCDate()).padStart(2, "0") } : { year: "____", month: "__", day: "__" }, u = i.map((a) => o[a.type]).join(e2);
+        super({ ...t, initialUserInput: u }, false), this.#s = i, this.#r = e2, this.#t = o, this.#n = t.minDate, this.#u = t.maxDate, this.#a(), this.on("cursor", (a) => this.#d(a)), this.on("key", (a, l) => this.#f(a, l)), this.on("finalize", () => this.#g(t));
+      }
+      #h() {
+        const t = Math.max(0, Math.min(this.#e.segmentIndex, this.#s.length - 1)), s = this.#s[t];
+        if (s) return this.#e.positionInSegment = Math.max(0, Math.min(this.#e.positionInSegment, s.len - 1)), { segment: s, index: t };
+      }
+      #l(t) {
+        this.inlineError = "", this.#o = null;
+        const s = this.#h();
+        s && (this.#e.segmentIndex = Math.max(0, Math.min(this.#s.length - 1, s.index + t)), this.#e.positionInSegment = 0, this.#i = true);
+      }
+      #p(t) {
+        const s = this.#h();
+        if (!s) return;
+        const { segment: e2 } = s, i = this.#t[e2.type], n = !i || i.replace(/_/g, "") === "", o = Number.parseInt((i || "0").replace(/_/g, "0"), 10) || 0, u = st(e2.type, x(this.#t), this.#n, this.#u);
+        let a;
+        n ? a = t === 1 ? u.min : u.max : a = Math.max(Math.min(u.max, o + t), u.min), this.#t = { ...this.#t, [e2.type]: a.toString().padStart(e2.len, "0") }, this.#i = true, this.#o = null, this.#a();
+      }
+      #d(t) {
+        if (t) switch (t) {
+          case "right":
+            return this.#l(1);
+          case "left":
+            return this.#l(-1);
+          case "up":
+            return this.#p(1);
+          case "down":
+            return this.#p(-1);
+        }
+      }
+      #f(t, s) {
+        if (s?.name === "backspace" || s?.sequence === "\x7F" || s?.sequence === "\b" || t === "\x7F" || t === "\b") {
+          this.inlineError = "";
+          const e2 = this.#h();
+          if (!e2) return;
+          if (!this.#t[e2.segment.type].replace(/_/g, "")) {
+            this.#l(-1);
+            return;
+          }
+          this.#t[e2.segment.type] = "_".repeat(e2.segment.len), this.#i = true, this.#e.positionInSegment = 0, this.#a();
+          return;
+        }
+        if (s?.name === "tab") {
+          this.inlineError = "";
+          const e2 = this.#h();
+          if (!e2) return;
+          const i = s.shift ? -1 : 1, n = e2.index + i;
+          n >= 0 && n < this.#s.length && (this.#e.segmentIndex = n, this.#e.positionInSegment = 0, this.#i = true);
+          return;
+        }
+        if (t && /^[0-9]$/.test(t)) {
+          const e2 = this.#h();
+          if (!e2) return;
+          const { segment: i } = e2, n = !this.#t[i.type].replace(/_/g, "");
+          if (this.#i && this.#o !== null && !n) {
+            const m = this.#o + t, g = { ...this.#t, [i.type]: m }, _ = this.#m(g, i);
+            if (_) {
+              this.inlineError = _, this.#o = null, this.#i = false;
+              return;
+            }
+            this.inlineError = "", this.#t[i.type] = m, this.#o = null, this.#i = false, this.#a(), e2.index < this.#s.length - 1 && (this.#e.segmentIndex = e2.index + 1, this.#e.positionInSegment = 0, this.#i = true);
+            return;
+          }
+          this.#i && !n && (this.#t[i.type] = "_".repeat(i.len), this.#e.positionInSegment = 0), this.#i = false, this.#o = null;
+          const o = this.#t[i.type], u = o.indexOf("_"), a = u >= 0 ? u : Math.min(this.#e.positionInSegment, i.len - 1);
+          if (a < 0 || a >= i.len) return;
+          let l = o.slice(0, a) + t + o.slice(a + 1), f = false;
+          if (a === 0 && o === "__" && (i.type === "month" || i.type === "day")) {
+            const m = Number.parseInt(t, 10);
+            l = `0${t}`, f = m <= (i.type === "month" ? 1 : 2);
+          }
+          if (i.type === "year" && (l = (o.replace(/_/g, "") + t).padStart(i.len, "_")), !l.includes("_")) {
+            const m = { ...this.#t, [i.type]: l }, g = this.#m(m, i);
+            if (g) {
+              this.inlineError = g;
+              return;
+            }
+          }
+          this.inlineError = "", this.#t[i.type] = l;
+          const y = l.includes("_") ? void 0 : F(this.#t);
+          if (y) {
+            const { year: m, month: g } = y, _ = $(m, g);
+            this.#t = { year: String(Math.max(0, Math.min(9999, m))).padStart(4, "0"), month: String(Math.max(1, Math.min(12, g))).padStart(2, "0"), day: String(Math.max(1, Math.min(_, y.day))).padStart(2, "0") };
+          }
+          this.#a();
+          const T = l.indexOf("_");
+          f ? (this.#i = true, this.#o = t) : T >= 0 ? this.#e.positionInSegment = T : u >= 0 && e2.index < this.#s.length - 1 ? (this.#e.segmentIndex = e2.index + 1, this.#e.positionInSegment = 0, this.#i = true) : this.#e.positionInSegment = Math.min(a + 1, i.len - 1);
+        }
+      }
+      #m(t, s) {
+        const { month: e2, day: i } = x(t);
+        if (s.type === "month" && (e2 < 0 || e2 > 12)) return h.date.messages.invalidMonth;
+        if (s.type === "day" && (i < 0 || i > 31)) return h.date.messages.invalidDay(31, "any month");
+      }
+      #g(t) {
+        const { year: s, month: e2, day: i } = x(this.#t);
+        if (s && e2 && i) {
+          const n = $(s, e2);
+          this.#t = { ...this.#t, day: String(Math.min(i, n)).padStart(2, "0") };
+        }
+        this.value = N(this.#t) ?? t.defaultValue ?? void 0;
+      }
+    };
+    it = class extends p {
+      options;
+      cursor = 0;
+      #s;
+      getGroupItems(t) {
+        return this.options.filter((s) => s.group === t);
+      }
+      isGroupSelected(t) {
+        const s = this.getGroupItems(t), e2 = this.value;
+        return e2 === void 0 ? false : s.every((i) => e2.includes(i.value));
+      }
+      toggleValue() {
+        const t = this.options[this.cursor];
+        if (this.value === void 0 && (this.value = []), t.group === true) {
+          const s = t.value, e2 = this.getGroupItems(s);
+          this.isGroupSelected(s) ? this.value = this.value.filter((i) => e2.findIndex((n) => n.value === i) === -1) : this.value = [...this.value, ...e2.map((i) => i.value)], this.value = Array.from(new Set(this.value));
+        } else {
+          const s = this.value.includes(t.value);
+          this.value = s ? this.value.filter((e2) => e2 !== t.value) : [...this.value, t.value];
+        }
+      }
+      constructor(t) {
+        super(t, false);
+        const { options: s } = t;
+        this.#s = t.selectableGroups !== false, this.options = Object.entries(s).flatMap(([e2, i]) => [{ value: e2, group: true, label: e2 }, ...i.map((n) => ({ ...n, group: e2 }))]), this.value = [...t.initialValues ?? []], this.cursor = Math.max(this.options.findIndex(({ value: e2 }) => e2 === t.cursorAt), this.#s ? 0 : 1), this.on("cursor", (e2) => {
+          switch (e2) {
+            case "left":
+            case "up": {
+              this.cursor = this.cursor === 0 ? this.options.length - 1 : this.cursor - 1;
+              const i = this.options[this.cursor]?.group === true;
+              !this.#s && i && (this.cursor = this.cursor === 0 ? this.options.length - 1 : this.cursor - 1);
+              break;
+            }
+            case "down":
+            case "right": {
+              this.cursor = this.cursor === this.options.length - 1 ? 0 : this.cursor + 1;
+              const i = this.options[this.cursor]?.group === true;
+              !this.#s && i && (this.cursor = this.cursor === this.options.length - 1 ? 0 : this.cursor + 1);
+              break;
+            }
+            case "space":
+              this.toggleValue();
+              break;
+          }
+        });
+      }
+    };
+    rt = class extends p {
+      #s = false;
+      #r;
+      focused = "editor";
+      get userInputWithCursor() {
+        if (this.state === "submit") return this.userInput;
+        const t = this.userInput;
+        if (this.cursor >= t.length) return `${t}\u2588`;
+        const s = t.slice(0, this.cursor), e2 = t[this.cursor], i = t.slice(this.cursor + 1);
+        return e2 === `
+` ? `${s}\u2588
+${i}` : `${s}${styleText("inverse", e2)}${i}`;
+      }
+      get cursor() {
+        return this._cursor;
+      }
+      #t(t) {
+        if (this.userInput.length === 0) {
+          this._setUserInput(t);
+          return;
+        }
+        this._setUserInput(this.userInput.slice(0, this.cursor) + t + this.userInput.slice(this.cursor));
+      }
+      #n(t) {
+        const s = this.value ?? "";
+        switch (t) {
+          case "up":
+            this._cursor = I(this._cursor, 0, -1, s);
+            return;
+          case "down":
+            this._cursor = I(this._cursor, 0, 1, s);
+            return;
+          case "left":
+            this._cursor = I(this._cursor, -1, 0, s);
+            return;
+          case "right":
+            this._cursor = I(this._cursor, 1, 0, s);
+            return;
+        }
+      }
+      _shouldSubmit(t, s) {
+        if (this.#r) return this.focused === "submit" ? true : (this.#t(`
+`), this._cursor++, false);
+        const e2 = this.#s;
+        return this.#s = true, e2 ? (this.userInput[this.cursor - 1] === `
+` && (this._setUserInput(this.userInput.slice(0, this.cursor - 1) + this.userInput.slice(this.cursor)), this._cursor--), true) : (this.#t(`
+`), this._cursor++, false);
+      }
+      constructor(t) {
+        super(t, false), this.#r = t.showSubmit ?? false, this.on("key", (s, e2) => {
+          if (e2?.name && h.actions.has(e2.name)) {
+            this.#n(e2.name);
+            return;
+          }
+          if (s === "	" && this.#r) {
+            this.focused = this.focused === "editor" ? "submit" : "editor";
+            return;
+          }
+          if (e2?.name !== "return") {
+            if (this.#s = false, e2?.name === "backspace" && this.cursor > 0) {
+              this._setUserInput(this.userInput.slice(0, this.cursor - 1) + this.userInput.slice(this.cursor)), this._cursor--;
+              return;
+            }
+            if (e2?.name === "delete" && this.cursor < this.userInput.length) {
+              this._setUserInput(this.userInput.slice(0, this.cursor) + this.userInput.slice(this.cursor + 1));
+              return;
+            }
+            s && (this.#r && this.focused === "submit" && (this.focused = "editor"), this.#t(s ?? ""), this._cursor++);
+          }
+        }), this.on("userInput", (s) => {
+          this._setValue(s);
+        }), this.on("finalize", () => {
+          this.value || (this.value = t.defaultValue), this.value === void 0 && (this.value = "");
+        });
+      }
+    };
     nt = class extends p {
       options;
       cursor = 0;
@@ -6970,6 +7424,21 @@ var init_dist4 = __esm({
         });
       }
     };
+    at = class extends p {
+      options;
+      cursor = 0;
+      constructor(t) {
+        super(t, false), this.options = t.options;
+        const s = t.caseSensitive === true, e2 = this.options.map(({ value: [i] }) => s ? i : i?.toLowerCase());
+        this.cursor = Math.max(e2.indexOf(t.initialValue), 0), this.on("key", (i, n) => {
+          if (!i) return;
+          const o = s && n.shift ? i.toUpperCase() : i;
+          if (!e2.includes(o)) return;
+          const u = this.options.find(({ value: [a] }) => s ? a === o : a?.toLowerCase() === i);
+          u && (this.value = u.value, this.state = "submit", this.emit("submit"));
+        });
+      }
+    };
     ht = class extends p {
       get userInputWithCursor() {
         if (this.state === "submit") return this.userInput;
@@ -6991,10 +7460,130 @@ var init_dist4 = __esm({
     };
   }
 });
+
+// ../../node_modules/.pnpm/@clack+prompts@1.3.0/node_modules/@clack/prompts/dist/index.mjs
+var dist_exports = {};
+__export(dist_exports, {
+  S_BAR: () => $2,
+  S_BAR_END: () => E2,
+  S_BAR_END_RIGHT: () => Et,
+  S_BAR_H: () => st2,
+  S_BAR_START: () => lt,
+  S_BAR_START_RIGHT: () => It,
+  S_CHECKBOX_ACTIVE: () => et2,
+  S_CHECKBOX_INACTIVE: () => J2,
+  S_CHECKBOX_SELECTED: () => U2,
+  S_CONNECT_LEFT: () => xt,
+  S_CORNER_BOTTOM_LEFT: () => dt,
+  S_CORNER_BOTTOM_RIGHT: () => $t,
+  S_CORNER_TOP_LEFT: () => Ot,
+  S_CORNER_TOP_RIGHT: () => ct,
+  S_ERROR: () => gt,
+  S_INFO: () => ht2,
+  S_PASSWORD_MASK: () => Gt,
+  S_RADIO_ACTIVE: () => z2,
+  S_RADIO_INACTIVE: () => H2,
+  S_STEP_ACTIVE: () => _t,
+  S_STEP_CANCEL: () => ot2,
+  S_STEP_ERROR: () => ut2,
+  S_STEP_SUBMIT: () => F2,
+  S_SUCCESS: () => pt,
+  S_WARN: () => mt,
+  autocomplete: () => At,
+  autocompleteMultiselect: () => ie,
+  box: () => oe,
+  cancel: () => me,
+  confirm: () => ue,
+  date: () => le,
+  group: () => he,
+  groupMultiselect: () => pe,
+  intro: () => ge,
+  isCI: () => at2,
+  isCancel: () => q,
+  isTTY: () => Tt,
+  limitOptions: () => Y2,
+  log: () => R2,
+  multiline: () => fe,
+  multiselect: () => ve,
+  note: () => Se,
+  outro: () => ye,
+  password: () => Ce,
+  path: () => Te,
+  progress: () => Ie,
+  select: () => Ee,
+  selectKey: () => Ge,
+  settings: () => h,
+  spinner: () => ft,
+  stream: () => K2,
+  symbol: () => M,
+  symbolBar: () => yt,
+  taskLog: () => Me,
+  tasks: () => xe,
+  text: () => Re,
+  unicode: () => tt2,
+  unicodeOr: () => w2,
+  updateSettings: () => j
+});
 function te() {
   return j2.platform !== "win32" ? j2.env.TERM !== "linux" : !!j2.env.CI || !!j2.env.WT_SESSION || !!j2.env.TERMINUS_SUBLIME || j2.env.ConEmuTask === "{cmd::Cmder}" || j2.env.TERM_PROGRAM === "Terminus-Sublime" || j2.env.TERM_PROGRAM === "vscode" || j2.env.TERM === "xterm-256color" || j2.env.TERM === "alacritty" || j2.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
-var import_sisteransi2, tt, at2, w2, _t, ot2, ut2, F, lt, $, E2, z2, H, et2, U, J, Gt, st, ct, xt, $t, dt, ht2, pt, mt, gt, M, yt, ee, Y2, ue, he, R2, me, ge, ye, Q2, ve, we, be, Se, Ce, _e, ft, it2, Ee, Re;
+function Mt(t) {
+  return t.label ?? String(t.value ?? "");
+}
+function Rt(t, r) {
+  if (!t) return true;
+  const s = (r.label ?? String(r.value ?? "")).toLowerCase(), i = (r.hint ?? "").toLowerCase(), u = String(r.value).toLowerCase(), n = t.toLowerCase();
+  return s.includes(n) || i.includes(n) || u.includes(n);
+}
+function se(t, r) {
+  const s = [];
+  for (const i of r) t.includes(i.value) && s.push(i);
+  return s;
+}
+function Pt(t, r, s, i) {
+  let u = s, n = s;
+  return i === "center" ? u = Math.floor((r - t) / 2) : i === "right" && (u = r - t - s), n = r - u - t, [u, n];
+}
+function ce(t, r) {
+  const s = t.segmentValues, i = t.segmentCursor;
+  if (r === "submit" || r === "cancel") return t.formattedValue;
+  const u = styleText("gray", t.separator);
+  return t.segments.map((n, o) => {
+    const c2 = o === i.segmentIndex && !["submit", "cancel"].includes(r), a = de[n.type];
+    return $e(s[n.type], { isActive: c2, label: a });
+  }).join(u);
+}
+function $e(t, r) {
+  const s = !t || t.replace(/_/g, "") === "";
+  return r.isActive ? styleText("inverse", s ? r.label : t.replace(/_/g, " ")) : s ? styleText("dim", r.label) : t.replace(/_/g, styleText("dim", " "));
+}
+function Ie({ style: t = "heavy", max: r = 100, size: s = 40, ...i } = {}) {
+  const u = ft(i);
+  let n = 0, o = "";
+  const c2 = Math.max(1, r), a = Math.max(1, s), l = (m) => {
+    switch (m) {
+      case "initial":
+      case "active":
+        return (g) => styleText("magenta", g);
+      case "error":
+      case "cancel":
+        return (g) => styleText("red", g);
+      case "submit":
+        return (g) => styleText("green", g);
+      default:
+        return (g) => styleText("magenta", g);
+    }
+  }, d2 = (m, g) => {
+    const S2 = Math.floor(n / c2 * a);
+    return `${l(m)(Vt[t].repeat(S2))}${styleText("dim", Vt[t].repeat(a - S2))} ${g}`;
+  }, y = (m = "") => {
+    o = m, u.start(d2("initial", m));
+  }, p2 = (m = 1, g) => {
+    n = Math.min(c2, m + n), u.message(d2("active", g ?? o)), o = g ?? o;
+  };
+  return { start: y, stop: u.stop, cancel: u.cancel, error: u.error, clear: u.clear, advance: p2, isCancelled: u.isCancelled, message: (m) => p2(0, m) };
+}
+var import_sisteransi2, tt2, at2, Tt, w2, _t, ot2, ut2, F2, lt, $2, E2, It, Et, z2, H2, et2, U2, J2, Gt, st2, ct, xt, $t, dt, Ot, ht2, pt, mt, gt, M, yt, ee, Y2, At, ie, re, ne, ae, oe, ue, le, de, he, pe, R2, me, ge, ye, fe, Q2, ve, we, be, Se, Ce, Te, _e, ft, Vt, it2, Ee, Ge, jt, K2, xe, Oe, Me, Re;
 var init_dist5 = __esm({
   "../../node_modules/.pnpm/@clack+prompts@1.3.0/node_modules/@clack/prompts/dist/index.mjs"() {
     init_dist4();
@@ -7002,30 +7591,31 @@ var init_dist5 = __esm({
     init_main();
     init_dist3();
     import_sisteransi2 = __toESM(require_src());
-    tt = te();
+    tt2 = te();
     at2 = () => process.env.CI === "true";
-    w2 = (t, r) => tt ? t : r;
+    Tt = (t) => t.isTTY === true;
+    w2 = (t, r) => tt2 ? t : r;
     _t = w2("\u25C6", "*");
     ot2 = w2("\u25A0", "x");
     ut2 = w2("\u25B2", "x");
-    F = w2("\u25C7", "o");
+    F2 = w2("\u25C7", "o");
     lt = w2("\u250C", "T");
-    $ = w2("\u2502", "|");
+    $2 = w2("\u2502", "|");
     E2 = w2("\u2514", "\u2014");
-    w2("\u2510", "T");
-    w2("\u2518", "\u2014");
+    It = w2("\u2510", "T");
+    Et = w2("\u2518", "\u2014");
     z2 = w2("\u25CF", ">");
-    H = w2("\u25CB", " ");
+    H2 = w2("\u25CB", " ");
     et2 = w2("\u25FB", "[\u2022]");
-    U = w2("\u25FC", "[+]");
-    J = w2("\u25FB", "[ ]");
+    U2 = w2("\u25FC", "[+]");
+    J2 = w2("\u25FB", "[ ]");
     Gt = w2("\u25AA", "\u2022");
-    st = w2("\u2500", "-");
+    st2 = w2("\u2500", "-");
     ct = w2("\u256E", "+");
     xt = w2("\u251C", "+");
     $t = w2("\u256F", "+");
     dt = w2("\u2570", "+");
-    w2("\u256D", "+");
+    Ot = w2("\u256D", "+");
     ht2 = w2("\u25CF", "\u2022");
     pt = w2("\u25C6", "*");
     mt = w2("\u25B2", "!");
@@ -7040,20 +7630,20 @@ var init_dist5 = __esm({
         case "error":
           return styleText("yellow", ut2);
         case "submit":
-          return styleText("green", F);
+          return styleText("green", F2);
       }
     };
     yt = (t) => {
       switch (t) {
         case "initial":
         case "active":
-          return styleText("cyan", $);
+          return styleText("cyan", $2);
         case "cancel":
-          return styleText("red", $);
+          return styleText("red", $2);
         case "error":
-          return styleText("yellow", $);
+          return styleText("yellow", $2);
         case "submit":
-          return styleText("green", $);
+          return styleText("green", $2);
       }
     };
     ee = (t, r, s, i, u) => {
@@ -7079,42 +7669,178 @@ var init_dist5 = __esm({
         h2.push(G2), f += G2.length;
       }
       if (f > d2) {
-        let b2 = 0, G2 = 0, x = f;
-        const A2 = t - v2, P = (N, D2) => ee(h2, x, N, D2, d2);
-        m ? ({ lineCount: x, removals: b2 } = P(0, A2), x > d2 && ({ lineCount: x, removals: G2 } = P(A2 + 1, h2.length))) : ({ lineCount: x, removals: G2 } = P(A2 + 1, h2.length), x > d2 && ({ lineCount: x, removals: b2 } = P(0, A2))), b2 > 0 && (m = true, h2.splice(0, b2)), G2 > 0 && (g = true, h2.splice(h2.length - G2, G2));
+        let b2 = 0, G2 = 0, x2 = f;
+        const A2 = t - v2, P2 = (N2, D2) => ee(h2, x2, N2, D2, d2);
+        m ? ({ lineCount: x2, removals: b2 } = P2(0, A2), x2 > d2 && ({ lineCount: x2, removals: G2 } = P2(A2 + 1, h2.length))) : ({ lineCount: x2, removals: G2 } = P2(A2 + 1, h2.length), x2 > d2 && ({ lineCount: x2, removals: b2 } = P2(0, A2))), b2 > 0 && (m = true, h2.splice(0, b2)), G2 > 0 && (g = true, h2.splice(h2.length - G2, G2));
       }
       const C2 = [];
       m && C2.push(l);
       for (const b2 of h2) for (const G2 of b2) C2.push(G2);
       return g && C2.push(l), C2;
     };
+    At = (t) => new Q({ options: t.options, initialValue: t.initialValue ? [t.initialValue] : void 0, initialUserInput: t.initialUserInput, placeholder: t.placeholder, filter: t.filter ?? ((r, s) => Rt(r, s)), signal: t.signal, input: t.input, output: t.output, validate: t.validate, render() {
+      const r = t.withGuide ?? h.withGuide, s = r ? [`${styleText("gray", $2)}`, `${M(this.state)}  ${t.message}`] : [`${M(this.state)}  ${t.message}`], i = this.userInput, u = this.options, n = t.placeholder, o = i === "" && n !== void 0, c2 = (a, l) => {
+        const d2 = Mt(a), y = a.hint && a.value === this.focusedValue ? styleText("dim", ` (${a.hint})`) : "";
+        switch (l) {
+          case "active":
+            return `${styleText("green", z2)} ${d2}${y}`;
+          case "inactive":
+            return `${styleText("dim", H2)} ${styleText("dim", d2)}`;
+          case "disabled":
+            return `${styleText("gray", H2)} ${styleText(["strikethrough", "gray"], d2)}`;
+        }
+      };
+      switch (this.state) {
+        case "submit": {
+          const a = se(this.selectedValues, u), l = a.length > 0 ? `  ${styleText("dim", a.map(Mt).join(", "))}` : "", d2 = r ? styleText("gray", $2) : "";
+          return `${s.join(`
+`)}
+${d2}${l}`;
+        }
+        case "cancel": {
+          const a = i ? `  ${styleText(["strikethrough", "dim"], i)}` : "", l = r ? styleText("gray", $2) : "";
+          return `${s.join(`
+`)}
+${l}${a}`;
+        }
+        default: {
+          const a = this.state === "error" ? "yellow" : "cyan", l = r ? `${styleText(a, $2)}  ` : "", d2 = r ? styleText(a, E2) : "";
+          let y = "";
+          if (this.isNavigating || o) {
+            const v2 = o ? n : i;
+            y = v2 !== "" ? ` ${styleText("dim", v2)}` : "";
+          } else y = ` ${this.userInputWithCursor}`;
+          const p2 = this.filteredOptions.length !== u.length ? styleText("dim", ` (${this.filteredOptions.length} match${this.filteredOptions.length === 1 ? "" : "es"})`) : "", m = this.filteredOptions.length === 0 && i ? [`${l}${styleText("yellow", "No matches found")}`] : [], g = this.state === "error" ? [`${l}${styleText("yellow", this.error)}`] : [];
+          r && s.push(`${l.trimEnd()}`), s.push(`${l}${styleText("dim", "Search:")}${y}${p2}`, ...m, ...g);
+          const S2 = [`${styleText("dim", "\u2191/\u2193")} to select`, `${styleText("dim", "Enter:")} confirm`, `${styleText("dim", "Type:")} to search`], h2 = [`${l}${S2.join(" \u2022 ")}`, d2], f = this.filteredOptions.length === 0 ? [] : Y2({ cursor: this.cursor, options: this.filteredOptions, columnPadding: r ? 3 : 0, rowPadding: s.length + h2.length, style: (v2, T) => c2(v2, v2.disabled ? "disabled" : T ? "active" : "inactive"), maxItems: t.maxItems, output: t.output });
+          return [...s, ...f.map((v2) => `${l}${v2}`), ...h2].join(`
+`);
+        }
+      }
+    } }).prompt();
+    ie = (t) => {
+      const r = (i, u, n, o) => {
+        const c2 = n.includes(i.value), a = i.label ?? String(i.value ?? ""), l = i.hint && o !== void 0 && i.value === o ? styleText("dim", ` (${i.hint})`) : "", d2 = c2 ? styleText("green", U2) : styleText("dim", J2);
+        return i.disabled ? `${styleText("gray", J2)} ${styleText(["strikethrough", "gray"], a)}` : u ? `${d2} ${a}${l}` : `${d2} ${styleText("dim", a)}`;
+      }, s = new Q({ options: t.options, multiple: true, placeholder: t.placeholder, filter: t.filter ?? ((i, u) => Rt(i, u)), validate: () => {
+        if (t.required && s.selectedValues.length === 0) return "Please select at least one item";
+      }, initialValue: t.initialValues, signal: t.signal, input: t.input, output: t.output, render() {
+        const i = t.withGuide ?? h.withGuide, u = `${i ? `${styleText("gray", $2)}
+` : ""}${M(this.state)}  ${t.message}
+`, n = this.userInput, o = t.placeholder, c2 = n === "" && o !== void 0, a = this.isNavigating || c2 ? styleText("dim", c2 ? o : n) : this.userInputWithCursor, l = this.options, d2 = this.filteredOptions.length !== l.length ? styleText("dim", ` (${this.filteredOptions.length} match${this.filteredOptions.length === 1 ? "" : "es"})`) : "";
+        switch (this.state) {
+          case "submit":
+            return `${u}${i ? `${styleText("gray", $2)}  ` : ""}${styleText("dim", `${this.selectedValues.length} items selected`)}`;
+          case "cancel":
+            return `${u}${i ? `${styleText("gray", $2)}  ` : ""}${styleText(["strikethrough", "dim"], n)}`;
+          default: {
+            const y = this.state === "error" ? "yellow" : "cyan", p2 = i ? `${styleText(y, $2)}  ` : "", m = i ? styleText(y, E2) : "", g = [`${styleText("dim", "\u2191/\u2193")} to navigate`, `${styleText("dim", this.isNavigating ? "Space/Tab:" : "Tab:")} select`, `${styleText("dim", "Enter:")} confirm`, `${styleText("dim", "Type:")} to search`], S2 = this.filteredOptions.length === 0 && n ? [`${p2}${styleText("yellow", "No matches found")}`] : [], h2 = this.state === "error" ? [`${p2}${styleText("yellow", this.error)}`] : [], f = [...`${u}${i ? styleText(y, $2) : ""}`.split(`
+`), `${p2}${styleText("dim", "Search:")} ${a}${d2}`, ...S2, ...h2], v2 = [`${p2}${g.join(" \u2022 ")}`, m], T = Y2({ cursor: this.cursor, options: this.filteredOptions, style: (C2, b2) => r(C2, b2, this.selectedValues, this.focusedValue), maxItems: t.maxItems, output: t.output, rowPadding: f.length + v2.length });
+            return [...f, ...T.map((C2) => `${p2}${C2}`), ...v2].join(`
+`);
+          }
+        }
+      } });
+      return s.prompt();
+    };
+    re = [Ot, ct, dt, $t];
+    ne = [lt, It, E2, Et];
+    ae = (t) => t;
+    oe = (t = "", r = "", s) => {
+      const i = s?.output ?? process.stdout, u = A(i), n = 2, o = s?.titlePadding ?? 1, c2 = s?.contentPadding ?? 2, a = s?.width === void 0 || s.width === "auto" ? 1 : Math.min(1, s.width), l = s?.withGuide ?? h.withGuide ? `${$2} ` : "", d2 = s?.formatBorder ?? ae, y = (s?.rounded ? re : ne).map(d2), p2 = d2(st2), m = d2($2), g = dist_default2(l), S2 = dist_default2(r), h2 = u - g;
+      let f = Math.floor(u * a) - g;
+      if (s?.width === "auto") {
+        const P2 = t.split(`
+`);
+        let N2 = S2 + o * 2;
+        for (const rt2 of P2) {
+          const W2 = dist_default2(rt2) + c2 * 2;
+          W2 > N2 && (N2 = W2);
+        }
+        const D2 = N2 + n;
+        D2 < f && (f = D2);
+      }
+      f % 2 !== 0 && (f < h2 ? f++ : f--);
+      const v2 = f - n, T = v2 - o * 2, C2 = S2 > T ? `${r.slice(0, T - 3)}...` : r, [b2, G2] = Pt(dist_default2(C2), v2, o, s?.titleAlign), x2 = wrapAnsi(t, v2 - c2 * 2, { hard: true, trim: false });
+      i.write(`${l}${y[0]}${p2.repeat(b2)}${C2}${p2.repeat(G2)}${y[1]}
+`);
+      const A2 = x2.split(`
+`);
+      for (const P2 of A2) {
+        const [N2, D2] = Pt(dist_default2(P2), v2, c2, s?.contentAlign);
+        i.write(`${l}${m}${" ".repeat(N2)}${P2}${" ".repeat(D2)}${m}
+`);
+      }
+      i.write(`${l}${y[2]}${p2.repeat(v2)}${y[3]}
+`);
+    };
     ue = (t) => {
       const r = t.active ?? "Yes", s = t.inactive ?? "No";
       return new X({ active: r, inactive: s, signal: t.signal, input: t.input, output: t.output, initialValue: t.initialValue ?? true, render() {
-        const i = t.withGuide ?? h.withGuide, u = `${M(this.state)}  `, n = i ? `${styleText("gray", $)}  ` : "", o = W(t.output, t.message, n, u), c2 = `${i ? `${styleText("gray", $)}
+        const i = t.withGuide ?? h.withGuide, u = `${M(this.state)}  `, n = i ? `${styleText("gray", $2)}  ` : "", o = W(t.output, t.message, n, u), c2 = `${i ? `${styleText("gray", $2)}
 ` : ""}${o}
 `, a = this.value ? r : s;
         switch (this.state) {
           case "submit": {
-            const l = i ? `${styleText("gray", $)}  ` : "";
+            const l = i ? `${styleText("gray", $2)}  ` : "";
             return `${c2}${l}${styleText("dim", a)}`;
           }
           case "cancel": {
-            const l = i ? `${styleText("gray", $)}  ` : "";
+            const l = i ? `${styleText("gray", $2)}  ` : "";
             return `${c2}${l}${styleText(["strikethrough", "dim"], a)}${i ? `
-${styleText("gray", $)}` : ""}`;
+${styleText("gray", $2)}` : ""}`;
           }
           default: {
-            const l = i ? `${styleText("cyan", $)}  ` : "", d2 = i ? styleText("cyan", E2) : "";
-            return `${c2}${l}${this.value ? `${styleText("green", z2)} ${r}` : `${styleText("dim", H)} ${styleText("dim", r)}`}${t.vertical ? i ? `
-${styleText("cyan", $)}  ` : `
-` : ` ${styleText("dim", "/")} `}${this.value ? `${styleText("dim", H)} ${styleText("dim", s)}` : `${styleText("green", z2)} ${s}`}
+            const l = i ? `${styleText("cyan", $2)}  ` : "", d2 = i ? styleText("cyan", E2) : "";
+            return `${c2}${l}${this.value ? `${styleText("green", z2)} ${r}` : `${styleText("dim", H2)} ${styleText("dim", r)}`}${t.vertical ? i ? `
+${styleText("cyan", $2)}  ` : `
+` : ` ${styleText("dim", "/")} `}${this.value ? `${styleText("dim", H2)} ${styleText("dim", s)}` : `${styleText("green", z2)} ${s}`}
 ${d2}
 `;
           }
         }
       } }).prompt();
     };
+    le = (t) => {
+      const r = t.validate;
+      return new et({ ...t, validate(s) {
+        if (s === void 0) return t.defaultValue !== void 0 ? void 0 : r ? r(s) : h.date.messages.required;
+        const i = (u) => u.toISOString().slice(0, 10);
+        if (t.minDate && i(s) < i(t.minDate)) return h.date.messages.afterMin(t.minDate);
+        if (t.maxDate && i(s) > i(t.maxDate)) return h.date.messages.beforeMax(t.maxDate);
+        if (r) return r(s);
+      }, render() {
+        const s = (t?.withGuide ?? h.withGuide) !== false, i = `${`${s ? `${styleText("gray", $2)}
+` : ""}${M(this.state)}  `}${t.message}
+`, u = this.state !== "initial" ? this.state : "active", n = ce(this, u), o = this.value instanceof Date ? this.formattedValue : "";
+        switch (this.state) {
+          case "error": {
+            const c2 = this.error ? `  ${styleText("yellow", this.error)}` : "", a = s ? `${styleText("yellow", $2)}  ` : "", l = s ? styleText("yellow", E2) : "";
+            return `${i.trim()}
+${a}${n}
+${l}${c2}
+`;
+          }
+          case "submit": {
+            const c2 = o ? `  ${styleText("dim", o)}` : "", a = s ? styleText("gray", $2) : "";
+            return `${i}${a}${c2}`;
+          }
+          case "cancel": {
+            const c2 = o ? `  ${styleText(["strikethrough", "dim"], o)}` : "", a = s ? styleText("gray", $2) : "";
+            return `${i}${a}${c2}${o.trim() ? `
+${a}` : ""}`;
+          }
+          default: {
+            const c2 = s ? `${styleText("cyan", $2)}  ` : "", a = s ? styleText("cyan", E2) : "", l = s ? `${styleText("cyan", $2)}  ` : "", d2 = this.inlineError ? `
+${l}${styleText("yellow", this.inlineError)}` : "";
+            return `${i}${c2}${n}${d2}
+${a}
+`;
+          }
+        }
+      } }).prompt();
+    };
+    de = { year: "yyyy", month: "mm", day: "dd" };
     he = async (t, r) => {
       const s = {}, i = Object.keys(t);
       for (const u of i) {
@@ -7129,7 +7855,74 @@ ${d2}
       }
       return s;
     };
-    R2 = { message: (t = [], { symbol: r = styleText("gray", $), secondarySymbol: s = styleText("gray", $), output: i = process.stdout, spacing: u = 1, withGuide: n } = {}) => {
+    pe = (t) => {
+      const { selectableGroups: r = true, groupSpacing: s = 0 } = t, i = (n, o, c2 = []) => {
+        const a = n.label ?? String(n.value), l = typeof n.group == "string", d2 = l && (c2[c2.indexOf(n) + 1] ?? { group: true }), y = l && d2 && d2.group === true, p2 = l ? r ? `${y ? E2 : $2} ` : "  " : "";
+        let m = "";
+        if (s > 0 && !l) {
+          const S2 = `
+${styleText("cyan", $2)}`;
+          m = `${S2.repeat(s - 1)}${S2}  `;
+        }
+        if (o === "active") return `${m}${styleText("dim", p2)}${styleText("cyan", et2)} ${a}${n.hint ? ` ${styleText("dim", `(${n.hint})`)}` : ""}`;
+        if (o === "group-active") return `${m}${p2}${styleText("cyan", et2)} ${styleText("dim", a)}`;
+        if (o === "group-active-selected") return `${m}${p2}${styleText("green", U2)} ${styleText("dim", a)}`;
+        if (o === "selected") {
+          const S2 = l || r ? styleText("green", U2) : "";
+          return `${m}${styleText("dim", p2)}${S2} ${styleText("dim", a)}${n.hint ? ` ${styleText("dim", `(${n.hint})`)}` : ""}`;
+        }
+        if (o === "cancelled") return `${styleText(["strikethrough", "dim"], a)}`;
+        if (o === "active-selected") return `${m}${styleText("dim", p2)}${styleText("green", U2)} ${a}${n.hint ? ` ${styleText("dim", `(${n.hint})`)}` : ""}`;
+        if (o === "submitted") return `${styleText("dim", a)}`;
+        const g = l || r ? styleText("dim", J2) : "";
+        return `${m}${styleText("dim", p2)}${g} ${styleText("dim", a)}`;
+      }, u = t.required ?? true;
+      return new it({ options: t.options, signal: t.signal, input: t.input, output: t.output, initialValues: t.initialValues, required: u, cursorAt: t.cursorAt, selectableGroups: r, validate(n) {
+        if (u && (n === void 0 || n.length === 0)) return `Please select at least one option.
+${styleText("reset", styleText("dim", `Press ${styleText(["gray", "bgWhite", "inverse"], " space ")} to select, ${styleText("gray", styleText(["bgWhite", "inverse"], " enter "))} to submit`))}`;
+      }, render() {
+        const n = t.withGuide ?? h.withGuide, o = `${n ? `${styleText("gray", $2)}
+` : ""}${M(this.state)}  ${t.message}
+`, c2 = this.value ?? [];
+        switch (this.state) {
+          case "submit": {
+            const a = this.options.filter(({ value: d2 }) => c2.includes(d2)).map((d2) => i(d2, "submitted")), l = a.length === 0 ? "" : `  ${a.join(styleText("dim", ", "))}`;
+            return `${o}${n ? styleText("gray", $2) : ""}${l}`;
+          }
+          case "cancel": {
+            const a = this.options.filter(({ value: l }) => c2.includes(l)).map((l) => i(l, "cancelled")).join(styleText("dim", ", "));
+            return `${o}${n ? `${styleText("gray", $2)}  ` : ""}${a.trim() ? `${a}${n ? `
+${styleText("gray", $2)}` : ""}` : ""}`;
+          }
+          case "error": {
+            const a = this.error.split(`
+`).map((l, d2) => d2 === 0 ? `${n ? `${styleText("yellow", E2)}  ` : ""}${styleText("yellow", l)}` : `   ${l}`).join(`
+`);
+            return `${o}${n ? `${styleText("yellow", $2)}  ` : ""}${this.options.map((l, d2, y) => {
+              const p2 = c2.includes(l.value) || l.group === true && this.isGroupSelected(`${l.value}`), m = d2 === this.cursor;
+              return !m && typeof l.group == "string" && this.options[this.cursor].value === l.group ? i(l, p2 ? "group-active-selected" : "group-active", y) : m && p2 ? i(l, "active-selected", y) : p2 ? i(l, "selected", y) : i(l, m ? "active" : "inactive", y);
+            }).join(`
+${n ? `${styleText("yellow", $2)}  ` : ""}`)}
+${a}
+`;
+          }
+          default: {
+            const a = this.options.map((d2, y, p2) => {
+              const m = c2.includes(d2.value) || d2.group === true && this.isGroupSelected(`${d2.value}`), g = y === this.cursor, S2 = !g && typeof d2.group == "string" && this.options[this.cursor].value === d2.group;
+              let h2 = "";
+              return S2 ? h2 = i(d2, m ? "group-active-selected" : "group-active", p2) : g && m ? h2 = i(d2, "active-selected", p2) : m ? h2 = i(d2, "selected", p2) : h2 = i(d2, g ? "active" : "inactive", p2), `${y !== 0 && !h2.startsWith(`
+`) ? "  " : ""}${h2}`;
+            }).join(`
+${n ? styleText("cyan", $2) : ""}`), l = a.startsWith(`
+`) ? "" : "  ";
+            return `${o}${n ? styleText("cyan", $2) : ""}${l}${a}
+${n ? styleText("cyan", E2) : ""}
+`;
+          }
+        }
+      } }).prompt();
+    };
+    R2 = { message: (t = [], { symbol: r = styleText("gray", $2), secondarySymbol: s = styleText("gray", $2), output: i = process.stdout, spacing: u = 1, withGuide: n } = {}) => {
       const o = [], c2 = n ?? h.withGuide, a = c2 ? s : "", l = c2 ? `${r}  ` : "", d2 = c2 ? `${s}  ` : "";
       for (let p2 = 0; p2 < u; p2++) o.push(a);
       const y = Array.isArray(t) ? t : t.split(`
@@ -7147,7 +7940,7 @@ ${d2}
     }, success: (t, r) => {
       R2.message(t, { ...r, symbol: styleText("green", pt) });
     }, step: (t, r) => {
-      R2.message(t, { ...r, symbol: styleText("green", F) });
+      R2.message(t, { ...r, symbol: styleText("green", F2) });
     }, warn: (t, r) => {
       R2.message(t, { ...r, symbol: styleText("yellow", mt) });
     }, warning: (t, r) => {
@@ -7167,25 +7960,53 @@ ${d2}
 `);
     };
     ye = (t = "", r) => {
-      const s = r?.output ?? process.stdout, i = r?.withGuide ?? h.withGuide ? `${styleText("gray", $)}
+      const s = r?.output ?? process.stdout, i = r?.withGuide ?? h.withGuide ? `${styleText("gray", $2)}
 ${styleText("gray", E2)}  ` : "";
       s.write(`${i}${t}
 
 `);
     };
+    fe = (t) => new rt({ validate: t.validate, placeholder: t.placeholder, defaultValue: t.defaultValue, initialValue: t.initialValue, showSubmit: t.showSubmit, output: t.output, signal: t.signal, input: t.input, render() {
+      const r = t?.withGuide ?? h.withGuide, s = `${`${r ? `${styleText("gray", $2)}
+` : ""}${M(this.state)}  `}${t.message}
+`, i = t.placeholder ? styleText("inverse", t.placeholder[0]) + styleText("dim", t.placeholder.slice(1)) : styleText(["inverse", "hidden"], "_"), u = this.userInput ? this.userInputWithCursor : i, n = this.value ?? "", o = t.showSubmit ? `
+  ${styleText(this.focused === "submit" ? "cyan" : "dim", "[ submit ]")}` : "";
+      switch (this.state) {
+        case "error": {
+          const c2 = `${styleText("yellow", $2)}  `, a = r ? W(t.output, u, c2, void 0) : u, l = styleText("yellow", E2);
+          return `${s}${a}
+${l}  ${styleText("yellow", this.error)}${o}
+`;
+        }
+        case "submit": {
+          const c2 = `${styleText("gray", $2)}  `, a = r ? W(t.output, n, c2, void 0, (l) => styleText("dim", l)) : n ? styleText("dim", n) : "";
+          return `${s}${a}`;
+        }
+        case "cancel": {
+          const c2 = `${styleText("gray", $2)}  `, a = r ? W(t.output, n, c2, void 0, (l) => styleText(["strikethrough", "dim"], l)) : n ? styleText(["strikethrough", "dim"], n) : "";
+          return `${s}${a}`;
+        }
+        default: {
+          const c2 = r ? `${styleText("cyan", $2)}  ` : "", a = r ? styleText("cyan", E2) : "", l = r ? W(t.output, u, c2) : u;
+          return `${s}${l}
+${a}${o}
+`;
+        }
+      }
+    } }).prompt();
     Q2 = (t, r) => t.split(`
 `).map((s) => r(s)).join(`
 `);
     ve = (t) => {
       const r = (i, u) => {
         const n = i.label ?? String(i.value);
-        return u === "disabled" ? `${styleText("gray", J)} ${Q2(n, (o) => styleText(["strikethrough", "gray"], o))}${i.hint ? ` ${styleText("dim", `(${i.hint ?? "disabled"})`)}` : ""}` : u === "active" ? `${styleText("cyan", et2)} ${n}${i.hint ? ` ${styleText("dim", `(${i.hint})`)}` : ""}` : u === "selected" ? `${styleText("green", U)} ${Q2(n, (o) => styleText("dim", o))}${i.hint ? ` ${styleText("dim", `(${i.hint})`)}` : ""}` : u === "cancelled" ? `${Q2(n, (o) => styleText(["strikethrough", "dim"], o))}` : u === "active-selected" ? `${styleText("green", U)} ${n}${i.hint ? ` ${styleText("dim", `(${i.hint})`)}` : ""}` : u === "submitted" ? `${Q2(n, (o) => styleText("dim", o))}` : `${styleText("dim", J)} ${Q2(n, (o) => styleText("dim", o))}`;
+        return u === "disabled" ? `${styleText("gray", J2)} ${Q2(n, (o) => styleText(["strikethrough", "gray"], o))}${i.hint ? ` ${styleText("dim", `(${i.hint ?? "disabled"})`)}` : ""}` : u === "active" ? `${styleText("cyan", et2)} ${n}${i.hint ? ` ${styleText("dim", `(${i.hint})`)}` : ""}` : u === "selected" ? `${styleText("green", U2)} ${Q2(n, (o) => styleText("dim", o))}${i.hint ? ` ${styleText("dim", `(${i.hint})`)}` : ""}` : u === "cancelled" ? `${Q2(n, (o) => styleText(["strikethrough", "dim"], o))}` : u === "active-selected" ? `${styleText("green", U2)} ${n}${i.hint ? ` ${styleText("dim", `(${i.hint})`)}` : ""}` : u === "submitted" ? `${Q2(n, (o) => styleText("dim", o))}` : `${styleText("dim", J2)} ${Q2(n, (o) => styleText("dim", o))}`;
       }, s = t.required ?? true;
       return new nt({ options: t.options, signal: t.signal, input: t.input, output: t.output, initialValues: t.initialValues, required: s, cursorAt: t.cursorAt, validate(i) {
         if (s && (i === void 0 || i.length === 0)) return `Please select at least one option.
 ${styleText("reset", styleText("dim", `Press ${styleText(["gray", "bgWhite", "inverse"], " space ")} to select, ${styleText("gray", styleText("bgWhite", styleText("inverse", " enter ")))} to submit`))}`;
       }, render() {
-        const i = t.withGuide ?? h.withGuide, u = W(t.output, t.message, i ? `${yt(this.state)}  ` : "", `${M(this.state)}  `), n = `${i ? `${styleText("gray", $)}
+        const i = t.withGuide ?? h.withGuide, u = W(t.output, t.message, i ? `${yt(this.state)}  ` : "", `${M(this.state)}  `), n = `${i ? `${styleText("gray", $2)}
 ` : ""}${u}
 `, o = this.value ?? [], c2 = (a, l) => {
           if (a.disabled) return r(a, "disabled");
@@ -7194,18 +8015,18 @@ ${styleText("reset", styleText("dim", `Press ${styleText(["gray", "bgWhite", "in
         };
         switch (this.state) {
           case "submit": {
-            const a = this.options.filter(({ value: d2 }) => o.includes(d2)).map((d2) => r(d2, "submitted")).join(styleText("dim", ", ")) || styleText("dim", "none"), l = W(t.output, a, i ? `${styleText("gray", $)}  ` : "");
+            const a = this.options.filter(({ value: d2 }) => o.includes(d2)).map((d2) => r(d2, "submitted")).join(styleText("dim", ", ")) || styleText("dim", "none"), l = W(t.output, a, i ? `${styleText("gray", $2)}  ` : "");
             return `${n}${l}`;
           }
           case "cancel": {
             const a = this.options.filter(({ value: d2 }) => o.includes(d2)).map((d2) => r(d2, "cancelled")).join(styleText("dim", ", "));
-            if (a.trim() === "") return `${n}${styleText("gray", $)}`;
-            const l = W(t.output, a, i ? `${styleText("gray", $)}  ` : "");
+            if (a.trim() === "") return `${n}${styleText("gray", $2)}`;
+            const l = W(t.output, a, i ? `${styleText("gray", $2)}  ` : "");
             return `${n}${l}${i ? `
-${styleText("gray", $)}` : ""}`;
+${styleText("gray", $2)}` : ""}`;
           }
           case "error": {
-            const a = i ? `${styleText("yellow", $)}  ` : "", l = this.error.split(`
+            const a = i ? `${styleText("yellow", $2)}  ` : "", l = this.error.split(`
 `).map((p2, m) => m === 0 ? `${i ? `${styleText("yellow", E2)}  ` : ""}${styleText("yellow", p2)}` : `   ${p2}`).join(`
 `), d2 = n.split(`
 `).length, y = l.split(`
@@ -7216,7 +8037,7 @@ ${l}
 `;
           }
           default: {
-            const a = i ? `${styleText("cyan", $)}  ` : "", l = n.split(`
+            const a = i ? `${styleText("cyan", $2)}  ` : "", l = n.split(`
 `).length, d2 = i ? 2 : 1;
             return `${n}${a}${Y2({ output: t.output, options: this.options, cursor: this.cursor, maxItems: t.maxItems, columnPadding: a.length, rowPadding: l + d2, style: c2 }).join(`
 ${a}`)}
@@ -7237,97 +8058,120 @@ ${i ? styleText("cyan", E2) : ""}
 `).map(n), ""], c2 = dist_default2(r), a = Math.max(o.reduce((p2, m) => {
         const g = dist_default2(m);
         return g > p2 ? g : p2;
-      }, 0), c2) + 2, l = o.map((p2) => `${styleText("gray", $)}  ${p2}${" ".repeat(a - dist_default2(p2))}${styleText("gray", $)}`).join(`
-`), d2 = u ? `${styleText("gray", $)}
+      }, 0), c2) + 2, l = o.map((p2) => `${styleText("gray", $2)}  ${p2}${" ".repeat(a - dist_default2(p2))}${styleText("gray", $2)}`).join(`
+`), d2 = u ? `${styleText("gray", $2)}
 ` : "", y = u ? xt : dt;
-      i.write(`${d2}${styleText("green", F)}  ${styleText("reset", r)} ${styleText("gray", st.repeat(Math.max(a - c2 - 1, 1)) + ct)}
+      i.write(`${d2}${styleText("green", F2)}  ${styleText("reset", r)} ${styleText("gray", st2.repeat(Math.max(a - c2 - 1, 1)) + ct)}
 ${l}
-${styleText("gray", y + st.repeat(a + 2) + $t)}
+${styleText("gray", y + st2.repeat(a + 2) + $t)}
 `);
     };
     Ce = (t) => new ot({ validate: t.validate, mask: t.mask ?? Gt, signal: t.signal, input: t.input, output: t.output, render() {
-      const r = t.withGuide ?? h.withGuide, s = `${r ? `${styleText("gray", $)}
+      const r = t.withGuide ?? h.withGuide, s = `${r ? `${styleText("gray", $2)}
 ` : ""}${M(this.state)}  ${t.message}
 `, i = this.userInputWithCursor, u = this.masked;
       switch (this.state) {
         case "error": {
-          const n = r ? `${styleText("yellow", $)}  ` : "", o = r ? `${styleText("yellow", E2)}  ` : "", c2 = u ?? "";
+          const n = r ? `${styleText("yellow", $2)}  ` : "", o = r ? `${styleText("yellow", E2)}  ` : "", c2 = u ?? "";
           return t.clearOnError && this.clear(), `${s.trim()}
 ${n}${c2}
 ${o}${styleText("yellow", this.error)}
 `;
         }
         case "submit": {
-          const n = r ? `${styleText("gray", $)}  ` : "", o = u ? styleText("dim", u) : "";
+          const n = r ? `${styleText("gray", $2)}  ` : "", o = u ? styleText("dim", u) : "";
           return `${s}${n}${o}`;
         }
         case "cancel": {
-          const n = r ? `${styleText("gray", $)}  ` : "", o = u ? styleText(["strikethrough", "dim"], u) : "";
+          const n = r ? `${styleText("gray", $2)}  ` : "", o = u ? styleText(["strikethrough", "dim"], u) : "";
           return `${s}${n}${o}${u && r ? `
-${styleText("gray", $)}` : ""}`;
+${styleText("gray", $2)}` : ""}`;
         }
         default: {
-          const n = r ? `${styleText("cyan", $)}  ` : "", o = r ? styleText("cyan", E2) : "";
+          const n = r ? `${styleText("cyan", $2)}  ` : "", o = r ? styleText("cyan", E2) : "";
           return `${s}${n}${i}
 ${o}
 `;
         }
       }
     } }).prompt();
+    Te = (t) => {
+      const r = t.validate;
+      return At({ ...t, initialUserInput: t.initialValue ?? t.root ?? process.cwd(), maxItems: 5, validate(s) {
+        if (!Array.isArray(s)) {
+          if (!s) return "Please select a path";
+          if (r) return r(s);
+        }
+      }, options() {
+        const s = this.userInput;
+        if (s === "") return [];
+        try {
+          let i;
+          existsSync(s) ? lstatSync(s).isDirectory() && (!t.directory || s.endsWith("/")) ? i = s : i = dirname(s) : i = dirname(s);
+          const u = s.length > 1 && s.endsWith("/") ? s.slice(0, -1) : s;
+          return readdirSync(i).map((n) => {
+            const o = join(i, n), c2 = lstatSync(o);
+            return { name: n, path: o, isDirectory: c2.isDirectory() };
+          }).filter(({ path: n, isDirectory: o }) => n.startsWith(u) && (o || !t.directory)).map((n) => ({ value: n.path }));
+        } catch {
+          return [];
+        }
+      } });
+    };
     _e = (t) => styleText("magenta", t);
-    ft = ({ indicator: t = "dots", onCancel: r, output: s = process.stdout, cancelMessage: i, errorMessage: u, frames: n = tt ? ["\u25D2", "\u25D0", "\u25D3", "\u25D1"] : ["\u2022", "o", "O", "0"], delay: o = tt ? 80 : 120, signal: c2, ...a } = {}) => {
+    ft = ({ indicator: t = "dots", onCancel: r, output: s = process.stdout, cancelMessage: i, errorMessage: u, frames: n = tt2 ? ["\u25D2", "\u25D0", "\u25D3", "\u25D1"] : ["\u2022", "o", "O", "0"], delay: o = tt2 ? 80 : 120, signal: c2, ...a } = {}) => {
       const l = at2();
       let d2, y, p2 = false, m = false, g = "", S2, h2 = performance.now();
-      const f = A(s), v2 = a?.styleFrame ?? _e, T = (I) => {
-        const V2 = I > 1 ? u ?? h.messages.error : i ?? h.messages.cancel;
-        m = I === 1, p2 && (W2(V2, I), m && typeof r == "function" && r());
+      const f = A(s), v2 = a?.styleFrame ?? _e, T = (I2) => {
+        const V2 = I2 > 1 ? u ?? h.messages.error : i ?? h.messages.cancel;
+        m = I2 === 1, p2 && (W2(V2, I2), m && typeof r == "function" && r());
       }, C2 = () => T(2), b2 = () => T(1), G2 = () => {
         process.on("uncaughtExceptionMonitor", C2), process.on("unhandledRejection", C2), process.on("SIGINT", b2), process.on("SIGTERM", b2), process.on("exit", T), c2 && c2.addEventListener("abort", b2);
-      }, x = () => {
+      }, x2 = () => {
         process.removeListener("uncaughtExceptionMonitor", C2), process.removeListener("unhandledRejection", C2), process.removeListener("SIGINT", b2), process.removeListener("SIGTERM", b2), process.removeListener("exit", T), c2 && c2.removeEventListener("abort", b2);
       }, A2 = () => {
         if (S2 === void 0) return;
         l && s.write(`
 `);
-        const I = wrapAnsi(S2, f, { hard: true, trim: false }).split(`
+        const I2 = wrapAnsi(S2, f, { hard: true, trim: false }).split(`
 `);
-        I.length > 1 && s.write(import_sisteransi2.cursor.up(I.length - 1)), s.write(import_sisteransi2.cursor.to(0)), s.write(import_sisteransi2.erase.down());
-      }, P = (I) => I.replace(/\.+$/, ""), N = (I) => {
-        const V2 = (performance.now() - I) / 1e3, B = Math.floor(V2 / 60), L2 = Math.floor(V2 % 60);
-        return B > 0 ? `[${B}m ${L2}s]` : `[${L2}s]`;
-      }, D2 = a.withGuide ?? h.withGuide, rt2 = (I = "") => {
-        p2 = true, d2 = R({ output: s }), g = P(I), h2 = performance.now(), D2 && s.write(`${styleText("gray", $)}
+        I2.length > 1 && s.write(import_sisteransi2.cursor.up(I2.length - 1)), s.write(import_sisteransi2.cursor.to(0)), s.write(import_sisteransi2.erase.down());
+      }, P2 = (I2) => I2.replace(/\.+$/, ""), N2 = (I2) => {
+        const V2 = (performance.now() - I2) / 1e3, B2 = Math.floor(V2 / 60), L2 = Math.floor(V2 % 60);
+        return B2 > 0 ? `[${B2}m ${L2}s]` : `[${L2}s]`;
+      }, D2 = a.withGuide ?? h.withGuide, rt2 = (I2 = "") => {
+        p2 = true, d2 = R({ output: s }), g = P2(I2), h2 = performance.now(), D2 && s.write(`${styleText("gray", $2)}
 `);
-        let V2 = 0, B = 0;
+        let V2 = 0, B2 = 0;
         G2(), y = setInterval(() => {
           if (l && g === S2) return;
           A2(), S2 = g;
           const L2 = v2(n[V2]);
-          let Z;
-          if (l) Z = `${L2}  ${g}...`;
-          else if (t === "timer") Z = `${L2}  ${g} ${N(h2)}`;
+          let Z2;
+          if (l) Z2 = `${L2}  ${g}...`;
+          else if (t === "timer") Z2 = `${L2}  ${g} ${N2(h2)}`;
           else {
-            const kt = ".".repeat(Math.floor(B)).slice(0, 3);
-            Z = `${L2}  ${g}${kt}`;
+            const kt = ".".repeat(Math.floor(B2)).slice(0, 3);
+            Z2 = `${L2}  ${g}${kt}`;
           }
-          const Nt = wrapAnsi(Z, f, { hard: true, trim: false });
-          s.write(Nt), V2 = V2 + 1 < n.length ? V2 + 1 : 0, B = B < 4 ? B + 0.125 : 0;
+          const Nt = wrapAnsi(Z2, f, { hard: true, trim: false });
+          s.write(Nt), V2 = V2 + 1 < n.length ? V2 + 1 : 0, B2 = B2 < 4 ? B2 + 0.125 : 0;
         }, o);
-      }, W2 = (I = "", V2 = 0, B = false) => {
+      }, W2 = (I2 = "", V2 = 0, B2 = false) => {
         if (!p2) return;
         p2 = false, clearInterval(y), A2();
-        const L2 = V2 === 0 ? styleText("green", F) : V2 === 1 ? styleText("red", ot2) : styleText("red", ut2);
-        g = I ?? g, B || (t === "timer" ? s.write(`${L2}  ${g} ${N(h2)}
+        const L2 = V2 === 0 ? styleText("green", F2) : V2 === 1 ? styleText("red", ot2) : styleText("red", ut2);
+        g = I2 ?? g, B2 || (t === "timer" ? s.write(`${L2}  ${g} ${N2(h2)}
 `) : s.write(`${L2}  ${g}
-`)), x(), d2();
+`)), x2(), d2();
       };
-      return { start: rt2, stop: (I = "") => W2(I, 0), message: (I = "") => {
-        g = P(I ?? g);
-      }, cancel: (I = "") => W2(I, 1), error: (I = "") => W2(I, 2), clear: () => W2("", 0, true), get isCancelled() {
+      return { start: rt2, stop: (I2 = "") => W2(I2, 0), message: (I2 = "") => {
+        g = P2(I2 ?? g);
+      }, cancel: (I2 = "") => W2(I2, 1), error: (I2 = "") => W2(I2, 2), clear: () => W2("", 0, true), get isCancelled() {
         return m;
       } };
     };
-    ({ light: w2("\u2500", "-"), heavy: w2("\u2501", "="), block: w2("\u2588", "#") });
+    Vt = { light: w2("\u2500", "-"), heavy: w2("\u2501", "="), block: w2("\u2588", "#") };
     it2 = (t, r) => t.includes(`
 `) ? t.split(`
 `).map((s) => r(s)).join(`
@@ -7337,7 +8181,7 @@ ${o}
         const u = s.label ?? String(s.value);
         switch (i) {
           case "disabled":
-            return `${styleText("gray", H)} ${it2(u, (n) => styleText("gray", n))}${s.hint ? ` ${styleText("dim", `(${s.hint ?? "disabled"})`)}` : ""}`;
+            return `${styleText("gray", H2)} ${it2(u, (n) => styleText("gray", n))}${s.hint ? ` ${styleText("dim", `(${s.hint ?? "disabled"})`)}` : ""}`;
           case "selected":
             return `${it2(u, (n) => styleText("dim", n))}`;
           case "active":
@@ -7345,25 +8189,25 @@ ${o}
           case "cancelled":
             return `${it2(u, (n) => styleText(["strikethrough", "dim"], n))}`;
           default:
-            return `${styleText("dim", H)} ${it2(u, (n) => styleText("dim", n))}`;
+            return `${styleText("dim", H2)} ${it2(u, (n) => styleText("dim", n))}`;
         }
       };
       return new ut({ options: t.options, signal: t.signal, input: t.input, output: t.output, initialValue: t.initialValue, render() {
-        const s = t.withGuide ?? h.withGuide, i = `${M(this.state)}  `, u = `${yt(this.state)}  `, n = W(t.output, t.message, u, i), o = `${s ? `${styleText("gray", $)}
+        const s = t.withGuide ?? h.withGuide, i = `${M(this.state)}  `, u = `${yt(this.state)}  `, n = W(t.output, t.message, u, i), o = `${s ? `${styleText("gray", $2)}
 ` : ""}${n}
 `;
         switch (this.state) {
           case "submit": {
-            const c2 = s ? `${styleText("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "selected"), c2);
+            const c2 = s ? `${styleText("gray", $2)}  ` : "", a = W(t.output, r(this.options[this.cursor], "selected"), c2);
             return `${o}${a}`;
           }
           case "cancel": {
-            const c2 = s ? `${styleText("gray", $)}  ` : "", a = W(t.output, r(this.options[this.cursor], "cancelled"), c2);
+            const c2 = s ? `${styleText("gray", $2)}  ` : "", a = W(t.output, r(this.options[this.cursor], "cancelled"), c2);
             return `${o}${a}${s ? `
-${styleText("gray", $)}` : ""}`;
+${styleText("gray", $2)}` : ""}`;
           }
           default: {
-            const c2 = s ? `${styleText("cyan", $)}  ` : "", a = s ? styleText("cyan", E2) : "", l = o.split(`
+            const c2 = s ? `${styleText("cyan", $2)}  ` : "", a = s ? styleText("cyan", E2) : "", l = o.split(`
 `).length, d2 = s ? 2 : 1;
             return `${o}${c2}${Y2({ output: t.output, cursor: this.cursor, options: this.options, maxItems: t.maxItems, columnPadding: c2.length, rowPadding: l + d2, style: (y, p2) => r(y, y.disabled ? "disabled" : p2 ? "active" : "inactive") }).join(`
 ${c2}`)}
@@ -7373,30 +8217,157 @@ ${a}
         }
       } }).prompt();
     };
-    `${styleText("gray", $)}  `;
+    Ge = (t) => {
+      const r = (s, i = "inactive") => {
+        const u = s.label ?? String(s.value);
+        return i === "selected" ? `${styleText("dim", u)}` : i === "cancelled" ? `${styleText(["strikethrough", "dim"], u)}` : i === "active" ? `${styleText(["bgCyan", "gray"], ` ${s.value} `)} ${u}${s.hint ? ` ${styleText("dim", `(${s.hint})`)}` : ""}` : `${styleText(["gray", "bgWhite", "inverse"], ` ${s.value} `)} ${u}${s.hint ? ` ${styleText("dim", `(${s.hint})`)}` : ""}`;
+      };
+      return new at({ options: t.options, signal: t.signal, input: t.input, output: t.output, initialValue: t.initialValue, caseSensitive: t.caseSensitive, render() {
+        const s = t.withGuide ?? h.withGuide, i = `${s ? `${styleText("gray", $2)}
+` : ""}${M(this.state)}  ${t.message}
+`;
+        switch (this.state) {
+          case "submit": {
+            const u = s ? `${styleText("gray", $2)}  ` : "", n = this.options.find((c2) => c2.value === this.value) ?? t.options[0], o = W(t.output, r(n, "selected"), u);
+            return `${i}${o}`;
+          }
+          case "cancel": {
+            const u = s ? `${styleText("gray", $2)}  ` : "", n = W(t.output, r(this.options[0], "cancelled"), u);
+            return `${i}${n}${s ? `
+${styleText("gray", $2)}` : ""}`;
+          }
+          default: {
+            const u = s ? `${styleText("cyan", $2)}  ` : "", n = s ? styleText("cyan", E2) : "", o = this.options.map((c2, a) => W(t.output, r(c2, a === this.cursor ? "active" : "inactive"), u)).join(`
+`);
+            return `${i}${o}
+${n}
+`;
+          }
+        }
+      } }).prompt();
+    };
+    jt = `${styleText("gray", $2)}  `;
+    K2 = { message: async (t, { symbol: r = styleText("gray", $2) } = {}) => {
+      process.stdout.write(`${styleText("gray", $2)}
+${r}  `);
+      let s = 3;
+      for await (let i of t) {
+        i = i.replace(/\n/g, `
+${jt}`), i.includes(`
+`) && (s = 3 + stripVTControlCharacters(i.slice(i.lastIndexOf(`
+`))).length);
+        const u = stripVTControlCharacters(i).length;
+        s + u < process.stdout.columns ? (s += u, process.stdout.write(i)) : (process.stdout.write(`
+${jt}${i.trimStart()}`), s = 3 + stripVTControlCharacters(i.trimStart()).length);
+      }
+      process.stdout.write(`
+`);
+    }, info: (t) => K2.message(t, { symbol: styleText("blue", ht2) }), success: (t) => K2.message(t, { symbol: styleText("green", pt) }), step: (t) => K2.message(t, { symbol: styleText("green", F2) }), warn: (t) => K2.message(t, { symbol: styleText("yellow", mt) }), warning: (t) => K2.warn(t), error: (t) => K2.message(t, { symbol: styleText("red", gt) }) };
+    xe = async (t, r) => {
+      for (const s of t) {
+        if (s.enabled === false) continue;
+        const i = ft(r);
+        i.start(s.title);
+        const u = await s.task(i.message);
+        i.stop(u || s.title);
+      }
+    };
+    Oe = (t) => t.replace(/\x1b\[(?:\d+;)*\d*[ABCDEFGHfJKSTsu]|\x1b\[(s|u)/g, "");
+    Me = (t) => {
+      const r = t.output ?? process.stdout, s = A(r), i = styleText("gray", $2), u = t.spacing ?? 1, n = 3, o = t.retainLog === true, c2 = !at2() && Tt(r);
+      r.write(`${i}
+`), r.write(`${styleText("green", F2)}  ${t.title}
+`);
+      for (let h2 = 0; h2 < u; h2++) r.write(`${i}
+`);
+      const a = [{ value: "", full: "" }];
+      let l = false;
+      const d2 = (h2) => {
+        if (a.length === 0) return;
+        let f = 0;
+        h2 && (f += u + 2);
+        for (const v2 of a) {
+          const { value: T, result: C2 } = v2;
+          let b2 = C2?.message ?? T;
+          if (b2.length === 0) continue;
+          C2 === void 0 && v2.header !== void 0 && v2.header !== "" && (b2 += `
+${v2.header}`);
+          const G2 = b2.split(`
+`).reduce((x2, A2) => A2 === "" ? x2 + 1 : x2 + Math.ceil((A2.length + n) / s), 0);
+          f += G2;
+        }
+        f > 0 && (f += 1, r.write(import_sisteransi2.erase.lines(f)));
+      }, y = (h2, f, v2) => {
+        const T = v2 ? `${h2.full}
+${h2.value}` : h2.value;
+        h2.header !== void 0 && h2.header !== "" && R2.message(h2.header.split(`
+`).map((C2) => styleText("bold", C2)), { output: r, secondarySymbol: i, symbol: i, spacing: 0 }), R2.message(T.split(`
+`).map((C2) => styleText("dim", C2)), { output: r, secondarySymbol: i, symbol: i, spacing: f ?? u });
+      }, p2 = () => {
+        for (const h2 of a) {
+          const { header: f, value: v2, full: T } = h2;
+          (f === void 0 || f.length === 0) && v2.length === 0 || y(h2, void 0, o === true && T.length > 0);
+        }
+      }, m = (h2, f, v2) => {
+        if (d2(false), (v2?.raw !== true || !l) && h2.value !== "" && (h2.value += `
+`), h2.value += Oe(f), l = v2?.raw === true, t.limit !== void 0) {
+          const T = h2.value.split(`
+`), C2 = T.length - t.limit;
+          if (C2 > 0) {
+            const b2 = T.splice(0, C2);
+            o && (h2.full += (h2.full === "" ? "" : `
+`) + b2.join(`
+`));
+          }
+          h2.value = T.join(`
+`);
+        }
+        c2 && g();
+      }, g = () => {
+        for (const h2 of a) h2.result ? h2.result.status === "error" ? R2.error(h2.result.message, { output: r, secondarySymbol: i, spacing: 0 }) : R2.success(h2.result.message, { output: r, secondarySymbol: i, spacing: 0 }) : h2.value !== "" && y(h2, 0);
+      }, S2 = (h2, f) => {
+        d2(false), h2.result = f, c2 && g();
+      };
+      return { message(h2, f) {
+        m(a[0], h2, f);
+      }, group(h2) {
+        const f = { header: h2, value: "", full: "" };
+        return a.push(f), { message(v2, T) {
+          m(f, v2, T);
+        }, error(v2) {
+          S2(f, { status: "error", message: v2 });
+        }, success(v2) {
+          S2(f, { status: "success", message: v2 });
+        } };
+      }, error(h2, f) {
+        d2(true), R2.error(h2, { output: r, secondarySymbol: i, spacing: 1 }), f?.showLog !== false && p2(), a.splice(1, a.length - 1), a[0].value = "", a[0].full = "";
+      }, success(h2, f) {
+        d2(true), R2.success(h2, { output: r, secondarySymbol: i, spacing: 1 }), f?.showLog === true && p2(), a.splice(1, a.length - 1), a[0].value = "", a[0].full = "";
+      } };
+    };
     Re = (t) => new ht({ validate: t.validate, placeholder: t.placeholder, defaultValue: t.defaultValue, initialValue: t.initialValue, output: t.output, signal: t.signal, input: t.input, render() {
-      const r = t?.withGuide ?? h.withGuide, s = `${`${r ? `${styleText("gray", $)}
+      const r = t?.withGuide ?? h.withGuide, s = `${`${r ? `${styleText("gray", $2)}
 ` : ""}${M(this.state)}  `}${t.message}
 `, i = t.placeholder ? styleText("inverse", t.placeholder[0]) + styleText("dim", t.placeholder.slice(1)) : styleText(["inverse", "hidden"], "_"), u = this.userInput ? this.userInputWithCursor : i, n = this.value ?? "";
       switch (this.state) {
         case "error": {
-          const o = this.error ? `  ${styleText("yellow", this.error)}` : "", c2 = r ? `${styleText("yellow", $)}  ` : "", a = r ? styleText("yellow", E2) : "";
+          const o = this.error ? `  ${styleText("yellow", this.error)}` : "", c2 = r ? `${styleText("yellow", $2)}  ` : "", a = r ? styleText("yellow", E2) : "";
           return `${s.trim()}
 ${c2}${u}
 ${a}${o}
 `;
         }
         case "submit": {
-          const o = n ? `  ${styleText("dim", n)}` : "", c2 = r ? styleText("gray", $) : "";
+          const o = n ? `  ${styleText("dim", n)}` : "", c2 = r ? styleText("gray", $2) : "";
           return `${s}${c2}${o}`;
         }
         case "cancel": {
-          const o = n ? `  ${styleText(["strikethrough", "dim"], n)}` : "", c2 = r ? styleText("gray", $) : "";
+          const o = n ? `  ${styleText(["strikethrough", "dim"], n)}` : "", c2 = r ? styleText("gray", $2) : "";
           return `${s}${c2}${o}${n.trim() ? `
 ${c2}` : ""}`;
         }
         default: {
-          const o = r ? `${styleText("cyan", $)}  ` : "", c2 = r ? styleText("cyan", E2) : "";
+          const o = r ? `${styleText("cyan", $2)}  ` : "", c2 = r ? styleText("cyan", E2) : "";
           return `${s}${o}${u}
 ${c2}
 `;
@@ -7406,7 +8377,7 @@ ${c2}
   }
 });
 
-// src/init/scriptWrap.ts
+// src/init/script-wrap.ts
 function analyzeScript(name, command) {
   const trimmed = command.trim();
   if (trimmed.startsWith("keynv ") || trimmed.startsWith("keynv	")) {
@@ -7511,8 +8482,8 @@ function applyWraps(original, selectedScriptNames) {
   return out;
 }
 var KEYNV_PREFIX, ENV_AWARE_TOOLS, NON_ENV_TOOLS;
-var init_scriptWrap = __esm({
-  "src/init/scriptWrap.ts"() {
+var init_script_wrap = __esm({
+  "src/init/script-wrap.ts"() {
     KEYNV_PREFIX = "keynv exec --";
     ENV_AWARE_TOOLS = /* @__PURE__ */ new Set([
       "node",
@@ -7797,7 +8768,7 @@ ${detail}`
             method: "POST",
             body: { env: env2, key: aliasKey, value: e2.value }
           });
-          const alias2 = buildAlias({
+          const alias2 = reference_exports.buildAlias({
             project: projectChoice.name,
             environment: env2,
             key: aliasKey
@@ -8138,10 +9109,10 @@ var init_init = __esm({
     init_dist5();
     init_dist();
     init_envFile();
-    init_aiContext();
+    init_ai_context();
     init_detect();
     init_heuristics();
-    init_scriptWrap();
+    init_script_wrap();
     init_cancel();
     init_pickProject();
   }
@@ -8172,7 +9143,16 @@ async function errorMessage(res, fallback) {
     return fallback;
   }
 }
+function isSafeUrl(urlStr) {
+  try {
+    const parsed = new URL(urlStr);
+    return parsed.protocol === "https:" || parsed.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
 function openBrowser(url) {
+  if (!isSafeUrl(url)) return false;
   try {
     const os = platform();
     const command = os === "win32" ? "cmd" : os === "darwin" ? "open" : "xdg-open";
@@ -8358,7 +9338,7 @@ async function runSecretMenu(client, project, alias2) {
         ]
       })
     );
-    const parsed = parseAlias(alias2);
+    const parsed = reference_exports.parseAlias(alias2);
     if (!parsed) {
       R2.warn(`unparseable alias: ${alias2}`);
       return;
@@ -8442,14 +9422,14 @@ async function promptNewSecret(client, project) {
       }
     }
   );
-  const built = buildAlias({ project: target.name, environment: env2, key: answers.key });
+  const built = reference_exports.buildAlias({ project: target.name, environment: env2, key: answers.key });
   if (!built) return null;
   return { alias: built.literal, value: answers.value };
 }
 async function createSecretInteractive(client, project) {
   const built = await promptNewSecret(client, project);
   if (!built) return;
-  const parsed = parseAlias(built.alias);
+  const parsed = reference_exports.parseAlias(built.alias);
   if (!parsed) {
     R2.warn("Invalid alias produced by form; aborting.");
     return;
@@ -14292,8 +15272,8 @@ var require_umd = __commonJS({
           if (this.unsigned) return this;
           return fromBits(this.low, this.high, true);
         };
-        LongPrototype.toBytes = function toBytes(le) {
-          return le ? this.toBytesLE() : this.toBytesBE();
+        LongPrototype.toBytes = function toBytes(le2) {
+          return le2 ? this.toBytesLE() : this.toBytesBE();
         };
         LongPrototype.toBytesLE = function toBytesLE() {
           var hi = this.high, lo = this.low;
@@ -14321,8 +15301,8 @@ var require_umd = __commonJS({
             lo & 255
           ];
         };
-        Long.fromBytes = function fromBytes(bytes, unsigned, le) {
-          return le ? Long.fromBytesLE(bytes, unsigned) : Long.fromBytesBE(bytes, unsigned);
+        Long.fromBytes = function fromBytes(bytes, unsigned, le2) {
+          return le2 ? Long.fromBytesLE(bytes, unsigned) : Long.fromBytesBE(bytes, unsigned);
         };
         Long.fromBytesLE = function fromBytesLE(bytes, unsigned) {
           return new Long(
@@ -18458,7 +19438,7 @@ var require_packet = __commonJS({
           let y = 0;
           let m = 0;
           let d2 = 0;
-          let H2 = 0;
+          let H3 = 0;
           let M2 = 0;
           let S2 = 0;
           let ms = 0;
@@ -18468,20 +19448,20 @@ var require_packet = __commonJS({
             d2 = this.readInt8();
           }
           if (length > 6) {
-            H2 = this.readInt8();
+            H3 = this.readInt8();
             M2 = this.readInt8();
             S2 = this.readInt8();
           }
           if (length > 10) {
             ms = this.readInt32() / 1e3;
           }
-          if (y + m + d2 + H2 + M2 + S2 + ms === 0) {
+          if (y + m + d2 + H3 + M2 + S2 + ms === 0) {
             return INVALID_DATE;
           }
           if (timezone === "Z") {
-            return new Date(Date.UTC(y, m - 1, d2, H2, M2, S2, ms));
+            return new Date(Date.UTC(y, m - 1, d2, H3, M2, S2, ms));
           }
-          return new Date(y, m - 1, d2, H2, M2, S2, ms);
+          return new Date(y, m - 1, d2, H3, M2, S2, ms);
         }
         let str = this.readDateTimeString(6, "T", null);
         if (!str) {
@@ -18497,7 +19477,7 @@ var require_packet = __commonJS({
         let y = 0;
         let m = 0;
         let d2 = 0;
-        let H2 = 0;
+        let H3 = 0;
         let M2 = 0;
         let S2 = 0;
         let ms = 0;
@@ -18509,11 +19489,11 @@ var require_packet = __commonJS({
           str = [leftPad(4, y), leftPad(2, m), leftPad(2, d2)].join("-");
         }
         if (length > 6) {
-          H2 = this.readInt8();
+          H3 = this.readInt8();
           M2 = this.readInt8();
           S2 = this.readInt8();
           str += `${timeSep || " "}${[
-            leftPad(2, H2),
+            leftPad(2, H3),
             leftPad(2, M2),
             leftPad(2, S2)
           ].join(":")}`;
@@ -18541,13 +19521,13 @@ var require_packet = __commonJS({
         }
         const sign = this.readInt8() ? -1 : 1;
         let d2 = 0;
-        let H2 = 0;
+        let H3 = 0;
         let M2 = 0;
         let S2 = 0;
         let ms = 0;
         if (length > 6) {
           d2 = this.readInt32();
-          H2 = this.readInt8();
+          H3 = this.readInt8();
           M2 = this.readInt8();
           S2 = this.readInt8();
         }
@@ -18555,14 +19535,14 @@ var require_packet = __commonJS({
           ms = this.readInt32();
         }
         if (convertTtoMs) {
-          H2 += d2 * 24;
-          M2 += H2 * 60;
+          H3 += d2 * 24;
+          M2 += H3 * 60;
           S2 += M2 * 60;
           ms += S2 * 1e3;
           ms *= sign;
           return ms;
         }
-        return (sign === -1 ? "-" : "") + [leftPad(2, d2 * 24 + H2), leftPad(2, M2), leftPad(2, S2)].join(":") + (ms ? `.${ms}`.replace(/0+$/, "") : "");
+        return (sign === -1 ? "-" : "") + [leftPad(2, d2 * 24 + H3), leftPad(2, M2), leftPad(2, S2)].join(":") + (ms ? `.${ms}`.replace(/0+$/, "") : "");
       }
       readLengthCodedString(encoding) {
         const len = this.readLengthCodedNumber();
@@ -18700,7 +19680,7 @@ var require_packet = __commonJS({
         }
         const bufferLength = buffer.length;
         function parseGeometry() {
-          let x, y, i, j3, numPoints, numRings, num, line;
+          let x2, y, i, j3, numPoints, numRings, num, line;
           let result = null;
           if (offset + 5 > bufferLength) {
             return null;
@@ -18714,11 +19694,11 @@ var require_packet = __commonJS({
               if (offset + 16 > bufferLength) {
                 return null;
               }
-              x = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
+              x2 = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
               offset += 8;
               y = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
               offset += 8;
-              result = { x, y };
+              result = { x: x2, y };
               break;
             case 2:
               if (offset + 4 > bufferLength) {
@@ -18734,11 +19714,11 @@ var require_packet = __commonJS({
                 if (offset + 16 > bufferLength) {
                   break;
                 }
-                x = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
+                x2 = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
                 offset += 8;
                 y = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
                 offset += 8;
-                result.push({ x, y });
+                result.push({ x: x2, y });
               }
               break;
             case 3:
@@ -18762,11 +19742,11 @@ var require_packet = __commonJS({
                   if (offset + 16 > bufferLength) {
                     break;
                   }
-                  x = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
+                  x2 = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
                   offset += 8;
                   y = byteOrder ? buffer.readDoubleLE(offset) : buffer.readDoubleBE(offset);
                   offset += 8;
-                  line.push({ x, y });
+                  line.push({ x: x2, y });
                 }
                 result.push(line);
               }
@@ -31107,28 +32087,28 @@ var require_helper = __commonJS({
     var isValidEntry = module.exports.isValidEntry = function(entry2) {
       var rules = {
         // host
-        0: function(x) {
-          return x.length > 0;
+        0: function(x2) {
+          return x2.length > 0;
         },
         // port
-        1: function(x) {
-          if (x === "*") {
+        1: function(x2) {
+          if (x2 === "*") {
             return true;
           }
-          x = Number(x);
-          return isFinite(x) && x > 0 && x < 9007199254740992 && Math.floor(x) === x;
+          x2 = Number(x2);
+          return isFinite(x2) && x2 > 0 && x2 < 9007199254740992 && Math.floor(x2) === x2;
         },
         // database
-        2: function(x) {
-          return x.length > 0;
+        2: function(x2) {
+          return x2.length > 0;
         },
         // username
-        3: function(x) {
-          return x.length > 0;
+        3: function(x2) {
+          return x2.length > 0;
         },
         // password
-        4: function(x) {
-          return x.length > 0;
+        4: function(x2) {
+          return x2.length > 0;
         }
       };
       for (var idx = 0; idx < fieldNames.length; idx += 1) {
@@ -31156,8 +32136,8 @@ var require_lib6 = __commonJS({
         if (err || !helper.usePgPass(stat, file)) {
           return cb(void 0);
         }
-        var st2 = fs.createReadStream(file);
-        helper.getPassword(connInfo, st2, cb);
+        var st3 = fs.createReadStream(file);
+        helper.getPassword(connInfo, st3, cb);
       });
     };
     module.exports.warnTo = helper.warnTo;
@@ -37188,8 +38168,8 @@ var require_utils4 = __commonJS({
     }
     exports.wrapMultiResult = wrapMultiResult;
     function isInt(value) {
-      const x = parseFloat(value);
-      return !isNaN(value) && (x | 0) === x;
+      const x2 = parseFloat(value);
+      return !isNaN(value) && (x2 | 0) === x2;
     }
     exports.isInt = isInt;
     function packObject(array) {
@@ -37798,9 +38778,9 @@ var require_Command = __commonJS({
         this.length = 0;
         this.items = [];
       }
-      push(x) {
-        this.length += Buffer.byteLength(x);
-        this.items.push(x);
+      push(x2) {
+        this.length += Buffer.byteLength(x2);
+        this.items.push(x2);
       }
       toBuffer() {
         const result = Buffer.allocUnsafe(this.length);
@@ -44033,11 +45013,11 @@ function formatMarkdownish(text, { format, paragraphs }) {
 
 `);
   }
-  text = text.replace(/(`+)((?:.|[\n])*?)\1/g, ($0, $1, $2) => {
-    return format.code($1 + $2 + $1);
+  text = text.replace(/(`+)((?:.|[\n])*?)\1/g, ($0, $1, $22) => {
+    return format.code($1 + $22 + $1);
   });
-  text = text.replace(/(\*\*)((?:.|[\n])*?)\1/g, ($0, $1, $2) => {
-    return format.bold($1 + $2 + $1);
+  text = text.replace(/(\*\*)((?:.|[\n])*?)\1/g, ($0, $1, $22) => {
+    return format.bold($1 + $22 + $1);
   });
   return text ? `${text}
 ` : ``;
@@ -44826,15 +45806,15 @@ init_envFile();
 init_dist();
 async function resolveAllAliases(client, argv2, extraStrings = []) {
   const seen = /* @__PURE__ */ new Map();
-  const argvScans = findAliasesInArgv(argv2);
+  const argvScans = reference_exports.findAliasesInArgv(argv2);
   for (const { matches } of argvScans) {
     for (const m of matches) {
       seen.set(m.literal, m);
     }
   }
   for (const s of extraStrings) {
-    for (const m of findAliasesInArgv([s])) {
-      for (const x of m.matches) seen.set(x.literal, x);
+    for (const m of reference_exports.findAliasesInArgv([s])) {
+      for (const x2 of m.matches) seen.set(x2.literal, x2);
     }
   }
   if (seen.size === 0) return [];
@@ -44926,10 +45906,18 @@ var BUILTIN_PATTERNS = [
     name: "stripe-live-secret-key",
     regex: /\bsk_live_[A-Za-z0-9]{24,}\b/g
   },
+  {
+    name: "stripe-test-secret-key",
+    regex: /\bsk_test_[A-Za-z0-9]{24,}\b/g
+  },
   {
     name: "stripe-restricted-live-key",
     regex: /\brk_live_[A-Za-z0-9]{24,}\b/g
   },
+  {
+    name: "stripe-restricted-test-key",
+    regex: /\brk_test_[A-Za-z0-9]{24,}\b/g
+  },
   {
     // Negative lookahead skips Anthropic-prefixed keys so the more
     // specific anthropic-api-key pattern wins on those.
@@ -45025,7 +46013,9 @@ function defaultRender(name) {
   return `<REDACTED:${name}>`;
 }
 function preview(matched) {
-  return matched.length <= 8 ? matched : `${matched.slice(0, 4)}...`;
+  if (matched.length <= 4)
+    return "****";
+  return `${matched.slice(0, 4)}...`;
 }
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -45056,8 +46046,8 @@ function redact(text, opts = {}) {
     for (const literal of opts.literals) {
       if (!literal)
         continue;
-      const re = new RegExp(escapeRegExp(literal), "g");
-      for (const m of text.matchAll(re)) {
+      const re2 = new RegExp(escapeRegExp(literal), "g");
+      for (const m of text.matchAll(re2)) {
         if (m.index === void 0)
           continue;
         raw.push({
@@ -45482,13 +46472,14 @@ spelled \`--from\` to avoid the collision.)
       const displayPath = relative(process.cwd(), envFileLoaded.path) || envFileLoaded.path;
       const parts = [];
       if (aliasEntries.length > 0) {
-        parts.push(aliasEntries.map((e2) => `${e2.name}=${e2.value}`).join(", ") + " (vault)");
+        parts.push(`${aliasEntries.map((e2) => `${e2.name}=${e2.value}`).join(", ")} (vault)`);
       }
       if (plainEntries.length > 0) {
-        parts.push(plainEntries.map((e2) => e2.name).join(", ") + " (plain)");
+        parts.push(`${plainEntries.map((e2) => e2.name).join(", ")} (plain)`);
       }
       this.context.stderr.write(
-        `keynv: loaded ${displayPath}` + (parts.length > 0 ? ` \u2014 ${parts.join("; ")}` : "") + "\n"
+        `keynv: loaded ${displayPath}${parts.length > 0 ? ` \u2014 ${parts.join("; ")}` : ""}
+`
       );
     }
     const timeoutS = this.timeout ? Number.parseInt(this.timeout, 10) : void 0;
@@ -45531,9 +46522,9 @@ function signalNumber(sig) {
 init_dist();
 init_http();
 init_envFile();
+init_ai_context();
 init_detect();
 init_heuristics();
-init_aiContext();
 init_init();
 init_cancel();
 init_tty();
@@ -45718,10 +46709,7 @@ any prompts.
       ["Preview without writing or uploading", "$0 init --dry-run"],
       ["Skip the package.json script-wrapping step", "$0 init --no-scripts"],
       ["Non-interactive (CI/CD)", "$0 init --env-file .env --project myproject --env dev"],
-      [
-        "Auto-scan & set up without prompts (CI/CD)",
-        "$0 init --yes"
-      ]
+      ["Auto-scan & set up without prompts (CI/CD)", "$0 init --yes"]
     ]
   });
   dryRun = options_exports.Boolean("--dry-run", false, {
@@ -45860,9 +46848,7 @@ any prompts.
   async runAutoScan(client) {
     const root = findProjectRoot(process.cwd());
     if (!root) {
-      this.context.stderr.write(
-        "keynv: no project root found (no package.json, .git, etc.).\n"
-      );
+      this.context.stderr.write("keynv: no project root found (no package.json, .git, etc.).\n");
       return 1;
     }
     const envFiles = findEnvFiles(root.path);
@@ -45908,14 +46894,23 @@ any prompts.
     } catch {
       const created = await client.request("/v1/projects", {
         method: "POST",
-        body: { name: projectName, environments: [{ name: envName, tier: "non-production", require_approval: false }] }
+        body: {
+          name: projectName,
+          environments: [{ name: envName, tier: "non-production", require_approval: false }]
+        }
       });
       projectId2 = created.id;
       this.context.stdout.write(`keynv: created project "${projectName}" (${projectId2}).
 `);
     }
     const secretsWithKeys = secrets.map((s) => ({ ...s, aliasKey: toAliasKey2(s.name) }));
-    const result = await this.uploadSecrets(client, projectId2, projectName, envName, secretsWithKeys);
+    const result = await this.uploadSecrets(
+      client,
+      projectId2,
+      projectName,
+      envName,
+      secretsWithKeys
+    );
     if (result !== 0) return result;
     const aliasLines = secretsWithKeys.map((s) => `# ${s.name}
 ${s.name}=@${projectName}.${envName}.${s.aliasKey}`).join("\n");
@@ -45936,7 +46931,9 @@ ${aliasLines}
       this.context.stdout.write(`keynv: removed ${f.name} (secrets migrated to vault).
 `);
     }
-    this.context.stdout.write("keynv: done. Use `keynv exec` to run commands with resolved secrets.\n");
+    this.context.stdout.write(
+      "keynv: done. Use `keynv exec` to run commands with resolved secrets.\n"
+    );
     return 0;
   }
   /**
@@ -45947,7 +46944,11 @@ ${aliasLines}
     let uploaded = 0;
     const failed = [];
     for (const s of secrets) {
-      const alias2 = buildAlias({ project: projectName, environment: envName, key: s.aliasKey });
+      const alias2 = reference_exports.buildAlias({
+        project: projectName,
+        environment: envName,
+        key: s.aliasKey
+      });
       if (!alias2) {
         failed.push({ name: s.name, reason: `invalid alias key: ${s.aliasKey}` });
         continue;
@@ -46048,7 +47049,7 @@ var LoginCommand = class extends Command {
   token = options_exports.String("--token", { description: "CLI token for headless auth." });
   email = options_exports.String("--email", { description: "Email address." });
   password = options_exports.String("--password", {
-    description: "Password (use stdin to avoid argv leak)."
+    description: "Password. WARNING: passing passwords via --password leaks them to process listings (ps). Use interactive prompt or pipe via stdin instead."
   });
   async execute() {
     const finalServerUrl = this.server ?? DEFAULT_SERVER_URL;
@@ -46080,7 +47081,15 @@ var LoginCommand = class extends Command {
       }
     }
     const email2 = this.email ?? await promptLine("email: ");
-    const password = this.password ?? await promptHidden("password: ");
+    let password;
+    if (this.password) {
+      this.context.stderr.write(
+        "keynv: WARNING: --password leaks credentials to process listings. Use interactive prompt or pipe via stdin instead.\n"
+      );
+      password = this.password;
+    } else {
+      password = await promptHidden("password: ");
+    }
     let res;
     try {
       res = await fetch(new URL("/v1/auth/login", finalServerUrl).toString(), {
@@ -46471,7 +47480,7 @@ var SecretCreateCommand = class extends Command {
           throw err;
         }
       }
-      const parsed = parseAlias(alias2);
+      const parsed = reference_exports.parseAlias(alias2);
       if (!parsed) {
         this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
@@ -46525,7 +47534,7 @@ var SecretGetCommand = class extends Command {
         }
         if (!alias2) return 1;
       }
-      const parsed = parseAlias(alias2);
+      const parsed = reference_exports.parseAlias(alias2);
       if (!parsed) {
         this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
@@ -46579,7 +47588,7 @@ var SecretListCommand = class extends Command {
       }
       let resolvedProjectName = projectName;
       if (projectName.startsWith("@")) {
-        const parsed = parseAlias(projectName);
+        const parsed = reference_exports.parseAlias(projectName);
         if (parsed) {
           resolvedProjectName = parsed.project;
         } else {
@@ -46631,7 +47640,7 @@ var SecretRotateCommand = class extends Command {
         }
         if (!alias2) return 1;
       }
-      const parsed = parseAlias(alias2);
+      const parsed = reference_exports.parseAlias(alias2);
       if (!parsed) {
         this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
@@ -46667,6 +47676,7 @@ var SecretDeleteCommand = class extends Command {
   static paths = [["secret", "delete"]];
   static usage = Command.Usage({ description: "Soft-delete a secret." });
   alias = options_exports.String({ required: false });
+  force = options_exports.Boolean("--force", false);
   async execute() {
     try {
       const client = new ApiClient();
@@ -46682,13 +47692,28 @@ var SecretDeleteCommand = class extends Command {
         }
         if (!alias2) return 1;
       }
-      const parsed = parseAlias(alias2);
+      const parsed = reference_exports.parseAlias(alias2);
       if (!parsed) {
         this.context.stderr.write(`keynv: invalid alias '${alias2}'.
   ${ALIAS_FORMAT_HINT}
 `);
         return 1;
       }
+      if (!this.force) {
+        if (isInteractive()) {
+          const { confirm } = await Promise.resolve().then(() => (init_dist5(), dist_exports));
+          const ok = await confirm({
+            message: `Delete secret ${parsed.literal}?`
+          });
+          if (!ok) {
+            this.context.stderr.write("Cancelled.\n");
+            return 130;
+          }
+        } else {
+          this.context.stderr.write("keynv: refusing to delete without --force\n");
+          return 2;
+        }
+      }
       const projectId2 = await resolveProjectId(client, parsed.project);
       await client.request(
         `/v1/projects/${projectId2}/secrets/${parsed.environment}/${parsed.key}`,
@@ -46765,7 +47790,7 @@ Non-interactive with --yes to skip prompts.
     ].join("\n");
     const { writeFileSync: writeFileSync5 } = await import('fs');
     writeFileSync5(outPath, `${contents}
-`);
+`, { mode: 384 });
     this.context.stdout.write(`Wrote ${outPath}
 
 `);
@@ -46830,7 +47855,7 @@ services:
 volumes:
   keynv-data:
 `;
-      writeFileSync5("docker-compose.yml", composeContent);
+      writeFileSync5("docker-compose.yml", composeContent, { mode: 384 });
       this.context.stdout.write(
         "\nWrote docker-compose.yml (update Litestream S3 config before deploying).\n"
       );
@@ -46844,6 +47869,60 @@ init_dist();
 
 // ../../packages/testers/dist/http.js
 init_zod();
+
+// ../../packages/testers/dist/ssrf.js
+var PRIVATE_CIDRS = [
+  /^0\./,
+  /^10\./,
+  /^127\./,
+  /^169\.254\./,
+  /^172\.(1[6-9]|2\d|3[01])\./,
+  /^192\.0[0-2]\./,
+  /^192\.168\./,
+  /^198\.51\.100\./,
+  /^203\.0\.113\./,
+  /^224\./,
+  /^240\./
+];
+var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata.internal",
+  "instance-data"
+]);
+function isLoopbackAllowed() {
+  return !!process.env["KEYNV_ALLOW_LOOPBACK_TESTERS"];
+}
+function isBlockedHost(host) {
+  const lower = host.toLowerCase();
+  if (BLOCKED_HOSTNAMES.has(lower)) {
+    if (isLoopbackAllowed() && lower === "localhost")
+      return false;
+    return true;
+  }
+  if (lower === "0.0.0.0" || lower === "[::]" || lower === "[::1]")
+    return !isLoopbackAllowed();
+  for (const re2 of PRIVATE_CIDRS) {
+    if (re2.test(lower)) {
+      if (isLoopbackAllowed() && /^127\./.test(lower))
+        return false;
+      return true;
+    }
+  }
+  return false;
+}
+function isBlockedUrl(urlStr) {
+  try {
+    const parsed = new URL(urlStr);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+      return true;
+    return isBlockedHost(parsed.hostname);
+  } catch {
+    return true;
+  }
+}
+
+// ../../packages/testers/dist/http.js
 var Target = external_exports.object({
   url: external_exports.string().url(),
   method: external_exports.enum(["GET", "POST", "HEAD"]).default("GET"),
@@ -46862,6 +47941,13 @@ var httpTester = {
   type: "http",
   schema: Target,
   async test(secret, target) {
+    if (isBlockedUrl(target.url)) {
+      return {
+        ok: false,
+        latency_ms: 0,
+        error: "Target URL is blocked (private/internal IP or metadata endpoint)."
+      };
+    }
     const start = Date.now();
     const headers = {};
     switch (target.auth) {
@@ -46915,12 +48001,20 @@ var Target2 = external_exports.object({
   host: external_exports.string().min(1),
   port: external_exports.coerce.number().int().min(1).max(65535).default(3306),
   database: external_exports.string().min(1).optional(),
-  user: external_exports.string().min(1)
+  user: external_exports.string().min(1),
+  ssl: external_exports.coerce.boolean().optional()
 });
 var mysqlTester = {
   type: "mysql",
   schema: Target2,
   async test(secret, target) {
+    if (isBlockedHost(target.host)) {
+      return {
+        ok: false,
+        latency_ms: 0,
+        error: "Target host is blocked (private/internal IP or metadata endpoint)."
+      };
+    }
     const start = Date.now();
     const mysql = await Promise.resolve().then(() => __toESM(require_promise()));
     const conn = await mysql.createConnection({
@@ -46929,6 +48023,7 @@ var mysqlTester = {
       ...target.database ? { database: target.database } : {},
       user: target.user,
       password: secret.value,
+      ...target.ssl !== false ? { ssl: {} } : {},
       connectTimeout: 5e3
     }).catch((err) => {
       return {
@@ -46968,6 +48063,13 @@ var postgresTester = {
   type: "postgres",
   schema: Target3,
   async test(secret, target) {
+    if (isBlockedHost(target.host)) {
+      return {
+        ok: false,
+        latency_ms: 0,
+        error: "Target host is blocked (private/internal IP or metadata endpoint)."
+      };
+    }
     const start = Date.now();
     const { Client: Client2 } = await Promise.resolve().then(() => (init_esm(), esm_exports));
     const client = new Client2({
@@ -46976,7 +48078,7 @@ var postgresTester = {
       database: target.database,
       user: target.user,
       password: secret.value,
-      ssl: target.ssl ?? false,
+      ssl: target.ssl ?? true,
       connectionTimeoutMillis: 5e3,
       statement_timeout: 5e3
     });
@@ -47015,6 +48117,13 @@ var redisTester = {
   type: "redis",
   schema: Target4,
   async test(secret, target) {
+    if (isBlockedHost(target.host)) {
+      return {
+        ok: false,
+        latency_ms: 0,
+        error: "Target host is blocked (private/internal IP or metadata endpoint)."
+      };
+    }
     const start = Date.now();
     const { default: Redis } = await Promise.resolve().then(() => __toESM(require_built3()));
     const client = new Redis({
@@ -47058,12 +48167,25 @@ var Target5 = external_exports.object({
    * 'password' uses secret.value as a password; 'key' uses
    * secret.value as a PEM-encoded private key.
    */
-  auth: external_exports.enum(["password", "key"]).default("password")
+  auth: external_exports.enum(["password", "key"]).default("password"),
+  /**
+   * Expected SHA-256 fingerprint of the server host public key
+   * (base64, no padding). When set, the connection is rejected if
+   * the key does not match — preventing MITM attacks.
+   */
+  host_key_sha256: external_exports.string().min(1).optional()
 });
 var sshTester = {
   type: "ssh",
   schema: Target5,
   async test(secret, target) {
+    if (isBlockedHost(target.host)) {
+      return {
+        ok: false,
+        latency_ms: 0,
+        error: "Target host is blocked (private/internal IP or metadata endpoint)."
+      };
+    }
     const start = Date.now();
     const { Client: Client2 } = await import('ssh2');
     return new Promise((resolve4) => {
@@ -47102,13 +48224,30 @@ var sshTester = {
         settle({ ok: false, latency_ms: Date.now() - start, error: err.message });
       });
       try {
-        client.connect({
+        const connectOpts = {
           host: target.host,
           port: target.port,
           username: target.user,
-          ...target.auth === "password" ? { password: secret.value } : { privateKey: secret.value },
           readyTimeout: 5e3
-        });
+        };
+        if (target.auth === "password") {
+          connectOpts.password = secret.value;
+        } else {
+          connectOpts.privateKey = secret.value;
+        }
+        if (target.host_key_sha256) {
+          const expected = target.host_key_sha256;
+          connectOpts.hostVerifier = (key2) => {
+            if (typeof key2 === "string") {
+              return createHash("sha256").update(key2, "utf8").digest("base64").replace(/=+$/, "") === expected;
+            }
+            if (Buffer.isBuffer(key2)) {
+              return createHash("sha256").update(key2).digest("base64").replace(/=+$/, "") === expected;
+            }
+            return false;
+          };
+        }
+        client.connect(connectOpts);
       } catch (err) {
         settle({
           ok: false,
@@ -47121,6 +48260,8 @@ var sshTester = {
 };
 
 // ../../packages/testers/dist/types.js
+init_zod();
+external_exports.enum(["postgres", "mysql", "redis", "ssh", "http"]);
 var DEFAULT_TIMEOUT_MS = 5e3;
 
 // ../../packages/testers/dist/sanitize.js
@@ -47183,7 +48324,7 @@ function formatZodIssues(error) {
 }
 
 // ../../packages/testers/dist/index.js
-var TESTERS = [
+var testers = [
   postgresTester,
   mysqlTester,
   redisTester,
@@ -47233,7 +48374,7 @@ the error message.
     description: "Override the default 5s timeout (in seconds)."
   });
   async execute() {
-    const parsedAlias = parseAlias(this.alias);
+    const parsedAlias = reference_exports.parseAlias(this.alias);
     if (!parsedAlias) {
       this.context.stderr.write(`keynv: invalid alias '${this.alias}'
 `);
@@ -47241,12 +48382,12 @@ the error message.
     }
     if (!this.as) {
       this.context.stderr.write(
-        `keynv: --as is required (one of: ${TESTERS.map((t) => t.type).join(", ")})
+        `keynv: --as is required (one of: ${testers.map((t) => t.type).join(", ")})
 `
       );
       return 2;
     }
-    const tester = TESTERS.find((t) => t.type === this.as);
+    const tester = testers.find((t) => t.type === this.as);
     if (!tester) {
       this.context.stderr.write(`keynv: unknown tester '${this.as}'
 `);
@@ -47376,7 +48517,7 @@ if (argv.length === 0) {
     process.exit(0);
   }
 } else {
-  cli.runExit(argv).catch((err) => {
+  cli.run(argv).then((code) => process.exit(code ?? 0)).catch((err) => {
     process.stderr.write(`${fmtError(err)}
 `);
     process.exit(1);