@keynv/cli 0.1.0-rc.22 → 0.1.0-rc.24

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { createHash, randomBytes } from 'crypto';
+import * as nodePath from 'path';
+import { relative, join, isAbsolute, resolve, dirname, sep, basename } from 'path';
+import { createHash } from 'crypto';
 import { readFileSync, existsSync, writeFileSync, statSync, realpathSync, readdirSync, renameSync, mkdirSync, rmSync, constants as constants$1, lstatSync } from 'fs';
 import { homedir, hostname, platform } from 'os';
-import * as nodePath from 'path';
-import { relative, join, isAbsolute, resolve, sep, dirname, basename } from 'path';
 import { mkdir, writeFile, readFile, unlink, stat, rm, access, constants, appendFile, readdir, open, rename, copyFile } from 'fs/promises';
 import { createConnection, createServer } from 'net';
 import { styleText, stripVTControlCharacters } from 'util';
@@ -1070,16 +1070,17 @@ var require_lib = __commonJS({
 var VERSION, AGENT;
 var init_version = __esm({
   "src/version.ts"() {
-    VERSION = "0.1.0-rc.22" ;
+    VERSION = "0.1.0-rc.24" ;
     AGENT = `keynv-cli/${VERSION}`;
   }
 });
 
 // src/client/defaults.ts
-var DEFAULT_SERVER_URL;
+var DEFAULT_SERVER_URL, DEFAULT_WEB_URL;
 var init_defaults = __esm({
   "src/client/defaults.ts"() {
     DEFAULT_SERVER_URL = "https://api.keynv.dev";
+    DEFAULT_WEB_URL = "https://keynv.dev";
   }
 });
 
@@ -1155,7 +1156,7 @@ function findAliasesInArgv(argv2) {
   }
   return result;
 }
-function replaceAliases(text, resolve4, opts = {}) {
+function replaceAliases(text, resolve6, opts = {}) {
   if (typeof text !== "string" || text.length === 0)
     return text;
   const matches = findAliases(text, opts);
@@ -1166,7 +1167,7 @@ function replaceAliases(text, resolve4, opts = {}) {
     const m = matches[i];
     if (!m)
       continue;
-    const replacement = resolve4(m);
+    const replacement = resolve6(m);
     if (parseAlias(replacement) !== null) {
       throw new Error(`replaceAliases: resolved value for ${m.literal} is itself a valid alias (${replacement}). Circular or misconfigured resolution detected.`);
     }
@@ -1227,6 +1228,14 @@ var init_types2 = __esm({
     NONCE_BYTES = 24;
   }
 });
+function loadSodiumModule() {
+  try {
+    return moduleRequire("libsodium-wrappers");
+  } catch {
+    const runtimeRequire = createRequire(join(process.cwd(), "package.json"));
+    return runtimeRequire("libsodium-wrappers");
+  }
+}
 function loadSodium() {
   if (!readyPromise) {
     readyPromise = sodium.ready.then(() => sodium);
@@ -1240,11 +1249,11 @@ function zero(buf) {
   }
   buf.fill(0);
 }
-var require2, sodium, readyPromise;
+var moduleRequire, sodium, readyPromise;
 var init_sodium = __esm({
   "../../packages/core/dist/crypto/sodium.js"() {
-    require2 = createRequire(import.meta.url);
-    sodium = require2("libsodium-wrappers");
+    moduleRequire = createRequire(import.meta.url);
+    sodium = loadSodiumModule();
     readyPromise = null;
   }
 });
@@ -5609,8 +5618,8 @@ function legacyPath() {
 }
 function loadEntryCtor() {
   if (!EntryCtor) {
-    const require3 = createRequire(import.meta.url);
-    EntryCtor = require3("@napi-rs/keyring").Entry;
+    const require2 = createRequire(import.meta.url);
+    EntryCtor = require2("@napi-rs/keyring").Entry;
   }
   return EntryCtor;
 }
@@ -6214,12 +6223,12 @@ async function startRpcServer(registry) {
     socket.on("error", () => {
     });
   });
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     server.once("error", reject);
     server.listen(path, () => {
       void chmodIfExists(path, 384).catch(() => {
       });
-      resolve4({
+      resolve6({
         socketPath: path,
         close: () => new Promise((res) => {
           server.close(() => res());
@@ -6281,7 +6290,7 @@ function handleLine(line, socket, registry) {
 async function registerValueWithWatcher(value, timeoutMs = 200) {
   if (value.length === 0) return null;
   const path = socketPath();
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     const socket = createConnection(path);
     let buffer = "";
     let settled = false;
@@ -6289,7 +6298,7 @@ async function registerValueWithWatcher(value, timeoutMs = 200) {
       if (settled) return;
       settled = true;
       socket.destroy();
-      resolve4(result);
+      resolve6(result);
     };
     const timer = setTimeout(() => settle(null), timeoutMs);
     socket.once("error", () => {
@@ -6345,8 +6354,8 @@ When the user asks about secrets or env vars, follow this decision tree:
 |---|---|
 | "Add a new API key" / "set up a secret" | \`keynv secret create\` (interactive prompt picks project + env + key) |
 | "I have a \`.env\`, migrate it" | Run \`keynv\` and choose **Set up this project** |
-| "Run the app / dev server / tests" | \`keynv exec -- <their existing command>\` (auto-loads \`.keynv.env\`) |
-| "Show me the value of X" | \`keynv secret get @alias --copy\` \u2014 \`--copy\` puts the value on the clipboard and never prints it. Without \`--copy\` it prints to stdout, so in agent contexts always pass \`--copy\`. |
+| "Run the app / dev server / tests" | Run the project's script as usual (e.g. \`npm run dev\`) \u2014 setup already wrapped it with keynv. For a one-off command that isn't a package.json script, use \`keynv exec -- <cmd>\`. |
+| "Show me the value of X" | Don't reveal it. \`keynv secret get @alias --copy\` puts the value on the clipboard without printing it. Bare \`keynv secret get\` refuses to print in a non-interactive context; \`--reveal\` forces raw stdout \u2014 avoid it in agent contexts. |
 | "Rotate this key" | \`keynv secret rotate @alias\` |
 | "Add a new env var to the project" | Edit \`.keynv.env\` and add \`NAME=@project.env.key\` (after creating the secret with \`keynv secret create\`) |
 | "Who has access?" | \`keynv member list <project>\` |
@@ -6617,20 +6626,30 @@ var init_collision = __esm({
     KEY_RE3 = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
   }
 });
-function findProjectRoot(startDir) {
-  const result = walkUp(startDir, (dir) => {
-    for (const marker of PROJECT_MARKERS) {
-      if (existsSync(join(dir, marker))) {
-        return { dir, marker };
-      }
-    }
-    if (existsSync(join(dir, GIT_MARKER))) {
-      return { dir, marker: GIT_MARKER };
-    }
-    return null;
-  });
-  if (!result) return null;
-  return buildRoot(result.dir, result.marker);
+function findProjectRoot(startDir, boundaryDir = homedir()) {
+  const start = resolve(startDir);
+  const boundary = resolve(boundaryDir);
+  let dir = start;
+  for (let i = 0; i < 64; i++) {
+    if (dir === boundary || isAncestorOf(dir, boundary)) break;
+    const marker = markerAt(dir);
+    if (marker) return buildRoot(dir, marker);
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return buildRoot(start, "current directory");
+}
+function markerAt(dir) {
+  for (const marker of PROJECT_MARKERS) {
+    if (existsSync(join(dir, marker))) return marker;
+  }
+  if (existsSync(join(dir, GIT_MARKER))) return GIT_MARKER;
+  return null;
+}
+function isAncestorOf(ancestor, descendant) {
+  const rel = relative(resolve(ancestor), resolve(descendant));
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
 }
 function buildRoot(dir, marker) {
   let suggestedName = basename(dir);
@@ -6662,6 +6681,7 @@ function buildRoot(dir, marker) {
 function findEnvFilesRecursive(rootDir, opts = {}) {
   const maxDepth = Math.max(1, opts.maxDepth ?? DEFAULT_MAX_DEPTH);
   const ignore = opts.ignore ?? IGNORE_DIRS;
+  const limit = Math.max(1, opts.limit ?? DEFAULT_MAX_RESULTS);
   let rootReal;
   try {
     rootReal = realpathSync(rootDir);
@@ -6716,10 +6736,15 @@ function findEnvFilesRecursive(rootDir, opts = {}) {
           relativeDir,
           containingDir: dir
         });
+        if (hits.length >= limit) {
+          queue.length = 0;
+          break;
+        }
         continue;
       }
       if (isDir && depth + 1 < maxDepth) {
         if (ignore.has(entry2.name)) continue;
+        if (entry2.name.startsWith(".")) continue;
         let realDir;
         try {
           realDir = realpathSync(full);
@@ -6767,10 +6792,9 @@ function suggestedEnvForSuffix(suffix) {
 function hasExistingKeynvEnv(rootDir) {
   return existsSync(join(rootDir, KEYNV_ENV_BASENAME));
 }
-var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME, KEYNV_ENV_EXCLUDE, IGNORE_DIRS, DEFAULT_MAX_DEPTH;
+var PROJECT_MARKERS, GIT_MARKER, ENV_GLOB, ENV_EXAMPLE, KEYNV_ENV_BASENAME, KEYNV_ENV_EXCLUDE, IGNORE_DIRS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_RESULTS;
 var init_detect = __esm({
   "src/init/detect.ts"() {
-    init_fs();
     PROJECT_MARKERS = [
       "package.json",
       "pyproject.toml",
@@ -6853,6 +6877,7 @@ var init_detect = __esm({
       ".fleet"
     ]);
     DEFAULT_MAX_DEPTH = 5;
+    DEFAULT_MAX_RESULTS = 100;
   }
 });
 function shannonEntropyBits(s) {
@@ -9192,6 +9217,15 @@ var init_script_wrap = __esm({
       "forever",
       "nodemon",
       "concurrently",
+      // Monorepo / task runners — wrapping the orchestrator injects secrets into
+      // every child task it spawns, so `npm run dev` still needs no `keynv exec`.
+      "turbo",
+      "nx",
+      "lerna",
+      "make",
+      "npm-run-all",
+      "run-p",
+      "run-s",
       "pytest",
       "python",
       "python3",
@@ -9297,31 +9331,65 @@ async function runInitFlow(client, opts) {
   if (root.packageJsonInvalid) {
     R2.warn(`package.json at ${root.path} is not valid JSON \u2014 script wrapping will be skipped.`);
   }
-  const envFiles = findEnvFilesRecursive(root.path);
+  const atHome = resolve(root.path) === resolve(homedir());
+  if (atHome) {
+    R2.warn(
+      "Running in your home directory \u2014 scanning only this folder, not the whole tree. cd into a project directory for a focused setup."
+    );
+  }
+  const envFiles = findEnvFilesRecursive(root.path, atHome ? { maxDepth: 1 } : void 0);
   const intoExisting = hasExistingKeynvEnv(root.path);
   if (envFiles.length === 0 && !intoExisting) {
-    R2.info(
-      `No .env files found in ${root.path} (scanned root and subdirectories). There's nothing to migrate yet \u2014 create a .keynv.env by hand or run \`keynv exec\` once you have one.`
+    Se(
+      [
+        `No .env files found in ${root.path} (scanned root and subdirectories),`,
+        "so there is nothing to migrate yet. To start from scratch:",
+        "",
+        "  1. keynv secret create      \u2014 add your first secret to the vault",
+        "  2. add its alias to .keynv.env, e.g.  OPENAI_API_KEY=@myapp.dev.openai-key",
+        "  3. run your app normally \u2014 keynv injects the real value",
+        "",
+        'Or re-run `keynv` \u2192 "Set up this project" once you have a .env to import.'
+      ].join("\n"),
+      "Nothing to migrate yet"
     );
-    ye("Nothing to do.");
+    ye("Create your first secret with `keynv secret create`.");
     return { exitCode: 0 };
   }
+  if (envFiles.length >= DEFAULT_MAX_RESULTS) {
+    R2.warn(
+      `Found ${envFiles.length}+ env files \u2014 that usually means keynv is running too high up the tree. Consider cd-ing into a specific project.`
+    );
+  }
   Se(
     [
       `Project root: ${root.path}`,
       `Marker: ${root.marker}`,
-      envFiles.length > 0 ? `Found env files:
-${envFiles.map((f) => `  ${displayName(f)}`).join("\n")}` : "Found env files: (none)",
+      envFiles.length === 0 ? "Found env files: (none)" : envFiles.length === 1 ? `Found env file: ${displayName(envFiles[0])}` : `Found ${envFiles.length} env files`,
       intoExisting ? "Existing root .keynv.env detected \u2014 will merge new entries in." : ""
     ].filter(Boolean).join("\n"),
     "Detected"
   );
+  let selectedFiles = envFiles;
+  if (envFiles.length > 1) {
+    const initialValues = envFiles.filter((f) => f.relativeDir === "").map((f) => f.path);
+    const picked = unwrap(
+      await ve({
+        message: "Which env files do you want to import?",
+        options: envFiles.map((f) => ({ value: f.path, label: displayName(f) })),
+        initialValues,
+        required: true
+      })
+    );
+    const pickedSet = new Set(picked);
+    selectedFiles = envFiles.filter((f) => pickedSet.has(f.path));
+  }
   const projectChoice = await pickOrCreateProject(client, root.suggestedName);
   if (projectChoice === null) {
     me("No project selected.");
     return { exitCode: 130 };
   }
-  const fileMapping = await pickFileEnvMapping(envFiles, projectChoice);
+  const fileMapping = await pickFileEnvMapping(selectedFiles, projectChoice);
   if (fileMapping === null) {
     me("No env mapping selected.");
     return { exitCode: 130 };
@@ -9433,7 +9501,7 @@ ${detail}`
   for (const g of groups.values()) {
     const dirs = [...new Set(g.sources.map((s) => s.source.relativeDir || "<root>"))];
     if (dirs.length > 1) g.label = `${g.label}  (shared by ${dirs.join(", ")})`;
-    else if (envFiles.some((f) => f.relativeDir !== "")) {
+    else if (selectedFiles.some((f) => f.relativeDir !== "")) {
       const only = dirs[0];
       if (only && only !== "<root>") g.label = `${g.label}  [${only}]`;
     }
@@ -9442,7 +9510,7 @@ ${detail}`
   const initialSecretSelection = choices.filter((c2) => c2.verdict === "secret" && !c2.isAlias).map((c2) => c2.composite);
   const selectedComposites = unwrap(
     await ve({
-      message: "Mark which keys are secrets (vault-uploaded). Unchecked keys stay as literals.",
+      message: "Which keys are secrets? (pre-selected by keynv \u2014 press Enter to accept; unchecked stay as literals)",
       options: choices.map((c2) => ({
         value: c2.composite,
         label: c2.label,
@@ -9468,19 +9536,21 @@ ${detail}`
   const writeDirs = [...new Set(plan.resolved.map((r) => r.source.containingDir))];
   const writeDirsLines = writeDirs.map((d2) => `  ${relFromRoot(root.path, d2)}`).join("\n");
   const renameLine = plan.renamed.length > 0 ? `Renamed vault keys: ${plan.renamed.length} (to avoid cross-app collisions)` : "";
+  const scriptWrapLine = scriptWrapSelection.length > 0 ? `package.json:      wrap ${scriptWrapSelection.length} script(s) with \`keynv exec\` \u2014 ${scriptWrapSelection.join(", ")}` : "package.json:      not modified (no wrappable scripts)";
   const planSummary = [
     `Project:           ${projectChoice.name}${projectChoice.created ? " (will be created)" : ""}`,
     `Environments:      ${distinctEnvs.join(", ")}`,
     "Per-env breakdown:",
     perEnvCounts,
-    `Script wraps:      ${scriptWrapSelection.length}`,
-    ".keynv.env files:  will be written under",
+    ".keynv.env files:  written under (safe to commit \u2014 aliases, not values)",
     writeDirsLines,
-    "Original .env files: rename to .env.backup after upload",
+    scriptWrapLine,
+    "AGENTS.md:         write/update keynv guidance for AI agents at the project root",
+    ".env files:        renamed to .env.backup after their values are uploaded",
     renameLine,
     opts.dryRun ? "Dry-run: no changes will be made." : ""
   ].filter(Boolean).join("\n");
-  Se(planSummary, "About to apply");
+  Se(planSummary, "About to apply \u2014 one confirmation applies all of the below");
   const proceed = unwrap(await ue({ message: "Proceed?", initialValue: true }));
   if (!proceed) {
     me("Aborted.");
@@ -9608,7 +9678,7 @@ ${detail}`
       );
     }
   }
-  for (const f of envFiles) {
+  for (const f of selectedFiles) {
     const relSrc = relFromRoot(root.path, f.path);
     try {
       const { renamedTo } = backupEnvFile(f.path);
@@ -9634,9 +9704,15 @@ ${detail}`
     });
     Se(lines.join("\n"), "Secrets in other envs");
   }
-  ye(
-    failed.length > 0 ? `Done with ${failed.length} failure(s) \u2014 see warnings above.` : `Done. Try: ${scriptWrapSelection.includes("dev") ? "pnpm dev" : "keynv exec -- <your command>"}`
-  );
+  let doneMsg;
+  if (failed.length > 0) {
+    doneMsg = `Done with ${failed.length} failure(s) \u2014 see warnings above.`;
+  } else if (scriptWrapSelection.length > 0) {
+    doneMsg = "Done. Your scripts are wrapped \u2014 just run them as usual (e.g. `npm run dev`). Secrets are injected automatically; you never type `keynv exec`.";
+  } else {
+    doneMsg = "Done. Prefix commands with `keynv exec --` to inject secrets (e.g. `keynv exec -- npm run dev`).";
+  }
+  ye(doneMsg);
   return { exitCode: failed.length > 0 ? 1 : 0 };
 }
 async function pickOrCreateProject(client, suggestedName) {
@@ -9845,7 +9921,7 @@ var init_tty = __esm({
   }
 });
 function sleep(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 async function errorMessage(res, fallback) {
   const text = await res.text();
@@ -10109,16 +10185,16 @@ async function runSecretMenu(client, project, alias2) {
 async function copyToClipboard(value) {
   const platform4 = process.platform;
   const cmd = platform4 === "darwin" ? ["pbcopy", []] : platform4 === "win32" ? ["clip", []] : ["xclip", ["-selection", "clipboard"]];
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     try {
       const child = spawn(cmd[0], cmd[1], {
         stdio: ["pipe", "ignore", "ignore"]
       });
-      child.on("error", () => resolve4(false));
-      child.on("exit", (code) => resolve4(code === 0));
+      child.on("error", () => resolve6(false));
+      child.on("exit", (code) => resolve6(code === 0));
       child.stdin.end(value);
     } catch {
-      resolve4(false);
+      resolve6(false);
     }
   });
 }
@@ -26864,7 +26940,7 @@ var require_named_placeholders = __commonJS({
         }
         return s;
       }
-      function join17(tree) {
+      function join18(tree) {
         if (tree.length === 1) {
           return tree;
         }
@@ -26890,7 +26966,7 @@ var require_named_placeholders = __commonJS({
         if (cache2 && (tree = cache2.get(query))) {
           return toArrayParams(tree, paramsObj);
         }
-        tree = join17(parse(query));
+        tree = join18(parse(query));
         if (cache2) {
           cache2.set(query, tree);
         }
@@ -27046,11 +27122,11 @@ var require_connection = __commonJS({
             const config = this.config;
             tracePromise(
               connectChannel,
-              () => new Promise((resolve4, reject) => {
+              () => new Promise((resolve6, reject) => {
                 let onConnect, onError;
                 onConnect = (param) => {
                   this.removeListener("error", onError);
-                  resolve4(param);
+                  resolve6(param);
                 };
                 onError = (err) => {
                   this.removeListener("connect", onConnect);
@@ -27475,9 +27551,9 @@ var require_connection = __commonJS({
         } else if (shouldTrace(queryChannel)) {
           tracePromise(
             queryChannel,
-            () => new Promise((resolve4, reject) => {
+            () => new Promise((resolve6, reject) => {
               cmdQuery.once("error", reject);
-              cmdQuery.once("end", () => resolve4());
+              cmdQuery.once("end", () => resolve6());
               this.addCommand(cmdQuery);
             }),
             () => {
@@ -27624,12 +27700,12 @@ var require_connection = __commonJS({
         } else if (shouldTrace(executeChannel)) {
           tracePromise(
             executeChannel,
-            () => new Promise((resolve4, reject) => {
+            () => new Promise((resolve6, reject) => {
               prepareAndExecute((err) => {
                 executeCommand.emit("error", err);
               });
               executeCommand.once("error", reject);
-              executeCommand.once("end", () => resolve4());
+              executeCommand.once("end", () => resolve6());
             }),
             () => {
               const server = getServerContext(this.config);
@@ -27894,13 +27970,13 @@ var require_capture_local_err = __commonJS({
 var require_make_done_cb = __commonJS({
   "../../node_modules/.pnpm/mysql2@3.22.3_@types+node@24.12.3/node_modules/mysql2/lib/promise/make_done_cb.js"(exports, module) {
     var { applyCapturedStack } = require_capture_local_err();
-    function makeDoneCb(resolve4, reject, stackHolder) {
+    function makeDoneCb(resolve6, reject, stackHolder) {
       return function(err, rows, fields) {
         if (err) {
           applyCapturedStack(err, stackHolder);
           reject(err);
         } else {
-          resolve4([rows, fields]);
+          resolve6([rows, fields]);
         }
       };
     }
@@ -27923,8 +27999,8 @@ var require_prepared_statement_info = __commonJS({
         const stackHolder = captureStackHolder(
           _PromisePreparedStatementInfo.prototype.execute
         );
-        return new this.Promise((resolve4, reject) => {
-          const done = makeDoneCb(resolve4, reject, stackHolder);
+        return new this.Promise((resolve6, reject) => {
+          const done = makeDoneCb(resolve6, reject, stackHolder);
           if (parameters) {
             s.execute(parameters, done);
           } else {
@@ -27933,9 +28009,9 @@ var require_prepared_statement_info = __commonJS({
         });
       }
       close() {
-        return new this.Promise((resolve4) => {
+        return new this.Promise((resolve6) => {
           this.statement.close();
-          resolve4();
+          resolve6();
         });
       }
     };
@@ -28006,8 +28082,8 @@ var require_connection2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve4, reject) => {
-          const done = makeDoneCb(resolve4, reject, stackHolder);
+        return new this.Promise((resolve6, reject) => {
+          const done = makeDoneCb(resolve6, reject, stackHolder);
           if (params !== void 0) {
             c2.query(query, params, done);
           } else {
@@ -28023,8 +28099,8 @@ var require_connection2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve4, reject) => {
-          const done = makeDoneCb(resolve4, reject, stackHolder);
+        return new this.Promise((resolve6, reject) => {
+          const done = makeDoneCb(resolve6, reject, stackHolder);
           if (params !== void 0) {
             c2.execute(query, params, done);
           } else {
@@ -28033,8 +28109,8 @@ var require_connection2 = __commonJS({
         });
       }
       end() {
-        return new this.Promise((resolve4) => {
-          this.connection.end(resolve4);
+        return new this.Promise((resolve6) => {
+          this.connection.end(resolve6);
         });
       }
       async [Symbol.asyncDispose]() {
@@ -28047,16 +28123,16 @@ var require_connection2 = __commonJS({
         const stackHolder = captureStackHolder(
           _PromiseConnection.prototype.beginTransaction
         );
-        return new this.Promise((resolve4, reject) => {
-          const done = makeDoneCb(resolve4, reject, stackHolder);
+        return new this.Promise((resolve6, reject) => {
+          const done = makeDoneCb(resolve6, reject, stackHolder);
           c2.beginTransaction(done);
         });
       }
       commit() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.commit);
-        return new this.Promise((resolve4, reject) => {
-          const done = makeDoneCb(resolve4, reject, stackHolder);
+        return new this.Promise((resolve6, reject) => {
+          const done = makeDoneCb(resolve6, reject, stackHolder);
           c2.commit(done);
         });
       }
@@ -28065,21 +28141,21 @@ var require_connection2 = __commonJS({
         const stackHolder = captureStackHolder(
           _PromiseConnection.prototype.rollback
         );
-        return new this.Promise((resolve4, reject) => {
-          const done = makeDoneCb(resolve4, reject, stackHolder);
+        return new this.Promise((resolve6, reject) => {
+          const done = makeDoneCb(resolve6, reject, stackHolder);
           c2.rollback(done);
         });
       }
       ping() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.ping);
-        return new this.Promise((resolve4, reject) => {
+        return new this.Promise((resolve6, reject) => {
           c2.ping((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve4(true);
+              resolve6(true);
             }
           });
         });
@@ -28087,13 +28163,13 @@ var require_connection2 = __commonJS({
       reset() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.reset);
-        return new this.Promise((resolve4, reject) => {
+        return new this.Promise((resolve6, reject) => {
           c2.reset((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve4();
+              resolve6();
             }
           });
         });
@@ -28101,13 +28177,13 @@ var require_connection2 = __commonJS({
       connect() {
         const c2 = this.connection;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.connect);
-        return new this.Promise((resolve4, reject) => {
+        return new this.Promise((resolve6, reject) => {
           c2.connect((err, param) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve4(param);
+              resolve6(param);
             }
           });
         });
@@ -28116,7 +28192,7 @@ var require_connection2 = __commonJS({
         const c2 = this.connection;
         const promiseImpl = this.Promise;
         const stackHolder = captureStackHolder(_PromiseConnection.prototype.prepare);
-        return new this.Promise((resolve4, reject) => {
+        return new this.Promise((resolve6, reject) => {
           c2.prepare(options, (err, statement) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
@@ -28126,7 +28202,7 @@ var require_connection2 = __commonJS({
                 statement,
                 promiseImpl
               );
-              resolve4(wrappedStatement);
+              resolve6(wrappedStatement);
             }
           });
         });
@@ -28136,13 +28212,13 @@ var require_connection2 = __commonJS({
         const stackHolder = captureStackHolder(
           _PromiseConnection.prototype.changeUser
         );
-        return new this.Promise((resolve4, reject) => {
+        return new this.Promise((resolve6, reject) => {
           c2.changeUser(options, (err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve4();
+              resolve6();
             }
           });
         });
@@ -28604,12 +28680,12 @@ var require_pool2 = __commonJS({
       }
       getConnection() {
         const corePool = this.pool;
-        return new this.Promise((resolve4, reject) => {
+        return new this.Promise((resolve6, reject) => {
           corePool.getConnection((err, coreConnection) => {
             if (err) {
               reject(err);
             } else {
-              resolve4(new PromisePoolConnection(coreConnection, this.Promise));
+              resolve6(new PromisePoolConnection(coreConnection, this.Promise));
             }
           });
         });
@@ -28625,8 +28701,8 @@ var require_pool2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve4, reject) => {
-          const done = makeDoneCb(resolve4, reject, stackHolder);
+        return new this.Promise((resolve6, reject) => {
+          const done = makeDoneCb(resolve6, reject, stackHolder);
           if (args !== void 0) {
             corePool.query(sql, args, done);
           } else {
@@ -28642,8 +28718,8 @@ var require_pool2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve4, reject) => {
-          const done = makeDoneCb(resolve4, reject, stackHolder);
+        return new this.Promise((resolve6, reject) => {
+          const done = makeDoneCb(resolve6, reject, stackHolder);
           if (args) {
             corePool.execute(sql, args, done);
           } else {
@@ -28654,13 +28730,13 @@ var require_pool2 = __commonJS({
       end() {
         const corePool = this.pool;
         const stackHolder = captureStackHolder(_PromisePool.prototype.end);
-        return new this.Promise((resolve4, reject) => {
+        return new this.Promise((resolve6, reject) => {
           corePool.end((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve4();
+              resolve6();
             }
           });
         });
@@ -29085,12 +29161,12 @@ var require_pool_cluster2 = __commonJS({
       }
       getConnection() {
         const corePoolNamespace = this.poolNamespace;
-        return new this.Promise((resolve4, reject) => {
+        return new this.Promise((resolve6, reject) => {
           corePoolNamespace.getConnection((err, coreConnection) => {
             if (err) {
               reject(err);
             } else {
-              resolve4(new PromisePoolConnection(coreConnection, this.Promise));
+              resolve6(new PromisePoolConnection(coreConnection, this.Promise));
             }
           });
         });
@@ -29105,8 +29181,8 @@ var require_pool_cluster2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve4, reject) => {
-          const done = makeDoneCb(resolve4, reject, stackHolder);
+        return new this.Promise((resolve6, reject) => {
+          const done = makeDoneCb(resolve6, reject, stackHolder);
           corePoolNamespace.query(sql, values, done);
         });
       }
@@ -29120,8 +29196,8 @@ var require_pool_cluster2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve4, reject) => {
-          const done = makeDoneCb(resolve4, reject, stackHolder);
+        return new this.Promise((resolve6, reject) => {
+          const done = makeDoneCb(resolve6, reject, stackHolder);
           corePoolNamespace.execute(sql, values, done);
         });
       }
@@ -29159,9 +29235,9 @@ var require_promise = __commonJS({
           "no Promise implementation available.Use promise-enabled node version or pass userland Promise implementation as parameter, for example: { Promise: require('bluebird') }"
         );
       }
-      return new thePromise((resolve4, reject) => {
+      return new thePromise((resolve6, reject) => {
         coreConnection.once("connect", () => {
-          resolve4(new PromiseConnection(coreConnection, thePromise));
+          resolve6(new PromiseConnection(coreConnection, thePromise));
         });
         coreConnection.once("error", (err) => {
           applyCapturedStack(err, stackHolder);
@@ -29188,7 +29264,7 @@ var require_promise = __commonJS({
       }
       getConnection(pattern, selector) {
         const corePoolCluster = this.poolCluster;
-        return new this.Promise((resolve4, reject) => {
+        return new this.Promise((resolve6, reject) => {
           corePoolCluster.getConnection(
             pattern,
             selector,
@@ -29196,7 +29272,7 @@ var require_promise = __commonJS({
               if (err) {
                 reject(err);
               } else {
-                resolve4(new PromisePoolConnection(coreConnection, this.Promise));
+                resolve6(new PromisePoolConnection(coreConnection, this.Promise));
               }
             }
           );
@@ -29210,8 +29286,8 @@ var require_promise = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve4, reject) => {
-          const done = makeDoneCb(resolve4, reject, stackHolder);
+        return new this.Promise((resolve6, reject) => {
+          const done = makeDoneCb(resolve6, reject, stackHolder);
           corePoolCluster.query(sql, args, done);
         });
       }
@@ -29225,8 +29301,8 @@ var require_promise = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve4, reject) => {
-          const done = makeDoneCb(resolve4, reject, stackHolder);
+        return new this.Promise((resolve6, reject) => {
+          const done = makeDoneCb(resolve6, reject, stackHolder);
           corePoolCluster.execute(sql, args, done);
         });
       }
@@ -29239,13 +29315,13 @@ var require_promise = __commonJS({
       end() {
         const corePoolCluster = this.poolCluster;
         const stackHolder = captureStackHolder(_PromisePoolCluster.prototype.end);
-        return new this.Promise((resolve4, reject) => {
+        return new this.Promise((resolve6, reject) => {
           corePoolCluster.end((err) => {
             if (err) {
               applyCapturedStack(err, stackHolder);
               reject(err);
             } else {
-              resolve4();
+              resolve6();
             }
           });
         });
@@ -30503,7 +30579,7 @@ var require_utils_webcrypto = __commonJS({
     var nodeCrypto = __require("crypto");
     module.exports = {
       postgresMd5PasswordHash,
-      randomBytes: randomBytes2,
+      randomBytes,
       deriveKey,
       sha256,
       hashByName,
@@ -30513,7 +30589,7 @@ var require_utils_webcrypto = __commonJS({
     var webCrypto = nodeCrypto.webcrypto || globalThis.crypto;
     var subtleCrypto = webCrypto.subtle;
     var textEncoder = new TextEncoder();
-    function randomBytes2(length) {
+    function randomBytes(length) {
       return webCrypto.getRandomValues(Buffer.alloc(length));
     }
     async function md5(string) {
@@ -32320,7 +32396,7 @@ var require_dist = __commonJS({
     function parse(stream, callback) {
       const parser = new parser_1.Parser();
       stream.on("data", (buffer) => parser.parse(buffer, callback));
-      return new Promise((resolve4) => stream.on("end", () => resolve4()));
+      return new Promise((resolve6) => stream.on("end", () => resolve6()));
     }
     exports.parse = parse;
   }
@@ -33045,12 +33121,12 @@ var require_client2 = __commonJS({
           this._connect(callback);
           return;
         }
-        return new this._Promise((resolve4, reject) => {
+        return new this._Promise((resolve6, reject) => {
           this._connect((error) => {
             if (error) {
               reject(error);
             } else {
-              resolve4(this);
+              resolve6(this);
             }
           });
         });
@@ -33396,8 +33472,8 @@ var require_client2 = __commonJS({
           readTimeout = config.query_timeout || this.connectionParameters.query_timeout;
           query = new Query2(config, values, callback);
           if (!query.callback) {
-            result = new this._Promise((resolve4, reject) => {
-              query.callback = (err, res) => err ? reject(err) : resolve4(res);
+            result = new this._Promise((resolve6, reject) => {
+              query.callback = (err, res) => err ? reject(err) : resolve6(res);
             }).catch((err) => {
               Error.captureStackTrace(err);
               throw err;
@@ -33474,8 +33550,8 @@ var require_client2 = __commonJS({
         if (cb) {
           this.connection.once("end", cb);
         } else {
-          return new this._Promise((resolve4) => {
-            this.connection.once("end", resolve4);
+          return new this._Promise((resolve6) => {
+            this.connection.once("end", resolve6);
           });
         }
       }
@@ -33523,8 +33599,8 @@ var require_pg_pool = __commonJS({
       const cb = function(err, client) {
         err ? rej(err) : res(client);
       };
-      const result = new Promise2(function(resolve4, reject) {
-        res = resolve4;
+      const result = new Promise2(function(resolve6, reject) {
+        res = resolve6;
         rej = reject;
       }).catch((err) => {
         Error.captureStackTrace(err);
@@ -33585,7 +33661,7 @@ var require_pg_pool = __commonJS({
         if (typeof Promise2.try === "function") {
           return Promise2.try(f);
         }
-        return new Promise2((resolve4) => resolve4(f()));
+        return new Promise2((resolve6) => resolve6(f()));
       }
       _isFull() {
         return this._clients.length >= this.options.max;
@@ -33977,8 +34053,8 @@ var require_query4 = __commonJS({
     NativeQuery.prototype._getPromise = function() {
       if (this._promise) return this._promise;
       this._promise = new Promise(
-        function(resolve4, reject) {
-          this._once("end", resolve4);
+        function(resolve6, reject) {
+          this._once("end", resolve6);
           this._once("error", reject);
         }.bind(this)
       );
@@ -34155,12 +34231,12 @@ var require_client3 = __commonJS({
         this._connect(callback);
         return;
       }
-      return new this._Promise((resolve4, reject) => {
+      return new this._Promise((resolve6, reject) => {
         this._connect((error) => {
           if (error) {
             reject(error);
           } else {
-            resolve4(this);
+            resolve6(this);
           }
         });
       });
@@ -34184,8 +34260,8 @@ var require_client3 = __commonJS({
         query = new NativeQuery(config, values, callback);
         if (!query.callback) {
           let resolveOut, rejectOut;
-          result = new this._Promise((resolve4, reject) => {
-            resolveOut = resolve4;
+          result = new this._Promise((resolve6, reject) => {
+            resolveOut = resolve6;
             rejectOut = reject;
           }).catch((err) => {
             Error.captureStackTrace(err);
@@ -34245,8 +34321,8 @@ var require_client3 = __commonJS({
       }
       let result;
       if (!cb) {
-        result = new this._Promise(function(resolve4, reject) {
-          cb = (err) => err ? reject(err) : resolve4();
+        result = new this._Promise(function(resolve6, reject) {
+          cb = (err) => err ? reject(err) : resolve6();
         });
       }
       this.native.end(function() {
@@ -39353,7 +39429,7 @@ var require_Command = __commonJS({
         }
       }
       initPromise() {
-        const promise = new Promise((resolve4, reject) => {
+        const promise = new Promise((resolve6, reject) => {
           if (!this.transformed) {
             this.transformed = true;
             const transformer = _Command._transformer.argument[this.name];
@@ -39362,7 +39438,7 @@ var require_Command = __commonJS({
             }
             this.stringifyArguments();
           }
-          this.resolve = this._convertValue(resolve4);
+          this.resolve = this._convertValue(resolve6);
           this.reject = (err) => {
             this._clearTimers();
             if (this.errorStack) {
@@ -39395,11 +39471,11 @@ var require_Command = __commonJS({
       /**
        * Convert the value from buffer to the target encoding.
        */
-      _convertValue(resolve4) {
+      _convertValue(resolve6) {
         return (value) => {
           try {
             this._clearTimers();
-            resolve4(this.transformReply(value));
+            resolve6(this.transformReply(value));
             this.isResolved = true;
           } catch (err) {
             this.reject(err);
@@ -39677,13 +39753,13 @@ var require_autoPipelining = __commonJS({
       if (client.isCluster && !client.slots.length) {
         if (client.status === "wait")
           client.connect().catch(lodash_1.noop);
-        return (0, standard_as_callback_1.default)(new Promise(function(resolve4, reject) {
+        return (0, standard_as_callback_1.default)(new Promise(function(resolve6, reject) {
           client.delayUntilReady((err) => {
             if (err) {
               reject(err);
               return;
             }
-            executeWithAutoPipelining(client, functionName, commandName, args, null).then(resolve4, reject);
+            executeWithAutoPipelining(client, functionName, commandName, args, null).then(resolve6, reject);
           });
         }), callback);
       }
@@ -39704,13 +39780,13 @@ var require_autoPipelining = __commonJS({
         pipeline[exports.kExec] = true;
         setImmediate(executeAutoPipeline, client, slotKey);
       }
-      const autoPipelinePromise = new Promise(function(resolve4, reject) {
+      const autoPipelinePromise = new Promise(function(resolve6, reject) {
         pipeline[exports.kCallbacks].push(function(err, value) {
           if (err) {
             reject(err);
             return;
           }
-          resolve4(value);
+          resolve6(value);
         });
         if (functionName === "call") {
           args.unshift(commandName);
@@ -39945,8 +40021,8 @@ var require_Pipeline = __commonJS({
           this[name] = redis[name];
           this[name + "Buffer"] = redis[name + "Buffer"];
         });
-        this.promise = new Promise((resolve4, reject) => {
-          this.resolve = resolve4;
+        this.promise = new Promise((resolve6, reject) => {
+          this.resolve = resolve6;
           this.reject = reject;
         });
         const _this = this;
@@ -40246,13 +40322,13 @@ var require_transaction = __commonJS({
           if (this.isCluster && !this.redis.slots.length) {
             if (this.redis.status === "wait")
               this.redis.connect().catch(utils_1.noop);
-            return (0, standard_as_callback_1.default)(new Promise((resolve4, reject) => {
+            return (0, standard_as_callback_1.default)(new Promise((resolve6, reject) => {
               this.redis.delayUntilReady((err) => {
                 if (err) {
                   reject(err);
                   return;
                 }
-                this.exec(pipeline).then(resolve4, reject);
+                this.exec(pipeline).then(resolve6, reject);
               });
             }), callback);
           }
@@ -41381,7 +41457,7 @@ var require_cluster = __commonJS({
        * Connect to a cluster
        */
       connect() {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve6, reject) => {
           if (this.status === "connecting" || this.status === "connect" || this.status === "ready") {
             reject(new Error("Redis is already connecting/connected"));
             return;
@@ -41410,7 +41486,7 @@ var require_cluster = __commonJS({
               this.retryAttempts = 0;
               this.executeOfflineCommands();
               this.resetNodesRefreshInterval();
-              resolve4();
+              resolve6();
             };
             let closeListener = void 0;
             const refreshListener = () => {
@@ -42020,7 +42096,7 @@ var require_cluster = __commonJS({
         });
       }
       resolveSrv(hostname2) {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve6, reject) => {
           this.options.resolveSrv(hostname2, (err, records) => {
             if (err) {
               return reject(err);
@@ -42034,7 +42110,7 @@ var require_cluster = __commonJS({
               if (!group.records.length) {
                 sortedKeys.shift();
               }
-              self2.dnsLookup(record.name).then((host) => resolve4({
+              self2.dnsLookup(record.name).then((host) => resolve6({
                 host,
                 port: record.port
               }), tryFirstOne);
@@ -42044,14 +42120,14 @@ var require_cluster = __commonJS({
         });
       }
       dnsLookup(hostname2) {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve6, reject) => {
           this.options.dnsLookup(hostname2, (err, address) => {
             if (err) {
               debug2("failed to resolve hostname %s to IP: %s", hostname2, err.message);
               reject(err);
             } else {
               debug2("resolved hostname %s to IP %s", hostname2, address);
-              resolve4(address);
+              resolve6(address);
             }
           });
         });
@@ -42206,7 +42282,7 @@ var require_StandaloneConnector = __commonJS({
         if (options.tls) {
           Object.assign(connectionOptions, options.tls);
         }
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve6, reject) => {
           process.nextTick(() => {
             if (!this.connecting) {
               reject(new Error(utils_1.CONNECTION_CLOSED_ERROR_MSG));
@@ -42225,7 +42301,7 @@ var require_StandaloneConnector = __commonJS({
             this.stream.once("error", (err) => {
               this.firstError = err;
             });
-            resolve4(this.stream);
+            resolve6(this.stream);
           });
         });
       }
@@ -42381,7 +42457,7 @@ var require_SentinelConnector = __commonJS({
             const error = new Error(errorMsg);
             if (typeof retryDelay === "number") {
               eventEmitter("error", error);
-              await new Promise((resolve4) => setTimeout(resolve4, retryDelay));
+              await new Promise((resolve6) => setTimeout(resolve6, retryDelay));
               return connectToNext();
             } else {
               throw error;
@@ -43698,7 +43774,7 @@ var require_Redis = __commonJS({
        * if the connection fails, times out, or if Redis is already connecting/connected.
        */
       connect(callback) {
-        const promise = new Promise((resolve4, reject) => {
+        const promise = new Promise((resolve6, reject) => {
           if (this.status === "connecting" || this.status === "connect" || this.status === "ready") {
             reject(new Error("Redis is already connecting/connected"));
             return;
@@ -43777,7 +43853,7 @@ var require_Redis = __commonJS({
             }
             const connectionReadyHandler = function() {
               _this.removeListener("close", connectionCloseHandler);
-              resolve4();
+              resolve6();
             };
             var connectionCloseHandler = function() {
               _this.removeListener("ready", connectionReadyHandler);
@@ -43871,10 +43947,10 @@ var require_Redis = __commonJS({
           monitor: true,
           lazyConnect: false
         });
-        return (0, standard_as_callback_1.default)(new Promise(function(resolve4, reject) {
+        return (0, standard_as_callback_1.default)(new Promise(function(resolve6, reject) {
           monitorInstance.once("error", reject);
           monitorInstance.once("monitoring", function() {
-            resolve4(monitorInstance);
+            resolve6(monitorInstance);
           });
         }), callback);
       }
@@ -44730,17 +44806,20 @@ async function pickConnectionTarget() {
   const target = await Ee({
     message: "Connect to keynv",
     options: [
-      { value: "cloud", label: "keynv.dev", hint: "hosted (beta)" },
+      { value: "cloud", label: "keynv.dev", hint: "hosted \u2014 fastest way to start" },
       {
         value: "self-hosted",
         label: "Self-hosted server",
-        hint: "recommended \u2014 enter your API URL"
+        hint: "your own deployment \u2014 enter its API URL"
       },
       { value: "exit", label: "Exit" }
     ]
   });
   if (q(target) || target === "exit") return null;
-  if (target === "cloud") return DEFAULT_SERVER_URL;
+  if (target === "cloud") {
+    R2.info(`New to keynv? Create a free account first: ${DEFAULT_WEB_URL}/register`);
+    return DEFAULT_SERVER_URL;
+  }
   const server = await Re({
     message: "Server API URL",
     placeholder: "https://api.keynv.example.com",
@@ -47845,7 +47924,7 @@ function resolverSocketPath() {
 }
 function resolveReferenceToken(token, timeoutMs = 5e3) {
   const path = resolverSocketPath();
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     const socket = createConnection(path);
     let buffer = "";
     let settled = false;
@@ -47853,7 +47932,7 @@ function resolveReferenceToken(token, timeoutMs = 5e3) {
       if (settled) return;
       settled = true;
       socket.destroy();
-      resolve4(result);
+      resolve6(result);
     };
     const timer = setTimeout(
       () => settle({ ok: false, error: "timed out waiting for keynv-mcp resolver" }),
@@ -48056,7 +48135,7 @@ function spawnPrivileged(opts) {
     }, opts.timeoutS * 1e3);
     timer.unref();
   }
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     child.on("error", (err) => {
       if (timer) clearTimeout(timer);
       clearSensitiveReferences(env2, literals);
@@ -48065,7 +48144,7 @@ function spawnPrivileged(opts) {
     child.on("close", (code, signal) => {
       if (timer) clearTimeout(timer);
       clearSensitiveReferences(env2, literals);
-      resolve4({
+      resolve6({
         exitCode: code ?? 0,
         signal,
         durationMs: Date.now() - startedAt
@@ -49010,7 +49089,7 @@ async function promptHidden(prompt) {
   process.stdin.setRawMode(true);
   process.stdin.resume();
   process.stdin.setEncoding("utf8");
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     let buf = "";
     const onData = (chunk) => {
       for (const ch of chunk) {
@@ -49019,7 +49098,7 @@ async function promptHidden(prompt) {
           process.stdin.pause();
           process.stdin.removeListener("data", onData);
           process.stdout.write("\n");
-          resolve4(buf);
+          resolve6(buf);
           return;
         }
         if (ch === "") {
@@ -49037,10 +49116,10 @@ async function promptHidden(prompt) {
 }
 async function promptLine(prompt) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     rl.question(prompt, (answer) => {
       rl.close();
-      resolve4(answer.trim());
+      resolve6(answer.trim());
     });
   });
 }
@@ -49435,9 +49514,9 @@ here (see the streaming-mode limitation in the redactor package).
 `
   });
   async execute() {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve6, reject) => {
       const transform = createRedactStream();
-      this.context.stdin.pipe(transform).pipe(this.context.stdout).on("error", reject).on("finish", () => resolve4(0));
+      this.context.stdin.pipe(transform).pipe(this.context.stdout).on("error", reject).on("finish", () => resolve6(0));
       this.context.stdin.on("error", reject);
     });
   }
@@ -49699,11 +49778,11 @@ async function copyToClipboard2(value) {
   );
 }
 function pipeToCommand(cmd, args, input) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = spawn(cmd, args, { stdio: ["pipe", "ignore", "ignore"] });
     child.on("error", reject);
     child.on("close", (code) => {
-      if (code === 0) resolve4();
+      if (code === 0) resolve6();
       else reject(new Error(`${cmd} exited with code ${code}`));
     });
     child.stdin.on("error", reject);
@@ -49795,12 +49874,15 @@ var SecretCreateCommand = class extends Command {
 var SecretGetCommand = class extends Command {
   static paths = [["secret", "get"]];
   static usage = Command.Usage({
-    description: "Resolve a secret. Prints the value to stdout, or use --copy to put it on the clipboard without printing it."
+    description: "Resolve a secret. By default the value is copied to the OS clipboard (never printed). Use --reveal to print it to stdout, or --json for automation."
   });
   alias = options_exports.String({ required: false });
   json = options_exports.Boolean("--json", false);
   copy = options_exports.Boolean("--copy", false, {
-    description: "Copy the value to the OS clipboard instead of printing it (never shown in output)."
+    description: "Copy the value to the OS clipboard (the default in an interactive terminal)."
+  });
+  reveal = options_exports.Boolean("--reveal", false, {
+    description: "Print the raw value to stdout. Opt-in, because it can land in terminal scrollback or an AI transcript."
   });
   async execute() {
     try {
@@ -49828,35 +49910,41 @@ var SecretGetCommand = class extends Command {
       const data = await client.request(
         `/v1/projects/${projectId3}/secrets/${parsed.environment}/${parsed.key}`
       );
-      if (this.copy) {
-        try {
-          await copyToClipboard2(data.value);
-        } catch (err) {
-          if (err instanceof ClipboardUnavailableError) {
-            this.context.stderr.write(
-              `keynv: ${err.message}.
-       Install one (pbcopy/clip are built in; Linux: wl-clipboard or xclip), or omit --copy to print to stdout.
-`
-            );
-            return 1;
-          }
-          throw err;
-        } finally {
-          data.value = "";
-        }
-        this.context.stderr.write(`keynv: copied ${data.alias} (v${data.version}) to clipboard.
-`);
-        return 0;
-      }
       if (this.json) {
         this.context.stdout.write(
           `${JSON.stringify({ alias: data.alias, version: data.version, value: data.value })}
 `
         );
-      } else {
+        return 0;
+      }
+      if (this.reveal) {
         this.context.stdout.write(`${data.value}
 `);
+        return 0;
       }
+      if (!this.copy && !isInteractive()) {
+        this.context.stderr.write(
+          "keynv: refusing to print a secret to a non-interactive stdout.\n       Pass --reveal to print it, --copy to copy it, or --json for automation.\n"
+        );
+        return 1;
+      }
+      try {
+        await copyToClipboard2(data.value);
+      } catch (err) {
+        if (err instanceof ClipboardUnavailableError) {
+          this.context.stderr.write(
+            `keynv: ${err.message}.
+       Install one (pbcopy/clip are built in; Linux: wl-clipboard or xclip), or pass --reveal to print to stdout / --json for automation.
+`
+          );
+          return 1;
+        }
+        throw err;
+      } finally {
+        data.value = "";
+      }
+      this.context.stderr.write(`keynv: copied ${data.alias} (v${data.version}) to clipboard.
+`);
       return 0;
     } catch (err) {
       return handleExecError(this.context.stderr, err);
@@ -50126,140 +50214,6 @@ var SecretRotationsCommand = class extends Command {
     }
   }
 };
-function generateSecret(bytes = 32) {
-  return randomBytes(bytes).toString("base64");
-}
-var ServerInitCommand = class extends Command {
-  static paths = [["server", "init"]];
-  static usage = Command.Usage({
-    description: "Generate secrets and deployment files for a new keynv server.",
-    details: `
-Interactive onboarding wizard that generates the configuration
-a fresh keynv server needs: JWT signing secret, master encryption
-key, and deployment templates.
-
-Outputs:
-  \u2022 A .keynv-server.env file you feed into your deployment
-    (Docker Compose, Coolify, or bare-metal).
-  \u2022 Optionally a docker-compose.yml in the current directory.
-
-Non-interactive with --yes to skip prompts.
-`,
-    examples: [
-      ["Interactive wizard", "$0 server init"],
-      ["Non-interactive (CI/scripts)", "$0 server init --yes"],
-      ["Docker Compose output", "$0 server init --compose"],
-      ["Custom output path", "$0 server init --out ./config/env"]
-    ]
-  });
-  yes = options_exports.Boolean("--yes", false, {
-    description: "Skip all prompts (non-interactive)."
-  });
-  compose = options_exports.Boolean("--compose", false, {
-    description: "Also write a docker-compose.yml to the current directory."
-  });
-  out = options_exports.String("--out", {
-    description: "Write server env file to this path (default: .keynv-server.env)."
-  });
-  async execute() {
-    const jwtSecret = generateSecret(48);
-    const masterKey = generateSecret(32);
-    const webSessionSecret = generateSecret(48);
-    const outPath = this.out ?? ".keynv-server.env";
-    const contents = [
-      "# Generated by `keynv server init`.",
-      "# Keep this file secret \u2014 it contains cryptographic key material.",
-      `KEYNV_JWT_SECRET=${jwtSecret}`,
-      `KEYNV_MASTER_KEY=${masterKey}`,
-      "",
-      "# Web dashboard session secret (required for Next.js JWE session tokens).",
-      `KEYNV_WEB_SESSION_SECRET=${webSessionSecret}`,
-      "",
-      "# Server configuration (uncomment and adjust):",
-      "# KEYNV_PORT=8080",
-      "# KEYNV_WEB_URL=https://keynv.example.com",
-      "# KEYNV_PUBLIC_REGISTRATION=false",
-      "# KEYNV_DB_PATH=./keynv.db",
-      "# KEYNV_MASTER_KEY_FILE=./master.key",
-      "# KEYNV_RATE_LIMIT_PER_MINUTE=120",
-      "# KEYNV_ARGON2_MEMORY_KIB=46080",
-      "# KEYNV_ARGON2_TIME_COST=3"
-    ].join("\n");
-    const { writeFileSync: writeFileSync5 } = await import('fs');
-    writeFileSync5(outPath, `${contents}
-`, { mode: 384 });
-    this.context.stdout.write(`Wrote ${outPath}
-
-`);
-    this.context.stdout.write("Generated secrets:\n");
-    this.context.stdout.write(
-      `  KEYNV_JWT_SECRET         ${jwtSecret.slice(0, 8)}... (base64, 48 bytes)
-`
-    );
-    this.context.stdout.write(
-      `  KEYNV_MASTER_KEY         ${masterKey.slice(0, 8)}... (base64, 32 bytes)
-`
-    );
-    this.context.stdout.write(
-      `  KEYNV_WEB_SESSION_SECRET ${webSessionSecret.slice(0, 8)}... (base64, 48 bytes)
-`
-    );
-    this.context.stdout.write("\nNext steps:\n");
-    this.context.stdout.write(`  1. Feed ${outPath} into your deployment:
-`);
-    this.context.stdout.write("     docker compose --env-file .keynv-server.env up -d\n");
-    this.context.stdout.write("     or load it into Coolify as environment variables.\n");
-    this.context.stdout.write("  2. Bootstrap the first owner:\n");
-    this.context.stdout.write(
-      "     docker exec -it <server-container> node dist/bootstrap.js \\\n"
-    );
-    this.context.stdout.write("       --owner-email alice@example.com \\\n");
-    this.context.stdout.write('       --owner-password "<a long random password>" \\\n');
-    this.context.stdout.write('       --org-name "Acme Inc"\n');
-    this.context.stdout.write("  3. Install the CLI and connect from the TUI:\n");
-    this.context.stdout.write("     npm install -g @keynv/cli\n");
-    this.context.stdout.write("     keynv\n");
-    this.context.stdout.write("  4. Onboard your first project from the same TUI:\n");
-    this.context.stdout.write("     cd your-project && keynv\n");
-    if (this.compose) {
-      const composeContent = `# keynv server + Litestream sidecar
-# Generated by \`keynv server init\`.
-# Load with: docker compose --env-file .keynv-server.env up -d
-
-services:
-  server:
-    image: ghcr.io/keynv-labs/keynv-server:latest
-    restart: unless-stopped
-    ports:
-      - '8080:8080'
-    env_file:
-      - .keynv-server.env
-    volumes:
-      - keynv-data:/data
-
-  litestream:
-    image: litestream/litestream:latest
-    restart: unless-stopped
-    volumes:
-      - keynv-data:/data
-    command: replicate
-    environment:
-      LITESTREAM_DB_PATH: /data/keynv.db
-      LITESTREAM_REPLICA_URL: s3://your-bucket/keynv
-      AWS_ACCESS_KEY_ID: \${LITESTREAM_AWS_ACCESS_KEY_ID}
-      AWS_SECRET_ACCESS_KEY: \${LITESTREAM_AWS_SECRET_ACCESS_KEY}
-
-volumes:
-  keynv-data:
-`;
-      writeFileSync5("docker-compose.yml", composeContent, { mode: 384 });
-      this.context.stdout.write(
-        "\nWrote docker-compose.yml (update Litestream S3 config before deploying).\n"
-      );
-    }
-    return 0;
-  }
-};
 
 // src/shell/templates.ts
 var SHELL_SECRET_ERE = "(AKIA|ASIA)[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|gh[uops]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{40,}|xox[abp]-[A-Za-z0-9-]{24,}|(sk|rk)_(live|test)_[A-Za-z0-9]{24,}|sk-ant-(api03|admin01)-[A-Za-z0-9_-]{20,}|sk-(proj-)?[A-Za-z0-9_-]{20,}|eyJ[A-Za-z0-9_-]{10,}\\.eyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}|(postgresql|postgres|mysql|mongodb)(\\+srv)?://[^@ ]+@[^ ]+|rediss?://[^@ ]+@[^ ]+";
@@ -51052,7 +51006,7 @@ var sshTester = {
     }
     const start = Date.now();
     const { Client: Client2 } = await import('ssh2');
-    return new Promise((resolve4) => {
+    return new Promise((resolve6) => {
       const client = new Client2();
       let settled = false;
       const settle = (result) => {
@@ -51063,7 +51017,7 @@ var sshTester = {
           client.end();
         } catch {
         }
-        resolve4(result);
+        resolve6(result);
       };
       client.once("ready", () => {
         client.exec("true", (err, stream) => {
@@ -51148,12 +51102,12 @@ function sanitizeResult(result, secret) {
 
 // ../../packages/testers/dist/run.js
 function withTimeout(promise, ms) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const t = setTimeout(() => reject(new Error(`tester timed out after ${ms}ms`)), ms);
     t.unref();
     promise.then((v2) => {
       clearTimeout(t);
-      resolve4(v2);
+      resolve6(v2);
     }, (err) => {
       clearTimeout(t);
       reject(err);
@@ -51329,6 +51283,25 @@ the error message.
     return result.ok ? 0 : 1;
   }
 };
+
+// src/commands/ui.ts
+init_tty();
+init_menu();
+var UICommand = class extends Command {
+  static paths = [["ui"]];
+  static usage = Command.Usage({
+    description: "Open the interactive menu (also runs by default when no args are given)."
+  });
+  async execute() {
+    if (!isInteractive()) {
+      this.context.stdout.write(
+        "keynv \u2014 AI-safe secrets management.\nRun `keynv --help` for the full command list, or run `keynv` in an interactive\nterminal to open the menu.\n"
+      );
+      return 0;
+    }
+    return runMenu();
+  }
+};
 init_format();
 init_state();
 init_version();
@@ -51495,8 +51468,8 @@ async function runWatcher(options = {}) {
     awaitWriteFinish: false,
     ...options.usePolling ? { usePolling: true, interval: 500 } : {}
   });
-  const readyPromise2 = new Promise((resolve4) => {
-    watcher.once("ready", () => resolve4());
+  const readyPromise2 = new Promise((resolve6) => {
+    watcher.once("ready", () => resolve6());
   });
   watcher.on("add", (path) => {
     if (matchesExt(path)) filesWatched += 1;
@@ -51837,7 +51810,7 @@ cli.register(WatchStartCommand);
 cli.register(WatchStopCommand);
 cli.register(WatchStatusCommand);
 cli.register(TestCommand);
-cli.register(ServerInitCommand);
+cli.register(UICommand);
 var argv = process.argv.slice(2);
 async function main() {
   if (argv.length === 0) {