@keynv/cli 0.1.0-rc.16 → 0.1.0-rc.18

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
 import { createHash, randomBytes } from 'crypto';
-import { readFileSync, writeFileSync, unlinkSync, existsSync, statSync, readdirSync, mkdirSync, rmSync, lstatSync } from 'fs';
+import { readFileSync, unlinkSync, existsSync, statSync, writeFileSync, readdirSync, mkdirSync, rmSync, lstatSync } from 'fs';
 import { hostname, platform, homedir } from 'os';
 import * as nodePath from 'path';
 import { relative, join, isAbsolute, resolve, dirname, basename } from 'path';
@@ -1057,7 +1057,7 @@ var require_lib = __commonJS({
 var VERSION, AGENT;
 var init_version = __esm({
   "src/version.ts"() {
-    VERSION = "0.1.0-rc.16" ;
+    VERSION = "0.1.0-rc.18" ;
     AGENT = `keynv-cli/${VERSION}`;
   }
 });
@@ -5734,7 +5734,7 @@ var init_http = __esm({
       async request(path, opts = {}) {
         if (this.hydrated) await this.hydrated;
         if (!this.creds && opts.authed !== false) {
-          throw clientError(401, "auth.missing_token", "Not logged in. Run `keynv login` first.");
+          throw clientError(401, "auth.missing_token", "Not connected. Run `keynv` first.");
         }
         const headers = {
           "content-type": "application/json",
@@ -5778,6 +5778,13 @@ var init_http = __esm({
        Check the server is running: curl ${serverUrl}/v1/health`
               );
             }
+          } else {
+            this.creds = null;
+            throw clientError(
+              401,
+              "auth.session_expired",
+              "Session expired. Run `keynv` to reconnect."
+            );
           }
         }
         if (res.status === 204) return void 0;
@@ -5994,7 +6001,7 @@ When the user asks about secrets or env vars, follow this decision tree:
 | User intent | Run / suggest |
 |---|---|
 | "Add a new API key" / "set up a secret" | \`keynv secret create\` (interactive prompt picks project + env + key) |
-| "I have a \`.env\`, migrate it" | \`keynv init\` (you're seeing this file because that already happened) |
+| "I have a \`.env\`, migrate it" | Run \`keynv\` and choose **Set up this project** |
 | "Run the app / dev server / tests" | \`keynv exec -- <their existing command>\` (auto-loads \`.keynv.env\`) |
 | "Show me the value of X" | \`keynv secret get @alias\` \u2014 but copy to clipboard, do NOT print the value into chat / terminal |
 | "Rotate this key" | \`keynv secret rotate @alias\` |
@@ -6021,7 +6028,7 @@ keynv whoami                # who am I logged in as
 keynv --help                # full command list
 \`\`\`
 
-If \`.keynv.env\` is missing or empty, the user probably hasn't run \`keynv init\` yet \u2014 suggest they do so before they paste a secret into a \`.env\`.`;
+If \`.keynv.env\` is missing or empty, the user probably hasn't run setup yet \u2014 suggest running \`keynv\` and choosing **Set up this project** before they paste a secret into a \`.env\`.`;
 }
 function renderKeynvBlock() {
   return `${KEYNV_BLOCK_START}
@@ -6060,7 +6067,7 @@ var AGENTS_FILE_BASENAME, KEYNV_BLOCK_START, KEYNV_BLOCK_END;
 var init_ai_context = __esm({
   "src/init/ai-context.ts"() {
     AGENTS_FILE_BASENAME = "AGENTS.md";
-    KEYNV_BLOCK_START = "<!-- keynv:start -- generated by `keynv init`; safe to leave intact, will be refreshed on re-run -->";
+    KEYNV_BLOCK_START = "<!-- keynv:start -- generated by keynv setup; safe to leave intact, will be refreshed on re-run -->";
     KEYNV_BLOCK_END = "<!-- keynv:end -->";
   }
 });
@@ -8605,11 +8612,11 @@ function toAliasKey(name) {
   return normalised.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64) || "key";
 }
 async function runInitFlow(client, opts) {
-  ge("keynv init");
+  ge("Set up this project");
   const root = findProjectRoot(opts.cwd);
   if (root === null) {
     me(
-      "Couldn't find a project root (no package.json, pyproject.toml, Cargo.toml, go.mod, or .git anywhere up the tree). Run `keynv init` inside a project directory."
+      'Couldn\'t find a project root (no package.json, pyproject.toml, Cargo.toml, go.mod, or .git anywhere up the tree). Run `keynv` inside a project directory and choose "Set up this project".'
     );
     return { exitCode: 1 };
   }
@@ -9063,7 +9070,7 @@ function composeKeynvEnv(opts) {
       lines.push(...trimmed.split("\n"));
       lines.push("");
     }
-    lines.push(`# >>> keynv init  ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)} >>>`);
+    lines.push(`# >>> keynv setup  ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)} >>>`);
   } else {
     lines.push("# .keynv.env \u2014 alias references to vault secrets.");
     lines.push("# Safe to commit: this file contains references, not values.");
@@ -9085,7 +9092,7 @@ function composeKeynvEnv(opts) {
     }
   }
   if (mergeWithExisting !== null) {
-    lines.push("# <<< keynv init <<<");
+    lines.push("# <<< keynv setup <<<");
   }
   return lines;
 }
@@ -9227,7 +9234,7 @@ async function runBrowserAuth(serverUrl) {
       access_expires_at: new Date(Date.now() + data.expires_in * 1e3).toISOString()
     };
   }
-  throw new BrowserAuthError("Browser auth timed out. Run `keynv login` to try again.");
+  throw new BrowserAuthError("Browser auth timed out. Run `keynv` to try again.");
 }
 var BrowserAuthError;
 var init_browser_auth = __esm({
@@ -43651,7 +43658,7 @@ var init_audit2 = __esm({
 async function runLoginFlow(client, options = {}) {
   const server = options.server ?? DEFAULT_SERVER_URL;
   const s = ft();
-  s.start("Waiting for authorization");
+  s.start(`Opening browser for ${server}`);
   let creds;
   try {
     creds = await runBrowserAuth(server);
@@ -43891,17 +43898,21 @@ async function runMenu() {
   await client.ensureHydrated();
   let didLogin = false;
   if (!client.isLoggedIn) {
-    R2.info("Not logged in.");
+    const server = await pickConnectionTarget();
+    if (server === null) {
+      ye("Bye.");
+      return 0;
+    }
     try {
-      const ok = await runLoginFlow(client);
+      const ok = await runLoginFlow(client, { server });
       if (!ok) {
-        ye("Login cancelled.");
+        ye("Connection cancelled.");
         return 1;
       }
       didLogin = true;
     } catch (err) {
       if (err instanceof UserCancelled) {
-        me("Login cancelled.");
+        me("Connection cancelled.");
         return 130;
       }
       throw err;
@@ -43938,7 +43949,7 @@ async function runMenu() {
       const value = await Ee({
         message: "What now?",
         options: [
-          { value: "init", label: "Initialize this project (migrate .env)", hint: "keynv init" },
+          { value: "init", label: "Set up this project", hint: "migrate .env into keynv" },
           { value: "projects", label: "Projects" },
           { value: "secrets", label: "Secrets" },
           { value: "members", label: "Members" },
@@ -43994,9 +44005,41 @@ async function runMenu() {
     }
   }
 }
+async function pickConnectionTarget() {
+  R2.info("Connect once, then manage projects and secrets from this menu.");
+  const target = await Ee({
+    message: "Connect to keynv",
+    options: [
+      { value: "cloud", label: "keynv.dev", hint: "recommended" },
+      { value: "self-hosted", label: "Self-hosted server", hint: "enter your API URL" },
+      { value: "exit", label: "Exit" }
+    ]
+  });
+  if (q(target) || target === "exit") return null;
+  if (target === "cloud") return DEFAULT_SERVER_URL;
+  const server = await Re({
+    message: "Server API URL",
+    placeholder: "https://api.keynv.example.com",
+    validate: (value) => {
+      if (!value) return "Enter a server URL.";
+      try {
+        const parsed = new URL(value);
+        if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+          return "Use an http:// or https:// URL.";
+        }
+        return void 0;
+      } catch {
+        return "Enter a valid URL.";
+      }
+    }
+  });
+  if (q(server)) return null;
+  return String(server);
+}
 var init_menu = __esm({
   "src/ui/menu.ts"() {
     init_dist5();
+    init_defaults();
     init_http();
     init_store();
     init_detect();
@@ -46364,7 +46407,7 @@ spelled \`--from\` to avoid the collision.)
     const client = new ApiClient();
     await client.ensureHydrated();
     if (!client.isLoggedIn) {
-      this.context.stderr.write("keynv: not logged in. Run `keynv login` first.\n");
+      this.context.stderr.write("keynv: not connected. Run `keynv` first.\n");
       return 1;
     }
     let envFileLoaded = null;
@@ -46393,7 +46436,7 @@ spelled \`--from\` to avoid the collision.)
     if (!envFileLoaded && !this.noEnvFile && !this.envFile && !process.env.KEYNV_ENV_FILE) {
       this.context.stderr.write(
         `keynv: no ${ENV_FILE_BASENAME} found in this directory or any parent.
-       Run \`keynv init\` in your project root to migrate secrets and create one.
+       Run \`keynv\` in your project root and choose "Set up this project" to create one.
 `
       );
     }
@@ -46682,6 +46725,28 @@ function toAliasKey2(name) {
   if (KEY_RE3.test(normalised)) return normalised;
   return normalised.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64) || "key";
 }
+function escapeRegExp2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function writeKeynvEnvMappings(path, projectName, envName, secrets) {
+  const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
+  const lines = [];
+  for (const s of secrets) {
+    const hasEntry = new RegExp(`^${escapeRegExp2(s.name)}=`, "m").test(existing);
+    if (!hasEntry) {
+      lines.push(`# ${s.name}`, `${s.name}=@${projectName}.${envName}.${s.aliasKey}`);
+    }
+  }
+  if (lines.length === 0) return 0;
+  const prefix = existing.trimEnd();
+  const block = `# Generated by keynv setup
+${lines.join("\n")}
+`;
+  writeFileSync(path, prefix ? `${prefix}
+
+${block}` : block);
+  return lines.length / 2;
+}
 var InitCommand = class extends Command {
   static paths = [["init"]];
   static usage = Command.Usage({
@@ -46737,7 +46802,7 @@ any prompts.
     const client = new ApiClient();
     await client.ensureHydrated();
     if (!client.isLoggedIn) {
-      this.context.stderr.write("keynv: not logged in. Run `keynv login` first.\n");
+      this.context.stderr.write("keynv: not connected. Run `keynv` first.\n");
       return 1;
     }
     const hasEnvFile = this.envFile != null;
@@ -46838,7 +46903,22 @@ any prompts.
       return 0;
     }
     const secretsWithKeys = secrets.map((s) => ({ ...s, aliasKey: toAliasKey2(s.name) }));
-    return this.uploadSecrets(client, projectId2, projectName, envName, secretsWithKeys);
+    const result = await this.uploadSecrets(
+      client,
+      projectId2,
+      projectName,
+      envName,
+      secretsWithKeys
+    );
+    if (result !== 0) return result;
+    const keynvEnvPath = join(process.cwd(), ".keynv.env");
+    const written = writeKeynvEnvMappings(keynvEnvPath, projectName, envName, secretsWithKeys);
+    this.context.stdout.write(
+      written > 0 ? `keynv: wrote ${keynvEnvPath}
+` : `keynv: ${keynvEnvPath} already up to date
+`
+    );
+    return 0;
   }
   /**
    * Auto-scan mode (--yes without explicit --env-file). Finds .env files
@@ -46912,14 +46992,13 @@ any prompts.
       secretsWithKeys
     );
     if (result !== 0) return result;
-    const aliasLines = secretsWithKeys.map((s) => `# ${s.name}
-${s.name}=@${projectName}.${envName}.${s.aliasKey}`).join("\n");
     const keynvEnvPath = join(root.path, ".keynv.env");
-    writeFileSync(keynvEnvPath, `# Auto-generated by keynv init --yes
-${aliasLines}
-`);
-    this.context.stdout.write(`keynv: wrote ${keynvEnvPath}
-`);
+    const written = writeKeynvEnvMappings(keynvEnvPath, projectName, envName, secretsWithKeys);
+    this.context.stdout.write(
+      written > 0 ? `keynv: wrote ${keynvEnvPath}
+` : `keynv: ${keynvEnvPath} already up to date
+`
+    );
     try {
       const outcome = writeAiContext(root.path);
       if (outcome === "created") this.context.stdout.write("keynv: wrote AGENTS.md\n");
@@ -47242,7 +47321,7 @@ var WhoamiCommand = class extends Command {
       const client = new ApiClient();
       await client.ensureHydrated();
       if (!client.isLoggedIn) {
-        this.context.stderr.write("keynv: not logged in. Run `keynv login`.\n");
+        this.context.stderr.write("keynv: not connected. Run `keynv`.\n");
         return 1;
       }
       const data = await client.request("/v1/whoami");
@@ -47819,11 +47898,11 @@ Non-interactive with --yes to skip prompts.
     this.context.stdout.write("       --owner-email alice@example.com \\\n");
     this.context.stdout.write('       --owner-password "<a long random password>" \\\n');
     this.context.stdout.write('       --org-name "Acme Inc"\n');
-    this.context.stdout.write("  3. Install the CLI and log in:\n");
+    this.context.stdout.write("  3. Install the CLI and connect from the TUI:\n");
     this.context.stdout.write("     npm install -g @keynv/cli\n");
-    this.context.stdout.write("     keynv login --server https://keynv.example.com\n");
-    this.context.stdout.write("  4. Onboard your first project:\n");
-    this.context.stdout.write("     cd your-project && keynv init\n");
+    this.context.stdout.write("     keynv\n");
+    this.context.stdout.write("  4. Onboard your first project from the same TUI:\n");
+    this.context.stdout.write("     cd your-project && keynv\n");
     if (this.compose) {
       const composeContent = `# keynv server + Litestream sidecar
 # Generated by \`keynv server init\`.
@@ -48409,7 +48488,7 @@ the error message.
     const client = new ApiClient();
     await client.ensureHydrated();
     if (!client.isLoggedIn) {
-      this.context.stderr.write("keynv: not logged in. Run `keynv login` first.\n");
+      this.context.stderr.write("keynv: not connected. Run `keynv` first.\n");
       return 1;
     }
     let value;
@@ -48501,28 +48580,27 @@ cli.register(RedactStreamCommand);
 cli.register(TestCommand);
 cli.register(ServerInitCommand);
 var argv = process.argv.slice(2);
-if (argv.length === 0) {
-  const { runMenu: runMenu2 } = await Promise.resolve().then(() => (init_menu(), menu_exports));
-  const { isInteractive: isInteractive2 } = await Promise.resolve().then(() => (init_tty(), tty_exports));
-  if (isInteractive2()) {
-    runMenu2().then((code) => process.exit(code)).catch((err) => {
-      process.stderr.write(`${fmtError(err)}
-`);
-      process.exit(1);
-    });
-  } else {
+async function main() {
+  if (argv.length === 0) {
+    const { runMenu: runMenu2 } = await Promise.resolve().then(() => (init_menu(), menu_exports));
+    const { isInteractive: isInteractive2 } = await Promise.resolve().then(() => (init_tty(), tty_exports));
+    if (isInteractive2()) {
+      return runMenu2();
+    }
     process.stdout.write(
       "keynv \u2014 AI-safe secrets management.\nRun `keynv --help` for the full command list, or run `keynv` in an interactive\nterminal to open the menu.\n"
     );
-    process.exit(0);
+    return 0;
   }
-} else {
-  cli.run(argv).then((code) => process.exit(code ?? 0)).catch((err) => {
-    process.stderr.write(`${fmtError(err)}
-`);
-    process.exit(1);
-  });
+  return cli.run(argv);
 }
+main().then((code) => {
+  process.exitCode = code ?? 0;
+}).catch((err) => {
+  process.stderr.write(`${fmtError(err)}
+`);
+  process.exitCode = 1;
+});
 /*! Bundled license information:
 
 long/umd/index.js: